krypteia-quantica 0.1.0

/// ML-KEM parameter sets as defined in FIPS 203 Section 8, Table 2.
///
/// Constants: n = 256, q = 3329 for all parameter sets.

/// The polynomial ring dimension. All ML-KEM parameter sets use n = 256.
pub const N: usize = 256;

/// The modulus for the polynomial ring `R_q = Z_q[X]/(X^n + 1)`.
///
/// q = 3329 is chosen because it is prime and satisfies q ≡ 1 (mod 2n),
/// enabling efficient NTT-based polynomial multiplication.
pub const Q: u16 = 3329;

/// Parameter set trait for ML-KEM security levels.
///
/// Implemented by [`MlKem512`], [`MlKem768`], and [`MlKem1024`], each
/// providing the constants that define key sizes, ciphertext sizes, and
/// sampling parameters for a specific NIST security category.
///
/// The derived constants ([`EK_LEN`](Params::EK_LEN), [`DK_LEN`](Params::DK_LEN),
/// [`CT_LEN`](Params::CT_LEN), [`SS_LEN`](Params::SS_LEN)) are computed
/// automatically from the core parameters.
pub trait Params: 'static {
    /// Module rank (number of polynomials per vector). Determines security level.
    const K: usize;
    /// CBD sampling parameter for secret key and first error vector.
    const ETA1: usize;
    /// CBD sampling parameter for second error vectors during encryption.
    const ETA2: usize;
    /// Compression bit-width for the `u` component of ciphertexts.
    const DU: usize;
    /// Compression bit-width for the `v` component of ciphertexts.
    const DV: usize;

    // Derived sizes (in bytes)
    /// Encapsulation key size in bytes: 384*k + 32.
    const EK_LEN: usize = 384 * Self::K + 32;
    /// Decapsulation key size in bytes: 768*k + 96.
    ///
    /// Layout: `dk_pke || ek_pke || H(ek) || z` where `z` is the implicit
    /// rejection seed.
    const DK_LEN: usize = 768 * Self::K + 96;
    /// Ciphertext size in bytes: 32*(du*k + dv).
    const CT_LEN: usize = 32 * (Self::DU * Self::K + Self::DV);
    /// Shared secret size in bytes. Always 32 (256 bits) for all parameter sets.
    const SS_LEN: usize = 32;
}

/// ML-KEM-512 parameter set (NIST security category 1).
///
/// Provides 128-bit classical security. Smallest key and ciphertext sizes.
///
/// | Property | Value |
/// |----------|-------|
/// | `EK_LEN` | 800 bytes |
/// | `DK_LEN` | 1632 bytes |
/// | `CT_LEN` | 768 bytes |
pub struct MlKem512;
impl Params for MlKem512 {
    const K: usize = 2;
    const ETA1: usize = 3;
    const ETA2: usize = 2;
    const DU: usize = 10;
    const DV: usize = 4;
}

/// ML-KEM-768 parameter set (NIST security category 3).
///
/// The NIST recommended default. Provides 192-bit classical security and
/// balances performance with security margin.
///
/// | Property | Value |
/// |----------|-------|
/// | `EK_LEN` | 1184 bytes |
/// | `DK_LEN` | 2400 bytes |
/// | `CT_LEN` | 1088 bytes |
pub struct MlKem768;
impl Params for MlKem768 {
    const K: usize = 3;
    const ETA1: usize = 2;
    const ETA2: usize = 2;
    const DU: usize = 10;
    const DV: usize = 4;
}

/// ML-KEM-1024 parameter set (NIST security category 5).
///
/// Provides 256-bit classical security. Largest key and ciphertext sizes,
/// but highest security margin.
///
/// | Property | Value |
/// |----------|-------|
/// | `EK_LEN` | 1568 bytes |
/// | `DK_LEN` | 3168 bytes |
/// | `CT_LEN` | 1568 bytes |
pub struct MlKem1024;
impl Params for MlKem1024 {
    const K: usize = 4;
    const ETA1: usize = 2;
    const ETA2: usize = 2;
    const DU: usize = 11;
    const DV: usize = 5;
}