FallenSigh
0a8b3dae69
Extend mlkem_top with a runtime op_i select (0=KeyGen, 1=Encaps) and the
first Encaps stages, reusing the shared keccak_core and the ST_H multi-block
SHA3-256 machinery:
ST_ENC_H: H(ek) over preloaded ek_bram (same FSM as KeyGen ST_H)
ST_ENC_G: (K,r) = G(m||H(ek)) via new 64-byte single-block SHA3-512
- sha3_top_shared: add mode=2'b11 = SHA3-512 over a full 512-bit message
(g512_pad). Standalone tb_sha3_g512 confirms it byte-exact.
- mlkem_top: new ports op_i, msg_i, ek_in_{we,addr,byte} (ek preload), ss_o,
dbg_ct_*, dbg_r_o/dbg_hek_o. st widened 4->5 bits; ST_ENC_* states added.
Renamed message port to msg_i to avoid collision with ST_M counter m_i.
- TB tb_mlkem_enc_katK + gen_encaps_vectors.py (per-byte ek/m/ct/ss vectors).
Verified ss==KAT.ss for K=2/3/4, cases 0-2 (all PASS). KeyGen unaffected
(K=2 c0 still ek==pk, dk==sk byte-exact).
51 lines
2.2 KiB
Verilog
51 lines
2.2 KiB
Verilog
// tb_sha3_g512.v - isolate sha3_top_shared mode=11 (64-byte SHA3-512).
|
|
`timescale 1ns/1ps
|
|
module tb_sha3_g512;
|
|
reg clk=0, rst_n=0;
|
|
reg [1:0] mode;
|
|
reg [511:0] data_i;
|
|
reg valid_i, ready_i;
|
|
wire ready_o, valid_o;
|
|
wire [511:0] hash_o;
|
|
// shared keccak
|
|
wire [1599:0] kc_state_i, kc_state_o;
|
|
wire kc_valid_i, kc_valid_o, kc_ready_o, kc_ready_i;
|
|
|
|
sha3_top_shared u_sha3 (
|
|
.clk(clk), .rst_n(rst_n), .mode(mode), .data_i(data_i),
|
|
.valid_i(valid_i), .ready_o(ready_o), .hash_o(hash_o), .valid_o(valid_o),
|
|
.ready_i(ready_i),
|
|
.mb_en(1'b0), .mb_block_i(1088'd0), .mb_valid_i(1'b0), .mb_last_i(1'b0), .mb_ready_o(),
|
|
.kc_state_o(kc_state_o), .kc_valid_o(kc_valid_o), .kc_ready_o(kc_ready_o),
|
|
.kc_state_i(kc_state_i), .kc_valid_i(kc_valid_i), .kc_ready_i(kc_ready_i)
|
|
);
|
|
keccak_core #(.ROUNDS(24)) u_kc (
|
|
.clk(clk), .rst_n(rst_n), .state_i(kc_state_i), .valid_i(kc_valid_i),
|
|
.ready_o(kc_ready_o), .state_o(kc_state_o), .valid_o(kc_valid_o), .ready_i(1'b1)
|
|
);
|
|
always #5 clk=~clk;
|
|
|
|
integer j;
|
|
initial begin
|
|
// m || hek (byte0 in [7:0]); m=20a7..ffff, hek=ca87..aac6
|
|
// build little-endian-in-register: byte0 at [7:0]
|
|
data_i = 512'd0;
|
|
// m bytes 0..31
|
|
data_i[ 0 +: 256] = 256'hffff80fc331b2ca1904ccf554ed114bf99f6de44b92082c36c49700fe1b7a720;
|
|
// hek bytes 32..63
|
|
data_i[256 +: 256] = 256'hc6aa5100ed06d0c2db8cc3d1a36a62055b182f8d51ea71602501857e7c5d87ca;
|
|
mode=2'b11; valid_i=0; ready_i=1;
|
|
rst_n=0; repeat(4) @(posedge clk); rst_n=1; @(posedge clk);
|
|
valid_i=1; @(posedge clk);
|
|
while(!(valid_i && ready_o)) @(posedge clk);
|
|
valid_i=0;
|
|
while(!valid_o) @(posedge clk);
|
|
$write("K_ss = "); for(j=0;j<32;j=j+1) $write("%02x", hash_o[8*j +: 8]); $write("\n");
|
|
$write("r = "); for(j=0;j<32;j=j+1) $write("%02x", hash_o[256+8*j +: 8]); $write("\n");
|
|
$display("want K_ss = 2b5c52ee72946331983ba050be0f435055c0547901e03559b356517889ea27c5");
|
|
$display("want r = 08cd245f59e6cb6e3687c6632749b6c0737d183701f0b0492b843358893c6a24");
|
|
$finish;
|
|
end
|
|
initial begin #100000; $display("timeout"); $finish; end
|
|
endmodule
|