XMSS: restore direct hash-layout and deterministic-key regression tests

[alexanderlhicks]

Current main removed three useful pieces of direct XMSS regression coverage after the base revision used by the initial formal-proof review:

• tweak_separates_everything;
• multi_block_hash_is_standard_blake2s;
• the same-seed and same-range assertion from deterministic_keygen, which was replaced rather than retained by key_range_changes_root.

The relevant diff is between 601386d and the PR 10 merge. This change came from later mainline cleanup work, not the formal-proof commits. The implementation is not shown to be wrong, and the remaining XMSS, primitive-hash, and aggregation tests passed. The loss is targeted coverage at exactly the implementation-refinement boundary that the Lean theorem does not prove.

Please restore stronger direct tests:

1. Assert the exact 16 tweak bytes for representative tag, position, and epoch values, including little-endian fields and the seven zero bytes.
2. Compare a multi-block XMSS tweak hash against an independently assembled tweak || public_parameter || payload input passed to the standard streaming hash implementation.
3. Retain both same-seed and same-range determinism and different-range root separation.

Longer term, shared Lean, Rust, Python, and zkDSL vectors would provide stronger coverage and could supersede locally duplicated expectations.

AI assistance disclosure: this issue was prepared with help from an OpenAI Codex agent during a fresh adversarial review of PR 10. The agent was instructed to reproduce or otherwise evidence each finding, try to falsify it, distinguish PR changes from pre-existing and later mainline changes, and make the proposed resolution pedagogical and actionable. This issue is explicitly attributed to the later mainline delta, not to the formal PR author, and its evidence was rechecked against merged commit f5d6e5040d666981005371742a6f21640ce865a1.

[alexanderlhicks]

Proposed fix

This is the complete issue-specific diff currently prepared in a local working tree based on f5d6e5040d666981005371742a6f21640ce865a1. It has not been committed or pushed.

These tests cover the byte-level Rust refinement boundary that the Lean theorem does not prove: exact tweak serialization, separation of hash domains and lengths, standard multi-block BLAKE2s composition, deterministic key generation, and range-dependent roots. They stay in the existing integration-test binary, preserving the repository's one-test-binary-per-crate convention.

Exact diff

diff --git a/crates/xmss/tests/xmss_tests.rs b/crates/xmss/tests/xmss_tests.rs
index 4a6acfe..79fd3d9 100644
--- a/crates/xmss/tests/xmss_tests.rs
+++ b/crates/xmss/tests/xmss_tests.rs
@@ -40,13 +40,78 @@ fn serialize_deserialize_and_size() {
 }
 
 #[test]
-fn key_range_changes_root() {
+fn deterministic_keygen_and_range_separation() {
     let seed = [3u8; 32];
     let (_, shorter_range) = xmss_key_gen(seed, 50, 60).unwrap();
+    let (_, same_range) = xmss_key_gen(seed, 50, 60).unwrap();
     let (_, longer_range) = xmss_key_gen(seed, 50, 61).unwrap();
+    assert_eq!(shorter_range, same_range);
     assert_ne!(shorter_range.merkle_root, longer_range.merkle_root);
 }
 
+#[test]
+fn tweak_layout_is_exact() {
+    assert_eq!(
+        make_tweak(TWEAK_TYPE_MERKLE, 0x0102_0304, 0xa0b0_c0d0),
+        [
+            TWEAK_TYPE_MERKLE,
+            0x04,
+            0x03,
+            0x02,
+            0x01,
+            0xd0,
+            0xc0,
+            0xb0,
+            0xa0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+        ]
+    );
+}
+
+#[test]
+fn tweak_separates_hash_domains() {
+    let public_parameter = [7; PUBLIC_PARAM_LEN];
+    let payload = [1; DIGEST_LEN];
+    let base = tweak_hash(&public_parameter, TWEAK_TYPE_CHAIN, 3, 5, &payload);
+    assert_ne!(base, tweak_hash(&public_parameter, TWEAK_TYPE_MERKLE, 3, 5, &payload));
+    assert_ne!(base, tweak_hash(&public_parameter, TWEAK_TYPE_CHAIN, 4, 5, &payload));
+    assert_ne!(base, tweak_hash(&public_parameter, TWEAK_TYPE_CHAIN, 3, 6, &payload));
+    assert_ne!(
+        base,
+        tweak_hash(&[8; PUBLIC_PARAM_LEN], TWEAK_TYPE_CHAIN, 3, 5, &payload)
+    );
+    let mut extended = [0; STATE_LEN];
+    extended[..DIGEST_LEN].copy_from_slice(&payload);
+    assert_ne!(base, tweak_hash(&public_parameter, TWEAK_TYPE_CHAIN, 3, 5, &extended));
+}
+
+#[test]
+fn multi_block_tweak_hash_is_standard_blake2s() {
+    let public_parameter = [9; PUBLIC_PARAM_LEN];
+    let payload = [5; V * DIGEST_LEN];
+    let mut input = Vec::new();
+    input.extend_from_slice(&make_tweak(TWEAK_TYPE_WOTS_PK, 0, 42));
+    input.extend_from_slice(&public_parameter);
+    input.extend_from_slice(&payload);
+
+    let mut hasher = primitives::hash::Hasher::new();
+    for chunk in input.chunks(37) {
+        hasher.update(chunk);
+    }
+    let expected = hasher.finalize();
+    assert_eq!(expected, primitives::hash::hash(&input));
+    assert_eq!(
+        tweak_hash(&public_parameter, TWEAK_TYPE_WOTS_PK, 0, 42, &payload),
+        expected[..DIGEST_LEN]
+    );
+}
+
 #[test]
 fn tampered_signatures_rejected() {
     let seed = [9u8; 32];

Why these tests are nontrivial

• tweak_layout_is_exact pins all 16 bytes using nontrivial values: the tag, both little-endian u32 fields, and all seven trailing zeros. An implementation and test that make the same endian mistake cannot both pass this literal vector.
• tweak_separates_hash_domains restores the removed direct regression coverage for type, position, index, public parameter, and exact payload length.
• The multi-block test uses the actual 42 by 16-byte WOTS public-key payload. Together with the tweak and public parameter, the input is 704 bytes, exactly 11 BLAKE2s blocks.
• The expected multi-block digest is computed from an independently assembled byte vector and streamed in unrelated 37-byte chunks, then cross-checked against the one-shot primitive before comparing the XMSS truncation.
• The key-generation test retains both claims instead of replacing determinism with range separation.

Validation

$ cargo test --release -p xmss --test xmss_tests
running 8 tests
test multi_block_tweak_hash_is_standard_blake2s ... ok
test tweak_layout_is_exact ... ok
test tweak_separates_hash_domains ... ok
test deterministic_keygen_and_range_separation ... ok
test serialize_deserialize_and_size ... ok
test tampered_signatures_rejected ... ok
test keygen_sign_verify ... ok
test encoding_grinding_bits ... ignored
test result: ok. 7 passed; 0 failed; 1 ignored

Repository-wide checks:

$ cargo testall
all active workspace tests and doctests passed

$ cargo clippyall
exit 0

$ cargo docall
exit 0

$ rustfmt --edition 2024 --check crates/xmss/tests/xmss_tests.rs
# no output, exit 0

$ git diff --check
# no output, exit 0

The XMSS test binary completed in 0.13 seconds in the combined validation run. The whole-workspace formatter currently reports pre-existing ordering drift in ten files untouched by this proposal; the changed test file itself is clean, and that unrelated churn is intentionally excluded.

The fenced diff was extracted verbatim and git apply --check accepted it against f5d6e5040d666981005371742a6f21640ce865a1.

Compatibility

This patch changes tests only. It does not change the XMSS implementation, public API, serialization, proof statement, guest, or wire format.

AI assistance disclosure: this proposed patch and validation report were prepared with help from an OpenAI Codex agent. The agent was asked to review the exact diff as if it were a focused PR, test independence and regression value, verify the byte and block counts, run focused and repository-wide checks, and distinguish implementation coverage from the Lean theorem's scope.

[mahmudsudo]

can i take on this ?