BCRYPT_MLKEM_KEY_BLOB structure

The BCRYPT_MLKEM_KEY_BLOB structure is used as a header for an ML-KEM public key (byte-encoded encapsulation key) or private keyBLOB in memory.

Syntax

typedef struct _BCRYPT_MLKEM_KEY_BLOB {
  ULONG dwMagic;
  ULONG cbParameterSet;             // Byte size of parameterSet[]
  ULONG cbKey;                      // Byte size of key[]
  // WCHAR parameterSet[cbParameterSet / sizeof(WCHAR)];  // Including \0-terminated
  // BYTE key[cbKey];                                     // Key material
} BCRYPT_MLKEM_KEY_BLOB, *PBCRYPT_MLKEM_KEY_BLOB;

Fields

dwMagic

The dwMagic field is a 4-byte value that indicates the format of the key being used. Se definen los siguientes valores:

cbParameterSet

The length, in bytes, of the buffer parameterSet directly following the struct. Este búfer contiene una cadena Unicode terminada en null que identifica el conjunto de parámetros de la clave. The following values (per FIPS 203) are currently supported:

cbKey

The length, in bytes, of the buffer key directly following parameterSet. Este tamaño es estático y depende del formato de clave y del parámetro establecido en uso.

Remarks

BCRYPT_MLKEM_PRIVATE_SEED_BLOB supports import and export of ML-KEM seeds. The blob has dwMagic value BCRYPT_MLKEM_PRIVATE_SEED_MAGIC and the key field contains the KEM seed (defined as the 64-byte concatenation of d || z per FIPS 203), so cbKey is currently always 64.

BCRYPT_MLKEM_PRIVATE_BLOB (also aliased as BCRYPT_MLKEM_DECAPSULATION_BLOB) supports import and export of standard byte-encoded ML-KEM decapsulation keys per FIPS 203. The blob has dwMagic value BCRYPT_MLKEM_PRIVATE_MAGIC and the key field contains the byte-encoded key.

BCRYPT_MLKEM_PUBLIC_BLOB (also aliased as BCRYPT_MLKEM_ENCAPSULATION_BLOB) supports import and export of standard byte-encoded ML-KEM encapsulation keys per FIPS 203. The blob has dwMagic value BCRYPT_MLKEM_PUBLIC_MAGIC and the key field contains the byte-encoded key.

The byte sizes of the byte-encoded keys can be found in FIPS 203 Section 8 Table 3. Many callers can instead dynamically query the required blob sizes using BCryptExportKey with NULLpbOutput.

Requirements

See also

BCryptGenerateKeyPair

BCryptImportKeyPair

BCryptFinalizeKeyPair

BCryptExportKey

BCryptGetProperty

BCryptSetProperty

BCryptEncapsulate

BCryptDecapsulate