@@ -87,6 +87,8 @@ func TestMLDSASignerVerifierRoundtrip(t *testing.T) {
8787 t .Fatal (err )
8888 }
8989
90+ t .Logf ("s.KeyHash(): %08x, v.KeyHash(): %08x" , s .KeyHash (), v .KeyHash ())
91+
9092 if _ , err := note .Open (n , note .VerifierList (v )); err != nil {
9193 t .Fatal (err )
9294 }
@@ -286,6 +288,74 @@ func TestVKeyToCosignatureV1(t *testing.T) {
286288 if _ , err = note .Open (n , note .VerifierList (v )); err == nil {
287289 t .Errorf ("Expected error trying to open cosigned note with standard vkey, but got success" )
288290 }
291+
292+ // Check that VKeyToCosignatureV1 fails for MLDSA keys.
293+ _ , mlVkey := mustGenerateMLDSAKey (t , "mldsa" )
294+ if _ , err := VKeyToCosignatureV1 (mlVkey ); err == nil {
295+ t .Errorf ("Expected error for MLDSA key in VKeyToCosignatureV1, got success" )
296+ }
297+ }
298+
299+ func TestSubtreeRoundtrip (t * testing.T ) {
300+ skey , vkey := mustGenerateMLDSAKey (t , "mldsa" )
301+
302+ signer , err := NewMLDSASigner (skey )
303+ if err != nil {
304+ t .Fatal (err )
305+ }
306+
307+ verifier , err := NewMLDSAVerifier (vkey )
308+ if err != nil {
309+ t .Fatal (err )
310+ }
311+
312+ origin := "test-log"
313+ var start uint64 = 0
314+ var end uint64 = 10
315+ root := make ([]byte , 32 )
316+ if _ , err := rand .Read (root ); err != nil {
317+ t .Fatal (err )
318+ }
319+ timestamp := uint64 (time .Now ().Unix ())
320+
321+ sig , err := signer .SignSubtree (timestamp , origin , start , end , root )
322+ if err != nil {
323+ t .Fatal (err )
324+ }
325+
326+ if ! verifier .VerifySubtree (timestamp , origin , start , end , root , sig ) {
327+ t .Error ("Failed to verify valid subtree signature" )
328+ }
329+
330+ // Test failure cases
331+ wrongRoot := make ([]byte , 32 )
332+ wrongRoot [0 ] = 1
333+ if verifier .VerifySubtree (timestamp , origin , start , end , wrongRoot , sig ) {
334+ t .Error ("VerifySubtree succeeded with wrong root" )
335+ }
336+
337+ if verifier .VerifySubtree (timestamp , "wrong origin" , start , end , root , sig ) {
338+ t .Error ("VerifySubtree succeeded with wrong origin" )
339+ }
340+ }
341+
342+ func TestMLDSAInvalidTimestamp (t * testing.T ) {
343+ skey , _ := mustGenerateMLDSAKey (t , "mldsa" )
344+ signer , err := NewMLDSASigner (skey )
345+ if err != nil {
346+ t .Fatal (err )
347+ }
348+
349+ origin := "test-log"
350+ var start uint64 = 10 // > 0
351+ var end uint64 = 20
352+ root := make ([]byte , 32 )
353+ timestamp := uint64 (time .Now ().Unix ()) // > 0
354+
355+ _ , err = signer .SignSubtree (timestamp , origin , start , end , root )
356+ if err == nil {
357+ t .Error ("Expected error for invalid timestamp (start > 0 && timestamp > 0), got nil" )
358+ }
289359}
290360
291361func mustGenerateEd25519Key (t * testing.T , name string ) (string , string ) {
0 commit comments