EVP_PKEY-ML-KEM(7ossl)

📦
version 3.5.9 · 8 versions
, in alpine 3.23, alpine 3.24

okay bestie, welcome to the EVP_PKEY-ML-KEM(7ossl) page 💅 — it's giving ML-KEM keytype and algorithm support, and we're gonna go through every single thing, no cap. ✨

✨ NAME ✨

These are the names this page covers, and they're all about ML-KEM keytype and algorithm support:

  • EVP_PKEY-ML-KEM
  • EVP_KEYMGMT-ML-KEM
  • EVP_PKEY-ML-KEM-512
  • EVP_PKEY-ML-KEM-768
  • EVP_PKEY-ML-KEM-1024
  • EVP_KEYMGMT-ML-KEM-512
  • EVP_KEYMGMT-ML-KEM-768
  • EVP_KEYMGMT-ML-KEM-1024

🦋 DESCRIPTION 🦋

Okay so the ML-KEM-512, ML-KEM-768, and ML-KEM-1024 keytypes are implemented in OpenSSL's default and FIPS providers. Slay. 💖

🌱 Keygen Parameters 🌱

No mandatory parameters are required for generating a key pair. If you want to set explicit parameters, use EVP_PKEY_CTX_set_params() after calling EVP_PKEY_keygen_init(). Easy.

  • "seed" (OSSL_PKEY_PARAM_ML_KEM_SEED) — <octet string> — Internally, ML-KEM generates keys using a 64-byte random value (seed), which is the concatenation of the 32-byte d and z parameters described in FIPS 203. This optional parameter can be used to set a pre-determined seed prior to keypair generation. Generated keys default to retaining the seed used. The seed is also by default retained when keys are loaded from PKCS#8 files in the seed format. When available, the seed parameter is also used during key export and import, with keys (by default) regenerated from the seed even when also provided on import. See "Provider configuration parameters" below for related controls. When the seed is retained, it is also available as a gettable parameter, and private key output to PKCS#8 files will by default include the seed. When the seed was not initially known, or was not retained, PKCS#8 private key files will contain only the private key in FIPS 203 "dk" format.
  • "properties" (OSSL_PKEY_PARAM_PROPERTIES) — <UTF8 string> — Sets properties to be used when fetching algorithm implementations used for ML-KEM hashing operations. Use EVP_PKEY_CTX_set_params(3) after calling EVP_PKEY_keygen_init(3).

The following key generation parameter can be retrieved with EVP_PKEY_CTX_get_params(3) from the OpenSSL FIPS provider:

  • "fips-indicator" (OSSL_PKEY_PARAM_FIPS_APPROVED_INDICATOR) — <integer> — Returns 1 if the operation is FIPS approved, or 0 otherwise. See "FIPS indicators" in fips_module(7) for more information.

🧸 Common parameters 🧸

In addition to the common parameters that all keytypes should support (see "Common Information Parameters" in provider-keymgmt(7)), ML-KEM keys keys support the parameters listed below. These are gettable using EVP_PKEY_get_octet_string_param(3) or EVP_PKEY_get_params(3). They can be initialised via EVP_PKEY_fromdata(3), and are returned by EVP_PKEY_todata(3) given a suitable selection. Once a public or private key is configured, it can no longer be modified, nor can another key component be added. No cap. 🔥

  • "pub" (OSSL_PKEY_PARAM_PUB_KEY) — <octet string> — The public key value. This parameter is used when importing or exporting the public key value with the EVP_PKEY_fromdata() and EVP_PKEY_todata() functions. The key length and content is that of the FIPS 203 (Algorithm 16: ML-KEM.KeyGen_internal) ek public key for the given ML-KEM variant. Initial import aside, this parameter is otherwise only gettable.
  • "priv" (OSSL_PKEY_PARAM_PRIV_KEY) — <octet string> — The private key value. This parameter is used when importing or exporting the private key value with the EVP_PKEY_fromdata() and EVP_PKEY_todata() functions. The key length and content is that of the FIPS 203 (Algorithm 16: ML-KEM.KeyGen_internal) dk private key for the given ML-KEM variant. Initial import aside, this parameter is otherwise only gettable.
  • "encoded-pub-key" (OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY) — <octet string> — Used for getting and setting the encoding of a public key. The key format is that of ek in FIPS 203, Algorithm 16: ML-KEM.KeyGen_internal. Updates of the public and private key components are only allowed on keys that are empty. Once a public or private key component is set, no further changes are allowed. This parameter is gettable and settable (once only).

🔧 Provider configuration parameters 🔧

See the description of the -provparam option in openssl(1) to learn how to set provider configuration parameters in the command line tools. See OSSL_PROVIDER_add_conf_parameter(3) to learn how to set provider configuration options programmatically.

  • "ml-kem.import_pct_type" (OSSL_PKEY_PARAM_ML_KEM_IMPORT_PCT_TYPE) — <UTF8 string> — When an ML-KEM key is imported as an explicit FIPS 203 dk decapsulation key, rather than a seed, a pairwise consistency test (PCT) is optionally performed. By default, or when this parameter is set explicitly to "random", the PCT is performed with a random entropy value for the encapsulation step. Setting the parameter to "fixed", still runs the test, but the encapsulation entropy is a fixed 32 byte value. Specifying any other value of the parameter, e.g. "none", skips the test.
  • "ml-kem.retain_seed" (OSSL_PKEY_PARAM_ML_KEM_RETAIN_SEED) — <UTF8 string> — When set to a string representing a false boolean value (see OSSL_PROVIDER_conf_get_bool(3)), the seed will not be retained after key generation or key import from a seed value. If the resulting key is then written to a PKCS#8 object, it will contain only the FIPS 203 "dk" key.
  • "ml-kem.prefer_seed" (OSSL_PKEY_PARAM_ML_KEM_PREFER_SEED) — <UTF8 string> — When decoding PKCS#8 objects that contain both a seed and the FIPS 203 "dk" private key, the seed is by default used to regenerate the key, and the companion key is ignored. When this configuration parameter is set to a string representing a false boolean value (see OSSL_PROVIDER_conf_get_bool(3)), the seed is ignored (neither used to regenerate the key, nor retained), and the companion key is used instead.
  • "ml-kem.input_formats" (OSSL_PKEY_PARAM_ML_KEM_INPUT_FORMATS) — <UTF8 string> — List of enabled private key input formats when parsing PKCS#8 objects. List elements are separated by commas and/or spaces or tabs. The list of enabled formats can be specified in the configuration file, as seen in the "EXAMPLES" section below, or the via the -provparam command-line option (see also OSSL_PROVIDER_add_conf_parameter(3)).

Values specified on the command-line override any configuration file settings. By default all the supported formats are enabled. The supported formats are:

  • "seed-priv": This format represents PKCS#8 objects in which both the FIPS 203 64-byte (d, z) seed and the decapsulation key dk are present in the private key as part of the DER encoding of the ASN.1 sequence:
ML-KEM-PrivateKey ::= CHOICE {
  seed [0] IMPLICIT OCTET STRING (SIZE (64)),
  expandedKey OCTET STRING (SIZE (1632 | 2400 | 3168)),
  both SEQUENCE {
    seed OCTET STRING (SIZE (64)),
    expandedKey OCTET STRING (SIZE (1632 | 2400 | 3168)) } }

If the "seed-priv" format is not included in the list, this format will not be recognised on input.

  • "seed-only": This format represents PKCS#8 objects in which only the 64-byte (d, z) seed is present in the above sequence. If the "seed-only" format is not included in the list, this format will not be recognised on input.
  • "priv-only": This format represents PKCS#8 objects in which only the FIPS 203 decapsulation key dk is present in the above sequence. If the "priv-only" format is not included in the list, this format will not be recognised on input.
  • "oqskeypair": This format represents PKCS#8 objects in which the private key is a DER encoding of an octet string containing the concatenaton of the FIPS 203 decapsulation key dk and the encapsulation key ek. This encoding is used in some builds of the "oqsprovider". If the "oqskeypair" format is not included in the list, this format will not be recognised on input.
  • "bare-seed": This format represents PKCS#8 objects in which the private key contains the 64-byte FIPS 204 seed (d, z) without any ASN.1 encapsulation. If the "bare-seed" format is not included in the list, this format will not be recognised on input.
  • "bare-priv": This format represents PKCS#8 objects in which the private key contains the FIPS 204 decapsulation key dk without any ASN.1 encapsulation. If the "bare-priv" format is not included in the list, this format will not be recognised on input.
  • "ml-kem.output_formats" (OSSL_PKEY_PARAM_ML_KEM_OUTPUT_FORMATS) — <UTF8 string> — Ordered list of enabled private key output formats when writing PKCS#8 files. List elements are separated by commas, spaces or tabs. The list of enabled formats can be specified in the configuration file, as seen in the "EXAMPLES" section below, or the via the -provparam command-line option.

This supports the same set of formats as described under "ml-kem.input_formats" above. The order in which elements are listed is important, the selected format will be the first one that is possible to output. If the key seed is known, the first listed format will be selected. If the key seed is not known, the first format that omits the seed will be selected. The default order is equivalent to "seed-priv" first and "priv-only" second, with both seed and key output when the seed is available, and just the key otherwise. If "seed-only" is listed first, then the seed will be output without the key when available, otherwise the output will have just the key. If "priv-only" is listed first, then just the key is output regardless of whether the seed is present. The legacy "oqskeypair", "bare-seed" and "bare-priv" formats can also be output, by listing those first.

🏆 CONFORMING TO 🏆

FIPS 203 ✨

🧪 EXAMPLES ✨

Okay bestie, this is the fun part — actual recipes you can copy-paste. Every one of these is a real, working incantation, so no cap, just type it 💅

First up: if you want an EVP_PKEY context (the little handle you do all your crypto with), you get one like this:

EVP_PKEY_CTX *pctx =
    EVP_PKEY_CTX_new_from_name(NULL, "ML-KEM-768", NULL);

Iconic. That's it. That's the whole vibe check.

And if you just want to make an ML-KEM-768 key, one line, chef's kiss:

pkey = EVP_PKEY_Q_keygen(NULL, NULL, "ML-KEM-768");

Like… EVP_PKEY_Q_keygen really said "I'll handle it" and then handled it. Periodt. 🎀

💖 Converting a seed to a dk key

So you've got an ML-KEM private key in seed format and you want it in the FIPS 203 dk format instead? Run this, bestie:

$ openssl pkey -provparam ml-kem.retain_seed=no \
    -in seed-only.pem -out priv-only.pem

The -provparam ml-kem.retain_seed=no is the whole trick — that's you telling the provider "nah, don't keep the seed around, give me the key itself." 🦋

✨ Generating a fresh dk-format key

Want to generate, like, an ML-KEM-768 key straight into FIPS 203 dk format from the jump? Easy:

$ openssl genpkey -provparam ml-kem.retain_seed=no \
    -algorithm ml-kem-768 -out priv-only.pem

Same retain_seed=no energy, just from genpkey this time. Lowkey the most satisfying way to do it. 🔥

🌸 Seed and key in one PKCS#8 file? No problem.

Say you've got a PKCS#8 file that has both a seed and a key inside it, and honestly you'd rather import the companion key than the seed. Then you want:

$ openssl pkey -provparam ml-kem.prefer_seed=no \
    -in seed-priv.pem -out priv-only.pem

Note the switch from retain_seed to prefer_seed — that's not a typo, she's just built different. prefer_seed=no = "give me the key, not the seed, thanks." 🙈

🧚 Doing it all in openssl.cnf

If you're an openssl.cnf girlie (and honestly, same), all of the above can be configured globally. It looks like this, verbatim:

openssl_conf = openssl_init

[openssl_init]
providers = providers_sect

# Can be referenced in one or more provider sections
[ml_kem_sect]
prefer_seed = yes
retain_seed = yes
# OQS legacy formats disabled
input_formats = seed-priv, seed-only, priv-only
# Output either the seed alone, or else the key alone
output_formats = seed-only, priv-only

[providers_sect]
default = default_sect
# Or perhaps just: base = default_sect
base = base_sect

[default_sect]
ml-kem = ml_kem_sect

[base_sect]
ml-kem = ml_kem_sect

A few little notes so you don't get lost in the sauce 🫶

  • That [ml_kem_sect] block is a reusable section — the comment literally says "Can be referenced in one or more provider sections", so you can point multiple providers at it and they'll all share the same settings. Efficiency queen.
  • prefer_seed = yes and retain_seed = yes are the config-file equivalents of the -provparam flags above.
  • # OQS legacy formats disabled — that's the comment explaining why input_formats only lists seed-priv, seed-only, priv-only. The OQS legacy formats are, well, disabled. Not invited to the party.
  • output_formats = seed-only, priv-only with the note "Output either the seed alone, or else the key alone" — so it's one or the other, not a mashup.
  • In [providers_sect] you can either declare default = default_sect or — as the comment says — "Or perhaps just: base = default_sect". Pick your fighter.
  • Then [default_sect] and [base_sect] each map ml-kem = ml_kem_sect, so whichever path you take, the ml_kem_sect settings come along for the ride. 😭 beautiful

👀 SEE ALSO

Go read these next, iykyk — they're all part of the same little ecosystem:

That's the whole reading list, bestie — go forth and get educated 📚✨

🕰️ HISTORY

This whole functionality? Added in OpenSSL 3.5. So if you're on anything older, sorry babe, it's not there yet. 😭

Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at:

https://www.openssl.org/source/license.html

And that's a wrap, my love 💖 — this page is OpenSSL 3.5.9, dated 2026-09-29, and it lives at EVP_PKEY-ML-KEM(7ossl). Go generate some keys, you absolute icon. 👑

📦 where this page comes from