code wiki / (root) / nx_ml_dsa_65_wasm.nx

nx_ml_dsa_65_wasm.nx

buildroot/runtime/nx_ml_dsa_65_wasm.nx

103017 B2340 linesdepth 0pulls 0 transitivereach 0 importersview sourcekind orphan librarytopic ml
docsdependenciesstructsconstsfunctions

about

nx_ml_dsa_65_wasm.nx -- Sovereign single-WASM FIPS 204 ML-DSA-65 (foundation). L131 iteration 1: math foundation only. Ships: * Constants + i32 polynomial helpers (256 i32 LE = 1024 B per poly) * Keccak-f[1600] + SHA-3-256 + SHAKE256 sponges (inlined verbatim from L126) * Montgomery + Barrett reductions for Z_8380417 * Full ML-DSA NTT + INVNTT with 256-entry zeta table (Montgomery form, primitive 512th root zeta=1753 mod q, bit-reversed indexed) * Pointwise basemul + montgomery acc * KAT export: nx_mldsa_ntt_round_trip_test(poly_ptr) returns 0 if INVNTT(NTT(poly)) ≡ original (mod q, accounting for the Montgomery factor R=2^32 that invntt_tomont leaves behind) Next iterations layer on: L132: sampling (rej_uniform for matrix A, rej_eta for s1/s2, sample_in_ball) L133: power-of-2 decompose + make_hint / use_hint L134: keygen + tobytes/frombytes for pk/sk L135: sign with rejection loop L136: verify L137: end-to-end round-trip self-test Final public API (after L137): nx_mldsa_keygen(seed_32, scratch, pk_out, sk_out) nx_mldsa_sign(sk, msg, msg_len, scratch, sig_out, sig_len_out) nx_mldsa_verify(pk, msg, msg_len, sig, sig_len, scratch) -> i64 1/0 Pillar 4 alignment: uses the same scratch-layout annotation pattern as L126 (F-meta-8 grader-compatible). license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/nist/fips_204 lineage_id: nishi_ml_dsa_65_wasm_q1 safe_shift_audit: shared Keccak _rotl64 uses gold-standard mask

dependencies 0 imports · 0 importers

imports: none

imported by: nobody (leaf or entry point)

structs

none

consts

39const MLDSA_Q: i64 = 8380417
40const MLDSA_QINV: i64 = 58728449 // q^{-1} mod 2^32 (unsigned)
41const MLDSA_N: i64 = 256
42const MLDSA_K: i64 = 6 // matrix rows
43const MLDSA_L: i64 = 5 // matrix cols
44const MLDSA_ETA: i64 = 4
45const MLDSA_TAU: i64 = 49
46const MLDSA_BETA: i64 = 196 // tau * eta
47const MLDSA_GAMMA1: i64 = 524288 // 2^19
48const MLDSA_GAMMA2: i64 = 261888 // (q-1)/32
49const MLDSA_OMEGA: i64 = 55
50const MLDSA_D: i64 = 13
52const MLDSA_PK_BYTES: i64 = 1952
53const MLDSA_SK_BYTES: i64 = 4032
54const MLDSA_SIG_BYTES: i64 = 3309
57const POLY_BUF: i64 = 1024

functions

63func _i32_load_le(p: *u8, i: i64) -> i64
called by 24: nx_mldsa_nttnx_mldsa_invnttnx_mldsa_basemulnx_mldsa_sample_in_ballnx_mldsa_poly_power2roundnx_mldsa_poly_decompose+18
73func _i32_store_le(p: *u8, i: i64, v: i64) -> i64
called by 26: nx_mldsa_nttnx_mldsa_invnttnx_mldsa_basemulnx_mldsa_rej_uniformnx_mldsa_rej_eta4nx_mldsa_sample_in_ball+20
89func _mont_reduce(a: i64) -> i64
called by 1: _fqmul
96func _reduce32(a: i64) -> i64
called by 8: nx_mldsa_keygennx_mldsa_signnx_mldsa_verifynx_mldsa_acc_basemul_large_testnx_mldsa_acc_basemul_round_trip_testnx_mldsa_basemul_round_trip_test+2
102func _fqmul(a: i64, b: i64) -> i64 { return _mont_reduce(a * b) }
called by 8: nx_mldsa_nttnx_mldsa_invnttnx_mldsa_basemulnx_mldsa_keygennx_mldsa_signnx_mldsa_verify+2 calls 1: _mont_reduce
105func _rotl64(x: i64, n: i64) -> i64
called by 1: _keccak_f1600
117func _lane_load(p: *u8) -> i64
called by 1: _keccak_f1600
122func _lane_store(p: *u8, v: i64) -> i64
called by 1: _keccak_f1600
127func _keccak_rc(i: i64) -> i64
called by 1: _keccak_f1600
142func _rho_off(lane_idx: i64) -> i64
called by 1: _keccak_f1600
157func _keccak_f1600(state_ptr: *u8) -> i64
called by 1: _sponge_one_shot calls 5: _lane_load_lane_store_rotl64_rho_off_keccak_rc
226func _sponge_one_shot(msg: *u8, msg_len: i64, rate: i64, dom_byte: i64,
called by 3: _sha3_256_shake256_shake128 calls 1: _keccak_f1600
255func _sha3_256(msg: *u8, msg_len: i64, state: *u8, out: *u8) -> i64
calls 1: _sponge_one_shot
258func _shake256(msg: *u8, msg_len: i64, state: *u8, out: *u8, out_len: i64) -> i64
called by 6: nx_mldsa_sample_in_ball_expand_s_entrynx_mldsa_keygen_expand_mask_entrynx_mldsa_signnx_mldsa_verify calls 1: _sponge_one_shot
261func _shake128(msg: *u8, msg_len: i64, state: *u8, out: *u8, out_len: i64) -> i64
called by 1: _expand_a_entry calls 1: _sponge_one_shot
271func _zeta(i: i64) -> i64
called by 2: nx_mldsa_nttnx_mldsa_invntt
345func nx_mldsa_ntt(poly: *u8) -> i64
called by 8: nx_mldsa_keygennx_mldsa_signnx_mldsa_verifynx_mldsa_acc_basemul_large_testnx_mldsa_acc_basemul_round_trip_testnx_mldsa_basemul_round_trip_test+2 calls 4: _zeta_fqmul_i32_load_le_i32_store_le
371func nx_mldsa_invntt(poly: *u8) -> i64
called by 8: nx_mldsa_keygennx_mldsa_signnx_mldsa_verifynx_mldsa_acc_basemul_large_testnx_mldsa_acc_basemul_round_trip_testnx_mldsa_basemul_round_trip_test+2 calls 4: _zeta_i32_load_le_i32_store_le_fqmul
403func nx_mldsa_basemul(out: *u8, a: *u8, b: *u8) -> i64
called by 1: nx_mldsa_basemul_round_trip_test calls 3: _fqmul_i32_load_le_i32_store_le
423func nx_mldsa_rej_uniform(poly: *u8, buf: *u8, buf_len: i64) -> i64
called by 1: _expand_a_entry calls 1: _i32_store_le
445func nx_mldsa_rej_eta4(poly: *u8, buf: *u8, buf_len: i64) -> i64
called by 1: _expand_s_entry calls 1: _i32_store_le
482func nx_mldsa_sample_in_ball(poly: *u8, c_tilde_32: *u8, scratch: *u8) -> i64
called by 2: nx_mldsa_signnx_mldsa_verify calls 3: _i32_store_le_shake256_i32_load_le
536func _power2round_coef(a: i64, out_a1: *u8, out_a0: *u8) -> i64
calls 1: _i32_store_le
545func nx_mldsa_poly_power2round(a1_poly: *u8, a0_poly: *u8, in_poly: *u8) -> i64
called by 1: nx_mldsa_keygen calls 2: _i32_load_le_i32_store_le
568func _decompose_coef(a: i64, out_a0: *u8, off: i64) -> i64
called by 1: nx_mldsa_poly_decompose calls 1: _i32_store_le
584func nx_mldsa_poly_decompose(a1_poly: *u8, a0_poly: *u8, in_poly: *u8) -> i64
called by 1: nx_mldsa_sign calls 3: _i32_load_le_decompose_coef_i32_store_le
598func _make_hint_coef(a0: i64, a1: i64) -> i64
called by 1: nx_mldsa_poly_make_hint
610func nx_mldsa_poly_make_hint(hint_out: *u8, a0_poly: *u8, a1_poly: *u8) -> i64
called by 1: nx_mldsa_sign calls 3: _make_hint_coef_i32_load_le_i32_store_le
627func _use_hint_coef(a: i64, hint: i64) -> i64
called by 1: nx_mldsa_poly_use_hint
641func nx_mldsa_poly_use_hint(out_poly: *u8, in_poly: *u8, hint_poly: *u8) -> i64
called by 1: nx_mldsa_verify calls 3: _use_hint_coef_i32_load_le_i32_store_le
658func _pack_t1_poly(out: *u8, poly: *u8) -> i64
called by 2: nx_mldsa_keygennx_mldsa_pack_t1_debug calls 1: _i32_load_le
678func _pack_eta4_poly(out: *u8, poly: *u8) -> i64
called by 1: nx_mldsa_keygen calls 1: _i32_load_le
691func _pack_t0_poly(out: *u8, poly: *u8) -> i64
called by 1: nx_mldsa_keygen calls 1: _i32_load_le
728func _expand_a_entry(out_poly: *u8, rho: *u8, j: i64, i_row: i64,
called by 3: nx_mldsa_keygennx_mldsa_signnx_mldsa_verify calls 2: _shake128nx_mldsa_rej_uniform
748func _expand_s_entry(out_poly: *u8, rho_prime: *u8, nonce: i64,
called by 1: nx_mldsa_keygen calls 2: _shake256nx_mldsa_rej_eta4
774func nx_mldsa_keygen(seed_32: *u8, scratch: *u8, pk_out: *u8, sk_out: *u8) -> i64
called by 4: nx_mldsa_keygen_deterministic_testnx_mldsa_sign_testnx_mldsa_verify_testnx_mldsa_verify_debug_one calls 13: _shake256_expand_s_entrynx_mldsa_ntt_i32_store_le_expand_a_entry_fqmul+7
926func nx_mldsa_keygen_deterministic_test(seed_32: *u8, scratch: *u8) -> i64
calls 1: nx_mldsa_keygen
961func _unpack_z_chunk(out_poly: *u8, base_idx: i64, buf: *u8, buf_off: i64) -> i64
called by 1: _unpack_z_poly calls 1: _i32_store_le
986func _pack_z_poly(out: *u8, poly: *u8) -> i64
called by 2: nx_mldsa_l135_encoders_testnx_mldsa_sign calls 1: _i32_load_le
1009func _unpack_z_poly(poly: *u8, bytes_in: *u8) -> i64
called by 3: _expand_mask_entrynx_mldsa_l135_encoders_testnx_mldsa_verify calls 1: _unpack_z_chunk
1019func _pack_w1_poly(out: *u8, poly: *u8) -> i64
called by 3: nx_mldsa_l135_encoders_testnx_mldsa_signnx_mldsa_verify calls 1: _i32_load_le
1036func _pack_hint_vec(out: *u8, hint_polys: *u8) -> i64
called by 2: nx_mldsa_l135_encoders_testnx_mldsa_sign calls 1: _i32_load_le
1062func _unpack_hint_vec(hint_polys: *u8, bytes_in: *u8) -> i64
called by 2: nx_mldsa_l135_encoders_testnx_mldsa_verify calls 1: _i32_store_le
1098func _expand_mask_entry(out_poly: *u8, rho_prime: *u8, kappa_plus_i: i64,
called by 2: nx_mldsa_l135_encoders_testnx_mldsa_sign calls 2: _shake256_unpack_z_poly
1121func nx_mldsa_l135_encoders_test(scratch: *u8) -> i64
calls 8: _i32_store_le_pack_z_poly_unpack_z_poly_i32_load_le_pack_w1_poly_pack_hint_vec+2
1239func _unpack_eta4_poly(out: *u8, bytes_in: *u8) -> i64
called by 1: nx_mldsa_sign calls 1: _i32_store_le
1251func _unpack_t0_poly(out: *u8, bytes_in: *u8) -> i64
called by 1: nx_mldsa_sign calls 1: _i32_store_le
1287func _poly_inf_norm(poly: *u8) -> i64
called by 1: _vec_inf_norm calls 1: _i32_load_le
1300func _vec_inf_norm(vec: *u8, n_polys: i64) -> i64
called by 2: nx_mldsa_signnx_mldsa_verify calls 1: _poly_inf_norm
1318func nx_mldsa_sign(sk: *u8, msg: *u8, msg_len: i64,
called by 3: nx_mldsa_sign_testnx_mldsa_verify_testnx_mldsa_verify_debug_one calls 18: _unpack_eta4_polynx_mldsa_ntt_unpack_t0_poly_shake256_expand_mask_entry_i32_store_le+12
1634func nx_mldsa_sign_test(seed_32: *u8, msg_32: *u8, scratch: *u8) -> i64
calls 2: nx_mldsa_keygennx_mldsa_sign
1691func _unpack_t1_poly(out_poly: *u8, packed: *u8) -> i64
called by 2: nx_mldsa_verifynx_mldsa_unpack_t1_debug calls 1: _i32_store_le
1723func nx_mldsa_verify(pk: *u8, msg: *u8, msg_len: i64,
called by 2: nx_mldsa_verify_testnx_mldsa_verify_debug_one calls 15: _unpack_z_poly_vec_inf_norm_unpack_hint_vec_unpack_t1_poly_shake256nx_mldsa_sample_in_ball+9
1942func nx_mldsa_verify_test(seed_32: *u8, msg_32: *u8, scratch: *u8) -> i64
calls 3: nx_mldsa_keygennx_mldsa_signnx_mldsa_verify
1981func nx_mldsa_acc_basemul_large_test(scratch: *u8) -> i64
calls 6: _i32_store_lenx_mldsa_ntt_fqmul_i32_load_le_reduce32nx_mldsa_invntt
2076func nx_mldsa_acc_basemul_round_trip_test(scratch: *u8) -> i64
calls 6: _i32_store_lenx_mldsa_ntt_fqmul_i32_load_le_reduce32nx_mldsa_invntt
2176func nx_mldsa_basemul_round_trip_test(scratch: *u8) -> i64
calls 6: _i32_store_lenx_mldsa_nttnx_mldsa_basemulnx_mldsa_invntt_reduce32_i32_load_le
2251func nx_mldsa_ntt_signed_round_trip_test(scratch: *u8) -> i64
calls 5: _i32_store_lenx_mldsa_nttnx_mldsa_invntt_reduce32_i32_load_le
2285func nx_mldsa_unpack_t1_debug(pk: *u8, out_poly: *u8) -> i64
calls 1: _unpack_t1_poly
2294func nx_mldsa_pack_t1_debug(in_poly: *u8, out_packed: *u8) -> i64
calls 1: _pack_t1_poly
2302func nx_mldsa_verify_debug_one(seed_32: *u8, msg_32: *u8, scratch: *u8) -> i64
calls 3: nx_mldsa_keygennx_mldsa_signnx_mldsa_verify
2311func nx_mldsa_ntt_round_trip_test(scratch: *u8) -> i64
calls 5: _i32_store_lenx_mldsa_nttnx_mldsa_invntt_reduce32_i32_load_le