In cryptography, a key encapsulation mechanism (KEM) is a public-key cryptosystem that allows a sender to generate a short secret key and transmit it to a receiver confidentially, in spite of eavesdropping and intercepting adversaries. Modern standards for public-key encryption of arbitrary messages are usually based on KEMs. A KEM allows a sender who knows a public key to simultaneously generate a short random secret key and an encapsulation or ciphertext of the secret key by the KEM's encapsulation algorithm. The receiver who knows the private key corresponding to the public key can recover the same random secret key from the encapsulation by the KEM's decapsulation algorithm. The security goal of a KEM is to prevent anyone who does not know the private key from recovering any information about the encapsulated secret keys, even after eavesdropping or submitting other encapsulations to the receiver to study how the receiver reacts.
Difference from public-key encryption
The difference between a public-key encryption scheme and a KEM is that a public-key encryption scheme allows a sender to choose an arbitrary message from some space of possible messages, while a KEM chooses a short secret key at random for the sender. The sender may take the random secret key produced by a KEM and use it as a symmetric key for an authenticated cipher whose ciphertext is sent alongside the encapsulation to the receiver. This serves to compose a public-key encryption scheme out of a KEM and a symmetric-key authenticated cipher in a hybrid cryptosystem. Most public-key encryption schemes such as RSAES-PKCS1-v1_5, RSAES-OAEP, and Elgamal encryption are limited to small messages and are almost always used to encrypt a short random secret key in a hybrid cryptosystem anyway. And although a public-key encryption scheme can conversely be converted to a KEM by choosing a random secret key and encrypting it as a message, it is easier to design and analyze a secure KEM than to design a secure public-key encryption scheme as a basis. So most modern public-key encryption schemes are based on KEMs rather than the other way around.
Definition
Syntax A KEM consists of three algorithms:
Key generation, ( p k , s k ) := Gen ( ) {\displaystyle ({\mathit {pk}},{\mathit {sk}}):=\operatorname {Gen} ()} , takes no inputs and returns a pair of a public key p k {\displaystyle {\mathit {pk}}} and a private key s k {\displaystyle {\mathit {sk}}} . Encapsulation, ( k , c ) := Encap ( p k ) {\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})} , takes a public key p k {\displaystyle {\mathit {pk}}} , randomly chooses a secret key k {\displaystyle k} , and returns k {\displaystyle k} along with its encapsulation c {\displaystyle c} . Decapsulation, k ′ := Decap ( s k , c ′ ) {\displaystyle k':=\operatorname {Decap} ({\mathit {sk}},c')} , takes a private key s k {\displaystyle {\mathit {sk}}} and an encapsulation c ′ {\displaystyle c'} , and either returns an encapsulated secret key k ′ {\displaystyle k'} or fails, sometimes denoted by returning ⊥ {\displaystyle \bot } (called "bottom"). In the asymptotic setting of theoretical cryptography, the algorithms are all probabilistic polynomial-time in a security parameter λ {\displaystyle \lambda } , and the length of the secret key k {\displaystyle k} is a function of the security parameter λ {\displaystyle \lambda } . In practical cryptography, the secret key k {\displaystyle k} is usually of a fixed length for each algorithm. For example, ML-KEM always uses 256-bit secret keys, while the algorithms in RFC 9180 vary between 256-, 384-, and 512-bit secret keys; secret keys of arbitrary length can be derived from k {\displaystyle k} by a key derivation function.
Explicit vs. implicit rejection Decapsulation can fail because its input c ′ {\displaystyle c'} is not an encapsulation c {\displaystyle c} returned by Encap, but has been tampered with or maliciously crafted. KEMs which report failure by a distinguished symbol ⊥ {\displaystyle \bot } (implemented in practice by returning an error code or raising an exception) are said to use explicit rejection. A KEM may instead return a random secret key in this event, or a secret key derived pseudorandomly from c ′ {\displaystyle c'} under the key s k {\displaystyle sk} ; this is called implicit rejection.
… excerpt ends here. Continue reading the full article.
