# Package org.bouncycastle.pqc.crypto.faest

Lightweight implementation of FAEST — symmetric-primitive digital signature scheme based on AES and the VOLE-in-the-Head proof system.

See: Description

- Class Summary
  Class | Description
  --- | ---
  FaestKeyGenerationParameters |
  FaestKeyPairGenerator | Implementation of the FAEST asymmetric key pair generator following the FAEST signature scheme specifications.
  FaestParameters | FAEST parameter sets per the v2.0 algorithm specification.
  FaestPrivateKeyParameters | FAEST private key: encoded as `owfInput || owfKey` (matching the upstream `SK_INPUT || SK_KEY` layout).
  FaestPublicKeyParameters | FAEST public key: encoded as `owfInput || owfOutput`.
  FaestSigner | FAEST signature generation and verification engine.

## Package org.bouncycastle.pqc.crypto.faest Description

Lightweight implementation of FAEST — symmetric-primitive digital signature scheme based on AES and the VOLE-in-the-Head proof system. Round 3 candidate of NIST's post-quantum additional signatures process.

## References

- Specification: FAEST v2.0 Algorithm Specifications.
- Reference implementation: faest-sign/faest-ref.

## Parameter sets

Twelve parameter sets per the v2.0 spec, identified by BC-arc OIDs declared in `BCObjectIdentifiers`:

- Base FAEST (AES one-way function): `faest_128s`, `faest_128f`, `faest_192s`, `faest_192f`, `faest_256s`, `faest_256f`.
- FAEST-EM (Even-Mansour one-way function): `faest_em_128s`, `faest_em_128f`, `faest_em_192s`, `faest_em_192f`, `faest_em_256s`, `faest_em_256f`.

The `s` (small) variants minimise signature size at the cost of slower signing/verification; the `f` (fast) variants invert the trade-off.

## Side-channel posture

All FAEST-specific arithmetic (GF(2^λ) and GF(2^8) field ops, byte-combine helpers, constraint primitives, witness expansion, key schedule, top-level prover/verifier) is strictly constant-time: it uses mask-based bit selection and has no secret-indexed table lookups. The AES used internally for the OWF and Even-Mansour round-key derivation runs through `FaestAES`, whose S-box is computed via the bit-serial `BF8#inv` squaring chain rather than a lookup table. The PRG used to expand the BAVC seed tree calls `AESEngine` for performance reasons; that engine clones its S-box on every `init()` call, which BC documents as sufficient to defeat cache-line monitoring of the secret seed material.