OASIS PKCS 11 TC

In the last few days, I have been contacted by 2 persons who had consulted PKCS#11 v3.2 working draft 08, to prepare for an implementation of ML-DSA in their applications. They had quite similar questions to make sure that their understanding of section 6.67 matches with ours. Triggered by that, I suggest to 

• replace all occurences of "Hash ML-DSA" (with space) by "HashML-DSA" (without space) to match the notation in FIPS 204
• reference the exact algorithms in FIPS 204 and add some words about the input data. See below a proposal for these extensions, marked as underlined text
• add hash functions SHA512_224 and SHA512_256 to table 284, as these hash functions are also used in ACVP test data

6.67 ML-DSA and HashML-DSA

ML-DSA and HashML-DSA are mechanisms for signatures and verification, following the digital signature algorithm defined in [FIPS 204].

…

6.67.5 ML-DSA

The ML-DSA signature mechanism, denoted CKM_ML_DSA, is a mechanism for generating and verifying ML-DSA signatures as defined in Algorithm 2 ML-DSA.Sign and Algorithm 3 ML-DSA.Verify in [FIPS 204], using SHAKE256 as hash function. The data passed in is the message M.

…

6.67.6 HashML-DSA Signature

The HashML-DSA signature mechanism, denoted CKM_HASH_ML_DSA is a single part mechanism for generating and verifying pre-hash ML-DSA signatures as defined in Algorithm 4 HashML-DSA.Sign and Algorithm 5 HashML-DSA.Verify in [FIPS 204]. The data passed in is an already hashed message PH_M.

…

6.67.7 HashML-DSA Signature with hashing

The HashML-DSA with hashing mechanism, denoted CKM_HASH_ML_DSA_<hash> where <hash> identifies a hash function as per Table 284, is a mechanism for single- and multiple-part signatures and verification for pre-hashed ML-DSA as defined in Algorithm 4 HashML-DSA.Sign and Algorithm 5 HashML-DSA.Verify in [FIPS 204]. The data passed in is the message M. This mechanism computes the entire HashML-DSA specification, including the hashing on token.

Any comments to these editorial changes?

P.S. Similar changes apply to section 6.69 SLH-DSA

In the last few days, I have been contacted by 2 persons who had consulted PKCS#11 v3.2 working draft 08, to prepare for an implementation of ML-DSA in their applications. They had quite similar questions to make sure that their understanding of section 6.67 matches with ours. Triggered by that, I suggest to 

• replace all occurences of "Hash ML-DSA" (with space) by "HashML-DSA" (without space) to match the notation in FIPS 204
• reference the exact algorithms in FIPS 204 and add some words about the input data. See below a proposal for these extensions, marked as underlined text
• add hash functions SHA512_224 and SHA512_256 to table 284, as these hash functions are also used in ACVP test data

6.67 ML-DSA and HashML-DSA

ML-DSA and HashML-DSA are mechanisms for signatures and verification, following the digital signature algorithm defined in [FIPS 204].

…

6.67.5 ML-DSA

The ML-DSA signature mechanism, denoted CKM_ML_DSA, is a mechanism for generating and verifying ML-DSA signatures as defined in Algorithm 2 ML-DSA.Sign and Algorithm 3 ML-DSA.Verify in [FIPS 204], using SHAKE256 as hash function. The data passed in is the message M.

…

6.67.6 HashML-DSA Signature

The HashML-DSA signature mechanism, denoted CKM_HASH_ML_DSA is a single part mechanism for generating and verifying pre-hash ML-DSA signatures as defined in Algorithm 4 HashML-DSA.Sign and Algorithm 5 HashML-DSA.Verify in [FIPS 204]. The data passed in is an already hashed message PH_M.

…

6.67.7 HashML-DSA Signature with hashing

The HashML-DSA with hashing mechanism, denoted CKM_HASH_ML_DSA_<hash> where <hash> identifies a hash function as per Table 284, is a mechanism for single- and multiple-part signatures and verification for pre-hashed ML-DSA as defined in Algorithm 4 HashML-DSA.Sign and Algorithm 5 HashML-DSA.Verify in [FIPS 204]. The data passed in is the message M. This mechanism computes the entire HashML-DSA specification, including the hashing on token.

Any comments to these editorial changes?

In the last few days, I have been contacted by 2 persons who had consulted PKCS#11 v3.2 working draft 08, to prepare for an implementation of ML-DSA in their applications. They had quite similar questions to make sure that their understanding of section 6.67 matches with ours. Triggered by that, I suggest to 

• replace all occurences of "Hash ML-DSA" (with space) by "HashML-DSA" (without space) to match the notation in FIPS 204
• reference the exact algorithms in FIPS 204 and add some words about the input data. See below a proposal for these extensions, marked as underlined text
• add hash functions SHA512_224 and SHA512_256 to table 284, as these hash functions are also used in ACVP test data

6.67 ML-DSA and HashML-DSA

ML-DSA and HashML-DSA are mechanisms for signatures and verification, following the digital signature algorithm defined in [FIPS 204].

…

6.67.5 ML-DSA

The ML-DSA signature mechanism, denoted CKM_ML_DSA, is a mechanism for generating and verifying ML-DSA signatures as defined in Algorithm 2 ML-DSA.Sign and Algorithm 3 ML-DSA.Verify in [FIPS 204], using SHAKE256 as hash function. The data passed in is the message M.

…

6.67.6 HashML-DSA Signature

The HashML-DSA signature mechanism, denoted CKM_HASH_ML_DSA is a single part mechanism for generating and verifying pre-hash ML-DSA signatures as defined in Algorithm 4 HashML-DSA.Sign and Algorithm 5 HashML-DSA.Verify in [FIPS 204]. The data passed in is an already hashed message PH_M.

…

6.67.7 HashML-DSA Signature with hashing

The HashML-DSA with hashing mechanism, denoted CKM_HASH_ML_DSA_<hash> where <hash> identifies a hash function as per Table 284, is a mechanism for single- and multiple-part signatures and verification for pre-hashed ML-DSA as defined in Algorithm 4 HashML-DSA.Sign and Algorithm 5 HashML-DSA.Verify in [FIPS 204]. The data passed in is the message M. This mechanism computes the entire HashML-DSA specification, including the hashing on token.

Any comments to these editorial changes?

In the last few days, I have been contacted by 2 persons who had consulted PKCS#11 v3.2 working draft 08, to prepare for an implementation of ML-DSA in their applications. They had quite similar questions to make sure that their understanding of section 6.67 matches with ours. Triggered by that, I suggest to 

• replace all occurences of "Hash ML-DSA" (with space) by "HashML-DSA" (without space) to match the notation in FIPS 204
• reference the exact algorithms in FIPS 204 and add some words about the input data. See below a proposal for these extensions, marked as underlined text
• add hash functions SHA512_224 and SHA512_256 to table 284, as these hash functions are also used in ACVP test data

6.67 ML-DSA and HashML-DSA

ML-DSA and HashML-DSA are mechanisms for signatures and verification, following the digital signature algorithm defined in [FIPS 204].

…

6.67.5 ML-DSA

The ML-DSA signature mechanism, denoted CKM_ML_DSA, is a mechanism for generating and verifying ML-DSA signatures as defined in Algorithm 2 ML-DSA.Sign and Algorithm 3 ML-DSA.Verify in [FIPS 204], using SHAKE256 as hash function. The data passed in is the message M.

…

6.67.6 HashML-DSA Signature

The HashML-DSA signature mechanism, denoted CKM_HASH_ML_DSA is a single part mechanism for generating and verifying pre-hash ML-DSA signatures as defined in Algorithm 4 HashML-DSA.Sign and Algorithm 5 HashML-DSA.Verify in [FIPS 204]. The data passed in is an already hashed message PH_M.

…

6.67.7 HashML-DSA Signature with hashing

The HashML-DSA with hashing mechanism, denoted CKM_HASH_ML_DSA_<hash> where <hash> identifies a hash function as per Table 284, is a mechanism for single- and multiple-part signatures and verification for pre-hashed ML-DSA as defined in Algorithm 4 HashML-DSA.Sign and Algorithm 5 HashML-DSA.Verify in [FIPS 204]. The data passed in is the message M. This mechanism computes the entire HashML-DSA specification, including the hashing on token.

Any comments to these editorial changes?

In the last few days, I have been contacted by 2 persons who had consulted PKCS#11 v3.2 working draft 08, to prepare for an implementation of ML-DSA in their applications. They had quite similar questions to make sure that their understanding of section 6.67 matches with ours. Triggered by that, I suggest to 

• replace all occurences of "Hash ML-DSA" (with space) by "HashML-DSA" (without space) to match the notation in FIPS 204
• reference the exact algorithms in FIPS 204 and add some words about the input data. See below a proposal for these extensions, marked as underlined text
• add hash functions SHA512_224 and SHA512_256 to table 284, as these hash functions are also used in ACVP test data

6.67 ML-DSA and HashML-DSA

ML-DSA and HashML-DSA are mechanisms for signatures and verification, following the digital signature algorithm defined in [FIPS 204].

…

6.67.5 ML-DSA

The ML-DSA signature mechanism, denoted CKM_ML_DSA, is a mechanism for generating and verifying ML-DSA signatures as defined in Algorithm 2 ML-DSA.Sign and Algorithm 3 ML-DSA.Verify in [FIPS 204], using SHAKE256 as hash function. The data passed in is the message M.

…

6.67.6 HashML-DSA Signature

The HashML-DSA signature mechanism, denoted CKM_HASH_ML_DSA is a single part mechanism for generating and verifying pre-hash ML-DSA signatures as defined in Algorithm 4 HashML-DSA.Sign and Algorithm 5 HashML-DSA.Verify in [FIPS 204]. The data passed in is an already hashed message PH_M.

…

6.67.7 HashML-DSA Signature with hashing

The HashML-DSA with hashing mechanism, denoted CKM_HASH_ML_DSA_<hash> where <hash> identifies a hash function as per Table 284, is a mechanism for single- and multiple-part signatures and verification for pre-hashed ML-DSA as defined in Algorithm 4 HashML-DSA.Sign and Algorithm 5 HashML-DSA.Verify in [FIPS 204]. The data passed in is the message M. This mechanism computes the entire HashML-DSA specification, including the hashing on token.

Any comments to these editorial changes?

In the last few days, I have been contacted by 2 persons who had consulted PKCS#11 v3.2 working draft 08, to prepare for an implementation of ML-DSA in their applications. They had quite similar questions to make sure that their understanding of section 6.67 matches with ours. Triggered by that, I suggest to 

• replace all occurences of "Hash ML-DSA" (with space) by "HashML-DSA" (without space) to match the notation in FIPS 204
• reference the exact algorithms in FIPS 204 and add some words about the input data. See below a proposal for these extensions, marked as underlined text
• add hash functions SHA512_224 and SHA512_256 to table 284, as these hash functions are also used in ACVP test data

6.67 ML-DSA and HashML-DSA

ML-DSA and HashML-DSA are mechanisms for signatures and verification, following the digital signature algorithm defined in [FIPS 204].

…

6.67.5 ML-DSA

The ML-DSA signature mechanism, denoted CKM_ML_DSA, is a mechanism for generating and verifying ML-DSA signatures as defined in Algorithm 2 ML-DSA.Sign and Algorithm 3 ML-DSA.Verify in [FIPS 204], using SHAKE256 as hash function. The data passed in is the message M.

…

6.67.6 HashML-DSA Signature

The HashML-DSA signature mechanism, denoted CKM_HASH_ML_DSA is a single part mechanism for generating and verifying pre-hash ML-DSA signatures as defined in Algorithm 4 HashML-DSA.Sign and Algorithm 5 HashML-DSA.Verify in [FIPS 204]. The data passed in is an already hashed message PH_M.

…

6.67.7 HashML-DSA Signature with hashing

The HashML-DSA with hashing mechanism, denoted CKM_HASH_ML_DSA_<hash> where <hash> identifies a hash function as per Table 284, is a mechanism for single- and multiple-part signatures and verification for pre-hashed ML-DSA as defined in Algorithm 4 HashML-DSA.Sign and Algorithm 5 HashML-DSA.Verify in [FIPS 204]. The data passed in is the message M. This mechanism computes the entire HashML-DSA specification, including the hashing on token.

Any comments to these editorial changes?