Core engineering and protocols for FIPS 203 Dual-Seed Keygen.
FIPS 203 ML-KEM specifies that all key generation operations derive deterministically from two 32-byte random seeds: d and z. Seed d is hashed through SHAKE-256 to produce a 32-byte public seed rho and a 32-byte noise seed sigma. Matrix A is generated from rho, while private key vectors s and error vectors e are generated from sigma using the Centered Binomial Distribution.
Seed z is independent of d and serves exclusively to compute the pseudo-random fallback key when an invalid ciphertext is decrypted. If an attacker could compromise seed z, they could verify whether decapsulation failed, turning implicit rejection into a timing oracle. MLKEMKey provides hardware-enforced isolation for seed z.