Detailed Description

ML-KEM-768 encapsulation (FIPS 203), responder side only.

The post-quantum half of the mlkem768x25519-sha256 (SSH) and X25519MLKEM768 (TLS 1.3) hybrid key exchanges. This server is always the KEM responder: the peer sends its ML-KEM encapsulation key, we run Encaps to produce a ciphertext + shared secret. Only Encaps is implemented - no KeyGen or Decaps - so none of the constant-time Fujisaki-Okamoto re-encryption/compare surface is present.

Encaps is the FIPS 203 "internal" (derandomized) form: the 32-octet message m is supplied by the caller (drawn from the platform RNG in production, fixed in known-answer tests). Deterministic given (ek, m), which is exactly what the ACVP encapsulation test vectors pin.

Arithmetic is a software NTT over q=3329 with Montgomery reduction (the twiddle factors are fixed constants premultiplied into Montgomery form, so each butterfly is two int16 multiplies and a shift - no division, and the hardware MPI, which targets RSA/DH-sized operands, would only add marshaling overhead). Zero heap; peak stack ~7 KB.

Author: Douglas Quigg (dstroy0)

Date: 2026

Definition in file mlkem.h.