How to encapsulate and decapsulate a shared secret with ML-KEM-768 with OpenSSL

1# Receiver: an ML-KEM-768 key pair (OpenSSL 3.5 or later); only ek.pem is handed out
2openssl genpkey -algorithm ML-KEM-768 -out dk.pem
3openssl pkey -in dk.pem -pubout -out ek.pem
4 
5# Sender: a fresh shared secret and the ciphertext that carries it, from the public key alone
6openssl pkeyutl -encap -pubin -inkey ek.pem -out ciphertext.bin -secret sender.key
7 
8# Receiver: the same secret from the ciphertext and the private key
9openssl pkeyutl -decap -inkey dk.pem -in ciphertext.bin -secret receiver.key
10cmp sender.key receiver.key && echo "shared secret agreed: $(wc -c < sender.key) bytes"

1# Keep only the 64-byte seed: the PKCS#8 form every library reads
2openssl pkey -in dk.pem -provparam ml-kem.output_formats=seed-only -out dk-seed.pem
3 
4# A key from a known seed, e.g. for test vectors
5openssl genpkey -algorithm ML-KEM-768 -pkeyopt hexseed:$SEED_HEX -out seeded.pem

How it works

1. openssl genpkey -algorithm ML-KEM-768 creates the decapsulation (private) key; openssl pkey -pubout writes the encapsulation key as SPKI (BEGIN PUBLIC KEY, 1206 bytes of DER).
2. The sender runs pkeyutl -encap -pubin -inkey ek.pem: -out receives the 1088-byte ciphertext to send, -secret the 32-byte shared secret to keep.
3. The receiver runs pkeyutl -decap -inkey dk.pem -in ciphertext.bin -secret … and gets the same 32 bytes — the run compares them with cmp.
4. -pkeyopt hexseed: derives the key from a 64-byte seed (d ‖ z); the run decapsulates the shared test ciphertext with the seed file and gets the shared secret dee35810…30f9 that every language on this page gets.

Gotchas

• A tampered ciphertext does not fail: decapsulation exits with code 0 and returns a different, unrelated secret (FIPS 203 "implicit rejection"). ML-KEM does not authenticate anything; the mismatch only shows when the derived key fails to decrypt or verify the next message.
• A ciphertext of the wrong length does fail, with only Public Key operation error and exit code 1.
• Encapsulation is randomized: running -encap twice for the same key gives two different secrets and ciphertexts.
• OpenSSL writes the private key as seed plus expanded key by default (2498 bytes of DER); -provparam ml-kem.output_formats=seed-only writes the 86-byte seed-only PKCS#8. pyca/cryptography reads only that form; Node.js reads both.

Related recipes

• How to encapsulate and decapsulate a shared secret with ML-KEM-768 in Python
• How to encapsulate and decapsulate a shared secret with ML-KEM-768 in Go
• How to encapsulate and decapsulate a shared secret with ML-KEM-768 in Node.js
• How to sign and verify with ML-DSA-65 with OpenSSL
• How to derive a shared key with ECDH and HKDF with OpenSSL