Cryptography

NIST check: verify ML-DSA-87, SLH-DSA and Ed25519 yourself

The US standards institute NIST publishes official test vectors for ML-DSA (FIPS 204) and SLH-DSA (FIPS 205): inputs together with the results a correct implementation must produce, including deliberately tampered signatures. Here your browser recomputes these cases with exactly the module that also verifies our reviews.

Start the test

The test files are loaded directly from NIST on GitHub, not from our servers. The SLH-DSA test file is about 30 MB, so loading may take a moment.

Or: download the files yourself and select them
  1. At NIST on GitHub, open the folders ML-DSA-keyGen-FIPS204, ML-DSA-sigVer-FIPS204, SLH-DSA-keyGen-FIPS205, SLH-DSA-sigVer-FIPS205, EDDSA-SigGen-1.0 and EDDSA-SigVer-1.0.
  2. Download internalProjection.json from each.
  3. Select the files here (all or individual ones):

What the test shows and what it doesn’t

  • Key generation (keyGen): From each NIST starting value (seed) our module creates a signature. It is only valid under the public key specified by NIST if our module computed exactly the same key.
  • Signature verification (sigVer): Our module must reach the same verdict as NIST in every case, including deliberately altered signatures, messages and contexts.
  • SLH-DSA-SHA2-256f: From NIST’s three seeds (skSeed, skPrf, pkSeed), our module must produce exactly the same private and public key as NIST — compared byte for byte. Signature verification works as above. Only the SHA2-256f parameter set, which McGesund uses, is evaluated.
  • Ed25519: This does not test our own code but the cryptography built into your browser and our fallback library noble, which checks reviews in browsers without Ed25519. Plain Ed25519 without pre-hash and context is tested, just as we sign. NIST provides only a few manipulated cases for this; the rest are valid signatures that must be accepted.
  • Not covered: key management, servers and the processes around the signature. The test shows that the mathematics matches the standard, nothing more.
  • FN-DSA (Falcon): The FIPS 206 standard is not final yet, so NIST has not published official test vectors. As soon as they appear, we will add them here.

← Back to the cryptography overview