The NTT module's known-answer tests validated the fast NTT against a naive
O(n^2) reference multiplication written for this project, not an
independent ground truth. A shared systematic error (wrong root of unity,
wrong modulus constant) in both the fast and "reference" path would have
passed every test.
Fixed in #86: numx_ntt_forward and numx_ntt_polymul are now additionally
cross-validated bit-for-bit against PQClean's ml-kem-512 (FIPS 203,
formerly CRYSTALS-Kyber-512) reference implementation. See
validation/reference/ntt/README.md for provenance (pinned commit,
Montgomery-domain reasoning, regeneration steps).
This sets the pattern #67 (NIST KAT test-vector integration for
Kyber/Dilithium) should follow: external, independently-citable ground
truth, not internal self-consistency.
The NTT module's known-answer tests validated the fast NTT against a naive
O(n^2) reference multiplication written for this project, not an
independent ground truth. A shared systematic error (wrong root of unity,
wrong modulus constant) in both the fast and "reference" path would have
passed every test.
Fixed in #86:
numx_ntt_forwardandnumx_ntt_polymulare now additionallycross-validated bit-for-bit against PQClean's
ml-kem-512(FIPS 203,formerly CRYSTALS-Kyber-512) reference implementation. See
validation/reference/ntt/README.mdfor provenance (pinned commit,Montgomery-domain reasoning, regeneration steps).
This sets the pattern #67 (NIST KAT test-vector integration for
Kyber/Dilithium) should follow: external, independently-citable ground
truth, not internal self-consistency.