# ML-KEM (FIPS 203)

> Key encapsulation demo with AES-GCM encryption derived from a shared secret.

- Source: https://stevenfoerster.com/lab/pqc/ml-kem/

Lab

Key encapsulation demo with AES-GCM encryption derived from a shared secret.

Educational demo - don't copy/paste into production

All cryptography runs locally in your browser. Keys and plaintext never leave your device, but this is still a simplified demo.

- [Lattices](https://stevenfoerster.com/lab/pqc/lattices/)
- [LWE](https://stevenfoerster.com/lab/pqc/lwe/)
- [ML-KEM](https://stevenfoerster.com/lab/pqc/ml-kem/)
- [ML-DSA](https://stevenfoerster.com/lab/pqc/ml-dsa/)
- [SLH-DSA](https://stevenfoerster.com/lab/pqc/slh-dsa/)
- [Learn](https://stevenfoerster.com/lab/pqc/learn/)
- [Migration](https://stevenfoerster.com/lab/pqc/migration/)

What this is

A post-quantum cryptography (PQC) key encapsulation demo using ML-KEM (formerly CRYSTALS-Kyber). It shows how a shared secret is created and then used for symmetric encryption.

Who it's for

-   Platform teams evaluating PQC-ready key exchange.
-   Security engineers testing encryption workflows.
-   Builders learning modern KEM concepts.

## Recipient keypair

Formerly CRYSTALS-Kyber

ML-KEM is a KEM. It encapsulates a shared secret. The demo derives an AES key from that secret for message encryption.

Parameter set

Generate keypair

Higher parameter sets improve security margins but increase key and ciphertext sizes.

Public key

Copy Export

Size: \-

Secret key

Reveal secret key Copy

Size: \-

Export all (unsafe)

## Sender: encapsulate to recipient

The sender encapsulates to the recipient public key, producing ciphertext + shared secret.

Encapsulate

Ciphertext

Size: \-

Shared secret

Reveal shared secret

Keep this secret. It becomes the input to HKDF for AES keys.

## AES-GCM message encryption

A shared secret is derived into a 256-bit AES key with HKDF-SHA-256. The ciphertext below is AES-GCM, not ML-KEM.

Message to encrypt

Size:

Encrypt with AES-GCM Decapsulate + decrypt Reset

AES-GCM ciphertext

HKDF salt

AES-GCM IV

Decrypted message

## Sizes & timings

Sizes

-   Public key: \-
-   Secret key: \-
-   KEM ciphertext: \-
-   Shared secret: \-
-   AES-GCM ciphertext: \-

Timings

-   Key generation: \-
-   Encapsulate: \-
-   Decapsulate: \-
-   AES encrypt: \-
-   AES decrypt: \-

Security model (30 seconds)

ML-KEM encapsulates a shared secret locally. The browser derives an AES-256-GCM key with HKDF and encrypts the message. No private keys or plaintext leave your device, and the server never sees the shared secret. No server-side secrets and no user tracking are used.