Merge pull request #1582 from usnistgov/ML-DSA-KATs

Updates info for ML-DSA KATs

Author: livebe01

src/ml-dsa/sections/04-testtypes.adoc

@@ -21,16 +21,16 @@ The IUT *SHALL* generate valid signatures based on the ACVP-provided message, mu
 
 There are several assurances to obtain from AFTs. First is correctness of the algorithm implementation. The server *SHALL* include at least 15 tests for each combination of capabilities to meet this assurance. The `"hashAlg"` capability *MAY* be excluded from the combination of capabilities due to the number of supported hash functions. Each `"hashAlg"` provided by the IUT *SHALL* be covered within the at least 15 tests generated for each combination of capabilities. 
 
-The second assurance is correctness under all rejection paths. Within ML-DSA sigGen, the algorithm enters a loop until a valid signature is found. The loop contains four potential reasons to reject a candidate signature: if the z infinity norm is too large, if the r infinity norm is too large, if there are too many hints in h, or if the ct0 infinity norm is too large. These conditions occur at various rarities that can make it difficult to test each error condition with randomized testing. If an implementation adheres strictly to the pseudocode in <<FIPS204>>, the following table provides helpful known answer tests that trigger each rejection case exactly once. If the implementation varies from the psuedocode, it would be prudent to use a debugger or other tooling to ensure that all rejection cases are triggered by testing. To save on space, the table will provide the seed used to generate the key pair, a hash of the keys, SHA2-256(pk || sk), and a hash of the resulting signature, SHA2-256(sig). All cases are defined using the deterministic signature method. Note that the ct0 infinity norm check only applies to ML-DSA-44. This condition is not possible on the other security levels. Thanks to Qinglai Xiao and Mike Hamburg (Rambus Inc) for providing code to generate these test cases; more information on their technique is available on the NIST PQC-Forum <<PQCForum>>. 
+The second assurance is correctness under all rejection paths. Within ML-DSA sigGen, i.e., in Algorithm 7 `ML-DSA.Sign_internal()`, the algorithm enters a loop until a valid signature is found. The loop contains four potential reasons to reject a candidate signature: if the z infinity norm is too large, if the r infinity norm is too large, if there are too many hints in h, or if the ct0 infinity norm is too large. These conditions occur at various rarities that can make it difficult to test each error condition with randomized testing. If an implementation adheres strictly to the pseudocode in Algorithm 7 `ML-DSA.Sign_internal()` <<FIPS204>>, the following table provides helpful known answer tests that trigger each rejection case exactly once. If the implementation varies from the psuedocode, it would be prudent to use a debugger or other tooling to ensure that all rejection cases are triggered by testing. To save on space, the table will provide the seed used to generate the key pair, a hash of the keys, SHA2-256(pk || sk), and a hash of the resulting signature, SHA2-256(sig). All cases are defined using the deterministic signature method, Algorithm 7 `ML-DSA.Sign_internal()`. Note that the ct0 infinity norm check only applies to ML-DSA-44. This condition is not possible on the other security levels. Thanks to Qinglai Xiao and Mike Hamburg (Rambus Inc) for providing code to generate these test cases; more information on their technique is available on the NIST PQC-Forum <<PQCForum>>. 
 
 The server *SHALL* include at least 5 tests that cover all rejection outcomes for all combinations of capabilities where `"signatureInterface" = "internal"` and `"deterministic" = true`. The internal signature interface is described in <<FIPS204>> Algorithm 7 ML-DSA.`Sign_internal()` must be used to test this assurance. The <<kats_table>> provides valid test cases for this assurance.
 
 The third assurance is correctness under a large number of rejections. The standard, <<FIPS204>>, does not define an upper limit on the number of potential rejections. Implementations that abort early may leak information about the underlying key. The server *SHALL* include at least 5 tests that lead to at least 32 rejections where `"signatureInterface" = "internal"` and `"deterministic" = true`. The internal signature interface described in <<FIPS204>> Algorithm 7 `ML-DSA.Sign_internal()` must be used to test this assurance. The <<rejections_table>> provides valid test cases for this assurance.
 
 [[kats_table]]
-.ML-DSA sigGen Known Answer Tests for Rejection Cases
+.ML-DSA Algorithm 7 `ML-DSA.Sign_internal()` Known Answer Tests for Rejection Cases
 |===
-| Security Level | Seed | Key Hash | Message | Signature Hash
+| Security Level | Seed | Key Hash | M' | Signature Hash
 
 | ML-DSA-44 | 5C624FCC 18624524 52D0C665 840D8237 F43108E5 499EDCDC 108FBC49 D596E4B7 | AC825C59 D8A4C453 A2C4EFEA 8395741C A404F300 0E28D56B 25D03BB4 02E5CB2F | 951FDF54 73A4CBA6 D9E5B5DB 7E79FB81 73921BA5 B13E9271 401B8F90 7B8B7D5B | DCC71A42 1BC6FFAF B7DF0C7F 6D018A19 ADA154D1 E2EE360E D533CECD 5DC980AD
 | ML-DSA-44 | 836EABED B4D2CD9B E6A4D957 CF5EE6BF 48930413 6864C55C 2C5F01DA 5047D18B | E1FF40D9 6E3552FA B531D171 5084B7E3 8CCDBACC 0A8AF94C 30959FB4 C7F5A445 | 199A0AB7 35E90041 63DD02D3 19A61CFE 81638E3B F47BB1E9 0E90D6E3 EA545247 | A2608BC2 7E60541D 27B6A14F 460D54A4 8C0298DC C3F45999 F29047A3 135C4941
@@ -50,9 +50,9 @@ The third assurance is correctness under a large number of rejections. The stand
 |===
 
 [[rejections_table]]
-.ML-DSA sigGen Known Answer Tests for Number of Rejection Cases
+.ML-DSA Algorithm 7 `ML-DSA.Sign_internal()` Known Answer Tests for Number of Rejection Cases
 |===
-| Security Level | Rejection Count | Seed | Key Hash | Message | Signature Hash
+| Security Level | Rejection Count | Seed | Key Hash | M' | Signature Hash
 
 | ML-DSA-44 | 77 | 090D97C1 F4166EB3 2CA67C5F B564ACBE 0735DB4A F4B8DB3A 7C2CE740 2357CA44 | 26D79E40 68040E99 6BC9EB50 34C20489 C0AD38DC 2FEC1918 D0760C86 21872408 | E3838364 B37F47ED FCA2B577 B20B80C3 CB51B9F5 6E0E4CDB 7DF002C8 74039252 | CD91150C 610FF02D E1DD7049 C309EFE8 00CE5C1B C2E5A32D 752AB62C 5BF5E16F 
 | ML-DSA-44 | 100 | CFC73D07 A883543A 804F7700 70861825 143A62F2 F97D05FC E00FD8B2 5D29A43F | 89142AB2 6D6EB6C0 1FA3F189 A9C87759 7740D685 983F29BB DD359664 8266AE0E | 0960C13E 9BA467A9 38450120 CC96FF6F 04B7E557 C99A8386 19A48F9A 38738AB8 | B6296FFF 0C1F23DE 4906D581 44B00A2D B13AD25E 49B4B857 3A62EFEE CB544DD7