Module engine 

Fine-grained, BRAM-oriented SHA-profile WOTS context engine.

One instance owns one four-bit scheduler context behind a shared SHA transport. The enclosing top chooses how many of the sixteen encodable context identifiers it instantiates. This engine constructs and retires the exact 1,258 compression tasks for a fused private-seed signature/public-key operation. Every segment advances independently: a resettable stage array, ready mask, and in-flight mask encode the per-segment dependency frontier. There are no whole-wave phase barriers.

The dependency graph is explicit:

• the private-seed hash releases the public-seed task and all 67 segment PRFs concurrently;
• the public-seed result releases all sixteen masks;
• segment PRF plus mask zero release secret data, whose response releases secret padding;
• secret padding and masks one through fifteen release each chain step;
• step fifteen retains the endpoint; and
• each serialized public-key block starts as soon as its endpoint pair and the preceding public-key digest are both ready.

The scheduler priority is public-key, seed, public-seed, masks, then segment work. Public-key work can occupy at most one issue per compression latency, and seed/public-seed/mask classes are finite, so the rotating hierarchical segment selector cannot starve. Segment readiness is stored as nine groups of eight bits (the last five bits are permanently zero); a rotating group cursor selects one nonempty group and a fixed eight-way encoder selects its lowest ready member.

State and final endpoints share two 64-entry, 256-bit memories banked by segment parity. The banks provide both endpoint operands for public-key blocks 0 through 32 without duplicating endpoint storage. Masks use a 16-entry memory. Signature segments use matching even/odd 64-entry banks so one pair read returns 64 bytes. Pair reads 0 through 32 furnish signature beats 0 through 32; pair 33 furnishes segment 66 alongside public_seed in beat 33, and public_key_hash occupies the valid half of beat 34. The unused addresses are unreachable padding imposed by power-of-two RHDL RAM depths. All wide data and RAM are resetless; separately reset ownership, ready, in-flight, request-valid, and result-valid bits determine whether the data is meaningful. The private seed is architecturally overwritten after its seed request transfers. A seven-bit counter tracks the one public-seed PRF plus 67 segment PRFs that consume the derived private key; the key is overwritten when the last of those 68 requests transfers. Both registers are overwritten again when result_taken releases the retained result. These are logical RTL assignments only, not evidence of physical zeroization, remanence resistance, power-analysis resistance, or any other side-channel property.

Each request uses a synchronous-memory prefetch followed by one stable resetless payload register. Accepting a request can launch the next prefetch in the same cycle, so a ready context can issue once every two cycles. A segment made ready by a response is excluded from selection in that response cycle, preventing same-address response-write/prefetch-read behavior. Mask retirement similarly delays all newly awakened segments for one cycle, and a newly completed endpoint cannot launch its public-key read until the next cycle.

Response and reset contract

Responses may return in any order. The complete 32-bit tag must be canonical, name this context and generation, and identify a task whose in-flight bit and current stage agree. Malformed, stale, duplicate, never-issued, or stage-mismatched responses are rejected without any cryptographic state write and latch fault. A fault does not discard the context’s retained storage: if all required tasks subsequently retire, result_valid and fault may be true together. The enclosing framer must treat that combination as a failed operation, emit no result bytes, and acknowledge it with result_taken to release the reserved credit. The fault remains visible through that acknowledgement cycle and clears when the retained result is released.

Reset is fail closed and directly suppresses requests, response acceptance, and all memory writes, even on the asserting edge. The enclosing transport and compression lanes must share reset so old tokens are flushed. If a system cannot guarantee a shared flush, it must not reuse a generation until every pre-reset token has drained. Eight-bit generation wrap is safe only under the same no-outstanding-old-token rule.

This module has source and simulation evidence only. Its logical storage mapping is an implementation intent, not evidence that a synthesis tool inferred block RAM or met resource, timing, or throughput targets.

Structs

ContextEngineInput

Inputs for one single-context work engine.

ContextEngineOutput

Status, transport request, and retained-result outputs.

EngineControl

Resettable ownership, dependency, and in-flight state.

PrepareRequestInput

Prepared-request inputs after the synchronous memory read.

SegmentSelection

Result of the hierarchical rotating segment selector.

SignatureBanks

Structural wrapper keeping the top synchronous-state tuple within Rust’s tuple trait arity while preserving two physical RAM children.

SignatureBanksInput

Read/write ports for the two signature parity banks.

SignatureBanksOutput

Registered outputs from both signature parity banks.

SingleContextWorkEngine

Complete one-context fine-grained WOTS work engine.

Constants

CONTEXT_LOGICAL_RAM_BITS

Total logical RAM bits authored per context.

ENGINE_SEGMENTS

Number of independently advancing WOTS segments.

MASK_ADDRESS_BITS

Address bits in the mask memory.

MASK_DEPTH

Logical entries in the mask memory.

MASK_STORAGE_BITS

Logical randomization-mask storage bits per context.

PRIVATE_KEY_CONSUMERS

Requests that consume the derived private key: one public-seed plus 67 segment PRFs.

PUBLIC_KEY_FOCUS_BLOCKS

Consecutive endpoint-stream blocks accelerated ahead of the PK hash.

SEGMENTS_PER_GROUP

Eight segments represented in each ready/in-flight group.

SEGMENT_GROUPS

Number of hierarchical segment groups.

SEGMENT_STAGE_CHAIN_FIRST

First chain stage code; stage 2 + step names one-based step.

SEGMENT_STAGE_CHAIN_LAST

Last chain stage code, corresponding to chain step fifteen.

SEGMENT_STAGE_ENDPOINT

Completed endpoint stage code.

SEGMENT_STAGE_PRF

Per-segment stage code for its initial PRF.

SEGMENT_STAGE_SECRET_DATA

Per-segment stage code for the secret-data block.

SEGMENT_STAGE_SECRET_PADDING

Per-segment stage code for the secret-padding block.

SIGNATURE_ADDRESS_BITS

Address bits in each even/odd signature bank.

SIGNATURE_DEPTH

Logical entries in each signature bank.

SIGNATURE_STORAGE_BITS

Logical signature storage bits per context.

STATE_BANK_ADDRESS_BITS

Address bits in each even/odd state bank.

STATE_BANK_DEPTH

Logical entries in each state bank.

STATE_STORAGE_BITS

Logical state/endpoints storage bits per context.

Functions

exclude_segment_groups_kernel

Remove response-cycle wakeups from the selector-visible ready groups.

increment_segment_group_kernel

Increment a segment-group cursor modulo nine.

prepare_request_kernel

Construct a complete compression request from prefetched context storage.

public_key_endpoints_ready_kernel

Return whether one serialized public-key block has all endpoints available.

segment_bit_kernel

Read one segment bit from a nine-group mask.

segment_required_mask_kernel

Return the randomization mask required by a segment stage.

segment_task_fields_kernel

Convert a segment stage to its one canonical compression-task tag.

select_public_key_focus_segment_kernel

Select a ready segment in an eight-block endpoint-stream lookahead window.

select_ready_segment_kernel

Select one ready segment with rotating group fairness.

set_segment_bit_kernel

Set or clear one segment bit in a nine-group mask.

signature_banks_kernel

Connectivity for SignatureBanks.

single_context_work_engine_kernel

State transition and memory connectivity for SingleContextWorkEngine.

state_pair_exclusion_kernel

Mark both segments sharing a parity-bank address as response-cycle hazards.

union_segment_groups_kernel

Bitwise union of two segment masks.

wake_segments_for_mask_kernel

Wake every dependency-waiting segment that needs a newly retired mask.

Type Aliases

SegmentGroups

Nine eight-bit groups used for 67-bit segment masks.

SegmentStages

One five-bit dependency stage per segment.