# Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License").  You may not use
# this file except in compliance with the License.  You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html

# Wycheproof test data for ML-DSA MlDsaVerify generated from
# https://github.com/C2SP/wycheproof/blob/8e7fa6f87e6993d7b613cf48b46512a32df8084a/testvectors_v1/mldsa_*_standard_*_test.json
# [version 1]

PublicKeyRaw = ML_DSA_87_1:ML-DSA-87:[encoded data, 5184 characters]

# 1 baseline
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 2 empty provided context
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = hexcontext-string:
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 3 non-empty context
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = hexcontext-string:436f6e74657874
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 4 longest context
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = hexcontext-string:414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 5 context too long
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = hexcontext-string:41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = PKEY_CTRL_ERROR

# 6 short signature
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9252 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 7 long signature
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9256 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 8 signature with a bit flip in c_tilde
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 9 signature with a bit flip in z[0]
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 10 signature with a bit flip in z[1]
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 11 signature with a bit flip in z[2]
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 12 signature with a bit flip in z[3]
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 13 signature with a bit flip in z[4]
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 14 signature with a bit flip in z[5]
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 15 signature with a bit flip in z[6]
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 16 signature with a bit flip in hints
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 17 signature with a bit flip in the last byte
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 18 signature with hints in reverse order
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 19 signature with too many hints (causing a buffer overflow)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 20 signature with non-zero padding in hints
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 21 signature with a repeated hint
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 22 signature with omega+1 hints (causing a buffer overflow)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 2b07000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = VERIFY_ERROR

# 23 signature that takes 1 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0500000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 24 signature that takes 2 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 25 signature that takes 3 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0600000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 26 signature that takes 4 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0e00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 27 signature that takes 5 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0300000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 28 signature that takes 6 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 1900000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 29 signature that takes 7 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 1100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 30 signature that takes 8 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0200000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 31 signature that takes 9 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 1d00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 32 signature that takes 10 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = a200000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 33 signature that takes 11 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 3e00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 34 signature that takes 12 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 2e00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 35 signature that takes 13 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 9300000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 36 signature that takes 14 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 7300000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 37 signature that takes 15 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 2a00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 38 signature that takes 16 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 1b00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 39 signature that takes 17 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 7600000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 40 signature that takes 18 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0801000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 41 signature that takes 19 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 1701000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 42 signature that takes 20 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 1c05000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 43 signature that takes 21 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 7a0d000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 44 signature that takes 22 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = db12000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 45 signature that takes 23 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = ee09000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 46 signature that takes 24 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 1c0b000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 47 signature that takes 25 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = d908000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 48 signature that takes 26 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = d301000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 49 signature that takes 27 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = d81e000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 50 signature that takes 29 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 9b17000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 51 signature that takes 31 iteration(s)
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 7503000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 52 sample_in_ball requires 1 SHAKE blocks
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 53 sample_in_ball requires 91 SHAKE bytes
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = fe00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 54 z_max below the limit
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = b401000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 55 z_max above the limit
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 0300000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 56 r0_max below the limit
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 1100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 57 r0_max above the limit
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 3a00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 58 h_ones below the limit
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = 7f00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 59 h_ones above the limit
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = c301000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 60 high_bits called on the edge case
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = f100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 61 low_bits called on the edge case
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_1
Input = b306000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 62 short public key
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-87
Ctrl = hexpub:[encoded data, 5182 characters]
Result = KEY_FROMDATA_ERROR

# 63 long public key
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-87
Ctrl = hexpub:[encoded data, 5186 characters]
Result = KEY_FROMDATA_ERROR

PublicKeyRaw = ML_DSA_87_4:ML-DSA-87:[encoded data, 5184 characters]

# 64 private key with s1 vector out of range
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_4
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PublicKeyRaw = ML_DSA_87_5:ML-DSA-87:[encoded data, 5184 characters]

# 65 private key with s2 vector out of range
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_5
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PublicKeyRaw = ML_DSA_87_6:ML-DSA-87:[encoded data, 5184 characters]

# 66 public key with t1 component set to zero
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_6
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PublicKeyRaw = ML_DSA_87_7:ML-DSA-87:[encoded data, 5184 characters]

# 67 rej_ntt_poly (sample_uniform) requires 5 SHAKE blocks
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_7
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 68 expand_a requires 280 SHAKE blocks
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_7
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 69 rej_bounded_poly (sample_uniform_eta) requires 2 SHAKE blocks
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_7
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 70 power_2_round returns a remainder of 4096
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_7
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PublicKeyRaw = ML_DSA_87_8:ML-DSA-87:[encoded data, 5184 characters]

# 71 rej_ntt_poly (sample_uniform) requires 783 SHAKE bytes
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_8
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PublicKeyRaw = ML_DSA_87_9:ML-DSA-87:[encoded data, 5184 characters]

# 72 expand_a requires 43101 SHAKE bytes
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_9
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PublicKeyRaw = ML_DSA_87_10:ML-DSA-87:[encoded data, 5184 characters]

# 73 expand_s requires 30 SHAKE blocks
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_10
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PublicKeyRaw = ML_DSA_87_11:ML-DSA-87:[encoded data, 5184 characters]

# 74 rej_bounded_poly (sample_uniform_eta) requires 149 SHAKE bytes
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_11
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PublicKeyRaw = ML_DSA_87_12:ML-DSA-87:[encoded data, 5184 characters]

# 75 expand_s requires 2093 SHAKE bytes
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_12
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PublicKeyRaw = ML_DSA_87_13:ML-DSA-87:[encoded data, 5184 characters]

# 76 power_2_round returns a remainder of -4095
FIPSversion = >=3.5.0
Verify-Message-Public = ML-DSA-87:ML_DSA_87_13
Input = 48656c6c6f20776f726c64
Output = [encoded data, 9254 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
