ML-KEM: harden constant-time cmov and add cross-implementation test coverage

[Copilot]

Code review of ML-KEM (FIPS 203) implementation for spec conformance, side-channel resistance, and test coverage.

Side-channel fix

The cmov function converted a bool to a mask without a compiler barrier, allowing the optimizer to potentially convert the branchless XOR pattern into a conditional branch—leaking timing in the FO transform's implicit rejection path.

fn cmov(out: &mut [u8; 32], value: &[u8; 32], cond: bool) {
    let mask = ct_mask_u8(cond); // now goes through asm barrier
    for i in 0..32 {
        out[i] ^= mask & (out[i] ^ value[i]);
    }
}

#[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
fn ct_barrier_u8(mut value: u8) -> u8 {
    unsafe { core::arch::asm!("/* {0} */", inout(reg_byte) value, options(pure, nomem, nostack, preserves_flags)); }
    value
}

Same technique used by the constant_time_eq crate in this repo. Platform coverage: x86/x86_64, ARM/AArch64, RISC-V, with black_box fallback.

Conformance review (no issues found)

• G(d || k) keygen domain separation correct
• v - s^T·u decryption order correct (Algorithm 6 step 3)
• FO implicit rejection correct (Algorithm 17)
• All compression uses division-free Barrett multiplication constants
• Rejection sampling only branches on public data (matrix A)

New tests (34 → 53)

• Cross-implementation: 10 ML-KEM-768 + 10 ML-KEM-1024 vectors generated by pqcrypto/liboqs, decapsulated by our implementation
• NIST FIPS 203: Full intermediate value verification (keygen + encaps + decaps) for both parameter sets
• Internal primitives: cmov, Barrett reduce, Montgomery reduce, NTT structure, compress/decompress roundtrips (4/5/10/11-bit), poly_tobytes roundtrip, gen_matrix transpose, CBD2 range, rej_uniform rejection, poly_tomsg boundaries