Post-Quantum Key Encapsulation: Kyber / ML-KEM & Classic McEliece Studio
Analyze post-quantum key encapsulation mechanisms (KEMs) engineered to defeat quantum Shor's algorithm. Contrast lattice-based ML-KEM (Module-LWE) with 45-year battle-tested Classic McEliece (binary Goppa codes). Simulate KeyGen, encapsulation, Fujisaki-Okamoto decapsulation, and TLS 1.3 hybrid handshakes.
1. Post-Quantum KEM Parameter Matrix & Overhead Profile
Polynomial Ring: R_q = Z_3329[X]/(X^256 + 1), k=3
IND-CCA2 Protection: Fujisaki-Okamoto (FO) Transform
TLS 1.3 Packet Fits in 1 MTU: YES (~1.2 KB payload < 1,420 bytes)
NIST Standardization: FIPS 203 Final (August 2024)
2. Interactive 3-Phase KEM Protocol Simulator
3. TLS 1.3 Hybrid Handshake (X25519MLKEM768) Wire Packet Inspector
Examine how Google Chrome and Cloudflare deploy post-quantum security in TLS 1.3. The key_share extension carries both classical Curve25519 (32 bytes) and ML-KEM-768 (1,184 bytes), totaling 1,216 bytes.
└─ Extension: supported_groups (Type: 10, Length: 6)
└─ Extension: key_share (Type: 51, Length: 1224 bytes)
└─ KeyShareEntry [NamedGroup: 0x6399 (X25519MLKEM768)]
└─ Part 1: X25519 Public Key (32 bytes) → 0x8a3f721...
└─ Part 2: ML-KEM-768 Public Seed & Polynomial Vector t (1,184 bytes) → 0x4d19e02...
└─ Handshake Packet Fragmentation: 0 fragments (Fits comfortably inside standard 1500-byte Ethernet MTU)
⚠️ 5 Fatal Traps in Post-Quantum Cryptography Migration
1. Legacy Middlebox & Firewall TLS ClientHello Drops (>1,420 Bytes)
Older corporate firewalls and middleboxes assume TLS 1.3 ClientHello messages fit within a single 1,500-byte TCP packet. When hybrid PQC key shares inflate the initial packet or trigger IP fragmentation, buggy network appliances silently drop packets, causing mysterious connection timeouts across enterprise networks.
2. Timing Side-Channel Leaks in Polynomial Polynomial Inversion
Non-constant-time NTT implementations or polynomial division routines leak secret error coefficients through CPU data-cache misses and variable-latency SIMD execution. Implementations must strictly adhere to branch-free, constant-time Montgomery reductions.
3. Omission of the Fujisaki-Okamoto Re-Encryption Check
Skipping the re-encryption verification during decapsulation or emitting explicit error codes upon mismatch reduces IND-CCA2 security to IND-CPA. Attackers can submit ciphertexts with crafted perturbations to deduce the private key through chosen-ciphertext oracle attacks.
4. Classic McEliece Public Key Buffer Exhaustion on Embedded IoT
Attempting to use Classic McEliece on microcontrollers or embedded smartcards (which often have only 32 KB to 64 KB of total RAM) causes instantaneous out-of-memory panics, as its 261 KB to 1 MB public key exceeds the physical SRAM of the device.
5. Reusing Ephemeral Seeds in Encapsulation
In ML-KEM encapsulation, the message $m$ must be freshly sampled from a cryptographically secure random number generator (CSPRNG). If an application reuses seeds across multiple encapsulations, adversaries can solve for the underlying lattice error vectors and recover plaintext session secrets.