FallenSigh
030931d4e5
Scaffolding for ML-KEM Decaps (FIPS 203 Alg 18):
- op_i widened to 2-bit: 00=KeyGen, 01=Encaps, 10=Decaps (op_r too).
- New ST_DEC_LOAD state (D0: settles to DONE so load/parse is dbg-checkable).
- dk (=sk) streamed via dk_in_*; load logic routes each byte by region:
[0,384K)->dk_pke (dkp_bram), [384K,768K+32)->ek_pke (ek_bram),
[768K+32,+32)->H(ek) (hek_r), [768K+64,+32)->z (z_r). Routing uses the
LIVE k_i input, not start-captured k_r (dk is streamed before start_i).
- c (=ct) streamed via c_in_* into a SEPARATE c_in_bram, so the computed c'
(ct_bram) can later be compared against original c and J(z||c) can read c.
- New dbg taps: dbg_mprime_o/dbg_kbar_o/dbg_decz_o/dbg_dech_o.
TB: tb_mlkem_dec_katK_xsim verifies dk parse (H(ek), z, ek_pke/dk_pke BRAM
round-trip). gen_decaps_vectors.py emits dec_k{K}_c{N}_{dk,ct,ss,ctn,ssn}.hex
from the NIST KAT. run_tb.sh gains a 'dec' module (mirrors 'enc').
Regression fix: old KeyGen/Encaps TBs didn't connect the new input ports,
floating them to X and corrupting the ek/dkp write muxes -> tied off
dk_in_*/c_in_*/new dbg taps in both.
Verified: dec D0 K=2/3/4 PASS; KeyGen K=2 + Encaps K=2 unregressed.
81 lines
2.9 KiB
Python
81 lines
2.9 KiB
Python
#!/usr/bin/env python3
|
|
"""gen_decaps_vectors.py - Emit per-byte Decaps KAT vectors for the XSIM TB.
|
|
|
|
For ML-KEM-512/768/1024, parse the NIST .rsp and write, per case:
|
|
dec_k{K}_c{N}_dk.hex : dk (=sk) bytes, one hex byte per line, byte 0 first
|
|
dec_k{K}_c{N}_ct.hex : ct bytes (valid ciphertext), one per line, byte 0 first
|
|
dec_k{K}_c{N}_ss.hex : ss bytes (shared secret for valid ct), byte 0 first
|
|
dec_k{K}_c{N}_ctn.hex : ct_n bytes (corrupted ct -> implicit reject)
|
|
dec_k{K}_c{N}_ssn.hex : ss_n bytes (shared secret K-bar for the reject path)
|
|
|
|
The TB streams dk into the design via dk_in_* (routed to dk_pke/ek_pke/h/z by
|
|
region) and ct into c_in_*, runs Decaps, and checks ss:
|
|
valid ct -> ss == ss (c'==c, K' kept)
|
|
ct_n -> ss == ss_n (c'!=c, K-bar via J(z||c_n))
|
|
|
|
Run: python3 gen_decaps_vectors.py [num_cases]
|
|
"""
|
|
|
|
import os
|
|
import re
|
|
import sys
|
|
|
|
ML_KEM_R = os.environ.get("ML_KEM_R", os.path.expanduser("~/Dev/ml-kem-r"))
|
|
OUT_DIR = os.path.join(os.path.dirname(__file__), "vectors")
|
|
KATS = {2: "kat_MLKEM_512.rsp", 3: "kat_MLKEM_768.rsp", 4: "kat_MLKEM_1024.rsp"}
|
|
|
|
|
|
def parse_kat(path, n):
|
|
"""Return list of dicts {count, sk, ct, ss, ct_n, ss_n} (hex) for first n."""
|
|
vecs, cur = [], {}
|
|
with open(path) as f:
|
|
for line in f:
|
|
line = line.strip()
|
|
m = re.match(r"^count\s*=\s*(\d+)$", line)
|
|
if m:
|
|
if cur:
|
|
vecs.append(cur)
|
|
if len(vecs) >= n:
|
|
break
|
|
cur = {"count": int(m.group(1))}
|
|
continue
|
|
# exact-key match: 'ct =' vs 'ct_n =', 'ss =' vs 'ss_n ='
|
|
m = re.match(r"^(sk|ct|ss|ct_n|ss_n)\s*=\s*([0-9a-fA-F]+)$", line)
|
|
if m and cur:
|
|
cur[m.group(1)] = m.group(2).lower()
|
|
if cur and len(vecs) < n:
|
|
vecs.append(cur)
|
|
return vecs
|
|
|
|
|
|
def write_bytes(path, hexstr):
|
|
"""Write hex string as one byte per line (byte 0 = first 2 hex chars)."""
|
|
with open(path, "w") as f:
|
|
for i in range(0, len(hexstr), 2):
|
|
f.write(hexstr[i:i + 2] + "\n")
|
|
|
|
|
|
def main():
|
|
ncases = int(sys.argv[1]) if len(sys.argv) > 1 else 3
|
|
os.makedirs(OUT_DIR, exist_ok=True)
|
|
for k, fname in KATS.items():
|
|
path = os.path.join(ML_KEM_R, "test_data", fname)
|
|
if not os.path.exists(path):
|
|
print(f"skip K={k}: {path} not found", file=sys.stderr)
|
|
continue
|
|
vecs = parse_kat(path, ncases)
|
|
for v in vecs:
|
|
n = v["count"]
|
|
base = os.path.join(OUT_DIR, f"dec_k{k}_c{n}")
|
|
write_bytes(f"{base}_dk.hex", v["sk"])
|
|
write_bytes(f"{base}_ct.hex", v["ct"])
|
|
write_bytes(f"{base}_ss.hex", v["ss"])
|
|
write_bytes(f"{base}_ctn.hex", v["ct_n"])
|
|
write_bytes(f"{base}_ssn.hex", v["ss_n"])
|
|
print(f"K={k}: wrote {len(vecs)} cases "
|
|
f"(dk={len(vecs[0]['sk'])//2}B ct={len(vecs[0]['ct'])//2}B)")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|