Research

Watch · narrated whiteboard episodesL3

ML-KEM Beyond IND-CCA: What the Definition Does Not Promise and What Deployments Must Add

IND-CCA says an eavesdropper with a decapsulation oracle cannot tell ML-KEM's shared secret from random. It says nothing about which public key or ciphertext that secret is tied to, what happens when someone else generated the key, what a 'formally verified' implementation has actually been checked against, or what HPKE, X-Wing and SSH quietly assume when they wrap the KEM. This series reads each of those gaps at the level of its evidence: the KEM binding notions and re-encapsulation attacks, malicious keys and the seed-versus-expanded format decision, the scope and limits of machine-checked ML-KEM, and the assumptions each protocol construction places on FIPS 203. Every topic is tied to the channels, key stores and model-serving endpoints that AI agents depend on.

Murali Chillakuru·4 episodes
  1. 22 min Episode 1What IND-CCA Does Not Promise: KEM Binding, Re-Encapsulation and the Shared Secret ML-KEM Hands YouWhy a hidden shared secret is not the same as an addressed one: the KEM binding notions, the re-encapsulation attack, the PQXDH case, where ML-KEM's binding really comes from, and what agent channels must add.
  2. 22 min Episode 2Keys You Did Not Generate: Malicious Binding, the FIPS 203 Checks and the Seed-Versus-Expanded DecisionWhat still holds when the party using an ML-KEM key did not generate it: the FIPS 203 checks and their stated limits, two malicious keys, what the seed buys, RFC 9935 as an import policy, poisoned keys, and the key paths of agent platforms.
  3. 23 min Episode 3What a Formally Verified ML-KEM Actually Proves: Specifications, Models and the Gaps Between ThemReading 'formally verified ML-KEM' as a scoped claim: four kinds of statement, three verified efforts, the specification, model and checker gaps, the properties no proof states, and how agent platforms should read the evidence.
  4. 22 min Episode 4ML-KEM Inside HPKE, X-Wing and SSH: What Each Construction Assumes of the KEMThree constructions wrap ML-KEM outside the TLS handshake: what HPKE, X-Wing and SSH each take from the KEM, what they supply themselves, what they give up, and how agent messaging, private inference and agent shells should use them.