Request to add support for providing a hash as an input to the composite ML-DSA signature algorithm

[tmelmoth]

The composite ML-DSA signature algorithm implemented in org.bouncycastle.jcajce.provider.asymmetric.compositesignatures.SignatureSpi looks like it only supports taking the message M as the input, and not the hash of the message, PH(M). This means that the system running BouncyCastle must have access to the message itself and not just the hash, which may be impractical if the message is large.

Would it be possible to add an option to the composite ML-DSA signature algorithm to support taking the hash of the message PH(M) as the input? This would be similar to ECDSA where you can either use SHA256withECDSA to take a message as an input, or NONEwithECDSA to take a hash as an input.

[dghgit]

I think we can do this. Looking at it, what I'm thinking is to add a parameter spec, so the look would be

        Signature signature = Signature.getInstance("MLDSA44-Ed25519-SHA512", "BC");
        signature.initSign(compPrivateKey);
        signature.setParameter(new CompositeSignatureParameterSpec(true));  // treat message as pre-hash
        signature.update(messageToBeSigned);
        byte[] signatureValue = signature.sign();

With CompositeSignatureParameterSpec having two constructors, one taking just the boolean and one taking the boolean and a ContextParameterSpec.

My rational is that the problem with doing a "NONEwith...", or I guess a "PH-", is we'll end up with a bazillion algorithm names and strictly speaking the pre-hash should be checked for the correct length as the pre-hash algorithm is actually defined by the name of the base algorithm invoked. The parameter spec should also make it easier to go directly of the OIDs where required as well.

[dghgit]

This is now done and in the latest beta as well which and available at:

https://downloads.bouncycastle.org/betas/
There is an example of use in the test case which is available at:

bc-java/prov/src/test/java/org/bouncycastle/jcajce/provider/test/CompositeSignaturesTest.java

Line 417 in 1a47dd0

public void testPrehash()

Let us know how it goes.

[dghgit]

After further discussion I've also add support for -PREHASH as a name, e.g:

// create a composite which takes a  SHA-256 hash as it's input via the update method
Signature sig = Signature.getInstance("MLDSA44-ECDSA-P256-SHA256-PREHASH", "BC");

See https://downloads.bouncycastle.org/betas/

[dghgit]

Released in 1.82.