How to encapsulate and decapsulate a shared secret with ML-KEM-768 in WebCrypto

1const algorithm = { name: "ML-KEM-768" };
2 
3export async function agree() {
4  // Receiver: a key pair; only the encapsulation key is handed out
5  const { publicKey, privateKey } = await crypto.subtle.generateKey(algorithm, true, ["encapsulateBits", "decapsulateBits"]);
6 
7  // Sender: a fresh 32-byte shared secret and the ciphertext that carries it
8  const { sharedKey, ciphertext } = await crypto.subtle.encapsulateBits(algorithm, publicKey);
9 
10  // Receiver: the same secret from the ciphertext
11  const received = await crypto.subtle.decapsulateBits(algorithm, privateKey, ciphertext);
12 
13  const raw = await crypto.subtle.exportKey("raw-public", publicKey);
14  console.log("encapsulation key", raw.byteLength, "bytes, ciphertext", ciphertext.byteLength, "bytes, shared secret", sharedKey.byteLength, "bytes");
15  const equal = new Uint8Array(received).every((byte, i) => byte === new Uint8Array(sharedKey)[i]);
16  console.log("shared secret agreed:", equal);
17}
18 
19// Decapsulate with a PKCS#8 private key (the DER of a "BEGIN PRIVATE KEY" seed file, e.g. from OpenSSL 3.5)
20export async function decapsulateWithPkcs8(pkcs8, ciphertext) {
21  const privateKey = await crypto.subtle.importKey("pkcs8", pkcs8, algorithm, false, ["decapsulateBits"]);
22  return crypto.subtle.decapsulateBits(algorithm, privateKey, ciphertext);
23}
24