[stenslae]

Description

SignMuWithSeed and VerifyMu take a precomputed mu but nothing produced one, so a message could not be hashed apart from the key holder. wc_MlDsaKey_GenMu now does that. It computes mu = SHAKE256(tr || 0 || ctxLen || ctx || msg, 64) as defined in FIPS 204.

• It reads tr from the private key when the key has one, and otherwise derives it from the public key.
• Its output matches the mu used by SignCtx, SignCtxWithSeed and VerifyCtx.
• It doesn't match the legacy no-context Sign or Verify path, and FIPS 204 draft keys are rejected.
• It returns NOT_COMPILED_IN under WOLF_CRYPTO_CB_ONLY_MLDSA.

Testing

Checked the flow from gen mu to sign mu and verify mu.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the new standalone ML-DSA mu-generation API.

No open issues 🎉

What changed in this PR

Adds wc_MlDsaKey_GenMu() so applications can compute an ML-DSA message digest separately from the private-key holder and use it with the existing external-mu signing and verification APIs.

Changes:

• Computes the FIPS 204 context-aware mu from public or private key material, with argument validation and draft-key rejection.
• Adds tests for signing equivalence, verification, key-source consistency, empty messages, and invalid inputs.
• Documents the API and its incompatibility with legacy no-context signing.

File	Description
wolfssl/​wolfcrypt/​wc_mldsa.h	Declares the public wc_MlDsaKey_GenMu() API.
wolfcrypt/​src/​wc_mldsa.c	Implements mu generation and input validation.
tests/​api/​test_mldsa.h	Registers the new API test.
tests/​api/​test_mldsa.c	Adds functional tests and a canonical API check.
doc/​dox_comments/​header_files/​wc_mldsa.h	Documents behavior, constraints, and example usage.

_{Review effort: Balanced}

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m4-pq

• FLASH: .text +128 B (+0.0%, 312,976 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +128 B (+0.0%, 313,808 B / 1,048,576 B, total: 30% used)

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,664 B (+0.6%, 284,112 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12070

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): doc/dox_comments/header_files/wc_mldsa.h, tests/api/test_mldsa.h
Coverage: 3 of 3 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max