fallensigh/mlkem-sync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(enc): Encaps E0 - op_i/msg_i/ek-load scaffold + H(ek)+G(m||H(ek))

Browse Source 
Extend mlkem_top with a runtime op_i select (0=KeyGen, 1=Encaps) and the
first Encaps stages, reusing the shared keccak_core and the ST_H multi-block
SHA3-256 machinery:
  ST_ENC_H: H(ek) over preloaded ek_bram (same FSM as KeyGen ST_H)
  ST_ENC_G: (K,r) = G(m||H(ek)) via new 64-byte single-block SHA3-512

- sha3_top_shared: add mode=2'b11 = SHA3-512 over a full 512-bit message
  (g512_pad). Standalone tb_sha3_g512 confirms it byte-exact.
- mlkem_top: new ports op_i, msg_i, ek_in_{we,addr,byte} (ek preload), ss_o,
  dbg_ct_*, dbg_r_o/dbg_hek_o. st widened 4->5 bits; ST_ENC_* states added.
  Renamed message port to msg_i to avoid collision with ST_M counter m_i.
- TB tb_mlkem_enc_katK + gen_encaps_vectors.py (per-byte ek/m/ct/ss vectors).

Verified ss==KAT.ss for K=2/3/4, cases 0-2 (all PASS). KeyGen unaffected
(K=2 c0 still ek==pk, dk==sk byte-exact).
This commit is contained in:
FallenSigh
2026-06-29 01:00:47 +08:00
parent c4669480d1
commit 0a8b3dae69
43 changed files with 21956 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
sync_rtl/sha3/TB/tb_sha3_g512.v Normal file
View File

@@ -0,0 +1,50 @@
// tb_sha3_g512.v - isolate sha3_top_shared mode=11 (64-byte SHA3-512).
`timescale 1ns/1ps
module tb_sha3_g512;
reg clk=0, rst_n=0;
reg [1:0] mode;
reg [511:0] data_i;
reg valid_i, ready_i;
wire ready_o, valid_o;
wire [511:0] hash_o;
// shared keccak
wire [1599:0] kc_state_i, kc_state_o;
wire kc_valid_i, kc_valid_o, kc_ready_o, kc_ready_i;
sha3_top_shared u_sha3 (
.clk(clk), .rst_n(rst_n), .mode(mode), .data_i(data_i),
.valid_i(valid_i), .ready_o(ready_o), .hash_o(hash_o), .valid_o(valid_o),
.ready_i(ready_i),
.mb_en(1'b0), .mb_block_i(1088'd0), .mb_valid_i(1'b0), .mb_last_i(1'b0), .mb_ready_o(),
.kc_state_o(kc_state_o), .kc_valid_o(kc_valid_o), .kc_ready_o(kc_ready_o),
.kc_state_i(kc_state_i), .kc_valid_i(kc_valid_i), .kc_ready_i(kc_ready_i)
);
keccak_core #(.ROUNDS(24)) u_kc (
.clk(clk), .rst_n(rst_n), .state_i(kc_state_i), .valid_i(kc_valid_i),
.ready_o(kc_ready_o), .state_o(kc_state_o), .valid_o(kc_valid_o), .ready_i(1'b1)
);
always #5 clk=~clk;
integer j;
initial begin
// m || hek (byte0 in [7:0]); m=20a7..ffff, hek=ca87..aac6
// build little-endian-in-register: byte0 at [7:0]
data_i = 512'd0;
// m bytes 0..31
data_i[ 0 +: 256] = 256'hffff80fc331b2ca1904ccf554ed114bf99f6de44b92082c36c49700fe1b7a720;
// hek bytes 32..63
data_i[256 +: 256] = 256'hc6aa5100ed06d0c2db8cc3d1a36a62055b182f8d51ea71602501857e7c5d87ca;
mode=2'b11; valid_i=0; ready_i=1;
rst_n=0; repeat(4) @(posedge clk); rst_n=1; @(posedge clk);
valid_i=1; @(posedge clk);
while(!(valid_i && ready_o)) @(posedge clk);
valid_i=0;
while(!valid_o) @(posedge clk);
$write("K_ss = "); for(j=0;j<32;j=j+1) $write("%02x", hash_o[8*j +: 8]); $write("\n");
$write("r = "); for(j=0;j<32;j=j+1) $write("%02x", hash_o[256+8*j +: 8]); $write("\n");
$display("want K_ss = 2b5c52ee72946331983ba050be0f435055c0547901e03559b356517889ea27c5");
$display("want r = 08cd245f59e6cb6e3687c6632749b6c0737d183701f0b0492b843358893c6a24");
$finish;
end
initial begin #100000; $display("timeout"); $finish; end
endmodule