Every official test case
Recorded Python matches, with a separate layer for this browser.
Test-case grid. Left and right arrow keys move between cases, up and down between groups, Home and End go to the first and last case of a group, and Escape hides the details.
One square per case. Ink centres remain visible when gold fills record a browser match.
One exchange, step by step
A recipient publishes an encapsulation key. A sender uses it to create a ciphertext and a shared secret. The recipient decapsulates the ciphertext to recover that secret.
All strips share a 2,400-byte scale. Labels sit outside the narrow segments.
Inputs of this exchange, in full
Tamper with the ciphertext
Reject malformed inputs
The wrapper checks are distinct from implicit rejection.
Inside: the NTT and the samplers
Reference inputs · first secret polynomial s0 · computed in this browser
Coefficient chart. Left and right arrow keys move one coefficient, Shift with an arrow moves ten, Home and End go to the first and last.
Coefficient-value chart. Left and right arrow keys move between the five values.
Small coefficients, exact arithmetic
The NTT changes representation, not the polynomial. Products are checked modulo X256 + 1 and q.
The standard, algorithm by algorithm
Algorithms 3–21 · coverage by a vector group is indirect, not an isolated test.
Speed
Python recorded · this browser measured after a vector run
What a byte-for-byte match establishes
A functional test of the implementation against a named set of answers.
Sources and dates
Read the implementation record Technical note (PDF) Notebook