Test vectors for Kyber and ML-KEM.

[sophieschmieg]

Specifically, for round 3 and for the NIST Draft standard, as well as the discussed potential modification of the draft standard that does silently reduce instead of failing on unreduced vectors:

• The vectors of the round 3 submission package
• Vectors where public or private keys are not reduced mod q
• Vectors where the various parts of Kyber are too short or too long
• Edge cases where the secret and/or the error are zero
• Vectors where the ciphertext is random bytes
• Bit flips in ciphertext
• message all zero/all 0xff
• Values of rho where SHAKE expands more than usual and read up to 591 bytes.
• Values of rho where the matrix has relatively large values (maximizing the sum of all entries)
• Values of rho where the matrix contains an unusual amount of zeroes in NTT form (I found a seed with 3 zeroes mod prime factor of (3329), and a number of seeds with 2 zeroes)
• Values of rho for which the matrix fails to be invertible mod (3329), which is otherwise a property that a random matrix is expected to have with high probability.