Request for technical feedback on CIRCL-based ML-DSA cross-implementation verification

[mokkunsuzuki-code]

Hello CIRCL maintainers,

I am looking for narrowly scoped technical feedback on the use of CIRCL as an independent ML-DSA verifier in an open reproducibility project.

I maintain an open verification project called QSP.

Current public Stage391 repository:

https://github.com/mokkunsuzuki-code/stage391

Public verification page:

https://mokkunsuzuki-code.github.io/stage391/

This is not a vulnerability report, certification request, endorsement request, or request for a review of the whole QSP project.

The specific reason I am contacting CIRCL is that QSP Stage387 introduced a second ML-DSA verification implementation using CIRCL in order to reduce dependence on a single verifier implementation.

The relevant design goal was:

same public key
+
same signed target
+
same signature
+
independent ML-DSA implementation

cross-implementation verification evidence

Stage387 then carries forward into the independent reproduction and assessment path now exposed by Stage391.

Current Stage391 assessment commit:

a74b7f47f8caabf37a910ea9f4da2b87c0cd5f15

Canonical Stage391 result SHA-256:

ed644d11bd49f67f89cfda50364d619066b4da3a36bf1fb26b38e111b6092b23

Current authoritative state:

third_party_submission_pending

verification_status:

waiting_for_external_submission

No independent external assessment is currently claimed.

My question is intentionally narrow:

Is the way QSP uses CIRCL as an independent ML-DSA verification implementation technically meaningful as cross-implementation evidence?

I would especially value feedback on any of the following:

1. whether the CIRCL verification path is being used correctly,
2. whether the compared ML-DSA inputs are sufficient for meaningful interoperability evidence,
3. whether important FIPS 204 / ML-DSA parameters or encodings are missing from the comparison,
4. whether the test demonstrates verifier independence in a meaningful way,
5. identification of any concrete methodological flaw,
6. or an independent reproduction of the CIRCL-based verification path.

A full review of QSP is not required.

Negative feedback is fully acceptable. A mismatch, incorrect assumption, or methodological criticism would be as valuable as agreement.

The relevant QSP work includes:

• Stage386: public-key binding and evidence portability
• Stage387: ML-DSA multi-implementation interoperability
• Stage390: independent assessment intake
• Stage391: external reproduction adjudication

A self-contained third-party reproduction package is prepared, but I am not attaching it unsolicited.

If a maintainer would like to inspect or reproduce the exact evidence, I can provide the fixed archive and SHA-256 record.

Related external requests:

mldsa-native:
pq-code-package/mldsa-native#1393

PQCA Readiness Tracking WG:
PQCA/wg-readiness-tracking#41

Open Quantum Safe:
https://github.com/orgs/open-quantum-safe/discussions/2533

OpenSSF Supply Chain Integrity:
ossf/wg-supply-chain-integrity#88

Thank you for any technical criticism or direction.

Best regards,
Motohiro Suzuki

[bwesterb]

Please state the issue or question succinctly.

[mokkunsuzuki-code]

Thanks — the concise question is:

If the same FIPS 204 ML-DSA-65 public key, message, and signature are accepted by both our primary verifier and CIRCL, is that meaningful cross-implementation verification evidence, or is there an important interoperability condition we are missing?

In particular, I would value knowing whether CIRCL requires any additional parameter, encoding, or context checks for that comparison to be technically sound.

[bwesterb]

Are test vectors meaningful? Yes! Wycheproof has excellent ML-DSA test vectors.

Update: I see we test against an old version of Wycheproof. I'll update that.

[mokkunsuzuki-code]

Thank you — that is very helpful. I’ll review the current Wycheproof ML-DSA vectors and compare them against our existing cross-implementation verification path. In particular, I want to test whether consistent accept/reject behavior across both valid and invalid vectors, combined with verification of the same artifact across independent ML-DSA implementations, provides stronger evidence than relying on a single fixed signature alone. If there is any specific Wycheproof ML-DSA test category you think is especially important not to miss, I’d appreciate the pointer.

…

2026/08/24 19:46、Bas Westerbaan ***@***.***>のメール: bwesterb left a comment (cloudflare/circl#691) <#691 (comment)> Are test vectors meaningful? Yes! Wycheproof <https://github.com/C2SP/wycheproof> has excellent ML-DSA test vectors. — Reply to this email directly, view it on GitHub <#691?email_source=notifications&email_token=BYN6ZAWFNPVZAXO2LN4YJQT5LQMIVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMZZGQYTGNRYGIZ2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-5394136823>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BYN6ZARTQSGO7XVZVX4UGL35LQMIVAVCNFSNUABFKJSXA33TNF2G64TZHMYTINZZGYZTCMJSHNEXG43VMU5TKMRRGQ2TANBRGI32C5QC>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BYN6ZAVTYU2OMWXIODZ3RP35LQMIVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMZZGQYTGNRYGIZ2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BYN6ZATHFGC6VRRMOKPLYY35LQMIVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMZZGQYTGNRYGIZ2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.

[bwesterb]

I would tests against all Wycheproof ML-DSA vectors. (There are some that are more important than others, but if you pass all you don't have to think about that.)

[mokkunsuzuki-code]

Thank you — I followed your suggestion and started with the full ML-DSA-65 verification vector set. I tested all 210 Wycheproof ML-DSA-65 verification vectors against both OpenSSL 3.6.3 and CIRCL v1.6.5. Both implementations matched the expected result for all 210 cases: all 79 valid cases were accepted and all 131 invalid cases were rejected, with zero cross-implementation mismatches. I’m now extending the same testing to the remaining Wycheproof ML-DSA vectors. Thanks again for the guidance.

…

2026/08/24 21:03、Bas Westerbaan ***@***.***>のメール: bwesterb left a comment (cloudflare/circl#691) <#691 (comment)> I would tests against all Wycheproof ML-DSA vectors. (There are some that are more important than others, but if you pass all you don't have to think about that.) — Reply to this email directly, view it on GitHub <#691?email_source=notifications&email_token=BYN6ZAVYRBIPQKGL6ICZXN35LQVJLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMZZGQ4TAMZYGQ32M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-5394903847>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BYN6ZATS4GZQ4B6ASP7V5G35LQVJLAVCNFSNUABFKJSXA33TNF2G64TZHMYTINZZGYZTCMJSHNEXG43VMU5TKMRRGQ2TANBRGI32C5QC>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BYN6ZARVG3IY24ZNE6PVQDL5LQVJLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMZZGQ4TAMZYGQ32M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BYN6ZAQZSORXYU45BYLQA6L5LQVJLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMZZGQ4TAMZYGQ32M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.

[mokkunsuzuki-code]

Thanks again for the suggestion to run the full Wycheproof set. I’ve now completed all 1,138 ML-DSA vectors in the pinned Wycheproof corpus I tested with both CIRCL and OpenSSL 3.6.3 — 2,276 executions in total. The full run did not pass uniformly. I found 9 differences from the Wycheproof expected result, all on vectors marked invalid: CIRCL accepted 6 cases that Wycheproof expected to reject: ML-DSA-44 tcIds 52, 53 ML-DSA-65 tcIds 56, 57 ML-DSA-87 tcIds 47, 48 OpenSSL accepted 3 cases that Wycheproof expected to reject: ML-DSA-44 tcId 84 ML-DSA-65 tcId 91 ML-DSA-87 tcId 82 I’m not treating these as confirmed implementation bugs or FIPS 204 nonconformance; at this point they are simply observed differences from the Wycheproof expectations. I’ve isolated the exact vector identities and observed outputs. Would a minimal reproducer for the six CIRCL-side cases be useful here? Your suggestion to run the full set was useful — these cases would not have shown up in the original single-signature comparison.

…

2026/08/24 21:03、Bas Westerbaan ***@***.***>のメール: bwesterb left a comment (cloudflare/circl#691) <#691 (comment)> I would tests against all Wycheproof ML-DSA vectors. (There are some that are more important than others, but if you pass all you don't have to think about that.) — Reply to this email directly, view it on GitHub <#691?email_source=notifications&email_token=BYN6ZAVYRBIPQKGL6ICZXN35LQVJLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMZZGQ4TAMZYGQ32M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-5394903847>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BYN6ZATS4GZQ4B6ASP7V5G35LQVJLAVCNFSNUABFKJSXA33TNF2G64TZHMYTINZZGYZTCMJSHNEXG43VMU5TKMRRGQ2TANBRGI32C5QC>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BYN6ZARVG3IY24ZNE6PVQDL5LQVJLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMZZGQ4TAMZYGQ32M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BYN6ZAQZSORXYU45BYLQA6L5LQVJLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMZZGQ4TAMZYGQ32M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.

[bwesterb]

These are deliberate choices of each implementation.

[mokkunsuzuki-code]

Thanks — that clarifies it. For the six CIRCL-side cases, is there a code comment, issue, test, or other reference that documents the intended behavior? I’m keeping the observed difference separate from any bug or conformance classification, so I’d like to make the rationale traceable if there’s an existing reference. Thanks again.

…

2026/09/07 20:53、Bas Westerbaan ***@***.***>のメール: bwesterb left a comment (cloudflare/circl#691) <#691 (comment)> These are deliberate choices of each implementation. — Reply to this email directly, view it on GitHub <#691?email_source=notifications&email_token=BYN6ZAUBOYIHG3AW33SMFOL5N2OUBA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNJXGAZDCOJRGU2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-5570219154>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BYN6ZAWOEKMBZOC2DP3UJO35N2OUBAVCNFSNUABFKJSXA33TNF2G64TZHMYTINZZGYZTCMJSHNEXG43VMU5TKMRRGQ2TANBRGI32C5QC>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BYN6ZAV7PJNMUHTHYDV5JCL5N2OUBA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNJXGAZDCOJRGU2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BYN6ZATMNI7PFG3XTLECIRD5N2OUBA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNJXGAZDCOJRGU2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.

[bwesterb]

here

[mokkunsuzuki-code]

Thanks — that’s exactly what I was looking for. I’ll use that reference to keep the CIRCL-side rationale traceable. Thanks again for the help.

…

2026/09/07 22:38、Bas Westerbaan ***@***.***>のメール: bwesterb left a comment (cloudflare/circl#691) <#691 (comment)> here <https://github.com/cloudflare/circl/blob/main/sign/schemes/wycheproof_test.go#L135-L137> — Reply to this email directly, view it on GitHub <#691?email_source=notifications&email_token=BYN6ZAWDXIQ365HDISJ67DL5N226NA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNJXGE2DONZWGY2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-5571477664>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BYN6ZAQA4TBA55V3IHJ7QC35N226NAVCNFSNUABFKJSXA33TNF2G64TZHMYTINZZGYZTCMJSHNEXG43VMU5TKMRRGQ2TANBRGI32C5QC>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BYN6ZAW4Y7ZAMXZKU3BMI335N226NA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNJXGE2DONZWGY2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BYN6ZATJE5J42XYKNXJVGE35N226NA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNJXGE2DONZWGY2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.

[mokkunsuzuki-code]

Thanks again for the pointer. I’ve now incorporated the CIRCL-side rationale reference into the public ML-DSA interoperability evidence, while keeping the observed behavior separate from any bug or conformance classification. The unified static evidence is published at this fixed revision: mokkunsuzuki-code/qsv-mldsa-interoperability-corpus@42f2229 <> No action needed — I just wanted to share the resulting traceable record. Thanks again for the help.

…

2026/09/07 22:38、Bas Westerbaan ***@***.***>のメール: bwesterb left a comment (cloudflare/circl#691) <#691 (comment)> here <https://github.com/cloudflare/circl/blob/main/sign/schemes/wycheproof_test.go#L135-L137> — Reply to this email directly, view it on GitHub <#691?email_source=notifications&email_token=BYN6ZAWDXIQ365HDISJ67DL5N226NA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNJXGE2DONZWGY2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-5571477664>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BYN6ZAQA4TBA55V3IHJ7QC35N226NAVCNFSNUABFKJSXA33TNF2G64TZHMYTINZZGYZTCMJSHNEXG43VMU5TKMRRGQ2TANBRGI32C5QC>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BYN6ZAW4Y7ZAMXZKU3BMI335N226NA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNJXGE2DONZWGY2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BYN6ZATJE5J42XYKNXJVGE35N226NA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNJXGE2DONZWGY2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.