What Is the Role of “Modified Ciphertext” in ML-KEM ACVP Test Vectors?

[alraddady]

Hi liboqs team,

While reviewing the ML-KEM ACVP test vectors—specifically, internalProjection.json—I noticed several test cases (e.g., tcId 88, 90, 91, 94, 95) that include a field or reason labeled “modified ciphertext.”

Could you clarify what “modified ciphertext” signifies in this context, and what specific property or behavior these test cases are designed to verify?

Best,
Khalid

[dstebila]

@abhinav-thales @bhess Any insight here?

[alraddady]

Thank you, Prof. Stebila, for your quick response and for involving others.

[bhess]

Hi @alraddady,

Please see the definition of the ACVP VAL tests in section 6.1:

The server will generate a decapsulation key dk and a potentially valid or invalid ciphertext c. The IUT SHALL generate the corresponding shared secret k whether the k is provided from the valid decapsulation route or from the implicit rejection present in [FIPS203] Algorithm 17. This tests the implementation of Algorithm 18 ML-KEM.Decaps_internal() from [FIPS203] Section 6.3.

[alraddady]

Hi @bhess,

Thanks for your response.

To confirm my understanding:

1. For each test case—regardless of whether "reason" is "valid ciphertext" or "modified ciphertext"—I call:

   // k_liboqs is the value produced by liboqs
   k_liboqs = ML-KEM.Decaps_internal(dk, c);
   

2. The value I produce, k_liboqs, must always exactly match the "k" field (shared_secret) in the JSON test vector provided by ACVP, regardless of which internal branch (normal or implicit rejection) is taken.

3. The "reason" field just indicates which path within algorithm is taken, I don’t need to check the validity of c myself.

Does that match your understanding?

Best regards,
Khalid

[bhess]

This matches my understanding.
To run the tests with the liboqs API, you can just use OQS_KEM_decaps, as done in the ACVP test code.

[alraddady]

Thank you so much, @bhess! I really appreciate your help.

[alraddady]

By the way, I noticed that a new pre-release version of the ACVP test suite has been published—thought this might be helpful.

[bhess]

By the way, I noticed that a new pre-release version of the ACVP test suite has been published—thought this might be helpful.

Thanks for the heads-up! I've opened issue #2128 to update the vectors once the new ACVP test suite is released.