How to encapsulate and decapsulate a shared secret with ML-KEM-768 in Swift

1// swift-tools-version:6.2
2import PackageDescription
3 
4let package = Package(
5    name: "howto",
6    platforms: [.macOS(.v15)],
7    dependencies: [
8        .package(url: "https://github.com/apple/swift-crypto.git", exact: "5.0.3"),
9        .package(url: "https://github.com/apple/swift-asn1.git", exact: "1.7.3"),
10    ],
11    targets: [
12        .executableTarget(
13            name: "mlkem",
14            dependencies: [
15                .product(name: "Crypto", package: "swift-crypto"),
16                .product(name: "SwiftASN1", package: "swift-asn1"),
17            ]
18        ),
19    ]
20)
21 

1import Crypto // CryptoKit's MLKEM768 API, also on Linux via swift-crypto
2import Foundation
3 
4func agree() throws {
5    // Receiver: a key pair; only publicKey.rawRepresentation is handed out
6    let privateKey = try MLKEM768.PrivateKey()
7    let encapsulationKey = try MLKEM768.PublicKey(rawRepresentation: privateKey.publicKey.rawRepresentation)
8 
9    // Sender: a fresh shared secret and the ciphertext ("encapsulated") that carries it
10    let result = try encapsulationKey.encapsulate()
11 
12    // Receiver: the same secret from the ciphertext
13    let received = try privateKey.decapsulate(result.encapsulated)
14 
15    print("encapsulation key \(encapsulationKey.rawRepresentation.count) bytes, ciphertext \(result.encapsulated.count) bytes")
16    print("shared secret agreed: \(received == result.sharedSecret)") // SymmetricKey == compares in constant time
17}
18 

1import Crypto
2import SwiftASN1
3 
4/// An ML-KEM-768 encapsulation key from an SPKI ("BEGIN PUBLIC KEY") PEM, e.g. written by OpenSSL 3.5.
5/// CryptoKit takes the raw 1184-byte key, so unwrap the SubjectPublicKeyInfo first.
6func encapsulationKey(fromSPKIPEM pem: String) throws -> MLKEM768.PublicKey {
7    let document = try PEMDocument(pemString: pem)
8    guard document.discriminator == "PUBLIC KEY" else { throw ASN1Error.invalidPEMDocument(reason: "not a PUBLIC KEY") }
9    let root = try DER.parse(document.derBytes)
10    guard case .constructed(let nodes) = root.content else { throw ASN1Error.invalidASN1Object(reason: "SPKI is not a SEQUENCE") }
11    var children = nodes.makeIterator()
12    guard let algorithm = children.next(), let key = children.next(),
13          case .constructed(let algorithmNodes) = algorithm.content,
14          let oidNode = algorithmNodes.first(where: { _ in true }) else {
15        throw ASN1Error.invalidASN1Object(reason: "malformed SubjectPublicKeyInfo")
16    }
17    let oid = try ASN1ObjectIdentifier(derEncoded: oidNode)
18    guard oid == [2, 16, 840, 1, 101, 3, 4, 4, 2] else { // id-alg-ml-kem-768 (RFC 9935)
19        throw ASN1Error.invalidASN1Object(reason: "not an ML-KEM-768 key: \(oid)")
20    }
21    let bits = try ASN1BitString(derEncoded: key)
22    return try MLKEM768.PublicKey(rawRepresentation: bits.bytes)
23}
24