Package org.bouncycastle.pqc.crypto.faest
package org.bouncycastle.pqc.crypto.faest
Lightweight implementation of FAEST — symmetric-primitive digital signature
scheme based on AES and the VOLE-in-the-Head proof system. Round 3 candidate of
NIST's post-quantum additional signatures process.
References
- Specification: FAEST v2.0 Algorithm Specifications.
- Reference implementation: faest-sign/faest-ref.
Parameter sets
Twelve parameter sets per the v2.0 spec, identified by BC-arc OIDs declared inBCObjectIdentifiers:
- Base FAEST (AES one-way function):
faest_128s,faest_128f,faest_192s,faest_192f,faest_256s,faest_256f. - FAEST-EM (Even-Mansour one-way function):
faest_em_128s,faest_em_128f,faest_em_192s,faest_em_192f,faest_em_256s,faest_em_256f.
s (small) variants minimise signature size at the cost of slower
signing/verification; the f (fast) variants invert the trade-off.
Side-channel posture
All FAEST-specific arithmetic (GF(2^λ) and GF(2^8) field ops, byte-combine helpers, constraint primitives, witness expansion, key schedule, top-level prover/verifier) is strictly constant-time: it uses mask-based bit selection and has no secret-indexed table lookups. The AES used internally for the OWF and Even-Mansour round-key derivation runs throughFaestAES, whose S-box is
computed via the bit-serial BF8.inv(int) squaring chain rather than a lookup
table. The PRG used to expand the BAVC seed tree calls
AESEngine for performance reasons; that
engine clones its S-box on every init() call, which BC documents as
sufficient to defeat cache-line monitoring of the secret seed material.-
ClassesClassDescriptionImplementation of the FAEST asymmetric key pair generator following the FAEST signature scheme specifications.FAEST parameter sets per the v2.0 algorithm specification.FAEST private key: encoded as
owfInput || owfKey(matching the upstreamSK_INPUT || SK_KEYlayout).FAEST public key: encoded asowfInput || owfOutput.FAEST signature generation and verification engine.