Module kem 

Hybrid post-quantum key encapsulation mechanism (KEM) based on ML-KEM and ristretto25519.

The rustls package already uses such a hybrid kem (X25519MLKEM768) for PQ KX, but does not expose this to us. So instead of adding an additional package to pull in X25519MLKEM768, we implement our own hybrid KEM using the implementations of ML-KEM and ristretto25519 already in our dependency tree.

Usage

To establish a SharedSecret between, say, Alice and Bob, Alice first generates a decapsulation key using DecapKey::generate. She keeps this key private, but sends the associated encapsulation key (obtained via DecapKey::encap_key) to Bob.

Using this EncapKey, Bob can generate a CiphertextBytes-SharedSecret pair using EncapKey::encap encapsulating the shared secret into the ciphertext.

The shared secret can be retrieved, or decapsulated, from the ciphertext using Alice’s decapsulation key, via DecapKey::decap.

Structs

CiphertextBytes

Encrypted SharedSecret. Create using EncapKey::encap and decrypt using DecapKey::decap.

DecapKey

Decapsulation key, the ‘private key’ of the KEM. Generate using DecapKey::generate.

DecapKeyBytes

Encoded form of DecapKey.

EncapKey

Encapsulation key, the ‘public key’ of the KEM. Can be obtained via DecapKey::encap_key.

EncapKeyBytes

Encoded form of EncapKey.

SharedSecret

Holds shared secrets generated by this KEM.