Rigorous justification of the heuristic ML-KEM-768 failure scale

Establish a rigorous justification of the heuristic decapsulation-failure probability scale reported for ML-KEM-768 beyond the restricted random-function/centered-binomial abstraction, including the dependency structure of the actual standardized construction.

Background

The paper distinguishes the reported approximately 2^-164.8 ML-KEM-768 failure scale from the certified theorem it proves. The theorem applies only to an explicit ROM/CBD abstraction in which domain-separated public-matrix streams are modeled as independent uniform ring elements and secret and noise polynomials are modeled as independent centered-binomial samples. It does not establish an information-theoretic result for the fixed SHAKE instantiation of FIPS 203.

The broader unresolved issue is to justify the heuristic-scale failure behavior while retaining the algebraic dependencies induced by the public matrix and both ciphertext-compression terms. The paper addresses only a restricted form of this gap by proving a dependency-preserving upper bound for a fixed message in the ROM/CBD model; it therefore does not resolve the general formal-justification problem identified in the cited assessments.