# Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License").  You may not use
# this file except in compliance with the License.  You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html

# Wycheproof test data for ML-DSA MlDsaSign generated from
# https://github.com/C2SP/wycheproof/blob/8e7fa6f87e6993d7b613cf48b46512a32df8084a/testvectors_v1/mldsa_*_standard_*_test.json
# [version 1]

PrivateKeyRaw = ML_DSA_65_1:ML-DSA-65:[encoded data, 8064 characters]

# 1 baseline
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 2 empty provided context
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = hexcontext-string:
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 3 non-empty context
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = hexcontext-string:436f6e74657874
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 4 longest context
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = hexcontext-string:414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 5 context too long
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 48656c6c6f20776f726c64
Output = 
Ctrl = hexcontext-string:41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = PKEY_CTRL_ERROR

# 6 signature that takes 1 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 0700000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 7 signature that takes 2 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 0f00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 8 signature that takes 3 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 0100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 9 signature that takes 4 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 0800000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 10 signature that takes 5 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 0500000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 11 signature that takes 6 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 2c00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 12 signature that takes 7 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 1200000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 13 signature that takes 8 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 0900000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 14 signature that takes 9 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 0a00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 15 signature that takes 10 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 0b00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 16 signature that takes 11 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 0200000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 17 signature that takes 12 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 1000000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 18 signature that takes 13 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 1500000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 19 signature that takes 14 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 8e00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 20 signature that takes 15 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = dd00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 21 signature that takes 16 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 6c00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 22 signature that takes 17 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 2400000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 23 signature that takes 18 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = f900000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 24 signature that takes 19 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = a401000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 25 signature that takes 20 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 1305000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 26 signature that takes 21 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 8d00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 27 signature that takes 22 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 7d00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 28 signature that takes 23 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = b900000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 29 signature that takes 24 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 2606000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 30 signature that takes 25 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 4301000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 31 signature that takes 26 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 4801000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 32 signature that takes 27 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = c302000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 33 signature that takes 28 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 8f07000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 34 signature that takes 29 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 2001000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 35 signature that takes 30 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 4901000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 36 signature that takes 31 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 3308000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 37 signature that takes 32 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 9721000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 38 signature that takes 33 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = b504000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 39 signature that takes 34 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = b502000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 40 signature that takes 37 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = d20c000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 41 signature that takes 39 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = cb0c000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 42 signature that takes 43 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = fe03000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 43 signature that takes 44 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = bc10000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 44 sample_in_ball requires 1 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 0100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 45 sample_in_ball requires 76 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 9e17000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 46 z_max below the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 8700000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 47 z_max above the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 6e01000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 48 r0_max below the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 3c00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 49 r0_max above the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 6400000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 50 h_ones below the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 2d05000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 51 h_ones above the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 9a01000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 52 high_bits called on the edge case
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = 8803000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 53 low_bits called on the edge case
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_1
Input = b502000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 54 short private key
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-65
Ctrl = hexpriv:[encoded data, 8062 characters]
Result = KEY_FROMDATA_ERROR

# 55 long private key
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-65
Ctrl = hexpriv:[encoded data, 8066 characters]
Result = KEY_FROMDATA_ERROR

# 56 private key with s1 vector out of range
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-65
Ctrl = hexpriv:[encoded data, 8064 characters]
Result = KEY_FROMDATA_ERROR

# 57 private key with s2 vector out of range
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-65
Ctrl = hexpriv:[encoded data, 8064 characters]
Result = KEY_FROMDATA_ERROR

PrivateKeyRaw = ML_DSA_65_6:ML-DSA-65:[encoded data, 8064 characters]

# 58 rej_ntt_poly (sample_uniform) requires 5 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_6
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 59 expand_a requires 150 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_6
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_65_7:ML-DSA-65:[encoded data, 8064 characters]

# 60 rej_ntt_poly (sample_uniform) requires 783 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_7
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_65_8:ML-DSA-65:[encoded data, 8064 characters]

# 61 expand_a requires 23103 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_8
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_65_9:ML-DSA-65:[encoded data, 8064 characters]

# 62 rej_bounded_poly (sample_uniform_eta) requires 3 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_9
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 63 expand_s requires 23 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_9
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_65_10:ML-DSA-65:[encoded data, 8064 characters]

# 64 rej_bounded_poly (sample_uniform_eta) requires 277 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_10
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_65_11:ML-DSA-65:[encoded data, 8064 characters]

# 65 expand_s requires 2649 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_11
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_65_12:ML-DSA-65:[encoded data, 8064 characters]

# 66 power_2_round returns a remainder of 4096
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_12
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 67 power_2_round returns a remainder of -4095
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-65:ML_DSA_65_12
Input = 48656c6c6f20776f726c64
Output = [encoded data, 6618 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
