From 9854456edb59c9d1a650c949834e21c1de0b395b Mon Sep 17 00:00:00 2001
From: Ugochukwu Mmaduekwe <ugo4brain@gmail.com>
Date: Tue, 1 Sep 2026 07:56:10 +0100
Subject: [PATCH] Skip hypertree root recomputation when signing SLH-DSA

The HT constructor always built the top-layer XMSS tree to derive the
hypertree public key, so every signature repeated that build (about 1/d
of key generation) to produce a value the private key already holds in
PK.root. Only key generation needs it, and the signing path never reads it.

Move the root computation out of the constructor into an explicit PKGen
method that only the key pair generator calls; the constructor now just
wires up the engine and WOTS+ state.
---
 .../Crypto/Generators/ClpSlhDsaGenerators.pas |  2 +-
 .../Crypto/Signers/SlhDsa/ClpSlhDsaCore.pas   | 30 ++++++++-----------
 2 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/CryptoLib/src/Crypto/Generators/ClpSlhDsaGenerators.pas b/CryptoLib/src/Crypto/Generators/ClpSlhDsaGenerators.pas
index b433552f..525da469 100644
--- a/CryptoLib/src/Crypto/Generators/ClpSlhDsaGenerators.pas
+++ b/CryptoLib/src/Crypto/Generators/ClpSlhDsaGenerators.pas
@@ -78,7 +78,7 @@ function TSlhDsaKeyPairGenerator.GenerateKeyPair: IAsymmetricCipherKeyPair;
   LHt := TSlhDsaHT.Create(LEngine, LSk.Seed, LPkSeed);
   try
     LPk.Seed := LPkSeed;
-    LPk.Root := LHt.GetHTPubKey;
+    LPk.Root := LHt.PKGen;
   finally
     LHt.Free;
   end;
diff --git a/CryptoLib/src/Crypto/Signers/SlhDsa/ClpSlhDsaCore.pas b/CryptoLib/src/Crypto/Signers/SlhDsa/ClpSlhDsaCore.pas
index 5ee2152a..3f67bbba 100644
--- a/CryptoLib/src/Crypto/Signers/SlhDsa/ClpSlhDsaCore.pas
+++ b/CryptoLib/src/Crypto/Signers/SlhDsa/ClpSlhDsaCore.pas
@@ -154,7 +154,6 @@   TSlhDsaHT = class
     FPkSeed: TCryptoLibByteArray;
     FEngine: ISlhDsaEngine;
     FWots: TSlhDsaWotsPlus;
-    FHTPubKey: TCryptoLibByteArray;
     class function GetXmssOffset(const AEngine: ISlhDsaEngine): Int32; static;
     function XmssPkFromSig(AIdx: UInt32; const ASigXmss: TCryptoLibByteArray; ASigXmssOff: Int32;
       const AM, APkSeed: TCryptoLibByteArray; const AParamAdrs: ISlhDsaAdrs): TCryptoLibByteArray;
@@ -165,7 +164,9 @@   TSlhDsaHT = class
   public
     constructor Create(const AEngine: ISlhDsaEngine; const ASkSeed, APkSeed: TCryptoLibByteArray);
     destructor Destroy; override;
-    function GetHTPubKey: TCryptoLibByteArray;
+    // Computes PK.root; only key generation calls this. Signing already holds
+    // PK.root, so recomputing here would cost a full top-layer XMSS tree build.
+    function PKGen: TCryptoLibByteArray;
     procedure Sign(const AM: TCryptoLibByteArray; AIdxTree: UInt64; AIdxLeaf: UInt32;
       var ASignature: TCryptoLibByteArray);
     function Verify(const AM, ASignature, APkSeed: TCryptoLibByteArray; AIdxTree: UInt64; AIdxLeaf: UInt32;
@@ -653,26 +654,12 @@ procedure TSlhDsaWotsPlus.PKFromSig(const ASig: TCryptoLibByteArray; ASigOff: In
 { TSlhDsaHT }
 
 constructor TSlhDsaHT.Create(const AEngine: ISlhDsaEngine; const ASkSeed, APkSeed: TCryptoLibByteArray);
-var
-  LAdrs: ISlhDsaAdrs;
 begin
   inherited Create;
   FSkSeed := ASkSeed;
   FPkSeed := APkSeed;
   FEngine := AEngine;
   FWots := TSlhDsaWotsPlus.Create(AEngine);
-
-  LAdrs := TSlhDsaAdrs.Create;
-  LAdrs.SetLayerAddress(UInt32(FEngine.D - 1));
-  LAdrs.SetTreeAddress(0);
-
-  if ASkSeed <> nil then
-  begin
-    System.SetLength(FHTPubKey, FEngine.N);
-    TreeHash(ASkSeed, 0, FEngine.HPrime, APkSeed, LAdrs, FHTPubKey, 0);
-  end
-  else
-    FHTPubKey := nil;
 end;
 
 destructor TSlhDsaHT.Destroy;
@@ -682,9 +669,16 @@ destructor TSlhDsaHT.Destroy;
   inherited Destroy;
 end;
 
-function TSlhDsaHT.GetHTPubKey: TCryptoLibByteArray;
+function TSlhDsaHT.PKGen: TCryptoLibByteArray;
+var
+  LAdrs: ISlhDsaAdrs;
 begin
-  Result := FHTPubKey;
+  LAdrs := TSlhDsaAdrs.Create;
+  LAdrs.SetLayerAddress(UInt32(FEngine.D - 1));
+  LAdrs.SetTreeAddress(0);
+
+  System.SetLength(Result, FEngine.N);
+  TreeHash(FSkSeed, 0, FEngine.HPrime, FPkSeed, LAdrs, Result, 0);
 end;
 
 class function TSlhDsaHT.GetXmssOffset(const AEngine: ISlhDsaEngine): Int32;