The deliverable
What you’re licensing
mldsasample is the sampling stage of post-quantum ML-DSA (Dilithium, It is delivered as a licensable soft-IP block engineered as an ASIL-B Safety Element out of Context — not just RTL, but the complete functional-safety work package needed to carry it into an ISO 26262 program:
Synthesizable RTL
Portable, vendor-neutral SystemVerilog that drops onto your existing SoC fabric — no foundry or EDA-tool lock-in.
Per-IP FMEDA report
SPFM / LFM / PMHF computed against the ASIL target per ISO 26262-5 — the quantitative analysis your assessor asks for.
Safety manual
Assumptions of use, the safety mechanisms and their diagnostic coverage — written to drop straight into your safety case.
IP-XACT + integration docs
A machine-readable descriptor plus register and integration documentation for fast, low-risk bring-up.
Self-checking testbench
A self-checking (crypto: bit-exact) testbench and a one-command build, so you can reproduce every claim on day one.
mldsa_sample is the sampling stage of post-quantum ML-DSA (Dilithium, FIPS 204) signatures — a bare compute core that turns pseudorandomness (a Keccak SHAKE byte stream) into the structured polynomials Dilithium signs with.
Key Features
- Four samplers on one shared datapath: ExpandA (rej_uniform, 3 B → 23-bit, accept < q) for the uniform matrix Â, ExpandS (rej_eta, nibble → [−η,η], η=4) for s1/s2, ExpandMask (unpack_gamma1, 20-bit fixed unpack, y = γ1−value) for the masking vector, and SampleInBall (Fisher-Yates placement of τ=49 ±1 coefficients) for the challenge c
- External byte-stream load plane — wr_en/wr_addr[10:0]/wr_data[7:0] into a 1024×8 byte RAM, buf_len[10:0] gating valid length — with the sponge (SHAKE-128/256) kept outside the core so it stays independently bit-exact-verifiable
- 256×32 signed coefficient RAM read back over rd_addr/rd_data, with coeff_cnt tracking accepts and underrun flagging a rejection buffer (ExpandA/ExpandS) exhausted before 256 coefficients
- Deterministic ExpandMask path needs no retry: exactly 640 bytes (128×5) always yield all 256 coefficients, no rejection involved
- Control-FSM duplicate-DMR safety check (err_code 9) plus an op-sequence parity check (err_code 1), both into a shared safety_monitor
- DFT fault-injection strobes fi_parity/fi_dmr exercise the err_code 1/err_code 9 paths in verification (tie 0 in mission mode)
- Verified bit-exact against the pq-crystals dilithium golden (tools/mldsa_sample_gold.py), which self-checks coefficient ranges and the τ-cardinality of the challenge; FMEDA (informational preview): SPFM 91.93%, LFM 94.82%, PMHF 2.28×10⁻⁸/h
Standards & Compliance
FIPS 204 (ML-DSA/Dilithium: ExpandA/ExpandS/ExpandMask/SampleInBall samplers); ISO 26262 ASIL-B SEooC, informational preview (SPFM 91.93%, LFM 94.82%, PMHF 2.28×10⁻⁸/h)
Functional Safety
ASIL-B (SEooC) · SPFM 91.93% · LFM 94.82% · PASS
ISO 26262:2018 · FMEDA available · Safety Manual included
Register Map
See datasheet for full register reference.
Getting Started
// Minimal instantiation
mldsa_sample #(
.ADDR_W(6)
) u_mldsa_sample (
.clk (clk),
.rst_n (rst_n),
// APB4
.p_paddr (paddr),
.p_psel (psel),
.p_penable (penable),
.p_pwrite (pwrite),
.p_pwdata (pwdata),
.p_prdata (prdata),
.p_pready (pready),
// Safety
.err_clear (1'b0),
.err_valid (err_valid),
.err_code (err_code)
);
Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.
Applications
Where it fits
Typically deployed in secure boot, firmware authentication, key storage, and confidential on-board communication.
Figures are pre-silicon engineering-grade estimates for a Safety Element out of Context (SEooC); final ASIL sign-off is the integrator’s, supported under NDA. FMEDA and Safety Manual available under NDA.