ML-KEM Decapsulate

Category: Post-Quantum Cryptography · Node Type ID: pqc-mlkem-decaps

Decapsulates shared key using secret key and ciphertext

Overview

Decapsulates an ML-KEM ciphertext (NIST FIPS 203) using the recipient's decapsulation Secret Key to recover the exact same 32-byte Recovered Shared Key produced by ML-KEM Encapsulate.

Per FIPS 203 Fujisaki-Okamoto transform with implicit rejection, if a tampered ciphertext of the correct byte length is supplied, decapsulation deterministically outputs a pseudorandom rejection key without leaking timing or failure side channels.

When to Use

Recovering the 32-byte post-quantum shared secret on the recipient side of an ML-KEM key exchange.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Variant `variant`	`select` Default: `768`	Always visible	Must match the ML-KEM variant used during key generation and encapsulation (`512`, `768`, or `1024`). `512`: ML-KEM-512 `768`: ML-KEM-768 `1024`: ML-KEM-1024

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Fixed Input Ports (2 total).

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`Secret Key`	`secretKey`	`Bytes`	Required	Always visible	Recipient's ML-KEM decapsulation secret key (1632B, 2400B, or 3168B).
`Ciphertext`	`ciphertext`	`Bytes`	Required	Always visible	ML-KEM ciphertext (768B, 1088B, or 1568B) received from the sender.

Output Ports

Port Nature: Fixed Output Ports (1 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Recovered Shared Key`	`sharedSecret`	`Bytes` (32B)	Always visible	Recovered 32-byte shared secret key.

Error Cases

When any of the following conditions occurs at runtime, this node transitions to an ERROR state and downstream nodes connected to its outputs do not execute.

Error Code	Default Engine Message	Trigger Condition
`INVALID_KEY_MATERIAL`	Invalid key length or format	Raised when `Secret Key` or `Ciphertext` byte length does not match the selected ML-KEM variant.

Examples

Recovering the ML-KEM-768 Shared Key

Decapsulate the ciphertext and verify that both sides hold the same 32-byte key.

Connect Secret Key from ML-KEM KeyGen and Ciphertext from ML-KEM Encapsulate to ML-KEM Decapsulate.
Compare Recovered Shared Key with the sender's Shared Key using Compare.