# ML-KEM / Kyber Keypair & Encapsulation Tester Generate ML-KEM-512/768/1024 (FIPS 203 / CRYSTALS-Kyber) keypairs, encapsulate a random shared secret against the public key, decapsulate it with the private key, and verify both sides match — with the exact wire sizes of all three parameter sets checked live against the standard. > Canonical page: https://elysiatools.com/en/tools/ml-kem-kyber-keypair-and-encapsulation-tester - **Category:** Security - **Keywords:** ml-kem, kyber, post-quantum, kem encapsulation, fips 203, shared secret ## Overview The ML-KEM / Kyber Keypair & Encapsulation Tester allows you to generate FIPS 203 (CRYSTALS-Kyber) post-quantum keypairs, run encapsulation and decapsulation operations, and inspect raw cryptographic artifacts. You can test ML-KEM-512, ML-KEM-768, and ML-KEM-1024 individually or side by side, verify shared secret agreement, and validate exact wire sizes across hexadecimal and Base64 formats. ## Inputs - **Parameter set** (select) - **Output format** (select) - **Deterministic seed (hex, optional)** (text): e.g. 9d61b19deffd5a60ba844af492ec2cc4 — any even-length hex string - **Reveal decapsulation key** (checkbox) ## When to use - Validating post-quantum key generation, encapsulation, and decapsulation workflows against the FIPS 203 specification. - Checking exact wire payload byte lengths for encapsulation keys, decapsulation keys, and ciphertexts when budgeting protocol network overhead. - Generating reproducible, deterministic test vectors using fixed hex seeds to perform cross-library interop testing. ## How it works - Select your target ML-KEM parameter set (512, 768, 1024, or all three) and choose the desired encoding format (Hex, Base64, or both). - Optionally supply a deterministic hex seed for reproducible test vectors and toggle the option to reveal the private decapsulation key. - The tool performs keypair generation, encapsulates a shared secret against the public key, and decapsulates the resulting ciphertext. - Inspect the verification verdict confirming shared secret equality alongside a detailed breakdown of byte sizes and encoded cryptographic material. ## Use cases - Evaluating packet overhead and payload constraints for post-quantum TLS, SSH, or custom VPN handshakes. - Generating test vectors to debug and verify custom ML-KEM and Kyber cryptographic implementations. - Comparing parameter sizes and shared secret agreements across ML-KEM-512, 768, and 1024 security levels. ## Frequently asked questions ### What is the difference between ML-KEM and CRYSTALS-Kyber? ML-KEM is the standardized post-quantum key encapsulation mechanism defined in NIST FIPS 203, based directly on the CRYSTALS-Kyber algorithm. ### Which ML-KEM parameter set is recommended for general use? ML-KEM-768 is the recommended default, providing a balance of high security (NIST Security Category 3) and efficient key and ciphertext sizes. ### What are the exact wire sizes for ML-KEM-768? ML-KEM-768 uses an encapsulation key of 1,184 bytes, a decapsulation key of 2,400 bytes, a ciphertext of 1,088 bytes, and a shared secret of 32 bytes. ### How does deterministic mode work? Providing a valid hex seed forces the internal random number generator to derive keypairs and encapsulation randomness deterministically, ensuring reproducible outputs. ### Why is the decapsulation key hidden by default? The decapsulation key is sensitive private key material, so it is masked by default and only displayed when the reveal option is checked. ## Related tools - [Env File Secret Rotation Planner](https://elysiatools.com/en/tools/env-file-secret-rotation-planner): Paste a .env file and get a staged secret-rotation plan. Detects database URLs, API keys, auth tokens, private keys, cloud credentials, payment keys and encryption secrets, scores each by exposure and age, and schedules them across a 4-week rotation timeline with a dual-key checklist and a generated .env.example. Optional last-rotated dates and a configurable cadence (30/90/180/365 days) drive compliance scoring. - [Security Headers Checker](https://elysiatools.com/en/tools/security-headers-checker): Audit HTTP response headers for security compliance — parses the raw headers you paste (no network) and grades them against the OWASP secure-header set with value-level checks: HSTS max-age, CSP unsafe-inline/eval, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP and more. Outputs a letter grade (A+ to F) plus per-header findings with copy-ready fix recommendations. - [PKCE Code Verifier & Challenge Generator](https://elysiatools.com/en/tools/pkce-code-verifier-generator): Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset \[A-Za-z0-9-._~\] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification. - [AI Domain Name Idea Generator](https://elysiatools.com/en/tools/ai-domain-name-idea-generator): Generate up to 10 creative domain names with AI and filter out already-registered ones via DNS + RDAP. - [RSA Key Pair Generator](https://elysiatools.com/en/tools/rsa-key-generator): Generate an RSA key pair (2048/3072/4096-bit) as PEM-encoded public and private keys. Optionally encrypt the private key with a passphrase. PKCS#8 (recommended) or PKCS#1 private key format. Everything runs locally. - [Shamir Secret Sharing](https://elysiatools.com/en/tools/shamir-secret-sharing): Split a secret into n shares where any k (the threshold) are required to reconstruct it — Shamir's k-of-n scheme over GF(256). Pure in-process cryptography (crypto.randomBytes for polynomial coefficients), no network. Split a password/key/passphrase into shares held by separate people, then combine any k of them to recover it. Confidentiality only — no authenticity. - [BIP39 Mnemonic Phrase Generator](https://elysiatools.com/en/tools/mnemonic-bip39-generator): Generate or validate 12 to 24 word BIP39 mnemonic phrases with entropy and PBKDF2-HMAC-SHA512 seed output - [AGEX Keypair Generator](https://elysiatools.com/en/tools/agex-keypair-generator): Generate an Ed25519 keypair for AGEX bundle signing and verification ## Samples - [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion - [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion - [Android Image Processing Kotlin Samples](https://elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion - [Web Image Processing Rust Samples](https://elysiatools.com/en/samples/web-image-processing-rust): Web Rust image processing examples including image read/save, scaling, and format conversion ## Related content - [Authentication, Password, and Token Security Tools](https://elysiatools.com/en/hubs/auth-token-security): Generate and validate passwords, review JWTs, compare password-hash workflows, and inspect auth-related security basics in one hub. - [Document Encryption, Redaction, and Field Security Tools](https://elysiatools.com/en/hubs/document-field-security-workflows): Compare PDF password protection, permission control, encrypted PDF export, CSV/XLSX field encryption, AES bundles, and document redaction tools in one security workflow hub. - [Audio Encoding and Format Conversion Tools](https://elysiatools.com/en/hubs/audio-convert): Compare audio format conversion, bitrate changes, sample-rate conversion, codec swaps, and export tools in one hub for delivery and archive workflows. - [Image Format Conversion and Animated Export Tools](https://elysiatools.com/en/hubs/image-convert): Compare image format converters for JPG, PNG, GIF, AVIF, WebP, TIFF, ICO, base64, and animation-friendly exports in one hub.