Algorithm (matches the reference {@code hash_to_point_vartime} exactly): absorb * {@code nonce || message} into a SHAKE256 sponge, then repeatedly squeeze two bytes, interpret * them as a big-endian 16-bit value {@code w}, and keep {@code w mod q} whenever {@code w < 5q = - * 61445}, until n coefficients are collected. Uses the audited Bouncy Castle SHAKE256 XOF. + * 61445}, until n coefficients are collected. Uses the Bouncy Castle SHAKE256 XOF (bcprov-jdk18on; not FIPS-validated, no published third-party audit known). */ public class HashToPointPrecompiledContract extends AbstractPrecompiledContract { diff --git a/precompiles/MLKEM768PrecompiledContract.java b/precompiles/MLKEM768PrecompiledContract.java index 35d5c44..324da97 100644 --- a/precompiles/MLKEM768PrecompiledContract.java +++ b/precompiles/MLKEM768PrecompiledContract.java @@ -44,7 +44,7 @@ import org.bouncycastle.pqc.crypto.mlkem.MLKEMPublicKeyParameters; *
Determinism: FIPS-203 Encaps normally draws {@code m} from a CSPRNG, which cannot run inside a * consensus-critical precompile. We take {@code m} from calldata and drive Bouncy Castle's * ML-KEM.Encaps_internal (K-PKE.Encrypt with explicit coins), so every node computes the identical - * {@code (c, K)}. No cryptography is reimplemented here; the audited Bouncy Castle BCPQC ML-KEM + * {@code (c, K)}. No cryptography is reimplemented here; the Bouncy Castle BCPQC ML-KEM (not FIPS-validated, no published third-party audit known) * implementation on the classpath does the work. */ public class MLKEM768PrecompiledContract extends AbstractPrecompiledContract { diff --git a/precompiles/SHAKE256PrecompiledContract.java b/precompiles/SHAKE256PrecompiledContract.java index d3c87ec..67604aa 100644 --- a/precompiles/SHAKE256PrecompiledContract.java +++ b/precompiles/SHAKE256PrecompiledContract.java @@ -28,7 +28,7 @@ import org.bouncycastle.crypto.digests.SHAKEDigest; * Output: exactly {@code outLen} bytes of SHAKE256(data). * *
SHAKE256 is the hashing bottleneck inside Falcon, ML-DSA and SLH-DSA; exposing it natively lets - * on-chain PQC flows offload the hot path to audited Bouncy Castle rather than hand-rolled Solidity. + * on-chain PQC flows offload the hot path to Bouncy Castle (well-exercised, but not FIPS-validated and with no published third-party audit known) rather than hand-rolled Solidity. */ public class SHAKE256PrecompiledContract extends AbstractPrecompiledContract {