SLH-DSA: align HashSLH-DSA pre-hash API with HashML-DSA

[Frauschi]

Summary

Fixes an API inconsistency between wolfSSL's two FIPS-standardised post-quantum signature schemes:

• ML-DSA (wc_dilithium_sign_ctx_hash / wc_dilithium_verify_ctx_hash) takes the caller's pre-hashed digest.
• SLH-DSA (wc_SlhDsaKey_*Hash*) used to take the full message and hash it internally.

This makes SLH-DSA the outlier within wolfSSL and against every other library checked (OpenSSL HASH-ML-DSA, mldsa-native, leancrypto SLH-DSA, sphincsplus reference) and against NIST ACVP signatureInterface=external/preHash=preHash test vectors — all of which take the digest at the pre-hash boundary. Breaking by design.

Changes

• wolfcrypt/src/wc_slhdsa.c — refactor slhdsakey_validate_prehash (renamed from slhdsakey_prehash_msg) to validate msgSz == digest size for hashType and copy, instead of calling wc_*Hash. Returns BAD_LENGTH_E on size mismatch. SHAKE128/SHAKE256 lengths are fixed at 256/512 bits per FIPS 205 Section 10.2.2. Sign- and verify-side M' construction is unchanged.
• wc_SlhDsaKey_SignMsg{Deterministic,WithRandom} — gain front-door NULL / sigSz / key-flag validation matching the *Hash* family. These functions are the SLH-DSA analog of wc_dilithium_verify_mu for ACVP signatureInterface=internal testing — documented as such.
• In-tree callers updated: wolfcrypt/test/test.c (SHA-256/SHAKE256/SHA-384 paths in slhdsa_test_param) and wolfcrypt/benchmark/benchmark.c (SHA-256 prehash sub-bench, hashed once outside the timed loop, with a SHAKE256 fallback for NO_SHA256 builds).
• API tests (tests/api/test_slhdsa.c):
  • BAD_LENGTH_E rejection coverage for both *Hash* and *Msg* sigSz paths
  • NOT_COMPILED_IN coverage for unsupported hashType
  • SHA-512 and SHAKE256 round-trips
  • New test_wc_slhdsa_sign_msg covering the SignMsg* family plus a byte-for-byte cross-check that an externally-built M' produces the same signature as the matching SignHashDeterministic call
• Doxygen updated with the new msg semantics, BAD_LENGTH_E returns, pre-hash examples, and \sa cross-references between the *Hash* and *Msg* API families.
• ChangeLog.md — BREAKING (FIPS 205 SLH-DSA) entry under the unreleased Enhancements with migration guidance.

Verification

Build	Result
--enable-slhdsa (full)	testwolfcrypt SLH-DSA pass, all 16 SLH-DSA API tests pass
--enable-slhdsa=verify-only	compiles clean, signing tests skipped as expected
benchmark -slhdsa	sign-pre / vrfy-pre rows present, no BAD_LENGTH_E

Test plan

• CI passes on the full SLH-DSA build
• CI passes on --enable-slhdsa=verify-only
• CI passes on a SHAKE-only / NO_SHA256 SLH-DSA configuration if such a target exists
• Manual review of doxygen output for the four *Hash* and three *Msg* functions
• Optional: integrate at least one NIST ACVP HashSLH-DSA known-answer vector in a follow-up PR (the plan called for this; not done here to keep the diff focused)

Migration

/* Before: */
wc_SlhDsaKey_SignHash(&key, ctx, ctxSz, msg, msgSz,
    WC_HASH_TYPE_SHA256, sig, &sigLen, &rng);

/* After: */
byte digest[WC_SHA256_DIGEST_SIZE];
wc_Sha256Hash(msg, msgSz, digest);
wc_SlhDsaKey_SignHash(&key, ctx, ctxSz, digest, sizeof(digest),
    WC_HASH_TYPE_SHA256, sig, &sigLen, &rng);

Callers that need the previous "pass full message" semantics for SLH-DSA can use wc_SlhDsaKey_Sign / wc_SlhDsaKey_Verify (the pure interface) instead.

https://claude.ai/code/session_015DkU7iXobMCKqSbMoTWCqd

---

Generated by Claude Code