fix!: replace GPL-3.0-only crystals-dilithium with fips204 (ML-DSA)

The signer used the `crystals-dilithium` crate, which implements the round-3
CRYSTALS submission. NIST changed the algorithm during standardisation, so
Dilithium and ML-DSA are different schemes with different wire formats. Keys
and signatures produced here could therefore be verified only by this code —
no FIPS 204 implementation can read them, and vice versa. For a signature
scheme whose entire purpose is letting someone else check your work, that is
a defect rather than a preference.

`fips204` also resolves a licensing problem. `crystals-dilithium` is
GPL-3.0-only; this package is MIT and builds as cdylib/staticlib, and
`hook/build.dart` compiles it unconditionally for every dependent app — with
the ordinary Schnorr verifier living in the same library, so even apps that
never touch post-quantum code link it. Statically linking GPL-3.0-only code
makes the combined binary a derivative work, which obliges every downstream
app to ship under GPL-3.0. That is a hard problem for closed-source
consumers, and GPL-3.0 is also widely held incompatible with App Store
distribution terms. `fips204` is MIT OR Apache-2.0 and imposes none of it.

Also adds seed derivation. Keys were random-only, so a signing key could
never be restored from a mnemonic — losing it lost the identity permanently.
`qs_derive_keypair_from_seed` derives from a 64-byte BIP-39 seed via
HKDF-SHA256 with `nip-pqc/v1/ml-dsa-<level>/<account>`, making the key a
sibling of the secp256k1 key rather than a child: breaking secp256k1 does not
reach it, and one mnemonic restores both. A 32-byte secp256k1 private key is
rejected as input, because deriving from it would be circular.

`level` now takes the ML-DSA numbers (44/65/87). The Dilithium values 2/3/5
are rejected rather than remapped, so an un-updated caller fails loudly
instead of silently receiving different security properties than it asked
for. Existing Dilithium keys do not carry over; they could never have
interoperated, and this is shipped as an experimental signer.

Two safety fixes found while auditing this code:

- `write_buffer` leaked a Vec recording only its length, while
  `qs_free_buffer` reconstructed it with `Vec::from_raw_parts(data, len,
  len)`. That is undefined behaviour whenever capacity exceeds length. It
  holds for every value passed today, so this was a latent trap rather than a
  live bug — the next contributor building an output with `push` or `extend`
  would have introduced heap corruption in the free path with no compiler
  diagnostic. `into_boxed_slice` reallocates to the exact size.
- `qs_free_buffer` now zeroizes before deallocating. These buffers carry
  secret keys, and a freed-but-unwiped secret is recoverable from a core
  dump or swap file.

Tests pin an ML-DSA-87 public key byte-for-byte against `@noble/post-quantum`
from the same derived seed, which is the interoperability the previous
implementation could not have satisfied.

BREAKING CHANGE: `level` now takes the ML-DSA parameter numbers (44/65/87)
instead of the Dilithium ones (2/3/5), and the old values are rejected rather
than remapped. Existing quantum-secure keys and signatures do not carry over:
they were round-3 CRYSTALS-Dilithium, which no FIPS 204 implementation can
read. The quantum-secure signer is experimental and this is the only way to
make it interoperable.

Author: leonacostaok

packages/ndk/lib/data_layer/repositories/signers/qs_rust_event_signer.dart

@@ -1,7 +1,7 @@
 /// Quantum-secure event signer with platform-specific implementations.
 ///
 /// On native platforms (Android, iOS, Linux, macOS, Windows), this uses FFI
-/// to call Rust code for CRYSTALS-Dilithium signing.
+/// to call Rust code for ML-DSA (FIPS 204) signing.
 ///
 /// On web platforms, this exports a stub that throws [UnsupportedError].
 library;

packages/ndk/lib/data_layer/repositories/signers/qs_rust_event_signer_native.dart

@@ -9,7 +9,7 @@ import '../../../domain_layer/entities/pending_signer_request.dart';
 import '../../../domain_layer/repositories/event_signer.dart';
 import '../../../src/rust_lib.dart' as rust_lib;
 
-/// Holds a Dilithium keypair (public key + full keypair bytes for signing).
+/// Holds an ML-DSA keypair (public key + full keypair bytes for signing).
 class QsKeypair {
   final Uint8List publicKeyBytes;
   final Uint8List keypairBytes;
@@ -23,9 +23,9 @@ class QsKeypair {
 }
 
 /// An implementation of [EventSigner] that uses quantum-secure
-/// CRYSTALS-Dilithium signatures via native Rust FFI.
+/// ML-DSA (FIPS 204) signatures via native Rust FFI.
 class QsRustEventSigner implements EventSigner {
-  /// The Dilithium security level (2, 3, or 5).
+  /// The ML-DSA parameter set: 44, 65 or 87.
   final int level;
 
   late final QsKeypair _keypair;
@@ -36,7 +36,7 @@ class QsRustEventSigner implements EventSigner {
   /// Creates a [QsRustEventSigner] from an existing [QsKeypair].
   ///
   /// Use [QsRustEventSigner.generate] to create a new keypair first.
-  QsRustEventSigner({required QsKeypair keypair, this.level = 2})
+  QsRustEventSigner({required QsKeypair keypair, this.level = 87})
     : _keypair = keypair;
 
   @override
@@ -48,21 +48,22 @@ class QsRustEventSigner implements EventSigner {
   @override
   Iterable<String> get signerTransportRelayUrls => const <String>[];
 
-  /// Generates a new Dilithium keypair.
+  /// Generates a new ML-DSA keypair.
   /// Its only added here for testing purposes!
   ///
-  /// [level] selects the security level: 2 (~AES-128), 3 (~AES-192), or 5 (~AES-256).
+  /// [level] selects the ML-DSA parameter set: 44 (~AES-128), 65 (~AES-192), or
+  /// 87 (~AES-256, the CNSA 2.0 set). The old Dilithium values 2/3/5 are rejected.
   ///
   /// Returns a [QsKeypair] that can be stored and later passed to the constructor.
   ///
   /// Throws [StateError] if key generation fails.
   ///
   /// Example:
   /// ```dart
-  /// final keypair = QsRustEventSigner.generateKeypair(level: 2);
-  /// final signer = QsRustEventSigner(keypair: keypair, level: 2);
+  /// final keypair = QsRustEventSigner.generateKeypair(level: 87);
+  /// final signer = QsRustEventSigner(keypair: keypair, level: 87);
   /// ```
-  static QsKeypair generateKeypair({int level = 2}) {
+  static QsKeypair generateKeypair({int level = 87}) {
     final outPk = calloc<rust_lib.QsBuffer>();
     final outSk = calloc<rust_lib.QsBuffer>();
 
@@ -71,7 +72,7 @@ class QsRustEventSigner implements EventSigner {
 
       if (result != 1) {
         throw StateError(
-          'Failed to generate Dilithium keypair at level $level',
+          'Failed to generate ML-DSA keypair at level $level',
         );
       }
 
@@ -126,7 +127,7 @@ class QsRustEventSigner implements EventSigner {
       );
 
       if (result != 1) {
-        throw StateError('Failed to sign event with Dilithium');
+        throw StateError('Failed to sign event with ML-DSA');
       }
 
       final sigLen = outSig.ref.len;

packages/ndk/lib/data_layer/repositories/signers/qs_rust_event_signer_stub.dart

@@ -24,7 +24,7 @@ class QsKeypair {
 class QsRustEventSigner implements EventSigner {
   final int level;
 
-  QsRustEventSigner({required QsKeypair keypair, this.level = 2});
+  QsRustEventSigner({required QsKeypair keypair, this.level = 87});
 
   @override
   bool get requiresInteractiveSigning => false;
@@ -35,7 +35,7 @@ class QsRustEventSigner implements EventSigner {
   @override
   Iterable<String> get signerTransportRelayUrls => const <String>[];
 
-  static QsKeypair generateKeypair({int level = 2}) {
+  static QsKeypair generateKeypair({int level = 87}) {
     throw UnsupportedError(
       'QsRustEventSigner is not available on this platform. '
       'FFI is not supported on web.',

packages/ndk/lib/data_layer/repositories/verifiers/qs_rust_event_verifier.dart

@@ -1,7 +1,7 @@
 /// Quantum-secure event verifier with platform-specific implementations.
 ///
 /// On native platforms (Android, iOS, Linux, macOS, Windows), this uses FFI
-/// to call Rust code for CRYSTALS-Dilithium verification.
+/// to call Rust code for ML-DSA (FIPS 204) verification.
 ///
 /// On web platforms, this exports a stub that throws [UnsupportedError].
 library;

packages/ndk/lib/data_layer/repositories/verifiers/qs_rust_event_verifier_native.dart

@@ -8,15 +8,15 @@ import '../../../domain_layer/repositories/event_verifier.dart';
 import '../../../src/rust_lib.dart' as rust_lib;
 
 /// An implementation of [EventVerifier] that uses quantum-secure
-/// CRYSTALS-Dilithium signatures via native Rust FFI.
+/// ML-DSA (FIPS 204) signatures via native Rust FFI.
 class QsRustEventVerifier implements EventVerifier {
-  /// The Dilithium security level (2, 3, or 5).
+  /// The ML-DSA parameter set: 44, 65 or 87.
   final int level;
 
   /// Creates a new instance of [QsRustEventVerifier].
   ///
   /// [level] defaults to 2 (NIST Security Level 2, ~AES-128).
-  QsRustEventVerifier({this.level = 2});
+  QsRustEventVerifier({this.level = 87});
 
   @override
   Future<bool> verify(Nip01Event event) async {

packages/ndk/lib/data_layer/repositories/verifiers/qs_rust_event_verifier_stub.dart

@@ -7,7 +7,7 @@ import '../../../domain_layer/repositories/event_verifier.dart';
 class QsRustEventVerifier implements EventVerifier {
   final int level;
 
-  QsRustEventVerifier({this.level = 2});
+  QsRustEventVerifier({this.level = 87});
 
   @override
   Future<bool> verify(Nip01Event event) {

packages/ndk/lib/src/rust_lib.dart

@@ -16,18 +16,17 @@ final class QsBuffer extends Struct {
 /// Verifies a Nostr event signature.
 /// Returns 1 if valid, 0 if invalid.
 @Native<
-  Int32 Function(
-    Pointer<Utf8>, // eventIdHex
-    Pointer<Utf8>, // pubKeyHex
-    Uint64, // createdAt
-    Uint32, // kind
-    Pointer<Pointer<Utf8>>, // tagsData
-    Pointer<Uint32>, // tagsLengths
-    Uint32, // tagsCount
-    Pointer<Utf8>, // content
-    Pointer<Utf8>, // signatureHex
-  )
->(symbol: 'verify_nostr_event')
+    Int32 Function(
+      Pointer<Utf8>, // eventIdHex
+      Pointer<Utf8>, // pubKeyHex
+      Uint64, // createdAt
+      Uint32, // kind
+      Pointer<Pointer<Utf8>>, // tagsData
+      Pointer<Uint32>, // tagsLengths
+      Uint32, // tagsCount
+      Pointer<Utf8>, // content
+      Pointer<Utf8>, // signatureHex
+    )>(symbol: 'verify_nostr_event')
 external int verifyNostrEventNative(
   Pointer<Utf8> eventIdHex,
   Pointer<Utf8> pubKeyHex,
@@ -40,47 +39,55 @@ external int verifyNostrEventNative(
   Pointer<Utf8> signatureHex,
 );
 
-// ── Quantum-Secure Dilithium bindings ──────────────────────────────────
+// ── Quantum-Secure ML-DSA (FIPS 204) bindings ──────────────────────────
+//
+// These were CRYSTALS-Dilithium. NIST altered the algorithm during
+// standardisation, so Dilithium keys and signatures are not interoperable with
+// FIPS 204 ML-DSA. [level] now takes the ML-DSA parameter numbers - 44, 65 or 87 -
+// and the old Dilithium values 2, 3 and 5 are rejected rather than remapped, so a
+// caller that was not updated fails loudly instead of silently getting different
+// security properties than it asked for.
 
 /// Frees a QsBuffer previously returned by the Rust library.
 @Native<Void Function(QsBuffer)>(symbol: 'qs_free_buffer')
 external void qsFreeBuffer(QsBuffer buf);
 
-/// Generates a Dilithium keypair.
+/// Generates a random ML-DSA keypair.
 ///
-/// [level]: security level (2, 3, or 5).
+/// Prefer [qsDeriveKeypairFromSeed] for anything representing an identity: a
+/// random key cannot be restored from a mnemonic, so losing it loses the identity.
+///
+/// [level]: ML-DSA parameter set (44, 65, or 87).
 /// [outPk], [outSk]: pointers to QsBuffer structs that will be filled.
 /// Returns 1 on success, 0 on failure.
 @Native<
-  Int32 Function(
-    Uint32, // level
-    Pointer<QsBuffer>, // outPk
-    Pointer<QsBuffer>, // outSk
-  )
->(symbol: 'qs_generate_keypair')
+    Int32 Function(
+      Uint32, // level
+      Pointer<QsBuffer>, // outPk
+      Pointer<QsBuffer>, // outSk
+    )>(symbol: 'qs_generate_keypair')
 external int qsGenerateKeypair(
   int level,
   Pointer<QsBuffer> outPk,
   Pointer<QsBuffer> outSk,
 );
 
-/// Signs a message with a Dilithium secret key.
+/// Signs a message with an ML-DSA secret key (empty FIPS 204 context).
 ///
-/// [level]: security level (2, 3, or 5).
+/// [level]: ML-DSA parameter set (44, 65, or 87).
 /// [skPtr]/[skLen]: secret key bytes.
 /// [msgPtr]/[msgLen]: message bytes.
 /// [outSig]: pointer to QsBuffer that will receive the signature.
 /// Returns 1 on success, 0 on failure.
 @Native<
-  Int32 Function(
-    Uint32, // level
-    Pointer<Uint8>, // skPtr
-    IntPtr, // skLen
-    Pointer<Uint8>, // msgPtr
-    IntPtr, // msgLen
-    Pointer<QsBuffer>, // outSig
-  )
->(symbol: 'qs_sign')
+    Int32 Function(
+      Uint32, // level
+      Pointer<Uint8>, // skPtr
+      IntPtr, // skLen
+      Pointer<Uint8>, // msgPtr
+      IntPtr, // msgLen
+      Pointer<QsBuffer>, // outSig
+    )>(symbol: 'qs_sign')
 external int qsSign(
   int level,
   Pointer<Uint8> skPtr,
@@ -90,21 +97,20 @@ external int qsSign(
   Pointer<QsBuffer> outSig,
 );
 
-/// Verifies a Dilithium signature.
+/// Verifies an ML-DSA signature (empty FIPS 204 context).
 ///
-/// [level]: security level (2, 3, or 5).
+/// [level]: ML-DSA parameter set (44, 65, or 87).
 /// Returns 1 if valid, 0 if invalid.
 @Native<
-  Int32 Function(
-    Uint32, // level
-    Pointer<Uint8>, // pkPtr
-    IntPtr, // pkLen
-    Pointer<Uint8>, // msgPtr
-    IntPtr, // msgLen
-    Pointer<Uint8>, // sigPtr
-    IntPtr, // sigLen
-  )
->(symbol: 'qs_verify')
+    Int32 Function(
+      Uint32, // level
+      Pointer<Uint8>, // pkPtr
+      IntPtr, // pkLen
+      Pointer<Uint8>, // msgPtr
+      IntPtr, // msgLen
+      Pointer<Uint8>, // sigPtr
+      IntPtr, // sigLen
+    )>(symbol: 'qs_verify')
 external int qsVerify(
   int level,
   Pointer<Uint8> pkPtr,
@@ -114,3 +120,30 @@ external int qsVerify(
   Pointer<Uint8> sigPtr,
   int sigLen,
 );
+
+/// Derives an ML-DSA keypair deterministically from a 64-byte BIP-39 seed.
+///
+/// The key is a sibling of the secp256k1 key derived from the same mnemonic, not a
+/// child of it, so one mnemonic restores both and breaking secp256k1 does not reach
+/// this key.
+///
+/// [seedPtr]/[seedLen] must be a 64-byte BIP-39 seed. Passing a 32-byte secp256k1
+/// private key is rejected: deriving from it would be circular.
+/// Returns 1 on success, 0 on failure.
+@Native<
+    Int32 Function(
+      Uint32, // level
+      Pointer<Uint8>, // seedPtr
+      IntPtr, // seedLen
+      Uint32, // account
+      Pointer<QsBuffer>, // outPk
+      Pointer<QsBuffer>, // outSk
+    )>(symbol: 'qs_derive_keypair_from_seed')
+external int qsDeriveKeypairFromSeed(
+  int level,
+  Pointer<Uint8> seedPtr,
+  int seedLen,
+  int account,
+  Pointer<QsBuffer> outPk,
+  Pointer<QsBuffer> outSk,
+);