MLKEM(2) MLKEM(2)
NAME
mlkem512_keypair, mlkem512_enc, mlkem512_dec,
mlkem768_keypair, mlkem768_enc, mlkem768_dec,
mlkem1024_keypair, mlkem1024_enc, mlkem1024_dec - Module-
Latice-Based Key-Encapsulation
SYNOPSIS
#include <u.h>
#include <libc.h>
#include <mp.h>
#include <libsec.h>
int mlkem512_keypair(uchar pk[MLKEM512_publicbytes],
uchar sk[MLKEM512_secretbytes]);
int mlkem512_enc(uchar ct[MLKEM512_cipherbytes], uchar ss[MLKEM_bytes],
uchar pk[MLKEM512_publicbytes]);
int mlkem512_dec(uchar ss[MLKEM_bytes], uchar ct[MLKEM512_cipherbytes],
uchar sk[MLKEM512_secretbytes]);
int mlkem768_keypair(uchar pk[MLKEM768_publicbytes],
uchar sk[MLKEM768_secretbytes]);
int mlkem768_enc(uchar ct[MLKEM768_cipherbytes], uchar ss[MLKEM_bytes],
uchar pk[MLKEM768_publicbytes]);
int mlkem768_dec(uchar ss[MLKEM_bytes], uchar ct[MLKEM768_cipherbytes],
uchar sk[MLKEM768_secretbytes]);
int mlkem1024_keypair(uchar pk[MLKEM1024_publicbytes],
uchar sk[MLKEM1024_secretbytes]);
int mlkem1024_enc(uchar ct[MLKEM1024_cipherbytes], uchar ss[MLKEM_bytes],
uchar pk[MLKEM1024_publicbytes]);
int mlkem1024_dec(uchar ss[MLKEM_bytes], uchar ct[MLKEM1024_cipherbytes],
uchar sk[MLKEM1024_secretbytes]);
DESCRIPTION
These functions implement module-latice-based key-
encapsulation as described in the FIPS 203 standard. The
standard defines three security levels that are represented
here by the 512, 768, and 1024 function variants. None of
these functions return allocated memory, yet must allocate
memory for temporaries due to their size. As such, alloca-
tion failures are still possible. The callers of each func-
tion are required to provide correctly sized buffers for
input and output. The array sized constants used above are
defined within <libsec.h>.
Mlkem512_keypair, mlkem768_keypair, and mlkem1024_keypair
generate a new key pair and write the public key into pk and
the secret key into sk. These functions return 0 on success
and non-zero on allocation failure.
Page 1 Plan 9 (printed 10/25/26)
MLKEM(2) MLKEM(2)
Mlkem512_enc, mlkem768_enc, and mlkem1024_enc encapsulate a
shared secret provided in ss into ct using the provided pub-
lic key pk. These functions return 0 on success and non-
zero if the provided public key is malformed or if an allo-
cation failure occurred.
Mlkem512_dec, mlkem768_dec, and mlkem1024_dec decapsulate
the cipher text provided in ct into ss using the provided
secret key sk. Note, decapsulation itself has no checks for
ensuring that the provided cipher text was properly encapsu-
lated with the matching public key. These functions there-
fore must first perform decapsulation, then encapsulation
and check if the resulting cipher text is the same. However
even if resulting cipher texts do not match these functions
do not return an error, instead they return a rejection key
in accordance with the FIPS standard. Thus, the resulting
shared secret should be used only in ways that require the
other party to also assert their knowledge of the shared
secret. Commonly this is done by using the shared secret as
input to a stream cipher. These functions return 0 on suc-
cess and non-zero if the provided secret key is malformed or
if an allocation failure occurred.
SOURCE
/sys/src/libsec/port/mlkem.c
SEE ALSO
FIPS 203
``CRYSTALS -- Kyber: a CCA-secure module-lattice-based
KEM'', https://ia.cr/2017/634
HISTORY
This implementation was first adapted from mlkem-native for
9front in Sept, 2026.
Page 2 Plan 9 (printed 10/25/26)