java.lang.Object
org.bouncycastle.pqc.crypto.mlkem.MLKEMIndCpa
class MLKEMIndCpaextends Object
Indistinguishability under Chosen Plaintext Attack (IND-CPA) security for ML-KEM. Provides key generation operations with IND-CPA security guarantees.

  • Field Summary

    Modifier and Type
    Field
    Description
    private MLKEMEngine
    engine
    The engine providing the primitives.
    private int
    indCpaBytes
    Ciphertext size of the IND-CPA scheme.
    private int
    indCpaPublicKeyBytes
    Public key size of the IND-CPA scheme.
    final int
    KyberGenerateMatrixNBlocks
    Number of XOF blocks squeezed per matrix entry, computed once in the constructor.
    private int
    kyberK
    The dimension K of the parameter set.
    private int
    polyCompressedBytes
    Size of a compressed polynomial.
    private int
    polyVecBytes
    Size of an uncompressed polynomial vector.
    private int
    polyVecCompressedBytes
    Size of a compressed polynomial vector.
    private Symmetric
    symmetric
    The symmetric primitives for the hashing.

  • Constructor Summary

    Constructors
    Constructor
    Description
    MLKEMIndCpa(MLKEMEngine engine)
    Creates the IND-CPA layer, caching the sizes derived from the engine's parameter set.

  • Method Summary

    Modifier and Type
    Method
    Description
    byte[]
    decrypt(byte[] secretKey, byte[] cipherText)
    Decrypts a ciphertext under the IND-CPA secret key, recovering the plaintext.
    byte[]
    encrypt(byte[] publicKeyInput, byte[] msg, byte[] coins)
    Encrypts a message under the IND-CPA public key, drawing all noise from the supplied coins.
    (package private) byte[][]
    generateKeyPair(byte[] d)
    Generates IndCpa Key Pair
    void
    generateMatrix(PolyVec[] aMatrix, byte[] seed, boolean transposed)
    Expands a 32-byte seed into the KyberK by KyberK public matrix A by rejection sampling.
    private byte[]
    packCipherText(PolyVec b, Poly v)
    Packs the two parts into the ciphertext.
    byte[]
    packPublicKey(PolyVec publicKeyPolyVec, byte[] seed)
    Packs a public key vector and its seed into the encapsulation key wire format.
    byte[]
    packSecretKey(PolyVec secretKeyPolyVec)
    Packs a secret key vector into the decapsulation key wire format.
    private static int
    rejectionSampling(Poly outputBuffer, int coeffOff, int len, byte[] inpBuf, int inpBufLen)
    Fills the polynomial by rejection sampling.
    private void
    unpackCipherText(PolyVec b, Poly v, byte[] cipherText)
    Unpacks the ciphertext into its two parts.
    byte[]
    unpackPublicKey(PolyVec publicKeyPolyVec, byte[] publicKey)
    Splits a packed encapsulation key into its key vector and its trailing public seed.
    void
    unpackSecretKey(PolyVec secretKeyPolyVec, byte[] secretKey)
    Deserializes a packed decapsulation key into the destination vector.

    Methods inherited from class Object

    clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • engine

      private MLKEMEngine engine
      The engine providing the primitives.

    • kyberK

      private int kyberK
      The dimension K of the parameter set.

    • indCpaPublicKeyBytes

      private int indCpaPublicKeyBytes
      Public key size of the IND-CPA scheme.

    • polyVecBytes

      private int polyVecBytes
      Size of an uncompressed polynomial vector.

    • indCpaBytes

      private int indCpaBytes
      Ciphertext size of the IND-CPA scheme.

    • polyVecCompressedBytes

      private int polyVecCompressedBytes
      Size of a compressed polynomial vector.

    • polyCompressedBytes

      private int polyCompressedBytes
      Size of a compressed polynomial.

    • symmetric

      private Symmetric symmetric
      The symmetric primitives for the hashing.

    • KyberGenerateMatrixNBlocks

      public final int KyberGenerateMatrixNBlocks
      Number of XOF blocks squeezed per matrix entry, computed once in the constructor.

  • Constructor Details

    • MLKEMIndCpa

      public MLKEMIndCpa(MLKEMEngine engine)
      Creates the IND-CPA layer, caching the sizes derived from the engine's parameter set.
      Parameters:
      engine - the parameter set supplying the Kyber constants, sizes and symmetric primitives

  • Method Details

    • generateKeyPair

      byte[][] generateKeyPair(byte[] d)
      Generates IndCpa Key Pair
      Parameters:
      d - the 32-byte random seed from which the keypair is derived
      Returns:
      KeyPair where each key is represented as bytes

    • encrypt

      public byte[] encrypt(byte[] publicKeyInput, byte[] msg, byte[] coins)
      Encrypts a message under the IND-CPA public key, drawing all noise from the supplied coins.
      Parameters:
      publicKeyInput - the packed encapsulation key, the compressed key vector then the 32-byte seed
      msg - the plaintext to encrypt, KyberIndCpaMsgBytes long
      coins - the 32-byte random coins supplying the encryption noise
      Returns:
      the packed ciphertext, KyberIndCpaBytes long

    • packCipherText

      private byte[] packCipherText(PolyVec b, Poly v)
      Packs the two parts into the ciphertext.
      Parameters:
      b - the vector part
      v - the polynomial part
      Returns:
      the packed ciphertext

    • unpackCipherText

      private void unpackCipherText(PolyVec b, Poly v, byte[] cipherText)
      Unpacks the ciphertext into its two parts.
      Parameters:
      b - the vector part to fill
      v - the polynomial part to fill
      cipherText - the packed ciphertext

    • packPublicKey

      public byte[] packPublicKey(PolyVec publicKeyPolyVec, byte[] seed)
      Packs a public key vector and its seed into the encapsulation key wire format.
      Parameters:
      publicKeyPolyVec - the key vector to serialize, filled in by this call
      seed - the 32-byte public seed appended after the key vector
      Returns:
      the packed encapsulation key, KyberPublicKeyBytes long

    • unpackPublicKey

      public byte[] unpackPublicKey(PolyVec publicKeyPolyVec, byte[] publicKey)
      Splits a packed encapsulation key into its key vector and its trailing public seed.
      Parameters:
      publicKeyPolyVec - the destination for the key vector in the leading bytes, before the seed
      publicKey - the packed encapsulation key to split
      Returns:
      the trailing KyberSymBytes-byte public seed

    • packSecretKey

      public byte[] packSecretKey(PolyVec secretKeyPolyVec)
      Packs a secret key vector into the decapsulation key wire format.
      Parameters:
      secretKeyPolyVec - the decapsulation key vector to serialize
      Returns:
      the packed decapsulation key, KyberIndCpaSecretKeyBytes long

    • unpackSecretKey

      public void unpackSecretKey(PolyVec secretKeyPolyVec, byte[] secretKey)
      Deserializes a packed decapsulation key into the destination vector.
      Parameters:
      secretKeyPolyVec - the destination for the deserialized key vector
      secretKey - the packed decapsulation key

    • generateMatrix

      public void generateMatrix(PolyVec[] aMatrix, byte[] seed, boolean transposed)
      Expands a 32-byte seed into the KyberK by KyberK public matrix A by rejection sampling.
      Parameters:
      aMatrix - the KyberK by KyberK matrix to fill, one PolyVec per row
      seed - the 32-byte seed absorbed by the XOF to expand the matrix
      transposed - true to swap the row and column indices, producing the transposed matrix used by encryption

    • rejectionSampling

      private static int rejectionSampling(Poly outputBuffer, int coeffOff, int len, byte[] inpBuf, int inpBufLen)
      Fills the polynomial by rejection sampling.
      Parameters:
      outputBuffer - the polynomial to fill
      coeffOff - where to start writing coefficients
      len - the number of coefficients to read
      inpBuf - the random bytes to sample from
      inpBufLen - the length of the random bytes
      Returns:
      the number of input bytes consumed

    • decrypt

      public byte[] decrypt(byte[] secretKey, byte[] cipherText)
      Decrypts a ciphertext under the IND-CPA secret key, recovering the plaintext.
      Parameters:
      secretKey - the packed decapsulation key
      cipherText - the packed ciphertext to decrypt
      Returns:
      the recovered plaintext, KyberIndCpaMsgBytes long