Re: Adding SHAKE hash algorithms to SHA-3

["Stephan Müller" <smueller@chronox.de>]

Am Freitag, 19. September 2025, 15:57:05 Mitteleuropäische Sommerzeit schrieb 
Simo Sorce:

Hi Simo,

> We are probably not interested in the HashML-DSA variant, so you should
> probably ignore that part of the specification for now.
> It is easy to implement on top of Pure ML-DSA if you allow the caller
> to specify and externally composed mu.

The key is to have a dedicated function for the Verify.Internal function which 
is wrapped by the pure/prehash API, for example as done in [1]. This way you 
can first have a pure implementation followed, if necessary, by a prehash API 
without changing the actual algorithm, e.g with [2] and [3] where those two 
would be the actual API to be exported.

The question on external Mu, however, is a bit more tricky: it requires the 
injection of a variable that is used in one processing step of 
Verify.Internal. That variable comes from the caller, but somehow needs to be 
transported to the internal - for example by [4].

[1] https://github.com/smuellerDD/leancrypto/blob/master/ml-dsa/src/
dilithium_signature_impl.h#L888

[2] https://github.com/smuellerDD/leancrypto/blob/master/ml-dsa/src/
dilithium_signature_impl.h#L947

[3] https://github.com/smuellerDD/leancrypto/blob/master/ml-dsa/src/
dilithium_signature_impl.h#L906

[4] https://github.com/smuellerDD/leancrypto/blob/master/ml-dsa/src/
dilithium_signature_impl.h#L784

Ciao
Stephan