From 038ba8ecf293bd9c4192564f4810905147114ded Mon Sep 17 00:00:00 2001 From: FallenSigh Date: Sat, 27 Jun 2026 03:01:34 +0800 Subject: [PATCH] fix(kg): byte-reverse d_reg before sha3_chain to match FIPS 203 RTL was feeding d bytes in reversed order to SHA3-512, causing G(d) to produce wrong rho/sigma. Fix: add d_rev wire with byte reversal, connect to sha3_chain_top_shared. --- sync_rtl/top/mlkem_top.v | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sync_rtl/top/mlkem_top.v b/sync_rtl/top/mlkem_top.v index acc1572..acc41e2 100644 --- a/sync_rtl/top/mlkem_top.v +++ b/sync_rtl/top/mlkem_top.v @@ -113,6 +113,13 @@ module mlkem_top #( reg [255:0] d_reg; // RNG output d reg [255:0] rho_reg; // G output rho reg [255:0] sigma_reg; // G output sigma + wire [255:0] d_rev; // byte-reversed d (FIPS 203 byte order) + genvar gi; + generate + for (gi = 0; gi < 32; gi = gi + 1) begin : gen_d_rev + assign d_rev[gi*8 +: 8] = d_reg[(31-gi)*8 +: 8]; + end + endgenerate reg [255:0] m_reg; // Encaps message m reg [255:0] Kbar_reg; // G output K-bar reg [255:0] r_reg; // G output r @@ -1490,7 +1497,7 @@ module mlkem_top #( sha3_chain_top_shared u_chain ( .clk (clk), .rst_n (rst_n), - .d_in (d_reg), + .d_in (d_rev), .start_i (chain_start), .done_o (chain_done), .rho_out (chain_rho),