Core engineering and protocols for Fujisaki-Okamoto CCA2 Security.
ML-KEM achieves chosen-ciphertext security (IND-CCA2) through a modified Fujisaki-Okamoto transform. Upon receiving a ciphertext c, the decapsulation engine uses the private key s to decrypt the message m', re-encrypts m' to obtain c', and compares c with c'. If c != c', the algorithm outputs a pseudo-random key derived from a random seed z embedded in the secret key.
A subtle vulnerability in flawed implementations is early termination during the byte-wise comparison of c and c'. MLKEMCipher implements bitwise OR-accumulation over the entire ciphertext array, executing in identical cycle counts regardless of where discrepancies occur, defeating chosen-ciphertext oracle attacks.