An Evidence-Gated KCMVP Pre-Certification Decision-Support Prototype: Rule-Based Analysis, Evidence Retrieval, and Constrained LLM Review

The Korean Cryptographic Module Validation Program (KCMVP) requires the joint review of source code, submission documents, and their traceability. This study presents an evidence-gated decision-support prototype combining rule-based candidate generation (L1), rule-bound evidence retrieval (L2), program-fact verification, and constrained LLM-assisted review (L3). Its 166 YAML rule assets, comprising 97 code rules, 65 document rules, and four traceability rules, were developed with reference to official KCMVP procedures and National Intelligence Service guidance on submission preparation and cryptographic algorithm implementation. On an LEA-centered development corpus, L1 matched 115 of 128 author-annotated positive file–rule pairs (89.84%). However, because these annotations were created during system development, independent expert validation is required before interpreting this value as detection accuracy. In nine source-derived mutation groups, the baseline and improved-evidence conditions each produced six binary dispositions and three holds (exact McNemar test, p=1.0). This result defines the current role of L2 as supplying traceable evidence, validating citations, and withholding unsupported decisions rather than independently determining compliance. L3 reviews only residual candidates supported by validated evidence and program facts under a structured output contract; failure to satisfy input, evidence, citation, or output-validation conditions results in a hold. Overall, the results demonstrate a feasible and auditable architecture that preserves evidence provenance and explicitly holds unresolved cases instead of forcing unsupported decisions.