ML-KEM Key-Encapsulation Mechanism (Kyber)

mlkem_kem is the complete ML-KEM key-encapsulation mechanism (FIPS 203, formerly CRYSTALS-Kyber) — the NIST-standardized, quantum-resistant replacement for RSA/ECDH key exchange — built as one parameterized RTL core covering all three NIST security levels (ML-KEM-512/768/1024, delivered as mlkem_kem_512 / mlkem_kem / mlkem_kem_1024).

Key Features

• Full KeyGen/Encaps/Decaps orchestrator at NIST Level 3 (K=3, ETA1=ETA2=2, DU=10, DV=4): ek 1184 B, dk 2400 B, ciphertext c 1088 B, 32 B shared secret — the same verified RTL as ML-KEM-512/1024 via parameter override (mlkem_kem_512 / mlkem_kem_1024)
• Captive orchestrator, not a bus peripheral: byte-wide in_sel load (d/z/m/ek/dk/c, idle-only), cmd/start handshake (0=KeyGen, 1=Encaps, 2=Decaps), out_sel read-back (ek/dk/c/shared-secret)
• Sequences 5 independently bit-exact ML-KEM primitives (kem_sponge, sample_ntt, mlkem_cbd, mlkem_ntt, mlkem_pack) through K-PKE + the Fujisaki-Okamoto transform around one shared central polynomial RAM
• Fujisaki-Okamoto implicit-reject: a tampered ciphertext never raises a decryption-error signal, it silently returns a deterministic pseudo-secret K̄=J(z‖c); the re-encryption compare walks the full ciphertext unconditionally, so the reject path carries no timing side channel
• ASIL-B overlay in one safety_monitor: control-FSM duplicate-DMR incl. the Keccak-f[1600] permutation’s own spatial-DMR compare → err_code 9; op-sequence parity → err_code 1 (fi_parity DFT hook, tie 0 in mission); central polynomial/byte-RAM SECDED is a documented integrator Assumption of Use → err_code 2
• Bit-exact verified against the FIPS 203 golden reference at all three NIST levels: KeyGen ek/dk, Encaps c/K, Decaps K’==K plus the implicit-reject branch (make mlkem_kem / mlkem_kem_512 / mlkem_kem_1024)
• Pre-sign-off FMEDA: SPFM 93.91% and LFM 94.86% pass ASIL-B with margin; PMHF 1.38×10⁻⁷/h (1.4× over target) is dominated by the polynomial/byte-RAM region (54.1 of 137.7 residual FIT), flagged for the SECDED wrap + measured-DC refinement

Standards & Compliance

NIST FIPS 203 (ML-KEM/Kyber, Level 3 default; Level 1/5 via mlkem_kem_512/_1024); FIPS 202 (SHA-3/SHAKE); ISO 26262 ASIL-B SEooC, informational preview (SPFM 93.91%, LFM 94.86%, PMHF 1.38×10⁻⁷/h pre-sign-off)

Functional Safety

ASIL-B (SEooC) · SPFM 93.91% · LFM 94.86% · FAIL

ISO 26262:2018 · FMEDA available · Safety Manual included

Register Map

See datasheet for full register reference.

Getting Started

// Minimal instantiation
mlkem_kem #(
  .ADDR_W(6)
) u_mlkem_kem (
  .clk       (clk),
  .rst_n     (rst_n),
  // APB4
  .p_paddr   (paddr),
  .p_psel    (psel),
  .p_penable (penable),
  .p_pwrite  (pwrite),
  .p_pwdata  (pwdata),
  .p_prdata  (prdata),
  .p_pready  (pready),
  // Safety
  .err_clear (1'b0),
  .err_valid (err_valid),
  .err_code  (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.