# Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License").  You may not use
# this file except in compliance with the License.  You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html

# Wycheproof test data for ML-DSA MlDsaSign generated from
# https://github.com/C2SP/wycheproof/blob/8e7fa6f87e6993d7b613cf48b46512a32df8084a/testvectors_v1/mldsa_*_standard_*_test.json
# [version 1]

PrivateKeyRaw = ML_DSA_44_1:ML-DSA-44:[encoded data, 5120 characters]

# 1 baseline
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 2 empty provided context
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = hexcontext-string:
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 3 non-empty context
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = hexcontext-string:436f6e74657874
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 4 longest context
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = hexcontext-string:414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 5 context too long
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 48656c6c6f20776f726c64
Output = 
Ctrl = hexcontext-string:41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
Ctrl = message-encoding:1
Ctrl = deterministic:1
Result = PKEY_CTRL_ERROR

# 6 signature that takes 1 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 0500000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 7 signature that takes 2 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 0100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 8 signature that takes 3 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 0e00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 9 signature that takes 4 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 0600000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 10 signature that takes 5 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 0300000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 11 signature that takes 6 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 1f00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 12 signature that takes 7 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 0b00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 13 signature that takes 8 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 1e00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 14 signature that takes 9 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 2a00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 15 signature that takes 10 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 3600000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 16 signature that takes 11 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 7a00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 17 signature that takes 12 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 1d00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 18 signature that takes 13 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 9e00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 19 signature that takes 14 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 6e00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 20 signature that takes 15 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 8501000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 21 signature that takes 16 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 0c00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 22 signature that takes 17 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 1c00000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 23 signature that takes 18 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = f202000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 24 signature that takes 19 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 3300000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 25 signature that takes 20 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 1601000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 26 signature that takes 21 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = b600000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 27 signature that takes 22 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 5c01000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 28 signature that takes 23 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = a707000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 29 signature that takes 24 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 6006000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 30 signature that takes 25 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 6f07000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 31 signature that takes 26 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 0e12000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 32 signature that takes 27 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = a306000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 33 signature that takes 28 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 4408000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 34 signature that takes 29 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = d420000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 35 signature that takes 30 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = ca1b000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 36 signature that takes 31 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = d308000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 37 signature that takes 32 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = bb10000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 38 signature that takes 34 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 1611000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 39 signature that takes 39 iteration(s)
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 3216000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 40 sample_in_ball requires 1 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 0100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 41 sample_in_ball requires 61 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = b20a000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 42 z_max below the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 4800000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 43 z_max above the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 8100000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 44 r0_max below the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 8600000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 45 r0_max above the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 8000000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 46 h_ones below the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 1300000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 47 h_ones above the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 9201000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 48 high_bits called on the edge case
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = a901000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 49 low_bits called on the edge case
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_1
Input = 7205000000000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 50 short private key
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-44
Ctrl = hexpriv:[encoded data, 5118 characters]
Result = KEY_FROMDATA_ERROR

# 51 long private key
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-44
Ctrl = hexpriv:[encoded data, 5122 characters]
Result = KEY_FROMDATA_ERROR

# 52 private key with s1 vector out of range
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-44
Ctrl = hexpriv:[encoded data, 5120 characters]
Result = KEY_FROMDATA_ERROR

# 53 private key with s2 vector out of range
FIPSversion = >=3.5.0
KeyFromData = ML-DSA-44
Ctrl = hexpriv:[encoded data, 5120 characters]
Result = KEY_FROMDATA_ERROR

PrivateKeyRaw = ML_DSA_44_6:ML-DSA-44:[encoded data, 5120 characters]

# 54 rej_ntt_poly (sample_uniform) requires 5 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_6
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 55 expand_a requires 80 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_6
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

# 56 rej_bounded_poly (sample_uniform_eta) requires 2 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_6
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_44_7:ML-DSA-44:[encoded data, 5120 characters]

# 57 rej_ntt_poly (sample_uniform) requires 783 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_7
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_44_8:ML-DSA-44:[encoded data, 5120 characters]

# 58 expand_a requires 12330 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_8
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_44_9:ML-DSA-44:[encoded data, 5120 characters]

# 59 expand_s requires 16 SHAKE blocks
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_9
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_44_10:ML-DSA-44:[encoded data, 5120 characters]

# 60 rej_bounded_poly (sample_uniform_eta) requires 149 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_10
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_44_11:ML-DSA-44:[encoded data, 5120 characters]

# 61 expand_s requires 1125 SHAKE bytes
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_11
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_44_12:ML-DSA-44:[encoded data, 5120 characters]

# 62 power_2_round returns a remainder of 4096
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_12
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_44_13:ML-DSA-44:[encoded data, 5120 characters]

# 63 power_2_round returns a remainder of -4095
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_13
Input = 48656c6c6f20776f726c64
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_44_14:ML-DSA-44:[encoded data, 5120 characters]

# 64 ct0_max below the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_14
Input = e4449e0400000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1

PrivateKeyRaw = ML_DSA_44_15:ML-DSA-44:[encoded data, 5120 characters]

# 65 ct0_max above the limit
FIPSversion = >=3.5.0
Sign-Message = ML-DSA-44:ML_DSA_44_15
Input = e4449e0400000000000000000000000000000000000000000000000000000000
Output = [encoded data, 4840 characters]
Ctrl = message-encoding:1
Ctrl = deterministic:1
