Post-Quantum · KEM NIST FIPS 203 (ML-KEM-768) C2SP CCTV Vector Verified

ML-KEM-768 decapsulation

Decapsulates a ciphertext with the full-size 2400-byte decapsulation key and checks the shared secret against an independent implementation's vector.

Open in app Download .ncw

Overview & Cryptographic Context

ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), standardized in NIST FIPS 203 (derived from CRYSTALS-Kyber), is the primary post-quantum key establishment standard designed to resist quantum computers running Shor's algorithm. The parameter set ML-KEM-768 targets NIST Security Category 3 (roughly equivalent to AES-192) using rank-k=3 polynomial matrices over R_q = ℤ₃₃₂₉[X]/(X²⁵⁶+1).

Unlike randomised encapsulation (ML-KEM.Encaps), decapsulation (ML-KEM.Decaps) is completely deterministic: given the 2,400-byte decapsulation key dk = dk_PKE ‖ ek ‖ H(ek) ‖ z and a 1,088-byte ciphertext c, it decrypts the candidate message m', re-encapsulates (K', c') = Encaps(ek, m') using the Fujisaki-Okamoto (FO) transform, and performs a constant-time comparison c = c' to return the 32-byte shared secret K (or an implicit-rejection pseudorandom value derived from z if modified).

Pipeline Architecture & Wiring Flow

Workflow Input (Decapsulation Key 2400B, Ciphertext 1088B) ──► ML-KEM Decapsulate (variant = 768) ──► Workflow Output (Shared Secret 32B)

Key & Ciphertext Ingress (Workflow Input): Supplies the full 2,400-byte Decapsulation Key and 1,088-byte Ciphertext.
FO Transform Decapsulation (ML-KEM Decapsulate): Configured with variant = 768. Executes K-PKE decryption, SHA3-256 / SHA3-512 hashing, and FO re-encryption verification.
Shared Secret Egress (Workflow Output): Emits the 32-byte (256-bit) Shared Secret.

Nodes & Configuration

Node	Node Role & Key Parameters	Count
Workflow Input	Supplies `Decapsulation Key` (2,400 B) and `Ciphertext` (1,088 B)	1
ML-KEM Decapsulate	Configured with `variant = 768` (ML-KEM-768)	1
Workflow Output	Collects the 32-byte `Shared Secret`	1

Node reference →

Inputs, Outputs & Test Vector Verification

Verification Source: C2SP CCTV ML-KEM intermediate/ML-KEM-768.txt (dk, c, K). The vectors follow the FIPS 203 draft key generation; Decaps is the same as the final standard.

Inputs

Name	Type	Value Summary (Full Vector Embedded in .ncw)
`Decapsulation Key`	`bytes` (2,400 B)	`3261790e9484c6453502778de5faccecc56d94fbbb3d6a039d03ceb70b254f2a…7e03e57f0600da8` (4,800 hex chars)
`Ciphertext`	`bytes` (1,088 B)	`afb72488670b7d47769ee04d7479303a40b8b9d395eccdae13519e11f68df029…7f9feea416e410b` (2,176 hex chars)

Expected Outputs

Name	Type	Value (Hex)
`Shared Secret`	`bytes` (32 B)	`4b4eba37eff0315dc6009dcffb4dfbbb680f8f2ebde8715fa3d6daf70256a2d9`