Add ML-KEM CAST for KeyGen, Encaps, and Decaps

[skmcgrail]

Description of changes:

• Per the I.G guidance a CAST using a KAT is required for ML-KEM key generation

if the module implements ML-KEM key generation, the module shall have an ML-KEM key generation
CAST. The ML-KEM key generation does not take input and outputs an encapsulation key (ek) and a
decapsulation key (dk). The CAST shall use the ML-KEM key generation algorithm (i.e., Algorithm
19 in FIPS 203), and for a KAT, using a fixed/predetermined random values (i.e., z and d), to
compare the resulting outputs to the pre-computed values of ek and dk.

• Per the I.G guidance a CAST using a KAT is required for ML-KEM encapsulation

if the module implements ML-KEM encapsulation, the module shall have a CAST for the ML-KEM
encapsulation mechanism. The encapsulation algorithm of ML-KEM accepts an encapsulation key
(ek) as input, requires randomness, and outputs a ciphertext (c) and a shared secret (K). The CAST
shall use the ML-KEM encapsulation algorithm (i.e., Algorithm 20 in FIPS 203), and for a KAT,
using fixed/predetermined ek and m values, to compare the resulting outputs to pre-computed values
of both c and K.

• Per the I.G. guidance a CAST using two KATs is required for mL-KEM decapsulation, one to test the non-implicit rejection path, and the other to test the rejection path.

if the module implements ML-KEM decapsulation, the module shall have a CAST for the ML-KEM
decapsulation mechanism. The decapsulation algorithm of ML-KEM accepts a decapsulation key (dk)
and a ML-KEM ciphertext (c) as input, does not use any randomness, and outputs a shared secret
(K’). The CAST shall use the ML-KEM decapsulation algorithm (i.e., Algorithm 21 in FIPS 203),
and for a KAT, using fixed/predetermined dk and c values, to compare the resulting outputs to pre-
computed value of K'.
Note21: The ML-KEM decapsulation CASTs shall cover both the implicit rejection and (unnamed)
non-rejection paths.

The source of the vectors were sourced from the ML-KEM ACVP demo server vectors that had been previously validated with.

Also only one ML-KEM parameter variant needs to be tested per I.G.:

Note22: The above CASTs shall be performed on at least one of the following parameter-sets for ML-
KEM that are implemented in the approved mode: ML-KEM-512, ML-KEM-768, or ML-KEM-1024.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 95.45455% with 3 lines in your changes missing coverage. Please review.

Project coverage is 78.50%. Comparing base (9a644b2) to head (4c3cdd4).

Files with missing lines	Patch %	Lines
crypto/fipsmodule/self_check/self_check.c	93.02%	3 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1846   +/-   ##
=======================================
  Coverage   78.50%   78.50%           
=======================================
  Files         583      583           
  Lines       98536    98600   +64     
  Branches    14133    14137    +4     
=======================================
+ Hits        77353    77408   +55     
- Misses      20555    20567   +12     
+ Partials      628      625    -3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.