Changes
=======

v1.4.0 20 Aug 2026
  * Add ML-DSA (FIPS 204) support: the `MLDSA44`, `MLDSA65`, and `MLDSA87`
    algorithms, the `SignMLDSA()` / `VerifyMLDSA()` primitives, and a new
    `MLDSAFamily` algorithm family. ML-DSA requires Go 1.27 or later, which is
    when `crypto/mldsa` joins the standard library; on earlier toolchains the
    constants are not declared and the algorithms are not registered.

    An ML-DSA key carries its own parameter set, so naming an algorithm that
    disagrees with the key is an error on both the sign and verify paths.
    `SignMLDSA()` takes a `crypto.SignerOpts` so that both signing modes stay
    reachable: an `*mldsa.Options` supplies a context string, and
    `crypto.MLDSAMu` signs a pre-hashed mu message representative.
    `VerifyMLDSA()` takes an `*mldsa.Options` because verification has a single
    mode. `SignDigest()` and `VerifyDigest()` return an error for ML-DSA, as
    they already do for EdDSA.

  * The minimum Go version is now 1.25.

v1.3.0 13 Apr 2026
  * Add `SignWithOpts()` and `VerifyWithOpts()`, which thread an optional
    `crypto.SignerOpts` through to the underlying signer. For built-in
    families (HMAC, RSA, ECDSA, EdDSA) the opts argument is ignored. For
    the `Custom` family, opts are forwarded to the algorithm's Meta when
    it implements the new `SignerWithOpts` / `VerifierWithOpts` interfaces;
    otherwise the dispatcher falls back to the plain `Signer` / `Verifier`
    methods and the opts are dropped. The canonical use case is composite
    ML-DSA signatures, where a per-call domain-separation context
    (`*mldsa.Options`) must reach `filippo.io/mldsa`.

  * `Sign()` is now a one-line wrapper around `SignWithOpts()` (and
    `Verify()` likewise wraps `VerifyWithOpts()`). The public signatures
    of `Sign` and `Verify` are unchanged; the only observable difference
    for existing callers is one extra call frame.

  * `RegisterAlgorithm()` for the `Custom` family now accepts a Meta that
    implements only `SignerWithOpts` / `VerifierWithOpts` (in addition to
    the existing `Signer` / `Verifier` paths).

  * In dsig v2, `Sign` / `Verify` will absorb the opts parameter and
    `SignWithOpts` / `VerifyWithOpts` will be removed. The same migration
    is planned for `SignDigest` / `VerifyDigest` once a `DigestSigner`
    interface for the `Custom` family lands. Doc comments on all four
    entry points flag the upcoming change.

v1.2.2 13 Apr 2026
  * Add `SignECDSADER()` and `VerifyECDSADER()` primitive helpers for ECDSA
    signatures in ASN.1 DER-encoded `Ecdsa-Sig-Value` form (RFC 3279 §2.2.3),
    as used by X.509/PKIX and composite signature schemes. The existing
    `SignECDSA()`/`VerifyECDSA()` functions remain the canonical entry points
    for the JWS-native fixed-length r||s format (RFC 7515 §3.4).

v1.2.1 7 Apr 2026
  * Add `SignDigest()` for signing pre-computed digests. Supported for HMAC,
    RSA (PKCS1v15 and PSS), and ECDSA families. EdDSA and Custom return an error.

v1.2.0 6 Apr 2026
  * Add `VerifyDigest()` for verifying signatures against pre-computed digests.
    Supported for HMAC, RSA, and ECDSA families. EdDSA and Custom return an error.

  * Add low-level digest verification functions: `VerifyHMACDigest()`,
    `VerifyRSADigest()`, `VerifyECDSADigest()`.

v1.1.0 2 Apr 2026
  * Add `Custom` algorithm family for registering user-defined sign/verify
    implementations. For the `Custom` family, `AlgorithmInfo.Meta` must implement
    the `Signer` and/or `Verifier` interfaces. The implementation struct can
    carry any additional metadata it needs (hash functions, curves, etc.).

  * Add `UnregisterAlgorithm()` for removing previously registered custom
    algorithms. Built-in algorithms are protected and cannot be unregistered.

  * `RegisterAlgorithm()` now rejects re-registration of an already-registered
    algorithm name. Use `UnregisterAlgorithm()` first if you need to replace it.

v1.0.0 - 18 Aug 2025
  * Initial release
