Defining ML-KEM and ML-DSA secret keys to be in seed format

[falko-strenzke]

Closes #139
Closes #108

[TJ-91]

Looks good to me aside from one further issue. We use ML-KEM.Decaps and ML-DSA.Sign directly with the secret key (seed) which is only defined for the expanded key. For ML-KEM we would first need to call ML-KEM.KeyGen_internal to obtain the actual key that can be input to Decaps.

[falko-strenzke]

We use ML-KEM.Decaps and ML-DSA.Sign directly with the secret key (seed) which is only defined for the expanded key. For ML-KEM we would first need to call ML-KEM.KeyGen_internal to obtain the actual key that can be input to Decaps.

This is why it says in the added text to the secret key format:

Upon parsing the private key format, or before using the secret key, for the expansion of the key, the function ML-KEM.KeyGen_internal [FIPS-203] has to be invoked [...]

I think it is easier to state that where the key format is defined, because it is up to the implementation when to expand the secret key.

[TJ-91]

I re-read and now agree with you. It should be sufficiently clear, especially since we clarify that mlkemSecretKey is the decapsulation key.

[fluppe2]

LGTM

[TJ-91]

Ah, just one minor detail: Could you add a changelog entry, Falko?

[wussler]

Same for me, with changelog looks good!