Issues

• LMS verify (crypto): the Algorithm 6a q bound uses > instead of >=, so a signature with q = 2^h throws IndexOutOfRangeException instead of returning INVALID

  usnistgov/ACVP-Server#481 · Filter by author Arpan0995 opened on Sep 3, 2026
  1

• ML-KEM encapDecap FIPS203: a registration omitting functions throws in the validator instead of failing validation, and the algorithm draft's Table 3 note tells clients to omit it

  Bug

  usnistgov/ACVP-Server#479 · Filter by author Arpan0995 opened on Aug 31, 2026
  1

  

• LMS sigGen: the new Q uniqueness validation throws on malformed submissions instead of failing them, in both the 1.0 and SP800-208 revisions

  usnistgov/ACVP-Server#478 · Filter by author Arpan0995 opened on Aug 29, 2026

• ML-DSA sigVer: no vector carries a wrong-length signature, while SLH-DSA sigVer carries 144

  usnistgov/ACVP-Server#477 · Filter by author Arpan0995 opened on Aug 24, 2026

• ML-DSA and SLH-DSA sigVer: the mandated rejection of an oversized context cannot be exercised by any vector, because the protocol caps contextLength at the FIPS boundary

  usnistgov/ACVP-Server#476 · Filter by author Arpan0995 opened on Aug 20, 2026

• LMS sigVer: no vector exercises the leaf index bound, OTS typecode match, or signature length checks of RFC 8554 verification

  usnistgov/ACVP-Server#475 · Filter by author Arpan0995 opened on Aug 17, 2026

• ML-KEM FIPS203-tr1: keyFormats registrations that pass validation and then crash generation, or silently drop decapsulationKeyCheck

  Bug

  usnistgov/ACVP-Server#474 · Filter by author Arpan0995 opened on Aug 13, 2026
  2

  

• ML-DSA sigVer: five verifier defects the published vectors do not distinguish, and the public cases that do

  usnistgov/ACVP-Server#470 · Filter by author KurathSec opened on Aug 11, 2026
  3

• ML-DSA and SLH-DSA sigVer: most (parameter set, pre-hash function) pairs have no valid vector, so a wrong pre-hash OID or digest goes undetected

  usnistgov/ACVP-Server#469 · Filter by author Arpan0995 opened on Aug 11, 2026
  2

• ML-KEM key check dispositions are fewer than the checks FIPS 203 sections 7.2 and 7.3 mandate, so some can never be exercised by a generated set

  usnistgov/ACVP-Server#468 · Filter by author KurathSec opened on Aug 10, 2026
  7

• No XMSS/XMSS^MT algorithm suites, so SP 800-208 verifiers have no NIST validation vectors while LMS does

  usnistgov/ACVP-Server#465 · Filter by author dotCooCoo opened on Aug 9, 2026

• AES-CCM aadLen minor inconsistency

  usnistgov/ACVP-Server#463 · Filter by author powersmc opened on Jul 30, 2026
  1

• ML-DSA sigVer "modified signature - z" vectors modify the hint block instead of z; the z-bound check is never exercised

  usnistgov/ACVP-Server#462 · Filter by author Arpan0995 opened on Jul 27, 2026 · v1.1.0.43
  12

• KAS-FFC Sp800-56Ar3 Registration cause General exception. Contact service provider.

  usnistgov/ACVP-Server#461 · Filter by author AlexThurston opened on Jul 27, 2026

• AlgoMode lookup fails for AES-CTR due to double dash when mode is an empty string

  usnistgov/ACVP-Server#457 · Filter by author SowmithaBavirisetty opened on Jul 13, 2026

• AES-CTR vector set tests empty with a certain selection

  usnistgov/ACVP-Server#453 · Filter by author AlexThurston opened on May 14, 2026

• ML-DSA sigVer in the test group does it need to have externalMu or not?

  usnistgov/ACVP-Server#448 · Filter by author haris-ziko opened on Apr 22, 2026

• Requests made on DEMO don't seem to ever transition to approved

  usnistgov/ACVP-Server#446 · Filter by author AlexThurston opened on Apr 10, 2026
  7

• Can ACVP testing catch "CVE-2026-28386: Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support" ?

  usnistgov/ACVP-Server#445 · Filter by author xnox opened on Apr 9, 2026

• Missing private key in LMS KeyGen tests

  usnistgov/ACVP-Server#442 · Filter by author BelenkyFortifyIQ opened on Mar 12, 2026
  3

• ParallelHash json files use byte-oriented block count, discard residual bits

  usnistgov/ACVP-Server#440 · Filter by author dspdon opened on Mar 9, 2026
  3

• Lack of ML-DSA-sigVer-FIPS204 tests with 0 hints for one of the polynomials

  enhancement
  usnistgov/ACVP-Server#436 · Filter by author BelenkyFortifyIQ opened on Feb 10, 2026
  6

  

• KAS‐ECC SP800-56Ar3 vector set submission fails with “General exception. Contact service provider.”

  usnistgov/ACVP-Server#432 · Filter by author Jman1321 opened on Dec 10, 2025

• Hybrid-firmware or hybrid-software implementation type

  usnistgov/ACVP-Server#431 · Filter by author amr-atsec opened on Dec 5, 2025

• AES-GCM External IV Encrypt Option Required for Test Suite Creation Despite FIPS Restrictions

  usnistgov/ACVP-Server#428 · Filter by author shivania2 opened on Nov 14, 2025
  1