Skip to main content
2 of 4
added 697 characters in body
Daniel S
  • 26.4k
  • 1
  • 29
  • 69

@DannyNiu is correct in noting that the public key is a necessary part of the ML-KEM.Decaps_internal, but the reason why this should be protected in the same way as the secret key has additional subtleties.

IN PROGRESS

What the values mean mathematically

Firstly, we note that in the idealised (M)MWE set-up $A\mathbf s+\mathbf e =\mathbf t$, the value sk (written $\mathrm {dk_{PKE}}$ in the standard) corresponds to $\mathbf s$ and the value pk (written $\mathrm {ek_{PKE}}$ in the standard) corresponds to $\mathbf t$. We note that the value $\mathbf s$ is sufficient information to recover execute K-PKE.Decrypt which is the core functionality, just as the the $\mathbf t$ is sufficient (with additional random value $r$) to execute K-PKE.Encrypt for a givne payload $m$.

Daniel S
  • 26.4k
  • 1
  • 29
  • 69