`rok::core::crypto::mlkem`

ML-KEM-768 (FIPS 203): k = 3, eta1 = eta2 = 2, du = 10, dv = 4.

Polynomials are 256 coefficients in [0, q) held in secret storage (SecretWords; a vector of k polynomials is one buffer of 256k), and so are the secret seeds, keys and messages. Secret values never steer a branch or an index: reduction is an exact multiply-shift division by q, the re-encryption compare and the implicit-rejection key select are masks. Only the rejection sampling of the public matrix branches.

Structs

MlKem768

pub struct MlKem768

ML-KEM-768 key encapsulation. The functions are the deterministic _internal forms: the caller supplies the random seeds.

pub const ENCAPSULATION_KEY_LEN: usize = 1184

pub const DECAPSULATION_KEY_LEN: usize = 2400

```
pub const CIPHERTEXT_LEN: usize = 1088
```
```
pub const SHARED_KEY_LEN: usize = 32
```

pub fn keygen(d: Bytes, z: Bytes) throws (ValueError) -> (List<u8>, Secret)

KeyGen from 32-byte seeds d and z: (ek, dk).

```
pub fn encapsulate(ek: Bytes, m: Bytes) throws (ValueError) -> (Secret, List<u8>)
```
Encaps with the 32-byte message m: (shared key, ciphertext). ek must pass the length and modulus checks (FIPS 203 7.2).
```
pub fn decapsulate(dk: Bytes, c: Bytes) throws (ValueError) -> Secret
```
Decaps: the shared key, or (implicit rejection) a key derived from z and c when c does not re-encrypt to itself.