Skip to content

Conversation

@samuel40791765
Copy link
Contributor

Description of changes:

NIST moved the private key in the ML-KEM decapsulation tests from the group to the individual tests. Upstream BoringSSL has a similar change here: google/boringssl@f12962c

Call-outs:

This will be cherry-picked over to FIPS branch once in main.

Testing:

Updated ACVP tests

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

@samuel40791765 samuel40791765 requested a review from a team as a code owner November 27, 2025 02:05
@codecov-commenter
Copy link

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.44%. Comparing base (31cb153) to head (565071e).

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2867      +/-   ##
==========================================
+ Coverage   78.24%   78.44%   +0.19%     
==========================================
  Files         683      683              
  Lines      117374   117375       +1     
  Branches    16492    16497       +5     
==========================================
+ Hits        91845    92075     +230     
+ Misses      24644    24411     -233     
- Partials      885      889       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Contributor

@WillChilds-Klein WillChilds-Klein left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why are the test vectors so much smaller? did you trim them with?

@samuel40791765
Copy link
Contributor Author

samuel40791765 commented Nov 28, 2025

why are the test vectors so much smaller? did you trim them with?

I ran trim_vectors.go on the new demo vectors we got. But that does remind me that I only included ML-KEM-512 in the new vectors here... Will put up another commit to fix that in a bit.

Edit: Misremembered things lol, this is the raw file we're testing against. trim_vectors chooses one from each vector type to ensure minimum coverage.

[
  {
    "acvVersion": "1.0"
  },
  {
    "algorithm": "ML-KEM",
    "isSample": false,
    "mode": "encapDecap",
    "revision": "FIPS203",
    "testGroups": [
      {
        "function": "encapsulation",
        "parameterSet": "ML-KEM-512",
        "testType": "AFT",
        "tests": [
          {
            "ek": "...",
            "m": "89707075A9DE103138605D087E1EE6246721AEAC5AFDB1C639F6FA63CA8B0E2C",
            "tcId": 11
          }
        ],
        "tgId": 1
      },
      {
        "function": "encapsulation",
        "parameterSet": "ML-KEM-768",
        "testType": "AFT",
        "tests": [
          {
            "ek": "...",
            "m": "FB075CB2F07E580DCA69C42212A22D61A30FF2360A8786E7BDBBCA8BC299A0E5",
            "tcId": 36
          }
        ],
        "tgId": 2
      },
      {
        "function": "encapsulation",
        "parameterSet": "ML-KEM-1024",
        "testType": "AFT",
        "tests": [
          {
            "ek": "...",
            "m": "F27237C4B32EC1FFF364BA29F6D9DB93695B8A8B6B243F62ABB3BF6A07B1F51E",
            "tcId": 61
          }
        ],
        "tgId": 3
      },
      {
        "function": "decapsulation",
        "parameterSet": "ML-KEM-512",
        "testType": "VAL",
        "tests": [
          {
            "c": "...",
            "dk": "...",
            "tcId": 85
          }
        ],
        "tgId": 4
      },
      {
        "function": "decapsulation",
        "parameterSet": "ML-KEM-768",
        "testType": "VAL",
        "tests": [
          {
            "c": "...",
            "dk": "...",
            "tcId": 95
          }
        ],
        "tgId": 5
      },
      {
        "function": "decapsulation",
        "parameterSet": "ML-KEM-1024",
        "testType": "VAL",
        "tests": [
          {
            "c": "...",
            "dk": "...",
            "tcId": 105
          }
        ],
        "tgId": 6
      }
    ],
    "vsId": 3513113
  }
]

@samuel40791765 samuel40791765 merged commit 1570066 into aws:main Nov 28, 2025
386 of 391 checks passed
@samuel40791765 samuel40791765 deleted the acvp-mlkem-dec-update branch November 28, 2025 19:33
samuel40791765 added a commit to samuel40791765/aws-lc that referenced this pull request Nov 28, 2025
### Description of changes:
NIST moved the private key in the ML-KEM decapsulation tests from the
group to the individual tests. Upstream BoringSSL has a similar change
here:  google/boringssl@f12962c.

### Call-outs:
This will be cherry-picked over to FIPS branch once in main.

### Testing:
Updated ACVP tests

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.

(cherry picked from commit 1570066)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants