crypto/mldsa: Sign panics with typed-nil *Options

[SphereDonout]

Go version

go1.26.0 darwin/arm64

What did you do?

I called crypto/mldsa.(*PrivateKey).Sign with a typed-nil *mldsa.Options value.
Minimal reproducer:

package main

import (
	"crypto/mldsa"
)

func main() {
	sk, err := mldsa.GenerateKey(mldsa.MLDSA44())
	if err != nil {
		panic(err)
	}

	var opts *mldsa.Options
	_, _ = sk.Sign(nil, []byte("message"), opts)
}

The same issue also applies to SignDeterministic:

var opts *mldsa.Options
_, _ = sk.SignDeterministic([]byte("message"), opts)

What did you see happen?

The ordinary untyped nil case is handled:

if opts == nil {
	opts = &Options{}
}

However, a typed-nil (*mldsa.Options)(nil) stored in the crypto.SignerOpts interface is not equal to nil. The code then calls opts.HashFunc(), which succeeds because (*Options).HashFunc does not dereference the receiver. After that, this block type-asserts back to *Options and dereferences the nil pointer:

if opts, ok := opts.(*Options); ok {
	context = opts.Context
}

That causes a runtime panic instead of returning an error or treating the typed-nil options value like nil.

What did you expect to see?

I expected typed-nil *mldsa.Options to be handled consistently with nil options, or rejected cleanly without panicking.
For example, either of these behaviors would be reasonable:

var opts *mldsa.Options
sig, err := sk.Sign(nil, []byte("message"), opts)
// behaves like opts == nil

or:

var opts *mldsa.Options
sig, err := sk.Sign(nil, []byte("message"), opts)
// returns a non-nil error

The panic can be avoided by checking the asserted *Options value before reading Context, for example:

if opts, ok := opts.(*Options); ok && opts != nil {
	context = opts.Context
}

[gabyhelp]

Related Issues

• crypto/mldsa: Sign panics on zero-value PrivateKey #80339
• crypto/mldsa: Verify accepts uninitialized PublicKey with empty signature #79959
• crypto/rsa: rsa.SignPSS doesn't handle opts as nil as described #34696 (closed)
• crypto/ecdsa: Sign() panics if public key is not set #70468 (closed)
• crypto/rsa: SignPSS documentation is incorrect. #9897 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[gopherbot]

Change https://go.dev/cl/799200 mentions this issue: crypto/mldsa: handle typed-nil *Options in Sign methods

[seankhliao]

afaik the standard library does not in general guard against typed nils.

[dr2chase]

@golang/security

proposed fix looks plausible

[FiloSottile]

afaik the standard library does not in general guard against typed nils.

Agreed, and I can see the same behavior in other crypto packages, but might as well add the guard while I'm in there.

[gopherbot]

Change https://go.dev/cl/800860 mentions this issue: crypto/mldsa: handle some uninitialized and nil values more gracefully

[gopherbot]

Change https://go.dev/cl/803500 mentions this issue: [release-branch.go1.27] crypto/mldsa: handle some uninitialized and nil values more gracefully