1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
//! # falcon — FN-DSA (FIPS 206) Post-Quantum Digital Signatures
//!
//! Native Rust implementation of **FN-DSA** (FFT over NTRU-Lattice-Based
//! Digital Signature Algorithm), the NIST FIPS 206 standard formerly known
//! as Falcon. Ported from the [C reference](https://falcon-sign.info/) by
//! Thomas Pornin.
//!
//! ## Quick start — Pure FN-DSA
//!
//! ```rust
//! use falcon::prelude::*;
//!
//! // Generate an FN-DSA-512 key pair
//! let kp = FnDsaKeyPair::generate(9).unwrap();
//!
//! // Sign with no context (ph_flag = 0x00)
//! let sig = kp.sign(b"Hello, post-quantum world!", &DomainSeparation::None).unwrap();
//!
//! // Verify
//! FnDsaSignature::verify(sig.to_bytes(), kp.public_key(),
//! b"Hello, post-quantum world!", &DomainSeparation::None).unwrap();
//! ```
//!
//! ## HashFN-DSA — pre-hash large messages
//!
//! ```rust
//! use falcon::prelude::*;
//!
//! let kp = FnDsaKeyPair::generate(9).unwrap();
//!
//! // ph_flag = 0x01: message is SHA-256 hashed before signing
//! let domain = DomainSeparation::Prehashed {
//! alg: PreHashAlgorithm::Sha256,
//! context: b"my-protocol-v1", // optional, max 255 bytes
//! };
//! let sig = kp.sign(b"large document ...", &domain).unwrap();
//! FnDsaSignature::verify(sig.to_bytes(), kp.public_key(),
//! b"large document ...", &domain).unwrap();
//! ```
//!
//! ## Key serialization
//!
//! ```rust
//! # use falcon::prelude::*;
//! let kp = FnDsaKeyPair::generate(9).unwrap();
//!
//! let private_key = kp.private_key().to_vec(); // 1281 bytes (FN-DSA-512)
//! let public_key = kp.public_key().to_vec(); // 897 bytes
//!
//! // Import from both keys or from private key only
//! let restored = FnDsaKeyPair::from_keys(&private_key, &public_key).unwrap();
//! let restored2 = FnDsaKeyPair::from_private_key(&private_key).unwrap();
//! assert_eq!(public_key, restored2.public_key());
//! ```
//!
//! ## Security levels
//!
//! | `logn` | Variant | NIST Level | Private Key | Public Key | Signature |
//! |--------|---------|------------|-------------|------------|-----------|
//! | 9 | FN-DSA-512 | I | 1281 B | 897 B | 666 B |
//! | 10 | FN-DSA-1024 | V | 2305 B | 1793 B | 1280 B |
//!
//! ## Modules
//!
//! | Module | Description |
//! |--------|-------------|
//! | [`prelude`] | Re-exports all core public types — `use falcon::prelude::*` |
//! | [`safe_api`] | High-level SDK: keygen, sign, verify, serialization |
//! | [`falcon`] | Low-level C-equivalent API (streamed signing, expanded keys) |
//! | `codec`, `shake`, `rng`, … | Internal ports of the C reference |
//!
//! ## Features
//!
//! | Feature | Default | Description |
//! |---------|---------|-------------|
//! | `std` | ✅ | Cross-platform OS entropy via `getrandom` crate |
//! | *(no std)* | — | `no_std` / WASM — use `generate_deterministic` |
//! | `serde` | — | `Serialize`/`Deserialize` for all public types |
extern crate std;
extern crate alloc;
/// Prelude — import the entire public API with `use falcon::prelude::*`.
///
/// ```rust
/// use falcon::prelude::*;
///
/// let kp = FnDsaKeyPair::generate(9).unwrap();
/// let sig = kp.sign(b"msg", &DomainSeparation::None).unwrap();
/// FnDsaSignature::verify(sig.to_bytes(), kp.public_key(), b"msg",
/// &DomainSeparation::None).unwrap();
///
/// // Expanded-key fast repeated signing
/// let ek = kp.expand().unwrap();
/// let sig2 = ek.sign(b"msg", &DomainSeparation::None).unwrap();
/// FnDsaSignature::verify(sig2.to_bytes(), ek.public_key(), b"msg",
/// &DomainSeparation::None).unwrap();
/// ```
// Root-level convenience re-exports so `falcon::FnDsaKeyPair` works directly.
pub use ;