Hello,
We would like to inquire about picking up the work on JDK-8384521. We
see it remains open and that the earlier exploration in PR #23934 was
abandoned due to its large scope.
We would like to propose that we move JDK-8384521 forward with a
focused scope. This would include the following:
1. Adding MLDSAParameterSpec.ExternalMu and MLDSAParameterSpec.Context
for configuring the Signature instances.
2. Providing a standard MessageDigest pre-initialized with the public
key and context to stream large messages and produce the 64 byte mu.
For this we will add MLDSAParameterSpec.DigestBuilder and
MLDSAExternalMuDigestSpi.
3. Complete implementation in the SUN provider.
We are aware that mu can be computed by hand with
MessageDigest.getInstance("SHAKE256-512") running over tr || 0x00 ||
len(ctx) || ctx || M. However, this is error-prone as callers need to
perform several steps and a mistake would produce a signature that
fails to verify. The typed API would allow providers that already
compute mu natively to plug in their own implementation.
We are raising this because we have encountered a critical requirement
for signing with an externally computed message representative mu when
deploying ML-DSA across hardware and isolated cryptographic modules.
We have a clean, tested prototype ready and would like to know if you
would welcome our help in driving JDK-8384521 forward and whether this
scoped design would meet your expectations.
Many thanks,
Sorin Basca (on behalf of the Google Java Platform & ISE Crypto teams)
