@quantakrypto/sieve 0.1.0

package/dist/categories/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../src/categories/helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAiB,MAAM,gBAAgB,CAAC;AAIxD,qDAAqD;AACrD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGzB;IAFlB,YACE,OAAe,EACC,QAAkB;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,aAAQ,GAAR,QAAQ,CAAU;QAGlC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,KAAe,EACf,IAAa;IAEb,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,EAAE,QAAQ;QAChB,KAAK;QACL,EAAE,EAAE,QAAQ;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,KAAe,EACf,KAAa,EACb,KAAc;IAEd,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,EAAE,QAAQ;QAChB,KAAK;QACL,EAAE,EAAE,QAAQ;QACZ,EAAE,EAAE,KAAK;QACT,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,KAAe,EACf,KAAa,EACb,KAAa;IAEb,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,KAAe,EACf,KAAa,EACb,KAAa;IAEb,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,KAAe,EAAE,KAAa;IACzE,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,SAAS,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,GAAI,GAAG,CAAC,GAAG,CAAY,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,UAAU,CAAC,CAAqB;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,CAAa,CAAC;AACvB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAa,EACb,KAAa,EACb,IAA+B;IAE/B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,UAA6B,CAAC;IAElC,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,OAAO,UAAU,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO;YACnB,IAAI,CAAC;gBACH,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,UAAU,KAAK,SAAS;oBAAE,UAAU,GAAG,GAAY,CAAC;gBACxD,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,UAAU,CAAC;IAC/C,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/categories/implicit-rejection.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Implicit-rejection category — AF-02 family (ML-KEM).
+ *
+ * ML-KEM uses the Fujisaki-Okamoto transform with *implicit rejection*: when
+ * decapsulation receives a ciphertext that does not re-encrypt to itself, it
+ * MUST NOT signal an error. Instead it derives a pseudo-random shared secret
+ * from the secret key and the (rejected) ciphertext — a deterministic value
+ * that an attacker cannot distinguish from a real one without the key.
+ *
+ * Concretely, for a corrupted ciphertext ct', a conforming SUT must:
+ *   1. NOT return an error or crash (it returns ok with an `ss`);
+ *   2. return a shared secret of the correct length;
+ *   3. be deterministic: decaps(sk, ct') is stable across repeated calls;
+ *   4. return a value that differs from the honest decaps(sk, ct).
+ *
+ * We make NO exact-value assertions — the implicit-rejection secret is
+ * implementation-internal and we never fabricate it. We only assert the
+ * observable structural properties above.
+ *
+ * Common AF-02 bugs this catches:
+ *   - returning an error/throwing on bad ct (leaks validity — Kyber's whole
+ *     point is to avoid this),
+ *   - returning a zero/constant ss (the "reject" secret isn't keyed),
+ *   - returning the honest ss anyway (no integrity check),
+ *   - non-deterministic reject secret.
+ */
+import { type Category } from "./types.js";
+export declare const implicitRejection: Category;
+//# sourceMappingURL=implicit-rejection.d.ts.map

package/dist/categories/implicit-rejection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"implicit-rejection.d.ts","sourceRoot":"","sources":["../../src/categories/implicit-rejection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,KAAK,QAAQ,EAOd,MAAM,YAAY,CAAC;AAgBpB,eAAO,MAAM,iBAAiB,EAAE,QAoI/B,CAAC"}

package/dist/categories/implicit-rejection.js

@@ -0,0 +1,126 @@
+/**
+ * Implicit-rejection category — AF-02 family (ML-KEM).
+ *
+ * ML-KEM uses the Fujisaki-Okamoto transform with *implicit rejection*: when
+ * decapsulation receives a ciphertext that does not re-encrypt to itself, it
+ * MUST NOT signal an error. Instead it derives a pseudo-random shared secret
+ * from the secret key and the (rejected) ciphertext — a deterministic value
+ * that an attacker cannot distinguish from a real one without the key.
+ *
+ * Concretely, for a corrupted ciphertext ct', a conforming SUT must:
+ *   1. NOT return an error or crash (it returns ok with an `ss`);
+ *   2. return a shared secret of the correct length;
+ *   3. be deterministic: decaps(sk, ct') is stable across repeated calls;
+ *   4. return a value that differs from the honest decaps(sk, ct).
+ *
+ * We make NO exact-value assertions — the implicit-rejection secret is
+ * implementation-internal and we never fabricate it. We only assert the
+ * observable structural properties above.
+ *
+ * Common AF-02 bugs this catches:
+ *   - returning an error/throwing on bad ct (leaks validity — Kyber's whole
+ *     point is to avoid this),
+ *   - returning a zero/constant ss (the "reject" secret isn't keyed),
+ *   - returning the honest ss anyway (no integrity check),
+ *   - non-deterministic reject secret.
+ */
+import { fail, pass, rollUp, skip, } from "./types.js";
+import { bytesEqual, flipBitB64, kemDecaps, kemDecapsRaw, kemEncaps, kemKeygen, requireKem, UnexpectedResponse, } from "./helpers.js";
+import { fromB64, toB64 } from "../protocol.js";
+const BUG = "AF-02";
+const REPEATS = 3;
+export const implicitRejection = async (ctx) => {
+    const checks = [];
+    if (ctx.sizes.family !== "ml-kem") {
+        return {
+            category: "implicit-rejection",
+            status: "skip",
+            bugClass: BUG,
+            checks: [skip("applicability", "implicit rejection is an ML-KEM property", BUG)],
+            summary: "skipped (not ML-KEM)",
+        };
+    }
+    const km = requireKem(ctx.sizes);
+    const param = km.id;
+    const ssLen = km.sharedSecret;
+    // Iterate over several fresh keys, corrupting one bit of each honest ct.
+    const trials = Math.max(1, Math.min(ctx.iterations, 16));
+    let noError = 0;
+    let goodLen = 0;
+    let deterministic = 0;
+    let differs = 0;
+    let attempted = 0;
+    for (let i = 0; i < trials; i++) {
+        try {
+            const { pk, sk } = await kemKeygen(ctx.runner, param);
+            const skB64 = toB64(sk);
+            const { ct } = await kemEncaps(ctx.runner, param, toB64(pk));
+            const honestCtB64 = toB64(ct);
+            const honestSs = await kemDecaps(ctx.runner, param, skB64, honestCtB64);
+            // Corrupt a different byte/bit each iteration so we exercise variety.
+            const badCtB64 = flipBitB64(honestCtB64, i % ct.length, i % 8);
+            attempted++;
+            // (1) must NOT error and must NOT crash.
+            const resp = await kemDecapsRaw(ctx.runner, param, skB64, badCtB64);
+            if (resp.ok !== true || !("ss" in resp)) {
+                checks.push(fail(`no-error[${i}]`, `decaps of a corrupted ciphertext returned an error/non-ss response ` +
+                    `(${resp.ok === false ? `${resp.code}: ${resp.message}` : "no ss field"}); ` +
+                    `ML-KEM must implicitly reject, not signal failure`, BUG));
+                continue;
+            }
+            noError++;
+            const rejectSs = fromB64(resp.ss);
+            // (2) correct length.
+            if (rejectSs.length === ssLen) {
+                goodLen++;
+            }
+            else {
+                checks.push(fail(`length[${i}]`, `implicit-rejection shared secret was ${rejectSs.length} bytes, expected ${ssLen}`, BUG));
+            }
+            // (3) deterministic for the same corrupted ct.
+            let stable = true;
+            for (let r = 1; r < REPEATS; r++) {
+                const again = await kemDecaps(ctx.runner, param, skB64, badCtB64);
+                if (!bytesEqual(rejectSs, again)) {
+                    stable = false;
+                    break;
+                }
+            }
+            if (stable) {
+                deterministic++;
+            }
+            else {
+                checks.push(fail(`deterministic[${i}]`, `implicit-rejection secret was not stable across ${REPEATS} identical corrupted decaps`, BUG));
+            }
+            // (4) differs from the honest shared secret.
+            if (!bytesEqual(rejectSs, honestSs)) {
+                differs++;
+            }
+            else {
+                checks.push(fail(`differs-from-honest[${i}]`, `implicit-rejection secret equals the honest shared secret — ` +
+                    `corruption was not detected`, BUG));
+            }
+        }
+        catch (err) {
+            const detail = err instanceof UnexpectedResponse
+                ? `SUT returned an unexpected response: ${err.message}`
+                : `harness error (possible crash on bad ct): ${err.message}`;
+            checks.push(fail(`trial[${i}]`, detail, BUG));
+        }
+    }
+    if (attempted > 0 && checks.length === 0) {
+        checks.push(pass("implicit-rejection", `${noError}/${attempted} corrupted ciphertexts implicitly rejected: ` +
+            `no error, correct length, deterministic, distinct from honest ss`, BUG));
+    }
+    const status = rollUp(checks);
+    return {
+        category: "implicit-rejection",
+        status,
+        bugClass: BUG,
+        checks,
+        summary: status === "pass"
+            ? `${attempted} corrupted ciphertexts handled by implicit rejection`
+            : `implicit-rejection violations detected (no-error:${noError} len:${goodLen} det:${deterministic} differs:${differs} of ${attempted})`,
+    };
+};
+//# sourceMappingURL=implicit-rejection.js.map

package/dist/categories/implicit-rejection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"implicit-rejection.js","sourceRoot":"","sources":["../../src/categories/implicit-rejection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAIL,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,IAAI,GACL,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,UAAU,EACV,UAAU,EACV,SAAS,EACT,YAAY,EACZ,SAAS,EACT,SAAS,EACT,UAAU,EACV,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,GAAG,GAAG,OAAgB,CAAC;AAC7B,MAAM,OAAO,GAAG,CAAC,CAAC;AAElB,MAAM,CAAC,MAAM,iBAAiB,GAAa,KAAK,EAAE,GAAG,EAA2B,EAAE;IAChF,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO;YACL,QAAQ,EAAE,oBAAoB;YAC9B,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,0CAA0C,EAAE,GAAG,CAAC,CAAC;YAChF,OAAO,EAAE,sBAAsB;SAChC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC;IAE9B,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;YACxB,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;YAExE,sEAAsE;YACtE,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,SAAS,EAAE,CAAC;YAEZ,yCAAyC;YACzC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpE,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CACT,IAAI,CACF,YAAY,CAAC,GAAG,EAChB,qEAAqE;oBACnE,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK;oBAC5E,mDAAmD,EACrD,GAAG,CACJ,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,OAAO,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAElC,sBAAsB;YACtB,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC9B,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,IAAI,CACF,UAAU,CAAC,GAAG,EACd,wCAAwC,QAAQ,CAAC,MAAM,oBAAoB,KAAK,EAAE,EAClF,GAAG,CACJ,CACF,CAAC;YACJ,CAAC;YAED,+CAA+C;YAC/C,IAAI,MAAM,GAAG,IAAI,CAAC;YAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAClE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;oBACjC,MAAM,GAAG,KAAK,CAAC;oBACf,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,aAAa,EAAE,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,IAAI,CACF,iBAAiB,CAAC,GAAG,EACrB,mDAAmD,OAAO,6BAA6B,EACvF,GAAG,CACJ,CACF,CAAC;YACJ,CAAC;YAED,6CAA6C;YAC7C,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,IAAI,CACF,uBAAuB,CAAC,GAAG,EAC3B,8DAA8D;oBAC5D,6BAA6B,EAC/B,GAAG,CACJ,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GACV,GAAG,YAAY,kBAAkB;gBAC/B,CAAC,CAAC,wCAAwC,GAAG,CAAC,OAAO,EAAE;gBACvD,CAAC,CAAC,6CAA8C,GAAa,CAAC,OAAO,EAAE,CAAC;YAC5E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CACT,IAAI,CACF,oBAAoB,EACpB,GAAG,OAAO,IAAI,SAAS,8CAA8C;YACnE,kEAAkE,EACpE,GAAG,CACJ,CACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO;QACL,QAAQ,EAAE,oBAAoB;QAC9B,MAAM;QACN,QAAQ,EAAE,GAAG;QACb,MAAM;QACN,OAAO,EACL,MAAM,KAAK,MAAM;YACf,CAAC,CAAC,GAAG,SAAS,sDAAsD;YACpE,CAAC,CAAC,oDAAoD,OAAO,QAAQ,OAAO,QAAQ,aAAa,YAAY,OAAO,OAAO,SAAS,GAAG;KAC5I,CAAC;AACJ,CAAC,CAAC"}

package/dist/categories/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Category registry. Each entry is selected by family so the runner only
+ * executes categories relevant to the parameter set under test.
+ */
+import type { Category } from "./types.js";
+import type { Family } from "../sizes.js";
+import { correctness } from "./correctness.js";
+import { determinism } from "./determinism.js";
+import { implicitRejection } from "./implicit-rejection.js";
+import { sizes } from "./sizes.js";
+import { robustness } from "./robustness.js";
+import { dsa } from "./dsa.js";
+import { slhDsa } from "./slh-dsa.js";
+import { kat } from "./kat.js";
+import { timing } from "./timing.js";
+export * from "./types.js";
+/** A named, family-scoped category. */
+export interface RegisteredCategory {
+    name: string;
+    family: Family | "any";
+    /** Whether the category runs by default (timing is opt-in). */
+    defaultOn: boolean;
+    run: Category;
+}
+/** The full catalog, in execution order. */
+export declare const CATEGORIES: readonly RegisteredCategory[];
+/** Categories applicable to a family (plus family-agnostic ones). */
+export declare function categoriesFor(family: Family, includeTiming: boolean): RegisteredCategory[];
+export { correctness, determinism, implicitRejection, sizes, robustness, dsa, slhDsa, kat, timing };
+//# sourceMappingURL=index.d.ts.map

package/dist/categories/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/categories/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,cAAc,YAAY,CAAC;AAE3B,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IACvB,+DAA+D;IAC/D,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED,4CAA4C;AAC5C,eAAO,MAAM,UAAU,EAAE,SAAS,kBAAkB,EAUnD,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,kBAAkB,EAAE,CAM1F;AAED,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC"}

package/dist/categories/index.js

@@ -0,0 +1,33 @@
+/**
+ * Category registry. Each entry is selected by family so the runner only
+ * executes categories relevant to the parameter set under test.
+ */
+import { correctness } from "./correctness.js";
+import { determinism } from "./determinism.js";
+import { implicitRejection } from "./implicit-rejection.js";
+import { sizes } from "./sizes.js";
+import { robustness } from "./robustness.js";
+import { dsa } from "./dsa.js";
+import { slhDsa } from "./slh-dsa.js";
+import { kat } from "./kat.js";
+import { timing } from "./timing.js";
+export * from "./types.js";
+/** The full catalog, in execution order. */
+export const CATEGORIES = [
+    { name: "correctness", family: "ml-kem", defaultOn: true, run: correctness },
+    { name: "determinism", family: "ml-kem", defaultOn: true, run: determinism },
+    { name: "implicit-rejection", family: "ml-kem", defaultOn: true, run: implicitRejection },
+    { name: "sizes", family: "ml-kem", defaultOn: true, run: sizes },
+    { name: "robustness", family: "ml-kem", defaultOn: true, run: robustness },
+    { name: "dsa", family: "ml-dsa", defaultOn: true, run: dsa },
+    { name: "slh-dsa", family: "slh-dsa", defaultOn: true, run: slhDsa },
+    { name: "kat", family: "any", defaultOn: true, run: kat },
+    { name: "timing", family: "ml-kem", defaultOn: false, run: timing },
+];
+/** Categories applicable to a family (plus family-agnostic ones). */
+export function categoriesFor(family, includeTiming) {
+    return CATEGORIES.filter((c) => (c.family === family || c.family === "any") &&
+        (c.defaultOn || (c.name === "timing" && includeTiming)));
+}
+export { correctness, determinism, implicitRejection, sizes, robustness, dsa, slhDsa, kat, timing };
+//# sourceMappingURL=index.js.map

package/dist/categories/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/categories/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,cAAc,YAAY,CAAC;AAW3B,4CAA4C;AAC5C,MAAM,CAAC,MAAM,UAAU,GAAkC;IACvD,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE;IAC5E,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE;IAC5E,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE;IACzF,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE;IAChE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE;IAC1E,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE;IAC5D,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE;IACpE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE;IACzD,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE;CACpE,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,aAAsB;IAClE,OAAO,UAAU,CAAC,MAAM,CACtB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;QAC3C,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC"}

package/dist/categories/kat.d.ts

@@ -0,0 +1,21 @@
+/**
+ * KAT category — Known-Answer Tests against OFFICIAL NIST ACVP vectors.
+ *
+ * This category is SKIPPED unless the user supplies `--vectors <dir>` with real
+ * ACVP files. Sieve never fabricates expected values; if no vectors are
+ * present, every check is a `skip` with a clear message pointing at
+ * vectors/README.md.
+ *
+ * What we check when vectors ARE present:
+ *   - kem-keygen: if a seed is given, deterministic keygen must reproduce the
+ *     expected pk/sk exactly. (Skipped if the SUT can't do seeded keygen.)
+ *   - kem-encap: if coins are given, deterministic encaps must reproduce ct/ss.
+ *   - kem-decap: decaps(sk, ct) must equal the expected ss exactly.
+ *   - dsa-verify: verify(pk, msg, sig) must equal the expected verdict.
+ *
+ * These ARE exact-value assertions — but the expected bytes come from the
+ * user's NIST files, not from Sieve.
+ */
+import { type Category } from "./types.js";
+export declare const kat: Category;
+//# sourceMappingURL=kat.d.ts.map

package/dist/categories/kat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kat.d.ts","sourceRoot":"","sources":["../../src/categories/kat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,KAAK,QAAQ,EAOd,MAAM,YAAY,CAAC;AAKpB,eAAO,MAAM,GAAG,EAAE,QAmFjB,CAAC"}

package/dist/categories/kat.js

@@ -0,0 +1,173 @@
+/**
+ * KAT category — Known-Answer Tests against OFFICIAL NIST ACVP vectors.
+ *
+ * This category is SKIPPED unless the user supplies `--vectors <dir>` with real
+ * ACVP files. Sieve never fabricates expected values; if no vectors are
+ * present, every check is a `skip` with a clear message pointing at
+ * vectors/README.md.
+ *
+ * What we check when vectors ARE present:
+ *   - kem-keygen: if a seed is given, deterministic keygen must reproduce the
+ *     expected pk/sk exactly. (Skipped if the SUT can't do seeded keygen.)
+ *   - kem-encap: if coins are given, deterministic encaps must reproduce ct/ss.
+ *   - kem-decap: decaps(sk, ct) must equal the expected ss exactly.
+ *   - dsa-verify: verify(pk, msg, sig) must equal the expected verdict.
+ *
+ * These ARE exact-value assertions — but the expected bytes come from the
+ * user's NIST files, not from Sieve.
+ */
+import { fail, pass, rollUp, skip, } from "./types.js";
+import { bytesEqual } from "./helpers.js";
+import { fromB64, toB64 } from "../protocol.js";
+import { loadVectors } from "../vectors.js";
+export const kat = async (ctx) => {
+    if (!ctx.vectorsDir) {
+        return {
+            category: "kat",
+            status: "skip",
+            checks: [
+                skip("vectors", "no --vectors <dir> supplied; Sieve ships no test vectors and will not " +
+                    "fabricate them. See vectors/README.md to obtain official NIST ACVP files."),
+            ],
+            summary: "skipped — no official vectors provided",
+        };
+    }
+    const checks = [];
+    let loaded;
+    try {
+        loaded = loadVectors(ctx.vectorsDir);
+    }
+    catch (err) {
+        return {
+            category: "kat",
+            status: "fail",
+            checks: [
+                fail("load", `could not load vectors from ${ctx.vectorsDir}: ${err.message}`),
+            ],
+            summary: "vector load failed",
+        };
+    }
+    for (const note of loaded.notes.slice(0, 10)) {
+        checks.push(skip("note", note));
+    }
+    // Only run vectors matching the parameter set under test.
+    const param = ctx.sizes.id;
+    const relevant = loaded.vectors.filter((v) => v.param === param);
+    if (relevant.length === 0) {
+        checks.push(skip("applicable", `loaded ${loaded.vectors.length} vector(s) from ${loaded.files.length} file(s), ` +
+            `but none for ${param}`));
+        const status = rollUp(checks);
+        return { category: "kat", status, checks, summary: `no ${param} vectors among supplied files` };
+    }
+    let okCount = 0;
+    let idx = 0;
+    for (const v of relevant) {
+        idx++;
+        try {
+            const result = await checkVector(ctx, v);
+            if (result.ok) {
+                okCount++;
+                // Keep the report compact: don't push a pass per vector.
+            }
+            else {
+                checks.push(fail(`${v.kind}[${idx}]`, result.detail, undefined));
+            }
+        }
+        catch (err) {
+            checks.push(fail(`${v.kind}[${idx}]`, `harness error: ${err.message}`));
+        }
+    }
+    if (okCount > 0) {
+        checks.push(pass("kat", `${okCount}/${relevant.length} ${param} vectors matched expected values`));
+    }
+    const status = rollUp(checks);
+    return {
+        category: "kat",
+        status,
+        checks,
+        summary: status === "pass"
+            ? `${okCount} ${param} KAT vectors passed`
+            : `${checks.filter((c) => c.status === "fail").length} KAT mismatch(es)`,
+    };
+};
+async function checkVector(ctx, v) {
+    const { runner } = ctx;
+    const param = v.param;
+    switch (v.kind) {
+        case "kem-keygen": {
+            if (!v.seed)
+                return { ok: true, detail: "no seed; skipped" };
+            const resp = await runner.send({
+                family: "ml-kem",
+                param,
+                op: "keygen",
+                seed: toB64(v.seed),
+            });
+            if (resp.ok !== true || !("pk" in resp) || !("sk" in resp)) {
+                return {
+                    ok: false,
+                    detail: "seeded keygen did not return pk/sk (SUT may not support seeds)",
+                };
+            }
+            const pkOk = bytesEqual(fromB64(resp.pk), v.pk);
+            const skOk = bytesEqual(fromB64(resp.sk), v.sk);
+            return pkOk && skOk
+                ? { ok: true, detail: "pk/sk match" }
+                : { ok: false, detail: `seeded keygen mismatch (pkOk=${pkOk}, skOk=${skOk})` };
+        }
+        case "kem-encap": {
+            if (!v.coins)
+                return { ok: true, detail: "no coins; skipped" };
+            const resp = await runner.send({
+                family: "ml-kem",
+                param,
+                op: "encaps",
+                pk: toB64(v.pk),
+                coins: toB64(v.coins),
+            });
+            if (resp.ok !== true || !("ct" in resp) || !("ss" in resp)) {
+                return {
+                    ok: false,
+                    detail: "deterministic encaps did not return ct/ss (SUT may not support coins)",
+                };
+            }
+            const ctOk = bytesEqual(fromB64(resp.ct), v.ct);
+            const ssOk = bytesEqual(fromB64(resp.ss), v.ss);
+            return ctOk && ssOk
+                ? { ok: true, detail: "ct/ss match" }
+                : { ok: false, detail: `encaps mismatch (ctOk=${ctOk}, ssOk=${ssOk})` };
+        }
+        case "kem-decap": {
+            const resp = await runner.send({
+                family: "ml-kem",
+                param,
+                op: "decaps",
+                sk: toB64(v.sk),
+                ct: toB64(v.ct),
+            });
+            if (resp.ok !== true || !("ss" in resp)) {
+                return { ok: false, detail: "decaps did not return ss" };
+            }
+            return bytesEqual(fromB64(resp.ss), v.ss)
+                ? { ok: true, detail: "ss matches" }
+                : { ok: false, detail: "decaps shared secret does not match expected" };
+        }
+        case "dsa-verify": {
+            const resp = await runner.send({
+                family: "ml-dsa",
+                param,
+                op: "verify",
+                pk: toB64(v.pk),
+                msg: toB64(v.msg),
+                sig: toB64(v.sig),
+            });
+            if (resp.ok !== true || !("valid" in resp)) {
+                return { ok: false, detail: "verify did not return a 'valid' verdict" };
+            }
+            return resp.valid === v.expected
+                ? { ok: true, detail: `verdict ${resp.valid} matches expected` }
+                : { ok: false, detail: `verify returned ${resp.valid}, expected ${v.expected}` };
+        }
+    }
+}
+//# sourceMappingURL=kat.js.map

package/dist/categories/kat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kat.js","sourceRoot":"","sources":["../../src/categories/kat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAIL,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,IAAI,GACL,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAe,MAAM,eAAe,CAAC;AAEzD,MAAM,CAAC,MAAM,GAAG,GAAa,KAAK,EAAE,GAAG,EAA2B,EAAE;IAClE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,MAAM;YACd,MAAM,EAAE;gBACN,IAAI,CACF,SAAS,EACT,wEAAwE;oBACtE,2EAA2E,CAC9E;aACF;YACD,OAAO,EAAE,wCAAwC;SAClD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,MAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,MAAM;YACd,MAAM,EAAE;gBACN,IAAI,CAAC,MAAM,EAAE,+BAA+B,GAAG,CAAC,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC;aACzF;YACD,OAAO,EAAE,oBAAoB;SAC9B,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,0DAA0D;IAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,IAAI,CACF,YAAY,EACZ,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,mBAAmB,MAAM,CAAC,KAAK,CAAC,MAAM,YAAY;YAC/E,gBAAgB,KAAK,EAAE,CAC1B,CACF,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,+BAA+B,EAAE,CAAC;IAClG,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,GAAG,EAAE,CAAC;QACN,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,EAAE,CAAC;gBACV,yDAAyD;YAC3D,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,GAAG,EAAE,kBAAmB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,KAAK,EAAE,GAAG,OAAO,IAAI,QAAQ,CAAC,MAAM,IAAI,KAAK,kCAAkC,CAAC,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,MAAM;QACN,MAAM;QACN,OAAO,EACL,MAAM,KAAK,MAAM;YACf,CAAC,CAAC,GAAG,OAAO,IAAI,KAAK,qBAAqB;YAC1C,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,mBAAmB;KAC7E,CAAC;AACJ,CAAC,CAAC;AAOF,KAAK,UAAU,WAAW,CACxB,GAAyC,EACzC,CAAS;IAET,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAEtB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,QAAQ;gBAChB,KAAK;gBACL,EAAE,EAAE,QAAQ;gBACZ,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;aACpB,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;gBAC3D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,gEAAgE;iBACzE,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAChD,OAAO,IAAI,IAAI,IAAI;gBACjB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;gBACrC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACnF,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAC/D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,QAAQ;gBAChB,KAAK;gBACL,EAAE,EAAE,QAAQ;gBACZ,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;aACtB,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;gBAC3D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,uEAAuE;iBAChF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAChD,OAAO,IAAI,IAAI,IAAI;gBACjB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;gBACrC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QAC5E,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,QAAQ;gBAChB,KAAK;gBACL,EAAE,EAAE,QAAQ;gBACZ,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;aAChB,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;YAC3D,CAAC;YACD,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACvC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE;gBACpC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QAC5E,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;gBAC7B,MAAM,EAAE,QAAQ;gBAChB,KAAK;gBACL,EAAE,EAAE,QAAQ;gBACZ,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;gBACjB,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;aAClB,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,QAAQ;gBAC9B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,IAAI,CAAC,KAAK,mBAAmB,EAAE;gBAChE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,IAAI,CAAC,KAAK,cAAc,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/categories/robustness.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Robustness category (ML-KEM).
+ *
+ * Feed deliberately malformed inputs and require a *defined error* response —
+ * never a crash, hang, or silent success:
+ *   - empty pk/ct/sk,
+ *   - non-base64 garbage in a byte field,
+ *   - an oversized blob (e.g. 1 MiB) where a key/ct is expected.
+ *
+ * This overlaps with the size category but targets structural malformation
+ * rather than off-by-N lengths. Together they map to the AF-05 family.
+ */
+import { type Category } from "./types.js";
+export declare const robustness: Category;
+//# sourceMappingURL=robustness.d.ts.map

package/dist/categories/robustness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"robustness.d.ts","sourceRoot":"","sources":["../../src/categories/robustness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAuD,MAAM,YAAY,CAAC;AAMhG,eAAO,MAAM,UAAU,EAAE,QA4FxB,CAAC"}

package/dist/categories/robustness.js

@@ -0,0 +1,98 @@
+/**
+ * Robustness category (ML-KEM).
+ *
+ * Feed deliberately malformed inputs and require a *defined error* response —
+ * never a crash, hang, or silent success:
+ *   - empty pk/ct/sk,
+ *   - non-base64 garbage in a byte field,
+ *   - an oversized blob (e.g. 1 MiB) where a key/ct is expected.
+ *
+ * This overlaps with the size category but targets structural malformation
+ * rather than off-by-N lengths. Together they map to the AF-05 family.
+ */
+import { fail, pass, rollUp } from "./types.js";
+import { requireKem } from "./helpers.js";
+const OVERSIZE = 1 << 20; // 1 MiB
+export const robustness = async (ctx) => {
+    const checks = [];
+    if (ctx.sizes.family !== "ml-kem") {
+        return {
+            category: "robustness",
+            status: "skip",
+            checks: [],
+            summary: "robustness probes currently target ML-KEM",
+        };
+    }
+    const km = requireKem(ctx.sizes);
+    const param = km.id;
+    const oversizeB64 = Buffer.alloc(OVERSIZE).toString("base64");
+    const probes = [
+        {
+            name: "encaps-empty-pk",
+            run: () => ctx.runner.send({ family: "ml-kem", param, op: "encaps", pk: "" }),
+        },
+        {
+            name: "encaps-garbage-pk",
+            run: () => ctx.runner.send({ family: "ml-kem", param, op: "encaps", pk: "!!!not base64!!!" }),
+        },
+        {
+            name: "encaps-oversize-pk",
+            run: () => ctx.runner.send({ family: "ml-kem", param, op: "encaps", pk: oversizeB64 }),
+        },
+        {
+            name: "decaps-empty-ct",
+            run: () => ctx.runner.send({
+                family: "ml-kem",
+                param,
+                op: "decaps",
+                sk: Buffer.alloc(km.secretKey).toString("base64"),
+                ct: "",
+            }),
+        },
+        {
+            name: "decaps-empty-sk",
+            run: () => ctx.runner.send({
+                family: "ml-kem",
+                param,
+                op: "decaps",
+                sk: "",
+                ct: Buffer.alloc(km.ciphertext).toString("base64"),
+            }),
+        },
+        {
+            name: "decaps-oversize-ct",
+            run: () => ctx.runner.send({
+                family: "ml-kem",
+                param,
+                op: "decaps",
+                sk: Buffer.alloc(km.secretKey).toString("base64"),
+                ct: oversizeB64,
+            }),
+        },
+    ];
+    for (const probe of probes) {
+        try {
+            const resp = await probe.run();
+            if (resp.ok === false) {
+                checks.push(pass(probe.name, `defined error: ${resp.code} (${resp.message})`));
+            }
+            else {
+                checks.push(fail(probe.name, "SUT returned a success result for malformed input instead of an error"));
+            }
+        }
+        catch (err) {
+            checks.push(fail(probe.name, `SUT crashed/hung on malformed input: ${err.message}`));
+        }
+    }
+    const status = rollUp(checks);
+    const failed = checks.filter((c) => c.status === "fail").length;
+    return {
+        category: "robustness",
+        status,
+        checks,
+        summary: status === "pass"
+            ? `${probes.length} malformed-input probes all rejected cleanly`
+            : `${failed}/${probes.length} malformed-input probes mishandled`,
+    };
+};
+//# sourceMappingURL=robustness.js.map

package/dist/categories/robustness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"robustness.js","sourceRoot":"","sources":["../../src/categories/robustness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAkD,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ;AAElC,MAAM,CAAC,MAAM,UAAU,GAAa,KAAK,EAAE,GAAG,EAA2B,EAAE;IACzE,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO;YACL,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,2CAA2C;SACrD,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;IACpB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE9D,MAAM,MAAM,GAA0D;QACpE;YACE,IAAI,EAAE,iBAAiB;YACvB,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;SAC9E;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC;SAC9F;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;SACvF;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,GAAG,EAAE,GAAG,EAAE,CACR,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,QAAQ;gBAChB,KAAK;gBACL,EAAE,EAAE,QAAQ;gBACZ,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACjD,EAAE,EAAE,EAAE;aACP,CAAC;SACL;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,GAAG,EAAE,GAAG,EAAE,CACR,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,QAAQ;gBAChB,KAAK;gBACL,EAAE,EAAE,QAAQ;gBACZ,EAAE,EAAE,EAAE;gBACN,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACnD,CAAC;SACL;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,GAAG,EAAE,GAAG,EAAE,CACR,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,QAAQ;gBAChB,KAAK;gBACL,EAAE,EAAE,QAAQ;gBACZ,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACjD,EAAE,EAAE,WAAW;aAChB,CAAC;SACL;KACF,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,kBAAkB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACjF,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,uEAAuE,CAAC,CAC1F,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,wCAAyC,GAAa,CAAC,OAAO,EAAE,CAAC,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAChE,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,MAAM;QACN,MAAM;QACN,OAAO,EACL,MAAM,KAAK,MAAM;YACf,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,8CAA8C;YAChE,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,oCAAoC;KACrE,CAAC;AACJ,CAAC,CAAC"}

package/dist/categories/signature.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Generic signature self-consistency category (FIPS 204 ML-DSA, FIPS 205
+ * SLH-DSA).
+ *
+ * Both schemes expose the same black-box surface — keygen, sign, verify — so a
+ * single driver covers them. Signing is randomized (hedged) by default, so we
+ * cannot assert exact signature bytes without official vectors; but several
+ * properties hold for any conforming implementation and need no external data:
+ *
+ *   - sizes:            pk/sk lengths match the parameter set; signature length
+ *                       matches the fixed encoding.
+ *   - sign-then-verify: verify(pk, msg, sign(sk, msg)) === true, over N msgs.
+ *   - tamper-message:   verify(pk, msg', sig) === false when msg' != msg.
+ *   - tamper-signature: verify(pk, msg, flip-a-bit(sig)) === false.
+ *   - wrong-length verify input is rejected with a defined error (AF-05).
+ *   - signing-mode (advisory): detect whether sign(sk, msg) is deterministic or
+ *     hedged by signing one fixed message twice and comparing. BOTH are valid;
+ *     this never fails — it only surfaces the observed behavior.
+ *
+ * Exact-value KAT (sigVer vectors) is handled separately by the kat category.
+ */
+import { type Category } from "./types.js";
+import { type SignatureFamily } from "../protocol.js";
+/**
+ * Build a signature category bound to a family. The same logic drives ML-DSA
+ * and SLH-DSA; only the family tag on the wire requests differs.
+ */
+export declare function makeSignatureCategory(name: string, family: SignatureFamily): Category;
+//# sourceMappingURL=signature.d.ts.map

package/dist/categories/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../src/categories/signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,KAAK,QAAQ,EAQd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKrF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,QAAQ,CAarF"}