Package org.bouncycastle.pqc.crypto.faest

Lightweight implementation of FAEST — symmetric-primitive digital signature scheme based on AES and the VOLE-in-the-Head proof system.

See: Description

Class Summary

Class	Description
FaestKeyGenerationParameters
FaestKeyPairGenerator	Implementation of the FAEST asymmetric key pair generator following the FAEST signature scheme specifications.
FaestParameters	FAEST parameter sets per the v2.0 algorithm specification.
FaestPrivateKeyParameters	FAEST private key: encoded as owfInput || owfKey (matching the upstream SK_INPUT || SK_KEY layout).
FaestPublicKeyParameters	FAEST public key: encoded as owfInput || owfOutput.
FaestSigner	FAEST signature generation and verification engine.

Package org.bouncycastle.pqc.crypto.faest Description

Lightweight implementation of FAEST — symmetric-primitive digital signature scheme based on AES and the VOLE-in-the-Head proof system. Round 3 candidate of NIST's post-quantum additional signatures process.

References

• Specification: FAEST v2.0 Algorithm Specifications.
• Reference implementation: faest-sign/faest-ref.

Parameter sets

Twelve parameter sets per the v2.0 spec, identified by BC-arc OIDs declared in BCObjectIdentifiers:

• Base FAEST (AES one-way function): faest_128s, faest_128f, faest_192s, faest_192f, faest_256s, faest_256f.
• FAEST-EM (Even-Mansour one-way function): faest_em_128s, faest_em_128f, faest_em_192s, faest_em_192f, faest_em_256s, faest_em_256f.

The s (small) variants minimise signature size at the cost of slower signing/verification; the f (fast) variants invert the trade-off.

Side-channel posture

All FAEST-specific arithmetic (GF(2^λ) and GF(2^8) field ops, byte-combine helpers, constraint primitives, witness expansion, key schedule, top-level prover/verifier) is strictly constant-time: it uses mask-based bit selection and has no secret-indexed table lookups. The AES used internally for the OWF and Even-Mansour round-key derivation runs through FaestAES, whose S-box is computed via the bit-serial BF8#inv squaring chain rather than a lookup table. The PRG used to expand the BAVC seed tree calls AESEngine for performance reasons; that engine clones its S-box on every init() call, which BC documents as sufficient to defeat cache-line monitoring of the secret seed material.