2f206a6bc5
feat(mlkem_top): KeyGen stages 2a-2c (G, SampleNTT A_hat, CBD s/e)
...
Fresh valid/ready KeyGen FSM for ML-KEM-512 (K=2, eta1=3). Independent
keccak per consumer (no arbiter). Verified stage-by-stage vs ml-kem-r golden:
- 2a G(d||K): rho/sigma exact (d byte0-low, K at byte32, no reversal).
- 2b SampleNTT: A_hat[i][j] from seed rho||j||i, 1024/1024 coeffs exact.
- 2c CBD: s[i]=CBD3(PRF(sigma,i)), e[i]=CBD3(PRF(sigma,K+i)); signed->mod-q
(+Q when negative); 2048/2048 (A+s+e) coeffs exact.
polymem register array (10 slots x 256), debug readback tap (dbg_slot/idx ->
coeff, rho/sigma taps) for stage TBs. a_busy/c_busy guards (defensive after
sample_ntt fix). FSM: IDLE->G->A->C->DONE (datapath extended in later stages).
Plan + progress doc in .claude/plans/keygen_plan.md.
2026-06-28 01:41:44 +08:00
1cace51649
delete mlkem_top
2026-06-27 03:20:52 +08:00
038ba8ecf2
fix(kg): byte-reverse d_reg before sha3_chain to match FIPS 203
...
RTL was feeding d bytes in reversed order to SHA3-512,
causing G(d) to produce wrong rho/sigma. Fix: add d_rev
wire with byte reversal, connect to sha3_chain_top_shared.
2026-06-27 03:01:34 +08:00
5e0ba7ad77
fix(tb): strict numerical pass/fail — FSM completion without value match now counts as FAIL
2026-06-27 01:46:35 +08:00
3284aa443f
fix(kg): implement t_hat computation and pk/sk output in mlkem_top
...
- Add s_hat0_reg/s_hat1_reg for s_hat capture during CBD→NTT output
- Add tmul_accum register for poly_mul result accumulation
- Implement S_KG_TMUL_MUL_LD: load A+s coefficients into poly_mul
- Implement S_KG_TMUL_MUL_WAIT/ACCUM: accumulate A·s products
- Implement S_KG_TMUL_ADD_E: add e_hat to accumulated sum
- Assign pk_o_r = {t_hat1, t_hat0}_reg and sk_o_r = {s_hat1, s_hat0}_reg
- Shift Encaps/Decaps FSM states by +3
KeyGen: 5/5 vectors complete in ~47K cycles/op
2026-06-27 01:38:38 +08:00
0e6798beb5
feat(tb): add KAT testbench for mlkem_top (ML-KEM-512)
...
- gen_vectors.py: parse kat_MLKEM_512.rsp, generate hex vectors
- tb_mlkem_top_xsim.v: force-inject d/msg/z for KAT testing
- mlkem_top_input.hex: 5 vectors (d + msg + z)
- mlkem_top_expected.hex: 5 vectors (pk + sk + ct + ss)
- xsim_run.tcl: full dependency chain compilation
Known issue: mlkem_top FSM has combinational race on rng_valid_i
- rng_valid_i driven by state_r (registered) causes rng_sync
to miss valid_i pulse when state transitions at posedge
- Fix: change rng_valid_i to use state_next pattern
(same as sha3_top uses state_next for kc_valid_i)
2026-06-27 01:07:34 +08:00
03b4707879
feat(top): add shared keccak variants, arbiter, and mlkem_top integration
...
- sha3_chain_top_shared.v: external keccak_core interface (6 ports)
- sample_cbd_sync_shared.v: shared keccak variant (6 ports)
- sample_ntt_sync_shared.v: shared keccak variant (6 ports)
- keccak_arbiter.v: fixed-priority arbiter for 3 keccak consumers
- mlkem_top.v: 1403-line monolithic FSM with KeyGen/Encaps/Decaps
Architecture:
keccak_arbiter → keccak_core → keccak_round (shared)
sha3_chain_top_shared (consumer 0)
sample_cbd_sync_shared (consumer 1)
sample_ntt_sync_shared (consumer 2)
sha3_top (separate, own keccak_core)
rng_sync, ntt_core, poly_arith, poly_mul, comp_decomp, mod_add
sd_bram for polynomial storage
All original RTL files preserved unchanged.
2026-06-26 03:35:37 +08:00
