Research seriesL3algorithms
FIPS 203 is a KEM built by hardening a simple public-key scheme into active security. This series walks the whole construction - the underlying encryption, the KEM game, the Fujisaki-Okamoto transform, the silent decapsulation-failure attacks, and the implementation realities. Grounded in FIPS 203 and the primary papers.
ML-KEM starts as a simple public-key encryption: encode a message as an offset of half the modulus, bury it in fresh noise, and let only the secret key subtract the noise away.
A KEM agrees on a random shared key rather than transmitting a chosen message, and it must survive an active attacker who submits ciphertexts of its own and watches the response.
The transform derandomizes encryption so a ciphertext is a deterministic function of its message, then re-encrypts at decapsulation to reject anything not honestly formed — killing the chosen-ciphertext attack.
A decapsulation failure is a one-in-a-nonillion event, yet it is a security parameter: each observed failure leaks a constraint on the secret, so the standard drives the probability below 2^-138 and uses ephemeral keys.
A correct ML-KEM on paper can be broken by a timing leak in one comparison. Getting it right means the number-theoretic transform for speed and rigorous constant-time discipline for safety.