Document ML-KEM key check wrapper commands The module wrapper implements ML-KEM encapsulation and decapsulation key checks, but the ACVP protocol command table does not list them. Add both commands and document the validity flag encoding for wrapper implementations. Change-Id: Ifcf21967d91158b15da94a3272b7bccc19e41dfe Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101207 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com>
diff --git a/util/fipstools/acvp/ACVP.md b/util/fipstools/acvp/ACVP.md index 0056b9f..5d1a073 100644 --- a/util/fipstools/acvp/ACVP.md +++ b/util/fipstools/acvp/ACVP.md
@@ -144,6 +144,8 @@ | ML-KEM-XX/encap | Public key, entropy | Ciphertext, shared secret | | ML-KEM-XX/decap | Private key, ciphertext | Shared secret | | ML-KEM-XX/decap/seed | Seed (d ‖ z), ciphertext | Shared secret | +| ML-KEM-XX/encapKeyCheck | Public key | Single-byte validity flag | +| ML-KEM-XX/decapKeyCheck | Private key | Single-byte validity flag | | SLH-DSA-XX/keyGen | Seed | Private key, public key | | SLH-DSA-XX/sigGen | Private key, message, entropy or empty | Signature | | SLH-DSA-XX/sigVer | Public key, message, signature | Single-byte validity flag | @@ -154,6 +156,8 @@ | KTS-IFC/<HASH>/responder/crt | iutN bytes, iutE bytes, iutP bytes, iutQ bytes, iutDmp1 bytes, iutDmq1 bytes, iutIqmp bytes, ciphertext (serverC) bytes | derived keying material (dkm) | | OneStepNoCounter/<HASH> | key, info, salt, output length bytes | derived key | +Validity flags are encoded as a single byte: zero is false and non-zero is true. + ¹ The iterated tests would result in excessive numbers of round trips if the module wrapper handled only basic operations. Thus some ACVP logic is pushed down for these tests so that the inner loop can be handled locally. Either read the NIST documentation ([block-ciphers](https://pages.nist.gov/ACVP/draft-celi-acvp-symmetric.html#name-monte-carlo-tests-for-block) [hashes](https://pages.nist.gov/ACVP/draft-celi-acvp-sha.html#name-monte-carlo-tests-for-sha-1)) to understand the iteration count and return values or, probably more fruitfully, see how these functions are handled in the `modulewrapper` directory. ² Will always be one because MCT tests are not supported for CS3.