How to encapsulate and decapsulate a shared secret with ML-KEM-768 in Rust

1[dependencies]
2ml-kem = { version = "=0.3.3", features = ["getrandom", "pem"] }
3pkcs8 = { version = "=0.11.0", features = ["pem"] }
4 

1use ml_kem::MlKem768;
2use ml_kem::kem::{Decapsulate, Encapsulate, Kem};
3 
4pub fn agree() {
5    // Receiver: a key pair from OS randomness ("getrandom" feature)
6    let (decapsulation_key, encapsulation_key) = MlKem768::generate_keypair();
7 
8    // Sender: a fresh shared secret and the ciphertext that carries it
9    let (ciphertext, sender_secret) = encapsulation_key.encapsulate();
10 
11    // Receiver: the same secret from the ciphertext
12    let receiver_secret = decapsulation_key.decapsulate(&ciphertext);
13 
14    println!("ciphertext {} bytes, shared secret {} bytes", ciphertext.len(), sender_secret.len());
15    println!("shared secret agreed: {}", sender_secret == receiver_secret);
16}
17 

How it works

1. MlKem768::generate_keypair() (from the kem::Kem trait) returns (decapsulation_key, encapsulation_key).
2. encapsulation_key.encapsulate() returns (ciphertext, shared_secret) — 1088 and 32 bytes, in that order, which is the reverse of Python and Go.
3. decapsulation_key.decapsulate(&ciphertext) returns the same secret; with a byte slice from the network use decapsulate_slice, which checks the length.
4. EncapsulationKey768::from_public_key_pem and DecapsulationKey768::from_pkcs8_pem read OpenSSL's files; the run decapsulates OpenSSL's ciphertext to dee35810…30f9, and OpenSSL decapsulates the ciphertext Rust made.

Gotchas

• Unlike ml-dsa, ml-kem has no randomness by default: generate_keypair and encapsulate need the getrandom feature, as in the Cargo.toml above.
• A tampered ciphertext still decapsulates (Ok) to a different secret — implicit rejection. Only the length is checked: a 1000-byte slice gives Err(TryFromSliceError(())).
• Secrets compare with == on the returned arrays; in a real protocol you do not compare them at all — each side derives keys from its own copy.

Related recipes

• How to encapsulate and decapsulate a shared secret with ML-KEM-768 in Go
• How to encapsulate and decapsulate a shared secret with ML-KEM-768 in Python
• How to encapsulate and decapsulate a shared secret with ML-KEM-768 with OpenSSL
• How to sign and verify with ML-DSA-65 in Rust
• How to derive a shared key with ECDH and HKDF in Rust