[lamps] Seed as private key for ML-DSA and ML-KEM

[Bas Westerbaan <[e-mail]>]

Hi all,

NIST allows two formats in which private keys are stored ML-DSA and ML-KEM.

1. Seed. 32 bytes for ML-DSA; 64 bytes for ML-KEM.
2. Expanded private key. Multiple kilobytes depending on instance.

An expanded private key is obtained from the seed by calling the
KeyGen_internal function.

In contrast to RSA, key generation for these algorithms is very fast. In
fact, if you use spinning disks, then using a seed is probably faster than
the expanded private key.

Another advantage is that we do not need to worry about private key
validation. NIST specified a few checks to perform, but there are more we
could do (eg. whether the decoded coefficients of \hat{s} are bounded.)

Of course a big advantage is storage space: the seeds are much smaller.

Now, how do we want to proceed? I see a few options.

1. Ignore the seed as private key.

2. Allow both seed and the expanded private key.

3. Assign separate algorithm for seed-as-private-key.

4. Switch to seed as private key only.

I prefer 4, and would otherwise go for 1.

The downside of 2 is that it adds complexity without the gain of
simplifying verification. If one only cares about size savings, then one
can use seed-as-private-key without needing a portable format for it.

So I'd prefer 4 and 1 second.

Best,

 Bas