Fix: Update BLS and crypto test signatures for latest API

- Update BLS Sign() calls to handle (signature, error) return values
- Fix MLKEM GenerateKeyPair() to handle 3 return values
- Update batch verification to use individual signature verification
- Fix duplicate test function names in comprehensive PQ tests

all_test.go

@@ -35,7 +35,7 @@ func testMLKEM(t *testing.T) {
 	for i, mode := range modes {
 		t.Run(names[i], func(t *testing.T) {
 			// Generate key pair
-			priv, err := mlkem.GenerateKeyPair(rand.Reader, mode)
+			priv, _, err := mlkem.GenerateKeyPair(rand.Reader, mode)
 			require.NoError(t, err)
 
 			// Encapsulate
@@ -269,7 +269,7 @@ func testCGOPerformance(t *testing.T) {
 		rand.Read(message)
 
 		// Benchmark pure Go implementation
-		priv, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
+		priv, _, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
 
 		start := time.Now()
 		for i := 0; i < 100; i++ {
@@ -316,7 +316,7 @@ func testCGOPerformance(t *testing.T) {
 // BenchmarkCrypto benchmarks all crypto implementations
 func BenchmarkCrypto(b *testing.B) {
 	b.Run("ML-KEM-768", func(b *testing.B) {
-		priv, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
+		priv, _, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
 
 		b.Run("Encapsulate", func(b *testing.B) {
 			for i := 0; i < b.N; i++ {

audit_test.go

@@ -15,23 +15,23 @@ import (
 // TestMLKEMEdgeCases tests edge cases and potential bugs
 func TestMLKEMEdgeCases(t *testing.T) {
 	t.Run("Invalid Mode", func(t *testing.T) {
-		_, err := mlkem.GenerateKeyPair(rand.Reader, mlkem.Mode(99))
+		_, _, err := mlkem.GenerateKeyPair(rand.Reader, mlkem.Mode(99))
 		assert.Error(t, err)
 	})
 
 	t.Run("Nil Random Source", func(t *testing.T) {
-		_, err := mlkem.GenerateKeyPair(nil, mlkem.MLKEM768)
+		_, _, err := mlkem.GenerateKeyPair(nil, mlkem.MLKEM768)
 		assert.Error(t, err)
 	})
 
 	t.Run("Empty Ciphertext", func(t *testing.T) {
-		priv, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
+		priv, _, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
 		_, err := priv.Decapsulate([]byte{})
 		assert.Error(t, err)
 	})
 
 	t.Run("Wrong Size Ciphertext", func(t *testing.T) {
-		priv, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
+		priv, _, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
 		wrongCT := make([]byte, 100) // Wrong size
 		_, err := priv.Decapsulate(wrongCT)
 		assert.Error(t, err)
@@ -40,7 +40,7 @@ func TestMLKEMEdgeCases(t *testing.T) {
 	t.Run("Serialization Round Trip", func(t *testing.T) {
 		modes := []mlkem.Mode{mlkem.MLKEM512, mlkem.MLKEM768, mlkem.MLKEM1024}
 		for _, mode := range modes {
-			priv1, _ := mlkem.GenerateKeyPair(rand.Reader, mode)
+			priv1, _, _ := mlkem.GenerateKeyPair(rand.Reader, mode)
 			
 			// Serialize
 			privBytes := priv1.Bytes()
@@ -170,7 +170,7 @@ func TestSLHDSAEdgeCases(t *testing.T) {
 // TestConcurrency tests thread safety
 func TestConcurrency(t *testing.T) {
 	t.Run("ML-KEM Concurrent Operations", func(t *testing.T) {
-		priv, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
+		priv, _, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
 		
 		// Run concurrent encapsulations
 		done := make(chan bool, 10)
@@ -216,7 +216,7 @@ func TestMemoryLeaks(t *testing.T) {
 		// This would need proper memory profiling
 		// For now, just ensure no panics on repeated operations
 		for i := 0; i < 100; i++ {
-			priv, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
+			priv, _, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
 			result, _ := priv.PublicKey.Encapsulate(rand.Reader)
 			priv.Decapsulate(result.Ciphertext)
 		}

bls/bls_extended_test.go

@@ -219,7 +219,10 @@ func TestSignAndVerify(t *testing.T) {
 	msg := []byte("test message")
 	
 	// Sign message
-	sig := sk.Sign(msg)
+	sig, err := sk.Sign(msg)
+	if err != nil {
+		t.Fatalf("Failed to sign message: %v", err)
+	}
 	if sig == nil {
 		t.Fatal("Signature should not be nil")
 	}
@@ -246,19 +249,28 @@ func TestSignAndVerify(t *testing.T) {
 	}
 	
 	// Test nil cases
-	nilSig := sk.Sign(nil)
+	nilSig, err := sk.Sign(nil)
+	if err != nil {
+		t.Fatalf("Failed to sign nil message: %v", err)
+	}
 	if nilSig == nil {
 		t.Fatal("Should handle nil message")
 	}
 	
 	var nilSk *SecretKey
-	nilSig2 := nilSk.Sign(msg)
+	nilSig2, err := nilSk.Sign(msg)
+	if err == nil {
+		t.Fatal("Nil secret key should return error")
+	}
 	if nilSig2 != nil {
 		t.Fatal("Nil secret key should return nil signature")
 	}
 	
 	emptySk := &SecretKey{}
-	emptySig := emptySk.Sign(msg)
+	emptySig, err := emptySk.Sign(msg)
+	if err == nil {
+		t.Fatal("Empty secret key should return error")
+	}
 	if emptySig != nil {
 		t.Fatal("Empty secret key should return nil signature")
 	}
@@ -268,7 +280,7 @@ func TestVerifyEdgeCases(t *testing.T) {
 	sk, _ := NewSecretKey()
 	pk := sk.PublicKey()
 	msg := []byte("test")
-	sig := sk.Sign(msg)
+	sig, _ := sk.Sign(msg)
 	
 	// Test nil public key
 	valid := Verify(nil, sig, msg)
@@ -300,7 +312,10 @@ func TestProofOfPossession(t *testing.T) {
 	msg := []byte("proof of possession")
 	
 	// Sign proof of possession
-	sig := sk.SignProofOfPossession(msg)
+	sig, err := sk.SignProofOfPossession(msg)
+	if err != nil {
+		t.Fatalf("Failed to sign PoP: %v", err)
+	}
 	if sig == nil {
 		t.Fatal("PoP signature should not be nil")
 	}
@@ -320,13 +335,19 @@ func TestProofOfPossession(t *testing.T) {
 	
 	// Test nil cases
 	var nilSk *SecretKey
-	nilSig := nilSk.SignProofOfPossession(msg)
+	nilSig, err := nilSk.SignProofOfPossession(msg)
+	if err == nil {
+		t.Fatal("Nil secret key should return error")
+	}
 	if nilSig != nil {
 		t.Fatal("Nil secret key should return nil PoP")
 	}
 	
 	emptySk := &SecretKey{}
-	emptySig := emptySk.SignProofOfPossession(msg)
+	emptySig, err := emptySk.SignProofOfPossession(msg)
+	if err == nil {
+		t.Fatal("Empty secret key should return error")
+	}
 	if emptySig != nil {
 		t.Fatal("Empty secret key should return nil PoP")
 	}
@@ -337,9 +358,9 @@ func TestSignatureBytes(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Failed to generate secret key: %v", err)
 	}
-	
+
 	msg := []byte("test")
-	sig := sk.Sign(msg)
+	sig, _ := sk.Sign(msg)
 	
 	// Convert to bytes
 	sigBytes := SignatureToBytes(sig)
@@ -421,7 +442,7 @@ func TestAggregateSignaturesEdgeCases(t *testing.T) {
 	// Test with nil signature in slice
 	sk1, _ := NewSecretKey()
 	msg := []byte("test")
-	sig1 := sk1.Sign(msg)
+	sig1, _ := sk1.Sign(msg)
 	
 	_, err = AggregateSignatures([]*Signature{sig1, nil})
 	if err == nil {
@@ -445,7 +466,7 @@ func TestMultipleAggregation(t *testing.T) {
 		}
 		sks[i] = sk
 		pks[i] = sk.PublicKey()
-		sigs[i] = sk.Sign(msg)
+		sigs[i], _ = sk.Sign(msg)
 	}
 	
 	// Aggregate public keys
@@ -488,7 +509,7 @@ func BenchmarkSignExtended(b *testing.B) {
 	
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
-		_ = sk.Sign(msg)
+		_, _ = sk.Sign(msg)
 	}
 }
 
@@ -496,8 +517,8 @@ func BenchmarkVerifyExtended(b *testing.B) {
 	sk, _ := NewSecretKey()
 	pk := sk.PublicKey()
 	msg := []byte("benchmark message")
-	sig := sk.Sign(msg)
-	
+	sig, _ := sk.Sign(msg)
+
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		_ = Verify(pk, sig, msg)
@@ -526,7 +547,7 @@ func BenchmarkAggregateSignaturesExtended(b *testing.B) {
 	
 	for i := 0; i < numSigs; i++ {
 		sk, _ := NewSecretKey()
-		sigs[i] = sk.Sign(msg)
+		sigs[i], _ = sk.Sign(msg)
 	}
 	
 	b.ResetTimer()

bls/bls_test.go

@@ -114,14 +114,14 @@ func TestSign(t *testing.T) {
 
 	// Test nil secret key
 	var sk *SecretKey
-	if sig := sk.Sign(msg); sig != nil {
-		t.Fatal("Expected nil signature from nil secret key")
+	if sig, err := sk.Sign(msg); err == nil || sig != nil {
+		t.Fatal("Expected error and nil signature from nil secret key")
 	}
 
 	// Test nil internal key
 	sk = &SecretKey{sk: nil}
-	if sig := sk.Sign(msg); sig != nil {
-		t.Fatal("Expected nil signature from nil internal key")
+	if sig, err := sk.Sign(msg); err == nil || sig != nil {
+		t.Fatal("Expected error and nil signature from nil internal key")
 	}
 
 	// Test valid signing
@@ -130,7 +130,10 @@ func TestSign(t *testing.T) {
 		t.Fatalf("Failed to generate secret key: %v", err)
 	}
 
-	sig := sk.Sign(msg)
+	sig, err := sk.Sign(msg)
+	if err != nil {
+		t.Fatalf("Failed to sign: %v", err)
+	}
 	if sig == nil {
 		t.Fatal("Signature is nil")
 	}
@@ -141,14 +144,14 @@ func TestSignProofOfPossession(t *testing.T) {
 
 	// Test nil secret key
 	var sk *SecretKey
-	if sig := sk.SignProofOfPossession(msg); sig != nil {
-		t.Fatal("Expected nil signature from nil secret key")
+	if sig, err := sk.SignProofOfPossession(msg); err == nil || sig != nil {
+		t.Fatal("Expected error and nil signature from nil secret key")
 	}
 
 	// Test nil internal key
 	sk = &SecretKey{sk: nil}
-	if sig := sk.SignProofOfPossession(msg); sig != nil {
-		t.Fatal("Expected nil signature from nil internal key")
+	if sig, err := sk.SignProofOfPossession(msg); err == nil || sig != nil {
+		t.Fatal("Expected error and nil signature from nil internal key")
 	}
 
 	// Test valid signing
@@ -157,7 +160,10 @@ func TestSignProofOfPossession(t *testing.T) {
 		t.Fatalf("Failed to generate secret key: %v", err)
 	}
 
-	sig := sk.SignProofOfPossession(msg)
+	sig, err := sk.SignProofOfPossession(msg)
+	if err != nil {
+		t.Fatalf("Failed to sign proof of possession: %v", err)
+	}
 	if sig == nil {
 		t.Fatal("Signature is nil")
 	}
@@ -266,7 +272,7 @@ func TestVerify(t *testing.T) {
 	}
 
 	pk := sk.PublicKey()
-	sig := sk.Sign(msg)
+	sig, _ := sk.Sign(msg)
 
 	// Test valid signature
 	if !Verify(pk, sig, msg) {
@@ -312,7 +318,7 @@ func TestVerifyProofOfPossession(t *testing.T) {
 	}
 
 	pk := sk.PublicKey()
-	sig := sk.SignProofOfPossession(msg)
+	sig, _ := sk.SignProofOfPossession(msg)
 
 	// Test valid proof
 	if !VerifyProofOfPossession(pk, sig, msg) {
@@ -339,7 +345,7 @@ func TestSignatureToBytes(t *testing.T) {
 	}
 
 	msg := []byte("test message")
-	sig := sk.Sign(msg)
+	sig, _ := sk.Sign(msg)
 	sigBytes := SignatureToBytes(sig)
 	if len(sigBytes) != SignatureLen {
 		t.Fatalf("Expected %d bytes, got %d", SignatureLen, len(sigBytes))
@@ -354,7 +360,7 @@ func TestSignatureFromBytes(t *testing.T) {
 	}
 
 	msg := []byte("test message")
-	sig1 := sk.Sign(msg)
+	sig1, _ := sk.Sign(msg)
 	sigBytes := SignatureToBytes(sig1)
 
 	// Deserialize
@@ -437,9 +443,9 @@ func TestAggregateSignatures(t *testing.T) {
 	sk2, _ := NewSecretKey()
 	sk3, _ := NewSecretKey()
 
-	sig1 := sk1.Sign(msg)
-	sig2 := sk2.Sign(msg)
-	sig3 := sk3.Sign(msg)
+	sig1, _ := sk1.Sign(msg)
+	sig2, _ := sk2.Sign(msg)
+	sig3, _ := sk3.Sign(msg)
 
 	// Test aggregation
 	aggSig, err := AggregateSignatures([]*Signature{sig1, sig2, sig3})
@@ -472,7 +478,7 @@ func TestMultiSignature(t *testing.T) {
 		}
 		secretKeys[i] = sk
 		publicKeys[i] = sk.PublicKey()
-		signatures[i] = sk.Sign(msg)
+		signatures[i], _ = sk.Sign(msg)
 	}
 
 	// Aggregate public keys and signatures
@@ -503,7 +509,7 @@ func TestEdgeCases(t *testing.T) {
 	emptyMsg := []byte{}
 	sk, _ := NewSecretKey()
 	pk := sk.PublicKey()
-	sig := sk.Sign(emptyMsg)
+	sig, _ := sk.Sign(emptyMsg)
 	if !Verify(pk, sig, emptyMsg) {
 		t.Fatal("Failed to verify signature on empty message")
 	}
@@ -511,7 +517,7 @@ func TestEdgeCases(t *testing.T) {
 	// Test with very long message
 	longMsg := make([]byte, 10000)
 	rand.Read(longMsg)
-	sig = sk.Sign(longMsg)
+	sig, _ = sk.Sign(longMsg)
 	if !Verify(pk, sig, longMsg) {
 		t.Fatal("Failed to verify signature on long message")
 	}
@@ -528,7 +534,7 @@ func BenchmarkSign(b *testing.B) {
 	msg := []byte("benchmark message")
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
-		_ = sk.Sign(msg)
+		_, _ = sk.Sign(msg)
 	}
 }
 
@@ -536,7 +542,7 @@ func BenchmarkVerify(b *testing.B) {
 	sk, _ := NewSecretKey()
 	pk := sk.PublicKey()
 	msg := []byte("benchmark message")
-	sig := sk.Sign(msg)
+	sig, _ := sk.Sign(msg)
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		_ = Verify(pk, sig, msg)
@@ -562,7 +568,7 @@ func BenchmarkAggregateSignatures(b *testing.B) {
 	sigs := make([]*Signature, n)
 	for i := 0; i < n; i++ {
 		sk, _ := NewSecretKey()
-		sigs[i] = sk.Sign(msg)
+		sigs[i], _ = sk.Sign(msg)
 	}
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {

bls12381/bls12381_blst.go

@@ -287,8 +287,14 @@ func BatchVerify(pubkeys []*PublicKey, messages [][]byte, signatures []*Signatur
 		blstMsgs[i] = messages[i]
 	}
 
-	// Use BLST's efficient batch verification
-	return blst.CoreBatchVerify(blstPks, blstSigs, true, blstMsgs, dst)
+	// Use BLST's batch verification through individual signature verification
+	// This is efficient for small batches and avoids complex aggregation
+	for i := range blstPks {
+		if !blstSigs[i].Verify(true, blstPks[i], false, blstMsgs[i], dst) {
+			return false
+		}
+	}
+	return true
 }
 
 // Helper functions

comprehensive_pq_test.go

@@ -19,7 +19,7 @@ func TestPQCrypto96Coverage(t *testing.T) {
 	t.Run("Hybrid", testHybrid)
 }
 
-func testMLDSA(t *testing.T) {
+func testMLDSAComprehensive(t *testing.T) {
 	modes := []mldsa.Mode{mldsa.MLDSA44, mldsa.MLDSA65, mldsa.MLDSA87}
 	
 	for _, mode := range modes {
@@ -131,7 +131,7 @@ func testMLDSAEdgeCases(t *testing.T) {
 	}
 }
 
-func testMLKEM(t *testing.T) {
+func testMLKEMComprehensive(t *testing.T) {
 	modes := []mlkem.Mode{mlkem.MLKEM512, mlkem.MLKEM768, mlkem.MLKEM1024}
 	
 	for _, mode := range modes {
@@ -142,19 +142,19 @@ func testMLKEM(t *testing.T) {
 		}
 		
 		// Encapsulate
-		ct, ss, err := pub.Encapsulate(rand.Reader)
+		result, err := pub.Encapsulate(rand.Reader)
 		if err != nil {
 			t.Fatalf("MLKEM Encapsulate failed: %v", err)
 		}
-		
+
 		// Decapsulate
-		ss2, err := priv.Decapsulate(ct)
+		ss2, err := priv.Decapsulate(result.Ciphertext)
 		if err != nil {
 			t.Fatalf("MLKEM Decapsulate failed: %v", err)
 		}
 		
 		// Verify shared secrets match
-		if !bytes.Equal(ss, ss2) {
+		if !bytes.Equal(result.SharedSecret, ss2) {
 			t.Fatal("MLKEM shared secrets don't match")
 		}
 		
@@ -174,22 +174,22 @@ func testMLKEM(t *testing.T) {
 		}
 		
 		// Test restored keys
-		ct2, ss3, err := pubRestored.Encapsulate(rand.Reader)
+		result2, err := pubRestored.Encapsulate(rand.Reader)
 		if err != nil {
 			t.Fatal("MLKEM restored key encapsulate failed")
 		}
 		
-		ss4, err := privRestored.Decapsulate(ct2)
+		ss4, err := privRestored.Decapsulate(result2.Ciphertext)
 		if err != nil {
 			t.Fatal("MLKEM restored key decapsulate failed")
 		}
-		
-		if !bytes.Equal(ss3, ss4) {
+
+		if !bytes.Equal(result2.SharedSecret, ss4) {
 			t.Fatal("MLKEM restored keys produce different shared secrets")
 		}
 		
 		// Test wrong ciphertext (should produce pseudorandom)
-		wrongCt := make([]byte, len(ct))
+		wrongCt := make([]byte, len(result.Ciphertext))
 		rand.Read(wrongCt)
 		ssWrong, err := priv.Decapsulate(wrongCt)
 		if err != nil {
@@ -197,7 +197,7 @@ func testMLKEM(t *testing.T) {
 		}
 		
 		// Should be different (pseudorandom)
-		if bytes.Equal(ss, ssWrong) {
+		if bytes.Equal(result.SharedSecret, ssWrong) {
 			t.Fatal("MLKEM wrong ct produced same shared secret")
 		}
 	}
@@ -221,7 +221,7 @@ func testMLKEMEdgeCases(t *testing.T) {
 	}
 	
 	var nilPub *mlkem.PublicKey
-	_, _, err = nilPub.Encapsulate(rand.Reader)
+	_, err = nilPub.Encapsulate(rand.Reader)
 	if err == nil {
 		t.Fatal("Expected error for nil MLKEM public key")
 	}
@@ -246,19 +246,19 @@ func testMLKEMEdgeCases(t *testing.T) {
 	
 	// Multiple encapsulations
 	_, pub, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
-	ct1, ss1, _ := pub.Encapsulate(rand.Reader)
-	ct2, ss2, _ := pub.Encapsulate(rand.Reader)
-	
-	if bytes.Equal(ct1, ct2) {
+	result1, _ := pub.Encapsulate(rand.Reader)
+	result2, _ := pub.Encapsulate(rand.Reader)
+
+	if bytes.Equal(result1.Ciphertext, result2.Ciphertext) {
 		t.Fatal("MLKEM multiple encapsulations produced same ciphertext")
 	}
-	
-	if bytes.Equal(ss1, ss2) {
+
+	if bytes.Equal(result1.SharedSecret, result2.SharedSecret) {
 		t.Fatal("MLKEM multiple encapsulations produced same shared secret")
 	}
 }
 
-func testSLHDSA(t *testing.T) {
+func testSLHDSAComprehensive(t *testing.T) {
 	// Note: SLH-DSA is computationally expensive, testing only 128s for quick validation
 	modes := []slhdsa.Mode{slhdsa.SLHDSA128s}
 	
@@ -368,7 +368,7 @@ func testIntegration(t *testing.T) {
 	sig, _ := mldsaPriv.Sign(rand.Reader, msg, nil)
 	
 	// Encapsulate with ML-KEM
-	ct, ss1, _ := mlkemPub.Encapsulate(rand.Reader)
+	result, _ := mlkemPub.Encapsulate(rand.Reader)
 	
 	// Verify signature
 	valid := mldsaPriv.PublicKey.Verify(msg, sig, nil)
@@ -377,8 +377,8 @@ func testIntegration(t *testing.T) {
 	}
 	
 	// Decapsulate
-	ss2, _ := mlkemPriv.Decapsulate(ct)
-	if !bytes.Equal(ss1, ss2) {
+	ss2, _ := mlkemPriv.Decapsulate(result.Ciphertext)
+	if !bytes.Equal(result.SharedSecret, ss2) {
 		t.Fatal("Integration: MLKEM shared secrets don't match")
 	}
 	

postquantum_test.go

@@ -23,7 +23,7 @@ func TestMLKEM(t *testing.T) {
 	for i, mode := range modes {
 		t.Run(names[i], func(t *testing.T) {
 			// Generate key pair
-			priv, err := mlkem.GenerateKeyPair(rand.Reader, mode)
+			priv, _, err := mlkem.GenerateKeyPair(rand.Reader, mode)
 			require.NoError(t, err)
 
 			// Encapsulate
@@ -122,7 +122,7 @@ func TestSLHDSA(t *testing.T) {
 func TestPerformance(t *testing.T) {
 	t.Run("ML-KEM Performance", func(t *testing.T) {
 		// Benchmark pure Go implementation
-		priv, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
+		priv, _, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
 
 		// Encapsulation benchmark
 		start := time.Now()
@@ -178,7 +178,7 @@ func TestHybridCrypto(t *testing.T) {
 		rand.Read(classicalSecret)
 
 		// Post-quantum ML-KEM
-		priv, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
+		priv, _, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
 		result, _ := priv.PublicKey.Encapsulate(rand.Reader)
 		pqSecret, _ := priv.Decapsulate(result.Ciphertext)
 
@@ -219,7 +219,7 @@ func TestHybridCrypto(t *testing.T) {
 // BenchmarkPostQuantum benchmarks all three standards
 func BenchmarkPostQuantum(b *testing.B) {
 	b.Run("ML-KEM-768", func(b *testing.B) {
-		priv, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
+		priv, _, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM768)
 
 		b.Run("Encapsulate", func(b *testing.B) {
 			for i := 0; i < b.N; i++ {

pq_integration_test.go

@@ -70,15 +70,15 @@ func TestMLKEMIntegration(t *testing.T) {
 			require.NotNil(pub)
 
 			// Encapsulate
-			ciphertext, sharedSecret, err := pub.Encapsulate(rand.Reader)
+			result, err := pub.Encapsulate(rand.Reader)
 			require.NoError(err)
-			require.NotEmpty(ciphertext)
-			require.NotEmpty(sharedSecret)
+			require.NotEmpty(result.Ciphertext)
+			require.NotEmpty(result.SharedSecret)
 
 			// Decapsulate
-			sharedSecret2, err := priv.Decapsulate(ciphertext)
+			sharedSecret2, err := priv.Decapsulate(result.Ciphertext)
 			require.NoError(err)
-			require.Equal(sharedSecret, sharedSecret2)
+			require.Equal(result.SharedSecret, sharedSecret2)
 
 			// Test serialization
 			pubBytes := pub.Bytes()
@@ -127,8 +127,8 @@ func TestSLHDSAIntegration(t *testing.T) {
 	}
 }
 
-// TestHybridCrypto tests hybrid classical + PQ modes
-func TestHybridCrypto(t *testing.T) {
+// TestHybridCryptoIntegration tests hybrid classical + PQ modes
+func TestHybridCryptoIntegration(t *testing.T) {
 	require := require.New(t)
 
 	// Test hybrid signing (classical + PQ)
@@ -174,7 +174,7 @@ func BenchmarkPQCrypto(b *testing.B) {
 		_, pub, _ := mlkem.GenerateKeyPair(rand.Reader, mlkem.MLKEM512)
 		b.ResetTimer()
 		for i := 0; i < b.N; i++ {
-			_, _, _ = pub.Encapsulate(rand.Reader)
+			_, _ = pub.Encapsulate(rand.Reader)
 		}
 	})
 

unified/signer_simple.go

@@ -45,7 +45,10 @@ func NewSimpleSigner() (*SimpleSigner, error) {
 
 // SignBLS creates a BLS signature
 func (s *SimpleSigner) SignBLS(message []byte) ([]byte, error) {
-	sig := s.blsKey.Sign(message)
+	sig, err := s.blsKey.Sign(message)
+	if err != nil {
+		return nil, err
+	}
 	return bls.SignatureToBytes(sig), nil
 }