Crypto: ML-KEM

The ML-KEM sample demonstrates how to use the PSA Crypto API to establish a shared secret using ML-KEM-768 post-quantum key-encapsulation algorithm.

Requirements

The sample supports the following development kits:

Hardware platforms	PCA	Board name	Board target
nRF54LV10 DK	PCA10188	nrf54lv10dk	nrf54lv10dk/nrf54lv10a/cpuapp
nRF54LM20 DK	PCA10184	nrf54lm20dk	nrf54lm20dk/nrf54lm20b/cpuapp nrf54lm20dk/nrf54lm20a/cpuapp
nRF54L15 DK	PCA10156	nrf54l15dk	nrf54l15dk/nrf54l15/cpuapp
nRF54L15 DK (emulating nRF54L10)	PCA10156	nrf54l15dk	nrf54l15dk/nrf54l10/cpuapp
nRF54L15 DK (emulating nRF54L05)	PCA10156	nrf54l15dk	nrf54l15dk/nrf54l05/cpuapp

Overview

The sample enables PSA Crypto API and configures the following Kconfig options for the cryptographic features:

• CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_IMPORT and CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_EXPORT - Used to enable support for importing and exporting ML-KEM key pairs from among the supported cryptographic operations for Key types and key management.

• CONFIG_PSA_WANT_ALG_ML_KEM - Used to enable support for the ML-KEM key encapsulation algorithm from among the supported cryptographic operations for Key encapsulation algorithms.

• CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_768 - Used to enable support for the ML-KEM-768 key type from among the supported key types.

• CONFIG_PSA_WANT_ALG_SHAKE128, CONFIG_PSA_WANT_ALG_SHAKE256, CONFIG_PSA_WANT_ALG_SHA3_256, and CONFIG_PSA_WANT_ALG_SHA3_512 - Used to enable the hash and extendable-output functions required internally by ML-KEM, from among the supported Hash algorithms.

• CONFIG_PSA_WANT_KEY_TYPE_AES and CONFIG_PSA_WANT_ALG_CCM - Used to store the shared secret returned by the ML-KEM operations as an AES key.

The sample also configures the cryptographic drivers for each board target using Kconfig options in the overlay files in the boards directory.

These Kconfig options are then used by the build system to compile the required cryptographic PSA directives and make the configured cryptographic drivers available at runtime. See Driver selection for more information about this process.

Once built and run, the sample performs the following operations:

1. Initialization:

   1. The PSA Crypto API is initialized using the psa_crypto_init() function.

   2. A known ML-KEM-768 key pair is imported using the psa_import_key() function. The key pair is configured with usage flags for encapsulation, decapsulation, and export.

2. ML-KEM key encapsulation and decapsulattion:

   1. The public key is derived from the imported key pair using the psa_export_public_key() function and imported using psa_import_key().

   2. A shared secret and ciphertext are generated using the psa_encapsulate() function with the public key.

   3. The ciphertext is decapsulated using the psa_decapsulate() function with the private key to recover the shared secret.

   4. The shared secrets are exported using the psa_export_key() function and compared to verify that they match.

3. Cleanup:

   The ML-KEM key pair, public key, and shared secrets are removed from the PSA crypto keystore using the psa_destroy_key() function.

Building and running

This sample can be found under samples/crypto/ml_kem in the nRF Connect SDK folder structure.

To build the sample, follow the instructions in Building an application for your preferred building environment. See also Programming an application for programming steps and Testing and optimization for general information about testing and debugging in the nRF Connect SDK.

Note

When building repository applications in the SDK repositories, building with sysbuild is enabled by default. If you work with out-of-tree freestanding applications, you need to manually pass the --sysbuild parameter to every build command or configure west to always use it.

Testing

After programming the sample to your development kit, complete the following steps to test it:

1. Connect to the kit with a terminal emulator (for example, the Serial Terminal app). See Testing and optimization for the required settings and steps.

2. Build and program the application.

3. Observe the logs from the application using the terminal emulator. For example, the log output should look like this:

*** Booting nRF Connect SDK v3.4.99-0fd29dba7821 ***
*** Using Zephyr OS v4.4.99-3b0f33aa64fb ***
[00:00:00.006,446] <inf> ml_kem: Starting ML-KEM example...
[00:00:00.006,451] <inf> ml_kem: Importing an ML-KEM-768 key pair...
[00:00:00.006,475] <inf> ml_kem: ML-KEM-768 key pair imported successfully!
[00:00:00.006,488] <inf> ml_kem: ---- ML-KEM-768 key pair seed (total len: 64, printing 16 bytes): ----
[00:00:00.006,496] <inf> ml_kem: Content:
                                 6d bb c4 37 51 36 df 3b  07 f7 c7 0e 63 9e 22 3e |m..7Q6.; ....c.">
[00:00:00.006,504] <inf> ml_kem: ---- ML-KEM-768 key pair seed end  ----
[00:00:00.012,532] <inf> ml_kem: ML-KEM-768 public key extracted successfully!
[00:00:00.012,546] <inf> ml_kem: ---- ML-KEM-768 public key (total len: 1184, printing 16 bytes): ----
[00:00:00.012,554] <inf> ml_kem: Content:
                                 01 f6 0a f1 dc 8e 63 60  ae 78 b5 9d 4a 50 42 eb |......c` .x..JPB.
[00:00:00.012,562] <inf> ml_kem: ---- ML-KEM-768 public key end  ----
[00:00:00.020,626] <inf> ml_kem: ---- Ciphertext (total len: 1088, printing 16 bytes): ----
[00:00:00.020,636] <inf> ml_kem: Content:
                                 42 4d c3 50 e7 3f 42 f8  aa ec 98 16 4d a8 21 38 |BM.P.?B. ....M.!8
[00:00:00.020,644] <inf> ml_kem: ---- Ciphertext end  ----
[00:00:00.020,647] <inf> ml_kem: ML-KEM encapsulation was successful!
[00:00:00.036,514] <inf> ml_kem: ---- Shared secret (total len: 32, printing 16 bytes): ----
[00:00:00.036,524] <inf> ml_kem: Content:
                                 f4 d5 cb 08 64 0f f8 62  a5 3a 15 8d 0a c9 31 17 |....d..b .:....1.
[00:00:00.036,533] <inf> ml_kem: ---- Shared secret end  ----
[00:00:00.036,536] <inf> ml_kem: Shared secrets match!
[00:00:00.036,577] <inf> ml_kem: Example finished successfully!