Class: Sign

Defined in: signatures.ts:263

Single-algorithm signatures: ML-DSA-44/65/87 or SLH-DSA (FIPS 205), matching quantum-safe-py's Sign. Hedged by default.

Note: quantum-safe-py's context handling is a message prefix, not FIPS 204's native context parameter, so these signatures verify under a generic ML-DSA library only if it reconstructs len(ctx) ‖ ctx ‖ prefix ‖ message. For interoperable signatures use the standards-mode JWT.

Example

const signer = new Sign(); // ML-DSA-65
using pair = signer.generateKeyPair();
const sm = signer.sign(utf8('hello'), pair.secretKey, { context: utf8('myapp-v1') });
signer.verify(sm, pair.publicKey);

Extends

• BaseSigner

Constructors

Constructor

new Sign(algorithm?, options?): Sign

Defined in: signatures.ts:264

Parameters

algorithm?

"ML-DSA-44" | "ML-DSA-65" | "ML-DSA-87" | "ML-DSA-44-v2" | "ML-DSA-65-v2" | "ML-DSA-87-v2" | "SLH-DSA-SHAKE-128s" | "SLH-DSA-SHAKE-128f" | "SLH-DSA-SHAKE-192s" | "SLH-DSA-SHAKE-192f" | "SLH-DSA-SHAKE-256s" | "SLH-DSA-SHAKE-256f" | "SLH-DSA-SHA2-128s" | "SLH-DSA-SHA2-128f" | "SLH-DSA-SHA2-192s" | "SLH-DSA-SHA2-192f" | "SLH-DSA-SHA2-256s" | "SLH-DSA-SHA2-256f"

options?

hedged?

boolean

Returns

Sign

Overrides

BaseSigner.constructor

Properties

algorithm

readonly algorithm: SignatureAlgorithm

Defined in: signatures.ts:133

Inherited from

BaseSigner.algorithm

---

hedged

readonly hedged: boolean

Defined in: signatures.ts:145

True when each signature is prefixed with 32 random bytes (default; see quantum-safe-py).

On a verifier this is also a security setting: the signed bytes are len(ctx) || ctx || prefix || message and the prefix length is stored in the unsigned signature blob, so a verifier that accepted any prefix length would let anyone move bytes between the prefix and the message of a valid signature and obtain a "valid" signature on a different message (a prefix or suffix of the signed one). Verification therefore requires the prefix length to be exactly 32 when hedged is true and 0 when it is false. To verify signatures made without hedging (quantum-safe-py hedged=False), construct the verifier with { hedged: false }. Does not apply to the -v2 formats, which have no prefix (and always hedge inside ML-DSA).

Inherited from

BaseSigner.hedged

---

info

readonly info: SuiteInfo

Defined in: signatures.ts:134

Inherited from

BaseSigner.info

Methods

generateKeyPair()

generateKeyPair(): KeyPair

Defined in: signatures.ts:161

Generates a signing key pair. Free it (or use using) when done.

Returns

KeyPair

Inherited from

BaseSigner.generateKeyPair

---

isValid()

isValid(signed, publicKey, options?): boolean

Defined in: signatures.ts:230

Like verify but returns a boolean instead of throwing VerificationError.

Parameters

signed

SignedMessage

publicKey

PublicKey

options?

expectedContext?

Uint8Array<ArrayBufferLike>

Returns

boolean

Inherited from

BaseSigner.isValid

---

sign()

sign(message, secretKey, options?): SignedMessage

Defined in: signatures.ts:170

Signs message.

Parameters

message

Uint8Array

secretKey

SecretKey

options?

SignOptions = {}

Returns

SignedMessage

Throws

if the key belongs to a different algorithm.

Throws

for an empty message or a context over 255 bytes.

Inherited from

BaseSigner.sign

---

signWithFingerprint()

signWithFingerprint(message, keyPair, options?): SignedMessage

Defined in: signatures.ts:189

Signs and records keyPair.publicKey.fingerprint() in the message.

Parameters

message

Uint8Array

keyPair

KeyPair

options?

Omit<SignOptions, "signerFingerprint"> = {}

Returns

SignedMessage

Inherited from

BaseSigner.signWithFingerprint

---

verify()

verify(signed, publicKey, options?): void

Defined in: signatures.ts:205

Verifies a signed message. For hybrids both signatures must be valid.

The signature covers the message's context, and this method requires it to equal options.expectedContext (default: empty, i.e. no context), so a signature made for one purpose cannot be accepted for another. Pass the context you signed with. (Reading the context from the message itself would let an attacker choose it.)

Parameters

signed

SignedMessage

publicKey

PublicKey

options?

expectedContext?

Uint8Array<ArrayBufferLike>

Returns

void

Throws

if the signature does not verify, or the context differs from expectedContext (no detail on why, by design).

Throws

if key and message algorithms differ.

Inherited from

BaseSigner.verify

---

verifyBytes()

verifyBytes(message, signature, publicKey, options?): void

Defined in: signatures.ts:218

Verifies a detached message + signature blob + context without a SignedMessage.

Parameters

message

Uint8Array

signature

Uint8Array

publicKey

PublicKey

options?

context?

Uint8Array<ArrayBufferLike>

Returns

void

Inherited from

BaseSigner.verifyBytes