mlkem-sync

Author SHA1 Message Date

Author	SHA1	Message	Date
FallenSigh	106b2925a8	feat(sha3): multi-block SHA3-256 absorb for H(ek); KeyGen golden vectors Stage 0+1 of mlkem_top KeyGen integration: - sha3_top: add multi-block SHA3-256 absorb FSM (mb_en/mb_block_i/mb_valid_i/ mb_last_i/mb_ready_o). Caller pre-pads final block; module does pure absorb loop (state^=block; Keccak-p). Single-block G/H/J paths bit-identical when mb_en=0. Sticky digest register holds output until consumer acks. - tb_sha3_mb_xsim: self-checking TB streams 800B ek (6 blocks) -> H(ek), verified == hashlib.sha3_256. Proper valid/ready handshake (no force). - Existing G/H/J TBs (xsim + Verilator) tie off mb_* ports; both frameworks regress clean (Verilator 25/25, XSIM G/H/J + keccak + 7-vec + multiblock). - test_framework/modules/mlkem_keygen/golden: full 256-coeff per-stage intermediates (rho/sigma, A_hat, s/e, s_hat/e_hat, t_hat, ek, dk_pke) for KAT count=0..4, dumped by ml-kem-r and self-verified against NIST KAT.	2026-06-27 23:37:23 +08:00
FallenSigh	4d7ce69405	fix(sample_ntt,sha3): FIPS-203 SHAKE-128 squeeze + self-checking sha3 TBs sample_ntt was non-conformant: both RTL and the test reference re-ran keccak_p after every 3-byte squeeze instead of consuming the full 1344-bit SHAKE-128 rate. Only coeff[0] matched a standard sampler, so the generated A matrix would not interoperate with any compliant ML-KEM. - sample_ntt_sync{,_shared}.v: walk all 56 groups of the rate block via grp_ptr_r; re-permute only when the block is exhausted. Verified 256/256 against ml-kem-r Rust sample_ntt on two seeds, and 1536/1536 in the Verilator framework (runtime ~128x faster per poly). - gen_vectors.py: use a self-contained hashlib.shake_128 oracle. sha3 testbench fixes (all now self-check hash_o against verified vectors, cross-checked with hashlib and ml-kem-r mlkem_G): - tb_sha3_xsim_simple.v: test G/H/J modes, not just G. - tb_keccak_core_xsim.v: correct the wrong EXPECTED_STATE constant (RTL was correct; lane0 = 0xf1258f7940e1dde7 per FIPS 202). - tb_sha3_xsim.v: read expected file and self-check per vector; add vectors/g_basic_{input,expected}.hex (3 G / 2 H / 2 J). Remove stale sha3_chain test (its RTL was deleted in `1cace51`) and its README references. Extend .gitignore for XSIM artifacts and result dumps.	2026-06-27 17:23:28 +08:00
FallenSigh	5941fee980	feat(phase1): implement RNG, SampleCBD, SampleNTT modules + xsim TBs Phase 1 complete — all 4 leaf modules verified: - rng_sync.v: 256-bit Galois LFSR PRNG (10/10 PASS) - sample_cbd_sync.v: CBD sampler with keccak_core PRF (2560/2560 PASS) - sample_ntt_sync.v: SHAKE-128 rejection sampling for A matrix (1536/1536 PASS) - xsim Verilog TBs for sha3 module (tb_sha3_xsim.v, tb_sha3_xsim_simple.v, tb_keccak_core_xsim.v)	2026-06-24 21:32:53 +08:00

FallenSigh

106b2925a8

feat(sha3): multi-block SHA3-256 absorb for H(ek); KeyGen golden vectors

Stage 0+1 of mlkem_top KeyGen integration:
- sha3_top: add multi-block SHA3-256 absorb FSM (mb_en/mb_block_i/mb_valid_i/
  mb_last_i/mb_ready_o). Caller pre-pads final block; module does pure absorb
  loop (state^=block; Keccak-p). Single-block G/H/J paths bit-identical when
  mb_en=0. Sticky digest register holds output until consumer acks.
- tb_sha3_mb_xsim: self-checking TB streams 800B ek (6 blocks) -> H(ek),
  verified == hashlib.sha3_256. Proper valid/ready handshake (no force).
- Existing G/H/J TBs (xsim + Verilator) tie off mb_* ports; both frameworks
  regress clean (Verilator 25/25, XSIM G/H/J + keccak + 7-vec + multiblock).
- test_framework/modules/mlkem_keygen/golden: full 256-coeff per-stage
  intermediates (rho/sigma, A_hat, s/e, s_hat/e_hat, t_hat, ek, dk_pke) for
  KAT count=0..4, dumped by ml-kem-r and self-verified against NIST KAT.

2026-06-27 23:37:23 +08:00

FallenSigh

4d7ce69405

fix(sample_ntt,sha3): FIPS-203 SHAKE-128 squeeze + self-checking sha3 TBs

sample_ntt was non-conformant: both RTL and the test reference re-ran
keccak_p after every 3-byte squeeze instead of consuming the full
1344-bit SHAKE-128 rate. Only coeff[0] matched a standard sampler, so
the generated A matrix would not interoperate with any compliant ML-KEM.

- sample_ntt_sync{,_shared}.v: walk all 56 groups of the rate block via
  grp_ptr_r; re-permute only when the block is exhausted. Verified
  256/256 against ml-kem-r Rust sample_ntt on two seeds, and 1536/1536
  in the Verilator framework (runtime ~128x faster per poly).
- gen_vectors.py: use a self-contained hashlib.shake_128 oracle.

sha3 testbench fixes (all now self-check hash_o against verified vectors,
cross-checked with hashlib and ml-kem-r mlkem_G):
- tb_sha3_xsim_simple.v: test G/H/J modes, not just G.
- tb_keccak_core_xsim.v: correct the wrong EXPECTED_STATE constant
  (RTL was correct; lane0 = 0xf1258f7940e1dde7 per FIPS 202).
- tb_sha3_xsim.v: read expected file and self-check per vector; add
  vectors/g_basic_{input,expected}.hex (3 G / 2 H / 2 J).

Remove stale sha3_chain test (its RTL was deleted in 1cace51) and its
README references. Extend .gitignore for XSIM artifacts and result dumps.

2026-06-27 17:23:28 +08:00

FallenSigh

5941fee980

feat(phase1): implement RNG, SampleCBD, SampleNTT modules + xsim TBs

Phase 1 complete — all 4 leaf modules verified:
- rng_sync.v: 256-bit Galois LFSR PRNG (10/10 PASS)
- sample_cbd_sync.v: CBD sampler with keccak_core PRF (2560/2560 PASS)
- sample_ntt_sync.v: SHAKE-128 rejection sampling for A matrix (1536/1536 PASS)
- xsim Verilog TBs for sha3 module (tb_sha3_xsim.v, tb_sha3_xsim_simple.v, tb_keccak_core_xsim.v)

2026-06-24 21:32:53 +08:00

3 Commits