ML-KEM / Kyber CBD Noise Sampler

mlkem_cbd is the centered-binomial-distribution (CBD) noise sampler of post-quantum ML-KEM (Kyber, FIPS 203) and ML-DSA (Dilithium, FIPS 204), turning the pseudorandom byte stream produced by the PRF (SHAKE-256) into the small “noise” polynomials that hide Kyber’s secrets.

Key Features

• Centered-binomial-distribution sampling for η ∈ {2, 3} (η₁/η₂ across the Kyber parameter sets): a = popcount(first η bits), b = popcount(next η bits), coefficient = a − b ∈ [−η, η], one coefficient per cycle (256 cycles/poly)
• Bare compute core: no bus, no register file — direct PRF byte-buffer load and coefficient read-back plus an eta/start/busy/done handshake, meant to sit behind a host or orchestrator sequencer
• Drop-in engine for mlkem_kem’s FIPS 203 KeyGen/Encaps/Decaps orchestrator: one of five shared compute engines behind a generic LOAD → RUN → READ phase sequencer, selected per noise term via cb_eta = ETA1/ETA2
• Bit-exact against the pq-crystals golden model (tools/mlkem_cbd_gold.py, cross-checked vs cbd2/cbd3): both η=2 and η=3 match 256/256 sampled coefficients
• Control-FSM duplicate-DMR (err_code 9) feeding a shared safety_monitor, with DFT fault-injection ports (fi_parity/fi_dmr) to prove the mechanisms — an ISO 26262 ASIL-B SEooC building block
• Coefficient-RAM SECDED is a stated integrator Assumption of Use (wrap in ecc_sram, credited at its measured DC) — the real protection against a corrupted PRF byte stream, since the coeff-count parity line is DFT-only in this revision
• FMEDA PASS at ASIL-B — SPFM 92.01%, LFM 94.66%, PMHF 2.05×10⁻⁸/h (informational Technology-Preview)

Standards & Compliance

FIPS 203 (ML-KEM/Kyber) and FIPS 204 (ML-DSA/Dilithium) noise sampling, pq-crystals reference algorithms; ISO 26262 ASIL-B SEooC (SPFM 92.01%, LFM 94.66%, PMHF 2.05×10⁻⁸/h, informational Technology-Preview)

Functional Safety

ASIL-B (SEooC) · SPFM 92.01% · LFM 94.66% · PASS

ISO 26262:2018 · FMEDA available · Safety Manual included

Register Map

See datasheet for full register reference.

Getting Started

// Minimal instantiation
mlkem_cbd #(
  .ADDR_W(6)
) u_mlkem_cbd (
  .clk       (clk),
  .rst_n     (rst_n),
  // APB4
  .p_paddr   (paddr),
  .p_psel    (psel),
  .p_penable (penable),
  .p_pwrite  (pwrite),
  .p_pwdata  (pwdata),
  .p_prdata  (prdata),
  .p_pready  (pready),
  // Safety
  .err_clear (1'b0),
  .err_valid (err_valid),
  .err_code  (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.