Add ML-DSA test vectors (FIPS 204 standard).

[gendx]

This PR adds test vectors for ML-DSA, for the FIPS 204 standard. It's a restart of #112 without the pre-standard versions (round 3, ipd).

These tests aim to cover the following cases:

• Baseline (signing a "Hello world" message).
• Keys and signatures of the wrong length.
• Signature with bit flips.
• Signature hints with a non-canonical encoding:
  • hints that aren't sorted,
  • hints are not strictly sorted (i.e. the same hint is repeated),
  • too many hints (potentially causing a buffer overflow),
  • non-zero padding after the hints.
• Secret keys with the s1 or s2 vectors out of the [-eta, eta] range.
• Public key with the t1 component set to zero (allowing trivial forgeries, but the verification algorithm should still accept signatures for this key).
• Boundary conditions in the signature rejection loop (aiming to detect incorrect comparisons):
  • z_max equals gamma1 - beta - 1 and gamma1 - beta,
  • r0_max equals gamma2 - beta - 1 and gamma2 - beta,
  • h_ones equals omega and omega + 1,
  • in the case of ML-DSA-44, |ct0|_max equals gamma2 - 1 and gamma2.
• A "large" number of SHAKE bytes and of SHAKE blocks generated in the expand_a, expand_s, rej_ntt_poly and rej_bounded_poly functions.
• Boundary conditions in arithmetic functions:
  • power_2_round function: when the remainder (found in t0) is equal to 4096 or -4095,
  • decompose (via high_bits or low_bits): when the condition r_plus - r_0 = q - 1 happens.

Beyond the baseline API, also covered are:

• The context value: empty (default), regular length, or context too long.

What isn't covered:

• The randomized variant (only the deterministic variant is covered).
• The pre-hased variant "HashML-DSA" (only the regular variant is covered).

Notable difference(s) from the previous pull request (#112):

• The algorithm now includes the level (e.g. "algorithm": "ML-DSA-44") to make it easier to consume without looking at file names.
• The 32-byte seed used to generate the private key is included (privateSeed field) when meaningful and known. It's notably absent for:
  • cases that check for an invalid encoding of the private key (e.g. wrong size, out-of-range values),
  • test vectors of ML-DSA-44 where no seed is known (by construction) for the boundary condition of |ct0|_max (note that it's possible to generate similar vectors with a known seed but using a lot of brute-force).

[cpu]

@gendx Was it intentional to put the test vectors in the schema dir? I think we'd probably want them in testvectors_v1 (?) or another top-level tests directory.

[gendx]

@cpu No that was a typo. Moved them to the suitable directory now :)

[cpu]

I haven't done a deep dive on the test vector content yet, but had some feedback on the schemas and splitting these up further based on which have seeds available. I also filed #147 to remind myself to put more of this into docs.

Thanks for picking this up again. I hope we can get it merged sooner than later.

[cpu]

For each object in your new schemas can you please add additionalProperties: false to avoid allowing extra unspec'd fields, and a required list with the required fields:

      "required": [ ... ],
      "additionalProperties": false

[cpu]

Let's split the tests that don't have a seed from the ones that do at the schema/testcase level instead of making it an optional field in one common test type.

[cpu]

Please also add a source property ref'ing the common.json definition:

        "source": {
          "$ref": "common.json#/definitions/Source"
        },

[cpu]

This should be marked deprecated "deprecated": true to match the other schemas. I think it's probably premature to avoid including it all-together (?)

[cpu]

I think all of my comments from the other schema file also apply here but I won't duplicate them :-)

[cpu]

nit: maybe clearer as:

Suggested change

	"description": "The encoded signature (empty in case of failure)"
	"description": "The encoded signature (empty in case of expected failure)"