fallensigh/mlkem-sync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(enc): Encaps E6 - v = INTT(sum t_hat o y_hat) + e2 + mu

Browse Source 
Storage choreography (per plan risk notes):
- TDEC now decodes t_hat[j] into bank_a slot j*K (was bank_t). This makes
  V's MAC reuse E4's u_aslot=u_j*K+u_row addressing with u_row=0, no mux
  change. bank_t has no room for K=4 (t_hat would fill all 4 slots vs
  psum's UPSUM slot), hence bank_a (16 slots, A_hat dead after E4).
- New ST_ENC_E2MV state relocates e2 (bank_t[0]) -> bank_a[1] so V-ADD
  reads psum (bank_t) and e2 (bank_a) from different banks (no port
  conflict). bank_se (y_hat + u) stays intact -> verify_e2/e3/e4 unaffected.
- V reuses the u_* MAC/INTT/ADD machine with u_row tied to 0 (u_row_max=1).
  ADD computes psum + e2 + mu mod Q -> bank_t[UPSUM] in place;
  mu[w] = m_r[w] ? 1665 : 0 (Decompress_1). FSM: C1->TDEC->E2MV->V->DONE.

Bug found+fixed during bring-up: e2 relocation was off-by-one (wrote
e2[i+1] into slot i) because em_we/em_widx were registered an extra cycle
past the bram read. Fixed: em_widx==em_ridx, write scheduled for the cycle
bt_rd_data presents e2[em_ridx].

TB: verify_e6 compares v (bank_t dbg slot 9, K=2) to ml-kem-r golden.
verify_e1 dropped (TDEC overwrites bank_a A_hat slots; A_hat transitively
verified by E4). Verified: K=2 E2/E3/E4/E6 == golden, E5 c1 == KAT prefix;
K=3/4 E0+E5 pass; KeyGen K=2 unregressed.
This commit is contained in:
FallenSigh
2026-06-29 11:03:33 +08:00
parent 4fee8bded3
commit e114bec5ee
3 changed files with 169 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
sync_rtl/top/TB/tb_mlkem_enc_katK_xsim.v
View File

@@ -102,10 +102,13 @@ module tb_mlkem_enc_katK_xsim;
// bank_t during C/N/U. A_hat equals KeyGen golden (K=2 c0). ----
// ---- E2: verify y[i], e1[i] (bank_se), e2 (bank_t slot_t) vs ml-kem-r.
if (KP == 2 && casenum == 0) begin
verify_e1;
// E1 (verify_e1) dropped: E6's TDEC overwrites bank_a (A_hat slots)
// with t_hat, so a post-run A_hat readback is invalid. A_hat is
// transitively verified by E4 (transpose MAC) and E6 (v uses t_hat).
verify_e2;
verify_e3;
verify_e4;
verify_e6;
end
// E5: c1 = byteEncode_du(Compress_du(u)) must equal KAT.ct[0..C1B-1].
// Runs for every K/case (ct_b is the full KAT ciphertext).
@@ -221,4 +224,24 @@ module tb_mlkem_enc_katK_xsim;
else $display("K=%0d CASE %0d FAIL (E5): %0d c1 byte mismatches", KP, casenum, be);
end
endtask
// E6: v = INTT(sum_j t_hat[j] o y_hat[j]) + e2 + mu lives in bank_t rel slot
// UPSUM=1 -> dbg slot slot_t_rt+1 = 9 (K=2). Compare to ml-kem-r golden v.
reg [11:0] gv [0:255];
task verify_e6;
begin
$readmemh("sync_rtl/top/TB/vectors/encgold/ec_k2_c0_v.hex", gv);
ce = 0;
for (idx = 0; idx < 256; idx = idx + 1) begin
dbg_slot_i = 9; dbg_idx_i = idx[7:0]; // bank_t rel UPSUM (K=2)
@(posedge clk); @(posedge clk); @(posedge clk);
if (dbg_coeff_o !== gv[idx]) begin
if (ce < 8) $display(" V[%0d] got=%03x exp=%03x", idx, dbg_coeff_o, gv[idx]);
ce = ce + 1;
end
end
if (ce == 0) $display("K=2 CASE 0 PASS (E6): v == ml-kem-r golden");
else $display("K=2 CASE 0 FAIL (E6): %0d coeff mismatches", ce);
end
endtask
endmodule