[crypto] ML-DSA-87: Computation of the S and T vectors (5-6/8)

[andrea-caforio]

The S and T vectors make up most of the public and secret key.

---

This is a series of PRs that in their composition result in FIPS-204-compliant OTBN implementation of ML-DSA-87 keygen.

Resources

• https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.204.pdf
• https://tches.iacr.org/index.php/TCHES/article/view/11158/10597
• https://github.com/pq-crystals/dilithium

Gadgets

1. sec_mod5 [crypto] ML-DSA-87: Modulo 5 gadget (1/8) #30108

Sampling

2. sample_uniform_eta, expand_s [crypto] ML-DSA-87: Rejection-sample coefficient-bounded polys (2/8) #30138

Encoding

3. encode_t0, encode_t1, power2round [crypto] ML-DSA-87: Encoding and rounding of T polynomials #30154
4. encode_s [crypto] ML-DSA-87: Encoding of S polynomials (4/8) #30162

Vector Ops

5. compute_t
6. sample_s
7. hash_seed, hask_pk

Epilogue

8. app

[nasahlpa]

Thanks Andi, the implementation looks very clean :-)