Single part sign for SLHDSA

[hsmguy]

hi team!
Great job on the SLHDSA code.

I see this in slhdsa.c

DISPATCH_SLHDSA_FN(sign_init);
DISPATCH_SLHDSA_FN(sign);
DISPATCH_SLHDSA_FN(verify_init);
DISPATCH_SLHDSA_FN(verify);

So are you implementing single part signing?

I am showing its calling multipart signing only when doing

openssl pkeyutl command line calls

(i pulled from master)

2026-08-05 20:14:13 [966352] t40674e785a7f0000: pkcs11: 000008CC >> C_SignInit
2026-08-05 20:14:13 [966352] t40674e785a7f0000: pkcs11: 000008CC > hSession 0x000008CC
2026-08-05 20:14:13 [966352] t40674e785a7f0000: pkcs11: 000008CC > pMechanism->mechanism 0x0000002E (CKM_SLH_DSA)
2026-08-05 20:14:13 [966352] t40674e785a7f0000: pkcs11: 000008CC > hKey 0x00000460
2026-08-05 20:14:13 [966352] t40674e785a7f0000: pkcs11: 00000000 D NFC__CheckMechanismAllowedGetInfo type 0x0000002E (CKM_SLH_DSA)
2026-08-05 20:14:13 [966352] t40674e785a7f0000: pkcs11: 00000000 D NFC__GetMechanismInfoEx type 0x0000002E (CKM_SLH_DSA)
2026-08-05 20:14:13 [966352] t40674e785a7f0000: pkcs11: 000008CC D NFC__SignInitVerifyPublic ok
2026-08-05 20:14:13 [966352] t40674e785a7f0000: pkcs11: 000008CC < rv 0x00000000 (CKR_OK)
2026-08-05 20:14:13 [966352] t40674e785a7f0000: pkcs11: 000008CC >> NFC_SignUpdate
2026-08-05 20:14:13 [966352] t40674e785a7f0000: pkcs11: 000008CC > ulPartLen 12
2026-08-05 20:14:13 [966352] t40674e785a7f0000: pkcs11: 000008CC Error: Mechanism is single part only
2026-08-05 20:14:13 [966352] t40674e785a7f0000: pkcs11: 000008CC < rv 0x00000070 (CKR_MECHANISM_INVALID)

sooo if your intention was to do single part signing in this release, there may still be an issue?

many thanks for all the work on SLHDSA :-) great feature !!! cheers!

P.S:

for MLDSA sing part sign, I tested on ncipher N5c rack mount hsm and it works good :-)

[hsmguy]

is this all thats needed?

#define SLHDSA_SIGNATURE_FUNCTIONS(variant)
const OSSL_DISPATCH p11prov_slhdsa_##variant##signature_functions[] = {
DISPATCH_SIG_ELEM(slhdsa##variant, NEWCTX, newctx),
DISPATCH_SIG_ELEM(sig, FREECTX, freectx),
DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx),
DISPATCH_SIG_ELEM(slhdsa, SIGN_INIT, sign_init),
DISPATCH_SIG_ELEM(slhdsa, SIGN, sign),
DISPATCH_SIG_ELEM(slhdsa, VERIFY_INIT, verify_init),
DISPATCH_SIG_ELEM(slhdsa, VERIFY, verify),
DISPATCH_SIG_ELEM(slhdsa, DIGEST_SIGN, sign),
DISPATCH_SIG_ELEM(slhdsa, DIGEST_VERIFY, verify),
DISPATCH_SIG_ELEM(slhdsa, DIGEST_SIGN_INIT, digest_sign_init),
DISPATCH_SIG_ELEM(slhdsa, DIGEST_SIGN_UPDATE, digest_sign_update),
DISPATCH_SIG_ELEM(slhdsa, DIGEST_SIGN_FINAL, digest_sign_final),
DISPATCH_SIG_ELEM(slhdsa, DIGEST_VERIFY_INIT, digest_verify_init),
DISPATCH_SIG_ELEM(slhdsa, DIGEST_VERIFY_UPDATE, digest_verify_update),
DISPATCH_SIG_ELEM(slhdsa, DIGEST_VERIFY_FINAL, digest_verify_final),
DISPATCH_MESSAGE_FUNCTIONS DISPATCH_SIG_ELEM(slhdsa, GET_CTX_PARAMS,
get_ctx_params),
DISPATCH_SIG_ELEM(slhdsa, GETTABLE_CTX_PARAMS, gettable_ctx_params),
DISPATCH_SIG_ELEM(slhdsa, SET_CTX_PARAMS, set_ctx_params),
DISPATCH_SIG_ELEM(slhdsa, SETTABLE_CTX_PARAMS, settable_ctx_params),
{ 0, NULL },
}

or needs more????

[hsmguy]

Yep that fixes the single sign :-) that 1 liner hahahah :-)

ok 2 lines 1 for sign and 1 for verify :-)

2026-08-05 20:50:41 [979617] t40f7726bce7f0000: pkcs11: 000008CC < rv 0x00000000 (CKR_OK)
[root@rhel93sw139opssl352 nfast]#
[root@rhel93sw139opssl352 nfast]# cat pkcs11.log | grep " C_"
2026-08-05 20:50:32 [979617]: pkcs11: 00000000 >> C_GetInterface
2026-08-05 20:50:32 [979617]: pkcs11: 00000000 >> C_GetInterfaceList
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 00000000 >> C_GetSlotList
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 00000000 >> C_GetSlotList
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 00000000 >> C_GetSlotInfo
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 00000000 >> C_GetTokenInfo
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 00000000 >> C_OpenSession
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CB >> C_FindObjectsInit
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CB >> C_CloseSession
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 00000000 >> C_GetMechanismList
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 00000000 >> C_GetMechanismList
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 00000000 >> C_GetSlotInfo
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 00000000 D C__update_worldinfo
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 00000000 >> C_GetSlotInfo
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 00000000 D C__update_worldinfo
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 00000000 >> C_OpenSession
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_GetSessionInfo
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_GenerateRandom
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC D C_GenerateRandom remainder 8
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_GetSessionInfo
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_FindObjectsInit
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_FindObjects
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_FindObjects
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_FindObjectsFinal
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_GetAttributeValue
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_GetAttributeValue
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_GetAttributeValue
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_GetAttributeValue
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_GetAttributeValue
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_GetSessionInfo
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_SignInit
2026-08-05 20:50:32 [979617] t40f7726bce7f0000: pkcs11: 000008CC >> C_Sign

:D :D :D

[hsmguy]

woohoo !!! single sign works with adding 2 lines :-)

many thanks for all the SLHDSA work :-) great work Simo and team :-) +500 dogecoins :-)

[root@rhel93sw139opssl352 nfast]# openssl pkeyutl -sign -rawin -inkey "pkcs11:token=accelerator;pin-value=1234;object=slhdsa44" -out workload.sig5 -in workload.txt

[root@rhel93sw139opssl352 nfast]# openssl pkeyutl -verify -in workload.txt -sigfile workload.sig5 -inkey "pkcs11:token=accelerator;pin-value=1234;object=slhdsa44;type=public" -pubin
Signature Verified Successfully