Encryption

Compact examples for encryption. → Details: Encryption Scenarios

// Receiver: Generate key pair
using var mlKem = MlKem.Create(MlKemParameterSet.MlKem768);
byte[] publicKey = mlKem.ExportPublicKey();
 
// Sender: Encapsulate shared secret
var encap = MlKem.Encapsulate(publicKey);
byte[] ciphertext = encap.Ciphertext;
byte[] senderSecret = encap.SharedSecret;
 
// Receiver: Decapsulate shared secret
byte[] receiverSecret = mlKem.Decapsulate(ciphertext);
// senderSecret == receiverSecret

→ Details: Key Encapsulation

// ECDH + ML-KEM combined
using var hybrid = HybridKeyExchange.Create(
    ECCurve.NamedCurves.nistP384,
    MlKemParameterSet.MlKem768);
 
byte[] publicKey = hybrid.ExportPublicKey();
 
// Sender
var encap = HybridKeyExchange.Encapsulate(publicKey);
byte[] sharedSecret = encap.SharedSecret; // 64 bytes (32 ECDH + 32 ML-KEM)

→ Details: Hybrid Encryption

// Derive key from shared secret
byte[] aesKey = KeyDerivationExtensions.DeriveKey(
    sharedSecret, outputLength: 32,
    info: Encoding.UTF8.GetBytes("AES-256-GCM"));
 
// Encrypt
using var aes = new OpenSslAesGcm(aesKey);
byte[] nonce = RandomNumberGenerator.GetBytes(12);
byte[] ciphertext = new byte[plaintext.Length];
byte[] tag = new byte[16];
 
aes.Encrypt(nonce, plaintext, ciphertext, tag);
 
// Decrypt
byte[] decrypted = new byte[ciphertext.Length];
aes.Decrypt(nonce, ciphertext, tag, decrypted);

→ Details: File Encryption

// 1. Key Exchange
using var mlKem = MlKem.Create(MlKemParameterSet.MlKem768);
var encap = MlKem.Encapsulate(mlKem.ExportPublicKey());
 
// 2. Key Derivation
byte[] key = KeyDerivationExtensions.DeriveKey(
    encap.SharedSecret, 32, info: "encryption"u8.ToArray());
 
// 3. Encryption
using var aes = new OpenSslAesGcm(key);
// ... encrypt

« <- Quick Reference | -> Encryption Scenarios (Details) »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional