ML-KEM Key-Encapsulation Mechanism (Kyber)

mlkem_kem is the complete ML-KEM key-encapsulation mechanism (FIPS 203, formerly CRYSTALS-Kyber) — the NIST-standardized, quantum-resistant replacement for RSA/ECDH key exchange — built as one parameterized RTL core covering all three NIST security levels (ML-KEM-512/768/1024, delivered as mlkem_kem_512 / mlkem_kem / mlkem_kem_1024).

Key Features

• Full KeyGen/Encaps/Decaps orchestrator at NIST Level 3 (K=3, ETA1=ETA2=2, DU=10, DV=4): ek 1184 B, dk 2400 B, ciphertext c 1088 B, 32 B shared secret — the same verified RTL as ML-KEM-512/1024 via parameter override (mlkem_kem_512 / mlkem_kem_1024)
• Captive orchestrator, not a bus peripheral: byte-wide in_sel load (d/z/m/ek/dk/c, idle-only), cmd/start handshake (0=KeyGen, 1=Encaps, 2=Decaps), out_sel read-back (ek/dk/c/shared-secret)
• Sequences 5 independently bit-exact ML-KEM primitives (kem_sponge, sample_ntt, mlkem_cbd, mlkem_ntt, mlkem_pack) through K-PKE + the Fujisaki-Okamoto transform around one shared central polynomial RAM
• Fujisaki-Okamoto implicit-reject: a tampered ciphertext never raises a decryption-error signal, it silently returns a deterministic pseudo-secret K̄=J(z‖c); the re-encryption compare walks the full ciphertext unconditionally, so the reject path carries no timing side channel
• ASIL-B overlay in one safety_monitor: control-FSM duplicate-DMR incl. the Keccak-f[1600] permutation’s own spatial-DMR compare → err_code 9; op-sequence parity → err_code 1 (fi_parity DFT hook, tie 0 in mission); central polynomial/byte-RAM SECDED is a documented integrator Assumption of Use → err_code 2
• Bit-exact verified against the FIPS 203 golden reference at all three NIST levels: KeyGen ek/dk, Encaps c/K, Decaps K’==K plus the implicit-reject branch (make mlkem_kem / mlkem_kem_512 / mlkem_kem_1024)
• Pre-sign-off FMEDA: SPFM 93.91% and LFM 94.86% pass ASIL-B with margin; PMHF 4.04×10⁻⁸/h (1.4× over target) is dominated by the polynomial/byte-RAM region (54.1 of 137.7 residual FIT), flagged for the SECDED wrap + measured-DC refinement

Standards & Compliance

NIST FIPS 203 (ML-KEM/Kyber, Level 3 default; Level 1/5 via mlkem_kem_512/_1024); FIPS 202 (SHA-3/SHAKE); ISO 26262 ASIL-B SEooC, informational preview (SPFM 93.91%, LFM 94.86%, PMHF 4.04×10⁻⁸/h pre-sign-off)

Functional Safety

ASIL-B target (SEooC) · SPFM 93.91% · LFM 94.86% · Informational — not gated

Informational FMEDA — this IP is reported but NOT gated. The SPFM/LFM figures above are engineering estimates from a model that is not held to the ASIL metric gates (QM, safety-by-composition, a vendor-core overlay, or a pre-sign-off Technology Preview, depending on the IP). They are not a certification claim and must not be relied on as one. See the safety manual for this IP’s exact status, assumptions of use, and any open items.

ISO 26262:2018 · FMEDA available · Safety Manual included

Register Map

See datasheet for full register reference.

Getting Started

// Minimal instantiation
mlkem_kem #(
 .ADDR_W(6)
) u_mlkem_kem (
 .clk (clk),
 .rst_n (rst_n),
 // APB4
 .p_paddr (paddr),
 .p_psel (psel),
 .p_penable (penable),
 .p_pwrite (pwrite),
 .p_pwdata (pwdata),
 .p_prdata (prdata),
 .p_pready (pready),
 // Safety
 .err_clear (1'b0),
 .err_valid (err_valid),
 .err_code (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.