fallensigh/mlkem-sync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(kg): byte-reverse d_reg before sha3_chain to match FIPS 203

Browse Source 
RTL was feeding d bytes in reversed order to SHA3-512,
causing G(d) to produce wrong rho/sigma. Fix: add d_rev
wire with byte reversal, connect to sha3_chain_top_shared.
This commit is contained in:
FallenSigh
2026-06-27 03:01:34 +08:00
parent 0b7c76283b
commit 038ba8ecf2
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
sync_rtl/top/mlkem_top.v
View File

@@ -113,6 +113,13 @@ module mlkem_top #(
reg [255:0] d_reg; // RNG output d reg [255:0] d_reg; // RNG output d
reg [255:0] rho_reg; // G output rho reg [255:0] rho_reg; // G output rho
reg [255:0] sigma_reg; // G output sigma reg [255:0] sigma_reg; // G output sigma
wire [255:0] d_rev; // byte-reversed d (FIPS 203 byte order)
genvar gi;
generate
for (gi = 0; gi < 32; gi = gi + 1) begin : gen_d_rev
assign d_rev[gi*8 +: 8] = d_reg[(31-gi)*8 +: 8];
end
endgenerate
reg [255:0] m_reg; // Encaps message m reg [255:0] m_reg; // Encaps message m
reg [255:0] Kbar_reg; // G output K-bar reg [255:0] Kbar_reg; // G output K-bar
reg [255:0] r_reg; // G output r reg [255:0] r_reg; // G output r
@@ -1490,7 +1497,7 @@ module mlkem_top #(
sha3_chain_top_shared u_chain ( sha3_chain_top_shared u_chain (
.clk (clk), .clk (clk),
.rst_n (rst_n), .rst_n (rst_n),
.d_in (d_reg), .d_in (d_rev),
.start_i (chain_start), .start_i (chain_start),
.done_o (chain_done), .done_o (chain_done),
.rho_out (chain_rho), .rho_out (chain_rho),