Skip to content

Support ML-KEM (Kyber) key encapsulation mechanism

Daiki Ueno requested to merge ueno/nettle:wip/dueno/kyber2 into master

This adds support for ML-KEM (Kyber) key encapsulation mechanism being standardized in FIPS 203[1], based also the explanation in draft-schwabe-cfrg-kyber[2]. A couple of notes on the implementation:

  • While the algorithm itself does not require bignum arithmetic, it is implemented as part of libhogweed, as polynomials are represented as an mp_limb_t array on heap allocated using GMP allocation functions.

  • There is a slight difference between the NIST draft and the round 3 submission which [2] is based on. KYBER_ROUND3 macro is added to control the behavior.

  1. https://csrc.nist.gov/pubs/fips/203/ipd
  2. https://datatracker.ietf.org/doc/draft-cfrg-schwabe-kyber/
Edited by Daiki Ueno

Merge request reports