Repository navigation
mlkem: add re-encryption comparison vectors to the seed-key files - #274
Merged
Merged
Conversation
One MLKEMTest group per parameter set: single-byte, message-preserving ciphertext modifications that a conforming decapsulation implicitly rejects. More: https://github.com/007bsd/mlkem-implicit-rejection
cpu
approved these changes
Aug 31, 2026
cpu
left a comment
cpu
left a comment
Member
There was a problem hiding this comment.
Thanks! This looks great.
Did you have any feedback about the process & vectorgen? Was it relatively painless? 🤞
Contributor
Author
Thanks! Along with the CVEs above, these also cover the RustSec advisory I filed (#3151) -- same implicit-rejection class. The process was smooth. My only real question was whether these belonged with the decap vectors or in their own group. We went with a separate group, and vectorgen was easy to work with from there. |
Member
|
I'm going to merge this but if anyone shows up with feedback after the fact we can iterate further. Thanks for the contribution! |
007bsd
added a commit
to 007bsd/mlkem-cmov-key-recovery
that referenced
this pull request
Sep 18, 2026
…vectors A conforming decapsulation must reject the tampered ciphertexts in the merged C2SP/wycheproof#274 re-encryption comparison vectors (ML-KEM-512/768/1024). The skipped-cmov fault accepts every ciphertext, so it fails them outright. Link the canonical suite and the generator repo 007bsd/mlkem-implicit-rejection so a reader can check their own build.
007bsd
added a commit
to 007bsd/ml-kem-key-recovery
that referenced
this pull request
Sep 18, 2026
…vectors The merged C2SP/wycheproof#274 re-encryption comparison vectors (ML-KEM-512/768/ 1024) are tampered ciphertexts a conforming decapsulation must reject; an incomplete FO comparison fails them. Link the canonical suite and the generator repo 007bsd/mlkem-implicit-rejection so a reader can check their own build.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds message-preserving ML-KEM re-encryption test vectors to the seed-key files
(mlkem_{512,768,1024}_test.json): each fails to decapsulate on a correct
implementation but returns the real shared secret on one that skips part of the
ciphertext comparison.
#254 added this kind of vector only to the semi-expanded decaps files; the
seed-key files have none (their existing reject vectors change the message, so
they cannot isolate a single-region skip). This adds one MLKEMTest group per
parameter set (7/8/9 tests), one single-byte modification per structural region:
byte 0, each c1 block boundary, and c2 start / interior / N-32 / last.
Motivated by the incomplete-comparison class behind CVE-2026-10097 and
CVE-2026-6330 (public, fixed); submitted post-fix per CONTRIBUTING. Generator and
cross-checks (OpenSSL, wolfSSL, Go crypto/mlkem):
https://github.com/007bsd/mlkem-implicit-rejection