Skip to content

Conversation

@samuel40791765
Copy link
Contributor

Description of changes:

ACVP has support for a new test vectors that test against the encapsulation/decapsulation key checks defined in FIPS 203.

Adds "encapsulationKeyCheck" and "decapsulationKeyCheck" as functions for ML-KEM Encap/Decap FIPS203 to exercise an implementation's capability to perform the Encapsulation Key Check in FIPS 203 Section 7.2 and the Decapsulation Key Check in FIPS 203 Section 7.3. These tests are only included if the appropriate function is present in the registration. They operate by providing a valid or invalid key and expecting the IUT to return a true for a valid key or false for an invalid key.

This add support in ACVP to run against the relevant crypto_kem_check_pk and crypto_kem_check_sk functions that do the checks for us. Also added the new encapsulationKeyCheck and decapsulationKeyCheck test vectors in ML-KEM.bz2.

Call-outs:

N/A

Testing:

new encapsulationKeyCheck and decapsulationKeyCheck test vectors in ML-KEM.bz2

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

@samuel40791765 samuel40791765 requested a review from a team as a code owner December 2, 2025 00:15
skmcgrail
skmcgrail previously approved these changes Dec 2, 2025
torben-hansen
torben-hansen previously approved these changes Dec 2, 2025
@codecov-commenter
Copy link

codecov-commenter commented Dec 2, 2025

Codecov Report

❌ Patch coverage is 0% with 24 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.23%. Comparing base (b5e2f86) to head (ff4fa4f).

Files with missing lines Patch % Lines
crypto/fipsmodule/ml_kem/ml_kem.c 0.00% 24 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2872      +/-   ##
==========================================
- Coverage   78.24%   78.23%   -0.01%     
==========================================
  Files         683      683              
  Lines      117388   117412      +24     
  Branches    16497    16503       +6     
==========================================
+ Hits        91853    91863      +10     
- Misses      24649    24663      +14     
  Partials      886      886              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

dkostic
dkostic previously approved these changes Dec 2, 2025
@samuel40791765 samuel40791765 enabled auto-merge (squash) December 2, 2025 18:37
@samuel40791765 samuel40791765 merged commit 0336dd7 into aws:main Dec 2, 2025
479 of 488 checks passed
samuel40791765 added a commit to samuel40791765/aws-lc that referenced this pull request Dec 2, 2025
ACVP has support for a new test vectors that test against the
encapsulation/decapsulation key checks defined in FIPS 203.
> Adds "encapsulationKeyCheck" and "decapsulationKeyCheck" as functions
for ML-KEM Encap/Decap FIPS203 to exercise an implementation's
capability to perform the Encapsulation Key Check in FIPS 203 Section
7.2 and the Decapsulation Key Check in FIPS 203 Section 7.3. These tests
are only included if the appropriate function is present in the
registration. They operate by providing a valid or invalid key and
expecting the IUT to return a true for a valid key or false for an
invalid key.

* https://github.com/usnistgov/ACVP-Server/releases

This add support in ACVP to run against the relevant
`crypto_kem_check_pk` and `crypto_kem_check_sk` functions that do the
checks for us. Also added the new `encapsulationKeyCheck` and
`decapsulationKeyCheck` test vectors in `ML-KEM.bz2`.

### Call-outs:
N/A

### Testing:
new `encapsulationKeyCheck` and `decapsulationKeyCheck` test vectors in
`ML-KEM.bz2`

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.

(cherry picked from commit 0336dd7)
samuel40791765 added a commit to samuel40791765/aws-lc that referenced this pull request Dec 2, 2025
ACVP has support for a new test vectors that test against the
encapsulation/decapsulation key checks defined in FIPS 203.
> Adds "encapsulationKeyCheck" and "decapsulationKeyCheck" as functions
for ML-KEM Encap/Decap FIPS203 to exercise an implementation's
capability to perform the Encapsulation Key Check in FIPS 203 Section
7.2 and the Decapsulation Key Check in FIPS 203 Section 7.3. These tests
are only included if the appropriate function is present in the
registration. They operate by providing a valid or invalid key and
expecting the IUT to return a true for a valid key or false for an
invalid key.

* https://github.com/usnistgov/ACVP-Server/releases

This add support in ACVP to run against the relevant
`crypto_kem_check_pk` and `crypto_kem_check_sk` functions that do the
checks for us. Also added the new `encapsulationKeyCheck` and
`decapsulationKeyCheck` test vectors in `ML-KEM.bz2`.

N/A

new `encapsulationKeyCheck` and `decapsulationKeyCheck` test vectors in
`ML-KEM.bz2`

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.
@samuel40791765 samuel40791765 deleted the mlkem-key-check branch December 2, 2025 22:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants