docs: correct ML-DSA-65 signing-mode description across spec, SDK, and demos - #57
Merged
Conversation
…d demos Only the Go reference fixture generator signs ML-DSA-65 deterministically; the TypeScript, Python, Rust, and C SDKs sign with hedged randomization by default. Both produce valid signatures accepted interchangeably by conforming verifiers, so this corrects the documentation, not any behavior. - SPEC 8.3: signing MAY be deterministic or hedged; canonical signable bytes and verification outcomes MUST match; the reference generator is deterministic only to make fixtures reproducible. - SPEC T10 threat model and the witness-fixture note: reconcile the wording with actual signer behavior. - crypto.go, TypeScript crypto.ts, TypeScript README, demos README: describe the actual signing mode, and note hedged signing as side-channel hardening that depends on trustworthy host entropy. No signer code changes. Signed-off-by: chuks <891251+chuks@users.noreply.github.com>
chuks
force-pushed
the
docs/signing-mode-accuracy
branch
from
August 4, 2026 03:07
53cd8bc to
f90f4ad
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Accuracy pass reconciling the ML-DSA-65 signing-mode description with actual
signer behavior across the SDKs.
Why
The spec (8.3, T10, the witness-fixture note) and several code comments stated
that v1 uses deterministic ML-DSA-65 signing. In practice only the Go reference
fixture generator is deterministic; the TypeScript, Python, Rust, and C SDKs sign
with hedged randomization, the default of their ML-DSA-65 libraries. Deterministic
and hedged signatures over identical canonical bytes are accepted interchangeably
by conforming verifiers, so interop and conformance are unaffected. This is a
documentation fix.
Scope
No signer code changes and no extraEntropy flag added. Gates pass: readme-sync,
release-sync, Go build, TypeScript build.