java.lang.Object
org.bouncycastle.pqc.crypto.mlkem.MLKEMEngine
class MLKEMEngineextends Object
Core engine for ML-KEM (Module-Lattice Key Encapsulation Mechanism) operations. Implements the cryptographic primitives for key generation, encapsulation, and decapsulation.

  • Field Details

    • random

      private SecureRandom random
      Random source for the key generation and encapsulation.

    • indCpa

      private MLKEMIndCpa indCpa
      The IND-CPA core of the KEM.

    • KyberN

      public static final int KyberN
      Kyber N parameter
      See Also:

    • KyberQ

      public static final int KyberQ
      Kyber Q parameter
      See Also:

    • KyberQinv

      public static final int KyberQinv
      Kyber Q inverse parameter
      See Also:

    • KyberSymBytes

      public static final int KyberSymBytes
      Number of bytes for Hashes and Seeds
      See Also:

    • KyberSharedSecretBytes

      private static final int KyberSharedSecretBytes
      Shared secret length, in bytes.
      See Also:

    • KyberPolyBytes

      public static final int KyberPolyBytes
      Kyber polynomial bytes
      See Also:

    • KyberEta2

      private static final int KyberEta2
      Eta2 noise parameter value.
      See Also:

    • KyberIndCpaMsgBytes

      private static final int KyberIndCpaMsgBytes
      Message length of the IND-CPA scheme, in bytes.
      See Also:

    • KyberK

      private final int KyberK
      The k parameter of the Kyber variant.

    • KyberPolyVecBytes

      private final int KyberPolyVecBytes
      Polynomial vector length, in bytes.

    • KyberPolyCompressedBytes

      private final int KyberPolyCompressedBytes
      Compressed polynomial length, in bytes.

    • KyberPolyVecCompressedBytes

      private final int KyberPolyVecCompressedBytes
      Compressed polynomial vector length, in bytes.

    • KyberEta1

      private final int KyberEta1
      Eta1 noise parameter value.

    • KyberIndCpaPublicKeyBytes

      private final int KyberIndCpaPublicKeyBytes
      IND-CPA public key length, in bytes.

    • KyberIndCpaSecretKeyBytes

      private final int KyberIndCpaSecretKeyBytes
      IND-CPA secret key length, in bytes.

    • KyberIndCpaBytes

      private final int KyberIndCpaBytes
      IND-CPA scheme size, in bytes.

    • KyberPublicKeyBytes

      private final int KyberPublicKeyBytes
      Encapsulating key length, in bytes.

    • KyberSecretKeyBytes

      private final int KyberSecretKeyBytes
      Decapsulating key length, in bytes.

    • KyberCipherTextBytes

      private final int KyberCipherTextBytes
      Ciphertext length, in bytes.

    • CryptoBytes

      private final int CryptoBytes
      Size named by the crypto suffix of the variant.

    • CryptoSecretKeyBytes

      private final int CryptoSecretKeyBytes
      Secret key length named by the crypto suffix.

    • CryptoPublicKeyBytes

      private final int CryptoPublicKeyBytes
      Public key length named by the crypto suffix.

    • CryptoCipherTextBytes

      private final int CryptoCipherTextBytes
      Ciphertext length named by the crypto suffix.

    • sessionKeyLength

      private final int sessionKeyLength
      Session key length derived per variant, in bytes.

    • symmetric

      private final Symmetric symmetric
      The symmetric primitives used by the scheme.

  • Constructor Details

    • MLKEMEngine

      public MLKEMEngine(int k)
      Build the parameter set for the given security level.
      Parameters:
      k - the security parameter: 2, 3 or 4

  • Method Details

    • getSymmetric

      public Symmetric getSymmetric()
      The symmetric primitives bound to this parameter set.
      Returns:
      the symmetric primitive set this engine was built with

    • getKyberEta2

      public static int getKyberEta2()
      The eta2 noise parameter.
      Returns:
      KyberEta2, the coefficient bound used when sampling messages

    • getKyberIndCpaMsgBytes

      public static int getKyberIndCpaMsgBytes()
      Message length in bytes that the IND-CPA scheme accepts.
      Returns:
      KyberIndCpaMsgBytes, the limit in bytes

    • getCryptoCipherTextBytes

      public int getCryptoCipherTextBytes()
      Ciphertext length in bytes at the KEM layer.
      Returns:
      CryptoCipherTextBytes, the length in bytes

    • getCryptoPublicKeyBytes

      public int getCryptoPublicKeyBytes()
      Public key length in bytes at the KEM layer.
      Returns:
      CryptoPublicKeyBytes, the length in bytes

    • getCryptoSecretKeyBytes

      public int getCryptoSecretKeyBytes()
      Secret key length in bytes at the KEM layer.
      Returns:
      CryptoSecretKeyBytes, the length in bytes

    • getCryptoBytes

      public int getCryptoBytes()
      Total key material length in bytes at the KEM layer.
      Returns:
      CryptoBytes, the combined length in bytes

    • getKyberCipherTextBytes

      public int getKyberCipherTextBytes()
      Ciphertext length in bytes produced by the IND-CPA scheme.
      Returns:
      KyberCipherTextBytes, the length in bytes

    • getKyberSecretKeyBytes

      public int getKyberSecretKeyBytes()
      Secret key length in bytes for the IND-CPA scheme.
      Returns:
      KyberSecretKeyBytes, the length in bytes

    • getKyberIndCpaPublicKeyBytes

      public int getKyberIndCpaPublicKeyBytes()
      Public key length in bytes for the IND-CPA scheme.
      Returns:
      KyberIndCpaPublicKeyBytes, the length in bytes

    • getKyberIndCpaSecretKeyBytes

      public int getKyberIndCpaSecretKeyBytes()
      Secret key length in bytes for the IND-CPA scheme.
      Returns:
      KyberIndCpaSecretKeyBytes, the length in bytes

    • getKyberIndCpaBytes

      public int getKyberIndCpaBytes()
      Seed length in bytes for the IND-CPA scheme.
      Returns:
      KyberIndCpaBytes, the length in bytes

    • getKyberPublicKeyBytes

      public int getKyberPublicKeyBytes()
      Public key length in bytes before the KEM layer wraps it.
      Returns:
      KyberPublicKeyBytes, the length in bytes

    • getKyberPolyCompressedBytes

      public int getKyberPolyCompressedBytes()
      Size in bytes of one compressed polynomial.
      Returns:
      KyberPolyCompressedBytes, the length in bytes

    • getKyberK

      public int getKyberK()
      The security parameter: 2, 3 or 4.
      Returns:
      KyberK, the level: 2, 3 or 4

    • getKyberPolyVecBytes

      public int getKyberPolyVecBytes()
      Size in bytes of one uncompressed polynomial vector.
      Returns:
      KyberPolyVecBytes, the length in bytes

    • getKyberPolyVecCompressedBytes

      public int getKyberPolyVecCompressedBytes()
      Size in bytes of one compressed polynomial vector.
      Returns:
      KyberPolyVecCompressedBytes, the length in bytes

    • getKyberEta1

      public int getKyberEta1()
      The eta1 noise parameter.
      Returns:
      KyberEta1, the coefficient bound used when sampling ciphertext

    • init

      public void init(SecureRandom random)
      Bind the entropy source used for key generation and encapsulation.
      Parameters:
      random - the source to draw randomness from

    • generateKemKeyPair

      public byte[][] generateKemKeyPair()
      Generate a KEM key pair, drawing both seeds from the bound entropy source.
      Returns:
      the key pair components, laid out as generateKemKeyPairInternal does

    • generateKemKeyPairInternal

      public byte[][] generateKemKeyPairInternal(byte[] d, byte[] z)
      Expand the two seeds into the full ML-KEM key pair.
      Parameters:
      d - the seed for the internal IND-CPA key pair
      z - the seed kept for implicit rejection
      Returns:
      the key pair: encapsulated public key, hashed public key, secret key, hashed public key, z, and the concatenated seeds

    • kemEncryptInternal

      public byte[][] kemEncryptInternal(byte[] publicKeyInput, byte[] randBytes)
      Encapsulate a shared secret against the recipient's public key.
      Parameters:
      publicKeyInput - the recipient's encapsulated public key
      randBytes - the 32 bytes of randomness the message hiding samples need
      Returns:
      the ciphertext and the shared secret

    • kemDecryptInternal

      public byte[] kemDecryptInternal(byte[] secretKey, byte[] cipherText)
      Recover the shared secret from a ciphertext.
      Parameters:
      secretKey - the recipient's secret key
      cipherText - the ciphertext to decapsulate
      Returns:
      the shared secret

    • kemEncrypt

      public byte[][] kemEncrypt(byte[] publicKeyInput, byte[] randBytes)
      Encapsulate a shared secret, drawing the randomness from this engine.
      Parameters:
      publicKeyInput - the recipient's encapsulated public key
      randBytes - the 32 bytes of randomness to encapsulate with
      Returns:
      the ciphertext and the shared secret

    • kemDecrypt

      public byte[] kemDecrypt(byte[] secretKey, byte[] cipherText)
      Recover the shared secret from a ciphertext.
      Parameters:
      secretKey - the recipient's secret key
      cipherText - the ciphertext to decapsulate
      Returns:
      the shared secret

    • cmov

      private void cmov(byte[] r, byte[] x, int xlen, boolean b)
      Conditionally copies x into r, constant time.
      Parameters:
      r - the destination array
      x - the source array
      xlen - the source length, in bytes
      b - true to copy

    • getRandomBytes

      public void getRandomBytes(byte[] buf)
      Fill a buffer with bytes from the bound entropy source.
      Parameters:
      buf - the buffer to fill, sized by the caller