[jnsiemer]

Description

This PR implements...

• a not up-to-spec implementation of ML-DSA,
• benchmarks for ML-DSA

Testing

• I added basic working examples (possibly in doc-comment)

Checklist:

• I have performed a self-review of my own code
  • The code provides good readability and maintainability s.t. it fulfills best practices like talking code, modularity, ...
    • The chosen implementation is not more complex than it has to be
  • My code should work as intended and no side effects occur (e.g. memory leaks)
  • The doc comments fit our style guide
  • I have credited related sources if needed

Benchmarks

Quickly run benchmarks on my old laptop

ML-DSA cycle 44         time:   [5.2569 ms 5.4252 ms 5.6071 ms]                            
ML-DSA key_gen 44       time:   [971.81 µs 972.22 µs 972.64 µs]                               
ML-DSA sign 44          time:   [3.1065 ms 3.2465 ms 3.3897 ms]                            
ML-DSA vfy 44           time:   [1.2287 ms 1.2292 ms 1.2298 ms]                           

ML-DSA cycle 65         time:   [9.6770 ms 10.354 ms 11.109 ms]                            
ML-DSA key_gen 65       time:   [1.7178 ms 1.8538 ms 2.0244 ms]                               
ML-DSA sign 65          time:   [5.9097 ms 6.5367 ms 7.2212 ms]                           
ML-DSA vfy 65           time:   [2.1117 ms 2.1128 ms 2.1139 ms]                           

ML-DSA cycle 87         time:   [13.540 ms 14.042 ms 14.560 ms]                            
ML-DSA key_gen 87       time:   [2.8620 ms 2.8640 ms 2.8660 ms]                               
ML-DSA sign 87          time:   [6.2018 ms 6.5699 ms 6.9440 ms]                           
ML-DSA vfy 87           time:   [3.6565 ms 3.7136 ms 3.8167 ms]

[Marvin-Beckmann]

mostly minor comments, but looks good as an example in general. I feel like the simplifications that you have made compared to the standard should be either collected at one place, or mentioned more explicitly in the documentation

[Marvin-Beckmann]

for the context of representation it is probably ok not to do the actual computation, but the changes should be expressed more in the function description.
I guess that you use the hash-digest as a seed here, but I would prefer to use the unmodified version here.