thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Advanced

Key Encapsulation Mechanism (KEM)

Public key scheme that encapsulates a randomly generated shared secret for a recipient's public key.

Definition

A KEM has three operations: key generation, encapsulation (producing a ciphertext and shared secret), and decapsulation (recovering the shared secret with the private key). It replaces Diffie-Hellman-style key exchange in post-quantum protocols. ML-KEM is the NIST-standardized post-quantum KEM.

Example

In hybrid TLS, the client sends an ML-KEM public key and the server returns an encapsulated shared secret.

Exam tip

KEMs establish keys; they are not used to encrypt arbitrary messages or sign.

Related terms