= Key encapsulation mechanism
A <key encapsulation mechanism> consists of key generation, encapsulation and decapsulation <algorithm>[algorithms]. Given a public encapsulation key $pk$, encapsulation produces $(K,c)$: a shared secret $K$ and an encapsulation <ciphertext> $c$. Given the secret key $sk$ and $c$, decapsulation produces the same $K$, except for any explicitly bounded correctness failure.<Module-Lattice-Based Key-Encapsulation Mechanism Standard by National Institute of Standards and Technology>[§2, KEM definition and security overview]{ref}
For example, a sender can encapsulate $K$, derive a session <encryption> key from $K$ and agreed context, then use <authenticated encryption> for a long message. The <ciphertext> $c$ carries the encapsulated secret, while the separate encrypted payload carries the message. Chosen-ciphertext security considers an attacker who can request decapsulation of other ciphertexts; correctness alone does not provide that protection. Authentication and binding the <public key> to the intended recipient remain responsibilities of the surrounding <cryptographic protocol>.
Back to article page
