Function test_mldsa_external_mu

tests/wycheproof/test_mldsa.py:193–223

(backend, wycheproof)

    "mldsa_87_sign_seed_test.json",
)
def test_mldsa_external_mu(backend, wycheproof):
    # Only some sign vectors carry a precomputed mu ("External Mu"), so we
    # filter out the ones that don't. The ones that do include the "Internal"
    # cases that NIST provides as bare mu values with no message or context;
    # those are skipped by the signing tests above (we don't expose
    # Sign_internal) but exercise the precomputed-mu verification interface
    # here. We only test cases with a valid signature -- rejection of bad
    # signatures is covered by the verify tests.
    if "mu" not in wycheproof.testcase or not wycheproof.valid:
        return

    public_key_class = _MLDSA_PUBLIC_KEYS[wycheproof.testfiledata["algorithm"]]
    pub_raw = binascii.unhexlify(wycheproof.testgroup["publicKey"])
    pub = public_key_class.from_public_bytes(pub_raw)
    mu = binascii.unhexlify(wycheproof.testcase["mu"])
    sig = binascii.unhexlify(wycheproof.testcase["sig"])

    # The signature verifies through the precomputed-mu interface.
    pub.verify_mu(sig, mu)
    # And must not verify against a different mu.
    with pytest.raises(InvalidSignature):
        pub.verify_mu(bytes(sig), bytes([mu[0] ^ 0x01]) + mu[1:])

    # When the message (and optional context) are also provided, the mu we
    # derive must match the one in the vector, and the signature is an
    # ordinary ML-DSA signature over that message.
    if "msg" in wycheproof.testcase:
        msg = binascii.unhexlify(wycheproof.testcase["msg"])
        ctx = binascii.unhexlify(wycheproof.testcase.get("ctx", ""))
        assert _compute_mu(pub_raw, msg, ctx) == mu
        pub.verify(sig, msg, ctx)


@pytest.mark.supported(