mlkem.h File Reference

ML-KEM-768 (FIPS 203): Encaps (responder) + KeyGen and Decaps (initiator). More...

#include "protocore_config.h"

Go to the source code of this file.

Detailed Description

ML-KEM-768 (FIPS 203): Encaps (responder) + KeyGen and Decaps (initiator).

The post-quantum half of the mlkem768x25519-sha256 (SSH) and X25519MLKEM768 (TLS 1.3) hybrid key exchanges. Both KEM roles are present:

• responder (server terminating an inbound handshake): Encaps takes the peer's encapsulation key and produces (ciphertext, shared secret);
• initiator (the device dialling out as an SSH/TLS client): KeyGen produces (ek, dk), the peer Encaps against ek, and Decaps recovers the shared secret from the returned ciphertext.

Decaps carries the full constant-time Fujisaki-Okamoto transform (re-encrypt m' under the embedded ek and select the real key vs the implicit-reject key J(z || ct) under a constant-time ciphertext compare), so a malformed or tampered ciphertext yields a pseudorandom secret rather than leaking a decryption failure - FIPS 203 §6.3.

KeyGen, Encaps and Decaps are the FIPS 203 "internal" (derandomized) forms: the caller supplies the randomness (KeyGen's (d, z), Encaps's message m), drawn from the platform RNG in production and fixed in known-answer tests. Deterministic given their inputs, which is exactly what the ACVP keyGen / encapDecap vectors pin.

Arithmetic is a software NTT over q=3329 with Montgomery reduction (the twiddle factors are fixed constants premultiplied into Montgomery form, so each butterfly is two int16 multiplies and a shift - no division, and the hardware MPI, which targets RSA/DH-sized operands, would only add marshaling overhead). Zero heap; peak stack ~9 KB (Decaps, which re-encrypts).

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file mlkem.h.