From cdc5ce25b13f74181d60c7c88103cf4c340ee706 Mon Sep 17 00:00:00 2001 From: FallenSigh Date: Mon, 29 Jun 2026 01:55:47 +0800 Subject: [PATCH] feat(enc): Encaps E2 - sample y/e1/e2 (CBD eta1/eta2, r seed) ST_ENC_C reuses the ST_C CBD datapath with Encaps muxes: seed=r (not sigma), eta=eta1 for y[0..K-1] then eta2 for e1[0..K-1]/e2, nonce 0..2K. 2K+1 polys (vs KeyGen 2K). y/e1 -> bank_se rel slots 0..2K-1; e2 -> bank_t rel slot 0 (free during C/N/U since TDEC is deferred to V-prep so the 28-slot banks hold all of A+y_hat+e1+e2 at K=4 without resizing). Bring-up golden via ml-kem-r dump_encaps_full (working-tree example): vectors/encgold/ec_k2_c0_{y,e1,e2}.hex. Verified (K=2 c0) y[0..1],e1[0..1],e2 == ml-kem-r; A_hat (E1) and ss (E0) still pass; K=3/4 no timeout. --- sync_rtl/top/TB/tb_mlkem_enc_katK_xsim.v | 61 +++-- .../top/TB/vectors/encgold/ec_k2_c0_e1_0.hex | 256 ++++++++++++++++++ .../top/TB/vectors/encgold/ec_k2_c0_e1_1.hex | 256 ++++++++++++++++++ .../top/TB/vectors/encgold/ec_k2_c0_e2.hex | 256 ++++++++++++++++++ .../top/TB/vectors/encgold/ec_k2_c0_u_0.hex | 256 ++++++++++++++++++ .../top/TB/vectors/encgold/ec_k2_c0_u_1.hex | 256 ++++++++++++++++++ .../top/TB/vectors/encgold/ec_k2_c0_v.hex | 256 ++++++++++++++++++ .../top/TB/vectors/encgold/ec_k2_c0_y_0.hex | 256 ++++++++++++++++++ .../top/TB/vectors/encgold/ec_k2_c0_y_1.hex | 256 ++++++++++++++++++ .../TB/vectors/encgold/ec_k2_c0_yhat_0.hex | 256 ++++++++++++++++++ .../TB/vectors/encgold/ec_k2_c0_yhat_1.hex | 256 ++++++++++++++++++ sync_rtl/top/mlkem_top.v | 58 ++-- 12 files changed, 2645 insertions(+), 34 deletions(-) create mode 100644 sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e1_0.hex create mode 100644 sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e1_1.hex create mode 100644 sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e2.hex create mode 100644 sync_rtl/top/TB/vectors/encgold/ec_k2_c0_u_0.hex create mode 100644 sync_rtl/top/TB/vectors/encgold/ec_k2_c0_u_1.hex create mode 100644 sync_rtl/top/TB/vectors/encgold/ec_k2_c0_v.hex create mode 100644 sync_rtl/top/TB/vectors/encgold/ec_k2_c0_y_0.hex create mode 100644 sync_rtl/top/TB/vectors/encgold/ec_k2_c0_y_1.hex create mode 100644 sync_rtl/top/TB/vectors/encgold/ec_k2_c0_yhat_0.hex create mode 100644 sync_rtl/top/TB/vectors/encgold/ec_k2_c0_yhat_1.hex diff --git a/sync_rtl/top/TB/tb_mlkem_enc_katK_xsim.v b/sync_rtl/top/TB/tb_mlkem_enc_katK_xsim.v index 4b555c4..4025cbf 100644 --- a/sync_rtl/top/TB/tb_mlkem_enc_katK_xsim.v +++ b/sync_rtl/top/TB/tb_mlkem_enc_katK_xsim.v @@ -92,16 +92,22 @@ module tb_mlkem_enc_katK_xsim; if (errors == 0) $display("K=%0d CASE %0d PASS (E0): ss == KAT.ss", KP, casenum); else $display("K=%0d CASE %0d FAIL (E0): %0d ss mismatches", KP, casenum, errors); - // ---- E1: verify A_hat (slots 0..K^2-1) and t_hat (slots slot_t..) ---- - // The KAT case-0 Encaps reuses ek=pk from KeyGen case-0, so regenerated - // A_hat and decoded t_hat equal KeyGen's golden vectors (K=2 c0 only). - if (KP == 2 && casenum == 0) verify_e1; + // ---- E1: verify A_hat (slots 0..K^2-1). t_hat (byteDecode12) is re- + // verified at E6 (V uses it); TDEC is deferred to V-prep so e2 can use + // bank_t during C/N/U. A_hat equals KeyGen golden (K=2 c0). ---- + // ---- E2: verify y[i], e1[i] (bank_se), e2 (bank_t slot_t) vs ml-kem-r. + if (KP == 2 && casenum == 0) begin + verify_e1; + verify_e2; + end $finish; end - // golden coeff arrays (K=2 c0): A_hat[i][j] and t_hat[i], 256 coeffs each - reg [11:0] ga [0:4*256-1]; // A00,A01,A10,A11 concatenated (slot*256+idx) - reg [11:0] gt [0:2*256-1]; // t_hat0, t_hat1 + // E1 golden: A_hat[i][j] (KeyGen golden, K=2 c0) + reg [11:0] ga [0:4*256-1]; + // E2 golden: y0,y1,e1_0,e1_1 (bank_se rel slots 0..3), e2 (bank_t slot 0) + reg [11:0] gy [0:4*256-1]; + reg [11:0] ge2 [0:255]; integer ce, slot, idx; task verify_e1; begin @@ -109,10 +115,7 @@ module tb_mlkem_enc_katK_xsim; $readmemh("test_framework/modules/mlkem_keygen/golden/c000_Ahat_0_1.hex", ga, 256, 511); $readmemh("test_framework/modules/mlkem_keygen/golden/c000_Ahat_1_0.hex", ga, 512, 767); $readmemh("test_framework/modules/mlkem_keygen/golden/c000_Ahat_1_1.hex", ga, 768, 1023); - $readmemh("test_framework/modules/mlkem_keygen/golden/c000_that_0.hex", gt, 0, 255); - $readmemh("test_framework/modules/mlkem_keygen/golden/c000_that_1.hex", gt, 256, 511); ce = 0; - // A_hat: slots 0..3 (i*k+j) for (slot = 0; slot < 4; slot = slot + 1) for (idx = 0; idx < 256; idx = idx + 1) begin dbg_slot_i = slot[3:0]; dbg_idx_i = idx[7:0]; @@ -122,18 +125,42 @@ module tb_mlkem_enc_katK_xsim; ce = ce + 1; end end - // t_hat: slots slot_t_rt(=8) .. +1 - for (slot = 0; slot < 2; slot = slot + 1) + if (ce == 0) $display("K=2 CASE 0 PASS (E1): A_hat (1024) == KeyGen golden"); + else $display("K=2 CASE 0 FAIL (E1): %0d A mismatches", ce); + end + endtask + // y[i],e1[i] live in bank_se at rel slots 0..K-1 (y), K..2K-1 (e1). + // dbg slot for bank_se = slot_s_rt + rel. K=2: slot_s_rt=4 -> y0=4,y1=5,e1_0=6,e1_1=7. + // e2 lives in bank_t rel slot 0 -> dbg slot = slot_t_rt = 8. + task verify_e2; + begin + $readmemh("sync_rtl/top/TB/vectors/encgold/ec_k2_c0_y_0.hex", gy, 0, 255); + $readmemh("sync_rtl/top/TB/vectors/encgold/ec_k2_c0_y_1.hex", gy, 256, 511); + $readmemh("sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e1_0.hex", gy, 512, 767); + $readmemh("sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e1_1.hex", gy, 768, 1023); + $readmemh("sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e2.hex", ge2); + ce = 0; + // y0,y1,e1_0,e1_1 at bank_se dbg slots 4..7 + for (slot = 0; slot < 4; slot = slot + 1) for (idx = 0; idx < 256; idx = idx + 1) begin - dbg_slot_i = (8+slot); dbg_idx_i = idx[7:0]; + dbg_slot_i = (4+slot); dbg_idx_i = idx[7:0]; @(posedge clk); @(posedge clk); @(posedge clk); - if (dbg_coeff_o !== gt[slot*256+idx]) begin - if (ce < 12) $display(" T[%0d,%0d] got=%03x exp=%03x", slot, idx, dbg_coeff_o, gt[slot*256+idx]); + if (dbg_coeff_o !== gy[slot*256+idx]) begin + if (ce < 8) $display(" Y[s%0d,%0d] got=%03x exp=%03x", slot, idx, dbg_coeff_o, gy[slot*256+idx]); ce = ce + 1; end end - if (ce == 0) $display("K=2 CASE 0 PASS (E1): A_hat (1024) + t_hat (512) == KeyGen golden"); - else $display("K=2 CASE 0 FAIL (E1): %0d coeff mismatches", ce); + // e2 at bank_t dbg slot 8 + for (idx = 0; idx < 256; idx = idx + 1) begin + dbg_slot_i = 8; dbg_idx_i = idx[7:0]; + @(posedge clk); @(posedge clk); @(posedge clk); + if (dbg_coeff_o !== ge2[idx]) begin + if (ce < 12) $display(" E2[%0d] got=%03x exp=%03x", idx, dbg_coeff_o, ge2[idx]); + ce = ce + 1; + end + end + if (ce == 0) $display("K=2 CASE 0 PASS (E2): y[0..1],e1[0..1],e2 == ml-kem-r golden"); + else $display("K=2 CASE 0 FAIL (E2): %0d coeff mismatches", ce); end endtask initial begin #120000000; $display("FAIL: global timeout"); $finish; end diff --git a/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e1_0.hex b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e1_0.hex new file mode 100644 index 0000000..ba1aa20 --- /dev/null +++ b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e1_0.hex @@ -0,0 +1,256 @@ +cff +d00 +000 +001 +d00 +001 +d00 +d00 +d00 +d00 +cff +d00 +d00 +000 +000 +000 +001 +000 +000 +001 +d00 +000 +002 +d00 +d00 +001 +001 +002 +002 +d00 +001 +001 +000 +d00 +000 +001 +001 +000 +cff +000 +d00 +d00 +000 +000 +cff +cff +000 +d00 +001 +000 +d00 +d00 +001 +d00 +d00 +001 +cff +000 +001 +d00 +000 +d00 +002 +001 +000 +002 +d00 +d00 +d00 +001 +001 +002 +000 +001 +000 +d00 +000 +d00 +000 +001 +002 +d00 +cff +cff +d00 +001 +cff +000 +000 +002 +001 +001 +d00 +000 +d00 +d00 +000 +cff +002 +d00 +cff +000 +000 +d00 +d00 +001 +001 +d00 +d00 +000 +cff +cff +cff +002 +d00 +d00 +001 +000 +001 +001 +001 +001 +001 +000 +000 +001 +d00 +002 +cff +d00 +001 +000 +000 +001 +000 +d00 +000 +001 +001 +001 +000 +000 +000 +000 +000 +001 +000 +d00 +d00 +d00 +000 +000 +d00 +000 +000 +000 +000 +000 +000 +000 +001 +001 +d00 +000 +d00 +001 +002 +d00 +000 +d00 +d00 +001 +d00 +d00 +000 +d00 +000 +000 +001 +d00 +002 +001 +d00 +000 +d00 +000 +002 +000 +d00 +000 +cff +002 +d00 +000 +000 +001 +001 +d00 +d00 +000 +d00 +002 +000 +d00 +000 +d00 +001 +001 +d00 +000 +001 +001 +000 +d00 +000 +000 +d00 +000 +000 +001 +000 +000 +002 +d00 +d00 +000 +d00 +002 +001 +d00 +000 +000 +001 +002 +001 +d00 +002 +001 +001 +000 +d00 +000 +001 +d00 +cff +d00 +001 +cff +001 +001 +001 +001 +d00 +001 +000 +d00 diff --git a/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e1_1.hex b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e1_1.hex new file mode 100644 index 0000000..e68141b --- /dev/null +++ b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e1_1.hex @@ -0,0 +1,256 @@ +d00 +000 +d00 +000 +d00 +000 +001 +000 +000 +000 +000 +001 +001 +002 +cff +d00 +d00 +002 +d00 +000 +000 +001 +001 +001 +001 +d00 +000 +000 +000 +000 +000 +000 +000 +000 +d00 +d00 +000 +001 +002 +d00 +000 +000 +d00 +000 +001 +001 +000 +001 +001 +000 +002 +d00 +d00 +000 +001 +000 +001 +000 +000 +000 +001 +002 +000 +000 +000 +001 +d00 +d00 +002 +001 +001 +000 +000 +000 +d00 +d00 +000 +000 +d00 +001 +001 +001 +000 +000 +d00 +000 +001 +d00 +000 +000 +000 +001 +d00 +cff +002 +000 +000 +d00 +d00 +d00 +000 +000 +cff +000 +001 +001 +000 +001 +d00 +002 +001 +cff +001 +000 +000 +001 +001 +001 +d00 +000 +000 +001 +000 +000 +001 +000 +000 +001 +d00 +000 +001 +000 +cff +000 +002 +001 +001 +001 +001 +000 +d00 +000 +001 +002 +000 +d00 +000 +000 +cff +000 +000 +cff +001 +002 +d00 +d00 +000 +000 +001 +d00 +001 +000 +000 +002 +000 +cff +001 +d00 +000 +000 +001 +d00 +d00 +002 +001 +d00 +002 +000 +d00 +cff +000 +000 +d00 +001 +000 +d00 +001 +001 +001 +002 +001 +000 +cff +000 +d00 +001 +000 +d00 +000 +d00 +000 +d00 +002 +000 +d00 +001 +001 +d00 +001 +001 +001 +000 +d00 +d00 +002 +001 +000 +000 +000 +d00 +001 +001 +000 +000 +001 +cff +000 +001 +001 +001 +001 +d00 +000 +001 +000 +000 +000 +000 +000 +001 +001 +001 +cff +d00 +cff +cff +d00 +001 +000 +001 +001 +000 +002 +000 +001 +000 diff --git a/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e2.hex b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e2.hex new file mode 100644 index 0000000..351fa20 --- /dev/null +++ b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_e2.hex @@ -0,0 +1,256 @@ +cff +000 +000 +000 +d00 +002 +d00 +000 +000 +d00 +d00 +001 +001 +d00 +d00 +001 +000 +000 +000 +000 +000 +d00 +001 +002 +001 +001 +001 +000 +002 +000 +001 +002 +d00 +000 +000 +d00 +000 +001 +d00 +d00 +001 +000 +d00 +d00 +d00 +d00 +d00 +d00 +001 +001 +001 +001 +001 +000 +001 +001 +001 +000 +cff +001 +000 +002 +000 +000 +001 +000 +000 +000 +000 +001 +000 +cff +000 +d00 +000 +001 +002 +000 +000 +d00 +d00 +001 +000 +002 +001 +001 +001 +d00 +d00 +d00 +000 +d00 +001 +001 +001 +d00 +001 +000 +000 +000 +d00 +000 +000 +d00 +001 +001 +001 +001 +000 +001 +001 +d00 +000 +001 +001 +001 +001 +000 +002 +001 +000 +002 +d00 +000 +d00 +001 +001 +000 +001 +000 +001 +000 +000 +000 +000 +000 +002 +001 +000 +000 +001 +000 +000 +d00 +d00 +001 +002 +000 +000 +002 +000 +000 +000 +000 +002 +001 +d00 +000 +d00 +000 +000 +d00 +d00 +d00 +000 +000 +002 +000 +d00 +d00 +000 +001 +001 +000 +000 +d00 +d00 +d00 +000 +001 +001 +000 +000 +d00 +000 +000 +001 +d00 +000 +cff +000 +d00 +d00 +d00 +001 +001 +001 +d00 +000 +000 +000 +d00 +001 +001 +d00 +cff +d00 +000 +d00 +001 +000 +d00 +000 +001 +d00 +d00 +001 +001 +001 +001 +001 +000 +001 +d00 +000 +000 +cff +000 +001 +000 +001 +000 +000 +000 +000 +001 +d00 +000 +000 +000 +000 +000 +000 +000 +000 +000 +002 +d00 +001 +001 +002 +000 +d00 +d00 +000 +000 diff --git a/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_u_0.hex b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_u_0.hex new file mode 100644 index 0000000..fdce2db --- /dev/null +++ b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_u_0.hex @@ -0,0 +1,256 @@ +857 +7b5 +384 +b79 +827 +564 +1bc +873 +391 +113 +431 +91b +00e +22a +a9e +483 +63d +2f5 +a7a +057 +af4 +643 +0f9 +cc2 +bce +2af +6a2 +ad7 +3f5 +bcc +a37 +6b3 +77a +710 +41d +698 +9c2 +7eb +0eb +9fe +8c6 +a63 +72f +403 +3d9 +530 +bb5 +28e +8b6 +0c0 +2bf +9ba +636 +7c3 +940 +188 +1e7 +1f6 +1ed +523 +285 +91c +c08 +3c8 +77a +9a9 +bd6 +7ca +cf1 +452 +7db +3f6 +3e1 +48c +197 +cfc +219 +666 +65a +576 +7f6 +20d +c55 +966 +c36 +856 +9bf +448 +11c +67c +59a +a3e +162 +317 +57d +ae4 +c3d +739 +577 +755 +58c +311 +757 +11e +75b +78f +088 +a61 +b31 +8ff +ba3 +842 +65a +bdb +108 +791 +2e3 +c6d +8a1 +97d +5bc +882 +bbb +423 +9ec +6c5 +70b +415 +305 +546 +7d5 +63a +204 +0f3 +6c8 +c8b +2c4 +a44 +5b6 +cb7 +a80 +019 +18f +293 +5b8 +56f +421 +b76 +918 +715 +8e5 +619 +814 +192 +2a8 +06f +0d7 +93a +6d8 +1b3 +83a +5cb +415 +0a4 +1bf +b9f +18f +8a5 +2e0 +c75 +5b5 +59b +364 +8c9 +8e2 +283 +cf6 +b81 +243 +2ae +8d9 +32b +b15 +cd7 +6b0 +8d2 +36f +543 +048 +72b +4fb +c73 +05d +402 +87d +342 +085 +32c +745 +3cf +959 +3d4 +9fa +90f +4bf +89e +0ed +a7f +c1a +036 +731 +67f +316 +636 +a45 +828 +a24 +746 +ab3 +580 +6dc +6e3 +542 +6a9 +95a +aa0 +7a7 +a1f +c5c +1b2 +049 +768 +830 +134 +076 +294 +392 +549 +19d +8ae +84b +881 +8b9 +81a +549 +642 +901 +191 +274 +c50 +24d +3f0 +160 +882 +ce6 +11a diff --git a/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_u_1.hex b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_u_1.hex new file mode 100644 index 0000000..aee1e81 --- /dev/null +++ b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_u_1.hex @@ -0,0 +1,256 @@ +541 +565 +972 +68c +0fb +416 +1a8 +6b2 +0f3 +3a4 +604 +94e +5c9 +330 +beb +56d +b19 +883 +019 +421 +525 +c52 +ab4 +943 +207 +a89 +1a1 +3b9 +04b +a86 +33f +65b +a0f +b82 +cbf +2a3 +ac0 +b3b +590 +2cc +18c +cae +8c2 +c4f +a70 +aa4 +7d1 +20b +4bc +57d +5c5 +a4d +176 +90e +139 +b5b +131 +8d7 +099 +280 +8c7 +045 +2d4 +aea +c06 +c41 +b60 +766 +9fe +99f +57d +7f9 +2ac +2c3 +4b7 +6aa +070 +b84 +c21 +bcd +0dc +941 +243 +144 +4fc +99b +7d2 +72a +bde +a87 +1ee +37e +cdb +1cf +a10 +36c +27c +c15 +6c5 +c3a +2b7 +6c8 +c20 +7f1 +67f +c9d +7bf +31a +b2a +6c5 +c4e +6a3 +972 +64a +548 +0e5 +69b +b43 +441 +a27 +1b4 +101 +176 +bd9 +267 +9b3 +1d1 +3f2 +97b +492 +c67 +ccb +1fa +2f7 +bd0 +6b8 +6d1 +cbf +62d +cfe +b03 +7d5 +5e2 +377 +70c +657 +48b +59c +c2c +c85 +55a +c45 +9b8 +9e1 +cb0 +ae5 +769 +25c +b11 +b24 +4ba +9e6 +cba +39a +031 +607 +05b +afd +a56 +7ae +02e +b45 +9c5 +3bc +4f2 +12d +4be +5f1 +59b +488 +b03 +50e +c2a +2b4 +271 +0ad +b36 +1e9 +44b +85d +c92 +bfa +bdc +3e9 +c43 +4ad +b67 +4ce +773 +627 +14c +150 +58a +931 +49d +c60 +2ba +2d1 +c18 +8e8 +2a1 +c0e +689 +350 +901 +8a6 +646 +9f4 +2f5 +672 +6df +079 +910 +4f7 +0f8 +a18 +2f7 +02c +2d9 +27d +4ad +521 +9fa +b77 +b64 +ce0 +ad2 +bdf +0fa +564 +103 +b98 +bd2 +96b +9b9 +632 +237 +21b +99b +3b7 +450 +76f +50b +7de +81d +6a3 diff --git a/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_v.hex b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_v.hex new file mode 100644 index 0000000..33dce36 --- /dev/null +++ b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_v.hex @@ -0,0 +1,256 @@ +b05 +019 +247 +3b4 +9a8 +2d3 +58a +3f0 +201 +110 +62d +6fb +8d0 +789 +842 +260 +4a8 +239 +5a2 +212 +819 +b2b +ccb +062 +076 +7e8 +b62 +adf +b26 +282 +4e2 +38c +816 +76f +022 +6ca +a18 +03b +292 +394 +a33 +11b +a68 +370 +17b +c7e +20e +305 +07d +9e7 +9b0 +a9d +aa1 +610 +87b +51a +701 +6a7 +7ef +905 +79d +56a +cb0 +ca9 +43d +aef +8f8 +170 +633 +5c4 +a01 +8a2 +086 +9d7 +250 +047 +558 +304 +c3a +333 +a60 +788 +a18 +142 +0d5 +202 +628 +201 +174 +05c +9b9 +46f +0f2 +29b +2d6 +786 +30e +9f9 +0d8 +a2b +02d +884 +c6d +7b7 +cd9 +445 +04e +75e +812 +3c0 +1b5 +ae1 +bb3 +aa1 +bdf +5f0 +6cb +b14 +ce4 +b35 +c0c +797 +392 +c9d +b13 +5d0 +b33 +065 +166 +5d7 +4ba +bb8 +7de +a8f +d00 +8a8 +a54 +b99 +5e8 +c8d +254 +b88 +027 +8a2 +b2e +6be +06e +aee +121 +24c +810 +4ca +beb +970 +41b +6cb +17b +552 +345 +3c4 +4e0 +942 +113 +a1b +91c +c83 +529 +c54 +989 +326 +456 +b35 +189 +6bb +1a8 +c0c +781 +714 +9b0 +04e +b4a +991 +c97 +a01 +3eb +7b2 +470 +01f +a7c +beb +b64 +5bf +43c +6c0 +58e +132 +6ed +79e +834 +6a8 +c2a +81e +685 +3cc +939 +2ae +098 +b84 +830 +810 +2f6 +537 +b35 +06c +89d +729 +33b +3eb +90a +af5 +77f +92b +a00 +0f4 +6ee +7ed +034 +ab3 +01d +574 +6f6 +ce4 +24d +104 +4bf +767 +bee +5d5 +cc7 +93d +346 +227 +13a +74c +0b5 +cc0 +3ea +890 +50a +a36 +765 +5b2 +268 +943 +a37 +1ee diff --git a/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_y_0.hex b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_y_0.hex new file mode 100644 index 0000000..cdd39da --- /dev/null +++ b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_y_0.hex @@ -0,0 +1,256 @@ +d00 +001 +d00 +001 +002 +cff +002 +d00 +003 +000 +000 +000 +d00 +000 +003 +000 +001 +002 +cff +cfe +cff +d00 +001 +cff +000 +002 +000 +001 +000 +001 +002 +002 +001 +001 +d00 +cff +d00 +001 +001 +002 +002 +001 +000 +000 +000 +002 +000 +d00 +001 +001 +001 +d00 +001 +000 +cff +000 +000 +001 +001 +002 +000 +cff +003 +000 +cff +000 +001 +000 +d00 +cff +000 +002 +d00 +003 +001 +d00 +cff +002 +cff +d00 +d00 +000 +000 +d00 +000 +d00 +cff +cff +000 +002 +002 +000 +000 +001 +000 +d00 +003 +001 +cff +001 +000 +cff +001 +001 +001 +d00 +001 +d00 +001 +d00 +001 +001 +d00 +001 +000 +000 +000 +000 +002 +d00 +001 +001 +000 +001 +d00 +000 +cff +000 +001 +d00 +001 +d00 +002 +000 +001 +d00 +cfe +001 +001 +001 +001 +000 +001 +002 +d00 +002 +d00 +cff +001 +003 +000 +000 +000 +d00 +002 +001 +001 +000 +000 +000 +cff +000 +d00 +001 +d00 +001 +000 +cff +001 +002 +002 +d00 +002 +000 +d00 +001 +002 +cff +d00 +002 +001 +000 +000 +000 +001 +000 +000 +d00 +000 +000 +d00 +000 +cff +d00 +000 +d00 +001 +d00 +002 +001 +000 +000 +d00 +000 +001 +001 +000 +001 +001 +000 +cff +000 +000 +002 +002 +000 +000 +001 +000 +002 +001 +001 +cff +000 +d00 +d00 +cff +000 +002 +001 +000 +000 +000 +002 +000 +000 +d00 +cff +000 +d00 +d00 +d00 +002 +d00 +002 +003 +000 +001 +d00 +002 +002 +000 +d00 +000 +002 +002 diff --git a/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_y_1.hex b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_y_1.hex new file mode 100644 index 0000000..19a65e5 --- /dev/null +++ b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_y_1.hex @@ -0,0 +1,256 @@ +000 +d00 +d00 +cff +000 +cff +002 +000 +001 +cff +002 +001 +001 +d00 +000 +d00 +001 +d00 +d00 +d00 +d00 +001 +001 +d00 +000 +000 +cff +000 +d00 +d00 +001 +001 +000 +000 +001 +001 +001 +000 +d00 +001 +000 +d00 +cff +000 +002 +000 +002 +001 +d00 +000 +000 +d00 +d00 +000 +002 +cff +001 +000 +d00 +001 +001 +000 +d00 +001 +d00 +000 +000 +d00 +001 +001 +001 +d00 +d00 +001 +d00 +001 +001 +cff +001 +000 +d00 +d00 +002 +000 +001 +001 +d00 +d00 +000 +000 +d00 +002 +d00 +cff +d00 +d00 +cff +d00 +002 +cfe +001 +002 +001 +001 +d00 +001 +001 +002 +000 +cff +d00 +d00 +cfe +000 +d00 +d00 +001 +000 +002 +cff +d00 +cff +d00 +000 +cff +002 +000 +001 +000 +d00 +001 +d00 +001 +003 +001 +d00 +000 +000 +001 +002 +000 +001 +d00 +002 +001 +d00 +000 +001 +cff +002 +002 +000 +000 +001 +000 +d00 +000 +000 +001 +002 +001 +d00 +d00 +d00 +cff +d00 +002 +000 +001 +000 +000 +001 +003 +cff +000 +000 +d00 +cff +000 +d00 +003 +cff +cfe +d00 +d00 +002 +002 +001 +000 +d00 +d00 +000 +d00 +002 +001 +000 +000 +001 +d00 +d00 +000 +cff +000 +002 +000 +002 +000 +d00 +000 +000 +cff +000 +000 +001 +d00 +d00 +003 +000 +001 +001 +cff +d00 +000 +000 +002 +d00 +001 +000 +cff +003 +000 +002 +001 +000 +001 +cfe +003 +001 +000 +001 +002 +d00 +000 +cff +001 +000 +000 +001 +000 +cff +000 +000 +001 +001 +000 +d00 diff --git a/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_yhat_0.hex b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_yhat_0.hex new file mode 100644 index 0000000..00c773e --- /dev/null +++ b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_yhat_0.hex @@ -0,0 +1,256 @@ +793 +7a2 +012 +c51 +c83 +055 +745 +0d1 +41c +4d5 +29b +b80 +485 +19c +19b +462 +c11 +c32 +84f +6ec +4aa +8aa +1cb +00f +359 +298 +a34 +60f +8aa +342 +c3a +301 +55d +7c8 +403 +97f +544 +8c1 +34b +95e +a82 +384 +aa6 +515 +9f0 +2fc +4ff +a4d +4f2 +13b +64c +8f4 +c7e +172 +55e +809 +9ff +360 +182 +3fd +101 +078 +804 +82a +6f8 +21d +bb1 +19b +a3f +2df +632 +9b0 +cef +7f8 +c29 +1be +0f4 +cc1 +af3 +31c +7c9 +45e +92a +890 +bec +2c5 +42d +4bb +8ed +10d +050 +2dc +9a3 +006 +36d +331 +732 +365 +7f0 +5d9 +461 +ab4 +6a9 +bbe +042 +952 +84f +0e2 +67b +0d5 +cd8 +bad +8dd +8d6 +c94 +9d4 +cbd +bf5 +422 +85b +031 +45e +afb +061 +a3f +718 +b95 +780 +a5e +8d6 +a36 +13a +813 +7f6 +166 +2ff +320 +8c3 +53a +115 +7a7 +c57 +1b6 +25a +ab1 +55d +13d +ba7 +62d +343 +35c +69d +50c +3e0 +066 +c9a +a9e +bf5 +b25 +722 +19b +821 +95d +05b +6e1 +3c1 +6af +06e +5a4 +c46 +b10 +2af +bf7 +364 +198 +21b +654 +35e +c6e +78b +b19 +22e +82d +208 +17b +a2b +1a1 +ccb +770 +362 +242 +a3e +82f +73d +409 +83b +091 +a70 +776 +2b1 +880 +ae5 +98c +1c5 +299 +83b +4b0 +850 +7a5 +bba +34b +7e0 +2c6 +c1a +5e5 +861 +474 +8fc +54c +6fb +abf +3d7 +99b +0e9 +2bd +a05 +215 +a66 +be8 +55d +10b +ca1 +5da +47a +1cd +9a9 +a80 +1c3 +711 +1fa +5eb +856 +6ee +cae +0cf +532 +529 +801 +30a +508 +b07 +cc5 +c46 +6a7 +140 +61b diff --git a/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_yhat_1.hex b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_yhat_1.hex new file mode 100644 index 0000000..8cb75c9 --- /dev/null +++ b/sync_rtl/top/TB/vectors/encgold/ec_k2_c0_yhat_1.hex @@ -0,0 +1,256 @@ +a0d +990 +c4b +481 +9e3 +190 +135 +bfe +0d4 +579 +a7f +66a +863 +20a +9a4 +b18 +7f8 +492 +909 +b37 +101 +750 +4b9 +104 +3f4 +b6c +b80 +139 +144 +09f +b5f +20b +0d5 +b3c +a70 +6df +c31 +698 +2e6 +15c +2d2 +148 +2a4 +572 +a56 +5d2 +a3e +0c7 +cc6 +55e +6b7 +cff +683 +877 +76e +10d +5d5 +1bd +a9b +617 +9ee +930 +2dc +088 +5ac +ce7 +413 +56c +422 +478 +51a +369 +9b0 +3c7 +032 +79e +9d0 +043 +95a +11a +6ca +c1d +981 +07a +43e +4cc +c2d +08f +454 +c74 +2df +cf1 +02c +6da +191 +b51 +61b +453 +303 +921 +520 +396 +6f6 +405 +4ce +797 +b9e +20f +cfb +a50 +7c4 +c82 +bb1 +402 +276 +c12 +ae2 +242 +4d1 +689 +c8b +88c +835 +360 +866 +5ea +66c +02b +af9 +29f +905 +783 +9c1 +9ff +500 +4a1 +984 +bb0 +a05 +08d +636 +8da +887 +ab6 +37e +7ae +7f3 +06d +1e6 +29b +942 +72a +1e1 +13e +6ac +4fe +a34 +994 +8db +bda +3c1 +4ec +8b4 +6d7 +227 +946 +a62 +9aa +163 +6d6 +96f +bb7 +161 +a7f +651 +8e1 +622 +78d +60b +86b +8bd +031 +246 +55e +7a0 +736 +cc9 +a07 +2c3 +58b +691 +8c7 +c13 +381 +49a +85d +c91 +43b +86a +0fb +2a8 +5b9 +743 +283 +8a7 +bef +be1 +20d +a3a +b6d +42f +b91 +501 +bc8 +0be +66b +3fe +994 +418 +440 +6c2 +8d1 +995 +980 +800 +8c6 +0f4 +6d2 +c7f +cef +781 +738 +3ec +065 +a50 +b75 +46a +4d1 +ad8 +377 +3ee +a4a +3a2 +5e9 +29f +597 +56a +c70 +8dc +7c0 +989 +c5f +3c1 +05a +497 +afd diff --git a/sync_rtl/top/mlkem_top.v b/sync_rtl/top/mlkem_top.v index fef3c7f..78744b4 100644 --- a/sync_rtl/top/mlkem_top.v +++ b/sync_rtl/top/mlkem_top.v @@ -212,12 +212,17 @@ module mlkem_top #( .clk(clk), .rd_addr(bt_rd_addr), .rd_data(bt_rd_data), .wr_en(bt_we), .wr_addr(bt_wa), .wr_data(bt_wd) ); - // bank_t write: KeyGen ST_M accumulate, or Encaps TDEC byteDecode12. - // ST_M: t_hat[m_i][m_oidx] <= (acc+product) mod Q when pm_vo. - // ST_ENC_TDEC: t_hat[td_poly][2*td_trip(+1)] <= decoded coeff (td_we/wa/wd). - assign bt_we = ((st == ST_M) && pm_vo) || td_we; - assign bt_wa = td_we ? td_wa : ((m_i*256 + m_oidx) & ((1< bank_t rel slot 0, free during C/N/U). + wire e2_we = (st == ST_ENC_C) && c_busy && cbd_vo && cbd_ack && + (c_poly == {1'b0, k_r, 1'b0}); // c_poly == 2K + assign bt_we = ((st == ST_M) && pm_vo) || td_we || e2_we; + assign bt_wa = td_we ? td_wa : + e2_we ? (c_widx & ((1<=K). nonce sequence 0..2K matches FIPS. + wire cbd_enc = (st == ST_ENC_C); + wire [255:0] cbd_seed = cbd_enc ? r_r : sigma_r; + wire [1:0] cbd_eta = cbd_enc ? ((c_poly < {2'b0, k_r}) ? eta1_rt : eta2_rt) + : eta1_rt; sample_cbd_sync_shared u_cbd ( .clk(clk), .rst_n(rst_n), - .seed_i(sigma_r), + .seed_i(cbd_seed), .nonce_i(c_nonce), - .eta_i(eta1_rt), + .eta_i(cbd_eta), .valid_i(cbd_valid), .ready_o(cbd_ready), .coeff_o(cbd_coeff), @@ -708,8 +725,9 @@ module mlkem_top #( ST_ENC_H: if (h_phase == 2'd3) st_next = ST_ENC_G; ST_ENC_G: if (sha3_vo) st_next = ST_ENC_LOAD; // (K,r) captured ST_ENC_LOAD: if (rl_idx >= 6'd33) st_next = ST_ENC_A; // rho loaded - ST_ENC_A: if (a_pair >= kk_rt) st_next = ST_ENC_TDEC; - ST_ENC_TDEC: if (td_done) st_next = ST_DONE; // E1: stop here (A, t_hat ready) + ST_ENC_A: if (a_pair >= kk_rt) st_next = ST_ENC_C; + ST_ENC_C: if (c_poly >= {k_r, 1'b1}) st_next = ST_DONE; // E2: stop (2K+1 polys: y,e1,e2) + ST_ENC_TDEC: if (td_done) st_next = ST_DONE; // (TDEC deferred to V-prep later) ST_DONE: st_next = ST_IDLE; default: st_next = ST_IDLE; endcase @@ -869,8 +887,9 @@ module mlkem_top #( end end - // Arm C stage when A finishes - if (st == ST_A && st_next == ST_C) begin + // Arm C stage when A finishes (KeyGen ST_A or Encaps ST_ENC_A) + if ((st == ST_A && st_next == ST_C) || + (st == ST_ENC_A && st_next == ST_ENC_C)) begin cbd_valid <= 1'b1; cbd_ack <= 1'b1; c_poly <= 3'd0; @@ -878,21 +897,26 @@ module mlkem_top #( c_busy <= 1'b0; end - // ---- ST_C: drive CBD, store 256 mod-q coeffs per poly ---- - if (st == ST_C) begin + // ---- ST_C / ST_ENC_C: drive CBD, store 256 mod-q coeffs per poly ---- + // KeyGen: 2K polys (s,e). Encaps: 2K+1 polys (y,e1,e2). Loop bound + // differs: KeyGen restarts while c_poly+1 < 2K; Encaps while < 2K+1. + if (st == ST_C || st == ST_ENC_C) begin if (cbd_valid && cbd_ready) begin cbd_valid <= 1'b0; c_busy <= 1'b1; end if (c_busy && cbd_vo && cbd_ack) begin - // bank_se write is the combinational bse_we/bse_wa/bse_wd - // assigns (rel slot c_poly); here only advance counters. if (cbd_last) begin c_poly <= c_poly + 3'd1; c_widx <= 8'd0; c_busy <= 1'b0; - if (c_poly + 3'd1 < {1'b0, k_r, 1'b0}) cbd_valid <= 1'b1; + // restart for next poly while more remain (state-dependent bound) + if (st == ST_ENC_C) begin + if (c_poly + 3'd1 < {k_r, 1'b1}) cbd_valid <= 1'b1; // < 2K+1 + end else begin + if (c_poly + 3'd1 < {1'b0, k_r, 1'b0}) cbd_valid <= 1'b1; // < 2K + end end else begin c_widx <= c_widx + 8'd1; end