feat(sha3): gate ml-kem and ml-dsa specific APIs behind features (#1532)

Arul-Sujith · Arul-Sujith · commit 6aace21ec3b8 · 2026-07-17T14:54:14.000+05:30
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -18,6 +18,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- (libcrux-sha3) [#1532](https://github.com/celabshq/libcrux/issues/1532): Put ML-KEM/ML-DSA specific SHA3 APIs behind optional features
 - [#1534](https://github.com/celabshq/libcrux/pull/XYZ): Update dependencies: `libcrux-blake2`, `libcrux-sha3`, `libcrux-sha2`, `libcrux-curve25519`, `libcrux-aes`, `libcrux-chacha20poly1305`, `libcrux-ml-dsa`, `libcrux-ml-kem`, `libcrux-rsa`, `libcrux-ed25519`, `libcrux-digest`, `libcrux-hmac`, `libcrux-p256`, `libcrux-aead`, `libcrux-hkdf`, `libcrux-ecdsa`, `libcrux-ecdh`, `libcrux-kem`, `libcrux-psq`, `hpke-rs`
 - [#1505](https://github.com/celabshq/libcrux/pull/1505): Update dependency: `hpke-rs`
 - (libcrux-traits, libcrux-sha3, libcrux-sha2, libcrux-blake2) [#1493](https://github.com/celabshq/libcrux/pull/1493): `finish` methods on digest traits consume the hasher
diff --git a/crates/algorithms/sha3/Cargo.toml b/crates/algorithms/sha3/Cargo.toml
@@ -22,6 +22,8 @@ hax-lib.workspace = true
 [features]
 simd128 = ["libcrux-intrinsics/simd128"]
 simd256 = ["libcrux-intrinsics/simd256"]
+mlkem = []
+mldsa = []
 
 [[bench]]
 name = "sha3"
diff --git a/crates/algorithms/sha3/benches/sha3.rs b/crates/algorithms/sha3/benches/sha3.rs
@@ -1,3 +1,4 @@
+#![cfg(any(feature = "mlkem", feature = "mldsa"))]
 #![allow(non_snake_case)]
 use criterion::{criterion_group, criterion_main, BatchSize, BenchmarkId, Criterion, Throughput};
 use libcrux_sha3::{portable::incremental::Xof, *};
diff --git a/crates/algorithms/sha3/src/avx2.rs b/crates/algorithms/sha3/src/avx2.rs
@@ -1,4 +1,5 @@
 /// Performing 4 operations in parallel
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 pub mod x4 {
     use crate::generic_keccak::simd256::keccak4;
 
diff --git a/crates/algorithms/sha3/src/neon.rs b/crates/algorithms/sha3/src/neon.rs
@@ -49,6 +49,7 @@ pub fn shake256<const LEN: usize>(digest: &mut [u8; LEN], data: &[u8]) {
 }
 
 /// Performing 2 operations in parallel
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 pub mod x2 {
     use super::*;
 
diff --git a/crates/algorithms/sha3/src/portable.rs b/crates/algorithms/sha3/src/portable.rs
@@ -48,4 +48,5 @@ pub fn shake256(digest: &mut [u8], data: &[u8]) {
 }
 
 /// An incremental API for SHAKE
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 pub mod incremental;
diff --git a/crates/algorithms/sha3/tests/avx2.rs b/crates/algorithms/sha3/tests/avx2.rs
@@ -1,4 +1,4 @@
-#![cfg(feature = "simd256")]
+#![cfg(all(feature = "simd256", any(feature = "mlkem", feature = "mldsa")))]
 
 mod test_vectors;
 
diff --git a/crates/algorithms/sha3/tests/cavp.rs b/crates/algorithms/sha3/tests/cavp.rs
@@ -1,3 +1,4 @@
+#![cfg(any(feature = "mlkem", feature = "mldsa"))]
 use libcrux_sha3::*;
 
 macro_rules! sha3_test {
diff --git a/crates/algorithms/sha3/tests/cross_spec.rs b/crates/algorithms/sha3/tests/cross_spec.rs
@@ -1,3 +1,4 @@
+#![cfg(any(feature = "mlkem", feature = "mldsa"))]
 /// Cross-spec tests: verify top-level SHA-3 / SHAKE functions against the
 /// hacspec specification.  Lower-level tests (permutation steps, sponge
 /// helpers) live as unit tests inside `src/generic_keccak.rs`.
diff --git a/crates/algorithms/sha3/tests/neon.rs b/crates/algorithms/sha3/tests/neon.rs
@@ -1,4 +1,4 @@
-#![cfg(feature = "simd128")]
+#![cfg(all(feature = "simd128", any(feature = "mlkem", feature = "mldsa")))]
 
 mod test_vectors;
 
diff --git a/crates/algorithms/sha3/tests/portable.rs b/crates/algorithms/sha3/tests/portable.rs
@@ -2,8 +2,10 @@ mod test_vectors;
 
 // Portable implementation tests
 use crate::test_vectors::{DIGEST_LEN, DIGEST_LEN_SHAKE256, STRING_LEN, STRING_LEN_SHAKE256};
-use libcrux_sha3::portable::incremental::Xof;
-use libcrux_sha3::portable::{incremental, sha224, sha256, sha384, sha512, shake128, shake256};
+use libcrux_sha3::portable::{sha224, sha256, sha384, sha512, shake128, shake256};
+
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
+use libcrux_sha3::portable::incremental::{self, Xof, Shake128Xof, Shake256Xof};
 
 #[test]
 fn sha3_224() {
@@ -110,6 +112,7 @@ fn sha3_shake256() {
     );
 }
 
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn sha3_shake128_incremental() {
     // Test squeezing 1 block (168 bytes)
@@ -151,6 +154,7 @@ fn sha3_shake128_incremental() {
     );
 }
 
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn sha3_shake256_incremental() {
     // Test squeezing 1 block (136 bytes for SHAKE256, not 168)
@@ -173,6 +177,7 @@ fn sha3_shake256_incremental() {
     );
 }
 
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn sha3_shake128_absorb() {
     let mut state = incremental::Shake128Xof::new();
@@ -205,6 +210,7 @@ fn sha3_shake128_absorb() {
     assert_eq!(hex::encode(digest), expected);
 }
 
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn sha3_shake256_absorb() {
     let mut state = incremental::Shake256Xof::new();
@@ -244,6 +250,7 @@ fn sha3_shake256_absorb() {
 /// keccakf1600() call before the first extraction. This test requests 200 bytes
 /// (> SHAKE128 RATE of 168) in a single squeeze call and compares against the
 /// known one-shot output.
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn bug1_xof_squeeze_skips_first_block_shake128() {
     // One-shot: known correct output
@@ -260,6 +267,7 @@ fn bug1_xof_squeeze_skips_first_block_shake128() {
 }
 
 /// Same regression test for SHAKE256 (RATE = 136).
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn bug1_xof_squeeze_skips_first_block_shake256() {
     let mut expected = [0u8; 200];
@@ -275,6 +283,7 @@ fn bug1_xof_squeeze_skips_first_block_shake256() {
 
 /// Regression test: multiple squeeze calls should produce the same output as
 /// a single large squeeze (i.e., streaming squeeze is consistent).
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn bug1_xof_squeeze_multi_call_consistency() {
     // Single large squeeze
@@ -299,6 +308,7 @@ fn bug1_xof_squeeze_multi_call_consistency() {
 /// as a single large squeeze. Previously, the XOF only supported RATE-aligned
 /// chunks because it had no internal buffering for the leftover bytes of a
 /// partially-consumed squeeze block.
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn issue_1362_xof_streaming_squeeze_partial_chunks_shake128() {
     let mut single = [0u8; 600];
@@ -318,6 +328,7 @@ fn issue_1362_xof_streaming_squeeze_partial_chunks_shake128() {
 }
 
 /// Same as the SHAKE128 test, but for SHAKE256 (RATE = 136).
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn issue_1362_xof_streaming_squeeze_partial_chunks_shake256() {
     let mut single = [0u8; 500];
@@ -337,6 +348,7 @@ fn issue_1362_xof_streaming_squeeze_partial_chunks_shake256() {
 
 /// Single-byte streaming squeeze: stresses the internal buffering by
 /// forcing a buffer drain on every call.
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn issue_1362_xof_streaming_squeeze_byte_at_a_time_shake128() {
     let mut single = [0u8; 350]; // > 2 * RATE so we cross block boundaries
@@ -352,6 +364,7 @@ fn issue_1362_xof_streaming_squeeze_byte_at_a_time_shake128() {
     assert_eq!(single, multi);
 }
 
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn issue_1362_xof_streaming_squeeze_byte_at_a_time_shake256() {
     let mut single = [0u8; 350]; // > 2 * RATE so we cross block boundaries
@@ -369,6 +382,7 @@ fn issue_1362_xof_streaming_squeeze_byte_at_a_time_shake256() {
 
 /// Squeeze that crosses a block boundary inside one call after a previous
 /// partial squeeze: drain leftover, then extract more than one further block.
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn issue_1362_xof_squeeze_crosses_block_boundary_after_partial_drain_shake128() {
     let mut single = [0u8; 400];
@@ -386,6 +400,7 @@ fn issue_1362_xof_squeeze_crosses_block_boundary_after_partial_drain_shake128()
     assert_eq!(single, multi);
 }
 
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn issue_1362_xof_squeeze_crosses_block_boundary_after_partial_drain_shake256() {
     let mut single = [0u8; 400];
@@ -400,6 +415,7 @@ fn issue_1362_xof_squeeze_crosses_block_boundary_after_partial_drain_shake256()
     assert_eq!(single, multi);
 }
 
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn issue_1362_xof_squeeze_empty_outputs_shake128() {
     let mut single = [0u8; 400];
@@ -416,6 +432,7 @@ fn issue_1362_xof_squeeze_empty_outputs_shake128() {
     assert_eq!(single, multi);
 }
 
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn issue_1362_xof_squeeze_empty_outputs_shake256() {
     let mut single = [0u8; 400];
@@ -432,6 +449,7 @@ fn issue_1362_xof_squeeze_empty_outputs_shake256() {
     assert_eq!(single, multi);
 }
 
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn issue_1362_xof_start_with_empty_squeeze_shake128() {
     let mut single = [0u8; 400];
@@ -448,6 +466,7 @@ fn issue_1362_xof_start_with_empty_squeeze_shake128() {
     assert_eq!(single, multi);
 }
 
+#[cfg(any(feature = "mlkem", feature = "mldsa"))]
 #[test]
 fn issue_1362_xof_start_with_empty_squeeze_shake256() {
     let mut single = [0u8; 400];
diff --git a/crates/utils/ctgrind-test/Cargo.toml b/crates/utils/ctgrind-test/Cargo.toml
@@ -11,7 +11,7 @@ publish = false
 
 [dependencies]
 crabgrind.workspace = true
-libcrux-sha3 = { workspace = true }
+libcrux-sha3 = { workspace = true, features = ["mlkem", "mldsa"] }
 libcrux-ml-kem = { workspace = true, features = ["mlkem512"] }
 libcrux-ml-dsa = { workspace = true }
 
diff --git a/libcrux-ml-dsa/Cargo.toml b/libcrux-ml-dsa/Cargo.toml
@@ -26,7 +26,7 @@ bench = false # so libtest doesn't eat the arguments to criterion
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-libcrux-sha3.workspace = true
+libcrux-sha3 = { workspace = true, features = ["mldsa"] }
 libcrux-intrinsics.workspace = true
 libcrux-platform.workspace = true
 libcrux-macros.workspace = true
diff --git a/libcrux-ml-kem/Cargo.toml b/libcrux-ml-kem/Cargo.toml
@@ -24,7 +24,7 @@ bench = false # so libtest doesn't eat the arguments to criterion
 [dependencies]
 rand = { version = "0.10", optional = true, default-features = false }
 libcrux-platform.workspace = true
-libcrux-sha3.workspace = true
+libcrux-sha3 = { workspace = true, features = ["mlkem"] }
 libcrux-intrinsics.workspace = true
 libcrux-secrets.workspace = true
 libcrux-traits.workspace = true

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+#![cfg(any(feature = "mlkem", feature = "mldsa"))]`
`1`	`2`	`#![allow(non_snake_case)]`
`2`	`3`	`use criterion::{criterion_group, criterion_main, BatchSize, BenchmarkId, Criterion, Throughput};`
`3`	`4`	`use libcrux_sha3::{portable::incremental::Xof, *};`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`/// Performing 4 operations in parallel`
	`2`	`+#[cfg(any(feature = "mlkem", feature = "mldsa"))]`
`2`	`3`	`pub mod x4 {`
`3`	`4`	`use crate::generic_keccak::simd256::keccak4;`
`4`	`5`
Original file line number	Diff line number	Diff line change
`@@ -49,6 +49,7 @@ pub fn shake256<const LEN: usize>(digest: &mut [u8; LEN], data: &[u8]) {`
`49`	`49`	`}`
`50`	`50`
`51`	`51`	`/// Performing 2 operations in parallel`
	`52`	`+#[cfg(any(feature = "mlkem", feature = "mldsa"))]`
`52`	`53`	`pub mod x2 {`
`53`	`54`	`use super::*;`
`54`	`55`
Original file line number	Diff line number	Diff line change
`@@ -48,4 +48,5 @@ pub fn shake256(digest: &mut [u8], data: &[u8]) {`
`48`	`48`	`}`
`49`	`49`
`50`	`50`	`/// An incremental API for SHAKE`
	`51`	`+#[cfg(any(feature = "mlkem", feature = "mldsa"))]`
`51`	`52`	`pub mod incremental;`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-#![cfg(feature = "simd256")]`
	`1`	`+#![cfg(all(feature = "simd256", any(feature = "mlkem", feature = "mldsa")))]`
`2`	`2`
`3`	`3`	`mod test_vectors;`
`4`	`4`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+#![cfg(any(feature = "mlkem", feature = "mldsa"))]`
`1`	`2`	`use libcrux_sha3::*;`
`2`	`3`
`3`	`4`	`macro_rules! sha3_test {`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+#![cfg(any(feature = "mlkem", feature = "mldsa"))]`
`1`	`2`	`/// Cross-spec tests: verify top-level SHA-3 / SHAKE functions against the`
`2`	`3`	`/// hacspec specification. Lower-level tests (permutation steps, sponge`
`3`	`4`	/// helpers) live as unit tests inside `src/generic_keccak.rs`.
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-#![cfg(feature = "simd128")]`
	`1`	`+#![cfg(all(feature = "simd128", any(feature = "mlkem", feature = "mldsa")))]`
`2`	`2`
`3`	`3`	`mod test_vectors;`
`4`	`4`