A2 · Decryption-failure calculator
Computed in the browser

How often does ML-KEM fail to decrypt?

Exact convolution rebuilds the published failure rates and measures the error in tail approximations.


Calculator inputs

Calculator inputs

Baseline
Parameter set

Threshold convention

Report probability

01 / Distribution

The noise distribution and its tail

Chart. Use the left and right arrow keys to move along the noise values, the up and down arrow keys or Shift with an arrow to move ten at a time, Home and End for the ends; Escape hides the reading.

The centre is a poor guide to the tail.

The largest variance component is bounded. Replacing it with a Gaussian adds tail mass that the exact law does not have.

Chart data
02 / Noise components

Where the variance comes from

Variances rounded for display. Shape sketches use independent horizontal scales.

03 / Method comparison

Four ways to price the tail

04 / Importance sampling

Estimate a tail too rare to observe

Exponential tilting puts draws in the tail, then corrects their weights.

Chernoff optimum

Effective sample size

The standard error describes simulation noise, not uncertainty in the noise model.

Chart. Use the left and right arrow keys to move between recorded batches, Home and End for the first and latest; Escape hides the reading.

Draws · same seed and parameters throughout

05 / Aggregate distribution

Building the distribution

The same operation that adds claim amounts can add coefficient noise.

06 / Custom parameters

What if

Positive Δ means a higher failure bound. Custom results change one parameter at a time from the selected baseline. Only the three FIPS 203 sets are standardised.

07 / Method notes

From coefficient noise to a failure bound

The threshold convention and the modelling assumptions remain part of the result.

Threshold convention

Limits of the model

    Sources and dates
      Reproduce the calculation Technical note (PDF) Notebook