/* wc_slhdsa.c
 *
 * Copyright (C) 2006-2026 wolfSSL Inc.
 *
 * This file is part of wolfSSL.
 *
 * wolfSSL is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * wolfSSL is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
 */

#include <wolfssl/wolfcrypt/libwolfssl_sources.h>

#if FIPS_VERSION3_GE(2,0,0)
    /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
    #define FIPS_NO_WRAPPERS
#endif

#include <wolfssl/wolfcrypt/wc_slhdsa.h>

#ifdef WOLFSSL_HAVE_SLHDSA

#include <wolfssl/wolfcrypt/asn.h>
#include <wolfssl/wolfcrypt/cpuid.h>
#include <wolfssl/wolfcrypt/error-crypt.h>
#ifdef NO_INLINE
    #include <wolfssl/wolfcrypt/misc.h>
#else
    #define WOLFSSL_MISC_INCLUDED
    #include <wolfcrypt/src/misc.c>
#endif
#include <wolfssl/wolfcrypt/hash.h>
#include <wolfssl/wolfcrypt/sha3.h>
#ifdef WOLFSSL_SLHDSA_SHA2
    #include <wolfssl/wolfcrypt/sha256.h>
    #include <wolfssl/wolfcrypt/sha512.h>
    #include <wolfssl/wolfcrypt/hmac.h>
#endif

#ifdef WC_SLHDSA_NO_ASM
    #undef USE_INTEL_SPEEDUP
    #undef WOLFSSL_ARMASM
    #undef WOLFSSL_RISCV_ASM
#endif

#if defined(USE_INTEL_SPEEDUP)
/* CPU information for Intel. */
static cpuid_flags_t cpuid_flags = WC_CPUID_INITIALIZER;
#endif


/* Winternitz number. */
#define SLHDSA_W                16
/* Number of iterations of hashing itself from Winternitz number. */
#define SLHDSA_WM1              (SLHDSA_W - 1)


#ifndef WOLFSSL_SLHDSA_PARAM_NO_256
    /* Maximum size of hash output. */
    #define SLHDSA_MAX_N                32
    #ifndef WOLFSSL_SLHDSA_PARAM_NO_FAST
        /* Maximum number of indices for FORS signatures. */
        #define SLHDSA_MAX_INDICES_SZ   35
    #else
        /* Maximum number of indices for FORS signatures. */
        #define SLHDSA_MAX_INDICES_SZ   22
    #endif
#elif !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
    /* Maximum size of hash output. */
    #define SLHDSA_MAX_N                24
    #ifndef WOLFSSL_SLHDSA_PARAM_NO_FAST
        /* Maximum number of indices for FORS signatures. */
        #define SLHDSA_MAX_INDICES_SZ   33
    #else
        /* Maximum number of indices for FORS signatures. */
        #define SLHDSA_MAX_INDICES_SZ   17
    #endif
#else
    /* Maximum size of hash output. */
    #define SLHDSA_MAX_N                16
    #ifndef WOLFSSL_SLHDSA_PARAM_NO_FAST
        /* Maximum number of indices for FORS signatures. */
        #define SLHDSA_MAX_INDICES_SZ   33
    #else
        /* Maximum number of indices for FORS signatures. */
        #define SLHDSA_MAX_INDICES_SZ   14
    #endif
#endif

#ifndef WOLFSSL_SLHDSA_PARAM_NO_SMALL
    #if !defined(WOLFSSL_SLHDSA_PARAM_NO_256)
        /* Maximum number of trees for FORS. */
        #define SLHDSA_MAX_A            14
    #elif !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
        /* Maximum number of trees for FORS. */
        #define SLHDSA_MAX_A            14
    #else
        /* Maximum number of trees for FORS. */
        #define SLHDSA_MAX_A            12
    #endif
#else
    #if !defined(WOLFSSL_SLHDSA_PARAM_NO_256)
        /* Maximum number of trees for FORS. */
        #define SLHDSA_MAX_A            9
    #elif !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
        /* Maximum number of trees for FORS. */
        #define SLHDSA_MAX_A            8
    #else
        /* Maximum number of trees for FORS. */
        #define SLHDSA_MAX_A            6
    #endif
#endif

#ifndef WOLFSSL_SLHDSA_PARAM_NO_SMALL
    /* Maximum height of Merkle tree. */
    #define SLHDSA_MAX_H_M              9
#else
    /* Maximum height of Merkle tree. */
    #define SLHDSA_MAX_H_M              3
#endif

/* Maximum message size in nibbles. */
#define SLHDSA_MAX_MSG_SZ       ((2 * SLHDSA_MAX_N) + 3)

/* SLH-DSA WOTS+ length: len = len_1 + len_2 = 2*n + 3 (for w=16). The chain
 * helpers below pass loop indices and chain steps through (byte) casts; this
 * assertion documents the invariant they rely on. */
wc_static_assert(SLHDSA_MAX_MSG_SZ <= 255);

/* Number of word64 in the 4-way (x4) SHAKE/Keccak state used by the AVX2
 * hash helpers (25 lanes * 4 ways). Single source for both the buffer
 * declarations and the ForceZero() sizes so they cannot drift. */
#define SLHDSA_SHAKE_X4_STATE_W     (25 * 4)

#ifndef WOLFSSL_SLHDSA_PARAM_NO_256F
    /* Maximum number of bytes to produce from digest of message. */
    #define SLHDSA_MAX_MD               49
#elif !defined(WOLFSSL_SLHDSA_PARAM_NO_256S)
    /* Maximum number of bytes to produce from digest of message. */
    #define SLHDSA_MAX_MD               47
#elif !defined(WOLFSSL_SLHDSA_PARAM_NO_192F)
    /* Maximum number of bytes to produce from digest of message. */
    #define SLHDSA_MAX_MD               42
#elif !defined(WOLFSSL_SLHDSA_PARAM_NO_192S)
    /* Maximum number of bytes to produce from digest of message. */
    #define SLHDSA_MAX_MD               39
#elif !defined(WOLFSSL_SLHDSA_PARAM_NO_128F)
    /* Maximum number of bytes to produce from digest of message. */
    #define SLHDSA_MAX_MD               34
#else
    /* Maximum number of bytes to produce from digest of message. */
    #define SLHDSA_MAX_MD               30
#endif


/******************************************************************************
 * HashAddress
 ******************************************************************************/

/* HashAddress types. */
/* WOTS+ hash. */
#define HA_WOTS_HASH    0
/* WOTS+ Public Key. */
#define HA_WOTS_PK      1
/* XMSS tree. */
#define HA_TREE         2
/* FORS tree. */
#define HA_FORS_TREE    3
/* FORS Root. */
#define HA_FORS_ROOTS   4
/* WOTS Pseudo-random function. */
#define HA_WOTS_PRF     5
/* FORS Pseudo-random function. */
#define HA_FORS_PRF     6

/* Size of an encoded HashAddress. */
#define SLHDSA_HA_SZ    32

/* Initialize a HashAddress.
 *
 * @param [in] a  HashAddress to initialize.
 */
#define HA_Init(a)                  XMEMSET(a, 0, sizeof(HashAddress))
/* Copy a HashAddress.
 *
 * @param [out] a  HashAddress to copy into.
 * @param [in]  b  HashAddress to copy from.
 */
#define HA_Copy(a, b)               XMEMCPY(a, b, sizeof(HashAddress))
/* Set layer address into HashAddress.
 *
 * FIPS 205. Section 4.3. Table 1. Line 1.
 *
 * @param [in] a  HashAddress set.
 * @param [in] l  Layer address.
 */
#define HA_SetLayerAddress(a, l)    (a)[0] = (word32)(l)
/* Set tree address into HashAddress.
 *
 * FIPS 205. Section 4.3. Table 1. Line 2.
 *
 * @param [in] a  HashAddress set.
 * @param [in] t  Tree address.
 */
#define HA_SetTreeAddress(a, t)                                                \
    do { (a)[1] = (t)[0]; (a)[2] = (t)[1]; (a)[3] = (t)[2]; } while (0)
/* Set type and clear following fields.
 *
 * FIPS 205. Section 4.3. Table 1. Line 3.
 *
 * @param [in] a  HashAddress set.
 * @param [in] y  HashAddress type.
 */
#define HA_SetTypeAndClear(a, y)                                               \
    do { (a)[4] = (word32)(y); (a)[5] = 0U; (a)[6] = 0U; (a)[7] = 0U; } while (0)
/* Set type and clear following fields but not Key Pair Address.
 *
 * FIPS 205. Section 4.3. Table 1. Line 3. But don't clear Key Pair Address.
 *
 * @param [in] a  HashAddress set.
 * @param [in] y  HashAddress type.
 */
#define HA_SetTypeAndClearNotKPA(a, y)                                         \
    do { (a)[4] = (word32)(y); (a)[6] = 0U; (a)[7] = 0U; } while (0)
/* Set key pair address into HashAddress.
 *
 * FIPS 205. Section 4.3. Table 1. Line 4.
 *
 * @param [in] a  HashAddress set.
 * @param [in] i  Key pair address.
 */
#define HA_SetKeyPairAddress(a, i)  (a)[5] = (word32)(i)
/* Set chain address into HashAddress.
 *
 * FIPS 205. Section 4.3. Table 1. Line 5.
 *
 * @param [in] a  HashAddress set.
 * @param [in] i  Chain address.
 */
#define HA_SetChainAddress(a, i)    (a)[6] = (word32)(i)
/* Set tree height into HashAddress.
 *
 * FIPS 205. Section 4.3. Table 1. Line 5.
 *
 * @param [in] a  HashAddress set.
 * @param [in] i  Tree height.
 */
#define HA_SetTreeHeight(a, i)      (a)[6] = (word32)(i)
/* Set tree height as big-endian into HashAddress.
 *
 * FIPS 205. Section 4.3. Table 1. Line 5. But encode value big-endian.
 *
 * @param [in] a  HashAddress set.
 * @param [in] i  Tree height.
 */
#define HA_SetTreeHeightBE(a, i)    c32toa((word32)(i), (a) + (6 * 4))
/* Set hash address into HashAddress.
 *
 * FIPS 205. Section 4.3. Table 1. Line 6.
 *
 * @param [in] a  HashAddress set.
 * @param [in] i  Hash address.
 */
#define HA_SetHashAddress(a, i)     (a)[7] = (word32)(i)
/* Set tree index into HashAddress.
 *
 * FIPS 205. Section 4.3. Table 1. Line 6.
 *
 * @param [in] a  HashAddress set.
 * @param [in] i  Tree index.
 */
#define HA_SetTreeIndex(a, i)       (a)[7] = (word32)(i)
/* Copy key pair address from one HashAddress to another.
 *
 * FIPS 205. Section 4.3. Table 1. Line 4 and 7.
 *
 * @param [in] a  HashAddress to copy into.
 * @param [in] b  HashAddress to copy from.
 */
#define HA_CopyKeyPairAddress(a, b) (a)[5] = (b)[5]

/* FIPS 205. Section 4.3. Table 1. Line 8 - Get tree index is not needed as
 * index is set and index value modified before being set again.
 */

/* HashAddress type. */
typedef word32 HashAddress[8];

/* Encode a HashAddress.
 *
 * @param [in]  adrs     HashAddress to encode.
 * @param [out] address  Buffer to encode into.
 */
static void HA_Encode(const word32* adrs, byte* address)
{
#ifndef WOLFSSL_WC_SLHDSA_SMALL
    c32toa(adrs[0], address + (0 * 4));
    c32toa(adrs[1], address + (1 * 4));
    c32toa(adrs[2], address + (2 * 4));
    c32toa(adrs[3], address + (3 * 4));
    c32toa(adrs[4], address + (4 * 4));
    c32toa(adrs[5], address + (5 * 4));
    c32toa(adrs[6], address + (6 * 4));
    c32toa(adrs[7], address + (7 * 4));
#else
    int i;

    for (i = 0; i < 8; i++) {
        c32toa(adrs[i], address + (i * 4));
    }
#endif
}

/******************************************************************************
 * Index Tree - 3 x 32-bit words
 ******************************************************************************/

/* Mask the tree index.
 *
 * @param [in] t     Tree index.
 * @param [in] mask  Mask to apply to index.
 * @return  Masked tree index.
 */
#define INDEX_TREE_MASK(t, mask)    ((t)[2] & (mask))

/* Shift the tree index down by a number of bits.
 *
 * @param [in] t  Tree index.
 * @param [in] b  Number of bits to shift.
 */
#define INDEX_TREE_SHIFT_DOWN(t, b)                     \
    (t)[2] = ((t)[1] << (32 - (b))) | ((t)[2] >> (b));  \
    (t)[1] =                           (t)[1] >> (b);

/******************************************************************************
 * Parameters
 ******************************************************************************/

/* Create parameter entry.
 *
 * Other parameters:
 *   len = 2 * n + 3
 *   dl1 = upper((k * a) / 8)
 *   dl2 = upper((h - (h / d)) / 8)
 *   dl3 = upper(h / (8 * d))
 *   sigLen = Root +     FORS SK + FORS AUTH + d * (XMSS SIG + XMSS AUTH)
 *           (   1 +           k +     k * a + d * (      h2 +       len)) * n
 *
 * @param [in] p    Parameter name.
 * @param [in] n    Hash size in bytes.
 * @param [in] h    Total tree height.
 * @param [in] d    Depth of subtree.
 * @param [in] h_m  Height of message tree - XMSS tree.
 * @param [in] a    Number of authentication nodes.
 * @param [in] k    Number of FORS signatures.
 */
#define SLHDSA_PARAMETERS(p, n, h, d, h_m, a, k)    \
    { (p), (n), (h), (d), (h_m), (a), (k),          \
      2 * (n) + 3,                                  \
      (((k) * (a)) + 7) / 8,                        \
      (((h) - ((h) / (d))) + 7) / 8,                \
      ((h) + ((8 * (d)) - 1)) / (8 * (d)),          \
      (1 + (k) * (1 + (a)) + (d) * ((h_m) + 2*(n) + 3)) * (n) }

/* An array of known parameters.
 *
 * FIPS 205. Section 11. Table 2.
 */
static const SlhDsaParameters SlhDsaParams[] =
{
                                     /*  n,  h,  d, h_m,  a,  k */
#ifndef WOLFSSL_SLHDSA_PARAM_NO_128S
    SLHDSA_PARAMETERS(SLHDSA_SHAKE128S, 16, 63,  7,   9, 12, 14),
#endif
#ifndef WOLFSSL_SLHDSA_PARAM_NO_128F
    SLHDSA_PARAMETERS(SLHDSA_SHAKE128F, 16, 66, 22,   3,  6, 33),
#endif
#ifndef WOLFSSL_SLHDSA_PARAM_NO_192S
    SLHDSA_PARAMETERS(SLHDSA_SHAKE192S, 24, 63,  7,   9, 14, 17),
#endif
#ifndef WOLFSSL_SLHDSA_PARAM_NO_192F
    SLHDSA_PARAMETERS(SLHDSA_SHAKE192F, 24, 66, 22,   3,  8, 33),
#endif
#ifndef WOLFSSL_SLHDSA_PARAM_NO_256S
    SLHDSA_PARAMETERS(SLHDSA_SHAKE256S, 32, 64,  8,   8, 14, 22),
#endif
#ifndef WOLFSSL_SLHDSA_PARAM_NO_256F
    SLHDSA_PARAMETERS(SLHDSA_SHAKE256F, 32, 68, 17,   4,  9, 35),
#endif
#ifdef WOLFSSL_SLHDSA_SHA2
                                     /*  n,  h,  d, h_m,  a,  k */
#ifndef WOLFSSL_SLHDSA_PARAM_NO_SHA2_128S
    SLHDSA_PARAMETERS(SLHDSA_SHA2_128S,  16, 63,  7,   9, 12, 14),
#endif
#ifndef WOLFSSL_SLHDSA_PARAM_NO_SHA2_128F
    SLHDSA_PARAMETERS(SLHDSA_SHA2_128F,  16, 66, 22,   3,  6, 33),
#endif
#ifndef WOLFSSL_SLHDSA_PARAM_NO_SHA2_192S
    SLHDSA_PARAMETERS(SLHDSA_SHA2_192S,  24, 63,  7,   9, 14, 17),
#endif
#ifndef WOLFSSL_SLHDSA_PARAM_NO_SHA2_192F
    SLHDSA_PARAMETERS(SLHDSA_SHA2_192F,  24, 66, 22,   3,  8, 33),
#endif
#ifndef WOLFSSL_SLHDSA_PARAM_NO_SHA2_256S
    SLHDSA_PARAMETERS(SLHDSA_SHA2_256S,  32, 64,  8,   8, 14, 22),
#endif
#ifndef WOLFSSL_SLHDSA_PARAM_NO_SHA2_256F
    SLHDSA_PARAMETERS(SLHDSA_SHA2_256F,  32, 68, 17,   4,  9, 35),
#endif
#endif /* WOLFSSL_SLHDSA_SHA2 */
};

/* Number of parameters in array. */
#define SLHDSA_PARAM_LEN    \
    ((int)(sizeof(SlhDsaParams) / sizeof(SlhDsaParameters)))

/******************************************************************************
 * Hashes
 ******************************************************************************/

#ifndef WOLFSSL_WC_SLHDSA_SMALL
/* Hash three data elements with SHAKE-256.
 *
 * Will be less than WC_SHA3_256_COUNT * 8 bytes of data.
 *
 * @param [in]  shake      SHAKE-256 object.
 * @param [in]  data1      First block of data to hash.
 * @param [in]  data1_len  Length of first block of data.
 * @param [in]  adrs       Unencoded HashAddress.
 * @param [in]  data2      Second block of data to hash.
 * @param [in]  data2_len  Length of second block of data.
 * @param [out] hash       Hash output.
 * @param [in]  hash_len   Length of hash to output in bytes.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_hash_shake_3(wc_Shake* shake, const byte* data1,
    byte data1_len, const word32* adrs, const byte* data2, byte data2_len,
    byte* hash, byte hash_len)
{
#ifdef WOLFSSL_SLHDSA_FULL_HASH
    int ret;
    byte address[SLHDSA_HA_SZ];

    /* Encode hash address. */
    HA_Encode(adrs, address);

    /* Update the SHAKE-256 object with first block of data. */
    ret = wc_Shake256_Update(shake, data1, data1_len);
    if (ret == 0) {
        /* Update the SHAKE-256 object with encoded HashAddress. */
        ret = wc_Shake256_Update(shake, address, SLHDSA_HA_SZ);
    }
    if (ret == 0) {
        /* Update the SHAKE-256 object with second block of data. */
        ret = wc_Shake256_Update(shake, data2, data2_len);
    }
    if (ret == 0) {
        /* Calculate and output hash. */
        ret = wc_Shake256_Final(shake, hash, hash_len);
    }

    return ret;
#elif defined(USE_INTEL_SPEEDUP)
    word64* state = shake->s;
    word8* state8 = (word8*)shake->s;
    word32 o = 0;

    /* Move the first block of data into the state. */
    XMEMCPY(state8 + o, data1, data1_len);
    o += data1_len;
    /* Encode the HashAddress into the state next. */
    HA_Encode(adrs, state8 + o);
    o += SLHDSA_HA_SZ;
    /* Move the second block of data into the state next. */
    XMEMCPY(state8 + o, data2, data2_len);
    o += data2_len;
    /* Place SHAKE end-of-content marker. */
    state8[o] = 0x1f;
    o += 1;
    /* Zero out rest of state. */
    XMEMSET(state8 + o, 0, sizeof(shake->s) - o);
    /* Place SHAKE-256 end-of-data marker. */
    state8[WC_SHA3_256_COUNT * 8 - 1] ^= 0x80;

#ifndef WC_SHA3_NO_ASM
    /* Check availability of AVX2 instructions. */
    if (IS_INTEL_AVX2(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
        /* Process the state using AVX2 instructions. */
        sha3_block_avx2(state);
        RESTORE_VECTOR_REGISTERS();
    }
    /* Check availability of BMI2 instructions. */
    else if (IS_INTEL_BMI2(cpuid_flags)) {
        /* Process the state using BMI2 instructions. */
        sha3_block_bmi2(state);
    }
    else
#endif
    {
        /* Process the state using C code. */
        BlockSha3(state);
    }
    /* Copy hash result, of the required length, from the state into hash. */
    XMEMCPY(hash, shake->s, hash_len);

    return 0;
#else
    /* Copy the first block of data into the cached data buffer. */
    XMEMCPY(shake->t, data1, data1_len);
    /* Encode HashAddress into the cached data buffer next. */
    HA_Encode(adrs, shake->t + data1_len);
    /* Copy the second block of data into the cached data buffer next. */
    XMEMCPY(shake->t + data1_len + SLHDSA_HA_SZ, data2, data2_len);

    /* Update count of bytes cached. */
    shake->i = (byte)(data1_len + SLHDSA_HA_SZ + data2_len);

    /* Calculate and output hash. */
    return wc_Shake256_Final(shake, hash, hash_len);
#endif
}
#endif

/* Hash four data elements with SHAKE-256.
 *
 * Will be less than WC_SHA3_256_COUNT * 8 bytes of data.
 *
 * @param [in]  shake      SHAKE-256 object.
 * @param [in]  data1      First block of data to hash.
 * @param [in]  data1_len  Length of first block of data.
 * @param [in]  adrs       Unencoded HashAddress.
 * @param [in]  data2      Second block of data to hash.
 * @param [in]  data2_len  Length of second block of data.
 * @param [in]  data3      Third block of data to hash.
 * @param [in]  data3_len  Length of third block of data.
 * @param [out] hash       Hash output.
 * @param [in]  hash_len   Length of hash to output in bytes.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_hash_shake_4(wc_Shake* shake, const byte* data1,
    byte data1_len, const word32* adrs, const byte* data2, byte data2_len,
    const byte* data3, byte data3_len, byte* hash, byte hash_len)
{
#ifdef WOLFSSL_SLHDSA_FULL_HASH
    int ret;
    byte address[SLHDSA_HA_SZ];

    /* Encode hash address. */
    HA_Encode(adrs, address);

    /* Update the SHAKE-256 object with first block of data. */
    ret = wc_Shake256_Update(shake, data1, data1_len);
    if (ret == 0) {
        /* Update the SHAKE-256 object with encoded HashAddress. */
        ret = wc_Shake256_Update(shake, address, SLHDSA_HA_SZ);
    }
    if (ret == 0) {
        /* Update the SHAKE-256 object with second block of data. */
        ret = wc_Shake256_Update(shake, data2, data2_len);
    }
    if (ret == 0) {
        /* Update the SHAKE-256 object with third block of data. */
        ret = wc_Shake256_Update(shake, data3, data3_len);
    }
    if (ret == 0) {
        /* Calculate and output hash. */
        ret = wc_Shake256_Final(shake, hash, hash_len);
    }

    return ret;
#elif defined(USE_INTEL_SPEEDUP)
    word64* state = shake->s;
    word8* state8 = (word8*)shake->s;
    word32 o = 0;

    /* Move the first block of data into the state. */
    XMEMCPY(state8 + o, data1, data1_len);
    o += data1_len;
    /* Encode the HashAddress into the state next. */
    HA_Encode(adrs, state8 + o);
    o += SLHDSA_HA_SZ;
    /* Move the second block of data into the state next. */
    XMEMCPY(state8 + o, data2, data2_len);
    o += data2_len;
    /* Move the third block of data into the state next. */
    XMEMCPY(state8 + o, data3, data3_len);
    o += data3_len;
    /* Place SHAKE end-of-content marker. */
    state8[o] = 0x1f;
    o += 1;
    /* Zero out rest of state. */
    XMEMSET(state8 + o, 0, sizeof(shake->s) - o);
    /* Place SHAKE-256 end-of-data marker. */
    state8[WC_SHA3_256_COUNT * 8 - 1] ^= 0x80;

#ifndef WC_SHA3_NO_ASM
    /* Check availability of AVX2 instructions. */
    if (IS_INTEL_AVX2(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
        /* Process the state using AVX2 instructions. */
        sha3_block_avx2(state);
        RESTORE_VECTOR_REGISTERS();
    }
    /* Check availability of BMI2 instructions. */
    else if (IS_INTEL_BMI2(cpuid_flags)) {
        /* Process the state using BMI2 instructions. */
        sha3_block_bmi2(state);
    }
    else
#endif
    {
        /* Process the state using C code. */
        BlockSha3(state);
    }
    /* Copy hash result, of the required length, from the state into hash. */
    XMEMCPY(hash, shake->s, hash_len);

    return 0;
#else
    /* Copy the first block of data into the cached data buffer. */
    XMEMCPY(shake->t, data1, data1_len);
    /* Encode HashAddress into the cached data buffer next. */
    HA_Encode(adrs, shake->t + data1_len);
    /* Copy the second block of data into the cached data buffer next. */
    XMEMCPY(shake->t + data1_len + SLHDSA_HA_SZ, data2, data2_len);
    /* Copy the third block of data into the cached data buffer next. */
    XMEMCPY(shake->t + data1_len + SLHDSA_HA_SZ + data2_len, data3, data3_len);

    /* Update count of bytes cached. */
    shake->i = (byte)(data1_len + SLHDSA_HA_SZ + data2_len + data3_len);

    /* Calculate and output hash. */
    return wc_Shake256_Final(shake, hash, hash_len);
#endif
}

/******************************************************************************
 * SHA2 Hash Functions (FIPS 205, Section 11.2)
 ******************************************************************************/

#ifdef WOLFSSL_SLHDSA_SHA2

/* Size of compressed HashAddress (ADRS^c) per FIPS 205 Section 11.2. */
#define SLHDSA_HAC_SZ   22

/* Encode a compressed HashAddress (ADRS^c).
 *
 * FIPS 205. Section 11.2.
 *   Byte 0:      low byte of adrs[0] (layer)
 *   Bytes 1-8:   adrs[2..3] (low 8 bytes of tree address)
 *   Byte 9:      low byte of adrs[4] (type)
 *   Bytes 10-21: adrs[5..7] (remaining 12 bytes, verbatim)
 *
 * @param [in]  adrs     HashAddress to encode (8 x word32).
 * @param [out] address  Buffer to encode into (22 bytes).
 */
static void HA_Encode_Compressed(const word32* adrs, byte* address)
{
    /* Byte 0: low byte of layer address. */
    address[0] = (byte)adrs[0];
    /* Bytes 1-4: adrs[2] (tree address high word). */
    c32toa(adrs[2], address + 1);
    /* Bytes 5-8: adrs[3] (tree address low word). */
    c32toa(adrs[3], address + 5);
    /* Byte 9: low byte of type. */
    address[9] = (byte)adrs[4];
    /* Bytes 10-13: adrs[5] (key pair address / padding). */
    c32toa(adrs[5], address + 10);
    /* Bytes 14-17: adrs[6] (chain address / tree height). */
    c32toa(adrs[6], address + 14);
    /* Bytes 18-21: adrs[7] (hash address / tree index). */
    c32toa(adrs[7], address + 18);
}

/* Pre-compute SHA2 midstates for PK.seed.
 *
 * SHA-256: PK.seed || pad(64 - n) is exactly one 64-byte block.
 * SHA-512: PK.seed || pad(128 - n) is exactly one 128-byte block.
 *
 * @param [in, out] key  SLH-DSA key with pk_seed set at key->sk[2*n].
 * @return  0 on success.
 */
static int slhdsakey_precompute_sha2_midstates(SlhDsaKey* key)
{
    int ret = 0;
    byte n = key->params->n;
    const byte* pk_seed = key->sk + 2 * n;
    byte block[WC_SHA512_BLOCK_SIZE];

    /* SHA-256 midstate: PK.seed || zeros to fill 64-byte block. */
    XMEMSET(block, 0, WC_SHA256_BLOCK_SIZE);
    XMEMCPY(block, pk_seed, n);
    if (key->hash.sha2.sha256_mid_inited) {
        wc_Sha256Free(&key->hash.sha2.sha256_mid);
        key->hash.sha2.sha256_mid_inited = 0;
    }
    ret = wc_InitSha256(&key->hash.sha2.sha256_mid);
    if (ret == 0) {
        key->hash.sha2.sha256_mid_inited = 1;
        ret = wc_Sha256Update(&key->hash.sha2.sha256_mid, block,
            WC_SHA256_BLOCK_SIZE);
    }

    /* SHA-512 midstate: PK.seed || zeros to fill 128-byte block.
     * Only needed for categories 3 and 5 (n > 16). */
    if ((ret == 0) && (n > 16)) {
        XMEMSET(block, 0, WC_SHA512_BLOCK_SIZE);
        XMEMCPY(block, pk_seed, n);
        if (key->hash.sha2.sha512_mid_inited) {
            wc_Sha512Free(&key->hash.sha2.sha512_mid);
            key->hash.sha2.sha512_mid_inited = 0;
        }
        ret = wc_InitSha512(&key->hash.sha2.sha512_mid);
        if (ret == 0) {
            key->hash.sha2.sha512_mid_inited = 1;
            ret = wc_Sha512Update(&key->hash.sha2.sha512_mid, block,
                WC_SHA512_BLOCK_SIZE);
        }
    }

    return ret;
}

/* SHA2 F function.
 *
 * FIPS 205. Section 11.2.
 *   F(PK.seed, ADRS, M1) = Trunc_n(SHA-256(PK.seed||pad(64-n)||ADRS^c||M1))
 *
 * Uses pre-computed midstate for the first block.
 *
 * @param [in]  key      SLH-DSA key (SHA2 hash objects + midstate).
 * @param [in]  pk_seed  Public key seed (unused - midstate).
 * @param [in]  adrs     HashAddress.
 * @param [in]  m        Message of n bytes.
 * @param [in]  n        Number of bytes in hash output.
 * @param [out] hash     Buffer to hold hash output.
 * @return  0 on success.
 */
static int slhdsakey_hash_f_sha2(SlhDsaKey* key, const byte* pk_seed,
    const word32* adrs, const byte* m, byte n, byte* hash)
{
    int ret;
    byte address[SLHDSA_HAC_SZ];
    byte digest[WC_SHA256_DIGEST_SIZE];

    (void)pk_seed;

    /* Encode compressed address. */
    HA_Encode_Compressed(adrs, address);

    /* Restore SHA-256 midstate. */

    if (key->hash.sha2.sha256_inited) {
        wc_Sha256Free(&key->hash.sha2.sha256);
        key->hash.sha2.sha256_inited = 0;
    }
    ret = wc_Sha256Copy(&key->hash.sha2.sha256_mid, &key->hash.sha2.sha256);
    if (ret == 0) {
        key->hash.sha2.sha256_inited = 1;
        /* Update with compressed ADRS and message. */
        ret = wc_Sha256Update(&key->hash.sha2.sha256, address, SLHDSA_HAC_SZ);
    }
    if (ret == 0) {
        ret = wc_Sha256Update(&key->hash.sha2.sha256, m, n);
    }
    if (ret == 0) {
        ret = wc_Sha256Final(&key->hash.sha2.sha256, digest);
    }
    if (ret == 0) {
        /* Truncate to n bytes. */
        XMEMCPY(hash, digest, n);
    }

    return ret;
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* SHA2 H function.
 *
 * FIPS 205. Section 11.2.
 *   Cat 1: H(PK.seed, ADRS, M2) = Trunc_n(SHA-256(PK.seed||pad||ADRS^c||M2))
 *   Cat 3,5: H(PK.seed, ADRS, M2) = Trunc_n(SHA-512(PK.seed||pad||ADRS^c||M2))
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  pk_seed  Public key seed (unused - midstate).
 * @param [in]  adrs     HashAddress.
 * @param [in]  node     Message of 2n bytes.
 * @param [in]  n        Number of bytes in hash output.
 * @param [out] hash     Buffer to hold hash output.
 * @return  0 on success.
 */
static int slhdsakey_hash_h_sha2(SlhDsaKey* key, const byte* pk_seed,
    const word32* adrs, const byte* node, byte n, byte* hash)
{
    int ret;
    byte address[SLHDSA_HAC_SZ];

    (void)pk_seed;

    /* Encode compressed address. */
    HA_Encode_Compressed(adrs, address);

    if (n == WC_SLHDSA_N_128) {
        /* Category 1: use SHA-256. */
        byte digest[WC_SHA256_DIGEST_SIZE];

        if (key->hash.sha2.sha256_inited) {
            wc_Sha256Free(&key->hash.sha2.sha256);
            key->hash.sha2.sha256_inited = 0;
        }
        ret = wc_Sha256Copy(&key->hash.sha2.sha256_mid,
            &key->hash.sha2.sha256);
        if (ret == 0) {
            key->hash.sha2.sha256_inited = 1;
            ret = wc_Sha256Update(&key->hash.sha2.sha256, address,
                SLHDSA_HAC_SZ);
        }
        if (ret == 0) {
            ret = wc_Sha256Update(&key->hash.sha2.sha256, node, 2U * n);
        }
        if (ret == 0) {
            ret = wc_Sha256Final(&key->hash.sha2.sha256, digest);
        }
        if (ret == 0) {
            XMEMCPY(hash, digest, n);
        }
    }
    else {
        /* Categories 3, 5: use SHA-512. */
        byte digest[WC_SHA512_DIGEST_SIZE];

        if (key->hash.sha2.sha512_inited) {
            wc_Sha512Free(&key->hash.sha2.sha512);
            key->hash.sha2.sha512_inited = 0;
        }
        ret = wc_Sha512Copy(&key->hash.sha2.sha512_mid,
            &key->hash.sha2.sha512);
        if (ret == 0) {
            key->hash.sha2.sha512_inited = 1;
            ret = wc_Sha512Update(&key->hash.sha2.sha512, address,
                SLHDSA_HAC_SZ);
        }
        if (ret == 0) {
            ret = wc_Sha512Update(&key->hash.sha2.sha512, node, 2U * n);
        }
        if (ret == 0) {
            ret = wc_Sha512Final(&key->hash.sha2.sha512, digest);
        }
        if (ret == 0) {
            XMEMCPY(hash, digest, n);
        }
    }

    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* SHA2 H function with two separate n-byte halves.
 *
 * Same as slhdsakey_hash_h_sha2 but M2 = m1 || m2.
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  pk_seed  Public key seed (unused - midstate).
 * @param [in]  adrs     HashAddress.
 * @param [in]  m1       First n bytes of message.
 * @param [in]  m2       Second n bytes of message.
 * @param [in]  n        Number of bytes in hash output.
 * @param [out] hash     Buffer to hold hash output.
 * @return  0 on success.
 */
static int slhdsakey_hash_h_2_sha2(SlhDsaKey* key, const byte* pk_seed,
    const word32* adrs, const byte* m1, const byte* m2, byte n, byte* hash)
{
    int ret;
    byte address[SLHDSA_HAC_SZ];

    (void)pk_seed;

    /* Encode compressed address. */
    HA_Encode_Compressed(adrs, address);

    if (n == WC_SLHDSA_N_128) {
        /* Category 1: use SHA-256. */
        byte digest[WC_SHA256_DIGEST_SIZE];

        if (key->hash.sha2.sha256_inited) {
            wc_Sha256Free(&key->hash.sha2.sha256);
            key->hash.sha2.sha256_inited = 0;
        }
        ret = wc_Sha256Copy(&key->hash.sha2.sha256_mid,
            &key->hash.sha2.sha256);
        if (ret == 0) {
            key->hash.sha2.sha256_inited = 1;
            ret = wc_Sha256Update(&key->hash.sha2.sha256, address,
                SLHDSA_HAC_SZ);
        }
        if (ret == 0) {
            ret = wc_Sha256Update(&key->hash.sha2.sha256, m1, n);
        }
        if (ret == 0) {
            ret = wc_Sha256Update(&key->hash.sha2.sha256, m2, n);
        }
        if (ret == 0) {
            ret = wc_Sha256Final(&key->hash.sha2.sha256, digest);
        }
        if (ret == 0) {
            XMEMCPY(hash, digest, n);
        }
    }
    else {
        /* Categories 3, 5: use SHA-512. */
        byte digest[WC_SHA512_DIGEST_SIZE];

        if (key->hash.sha2.sha512_inited) {
            wc_Sha512Free(&key->hash.sha2.sha512);
            key->hash.sha2.sha512_inited = 0;
        }
        ret = wc_Sha512Copy(&key->hash.sha2.sha512_mid,
            &key->hash.sha2.sha512);
        if (ret == 0) {
            key->hash.sha2.sha512_inited = 1;
            ret = wc_Sha512Update(&key->hash.sha2.sha512, address,
                SLHDSA_HAC_SZ);
        }
        if (ret == 0) {
            ret = wc_Sha512Update(&key->hash.sha2.sha512, m1, n);
        }
        if (ret == 0) {
            ret = wc_Sha512Update(&key->hash.sha2.sha512, m2, n);
        }
        if (ret == 0) {
            ret = wc_Sha512Final(&key->hash.sha2.sha512, digest);
        }
        if (ret == 0) {
            XMEMCPY(hash, digest, n);
        }
    }

    return ret;
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* SHA2 PRF function.
 *
 * FIPS 205. Section 11.2.
 *   PRF(PK.seed, SK.seed, ADRS) =
 *       Trunc_n(SHA-256(PK.seed || pad(64-n) || ADRS^c || SK.seed))
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  pk_seed  Public key seed (unused - midstate).
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  adrs     HashAddress.
 * @param [in]  n        Number of bytes in hash output.
 * @param [out] hash     Buffer to hold hash output.
 * @return  0 on success.
 */
static int slhdsakey_hash_prf_sha2(SlhDsaKey* key, const byte* pk_seed,
    const byte* sk_seed, const word32* adrs, byte n, byte* hash)
{
    int ret;
    byte address[SLHDSA_HAC_SZ];
    byte digest[WC_SHA256_DIGEST_SIZE];

    (void)pk_seed;

    /* Encode compressed address. */
    HA_Encode_Compressed(adrs, address);

    /* Restore SHA-256 midstate. */
    if (key->hash.sha2.sha256_inited) {
        wc_Sha256Free(&key->hash.sha2.sha256);
        key->hash.sha2.sha256_inited = 0;
    }
    ret = wc_Sha256Copy(&key->hash.sha2.sha256_mid, &key->hash.sha2.sha256);
    if (ret == 0) {
        key->hash.sha2.sha256_inited = 1;
        ret = wc_Sha256Update(&key->hash.sha2.sha256, address, SLHDSA_HAC_SZ);
    }
    if (ret == 0) {
        ret = wc_Sha256Update(&key->hash.sha2.sha256, sk_seed, n);
    }
    if (ret == 0) {
        ret = wc_Sha256Final(&key->hash.sha2.sha256, digest);
    }
    if (ret == 0) {
        XMEMCPY(hash, digest, n);
    }

    /* digest holds the secret PRF output (WOTS+/FORS key). */
    ForceZero(digest, sizeof(digest));
    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* SHA2 T_l streaming: start with address.
 *
 * Restores midstate then updates with compressed ADRS.
 *
 * @param [in] key      SLH-DSA key.
 * @param [in] pk_seed  Public key seed (unused - midstate).
 * @param [in] adrs     HashAddress.
 * @param [in] n        Number of bytes of hash output (determines cat).
 * @return  0 on success.
 */
static int slhdsakey_hash_start_addr_sha2(SlhDsaKey* key,
    const byte* pk_seed, const word32* adrs, byte n)
{
    int ret;
    byte address[SLHDSA_HAC_SZ];

    (void)pk_seed;

    HA_Encode_Compressed(adrs, address);

    if (n == WC_SLHDSA_N_128) {
        /* Category 1: SHA-256 -- use sha256_2 (T_l must not collide with
         * sha256 which is used by F and H). */
        if (key->hash.sha2.sha256_2_inited) {
            wc_Sha256Free(&key->hash.sha2.sha256_2);
            key->hash.sha2.sha256_2_inited = 0;
        }
        ret = wc_Sha256Copy(&key->hash.sha2.sha256_mid,
            &key->hash.sha2.sha256_2);
        if (ret == 0) {
            key->hash.sha2.sha256_2_inited = 1;
            ret = wc_Sha256Update(&key->hash.sha2.sha256_2, address,
                SLHDSA_HAC_SZ);
        }
    }
    else {
        /* Categories 3, 5: SHA-512 -- use sha512_2 (T_l must not collide
         * with sha512 which is used by H). */
        if (key->hash.sha2.sha512_2_inited) {
            wc_Sha512Free(&key->hash.sha2.sha512_2);
            key->hash.sha2.sha512_2_inited = 0;
        }
        ret = wc_Sha512Copy(&key->hash.sha2.sha512_mid,
            &key->hash.sha2.sha512_2);
        if (ret == 0) {
            key->hash.sha2.sha512_2_inited = 1;
            ret = wc_Sha512Update(&key->hash.sha2.sha512_2, address,
                SLHDSA_HAC_SZ);
        }
    }

    return ret;
}

/* SHA2 T_l streaming: update with data.
 *
 * @param [in] key   SLH-DSA key.
 * @param [in] data  Data to hash.
 * @param [in] len   Length of data.
 * @return  0 on success.
 */
static int slhdsakey_hash_update_sha2(SlhDsaKey* key, const byte* data,
    word32 len)
{
    if (key->params->n == WC_SLHDSA_N_128) {
        return wc_Sha256Update(&key->hash.sha2.sha256_2, data, len);
    }
    else {
        return wc_Sha512Update(&key->hash.sha2.sha512_2, data, len);
    }
}

/* SHA2 T_l streaming: finalize.
 *
 * @param [in]  key   SLH-DSA key.
 * @param [out] hash  Output buffer.
 * @param [in]  len   Desired output length (truncate to n).
 * @return  0 on success.
 */
static int slhdsakey_hash_final_sha2(SlhDsaKey* key, byte* hash, word32 len)
{
    int ret;
    byte n = key->params->n;

    if (n == WC_SLHDSA_N_128) {
        byte digest[WC_SHA256_DIGEST_SIZE];
        ret = wc_Sha256Final(&key->hash.sha2.sha256_2, digest);
        if (ret == 0) {
            XMEMCPY(hash, digest, (len < n) ? len : n);
        }
    }
    else {
        byte digest[WC_SHA512_DIGEST_SIZE];
        ret = wc_Sha512Final(&key->hash.sha2.sha512_2, digest);
        if (ret == 0) {
            XMEMCPY(hash, digest, (len < n) ? len : n);
        }
    }

    return ret;
}

/* SHA2 T_l streaming: free internal allocations.
 *
 * @param [in]  key   SLH-DSA key.
 */
static void slhdsakey_hash_free_sha2(SlhDsaKey* key)
{
    byte n = key->params->n;

    if (n == WC_SLHDSA_N_128) {
        wc_Sha256Free(&key->hash.sha2.sha256_2);
        key->hash.sha2.sha256_2_inited = 0;
    }
    else {
        wc_Sha512Free(&key->hash.sha2.sha512_2);
        key->hash.sha2.sha512_2_inited = 0;
    }

    return;
}

/* Local MGF1 implementation for H_msg.
 *
 * FIPS 205. Section 11.2.
 *   H_msg uses MGF1-SHA-256/512(R || PK.seed || digest, m) where m is the
 *   required output length.
 *
 * @param [in]  key       SLH-DSA key (for hash objects).
 * @param [in]  seed      Seed data for MGF1.
 * @param [in]  seedLen   Length of seed.
 * @param [out] out       Output buffer.
 * @param [in]  outLen    Required output length.
 * @return  0 on success.
 */
static int slhdsakey_mgf1_sha2(SlhDsaKey* key, const byte* seed,
    word32 seedLen, byte* out, word32 outLen)
{
    int ret = 0;
    word32 counter = 0;
    word32 done = 0;
    byte n = key->params->n;

    while ((ret == 0) && (done < outLen)) {
        byte cBuf[4];
        word32 left = outLen - done;

        c32toa(counter, cBuf);

        if (n == WC_SLHDSA_N_128) {
            /* Category 1: MGF1-SHA-256. */
            byte digest[WC_SHA256_DIGEST_SIZE];
            word32 cpLen = (left < WC_SHA256_DIGEST_SIZE) ?
                left : WC_SHA256_DIGEST_SIZE;

            if (! key->hash.sha2.sha256_2_inited) {
                ret = wc_InitSha256(&key->hash.sha2.sha256_2);
                if (ret == 0)
                    key->hash.sha2.sha256_2_inited = 1;
            }
            if (ret == 0) {
                ret = wc_Sha256Update(&key->hash.sha2.sha256_2, seed, seedLen);
            }
            if (ret == 0) {
                ret = wc_Sha256Update(&key->hash.sha2.sha256_2, cBuf, 4);
            }
            if (ret == 0) {
                ret = wc_Sha256Final(&key->hash.sha2.sha256_2, digest);
            }
            if (ret == 0) {
                XMEMCPY(out + done, digest, cpLen);
                done += cpLen;
            }
        }
        else {
            /* Categories 3, 5: MGF1-SHA-512. */
            byte digest[WC_SHA512_DIGEST_SIZE];
            word32 cpLen = (left < WC_SHA512_DIGEST_SIZE) ?
                left : WC_SHA512_DIGEST_SIZE;

            if (! key->hash.sha2.sha512_2_inited) {
                ret = wc_InitSha512(&key->hash.sha2.sha512_2);
                if (ret == 0)
                    key->hash.sha2.sha512_2_inited = 1;
            }
            if (ret == 0) {
                ret = wc_Sha512Update(&key->hash.sha2.sha512_2, seed, seedLen);
            }
            if (ret == 0) {
                ret = wc_Sha512Update(&key->hash.sha2.sha512_2, cBuf, 4);
            }
            if (ret == 0) {
                ret = wc_Sha512Final(&key->hash.sha2.sha512_2, digest);
            }
            if (ret == 0) {
                XMEMCPY(out + done, digest, cpLen);
                done += cpLen;
            }
        }
        counter++;
    }

    return ret;
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* SHA2 PRF_msg function.
 *
 * FIPS 205. Section 11.2.
 *   PRF_msg(SK.prf, opt_rand, M) =
 *       Trunc_n(HMAC-SHA-256/512(SK.prf, opt_rand || M))
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sk_prf   SK.prf seed.
 * @param [in]  opt_rand Random or PK.seed.
 * @param [in]  hdr      Message header (2 bytes).
 * @param [in]  ctx      Context data (may be NULL).
 * @param [in]  ctxSz    Context data length.
 * @param [in]  msg      Message data.
 * @param [in]  msgSz    Message data length.
 * @param [in]  n        Number of bytes in hash output.
 * @param [out] hash     Buffer to hold hash output.
 * @return  0 on success.
 */
static int slhdsakey_prf_msg_sha2(SlhDsaKey* key, const byte* sk_prf,
    const byte* opt_rand, const byte* hdr, const byte* ctx, byte ctxSz,
    const byte* msg, word32 msgSz, byte n, byte* hash)
{
    int ret;
    Hmac hmac;
    int hmacType;
    byte digest[WC_SHA512_DIGEST_SIZE];

    if (n == WC_SLHDSA_N_128) {
        hmacType = WC_SHA256;
    }
    else {
        hmacType = WC_SHA512;
    }

    ret = wc_HmacInit(&hmac, key->heap, INVALID_DEVID);
    if (ret == 0) {
        ret = wc_HmacSetKey(&hmac, hmacType, sk_prf, n);
    }
    if (ret == 0) {
        ret = wc_HmacUpdate(&hmac, opt_rand, n);
    }
    if ((ret == 0) && (hdr != NULL)) {
        ret = wc_HmacUpdate(&hmac, hdr, 2);
    }
    if ((ret == 0) && (ctxSz > 0) && (ctx != NULL)) {
        ret = wc_HmacUpdate(&hmac, ctx, ctxSz);
    }
    if (ret == 0) {
        ret = wc_HmacUpdate(&hmac, msg, msgSz);
    }
    if (ret == 0) {
        ret = wc_HmacFinal(&hmac, digest);
    }
    wc_HmacFree(&hmac);

    if (ret == 0) {
        XMEMCPY(hash, digest, n);
    }

    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* SHA2 H_msg function.
 *
 * FIPS 205. Section 11.2.
 *   H_msg(R, PK.seed, PK.root, M) = MGF1-SHA-256/512(
 *       R || PK.seed || SHA-256/512(R || PK.seed || PK.root || M), m)
 *
 * @param [in]  key    SLH-DSA key.
 * @param [in]  r      Randomizer (n bytes from signature).
 * @param [in]  hdr    Message header (2 bytes).
 * @param [in]  ctx    Context data (may be NULL).
 * @param [in]  ctxSz  Context data length.
 * @param [in]  msg    Message data.
 * @param [in]  msgSz  Message data length.
 * @param [out] md     Output message digest.
 * @param [in]  mdLen  Required digest length (dl1+dl2+dl3).
 * @return  0 on success.
 */
static int slhdsakey_h_msg_sha2(SlhDsaKey* key, const byte* r,
    const byte* hdr, const byte* ctx, byte ctxSz, const byte* msg,
    word32 msgSz, byte* md, word32 mdLen)
{
    int ret = 0;
    byte n = key->params->n;
    const byte* pk_seed = key->sk + 2 * n;
    const byte* pk_root = key->sk + 3 * n;

    if (n == WC_SLHDSA_N_128) {
        /* Category 1: SHA-256 + MGF1-SHA-256. */
        byte innerHash[WC_SHA256_DIGEST_SIZE];
        /* Seed for MGF1: R || PK.seed || innerHash. */
        byte mgfSeed[32 + 16 + WC_SHA256_DIGEST_SIZE];

        /* Step 1: innerHash = SHA-256(R || PK.seed || PK.root || M). */
        if (! key->hash.sha2.sha256_2_inited) {
            ret = wc_InitSha256(&key->hash.sha2.sha256_2);
            if (ret == 0)
                key->hash.sha2.sha256_2_inited = 1;
        }
        if (ret == 0) {
            ret = wc_Sha256Update(&key->hash.sha2.sha256_2, r, n);
        }
        if (ret == 0) {
            ret = wc_Sha256Update(&key->hash.sha2.sha256_2, pk_seed, n);
        }
        if (ret == 0) {
            ret = wc_Sha256Update(&key->hash.sha2.sha256_2, pk_root, n);
        }
        if ((ret == 0) && (hdr != NULL)) {
            ret = wc_Sha256Update(&key->hash.sha2.sha256_2, hdr, 2);
        }
        if ((ret == 0) && (ctxSz > 0) && (ctx != NULL)) {
            ret = wc_Sha256Update(&key->hash.sha2.sha256_2, ctx, ctxSz);
        }
        if (ret == 0) {
            ret = wc_Sha256Update(&key->hash.sha2.sha256_2, msg, msgSz);
        }
        if (ret == 0) {
            ret = wc_Sha256Final(&key->hash.sha2.sha256_2, innerHash);
        }

        /* Step 2: MGF1-SHA-256(R || PK.seed || innerHash, mdLen). */
        if (ret == 0) {
            XMEMCPY(mgfSeed, r, n);
            XMEMCPY(mgfSeed + n, pk_seed, n);
            XMEMCPY(mgfSeed + 2 * n, innerHash, WC_SHA256_DIGEST_SIZE);
            ret = slhdsakey_mgf1_sha2(key, mgfSeed,
                2U * n + WC_SHA256_DIGEST_SIZE, md, mdLen);
        }
    }
    else {
        /* Categories 3, 5: SHA-512 + MGF1-SHA-512. */
        byte innerHash[WC_SHA512_DIGEST_SIZE];
        /* Seed for MGF1: R || PK.seed || innerHash. */
        byte mgfSeed[32 + 32 + WC_SHA512_DIGEST_SIZE];

        /* Step 1: innerHash = SHA-512(R || PK.seed || PK.root || M). */
        if (! key->hash.sha2.sha512_2_inited) {
            ret = wc_InitSha512(&key->hash.sha2.sha512_2);
            if (ret == 0)
                key->hash.sha2.sha512_2_inited = 1;
        }
        if (ret == 0) {
            ret = wc_Sha512Update(&key->hash.sha2.sha512_2, r, n);
        }
        if (ret == 0) {
            ret = wc_Sha512Update(&key->hash.sha2.sha512_2, pk_seed, n);
        }
        if (ret == 0) {
            ret = wc_Sha512Update(&key->hash.sha2.sha512_2, pk_root, n);
        }
        if ((ret == 0) && (hdr != NULL)) {
            ret = wc_Sha512Update(&key->hash.sha2.sha512_2, hdr, 2);
        }
        if ((ret == 0) && (ctxSz > 0) && (ctx != NULL)) {
            ret = wc_Sha512Update(&key->hash.sha2.sha512_2, ctx, ctxSz);
        }
        if (ret == 0) {
            ret = wc_Sha512Update(&key->hash.sha2.sha512_2, msg, msgSz);
        }
        if (ret == 0) {
            ret = wc_Sha512Final(&key->hash.sha2.sha512_2, innerHash);
        }

        /* Step 2: MGF1-SHA-512(R || PK.seed || innerHash, mdLen). */
        if (ret == 0) {
            XMEMCPY(mgfSeed, r, n);
            XMEMCPY(mgfSeed + n, pk_seed, n);
            XMEMCPY(mgfSeed + 2 * n, innerHash, WC_SHA512_DIGEST_SIZE);
            ret = slhdsakey_mgf1_sha2(key, mgfSeed,
                2U * n + WC_SHA512_DIGEST_SIZE, md, mdLen);
        }
    }

    return ret;
}

#endif /* WOLFSSL_SLHDSA_SHA2 */

/******************************************************************************
 * Dispatching Hash Macros
 ******************************************************************************/

/* When WOLFSSL_SLHDSA_SHA2 is defined, macros dispatch between SHAKE and SHA2
 * based on the key's parameter set. When not defined, macros call SHAKE
 * directly (zero overhead). */

#ifdef WOLFSSL_SLHDSA_SHA2

/* SHAKE wrapper functions for SHA2 dispatch macros. */
static int slhdsakey_hash_f_shake(SlhDsaKey* key, const byte* pk_seed,
    const word32* adrs, const byte* m, byte n, byte* hash)
{
#ifndef WOLFSSL_WC_SLHDSA_SMALL
    return slhdsakey_hash_shake_3(&key->hash.shk.shake, pk_seed, n, adrs, m,
        n, hash, n);
#else
    return slhdsakey_hash_shake_4(&key->hash.shk.shake, pk_seed, n, adrs, m,
        n, NULL, 0, hash, n);
#endif
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
static int slhdsakey_hash_h_shake(SlhDsaKey* key, const byte* pk_seed,
    const word32* adrs, const byte* node, byte n, byte* hash)
{
#ifndef WOLFSSL_WC_SLHDSA_SMALL
    return slhdsakey_hash_shake_3(&key->hash.shk.shake, pk_seed, n, adrs, node,
        (byte)(2 * n), hash, n);
#else
    return slhdsakey_hash_shake_4(&key->hash.shk.shake, pk_seed, n, adrs, node,
        (byte)(2 * n), NULL, 0, hash, n);
#endif
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

static int slhdsakey_hash_h_2_shake(SlhDsaKey* key, const byte* pk_seed,
    const word32* adrs, const byte* m1, const byte* m2, byte n, byte* hash)
{
    return slhdsakey_hash_shake_4(&key->hash.shk.shake, pk_seed, n, adrs, m1,
        n, m2, n, hash, n);
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
static int slhdsakey_hash_prf_shake(SlhDsaKey* key, const byte* pk_seed,
    const byte* sk_seed, const word32* adrs, byte n, byte* hash)
{
#ifndef WOLFSSL_WC_SLHDSA_SMALL
    return slhdsakey_hash_shake_3(&key->hash.shk.shake, pk_seed, n, adrs,
        sk_seed, n, hash, n);
#else
    return slhdsakey_hash_shake_4(&key->hash.shk.shake, pk_seed, n, adrs,
        sk_seed, n, NULL, 0, hash, n);
#endif
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

#define HASH_PRF(k, pk_seed, sk_seed, adrs, n, o)                            \
    (SLHDSA_IS_SHA2((k)->params->param) ?                                    \
        slhdsakey_hash_prf_sha2(k, pk_seed, sk_seed, adrs, n, o) :          \
        slhdsakey_hash_prf_shake(k, pk_seed, sk_seed, adrs, n, o))

#define HASH_F(k, pk_seed, adrs, m, n, o)                                   \
    (SLHDSA_IS_SHA2((k)->params->param) ?                                    \
        slhdsakey_hash_f_sha2(k, pk_seed, adrs, m, n, o) :                  \
        slhdsakey_hash_f_shake(k, pk_seed, adrs, m, n, o))

#define HASH_H(k, pk_seed, adrs, node, n, o)                                \
    (SLHDSA_IS_SHA2((k)->params->param) ?                                    \
        slhdsakey_hash_h_sha2(k, pk_seed, adrs, node, n, o) :               \
        slhdsakey_hash_h_shake(k, pk_seed, adrs, node, n, o))

#define HASH_H_2(k, pk_seed, adrs, m1, m2, n, o)                            \
    (SLHDSA_IS_SHA2((k)->params->param) ?                                    \
        slhdsakey_hash_h_2_sha2(k, pk_seed, adrs, m1, m2, n, o) :           \
        slhdsakey_hash_h_2_shake(k, pk_seed, adrs, m1, m2, n, o))

#else /* !WOLFSSL_SLHDSA_SHA2 */

#ifndef WOLFSSL_WC_SLHDSA_SMALL
/* PRF hash.
 *
 * FIPS 205. Section 4.1.
 *   PRF(PK.seed, SK.seed, ADRS) (Bn x Bn x B32 -> Bn) is a PRF that is used to
 *   generate the secret values in WOTS+ and FORS private keys.
 * FIPS 205. Section 11.1.
 *   PRF(PK.seed, SK.seed, ADRS) = SHAKE256(PK.seed || ADRS || SK.seed, 8n)
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  adrs     HashAddress.
 * @param [in]  n        Number of bytes in hash output.
 * @param [out] hash     Buffer to hold hash output.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 */
#define HASH_PRF(k, pk_seed, sk_seed, adrs, n, o)                            \
    slhdsakey_hash_shake_3(&(k)->hash.shk.shake, pk_seed, n, adrs,           \
        sk_seed, n, o, n)
/* Hash F. */
#define HASH_F(k, pk_seed, adrs, m, n, o)                                    \
    slhdsakey_hash_shake_3(&(k)->hash.shk.shake, pk_seed, n, adrs, m, n,    \
        o, n)
/* Hash H. */
#define HASH_H(k, pk_seed, adrs, node, n, o)                                \
    slhdsakey_hash_shake_3(&(k)->hash.shk.shake, pk_seed, n, adrs, node,    \
        (byte)(2 * (n)), o, (n))
#else
/* PRF hash. */
#define HASH_PRF(k, pk_seed, sk_seed, adrs, n, o)                           \
    slhdsakey_hash_shake_4(&(k)->hash.shk.shake, pk_seed, n, adrs,          \
        sk_seed, n, NULL, 0, o, n)
/* Hash F. */
#define HASH_F(k, pk_seed, adrs, m, n, o)                                   \
    slhdsakey_hash_shake_4(&(k)->hash.shk.shake, pk_seed, n, adrs, m, n,   \
        NULL, 0, o, n)
/* Hash H. */
#define HASH_H(k, pk_seed, adrs, node, n, o)                                \
    slhdsakey_hash_shake_4(&(k)->hash.shk.shake, pk_seed, n, adrs, node,   \
        (byte)(2 * (n)), NULL, 0, o, n)
#endif

/* Hash H with 2n byte message as two separate n byte parameters. */
#define HASH_H_2(k, pk_seed, adrs, m1, m2, n, o)                            \
    slhdsakey_hash_shake_4(&(k)->hash.shk.shake, pk_seed, n, adrs, m1, n,  \
        m2, n, o, n)

#endif /* WOLFSSL_SLHDSA_SHA2 */

/* T_l streaming dispatch macros for the secondary hash (used by WOTS+ pk
 * compression and FORS root computation). */
#ifdef WOLFSSL_SLHDSA_SHA2

#define HASH_T_START_ADDR(k, pk_seed, adrs, n)                              \
    (SLHDSA_IS_SHA2((k)->params->param) ?                                    \
        slhdsakey_hash_start_addr_sha2(k, pk_seed, adrs, n) :               \
        slhdsakey_hash_start_addr(&(k)->hash.shk.shake2, pk_seed, adrs, n))

#define HASH_T_UPDATE(k, d, l)                                               \
    (SLHDSA_IS_SHA2((k)->params->param) ?                                    \
        slhdsakey_hash_update_sha2(k, d, l) :                                \
        slhdsakey_hash_update(&(k)->hash.shk.shake2, d, l))

#define HASH_T_FINAL(k, o, l)                                                \
    (SLHDSA_IS_SHA2((k)->params->param) ?                                    \
        slhdsakey_hash_final_sha2(k, o, l) :                                 \
        slhdsakey_hash_final(&(k)->hash.shk.shake2, o, l))

#define HASH_T_FREE(k)                                                       \
    (SLHDSA_IS_SHA2((k)->params->param) ?                                    \
        slhdsakey_hash_free_sha2(k) :                                        \
        slhdsakey_hash_free(&(k)->hash.shk.shake2))

#else

#define HASH_T_START_ADDR(k, pk_seed, adrs, n)                               \
    slhdsakey_hash_start_addr(&(k)->hash.shk.shake2, pk_seed, adrs, n)

#define HASH_T_UPDATE(k, d, l)                                               \
    slhdsakey_hash_update(&(k)->hash.shk.shake2, d, l)

#define HASH_T_FINAL(k, o, l)                                                \
    slhdsakey_hash_final(&(k)->hash.shk.shake2, o, l)

#define HASH_T_FREE(k)                                                       \
    slhdsakey_hash_free(&(k)->hash.shk.shake2)

#endif /* WOLFSSL_SLHDSA_SHA2 */

/* Start hashing with SHAKE-256.
 *
 * @param [in] shake  SHAKE-256 object.
 * @param [in] data   First block of data to hash.
 * @param [in] len    Length in bytes of first block of data.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_hash_start(wc_Shake* shake, const byte* data, byte len)
{
#if defined(USE_INTEL_SPEEDUP)
    /* Clear state for new hash. */
    XMEMSET(shake->s, 0, sizeof(shake->s));
#endif
#ifdef WOLFSSL_SLHDSA_FULL_HASH
    /* Update the hash. */
    return wc_Shake256_Update(shake, data, len);
#else
    /* Copy the data to hash into the cache and update cached length. */
    XMEMCPY(shake->t, data, len);
    shake->i = (byte)len;

    return 0;
#endif
}

/* Start hashing with SHAKE-256. HashAddress to update too.
 *
 * @param [in] shake    SHAKE-256 object.
 * @param [in] pk_seed  Public key seed - a hash output.
 * @param [in] adrs     HashAddress.
 * @param [in] n        Number of bytes in hash output.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_hash_start_addr(wc_Shake* shake, const byte* pk_seed,
    const word32* adrs, byte n)
{
#ifdef WOLFSSL_SLHDSA_FULL_HASH
    int ret;
    byte address[SLHDSA_HA_SZ];

    /* Encode HashAddress. */
    HA_Encode(adrs, address);

#if defined(USE_INTEL_SPEEDUP)
    /* Clear state for new hash. */
    XMEMSET(shake->s, 0, sizeof(shake->s));
#endif
    /* Update the hash with the public key seed. */
    ret = wc_Shake256_Update(shake, pk_seed, n);
    if (ret == 0) {
        /* Update the hash with the encoded HashAddress. */
        ret = wc_Shake256_Update(shake, address, SLHDSA_HA_SZ);
    }

    return ret;
#else
#if defined(USE_INTEL_SPEEDUP)
    /* Clear state for new hash. */
    XMEMSET(shake->s, 0, sizeof(shake->s));
#endif
    /* Copy the data to hash into the cache and update cached length. */
    XMEMCPY(shake->t, pk_seed, n);
    HA_Encode(adrs, shake->t + n);
    shake->i = (byte)(n + SLHDSA_HA_SZ);

    return 0;
#endif
}

/* Update the hash with more data.
 *
 * @param [in] shake  SHAKE-256 object.
 * @param [in] data   Block of data to hash.
 * @param [in] len    Length in bytes of first block of data.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_hash_update(wc_Shake* shake, const byte* data, word32 len)
{
    return wc_Shake256_Update(shake, data, len);
}

/* Calculate and output hash.
 *
 * @param [in]  shake  SHAKE-256 object.
 * @param [out] hash   Hash output.
 * @param [in]  len    Length of hash to output in bytes.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_hash_final(wc_Shake* shake, byte* hash, word32 len)
{
    return wc_Shake256_Final(shake, hash, len);
}

/* Free internal resources.
 *
 * @param [in]  shake  SHAKE-256 object.
 */
static void slhdsakey_hash_free(wc_Shake* shake)
{
    wc_Shake256_Free(shake);
}

/******************************************************************************
 * Conversion functions
 ******************************************************************************/

/* Convert array of bytes to array of b-bit values.
 *
 * b is 6, 8, 9, 12 or 14.
 *
 * FIPS 205. Section 4.4. Algorithm 4.
 * base_2b(X, b, out_len)
 *   1: in <- 0
 *   2: bits <- 0
 *   3: total <- 0
 *   4: for out from 0 to out_len - 1 do
 *   5:     while bits < b do
 *   6:         total <- (total << 8) + X[in]
 *   7:         in <- in + 1
 *   8:         bits <- bits + 8
 *   9:     end while
 *  10:     bits <- bits - b
 *  11:     baseb[out] <- (total >> bits mod 2^b
 *  12: end for
 *  13: return baseb
 *
 * @param [in]  x       Array of bytes.
 * @param [in]  b       Number of bits.
 * @param [in]  outLen  Length of output array.
 * @param [out] baseb   Array of b-bit values.
 */
static void slhdsakey_base_2b(const byte* x, byte b, byte outLen, word16* baseb)
{
    int j;
    int i = 0;
    int bits = 0;
    int total = 0;
    word16 mask = (word16)((1 << b) - 1);

    for (j = 0; j < outLen; j++) {
        while (bits < b) {
            total = (total << 8) + x[i++];
            bits += 8;
        }
        bits -= b;
        baseb[j] = (word16)((total >> bits) & mask);
    }
}

/******************************************************************************
 * WOTS+
 ******************************************************************************/

/* Iterate the hash function s times.
 *
 * FIPS 205. Section 5. Algorithm 5.
 * chain(X, i, s, PK.seed, ADRS)
 *   1: tmp <- X
 *   2: for j from i to i + s - 1 do
 *   3:     ADRS.setHashAddress(j)
 *   4:     tmp <- F(PK.seed, ADRS, tmp
 *   5: end for
 *   6: return tmp
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  x        n-byte string.
 * @param [in]  i        Start index iterations.
 * @param [in]  s        Number of times to iterate.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     HashAddress.
 * @param [out] node     Hash output - n bytes.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_chain(SlhDsaKey* key, const byte* x, byte i, byte s,
    const byte* pk_seed, word32* adrs, byte* node)
{
    int ret = 0;
    int j;
    byte n = key->params->n;

    /* When no steps, copy. */
    if (s == 0) {
        /* Only copy when input and output buffers different. */
        if (x != node) {
            XMEMCPY(node, x, n);
        }
    }
    else {
        /* Set the hash address for first iteration. */
        HA_SetHashAddress(adrs, i);
        /* First iteration of hash using input and writing to output buffers. */
        ret = HASH_F(key, pk_seed, adrs, x, n, node);
        if (ret == 0) {
            for (j = i + 1; j < i + s; j++) {
                /* Set the hash address. */
                HA_SetHashAddress(adrs, j);
                /* Iterate hash using output buffer as input. */
                ret = HASH_F(key, pk_seed, adrs, node, n, node);
                if (ret != 0) {
                    break;
                }
            }
        }
    }

    return ret;
}

#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
#ifndef WOLFSSL_SLHDSA_PARAM_NO_128
/* Set into SHAKE-256 x4 state the 16-byte seed and encoded HashAddress.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      seed   Seed at start of each hash.
 * @param [in]      addr   Encoded HashAddress for each hash.
 */
#define SHAKE256_SET_SEED_HA_X4_16(state, seed, addr)                       \
do {                                                                        \
    /* Set 4 copies of the seed 64-bits at a time. */                       \
    (state)[0] = (state)[1] = (state)[2] = (state)[3] =                     \
                        readUnalignedWord64((seed) + (0 * sizeof(word64))); \
    (state)[4] = (state)[5] = (state)[6] = (state)[7] =                     \
                        readUnalignedWord64((seed) + (1 * sizeof(word64))); \
    /* 32 bytes copied 8 bytes at a time. */                                \
    (state)[ 8] = (state)[ 9] = (state)[10] = (state)[11] =                 \
                        readUnalignedWord64((addr) + (0 * sizeof(word64))); \
    (state)[12] = (state)[13] = (state)[14] = (state)[15] =                 \
                        readUnalignedWord64((addr) + (1 * sizeof(word64))); \
    (state)[16] = (state)[17] = (state)[18] = (state)[19] =                 \
                        readUnalignedWord64((addr) + (2 * sizeof(word64))); \
    (state)[20] = (state)[21] = (state)[22] = (state)[23] =                 \
                        readUnalignedWord64((addr) + (3 * sizeof(word64))); \
} while (0)

/* Append to SHAKE-256 x4 state the 16-byte hash.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      hash   Hash data for each hash.
 */
#define SHAKE256_SET_HASH_X4_16(state, hash)                                \
do {                                                                        \
    (state)[24] = ((word64*)((hash) + 0 * 16))[0];                          \
    (state)[25] = ((word64*)((hash) + 1 * 16))[0];                          \
    (state)[26] = ((word64*)((hash) + 2 * 16))[0];                          \
    (state)[27] = ((word64*)((hash) + 3 * 16))[0];                          \
    (state)[28] = ((word64*)((hash) + 0 * 16))[1];                          \
    (state)[29] = ((word64*)((hash) + 1 * 16))[1];                          \
    (state)[30] = ((word64*)((hash) + 2 * 16))[1];                          \
    (state)[31] = ((word64*)((hash) + 3 * 16))[1];                          \
} while (0)

/* Get the four SHAKE-256 16-byte hash results.
 *
 * @param [in]  state  SHAKE-256 x4 state.
 * @param [out] hash   Hash buffer to hold 4 16-byte hash results.
 */
#define SHAKE256_GET_HASH_X4_16(state, hash)                                \
do {                                                                        \
    ((word64*)((hash) + 0 * 16))[0] = (state)[0];                           \
    ((word64*)((hash) + 1 * 16))[0] = (state)[1];                           \
    ((word64*)((hash) + 2 * 16))[0] = (state)[2];                           \
    ((word64*)((hash) + 3 * 16))[0] = (state)[3];                           \
    ((word64*)((hash) + 0 * 16))[1] = (state)[4];                           \
    ((word64*)((hash) + 1 * 16))[1] = (state)[5];                           \
    ((word64*)((hash) + 2 * 16))[1] = (state)[6];                           \
    ((word64*)((hash) + 3 * 16))[1] = (state)[7];                           \
} while (0)
#endif

#ifndef WOLFSSL_SLHDSA_PARAM_NO_192
/* Set into SHAKE-256 x4 state the 24-byte seed and encoded HashAddress.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      seed   Seed at start of each hash.
 * @param [in]      addr   Encoded HashAddress for each hash.
 */
#define SHAKE256_SET_SEED_HA_X4_24(state, seed, addr)                       \
do {                                                                        \
    (state)[0] = (state)[1] = (state)[ 2] = (state)[ 3] =                   \
                        readUnalignedWord64((seed) + (0 * sizeof(word64))); \
    (state)[4] = (state)[5] = (state)[ 6] = (state)[ 7] =                   \
                        readUnalignedWord64((seed) + (1 * sizeof(word64))); \
    (state)[8] = (state)[9] = (state)[10] = (state)[11] =                   \
                        readUnalignedWord64((seed) + (2 * sizeof(word64))); \
    /* 32 bytes copied 8 bytes at a time. */                                \
    (state)[12] = (state)[13] = (state)[14] = (state)[15] =                 \
                        readUnalignedWord64((addr) + (0 * sizeof(word64))); \
    (state)[16] = (state)[17] = (state)[18] = (state)[19] =                 \
                        readUnalignedWord64((addr) + (1 * sizeof(word64))); \
    (state)[20] = (state)[21] = (state)[22] = (state)[23] =                 \
                        readUnalignedWord64((addr) + (2 * sizeof(word64))); \
    (state)[24] = (state)[25] = (state)[26] = (state)[27] =                 \
                        readUnalignedWord64((addr) + (3 * sizeof(word64))); \
} while (0)

/* Append to SHAKE-256 x4 state the 24-byte hash.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      hash   Hash data for each hash.
 */
#define SHAKE256_SET_HASH_X4_24(state, hash)                                \
do {                                                                        \
    (state)[28] = ((word64*)((hash) + 0 * 24))[0];                          \
    (state)[29] = ((word64*)((hash) + 1 * 24))[0];                          \
    (state)[30] = ((word64*)((hash) + 2 * 24))[0];                          \
    (state)[31] = ((word64*)((hash) + 3 * 24))[0];                          \
    (state)[32] = ((word64*)((hash) + 0 * 24))[1];                          \
    (state)[33] = ((word64*)((hash) + 1 * 24))[1];                          \
    (state)[34] = ((word64*)((hash) + 2 * 24))[1];                          \
    (state)[35] = ((word64*)((hash) + 3 * 24))[1];                          \
    (state)[36] = ((word64*)((hash) + 0 * 24))[2];                          \
    (state)[37] = ((word64*)((hash) + 1 * 24))[2];                          \
    (state)[38] = ((word64*)((hash) + 2 * 24))[2];                          \
    (state)[39] = ((word64*)((hash) + 3 * 24))[2];                          \
} while (0)

/* Get the four SHAKE-256 24-byte (hash) results.
 *
 * @param [in]  state  SHAKE-256 x4 state.
 * @param [out] hash   Hash buffer to hold 4 24-byte hash results.
 */
#define SHAKE256_GET_HASH_X4_24(state, hash)                                \
do {                                                                        \
    ((word64*)((hash) + 0 * 24))[0] = (state)[ 0];                          \
    ((word64*)((hash) + 1 * 24))[0] = (state)[ 1];                          \
    ((word64*)((hash) + 2 * 24))[0] = (state)[ 2];                          \
    ((word64*)((hash) + 3 * 24))[0] = (state)[ 3];                          \
    ((word64*)((hash) + 0 * 24))[1] = (state)[ 4];                          \
    ((word64*)((hash) + 1 * 24))[1] = (state)[ 5];                          \
    ((word64*)((hash) + 2 * 24))[1] = (state)[ 6];                          \
    ((word64*)((hash) + 3 * 24))[1] = (state)[ 7];                          \
    ((word64*)((hash) + 0 * 24))[2] = (state)[ 8];                          \
    ((word64*)((hash) + 1 * 24))[2] = (state)[ 9];                          \
    ((word64*)((hash) + 2 * 24))[2] = (state)[10];                          \
    ((word64*)((hash) + 3 * 24))[2] = (state)[11];                          \
} while (0)
#endif

#ifndef WOLFSSL_SLHDSA_PARAM_NO_256
/* Set into SHAKE-256 x4 state the 32-byte seed and encoded HashAddress.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      seed   Seed at start of each hash.
 * @param [in]      addr   Encoded HashAddress for each hash.
 */
#define SHAKE256_SET_SEED_HA_X4_32(state, seed, addr)                       \
do {                                                                        \
    (state)[ 0] = (state)[ 1] = (state)[ 2] = (state)[ 3] =                 \
                        readUnalignedWord64((seed) + (0 * sizeof(word64))); \
    (state)[ 4] = (state)[ 5] = (state)[ 6] = (state)[ 7] =                 \
                        readUnalignedWord64((seed) + (1 * sizeof(word64))); \
    (state)[ 8] = (state)[ 9] = (state)[10] = (state)[11] =                 \
                        readUnalignedWord64((seed) + (2 * sizeof(word64))); \
    (state)[12] = (state)[13] = (state)[14] = (state)[15] =                 \
                        readUnalignedWord64((seed) + (3 * sizeof(word64))); \
    /* 32 bytes copied 8 bytes at a time. */                                \
    (state)[16] = (state)[17] = (state)[18] = (state)[19] =                 \
                        readUnalignedWord64((addr) + (0 * sizeof(word64))); \
    (state)[20] = (state)[21] = (state)[22] = (state)[23] =                 \
                        readUnalignedWord64((addr) + (1 * sizeof(word64))); \
    (state)[24] = (state)[25] = (state)[26] = (state)[27] =                 \
                        readUnalignedWord64((addr) + (2 * sizeof(word64))); \
    (state)[28] = (state)[29] = (state)[30] = (state)[31] =                 \
                        readUnalignedWord64((addr) + (3 * sizeof(word64))); \
} while (0)

/* Append to SHAKE-256 x4 state the 32-byte hash.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      hash   Hash data for each hash.
 */
#define SHAKE256_SET_HASH_X4_32(state, hash)                                \
do {                                                                        \
    (state)[32] = ((word64*)((hash) + 0 * 32))[0];                          \
    (state)[33] = ((word64*)((hash) + 1 * 32))[0];                          \
    (state)[34] = ((word64*)((hash) + 2 * 32))[0];                          \
    (state)[35] = ((word64*)((hash) + 3 * 32))[0];                          \
    (state)[36] = ((word64*)((hash) + 0 * 32))[1];                          \
    (state)[37] = ((word64*)((hash) + 1 * 32))[1];                          \
    (state)[38] = ((word64*)((hash) + 2 * 32))[1];                          \
    (state)[39] = ((word64*)((hash) + 3 * 32))[1];                          \
    (state)[40] = ((word64*)((hash) + 0 * 32))[2];                          \
    (state)[41] = ((word64*)((hash) + 1 * 32))[2];                          \
    (state)[42] = ((word64*)((hash) + 2 * 32))[2];                          \
    (state)[43] = ((word64*)((hash) + 3 * 32))[2];                          \
    (state)[44] = ((word64*)((hash) + 0 * 32))[3];                          \
    (state)[45] = ((word64*)((hash) + 1 * 32))[3];                          \
    (state)[46] = ((word64*)((hash) + 2 * 32))[3];                          \
    (state)[47] = ((word64*)((hash) + 3 * 32))[3];                          \
} while (0)

/* Get the four SHAKE-256 32-byte hash results.
 *
 * @param [in]  state  SHAKE-256 x4 state.
 * @param [out] hash   Hash buffer to hold 4 32-byte hash results.
 */
#define SHAKE256_GET_HASH_X4_32(state, hash)                                \
do {                                                                        \
    ((word64*)((hash) + 0 * 32))[0] = (state)[ 0];                          \
    ((word64*)((hash) + 1 * 32))[0] = (state)[ 1];                          \
    ((word64*)((hash) + 2 * 32))[0] = (state)[ 2];                          \
    ((word64*)((hash) + 3 * 32))[0] = (state)[ 3];                          \
    ((word64*)((hash) + 0 * 32))[1] = (state)[ 4];                          \
    ((word64*)((hash) + 1 * 32))[1] = (state)[ 5];                          \
    ((word64*)((hash) + 2 * 32))[1] = (state)[ 6];                          \
    ((word64*)((hash) + 3 * 32))[1] = (state)[ 7];                          \
    ((word64*)((hash) + 0 * 32))[2] = (state)[ 8];                          \
    ((word64*)((hash) + 1 * 32))[2] = (state)[ 9];                          \
    ((word64*)((hash) + 2 * 32))[2] = (state)[10];                          \
    ((word64*)((hash) + 3 * 32))[2] = (state)[11];                          \
    ((word64*)((hash) + 0 * 32))[3] = (state)[12];                          \
    ((word64*)((hash) + 1 * 32))[3] = (state)[13];                          \
    ((word64*)((hash) + 2 * 32))[3] = (state)[14];                          \
    ((word64*)((hash) + 3 * 32))[3] = (state)[15];                          \
} while (0)
#endif

/* Set the end of the SHAKE256 x4 state.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      o      Offset to end of data.
 */
#define SHAKE256_SET_END_X4(state, o)                                       \
do {                                                                        \
    /* Data end marker. */                                                  \
    (state)[(o) + 0] = (word64)0x1f;                                        \
    (state)[(o) + 1] = (word64)0x1f;                                        \
    (state)[(o) + 2] = (word64)0x1f;                                        \
    (state)[(o) + 3] = (word64)0x1f;                                        \
    XMEMSET((state) + (o) + 4, 0,                                           \
        (size_t)(SLHDSA_SHAKE_X4_STATE_W - ((o) + 4)) * sizeof(word64));    \
    /* SHAKE-256 (state) end marker. */                                     \
    ((word8*)((state) + 4 * WC_SHA3_256_COUNT - 4))[7] ^= 0x80;             \
    ((word8*)((state) + 4 * WC_SHA3_256_COUNT - 3))[7] ^= 0x80;             \
    ((word8*)((state) + 4 * WC_SHA3_256_COUNT - 2))[7] ^= 0x80;             \
    ((word8*)((state) + 4 * WC_SHA3_256_COUNT - 1))[7] ^= 0x80;             \
} while (0)

/* Set into SHAKE-256 x4 state the n-byte seed and encoded HashAddress.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      seed   Seed at start of each hash.
 * @param [in]      addr   Encoded HashAddress for each hash.
 * @param [in]      n      Number of bytes of seed.
 * @return  Offset after seed and HashAddress.
 */
static word32 slhdsakey_shake256_set_seed_ha_x4(word64* state,
    const byte* seed, const byte* addr, int n)
{
    int i;
    word32 o = 0;

    /* Set 4 copies of the seed 64-bits at a time. */
    for (i = 0; i < n; i += 8) {
        state[o + 0] = state[o + 1] = state[o + 2] = state[o + 3] =
                readUnalignedWord64(seed + i);
        o += 4;
    }
    /* 32 bytes copied 8 bytes at a time. */
    for (i = 0; i < SLHDSA_HA_SZ; i += 8) {
        state[o + 0] = state[o + 1] = state[o + 2] = state[o + 3] =
            readUnalignedWord64(addr + i);
        o += 4;
    }

    return o;
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Fill out SHAKE-256 x4 state with n-byte seed, encoded HashAddress and hash.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      seed   Seed at start of each hash.
 * @param [in]      addr   Encoded HashAddress for each hash.
 * @param [in]      hash   Hash data to put into each hash.
 * @param [in]      n      Number of bytes of seed.
 * @return  Offset after seed and HashAddress.
 */
static word32 slhdsakey_shake256_set_seed_ha_hash_x4(word64* state,
    const byte* seed, const byte* addr, const byte* hash, int n)
{
    int i;
    word32 o;
    word32 ret;

    ret = o = slhdsakey_shake256_set_seed_ha_x4(state, seed, addr, n);
    for (i = 0; i < n; i += 8) {
        state[o + 0] = state[o + 1] = state[o + 2] = state[o + 3] =
            readUnalignedWord64(hash + i);
        o += 4;
    }

    SHAKE256_SET_END_X4(state, o);

    return ret;
}
#endif /* WOLFSSL_SLHDSA_VERIFY_ONLY */

/* Get the four SHAKE-256 n-byte hash results.
 *
 * @param [in]  state  SHAKE-256 x4 state.
 * @param [out] hash   Hash buffer to hold 4 n-byte hash results.
 * @param [in]  n      Length of each hash in bytes.
 */
static void slhdsakey_shake256_get_hash_x4(const word64* state, byte* hash,
    int n)
{
    int i;

    for (i = 0; i < (n / 8); i++) {
        ((word64*)(hash + 0 * n))[i] = state[4 * i + 0];
        ((word64*)(hash + 1 * n))[i] = state[4 * i + 1];
        ((word64*)(hash + 2 * n))[i] = state[4 * i + 2];
        ((word64*)(hash + 3 * n))[i] = state[4 * i + 3];
    }
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Set the chain address into the SHAKE-256 x4 state.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      o      Offset of state after HashAddress.
 * @param [in]      a      Value to set that increments for each hash.
 */
#define SHAKE256_SET_CHAIN_ADDRESS(state, o, a)                             \
do {                                                                        \
    ((word8*)((state) + (o) - 4))[3] = (word8)((a) + 0);                    \
    ((word8*)((state) + (o) - 3))[3] = (word8)((a) + 1);                    \
    ((word8*)((state) + (o) - 2))[3] = (word8)((a) + 2);                    \
    ((word8*)((state) + (o) - 1))[3] = (word8)((a) + 3);                    \
} while (0)
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* Set the chain address indices into the SHAKE-256 x4 state.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      o      Offset of state after HashAddress.
 * @param [in]      idx    Indices to set for each hash.
 */
#define SHAKE256_SET_CHAIN_ADDRESS_IDX(state, o, idx)                       \
do {                                                                        \
    ((word8*)((state) + (o) - 4))[3] = (idx)[0];                            \
    ((word8*)((state) + (o) - 3))[3] = (idx)[1];                            \
    ((word8*)((state) + (o) - 2))[3] = (idx)[2];                            \
    ((word8*)((state) + (o) - 1))[3] = (idx)[3];                            \
} while (0)

/* Set the hash address into the SHAKE-256 x4 state.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      (o)      Offset of state after HashAddress.
 * @param [in]      a      Value to set for each hash.
 */
#define SHAKE256_SET_HASH_ADDRESS(state, o, a)                              \
do {                                                                        \
    ((word8*)((state) + (o) - 4))[7] = (word8)(a);                          \
    ((word8*)((state) + (o) - 3))[7] = (word8)(a);                          \
    ((word8*)((state) + (o) - 2))[7] = (word8)(a);                          \
    ((word8*)((state) + (o) - 1))[7] = (word8)(a);                          \
} while (0)

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Set the tree index into the SHAKE-256 x4 state.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      (o)      Offset of state after HashAddress.
 * @param [in]      ti     Value to encode that increments for each hash.
 */
#define SHAKE256_SET_TREE_INDEX(state, o, ti)                               \
do {                                                                        \
    c32toa((word32)((ti) + 0), (byte*)&((word32*)((state) + (o) - 4))[1]);  \
    c32toa((word32)((ti) + 1), (byte*)&((word32*)((state) + (o) - 3))[1]);  \
    c32toa((word32)((ti) + 2), (byte*)&((word32*)((state) + (o) - 2))[1]);  \
    c32toa((word32)((ti) + 3), (byte*)&((word32*)((state) + (o) - 1))[1]);  \
} while (0)
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* Set the tree indices into the SHAKE-256 x4 state.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      (o)      Offset of state after HashAddress.
 * @param [in]      ti     Indices to encode for each hash.
 */
#define SHAKE256_SET_TREE_INDEX_IDX(state, o, ti)                           \
do {                                                                        \
    c32toa((ti)[0], (byte*)&((word32*)((state) + (o) - 4))[1]);             \
    c32toa((ti)[1], (byte*)&((word32*)((state) + (o) - 3))[1]);             \
    c32toa((ti)[2], (byte*)&((word32*)((state) + (o) - 2))[1]);             \
    c32toa((ti)[3], (byte*)&((word32*)((state) + (o) - 1))[1]);             \
} while (0)

/* Set the tree height into the SHAKE-256 x4 state.
 *
 * @param [in, out] state  SHAKE-256 x4 state.
 * @param [in]      (o)      Offset of state after HashAddress.
 * @param [in]      ti     Value to encode for each hash.
 */
#define SHAKE256_SET_TREE_HEIGHT(state, o, th)                              \
do {                                                                        \
    c32toa((th), (byte*)&((word32*)((state) + (o) - 4))[0]);                \
    c32toa((th), (byte*)&((word32*)((state) + (o) - 3))[0]);                \
    c32toa((th), (byte*)&((word32*)((state) + (o) - 2))[0]);                \
    c32toa((th), (byte*)&((word32*)((state) + (o) - 1))[0]);                \
} while (0)

#ifndef WOLFSSL_SLHDSA_PARAM_NO_128
/* Iterate the hash function s times with 4 hashes when n=16.
 *
 * FIPS 205. Section 5. Algorithm 5.
 * chain(X, i, s, PK.seed, ADRS)
 *   1: tmp <- X
 *   2: for j from i to i + s - 1 do
 *   3:     ADRS.setHashAddress(j)
 *   4:     tmp <- F(PK.seed, ADRS, tmp
 *   5: end for
 *   6: return tmp
 *
 * @param [in, out] sk       4 hashes to iterate.
 * @param [in]      i        Start index iterations.
 * @param [in]      s        Number of times to iterate.
 * @param [in]      pk_seed  Public key seed.
 * @param [in]      addr     Encoded HashAddress.
 * @param [in]      idx      Indices for chain address.
 * @param [in]      heap     Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_chain_idx_x4_16(byte* sk, word32 i, word32 s,
    const byte* pk_seed, byte* addr, byte* idx, void* heap)
{
    int ret = 0;
    word32 j;
    WC_DECLARE_VAR(fixed, word64, 6 * 4, heap);
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(fixed, word64, 6 * 4, heap, DYNAMIC_TYPE_SLHDSA,
        ret = MEMORY_E);
    if (ret == 0) {
        WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
            DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    }
    if (ret == 0) {
        SHAKE256_SET_SEED_HA_X4_16(fixed, pk_seed, addr);
        SHAKE256_SET_CHAIN_ADDRESS_IDX(fixed, 24, idx);
        SHAKE256_SET_HASH_X4_16(state, sk);

        for (j = i; j < i + s; j++) {
            if (j != i) {
                XMEMCPY(state + 24, state, 16 * 4);
            }
            XMEMCPY(state, fixed, (6 * 4) * sizeof(word64));
            SHAKE256_SET_HASH_ADDRESS(state, 24, j);
            SHAKE256_SET_END_X4(state, 32);
            ret = SAVE_VECTOR_REGISTERS2();
            if (ret != 0)
                break;
            sha3_blocksx4_avx2(state);
            RESTORE_VECTOR_REGISTERS();
        }

        if (ret == 0)
            SHAKE256_GET_HASH_X4_16(state, sk);
    }

    /* state holds the secret WOTS+ chain value; guard against a NULL state
     * after an allocation failure (WOLFSSL_SMALL_STACK). */
    if (WC_VAR_OK(state)) {
        ForceZero(state, sizeof(word64) * SLHDSA_SHAKE_X4_STATE_W);
    }
    WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    WC_FREE_VAR_EX(fixed, heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif
#ifndef WOLFSSL_SLHDSA_PARAM_NO_192
/* Iterate the hash function s times with 4 hashes when n=24.
 *
 * FIPS 205. Section 5. Algorithm 5.
 * chain(X, i, s, PK.seed, ADRS)
 *   1: tmp <- X
 *   2: for j from i to i + s - 1 do
 *   3:     ADRS.setHashAddress(j)
 *   4:     tmp <- F(PK.seed, ADRS, tmp
 *   5: end for
 *   6: return tmp
 *
 * @param [in, out] sk       4 hashes to iterate.
 * @param [in]      i        Start index iterations.
 * @param [in]      s        Number of times to iterate.
 * @param [in]      pk_seed  Public key seed.
 * @param [in]      addr     Encoded HashAddress.
 * @param [in]      idx      Indices for chain address.
 * @param [in]      heap     Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_chain_idx_x4_24(byte* sk, word32 i, word32 s,
    const byte* pk_seed, byte* addr, byte* idx, void* heap)
{
    int ret = 0;
    word32 j;
    WC_DECLARE_VAR(fixed, word64, 7 * 4, heap);
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(fixed, word64, 7 * 4, heap, DYNAMIC_TYPE_SLHDSA,
        ret = MEMORY_E);
    if (ret == 0) {
        WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
            DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    }
    if (ret == 0) {
        SHAKE256_SET_SEED_HA_X4_24(fixed, pk_seed, addr);
        SHAKE256_SET_CHAIN_ADDRESS_IDX(fixed, 28, idx);
        SHAKE256_SET_HASH_X4_24(state, sk);

        for (j = i; j < i + s; j++) {
            if (j != i) {
                XMEMCPY(state + 28, state, 24 * 4);
            }
            XMEMCPY(state, fixed, 28 * sizeof(word64));
            SHAKE256_SET_HASH_ADDRESS(state, 28, j);
            SHAKE256_SET_END_X4(state, 40);
            ret = SAVE_VECTOR_REGISTERS2();
            if (ret != 0)
                break;
            sha3_blocksx4_avx2(state);
            RESTORE_VECTOR_REGISTERS();
        }

        if (ret == 0)
            SHAKE256_GET_HASH_X4_24(state, sk);
    }

    /* state holds the secret WOTS+ chain value; guard against a NULL state
     * after an allocation failure (WOLFSSL_SMALL_STACK). */
    if (WC_VAR_OK(state)) {
        ForceZero(state, sizeof(word64) * SLHDSA_SHAKE_X4_STATE_W);
    }
    WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    WC_FREE_VAR_EX(fixed, heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif
#ifndef WOLFSSL_SLHDSA_PARAM_NO_256
/* Iterate the hash function s times with 4 hashes when n=32.
 *
 * FIPS 205. Section 5. Algorithm 5.
 * chain(X, i, s, PK.seed, ADRS)
 *   1: tmp <- X
 *   2: for j from i to i + s - 1 do
 *   3:     ADRS.setHashAddress(j)
 *   4:     tmp <- F(PK.seed, ADRS, tmp
 *   5: end for
 *   6: return tmp
 *
 * @param [in, out] sk       4 hashes to iterate.
 * @param [in]      i        Start index iterations.
 * @param [in]      s        Number of times to iterate.
 * @param [in]      pk_seed  Public key seed.
 * @param [in]      addr     Encoded HashAddress.
 * @param [in]      idx      Indices for chain address.
 * @param [in]      heap     Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_chain_idx_x4_32(byte* sk, word32 i, word32 s,
    const byte* pk_seed, byte* addr, byte* idx, void* heap)
{
    int ret = 0;
    word32 j;
    WC_DECLARE_VAR(fixed, word64, 8 * 4, heap);
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(fixed, word64, 8 * 4, heap, DYNAMIC_TYPE_SLHDSA,
        ret = MEMORY_E);
    if (ret == 0) {
        WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
            DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    }
    if (ret == 0) {
        SHAKE256_SET_SEED_HA_X4_32(fixed, pk_seed, addr);
        SHAKE256_SET_CHAIN_ADDRESS_IDX(fixed, 32, idx);
        SHAKE256_SET_HASH_X4_32(state, sk);

        for (j = i; j < i + s; j++) {
            if (j != i) {
                XMEMCPY(state + 32, state, 32 * 4);
            }
            XMEMCPY(state, fixed, 32 * sizeof(word64));
            SHAKE256_SET_HASH_ADDRESS(state, 32, j);
            SHAKE256_SET_END_X4(state, 48);
            ret = SAVE_VECTOR_REGISTERS2();
            if (ret != 0)
                break;
            sha3_blocksx4_avx2(state);
            RESTORE_VECTOR_REGISTERS();
        }

        if (ret == 0)
            SHAKE256_GET_HASH_X4_32(state, sk);
    }

    /* state holds the secret WOTS+ chain value; guard against a NULL state
     * after an allocation failure (WOLFSSL_SMALL_STACK). */
    if (WC_VAR_OK(state)) {
        ForceZero(state, sizeof(word64) * SLHDSA_SHAKE_X4_STATE_W);
    }
    WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    WC_FREE_VAR_EX(fixed, heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif
#endif

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
/* PRF hash 4 simultaneously.
 *
 * Each hash varies by the chain address with the first value in sequence passed
 * in.
 *
 * FIPS 205. Section 4.1.
 *   PRF(PK.seed, SK.seed, ADRS) (Bn x Bn x B32 -> Bn) is a PRF that is used to
 *   generate the secret values in WOTS+ and FORS private keys.
 * FIPS 205. Section 11.1.
 *   PRF(PK.seed, SK.seed, ADRS) = SHAKE256(PK.seed || ADRS || SK.seed, 8n)
 *
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  addr     Encoded HashAddress.
 * @param [in]  n        Number of bytes in hash output.
 * @param [in]  ca       Chain address start index.
 * @param [out] sk       Buffer to hold hash output.
 * @param [in]  heap     Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_hash_prf_x4(const byte* pk_seed, const byte* sk_seed,
    byte* addr, byte n, byte ca, byte* sk, void* heap)
{
    int ret = 0;
    word32 o = 0;
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        o = slhdsakey_shake256_set_seed_ha_hash_x4(state, pk_seed, addr,
            sk_seed, n);
        SHAKE256_SET_CHAIN_ADDRESS(state, o, ca);
        ret = SAVE_VECTOR_REGISTERS2();
        if (ret == 0) {
            sha3_blocksx4_avx2(state);
            slhdsakey_shake256_get_hash_x4(state, sk, n);
            RESTORE_VECTOR_REGISTERS();
        }

        /* state holds the secret PRF output (WOTS+ key). */
        ForceZero(state, sizeof(word64) * SLHDSA_SHAKE_X4_STATE_W);
        WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    }

    return ret;
}

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_128)
/* Iterate the hash function 15 times with 4 hashes when n=16.
 *
 * FIPS 205. Section 5. Algorithm 5.
 * chain(X, i, s, PK.seed, ADRS)
 *   1: tmp <- X
 *   2: for j from i to i + s - 1 do
 *   3:     ADRS.setHashAddress(j)
 *   4:     tmp <- F(PK.seed, ADRS, tmp
 *   5: end for
 *   6: return tmp
 *
 * @param [in, out] sk       4 hashes to iterate.
 * @param [in]      pk_seed  Public key seed.
 * @param [in]      addr     Encoded HashAddress.
 * @param [in]      ca       Chain address start index.
 * @param [in]      heap     Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_chain_x4_16(byte* sk, const byte* pk_seed, byte* addr,
    byte ca, void* heap)
{
    int ret = 0;
    int j;
    WC_DECLARE_VAR(fixed, word64, 8 * 4, heap);
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(fixed, word64, 8 * 4, heap, DYNAMIC_TYPE_SLHDSA,
        ret = MEMORY_E);
    if (ret == 0) {
        WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
            DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    }
    if (ret == 0) {
        SHAKE256_SET_SEED_HA_X4_16(fixed, pk_seed, addr);
        SHAKE256_SET_CHAIN_ADDRESS(fixed, 24, ca);
        SHAKE256_SET_HASH_X4_16(state, sk);

        for (j = 0; j < 15; j++) {
            if (j != 0) {
                XMEMCPY(state + 24, state, 16 * 4);
            }
            XMEMCPY(state, fixed, 24 * sizeof(word64));
            SHAKE256_SET_HASH_ADDRESS(state, 24, j);
            SHAKE256_SET_END_X4(state, 32);
            ret = SAVE_VECTOR_REGISTERS2();
            if (ret != 0)
                break;
            sha3_blocksx4_avx2(state);
            RESTORE_VECTOR_REGISTERS();
        }

        if (ret == 0)
            SHAKE256_GET_HASH_X4_16(state, sk);
    }

    /* state holds the secret WOTS+ chain value; guard against a NULL state
     * after an allocation failure (WOLFSSL_SMALL_STACK). */
    if (WC_VAR_OK(state)) {
        ForceZero(state, sizeof(word64) * SLHDSA_SHAKE_X4_STATE_W);
    }
    WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    WC_FREE_VAR_EX(fixed, heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
/* Iterate the hash function 15 times with 4 hashes when n=24.
 *
 * FIPS 205. Section 5. Algorithm 5.
 * chain(X, i, s, PK.seed, ADRS)
 *   1: tmp <- X
 *   2: for j from i to i + s - 1 do
 *   3:     ADRS.setHashAddress(j)
 *   4:     tmp <- F(PK.seed, ADRS, tmp
 *   5: end for
 *   6: return tmp
 *
 * @param [in, out] sk       4 hashes to iterate.
 * @param [in]      pk_seed  Public key seed.
 * @param [in]      addr     Encoded HashAddress.
 * @param [in]      ca       Chain address start index.
 * @param [in]      heap     Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_chain_x4_24(byte* sk, const byte* pk_seed, byte* addr,
    byte ca, void* heap)
{
    int ret = 0;
    int j;
    WC_DECLARE_VAR(fixed, word64, 8 * 4, heap);
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(fixed, word64, 8 * 4, heap, DYNAMIC_TYPE_SLHDSA,
        ret = MEMORY_E);
    if (ret == 0) {
        WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
            DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    }
    if (ret == 0) {
        SHAKE256_SET_SEED_HA_X4_24(fixed, pk_seed, addr);
        SHAKE256_SET_CHAIN_ADDRESS(fixed, 28, ca);
        SHAKE256_SET_HASH_X4_24(state, sk);

        for (j = 0; j < 15; j++) {
            if (j != 0) {
                XMEMCPY(state + 28, state, 24 * 4);
            }
            XMEMCPY(state, fixed, 28 * sizeof(word64));
            SHAKE256_SET_HASH_ADDRESS(state, 28, j);
            SHAKE256_SET_END_X4(state, 40);
            ret = SAVE_VECTOR_REGISTERS2();
            if (ret != 0)
                break;
            sha3_blocksx4_avx2(state);
            RESTORE_VECTOR_REGISTERS();
        }

        if (ret == 0)
            SHAKE256_GET_HASH_X4_24(state, sk);
    }

    /* state holds the secret WOTS+ chain value; guard against a NULL state
     * after an allocation failure (WOLFSSL_SMALL_STACK). */
    if (WC_VAR_OK(state)) {
        ForceZero(state, sizeof(word64) * SLHDSA_SHAKE_X4_STATE_W);
    }
    WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    WC_FREE_VAR_EX(fixed, heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_256)
/* Iterate the hash function 15 times with 4 hashes when n=32.
 *
 * FIPS 205. Section 5. Algorithm 5.
 * chain(X, i, s, PK.seed, ADRS)
 *   1: tmp <- X
 *   2: for j from i to i + s - 1 do
 *   3:     ADRS.setHashAddress(j)
 *   4:     tmp <- F(PK.seed, ADRS, tmp
 *   5: end for
 *   6: return tmp
 *
 * @param [in, out] sk       4 hashes to iterate.
 * @param [in]      pk_seed  Public key seed.
 * @param [in]      addr     Encoded HashAddress.
 * @param [in]      ca       Chain address start index.
 * @param [in]      heap     Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_chain_x4_32(byte* sk, const byte* pk_seed, byte* addr,
    byte ca, void* heap)
{
    int ret = 0;
    int j;
    WC_DECLARE_VAR(fixed, word64, 8 * 4, heap);
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(fixed, word64, 8 * 4, heap, DYNAMIC_TYPE_SLHDSA,
        ret = MEMORY_E);
    if (ret == 0) {
        WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
            DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    }
    if (ret == 0) {
        SHAKE256_SET_SEED_HA_X4_32(fixed, pk_seed, addr);
        SHAKE256_SET_CHAIN_ADDRESS(fixed, 32, ca);
        SHAKE256_SET_HASH_X4_32(state, sk);

        for (j = 0; j < 15; j++) {
            if (j != 0) {
                XMEMCPY(state + 32, state, 32 * 4);
            }
            XMEMCPY(state, fixed, 32 * sizeof(word64));
            SHAKE256_SET_HASH_ADDRESS(state, 32, j);
            SHAKE256_SET_END_X4(state, 48);
            ret = SAVE_VECTOR_REGISTERS2();
            if (ret != 0)
                break;
            sha3_blocksx4_avx2(state);
            RESTORE_VECTOR_REGISTERS();
        }

        if (ret == 0)
            SHAKE256_GET_HASH_X4_32(state, sk);
    }

    /* state holds the secret WOTS+ chain value; guard against a NULL state
     * after an allocation failure (WOLFSSL_SMALL_STACK). */
    if (WC_VAR_OK(state)) {
        ForceZero(state, sizeof(word64) * SLHDSA_SHAKE_X4_STATE_W);
    }
    WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    WC_FREE_VAR_EX(fixed, heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif

/* PRF hash 4 simultaneously.
 *
 * Each hash varies by the chain address which is passed in as an array.
 *
 * FIPS 205. Section 4.1.
 *   PRF(PK.seed, SK.seed, ADRS) (Bn x Bn x B32 -> Bn) is a PRF that is used to
 *   generate the secret values in WOTS+ and FORS private keys.
 * FIPS 205. Section 11.1.
 *   PRF(PK.seed, SK.seed, ADRS) = SHAKE256(PK.seed || ADRS || SK.seed, 8n)
 *
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  addr     Encoded HashAddress.
 * @param [in]  n        Number of bytes in hash output.
 * @param [in]  idx      Four chain address indices.
 * @param [out] sk       Buffer to hold hash output.
 * @param [in]  heap     Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_hash_prf_idx_x4(const byte* pk_seed, const byte* sk_seed,
    byte* addr, byte n, byte* idx, byte* sk, void* heap)
{
    int ret = 0;
    word32 o = 0;
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        o = slhdsakey_shake256_set_seed_ha_hash_x4(state, pk_seed, addr,
            sk_seed, n);
        SHAKE256_SET_CHAIN_ADDRESS_IDX(state, o, idx);
        ret = SAVE_VECTOR_REGISTERS2();
        if (ret == 0) {
            sha3_blocksx4_avx2(state);
            RESTORE_VECTOR_REGISTERS();
            slhdsakey_shake256_get_hash_x4(state, sk, n);
        }

        /* state holds the secret PRF output (WOTS+ key). */
        ForceZero(state, sizeof(word64) * SLHDSA_SHAKE_X4_STATE_W);
        WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    }

    return ret;
}

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_128)
/* Iterate hash function up to index times for each of the hashes when n=16.
 *
 * FIPS 205. Section 5. Algorithm 5.
 * chain(X, i, s, PK.seed, ADRS)
 *   1: tmp <- X
 *   2: for j from i to i + s - 1 do
 *   3:     ADRS.setHashAddress(j)
 *   4:     tmp <- F(PK.seed, ADRS, tmp
 *   5: end for
 *   6: return tmp
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sk       Hashes to iterate. Data modified.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     HashAddress.
 * @param [in]  addr     Encoded HashAddress.
 * @param [in]  msg      Array of counts.
 * @param [in]  idx      Indices into array of counts.
 * @param [in]  j        Minimum number of iterations for all 4 hashes.
 * @param [in]  cnt      Number of hashes to iterate.
 * @param [out] sig      Hash results.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_chain_idx_16(SlhDsaKey* key, byte* sk,
     const byte* pk_seed, word32* adrs, byte* addr, const byte* msg, byte* idx,
     int j, int cnt, byte* sig)
{
    int ret = 0;

    /* Iterate the minimum number of iterations on all hashes. */
    if (j != 0) {
        ret = slhdsakey_chain_idx_x4_16(sk, 0U, (word32)j, pk_seed, addr, idx,
            key->heap);
    }
    if (ret == 0) {
        if (cnt > 3) {
            /* Copy out hash at index 3 as it is finished. */
            XMEMCPY(sig + idx[3] * 16, sk + 3 * 16, 16);
        }
        /* Check if more iterations needed for index 2. */
        if (msg[idx[2]] != j) {
            /* Do 4 as we can't do less. */
            ret = slhdsakey_chain_idx_x4_16(sk, (word32)j,
                    (word32)(msg[idx[2]] - j), pk_seed, addr, idx, key->heap);
            /* Update number of iterations performed. */
            j = msg[idx[2]];
        }
    }
    if (ret == 0) {
        /* Copy out hash at index 2 as it is finished. */
        XMEMCPY(sig + idx[2] * 16, sk + 2 * 16, 16);
        /* Check if more iterations needed for index 1. */
        if (msg[idx[1]] != j) {
            /* Do 4 as we can't do less. */
            ret = slhdsakey_chain_idx_x4_16(sk, (word32)j,
                    (word32)(msg[idx[1]] - j), pk_seed, addr, idx, key->heap);
            /* Update number of iterations performed. */
            j = msg[idx[1]];
        }
    }
    if (ret == 0) {
        /* Copy out hash at index 1 as it is finished. */
        XMEMCPY(sig + idx[1] * 16, sk + 1 * 16, 16);
        /* Check if more iterations needed for index 0. */
        if (msg[idx[0]] != j) {
            /* Iterate 1 hash as it takes less time than doing 4. */
            HA_SetChainAddress(adrs, idx[0]);
            ret = slhdsakey_chain(key, sk, (byte)j, (byte)(msg[idx[0]] - j),
                    pk_seed, adrs, sk);
        }
    }
    if (ret == 0) {
        /* Copy out hash at index 0 as it is finished. */
        XMEMCPY(sig + idx[0] * 16, sk + 0 * 16, 16);
    }

    return ret;
}
#endif

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
/* Iterate hash function up to index times for each of the hashes when n=24.
 *
 * FIPS 205. Section 5. Algorithm 5.
 * chain(X, i, s, PK.seed, ADRS)
 *   1: tmp <- X
 *   2: for j from i to i + s - 1 do
 *   3:     ADRS.setHashAddress(j)
 *   4:     tmp <- F(PK.seed, ADRS, tmp
 *   5: end for
 *   6: return tmp
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sk       Hashes to iterate. Data modified.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     HashAddress.
 * @param [in]  addr     Encoded HashAddress.
 * @param [in]  msg      Array of counts.
 * @param [in]  idx      Indices into array of counts.
 * @param [in]  j        Minimum number of iterations for all 4 hashes.
 * @param [in]  cnt      Number of hashes to iterate.
 * @param [out] sig      Hash results.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_chain_idx_24(SlhDsaKey* key, byte* sk,
     const byte* pk_seed, word32* adrs, byte* addr, const byte* msg, byte* idx,
     int j, int cnt, byte* sig)
{
    int ret = 0;

    /* Iterate the minimum number of iterations on all hashes. */
    if (j != 0) {
        ret = slhdsakey_chain_idx_x4_24(sk, 0U, (word32)j, pk_seed, addr, idx,
            key->heap);
    }
    if (ret == 0) {
        if (cnt > 3) {
            /* Copy out hash at index 3 as it is finished. */
            XMEMCPY(sig + idx[3] * 24, sk + 3 * 24, 24);
        }
        /* Check if more iterations needed for index 2. */
        if (msg[idx[2]] != j) {
            /* Do 4 as we can't do less. */
            ret = slhdsakey_chain_idx_x4_24(sk, (word32)j,
                    (word32)(msg[idx[2]] - j), pk_seed, addr, idx, key->heap);
            /* Update number of iterations performed. */
            j = msg[idx[2]];
        }
    }
    if (ret == 0) {
        /* Copy out hash at index 2 as it is finished. */
        XMEMCPY(sig + idx[2] * 24, sk + 2 * 24, 24);
        /* Check if more iterations needed for index 1. */
        if (msg[idx[1]] != j) {
            /* Do 4 as we can't do less. */
            ret = slhdsakey_chain_idx_x4_24(sk, (word32)j,
                    (word32)(msg[idx[1]] - j), pk_seed, addr, idx, key->heap);
            /* Update number of iterations performed. */
            j = msg[idx[1]];
        }
    }
    if (ret == 0) {
        /* Copy out hash at index 1 as it is finished. */
        XMEMCPY(sig + idx[1] * 24, sk + 1 * 24, 24);
        /* Check if more iterations needed for index 0. */
        if (msg[idx[0]] != j) {
            /* Iterate 1 hash as it takes less time than doing 4. */
            HA_SetChainAddress(adrs, idx[0]);
            ret = slhdsakey_chain(key, sk, (byte)j, (byte)(msg[idx[0]] - j),
                    pk_seed, adrs, sk);
        }
    }
    if (ret == 0) {
        /* Copy out hash at index 0 as it is finished. */
        XMEMCPY(sig + idx[0] * 24, sk + 0 * 24, 24);
    }

    return ret;
}
#endif

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_256)
/* Iterate hash function up to index times for each of the hashes when n=32.
 *
 * FIPS 205. Section 5. Algorithm 5.
 * chain(X, i, s, PK.seed, ADRS)
 *   1: tmp <- X
 *   2: for j from i to i + s - 1 do
 *   3:     ADRS.setHashAddress(j)
 *   4:     tmp <- F(PK.seed, ADRS, tmp
 *   5: end for
 *   6: return tmp
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sk       Hashes to iterate. Data modified.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     HashAddress.
 * @param [in]  addr     Encoded HashAddress.
 * @param [in]  msg      Array of counts.
 * @param [in]  idx      Indices into array of counts.
 * @param [in]  j        Minimum number of iterations for all 4 hashes.
 * @param [in]  cnt      Number of hashes to iterate.
 * @param [out] sig      Hash results.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_chain_idx_32(SlhDsaKey* key, byte* sk,
     const byte* pk_seed, word32* adrs, byte* addr, const byte* msg, byte* idx,
     int j, int cnt, byte* sig)
{
    int ret = 0;

    /* Iterate the minimum number of iterations on all hashes. */
    if (j != 0) {
        ret = slhdsakey_chain_idx_x4_32(sk, 0U, (word32)j, pk_seed, addr, idx,
            key->heap);
    }
    if (ret == 0) {
        if (cnt > 3) {
            /* Copy out hash at index 3 as it is finished. */
            XMEMCPY(sig + idx[3] * 32, sk + 3 * 32, 32);
        }
        /* Check if more iterations needed for index 2. */
        if (msg[idx[2]] != j) {
            /* Do 4 as we can't do less. */
            ret = slhdsakey_chain_idx_x4_32(sk, (word32)j,
                    (word32)(msg[idx[2]] - j), pk_seed, addr, idx, key->heap);
            /* Update number of iterations performed. */
            j = msg[idx[2]];
        }
    }
    if (ret == 0) {
        /* Copy out hash at index 2 as it is finished. */
        XMEMCPY(sig + idx[2] * 32, sk + 2 * 32, 32);
        /* Check if more iterations needed for index 1. */
        if (msg[idx[1]] != j) {
            /* Do 4 as we can't do less. */
            ret = slhdsakey_chain_idx_x4_32(sk, (word32)j,
                    (word32)(msg[idx[1]] - j), pk_seed, addr, idx, key->heap);
            /* Update number of iterations performed. */
            j = msg[idx[1]];
        }
    }
    if (ret == 0) {
        /* Copy out hash at index 1 as it is finished. */
        XMEMCPY(sig + idx[1] * 32, sk + 1 * 32, 32);
        /* Check if more iterations needed for index 0. */
        if (msg[idx[0]] != j) {
            /* Iterate 1 hash as it takes less time than doing 4. */
            HA_SetChainAddress(adrs, idx[0]);
            ret = slhdsakey_chain(key, sk, (byte)j, (byte)(msg[idx[0]] - j),
                    pk_seed, adrs, sk);
        }
    }
    if (ret == 0) {
        /* Copy out hash at index 0 as it is finished. */
        XMEMCPY(sig + idx[0] * 32, sk + 0 * 32, 32);
    }

    return ret;
}
#endif
#endif

#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_128)
/* Generate WOTS+ public key, 16-byte hashes - 4 consecutive at a time.
 *
 * FIPS 205 Section 5.1. Algorithm 6.
 * wots_pkGen(SK.seed, PK.seed, ADRS)
 *  ...
 *   4: for i from 0 to len - 1 do
 *   5:     skADRS.setChainAddress(i)
 *   6:     sk <- PRF(PK.seed, SK.seed, skADRS)
 *                                            > compute secret value for chain i
 *   7:     ADRS.setChainAddress(i)
 *   8:     tmp[i] <- chain(sk 0, w - 1, PK.seed, ADRS)
 *                                            > compute public value for chain i
 *   9: end for
 *  10: wotspkADRS <- ADRS     > copy address to create WOTS+ public key address
 *  ...
 *  13: pk <- Tlen(PK.seed, wotspkADRS, tmp)               > compress public key
 *  ...
 *
 * @param [in] key      SLH-DSA key.
 * @param [in] sk_seed  Private key seed.
 * @param [in] pk_seed  Public key seed.
 * @param [in] addr     Encoded HashAddress.
 * @param [in] sk_addr  Encoded WOTS PRF HashAddress.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_wots_pkgen_chain_x4_16(SlhDsaKey* key, const byte* sk_seed,
    const byte* pk_seed, byte* addr, byte* sk_addr)
{
    int ret = 0;
    int i;
    byte len = key->params->len;
    WC_DECLARE_VAR(sk, byte, (SLHDSA_MAX_MSG_SZ + 3) * 16, key->heap);

    WC_ALLOC_VAR_EX(sk, byte, (SLHDSA_MAX_MSG_SZ + 3) * 16, key->heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        for (i = 0; i < len - 3; i += 4) {
            ret = slhdsakey_hash_prf_x4(pk_seed, sk_seed, sk_addr, 16, (byte)i,
                sk + i * 16, key->heap);
            if (ret != 0) {
                break;
            }
            ret = slhdsakey_chain_x4_16(sk + i * 16, pk_seed, addr, (byte)i,
                key->heap);
            if (ret != 0) {
                break;
            }
        }
    }
    if (ret == 0) {
        ret = slhdsakey_hash_prf_x4(pk_seed, sk_seed, sk_addr, 16, (byte)i,
            sk + i * 16, key->heap);
        if (ret == 0) {
            ret = slhdsakey_chain_x4_16(sk + i * 16, pk_seed, addr, (byte)i,
                key->heap);
        }
    }
    if (ret == 0) {
        ret = HASH_T_UPDATE(key, sk, (word32)len * 16U);
    }

    /* On error sk still holds secret WOTS+ leaves; on success it is overwritten
     * with public chain values. The x4 PRF fills up to a 4-lane multiple
     * (beyond len), so wipe the whole buffer. */
    if ((ret != 0) && WC_VAR_OK(sk)) {
        ForceZero(sk, (SLHDSA_MAX_MSG_SZ + 3) * 16);
    }
    WC_FREE_VAR_EX(sk, key->heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
/* Generate WOTS+ public key, 24-byte hashes - 4 consecutive at a time.
 *
 * FIPS 205 Section 5.1. Algorithm 6.
 * wots_pkGen(SK.seed, PK.seed, ADRS)
 *  ...
 *   4: for i from 0 to len - 1 do
 *   5:     skADRS.setChainAddress(i)
 *   6:     sk <- PRF(PK.seed, SK.seed, skADRS)
 *                                            > compute secret value for chain i
 *   7:     ADRS.setChainAddress(i)
 *   8:     tmp[i] <- chain(sk 0, w - 1, PK.seed, ADRS)
 *                                            > compute public value for chain i
 *   9: end for
 *  10: wotspkADRS <- ADRS     > copy address to create WOTS+ public key address
 *  ...
 *  13: pk <- Tlen(PK.seed, wotspkADRS, tmp)               > compress public key
 *  ...
 *
 * @param [in] key      SLH-DSA key.
 * @param [in] sk_seed  Private key seed.
 * @param [in] pk_seed  Public key seed.
 * @param [in] addr     Encoded HashAddress.
 * @param [in] sk_addr  Encoded WOTS PRF HashAddress.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_wots_pkgen_chain_x4_24(SlhDsaKey* key, const byte* sk_seed,
    const byte* pk_seed, byte* addr, byte* sk_addr)
{
    int ret = 0;
    int i;
    byte len = key->params->len;
    WC_DECLARE_VAR(sk, byte, (SLHDSA_MAX_MSG_SZ + 3) * 24, key->heap);

    WC_ALLOC_VAR_EX(sk, byte, (SLHDSA_MAX_MSG_SZ + 3) * 24, key->heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        for (i = 0; i < len - 3; i += 4) {
            ret = slhdsakey_hash_prf_x4(pk_seed, sk_seed, sk_addr, 24, (byte)i,
                sk + i * 24, key->heap);
            if (ret != 0) {
                break;
            }
            ret = slhdsakey_chain_x4_24(sk + i * 24, pk_seed, addr, (byte)i,
                key->heap);
            if (ret != 0) {
                break;
            }
        }
    }
    if (ret == 0) {
        ret = slhdsakey_hash_prf_x4(pk_seed, sk_seed, sk_addr, 24, (byte)i,
            sk + i * 24, key->heap);
        if (ret == 0) {
            ret = slhdsakey_chain_x4_24(sk + i * 24, pk_seed, addr, (byte)i,
                key->heap);
        }
    }
    if (ret == 0) {
        ret = HASH_T_UPDATE(key, sk, (word32)len * 24U);
    }

    /* On error sk still holds secret WOTS+ leaves; on success it is overwritten
     * with public chain values. The x4 PRF fills up to a 4-lane multiple
     * (beyond len), so wipe the whole buffer. */
    if ((ret != 0) && WC_VAR_OK(sk)) {
        ForceZero(sk, (SLHDSA_MAX_MSG_SZ + 3) * 24);
    }
    WC_FREE_VAR_EX(sk, key->heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_256)
/* Generate WOTS+ public key, 32-byte hashes - 4 consecutive at a time.
 *
 * FIPS 205 Section 5.1. Algorithm 6.
 * wots_pkGen(SK.seed, PK.seed, ADRS)
 *  ...
 *   4: for i from 0 to len - 1 do
 *   5:     skADRS.setChainAddress(i)
 *   6:     sk <- PRF(PK.seed, SK.seed, skADRS)
 *                                            > compute secret value for chain i
 *   7:     ADRS.setChainAddress(i)
 *   8:     tmp[i] <- chain(sk 0, w - 1, PK.seed, ADRS)
 *                                            > compute public value for chain i
 *   9: end for
 *  10: wotspkADRS <- ADRS     > copy address to create WOTS+ public key address
 *  ...
 *  13: pk <- Tlen(PK.seed, wotspkADRS, tmp)               > compress public key
 *  ...
 *
 * @param [in] key      SLH-DSA key.
 * @param [in] sk_seed  Private key seed.
 * @param [in] pk_seed  Public key seed.
 * @param [in] addr     Encoded HashAddress.
 * @param [in] sk_addr  Encoded WOTS PRF HashAddress.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_wots_pkgen_chain_x4_32(SlhDsaKey* key, const byte* sk_seed,
    const byte* pk_seed, byte* addr, byte* sk_addr)
{
    int ret = 0;
    int i;
    byte len = key->params->len;
    WC_DECLARE_VAR(sk, byte, (SLHDSA_MAX_MSG_SZ + 3) * 32, key->heap);

    WC_ALLOC_VAR_EX(sk, byte, (SLHDSA_MAX_MSG_SZ + 3) * 32, key->heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        for (i = 0; i < len - 3; i += 4) {
            ret = slhdsakey_hash_prf_x4(pk_seed, sk_seed, sk_addr, 32, (byte)i,
                sk + i * 32, key->heap);
            if (ret != 0) {
                break;
            }
            ret = slhdsakey_chain_x4_32(sk + i * 32, pk_seed, addr, (byte)i,
                key->heap);
            if (ret != 0) {
                break;
            }
        }
    }
    if (ret == 0) {
        ret = slhdsakey_hash_prf_x4(pk_seed, sk_seed, sk_addr, 32, (byte)i,
            sk + i * 32, key->heap);
        if (ret == 0) {
            ret = slhdsakey_chain_x4_32(sk + i * 32, pk_seed, addr, (byte)i,
                key->heap);
        }
    }
    if (ret == 0) {
        ret = HASH_T_UPDATE(key, sk, (word32)len * 32U);
    }

    /* On error sk still holds secret WOTS+ leaves; on success it is overwritten
     * with public chain values. The x4 PRF fills up to a 4-lane multiple
     * (beyond len), so wipe the whole buffer. */
    if ((ret != 0) && WC_VAR_OK(sk)) {
        ForceZero(sk, (SLHDSA_MAX_MSG_SZ + 3) * 32);
    }
    WC_FREE_VAR_EX(sk, key->heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif

/* Generate WOTS+ public key - 4 consecutive addresses at a time.
 *
 * FIPS 205 Section 5.1. Algorithm 6.
 * wots_pkGen(SK.seed, PK.seed, ADRS)
 *  ...
 *   4: for i from 0 to len - 1 do
 *   5:     skADRS.setChainAddress(i)
 *   6:     sk <- PRF(PK.seed, SK.seed, skADRS)
 *                                            > compute secret value for chain i
 *   7:     ADRS.setChainAddress(i)
 *   8:     tmp[i] <- chain(sk 0, w - 1, PK.seed, ADRS)
 *                                            > compute public value for chain i
 *   9: end for
 *  10: wotspkADRS <- ADRS     > copy address to create WOTS+ public key address
 *  ...
 *  13: pk <- Tlen(PK.seed, wotspkADRS, tmp)               > compress public key
 *  ...
 *
 * @param [in] key      SLH-DSA key.
 * @param [in] sk_seed  Private key seed.
 * @param [in] pk_seed  Public key seed.
 * @param [in] adrs     HashAddress.
 * @param [in] sk_adrs  WOTS PRF HashAddress.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_wots_pkgen_chain_x4(SlhDsaKey* key, const byte* sk_seed,
    const byte* pk_seed, word32* adrs, word32* sk_adrs)
{
    int ret = 0;
    byte sk_addr[SLHDSA_HA_SZ];
    byte addr[SLHDSA_HA_SZ];
    byte n = key->params->n;

    HA_SetHashAddress(sk_adrs, 0);
    HA_Encode(sk_adrs, sk_addr);
    HA_Encode(adrs, addr);

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_128)
    if (n == WC_SLHDSA_N_128) {
        ret = slhdsakey_wots_pkgen_chain_x4_16(key, sk_seed, pk_seed, addr,
            sk_addr);
    }
    else
#endif
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
    if (n == 24) {
        ret = slhdsakey_wots_pkgen_chain_x4_24(key, sk_seed, pk_seed, addr,
            sk_addr);
    }
    else
#endif
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_256)
    if (n == 32) {
        ret = slhdsakey_wots_pkgen_chain_x4_32(key, sk_seed, pk_seed, addr,
            sk_addr);
    }
    else
#endif
    if (ret == 0) {
        ret = NOT_COMPILED_IN;
    }

    return ret;
}
#endif

/* Generate WOTS+ public key.
 *
 * FIPS 205 Section 5.1. Algorithm 6.
 * wots_pkGen(SK.seed, PK.seed, ADRS)
 *  ...
 *   4: for i from 0 to len - 1 do
 *   5:     skADRS.setChainAddress(i)
 *   6:     sk <- PRF(PK.seed, SK.seed, skADRS)
 *                                            > compute secret value for chain i
 *   7:     ADRS.setChainAddress(i)
 *   8:     tmp[i] <- chain(sk 0, w - 1, PK.seed, ADRS)
 *                                            > compute public value for chain i
 *   9: end for
 *  10: wotspkADRS <- ADRS     > copy address to create WOTS+ public key address
 *  ...
 *  13: pk <- Tlen(PK.seed, wotspkADRS, tmp)               > compress public key
 *  ...
 *
 * @param [in] key      SLH-DSA key.
 * @param [in] sk_seed  Private key seed.
 * @param [in] pk_seed  Public key seed.
 * @param [in] adrs     HashAddress.
 * @param [in] sk_adrs  WOTS PRF HashAddress.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_wots_pkgen_chain_c(SlhDsaKey* key, const byte* sk_seed,
    const byte* pk_seed, word32* adrs, word32* sk_adrs)
{
    int ret = 0;
    int i;
    byte n = key->params->n;
    byte len = key->params->len;

#if !defined(WOLFSSL_WC_SLHDSA_SMALL_MEM)
    WC_DECLARE_VAR(sk, byte, (SLHDSA_MAX_MSG_SZ + 3) * SLHDSA_MAX_N, key->heap);

    WC_ALLOC_VAR_EX(sk, byte, (SLHDSA_MAX_MSG_SZ + 3) * SLHDSA_MAX_N,
        key->heap, DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        /* Step 4. len consecutive addresses. */
        for (i = 0; i < len; i++) {
            /* Step 5. Set chain address for WOTS PRF. */
            HA_SetChainAddress(sk_adrs, i);
            /* Step 6. PRF hash seeds and chain address. */
            ret = HASH_PRF(key, pk_seed, sk_seed, sk_adrs, n,
                sk + i * n);
            if (ret != 0) {
                break;
            }
            /* Step 7. Set chain address for WOTS HASH. */
            HA_SetChainAddress(adrs, i);
            /* Step 8. Chain hashes for w-1 iterations. */
            ret = slhdsakey_chain(key, sk + i * n, 0, SLHDSA_WM1, pk_seed, adrs,
                sk + i * n);
            if (ret != 0) {
                break;
            }
        }
    }
    if (ret == 0) {
        /* Step 13: Compress public key. */
        ret = HASH_T_UPDATE(key, sk, (word32)len * n);
    }
    /* On error sk still holds secret WOTS+ leaves; on success it is overwritten
     * with public chain values (generic path fills exactly len entries). */
    if ((ret != 0) && WC_VAR_OK(sk)) {
        ForceZero(sk, (word32)len * n);
    }
    WC_FREE_VAR_EX(sk, key->heap, DYNAMIC_TYPE_SLHDSA);
#else
    byte sk[SLHDSA_MAX_N];

    /* Step 4. len consecutive addresses. */
    for (i = 0; i < len; i++) {
        /* Step 5. Set chain address for WOTS PRF. */
        HA_SetChainAddress(sk_adrs, i);
        /* Step 6. PRF hash seeds and chain address. */
        ret = HASH_PRF(key, pk_seed, sk_seed, sk_adrs, n, sk);
        if (ret != 0) {
            break;
        }
        /* Step 7. Set chain address for WOTS HASH. */
        HA_SetChainAddress(adrs, i);
        /* Step 8. Chain hashes for w-1 iterations. */
        ret = slhdsakey_chain(key, sk, 0, SLHDSA_WM1, pk_seed, adrs, sk);
        if (ret != 0) {
            break;
        }

        /* Step 13: Compress public key - for each tmp. */
        ret = HASH_T_UPDATE(key, sk, n);
        if (ret != 0) {
            break;
        }
    }

    /* On error sk still holds a secret WOTS+ leaf; on success it is overwritten
     * with a public chain value. */
    if (ret != 0) {
        ForceZero(sk, n);
    }
#endif

    return ret;
}

/* Generate WOTS+ public key.
 *
 * FIPS 205 Section 5.1. Algorithm 6.
 * wots_pkGen(SK.seed, PK.seed, ADRS)
 *   1: skADRS <- ADRS       > copy address to create key generation key address
 *   2: skADRS.setTypeAndClear(WOTS_PRF)
 *   3: skADRS.setKeyPairAddress(ADRS.getKeyPairAddress())
 *  ...
 *  11: wotspkADRS.setTypeAndClear(WOTS_PK)
 *  12: wotspkADRS.setKeyPairAddress(ADRS.getKeyPairAddress())
 *  13: pk <- Tlen(PK.seed, wotspkADRS, tmp)               > compress public key
 *  14: return pk
 *
 * @param [in] key      SLH-DSA key.
 * @param [in] sk_seed  Private key seed.
 * @param [in] pk_seed  Public key seed.
 * @param [in] adrs     HashAddress.
 * @param [in] sk_adrs  WOTS PRF HashAddress.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_wots_pkgen(SlhDsaKey* key, const byte* sk_seed,
    const byte* pk_seed, word32* adrs, byte* node)
{
    int ret;
    byte n = key->params->n;
    int hash_t_started = 0;

    {
        HashAddress wotspk_adrs;

        /* Steps 11-12. Copy address and set to WOTS PK. */
        HA_Copy(wotspk_adrs, adrs);
        HA_SetTypeAndClearNotKPA(wotspk_adrs, HA_WOTS_PK);
        /* Step 13. Start hash with public key seed and address. */
        ret = HASH_T_START_ADDR(key, pk_seed, wotspk_adrs, n);
    }
    if (ret == 0) {
        HashAddress sk_adrs;

        hash_t_started = 1;

        /* Steps 1-2. Copy address and set to WOTS PRF. */
        HA_Copy(sk_adrs, adrs);
        HA_SetTypeAndClearNotKPA(sk_adrs, HA_WOTS_PRF);
        /* Steps 4-10,13: Generate hashes and update the public key hash. */
#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
        if (!SLHDSA_IS_SHA2(key->params->param) &&
                IS_INTEL_AVX2(cpuid_flags) &&
                (SAVE_VECTOR_REGISTERS2() == 0)) {
            ret = slhdsakey_wots_pkgen_chain_x4(key, sk_seed, pk_seed, adrs,
                sk_adrs);
            RESTORE_VECTOR_REGISTERS();
        }
        else
#endif
        {
            ret = slhdsakey_wots_pkgen_chain_c(key, sk_seed, pk_seed, adrs,
                sk_adrs);
        }
    }
    if (ret == 0) {
        /* Step 13: Output hash of compressed public key. */
        ret = HASH_T_FINAL(key, node, n);
    }

    if (hash_t_started) {
        HASH_T_FREE(key);
    }

    return ret;
}

#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_128)
/* Generate a WOTS+ signature, 32-byte hashed, on msg - iterating 4 hashes.
 *
 * FIPS 205. Section 5.2. Algorithm 7
 * wots_sign(M, SK.seed, PK.seed, ADRS)
 *  ...
 *  11: for i from 0 to len - 1 do
 *  12:     skADRS.setChainAddress(i)
 *  13:     sk <- PRF(PK.seed, SK.seed, skADRS)   > compute chain i secret value
 *  14:     ADRS.setChainAddress(i)
 *  15:     sig[i] <- chain(sk, 0, msg[i], PK.seed, ADRS)
 *                                             > compute chain i signature value
 *  16: end for
 *  17: return sig
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  msg      Encoded message with checksum.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     HashAddress.
 * @param [in]  sk_adrs  PRF HashAddress.
 * @param [out] sig      Signature - (2.n + 3) hashes of length n.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_wots_sign_chain_x4_16(SlhDsaKey* key, const byte* msg,
    const byte* sk_seed, const byte* pk_seed, word32* adrs, byte* addr,
    byte* sk_addr, byte* sig)
{
    int ret = 0;
    int i;
    sword8 j;
    byte ii;
    byte idx[4] = {0};
    byte n = key->params->n;
    byte len = key->params->len;
    WC_DECLARE_VAR(sk, byte, 4 * 16, key->heap);

    WC_ALLOC_VAR_EX(sk, byte, 4 * 16, key->heap, DYNAMIC_TYPE_SLHDSA,
        ret = MEMORY_E);
    if (ret == 0) {
        ii = 0;
        for (j = (sword8)SLHDSA_WM1; j >= 0; j--) {
            for (i = 0; i < len; i++) {
                if ((sword8)msg[i] == j) {
                    idx[ii++] = (byte)i;
                    if (ii == 4) {
                        ret = slhdsakey_hash_prf_idx_x4(pk_seed, sk_seed,
                            sk_addr, n, idx, sk, key->heap);
                        if (ret != 0) {
                            break;
                        }
                        ret = slhdsakey_chain_idx_16(key, sk, pk_seed, adrs,
                            addr, msg, idx, j, 4, sig);
                        if (ret != 0) {
                            break;
                        }
                        ii = 0;
                    }
                }
            }
        }
    }

    if (ret == 0) {
        ret = slhdsakey_hash_prf_idx_x4(pk_seed, sk_seed, sk_addr, n, idx, sk,
            key->heap);
    }
    if (ret == 0) {
        j = (sword8)min(min(msg[idx[0]], msg[idx[1]]), msg[idx[2]]);
        ret = slhdsakey_chain_idx_16(key, sk, pk_seed, adrs, addr, msg, idx, j,
            3, sig);
    }

    /* sk holds the secret WOTS+ leaves (guard for NULL after a SMALL_STACK
     * allocation failure). */
    if (WC_VAR_OK(sk)) {
        ForceZero(sk, 4 * 16);
    }
    /* On error, sig may hold partial (secret) chain values; wipe the WOTS sig. */
    if (ret != 0) {
        ForceZero(sig, (word32)len * n);
    }
    WC_FREE_VAR_EX(sk, key->heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
/* Generate a WOTS+ signature, 32-byte hashed, on msg - iterating 4 hashes.
 *
 * FIPS 205. Section 5.2. Algorithm 7
 * wots_sign(M, SK.seed, PK.seed, ADRS)
 *  ...
 *  11: for i from 0 to len - 1 do
 *  12:     skADRS.setChainAddress(i)
 *  13:     sk <- PRF(PK.seed, SK.seed, skADRS)   > compute chain i secret value
 *  14:     ADRS.setChainAddress(i)
 *  15:     sig[i] <- chain(sk, 0, msg[i], PK.seed, ADRS)
 *                                             > compute chain i signature value
 *  16: end for
 *  17: return sig
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  msg      Encoded message with checksum.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     HashAddress.
 * @param [in]  sk_adrs  PRF HashAddress.
 * @param [out] sig      Signature - (2.n + 3) hashes of length n.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_wots_sign_chain_x4_24(SlhDsaKey* key, const byte* msg,
    const byte* sk_seed, const byte* pk_seed, word32* adrs, byte* addr,
    byte* sk_addr, byte* sig)
{
    int ret = 0;
    int i;
    sword8 j;
    byte ii;
    byte idx[4] = {0};
    byte n = key->params->n;
    byte len = key->params->len;
    WC_DECLARE_VAR(sk, byte, 4 * 24, key->heap);

    WC_ALLOC_VAR_EX(sk, byte, 4 * 24, key->heap, DYNAMIC_TYPE_SLHDSA,
        ret = MEMORY_E);
    if (ret == 0) {
        ii = 0;
        for (j = (sword8)SLHDSA_WM1; j >= 0; j--) {
            for (i = 0; i < len; i++) {
                if ((sword8)msg[i] == j) {
                    idx[ii++] = (byte)i;
                    if (ii == 4) {
                        ret = slhdsakey_hash_prf_idx_x4(pk_seed, sk_seed,
                            sk_addr, n, idx, sk, key->heap);
                        if (ret != 0) {
                            break;
                        }
                        ret = slhdsakey_chain_idx_24(key, sk, pk_seed, adrs,
                            addr, msg, idx, j, 4, sig);
                        if (ret != 0) {
                            break;
                        }
                        ii = 0;
                    }
                }
            }
        }
    }

    if (ret == 0) {
        ret = slhdsakey_hash_prf_idx_x4(pk_seed, sk_seed, sk_addr, n, idx, sk,
            key->heap);
    }
    if (ret == 0) {
        j = (sword8)min(min(msg[idx[0]], msg[idx[1]]), msg[idx[2]]);
        ret = slhdsakey_chain_idx_24(key, sk, pk_seed, adrs, addr,
            msg, idx, j, 3, sig);
    }

    /* sk holds the secret WOTS+ leaves (guard for NULL after a SMALL_STACK
     * allocation failure). */
    if (WC_VAR_OK(sk)) {
        ForceZero(sk, 4 * 24);
    }
    /* On error, sig may hold partial (secret) chain values; wipe the WOTS sig. */
    if (ret != 0) {
        ForceZero(sig, (word32)len * n);
    }
    WC_FREE_VAR_EX(sk, key->heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_256)
/* Generate a WOTS+ signature, 32-byte hashed, on msg - iterating 4 hashes.
 *
 * FIPS 205. Section 5.2. Algorithm 7
 * wots_sign(M, SK.seed, PK.seed, ADRS)
 *  ...
 *  11: for i from 0 to len - 1 do
 *  12:     skADRS.setChainAddress(i)
 *  13:     sk <- PRF(PK.seed, SK.seed, skADRS)   > compute chain i secret value
 *  14:     ADRS.setChainAddress(i)
 *  15:     sig[i] <- chain(sk, 0, msg[i], PK.seed, ADRS)
 *                                             > compute chain i signature value
 *  16: end for
 *  17: return sig
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  msg      Encoded message with checksum.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     HashAddress.
 * @param [in]  sk_adrs  PRF HashAddress.
 * @param [out] sig      Signature - (2.n + 3) hashes of length n.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_wots_sign_chain_x4_32(SlhDsaKey* key, const byte* msg,
    const byte* sk_seed, const byte* pk_seed, word32* adrs, byte* addr,
    byte* sk_addr, byte* sig)
{
    int ret = 0;
    int i;
    sword8 j;
    byte ii;
    byte idx[4] = {0};
    byte n = key->params->n;
    byte len = key->params->len;
    WC_DECLARE_VAR(sk, byte, 4 * 32, key->heap);

    WC_ALLOC_VAR_EX(sk, byte, 4 * 32, key->heap, DYNAMIC_TYPE_SLHDSA,
        ret = MEMORY_E);
    if (ret == 0) {
        ii = 0;
        for (j = (sword8)SLHDSA_WM1; j >= 0; j--) {
            for (i = 0; i < len; i++) {
                if ((sword8)msg[i] == j) {
                    idx[ii++] = (byte)i;
                    if (ii == 4) {
                        ret = slhdsakey_hash_prf_idx_x4(pk_seed, sk_seed,
                            sk_addr, n, idx, sk, key->heap);
                        if (ret != 0) {
                            break;
                        }
                        ret = slhdsakey_chain_idx_32(key, sk, pk_seed, adrs,
                            addr, msg, idx, j, 4, sig);
                        if (ret != 0) {
                            break;
                        }
                        ii = 0;
                    }
                }
            }
        }
    }

    if (ret == 0) {
        ret = slhdsakey_hash_prf_idx_x4(pk_seed, sk_seed, sk_addr, n, idx, sk,
            key->heap);
    }
    if (ret == 0) {
        j = (sword8)min(min(msg[idx[0]], msg[idx[1]]), msg[idx[2]]);
        ret = slhdsakey_chain_idx_32(key, sk, pk_seed, adrs, addr, msg, idx, j,
            3, sig);
    }
    if (ret == 0) {
        sig += len * n;
    }

    /* sk holds the secret WOTS+ leaves (guard for NULL after a SMALL_STACK
     * allocation failure). */
    if (WC_VAR_OK(sk)) {
        ForceZero(sk, 4 * 32);
    }
    /* On error, sig may hold partial (secret) chain values; wipe the WOTS sig. */
    if (ret != 0) {
        ForceZero(sig, (word32)len * n);
    }
    WC_FREE_VAR_EX(sk, key->heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif

/* Generate a WOTS+ signature on msg - iterating 4 hashes at a time.
 *
 * FIPS 205. Section 5.2. Algorithm 7
 * wots_sign(M, SK.seed, PK.seed, ADRS)
 *  ...
 *   8: skADRS <- ADRS       > copy address to create key generation key address
 *   9: skADRS.setTypeAndClear(WOTS_PRF)
 *  10: skADRS.setKeyPairAddress(ADRS.getKeyPairAddress())
 *  11: for i from 0 to len - 1 do
 *  12:     skADRS.setChainAddress(i)
 *  13:     sk <- PRF(PK.seed, SK.seed, skADRS)   > compute chain i secret value
 *  14:     ADRS.setChainAddress(i)
 *  15:     sig[i] <- chain(sk, 0, msg[i], PK.seed, ADRS)
 *                                             > compute chain i signature value
 *  16: end for
 *  17: return sig
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  msg      Encoded message with checksum.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     HashAddress.
 * @param [in]  sk_adrs  PRF HashAddress.
 * @param [out] sig      Signature - (2.n + 3) hashes of length n.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_wots_sign_chain_x4(SlhDsaKey* key, const byte* msg,
    const byte* sk_seed, const byte* pk_seed, word32* adrs, word32* sk_adrs,
    byte* sig)
{
    int ret = 0;
    byte sk_addr[SLHDSA_HA_SZ];
    byte addr[SLHDSA_HA_SZ];
    byte n = key->params->n;

    HA_SetHashAddress(sk_adrs, 0);
    HA_Encode(sk_adrs, sk_addr);
    HA_Encode(adrs, addr);

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_128)
    if (n == WC_SLHDSA_N_128) {
        ret = slhdsakey_wots_sign_chain_x4_16(key, msg, sk_seed, pk_seed, adrs,
            addr, sk_addr, sig);
    }
    else
#endif
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
    if (n == 24) {
        ret = slhdsakey_wots_sign_chain_x4_24(key, msg, sk_seed, pk_seed, adrs,
            addr, sk_addr, sig);
    }
    else
#endif
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_256)
    if (n == 32) {
        ret = slhdsakey_wots_sign_chain_x4_32(key, msg, sk_seed, pk_seed, adrs,
             addr, sk_addr, sig);
    }
    else
#endif
    if (ret == 0) {
        ret = NOT_COMPILED_IN;
    }

    return ret;
}
#endif

/* Generate a WOTS+ signature on an n-byte message.
 *
 * FIPS 205. Section 5.2. Algorithm 7
 * wots_sign(M, SK.seed, PK.seed, ADRS)
 *   1: csum <- 0
 *   2: msg <- base_2b(M , lgw , len1 )              > convert message to base w
 *   3: for i from 0 to len1 - 1 do
 *   4:     csum <- csum + w - 1 - msg[i]
 *   5: end for                                               > compute checksum
 *   6: csum <- csum << ((8 - ((len2.lgw) mod 8)) mod 8)
 *                                                > for lgw = 4, left shift by 4
 *   7: msg <- msg || base_2b(toByte(csum, upper(len2.lgw/8)), lgw , len2)
 *                                                           > convert to base w
 *   8: skADRS <- ADRS       > copy address to create key generation key address
 *   9: skADRS.setTypeAndClear(WOTS_PRF)
 *  10: skADRS.setKeyPairAddress(ADRS.getKeyPairAddress())
 *  11: for i from 0 to len - 1 do
 *  12:     skADRS.setChainAddress(i)
 *  13:     sk <- PRF(PK.seed, SK.seed, skADRS)   > compute chain i secret value
 *  14:     ADRS.setChainAddress(i)
 *  15:     sig[i] <- chain(sk, 0, msg[i], PK.seed, ADRS)
 *                                             > compute chain i signature value
 *  16: end for
 *  17: return sig
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  m        n-bytes message.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     HashAddress.
 * @param [out] sig      Signature - (2.n + 3) hashes of length n.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_wots_sign(SlhDsaKey* key, const byte* m,
    const byte* sk_seed, const byte* pk_seed, word32* adrs, byte* sig)
{
    int ret = WC_NO_ERR_TRACE(BAD_FUNC_ARG);
    word16 csum;
    HashAddress sk_adrs;
    byte n = key->params->n;
    byte len = key->params->len;
    int i;
    byte msg[SLHDSA_MAX_MSG_SZ];

    /* Step 1: Start csum at 0 */
    csum = 0;
    /* Step 3: For each byte in message. */
    for (i = 0; i < n * 2; i += 2) {
        /* Step 2: Append high order 4 bits to msg. */
        msg[i+0] = (byte)((m[i / 2] >> 4) & 0xf);
        /* Step 4: Calculate checksum with first lgw bits. */
        csum = (word16)(csum + SLHDSA_WM1 - msg[i + 0]);
        /* Step 2: Append low order 4 bits to msg. */
        msg[i+1] = (byte)( m[i / 2]       & 0xf);
        /* Step 4: Calculate checksum with next lgw bits. */
        csum = (word16)(csum + SLHDSA_WM1 - msg[i + 1]);
    }
    /* Steps 6-7: Encode bottom 12 bits of csum onto end of msg. */
    msg[i + 0] = (byte)((csum >> 8) & 0xf);
    msg[i + 1] = (byte)((csum >> 4) & 0xf);
    msg[i + 2] = (byte)( csum       & 0xf);

    /* Steps 8-10: Copy address for WOTS PRF. */
    HA_Copy(sk_adrs, adrs);
    HA_SetTypeAndClearNotKPA(sk_adrs, HA_WOTS_PRF);
#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
    /* Steps 11-17: Generate signature from msg. */
    if (!SLHDSA_IS_SHA2(key->params->param) &&
            IS_INTEL_AVX2(cpuid_flags) &&
            (SAVE_VECTOR_REGISTERS2() == 0)) {
        ret = slhdsakey_wots_sign_chain_x4(key, msg, sk_seed, pk_seed, adrs,
            sk_adrs, sig);
        RESTORE_VECTOR_REGISTERS();
    }
    else
#endif
    {
        byte sk[SLHDSA_MAX_N];

        /* Step 11: For each value of msg. */
        for (i = 0; i < len; i++) {
            /* Step 12: Set chain address for WOTS PRF. */
            HA_SetChainAddress(sk_adrs, i);
            /* Step 13. PRF the secret chain value into a temp (not sig). */
            ret = HASH_PRF(key, pk_seed, sk_seed, sk_adrs, n, sk);
            if (ret != 0) {
                break;
            }
            /* Step 14: Set chain address for WOTS HASH. */
            HA_SetChainAddress(adrs, i);
            /* Step 15. Chain hashes in the temp so intermediate secret chain
             * values never touch the public sig buffer (even on error). */
            ret = slhdsakey_chain(key, sk, 0, msg[i], pk_seed, adrs, sk);
            if (ret != 0) {
                break;
            }
            /* Step 15: Copy the (public) chain result into the signature. */
            XMEMCPY(sig, sk, n);
            sig += n;
        }

        /* sk held the secret WOTS+ leaf. */
        ForceZero(sk, n);
    }

    return ret;
}
#endif

#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_128)
/* Computes 4 chains simultaneously from starts to w-1 when n=16.
 *
 * FIPS 205. Section 5.3. Algorithm 8.
 * wots_pkFromSig(sig, M, PK.seed, ADRS)
 *  ...
 *  10:     tmp[i] <- chain(sig[i], msg[i], w - 1 - msg[i], PK.seed, ADRS)
 *  ...
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sig      Signature - (2.n + 3) hashes of length n.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     WOTS HASH HashAddress.
 * @param [in]  msg      Encoded message with checksum.
 * @param [in]  idx      Indices of chains.
 * @param [in]  j        Shortest chain length already calculated.
 * @param [in]  cnt      Number of chains to complete.
 * @param [out] nodes    Buffer to place completed chains.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_chain_idx_to_max_16(SlhDsaKey* key, const byte* sig,
     const byte* pk_seed, word32* adrs, const byte* msg, byte* idx, int j,
     int cnt, byte* nodes)
{
    int ret = 0;
    byte node[4 * 16];
    byte addr[SLHDSA_HA_SZ];

    HA_SetChainAddress(adrs, idx[0]);
    HA_Encode(adrs, addr);

    XMEMCPY(node + 0 * 16, sig + idx[0] * 16, 16);
    if ((msg[idx[0]] != j) && (msg[idx[0]] != msg[idx[1]])) {
        ret = slhdsakey_chain(key, node, msg[idx[0]],
            (byte)(msg[idx[1]] - msg[idx[0]]), pk_seed, adrs, node);
    }
    if (ret == 0) {
        XMEMCPY(node + 1 * 16, sig + idx[1] * 16, 16);
        XMEMSET(node + 2 * 16, 0, sizeof(node) - 2 * 16);
        if ((msg[idx[1]] != j) && (msg[idx[1]] != msg[idx[2]])) {
            ret = slhdsakey_chain_idx_x4_16(node, msg[idx[1]],
                (word32)(msg[idx[2]] - msg[idx[1]]), pk_seed, addr, idx,
                key->heap);
        }
    }
    if (ret == 0) {
        XMEMCPY(node + 2 * 16, sig + idx[2] * 16, 16);
        if ((cnt > 3) && (msg[idx[2]] != j)) {
            ret = slhdsakey_chain_idx_x4_16(node, msg[idx[2]],
                (word32)(j - msg[idx[2]]), pk_seed, addr, idx, key->heap);
        }
    }
    if (ret == 0) {
        if (cnt > 3) {
            XMEMCPY(node + 3 * 16, sig + idx[3] * 16, 16);
        }
        if (j != SLHDSA_WM1) {
            ret = slhdsakey_chain_idx_x4_16(node, (word32)j,
                (word32)(SLHDSA_WM1 - j), pk_seed, addr, idx, key->heap);
        }
    }
    if (ret == 0) {
        XMEMCPY(nodes + idx[0] * 16, node + 0 * 16, 16);
        XMEMCPY(nodes + idx[1] * 16, node + 1 * 16, 16);
        XMEMCPY(nodes + idx[2] * 16, node + 2 * 16, 16);
        if (cnt > 3) {
            XMEMCPY(nodes + idx[3] * 16, node + 3 * 16, 16);
        }
    }

    return ret;
}
#endif

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
/* Computes 4 chains simultaneously from starts to w-1 when n=24.
 *
 * FIPS 205. Section 5.3. Algorithm 8.
 * wots_pkFromSig(sig, M, PK.seed, ADRS)
 *  ...
 *  10:     tmp[i] <- chain(sig[i], msg[i], w - 1 - msg[i], PK.seed, ADRS)
 *  ...
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sig      Signature - (2.n + 3) hashes of length n.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     WOTS HASH HashAddress.
 * @param [in]  msg      Encoded message with checksum.
 * @param [in]  idx      Indices of chains.
 * @param [in]  j        Shortest chain length already calculated.
 * @param [in]  cnt      Number of chains to complete.
 * @param [out] nodes    Buffer to place completed chains.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_chain_idx_to_max_24(SlhDsaKey* key, const byte* sig,
     const byte* pk_seed, word32* adrs, const byte* msg, byte* idx, int j,
     int cnt, byte* nodes)
{
    int ret = 0;
    byte node[4 * 24];
    byte addr[SLHDSA_HA_SZ];

    HA_SetChainAddress(adrs, idx[0]);
    HA_Encode(adrs, addr);

    XMEMCPY(node + 0 * 24, sig + idx[0] * 24, 24);
    if ((msg[idx[0]] != j) && (msg[idx[0]] != msg[idx[1]])) {
        ret = slhdsakey_chain(key, node, msg[idx[0]],
            (byte)(msg[idx[1]] - msg[idx[0]]), pk_seed, adrs, node);
    }
    if (ret == 0) {
        XMEMCPY(node + 1 * 24, sig + idx[1] * 24, 24);
        XMEMSET(node + 2 * 24, 0, sizeof(node) - 2 * 24);
        if ((msg[idx[1]] != j) && (msg[idx[1]] != msg[idx[2]])) {
            ret = slhdsakey_chain_idx_x4_24(node, msg[idx[1]],
                (word32)(msg[idx[2]] - msg[idx[1]]), pk_seed, addr, idx,
                key->heap);
        }
    }
    if (ret == 0) {
        XMEMCPY(node + 2 * 24, sig + idx[2] * 24, 24);
        if ((cnt > 3) && (msg[idx[2]] != j)) {
            ret = slhdsakey_chain_idx_x4_24(node, msg[idx[2]],
                (word32)(j - msg[idx[2]]), pk_seed, addr, idx, key->heap);
        }
    }
    if (ret == 0) {
        if (cnt > 3) {
            XMEMCPY(node + 3 * 24, sig + idx[3] * 24, 24);
        }
        if (j != SLHDSA_WM1) {
            ret = slhdsakey_chain_idx_x4_24(node, (word32)j,
                (word32)(SLHDSA_WM1 - j), pk_seed, addr, idx, key->heap);
        }
    }
    if (ret == 0) {
        XMEMCPY(nodes + idx[0] * 24, node + 0 * 24, 24);
        XMEMCPY(nodes + idx[1] * 24, node + 1 * 24, 24);
        XMEMCPY(nodes + idx[2] * 24, node + 2 * 24, 24);
        if (cnt > 3) {
            XMEMCPY(nodes + idx[3] * 24, node + 3 * 24, 24);
        }
    }

    return ret;
}
#endif

#if !defined(WOLFSSL_SLHDSA_PARAM_NO_256)
/* Computes 4 chains simultaneously from starts to w-1 when n=32.
 *
 * FIPS 205. Section 5.3. Algorithm 8.
 * wots_pkFromSig(sig, M, PK.seed, ADRS)
 *  ...
 *  10:     tmp[i] <- chain(sig[i], msg[i], w - 1 - msg[i], PK.seed, ADRS)
 *  ...
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sig      Signature - (2.n + 3) hashes of length n.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     WOTS HASH HashAddress.
 * @param [in]  msg      Encoded message with checksum.
 * @param [in]  idx      Indices of chains.
 * @param [in]  j        Shortest chain length already calculated.
 * parama [in]  cnt      Number of chains to complete.
 * @param [out] nodes    Buffer to place completed chains.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_chain_idx_to_max_32(SlhDsaKey* key, const byte* sig,
     const byte* pk_seed, word32* adrs, const byte* msg, byte* idx, int j,
     int cnt, byte* nodes)
{
    int ret = 0;
    byte node[4 * 32];
    byte addr[SLHDSA_HA_SZ];

    HA_SetChainAddress(adrs, idx[0]);
    HA_Encode(adrs, addr);

    XMEMCPY(node + 0 * 32, sig + idx[0] * 32, 32);
    if ((msg[idx[0]] != j) && (msg[idx[0]] != msg[idx[1]])) {
        ret = slhdsakey_chain(key, node, msg[idx[0]],
            (byte)(msg[idx[1]] - msg[idx[0]]), pk_seed, adrs, node);
    }
    if (ret == 0) {
        XMEMCPY(node + 1 * 32, sig + idx[1] * 32, 32);
        XMEMSET(node + 2 * 32, 0, sizeof(node) - 2 * 32);
        if ((msg[idx[1]] != j) && (msg[idx[1]] != msg[idx[2]])) {
            ret = slhdsakey_chain_idx_x4_32(node, msg[idx[1]],
                (word32)(msg[idx[2]] - msg[idx[1]]), pk_seed, addr, idx,
                key->heap);
        }
    }
    if (ret == 0) {
        XMEMCPY(node + 2 * 32, sig + idx[2] * 32, 32);
        if ((cnt > 3) && (msg[idx[2]] != j)) {
            ret = slhdsakey_chain_idx_x4_32(node, msg[idx[2]],
                (word32)(j - msg[idx[2]]), pk_seed, addr, idx, key->heap);
        }
    }
    if (ret == 0) {
        if (cnt > 3) {
            XMEMCPY(node + 3 * 32, sig + idx[3] * 32, 32);
        }
        if (j != SLHDSA_WM1) {
            ret = slhdsakey_chain_idx_x4_32(node, (word32)j,
                (word32)(SLHDSA_WM1 - j), pk_seed, addr, idx, key->heap);
        }
    }
    if (ret == 0) {
        XMEMCPY(nodes + idx[0] * 32, node + 0 * 32, 32);
        XMEMCPY(nodes + idx[1] * 32, node + 1 * 32, 32);
        XMEMCPY(nodes + idx[2] * 32, node + 2 * 32, 32);
        if (cnt > 3) {
            XMEMCPY(nodes + idx[3] * 32, node + 3 * 32, 32);
        }
    }

    return ret;
}
#endif
#endif

#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
/* Computes a WOTS+ public key from a message and its signature.
 *
 * Computes four iteration hashes simultaneously.
 *
 * FIPS 205. Section 5.3. Algorithm 8.
 * wots_pkFromSig(sig, M, PK.seed, ADRS)
 *  ...
 *   8: for i from 0 to len - 1 do
 *   9:     ADRS.setChainAddress(i)
 *  ...
 *  11: end for
 *  12: wotspkADRS <- ADRS     > copy address to create WOTS+ public key address
 *  13: wotspkADRS.setTypeAndClear(WOTS_PK)
 *  14: wotspkADRS.setKeyPairAddress(ADRS.getKeyPairAddress())
 *  15: pksig <- Tlen (PK.seed, wotspkADRS, tmp)
 *  16: return pksig
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sig      Signature - (2.n + 3) hashes of length n.
 * @param [in]  msg      Encoded message with checksum.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     WOTS HASH HashAddress.
 * @param [out] pk_sig   Root node - public key signature.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_wots_pk_from_sig_x4(SlhDsaKey* key, const byte* sig,
    const byte* msg, const byte* pk_seed, word32* adrs, byte* pk_sig)
{
    int ret = 0;
    HashAddress wotspk_adrs;
    byte n = key->params->n;
    byte len = key->params->len;
    WC_DECLARE_VAR(nodes, byte, SLHDSA_MAX_MSG_SZ * SLHDSA_MAX_N, key->heap);
    int hash_t_started = 0;

    WC_ALLOC_VAR_EX(nodes, byte, SLHDSA_MAX_MSG_SZ * SLHDSA_MAX_N, key->heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_128)
    if ((ret == 0) && (n == WC_SLHDSA_N_128)) {
        int i;
        sword8 j;
        byte ii = 0;
        byte idx[4] = {0};
        for (j = 0; j <= (sword8)SLHDSA_WM1; j++) {
            for (i = 0; i < len; i++) {
                if ((sword8)msg[i] == j) {
                    idx[ii++] = (byte)i;
                    if (ii == 4) {
                        ret = slhdsakey_chain_idx_to_max_16(key, sig,
                            pk_seed, adrs, msg, idx, j, 4, nodes);
                        if (ret != 0) {
                            break;
                        }
                        ii = 0;
                    }
                }
            }
        }

        if (ret == 0) {
            j = (sword8)max(max(msg[idx[0]], msg[idx[1]]), msg[idx[2]]);
            ret = slhdsakey_chain_idx_to_max_16(key, sig, pk_seed, adrs, msg,
                idx, j, 3, nodes);
        }
    }
    else
#endif
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
    if ((ret == 0) && (n == 24)) {
        int i;
        sword8 j;
        byte ii = 0;
        byte idx[4] = {0};
        for (j = 0; j <= (sword8)SLHDSA_WM1; j++) {
            for (i = 0; i < len; i++) {
                if ((sword8)msg[i] == j) {
                    idx[ii++] = (byte)i;
                    if (ii == 4) {
                        ret = slhdsakey_chain_idx_to_max_24(key, sig,
                            pk_seed, adrs, msg, idx, j, 4, nodes);
                        if (ret != 0) {
                            break;
                        }
                        ii = 0;
                    }
                }
            }
        }

        if (ret == 0) {
            j = (sword8)max(max(msg[idx[0]], msg[idx[1]]), msg[idx[2]]);
            ret = slhdsakey_chain_idx_to_max_24(key, sig, pk_seed, adrs, msg,
                idx, j, 3, nodes);
        }
    }
    else
#endif
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_256)
    if ((ret == 0) && (n == 32)) {
        int i;
        sword8 j;
        byte ii = 0;
        byte idx[4] = {0};
        for (j = 0; j <= (sword8)SLHDSA_WM1; j++) {
            for (i = 0; i < len; i++) {
                if ((sword8)msg[i] == j) {
                    idx[ii++] = (byte)i;
                    if (ii == 4) {
                        ret = slhdsakey_chain_idx_to_max_32(key, sig,
                            pk_seed, adrs, msg, idx, j, 4, nodes);
                        if (ret != 0) {
                            break;
                        }
                        ii = 0;
                    }
                }
            }
        }

        if (ret == 0) {
            j = (sword8)max(max(msg[idx[0]], msg[idx[1]]), msg[idx[2]]);
            ret = slhdsakey_chain_idx_to_max_32(key, sig, pk_seed, adrs, msg,
                idx, j, 3, nodes);
        }
    }
    else
#endif
    {
        (void)msg;
        (void)key;
        if (ret == 0) {
            ret = NOT_COMPILED_IN;
        }
    }

    if (ret == 0) {
        HA_Copy(wotspk_adrs, adrs);
        HA_SetTypeAndClearNotKPA(wotspk_adrs, HA_WOTS_PK);
        ret = HASH_T_START_ADDR(key, pk_seed, wotspk_adrs, n);
    }
    if (ret == 0) {
        hash_t_started = 1;
        ret = HASH_T_UPDATE(key, nodes, (word32)len * n);
        sig += len * n;
    }
    if (ret == 0) {
        ret = HASH_T_FINAL(key, pk_sig, n);
    }
    if (hash_t_started) {
        HASH_T_FREE(key);
    }

    WC_FREE_VAR_EX(nodes, key->heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif

#if !defined(WOLFSSL_WC_SLHDSA_SMALL_MEM)
/* Computes a WOTS+ public key from a message and its signature.
 *
 * FIPS 205. Section 5.3. Algorithm 8.
 * wots_pkFromSig(sig, M, PK.seed, ADRS)
 *  ...
 *   8: for i from 0 to len - 1 do
 *   9:     ADRS.setChainAddress(i)
 *  10:     tmp[i] <- chain(sig[i], msg[i], w - 1 - msg[i], PK.seed, ADRS)
 *  11: end for
 *  12: wotspkADRS <- ADRS     > copy address to create WOTS+ public key address
 *  13: wotspkADRS.setTypeAndClear(WOTS_PK)
 *  14: wotspkADRS.setKeyPairAddress(ADRS.getKeyPairAddress())
 *  15: pksig <- Tlen(PK.seed, wotspkADRS, tmp)
 *  16: return pksig
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sig      Signature - (2.n + 3) hashes of length n.
 * @param [in]  msg      Encoded message with checksum.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     WOTS HASH HashAddress.
 * @param [out] pk_sig   Root node - public key signature.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_wots_pk_from_sig_c(SlhDsaKey* key, const byte* sig,
    const byte* msg, const byte* pk_seed, word32* adrs, byte* pk_sig)
{
    int ret = 0;
    int i;
    byte n = key->params->n;
    byte len = key->params->len;
    HashAddress wotspk_adrs;
    WC_DECLARE_VAR(nodes, byte, SLHDSA_MAX_MSG_SZ * SLHDSA_MAX_N, key->heap);
    int hash_t_started = 0;

    WC_ALLOC_VAR_EX(nodes, byte, SLHDSA_MAX_MSG_SZ * SLHDSA_MAX_N, key->heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        /* Step 8: For each value in msg. */
        for (i = 0; i < len; i++) {
            /* Step 9: Set chain address for WOTS HASH. */
            HA_SetChainAddress(adrs, i);
            /* Step 10: Chain the hash from the msg value to w-1. */
            ret = slhdsakey_chain(key, sig, msg[i], (byte)(SLHDSA_WM1 - msg[i]),
                pk_seed, adrs, nodes + i * n);
            if (ret != 0) {
                break;
            }
            /* Move on to next signature hash. */
            sig += n;
        }
    }
    if (ret == 0) {
        /* Step 12-14: Copy the address for WOTS PK. */
        HA_Copy(wotspk_adrs, adrs);
        HA_SetTypeAndClearNotKPA(wotspk_adrs, HA_WOTS_PK);
        /* Step 15: Hash the public key seed and WOTS PK address ... */
        ret = HASH_T_START_ADDR(key, pk_seed, wotspk_adrs, n);
    }
    if (ret == 0) {
        hash_t_started = 1;
        /* Step 15: Update with the nodes ... */
        ret = HASH_T_UPDATE(key, nodes, (word32)len * n);
    }
    if (ret == 0) {
        /* Step 15: Generate root node - public key signature. */
        ret = HASH_T_FINAL(key, pk_sig, n);
    }
    if (hash_t_started) {
        HASH_T_FREE(key);
    }

    WC_FREE_VAR_EX(nodes, key->heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#else
/* Computes a WOTS+ public key from a message and its signature.
 *
 * FIPS 205. Section 5.3. Algorithm 8.
 * wots_pkFromSig(sig, M, PK.seed, ADRS)
 *  ...
 *   8: for i from 0 to len - 1 do
 *   9:     ADRS.setChainAddress(i)
 *  10:     tmp[i] <- chain(sig[i], msg[i], w - 1 - msg[i], PK.seed, ADRS)
 *  11: end for
 *  12: wotspkADRS <- ADRS     > copy address to create WOTS+ public key address
 *  13: wotspkADRS.setTypeAndClear(WOTS_PK)
 *  14: wotspkADRS.setKeyPairAddress(ADRS.getKeyPairAddress())
 *  15: pksig <- Tlen (PK.seed, wotspkADRS, tmp)
 *  16: return pksig
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sig      Signature - (2.n + 3) hashes of length n.
 * @param [in]  msg      Encoded message with checksum.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     WOTS HASH HashAddress.
 * @param [out] pk_sig   Root node - public key signature.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_wots_pk_from_sig_c(SlhDsaKey* key, const byte* sig,
    const byte* msg, const byte* pk_seed, word32* adrs, byte* pk_sig)
{
    int ret;
    int i;
    byte n = key->params->n;
    byte len = key->params->len;
    HashAddress wotspk_adrs;
    byte* node = pk_sig;
    int hash_t_started = 0;

    /* Step 12-14: Copy the address for WOTS PK. */
    HA_Copy(wotspk_adrs, adrs);
    HA_SetTypeAndClearNotKPA(wotspk_adrs, HA_WOTS_PK);
    /* Step 15: Hash the public key seed and WOTS PK address ... */
    ret = HASH_T_START_ADDR(key, pk_seed, wotspk_adrs, n);
    if (ret == 0) {
        hash_t_started = 1;
        /* Step 8: For each value in msg. */
        for (i = 0; i < len; i++) {
            /* Step 9: Set chain address for WOTS HASH. */
            HA_SetChainAddress(adrs, i);
            /* Step 10: Chain the hash from the msg value to w-1. */
            ret = slhdsakey_chain(key, sig, msg[i], (byte)(SLHDSA_WM1 - msg[i]),
                pk_seed, adrs, node);
            if (ret != 0) {
                break;
            }
            /* Step 15: Update with node ... */
            ret = HASH_T_UPDATE(key, node, n);
            if (ret != 0) {
                break;
            }
            /* Move on to next signature hash. */
            sig += n;
        }
    }
    if (ret == 0) {
        /* Step 15: Generate root node - public key signature. */
        ret = HASH_T_FINAL(key, pk_sig, n);
    }
    if (hash_t_started) {
        HASH_T_FREE(key);
    }

    return ret;
}
#endif

/* Computes a WOTS+ public key from a message and its signature.
 *
 * FIPS 205. Section 5.3. Algorithm 8.
 * wots_pkFromSig(sig, M, PK.seed, ADRS)
 *   1: csum <- 0
 *   2: msg <- base_2b(M , lgw , len1 )              > convert message to base w
 *   3: for i from 0 to len1 - 1 do
 *   4:     csum <- csum + w - 1 - msg[i]
 *   5: end for                                               > compute checksum
 *   6: csum <- csum << ((8 - ((len2.lgw) mod 8)) mod 8)
 *                                                > for lgw = 4, left shift by 4
 *   7: msg <- msg || base_2b(toByte(csum, upper(len2.lgw/8)), lgw , len2)
 *  ...
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sig      Signature - (2.n + 3) hashes of length n.
 * @param [in]  m        Message.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     WOTS HASH HashAddress.
 * @param [out] pk_sig   Root node - public key signature.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_wots_pk_from_sig(SlhDsaKey* key, const byte* sig,
    const byte* m, const byte* pk_seed, word32* adrs, byte* pk_sig)
{
    int ret;
    word16 csum;
    byte n = key->params->n;
    int i;
    byte msg[SLHDSA_MAX_MSG_SZ];

    /* Step 1: Start csum at 0 */
    csum = 0;
    /* Step 3: For each byte in message. */
    for (i = 0; i < n * 2; i += 2) {
        /* Step 2: Append high order 4 bits to msg. */
        msg[i+0] = (byte)((m[i / 2] >> 4) & 0xf);
        /* Step 4: Calculate checksum with first lgw bits. */
        csum = (word16)(csum + SLHDSA_WM1 - msg[i + 0]);
        /* Step 2: Append low order 4 bits to msg. */
        msg[i+1] = (byte)( m[i / 2]       & 0xf);
        /* Step 4: Calculate checksum with next lgw bits. */
        csum = (word16)(csum + SLHDSA_WM1 - msg[i + 1]);
    }
    /* Steps 6-7: Encode bottom 12 bits of csum onto end of msg. */
    msg[i + 0] = (byte)((csum >> 8) & 0xf);
    msg[i + 1] = (byte)((csum >> 4) & 0xf);
    msg[i + 2] = (byte)( csum       & 0xf);

    /* Steps 8-16. */
#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
    if (!SLHDSA_IS_SHA2(key->params->param) &&
            IS_INTEL_AVX2(cpuid_flags) &&
            (SAVE_VECTOR_REGISTERS2() == 0)) {
        ret = slhdsakey_wots_pk_from_sig_x4(key, sig, msg, pk_seed, adrs,
            pk_sig);
        RESTORE_VECTOR_REGISTERS();
    }
    else
#endif
    {
        ret = slhdsakey_wots_pk_from_sig_c(key, sig, msg, pk_seed, adrs,
            pk_sig);
    }

    return ret;
}

/******************************************************************************
 * XMSS
 ******************************************************************************/

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
#ifndef WOLFSSL_WC_SLHDSA_RECURSIVE
/* Compute the root node of Merkle subtree of WOTS+ public keys.
 *
 * Algorithm 9 xmss_node(SK.seed, i, z, PK.seed, ADRS)
 *   1: if z = 0 then
 *   2:     ADRS.setTypeAndClear(WOTS_HASH)
 *   3:     ADRS.setKeyPairAddress(i)
 *   4:     node <- wots_pkGen(SK.seed, PK.seed, ADRS)
 *   5: else
 *   6:     lnode <- xmss_node(SK.seed, 2i, z - 1, PK.seed, ADRS)
 *   7:     rnode <- xmss_node(SK.seed, 2i + 1, z - 1, PK.seed, ADRS)
 *   8:     ADRS.setTypeAndClear(TREE)
 *   9:     ADRS.setTreeHeight(z)
 *  10:     ADRS.setTreeIndex(i)
 *  11:     node <- H(PK.seed, ADRS, lnode || rnode)
 *  12: end if
 *  13: return node
 *
 * @param [in]       key      SLH-DSA key.
 * @param [in]       sk_seed  Private key seed.
 * @param [in]       i        Node index.
 * @param [in]       z        Node height.
 * @param [in]       pk_seed  Public key seed.
 * @param [in, out]  adrs     HashAddress - WOTS HASH.
 * @param [out]      node     Root node.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_xmss_node(SlhDsaKey* key, const byte* sk_seed, int i,
    int z, const byte* pk_seed, word32* adrs, byte* node)
{
    int ret = 0;

    /* Step 1: Are we at the bottom of the subtree. */
    if (z == 0) {
        /* Step 2: Copy the address for WOTS HASH. */
        HA_SetTypeAndClearNotKPA(adrs, HA_WOTS_HASH);
        /* Step 3: Set key pair address. */
        HA_SetKeyPairAddress(adrs, i);
        /* Step 4: Generate WOTS+ public key. */
        ret = slhdsakey_wots_pkgen(key, sk_seed, pk_seed, adrs, node);
    }
    else {
        WC_DECLARE_VAR(nodes, byte, (SLHDSA_MAX_H_M + 2) * SLHDSA_MAX_N,
            key->heap);
        word32 j;
        word32 k;
        word32 m = (word32)1U << z;
        byte n = key->params->n;

        WC_ALLOC_VAR_EX(nodes, byte, (SLHDSA_MAX_H_M + 2) * SLHDSA_MAX_N,
            key->heap, DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
        if (ret == 0) {
            /* For each node at bottom of tree. */
            for (j = 0; j < m; j++) {
                /* Step 2: Copy the address for WOTS HASH. */
                HA_SetTypeAndClearNotKPA(adrs, HA_WOTS_HASH);
                /* Step 3: Set key pair address. */
                HA_SetKeyPairAddress(adrs, m * (word32)i + j);
                /* Step 4: Generate WOTS+ public key. */
                ret = slhdsakey_wots_pkgen(key, sk_seed, pk_seed, adrs,
                    nodes + ((word32)z - 1U + (j & 1U)) * n);
                if (ret != 0) {
                    break;
                }

                /* For intermediate nodes. */
                for (k = (word32)z - 1U; k > 0; k--) {
                    if (((j >> ((word32)z - 1U - k)) & 1U) == 1U) {
                        /* Step 6 and 7 have been done.  */
                        /* Steps 8-10: Step type, height and index for TREE. */
                        HA_SetTypeAndClear(adrs, HA_TREE);
                        HA_SetTreeHeight(adrs, (word32)z - k);
                        HA_SetTreeIndex(adrs,
                                        (m * (word32)i + j) >> ((word32)z - k));
                        /* Step 11: Calculate node from two below. */
                        ret = HASH_H(key, pk_seed, adrs, nodes + k * n, n,
                                nodes +
                                  (k - 1U + ((j >> ((word32)z - k)) & 1U)) * n);
                        if (ret != 0) {
                            break;
                        }
                    }
                    else {
                        break;
                    }
                }
                if (ret != 0) {
                    break;
                }
            }
            if (ret == 0) {
                /* Root node into output. */
                /* Steps 8-10: Step type, height and index for TREE. */
                HA_SetTypeAndClear(adrs, HA_TREE);
                HA_SetTreeHeight(adrs, z);
                HA_SetTreeIndex(adrs, i);
                /* Step 11: Calculate node from two below. */
                ret = HASH_H(key, pk_seed, adrs, nodes, n, node);
            }
        }

        WC_FREE_VAR_EX(nodes, key->heap, DYNAMIC_TYPE_SLHDSA);
    }

    return ret;
}
#else
/* Compute the root node of Merkle subtree of WOTS+ public keys.
 *
 * FIPS 205. Section 6.1. Algorithm 9.
 * xmss_node(SK.seed, i, z, PK.seed, ADRS)
 *   1: if z = 0 then
 *   2:     ADRS.setTypeAndClear(WOTS_HASH)
 *   3:     ADRS.setKeyPairAddress(i)
 *   4:     node <- wots_pkGen(SK.seed, PK.seed, ADRS)
 *   5: else
 *   6:     lnode <- xmss_node(SK.seed, 2i, z - 1, PK.seed, ADRS)
 *   7:     rnode <- xmss_node(SK.seed, 2i + 1, z - 1, PK.seed, ADRS)
 *   8:     ADRS.setTypeAndClear(TREE)
 *   9:     ADRS.setTreeHeight(z)
 *  10:     ADRS.setTreeIndex(i)
 *  11:     node <- H(PK.seed, ADRS, lnode || rnode)
 *  12: end if
 *  13: return node
 *
 * @param [in]       key      SLH-DSA key.
 * @param [in]       sk_seed  Private key seed.
 * @param [in]       i        Node index.
 * @param [in]       z        Node height.
 * @param [in]       pk_seed  Public key seed.
 * @param [in, out]  adrs     HashAddress - WOTS HASH.
 * @param [out]      node     Root node.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_xmss_node(SlhDsaKey* key, const byte* sk_seed, int i,
    int z, const byte* pk_seed, word32* adrs, byte* node)
{
    int ret;
    byte nodes[2 * SLHDSA_MAX_N];

    /* Step 1: Are we at the bottom of the subtree. */
    if (z == 0) {
        /* Step 2: Copy the address for WOTS HASH. */
        HA_SetTypeAndClearNotKPA(adrs, HA_WOTS_HASH);
        /* Step 3: Set key pair address. */
        HA_SetKeyPairAddress(adrs, i);
        /* Step 4: Generate WOTS+ public key. */
        ret = slhdsakey_wots_pkgen(key, sk_seed, pk_seed, adrs, node);
    }
    else {
        byte n = key->params->n;

        /* Step 6: Calculate left node recursively. */
        ret = slhdsakey_xmss_node(key, sk_seed, 2 * i, z - 1, pk_seed, adrs,
            nodes);
        if (ret == 0) {
            /* Step 7: Calculate right node recursively. */
            ret = slhdsakey_xmss_node(key, sk_seed, 2 * i + 1, z - 1, pk_seed,
                adrs, nodes + n);
        }
        if (ret == 0) {
            /* Steps 8-10: Step type, height and index for TREE. */
            HA_SetTypeAndClear(adrs, HA_TREE);
            HA_SetTreeHeight(adrs, z);
            HA_SetTreeIndex(adrs, i);
            /* Step 11: Calculate node from two below. */
            ret = HASH_H(key, pk_seed, adrs, nodes, n, node);
        }
    }

    return ret;
}
#endif

/* Generate XMSS signature.
 *
 * FIPS 205. Section 6.2. Algorithm 10.
 * xmss_sign(M SK.seed, idx PK.seed, ADRS)
 *   1: for j from 0 to h' - 1 do                    > build authentication path
 *   2:     k <- lower(idx/2^j) XOR 1
 *   3:     AUTH[j] <- xmss_node(SK.seed, k, j, PK.seed, ADRS)
 *   4: end for
 *   5: ADRS.setTypeAndClear(WOTS_HASH)
 *   6: ADRS.setKeyPairAddress(idx)
 *   7: sig <- wots_sign(M , SK.seed, PK.seed, ADRS)
 *   8: SIGXMSS <- sig || AUTH
 *   9: return SIGXMSS
 *
 * @param [in]  key       SLH-DSA key.
 * @param [in]  m         n-byte message.
 * @param [in]  sk_seed   Private key seed.
 * @param [in]  idx       Key pair address of WOTS hash.
 * @param [in]  pk_seed   Public key seed.
 * @param [in]  adrs      HashAddress.
 * @param [out] sig_xmss  XMSS signature.
 *                        len n-byte nodes and h' authentication nodes.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_xmss_sign(SlhDsaKey* key, const byte* m,
    const byte* sk_seed, word32 idx, const byte* pk_seed, word32* adrs,
    byte* sig_xmss)
{
    int ret = WC_NO_ERR_TRACE(BAD_FUNC_ARG);
    byte n = key->params->n;
    byte len = key->params->len;
    byte h_m = key->params->h_m;
    /* Step 8: Place authentication nodes after WOTS+ signature. */
    byte* auth = sig_xmss + (len * n);
    word32 i = idx;
    int j;

    /* Step 1: For each height of XMSS tree. */
    for (j = 0; j < h_m; j++) {
        /* Step 2: Calculate index of other node. */
        word32 k = i ^ 1;
        /* Step 3: Calculate authentication node. */
        ret = slhdsakey_xmss_node(key, sk_seed, (int)k, j, pk_seed, adrs,
            auth);
        if (ret != 0) {
            break;
        }
        /* Step 3: Move to next authentication node. */
        auth += n;
        /* Step 2: Update index. */
        i >>= 1;
    }

    if (ret == 0) {
        /* Step 5: Set address of WOTS HASH. */
        HA_SetTypeAndClearNotKPA(adrs, HA_WOTS_HASH);
        /* Step 6: Set key pair address into address. */
        HA_SetKeyPairAddress(adrs, idx);
        /* Step 7: WOTS+ sign message. */
        ret = slhdsakey_wots_sign(key, m, sk_seed, pk_seed, adrs, sig_xmss);
    }

    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* Compute XMSS public key from XMSS signature.
 *
 * FIPS 205. Section 6.3. Algorithm 11.
 * xmss_pkFromSig(idx, SIGXMSS, M PK.seed, ADRS)
 *   1: ADRS.setTypeAndClear(WOTS_HASH)        > compute WOTS+ pk from WOTS+ sig
 *   2: ADRS.setKeyPairAddress(idx)
 *   3: sig <- SIGXMSS.getWOTSSig()                      > SIGXMSS [0 : len . n]
 *   4: AUTH <- SIGXMSS.getXMSSAUTH()       > SIGXMSS [len . n : (len + h') . n]
 *   5: node[0] <- wots_pkFromSig(sig, M, PK.seed, ADRS)
 *   6: ADRS.setTypeAndClear(TREE)         > compute root from WOTS+ pk and AUTH
 *   7: ADRS.setTreeIndex(idx
 *   8: for k from 0 to h' - 1 do
 *   9:     ADRS.setTreeHeight(k + 1)
 *  10:     if lower(idx/2^k) is even then
 *  11:         ADRS.setTreeIndex(ADRS.getTreeIndex()/2)
 *  12:         node[1] <- H(PK.seed, ADRS, node[0] || AUTH[k])
 *  13:     else
 *  14:         ADRS.setTreeIndex((ADRS.getTreeIndex() - 1)/2)
 *  15:         node[1] <- H(PK.seed, ADRS, AUTH[k] || node[0])
 *  16:     end if
 *  17:     node[0] <- node[1]
 *  18: end for
 *  19: return node[0]
 *
 * @param [in]  key       SLH-DSA key.
 * @param [in]  idx       Key pair address of WOTS hash.
 * @param [in]  sig_xmss  XMSS signature.
 *                        len n-byte nodes and h' authentication nodes.
 * @param [in]  m         n-byte message.
 * @param [in]  pk_seed   Public key seed.
 * @param [in]  adrs      HashAddress.
 * @param [out] node      XMSS public key.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_xmss_pk_from_sig(SlhDsaKey* key, word32 idx,
    const byte* sig_xmss, const byte* m, const byte* pk_seed, word32* adrs,
    byte* node)
{
    int ret;
    byte n = key->params->n;
    byte h_m = key->params->h_m;
    byte len = key->params->len;
    /* Step  3: Set pointer to first signature node. */
    const byte* sig = sig_xmss;
    /* Step 4: Set pointer to first authentication node. */
    const byte* auth = sig_xmss + (len * n);
    int k;

    /* Step 1: Set address type to WOTS HASH. */
    HA_SetTypeAndClear(adrs, HA_WOTS_HASH);
    /* Step 2: Set key pair address. */
    HA_SetKeyPairAddress(adrs, idx);
    /* Step 5: Compute WOTS+ public key from signature. */
    ret = slhdsakey_wots_pk_from_sig(key, sig, m, pk_seed, adrs, node);
    if (ret == 0) {
        /* Step 6: Set address type to TREE. */
        HA_SetTypeAndClear(adrs, HA_TREE);
        /* Step 2: Set key pair address. */
        HA_SetTreeIndex(adrs, idx);
        /* Step 8: For each height of the XMSS tree. */
        for (k = 0; k < h_m; k++) {
            /* Calculate which side the current and authentication nodes are. */
            byte side = idx & 1;
            /* Update tree index. */
            idx >>= 1;

            /* Step 9: Set tree height. */
            HA_SetTreeHeight(adrs, k + 1);
            /* Steps 11 and 14: Set tree index. */
            HA_SetTreeIndex(adrs, idx);
            /* Step 10: Check which order to put nodes. */
            if (side == 0) {
                /* Steps 12,17: Calculate node with sig node on right. */
                ret = HASH_H_2(key, pk_seed, adrs, node, auth, n, node);
            }
            else {
                /* Steps 15,17: Calculate node with sig node on left. */
                ret = HASH_H_2(key, pk_seed, adrs, auth, node, n, node);
            }
            if (ret != 0) {
                break;
            }
            /* Next authentication node. */
            auth += n;
        }
    }

    return ret;
}

/******************************************************************************
 * HT - HyperTree
 ******************************************************************************/

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Generate hypertree signature.
 *
 * FIPS 205. Section 7.1. Algorithm 12.
 * ht_sign(M SK.seed, PK.seed, idxtree, idxleaf)
 *   1: ADRS <- toByte(0, 32)
 *   2: ADRS.setTreeAddress(idxtree)
 *   3: SIGtmp <- xmss_sign(x, SK.seed, idxleaf, PK.seed, ADRS)
 *   4: SIGHT <- SIGtmp
 *   5: root <- xmss_pkFromSig(idxleaf, SIGtmp, M, PK.seed, ADRS)
 *   6: for j from 1 to d - 1 do
 *   7:     idxleaf <- idxleaf mod 2^h'   > h' least significant bits of idxtree
 *   8:     idxtree <- idxtree >> h'
 *                               > remove least significant h' bits from idxtree
 *   9:     ADRS.setLayerAddress(j)
 *  10:    ADRS.setTreeAddress(idxtree)
 *  11:    SIGtmp <- xmss_sign(root, SK.seed, idxleaf, PK.seed, ADRS)
 *  12:    SIGHT <- SIGHT || SIGtmp
 *  13:    if j < d - 1 then
 *  14:        root <- xmss_pkFromSig(idxleaf, SIGtmp, root, PK.seed, ADRS)
 *  15:    end if
 *  16: end for
 *  17: return SIGHT
 *
 * @param [in]  key       SLH-DSA key.
 * @param [in]  pk_fors   FORS public key.
 * @param [in]  sk_seed   Private key seed.
 * @param [in]  pk_seed   Public key seed.
 * @param [in]  idx_tree  Tree address.
 * @param [in]  idx_leaf  Key pair address.
 * @param [out] sig_ht    Hypertree signature - d x n-byte nodes.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_ht_sign(SlhDsaKey* key, const byte* pk_fors,
    const byte* sk_seed, const byte* pk_seed, word32* idx_tree, word32 idx_leaf,
    byte* sig_ht)
{
    int ret;
    HashAddress adrs;
    byte root[SLHDSA_MAX_N];
    byte n = key->params->n;
    byte h_m = key->params->h_m;
    byte len = key->params->len;
    byte d = key->params->d;
    int j;
    word32 mask = ((word32)1U << h_m) - 1U;

    /* Step 1: Set address to all zeros. */
    HA_Init(adrs);
    /* Step 2: Set tree address. */
    HA_SetTreeAddress(adrs, idx_tree);
    /* Step 3: Compute XMSS signature. */
    ret = slhdsakey_xmss_sign(key, pk_fors, sk_seed, idx_leaf, pk_seed, adrs,
        sig_ht);
    if (ret == 0) {
        /* Step 5: Compute root/public key from signature. */
        ret = slhdsakey_xmss_pk_from_sig(key, idx_leaf, sig_ht, pk_fors,
            pk_seed, adrs, root);
        /* Step 4: Step hypertree signature over XMSS signature. */
        sig_ht += (h_m + len) * n;
    }
    if (ret == 0) {
        /* Step 6: For remaining depths. */
        for (j = 1; j < d; j++) {
            /* Step 7: Get bottom h' bits for index into tree. */
            idx_leaf = INDEX_TREE_MASK(idx_tree, mask);
            /* Step 8: Update tree index to exclude this subtree. */
            INDEX_TREE_SHIFT_DOWN(idx_tree, h_m);
            /* Step 9: Set layer address. */
            HA_SetLayerAddress(adrs, j);
            /* Step 10: Set tree index. */
            HA_SetTreeAddress(adrs, idx_tree);
            /* Step 11: Compute XMSS signature. */
            ret = slhdsakey_xmss_sign(key, root, sk_seed, idx_leaf, pk_seed,
                adrs, sig_ht);
            if (ret != 0) {
                break;
            }
            /* Step 13: Check if we need to calculate next root. */
            if (j < d) {
                /* Step 14: Compute root/public key from signature. */
                ret = slhdsakey_xmss_pk_from_sig(key, idx_leaf, sig_ht, root,
                    pk_seed, adrs, root);
                if (ret != 0) {
                    break;
                }
            }
            /* Step 12: Step hypertree signature over XMSS signature. */
            sig_ht += (h_m + len) * n;
        }
    }

    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* Verify hypertree signature.
 *
 * FIPS 205. Section 7.2 Algorithm 13.
 * ht_verify(M SIGHT, PK.seed, idxtree, idxleaf, PK.root)
 *   1: ADRS <- toByte(0, 32)
 *   2: ADRS.setTreeAddress(idxtree)
 *   3: SIGtmp <- SIGHT.getXMSSSignature(0)          > SIGHT[0 : (h' + len) . n]
 *   4: node <- xmss_pkFromSig(idxleaf, SIGtmp, M, PK.seed, ADRS)
 *   5: for j from 1 to d - 1 do
 *   6:     idxleaf <- idxtree mod 2^h'   > h' least significant bits of idxtree
 *   7:     idxtree <- idxtree >> h'
 *                               > remove least significant h' bits from idxtree
 *   8:     ADRS.setLayerAddress(j)
 *   9:     ADRS.setTreeAddress(idxtree)
 *  10:     SIGtmp <- SIGHT .getXMSSSignature(j)
 *                            > SIGHT[h . (h' + len) . n : (j + 1)(h' + len . n]
 *  11:     node <- xmss_pkFromSig(idxleaf, SIGtmp, node, PK.seed, ADRS)
 *  12: end for
 *  13: if node = PK.root then
 *  14:     return true
 *  15: else
 *  16:     return false
 *  17: end if
 *
 * @param [in] key       SLH-DSA key.
 * @param [in] m         Message to verify.
 * @param [in] sig_ht    Hypertree signature.
 * @param [in] pk_seed   Public key seed.
 * @param [in] idx_tree  Tree address.
 * @param [in] idx_leaf  Key pair address.
 * @param [in] pk_root   Public key root node.
 * @return  0 on success.
 * @return  SIG_VERIFY_E when calculated node doesn't match public key node.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_ht_verify(SlhDsaKey* key, const byte* m,
    const byte* sig_ht, const byte* pk_seed, word32* idx_tree, word32 idx_leaf,
    const byte* pk_root)
{
    int ret;
    HashAddress adrs;
    byte node[SLHDSA_MAX_N];
    byte n = key->params->n;
    byte h_m = key->params->h_m;
    byte len = key->params->len;
    byte d = key->params->d;
    int j;
    /* For Step 6. */
    word32 mask = ((word32)1U << h_m) - 1U;

    /* Step 1: Set address to all zeros. */
    HA_Init(adrs);
    /* Step 2: Set tree address. */
    HA_SetTreeAddress(adrs, idx_tree);
    /* Step 4: Get public key node from XMSS signature. */
    ret = slhdsakey_xmss_pk_from_sig(key, idx_leaf, sig_ht, m, pk_seed, adrs,
        node);
    /* Step 3: Move over XMSS signature. */
    sig_ht += (h_m + len) * n;

    if (ret == 0) {
        /* Step 5: For remaining depths. */
        for (j = 1; j < d; j++) {
            /* Step 6: Get bottom h' bits for index into tree. */
            idx_leaf = INDEX_TREE_MASK(idx_tree, mask);
            /* Step 7: Update tree index to exclude this subtree. */
            INDEX_TREE_SHIFT_DOWN(idx_tree, h_m);
            /* Step 8: Set layer address. */
            HA_SetLayerAddress(adrs, j);
            /* Step 9: Set tree index. */
            HA_SetTreeAddress(adrs, idx_tree);
            /* Step 11: Get public key node from XMSS signature. */
            ret = slhdsakey_xmss_pk_from_sig(key, idx_leaf, sig_ht, node,
                pk_seed, adrs, node);
            if (ret != 0) {
                break;
            }
            /* Step 10: Move over XMSS signature. */
            sig_ht += (h_m + len) * n;
        }
    }
    /* Step 13: Compare computed node with public key root. */
    if ((ret == 0) && (XMEMCMP(node, pk_root, n) != 0)) {
        /* Step 16: Return signature verification failed. */
        ret = SIG_VERIFY_E;
    }

    return ret;
}

/******************************************************************************
 * FORS
 ******************************************************************************/

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Generate FORS private-key value.
 *
 * FIPS 205. Section 8.1. Algorithm 14
 * fors_skGen(SK.seed, PK.seed, ADRS, idx)
 *   1: skADRS <- ADRS           > copy address to create key generation address
 *   2: skADRS.setTypeAndClear(FORS_PRF)
 *   3: skADRS.setKeyPairAddress(ADRS.getKeyPairAddress())
 *   4: skADRS.setTreeIndex(idx)
 *   5: return PRF(PK.seed, SK.seed, skADRS)
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     HashAddress.
 * @param [in]  idx      Private key index.
 * @param [out] node     FORS private-key value.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_fors_sk_gen(SlhDsaKey* key, const byte* sk_seed,
    const byte* pk_seed, word32* adrs, word32 idx, byte* node)
{
    HashAddress sk_adrs;

    /* Step 1: Copy address to FORS PRF. */
    HA_Copy(sk_adrs, adrs);
    /* Steps 2-3: Set type and keep key pair address. */
    HA_SetTypeAndClearNotKPA(sk_adrs, HA_FORS_PRF);
    /* Step 4: Set tree index. */
    HA_SetTreeIndex(sk_adrs, idx);
    /* Step 5: Hash seeds and address. */
    return HASH_PRF(key, pk_seed, sk_seed, sk_adrs, key->params->n,
        node);
}

#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
/* PRF hash 4 simultaneously.
 *
 * Each hash varies by the tree index with the first value in sequence passed
 * in.
 *
 * FIPS 205. Section 4.1.
 *   PRF(PK.seed, SK.seed, ADRS) (Bn x Bn x B32 -> Bn) is a PRF that is used to
 *   generate the secret values in WOTS+ and FORS private keys.
 * FIPS 205. Section 11.1.
 *   PRF(PK.seed, SK.seed, ADRS) = SHAKE256(PK.seed || ADRS || SK.seed, 8n)
 *
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  addr     Encoded HashAddress.
 * @param [in]  n        Number of bytes in hash output.
 * @param [in]  ti       Tree index start value.
 * @param [out] node     Buffer to hold hash output.
 * @param [in]  heap     Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_hash_prf_ti_x4(const byte* pk_seed, const byte* sk_seed,
    byte* addr, byte n, word32 ti, byte* node, void* heap)
{
    int ret = 0;
    word32 o = 0;
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        o = slhdsakey_shake256_set_seed_ha_hash_x4(state, pk_seed, addr,
            sk_seed, n);
        SHAKE256_SET_TREE_INDEX(state, o, ti);
        ret = SAVE_VECTOR_REGISTERS2();
        if (ret == 0) {
            sha3_blocksx4_avx2(state);
            RESTORE_VECTOR_REGISTERS();
            slhdsakey_shake256_get_hash_x4(state, node, n);
        }

        /* state holds the secret PRF output (FORS key). */
        ForceZero(state, sizeof(word64) * SLHDSA_SHAKE_X4_STATE_W);
        WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    }

    return ret;
}

/* F hash 4 simultaneously.
 *
 * Each hash varies by the tree index with the first value in sequence passed
 * in.
 *
 * FIPS 205. Section 4.1.
 *   F(PK.seed, ADRS, M1) (Bn x B32 x Bn -> Bn) is a hash function that takes an
 *   n-byte message as input and produces an n-byte output.
 * FIPS 205. Section 11.1.
 *   F(PK.seed, ADRS, M1) = SHAKE256(PK.seed || ADRS || M1 , 8n)
 *
 * @param [in]      pk_seed  Public key seed.
 * @param [in]      addr     Encoded HashAddress.
 * @param [in, out] node     On in, n-byte messages. On out, n-byte outputs.
 * @param [in]      n        Number of bytes in hash output.
 * @param [in]      ti       Tree index start value.
 * @param [in]      heap     Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_hash_f_ti_x4(const byte* pk_seed, byte* addr, byte* node,
    byte n, word32 ti, void* heap)
{
    int ret = 0;
    int i;
    word32 o = 0;
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        o = slhdsakey_shake256_set_seed_ha_x4(state, pk_seed, addr, n);
        SHAKE256_SET_TREE_INDEX(state, o, ti);
        for (i = 0; i < n / 8; i++) {
            state[o + 0] = ((word64*)(node + 0 * n))[i];
            state[o + 1] = ((word64*)(node + 1 * n))[i];
            state[o + 2] = ((word64*)(node + 2 * n))[i];
            state[o + 3] = ((word64*)(node + 3 * n))[i];
            o += 4;
        }
        SHAKE256_SET_END_X4(state, o);
        ret = SAVE_VECTOR_REGISTERS2();
        if (ret == 0) {
            sha3_blocksx4_avx2(state);
            RESTORE_VECTOR_REGISTERS();
            slhdsakey_shake256_get_hash_x4(state, node, n);
        }

        WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    }

    return ret;
}

/* H hash 4 simultaneously.
 *
 * Each hash varies by the tree index with the first value in sequence passed
 * in.
 *
 * FIPS 205. Section 4.1.
 *   H(PK.seed, ADRS, M2) (Bn x B32 x B2n -> Bn) is a special case of Tl that
 *   takes a 2n-byte message as input.
 * FIPS 205. Section 11.1.
 *   H(PK.seed, ADRS, M2) = SHAKE256(PK.seed || ADRS || M2, 8n)
 *
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  addr     Encoded HashAddress.
 * @param [in]  m        2n-byte message.
 * @param [in]  n        Number of bytes in hash output.
 * @param [in]  ti       Tree index start value.
 * @param [out] hash     Buffer to hold hash output.
 * @param [in]  heap     Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_hash_h_ti_x4(const byte* pk_seed, byte* addr,
    const byte* m, byte n, word32 ti, byte* hash, void* heap)
{
    int ret = 0;
    int i;
    word32 o = 0;
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        o = slhdsakey_shake256_set_seed_ha_x4(state, pk_seed, addr, n);
        SHAKE256_SET_TREE_INDEX(state, o, ti);
        for (i = 0; i < 2 * n / 8; i++) {
            state[o + 0] = ((const word64*)(m + 0 * n))[i];
            state[o + 1] = ((const word64*)(m + 2 * n))[i];
            state[o + 2] = ((const word64*)(m + 4 * n))[i];
            state[o + 3] = ((const word64*)(m + 6 * n))[i];
            o += 4;
        }
        SHAKE256_SET_END_X4(state, o);
        ret = SAVE_VECTOR_REGISTERS2();
        if (ret == 0) {
            sha3_blocksx4_avx2(state);
            RESTORE_VECTOR_REGISTERS();
            slhdsakey_shake256_get_hash_x4(state, hash, n);
        }

        WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    }

    return ret;
}

/* A ranges from 6-14. */
#if SLHDSA_MAX_A < 9
    /* Maximum node depth that determines the number of nodes stored and
     * hashed in one call. */
    #define SLHDSA_MAX_FORS_NODE_DEPTH      (SLHDSA_MAX_A-1)
#else
    /* Maximum node depth that determines the number of nodes stored and
     * hashed in one call. */
    #define SLHDSA_MAX_FORS_NODE_DEPTH      8
#endif
/* Maximum node depth that determines the number of nodes stored and
 * hashed in one call with an 8 depth tree below. */
#define SLHDSA_MAX_FORS_NODE_TOP_DEPTH  \
    (SLHDSA_MAX_A - SLHDSA_MAX_FORS_NODE_DEPTH)

/* Compute the root of a zero height Merkle subtree of FORS public values.
 *
 * Performs 4 hashes at the same time where possible.
 *
 * FIPS 205. Section 8.2. Algorithm 15.
 * fors_node(SK.seed, i, z, PK.seed, ADRS)
 *   1: if z = 0 then
 *   2:     sk <- fors_skGen(SK.seed, PK.seed, ADRS, i)
 *   3:     ADRS.setTreeHeight(0)
 *   4:     ADRS.setTreeIndex(i)
 *   5:     node <- F(PK.seed, ADRS, sk)
 *   6: else
 *  ...
 *  13: return node
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  i        Node index.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     FORS tree HashAddress.
 * @param [out] node     n-byte root node.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_fors_node_x4_z0(SlhDsaKey* key, const byte* sk_seed,
    word32 i, const byte* pk_seed, word32* adrs, byte* node)
{
    int ret;
    byte n = key->params->n;

    /* Step 2: Generate private key value for index. */
    ret = slhdsakey_fors_sk_gen(key, sk_seed, pk_seed, adrs, i, node);
    if (ret == 0) {
        /* Step 3: Set tree height to zero. */
        HA_SetTreeHeight(adrs, 0);
        /* Step 4: Set tree index. */
        HA_SetTreeIndex(adrs, i);
        /* Step 5: Compute node from public key seed, address and value. */
        ret = HASH_F(key, pk_seed, adrs, node, n, node);
    }

    return ret;
}

/* Compute the root of a one height Merkle subtree of FORS public values.
 *
 * Performs 4 hashes at the same time where possible.
 *
 * FIPS 205. Section 8.2. Algorithm 15.
 * fors_node(SK.seed, i, z, PK.seed, ADRS)
 *   1: if z = 0 then
 *   2:     sk <- fors_skGen(SK.seed, PK.seed, ADRS, i)
 *   3:     ADRS.setTreeHeight(0)
 *   4:     ADRS.setTreeIndex(i)
 *   5:     node <- F(PK.seed, ADRS, sk)
 *   6: else
 *   7:     lnode <- fors_node(SK.seed, 2i, z - 1, PK.seed, ADRS)
 *   8:     rnode <- fors_node(SK.seed, 2i + 1, z - 1, PK.seed, ADRS)
 *   9:     ADRS.setTreeHeight(z)
 *  10:     ADRS.setTreeIndex(i)
 *  11:     node <- H(PK.seed, ADRS, lnode || rnode)
 *  12: end if
 *  13: return node
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  i        Node index.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     FORS tree HashAddress.
 * @param [out] node     n-byte root node.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_fors_node_x4_z1(SlhDsaKey* key, const byte* sk_seed,
    word32 i, const byte* pk_seed, word32* adrs, byte* node)
{
    int ret;
    byte n = key->params->n;
    byte nodes[2 * SLHDSA_MAX_N];

    /* Step 7: Compute left node. */
    /* Step 2: Generate private key value for index. */
    ret = slhdsakey_fors_sk_gen(key, sk_seed, pk_seed, adrs, 2 * i + 0, nodes);
    if (ret == 0) {
        /* Step 3: Set tree height to zero. */
        HA_SetTreeHeight(adrs, 0);
        /* Step 4: Set tree index. */
        HA_SetTreeIndex(adrs, 2 * i + 0);
        /* Step 5: Compute node from public key seed, address and value. */
        ret = HASH_F(key, pk_seed, adrs, nodes, n, nodes);
    }
    /* Step 8: Compute right node. */
    if (ret == 0) {
        /* Step 2: Generate private key value for index. */
        ret = slhdsakey_fors_sk_gen(key, sk_seed, pk_seed, adrs, 2 * i + 1,
            nodes + n);
    }
    if (ret == 0) {
        /* Step 4: Set tree index. */
        HA_SetTreeIndex(adrs, 2 * i + 1);
        /* Step 5: Compute node from public key seed, address and value. */
        ret = HASH_F(key, pk_seed, adrs, nodes + n, n, nodes + n);
    }
    if (ret == 0) {
        /* Step 9: Set tree height. */
        HA_SetTreeHeight(adrs, 1);
        /* Step 10: Set tree index. */
        HA_SetTreeIndex(adrs, i);
        /* Step 11: Compute node from public key seed, address and nodes. */
        ret = HASH_H(key, pk_seed, adrs, nodes, n, node);
    }

    return ret;
}

/* Compute the root of a Merkle subtree of FORS public values.
 *
 * Performs 4 hashes at the same time where possible.
 *
 * FIPS 205. Section 8.2. Algorithm 15.
 * fors_node(SK.seed, i, z, PK.seed, ADRS)
 *   1: if z = 0 then
 *   2:     sk <- fors_skGen(SK.seed, PK.seed, ADRS, i)
 *   3:     ADRS.setTreeHeight(0)
 *   4:     ADRS.setTreeIndex(i)
 *   5:     node <- F(PK.seed, ADRS, sk)
 *   6: else
 *   7:     lnode <- fors_node(SK.seed, 2i, z - 1, PK.seed, ADRS)
 *   8:     rnode <- fors_node(SK.seed, 2i + 1, z - 1, PK.seed, ADRS)
 *   9:     ADRS.setTreeHeight(z)
 *  10:     ADRS.setTreeIndex(i)
 *  11:     node <- H(PK.seed, ADRS, lnode || rnode)
 *  12: end if
 *  13: return node
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  i        Node index.
 * @param [in]  z        Node height.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     FORS tree HashAddress.
 * @param [out] node     n-byte root node.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_fors_node_x4_low(SlhDsaKey* key, const byte* sk_seed,
    word32 i, word32 z, const byte* pk_seed, word32* adrs, byte* node)
{
    int ret = 0;
    byte n = key->params->n;
    HashAddress sk_adrs;
    byte addr[SLHDSA_HA_SZ];
    word32 j;
    word32 m = (word32)1U << z;
    WC_DECLARE_VAR(nodes, byte, (1 << SLHDSA_MAX_FORS_NODE_DEPTH) *
        SLHDSA_MAX_N, key->heap);

    WC_ALLOC_VAR_EX(nodes, byte, (1 << SLHDSA_MAX_FORS_NODE_DEPTH) *
        SLHDSA_MAX_N, key->heap, DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        byte sk_addr[SLHDSA_HA_SZ];

        HA_SetTreeHeight(adrs, 0);
        /* Copy address for FORS PRF. */
        HA_Copy(sk_adrs, adrs);
        /* Set type and keep key pair address. */
        HA_SetTypeAndClearNotKPA(sk_adrs, HA_FORS_PRF);
        /* Encode FORS PRF address for hashing. */
        HA_Encode(sk_adrs, sk_addr);
        /* Encode FORS tree address for hashing. */
        HA_Encode(adrs, addr);

        /* Step 2: Generate private key values for leaf indices. */
        for (j = 0; j < m; j += 4) {
            ret = slhdsakey_hash_prf_ti_x4(pk_seed, sk_seed, sk_addr, n,
                m * i + j, nodes + j * n, key->heap);
            if (ret != 0) {
                break;
            }
        }
    }
    if (ret == 0) {
        /* Step 3: Set tree height to zero. */
        HA_SetTreeHeight((word32*)addr, 0);
        /* Step 4-5: Set tree indices and compute leaf node. */
        for (j = 0; j < m; j += 4) {
            ret = slhdsakey_hash_f_ti_x4(pk_seed, addr, nodes + j * n, n,
                m * i + j, key->heap);
            if (ret != 0) {
                break;
            }
        }
    }
    if (ret == 0) {
        word32 k;
        for (k = 1; k < z - 1; k++) {
            m >>= 1;
            /* Step 9: Set tree height. */
            HA_SetTreeHeightBE(addr, k);
            /* Step 10-11: Set tree index and compute nodes. */
            for (j = 0; j < m; j += 4) {
                ret = slhdsakey_hash_h_ti_x4(pk_seed, addr, nodes + 2 * j * n,
                    n, m * i + j, nodes + j * n, key->heap);
                if (ret != 0) {
                    break;
                }
            }
            if (ret != 0) {
                break;
            }
        }
    }
    /* Step 7: Compute left node. */
    if (ret == 0) {
        /* Step 9: Set tree height. */
        HA_SetTreeHeight(adrs, z - 1);
        /* Step 10: Set tree index. */
        HA_SetTreeIndex(adrs, 2 * i + 0);
        /* Step 11: Compute node from public key seed, address and nodes. */
        ret = HASH_H(key, pk_seed, adrs, nodes, n, nodes);
    }
    /* Step 8: Compute right node. */
    if (ret == 0) {
        /* Step 10: Set tree index. */
        HA_SetTreeIndex(adrs, 2 * i + 1);
        /* Step 11: Compute node from public key seed, address and nodes. */
        ret = HASH_H(key, pk_seed, adrs, nodes + 2 * n, n,
            nodes + 1 * n);
    }
    if (ret == 0) {
        /* Step 9: Set tree height. */
        HA_SetTreeHeight(adrs, z);
        /* Step 10: Set tree index. */
        HA_SetTreeIndex(adrs, i);
        /* Step 11: Compute node from public key seed, address and nodes. */
        ret = HASH_H(key, pk_seed, adrs, nodes, n, node);
    }

    WC_FREE_VAR_EX(nodes, key->heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}

#if SLHDSA_MAX_FORS_NODE_DEPTH < SLHDSA_MAX_A-1
/* Compute the root of a Merkle subtree of FORS public values for large heights.
 *
 * Performs 4 hashes at the same time where possible.
 *
 * FIPS 205. Section 8.2. Algorithm 15.
 * fors_node(SK.seed, i, z, PK.seed, ADRS)
 *   1: if z = 0 then
 *   2:     sk <- fors_skGen(SK.seed, PK.seed, ADRS, i)
 *   3:     ADRS.setTreeHeight(0)
 *   4:     ADRS.setTreeIndex(i)
 *   5:     node <- F(PK.seed, ADRS, sk)
 *   6: else
 *   7:     lnode <- fors_node(SK.seed, 2i, z - 1, PK.seed, ADRS)
 *   8:     rnode <- fors_node(SK.seed, 2i + 1, z - 1, PK.seed, ADRS)
 *   9:     ADRS.setTreeHeight(z)
 *  10:     ADRS.setTreeIndex(i)
 *  11:     node <- H(PK.seed, ADRS, lnode || rnode)
 *  12: end if
 *  13: return node
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  i        Node index.
 * @param [in]  z        Node height.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     FORS tree HashAddress.
 * @param [out] node     n-byte root node.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_fors_node_x4_high(SlhDsaKey* key, const byte* sk_seed,
    word32 i, word32 z, const byte* pk_seed, word32* adrs, byte* node)
{
    int ret = 0;
    byte n = key->params->n;
    word32 j;
    word32 z2 = z % SLHDSA_MAX_FORS_NODE_DEPTH;
    word32 m;
    WC_DECLARE_VAR(nodes, byte, (1 << SLHDSA_MAX_FORS_NODE_TOP_DEPTH) *
        SLHDSA_MAX_N, key->heap);

    WC_ALLOC_VAR_EX(nodes, byte, (1 << SLHDSA_MAX_FORS_NODE_TOP_DEPTH) *
        SLHDSA_MAX_N, key->heap, DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        if (z2 == 0) {
            z2 = SLHDSA_MAX_FORS_NODE_DEPTH;
        }
        m = (word32)1U << z2;
        /* Steps 7-8: Compute left and right nodes. */
        for (j = 0; j < m; j++) {
            ret = slhdsakey_fors_node_x4_low(key, sk_seed, m * i + j, z - z2,
                pk_seed, adrs, nodes + j * n);
            if (ret != 0) {
                break;
            }
        }
    }
    if ((ret == 0) && (z2 > 2)) {
        word32 k;
        for (k = z - z2 + 1; k < z - 1; k++) {
            byte addr[SLHDSA_HA_SZ];

            m >>= 1;
            /* Step 9: Set tree height. */
            HA_SetTreeHeight(adrs, k);
            /* Encode FORS tree address for hashing. */
            HA_Encode(adrs, addr);
            /* Step 10-11: Set tree index and compute nodes. */
            for (j = 0; j < m; j += 4) {
                ret = slhdsakey_hash_h_ti_x4(pk_seed, addr, nodes + 2 * j * n,
                    n, m * i + j, nodes + j * n, key->heap);
                if (ret != 0) {
                    break;
                }
            }
            if (ret != 0) {
                break;
            }
        }
    }
    /* Step 7: Compute left node. */
    if ((ret == 0) && (z2 > 1)) {
        /* Step 9: Set tree height. */
        HA_SetTreeHeight(adrs, z - 1);
        /* Step 10: Set tree index. */
        HA_SetTreeIndex(adrs, 2 * i + 0);
        /* Step 11: Compute node from public key seed, address and nodes. */
        ret = HASH_H(key, pk_seed, adrs, nodes, n, nodes);
    }
    /* Step 8: Compute right node. */
    if ((ret == 0) && (z2 > 1)) {
        /* Step 10: Set tree index. */
        HA_SetTreeIndex(adrs, 2 * i + 1);
        /* Step 11: Compute node from public key seed, address and nodes. */
        ret = HASH_H(key, pk_seed, adrs, nodes + 2 * n, n,
            nodes + 1 * n);
    }
    if (ret == 0) {
        /* Step 9: Set tree height. */
        HA_SetTreeHeight(adrs, z);
        /* Step 10: Set tree index. */
        HA_SetTreeIndex(adrs, i);
        /* Step 11: Compute node from public key seed, address and nodes. */
        ret = HASH_H(key, pk_seed, adrs, nodes, n, node);
    }

    WC_FREE_VAR_EX(nodes, key->heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif

/* Compute the root of a Merkle subtree of FORS public values.
 *
 * Performs 4 hashes at the same time where possible.
 *
 * FIPS 205. Section 8.2. Algorithm 15.
 * fors_node(SK.seed, i, z, PK.seed, ADRS)
 *   1: if z = 0 then
 *   2:     sk <- fors_skGen(SK.seed, PK.seed, ADRS, i)
 *   3:     ADRS.setTreeHeight(0)
 *   4:     ADRS.setTreeIndex(i)
 *   5:     node <- F(PK.seed, ADRS, sk)
 *   6: else
 *   7:     lnode <- fors_node(SK.seed, 2i, z - 1, PK.seed, ADRS)
 *   8:     rnode <- fors_node(SK.seed, 2i + 1, z - 1, PK.seed, ADRS)
 *   9:     ADRS.setTreeHeight(z)
 *  10:     ADRS.setTreeIndex(i)
 *  11:     node <- H(PK.seed, ADRS, lnode || rnode)
 *  12: end if
 *  13: return node
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  i        Node index.
 * @param [in]  z        Node height.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     FORS tree HashAddress.
 * @param [out] node     n-byte root node.
 * @return  0 on success.
 * @return  SHAKE-256 error return code on digest failure.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_fors_node_x4(SlhDsaKey* key, const byte* sk_seed, word32 i,
    word32 z, const byte* pk_seed, word32* adrs, byte* node)
{
    int ret = 0;

    /* Step 1: Check if we are at leaf node. */
    if (z == 0) {
        ret = slhdsakey_fors_node_x4_z0(key, sk_seed, i, pk_seed, adrs, node);
    }
    /* Step 6: 1 level above leaf node. */
    else if (z == 1) {
        ret = slhdsakey_fors_node_x4_z1(key, sk_seed, i, pk_seed, adrs, node);
    }
    /* Step 6: 2-MAX_DEPTH levels above leaf node. */
    else if ((z >= 2) && (z <= SLHDSA_MAX_FORS_NODE_DEPTH)) {
        ret = slhdsakey_fors_node_x4_low(key, sk_seed, i, z, pk_seed, adrs,
            node);
    }
#if SLHDSA_MAX_FORS_NODE_DEPTH < SLHDSA_MAX_A-1
    /* Step 6: More than MAX_DEPTH levels above leaf node. */
    else {
        ret = slhdsakey_fors_node_x4_high(key, sk_seed, i, z, pk_seed, adrs,
            node);
    }
#endif

    return ret;
}
#endif

#if !defined(WOLFSSL_WC_SLHDSA_RECURSIVE)
/* Compute the root of a Merkle subtree of FORS public values.
 *
 * Iterative implementation.
 *
 * FIPS 205. Section 8.2. Algorithm 15.
 * fors_node(SK.seed, i, z, PK.seed, ADRS)
 *   1: if z = 0 then
 *   2:     sk <- fors_skGen(SK.seed, PK.seed, ADRS, i)
 *   3:     ADRS.setTreeHeight(0)
 *   4:     ADRS.setTreeIndex(i)
 *   5:     node <- F(PK.seed, ADRS, sk)
 *   6: else
 *   7:     lnode <- fors_node(SK.seed, 2i, z - 1, PK.seed, ADRS)
 *   8:     rnode <- fors_node(SK.seed, 2i + 1, z - 1, PK.seed, ADRS)
 *   9:     ADRS.setTreeHeight(z)
 *  10:     ADRS.setTreeIndex(i)
 *  11:     node <- H(PK.seed, ADRS, lnode || rnode)
 *  12: end if
 *  13: return node
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  i        Node index.
 * @param [in]  z        Node height.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     FORS tree HashAddress.
 * @param [out] node     n-byte root node.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_fors_node_c(SlhDsaKey* key, const byte* sk_seed, word32 i,
    word32 z, const byte* pk_seed, word32* adrs, byte* node)
{
    int ret = 0;
    byte n = key->params->n;

    /* Step 1: Check if we are at leaf node. */
    if (z == 0) {
        /* Step 2: Generate private key value for index. */
        ret = slhdsakey_fors_sk_gen(key, sk_seed, pk_seed, adrs, i, node);
        if (ret == 0) {
            /* Step 3: Set tree height to zero. */
            HA_SetTreeHeight(adrs, 0);
            /* Step 4: Set tree index. */
            HA_SetTreeIndex(adrs, i);
            /* Step 5: Compute node from public key seed, address and value. */
            ret = HASH_F(key, pk_seed, adrs, node, n, node);
        }
    }
    /* Step 6: Non leaf node. */
    else {
        WC_DECLARE_VAR(nodes, byte, (SLHDSA_MAX_A + 1) * SLHDSA_MAX_N,
            key->heap);
        word32 j;
        word32 k;
        word32 m = (word32)1U << z;

        WC_ALLOC_VAR_EX(nodes, byte, (SLHDSA_MAX_A + 1) * SLHDSA_MAX_N,
            key->heap, DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
        if (ret == 0) {
            /* For all leaf nodes. */
            for (j = 0; j < m; j++) {
                word32 o = ((word32)z - 1U + (j & 1U)) * n;
                /* Step 2: Generate private key value for index. */
                ret = slhdsakey_fors_sk_gen(key, sk_seed, pk_seed, adrs,
                    m * (word32)i + j, nodes + o);
                if (ret != 0) {
                    break;
                }
                /* Step 3: Set tree height to zero. */
                HA_SetTreeHeight(adrs, 0);
                /* Step 4: Set tree index. */
                HA_SetTreeIndex(adrs, m * (word32)i + j);
                /* Step 5: Compute node from public key seed, address and value.
                 */
                ret = HASH_F(key, pk_seed, adrs, nodes + o, n,
                    nodes + o);
                if (ret != 0) {
                    break;
                }

                /* For each intermediate node as soon as left and right have
                 * been computed. */
                for (k = (word32)z - 1U; k > 0; k--) {
                    /* Check if this is the right node at a height. */
                    if (((j >> ((word32)z - 1U - k)) & 1U) == 1U) {
                        /* Step 9: Set tree height. */
                        HA_SetTreeHeight(adrs, (word32)z - k);
                        /* Step 10: Set tree index. */
                        HA_SetTreeIndex(adrs,
                                        (m * (word32)i + j) >> ((word32)z - k));
                        /* Step 11: Compute node from public key seed, address
                         * and left and right nodes. */
                        ret = HASH_H(key, pk_seed, adrs, nodes + k * n, n,
                                nodes +
                                  (k - 1U + ((j >> ((word32)z - k)) & 1U)) * n);
                        if (ret != 0) {
                            break;
                        }
                    }
                    /* Left node - can go no higher. */
                    else {
                        break;
                    }
                }
            }
            if (ret == 0) {
                /* Step 9: Set tree height. */
                HA_SetTreeHeight(adrs, z);
                /* Step 10: Set tree index. */
                HA_SetTreeIndex(adrs, i);
                /* Step 11: Compute node from public key seed, address
                 * and nodes. */
                ret = HASH_H(key, pk_seed, adrs, nodes, n, node);
            }
        }

        WC_FREE_VAR_EX(nodes, key->heap, DYNAMIC_TYPE_SLHDSA);
    }

    return ret;
}
#else
/* Compute the root of a Merkle subtree of FORS public values.
 *
 * Recursive implementation.
 *
 * FIPS 205. Section 8.2. Algorithm 15.
 * fors_node(SK.seed, i, z, PK.seed, ADRS)
 *   1: if z = 0 then
 *   2:     sk <- fors_skGen(SK.seed, PK.seed, ADRS, i)
 *   3:     ADRS.setTreeHeight(0)
 *   4:     ADRS.setTreeIndex(i)
 *   5:     node <- F(PK.seed, ADRS, sk)
 *   6: else
 *   7:     lnode <- fors_node(SK.seed, 2i, z - 1, PK.seed, ADRS)
 *   8:     rnode <- fors_node(SK.seed, 2i + 1, z - 1, PK.seed, ADRS)
 *   9:     ADRS.setTreeHeight(z)
 *  10:     ADRS.setTreeIndex(i)
 *  11:     node <- H(PK.seed, ADRS, lnode || rnode)
 *  12: end if
 *  13: return node
 *
 * @param [in]  key      SLH-DSA key.
 * @param [in]  sk_seed  Private key seed.
 * @param [in]  i        Node index.
 * @param [in]  z        Node height.
 * @param [in]  pk_seed  Public key seed.
 * @param [in]  adrs     FORS tree HashAddress.
 * @param [out] node     n-byte root node.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_fors_node_c(SlhDsaKey* key, const byte* sk_seed, word32 i,
    word32 z, const byte* pk_seed, word32* adrs, byte* node)
{
    int ret;
    byte n = key->params->n;

    /* Step 1: Check if we are at leaf node. */
    if (z == 0) {
        /* Step 2: Generate private key value for index. */
        ret = slhdsakey_fors_sk_gen(key, sk_seed, pk_seed, adrs, i, node);
        if (ret == 0) {
            /* Step 3: Set tree height to zero. */
            HA_SetTreeHeight(adrs, 0);
            /* Step 4: Set tree index. */
            HA_SetTreeIndex(adrs, i);
            /* Step 5: Compute node from public key seed, address and value. */
            ret = HASH_F(key, pk_seed, adrs, node, n, node);
        }
    }
    else {
        byte nodes[2 * SLHDSA_MAX_N];

        /* Step 7: Compute left node. */
        ret = slhdsakey_fors_node_c(key, sk_seed, 2 * i + 0, z - 1, pk_seed,
            adrs, nodes);
        if (ret == 0) {
            /* Step 8: Compute right node. */
            ret = slhdsakey_fors_node_c(key, sk_seed, 2 * i + 1, z - 1, pk_seed,
                adrs, nodes + n);
        }
        if (ret == 0) {
            /* Step 9: Set tree height. */
            HA_SetTreeHeight(adrs, z);
            /* Step 10: Set tree index. */
            HA_SetTreeIndex(adrs, i);
            /* Step 11: Compute node from public key seed, address and nodes. */
            ret = HASH_H(key, pk_seed, adrs, nodes, n, node);
        }
    }

    return ret;
}
#endif

/* Generate FORS signature.
 *
 * FIPS 205. Section 8.3. Algorithm 16.
 * fors_sign(md SK.seed, PK.seed, ADRS)
 *   1: SIGFORS = NULL         > initialize SIGFORS as a zero-length byte string
 *   2: indices <- base_2b(md, a, k)
 *   3: for i from 0 to k - 1 do                    > compute signature elements
 *   4:     SIGFORS <- SIGFORS ||
 *                     fors_skGen(SK.seed, PK.seed, ADRS, i . 2^a + indices)
 *   5:     for j from 0 to a - 1 do                         > compute auth path
 *   6:         s <- lower(indices[i]/2^j) XOR 1
 *   7:         AUTH[j] <- fors_node(SK.seed, i . 2^(a-j) + s, j, PK.seed, ADRS)
 *   8:     end for
 *   9:     SIGFORS <- SIGFORS || AUTH
 *  10: end for
 *  11: return SIGFORS
 *
 * @param [in]       key       SLH-DSA key.
 * @param [in]       md        Message digest.
 * @param [in]       sk_seed   Private key seed.
 * @param [in]       pk_seed   Public key seed.
 * @param [inm out]  adrs      FORS tree HashAddress.
 * @param [out]      sig_fors  FORS signature.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_fors_sign(SlhDsaKey* key, const byte* md,
    const byte* sk_seed, const byte* pk_seed, word32* adrs, byte* sig_fors)
{
    int ret = WC_NO_ERR_TRACE(BAD_FUNC_ARG);
    word16 indices[SLHDSA_MAX_INDICES_SZ];
    int i;
    int j;
    byte n = key->params->n;
    byte a = key->params->a;
    byte k = key->params->k;

    /* Step 2: Convert message digest to base 2^a. */
    slhdsakey_base_2b(md, a, k, indices);

    /* Step 3: For each index: */
    for (i = 0; i < k; i++) {
        /* Step 4: Generate FORS private key value into signature. */
        ret = slhdsakey_fors_sk_gen(key, sk_seed, pk_seed, adrs,
            ((word32)i << a) + indices[i], sig_fors);
        if (ret != 0) {
            break;
        }
        /* Step 4: Move over private key value. */
        sig_fors += n;

    #if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
        if (!SLHDSA_IS_SHA2(key->params->param) &&
                IS_INTEL_AVX2(cpuid_flags) &&
                CAN_SAVE_VECTOR_REGISTERS()) {
            word16 idx = indices[i];
            /* Step 5: For each bit: */
            for (j = 0; j < a; j++) {
                /* Calculate side. */
                word32 s = idx ^ 1;
                /* Step 7: Compute authentication node into signature. */
                ret = slhdsakey_fors_node_x4(key, sk_seed,
                    ((word32)i << (a - j)) + s, (word32)j, pk_seed, adrs,
                    sig_fors);
                if (ret != 0) {
                    break;
                }
                /* Step 9: Move signature to after authentication node. */
                sig_fors += n;
                /* Update tree index. */
                idx >>= 1;
            }
        }
        else
    #endif
        {
            word16 idx = indices[i];
            /* Step 5: For each bit: */
            for (j = 0; j < a; j++) {
                /* Calculate side. */
                word32 s = idx ^ 1;
                /* Step 7: Compute authentication node into signature. */
                ret = slhdsakey_fors_node_c(key, sk_seed,
                    ((word32)i << (a - j)) + s, (word32)j, pk_seed, adrs,
                    sig_fors);
                if (ret != 0) {
                    break;
                }
                /* Step 9: Move signature to after authentication node. */
                sig_fors += n;
                /* Update tree index. */
                idx >>= 1;
            }
        }
        if (ret != 0) {
            break;
        }
    }

    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
/* F hash 4 simultaneously.
 *
 * Each hash varies by the tree index with the values passed in.
 * Each n-byte message in sig_fors is offset by so x n bytes.
 *
 * FIPS 205. Section 4.1.
 *   F(PK.seed, ADRS, M1) (Bn x B32 x Bn -> Bn) is a hash function that takes an
 *   n-byte message as input and produces an n-byte output.
 * FIPS 205. Section 11.1.
 *   F(PK.seed, ADRS, M1) = SHAKE256(PK.seed || ADRS || M1 , 8n)
 *
 * @param [in]  pk_seed   Public key seed.
 * @param [in]  addr      Encoded HashAddress.
 * @param [in]  sig_fors  n-byte messages.
 * @param [in]  so        Tree index start value.
 * @param [in]  n         Number of bytes in hash output.
 * @param [in]  ti        Tree index start value.
 * @param [out] node      n-byte hash outputs.
 * @param [in]  heap      Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_hash_f_ti4_x4(const byte* pk_seed, byte* addr,
    const byte* sig_fors, int so, byte n, word32* ti, byte* node, void* heap)
{
    int ret = 0;
    int i;
    word32 o = 0;
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        o = slhdsakey_shake256_set_seed_ha_x4(state, pk_seed, addr, n);
        SHAKE256_SET_TREE_INDEX_IDX(state, o, ti);
        for (i = 0; i < n / 8; i++) {
            state[o + 0] = ((const word64*)(sig_fors + 0 * so * n))[i];
            state[o + 1] = ((const word64*)(sig_fors + 1 * so * n))[i];
            state[o + 2] = ((const word64*)(sig_fors + 2 * so * n))[i];
            state[o + 3] = ((const word64*)(sig_fors + 3 * so * n))[i];
            o += 4;
        }
        SHAKE256_SET_END_X4(state, o);
        ret = SAVE_VECTOR_REGISTERS2();
        if (ret == 0) {
            sha3_blocksx4_avx2(state);
            RESTORE_VECTOR_REGISTERS();
            slhdsakey_shake256_get_hash_x4(state, node, n);
        }

        WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    }

    return ret;
}

/* H hash 4 simultaneously with two buffers holding two halves of messages.
 *
 * Each hash varies by the tree index with the first value in sequence passed
 * in.
 * Each n-byte message in sig_fors is offset by so x n bytes.
 *
 * FIPS 205. Section 4.1.
 *   H(PK.seed, ADRS, M2) (Bn x B32 x B2n -> Bn) is a special case of Tl that
 *   takes a 2n-byte message as input.
 * FIPS 205. Section 11.1.
 *   H(PK.seed, ADRS, M2) = SHAKE256(PK.seed || ADRS || M2, 8n)
 *
 * @param [in]      pk_seed   Public key seed.
 * @param [in]      addr      Encoded HashAddress.
 * @param [in, out] node      On in, n-byte messages. On out, hash output.
 * @param [in]      sig_fors  n-byte messages.
 * @param [in]      so        Tree index start value.
 * @param [in]      bit       Bits to indicate which order of node/sig_fors.
 * @param [in]      n         Number of bytes in hash output.
 * @param [in]      ti        Tree index start value.
 * @param [in]      heap      Dynamic memory allocation hint.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_hash_h_2_x4(const byte* pk_seed, byte* addr, byte* node,
    const byte* sig_fors, int so, word32* bit, byte n, word32 th, word32* ti,
    void* heap)
{
    int ret = 0;
    int i;
    word32 j;
    word32 o = 0;
    WC_DECLARE_VAR(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap);

    (void)heap;

    WC_ALLOC_VAR_EX(state, word64, SLHDSA_SHAKE_X4_STATE_W, heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        o = slhdsakey_shake256_set_seed_ha_x4(state, pk_seed, addr, n);
        SHAKE256_SET_TREE_HEIGHT(state, o, th);
        SHAKE256_SET_TREE_INDEX_IDX(state, o, ti);
        for (i = 0; i < n / 8; i++) {
            for (j = 0; j < 4; j++) {
                if (bit[j] == 0) {
                    state[o + j] = ((const word64*)(node + j * n))[i];
                }
                else {
                    state[o + j] =
                        ((const word64*)(sig_fors + j * (word32)so * n))[i];
                }
            }
            o += 4;
        }
        for (i = 0; i < n / 8; i++) {
            for (j = 0; j < 4; j++) {
                if (bit[j] == 0) {
                    state[o + j] =
                        ((const word64*)(sig_fors + j * (word32)so * n))[i];
                }
                else {
                    state[o + j] = ((const word64*)(node + j * n))[i];
                }
            }
            o += 4;
        }
        SHAKE256_SET_END_X4(state, o);
        ret = SAVE_VECTOR_REGISTERS2();
        if (ret == 0) {
            sha3_blocksx4_avx2(state);
            RESTORE_VECTOR_REGISTERS();
            slhdsakey_shake256_get_hash_x4(state, node, n);
        }

        WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA);
    }

    return ret;
}

/* Compute ith FORS public key from ith FORS signature.
 *
 * 4 hashes computed simultaneously.
 *
 * FIPS 205. Section 8.4 Algorithm 17.
 * fors_pkFromSig(SIGFORS, md, PK.seed, ADRS)
 *  ...
 *   4:     ADRS.setTreeHeight(0)                                 > compute leaf
 *   5:     ADRS.setTreeIndex(i . 2^a + indices[i])
 *   6:     node[0] <- F(PK.seed, ADRS, sk)
 *   7:     auth <- SIGFORS.getAUTH(i)
 *                     > SIGFORS [(i . (a + 1) + 1) . n : (i + 1) . (a + 1) . n]
 *   8:     for j from 0 to a - 1 do           > compute root from leaf and AUTH
 *   9:         ADRS.setTreeHeight(j + 1)
 *  10:         if lower(indices[i]/(2^j)) is even then
 *  11:             ADRS.setTreeIndex(ADRS.getTreeIndex()/2)
 *  12:             node[1] <- H(PK.seed, ADRS, node[0] || auth[i])
 *  13:         else
 *  14:             ADRS.setTreeIndex((ADRS.getTreeIndex() - 1)/2)
 *  15:             node[1] <- H(PK.seed, ADRS, auth[j] || node[0])
 *  16:         end if
 *  17:         node[0] <- node[1]
 *  18:     end for
 *  19:     root[i] <- node[0]
 *  ...
 *
 * @param [in]  key       SLH-DSA key.
 * @param [in]  sig_fors  FORS signature.
 * @param [in]  pk_seed   Public key seed.
 * @param [in]  addr      Encoded HashAddress.
 * @param [in]  indices   Base 2^a values from message digest.
 * @param [in]  i         Index.
 * @param [out] node      Root node of ith tree.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 */
static int slhdsakey_fors_pk_from_sig_i_x4(SlhDsaKey* key, const byte* sig_fors,
    const byte* pk_seed, byte* addr, const word16* indices, int i, byte* node)
{
    int ret;
    int j;
    int k;
    byte n = key->params->n;
    byte a = key->params->a;
    word32 ti[4];
    word32 bit[4];

    /* Step 5: Calculate the index of each hash ... */
    ti[0] = ((word32)(i + 0) << a) + indices[i + 0];
    ti[1] = ((word32)(i + 1) << a) + indices[i + 1];
    ti[2] = ((word32)(i + 2) << a) + indices[i + 2];
    ti[3] = ((word32)(i + 3) << a) + indices[i + 3];
    /* Steps 4-6: Compute nodes.  */
    ret = slhdsakey_hash_f_ti4_x4(pk_seed, addr, sig_fors, 1 + a, n, ti, node,
        key->heap);
    if (ret == 0) {
        /* Step 7: Move on to authentication nodes. */
        sig_fors += n;
        /* Step 8: For each level: */
        for (j = 0; j < a; j++) {
            /* Calculate which order of node and sig_fors for each hash. */
            for (k = 0; k < 4; k++) {
                bit[k] = ti[k] & 1;
                ti[k] /= 2;
            }
            /* Steps 9-17: 4 hash with tree indices. */
            ret = slhdsakey_hash_h_2_x4(pk_seed, addr, node, sig_fors, 1 + a,
                bit, n, (word32)(j + 1), ti, key->heap);
            if (ret != 0) {
                break;
            }
            /* Move on to next authentication node. */
            sig_fors += n;
        }
    }

    return ret;
}

/* Compute ith FORS public key from ith FORS signature.
 *
 * 4 hashes computed simultaneously.
 *
 * FIPS 205. Section 8.4 Algorithm 17.
 * fors_pkFromSig(SIGFORS, md, PK.seed, ADRS)
 *  ...
 *   2: for i from 0 to k - 1 do
 *   3:     sk <- SIGFORS.getSK(i)
 *                           > SIGFORS [i . (a + 1) . n : (i . (a + 1) + 1) . n]
 *   4:     ADRS.setTreeHeight(0)                                 > compute leaf
 *   5:     ADRS.setTreeIndex(i . 2^a + indices[i])
 *   6:     node[0] <- F(PK.seed, ADRS, sk)
 *   7:     auth <- SIGFORS.getAUTH(i)
 *                     > SIGFORS [(i . (a + 1) + 1) . n : (i + 1) . (a + 1) . n]
 *   8:     for j from 0 to a - 1 do           > compute root from leaf and AUTH
 *   9:         ADRS.setTreeHeight(j + 1)
 *  10:         if lower(indices[i]/(2^j)) is even then
 *  11:             ADRS.setTreeIndex(ADRS.getTreeIndex()/2)
 *  12:             node[1] <- H(PK.seed, ADRS, node[0] || auth[i])
 *  13:         else
 *  14:             ADRS.setTreeIndex((ADRS.getTreeIndex() - 1)/2)
 *  15:             node[1] <- H(PK.seed, ADRS, auth[j] || node[0])
 *  16:         end if
 *  17:         node[0] <- node[1]
 *  18:     end for
 *  19:     root[i] <- node[0]
 *  20: end for
 * ...
 *  24: pk <- Tk(PK.seed, forspkADRS, root)        > compute the FORS public key
 * ...
 *
 * @param [in]  key       SLH-DSA key.
 * @param [in]  sig_fors  FORS signature.
 * @param [in]  indices   Base 2^a values from message digest.
 * @param [in]  pk_seed   Public key seed.
 * @param [in]  adrs      Encoded HashAddress.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_fors_pk_from_sig_x4(SlhDsaKey* key, const byte* sig_fors,
    const word16* indices, const byte* pk_seed, word32* adrs)
{
    int ret = 0;
    int i;
    int j;
    byte n = key->params->n;
    byte a = key->params->a;
    byte k = key->params->k;
    byte addr[SLHDSA_HA_SZ];
    WC_DECLARE_VAR(node, byte, SLHDSA_MAX_INDICES_SZ * SLHDSA_MAX_N, key->heap);

    WC_ALLOC_VAR_EX(node, byte, SLHDSA_MAX_INDICES_SZ * SLHDSA_MAX_N, key->heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        /* Step 4: Set tree height for address.  */
        HA_SetTreeHeight(adrs, 0);
        /* Encode address for multiple hashing. */
        HA_Encode(adrs, addr);

        /* Step 2: Do multiple of 4 iterations. */
        for (i = 0; i < k-3; i += 4) {
            /* Steps 4-19: Compute public key root for signature at index. */
            ret = slhdsakey_fors_pk_from_sig_i_x4(key, sig_fors, pk_seed, addr,
                indices, i, node + i * n);
            if (ret != 0) {
                break;
            }
            /* Move on to next signatures. */
            sig_fors += 4 * (1 + a) * n;
        }
    }
    if (ret == 0) {
        /* Step 2: Do remaining iterations. */
        for (; i < k; i++) {
            /* Step 5: Calculate index ...  */
            word32 idx = ((word32)i << a) + indices[i];

            /* Step 4: Set tree height for address.  */
            HA_SetTreeHeight(adrs, 0);
            /* Step 5: Set tree index for address.  */
            HA_SetTreeIndex(adrs, idx);
            /* Step 6: Compute node from public key seed, address and value. */
            ret = HASH_F(key, pk_seed, adrs, sig_fors, n, node + i * n);
            if (ret != 0) {
                break;
            }
            /* Step 7: Move to authentication nodes. */
            sig_fors += n;

            /* Step 8: For all heights: */
            for (j = 0; j < a; j++) {
                /* Step 10: Calculate side ... */
                word32 side = idx & 1;

                /* Step 11/14: Update tree index value ... */
                idx >>= 1;
                /* Step 9: Set tree height. */
                HA_SetTreeHeight(adrs, j + 1);
                /* Step 11/14: Set tree index. */
                HA_SetTreeIndex(adrs, idx);
                /* Step 10: Check which side node is on. */
                if (side == 0) {
                    /* Step 12: Hash node || auth node. */
                    ret = HASH_H_2(key, pk_seed, adrs, node + i * n,
                        sig_fors, n, node + i * n);
                }
                else {
                    /* Step 15: Hash auth node || node. */
                    ret = HASH_H_2(key, pk_seed, adrs, sig_fors,
                        node + i * n, n, node + i * n);
                }
                if (ret != 0) {
                    break;
                }
                /* Move on to next authentication node. */
                sig_fors += n;
            }
            if (ret != 0) {
                break;
            }
        }
    }
    if (ret == 0) {
        /* Step 24: Add more root nodes to hash ... */
        ret = HASH_T_UPDATE(key, node, (word32)i * n);
    }

    WC_FREE_VAR_EX(node, key->heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#endif

#if !defined(WOLFSSL_WC_SLHDSA_SMALL_MEM)
/* Compute FORS public key from FORS signature.
 *
 * 4 hashes computed simultaneously.
 *
 * FIPS 205. Section 8.4 Algorithm 17.
 * fors_pkFromSig(SIGFORS, md, PK.seed, ADRS)
 *  ...
 *   2: for i from 0 to k - 1 do
 *   3:     sk <- SIGFORS.getSK(i)
 *                           > SIGFORS [i . (a + 1) . n : (i . (a + 1) + 1) . n]
 *   4:     ADRS.setTreeHeight(0)                                 > compute leaf
 *   5:     ADRS.setTreeIndex(i . 2^a + indices[i])
 *   6:     node[0] <- F(PK.seed, ADRS, sk)
 *   7:     auth <- SIGFORS.getAUTH(i)
 *                     > SIGFORS [(i . (a + 1) + 1) . n : (i + 1) . (a + 1) . n]
 *   8:     for j from 0 to a - 1 do           > compute root from leaf and AUTH
 *   9:         ADRS.setTreeHeight(j + 1)
 *  10:         if lower(indices[i]/(2^j)) is even then
 *  11:             ADRS.setTreeIndex(ADRS.getTreeIndex()/2)
 *  12:             node[1] <- H(PK.seed, ADRS, node[0] || auth[i])
 *  13:         else
 *  14:             ADRS.setTreeIndex((ADRS.getTreeIndex() - 1)/2)
 *  15:             node[1] <- H(PK.seed, ADRS, auth[j] || node[0])
 *  16:         end if
 *  17:         node[0] <- node[1]
 *  18:     end for
 *  19:     root[i] <- node[0]
 *  20: end for
 * ...
 *  24: pk <- Tk(PK.seed, forspkADRS, root)        > compute the FORS public key
 * ...
 *
 * @param [in]  key       SLH-DSA key.
 * @param [in]  sig_fors  FORS signature.
 * @param [in]  indices   Base 2^a values from message digest.
 * @param [in]  pk_seed   Public key seed.
 * @param [in]  adrs      HashAddress.
 * @param [out] pk_fors   FORS public key from signature.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_fors_pk_from_sig_c(SlhDsaKey* key, const byte* sig_fors,
    const word16* indices, const byte* pk_seed, word32* adrs, byte* pk_fors)
{
    int ret = 0;
    int i = 0;
    int j;
    byte n = key->params->n;
    byte a = key->params->a;
    byte k = key->params->k;
    WC_DECLARE_VAR(node, byte, SLHDSA_MAX_INDICES_SZ * SLHDSA_MAX_N, key->heap);

    (void)pk_fors;

    WC_ALLOC_VAR_EX(node, byte, SLHDSA_MAX_INDICES_SZ * SLHDSA_MAX_N, key->heap,
        DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
    if (ret == 0) {
        /* Step 2: For all indices: */
        for (i = 0; i < k; i++) {
            /* Step 5: Calculate index ...  */
            word32 idx = ((word32)i << a) + indices[i];

            /* Step 4: Set tree height for address.  */
            HA_SetTreeHeight(adrs, 0);
            /* Step 5: Set tree index for address.  */
            HA_SetTreeIndex(adrs, idx);
            /* Step 6: Compute node from public key seed, address and value. */
            ret = HASH_F(key, pk_seed, adrs, sig_fors, n, node + i * n);
            if (ret != 0) {
                break;
            }
            /* Step 7: Move to authentication nodes. */
            sig_fors += n;

            /* Step 8: For all heights: */
            for (j = 0; j < a; j++) {
                /* Step 10: Calculate side ... */
                word32 bit = idx & 1;

                /* Step 11/14: Update tree index value ... */
                idx >>= 1;
                /* Step 9: Set tree height. */
                HA_SetTreeHeight(adrs, j + 1);
                /* Step 11/14: Set tree index. */
                HA_SetTreeIndex(adrs, idx);
                /* Step 10: Check which side node is on. */
                if (bit == 0) {
                    /* Step 12: Hash node || auth node. */
                    ret = HASH_H_2(key, pk_seed, adrs, node + i * n,
                        sig_fors, n, node + i * n);
                }
                else {
                    /* Step 15: Hash auth node || node. */
                    ret = HASH_H_2(key, pk_seed, adrs, sig_fors,
                        node + i * n, n, node + i * n);
                }
                if (ret != 0) {
                    break;
                }
                /* Move on to next authentication node. */
                sig_fors += n;
            }
            if (ret != 0) {
                break;
            }
        }
    }
    if (ret == 0) {
        /* Step 24: Add more root nodes to hash ... */
        ret = HASH_T_UPDATE(key, node, (word32)i * n);
    }

    WC_FREE_VAR_EX(node, key->heap, DYNAMIC_TYPE_SLHDSA);
    return ret;
}
#else
/* Compute FORS public key from FORS signature.
 *
 * Update hash one node at a time to save stack.
 *
 * FIPS 205. Section 8.4 Algorithm 17.
 * fors_pkFromSig(SIGFORS, md, PK.seed, ADRS)
 *  ...
 *   2: for i from 0 to k - 1 do
 *   3:     sk <- SIGFORS.getSK(i)
 *                           > SIGFORS [i . (a + 1) . n : (i . (a + 1) + 1) . n]
 *   4:     ADRS.setTreeHeight(0)                                 > compute leaf
 *   5:     ADRS.setTreeIndex(i . 2^a + indices[i])
 *   6:     node[0] <- F(PK.seed, ADRS, sk)
 *   7:     auth <- SIGFORS.getAUTH(i)
 *                     > SIGFORS [(i . (a + 1) + 1) . n : (i + 1) . (a + 1) . n]
 *   8:     for j from 0 to a - 1 do           > compute root from leaf and AUTH
 *   9:         ADRS.setTreeHeight(j + 1)
 *  10:         if lower(indices[i]/(2^j)) is even then
 *  11:             ADRS.setTreeIndex(ADRS.getTreeIndex()/2)
 *  12:             node[1] <- H(PK.seed, ADRS, node[0] || auth[i])
 *  13:         else
 *  14:             ADRS.setTreeIndex((ADRS.getTreeIndex() - 1)/2)
 *  15:             node[1] <- H(PK.seed, ADRS, auth[j] || node[0])
 *  16:         end if
 *  17:         node[0] <- node[1]
 *  18:     end for
 *  19:     root[i] <- node[0]
 *  20: end for
 * ...
 *  24: pk <- Tk(PK.seed, forspkADRS, root)        > compute the FORS public key
 * ...
 *
 * @param [in]  key       SLH-DSA key.
 * @param [in]  sig_fors  FORS signature.
 * @param [in]  indices   Base 2^a values from message digest.
 * @param [in]  pk_seed   Public key seed.
 * @param [in]  adrs      HashAddress.
 * @param [out] node      Root node of ith tree.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_fors_pk_from_sig_c(SlhDsaKey* key, const byte* sig_fors,
    const word16* indices, const byte* pk_seed, word32* adrs, byte* node)
{
    int ret;
    int i;
    int j;
    byte n = key->params->n;
    byte a = key->params->a;
    byte k = key->params->k;

    /* Step 2: For all indices: */
    for (i = 0; i < k; i++) {
        /* Step 5: Calculate index ...  */
        word32 idx = ((word32)i << a) + indices[i];

        /* Step 4: Set tree height for address.  */
        HA_SetTreeHeight(adrs, 0);
        /* Step 5: Set tree index for address.  */
        HA_SetTreeIndex(adrs, idx);
        /* Step 6: Compute node from public key seed, address and value. */
        ret = HASH_F(key, pk_seed, adrs, sig_fors, n, node);
        if (ret != 0) {
            break;
        }
        /* Step 7: Move to authentication nodes. */
        sig_fors += n;

        /* Step 8: For all heights: */
        for (j = 0; j < a; j++) {
            /* Step 10: Calculate side ... */
            word32 bit = idx & 1;

            /* Step 11/14: Update tree index value ... */
            idx >>= 1;
            /* Step 9: Set tree height. */
            HA_SetTreeHeight(adrs, j + 1);
            /* Step 11/14: Set tree index. */
            HA_SetTreeIndex(adrs, idx);
            /* Step 10: Check which side node is on. */
            if (bit == 0) {
                /* Step 12: Hash node || auth node. */
                ret = HASH_H_2(key, pk_seed, adrs, node, sig_fors, n,
                    node);
            }
            else {
                /* Step 15: Hash auth node || node. */
                ret = HASH_H_2(key, pk_seed, adrs, sig_fors, node, n,
                    node);
            }
            if (ret != 0) {
                break;
            }
            /* Move on to next authentication node. */
            sig_fors += n;
        }
        if (ret == 0) {
            /* Step 24: Add root node to hash ... */
            ret = HASH_T_UPDATE(key, node, n);
        }
        if (ret != 0) {
            break;
        }
    }

    return ret;
}
#endif

/* Compute FORS public key from FORS signature.
 *
 * 4 hashes computed simultaneously.
 *
 * FIPS 205. Section 8.4 Algorithm 17.
 * fors_pkFromSig(SIGFORS, md, PK.seed, ADRS)
 *   1: indices <- base_2b(md, a, k)
 *  ...
 *  21: forspkADRS <- ADRS    > copy address to create a FORS public-key address
 *  22: forspkADRS.setTypeAndClear(FORS_ROOTS)
 *  23: forspkADRS.setKeyPairAddress(ADRS.getKeyPairAddress())
 *  24: pk <- Tk(PK.seed, forspkADRS, root)        > compute the FORS public key
 *  25: return pk
 *
 * @param [in]  key       SLH-DSA key.
 * @param [in]  sig_fors  FORS signature.
 * @param [in]  md        Message digest.
 * @param [in]  pk_seed   Public key seed.
 * @param [in]  addr      Encoded HashAddress.
 * @param [out] pk_fors   FORS public key form signature.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_fors_pk_from_sig(SlhDsaKey* key, const byte* sig_fors,
    const byte* md, const byte* pk_seed, word32* adrs, byte* pk_fors)
{
    int ret;
    word16 indices[SLHDSA_MAX_INDICES_SZ];
    HashAddress forspk_adrs;
    byte n = key->params->n;
    byte a = key->params->a;
    byte k = key->params->k;
    int hash_t_started = 0;

    /* Step 1: Get indices from byte array. */
    slhdsakey_base_2b(md, a, k, indices);

    /* Step 21: Create address to FORS roots */
    HA_Copy(forspk_adrs, adrs);
    /* Steps 22-23: Set type and clear all but key pair address. */
    HA_SetTypeAndClearNotKPA(forspk_adrs, HA_FORS_ROOTS);
    /* Step 24: Add public key seed and FORS roots address to hash ... */
    ret = HASH_T_START_ADDR(key, pk_seed, forspk_adrs, n);

    if (ret == 0) {
        hash_t_started = 1;
    }

    /* Steps 2-20: Compute roots and add to hash. */
#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
    if ((ret == 0) && !SLHDSA_IS_SHA2(key->params->param) &&
            IS_INTEL_AVX2(cpuid_flags) &&
            (SAVE_VECTOR_REGISTERS2() == 0)) {
        ret = slhdsakey_fors_pk_from_sig_x4(key, sig_fors, indices, pk_seed,
            adrs);
        RESTORE_VECTOR_REGISTERS();
    }
    else
#endif
    if (ret == 0) {
        ret = slhdsakey_fors_pk_from_sig_c(key, sig_fors, indices, pk_seed,
            adrs, pk_fors);
    }

    if (ret == 0) {
        /* Step 24. Compute FORS public key. */
        ret = HASH_T_FINAL(key, pk_fors, n);
    }

    if (hash_t_started) {
        HASH_T_FREE(key);
    }

    return ret;
}

/******************************************************************************
 * SLH-DSA API
 ******************************************************************************/

/* Initialize an SLH-DSA key.
 *
 * @param [in] key    SLH-DSA key.
 * @param [in] param  SLH-DSA parameter set to use.
 * @param [in] heap   Dynamic memory allocation hint.
 * @param [in] devId  Device Id.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key is NULL.
 * @return  NOT_COMPILED_IN when parameter set not compiled in.
 * @return  SHAKE-256 error return code on digest initialization failure.
 */
int wc_SlhDsaKey_Init(SlhDsaKey* key, enum SlhDsaParam param, void* heap,
    int devId)
{
    int ret = 0;
    int idx = -1;

    /* Validate parameters. */
    if (key == NULL) {
        ret = BAD_FUNC_ARG;
    }
    if (ret == 0) {
        int i;

        /* Find parameters in available parameter list. */
        for (i = 0; i < SLHDSA_PARAM_LEN; i++) {
            if (param == SlhDsaParams[i].param) {
                idx = i;
                break;
            }
        }
        if (idx == -1) {
            /* Parameter set not compiled in.  */
            ret = NOT_COMPILED_IN;
        }
    }
    if (ret == 0) {
        /* Zeroize key. */
        XMEMSET(key, 0, sizeof(SlhDsaKey));

        /* Set the parameters into key early so SLHDSA_IS_SHA2 works. */
        key->params = &SlhDsaParams[idx];
        /* Set heap hint to use with all allocations. */
        key->heap = heap;
    #ifdef WOLF_CRYPTO_CB
        /* Set device context and id. */
        key->devCtx = NULL;
        key->devId = devId;
    #endif
    #ifdef WOLF_PRIVATE_KEY_ID
        key->idLen = 0;
        key->labelLen = 0;
    #endif

#ifdef WOLFSSL_SLHDSA_SHA2
        if (SLHDSA_IS_SHA2(param)) {
            /* Initialize SHA2 hash objects. */
            ret = wc_InitSha256(&key->hash.sha2.sha256);
            if (ret == 0)
                key->hash.sha2.sha256_inited = 1;
            if ((ret == 0) && (key->params->n > 16)) {
                ret = wc_InitSha512(&key->hash.sha2.sha512);
                if (ret == 0)
                    key->hash.sha2.sha512_inited = 1;
            }
        }
        else
#endif
        {
            /* Initialize SHAKE-256 objects. */
            ret = wc_InitShake256(&key->hash.shk.shake, key->heap,
                INVALID_DEVID);
            if (ret == 0) {
                ret = wc_InitShake256(&key->hash.shk.shake2, key->heap,
                    INVALID_DEVID);
            }
        }
    }
    (void)devId;

#if defined(USE_INTEL_SPEEDUP)
    /* Ensure the CPU features are known. */
    cpuid_get_flags_ex(&cpuid_flags);
#endif

    return ret;
}

#ifdef WOLF_PRIVATE_KEY_ID
/* Initialize an SLH-DSA key with a device key id.
 *
 * @param [in] key    SLH-DSA key.
 * @param [in] param  SLH-DSA parameter set to use.
 * @param [in] id     Device-side key handle bytes.
 * @param [in] len    Length of id in bytes.
 * @param [in] heap   Dynamic memory allocation hint.
 * @param [in] devId  Device Id.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key is NULL or when id is NULL with len > 0.
 * @return  BUFFER_E when len is negative or larger than SLHDSA_MAX_ID_LEN.
 */
int wc_SlhDsaKey_Init_id(SlhDsaKey* key, enum SlhDsaParam param,
    const unsigned char* id, int len, void* heap, int devId)
{
    int ret = 0;

    if (key == NULL) {
        ret = BAD_FUNC_ARG;
    }
    /* Reject id == NULL with len > 0. */
    if ((ret == 0) && (id == NULL) && (len > 0)) {
        ret = BAD_FUNC_ARG;
    }
    if ((ret == 0) && ((len < 0) || (len > SLHDSA_MAX_ID_LEN))) {
        ret = BUFFER_E;
    }

    if (ret == 0) {
        ret = wc_SlhDsaKey_Init(key, param, heap, devId);
    }
    if ((ret == 0) && (id != NULL) && (len > 0)) {
        XMEMCPY(key->id, id, (size_t)len);
        key->idLen = len;
    }

    return ret;
}

/* Initialize an SLH-DSA key with a device key label.
 *
 * Label length is taken via XSTRLEN; embedded NULs terminate the label.
 *
 * @param [in] key    SLH-DSA key.
 * @param [in] param  SLH-DSA parameter set to use.
 * @param [in] label  NUL-terminated device-side key label.
 * @param [in] heap   Dynamic memory allocation hint.
 * @param [in] devId  Device Id.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key or label is NULL.
 * @return  BUFFER_E when label is empty or longer than SLHDSA_MAX_LABEL_LEN.
 */
int wc_SlhDsaKey_Init_label(SlhDsaKey* key, enum SlhDsaParam param,
    const char* label, void* heap, int devId)
{
    int ret = 0;
    int labelLen = 0;

    if ((key == NULL) || (label == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    if (ret == 0) {
        labelLen = (int)XSTRLEN(label);
        if ((labelLen == 0) || (labelLen > SLHDSA_MAX_LABEL_LEN)) {
            ret = BUFFER_E;
        }
    }

    if (ret == 0) {
        ret = wc_SlhDsaKey_Init(key, param, heap, devId);
    }
    if (ret == 0) {
        XMEMCPY(key->label, label, (size_t)labelLen);
        key->labelLen = labelLen;
    }

    return ret;
}
#endif /* WOLF_PRIVATE_KEY_ID */

/* Free the SLH-DSA key.
 *
 * @param [in] key  SLH-DSA key. Cannot be used after this call.
 */
void wc_SlhDsaKey_Free(SlhDsaKey* key)
{
    if (key == NULL)
        return;

#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
    if ((key->params != NULL) && (key->devId != INVALID_DEVID)) {
        (void)wc_CryptoCb_Free(key->devId, WC_ALGO_TYPE_PK,
                               WC_PK_TYPE_PQC_SIG_KEYGEN,
                               WC_PQC_SIG_TYPE_SLHDSA,
                               (void*)key);
    }
#endif

    if (key->params != NULL) {
        /* Ensure the private key data is zeroized. */
        ForceZero(key->sk, (size_t)key->params->n * 2);
#ifdef WOLFSSL_SLHDSA_SHA2
        if (SLHDSA_IS_SHA2(key->params->param)) {
            /* Dispose of the SHA2 hash objects. */
            if (key->hash.sha2.sha256_inited) {
                wc_Sha256Free(&key->hash.sha2.sha256);
                key->hash.sha2.sha256_inited = 0;
            }
            if (key->hash.sha2.sha256_2_inited) {
                wc_Sha256Free(&key->hash.sha2.sha256_2);
                key->hash.sha2.sha256_2_inited = 0;
            }
            if (key->hash.sha2.sha256_mid_inited) {
                wc_Sha256Free(&key->hash.sha2.sha256_mid);
                key->hash.sha2.sha256_mid_inited = 0;
            }
            if (key->hash.sha2.sha512_inited) {
                wc_Sha512Free(&key->hash.sha2.sha512);
                key->hash.sha2.sha512_inited = 0;
            }
            if (key->hash.sha2.sha512_2_inited) {
                wc_Sha512Free(&key->hash.sha2.sha512_2);
                key->hash.sha2.sha512_2_inited = 0;
            }
            if (key->hash.sha2.sha512_mid_inited) {
                wc_Sha512Free(&key->hash.sha2.sha512_mid);
                key->hash.sha2.sha512_mid_inited = 0;
            }
        }
        else
#endif
        {
            /* Dispose of the SHAKE-256 objects. */
            wc_Shake256_Free(&key->hash.shk.shake2);
            wc_Shake256_Free(&key->hash.shk.shake);
        }
    }

#ifdef WOLF_PRIVATE_KEY_ID
    key->idLen = 0;
    key->labelLen = 0;
#endif
#ifdef WOLF_CRYPTO_CB
    key->devCtx = NULL;
    key->devId = INVALID_DEVID;
#endif
    /* Marks the key freed; subsequent Frees become no-ops. */
    key->params = NULL;
}

/* Set the HashAddress based on message digest data.
 *
 * FIPS 205. Section 9.2. Algorithm 19.
 * slh_sign_internal(M, SK, addrnd)
 *   1: ADRS <- toByte(0, 32)
 *  ...
 *   7: tmp_idxtree <- digest [upper(k.a / 8) : upper(k.a / 8) +
 *                                              upper((h - h/d) / 8)]
 *                                             > next upper((h - h/d) / 8) bytes
 *   8: tmp_idxleaf <- digest [upper(k.a / 8) + upper((h - h/d) / 8) :
 *                             upper(k.a / 8) + upper((h - h/d) / 8) +
 *                             upper(h / 8d) ]
 *                                                    > next upper(h / 8d) bytes
 *   9: idxtree <- toInt(tmp_idxtree, upper((h-h/d) / 8)) mod 2^(h-h/d)
 *  10: idxleaf <- toInt(tmp_idxleaf, upper(h / 8d)) mode 2^(h/d)
 *  11: ADRS.setTreeAddress(idxtree)
 *  12: ADRS.setTypeAndClear(FORS_TREE)
 *  13: ADRS.setKeyPairAddress(idxleaf)
 *  ...
 *
 * FIPS 205. Section 9.3. Algorithm 20.
 * slh_verify_internal(M, SIG, PK)
 *   4: ADRS <- toByte(0, 32)
 *  ...
 *  10: tmp_idxtree <- digest [upper(k.a / 8) : upper(k.a / 8) +
 *                                              upper((h - h/d) / 8)]
 *                                             > next upper((h - h/d) / 8) bytes
 *  11: tmp_idxleaf <- digest [upper(k.a / 8) + upper((h - h/d) / 8) :
 *                             upper(k.a / 8) + upper((h - h/d) / 8) +
 *                             upper(h / 8d) ]
 *                                                    > next upper(h / 8d) bytes
 *  12: idxtree <- toInt(tmp_idxtree, upper((h-h/d) / 8)) mod 2^(h-h/d)
 *  13: idxleaf <- toInt(tmp_idxleaf, upper(h / 8d)) mode 2^(h/d)
 *  14: ADRS.setTreeAddress(idxtree)
 *  15: ADRS.setTypeAndClear(FORS_TREE)
 *  16: ADRS.setKeyPairAddress(idxleaf)
 *  ...
 *
 * @param [in]  key   SLH-DSA key.
 * @param [in]  md    Message digest.
 * @param [out] adrs  FORS tree HashAddress.
 * @param [out] t     Tree index as 3 32-bit integers.
 * @param [out] l     Tree leaf index.
 */
static void slhdsakey_set_ha_from_md(SlhDsaKey* key, const byte* md,
    HashAddress adrs, word32* t, word32* l)
{
    const byte* p;
    int bits;

    /* Step 1/4: Set address to all zeroes. */
    HA_Init(adrs);
    /* Step 7/10: Get pointer to tree index data. */
    p = md + key->params->dl1 + (key->params->dl2 - 8);
    /* Step 9/12: Convert tree index data to an integer ... */
    t[0] = 0;
    ato32(p + 0, &t[1]);
    ato32(p + 4, &t[2]);
    /* Step 9/12: Mask off any extra high bits. */
    bits = key->params->h  - (key->params->h / key->params->d);
    if (bits < 64) {
        t[1] &= ((word32)1U << (bits - 32)) - 1U;
    }

    /* Step 8/11: Get pointer to tree leaf index data. */
    p = md + key->params->dl1 + key->params->dl2 + (key->params->dl3 - 4);
    /* Step 10/13: Convert tree leaf index data to an integer ... */
    ato32(p, l);
    /* Step 10/13: Mask off any extra high bits. */
    bits = key->params->h / key->params->d;
    *l &= ((word32)1U << bits) - 1U;

    /* Step 11/14: Set the tree index into address. */
    HA_SetTreeAddress(adrs, t);
    /* Step 12/15: Set type of address and clear except key pair address. */
    HA_SetTypeAndClearNotKPA(adrs, HA_FORS_TREE);
    /* Step 13/16: Set key pair address. */
    HA_SetKeyPairAddress(adrs, *l);
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Generate an SLH-DSA key with a random number generator.
 *
 * FIPS 205. Section 10.1. Algorithm 21.
 * slh_keygen()
 *   1: SK.seed <-$- Bn     > set SK.seed, SK.prf, and PK.seed to random n-byte
 *   2: SK.prf <-$- Bn          > strings using an approved random bit generator
 *   3: PK.seed <-$- Bn
 *   4: if SK.seed = NULL or SK.prf = NULL or PK.seed = NULL then
 *   5:     return falsity
 *                 > return an error indication if random bit generation failed
 *   6: end if
 *   7: return slh_keygen_internal(SK.seed, SK.prf, PK.seed)
 *
 * @param [in] key  SLH-DSA key.
 * @param [in] rng  Random number generator.
 * @return  0 on success.
 * @return  RNG error code when random number generation fails.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_MakeKey(SlhDsaKey* key, WC_RNG* rng)
{
    int ret = 0;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL) || (rng == NULL)) {
        ret = BAD_FUNC_ARG;
    }

#ifdef WOLF_CRYPTO_CB
    if (ret == 0) {
    #ifndef WOLF_CRYPTO_CB_FIND
        if (key->devId != INVALID_DEVID)
    #endif
        {
            /* size is the SlhDsaParam enum (S/F variants are distinct). */
            ret = wc_CryptoCb_MakePqcSignatureKey(rng,
                WC_PQC_SIG_TYPE_SLHDSA, (int)key->params->param, key);
            if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
                return ret;
            /* fall-through when unavailable */
            ret = 0;
        }
    }
#endif

    if (ret == 0) {
        /* Steps 1-5: Generate the 3 random hashes. */
        ret = wc_RNG_GenerateBlock(rng, key->sk, 3U * key->params->n);
    }
    if (ret == 0) {
        byte n = key->params->n;

        /* Step 7: Make the key with the random  */
        ret = wc_SlhDsaKey_MakeKeyWithRandom(key, key->sk, n, key->sk + n, n,
            key->sk + 2 * n, n);
    }

    return ret;
}

/* Generate an SLH-DSA key pair.
 *
 * FIPS 205. Section 9.1. Algorithm 18.
 * slh_keygen_internal(SK.seed, SK.prf, PK.seed)
 *   1: ADRS <- toByte(0, 32)
 *                        > generate the public key for the top-level XMSS tree
 *   2: ADRS.setLayerAddress(d - 1)
 *   3: PK.root <- xmss_node(SK.seed, 0, h' , PK.seed, ADRS)
 *   4: return ( (SK.seed, SK.prf, PK.seed, PK.root), (PK.seed, PK.root) )
 *
 * @param [in] key          SLH-DSA key.
 * @param [in] sk_seed      Private key seed.
 * @param [in] sk_seed_len  Length of private key seed.
 * @param [in] sk_prf       Private key PRF seed.
 * @param [in] sk_prf_len   Length of private key PRF seed.
 * @param [in] pk_seed      Public key seed.
 * @param [in] pk_seed_len  Length of public key seed.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key or key's parameters is NULL.
 * @return  BAD_FUNC_ARG when sk_seed is NULL or length is not n.
 * @return  BAD_FUNC_ARG when sk_prf is NULL or length is not n.
 * @return  BAD_FUNC_ARG when pk_seed is NULL or length is not n.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_MakeKeyWithRandom(SlhDsaKey* key, const byte* sk_seed,
    word32 sk_seed_len, const byte* sk_prf, word32 sk_prf_len,
    const byte* pk_seed, word32 pk_seed_len)
{
    int ret = 0;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Ensure private key seed is passed in and is the right length. */
    else if ((sk_seed == NULL) || (sk_seed_len != key->params->n)) {
        ret = BAD_FUNC_ARG;
    }
    /* Ensure public key PRF seed is passed in and is the right length. */
    else if ((sk_prf == NULL) || (sk_prf_len != key->params->n)) {
        ret = BAD_FUNC_ARG;
    }
    /* Ensure public key seed is passed in and is the right length. */
    else if ((pk_seed == NULL) || (pk_seed_len != key->params->n)) {
        ret = BAD_FUNC_ARG;
    }
    else {
        byte n = key->params->n;
        HashAddress adrs;

        /* Step 4: Copy the seeds into the key if they didn't come from the key.
         */
        if (sk_seed != key->sk) {
            XMEMCPY(key->sk        , sk_seed, n);
            XMEMCPY(key->sk +     n, sk_prf , n);
            XMEMCPY(key->sk + 2 * n, pk_seed, n);
        }

#ifdef WOLFSSL_SLHDSA_SHA2
        /* Pre-compute SHA2 midstates now that PK.seed is set. */
        if (SLHDSA_IS_SHA2(key->params->param)) {
            ret = slhdsakey_precompute_sha2_midstates(key);
        }
        if (ret != 0) {
            return ret;
        }
#endif

        /* Step 1: Set address to all zeroes. */
        HA_Init(adrs);
        /* Step 2: Set the address layer to the top of the subtree. */
        HA_SetLayerAddress(adrs, key->params->d - 1);
        /* Step 3: Compute the root node. */
        ret = slhdsakey_xmss_node(key, sk_seed, 0, key->params->h_m, pk_seed,
             adrs, &key->sk[3 * n]);
        if (ret == 0) {
            key->flags = WC_SLHDSA_FLAG_BOTH_KEYS;
        }
    }

    return ret;
}

/* Generate an SLH-DSA signature.
 *
 * FIPS 205. Section 9.2. Algorithm 19.
 * slh_sign_internal(M, SK, addrnd)
 *  ...
 *                                              upper((h - h/d) / 8)]
 *                                             > next upper((h - h/d) / 8) bytes
 *   8: tmp_idxleaf <- digest [upper(k.a / 8) + upper((h - h/d) / 8) :
 *                             upper(k.a / 8) + upper((h - h/d) / 8) +
 *                             upper(h / 8d) ]
 *                                                    > next upper(h / 8d) bytes
 *   9: idxtree <- toInt(tmp_idxtree, upper((h-h/d) / 8)) mod 2^(h-h/d)
 *  10: idxleaf <- toInt(tmp_idxleaf, upper(h / 8d)) mode 2^(h/d)
 *  11: ADRS.setTreeAddress(idxtree)
 *  12: ADRS.setTypeAndClear(FORS_TREE)
 *  13: ADRS.setKeyPairAddress(idxleaf)
 *  14: SIGFORS <- fors_sign(md, SK.seed, PK.seed, ADRS)
 *  15: SIG <- SIG || SIGFORS
 *  16: PKFORS <- fors_pkFromSig(SIGFORS, md, PK.seed, ADRS)      > get FORS key
 *  17: SIGHT <- ht_sign(PKFORS , SK.seed, PK.seed, idxtree , idxleaf )
 *  18: SIG <- SIG || SIGHT
 *  19: return SIG
 *
 * @param [in]  key  SLH-DSA key.
 * @param [in]  md   Message digest.
 * @param [out] sig  Signature buffer.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_sign(SlhDsaKey* key, byte* md, byte* sig)
{
    int ret;
    HashAddress adrs;
    word32 t[3];
    word32 l;
    byte pk_fors[SLHDSA_MAX_N];
    byte n = key->params->n;

    /* Steps 1, 7-13: Set address based on message digest. */
    slhdsakey_set_ha_from_md(key, md, adrs, t, &l);

    /* Step 14: FORS sign message. */
    ret = slhdsakey_fors_sign(key, md, key->sk, key->sk + 2 * n, adrs, sig);
    if (ret == 0) {
        /* Step 16: FORS public key from signature. */
        ret = slhdsakey_fors_pk_from_sig(key, sig, md, key->sk + 2 * n, adrs,
            pk_fors);
        /* Step 15: Move over signature data. */
        sig += key->params->k * (1 + key->params->a) * n;
    }
    if (ret == 0) {
        /* Steps 17-18: Hypertree sign FORS public key. */
        ret = slhdsakey_ht_sign(key, pk_fors, key->sk, key->sk + 2 * n, t, l,
            sig);
    }

    return ret;
}

/* Lower-level sign: slh_sign_internal(M, SK, addrnd).
 *
 * Takes M directly and performs PRF_msg, H_msg, and the FORS + hypertree
 * signing -- Algorithm 19 without the M' construction of Algorithm 22.
 *
 * FIPS 205. Section 9.2. Algorithm 19.
 * slh_sign_internal(M, SK, addrnd)
 *   2: opt_rand <- addrnd
 *   3: R <- PRFmsg(SK.prf, opt_rand, M)
 *   4: SIG <- R
 *   5: digest <- Hmsg(R, PK.seed, PK.root, M)
 *   6: md <- digest[0 : upper(k*a / 8)]
 *  ...
 *
 * @param [in]      key     SLH-DSA key (private key must be set).
 * @param [in]      m       Message (goes directly to PRF_msg and H_msg).
 * @param [in]      mSz     Length of message in bytes.
 * @param [out]     sig     Buffer to hold signature.
 * @param [in, out] sigSz   On in, buffer length. On out, signature length.
 * @param [in]      addRnd  opt_rand (PK.seed for deterministic).
 * @return  0 on success.
 */
static int slhdsakey_sign_internal_msg(SlhDsaKey* key, const byte* m,
    word32 mSz, byte* sig, word32* sigSz, const byte* addRnd)
{
    int ret = 0;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL) || (m == NULL) ||
            (sig == NULL) || (sigSz == NULL) || (addRnd == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    else if (*sigSz < key->params->sigLen) {
        ret = BAD_LENGTH_E;
    }
    else if ((key->flags & WC_SLHDSA_FLAG_PRIVATE) == 0) {
        ret = MISSING_KEY;
    }
    if (ret == 0) {
        byte md[SLHDSA_MAX_MD];
        byte n = key->params->n;

#ifdef WOLFSSL_SLHDSA_SHA2
        if (SLHDSA_IS_SHA2(key->params->param)) {
            /* SHA2: PRF_msg = Trunc_n(HMAC(SK.prf, opt_rand || M)).
             * Internal interface: no M' header, pass whole M directly. */
            ret = slhdsakey_prf_msg_sha2(key, key->sk + n, addRnd,
                NULL, NULL, 0, m, mSz, n, sig);
            if (ret == 0) {
                /* SHA2: H_msg via MGF1. No header for internal interface. */
                ret = slhdsakey_h_msg_sha2(key, sig,
                    NULL, NULL, 0, m, mSz,
                    md, (word32)key->params->dl1 + key->params->dl2 +
                    key->params->dl3);
                sig += n;
            }
        }
        else
#endif
        {
            /* SHAKE: PRF_msg = SHAKE256(SK.prf || opt_rand || M, 8n). */
            {
                wc_Shake tmpShake;
                ret = wc_InitShake256(&tmpShake, NULL, INVALID_DEVID);
                if (ret == 0) ret = wc_Shake256_Update(&tmpShake, key->sk + n, n);
                if (ret == 0) ret = wc_Shake256_Update(&tmpShake, addRnd, n);
                if (ret == 0) ret = wc_Shake256_Update(&tmpShake, m, mSz);
                if (ret == 0) ret = wc_Shake256_Final(&tmpShake, sig, n);
                wc_Shake256_Free(&tmpShake);
            }
            /* SHAKE: H_msg = SHAKE256(R || PK.seed || PK.root || M, ...). */
            if (ret == 0) {
                ret = wc_InitShake256(&key->hash.shk.shake, NULL, INVALID_DEVID);
            }
            if (ret == 0) {
                ret = wc_Shake256_Update(&key->hash.shk.shake, sig, n);
                sig += n;
            }
            if (ret == 0) {
                ret = wc_Shake256_Update(&key->hash.shk.shake,
                    key->sk + 2U * n, 2U * n);
            }
            if (ret == 0) {
                ret = wc_Shake256_Update(&key->hash.shk.shake, m, mSz);
            }
            if (ret == 0) {
                ret = wc_Shake256_Final(&key->hash.shk.shake, md,
                    (word32)key->params->dl1 + key->params->dl2 +
                    key->params->dl3);
            }
        }
        if (ret == 0) {
            ret = slhdsakey_sign(key, md, sig);
        }
        if (ret == 0) {
            *sigSz = key->params->sigLen;
        }
    }

    return ret;
}

/* Upper-level sign: construct M' from ctx + msg, then call internal.
 *
 * FIPS 205. Section 10.2.1. Algorithm 22.
 * slh_sign(M, ctx, SK)
 *   8: M' <- toByte(0, 1) || toByte(|ctx|, 1) || ctx || M
 *   9: SIG <- slh_sign_internal(M', SK, addrnd)
 *
 * @param [in]      key    SLH-DSA key.
 * @param [in]      ctx    Context of signing.
 * @param [in]      ctxSz  Length of context in bytes.
 * @param [in]      msg    Message to sign.
 * @param [in]      msgSz  Length of message in bytes.
 * @param [out]     sig    Buffer to hold signature.
 * @param [in, out] sigSz  On in, length of signature buffer.
 *                         On out, length of signature data.
 * @param [in]      addRnd opt_rand (PK.seed for deterministic, random otherwise).
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, msg, sig, sigSz or addRnd
 *          is NULL.
 * @return  BAD_FUNC_ARG when ctx is NULL but ctx length is greater than 0.
 * @return  BAD_LENGTH_E when sigSz is less than required signature length.
 * @return  MISSING_KEY when private key not set.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_sign_external(SlhDsaKey* key, const byte* ctx, byte ctxSz,
    const byte* msg, word32 msgSz, byte* sig, word32* sigSz,
    const byte* addRnd)
{
    int ret = 0;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL) ||
            ((ctx == NULL) && (ctxSz > 0)) || (msg == NULL) || (sig == NULL) ||
            (sigSz == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Check sig buffer is large enough to hold generated signature. */
    else if (*sigSz < key->params->sigLen) {
        ret = BAD_LENGTH_E;
    }
    /* Alg 22, Step 5: Check addrnd is not NULL. */
    else if (addRnd == NULL) {
        /* Alg 22, Step 6: Return error. */
        ret = BAD_FUNC_ARG;
    }
    /* Check we have a private key to sign with. */
    else if ((key->flags & WC_SLHDSA_FLAG_PRIVATE) == 0) {
        ret = MISSING_KEY;
    }
    if (ret == 0) {
        byte md[SLHDSA_MAX_MD];
        byte hdr[2];
        byte n = key->params->n;

        /* Alg 22, Step 8: M' = toByte(0,1) || toByte(|ctx|,1) || ctx || M.
         * We stream the M' components into PRF_msg and H_msg. */
        hdr[0] = 0;
        hdr[1] = ctxSz;

#ifdef WOLFSSL_SLHDSA_SHA2
        if (SLHDSA_IS_SHA2(key->params->param)) {
            /* SHA2: PRF_msg via HMAC. */
            ret = slhdsakey_prf_msg_sha2(key, key->sk + n, addRnd, hdr, ctx,
                ctxSz, msg, msgSz, n, sig);
            if (ret == 0) {
                /* SHA2: H_msg via MGF1. */
                ret = slhdsakey_h_msg_sha2(key, sig, hdr, ctx, ctxSz, msg,
                    msgSz, md, (word32)key->params->dl1 + key->params->dl2 +
                    key->params->dl3);
                /* Move over randomizer. */
                sig += n;
            }
        }
        else
#endif
        {
            /* SHAKE: PRF_msg streaming with M' = hdr || ctx || msg. */
            ret = slhdsakey_hash_start(&key->hash.shk.shake, key->sk + n, n);
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, addRnd, n);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, hdr,
                    sizeof(hdr));
            }
            if ((ret == 0) && (ctxSz > 0)) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, ctx, ctxSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, msg, msgSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_final(&key->hash.shk.shake, sig, n);
            }
            /* SHAKE: H_msg streaming. */
            if (ret == 0) {
                ret = slhdsakey_hash_start(&key->hash.shk.shake, sig, n);
                sig += n;
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake,
                    key->sk + 2U * n, 2U * n);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, hdr,
                    sizeof(hdr));
            }
            if ((ret == 0) && (ctxSz > 0)) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, ctx, ctxSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, msg, msgSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_final(&key->hash.shk.shake, md,
                    (word32)key->params->dl1 + key->params->dl2 +
                    key->params->dl3);
            }
        }
        if (ret == 0) {
            /* Alg 19. Steps 7-19 */
            ret = slhdsakey_sign(key, md, sig);
        }
        if (ret == 0) {
            /* Return the signature size generated. */
            *sigSz = key->params->sigLen;
        }
    }

    return ret;
}

/* Generate a deterministic SLH-DSA signature.
 *
 * addrnd is the public key seed.
 *
 * @param [in]      key    SLH-DSA key.
 * @param [in]      ctx    Context of signing.
 * @param [in]      ctxSz  Length of context in bytes.
 * @param [in]      msg    Message to sign.
 * @param [in]      msgSz  Length of message in bytes.
 * @param [out]     sig    Buffer to hold signature.
 * @param [in, out] sigSz  On in, length of signature buffer.
 *                         On out, length of signature data.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, msg or sig is NULL.
 * @return  BAD_FUNC_ARG when ctx is NULL but ctx length is greater than 0.
 * @return  BAD_LENGTH_E when sigSz is less than required signature length.
 * @return  MISSING_KEY when private key not set.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_SignDeterministic(SlhDsaKey* key, const byte* ctx, byte ctxSz,
    const byte* msg, word32 msgSz, byte* sig, word32* sigSz)
{
    int ret;

    /* Validate parameters that will be used in this function. */
    if ((key == NULL) || (key->params == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    else {
        /* Pure sign. */
        ret = slhdsakey_sign_external(key, ctx, ctxSz, msg, msgSz, sig, sigSz,
            key->sk + 2 * key->params->n);
    }

    return ret;
}

/* Generate a pure SLH-DSA signature.
 *
 * @param [in]      key     SLH-DSA key.
 * @param [in]      ctx     Context of signing.
 * @param [in]      ctxSz   Length of context in bytes.
 * @param [in]      msg     Message to sign.
 * @param [in]      msgSz   Length of message in bytes.
 * @param [out]     sig     Buffer to hold signature.
 * @param [in, out] sigSz   On in, length of signature buffer.
 *                          On out, length of signature data.
 * @param [in]      addRnd  Additional random for signature.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, msg, sig or addrnd is NULL.
 * @return  BAD_FUNC_ARG when ctx is NULL but ctx length is greater than 0.
 * @return  BAD_LENGTH_E when sigSz is less than required signature length.
 * @return  MISSING_KEY when private key not set.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_SignWithRandom(SlhDsaKey* key, const byte* ctx, byte ctxSz,
    const byte* msg, word32 msgSz, byte* sig, word32* sigSz, const byte* addRnd)
{
    /* Pure sign. */
    return slhdsakey_sign_external(key, ctx, ctxSz, msg, msgSz, sig, sigSz,
        addRnd);
}

/* Generate a pure SLH-DSA signature with a random number generator.
 *
 * @param [in]      key     SLH-DSA key.
 * @param [in]      ctx     Context of signing.
 * @param [in]      ctxSz   Length of context in bytes.
 * @param [in]      msg     Message to sign.
 * @param [in]      msgSz   Length of message in bytes.
 * @param [out]     sig     Buffer to hold signature.
 * @param [in, out] sigSz   On in, length of signature buffer.
 *                          On out, length of signature data.
 * @param [in]      rng     Random number generator.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, msg, sig, sigSz or rng is
 *          NULL.
 * @return  BAD_FUNC_ARG when ctx is NULL but ctx length is greater than 0.
 * @return  BAD_LENGTH_E when sigSz is less than required signature length.
 * @return  MISSING_KEY when private key not set.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_Sign(SlhDsaKey* key, const byte* ctx, byte ctxSz,
    const byte* msg, word32 msgSz, byte* sig, word32* sigSz, WC_RNG* rng)
{
    int ret = 0;
    byte addRnd[SLHDSA_MAX_N];

    /* Validate parameters before generating random. */
    if ((key == NULL) || (key->params == NULL) ||
            ((ctx == NULL) && (ctxSz > 0)) || (msg == NULL) || (sig == NULL) ||
            (sigSz == NULL) || (rng == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Check sig buffer is large enough to hold generated signature. */
    else if (*sigSz < key->params->sigLen) {
        ret = BAD_LENGTH_E;
    }
    /* Check we have a private key to sign with. */
    else if ((key->flags & WC_SLHDSA_FLAG_PRIVATE) == 0) {
        ret = MISSING_KEY;
    }

#ifdef WOLF_CRYPTO_CB
    if (ret == 0) {
    #ifndef WOLF_CRYPTO_CB_FIND
        if (key->devId != INVALID_DEVID)
    #endif
        {
            ret = wc_CryptoCb_PqcSign(msg, msgSz, sig, sigSz, ctx, ctxSz,
                WC_HASH_TYPE_NONE, rng, WC_PQC_SIG_TYPE_SLHDSA, key);
            if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
                return ret;
            /* fall-through when unavailable */
            ret = 0;
        }
    }
#endif

    if (ret == 0) {
        /* Generate n bytes of random. */
        ret = wc_RNG_GenerateBlock(rng, addRnd, key->params->n);
    }
    if (ret == 0) {
        /* Pure sign. */
        ret = wc_SlhDsaKey_SignWithRandom(key, ctx, ctxSz, msg, msgSz, sig,
            sigSz, addRnd);
    }

    ForceZero(addRnd, sizeof(addRnd));

    return ret;
}

/* Sign using the FIPS 205 internal interface (Algorithm 19) -- M' provided
 * directly by the caller, deterministic variant (opt_rand = PK.seed).
 *
 * Used for HashSLH-DSA implementations that build M' externally and for ACVP
 * signatureInterface=internal test vectors.
 *
 * @param [in]      key       SLH-DSA key.
 * @param [in]      mprime    M' message (already in internal format).
 * @param [in]      mprimeSz  Length of M' in bytes.
 * @param [out]     sig       Buffer to hold signature.
 * @param [in, out] sigSz     On in, buffer length. On out, signature length.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, mprime, sig or sigSz is
 *          NULL.
 * @return  BAD_LENGTH_E when sigSz is less than required signature length.
 * @return  MISSING_KEY when private key not set.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_SignMsgDeterministic(SlhDsaKey* key, const byte* mprime,
    word32 mprimeSz, byte* sig, word32* sigSz)
{
    int ret = 0;

    if ((key == NULL) || (key->params == NULL) || (mprime == NULL) ||
            (sig == NULL) || (sigSz == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    else if (*sigSz < key->params->sigLen) {
        ret = BAD_LENGTH_E;
    }
    else if ((key->flags & WC_SLHDSA_FLAG_PRIVATE) == 0) {
        ret = MISSING_KEY;
    }
    if (ret == 0) {
        ret = slhdsakey_sign_internal_msg(key, mprime, mprimeSz, sig, sigSz,
            key->sk + 2 * key->params->n);
    }

    return ret;
}

/* Sign using the FIPS 205 internal interface (Algorithm 19) -- M' provided
 * directly by the caller, with explicit randomness.
 *
 * Used for HashSLH-DSA implementations that build M' externally and for ACVP
 * signatureInterface=internal test vectors.
 *
 * @param [in]      key       SLH-DSA key.
 * @param [in]      mprime    M' message (already in internal format).
 * @param [in]      mprimeSz  Length of M' in bytes.
 * @param [out]     sig       Buffer to hold signature.
 * @param [in, out] sigSz     On in, buffer length. On out, signature length.
 * @param [in]      addRnd    opt_rand value.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, mprime, sig, sigSz or
 *          addRnd is NULL.
 * @return  BAD_LENGTH_E when sigSz is less than required signature length.
 * @return  MISSING_KEY when private key not set.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_SignMsgWithRandom(SlhDsaKey* key, const byte* mprime,
    word32 mprimeSz, byte* sig, word32* sigSz, const byte* addRnd)
{
    int ret = 0;

    if ((key == NULL) || (key->params == NULL) || (mprime == NULL) ||
            (sig == NULL) || (sigSz == NULL) || (addRnd == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    else if (*sigSz < key->params->sigLen) {
        ret = BAD_LENGTH_E;
    }
    else if ((key->flags & WC_SLHDSA_FLAG_PRIVATE) == 0) {
        ret = MISSING_KEY;
    }
    if (ret == 0) {
        ret = slhdsakey_sign_internal_msg(key, mprime, mprimeSz, sig, sigSz,
            addRnd);
    }

    return ret;
}

#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* Verify SLH-DSA signature.
 *
 * FIPS 205. Section 9.3. Algorithm 20.
 * slh_verify_internal(M, SIG, PK)
 *  ...
 *   6: SIGFORS <- SIG.getSIG_FORS()               > SIG[n : (1 + k(1 + a)) . n]
 *   7: SIGHT <- SIG.getSIG_HT()
 *                  > SIG[(1 + k(1 + a)) . n : (1 + k(1 + a) + h + d . len) . n]
 *  ...
 *  17: PKFORS <- fors_pkFromSig(SIGFORS, md, PK.seed, ADRS)
 *  18: return ht_verify(PKFORS, SIGHT, PK.seed, idxtree, idxleaf, PK.root)
 *
 * @param [in] key  SLH-DSA key.
 * @param [in] md   Message digest.
 * @param [in] sig  Signature data.
 * @return  0 on success.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_verify(SlhDsaKey* key, byte* md, const byte* sig)
{
    int ret;
    HashAddress adrs;
    word32 t[3];
    word32 l;
    byte pk_fors[SLHDSA_MAX_N];
    byte n = key->params->n;

    /* Steps 4, 10-16: Set address based on message digest. */
    slhdsakey_set_ha_from_md(key, md, adrs, t, &l);

    /* Step 6: Move pointer to FORS signature. */
    sig += n;
    /* Step 17: Get FORS public key from FORS signature. */
    ret = slhdsakey_fors_pk_from_sig(key, sig, md, key->sk + 2 * n, adrs,
        pk_fors);
    /* Step 7: Move pointer to hypertree signature. */
    sig += key->params->k * (1 + key->params->a) * n;
    if (ret == 0) {
        /* Step 18: Verify hypertree signature. */
        ret = slhdsakey_ht_verify(key, pk_fors, sig, key->sk + 2 * n, t, l,
            key->sk + 3 * n);
    }

    return ret;
}

/* Verify SLH-DSA signature.
 *
 * FIPS 205. Section 9.3. Algorithm 20.
 * slh_verify_internal(M, SIG, PK)
 *   1: if |SIG| != (1 + k(1 + a) + h + d . len . n then
 *   2:     return false
 *   3: end if
 *  ...
 *   5: R <- SIG.getR()                                             > SIG[0 : n]
 *  ...
 *   8: digest <- Hmsg (R, PK.seed, PK.root, M)         > compute message digest
 *   9: md <- digest [0 : upper(k.a / 8)]           > first upper(k.a / 8) bytes
 *  ...
 *
 * FIPS 205. Section 10.3. Algorithm 24.
 * slh_verify(M, SIG, ctx, PK)
 *   1: if |ctx| > 255 then
 *   2:     return false
 *   3: end if
 *   4: M' <- toByte(0, 1) || toByte(|ctx|, 1) || ctx
 *   5: return slh_verify_internal(M', SIG, PK)
 *
 * Note: ctx length is of type byte which means it can never be more than 255.
 *
 * @param [in] key    SLH-DSA key.
 * @param [in] ctx    Context of signing.
 * @param [in] ctxSz  Length of context in bytes.
 * @param [in] msg    Message to sign.
 * @param [in] msgSz  Length of message in bytes.
 * @param [in] sig    Signature data.
 * @param [in] sigSz  Length of signature in bytes.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, msg or sig is NULL.
 * @return  BAD_FUNC_ARG when ctx is NULL but ctxSz is greater than 0.
 * @return  BAD_LENGTH_E when signature size does not match parameters.
 * @return  MISSING_KEY when public key not set.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_Verify(SlhDsaKey* key, const byte* ctx, byte ctxSz,
    const byte* msg, word32 msgSz, const byte* sig, word32 sigSz)
{
    int ret = 0;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL) ||
            ((ctx == NULL) && (ctxSz > 0)) || (msg == NULL) ||
            (sig == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Alg 20, Step 1: Check signature length is the expect length. */
    else if (sigSz != key->params->sigLen) {
        /* Alg 20, Step 2: Return error  */
        ret = BAD_LENGTH_E;
    }
    /* Check we have a public key to verify with. */
    else if ((key->flags & WC_SLHDSA_FLAG_PUBLIC) == 0) {
        ret = MISSING_KEY;
    }

#ifdef WOLF_CRYPTO_CB
    if (ret == 0) {
    #ifndef WOLF_CRYPTO_CB_FIND
        if (key->devId != INVALID_DEVID)
    #endif
        {
            int res = 0;
            ret = wc_CryptoCb_PqcVerify(sig, sigSz, msg, msgSz, ctx, ctxSz,
                WC_HASH_TYPE_NONE, &res, WC_PQC_SIG_TYPE_SLHDSA, key);
            if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) {
                if (ret != 0)
                    return ret;
                return (res == 1) ? 0 : SIG_VERIFY_E;
            }
            /* fall-through when unavailable */
            ret = 0;
        }
    }
#endif

    if (ret == 0) {
        byte md[SLHDSA_MAX_MD];
        byte n = key->params->n;
        byte hdr[2];

        /* Alg 24, Step 4: Make M' header. */
        hdr[0] = 0;
        hdr[1] = ctxSz;

#ifdef WOLFSSL_SLHDSA_SHA2
        if (SLHDSA_IS_SHA2(key->params->param)) {
            /* SHA2: H_msg via MGF1 (no PRF_msg for verify). */
            ret = slhdsakey_h_msg_sha2(key, sig, hdr, ctx, ctxSz, msg, msgSz,
                md, (word32)key->params->dl1 + key->params->dl2 +
                key->params->dl3);
        }
        else
#endif
        {
            /* SHAKE: H_msg streaming. */
            ret = slhdsakey_hash_start(&key->hash.shk.shake, sig, n);
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake,
                    key->sk + 2U * n, 2U * n);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, hdr,
                    sizeof(hdr));
            }
            if ((ret == 0) && (ctxSz > 0)) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, ctx, ctxSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, msg, msgSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_final(&key->hash.shk.shake, md,
                    (word32)key->params->dl1 + key->params->dl2 +
                    key->params->dl3);
            }
        }
        if (ret == 0) {
            /* Alg 24, Step 5: Verify M'.
             * Alg 20, Steps 4,6-18: Verify digest. */
            ret = slhdsakey_verify(key, md, sig);
        }
    }

    return ret;
}

/* Verify SLH-DSA signature using internal interface -- M' provided directly.
 *
 * FIPS 205. Section 9.3. Algorithm 20.
 * slh_verify_internal(M', SIG, PK)
 *
 * @param [in] key       SLH-DSA key.
 * @param [in] mprime    M' message (already in internal format).
 * @param [in] mprimeSz  Length of M' in bytes.
 * @param [in] sig       Signature data.
 * @param [in] sigSz     Length of signature in bytes.
 * @return  0 on success.
 * @return  SIG_VERIFY_E on verification failure.
 */
int wc_SlhDsaKey_VerifyMsg(SlhDsaKey* key, const byte* mprime,
    word32 mprimeSz, const byte* sig, word32 sigSz)
{
    int ret = 0;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL) || (mprime == NULL) ||
            (sig == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    else if (sigSz != key->params->sigLen) {
        ret = BAD_LENGTH_E;
    }
    else if ((key->flags & WC_SLHDSA_FLAG_PUBLIC) == 0) {
        ret = MISSING_KEY;
    }
    if (ret == 0) {
        byte md[SLHDSA_MAX_MD];
        byte n = key->params->n;

#ifdef WOLFSSL_SLHDSA_SHA2
        if (SLHDSA_IS_SHA2(key->params->param)) {
            /* SHA2: H_msg. Internal interface: no M' header, pass whole
             * message directly. */
            ret = slhdsakey_h_msg_sha2(key, sig,
                NULL, NULL, 0, mprime, mprimeSz,
                md, (word32)key->params->dl1 + key->params->dl2 +
                key->params->dl3);
        }
        else
#endif
        {
            /* SHAKE: H_msg = SHAKE(R || PK.seed || PK.root || M). */
            ret = slhdsakey_hash_start(&key->hash.shk.shake, sig, n);
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake,
                    key->sk + 2U * n, 2U * n);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake,
                    mprime, mprimeSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_final(&key->hash.shk.shake, md,
                    (word32)key->params->dl1 + key->params->dl2 +
                    key->params->dl3);
            }
        }
        if (ret == 0) {
            ret = slhdsakey_verify(key, md, sig);
        }
    }

    return ret;
}

/* All HashSLH-DSA hash OIDs are DER-encoded as tag(0x06) + length(0x09) + 9
 * bytes, so any approved hash OID is exactly 11 bytes. The PRF_msg / H_msg
 * input for the SHA-2 path is the concatenation OID || PHM, bounded by
 * SLHDSA_OID_MAX_LEN + WC_MAX_DIGEST_SIZE. The PHM buffer fits in
 * WC_MAX_DIGEST_SIZE bytes because slhdsakey_validate_prehash enforces
 * hashSz == expectedLen[hashType] for every supported hashType and every
 * supported expectedLen is <= WC_MAX_DIGEST_SIZE. The largest FIPS 205
 * approved PHM is 64 bytes (SHA-512 digest size, also the SHAKE256 PHM
 * length fixed at 512 bits per Section 10.2.2). The static assert below
 * catches a future hash being added whose digest exceeds the bound. The
 * literal 64 is used directly because WC_SHA512_DIGEST_SIZE is only
 * defined when SHA-512 is compiled in. */
#define SLHDSA_OID_MAX_LEN              11
#define SLHDSA_LARGEST_APPROVED_PHM_LEN 64
#define SLHDSA_PHMSG_MAX_LEN            (SLHDSA_OID_MAX_LEN + \
                                         WC_MAX_DIGEST_SIZE)
wc_static_assert(WC_MAX_DIGEST_SIZE >= SLHDSA_LARGEST_APPROVED_PHM_LEN);

#ifdef WOLFSSL_SHA224
/* OID for SHA-224 for hash signing/verification. */
static const byte slhdsakey_oid_sha224[] = {
    0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04
};
#endif
#ifndef NO_SHA256
/* OID for SHA-256 for hash signing/verification. */
static const byte slhdsakey_oid_sha256[] = {
    0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01
};
#endif
#ifdef WOLFSSL_SHA384
/* OID for SHA-384 for hash signing/verification. */
static const byte slhdsakey_oid_sha384[] = {
    0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02
};
#endif
#ifdef WOLFSSL_SHA512
/* OID for SHA-512 for hash signing/verification. */
static const byte slhdsakey_oid_sha512[] = {
    0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03
};
#ifndef WOLFSSL_NOSHA512_224
/* OID for SHA-512/224 for hash signing/verification. */
static const byte slhdsakey_oid_sha512_224[] = {
    0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x05
};
#endif
#ifndef WOLFSSL_NOSHA512_256
/* OID for SHA-512/256 for hash signing/verification. */
static const byte slhdsakey_oid_sha512_256[] = {
    0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x06
};
#endif
#endif
#ifdef WOLFSSL_SHAKE128
/* OID for SHAKE-128 for hash signing/verification. */
static const byte slhdsakey_oid_shake128[] = {
    0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x0b
};
#endif
#ifdef WOLFSSL_SHAKE256
/* OID for SHAKE-256 for hash signing/verification. */
static const byte slhdsakey_oid_shake256[] = {
    0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x0c
};
#endif
#ifdef WOLFSSL_SHA3
#ifndef WOLFSSL_NOSHA3_224
/* OID for SHA3-224 for hash signing/verification. */
static const byte slhdsakey_oid_sha3_224[] = {
    0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x07
};
#endif
#ifndef WOLFSSL_NOSHA3_256
/* OID for SHA3-256 for hash signing/verification. */
static const byte slhdsakey_oid_sha3_256[] = {
    0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x08
};
#endif
#ifndef WOLFSSL_NOSHA3_384
/* OID for SHA3-384 for hash signing/verification. */
static const byte slhdsakey_oid_sha3_384[] = {
    0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x09
};
#endif
#ifndef WOLFSSL_NOSHA3_512
/* OID for SHA3-512 for hash signing/verification. */
static const byte slhdsakey_oid_sha3_512[] = {
    0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x0a
};
#endif
#endif

/* Validate the caller-supplied pre-hashed digest length and look up the
 * corresponding OID for the chosen hash algorithm.
 *
 * The HashSLH-DSA family takes the digest as input rather than the full
 * message. This mirrors the wc_MlDsaKey_*Ctx_Hash interface and matches the
 * convention used by NIST ACVP signatureInterface=external / preHash test
 * vectors and other libraries (OpenSSL HASH-ML-DSA, leancrypto SLH-DSA,
 * mldsa-native pre_hash_internal). The expected digest length is fixed by
 * FIPS 205 Section 10.2.2 and equals wc_HashGetDigestSize(hashType) for the
 * fixed-output hashes; for SHAKE128/256 the standard fixes the XOF output to
 * 256/512 bits respectively. Callers feed the caller-supplied digest buffer
 * directly into the M' construction -- there is no copy.
 *
 * @param [in]  hashSz    Length of the caller-supplied digest in bytes.
 * @param [in]  hashType  Hash algorithm identifier (selects OID and length).
 * @param [out] oid       OID data for hash algorithm.
 * @param [out] oidLen    Length of OID data for hash algorithm.
 * @return  0 on success.
 * @return  BAD_LENGTH_E when hashSz does not equal the expected digest size.
 * @return  NOT_COMPILED_IN when hash algorithm not supported.
 */
static int slhdsakey_validate_prehash(word32 hashSz,
    enum wc_HashType hashType, const byte** oid, byte* oidLen)
{
    int ret = 0;
    word32 expectedLen = 0;

    switch ((int)hashType) {
    #ifdef WOLFSSL_SHA224
        case WC_HASH_TYPE_SHA224:
            *oid = slhdsakey_oid_sha224;
            *oidLen = (byte)sizeof(slhdsakey_oid_sha224);
            expectedLen = WC_SHA224_DIGEST_SIZE;
            break;
    #endif
    #ifndef NO_SHA256
        case WC_HASH_TYPE_SHA256:
            *oid = slhdsakey_oid_sha256;
            *oidLen = (byte)sizeof(slhdsakey_oid_sha256);
            expectedLen = WC_SHA256_DIGEST_SIZE;
            break;
    #endif
    #ifdef WOLFSSL_SHA384
        case WC_HASH_TYPE_SHA384:
            *oid = slhdsakey_oid_sha384;
            *oidLen = (byte)sizeof(slhdsakey_oid_sha384);
            expectedLen = WC_SHA384_DIGEST_SIZE;
            break;
    #endif
#ifdef WOLFSSL_SHA512
        case WC_HASH_TYPE_SHA512:
            *oid = slhdsakey_oid_sha512;
            *oidLen = (byte)sizeof(slhdsakey_oid_sha512);
            expectedLen = WC_SHA512_DIGEST_SIZE;
            break;
    #ifndef WOLFSSL_NOSHA512_224
        case WC_HASH_TYPE_SHA512_224:
            *oid = slhdsakey_oid_sha512_224;
            *oidLen = (byte)sizeof(slhdsakey_oid_sha512_224);
            expectedLen = WC_SHA512_224_DIGEST_SIZE;
            break;
    #endif
    #ifndef WOLFSSL_NOSHA512_256
        case WC_HASH_TYPE_SHA512_256:
            *oid = slhdsakey_oid_sha512_256;
            *oidLen = (byte)sizeof(slhdsakey_oid_sha512_256);
            expectedLen = WC_SHA512_256_DIGEST_SIZE;
            break;
    #endif
#endif
    #ifdef WOLFSSL_SHAKE128
        case WC_HASH_TYPE_SHAKE128:
            *oid = slhdsakey_oid_shake128;
            *oidLen = (byte)sizeof(slhdsakey_oid_shake128);
            /* FIPS 205 Section 10.2.2 fixes SHAKE128 PHM length at 256 bits. */
            expectedLen = WC_SHA3_256_DIGEST_SIZE;
            break;
    #endif
    #ifdef WOLFSSL_SHAKE256
        case WC_HASH_TYPE_SHAKE256:
            *oid = slhdsakey_oid_shake256;
            *oidLen = (byte)sizeof(slhdsakey_oid_shake256);
            /* FIPS 205 Section 10.2.2 fixes SHAKE256 PHM length at 512 bits. */
            expectedLen = WC_SHA3_512_DIGEST_SIZE;
            break;
    #endif
    #ifdef WOLFSSL_SHA3
    #ifndef WOLFSSL_NOSHA3_224
        case WC_HASH_TYPE_SHA3_224:
            *oid = slhdsakey_oid_sha3_224;
            *oidLen = (byte)sizeof(slhdsakey_oid_sha3_224);
            expectedLen = WC_SHA3_224_DIGEST_SIZE;
            break;
    #endif
    #ifndef WOLFSSL_NOSHA3_256
        case WC_HASH_TYPE_SHA3_256:
            *oid = slhdsakey_oid_sha3_256;
            *oidLen = (byte)sizeof(slhdsakey_oid_sha3_256);
            expectedLen = WC_SHA3_256_DIGEST_SIZE;
            break;
    #endif
    #ifndef WOLFSSL_NOSHA3_384
        case WC_HASH_TYPE_SHA3_384:
            *oid = slhdsakey_oid_sha3_384;
            *oidLen = (byte)sizeof(slhdsakey_oid_sha3_384);
            expectedLen = WC_SHA3_384_DIGEST_SIZE;
            break;
    #endif
    #ifndef WOLFSSL_NOSHA3_512
        case WC_HASH_TYPE_SHA3_512:
            *oid = slhdsakey_oid_sha3_512;
            *oidLen = (byte)sizeof(slhdsakey_oid_sha3_512);
            expectedLen = WC_SHA3_512_DIGEST_SIZE;
            break;
    #endif
    #endif
        default:
            ret = NOT_COMPILED_IN;
            break;
    }

    if ((ret == 0) && (hashSz != expectedLen)) {
        ret = BAD_LENGTH_E;
    }

    return ret;
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Generate pre-hash SLH-DSA signature.
 *
 * FIPS 205. Section 10.2.2. Algorithm 23.
 * hash_slh_sign(M, ctx, PH, SK)
 *   1: if |ctx| > 255 then
 *   2:  return falsity
 *                > return an error indication if the context string is too long
 *   3: end if
 *   4: addrnd <-$- Bn    > skip lines 4 through 7 for the deterministic variant
 *   5: if addrnd = NULL then
 *   6:     return falsity
 *                  > return an error indication if random bit generation failed
 *   7: end if
 *   8: switch PH do
 *   9:     case SHA-256:
 *  10:         OID <- toByte(0x0609608648016503040201, 11)
 *                                                      > 2.16.840.1.101.3.4.2.1
 *  11:         PHM <- SHA-256(M)
 *  12:     case SHA-512:
 *  13:         OID <- toByte(0x0609608648016503040203, 11)
 *                                                      > 2.16.840.1.101.3.4.2.3
 *  14:         PHM <- SHA-512(M)
 *  15:     case SHAKE128:
 *  16:         OID <- toByte(0x060960864801650304020B, 11)
 *                                                     > 2.16.840.1.101.3.4.2.11
 *  17:         PHM <- SHAKE128(M, 256)
 *  18:     case SHAKE256:
 *  19:         OID <- toByte(0x060960864801650304020C, 11)
 *                                                     > 2.16.840.1.101.3.4.2.12
 *  20:         PHM <- SHAKE256(M , 512)
 *  21:     case ...                     > other approved hash functions or XOFs
 *  22:         ...
 *  23: end switch
 *  24: M' <- toByte(1, 1) || toByte(|ctx|, 1) || ctx || OID || PHM
 *                                   > omit addrnd for the deterministic variant
 *  25: SIG <- slh_sign_internal(M', SK, addrnd)
 *  26: return SIG
 *
 * FIPS 205. Section 9.2. Algorithm 19.
 * slh_sign_internal(M, SK, addrnd)
 *  ...
 *   2: opt_rand <- addrnd
 *                > substitute opt_rand <- PK.seed for the deterministic variant
 *   3: R <- PRFmsg (SK.prf, opt_rand, M)                  > generate randomizer
 *   4: SIG <- R
 *   5: digest <- Hmsg(R, PK.seed, PK.root, M)          > compute message digest
 *   6: md <- digest [0 : upper(k.a / 8)]          > first upper(k.a / 8)] bytes
 *  ...
 *
 * Note: ctx length is of type byte which means it can never be more than 255.
 *
 * The caller MUST pre-hash the application message with hashType before
 * calling and pass the digest as hash. hashSz must equal the digest size of
 * hashType (32 for SHAKE128, 64 for SHAKE256 per FIPS 205 Section 10.2.2).
 *
 * @param [in]      key       SLH-DSA key.
 * @param [in]      ctx       Context of signing.
 * @param [in]      ctxSz     Length of context in bytes.
 * @param [in]      hash      Pre-hashed message digest to sign.
 * @param [in]      hashSz    Length of digest in bytes.
 * @param [in]      hashType  Hash algorithm used for pre-hash (selects OID).
 * @param [out]     sig       Buffer to hold signature.
 * @param [in, out] sigSz     On in, length of signature buffer.
 *                            On out, length of signature data.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, hash, sig, sigSz or addRnd
 *          is NULL.
 * @return  BAD_FUNC_ARG when ctx is NULL but ctx length is greater than 0.
 * @return  BAD_LENGTH_E when sigSz is less than required signature length, or
 *          when hashSz does not equal the digest size for hashType.
 * @return  NOT_COMPILED_IN when hash algorithm is not supported.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
static int slhdsakey_signhash_external(SlhDsaKey* key, const byte* ctx,
    byte ctxSz, const byte* hash, word32 hashSz, enum wc_HashType hashType,
    byte* sig, word32* sigSz, const byte* addRnd)
{
    int ret = 0;
    const byte* oid = NULL;
    byte oidLen = 0;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL) ||
            ((ctx == NULL) && (ctxSz > 0)) || (hash == NULL) || (sig == NULL) ||
            (sigSz == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Check sig buffer is large enough to hold generated signature. */
    else if (*sigSz < key->params->sigLen) {
        ret = BAD_LENGTH_E;
    }
    /* Alg 23, Step 5: Check addrnd is not NULL. */
    else if (addRnd == NULL) {
        /* Alg 23, Step 6: Return error. */
        ret = BAD_FUNC_ARG;
    }
    if (ret == 0) {
        /* Alg 23, Steps 8-23: Validate caller-supplied pre-hashed digest length
         * and select OID for the chosen hash algorithm. */
        ret = slhdsakey_validate_prehash(hashSz, hashType, &oid, &oidLen);
    }
    if (ret == 0) {
        byte n = key->params->n;
        byte md[SLHDSA_MAX_MD];
        byte hdr[2];

        /* Alg 23, Step 24: Set first two bytes to pass to hash ... */
        hdr[0] = 1;
        hdr[1] = ctxSz;

#ifdef WOLFSSL_SLHDSA_SHA2
        if (SLHDSA_IS_SHA2(key->params->param)) {
            /* SHA2: Build oid||hash as message for PRF_msg/H_msg. */
            byte phMsg[SLHDSA_PHMSG_MAX_LEN];
            word32 phMsgLen = (word32)oidLen + hashSz;

            XMEMCPY(phMsg, oid, oidLen);
            XMEMCPY(phMsg + oidLen, hash, hashSz);

            ret = slhdsakey_prf_msg_sha2(key, key->sk + n, addRnd, hdr, ctx,
                ctxSz, phMsg, phMsgLen, n, sig);
            if (ret == 0) {
                ret = slhdsakey_h_msg_sha2(key, sig, hdr, ctx, ctxSz, phMsg,
                    phMsgLen, md, (word32)key->params->dl1 + key->params->dl2 +
                    key->params->dl3);
                sig += n;
            }
        }
        else
#endif
        {
            /* SHAKE: PRF_msg streaming. */
            ret = slhdsakey_hash_start(&key->hash.shk.shake, key->sk + n, n);
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, addRnd, n);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, hdr,
                    sizeof(hdr));
            }
            if ((ret == 0) && (ctxSz > 0)) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, ctx, ctxSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, oid, oidLen);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, hash, hashSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_final(&key->hash.shk.shake, sig, n);
            }
            /* SHAKE: H_msg streaming. */
            if (ret == 0) {
                ret = slhdsakey_hash_start(&key->hash.shk.shake, sig, n);
                sig += n;
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake,
                    key->sk + 2U * n, 2U * n);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, hdr,
                    sizeof(hdr));
            }
            if ((ret == 0) && (ctxSz > 0)) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, ctx, ctxSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, oid, oidLen);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, hash, hashSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_final(&key->hash.shk.shake, md,
                    (word32)key->params->dl1 + key->params->dl2 +
                    key->params->dl3);
            }
        }
        if (ret == 0) {
            /* Alg 19. Steps 7-19 */
            ret = slhdsakey_sign(key, md, sig);
        }
        if (ret == 0) {
            /* Return the signature size generated. */
            *sigSz = key->params->sigLen;
        }
    }

    return ret;
}

/* Generate a deterministic HashSLH-DSA signature.
 *
 * addrnd is the public key seed. The caller MUST pre-hash the application
 * message with hashType before calling and pass the digest as hash; hashSz
 * must equal the digest size of hashType (32 for SHAKE128, 64 for SHAKE256
 * per FIPS 205 Section 10.2.2).
 *
 * @param [in]      key       SLH-DSA key.
 * @param [in]      ctx       Context of signing.
 * @param [in]      ctxSz     Length of context in bytes.
 * @param [in]      hash      Pre-hashed message digest to sign.
 * @param [in]      hashSz    Length of digest in bytes.
 * @param [in]      hashType  Hash algorithm used for pre-hash (selects OID).
 * @param [out]     sig       Buffer to hold signature.
 * @param [in, out] sigSz     On in, length of signature buffer.
 *                            On out, length of signature data.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, hash, sig or sigSz is NULL.
 * @return  BAD_FUNC_ARG when ctx is NULL but ctx length is greater than 0.
 * @return  BAD_LENGTH_E when sigSz is less than required signature length, or
 *          when hashSz does not equal the digest size for hashType.
 * @return  MISSING_KEY when private key not set.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_SignHashDeterministic(SlhDsaKey* key, const byte* ctx,
    byte ctxSz, const byte* hash, word32 hashSz, enum wc_HashType hashType,
    byte* sig, word32* sigSz)
{
    int ret;

    /* Validate parameters that will be used in this function. */
    if ((key == NULL) || (key->params == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Check we have a private key to sign with. */
    else if ((key->flags & WC_SLHDSA_FLAG_PRIVATE) == 0) {
        ret = MISSING_KEY;
    }
    else {
        /* HashSLH-DSA sign with caller-supplied digest. */
        ret = slhdsakey_signhash_external(key, ctx, ctxSz, hash, hashSz,
            hashType, sig, sigSz, key->sk + 2 * key->params->n);
    }

    return ret;
}

/* Generate a HashSLH-DSA signature with explicit randomness.
 *
 * The caller MUST pre-hash the application message with hashType before
 * calling and pass the digest as hash; hashSz must equal the digest size of
 * hashType (32 for SHAKE128, 64 for SHAKE256 per FIPS 205 Section 10.2.2).
 *
 * @param [in]      key       SLH-DSA key.
 * @param [in]      ctx       Context of signing.
 * @param [in]      ctxSz     Length of context in bytes.
 * @param [in]      hash      Pre-hashed message digest to sign.
 * @param [in]      hashSz    Length of digest in bytes.
 * @param [in]      hashType  Hash algorithm used for pre-hash (selects OID).
 * @param [out]     sig       Buffer to hold signature.
 * @param [in, out] sigSz     On in, length of signature buffer.
 *                            On out, length of signature data.
 * @param [in]      addRnd    Additional random for signature.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, hash, sig, sigSz or addrnd
 *          is NULL.
 * @return  BAD_FUNC_ARG when ctx is NULL but ctx length is greater than 0.
 * @return  BAD_LENGTH_E when sigSz is less than required signature length, or
 *          when hashSz does not equal the digest size for hashType.
 * @return  MISSING_KEY when private key not set.
 * @return  NOT_COMPILED in when hash algorithm is not supported.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_SignHashWithRandom(SlhDsaKey* key, const byte* ctx, byte ctxSz,
    const byte* hash, word32 hashSz, enum wc_HashType hashType, byte* sig,
    word32* sigSz, const byte* addRnd)
{
    /* HashSLH-DSA sign with caller-supplied digest. */
    return slhdsakey_signhash_external(key, ctx, ctxSz, hash, hashSz, hashType,
        sig, sigSz, addRnd);
}

/* Generate a HashSLH-DSA signature using an RNG for added randomness.
 *
 * The caller MUST pre-hash the application message with hashType before
 * calling and pass the digest as hash; hashSz must equal the digest size of
 * hashType (32 for SHAKE128, 64 for SHAKE256 per FIPS 205 Section 10.2.2).
 *
 * @param [in]      key     SLH-DSA key.
 * @param [in]      ctx     Context of signing.
 * @param [in]      ctxSz   Length of context in bytes.
 * @param [in]      hash    Pre-hashed message digest to sign.
 * @param [in]      hashSz  Length of digest in bytes.
 * @param [in]      hashType  Hash algorithm used for pre-hash (selects OID).
 * @param [out]     sig     Buffer to hold signature.
 * @param [in, out] sigSz   On in, length of signature buffer.
 *                          On out, length of signature data.
 * @param [in]      rng     Random number generator.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, hash, sig, sigSz or rng is
 *          NULL.
 * @return  BAD_FUNC_ARG when ctx is NULL but ctx length is greater than 0.
 * @return  BAD_LENGTH_E when hashSz does not equal the digest size for
 *          hashType.
 * @return  MISSING_KEY when private key not set.
 * @return  NOT_COMPILED in when hash algorithm is not supported.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_SignHash(SlhDsaKey* key, const byte* ctx, byte ctxSz,
    const byte* hash, word32 hashSz, enum wc_HashType hashType, byte* sig,
    word32* sigSz, WC_RNG* rng)
{
    int ret = 0;
    byte addRnd[SLHDSA_MAX_N];

    /* Validate parameters before generating random.
     * hashSz / hashType validation lives in the internal worker and therefore
     * runs after wc_RNG_GenerateBlock. A call with a bad hashSz/hashType will
     * waste n bytes of DRBG output before the error is reported (similar to
     * ML-DSA pre-hash handling). */
    if ((key == NULL) || (key->params == NULL) ||
            ((ctx == NULL) && (ctxSz > 0)) || (hash == NULL) || (sig == NULL) ||
            (sigSz == NULL) || (rng == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Check sig buffer is large enough to hold generated signature. */
    else if (*sigSz < key->params->sigLen) {
        ret = BAD_LENGTH_E;
    }
    /* Check we have a private key to sign with. */
    else if ((key->flags & WC_SLHDSA_FLAG_PRIVATE) == 0) {
        ret = MISSING_KEY;
    }
    /* First sanity check on hashType; the downstream prehash validator does
     * the detailed check for the actual type. */
    else if ((word32)hashType > (word32)WC_HASH_TYPE_MAX) {
        ret = BAD_FUNC_ARG;
    }

#ifdef WOLF_CRYPTO_CB
    if (ret == 0) {
    #ifndef WOLF_CRYPTO_CB_FIND
        if (key->devId != INVALID_DEVID)
    #endif
        {
            ret = wc_CryptoCb_PqcSign(hash, hashSz, sig, sigSz, ctx, ctxSz,
                (word32)hashType, rng, WC_PQC_SIG_TYPE_SLHDSA, key);
            if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
                return ret;
            /* fall-through when unavailable */
            ret = 0;
        }
    }
#endif

    if (ret == 0) {
        /* Generate n bytes of random. */
        ret = wc_RNG_GenerateBlock(rng, addRnd, key->params->n);
    }
    if (ret == 0) {
        /* HashSLH-DSA sign with caller-supplied digest. */
        ret = wc_SlhDsaKey_SignHashWithRandom(key, ctx, ctxSz, hash, hashSz,
            hashType, sig, sigSz, addRnd);
    }

    ForceZero(addRnd, sizeof(addRnd));

    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* Verify SLH-DSA signature.
 *
 * FIPS 205. Section 9.3. Algorithm 20.
 * slh_verify_internal(M, SIG, PK)
 *   1: if |SIG| != (1 + k(1 + a) + h + d . len . n then
 *   2:     return false
 *   3: end if
 *  ...
 *   5: R <- SIG.getR()                                             > SIG[0 : n]
 *  ...
 *   8: digest <- Hmsg (R, PK.seed, PK.root, M)         > compute message digest
 *   9: md <- digest [0 : upper(k.a / 8)]           > first upper(k.a / 8) bytes
 * ...
 *
 * FIPS 205. Section 10.3. Algorithm 25.
 * hash_slh_verify(M, SIG, ctx, PH, PK)
 *   1: if |ctx| > 255 then
 *   2:     return false
 *   3: end if
 *   4: switch PH do
 *   5:     case SHA-256:
 *   6:         OID <- toByte(0x0609608648016503040201, 11)
 *                                                      > 2.16.840.1.101.3.4.2.1
 *   7:         PHM <- SHA-256(M)
 *   8:     case SHA-512:
 *   9:         OID <- toByte(0x0609608648016503040203, 11)
 *                                                      > 2.16.840.1.101.3.4.2.3
 *  10:         PHM <- SHA-512(M)
 *  11:     case SHAKE128:
 *  12:         OID <- toByte(0x060960864801650304020B, 11)
 *                                                     > 2.16.840.1.101.3.4.2.11
 *  13:         PHM <- SHAKE128(M, 256)
 *  14:     case SHAKE256:
 *  15:         OID <- toByte(0x060960864801650304020C, 11)
 *                                                     > 2.16.840.1.101.3.4.2.12
 *  16:         PHM <- SHAKE256(M , 512)
 *  17:     case ...                     > other approved hash functions or XOFs
 *  18:         ...
 *  19: end switch
 *  20: M' <- toByte(1, 1) || toByte(|ctx|, 1) || ctx || OID || PHM
 *  21: return slh_verify_internal(M', SIG, PK)
 *
 * The caller MUST pre-hash the application message with hashType before
 * calling and pass the digest as hash; hashSz must equal the digest size of
 * hashType (32 for SHAKE128, 64 for SHAKE256 per FIPS 205 Section 10.2.2).
 *
 * @param [in] key       SLH-DSA key.
 * @param [in] ctx       Context of signing.
 * @param [in] ctxSz     Length of context in bytes.
 * @param [in] hash      Pre-hashed message digest to verify against.
 * @param [in] hashSz    Length of digest in bytes.
 * @param [in] hashType  Hash algorithm used for pre-hash (selects OID).
 * @param [in] sig       Signature data.
 * @param [in] sigSz     Length of signature in bytes.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, hash or sig is NULL.
 * @return  BAD_FUNC_ARG when ctx is NULL but ctx length is greater than 0.
 * @return  BAD_LENGTH_E when signature size does not match parameters, or
 *          when hashSz does not equal the digest size for hashType.
 * @return  MISSING_KEY when public key not set.
 * @return  NOT_COMPILED in when hash algorithm is not supported.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_VerifyHash(SlhDsaKey* key, const byte* ctx, byte ctxSz,
    const byte* hash, word32 hashSz, enum wc_HashType hashType, const byte* sig,
    word32 sigSz)
{
    int ret = 0;
    const byte* oid = NULL;
    byte oidLen = 0;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL) ||
            ((ctx == NULL) && (ctxSz > 0)) || (hash == NULL) || (sig == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Alg 20, Step 1: Check signature length is the expect length. */
    else if (sigSz != key->params->sigLen) {
        /* Alg 20, Step 2: Return error  */
        ret = BAD_LENGTH_E;
    }
    /* Check we have a public key to verify with. */
    else if ((key->flags & WC_SLHDSA_FLAG_PUBLIC) == 0) {
        ret = MISSING_KEY;
    }
    /* First sanity check on hashType; the downstream prehash validator does
     * the detailed check for the actual type. */
    else if ((word32)hashType > (word32)WC_HASH_TYPE_MAX) {
        ret = BAD_FUNC_ARG;
    }

#ifdef WOLF_CRYPTO_CB
    if (ret == 0) {
    #ifndef WOLF_CRYPTO_CB_FIND
        if (key->devId != INVALID_DEVID)
    #endif
        {
            int res = 0;
            ret = wc_CryptoCb_PqcVerify(sig, sigSz, hash, hashSz, ctx, ctxSz,
                (word32)hashType, &res, WC_PQC_SIG_TYPE_SLHDSA, key);
            if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) {
                if (ret != 0)
                    return ret;
                return (res == 1) ? 0 : SIG_VERIFY_E;
            }
            /* fall-through when unavailable */
            ret = 0;
        }
    }
#endif

    if (ret == 0) {
        /* Alg 25, Steps 4-19: Validate caller-supplied pre-hashed digest length
         * and select OID for the chosen hash algorithm. */
        ret = slhdsakey_validate_prehash(hashSz, hashType, &oid, &oidLen);
    }
    if (ret == 0) {
        byte n = key->params->n;
        byte md[SLHDSA_MAX_MD];
        byte hdr[2];

        /* Alg 25, Step 20: Make M' header. */
        hdr[0] = 1;
        hdr[1] = ctxSz;

#ifdef WOLFSSL_SLHDSA_SHA2
        if (SLHDSA_IS_SHA2(key->params->param)) {
            /* SHA2: Build oid||hash as message for H_msg. */
            byte phMsg[SLHDSA_PHMSG_MAX_LEN];
            word32 phMsgLen = (word32)oidLen + hashSz;

            XMEMCPY(phMsg, oid, oidLen);
            XMEMCPY(phMsg + oidLen, hash, hashSz);

            ret = slhdsakey_h_msg_sha2(key, sig, hdr, ctx, ctxSz, phMsg,
                phMsgLen, md, (word32)key->params->dl1 + key->params->dl2 +
                key->params->dl3);
        }
        else
#endif
        {
            /* SHAKE: H_msg streaming. */
            ret = slhdsakey_hash_start(&key->hash.shk.shake, sig, n);
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake,
                    key->sk + 2U * n, 2U * n);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, hdr,
                    sizeof(hdr));
            }
            if ((ret == 0) && (ctxSz > 0)) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, ctx, ctxSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, oid, oidLen);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_update(&key->hash.shk.shake, hash, hashSz);
            }
            if (ret == 0) {
                ret = slhdsakey_hash_final(&key->hash.shk.shake, md,
                    (word32)key->params->dl1 + key->params->dl2 +
                    key->params->dl3);
            }
        }
        if (ret == 0) {
            /* Alg 25, Step 21: Verify M'.
             * Alg 20, Steps 4,6-18: Verify digest. */
            ret = slhdsakey_verify(key, md, sig);
        }
    }

    return ret;
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Import private key from data.
 *
 * Includes the public key.
 *
 * @param [in] key      SLH-DSA key.
 * @param [in] priv     Private key data.
 * @param [in] privLen  Length of private key data in bytes.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters or priv is NULL.
 * @return  BAD_LENGTH_E when inLen does not match parameters.
 */
int wc_SlhDsaKey_ImportPrivate(SlhDsaKey* key, const byte* priv, word32 privLen)
{
    int ret = 0;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL) || (priv == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Check private key data length matches parameters. */
    else if ((privLen != 4 * key->params->n)) {
        ret = BAD_LENGTH_E;
    }
    else {
        /* Copy private and public key data into SLH-DSA key object. */
        XMEMCPY(key->sk, priv, 4U * key->params->n);
        key->flags = WC_SLHDSA_FLAG_BOTH_KEYS;
#ifdef WOLFSSL_SLHDSA_SHA2
        if (SLHDSA_IS_SHA2(key->params->param)) {
            ret = slhdsakey_precompute_sha2_midstates(key);
        }
#endif
    }

    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* Import public key from data.
 *
 * @param [in] key     SLH-DSA key.
 * @param [in] pub     Public key data.
 * @param [in] pubLen  Length of public key data in bytes.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters or in is NULL.
 * @return  BAD_LENGTH_E when inLen does not match parameters.
 */
int wc_SlhDsaKey_ImportPublic(SlhDsaKey* key, const byte* pub, word32 pubLen)
{
    int ret = 0;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL) || (pub == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Check public key data length matches parameters. */
    else if ((pubLen != 2 * key->params->n)) {
        ret = BAD_LENGTH_E;
    }
    else {
        /* Copy public key data into SLH-DSA key object. */
        XMEMCPY(key->sk + 2U * key->params->n, pub, 2U * key->params->n);
        key->flags |= WC_SLHDSA_FLAG_PUBLIC;
#ifdef WOLFSSL_SLHDSA_SHA2
        if (SLHDSA_IS_SHA2(key->params->param)) {
            ret = slhdsakey_precompute_sha2_midstates(key);
        }
#endif
    }

    return ret;
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Check that the private key is valid.
 *
 * @param [in] key  SLH-DSA key.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key or key's parameters is NULL.
 * @return  MISSING_KEY when private key not set.
 * @return  WC_KEY_MISMATCH_E when private key and public seed don't compute
 *          public key root.
 * @return  MEMORY_E on dynamic memory allocation failure.
 * @return  SHAKE-256 error return code on digest failure.
 */
int wc_SlhDsaKey_CheckKey(SlhDsaKey* key)
{
    int ret = 0;

    /* Validate parameter. */
    if ((key == NULL) || (key->params == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Check we have a private key to validate. */
    else if ((key->flags & WC_SLHDSA_FLAG_PRIVATE) == 0) {
        ret = MISSING_KEY;
    }
    if (ret == 0) {
        byte root[SLHDSA_MAX_N];
        byte n = key->params->n;

        /* Cache the public key root as making the key overwrites. */
        XMEMCPY(root, key->sk + 3 * n, n);
        ret = wc_SlhDsaKey_MakeKeyWithRandom(key, key->sk, n, key->sk + n, n,
                key->sk + 2 * n, n);
        /* Compare computed root with what was cached. */
        if ((ret == 0) && (XMEMCMP(root, key->sk + 3 * n, n) != 0)) {
            ret = WC_KEY_MISMATCH_E;
        }
    }

    return ret;
}

/* Export the private key.
 *
 * Includes the public key.
 *
 * @param [in]       key      SLH-DSA key.
 * @param [out]      priv     Buffer for private key data.
 * @param [in, out]  privLen  On in, length of buffer.
 *                            On out, length of private key.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, priv or privLen is NULL.
 * @return  BAD_LENGTH_E when privLen is too small for private key.
 */
int wc_SlhDsaKey_ExportPrivate(SlhDsaKey* key, byte* priv, word32* privLen)
{
    int ret = 0;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL) || (priv == NULL) ||
            (privLen == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Check private key buffer length. */
    else if (*privLen < key->params->n * 4) {
        ret = BAD_LENGTH_E;
    }
    else {
        word32 n = (word32)key->params->n;

        /* Copy data out and return length. */
        XMEMCPY(priv, key->sk, n * 4U);
        *privLen = n * 4U;
    }

    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* Export the public key.
 *
 * @param [in]       key     SLH-DSA key.
 * @param [out]      pub     Buffer for public key data.
 * @param [in, out]  pubLen  On in, length of buffer.
 *                           On out, length of public key.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when key, key's parameters, pub or pubLen is NULL.
 * @return  BAD_LENGTH_E when pubLen is too small for public key.
 */
int wc_SlhDsaKey_ExportPublic(SlhDsaKey* key, byte* pub, word32* pubLen)
{
    int ret = 0;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL) || (pub == NULL) ||
            (pubLen == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    /* Check public key buffer length. */
    else if (*pubLen < key->params->n * 2) {
        ret = BAD_LENGTH_E;
    }
    else {
        word32 n = (word32)key->params->n;

        /* Copy data out and return length. */
        XMEMCPY(pub, key->sk + n * 2U, n * 2U);
        *pubLen = n * 2U;
    }

    return ret;
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Return the size of the private key for the parameters.
 *
 * @param [in] key  SLH-DSA key.
 * @return  Private key data length in bytes on success.
 * @return  BAD_FUNC_ARG when key or key's parameters is NULL.
 */
int wc_SlhDsaKey_PrivateSize(SlhDsaKey* key)
{
    int ret;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    else {
        /* Length is of 3 seeds and a hash, all n bytes long.  */
        ret = key->params->n * 4;
    }

    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* Return the size of the public key for the parameters.
 *
 * @param [in] key  SLH-DSA key.
 * @return  Public key data length in bytes on success.
 * @return  BAD_FUNC_ARG when key or key's parameters is NULL.
 */
int wc_SlhDsaKey_PublicSize(SlhDsaKey* key)
{
    int ret;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    else {
        /* Length is of a seed and a hash, both n bytes long.  */
        ret = key->params->n * 2;
    }

    return ret;
}

/* Return the size of a signature for the parameters.
 *
 * @param [in] key  SLH-DSA key.
 * @return  Signature length in bytes on success.
 * @return  BAD_FUNC_ARG when key or key's parameters is NULL.
 */
int wc_SlhDsaKey_SigSize(SlhDsaKey* key)
{
    int ret;

    /* Validate parameters. */
    if ((key == NULL) || (key->params == NULL)) {
        ret = BAD_FUNC_ARG;
    }
    else {
        /* Length from the parameters. */
        ret = (int)key->params->sigLen;
    }

    return ret;
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Return the size of the private key for the parameters.
 *
 * @param [in] param  SLH-DSA parameters.
 * @return  Private key data length in bytes on success.
 * @return  NOT_COMPILED_IN when parameters not supported.
 */
int wc_SlhDsaKey_PrivateSizeFromParam(enum SlhDsaParam param)
{
    int ret;

    switch (param) {
        case SLHDSA_SHAKE128S:
            ret = WC_SLHDSA_SHAKE128S_PRIV_LEN;
            break;
        case SLHDSA_SHAKE128F:
            ret = WC_SLHDSA_SHAKE128F_PRIV_LEN;
            break;
        case SLHDSA_SHAKE192S:
            ret = WC_SLHDSA_SHAKE192S_PRIV_LEN;
            break;
        case SLHDSA_SHAKE192F:
            ret = WC_SLHDSA_SHAKE192F_PRIV_LEN;
            break;
        case SLHDSA_SHAKE256S:
            ret = WC_SLHDSA_SHAKE256S_PRIV_LEN;
            break;
        case SLHDSA_SHAKE256F:
            ret = WC_SLHDSA_SHAKE256F_PRIV_LEN;
            break;
#ifdef WOLFSSL_SLHDSA_SHA2
        case SLHDSA_SHA2_128S:
            ret = WC_SLHDSA_SHA2_128S_PRIV_LEN;
            break;
        case SLHDSA_SHA2_128F:
            ret = WC_SLHDSA_SHA2_128F_PRIV_LEN;
            break;
        case SLHDSA_SHA2_192S:
            ret = WC_SLHDSA_SHA2_192S_PRIV_LEN;
            break;
        case SLHDSA_SHA2_192F:
            ret = WC_SLHDSA_SHA2_192F_PRIV_LEN;
            break;
        case SLHDSA_SHA2_256S:
            ret = WC_SLHDSA_SHA2_256S_PRIV_LEN;
            break;
        case SLHDSA_SHA2_256F:
            ret = WC_SLHDSA_SHA2_256F_PRIV_LEN;
            break;
#endif
        default:
            ret = NOT_COMPILED_IN;
            break;
    }

    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* Return the size of the public key for the parameters.
 *
 * @param [in] param  SLH-DSA parameters.
 * @return  Public key data length in bytes on success.
 * @return  NOT_COMPILED_IN when parameters not supported.
 */
int wc_SlhDsaKey_PublicSizeFromParam(enum SlhDsaParam param)
{
    int ret;

    switch (param) {
        case SLHDSA_SHAKE128S:
            ret = WC_SLHDSA_SHAKE128S_PUB_LEN;
            break;
        case SLHDSA_SHAKE128F:
            ret = WC_SLHDSA_SHAKE128F_PUB_LEN;
            break;
        case SLHDSA_SHAKE192S:
            ret = WC_SLHDSA_SHAKE192S_PUB_LEN;
            break;
        case SLHDSA_SHAKE192F:
            ret = WC_SLHDSA_SHAKE192F_PUB_LEN;
            break;
        case SLHDSA_SHAKE256S:
            ret = WC_SLHDSA_SHAKE256S_PUB_LEN;
            break;
        case SLHDSA_SHAKE256F:
            ret = WC_SLHDSA_SHAKE256F_PUB_LEN;
            break;
#ifdef WOLFSSL_SLHDSA_SHA2
        case SLHDSA_SHA2_128S:
            ret = WC_SLHDSA_SHA2_128S_PUB_LEN;
            break;
        case SLHDSA_SHA2_128F:
            ret = WC_SLHDSA_SHA2_128F_PUB_LEN;
            break;
        case SLHDSA_SHA2_192S:
            ret = WC_SLHDSA_SHA2_192S_PUB_LEN;
            break;
        case SLHDSA_SHA2_192F:
            ret = WC_SLHDSA_SHA2_192F_PUB_LEN;
            break;
        case SLHDSA_SHA2_256S:
            ret = WC_SLHDSA_SHA2_256S_PUB_LEN;
            break;
        case SLHDSA_SHA2_256F:
            ret = WC_SLHDSA_SHA2_256F_PUB_LEN;
            break;
#endif
        default:
            ret = NOT_COMPILED_IN;
            break;
    }

    return ret;
}

/* Return the size of a signature for the parameters.
 *
 * @param [in] param  SLH-DSA parameters.
 * @return  Signature length in bytes on success.
 * @return  NOT_COMPILED_IN when parameters not supported.
 */
int wc_SlhDsaKey_SigSizeFromParam(enum SlhDsaParam param)
{
    int ret;

    switch (param) {
        case SLHDSA_SHAKE128S:
            ret = WC_SLHDSA_SHAKE128S_SIG_LEN;
            break;
        case SLHDSA_SHAKE128F:
            ret = WC_SLHDSA_SHAKE128F_SIG_LEN;
            break;
        case SLHDSA_SHAKE192S:
            ret = WC_SLHDSA_SHAKE192S_SIG_LEN;
            break;
        case SLHDSA_SHAKE192F:
            ret = WC_SLHDSA_SHAKE192F_SIG_LEN;
            break;
        case SLHDSA_SHAKE256S:
            ret = WC_SLHDSA_SHAKE256S_SIG_LEN;
            break;
        case SLHDSA_SHAKE256F:
            ret = WC_SLHDSA_SHAKE256F_SIG_LEN;
            break;
#ifdef WOLFSSL_SLHDSA_SHA2
        case SLHDSA_SHA2_128S:
            ret = WC_SLHDSA_SHA2_128S_SIG_LEN;
            break;
        case SLHDSA_SHA2_128F:
            ret = WC_SLHDSA_SHA2_128F_SIG_LEN;
            break;
        case SLHDSA_SHA2_192S:
            ret = WC_SLHDSA_SHA2_192S_SIG_LEN;
            break;
        case SLHDSA_SHA2_192F:
            ret = WC_SLHDSA_SHA2_192F_SIG_LEN;
            break;
        case SLHDSA_SHA2_256S:
            ret = WC_SLHDSA_SHA2_256S_SIG_LEN;
            break;
        case SLHDSA_SHA2_256F:
            ret = WC_SLHDSA_SHA2_256F_SIG_LEN;
            break;
#endif
        default:
            ret = NOT_COMPILED_IN;
            break;
    }

    return ret;
}

/* Find SlhDsaParameters entry for a given param enum. */
static const SlhDsaParameters* slhdsa_find_params(enum SlhDsaParam param)
{
    int i;
    for (i = 0; i < SLHDSA_PARAM_LEN; i++) {
        if (SlhDsaParams[i].param == param) {
            return &SlhDsaParams[i];
        }
    }
    return NULL;
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Decode a DER-encoded SLH-DSA private key (PKCS#8 / OneAsymmetricKey).
 *
 * RFC 9909 Section 6: The privateKey OCTET STRING contains the raw
 * concatenation SK.seed || SK.prf || PK.seed || PK.root (4*n bytes)
 * directly, without a nested OCTET STRING wrapper. This differs from
 * Ed25519/Ed448 which wrap the key in an additional OCTET STRING.
 *
 * The parameter set is detected from the AlgorithmIdentifier OID.
 * On success, key->params is updated to match the detected parameter set.
 *
 * @param [in]      input     DER-encoded key data.
 * @param [in, out] inOutIdx  Index into input, updated on return.
 * @param [in, out] key       SLH-DSA key. Parameter set is auto-detected.
 * @param [in]      inSz      Size of input in bytes.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when input, inOutIdx, or key is NULL.
 * @return  ASN_PARSE_E when the DER cannot be parsed as an SLH-DSA key.
 */
int wc_SlhDsaKey_PrivateKeyDecode(const byte* input, word32* inOutIdx,
    SlhDsaKey* key, word32 inSz)
{
    int ret = 0;
    int length;
    int version;
    word32 oid = 0;
    word32 seqEnd;
    word32 savedIdx;
    int privSz;
    int paramId;
    const SlhDsaParameters* params;

    if ((input == NULL) || (inOutIdx == NULL) || (key == NULL) || (inSz == 0)) {
        return BAD_FUNC_ARG;
    }

    /* Snapshot the caller's index so failures restore it -- mirrors
     * wc_SlhDsaKey_PublicKeyDecode and lets callers chain parsers or
     * retry on the same buffer without recomputing the offset. */
    savedIdx = *inOutIdx;

    /* Parse PKCS#8 OneAsymmetricKey wrapper:
     * SEQUENCE { version, AlgorithmIdentifier { OID }, OCTET STRING { key },
     *            [0] attributes OPTIONAL, [1] publicKey OPTIONAL }
     */
    if (GetSequence(input, inOutIdx, &length, inSz) < 0) {
        *inOutIdx = savedIdx;
        return ASN_PARSE_E;
    }
    seqEnd = *inOutIdx + (word32)length;

    if (GetMyVersion(input, inOutIdx, &version, inSz) < 0) {
        *inOutIdx = savedIdx;
        return ASN_PARSE_E;
    }
    if (version != 0 && version != 1) {
        *inOutIdx = savedIdx;
        return ASN_PARSE_E;
    }

    if (GetAlgoId(input, inOutIdx, &oid, oidKeyType, inSz) < 0) {
        *inOutIdx = savedIdx;
        return ASN_PARSE_E;
    }

    /* Map the OID to an SLH-DSA parameter set.  Pass through NOT_COMPILED_IN
     * so callers can distinguish "variant present but not built in" from
     * "malformed DER". */
    paramId = wc_SlhDsaOidToParam((int)oid);
    if (paramId == WC_NO_ERR_TRACE(NOT_COMPILED_IN)) {
        *inOutIdx = savedIdx;
        return NOT_COMPILED_IN;
    }
    if (paramId < 0) {
        *inOutIdx = savedIdx;
        return ASN_PARSE_E;
    }
    params = slhdsa_find_params((enum SlhDsaParam)paramId);
    if (params == NULL) {
        *inOutIdx = savedIdx;
        return ASN_PARSE_E;
    }

    /* RFC 9909: privateKey is a single OCTET STRING containing the raw key
     * (4*n bytes). Unlike Ed25519/Ed448, there is no nested inner OCTET
     * STRING wrapping. */
    if (GetOctetString(input, inOutIdx, &privSz, inSz) < 0) {
        *inOutIdx = savedIdx;
        return ASN_PARSE_E;
    }

    if (privSz != params->n * 4) {
        *inOutIdx = savedIdx;
        return ASN_PARSE_E;
    }

    {
        const SlhDsaParameters* oldParams = key->params;
        int oldFlags = (int)key->flags;

        /* Update the key's parameter set to the detected one. */
        key->params = params;

        /* Import the raw private key: SK.seed || SK.prf || PK.seed || PK.root */
        ret = wc_SlhDsaKey_ImportPrivate(key, input + *inOutIdx,
                                         (word32)privSz);
        if (ret == 0) {
            /* Validate trailing fields per RFC 5958 OneAsymmetricKey:
             *   [0] IMPLICIT Attributes  OPTIONAL  -- at most once
             *   [1] IMPLICIT PublicKey   OPTIONAL  -- at most once,
             *                                        must follow [0]
             * Reject duplicates, out-of-order tags, and any other tag.
             * The previous code accepted any number of either tag in any
             * order. */
            const byte tagAttrs = ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | 0;
            const byte tagPub   = ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | 1;
            int seenAttrs = 0;
            int seenPub   = 0;
            *inOutIdx += (word32)privSz;
            while (ret == 0 && *inOutIdx < seqEnd) {
                byte tlvTag;
                int tlvLen;
                if (GetASNTag(input, inOutIdx, &tlvTag, inSz) < 0) {
                    ret = ASN_PARSE_E;
                    break;
                }
                if (tlvTag == tagAttrs) {
                    /* attributes must precede publicKey and appear once */
                    if (seenAttrs || seenPub) {
                        ret = ASN_PARSE_E;
                        break;
                    }
                    seenAttrs = 1;
                }
                else if (tlvTag == tagPub) {
                    /* publicKey may appear at most once */
                    if (seenPub) {
                        ret = ASN_PARSE_E;
                        break;
                    }
                    seenPub = 1;
                }
                else {
                    ret = ASN_PARSE_E;
                    break;
                }
                if (GetLength(input, inOutIdx, &tlvLen, inSz) < 0) {
                    ret = ASN_PARSE_E;
                    break;
                }
                /* Length must stay within the outer SEQUENCE. */
                if (*inOutIdx + (word32)tlvLen > seqEnd) {
                    ret = ASN_PARSE_E;
                    break;
                }
                *inOutIdx += (word32)tlvLen;
            }
            if (ret == 0 && *inOutIdx != seqEnd) {
                ret = ASN_PARSE_E;
            }
            if (ret != 0) {
                /* Trailing-field validation failed after ImportPrivate
                 * already populated key->sk. Scrub the imported material
                 * and roll back state so the caller sees the failure as
                 * if the import never happened. Clear FLAG_BOTH_KEYS from
                 * the restored flags since we just zeroed the bytes those
                 * flags would claim. */
                ForceZero(key->sk, (word32)(4 * params->n));
                key->params = oldParams;
                key->flags = oldFlags & ~((int)WC_SLHDSA_FLAG_BOTH_KEYS);
                *inOutIdx = savedIdx;
            }
        }
        else {
            /* On failure, restore params/flags. ImportPrivate writes the
             * full sk[0..4*n] (private + public material) before any
             * SHA-2 precompute step, so a precompute failure can leave
             * the entire sk dirty -- clear it and clear the matching
             * flags so flags can never claim valid bytes that we zeroed.
             * BAD_LENGTH_E is detected before any write, so no zeroing
             * (or flag scrubbing) is needed in that case. */
            if (ret != WC_NO_ERR_TRACE(BAD_LENGTH_E)) {
                ForceZero(key->sk, (word32)(4 * params->n));
                key->flags = oldFlags & ~((int)WC_SLHDSA_FLAG_BOTH_KEYS);
            }
            else {
                key->flags = oldFlags;
            }
            key->params = oldParams;
            *inOutIdx = savedIdx;
        }
    }

    return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

/* Decode a DER-encoded SLH-DSA public key (SubjectPublicKeyInfo).
 *
 * The parameter set is detected from the AlgorithmIdentifier OID.
 * On success, key->params is updated to match the detected parameter set.
 *
 * @param [in]      input     DER-encoded key data.
 * @param [in, out] inOutIdx  Index into input, updated on return.
 * @param [in, out] key       SLH-DSA key. Parameter set is auto-detected.
 * @param [in]      inSz      Size of input in bytes.
 * @return  0 on success.
 * @return  BAD_FUNC_ARG when input, inOutIdx, or key is NULL.
 * @return  ASN_PARSE_E when the DER cannot be parsed as an SLH-DSA key.
 */
int wc_SlhDsaKey_PublicKeyDecode(const byte* input, word32* inOutIdx,
    SlhDsaKey* key, word32 inSz)
{
    int ret;
    int keytype = ANONk;
    int paramId;
    const SlhDsaParameters* params;
    const SlhDsaParameters* oldParams;
    const byte* pubKeyPtr = NULL;
    word32 pubKeyLen = 0;
    word32 savedIdx;
    int oldFlags;

    if ((input == NULL) || (inOutIdx == NULL) || (key == NULL) || (inSz == 0)) {
        return BAD_FUNC_ARG;
    }

    savedIdx = *inOutIdx;

    /* Fast path: if the caller initialised the key with a parameter set,
     * treat the entire window from *inOutIdx to inSz as a candidate raw
     * public key and let wc_SlhDsaKey_ImportPublic decide via its length
     * check. The window must contain exactly 2*n bytes for the configured
     * parameter set -- callers chaining decoders must pass inSz scoped to
     * just the public-key buffer or the import will reject the length and
     * fall through to SPKI parsing. Mirrors the raw-first fallback in
     * wc_MlDsaKey_PublicKeyDecode and wc_Falcon_PublicKeyDecode so all PQ
     * public-key decoders accept either raw bytes or SPKI.
     *
     * The length check in ImportPublic is the disambiguator: a real SPKI
     * for any SLH-DSA variant carries ~19 bytes of AlgorithmIdentifier and
     * BIT STRING overhead on top of the 2*n public bytes, so SPKI input
     * never collides with the 2*n raw length and falls through cleanly. */
    if (key->params != NULL && savedIdx < inSz) {
        word32 windowSz = inSz - savedIdx;
        int n = key->params->n;
        oldFlags = key->flags;
        ret = wc_SlhDsaKey_ImportPublic(key, input + savedIdx, windowSz);
        if (ret == 0) {
            *inOutIdx += windowSz;
            return 0;
        }
        /* Fall through to SPKI parsing. BAD_LENGTH_E is detected before
         * any write (typical SPKI input), so there is nothing to scrub.
         * On SHA-2 precompute failure ImportPublic has written only the
         * public half at sk[2*n .. 4*n] - leave the private half
         * sk[0 .. 2*n] untouched in case the caller imported it earlier.
         * When we do scrub the public half, also clear FLAG_PUBLIC from
         * the restored flags so flags cannot claim a public key over the
         * zeroed bytes (the caller may have had FLAG_PUBLIC set from a
         * prior import). */
        if (ret != WC_NO_ERR_TRACE(BAD_LENGTH_E)) {
            ForceZero(key->sk + 2 * n, (word32)(2 * n));
            key->flags = oldFlags & ~((int)WC_SLHDSA_FLAG_PUBLIC);
        }
        else {
            key->flags = oldFlags;
        }
    }

    /* Use ANONk to auto-detect the OID from the SPKI AlgorithmIdentifier
     * in a single parse. (PrivateKeyDecode parses each DER element
     * manually because the PKCS#8 OneAsymmetricKey layout differs from
     * SPKI and has no matching helper.) */
    ret = DecodeAsymKeyPublic_Assign(input, inOutIdx, inSz, &pubKeyPtr,
                                     &pubKeyLen, &keytype);
    if (ret != 0) {
        return ret;
    }

    /* Map the detected OID key type to an SLH-DSA parameter set.  Pass
     * through NOT_COMPILED_IN so callers see the specific reason
     * (unsupported variant) rather than a generic parse error. */
    paramId = wc_SlhDsaOidToParam(keytype);
    if (paramId == WC_NO_ERR_TRACE(NOT_COMPILED_IN)) {
        *inOutIdx = savedIdx;
        return NOT_COMPILED_IN;
    }
    if (paramId < 0) {
        *inOutIdx = savedIdx;
        return ASN_PARSE_E;
    }
    params = slhdsa_find_params((enum SlhDsaParam)paramId);
    if (params == NULL) {
        *inOutIdx = savedIdx;
        return ASN_PARSE_E;
    }

    oldFlags = key->flags;
    oldParams = key->params;
    key->params = params;
    ret = wc_SlhDsaKey_ImportPublic(key, pubKeyPtr, pubKeyLen);
    if (ret != 0) {
        /* Restore params/flags/inOutIdx. ImportPublic writes only the
         * public half (sk[2*n .. 4*n]) and only after the length check
         * passes; preserve any prior private bytes the caller may have
         * imported into sk[0 .. 2*n]. When we scrub the public half on
         * a post-write failure, also clear FLAG_PUBLIC from the restored
         * flags so flags cannot claim a public key over the zeroed bytes
         * (the caller may have had FLAG_PUBLIC set from a prior import). */
        if (ret != WC_NO_ERR_TRACE(BAD_LENGTH_E)) {
            ForceZero(key->sk + 2 * params->n, (word32)(2 * params->n));
            key->flags = oldFlags & ~((int)WC_SLHDSA_FLAG_PUBLIC);
        }
        else {
            key->flags = oldFlags;
        }
        key->params = oldParams;
        *inOutIdx = savedIdx;
    }

    return ret;
}

#ifdef WC_ENABLE_ASYM_KEY_EXPORT
/* Encode an SLH-DSA public key to DER.
 *
 * Pass NULL for output to get the size of the encoding.
 *
 * @param [in]  key       SLH-DSA key object.
 * @param [out] output    Buffer to put encoded data in.
 * @param [in]  inLen     Size of buffer in bytes.
 * @param [in]  withAlg   Whether to use SubjectPublicKeyInfo format.
 * @return  Size of encoded data in bytes on success.
 * @return  BAD_FUNC_ARG when key/key->params is NULL or param is unknown.
 * @return  NOT_COMPILED_IN when key->params names a known SLH-DSA variant
 *          whose parameter set isn't compiled in. In practice unreachable
 *          because SlhDsaParams[] is itself gated on the build, but the
 *          contract matches wc_SlhDsaOidToParam for forward compatibility.
 */
int wc_SlhDsaKey_PublicKeyToDer(SlhDsaKey* key, byte* output, word32 inLen,
    int withAlg)
{
    int ret;
    byte pubKey[WC_SLHDSA_MAX_PUB_LEN];
    word32 pubKeyLen = (word32)sizeof(pubKey);
    int keytype;

    if ((key == NULL) || (key->params == NULL)) {
        return BAD_FUNC_ARG;
    }

    keytype = wc_SlhDsaParamToOid(key->params->param);
    if (keytype < 0) {
        return keytype;
    }

    ret = wc_SlhDsaKey_ExportPublic(key, pubKey, &pubKeyLen);
    if (ret == 0) {
        ret = SetAsymKeyDerPublic(pubKey, pubKeyLen, output, inLen, keytype,
                                  withAlg);
    }

    return ret;
}

#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
/* Encode an SLH-DSA private key to DER (PKCS#8 / OneAsymmetricKey).
 *
 * RFC 9909: The privateKey OCTET STRING contains the raw 4*n bytes
 * (SK.seed || SK.prf || PK.seed || PK.root) directly, without a nested
 * OCTET STRING wrapper. This differs from Ed25519/Ed448 which use a
 * double OCTET STRING wrapping.
 *
 * Pass NULL for output to get the required buffer size.
 *
 * @param [in]  key       SLH-DSA key object.
 * @param [out] output    Buffer to put encoded data in (or NULL for size).
 * @param [in]  inLen     Size of buffer in bytes.
 * @return  Size of encoded data in bytes on success.
 * @return  BAD_FUNC_ARG when key/key->params is NULL or param is unknown.
 * @return  NOT_COMPILED_IN when key->params names a known SLH-DSA variant
 *          whose parameter set isn't compiled in (in practice unreachable;
 *          SlhDsaParams[] is itself gated on the build).
 * @return  MISSING_KEY when private key not set.
 * @return  BUFFER_E when output buffer is too small.
 * @return  ASN_PARSE_E when SetMyVersion returns an unexpected size
 *          (internal encoder consistency check).
 */
int wc_SlhDsaKey_KeyToDer(SlhDsaKey* key, byte* output, word32 inLen)
{
    int keytype;
    int n;
    word32 privSz, algoSz, verSz, seqSz, sz;

    if ((key == NULL) || (key->params == NULL)) {
        return BAD_FUNC_ARG;
    }
    if ((key->flags & WC_SLHDSA_FLAG_PRIVATE) == 0) {
        return MISSING_KEY;
    }

    keytype = wc_SlhDsaParamToOid(key->params->param);
    if (keytype < 0) {
        return keytype;
    }

    n = key->params->n;
    /* RFC 9909: bare OCTET STRING containing 4*n raw key bytes */
    privSz = SetOctetString((word32)(n * 4), NULL) + (word32)(n * 4);
    algoSz = SetAlgoID(keytype, NULL, oidKeyType, 0);
    verSz  = 3; /* ASN_INTEGER(1) + length(1) + version_byte(1) */
    seqSz  = SetSequence(verSz + algoSz + privSz, NULL);
    sz     = seqSz + verSz + algoSz + privSz;

    if (output == NULL) {
        return (int)sz;
    }
    if (sz > inLen) {
        return BUFFER_E;
    }

    {
        word32 idx = 0;
        int actualVerSz;
        idx += SetSequence(verSz + algoSz + privSz, output + idx);
        actualVerSz = SetMyVersion(0, output + idx, FALSE);
        if (actualVerSz != (int)verSz) {
            /* Internal consistency: if SetMyVersion ever returns a size
             * different from the verSz we used to compute the total,
             * something in the encoder changed -- this is not a caller
             * buffer-size issue, so report it as an ASN encoding error. */
            return ASN_PARSE_E;
        }
        idx += (word32)actualVerSz;
        idx += SetAlgoID(keytype, output + idx, oidKeyType, 0);
        idx += SetOctetString((word32)(n * 4), output + idx);
        XMEMCPY(output + idx, key->sk, (word32)(n * 4));
        idx += (word32)(n * 4);
        return (int)idx;
    }
}

/* Encode an SLH-DSA private key to DER (PKCS#8 / OneAsymmetricKey).
 *
 * For SLH-DSA, RFC 9909 packs SK.seed || SK.prf || PK.seed || PK.root into
 * a single OCTET STRING, so there is no separate "private-only" encoding.
 * This function is intentionally an alias of wc_SlhDsaKey_KeyToDer, kept
 * for API parity with Ed25519/Ed448 which do have a distinct private form.
 *
 * @param [in]  key       SLH-DSA key object.
 * @param [out] output    Buffer to put encoded data in (or NULL for size).
 * @param [in]  inLen     Size of buffer in bytes.
 * @return  Size of encoded data in bytes on success.
 * @return  BAD_FUNC_ARG when key is NULL.
 * @return  MISSING_KEY when private key not set.
 * @return  BUFFER_E when output buffer is too small.
 */
int wc_SlhDsaKey_PrivateKeyToDer(SlhDsaKey* key, byte* output, word32 inLen)
{
    return wc_SlhDsaKey_KeyToDer(key, output, inLen);
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
#endif /* WC_ENABLE_ASYM_KEY_EXPORT */

#endif /* WOLFSSL_HAVE_SLHDSA */
