ml_dsa_sign_verify/

ml_dsa_sign_verify.rs

// SPDX-License-Identifier: Apache-2.0
// Copyright 2026 Cédric Mesnil <cslashm@pm.me>

// ML-DSA Sign / Verify Example
//
// Demonstrates the ML-DSA digital signature scheme (FIPS 204) using the
// ML-DSA-65 parameter set (NIST Security Category 3, ~192-bit classical).
//
// ML-DSA is a lattice-based signature scheme (formerly CRYSTALS-Dilithium).
// It uses hedged signing: each signature mixes in fresh randomness, so signing
// the same message twice yields different (but equally valid) signatures.
//
// The flow is:
//   1. Key generation  -- produces a public key (pk) and a secret key (sk).
//   2. Signing         -- produces a signature over a message, with an
//                         optional context string for domain separation.
//   3. Verification    -- checks the signature against the public key.
//   4. Tamper test     -- flips a bit in the signature and confirms that
//                         verification correctly rejects it.
//
// Run:
//   cargo run --example sign_verify -p ml_dsa

use quantica::ml_dsa::*;
use std::time::Instant;

/// Pretty-print a byte slice as a hex string.
fn hex(bytes: &[u8]) -> String {
    bytes.iter().map(|b| format!("{:02x}", b)).collect()
}

fn main() {
    println!("=== ML-DSA (FIPS 204) Sign / Verify Example ===\n");

    let mut rng = OsRng;

    // ---------------------------------------------------------------
    // Step 1: Key generation (ML-DSA-65)
    // ---------------------------------------------------------------
    // ML-DSA-65 targets NIST Security Category 3, suitable for most
    // applications requiring post-quantum signature security.
    let t0 = Instant::now();
    let (pk, sk) = MlDsa65Scheme::keygen(&mut rng).expect("keygen failed");
    let keygen_us = t0.elapsed().as_micros();

    println!("--- Key Generation (ML-DSA-65) ---");
    println!("  public key:  {} bytes", pk.len());
    println!("  secret key:  {} bytes", sk.len());
    println!("  time:        {} us", keygen_us);
    println!();

    // ---------------------------------------------------------------
    // Step 2: Sign a message with a context string
    // ---------------------------------------------------------------
    // The context string provides domain separation. Different contexts
    // produce different signatures even for the same message and key.
    // It must be at most 255 bytes. An empty context (b"") is valid.
    let message = b"Post-quantum cryptography is here.";
    let context = b"example-context-v1";

    let t0 = Instant::now();
    let sig = MlDsa65Scheme::sign(&sk, message, context, &mut rng).expect("sign failed");
    let sign_us = t0.elapsed().as_micros();

    println!("--- Signing ---");
    println!("  message:     {:?}", std::str::from_utf8(message).unwrap());
    println!("  context:     {:?}", std::str::from_utf8(context).unwrap());
    println!("  signature:   {} bytes", sig.len());
    println!("  sig[0..32]:  {}", hex(&sig[..32]));
    println!("  time:        {} us", sign_us);
    println!();

    // ---------------------------------------------------------------
    // Step 3: Verify the signature
    // ---------------------------------------------------------------
    // The verifier needs the public key, the original message, the same
    // context string, and the signature.
    let t0 = Instant::now();
    let valid = MlDsa65Scheme::verify(&pk, message, context, &sig).expect("verify call failed");
    let verify_us = t0.elapsed().as_micros();

    println!("--- Verification ---");
    println!("  valid:       {}", valid);
    println!("  time:        {} us", verify_us);
    assert!(valid, "Signature should be valid!");
    println!();

    // ---------------------------------------------------------------
    // Step 4: Tamper with the signature and verify it is rejected
    // ---------------------------------------------------------------
    // Flipping a single bit in the signature must cause verification to fail.
    let mut tampered_bytes = sig.as_bytes().to_vec();
    tampered_bytes[0] ^= 0x01;
    let tampered_sig = quantica::ml_dsa::Signature::<MlDsa65>::from_bytes(&tampered_bytes).expect("from_bytes");

    let tampered_valid = MlDsa65Scheme::verify(&pk, message, context, &tampered_sig).expect("verify call failed");

    println!("--- Tamper Test ---");
    println!("  flipped bit in sig[0]");
    println!("  valid:       {} (expected: false)", tampered_valid);
    assert!(!tampered_valid, "Tampered signature should be rejected!");
    println!();

    // ---------------------------------------------------------------
    // Summary of sizes across all parameter sets
    // ---------------------------------------------------------------
    println!("--- ML-DSA Parameter Set Sizes ---");
    println!(
        "  ML-DSA-44: pk={:>4}  sk={:>4}  sig={:>4}",
        MlDsa44Scheme::PK_LEN,
        MlDsa44Scheme::SK_LEN,
        MlDsa44Scheme::SIG_LEN,
    );
    println!(
        "  ML-DSA-65: pk={:>4}  sk={:>4}  sig={:>4}",
        MlDsa65Scheme::PK_LEN,
        MlDsa65Scheme::SK_LEN,
        MlDsa65Scheme::SIG_LEN,
    );
    println!(
        "  ML-DSA-87: pk={:>4}  sk={:>4}  sig={:>4}",
        MlDsa87Scheme::PK_LEN,
        MlDsa87Scheme::SK_LEN,
        MlDsa87Scheme::SIG_LEN,
    );
    println!();

    println!("All checks passed.");
}