ML-KEM-768.KeyGenDerand definition disagrees with Appendix B and C

[FiloSottile]

Section 4 defines ML-KEM-768.KeyGenDerand as

seed[0:32] is used for z in line 1 of algorithm 15 from [MLKEM] and seed[32:64] is used for d in line 1 of algorithm 12.

However, the implementation in Appendix B.3 does the opposite

z = seed[32:]
pk, sk2 = InnerKeyGen(seed[:32], params)

and the test vector in Appendix C passes when using seed[0:32] for d and seed[32:64] for z.

[bwesterb]

Whoops, you're right. Fixed on main.

[chris-wood]

Thanks @bwesterb. Any chance you'll cut a new version soon? I also ran into this issue.

[bwesterb]

Released -02.