feat: hom prf keygen protocol

[kc1212]

Description of changes

Implement homomorphic prf keygen on the core/threshold side.

As we don't have the right types to store the key yet, some bits of this PR will change. But it's good to setup the basic protocol and the tests to ensure everything works well going forward.

Issue ticket number and link

Closes zama-ai/kms-internal#2978

PR Checklist

I attest that all checked items are satisfied. Any deviation is clearly justified above.

• Title follows conventional commits (e.g. chore: ...).
• Tests added for every new pub item and test coverage has not decreased.
• Public APIs and non-obvious logic documented; unfinished work marked as TODO(#issue).
• unwrap/expect/panic only in tests or for invariant bugs (documented if present).
• No dependency version changes OR (if changed) only minimal required fixes.
• No architectural protocol changes OR linked spec PR/issue provided.
• No breaking deployment config changes OR devops label + infra notified + infra-team reviewer assigned.
• No breaking gRPC / serialized data changes OR commit marked with ! and affected teams notified.
• No modifications to existing versionized structs OR backward compatibility tests updated.
• No critical business logic / crypto changes OR ≥2 reviewers assigned.
• No new sensitive data fields added OR Zeroize + ZeroizeOnDrop implemented.
• No new public storage data OR data is verifiable (signature / digest).
• No unsafe; if unavoidable: minimal, justified, documented, and test/fuzz covered.
• Strongly typed boundaries: typed inputs validated at the edge; no untyped values or errors cross modules.
• Self-review completed.

Dependency Update Questionnaire (only if deps changed or added)

Answer in the Cargo.toml next to the dependency (or here if updating):

1. Ownership changes or suspicious concentration?
2. Low popularity?
3. Unusual version jump?
4. Lacking documentation?
5. Missing CI?
6. No security / disclosure policy?
7. Significant size increase?

More details and explanations for the checklist and dependency updates can be found in CONTRIBUTING.md

[github-actions]

Consolidated Tests Results 2026-04-16 - 13:32:25

Test Results

18 passed

Details

18 tests
not captured
junit-to-ctrf
build-and-test test-reporter #1389
feat: hom prf keygen protocol #527

test-reporter: Run #1389

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Pending ⏳	Other ❓	Flaky 🍂	Duration ⏱️
18	18	0	0	0	0	0	not captured

🎉 All tests passed!

Tests

View All Tests

Test Name	Status	Flaky	Duration
nightly_full_gen_tests_k8s_default_threshld_sequential_crs	✅		32.6s
test_k8s_threshld_insecure	✅		3m 18s
k8s_test_crs_uniqueness	✅		32.7s
k8s_test_insecure_keygen_encrypt_and_public_decrypt	✅		3m 23s
k8s_test_insecure_keygen_encrypt_multiple_types	✅		3m 44s
k8s_test_keygen_and_crs	✅		3m 17s
k8s_test_keygen_uniqueness	✅		9m 1s
nightly_full_gen_tests_k8s_default_threshld_sequential_crs	✅		34.7s
test_k8s_threshld_insecure	✅		3m 23s
k8s_test_crs_uniqueness	✅		34.6s
k8s_test_insecure_keygen_encrypt_and_public_decrypt	✅		3m 25s
k8s_test_insecure_keygen_encrypt_multiple_types	✅		3m 45s
k8s_test_keygen_and_crs	✅		3m 23s
k8s_test_keygen_uniqueness	✅		9m 17s
nightly_full_gen_tests_k8s_default_centralzd_sequential_crs	✅		1.8s
test_k8s_centralzd_insecure	✅		1m 2s
k8s_test_centralized_insecure	✅		1m 2s
nightly_full_gen_tests_default_k8s_centralized_sequential_crs	✅		1.8s

_{🍂 No flaky tests in this run.}

Github Test Reporter by CTRF 💚

🔄 This comment has been updated

[titouantanguy]

LGTM !