# Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License").  You may not use
# this file except in compliance with the License.  You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html

# Wycheproof test data for ML-DSA MlDsaSign generated from
# https://github.com/C2SP/wycheproof/blob/8e7fa6f87e6993d7b613cf48b46512a32df8084a/testvectors_v1/mldsa_*_standard_*_test.json
# [version 1]

PrivateKeyRaw = ML_DSA_87_1:ML-DSA-87:[encoded data, 9792 characters]

# 1 baseline
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 2 empty provided context
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = hexcontext-string:
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 3 non-empty context
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = hexcontext-string:436f6e74657874
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 4 longest context
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = hexcontext-string:414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 5 context too long
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = 
Ctrl = hexcontext-string:41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = PKEY_CTRL_ERROR

# 6 signature that takes 1 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 0500000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 7 signature that takes 2 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 0100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 8 signature that takes 3 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 0600000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 9 signature that takes 4 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 0e00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 10 signature that takes 5 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 0300000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 11 signature that takes 6 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 1900000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 12 signature that takes 7 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 1100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 13 signature that takes 8 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 0200000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 14 signature that takes 9 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 1d00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 15 signature that takes 10 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = a200000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 16 signature that takes 11 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 3e00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 17 signature that takes 12 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 2e00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 18 signature that takes 13 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 9300000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 19 signature that takes 14 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 7300000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 20 signature that takes 15 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 2a00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 21 signature that takes 16 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 1b00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 22 signature that takes 17 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 7600000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 23 signature that takes 18 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 0801000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 24 signature that takes 19 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 1701000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 25 signature that takes 20 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 1c05000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 26 signature that takes 21 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 7a0d000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 27 signature that takes 22 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = db12000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 28 signature that takes 23 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = ee09000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 29 signature that takes 24 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 1c0b000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 30 signature that takes 25 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = d908000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 31 signature that takes 26 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = d301000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 32 signature that takes 27 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = d81e000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 33 signature that takes 29 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 9b17000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 34 signature that takes 31 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 7503000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 35 sample_in_ball requires 1 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 0100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 36 sample_in_ball requires 91 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = fe00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 37 z_max below the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = b401000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 38 z_max above the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 0300000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 39 r0_max below the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 1100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 40 r0_max above the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 3a00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 41 h_ones below the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = 7f00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 42 h_ones above the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = c301000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 43 high_bits called on the edge case
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = f100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 44 low_bits called on the edge case
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_1
Input = b306000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 45 short private key
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-87
Ctrl = hexpriv:[encoded data, 9790 characters]
Result = KEY_FROMDATA_ERROR

# 46 long private key
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-87
Ctrl = hexpriv:[encoded data, 9794 characters]
Result = KEY_FROMDATA_ERROR

# 47 private key with s1 vector out of range
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-87
Ctrl = hexpriv:[encoded data, 9792 characters]
Result = KEY_FROMDATA_ERROR

# 48 private key with s2 vector out of range
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-87
Ctrl = hexpriv:[encoded data, 9792 characters]
Result = KEY_FROMDATA_ERROR

PrivateKeyRaw = ML_DSA_87_6:ML-DSA-87:[encoded data, 9792 characters]

# 49 rej_ntt_poly (sample_uniform) requires 5 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_6
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 50 expand_a requires 280 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_6
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 51 rej_bounded_poly (sample_uniform_eta) requires 2 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_6
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 52 power_2_round returns a remainder of 4096
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_6
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_87_7:ML-DSA-87:[encoded data, 9792 characters]

# 53 rej_ntt_poly (sample_uniform) requires 783 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_7
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_87_8:ML-DSA-87:[encoded data, 9792 characters]

# 54 expand_a requires 43101 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_8
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_87_9:ML-DSA-87:[encoded data, 9792 characters]

# 55 expand_s requires 30 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_9
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_87_10:ML-DSA-87:[encoded data, 9792 characters]

# 56 rej_bounded_poly (sample_uniform_eta) requires 149 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_10
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_87_11:ML-DSA-87:[encoded data, 9792 characters]

# 57 expand_s requires 2093 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_11
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_87_12:ML-DSA-87:[encoded data, 9792 characters]

# 58 power_2_round returns a remainder of -4095
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-87:ML_DSA_87_12
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
