map to canonical

[vincentvbh]

This PR fixes the testvector mismatch introduced in #244.

A bit more history.
In the PR #128, there was the same issue. But this was identified and fixed before merging to pqm4. The problem is that the element 3329 should be mapped to 0 while packing to the public key array. In pull/128, there are two reductions: one in the NTT and one in the poly_tobytes. Due to the stack optimizations that are not described in the specification of Kyber/ML-KEM, the output of NTT should be mapped to [0, q) while packing the elements to the public key array. This remains until pull/244 removed the reduction in the NTT (and counted as a contribution of their paper).

I encountered mismatched testvectors while generating with my own chacha20 for the randombytes and iterating with 5 iterations for all the parameter sets of ml-kem. The mismatched testvectors occurred only on the 5th iteration of ml-kem768.
I don't know what's the plan of the randombytes, so I only applied minimal changes to the files under crypto_kem.
Assembly optimized subroutines and detailed documentations will appear in the future.

• PR changes testvectors
• Tests pass in qemu
• Testvectors pass in qemu
• Tests pass on Nucleo-L4R5ZI
• Testvectors pass on Nucleo-L4R5ZI
• Updated Benchmarks
• Updated Skiplist entries

[mkannwischer]

Thanks @vincentvbh. I confirm the mismatching testvectors with the current version (if you increase NTESTS - for ml-kem-768, just changing it from 2 to 3 is enough).

Let me benchmark this and merge it later today. We should really run more testvector iterations.
Tracking progress:

• PR changes testvectors
• Tests pass in qemu
• Testvectors pass in qemu
• Tests pass on Nucleo-L4R5ZI
• Testvectors pass on Nucleo-L4R5ZI
• Updated Benchmarks
• Updated Skiplist entries

This acts as a reminder that one should not be using code from pqm4 in production. If someone wants to use it in production, please contact me and we can possibly bring it into shape together (maybe within https://github.com/pq-code-package/mlkem-c-embedded).

[mkannwischer]

I don't have permission to push to this fork - merging into local branch first.