MLDSASigner.verifyMu now derives the expected mu from the message digest as generateMu does and compares in constant time, leaving the signer usable afterwards, and the ML-DSA-CALCULATE-MU service reports a mu of the wrong length with a SignatureException; the verify side's contract is documented on both.

Author: dghgit

core/src/main/java/org/bouncycastle/crypto/signers/MLDSASigner.java

@@ -13,6 +13,7 @@
 import org.bouncycastle.crypto.params.ParametersWithContext;
 import org.bouncycastle.crypto.params.ParametersWithRandom;
 import org.bouncycastle.crypto.signers.mldsa.MLDSAEngine;
+import org.bouncycastle.util.Arrays;
 
 /**
  * ML-DSA (FIPS 204) signer/verifier.
@@ -171,18 +172,29 @@ public byte[] generateSignature()
         return sig;
     }
 
+    /**
+     * Compare a mu value with the mu of the message fed through update(): SHAKE256 over tr, the context
+     * and the message, which is what {@link #generateMu()} returns on the signing side for the same key,
+     * context and message. The signer is reset afterwards, as it is after any other verification.
+     *
+     * @param mu the candidate mu, 64 bytes.
+     * @return true if mu is the message's mu under this key and context, false otherwise.
+     * @throws DataLengthException if mu is not 64 bytes long.
+     */
     public boolean verifyMu(byte[] mu)
     {
         if (mu.length != MLDSAEngine.CrhBytes)
         {
+            reset();
+
             throw new DataLengthException("mu value must be " + MLDSAEngine.CrhBytes + " bytes");
         }
 
-        boolean isTrue = engine.verifyInternalMu(mu);
+        byte[] expected = engine.generateMu(msgDigest);
 
         reset();
 
-        return isTrue;
+        return Arrays.constantTimeAreEqual(expected, mu);
     }
 
     public boolean verifySignature(byte[] signature)

core/src/main/java/org/bouncycastle/crypto/signers/mldsa/MLDSAEngine.java

@@ -499,15 +499,6 @@ public byte[] generateSignature(byte[] mu, SHAKEDigest shake256Digest, byte[] rh
         return null;
     }
 
-    public boolean verifyInternalMu(byte[] providedMu)
-    {
-        byte[] mu = new byte[CrhBytes];
-
-        shake256Digest.doFinal(mu, 0);
-
-        return Arrays.constantTimeAreEqual(mu, providedMu);
-    }
-
     public boolean verifyInternalMuSignature(byte[] mu, byte[] sig, int siglen, SHAKEDigest shake256Digest, byte[] rho, byte[] encT1)
     {
         byte[] buf = new byte[Math.max(CrhBytes + DilithiumK * DilithiumPolyW1PackedBytes, DilithiumCTilde)];

core/src/test/java/org/bouncycastle/pqc/crypto/test/MLDSATest.java

@@ -19,13 +19,16 @@
 import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
 import org.bouncycastle.crypto.AsymmetricCipherKeyPair;
+import org.bouncycastle.crypto.CipherParameters;
 import org.bouncycastle.crypto.CryptoException;
+import org.bouncycastle.crypto.DataLengthException;
 import org.bouncycastle.crypto.Signer;
 import org.bouncycastle.crypto.generators.MLDSAKeyPairGenerator;
 import org.bouncycastle.crypto.params.MLDSAKeyGenerationParameters;
 import org.bouncycastle.crypto.params.MLDSAParameters;
 import org.bouncycastle.crypto.params.MLDSAPrivateKeyParameters;
 import org.bouncycastle.crypto.params.MLDSAPublicKeyParameters;
+import org.bouncycastle.crypto.params.ParametersWithContext;
 import org.bouncycastle.crypto.params.ParametersWithRandom;
 import org.bouncycastle.crypto.signers.HashMLDSASigner;
 import org.bouncycastle.crypto.signers.MLDSASigner;
@@ -710,6 +713,60 @@ public void testHashExternalMu()
         }
     }
 
+    public void testCalculateMuVerify()
+        throws Exception
+    {
+        MLDSAKeyPairGenerator kpGen = new MLDSAKeyPairGenerator();
+        kpGen.init(new MLDSAKeyGenerationParameters(new SecureRandom(), MLDSAParameters.ml_dsa_65));
+        AsymmetricCipherKeyPair kp = kpGen.generateKeyPair();
+
+        byte[][] messages = { new byte[0], Strings.toByteArray("Hello World!") };
+        byte[][] contexts = { null, Strings.toByteArray("context") };
+
+        for (int c = 0; c != contexts.length; c++)
+        {
+            for (int m = 0; m != messages.length; m++)
+            {
+                byte[] message = messages[m];
+                CipherParameters priv = contexts[c] == null ? (CipherParameters)kp.getPrivate() : new ParametersWithContext(kp.getPrivate(), contexts[c]);
+                CipherParameters pub = contexts[c] == null ? (CipherParameters)kp.getPublic() : new ParametersWithContext(kp.getPublic(), contexts[c]);
+
+                MLDSASigner signer = new MLDSASigner();
+                signer.init(true, priv);
+                signer.update(message, 0, message.length);
+                byte[] mu = signer.generateMu();
+                signer.update(message, 0, message.length);
+                byte[] signature = signer.generateSignature();
+
+                MLDSASigner verifier = new MLDSASigner();
+                verifier.init(false, pub);
+                verifier.update(message, 0, message.length);
+                assertTrue("mu rejected, message length " + message.length, verifier.verifyMu(mu));
+
+                byte[] flipped = Arrays.clone(mu);
+                flipped[0] ^= 1;
+                verifier.update(message, 0, message.length);
+                assertFalse(verifier.verifyMu(flipped));
+
+                // checking a mu must leave the verifier able to check an ordinary signature
+                verifier.update(message, 0, message.length);
+                assertTrue(verifier.verifySignature(signature));
+
+                try
+                {
+                    verifier.verifyMu(new byte[3]);
+                    fail("short mu accepted");
+                }
+                catch (DataLengthException e)
+                {
+                    assertEquals("mu value must be 64 bytes", e.getMessage());
+                }
+                verifier.update(message, 0, message.length);
+                assertTrue(verifier.verifyMu(mu));
+            }
+        }
+    }
+
     public void testMLDSARejection()
         throws Exception
     {

docs/releasenotes.md

@@ -18,6 +18,7 @@ Date: 2026, TBD
 - X500Name.equals compared two names that are equal but not byte-identical - the same RDNs in another order, or in another string type - by searching the second name for each RDN of the first and canonicalising both values on every candidate comparison, so the comparison was quadratic in the number of RDNs, and CMSSignedData.getSignerInfos(), the CMSEnvelopedData, CMSAuthEnvelopedData and CMSEnvelopedDataParser constructors, TimeStampToken, the S/MIME classes built on them and X509CertificateHolderSelector.match() all compare names taken from the message before anything in it is verified: a 1.1 MB signed or enveloped message carrying two 40,000 RDN issuer names took about 90 seconds of CPU to parse. The signer and recipient stores also indexed their entries in a HashMap keyed on the signer or recipient id, whose hash code is easy to make collide, so a message with 16,000 signers or recipients chosen to collide took several seconds to index. AbstractX500NameStyle.areEqual now compares the RDNs positionally and otherwise sorts the canonical form of each RDN once and compares the two multisets, so a comparison is n log n in the number of RDNs, the two stores now scan their entries on lookup instead of indexing them, and the selector checks the serial number before the issuer name.
 - The hash code of an ASN.1 object is a short fold over its content octets that a sender can make collide at will, and several tables built while a message is parsed were keyed on one: the extension table behind Extensions, so every certificate, CRL, OCSP and timestamp request parse, the deprecated X509Extensions, ExtendedKeyUsage, the CMS AttributeTable built from a SignerInfo's signed and unsigned attributes (the unsigned ones lying outside the signature), the EST CSRAttributesResponse index, and the Set of digest AlgorithmIdentifiers that the CMSSignedDataParser constructor and CMSSignedData.getDigestAlgorithmIDs() build from the SignedData digestAlgorithms field. With every key sharing one hash code each insert scanned all those before it, so a 6 MB certificate or message holding 65,000 such entries took about 35 seconds of CPU to parse and the parser's digest algorithm set about 140 seconds. Those tables are now ordered maps keyed on the OID's string form and the digest algorithm sets are ordered on the identifier's DER encoding, so each is n log n in the number of entries whatever their hash codes. AttributeTable.add() and remove() also no longer share a multi-valued entry's Vector with the table they were derived from.
 - CMSSignedData digested the encapsulated or detached content once for every signer it verified, so a message carrying many SignerInfos over a large content cost their product in digesting before any signature was checked, where CMSSignedDataParser digests once per algorithm named in the digestAlgorithms field. The signers of a CMSSignedData now share the content digests computed under each digest algorithm identifier, so signers using the same algorithm digest the content once. The new org.bouncycastle.cms.max_digest_algorithms property bounds the number of distinct digest algorithms either class will compute over one message's content, each algorithm past the limit raising a CMSException; it is unlimited unless set.
+- The verify side of the ML-DSA-CALCULATE-MU signature service, and MLDSASigner.verifyMu beneath it, compared the supplied mu with a value derived from the key's tr and the context alone, never absorbing the message passed to update(), so a correct mu was accepted only for an empty message and rejected for every other, while the sign side of the same service computed mu correctly. The comparison also finalised the engine's shared digest, so an ordinary verifySignature on the same MLDSASigner afterwards failed for a valid signature, and a mu of the wrong length escaped Signature.verify() as an unchecked DataLengthException. verifyMu now derives the expected mu from the message digest exactly as generateMu does and compares in constant time, the signer stays usable afterwards, the service answers a wrong-length mu with a SignatureException, and the contract - the verify side accepts exactly the mu the sign side returns for the same key, context and data - is now in the javadoc of both.
 - The SM2 key pair generator of the BC provider, KeyPairGenerator.getInstance("SM2", "BC"), was built on the generic EC key pair generator rather than the lightweight SM2KeyPairGenerator the 1.73 release notes described, so it could draw a private key of n - 1, which Section 6.1 of GB/T 32918.1 excludes and which the SM2 signer rejects. It now uses SM2KeyPairGenerator and draws from [1, n - 2].
 - ESTResponse added each header line of an EST server's response to its header table by copying that header's value array, so a response repeating one header many times was quadratic to parse - about 7 seconds of CPU per megabyte of header lines - and a read limit set through JsseESTServiceBuilder.withReadLimit() only applied once the header block had been read. The values of each header are now collected once, and the header block counts against the read limit of the source.
 - The C509 encoding of an RFC 6955 proof-of-possession value (the sa-ecdhPop signature algorithms, values 14 to 16 of the C509 Signature Algorithms Registry) copied the DER DhSigStatic into the signature value byte string, where Section 4.2 of draft-ietf-cose-cbor-encoded-cert-21 defines the value as the bare hashValue when the DhSigStatic names no issuer and serial number and as the [issuer, certificateSerialNumber, hashValue] array when it does. The converter now produces both forms from the DER and reconstructs the DER from either; previously the array form was rejected outright and the byte-string form reconstructed a signature value four bytes short of the DER it came from, so a type 3 request carrying one could not verify. The privateKeyPossessionStatement certification request attribute (RFC 9883, Section 4.3.3 of the draft) was carried in the generic ~oid form on conversion and refused on reconstruction; it is now converted to and from its int-coded [issuer, certificateSerialNumber, cert] form, with an embedded signature certificate re-encoded as a type 3 C509 certificate. The certificate, certification request and template vectors of draft-ietf-cose-c509-test-vectors-02 now drive the util and pkix test suites.

prov/src/main/java/org/bouncycastle/jcajce/provider/asymmetric/mldsa/SignatureSpi.java

@@ -19,6 +19,7 @@
 import org.bouncycastle.jcajce.MLDSAProxyPrivateKey;
 import org.bouncycastle.jcajce.interfaces.MLDSAPublicKey;
 import org.bouncycastle.jcajce.provider.asymmetric.util.BaseDeterministicOrRandomSignature;
+import org.bouncycastle.jcajce.provider.util.SecurityExceptions;
 import org.bouncycastle.jcajce.spec.MLDSAParameterSpec;
 
 /**
@@ -273,6 +274,12 @@ protected boolean engineVerify(byte[] sigBytes)
         }
     }
 
+    /**
+     * The ML-DSA-CALCULATE-MU service. Signing returns the 64 byte mu of the key, the context and the
+     * data passed to update(), for an external signer to sign through ML-DSA-EXTERNAL-MU. Verifying takes
+     * such a mu in place of a signature and reports whether it is the mu of the data passed to update()
+     * under the key and context, which is exactly what the signing side of the service returns for them.
+     */
     public static class MLDSACalcMu
         extends SignatureSpi
     {
@@ -297,7 +304,14 @@ protected byte[] engineSign()
         protected boolean engineVerify(byte[] sigBytes)
             throws SignatureException
         {
-            return signer.verifyMu(sigBytes);
+            try
+            {
+                return signer.verifyMu(sigBytes);
+            }
+            catch (DataLengthException e)
+            {
+                throw SecurityExceptions.signatureException(e.getMessage(), e);
+            }
         }
     }
 }

prov/src/test/java/org/bouncycastle/pqc/jcajce/provider/test/MLDSATest.java

@@ -702,6 +702,73 @@ public void testMLDSARandomMsgAndMuSig()
         assertTrue(Arrays.areEqual(mu, mu2));
     }
 
+    public void testMLDSACalculateMuVerify()
+        throws Exception
+    {
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance("ML-DSA", "BC");
+
+        kpg.initialize(MLDSAParameterSpec.ml_dsa_65, new SecureRandom());
+
+        KeyPair kp = kpg.generateKeyPair();
+        byte[][] messages = { new byte[0], msg };
+        byte[][] contexts = { null, Strings.toByteArray("context") };
+
+        for (int c = 0; c != contexts.length; c++)
+        {
+            for (int m = 0; m != messages.length; m++)
+            {
+                byte[] message = messages[m];
+
+                Signature calc = Signature.getInstance("ML-DSA-CALCULATE-MU", "BC");
+                calc.initSign(kp.getPrivate(), new SecureRandom());
+                if (contexts[c] != null)
+                {
+                    calc.setParameter(new ContextParameterSpec(contexts[c]));
+                }
+                calc.update(message);
+                byte[] mu = calc.sign();
+
+                // the verify side takes the mu in place of a signature and must accept the sign side's own
+                Signature ver = Signature.getInstance("ML-DSA-CALCULATE-MU", "BC");
+                ver.initVerify(kp.getPublic());
+                if (contexts[c] != null)
+                {
+                    ver.setParameter(new ContextParameterSpec(contexts[c]));
+                }
+                ver.update(message);
+                assertTrue("mu rejected, message length " + message.length, ver.verify(mu));
+
+                byte[] flipped = Arrays.clone(mu);
+                flipped[0] ^= 1;
+                ver.update(message);
+                assertFalse(ver.verify(flipped));
+
+                ver.update(message);
+                try
+                {
+                    ver.verify(new byte[3]);
+                    fail("short mu accepted");
+                }
+                catch (SignatureException e)
+                {
+                    assertEquals("mu value must be 64 bytes", e.getMessage());
+                }
+
+                // a rejected or malformed mu leaves the object ready for the next verification
+                ver.update(message);
+                assertTrue(ver.verify(mu));
+
+                if (contexts[c] != null)
+                {
+                    Signature noContext = Signature.getInstance("ML-DSA-CALCULATE-MU", "BC");
+                    noContext.initVerify(kp.getPublic());
+                    noContext.update(message);
+                    assertFalse(noContext.verify(mu));
+                }
+            }
+        }
+    }
+
     public void testMLDSAMuKatTest()
         throws Exception
     {