CRYSTALS-Kyber.

CRYSTALS-Kyber is a key-encapsulation mechanism (KEM) whose security reduces to the Module Learning With Errors (MLWE) problem over structured lattices. NIST selected it as the primary PQC KEM in 2022 and finalized it as FIPS 203 (ML-KEM) in August 2024. The standard defines three parameter sets — ML-KEM-512, ML-KEM-768, and ML-KEM-1024 — targeting NIST security categories 1, 3, and 5, with public keys of roughly 800, 1184, and 1568 bytes and ciphertexts of comparable size.

Internally, an IND-CPA public-key scheme is hardened into an IND-CCA2 KEM using a Fujisaki–Okamoto transform: decapsulation re-encrypts the recovered message and rejects any mismatch, so a tampered ciphertext yields a pseudorandom "implicit reject" key rather than leaking secrets. Because a store-now-decrypt-later adversary could archive today's traffic for a future quantum computer, Kyber is deployed in hybrid mode (for example X25519MLKEM768), where an attacker must break both the classical and the post-quantum half.

Implementation security matters as much as the math. The KyberSlash disclosure (2024) showed that a secret-dependent integer division by the modulus q = 3329 was variable-time on many CPUs; timing decapsulation of forged ciphertexts could recover key bits. KyberSlash1 and KyberSlash2 were patched in the reference code (December 2023) by replacing divisions with multiplications, and fixes propagated to liboqs, PQClean, CIRCL, AWS-LC, and Botan.

flowchart LR
  KG[KeyGen] --> PK[Public key pk]
  KG --> SK[Secret key sk]
  PK --> ENC[Encapsulate: pick m, derive K and ciphertext c]
  ENC --> C[Ciphertext c]
  ENC --> KS1[Shared secret K]
  C --> DEC[Decapsulate with sk plus FO re-encrypt check]
  SK --> DEC
  DEC -->|match| KS2[Same shared secret K]
  DEC -->|mismatch| REJ[Implicit reject: pseudorandom key]