mlkem-sync

Author SHA1 Message Date

Author	SHA1	Message	Date
FallenSigh	4d7ce69405	fix(sample_ntt,sha3): FIPS-203 SHAKE-128 squeeze + self-checking sha3 TBs sample_ntt was non-conformant: both RTL and the test reference re-ran keccak_p after every 3-byte squeeze instead of consuming the full 1344-bit SHAKE-128 rate. Only coeff[0] matched a standard sampler, so the generated A matrix would not interoperate with any compliant ML-KEM. - sample_ntt_sync{,_shared}.v: walk all 56 groups of the rate block via grp_ptr_r; re-permute only when the block is exhausted. Verified 256/256 against ml-kem-r Rust sample_ntt on two seeds, and 1536/1536 in the Verilator framework (runtime ~128x faster per poly). - gen_vectors.py: use a self-contained hashlib.shake_128 oracle. sha3 testbench fixes (all now self-check hash_o against verified vectors, cross-checked with hashlib and ml-kem-r mlkem_G): - tb_sha3_xsim_simple.v: test G/H/J modes, not just G. - tb_keccak_core_xsim.v: correct the wrong EXPECTED_STATE constant (RTL was correct; lane0 = 0xf1258f7940e1dde7 per FIPS 202). - tb_sha3_xsim.v: read expected file and self-check per vector; add vectors/g_basic_{input,expected}.hex (3 G / 2 H / 2 J). Remove stale sha3_chain test (its RTL was deleted in `1cace51`) and its README references. Extend .gitignore for XSIM artifacts and result dumps.	2026-06-27 17:23:28 +08:00
FallenSigh	5941fee980	feat(phase1): implement RNG, SampleCBD, SampleNTT modules + xsim TBs Phase 1 complete — all 4 leaf modules verified: - rng_sync.v: 256-bit Galois LFSR PRNG (10/10 PASS) - sample_cbd_sync.v: CBD sampler with keccak_core PRF (2560/2560 PASS) - sample_ntt_sync.v: SHAKE-128 rejection sampling for A matrix (1536/1536 PASS) - xsim Verilog TBs for sha3 module (tb_sha3_xsim.v, tb_sha3_xsim_simple.v, tb_keccak_core_xsim.v)	2026-06-24 21:32:53 +08:00

FallenSigh

4d7ce69405

fix(sample_ntt,sha3): FIPS-203 SHAKE-128 squeeze + self-checking sha3 TBs

sample_ntt was non-conformant: both RTL and the test reference re-ran
keccak_p after every 3-byte squeeze instead of consuming the full
1344-bit SHAKE-128 rate. Only coeff[0] matched a standard sampler, so
the generated A matrix would not interoperate with any compliant ML-KEM.

- sample_ntt_sync{,_shared}.v: walk all 56 groups of the rate block via
  grp_ptr_r; re-permute only when the block is exhausted. Verified
  256/256 against ml-kem-r Rust sample_ntt on two seeds, and 1536/1536
  in the Verilator framework (runtime ~128x faster per poly).
- gen_vectors.py: use a self-contained hashlib.shake_128 oracle.

sha3 testbench fixes (all now self-check hash_o against verified vectors,
cross-checked with hashlib and ml-kem-r mlkem_G):
- tb_sha3_xsim_simple.v: test G/H/J modes, not just G.
- tb_keccak_core_xsim.v: correct the wrong EXPECTED_STATE constant
  (RTL was correct; lane0 = 0xf1258f7940e1dde7 per FIPS 202).
- tb_sha3_xsim.v: read expected file and self-check per vector; add
  vectors/g_basic_{input,expected}.hex (3 G / 2 H / 2 J).

Remove stale sha3_chain test (its RTL was deleted in 1cace51) and its
README references. Extend .gitignore for XSIM artifacts and result dumps.

2026-06-27 17:23:28 +08:00

FallenSigh

5941fee980

feat(phase1): implement RNG, SampleCBD, SampleNTT modules + xsim TBs

Phase 1 complete — all 4 leaf modules verified:
- rng_sync.v: 256-bit Galois LFSR PRNG (10/10 PASS)
- sample_cbd_sync.v: CBD sampler with keccak_core PRF (2560/2560 PASS)
- sample_ntt_sync.v: SHAKE-128 rejection sampling for A matrix (1536/1536 PASS)
- xsim Verilog TBs for sha3 module (tb_sha3_xsim.v, tb_sha3_xsim_simple.v, tb_keccak_core_xsim.v)

2026-06-24 21:32:53 +08:00

2 Commits