Skip to content

Freeze legacy Kyber output with golden vectors from v1.0.5 #6

Closed

Description

@Zikithezikit

Issue #3 promises that Kyber512/768/1024 keep giving the same results. This issue makes that something CI can check.

  • Install pykyber==1.0.5 from PyPI in a clean venv and record outputs for fixed seeds: keypairs, decapsulation of fixed ciphertexts, and encapsulation (through the Rust seeded path at tag v1.0.5, since Python encapsulate has no seed)
  • Save them as tests/vectors/legacy-kyber-v1.0.5.json, along with the script that made them
  • Add Rust and Python tests that check the current code against the file

These vectors are append-only. Nobody regenerates them from the current code, ever. That's the whole point.

Done when: the tests pass on dev-v2, and changing a single constant in src/kyber/ makes them fail.

Depends on: #5. Plan: WP-1.

Part of #3.

Activity

  1. added this to the 2.0.0 milestone on Oct 29, 2026
  2. Zikithezikit commented on Oct 29, 2026

    @Zikithezikit
    OwnerAuthor

    Filed as PR #22 (branch wp6-golden-vectors, based on dev-v2 at 6e29bef; please review and rebase-merge, nothing is merged by me).

    • tests/vectors/legacy-kyber-v1.0.5.json (append-only) now holds 9 golden vectors (3 seeds x 3 parameter sets) captured on 2026-10-29 from the pinned PyPI wheel pykyber 1.0.5 (sha256 0bd5d644...) and from a cargo --release run in a worktree of the v1.0.5 tag. The generator (tests/vectors/generate.py) cross-checks the 1.0.5 Python layer against the 1.0.5 Rust core before writing.
    • Rust tests/legacy_vectors.rs and python/tests/test_legacy_vectors.py replay seeded keygen, seeded encapsulation, and decapsulation against the file; the record also covers Python from_keys and an encapsulate/decapsulate roundtrip over v1.0.5 key material.
    • Acceptance check from the issue passed review testing: with KYBER_Q changed 3329 -> 3331 in src/kyber/params.rs, cargo test --test legacy_vectors fails at vector #0 and 36 of 37 of the new Python tests fail. Reverted afterwards; suite green again.
    • Per-commit verification ran with git rebase --exec as in AGENTS.md (cargo fmt --check, cargo test --no-fail-fast, maturin develop, pytest): commit 1 is green with 158 Python tests, commit 2 with 195. Clippy stays at the pre-existing 57 diagnostics; no new ones from the files in this PR.
    • Source check (PLAN-2.0.md section 9, 2026-10-29): NVD keyword search for "pykyber" and "CRYSTALS-Kyber" found no advisories; RustSec has none for pykyber; the PyPI 1.0.5 wheel hashes to the pinned sha256; no change, nothing needs redoing. The pq-crystals round-3 PDF link currently 404s and was not relied on; the capture authority is the 1.0.5 artifact itself.
    • Out of scope, as planned: declaring pytest/maturin as dev deps and the CI test job (issue CI: run tests and lints on every PR #7); clippy cleanup (its own PR before issue CI: run tests and lints on every PR #7); Cargo.lock stale-entry cleanup (chore PR still owed).
  3. Zikithezikit commented on Oct 30, 2026

    @Zikithezikit
    OwnerAuthor

    Done in 7434f3d and 2716829 (golden vectors from v1.0.5 plus the Rust and Python checks). Both suites pass on dev-v2 and now run in CI on every commit of a PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requestlegacy-kyberRound-3 Kyber classes kept for compatibility

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions