Struct MLKEM768X25519 

pub struct MLKEM768X25519;

MLKEM768-X25519 hybrid post-quantum KEM (ML-KEM-768 with X25519), as specified in draft-ietf-hpke-pq-05.

This is the same construction as X-Wing (draft-connolly-cfrg-xwing-kem), as noted in draft-irtf-cfrg-concrete-hybrid-kems-03 Section 4.2.

MLKEM768-X25519 is usable with the Base and pre-shared key modes of HPKE. draft-ietf-hpke-hpke-05 removed the authenticated modes, so no KEM is required to provide AuthEncap/AuthDecap; for sender authentication, sign the (encapped_key, ciphertext) tuple instead.

The KEM identifier is 0x647a, as registered by the draft in the IANA “HPKE KEM Identifiers” registry.

Key encoding

A secret key is the 32-byte X-Wing seed: Kem::secret_key_to_bytes returns that seed, and Kem::secret_key_from_bytes takes it and re-derives the full key pair (recomputing the public key). The seed is therefore the entire secret; treat it as such.

Example

use hpke::kem::{Kem, MLKEM768X25519};

let (secret_key, public_key) = MLKEM768X25519::generate_keypair().unwrap();
let (shared_secret, encapped_key) = MLKEM768X25519::encap(&public_key).unwrap();
let decapsulated = MLKEM768X25519::decap(&encapped_key, &secret_key).unwrap();
assert_eq!(shared_secret.as_ref(), decapsulated.as_ref());

Trait Implementations

impl Clone for MLKEM768X25519

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for MLKEM768X25519

impl Debug for MLKEM768X25519

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for MLKEM768X25519

impl Kem for MLKEM768X25519

const HPKE_KEM_ID: u16 = 0x647a

The HPKE KEM identifier (draft-ietf-hpke-hpke-05 Section 7.1, IANA “HPKE KEM Identifiers”), used to build the ciphersuite suite_id.

const SHARED_SECRET_SIZE: usize = crypto::xwing::SHARED_SECRET_SIZE

The size of the shared secret produced by this KEM.

const ENCAPPED_KEY_SIZE: usize = crypto::xwing::CIPHERTEXT_SIZE

The size of an encapsulated key.

const PUBLIC_KEY_SIZE: usize = crypto::xwing::PUBLIC_KEY_SIZE

The size of a serialized public key.

const SECRET_KEY_SIZE: usize = crypto::xwing::SECRET_KEY_SIZE

The size of a serialized secret key.

const RANDOMNESS_SIZE: usize = 64

The size of the randomness consumed by Kem::encap_deterministic.

type PublicKey = PublicKey

The public (encapsulation) key type.

type SecretKey = SecretKey

The secret (decapsulation) key type.

type EncappedKey = [u8; 1120]

The encapsulated key type (the KEM ciphertext sent alongside the first encrypted message).

fn derive_keypair( input_keying_material: &[u8], ) -> Result<(Self::SecretKey, Self::PublicKey), HpkeError>

Deterministically derives a key pair from input keying material.

fn generate_keypair() -> Result<(Self::SecretKey, Self::PublicKey), HpkeError>

Generates a fresh random key pair using the operating system’s random number generator.

fn derive_public_key(secret_key: &Self::SecretKey) -> Self::PublicKey

Derives the public key of a secret key.

fn public_key_to_bytes( out: &mut [u8], public_key: &Self::PublicKey, ) -> Result<(), HpkeError>

Serializes a public key into out, which must be exactly Kem::PUBLIC_KEY_SIZE bytes long.

fn public_key_from_bytes(bytes: &[u8]) -> Result<Self::PublicKey, HpkeError>

Deserializes a public key from bytes, which must be exactly Kem::PUBLIC_KEY_SIZE bytes long and a valid, fully validated public key.

fn secret_key_to_bytes( out: &mut [u8], secret_key: &Self::SecretKey, ) -> Result<(), HpkeError>

Serializes a secret key into out, which must be exactly Kem::SECRET_KEY_SIZE bytes long.

fn secret_key_from_bytes(bytes: &[u8]) -> Result<Self::SecretKey, HpkeError>

Deserializes a secret key from bytes, which must be exactly Kem::SECRET_KEY_SIZE bytes long.

fn encapped_key_to_bytes( out: &mut [u8], encapped_key: &Self::EncappedKey, ) -> Result<(), HpkeError>

Serializes an encapsulated key into out, which must be exactly Kem::ENCAPPED_KEY_SIZE bytes long.

fn encapped_key_from_bytes(bytes: &[u8]) -> Result<Self::EncappedKey, HpkeError>

Deserializes an encapsulated key from bytes, which must be exactly Kem::ENCAPPED_KEY_SIZE bytes long.

fn encap( recipient_public_key: &Self::PublicKey, ) -> Result<(Hash, Self::EncappedKey), HpkeError>

Encapsulates a fresh shared secret against recipient_public_key using a freshly generated ephemeral key pair.

fn encap_deterministic( recipient_public_key: &Self::PublicKey, randomness: &[u8], ) -> Result<(Hash, Self::EncappedKey), HpkeError>

Encapsulates a shared secret against recipient_public_key from caller-provided randomness (EncapDerand).

fn encap_with_ephemeral( ephemeral_secret_key: &Self::SecretKey, recipient_public_key: &Self::PublicKey, ) -> Result<(Hash, Self::EncappedKey), HpkeError>

Encapsulates a shared secret against recipient_public_key, using the given ephemeral secret key ephemeral_secret_key.

fn decap( encapped_key: &Self::EncappedKey, recipient_secret_key: &Self::SecretKey, ) -> Result<Hash, HpkeError>

Recovers the shared secret encapsulated in encapped_key with the secret key recipient_secret_key.

impl PartialEq for MLKEM768X25519

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for MLKEM768X25519