pq_crypto 0.6.4 → 0.6.6

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/armv81m/src/{state_xor_bytes_x4_mve.S → keccak_f1600_x4_state_xor_bytes_mve.S}

@@ -61,7 +61,7 @@
 
 /*
  * WARNING: This file is auto-derived from the mlkem-native source file
- *   dev/fips202/armv81m/src/state_xor_bytes_x4_mve.S using scripts/simpasm. Do not modify it directly.
+ *   dev/fips202/armv81m/src/keccak_f1600_x4_state_xor_bytes_mve.S using scripts/simpasm. Do not modify it directly.
  */
 
 .thumb
@@ -98,13 +98,13 @@ MLK_ASM_FN_SYMBOL(keccak_f1600_x4_state_xor_bytes_asm)
         ldr.w r10, [sp, #0x6c]
         ldr r6, [sp, #0x70]
         cmp r6, #0x0
-        beq.w Lkeccak_f1600_x4_state_xor_bytes_asm_exit @ imm = #0x346
+        beq.w Lmlk_keccak_f1600_x4_state_xor_bytes_asm_exit @ imm = #0x346
         and r5, r10, #0x7
         bic r9, r10, #0x7
         add.w r8, r0, r9, lsl #1
         add.w r7, r8, #0x190
         cmp r5, #0x0
-        beq.w Lkeccak_f1600_x4_state_xor_bytes_asm_pre_main @ imm = #0x12c
+        beq.w Lmlk_keccak_f1600_x4_state_xor_bytes_asm_pre_main @ imm = #0x12c
         subs r1, r1, r5
         subs r2, r2, r5
         subs r3, r3, r5
@@ -183,19 +183,19 @@ MLK_ASM_FN_SYMBOL(keccak_f1600_x4_state_xor_bytes_asm)
         vstrw.32 q5, [r7], #16
         vmov q7[2], q7[0], r1, r3
         vmov q7[3], q7[1], r2, r4
-        b Lkeccak_f1600_x4_state_xor_bytes_asm_main_body @ imm = #0xe
+        b Lmlk_keccak_f1600_x4_state_xor_bytes_asm_main_body @ imm = #0xe
 
-Lkeccak_f1600_x4_state_xor_bytes_asm_pre_main:
+Lmlk_keccak_f1600_x4_state_xor_bytes_asm_pre_main:
         vmov q7[2], q7[0], r1, r3
         vmov q7[3], q7[1], r2, r4
         mov.w r0, #0x4
         vsub.i32 q7, q7, r0
 
-Lkeccak_f1600_x4_state_xor_bytes_asm_main_body:
+Lmlk_keccak_f1600_x4_state_xor_bytes_asm_main_body:
         lsr.w lr, r6, #0x3
-        wls lr, lr, Lkeccak_f1600_x4_state_xor_bytes_asm_main_loop_end @ imm = #0xd4
+        wls lr, lr, Lmlk_keccak_f1600_x4_state_xor_bytes_asm_main_loop_end @ imm = #0xd4
 
-Lkeccak_f1600_x4_state_xor_bytes_asm_main_loop_start:
+Lmlk_keccak_f1600_x4_state_xor_bytes_asm_main_loop_start:
         vldrw.u32 q0, [q7, #4]!
         vldrw.u32 q1, [q7, #4]!
         vmov q2, q0
@@ -248,11 +248,11 @@ Lkeccak_f1600_x4_state_xor_bytes_asm_main_loop_start:
         veor q5, q5, q1
         vstrw.32 q4, [r8], #16
         vstrw.32 q5, [r7], #16
-        le lr, Lkeccak_f1600_x4_state_xor_bytes_asm_main_loop_start @ imm = #-0xd4
+        le lr, Lmlk_keccak_f1600_x4_state_xor_bytes_asm_main_loop_start @ imm = #-0xd4
 
-Lkeccak_f1600_x4_state_xor_bytes_asm_main_loop_end:
+Lmlk_keccak_f1600_x4_state_xor_bytes_asm_main_loop_end:
         ands r6, r6, #0x7
-        beq.w Lkeccak_f1600_x4_state_xor_bytes_asm_exit @ imm = #0x110
+        beq.w Lmlk_keccak_f1600_x4_state_xor_bytes_asm_exit @ imm = #0x110
         mov.w r0, #0x4
         vadd.i32 q7, q7, r0
         vmov r1, r3, q7[2], q7[0]
@@ -322,7 +322,7 @@ Lkeccak_f1600_x4_state_xor_bytes_asm_main_loop_end:
         vstrw.32 q4, [r8], #16
         vstrw.32 q5, [r7], #16
 
-Lkeccak_f1600_x4_state_xor_bytes_asm_exit:
+Lmlk_keccak_f1600_x4_state_xor_bytes_asm_exit:
         vpop {d8, d9, d10, d11, d12, d13, d14, d15}
         .cfi_restore d8
         .cfi_restore d9

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/x86_64/keccak_f1600_x4_avx2.h

@@ -11,7 +11,7 @@
 #define MLK_FIPS202_X86_64_NEED_X4_AVX2
 
 /* Part of backend API */
-#define MLK_USE_FIPS202_X4_NATIVE
+#define MLK_USE_NATIVE_FIPS202_X4
 
 #if !defined(__ASSEMBLER__)
 #include "../api.h"
@@ -19,7 +19,7 @@
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_keccak_f1600_x4_native(uint64_t *state)
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/x86_64/src/keccak_f1600_x4_avx2_asm.S

@@ -6,6 +6,40 @@
 
 #if defined(MLK_FIPS202_X86_64_NEED_X4_AVX2) && \
     !defined(MLK_CONFIG_MULTILEVEL_NO_SHARED)
+/*yaml
+  Name: keccak_f1600_x4_avx2_asm
+  Description: x86_64 AVX2 Keccak-f[1600] permutation for four sequential states
+  Signature: void mlk_keccak_f1600_x4_avx2_asm(uint64_t states[100], const uint64_t rc[24], const uint64_t rho8[4], const uint64_t rho56[4])
+  ABI:
+    Architecture: x86_64
+    CallingConvention: SysV
+    Features: [AVX2]
+    rdi:
+      type: buffer
+      size_bytes: 800
+      permissions: read/write
+      c_parameter: uint64_t states[100]
+      description: Four sequential Keccak states (4 x 25 x uint64_t)
+    rsi:
+      type: buffer
+      size_bytes: 192
+      permissions: read-only
+      c_parameter: const uint64_t rc[24]
+      description: Round constants (24 x uint64_t)
+    rdx:
+      type: buffer
+      size_bytes: 32
+      permissions: read-only
+      c_parameter: const uint64_t rho8[4]
+      description: Rotation constant rho8 (4 x uint64_t)
+    rcx:
+      type: buffer
+      size_bytes: 32
+      permissions: read-only
+      c_parameter: const uint64_t rho56[4]
+      description: Rotation constant rho56 (4 x uint64_t)
+*/
+
 
 /*
  * WARNING: This file is auto-derived from the mlkem-native source file
@@ -119,7 +153,7 @@ MLK_ASM_FN_SYMBOL(keccak_f1600_x4_avx2_asm)
         vinserti128 $0x1, %xmm0, %ymm1, %ymm2
         movq $0x0, %r10
 
-LLkeccak_f1600_x4_avx2:
+LLmlk_keccak_f1600_x4_avx2:
         vmovdqu 0xa0(%rsp), %ymm4
         vpxor 0x1c0(%rsp), %ymm9, %ymm0
         vmovdqu %ymm9, 0x200(%rsp)
@@ -343,7 +377,7 @@ LLkeccak_f1600_x4_avx2:
         addq $0x8, %rsi
         addq $0x1, %r10
         cmpq $0x18, %r10
-        jne LLkeccak_f1600_x4_avx2
+        jne LLmlk_keccak_f1600_x4_avx2
         vmovdqu (%rsp), %ymm4
         vmovdqu 0x40(%rsp), %ymm5
         vmovdqu 0x20(%rsp), %ymm0

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/indcpa.c

@@ -55,6 +55,7 @@
  *                  [0,..,MLKEM_Q-1].
  * @param[in]  seed Input public seed.
  */
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 static void mlk_pack_pk(uint8_t r[MLKEM_INDCPA_PUBLICKEYBYTES],
                         const mlk_polyvec *pk,
                         const uint8_t seed[MLKEM_SYMBYTES])
@@ -63,6 +64,7 @@ static void mlk_pack_pk(uint8_t r[MLKEM_INDCPA_PUBLICKEYBYTES],
   mlk_polyvec_tobytes(r, pk);
   mlk_memcpy(r + MLKEM_POLYVECBYTES, seed, MLKEM_SYMBYTES);
 }
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
 /**
  * De-serialize public key from a byte array; approximate inverse of
@@ -75,6 +77,7 @@ static void mlk_pack_pk(uint8_t r[MLKEM_INDCPA_PUBLICKEYBYTES],
  * @param[out] seed     Output seed to generate matrix A.
  * @param[in]  packedpk Input serialized public key.
  */
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 static void mlk_unpack_pk(mlk_polyvec *pk, uint8_t seed[MLKEM_SYMBYTES],
                           const uint8_t packedpk[MLKEM_INDCPA_PUBLICKEYBYTES])
 {
@@ -86,6 +89,7 @@ static void mlk_unpack_pk(mlk_polyvec *pk, uint8_t seed[MLKEM_SYMBYTES],
    * specifications and proofs, however, do _not_ assume this, and instead
    * work with the easily provable bound by MLKEM_UINT12_LIMIT. */
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 /**
  * Serialize the secret key.
@@ -95,12 +99,14 @@ static void mlk_unpack_pk(mlk_polyvec *pk, uint8_t seed[MLKEM_SYMBYTES],
  * @param[out] r  Output serialized secret key.
  * @param[in]  sk Input vector of polynomials (secret key).
  */
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 static void mlk_pack_sk(uint8_t r[MLKEM_INDCPA_SECRETKEYBYTES],
                         const mlk_polyvec *sk)
 {
   mlk_assert_bound_2d(sk->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q);
   mlk_polyvec_tobytes(r, sk);
 }
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
 /**
  * De-serialize the secret key; inverse of mlk_pack_sk.
@@ -110,11 +116,13 @@ static void mlk_pack_sk(uint8_t r[MLKEM_INDCPA_SECRETKEYBYTES],
  * @param[out] sk       Output vector of polynomials (secret key).
  * @param[in]  packedsk Input serialized secret key.
  */
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 static void mlk_unpack_sk(mlk_polyvec *sk,
                           const uint8_t packedsk[MLKEM_INDCPA_SECRETKEYBYTES])
 {
   mlk_polyvec_frombytes(sk, packedsk);
 }
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
 /**
  * Serialize the ciphertext as the concatenation of the compressed and
@@ -127,12 +135,14 @@ static void mlk_unpack_sk(mlk_polyvec *sk,
  * @param[in]  b Input vector of polynomials b.
  * @param[in]  v Input polynomial v.
  */
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 static void mlk_pack_ciphertext(uint8_t r[MLKEM_INDCPA_BYTES],
                                 const mlk_polyvec *b, mlk_poly *v)
 {
   mlk_polyvec_compress_du(r, b);
   mlk_poly_compress_dv(r + MLKEM_POLYVECCOMPRESSEDBYTES_DU, v);
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 /**
  * De-serialize and decompress ciphertext from a byte array; approximate
@@ -144,12 +154,14 @@ static void mlk_pack_ciphertext(uint8_t r[MLKEM_INDCPA_BYTES],
  * @param[out] v Output polynomial v.
  * @param[in]  c Input serialized ciphertext.
  */
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 static void mlk_unpack_ciphertext(mlk_polyvec *b, mlk_poly *v,
                                   const uint8_t c[MLKEM_INDCPA_BYTES])
 {
   mlk_polyvec_decompress_du(b, c);
   mlk_poly_decompress_dv(v, c + MLKEM_POLYVECCOMPRESSEDBYTES_DU);
 }
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
 /* Helper function to ensure that the polynomial entries in the output
  * of gen_matrix use the standard (bitreversed) ordering of coefficients.
@@ -345,6 +357,7 @@ __contract__(
  * @param[out] e    Output polynomial vector.
  * @param[in]  seed Seed bytes for sampling.
  */
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 static void mlk_keypair_getnoise_eta1(mlk_polyvec *pv, mlk_polyvec *e,
                                       const uint8_t seed[MLKEM_SYMBYTES])
 __contract__(
@@ -378,6 +391,7 @@ __contract__(
                             seed, 4, 5, 6, 7);
 #endif /* MLKEM_K == 4 */
 }
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
 /**
  * Compute and fill the sp, ep, and epp polynomial structures needed by
@@ -391,6 +405,7 @@ __contract__(
  * @param[out] epp   Output polynomial.
  * @param[in]  coins Seed bytes for sampling.
  */
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 static void mlk_enc_getnoise_eta1_eta2(mlk_polyvec *sp, mlk_polyvec *ep,
                                        mlk_poly *epp,
                                        const uint8_t coins[MLKEM_SYMBYTES])
@@ -429,6 +444,7 @@ __contract__(
   mlk_poly_getnoise_eta2(epp, coins, 8);
 #endif /* MLKEM_K == 4 */
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 
 /* Reference: `indcpa_keypair_derand()` in the reference implementation @[REF].
@@ -437,6 +453,7 @@ __contract__(
  *            - We use a mulcache to speed up matrix-vector multiplication.
  *            - We include buffer zeroization.
  */
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 MLK_INTERNAL_API
 int mlk_indcpa_keypair_derand(uint8_t pk[MLKEM_INDCPA_PUBLICKEYBYTES],
                               uint8_t sk[MLKEM_INDCPA_SECRETKEYBYTES],
@@ -508,6 +525,7 @@ cleanup:
   MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context);
   return ret;
 }
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
 /* Reference: `indcpa_enc()` in the reference implementation @[REF].
  *            - We use x4-batched versions of `poly_getnoise` to leverage
@@ -517,6 +535,7 @@ cleanup:
  *            - We use a mulcache to speed up matrix-vector multiplication.
  *            - We include buffer zeroization.
  */
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 MLK_INTERNAL_API
 int mlk_indcpa_enc(uint8_t c[MLKEM_INDCPA_BYTES],
                    const uint8_t m[MLKEM_INDCPA_MSGBYTES],
@@ -591,10 +610,12 @@ cleanup:
   MLK_FREE(seed, uint8_t, MLKEM_SYMBYTES, context);
   return ret;
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 /* Reference: `indcpa_dec()` in the reference implementation @[REF].
  *            - We use a mulcache for the scalar product.
  *            - We include buffer zeroization. */
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 MLK_INTERNAL_API
 int mlk_indcpa_dec(uint8_t m[MLKEM_INDCPA_MSGBYTES],
                    const uint8_t c[MLKEM_INDCPA_BYTES],
@@ -637,6 +658,7 @@ cleanup:
   MLK_FREE(b, mlk_polyvec, 1, context);
   return ret;
 }
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
 /* To facilitate single-compilation-unit (SCU) builds, undefine all macros.
  * Don't modify by hand -- this is auto-generated by scripts/autogen. */

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/indcpa.h

@@ -45,6 +45,7 @@ __contract__(
   array_bound(a->vec[x].vec[y].coeffs, 0, MLKEM_N, 0, MLKEM_Q))))
 );
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 #define mlk_indcpa_keypair_derand \
   MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3
 /**
@@ -63,10 +64,8 @@ __contract__(
  *                     MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          MLK_CONFIG_KEYGEN_PCT enabled and PCT failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
- * @retval MLK_ERR_RNG_FAIL      Random number generation failed.
  */
 MLK_INTERNAL_API
 MLK_MUST_CHECK_RETURN_VALUE
@@ -80,11 +79,16 @@ __contract__(
   requires(memory_no_alias(coins, MLKEM_SYMBYTES))
   assigns(memory_slice(pk, MLKEM_INDCPA_PUBLICKEYBYTES))
   assigns(memory_slice(sk, MLKEM_INDCPA_SECRETKEYBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
-          return_value == MLK_ERR_OUT_OF_MEMORY ||
-          return_value == MLK_ERR_RNG_FAIL)
+  ensures(return_value == 0 || return_value == MLK_ERR_OUT_OF_MEMORY)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(pk, MLKEM_INDCPA_PUBLICKEYBYTES))
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(sk, MLKEM_INDCPA_SECRETKEYBYTES))
 );
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4
 /**
  * Encryption function of the CPA-secure public-key encryption scheme
@@ -103,7 +107,6 @@ __contract__(
  *                     MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          Operation failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  */
@@ -120,10 +123,14 @@ __contract__(
   requires(memory_no_alias(pk, MLKEM_INDCPA_PUBLICKEYBYTES))
   requires(memory_no_alias(coins, MLKEM_SYMBYTES))
   assigns(memory_slice(c, MLKEM_INDCPA_BYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
-          return_value == MLK_ERR_OUT_OF_MEMORY)
+  ensures(return_value == 0 || return_value == MLK_ERR_OUT_OF_MEMORY)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(c, MLKEM_INDCPA_BYTES))
 );
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3
 /**
  * Decryption function of the CPA-secure public-key encryption scheme
@@ -141,7 +148,6 @@ __contract__(
  *                     MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          Operation failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  */
@@ -156,8 +162,11 @@ __contract__(
   requires(memory_no_alias(m, MLKEM_INDCPA_MSGBYTES))
   requires(memory_no_alias(sk, MLKEM_INDCPA_SECRETKEYBYTES))
   assigns(memory_slice(m, MLKEM_INDCPA_MSGBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
-          return_value == MLK_ERR_OUT_OF_MEMORY)
+  ensures(return_value == 0 || return_value == MLK_ERR_OUT_OF_MEMORY)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(m, MLKEM_INDCPA_MSGBYTES))
 );
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
 #endif /* !MLK_INDCPA_H */

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/kem.c

@@ -37,6 +37,7 @@
 #define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2
 /* End of parameter set namespacing */
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API)
 /* Reference: Not implemented in the reference implementation @[REF]. */
 MLK_EXTERNAL_API
 MLK_MUST_CHECK_RETURN_VALUE
@@ -59,7 +60,8 @@ int mlk_kem_check_pk(const uint8_t pk[MLKEM_INDCCA_PUBLICKEYBYTES],
 
   /* We use a constant-time memcmp here to avoid having to
    * declassify the PK before the PCT has succeeded. */
-  ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0;
+  ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_INVALID_PK
+                                                           : 0;
 
 cleanup:
   /* Specification: Partially implements
@@ -68,8 +70,10 @@ cleanup:
   MLK_FREE(p, mlk_polyvec, 1, context);
   return ret;
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API */
 
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 /* Reference: Not implemented in the reference implementation @[REF]. */
 MLK_EXTERNAL_API
 MLK_MUST_CHECK_RETURN_VALUE
@@ -104,7 +108,7 @@ int mlk_kem_check_sk(const uint8_t sk[MLKEM_INDCCA_SECRETKEYBYTES],
    * of minimizing stdlib dependency, we use our constant-time one anyway. */
   ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES,
                       test, MLKEM_SYMBYTES)
-            ? MLK_ERR_FAIL
+            ? MLK_ERR_INVALID_SK
             : 0;
 
 cleanup:
@@ -113,7 +117,9 @@ cleanup:
   MLK_FREE(test, uint8_t, MLKEM_SYMBYTES, context);
   return ret;
 }
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 MLK_MUST_CHECK_RETURN_VALUE
 static int mlk_check_pct(uint8_t const pk[MLKEM_INDCCA_PUBLICKEYBYTES],
                          uint8_t const sk[MLKEM_INDCCA_SECRETKEYBYTES],
@@ -121,9 +127,9 @@ static int mlk_check_pct(uint8_t const pk[MLKEM_INDCCA_PUBLICKEYBYTES],
 __contract__(
   requires(memory_no_alias(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
   requires(memory_no_alias(sk, MLKEM_INDCCA_SECRETKEYBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
-          return_value == MLK_ERR_OUT_OF_MEMORY ||
-          return_value == MLK_ERR_RNG_FAIL)
+  ensures(return_value == 0 || return_value == MLK_ERR_OUT_OF_MEMORY ||
+          return_value == MLK_ERR_RNG_FAIL ||
+          return_value == MLK_ERR_PCT_FAIL)
 );
 
 #if defined(MLK_CONFIG_KEYGEN_PCT)
@@ -131,7 +137,13 @@ __contract__(
  * Partially implements 'Pairwise Consistency Test' @[FIPS140_3_IG, p.87] and
  * @[FIPS203, Section 7.1, Pairwise Consistency]. */
 
-/* Reference: Not implemented in the reference implementation @[REF]. */
+/* Reference: Not implemented in the reference implementation @[REF].
+ *
+ * @retval 0                     Success.
+ * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
+ *                               MLK_CUSTOM_ALLOC returned NULL.
+ * @retval MLK_ERR_RNG_FAIL      Random number generation failed.
+ * @retval MLK_ERR_PCT_FAIL      The consistency check failed. */
 MLK_MUST_CHECK_RETURN_VALUE
 static int mlk_check_pct(uint8_t const pk[MLKEM_INDCCA_PUBLICKEYBYTES],
                          uint8_t const sk[MLKEM_INDCCA_SECRETKEYBYTES],
@@ -174,7 +186,7 @@ static int mlk_check_pct(uint8_t const pk[MLKEM_INDCCA_PUBLICKEYBYTES],
 
   if (ret != 0)
   {
-    ret = MLK_ERR_FAIL;
+    ret = MLK_ERR_PCT_FAIL;
   }
 
 cleanup:
@@ -184,9 +196,21 @@ cleanup:
   MLK_FREE(ss_dec, uint8_t, MLKEM_SSBYTES, context);
   MLK_FREE(ss_enc, uint8_t, MLKEM_SSBYTES, context);
   MLK_FREE(ct, uint8_t, MLKEM_INDCCA_CIPHERTEXTBYTES, context);
+
+  /* The key pair being tested was just generated by this library, so a key
+   * check rejecting it hints at a faulty implementation rather than at bad
+   * input. Report it as a PCT failure. */
+  if (ret == MLK_ERR_INVALID_PK || ret == MLK_ERR_INVALID_SK)
+  {
+    ret = MLK_ERR_PCT_FAIL;
+  }
+
+  /* Other error codes, e.g. platform failures like out of memory or
+   * randomness failure, are passed on unmodified. */
+
   return ret;
 }
-#else /* MLK_CONFIG_KEYGEN_PCT */
+#else  /* MLK_CONFIG_KEYGEN_PCT */
 MLK_MUST_CHECK_RETURN_VALUE
 static int mlk_check_pct(uint8_t const pk[MLKEM_INDCCA_PUBLICKEYBYTES],
                          uint8_t const sk[MLKEM_INDCCA_SECRETKEYBYTES],
@@ -195,9 +219,7 @@ static int mlk_check_pct(uint8_t const pk[MLKEM_INDCCA_PUBLICKEYBYTES],
   /* Skip PCT */
   ((void)pk);
   ((void)sk);
-#if defined(MLK_CONFIG_CONTEXT_PARAMETER)
-  ((void)context);
-#endif
+  MLK_CONTEXT_UNUSED(context);
   return 0;
 }
 #endif /* !MLK_CONFIG_KEYGEN_PCT */
@@ -207,6 +229,7 @@ static int mlk_check_pct(uint8_t const pk[MLKEM_INDCCA_PUBLICKEYBYTES],
  *            - We optionally include PCT which is not present in
  *              the reference code. */
 MLK_EXTERNAL_API
+MLK_MUST_CHECK_RETURN_VALUE
 int mlk_kem_keypair_derand(uint8_t pk[MLKEM_INDCCA_PUBLICKEYBYTES],
                            uint8_t sk[MLKEM_INDCCA_SECRETKEYBYTES],
                            const uint8_t coins[2 * MLKEM_SYMBYTES],
@@ -282,7 +305,9 @@ cleanup:
   return ret;
 }
 #endif /* !MLK_CONFIG_NO_RANDOMIZED_API */
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API)
 /* Reference: `crypto_kem_enc_derand()` in the reference implementation @[REF]
  *            - We include public key check
  *            - We include stack buffer zeroization */
@@ -368,7 +393,9 @@ cleanup:
   return ret;
 }
 #endif /* !MLK_CONFIG_NO_RANDOMIZED_API */
+#endif /* !MLK_CONFIG_NO_ENCAPS_API */
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 /* Reference: `crypto_kem_dec()` in the reference implementation @[REF]
  *            - We include secret key check
  *            - We include stack buffer zeroization */
@@ -440,6 +467,7 @@ cleanup:
 
   return ret;
 }
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
 /* To facilitate single-compilation-unit (SCU) builds, undefine all macros.
  * Don't modify by hand -- this is auto-generated by scripts/autogen. */