# BaseCryptLib Host Unit Tests

## SLH-DSA Precomputed Signatures

### Background
SLH-DSA (FIPS 205, formerly SPHINCS+) is a stateless hash-based digital signature algorithm.
Generating an SLH-DSA-SHAKE-256s signature involves evaluating millions of Keccak hash rounds
across FORS and XMSS tree structures. On unoptimized or 32-bit builds (`NOOPT` / `IA32`), a single
live signing operation takes several minutes of CPU time.

To maintain complete test coverage across all 18 test cases without excessive execution times,
precomputed signature test vectors are stored in `SlhDsaTestVectors.h` and used for verification,
tampering, context validation, and boundary checking tests.

### Generated Test Vectors
`SlhDsaTestVectors.h` contains the following precomputed signatures matching `mSlhDsaShake256sTestPemKey` / `mSlhDsaShake256sTestCert`:
* `mSlhDsaShake256sTestSignature`: Default test message without context.
* `mSlhDsaShake256sTestContextSignature`: Default test message with context string `"SLH-DSA test context"`.
* `mSlhDsaShake256sTestEmptyMsgSignature`: Empty test message (`""`) without context.
* `mSlhDsaShake256sTestMaxContextSignature`: Default test message with 255-byte maximum context.
* `mSlhDsaShake256sTestMsg2Signature`: Secondary test message (`"Second message"`) for multi-signature tests.

### Regenerating Signatures
When test keys or test messages are updated, the signatures can be regenerated using `GenerateSlhDsaSignatures.py`:

#### Prerequisites
* Python 3.10+
* OpenSSL 3.5+ CLI with SLH-DSA support

#### Command
```bash
python GenerateSlhDsaSignatures.py --openssl /path/to/openssl --output new_signatures.h
```
Paste the generated arrays into `SlhDsaTestVectors.h`.