K-PKE.Decrypt steps 2-3 (FIPS 203 Alg 15), both by reusing Encaps machines:
- ST_DEC_SDEC reuses the Encaps TDEC (byteDecode12) machine: only the byte
source changes (td_byte mux -> dkp_rd_data; dkp_rd_addr driven by td_ekaddr
in SDEC). Decodes dk_pke -> s_hat[j] into bank_a slot j*K, the same layout
t_hat uses, so the D3 MAC can read s_hat[j] with the existing addressing.
- ST_DEC_NTT reuses the forward-NTT machine (n_slot_max=k_r) to transform
u'[i] in place in bank_se rel slots 0..K-1 -> u_hat[i]. Added ST_DEC_NTT to
the bank_se read/write muxes and the NTT load/process/arm blocks alongside
ST_N/ST_ENC_N.
- FSM: DECOMP -> SDEC -> NTT -> DONE.
TB verify_d2 checks s_hat[i] (bank_a slot i*K) and u_hat[i] (bank_se rel i)
against golden. verify_d1 narrowed to v' only: D2's in-place NTT overwrites u'
in bank_se, so u' correctness is now proven transitively via u_hat==NTT(u').
Verified: dec D2 K=2/3/4 all cases PASS; KeyGen + Encaps unregressed.
FallenSigh
940946f30c