Integrate Wycheproof ML-KEM test vectors#2891
Merged
Conversation
### Issues: Integrating Wycheproof ML-KEM test vectors. ### Description of changes: Integrates all 6 Wycheproof ML-KEM test vector files: - 3 ML-KEM encapsulation test files (mlkem_512_encaps_test, mlkem_768_encaps_test, mlkem_1024_encaps_test) - 3 ML-KEM decapsulation test files (mlkem_512_test, mlkem_768_test, mlkem_1024_test) Each integration adds upstream JSON vectors and converted txt files to `third_party/vectors/`, and adds test code with duvet annotations for traceability. ### Call-outs: - We successfully import ML-KEM encapsulation keys with modulus overflow. This is allowed by FIPS 203, but is not ideal, so the tests print a warning. - Decapsulation tests have only one test case per parameter set. We will add more vectors in follow-up PR. ### Testing: All new tests pass and duvet verification succeeds: ```bash cd build && ./crypto/crypto_test --gtest_filter="*Wycheproof*" cd third_party/vectors && python3 sync.py ``` By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2891 +/- ##
=======================================
Coverage 78.07% 78.07%
=======================================
Files 682 682
Lines 118273 118355 +82
Branches 16607 16611 +4
=======================================
+ Hits 92336 92410 +74
- Misses 25050 25055 +5
- Partials 887 890 +3 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Contributor
Author
|
I added some noseed decaps test vectors to see how we handle invalid decaps keys, and similarly to encaps, we successfully import invalid decaps keys, but do not successfully decaps with them. This also seems not-ideal. |
justsmth
previously approved these changes
Dec 9, 2025
dkostic
previously approved these changes
Jan 14, 2026
Contributor
dkostic
left a comment
There was a problem hiding this comment.
Great work, thanks for doing this!
justsmth
previously approved these changes
Jan 20, 2026
justsmth
approved these changes
Jan 20, 2026
dkostic
approved these changes
Jan 20, 2026
Merged
justsmth
added a commit
that referenced
this pull request
Jan 22, 2026
### Description of changes: Prepare AWS-LC v1.67.0 #### What's Changed * Migrate Wycheproof test vectors for ECDSA, RSA PKCS#1, and some more by @sgmenda in #2887 * increase timeout for SDE tests by @sgmenda in #2936 * Rename volatile state/memory to unique state/memory by @torben-hansen in #2935 * Fix failing Windows Docker image build by @nhatnghiho in #2931 * Service Indicator: Add error call trampoline to avoid delocator issue by @jakemas in #2920 * Add support for Big Endian in ACVP tool by @samuel40791765 in #2938 * AES-GCM: Add function pointer trampolines to avoid delocator issue by @jakemas in #2919 * Use already defined macro for no inline by @torben-hansen in #2942 * Remove Kyber completely by @torben-hansen in #2941 * Windows 7 support by @justsmth in #2940 * Import mldsa-native by @jakemas in #2902 * Use existing session context if new is actually NULL by @torben-hansen in #2946 * Integrate Wycheproof ML-KEM test vectors by @sgmenda in #2891 * Avoid cross-compilation build failure by @justsmth in #2944 By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes:
Integrates 9 Wycheproof ML-KEM test vector files:
Each integration adds upstream JSON vectors and converted txt files to
third_party/vectors/, and adds test code with duvet annotations for traceability.Call-outs:
mlkem_[512/768/1024]thu_semi_expanded_decaps_test) are new, and have been merged into upstream Add ML-KEM decapsulation validation test vectors C2SP/wycheproof#202. Addsutil/vecgenthat we used to generate the test vectors.Testing:
All new tests pass and duvet verification succeeds:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.