iraca: verificación diferencial independiente de ML-KEM (FIPS 203) en RustCrypto
Qué hicimos iraca es un arnés que verifica la criptografía post-cuántica que el ecosistema Rust realmente usa, diferenciándola contra una implementación independiente . Primer resultado público: el crate ml-kem de RustCrypto (ML-KEM / FIPS 203), muy usado y sin auditoría independiente publicada , resulta idéntico byte a byte a la referencia en C de pq-crystals en generación de claves,…
The IRACA project has developed a harness that verifies post-quantum cryptography used in the Rust ecosystem, distinguishing it from an independent implementation. Their public result shows that the RustCrypto crate ml-kem (ML-KEM/FIPS 203), widely used and without independent auditing, is identical byte-for-byte to the C reference of pq-crystals in key generation, encapsulation, and decapsulation, and correctly rejects non-canonical keys as required by FIPS 203.
This is a compliance check, not a complete audit, and does not cover lateral channels (the KyberSlash class). The importance of this lies in the NIST standards (FIPS 203/204/205) being definitive and migration being mandatory; a large part of the Rust world uses the RustCrypto crates, which today lack independent auditing. By comparing the same raw bytes to two independent implementations, IRACA hunts for the class of errors that could be shared between adaptations to the same language.
The method involves feeding the same raw bytes to both the crate and the C reference of pq-crystals as deterministic inputs, without DRBG and without repeating vectors. With end-to-end determinism, every discrepancy is real, not random noise. The C reference is compiled from source and linked through a thin FFI module; the rest is safe Rust.
An adversarial layer also tests the input validation by generating non-canonical encapsulation keys (a coefficient greater than or equal to q) and checking that the crate rejects them, as required by FIPS 203 (the modulus check). The canonical oracle is the standard itself, not another implementation. Results show functional differential testing (ML-KEM-768): keys, ciphertexts, and shared secrets are identical byte-for-byte to pq-crystals with 128 seeds plus a fixed vector.
Adversarial compliance (ML-KEM-768): RustCrypto rejects non-canonical keys required by FIPS 203; confirmed by source reading and execution on 128 samples. An accompanying result (ML-DSA-87) shows byte-for-byte agreement with the Dilithium reference using crossed verification and a manipulation proof. Each result has its own red/green pair and positive control: a result without discrepancy means the truth comparison path executed and knows how to distinguish.
What it is not: this is not a complete audit, not a lateral channel or temporal analysis; it's a version and specific properties. The assurance is cumulative, not a single seal. Reproducible and collaborative: the harness is small, deterministic, and designed to be rerun. If you maintain a post-quantum implementation and want an independent differential and adversarial check, or an oracle against which to differentiate your work, this is what it's for.
They also collaborate with the Ethereum Foundation's post-quantum verification effort in signature schemes verification.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
