Merge pull request #1530 from usnistgov/ML-DSA-Clarification

Clarifies table until we can fix it later

src/ml-dsa/sections/04-testtypes.adoc

@@ -33,6 +33,8 @@ The tests described in this document have the intention of ensuring an implement
 
 Within ML-DSA sigGen, the algorithm enters a loop until a valid signature is found. The loop contains four potential reasons to reject a candidate signature: if the z infinity norm is too large, if the r infinity norm is too large, if there are too many hints in h, or if the ct0 infinity norm is too large. These conditions occur at various rarities that can make it difficult to test each error condition with randomized testing. If an implementation adheres strictly to the pseudocode in <<FIPS204>>, the following table provides helpful known answer tests that trigger each rejection case exactly once. If the implementation varies from the psuedocode, it would be prudent to use a debugger to ensure that all rejection cases are triggered by testing. To save on space, the table will provide the seed used to generate the key pair, and a hash of the keys, SHA2-256(pk || sk). A hash of the resulting signature is also provided, SHA2-256(sig). All cases are defined using the deterministic signature method. Note that the ct0 infinity norm check only applies to ML-DSA-44. This condition is not possible on the other security levels. Thanks to Qinglai Xiao and Mike Hamburg (Rambus Inc) for providing code to generate these test cases; more information on their technique is available on the NIST PQC-Forum <<PQCForum>>. 
 
+NOTE: The following table was generated using a draft version of FIPS 204. To regenerate the correct key from the seed provided, a change to Algorithm 6 ML-DSA.KeyGen_internal is required. Line 1 should read `<- H(xi, 128)` where `xi` is the seed.
+
 [[kats_table]]
 .ML-DSA sigGen Known Answer Tests for Rejection Cases
 |===