| name | pqc-signature-auditor |
| description | Audit post-quantum signature implementations — ML-DSA (FIPS 204), SLH-DSA (FIPS 205), FN-DSA/Falcon (pending standardization), and stateful hash signatures XMSS/LMS/HSS (NIST SP 800-208) — for rejection-sampling correctness, hedged/deterministic signing modes, verification bound enforcement, and one-time-signature state management. Use when reviewing PQ signing, verification, or OTS index/state persistence.
|
| allowed-tools | ["Read","Grep","Glob","Bash"] |
pqc-signature-auditor
Domain auditor for standardized post-quantum signatures, in two families
with different failure modes: stateless schemes (ML-DSA, SLH-DSA, FN-DSA)
where the risks are sampling and bound enforcement, and stateful hash-based
schemes (XMSS/LMS/HSS) where the dominant risk is one-time-key state reuse.
Do not fold ML-KEM/Kyber findings into this skill — KEM review belongs to
pqc-kem-auditor.
When to Use
- Auditing ML-DSA (FIPS 204) signing/verification: rejection sampling,
hint computation, deterministic vs hedged modes
- Auditing SLH-DSA (FIPS 205): FORS/WOTS+ structure, addressing, and
randomizer handling
- Auditing FN-DSA/Falcon implementations (with its standardization status
pinned in source notes — FIPS 206 not yet final)
- Auditing XMSS/LMS/HSS under NIST SP 800-208: OTS index monotonicity,
crash recovery, backup/restore, cloning, and hardware-binding
requirements
When NOT to Use
- ML-KEM/Kyber or any KEM decapsulation review ->
pqc-kem-auditor
- Classical signatures (ECDSA, Schnorr, EdDSA, RSA) ->
signature-scheme-auditor
- Generic lattice parameter/noise design for custom schemes ->
lattice-auditor
- Timing measurement methodology for samplers ->
side-channel-auditor
Core Review Areas
- Parameter-set and version provenance: FIPS 204/205 final vs round-3
Dilithium/SPHINCS+ differences; Falcon flagged as pre-standard
- ML-DSA signing: rejection-sampling loop exactness (norm checks on z,
r0, hint count), iteration bounds, and no leakage of rejected
candidates
- Signing modes: deterministic vs hedged (rnd) handling per FIPS 204;
SLH-DSA opt_rand per FIPS 205; fault posture of deterministic modes
- Verification bounds: every norm/weight/count bound checked (z bound,
hint weight, FORS/WOTS checksum rules) — skipping any bound admits
forgery
- Stateful OTS index management (XMSS/LMS/HSS): monotonic persistent
counter committed BEFORE signature release, crash recovery, backups,
replication, and SP 800-208 hardware-binding requirements
- Encoding/serialization: canonical encodings, length checks, context
strings (FIPS 204/205 ctx parameter) bound correctly
Workflow
Phase 1: Family and version mapping
- Read
references/pqc-signature-checklist.md
- Pin the scheme, parameter set, and spec version; queue
spec-delta-checker for conformance claims
Phase 2: Family-specific review
- Stateless (ML-DSA, SLH-DSA, FN-DSA): execute
workflows/pqc-signature-review.md
- Stateful (XMSS/LMS/HSS): execute
workflows/stateful-hash-signature-review.md
Phase 3: Pattern hunt
- Read
references/finding-patterns.md
- Prioritize skipped verification bounds, rejection-loop shortcuts, and
OTS index rollback paths
Phase 4: Handoff
- Send surviving findings to
crypto-fp-check
- Cross-route sampler leakage to
side-channel-auditor, RNG lifecycle to
randomness-auditor, KEM questions to pqc-kem-auditor
Output Contract
Produce a PQ-signature handoff that includes:
signature_family_and_parameter_setsign_or_verify_pathstate_or_sampling_invariantevidencedisposition (one of verified, false_positive, unverified,
observation, residual_risk)next_route
Reference Index
