Package zeroecho.core.alg.kyber

package zeroecho.core.alg.kyber
Kyber (ML-KEM) post-quantum key encapsulation integration.

This package wires the Kyber key encapsulation mechanism into the core layer. It provides the algorithm descriptor, a lightweight runtime KEM context, key-generation specifications for the supported Kyber variants, and encoded key specs for import and export. Provider-specific details are kept behind small factories while roles and metadata remain explicit to higher layers.

Scope and responsibilities

  • Register Kyber under a canonical identifier and declare KeyUsage.ENCAPSULATE and KeyUsage.DECAPSULATE roles, with an optional message-style agreement adapter where needed.
  • Provide a KemContext implementation bound to either a public or private key for encapsulation or decapsulation.
  • Expose immutable key-generation specifications and defensively copying encoded-key carriers with compact marshalling helpers; private-key carriers are destroyable.
  • Ensure operations are delegated to an available PQC provider and fail fast if the provider is absent.

Components

  • KyberAlgorithm: algorithm descriptor that wires KEM and, when required, message-agreement roles and registers asymmetric key builders for generation and encoded-key import.
  • KyberKemContext: runtime context implementing encapsulate and decapsulate operations via provider primitives.
  • KyberKeyGenSpec: immutable specification of the Kyber variant (512, 768, 1024) with convenience factories.
  • KyberPublicKeySpec and KyberPrivateKeySpec: wrappers over X.509 and PKCS#8 encodings with defensive copying and simple marshalling utilities.

Design notes

  • Algorithm descriptors are immutable and safe to share across threads.
  • KEM contexts are stateful and not thread-safe; create one per encapsulation or decapsulation operation.
  • Key specifications preserve encoded form without internal parsing and rely on defensive cloning for safety.
  • Agreement adapters allow Kyber to be composed into initiator/responder exchanges when a message-based interface is preferred.
Since:
1.0
  • Class
    Description
    KyberAlgorithm
    Concrete CryptoAlgorithm implementation for the post-quantum key encapsulation mechanism (KEM) Kyber, standardized as ML-KEM.
    KyberKemContext
    KyberKemContext is a lightweight KEM context used to perform Kyber (ML-KEM) encapsulation or decapsulation.
    KyberKeyGenSpec
    Key generation specification for the Kyber (ML-KEM) algorithm family.
    KyberKeyGenSpec.Variant
    Enumerates the supported Kyber parameter sets.
    KyberPrivateKeySpec
    Specification wrapper for a Kyber (ML-KEM) private key encoded in PKCS#8.
    KyberPublicKeySpec
    Specification wrapper for a Kyber (ML-KEM) public key encoded in X.509.