ML-KEM-512 Key-Encapsulation Mechanism

Post-quantum key-encapsulation mechanism, ML-KEM-512 (FIPS 203, NIST security Level 1). ISO 26262 ASIL-B SEooC (informational preview). ## 1.

Key Features

• Complete NIST Level-1 KEM in one orchestrator: KeyGen (ek 800 B / dk 1632 B), Encaps (c 768 B + 32 B shared secret), Decaps (32 B shared secret or deterministic implicit-reject) from seeds d/z/m via a single host byte-load/read-back interface
• Same verified silicon as ML-KEM-768/1024 — only the (K=2, ETA1=3, DU=10, DV=4) parameter set changes, so a design that qualifies the 768/1024 orchestrator inherits the same control-flow and safety-mechanism verification at Level 1
• Drives five independently bit-exact primitives (Keccak sponge, sample_ntt, mlkem_cbd, mlkem_ntt, mlkem_pack) through K-PKE + the Fujisaki-Okamoto transform, so every arithmetic stage is individually golden-checked, not just the end-to-end result
• Fujisaki-Okamoto implicit-reject: a tampered ciphertext c never triggers a decryption error signal — it silently produces a deterministic pseudo-secret K̄, closing the CCA2 decryption-oracle side channel at the protocol level
• Control-FSM duplicate-DMR (err_code 9) that also folds in the Keccak-f[1600] permutation’s spatial-DMR compare, plus op-sequence parity (err_code 1), both reported through one shared safety_monitor with err_clear/err_valid/err_code handshake
• Single clock domain, no internal CDC — host byte-load (in_wr_en/in_sel/in_addr/in_data) and read-back (out_sel/out_addr/out_data) planes keep seed/key/ciphertext material entirely inside one synchronous fabric clock
• Bit-exact verified against the FIPS 203 reference at Level 1 (make mlkem_kem_512): KeyGen ek/dk, Encaps c/K, Decaps K’==K, plus FSM-DMR -> err 9 and op-parity -> err 1 fault-injection checks

Standards & Compliance

NIST FIPS 203 (Module-Lattice-Based Key-Encapsulation Mechanism), NIST security Level 1; FIPS 202 (SHA3/SHAKE); ISO 26262 ASIL-B SEooC — pre-sign-off engineering FMEDA: SPFM 93.91% (pass), LFM 94.86% (pass), PMHF 3.81×10⁻⁸/h (informational preview, 1.1× over target)

Functional Safety

ASIL-B target (SEooC) · SPFM 93.91% · LFM 94.86% · Informational — not gated

Informational FMEDA — this IP is reported but NOT gated. The SPFM/LFM figures above are engineering estimates from a model that is not held to the ASIL metric gates (QM, safety-by-composition, a vendor-core overlay, or a pre-sign-off Technology Preview, depending on the IP). They are not a certification claim and must not be relied on as one. See the safety manual for this IP’s exact status, assumptions of use, and any open items.

ISO 26262:2018 · FMEDA available · Safety Manual included

Register Map

See datasheet for full register reference.

Getting Started

// Minimal instantiation
mlkem_kem_512 #(
 .ADDR_W(6)
) u_mlkem_kem_512 (
 .clk (clk),
 .rst_n (rst_n),
 // APB4
 .p_paddr (paddr),
 .p_psel (psel),
 .p_penable (penable),
 .p_pwrite (pwrite),
 .p_pwdata (pwdata),
 .p_prdata (prdata),
 .p_pready (pready),
 // Safety
 .err_clear (1'b0),
 .err_valid (err_valid),
 .err_code (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.