Completes K-PKE.Decrypt (FIPS 203 Alg 15) in hardware: m' is recovered.
D3 (ST_DEC_W) reuses the Encaps V MAC/INTT machine (u_row tied to 0):
- MAC s_hat[j] (bank_a slot j*K) o u_hat[j] (bank_se rel j) -> psum bank_t[UPSUM]
-- identical addressing to Encaps V (t_hat[j] o y_hat[j]), so free reuse.
- INTT(psum) in place.
- SUB: w = v' - psum mod Q (negative -> +Q), written to bank_t[UPSUM].
To read v' and psum in parallel during SUB (one read port per bank), D1's v'
write was relocated from bank_t to bank_a slot DEC_VASLOT=1 (always free:
s_hat occupies j*K, slot 1 is unused for K>=2). This mirrors V-ADD reading
psum (bank_t) + e2 (bank_a) simultaneously.
D4 (ST_DEC_MENC): m' = byteEncode_1(Compress_1(w)). Compress_1(w)=1 iff
832 < w <= 2496 (Q=3329); bits packed LSB-first into mprime_r, exposed on
dbg_mprime_o (was a placeholder tied to m_r).
Added ST_DEC_W to the u_* machine muxes/sub-phases and the FSM chain
NTT->W->MENC->DONE. TB verify_d3 checks w (bank_t UPSUM); verify_d4 checks the
32-byte m' against golden (== the KAT-decrypted m == original message).
Verified: dec D1-D4 K=2/3/4 all cases PASS; KeyGen + Encaps unregressed.
FallenSigh
7f519fe826