PKCS#11 mechanism for External ML-DSA M𝜇 Calculation/Generation

[Hamish77]

#19

• PKCS#11 mechanism with hash value 𝜇 for calculating an ML-DSA signature, also to generate a Mu.
• First draft for discussion still needs changes

[Hamish77]

Decision to split the PR into two Signature of External Mu and generate Mu need to create branch for both.
gen mu params need public key handle rather than value or the hash of public key?

[simo5]

I think we should have a the public key to generate mu, but I think others are open to just passing the bare public key value or even directly the public key hash. It is unclear to me why that is desirable, this is the public key corresponding to the private key that is going to eventually sign the generated mu value, so I would think the public key would easily be loaded once on the generator side and reused over and over to generate MUs to then pass to the other module for signing.

[vdukhovni]

Is leaving HashML-DSA-style external-μ out of the specification a deliberate choice?
I'd have expected to also see an optional DER encoding of the hash OID that if provided implies 1 rather than 0 for the first byte of $M'$ and then gets prepended to the message prehash octets.