@DannyNiu is correct in noting that the public key is a necessary part of the ML-KEM.Decaps_internal
, but the reason why this should be protected in the same way as the secret key has additional subtleties.
IN PROGRESS
What the values mean mathematically
Firstly, we note that in the idealised (M)MWE set-up $A\mathbf s+\mathbf e =\mathbf t$, the value sk
(written $\mathrm {dk_{PKE}}$ in the standard) corresponds to $\mathbf s$ and the value pk
(written $\mathrm {ek_{PKE}}$ in the standard) corresponds to $\mathbf t$. We note that the value $\mathbf s$ is sufficient information to recover execute K-PKE.Decrypt
which is the core functionality, just as the the $\mathbf t$ is sufficient (with additional random value $r$) to execute K-PKE.Encrypt
for a givne payload $m$.