FallenSigh
0a8b3dae69
Extend mlkem_top with a runtime op_i select (0=KeyGen, 1=Encaps) and the
first Encaps stages, reusing the shared keccak_core and the ST_H multi-block
SHA3-256 machinery:
ST_ENC_H: H(ek) over preloaded ek_bram (same FSM as KeyGen ST_H)
ST_ENC_G: (K,r) = G(m||H(ek)) via new 64-byte single-block SHA3-512
- sha3_top_shared: add mode=2'b11 = SHA3-512 over a full 512-bit message
(g512_pad). Standalone tb_sha3_g512 confirms it byte-exact.
- mlkem_top: new ports op_i, msg_i, ek_in_{we,addr,byte} (ek preload), ss_o,
dbg_ct_*, dbg_r_o/dbg_hek_o. st widened 4->5 bits; ST_ENC_* states added.
Renamed message port to msg_i to avoid collision with ST_M counter m_i.
- TB tb_mlkem_enc_katK + gen_encaps_vectors.py (per-byte ek/m/ct/ss vectors).
Verified ss==KAT.ss for K=2/3/4, cases 0-2 (all PASS). KeyGen unaffected
(K=2 c0 still ek==pk, dk==sk byte-exact).
114 lines
5.1 KiB
Verilog
114 lines
5.1 KiB
Verilog
// tb_mlkem_kg_katK_xsim.v - ML-KEM KeyGen vs NIST KAT, parametric K (KP) + CASE.
|
|
// xelab -generic_top KP=2|3|4 ; xsim -testplusarg CASE=n
|
|
// KP=2 -> k2 vectors (ML-KEM-512), KP=3 -> k3 (768), KP=4 -> k4 (1024).
|
|
// ek = 384*KP+32 bytes (==KAT pk), dk = 768*KP+96 bytes (==KAT sk).
|
|
`timescale 1ns/1ps
|
|
module tb_mlkem_kg_katK_xsim;
|
|
parameter KP = 2;
|
|
localparam EKB = 384*KP + 32;
|
|
localparam DKB = 768*KP + 96;
|
|
|
|
reg clk=0, rst_n=0, start_i=0;
|
|
reg [2:0] k_i;
|
|
reg [255:0] d_i, z_i;
|
|
wire busy_o, done_o;
|
|
reg [3:0] dbg_slot_i=0; reg [7:0] dbg_idx_i=0; wire [11:0] dbg_coeff_o;
|
|
reg dbg_byte_sel_i=0; reg [10:0] dbg_byte_idx_i=0; wire [7:0] dbg_byte_o;
|
|
reg [11:0] dbg_dk_idx_i=0; wire [7:0] dbg_dk_o;
|
|
wire [255:0] dbg_rho_o, dbg_sigma_o;
|
|
|
|
// KMAX defaults to 4 (worst-case sizing); KP selects the runtime k value.
|
|
mlkem_top dut (
|
|
.clk(clk), .rst_n(rst_n), .k_i(k_i), .op_i(1'b0),
|
|
.d_i(d_i), .z_i(z_i), .msg_i(256'd0), .start_i(start_i),
|
|
.busy_o(busy_o), .done_o(done_o),
|
|
.ek_in_we(1'b0), .ek_in_addr(11'd0), .ek_in_byte(8'd0),
|
|
.ss_o(), .dbg_ct_idx_i(11'd0), .dbg_ct_o(),
|
|
.dbg_slot_i(dbg_slot_i), .dbg_idx_i(dbg_idx_i), .dbg_coeff_o(dbg_coeff_o),
|
|
.dbg_byte_sel_i(dbg_byte_sel_i), .dbg_byte_idx_i(dbg_byte_idx_i), .dbg_byte_o(dbg_byte_o),
|
|
.dbg_dk_idx_i(dbg_dk_idx_i), .dbg_dk_o(dbg_dk_o),
|
|
.dbg_rho_o(dbg_rho_o), .dbg_sigma_o(dbg_sigma_o),
|
|
.dbg_r_o(), .dbg_hek_o()
|
|
);
|
|
always #5 clk = ~clk;
|
|
|
|
reg [255:0] dmem [0:0];
|
|
reg [255:0] zmem [0:0];
|
|
reg [7:0] ek_gold [0:EKB-1];
|
|
reg [7:0] dk_gold [0:DKB-1];
|
|
reg [7:0] ek_got [0:EKB-1]; // ek bytes read back from DUT
|
|
reg [7:0] dk_got [0:DKB-1]; // dk bytes read back from DUT
|
|
integer c, i, errors, casenum, j;
|
|
reg [8*80-1:0] tag, dfile, zfile, ekfile, dkfile;
|
|
|
|
// Dump a byte array as offset-prefixed hex, 32 bytes/line.
|
|
task dump_bytes(input [8*16-1:0] name, input integer n);
|
|
integer a, b;
|
|
begin
|
|
for (a = 0; a < n; a = a + 32) begin
|
|
$write(" %0s[%4d] ", name, a);
|
|
for (b = a; b < a+32 && b < n; b = b + 1) begin
|
|
if (name == "ek") $write("%02x", ek_got[b]);
|
|
else $write("%02x", dk_got[b]);
|
|
end
|
|
$write("\n");
|
|
end
|
|
end
|
|
endtask
|
|
|
|
initial begin
|
|
if (!$value$plusargs("CASE=%d", casenum)) casenum = 0;
|
|
$sformat(tag, "k%0d", KP);
|
|
$sformat(dfile, "sync_rtl/top/TB/vectors/kat_%0s_c%0d_d.hex", tag, casenum);
|
|
$sformat(zfile, "sync_rtl/top/TB/vectors/kat_%0s_c%0d_z.hex", tag, casenum);
|
|
$sformat(ekfile, "sync_rtl/top/TB/vectors/kat_%0s_c%0d_ek.hex", tag, casenum);
|
|
$sformat(dkfile, "sync_rtl/top/TB/vectors/kat_%0s_c%0d_dk.hex", tag, casenum);
|
|
$readmemh(dfile, dmem);
|
|
$readmemh(zfile, zmem);
|
|
$readmemh(ekfile, ek_gold);
|
|
$readmemh(dkfile, dk_gold);
|
|
d_i = dmem[0]; z_i = zmem[0];
|
|
k_i = KP[2:0];
|
|
|
|
// ---- show the KeyGen inputs (d, z seeds: 32 bytes each, MSB-first) ----
|
|
$display("=== ML-KEM K=%0d KAT case %0d INPUTS ===", KP, casenum);
|
|
$write(" d = "); for (j = 0; j < 32; j = j + 1) $write("%02x", d_i[8*(31-j) +: 8]); $write("\n");
|
|
$write(" z = "); for (j = 0; j < 32; j = j + 1) $write("%02x", z_i[8*(31-j) +: 8]); $write("\n");
|
|
|
|
rst_n=0; repeat(4) @(posedge clk); rst_n=1; @(posedge clk);
|
|
start_i=1; @(posedge clk); start_i=0;
|
|
c=0; while(!done_o && c<2000000) begin @(posedge clk); c=c+1; end
|
|
if(!done_o) begin $display("FAIL K=%0d case %0d: timeout", KP, casenum); $finish; end
|
|
$display("=== ML-KEM K=%0d KAT case %0d: KeyGen done in %0d cyc ===", KP, casenum, c);
|
|
|
|
errors = 0;
|
|
dbg_byte_sel_i = 1'b0;
|
|
for (i = 0; i < EKB; i = i + 1) begin
|
|
dbg_byte_idx_i = i[10:0]; @(posedge clk); @(posedge clk);
|
|
ek_got[i] = dbg_byte_o;
|
|
if (dbg_byte_o !== ek_gold[i]) begin
|
|
if (errors < 8) $display(" EK[%0d] got=%02x exp=%02x", i, dbg_byte_o, ek_gold[i]);
|
|
errors = errors + 1;
|
|
end
|
|
end
|
|
for (i = 0; i < DKB; i = i + 1) begin
|
|
dbg_dk_idx_i = i[11:0]; @(posedge clk); @(posedge clk);
|
|
dk_got[i] = dbg_dk_o;
|
|
if (dbg_dk_o !== dk_gold[i]) begin
|
|
if (errors < 8) $display(" DK[%0d] got=%02x exp=%02x", i, dbg_dk_o, dk_gold[i]);
|
|
errors = errors + 1;
|
|
end
|
|
end
|
|
|
|
// ---- show the KeyGen outputs (ek, dk byte strings read from DUT) ----
|
|
$display("=== ML-KEM K=%0d KAT case %0d OUTPUTS ===", KP, casenum);
|
|
$display(" ek (%0d bytes):", EKB); dump_bytes("ek", EKB);
|
|
$display(" dk (%0d bytes):", DKB); dump_bytes("dk", DKB);
|
|
|
|
if (errors == 0) $display("K=%0d CASE %0d PASS: ek (%0dB)==pk, dk (%0dB)==sk", KP, casenum, EKB, DKB);
|
|
else $display("K=%0d CASE %0d FAIL: %0d mismatches", KP, casenum, errors);
|
|
$finish;
|
|
end
|
|
initial begin #120000000; $display("FAIL: global timeout"); $finish; end
|
|
endmodule
|