Core engineering and protocols for CMVP & CAVP Test Automation.
NIST CMVP transitions from manual test suites to the Automated Cryptographic Validation Protocol (ACVP). MLKEMCert provides a turnkey client daemon that communicates directly with NIST ACV servers over TLS 1.3, retrieving test vectors for ML-KEM key generation, encapsulation, and decapsulation, feeding them into the target cryptographic module under test, and formatting verifiable JSON response payloads.
FIPS 203 specifies strict decapsulation failure behavior: when presented with an invalid ciphertext or mismatched hash, the module must execute Fujisaki-Okamoto implicit rejection, deriving a pseudo-random shared secret from secret seed z rather than revealing an explicit error. Our test harness rigorously exercises these edge conditions to prevent timing or oracle leaks.