ml_kem_768.nx

ml_kem_768.nx -- ML-KEM-768 post-quantum key encapsulation. NIST FIPS 203 (August 2024). Lattice-based (Module-LWE), security category 3 (AES-192 equivalent against both classical and quantum adversaries). Drop-in replacement for the X25519 key-exchange primitive we ship today -- X25519 is broken by Shor's algorithm once a sufficiently large fault-tolerant quantum computer exists. ML-KEM stays secure even then. Parameters (FIPS 203 Table 2, ML-KEM-768): n = 256 polynomial degree q = 3329 modulus k = 3 module rank eta1 = 2 secret / error distribution parameter eta2 = 2 noise distribution parameter d_u = 10 ciphertext compression (u part) d_v = 4 ciphertext compression (v part) Key / ciphertext sizes: public key = 1184 bytes secret key = 2400 bytes ciphertext = 1088 bytes shared secret = 32 bytes Status (2026-04-23): SKELETON. Structures + API signatures + test vectors scaffolded. Heart of the impl -- NTT over Z_3329[x]/(x^256+1), sample_poly, compress/decompress, K-PKE wrapping -- is bounded ~600 LoC port from the NIST reference and will ship next. Dependencies: - sha3.nx (shipped) for SHAKE-128/256 + SHA3-256/512 - rand.nx (shipped) for 32-byte randomness at keygen + encap Invariants: ML1 Output bytes match FIPS 203 Appendix A test vectors. ML2 Constant-time critical paths (sample_ntt / compress / decapsulate re-encrypt) -- no secret-dependent branches. ML3 Zero dynamic allocation in decap hot path (fixed-size buffers) for embedded deployability.