Watch · narrated walkthroughs

ML-KEM Beyond IND-CCA: What the Definition Does Not Promise and What Deployments Must Add

IND-CCA says an eavesdropper with a decapsulation oracle cannot tell ML-KEM's shared secret from random. It says nothing about which public key or ciphertext that secret is tied to, what happens when someone else generated the key, what a 'formally verified' implementation has actually been checked against, or what HPKE, X-Wing and SSH quietly assume when they wrap the KEM. This series reads each of those gaps at the level of its evidence: the KEM binding notions and re-encapsulation attacks, malicious keys and the seed-versus-expanded format decision, the scope and limits of machine-checked ML-KEM, and the assumptions each protocol construction places on FIPS 203. Every topic is tied to the channels, key stores and model-serving endpoints that AI agents depend on.