Module prehash 

Pre-hash selector (prehash::PreHash) and M′ message encoding shared by the ML-DSA and SLH-DSA external signature APIs (FIPS 204 §5.4 / FIPS 205 §10.2). Pre-hash selectors and M′ message encoding for the external signature APIs (FIPS 204 §5.4 / FIPS 205 §10.2).

Both ML-DSA (HashML-DSA) and SLH-DSA (HashSLH-DSA) wrap the message into M′ for domain separation before calling the internal signer:

• pure: M′ = 0x00 ‖ len(ctx) ‖ ctx ‖ M
• prehash: M′ = 0x01 ‖ len(ctx) ‖ ctx ‖ OID(PH) ‖ PH(M)

OID(PH) is the full DER object identifier (tag + length + content, 11 bytes for every NIST CSOR hash/XOF) per FIPS 204 Algorithm 4. The pre-hash digest is computed from the shared krypteia-tessera primitives; SHAKE128 is squeezed to 256 bits and SHAKE256 to 512 bits.

M′ is built over public data (domain tag, context, OID, message or its digest) — no secret-dependent branch, index, or length. The only decision is the public |ctx| ≤ 255 check, done by the callers.

Enums

PreHash

Approved pre-hash function for HashML-DSA / HashSLH-DSA (FIPS 204 §5.4, FIPS 205 §10.2). Selects both the digest computed over the message and the DER OID embedded in M′.