Module mlkem 

ML-KEM-768 (FIPS-203) keygen / encapsulation / decapsulation as a Rust composition of the verified native kernels in crate::ntt (NTT, base-multiply, CBD, compress, byte-encode, 4-way AVX2 matrix expansion) and crate::keccak (SHA3-256/512, SHAKE256). This is the exact same primitive set the assets/std/crypto.lg Logos ML-KEM orchestrates and that the logicaffeine-tests AOT gates prove bit-exact vs the FIPS-203 reference — here orchestrated in Rust so the post-quantum channel (logicaffeine_compile::concurrency::channel) can run the handshake. Coefficients ride the fast Word16 carrier throughout.

Constants

CT_BYTES

ct = K·(32·du) + 32·dv (ciphertext).

DK_BYTES

dk = dk_pke ‖ ek ‖ H(ek) ‖ z (decapsulation / secret key).

EK_BYTES

ek = K·384 + 32 (encapsulation / public key).

SS_BYTES

Shared secret length.

Functions

decaps

ML-KEM.Decaps(dk, c) → shared secret, with the Fujisaki-Okamoto implicit reject.

encaps

ML-KEM.Encaps(ek, m) → (ciphertext, shared secret). m is the 32-byte message randomness.

keygen

ML-KEM.KeyGen(d, z) → (ek, dk) where dk = dk_pke ‖ ek ‖ H(ek) ‖ z.

mlkem_decaps_seq

mlkemDecapsKem(dk, ct) → shared_secret(32).

mlkem_encaps_seq

mlkemEncapsKem(ek, m) → ciphertext(1088) ‖ shared_secret(32).

mlkem_keypair_seq

mlkemKeypair(d, z) → ek(1184) ‖ dk(2400).

mlkem_noise_batch_from_int

mlkemNoiseBatch(seed, base, count) → count·256 raw CBD_2 Word16 coefficients (nonces base..base+count, no NTT), the flat concatenation of count noise polynomials. The fast primitive the Logos mlkem768Keygen/mlkemEncrypt call once instead of count scalar mlkemPrfNoises — one 4-way SHAKE256 permutation covers four PRF streams (see [noise_batch_raw]).