====== Encryption ======

Compact examples for encryption. -> **Details:** [[en:int:pqcrypt:szenarien:verschluesselung:start|Encryption Scenarios]]

----

===== ML-KEM Key Encapsulation =====

<code csharp>
// Receiver: Generate key pair
using var mlKem = MlKem.Create(MlKemParameterSet.MlKem768);
byte[] publicKey = mlKem.ExportPublicKey();

// Sender: Encapsulate shared secret
var encap = MlKem.Encapsulate(publicKey);
byte[] ciphertext = encap.Ciphertext;
byte[] senderSecret = encap.SharedSecret;

// Receiver: Decapsulate shared secret
byte[] receiverSecret = mlKem.Decapsulate(ciphertext);
// senderSecret == receiverSecret
</code>

-> **Details:** [[en:int:pqcrypt:szenarien:verschluesselung:key_encapsulation|Key Encapsulation]]

----

===== Hybrid Key Exchange =====

<code csharp>
// ECDH + ML-KEM combined
using var hybrid = HybridKeyExchange.Create(
    ECCurve.NamedCurves.nistP384,
    MlKemParameterSet.MlKem768);

byte[] publicKey = hybrid.ExportPublicKey();

// Sender
var encap = HybridKeyExchange.Encapsulate(publicKey);
byte[] sharedSecret = encap.SharedSecret; // 64 bytes (32 ECDH + 32 ML-KEM)
</code>

-> **Details:** [[en:int:pqcrypt:szenarien:verschluesselung:hybrid_encryption|Hybrid Encryption]]

----

===== AES-256-GCM =====

<code csharp>
// Derive key from shared secret
byte[] aesKey = KeyDerivationExtensions.DeriveKey(
    sharedSecret, outputLength: 32,
    info: Encoding.UTF8.GetBytes("AES-256-GCM"));

// Encrypt
using var aes = new OpenSslAesGcm(aesKey);
byte[] nonce = RandomNumberGenerator.GetBytes(12);
byte[] ciphertext = new byte[plaintext.Length];
byte[] tag = new byte[16];

aes.Encrypt(nonce, plaintext, ciphertext, tag);

// Decrypt
byte[] decrypted = new byte[ciphertext.Length];
aes.Decrypt(nonce, ciphertext, tag, decrypted);
</code>

-> **Details:** [[en:int:pqcrypt:szenarien:verschluesselung:file_encryption|File Encryption]]

----

===== Complete Workflow =====

<code csharp>
// 1. Key Exchange
using var mlKem = MlKem.Create(MlKemParameterSet.MlKem768);
var encap = MlKem.Encapsulate(mlKem.ExportPublicKey());

// 2. Key Derivation
byte[] key = KeyDerivationExtensions.DeriveKey(
    encap.SharedSecret, 32, info: "encryption"u8.ToArray());

// 3. Encryption
using var aes = new OpenSslAesGcm(key);
// ... encrypt
</code>

----

===== Algorithms =====

^  Algorithm  ^  Key  ^  Security  ^
| ML-KEM-512 | 800 B pub / 1632 B priv | Level 1 |
| ML-KEM-768 | 1184 B pub / 2400 B priv | Level 3 |
| ML-KEM-1024 | 1568 B pub / 3168 B priv | Level 5 |
| AES-256-GCM | 256 bit | 256 bit |

----

<< [[.:start|<- Quick Reference]] | [[en:int:pqcrypt:szenarien:verschluesselung:start|-> Encryption Scenarios (Details)]] >>

----
//Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional//

{{tag>quickreference encryption ml-kem aes-gcm hybrid}}