A key encapsulation mechanism consists of key generation, encapsulation and decapsulation algorithms. Given a public encapsulation key , encapsulation produces : a shared secret and an encapsulation ciphertext . Given the secret key and , decapsulation produces the same , except for any explicitly bounded correctness failure.[ref]
Module-Lattice-Based Key-Encapsulation Mechanism Standard by National Institute of Standards and Technology. §2, KEM definition and security overview
For example, a sender can encapsulate , derive a session encryption key from and agreed context, then use authenticated encryption for a long message. The ciphertext carries the encapsulated secret, while the separate encrypted payload carries the message. Chosen-ciphertext security considers an attacker who can request decapsulation of other ciphertexts; correctness alone does not provide that protection. Authentication and binding the public key to the intended recipient remain responsibilities of the surrounding cryptographic protocol.
Articles by others on the same topic
A Key Encapsulation Mechanism (KEM) is a cryptographic primitive used to securely encapsulate a symmetric key for encryption and decryption purposes. It allows for the secure exchange of symmetric keys between parties in a way that protects them from eavesdroppers. KEMs play a fundamental role in hybrid encryption schemes, where asymmetric cryptography is used to encrypt symmetric keys, which are then used to encrypt the actual message data.