libcrux-ml-kem

libcrux-ml-kem is a formally verified implementation of ML-KEM, the NIST-standardized post-quantum key encapsulation mechanism defined in FIPS 203 (and its Kyber predecessor). It is part of the libcrux high-assurance cryptographic library, whose Rust code is verified for runtime safety and functional correctness using the hax toolchain and HACL* verified building blocks.

The crate implements all three ML-KEM parameter sets, 512, 768, and 1024, each exposing key generation, encapsulation, decapsulation, and FIPS 203 key/ciphertext validation. It ships a portable Rust implementation alongside AVX2 and AArch64 NEON SIMD variants, with runtime CPU feature detection selecting the fastest available path automatically.

What You Get

• All three ML-KEM parameter sets: mlkem512, mlkem768, and mlkem1024
• generate_key_pair, encapsulate, and decapsulate for each variant
• FIPS 203 public-key and private-key/ciphertext validation functions
• Portable Rust plus AVX2 and AArch64 NEON optimized implementations
• Automatic runtime CPU feature detection for optimal backend selection

Common Use Cases

• Adding post-quantum key encapsulation to protocols and handshakes
• Hybrid classical/post-quantum key exchange to hedge against quantum attacks
• High-assurance deployments that require formally verified cryptographic code
• Cross-platform crypto needing portable, AVX2, and NEON code paths from one crate

Under The Hood

Architecture - The crate exposes three top-level modules (mlkem512/768/1024), each a thin parameterization over a shared core split into ind_cpa.rs (the IND-CPA PKE) and ind_cca.rs/ind_cca/ (the IND-CCA KEM transform), with hash_functions.rs, constants.rs, and constant_time_ops.rs supporting them. A build.rs selects portable versus AVX2/NEON backends by target arch, and runtime feature detection picks the fastest path; much of the code is generated from formally verified specifications via the hax toolchain.

Tech Stack - Rust (workspace edition), part of the larger libcrux Cargo workspace alongside libcrux-kem, libcrux-ml-dsa, and libcrux-ecdh. Optional rand dependency, no_std-capable, with SIMD intrinsics for Intel AVX2 and AArch64 NEON. Verification tooling includes hax and HACL*-derived components.

Code Quality - Test coverage is extensive and standards-driven: tests/ contains ACVP vectors, NIST KATs, Wycheproof vectors, and Kyber/ML-KEM known-answer tests. The formal-verification pipeline (proofs/, formal_verification/) provides correctness and safety guarantees beyond ordinary testing, and constant-time modules address side channels.

API Design - Each parameter set offers the same small, consistent surface (generate_key_pair, encapsulate, decapsulate, validate_public_key, validate_private_key), so switching security levels is a module swap. The main friction is the crate’s pre-0.1 status and feature-flag matrix, but the per-variant README documents usage and SIMD control clearly.