[
  {
    "section": "Specification conformance",
    "items": [
      "Implements the final FIPS 203/204/205 (2024-08-13) or SP 800-208, not a pre-standard round submission",
      "Passes the NIST ACVP / CAVP known-answer tests for every parameter set shipped",
      "Domain-separation bytes, context strings, and pre-hash variants match the standard exactly"
    ]
  },
  {
    "section": "Input validation",
    "items": [
      "ML-KEM: modulus check on encapsulation keys, hash check on decapsulation keys, length checks on ciphertexts",
      "ML-DSA / SLH-DSA: bounds checks on all decoded signature components; reject malformed encodings before any secret operation",
      "Stateful signatures: verifier validates parameter identifiers and index ranges"
    ]
  },
  {
    "section": "Side channels",
    "items": [
      "No secret-dependent branches, memory accesses, or variable-time arithmetic (division, modular reduction, floating point)",
      "Rejection-sampling loops do not leak secret-correlated information",
      "Verified with tooling (for example ctgrind, dudect, or formal methods), not by inspection alone"
    ]
  },
  {
    "section": "Randomness and hedging",
    "items": [
      "Fresh seeds from an approved DRBG for every key generation and encapsulation",
      "ML-DSA and SLH-DSA use hedged signing unless there is a documented reason for deterministic mode",
      "Fault-attack countermeasures where deterministic signing or hash-based signing is used"
    ]
  },
  {
    "section": "Protocol integration",
    "items": [
      "Hybrid combiners bind both shared secrets and both ciphertexts (RFC 10024, SP 800-227)",
      "Key-share encoding order matches the named group definition",
      "Downgrade and negotiation paths cannot silently drop the post-quantum component",
      "Stateful signature state is persisted atomically, never cloned, and survives crash and restore"
    ]
  },
  {
    "section": "Crypto-agility and operations",
    "items": [
      "Algorithm identifiers are negotiated or versioned so a future switch (for example to HQC or FN-DSA) does not require a protocol redesign",
      "Key and signature sizes are accounted for in storage, MTU, and DoS budgets",
      "Documented migration plan aligned to the NIST IR 8547, CNSA 2.0, EU, or UK NCSC timeline that applies"
    ]
  }
]