FIPS 203
Federal Information Processing Standards Publication

Module-Lattice-Based
Key-Encapsulation Mechanism Standard
Category: Computer Security

Subcategory: Cryptography

Information Technology Laboratory
National Institute of Standards and Technology
Gaithersburg, MD 20899-8900
This publication is available free of charge from:
https://doi.org/10.6028/NIST.FIPS.203
Published August 13, 2024

U.S. Department of Commerce
Gina M. Raimondo, Secretary
National Institute of Standards and Technology
Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Foreword
The Federal Information Processing Standards (FIPS) Publication Series of the National Institute of Standards and Technology is the official series of publications relating to standards and guidelines developed
under 15 U.S.C. 278g-3, and issued by the Secretary of Commerce under 40 U.S.C. 11331.
Comments concerning this Federal Information Processing Standard publication are welcomed and should
be submitted using the contact information in the “Inquiries and Comments” clause of the announcement
section.
Kevin M. Stine, Director
Information Technology Laboratory

FIPS 203

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

Abstract
A key-encapsulation mechanism (KEM) is a set of algorithms that, under certain conditions, can be
used by two parties to establish a shared secret key over a public channel. A shared secret key that
is securely established using a KEM can then be used with symmetric-key cryptographic algorithms
to perform basic tasks in secure communications, such as encryption and authentication. This
standard specifies a key-encapsulation mechanism called ML-KEM. The security of ML-KEM is
related to the computational difficulty of the Module Learning with Errors problem. At present,
ML-KEM is believed to be secure, even against adversaries who possess a quantum computer.
This standard specifies three parameter sets for ML-KEM. In order of increasing security strength
and decreasing performance, these are ML-KEM-512, ML-KEM-768, and ML-KEM-1024.
Keywords: computer security; cryptography; encryption; Federal Information Processing Standards; key-encapsulation mechanism; lattice-based cryptography; post-quantum; public-key
cryptography.

FIPS 203

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

Federal Information Processing Standards Publication 203
Published: August 13, 2024
Effective: August 13, 2024

Announcing the

Module-Lattice-Based Key-Encapsulation
Mechanism Standard
Federal Information Processing Standards (FIPS) publications are developed by the National
Institute of Standards and Technology (NIST) under 15 U.S.C. 278g-3 and issued by the Secretary
of Commerce under 40 U.S.C. 11331.
1. Name of Standard. Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS
203).
2. Category of Standard. Computer Security. Subcategory. Cryptography.
3. Explanation. A cryptographic key (or simply “key”) is represented in a computer as a string of
bits. A shared secret key is a cryptographic key that is computed jointly by two parties (e.g.,
Alice and Bob) using a set of algorithms. Under certain conditions, these algorithms ensure
that both parties will produce the same key and that this key is secret from adversaries. Such
a shared secret key can then be used with symmetric-key cryptographic algorithms (specified
in other NIST standards) to perform tasks such as encryption and authentication of digital
information.
This standard specifies a set of algorithms for establishing a shared secret key. While there
are many methods for establishing a shared secret key, the particular method described in
this standard is a key-encapsulation mechanism (KEM).
In a KEM, the computation of the shared secret key begins with Alice generating a decapsulation key and an encapsulation key. Alice keeps the decapsulation key private and makes
the encapsulation key available to Bob. Bob then uses Alice’s encapsulation key to generate
one copy of a shared secret key along with an associated ciphertext. Bob then sends the
ciphertext to Alice. Finally, Alice uses the ciphertext from Bob along with Alice’s private
decapsulation key to compute another copy of the shared secret key.
The security of the particular KEM specified in this standard is related to the computational
difficulty of solving certain systems of noisy linear equations, specifically the Module Learning With Errors (MLWE) problem. At present, it is believed that this particular method of
establishing a shared secret key is secure, even against adversaries who possess a quantum
computer. In the future, additional KEMs may be specified and approved in FIPS publications
or in NIST Special Publications.
4. Approving Authority. Secretary of Commerce.
5. Maintenance Agency. Department of Commerce, National Institute of Standards and Technology, Information Technology Laboratory (ITL).
i

FIPS 203

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

6. Applicability. Federal Information Processing Standards apply to information systems used or
operated by federal agencies or by a contractor of an agency or other organization on behalf
of an agency. They do not apply to national security systems as defined in 44 U.S.C. 3552.
This standard, or other FIPS or NIST Special Publications that specify alternative mechanisms,
shall be used wherever the establishment of a shared secret key (or shared secret from which
keying material can be generated) is required for federal applications, including the use of
such a key with symmetric-key cryptographic algorithms, in accordance with applicable Office
of Management and Budget and agency policies.
The adoption and use of this standard are available to private and commercial organizations.
7. Implementations. A key-encapsulation mechanism may be implemented in software, firmware,
hardware, or any combination thereof. For every computational procedure that is specified
in this standard, a conforming implementation may replace the given set of steps with any
mathematically equivalent set of steps. In other words, different procedures that produce
the correct output for every input are permitted.
NIST will develop a validation program to test implementations for conformance to the
algorithms in this standard. Information about validation programs is available at https:
//csrc.nist.gov/projects/cmvp. Example values will be available at https://csrc.nist.gov/proj
ects/cryptographic-standards-and-guidelines/example-values.
8. Other Approved Security Functions. Implementations that comply with this standard
shall employ cryptographic algorithms that have been approved for protecting Federal
Government-sensitive information. Approved cryptographic algorithms and techniques
include those that are either:
(a) Specified in a Federal Information Processing Standards (FIPS) publication,
(b) Adopted in a FIPS or NIST recommendation, or
(c) Specified in the list of approved security functions in SP 800-140C.
9. Export Control. Certain cryptographic devices and technical data regarding them are subject
to federal export controls. Exports of cryptographic modules that implement this standard
and technical data regarding them must comply with all federal laws and regulations and
be licensed by the Bureau of Industry and Security of the U.S. Department of Commerce.
Information about export regulations is available at https://www.bis.doc.gov.
10. Patents. NIST has entered into two patent license agreements to facilitate the adoption of
NIST’s announced selection of the PQC key-encapsulation mechanism CRYSTALS-KYBER. NIST
and the licensing parties share a desire, in the public interest, the licensed patents be freely
available to be practiced by any implementer of the ML-KEM algorithm as published by NIST.
ML-KEM is the name given to the algorithm in this standard derived from CRYSTALS-KYBER.
For a summary and extracts from the license, please see https://csrc.nist.gov/csrc/media/P
rojects/post-quantum-cryptography/documents/selected-algos-2022/nist-pqc-license-sum
mary-and-excerpts.pdf. Implementation of the algorithm specified in the standard may be
covered by U.S. and foreign patents of which NIST is not aware.

ii

FIPS 203

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

11. Implementation Schedule. This standard becomes effective immediately upon final publication.
12. Specifications. Federal Information Processing Standards (FIPS) 203, Module-Lattice-Based
Key-Encapsulation Mechanism Standard (affixed).
13. Qualifications. In applications, the security guarantees of a KEM only hold under certain
conditions (see SP 800-227 [1]). One such condition is the secrecy of several values, including
the randomness used by the two parties, the decapsulation key, and the shared secret key
itself. Users shall, therefore, guard against the disclosure of these values.
While it is the intent of this standard to specify general requirements for implementing
ML-KEM algorithms, conformance to this standard does not ensure that a particular implementation is secure. It is the responsibility of the implementer to ensure that any module
that implements a key establishment capability is designed and built in a secure manner.
Similarly, the use of a product containing an implementation that conforms to this standard
does not guarantee the security of the overall system in which the product is used. The responsible authority in each agency or department shall ensure that an overall implementation
provides an acceptable level of security.
NIST will continue to follow developments in the analysis of the ML-KEM algorithm. As with
its other cryptographic algorithm standards, NIST will formally reevaluate this standard every
five years.
Both this standard and possible threats that reduce the security provided through the use of
this standard will undergo review by NIST as appropriate, taking into account newly available
analysis and technology. In addition, the awareness of any breakthrough in technology or
any mathematical weakness of the algorithm will cause NIST to reevaluate this standard and
provide necessary revisions.
14. Waiver Procedure. The Federal Information Security Management Act (FISMA) does not allow
for waivers to Federal Information Processing Standards (FIPS) that are made mandatory by
the Secretary of Commerce.
15. Where to Obtain Copies of the Standard. This publication is available by accessing https:
//csrc.nist.gov/publications. Other computer security publications are available at the same
website.
16. How to Cite This Publication. NIST has assigned NIST FIPS 203 as the publication identifier
for this FIPS, per the NIST Technical Series Publication Identifier Syntax. NIST recommends
that it be cited as follows:
National Institute of Standards and Technology (2024) Module-Lattice-Based KeyEncapsulation Mechanism Standard. (Department of Commerce, Washington,
D.C.), Federal Information Processing Standards Publication (FIPS) NIST FIPS 203.
https://doi.org/10.6028/NIST.FIPS.203
17. Inquiries and Comments. Inquiries and comments about this FIPS may be submitted to
fips-203-comments@nist.gov.

iii

FIPS 203

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

Federal Information Processing Standards Publication 203
Specification for the

Module-Lattice-Based Key-Encapsulation
Mechanism Standard
Table of Contents
1 Introduction

1

1.1

Purpose and Scope

1

1.2

Context

1

2 Terms, Acronyms, and Notation

2

2.1

Terms and Definitions

2

2.2

Acronyms

4

2.3

Mathematical Symbols

5

2.4

Interpreting the Pseudocode
2.4.1 Data Types
2.4.2 Loop Syntax
2.4.3 Arithmetic With Arrays of Integers
2.4.4 Representations of Algebraic Objects
2.4.5 Arithmetic With Polynomials and NTT Representations
2.4.6 Matrices and Vectors
2.4.7 Arithmetic With Matrices and Vectors
2.4.8 Applying Algorithms to Arrays, Examples

6
7
7
7
8
9
9
10
11

3 Overview of the ML-KEM Scheme

12

3.1

Key-Encapsulation Mechanisms

12

3.2

The ML-KEM Scheme

13

3.3

Requirements for ML-KEM Implementations

15

4 Auxiliary Algorithms

18

4.1

Cryptographic Functions

18

4.2

General Algorithms
4.2.1 Conversion and Compression Algorithms
4.2.2 Sampling Algorithms
The Number-Theoretic Transform

20
20
22
24

4.3

iv

FIPS 203

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

4.3.1

Multiplication in the NTT Domain

5 The K-PKE Component Scheme

27
28

5.1

K-PKE Key Generation

28

5.2

K-PKE Encryption

29

5.3

K-PKE Decryption

31

6 Main Internal Algorithms

32

6.1

Internal Key Generation

32

6.2

Internal Encapsulation

32

6.3

Internal Decapsulation

33

7 The ML-KEM Key-Encapsulation Mechanism

35

7.1

ML-KEM Key Generation

35

7.2

ML-KEM Encapsulation

36

7.3

ML-KEM Decapsulation

37

8 Parameter Sets

39

References

41

Appendix A — Precomputed Values for the NTT

44

Appendix B — SampleNTT Loop Bounds

46

Appendix C — Differences From the CRYSTALS-KYBER Submission

47

C.1

Differences Between CRYSTALS-KYBER and FIPS 203 Initial Public Draft

47

C.2

Changes From FIPS 203 Initial Public Draft

47

v

FIPS 203

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

List of Tables
Table 1
Table 2
Table 3
Table 4

Decapsulation failure rates for ML-KEM
Approved parameter sets for ML-KEM
Sizes (in bytes) of keys and ciphertexts of ML-KEM
While-loop limits and probabilities of occurrence for SampleNTT

15
39
39
46

List of Figures
Figure 1

A simple view of key establishment using a KEM

12

List of Algorithms
Algorithm 1
Algorithm 2
Algorithm 3
Algorithm 4
Algorithm 5
Algorithm 6
Algorithm 7
Algorithm 8
Algorithm 9
Algorithm 10
Algorithm 11
Algorithm 12
Algorithm 13
Algorithm 14
Algorithm 15
Algorithm 16
Algorithm 17
Algorithm 18
Algorithm 19
Algorithm 20
Algorithm 21

ForExample() . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
SHAKE128example(str1 , … , str𝑚 , 𝑏1 , … , 𝑏ℓ ) . . . . . . . . . . . . .
BitsToBytes(𝑏) . . . . . . . . . . . . . . . . . . . . . . . . . . . .
BytesToBits(𝐵) . . . . . . . . . . . . . . . . . . . . . . . . . . . .
ByteEncode𝑑 (𝐹 ) . . . . . . . . . . . . . . . . . . . . . . . . . . . .
ByteDecode𝑑 (𝐵) . . . . . . . . . . . . . . . . . . . . . . . . . . . .
SampleNTT(𝐵) . . . . . . . . . . . . . . . . . . . . . . . . . . . .
SamplePolyCBD𝜂 (𝐵) . . . . . . . . . . . . . . . . . . . . . . . . .
NTT(𝑓) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
NTT−1 (𝑓)̂ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
MultiplyNTTs(𝑓,̂ 𝑔)̂ . . . . . . . . . . . . . . . . . . . . . . . . . .
BaseCaseMultiply(𝑎0 , 𝑎1 , 𝑏0 , 𝑏1 , 𝛾) . . . . . . . . . . . . . . . . . .
K-PKE.KeyGen(𝑑) . . . . . . . . . . . . . . . . . . . . . . . . . . .
K-PKE.Encrypt(ekPKE , 𝑚, 𝑟) . . . . . . . . . . . . . . . . . . . . . . .
K-PKE.Decrypt(dkPKE , 𝑐) . . . . . . . . . . . . . . . . . . . . . . . .
ML-KEM.KeyGen_internal(𝑑, 𝑧) . . . . . . . . . . . . . . . . . . . .
ML-KEM.Encaps_internal(ek, 𝑚) . . . . . . . . . . . . . . . . . . .
ML-KEM.Decaps_internal(dk, 𝑐) . . . . . . . . . . . . . . . . . . . .
ML-KEM.KeyGen() . . . . . . . . . . . . . . . . . . . . . . . . . . .
ML-KEM.Encaps(ek) . . . . . . . . . . . . . . . . . . . . . . . . . .
ML-KEM.Decaps(dk, 𝑐) . . . . . . . . . . . . . . . . . . . . . . . .

vi

8
19
20
20
22
22
23
23
26
26
27
27
29
30
31
32
33
34
35
37
38

FIPS 203

1.

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

Introduction

1.1 Purpose and Scope
This standard specifies the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). A
key-encapsulation mechanism (KEM) is a set of algorithms that can be used to establish a shared
secret key between two parties communicating over a public channel. A KEM is a particular type
of key establishment scheme. Other NIST-approved key establishment schemes are specified
in NIST Special Publication (SP) 800-56A, Recommendation for Pair-Wise Key-Establishment
Schemes Using Discrete Logarithm-Based Cryptography [2], and SP 800-56B, Recommendation
for Pair-Wise Key Establishment Schemes Using Integer Factorization Cryptography [3].
The key establishment schemes specified in SP 800-56A and SP 800-56B are vulnerable to
attacks that use sufficiently-capable quantum computers. ML-KEM is an approved alternative
that is presently believed to be secure, even against adversaries in possession of a large-scale
fault-tolerant quantum computer. ML-KEM is derived from the round-three version of the
CRYSTALS-KYBER KEM [4], a submission in the NIST Post-Quantum Cryptography Standardization
project. For the differences between ML-KEM and CRYSTALS-KYBER, see Appendix C.
This standard specifies the algorithms and parameter sets of the ML-KEM scheme. It aims
to provide sufficient information to implement ML-KEM in a manner that can pass validation
(see https://csrc.nist.gov/projects/cryptographic- module- validation- program). For
general definitions and properties of KEMs, including requirements for the secure use of KEMs
in applications, see SP 800-227 [1].
This standard specifies three parameter sets for ML-KEM that offer different trade-offs in security
strength versus performance. All three parameter sets of ML-KEM are approved to protect
sensitive, non-classified communication systems of the U.S. Federal Government.

1.2 Context
Over the past several years, there has been steady progress toward building quantum computers.
If large-scale quantum computers are realized, the security of many commonly used public-key
cryptosystems will be at risk. This would include key-establishment schemes and digital signature
schemes whose security depends on the difficulty of solving the integer factorization and discrete
logarithm problems (both over finite fields and elliptic curves). As a result, in 2016, NIST initiated
a public Post-Quantum Cryptography (PQC) Standardization process to select quantum-resistant
public-key cryptographic algorithms. A total of 82 candidate algorithms were submitted to NIST
for consideration.
After three rounds of evaluation and analysis, NIST selected the first four algorithms for standardization. These algorithms are intended to protect sensitive U.S. Government information
well into the foreseeable future, including after the advent of cryptographically-relevant quantum computers. This standard specifies a variant of the selected algorithm CRYSTALS-KYBER, a
lattice-based key-encapsulation mechanism (KEM) designed by Peter Schwabe, Roberto Avanzi,
Joppe Bos, Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, John Schanck, Gregor
Seiler, Damien Stehlé, and Jintai Ding [4]. Throughout this standard, the KEM specified here will
be referred to as ML-KEM, as it is based on the Module Learning With Errors assumption.
1

FIPS 203

2.

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

Terms, Acronyms, and Notation

2.1 Terms and Definitions
approved

FIPS-approved and/or NIST-recommended. An algorithm or technique
that is either 1) specified in a FIPS or NIST recommendation, 2) adopted
in a FIPS or NIST recommendation, or 3) specified in a list of NIST-approved
security functions.

(KEM) ciphertext

A bit string that is produced by encapsulation and used as an input to
decapsulation.

cryptographic
module

The set of hardware, software, and/or firmware that implements approved cryptographic functions (including key generation) that are contained within the cryptographic boundary of the module.

decapsulation

The process of applying the Decaps algorithm of a KEM. This algorithm
accepts a KEM ciphertext and the decapsulation key as input and produces a shared secret key as output.

decapsulation key

A cryptographic key produced by a KEM during key generation and used
during the decapsulation process. The decapsulation key must be kept
private and must be destroyed after it is no longer needed. (See Section
3.3.)

decryption key

A cryptographic key that is used with a PKE in order to decrypt ciphertexts into plaintexts. The decryption key must be kept private and must
be destroyed after it is no longer needed.

destroy

An action applied to a key or other piece of secret data. After a piece
of secret data is destroyed, no information about its value can be recovered.

encapsulation

The process of applying the Encaps algorithm of a KEM. This algorithm
accepts the encapsulation key as input, requires private randomness,
and produces a shared secret key and an associated ciphertext as output.

encapsulation key

A cryptographic key produced by a KEM during key generation and used
during the encapsulation process. The encapsulation key can be made
public. (See Section 3.3.)

encryption key

A cryptographic key that is used with a PKE in order to encrypt plaintexts
into ciphertexts. The encryption key can be made public.

equivalent process

Two processes are equivalent if the same output is produced when the
same values are input to each process (either as input parameters, as
values made available during the process, or both).

fresh random value An output that was produced by a random bit generator and has not
been previously used.
2

FIPS 203

hash function

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

A function on bit strings in which the length of the output is fixed.
Approved hash functions (such as those specified in FIPS 180 [5] and
FIPS 202 [6]) are designed to satisfy the following properties:
1. (One-way) It is computationally infeasible to find any input that
maps to any new pre-specified output.
2. (Collision-resistant) It is computationally infeasible to find any two
distinct inputs that map to the same output.

input checking

Examination of a potential input to an algorithm for the purpose of
determining whether it conforms to certain requirements.

key

A bit string that is used in conjunction with a cryptographic algorithm,
such as the encapsulation and decapsulation keys (of a KEM), the shared
secret key (produced by a KEM), and the encryption and decryption
keys (of a PKE). (See Section 3.3.)

key-encapsulation
mechanism (KEM)

A set of three cryptographic algorithms (KeyGen, Encaps, and Decaps)
that can be used by two parties to establish a shared secret key over a
public channel.

key establishment

A procedure that results in secret keying material that is shared among
different parties.

key pair

A set of two keys with the property that one key can be made public
while the other key must be kept private. In this standard, this could
refer to either the (encapsulation key, decapsulation key) key pair of a
KEM or the (encryption key, decryption key) key pair of a PKE.

little-endian

The property of a byte string having its bytes positioned in order of
increasing significance. In particular, the leftmost (first) byte is the
least significant, and the rightmost (last) byte is the most significant.
The term “little-endian” may also be applied in the same manner to
bit strings (e.g., the 8-bit string 11010001 corresponds to the byte
20 + 21 + 23 + 27 = 139).

party

An individual person, organization, device, or process. In this specification, there are two parties (e.g., Party A and Party B, or Alice and Bob)
who jointly perform the key establishment process using a KEM.

pseudorandom

A process (or data produced by a process) is said to be pseudorandom
when the outcome is deterministic yet also appears random as long
as the internal action of the process is hidden from observation. For
cryptographic purposes, “effectively random” means “computationally
indistinguishable from random within the limits of the intended security
strength.”

public channel

A communication channel between two parties. Such a channel can be
observed and possibly also corrupted by third parties.

3

FIPS 203

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

public-key
encryption scheme
(PKE)

A set of three cryptographic algorithms (KeyGen, Encrypt, and Decrypt)
that can be used by two parties to send secret data over a public channel.
Also known as an asymmetric encryption scheme.

shared secret

A secret value that has been computed during a key-establishment
scheme, is known by both participants, and is used as input to a keyderivation method to produce keying material.

shared secret key

A shared secret that can be used directly as a cryptographic key in
symmetric-key cryptography. It does not require additional key derivation. The shared secret key must be kept private and must be destroyed
when no longer needed.

security category

A number associated with the security strength of a post-quantum
cryptographic algorithm, as specified by NIST (see [7]).

security strength

A number associated with the amount of work (i.e., the number of operations) that is required to break a cryptographic algorithm or system.

shall

Used to indicate a requirement of this standard.

should

Used to indicate a strong recommendation but not a requirement of
this standard. Ignoring the recommendation could lead to undesirable
results.

2.2 Acronyms
AES

Advanced Encryption Standard

CBD

Centered Binomial Distribution

FIPS

Federal Information Processing Standard

KEM

Key-Encapsulation Mechanism

LWE

Learning with Errors

MLWE

Module Learning with Errors

NIST

National Institute of Standards and Technology

NISTIR

NIST Interagency or Internal Report

NTT

Number-Theoretic Transform

PKE

Public-Key Encryption

PQC

Post-Quantum Cryptography

PRF

Pseudorandom Function

RBG

Random Bit Generator

SHA

Secure Hash Algorithm
4

FIPS 203

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

SHAKE

Secure Hash Algorithm KECCAK

SP

Special Publication

XOF

Extendable-Output Function

2.3 Mathematical Symbols
𝑛

Denotes the integer 256 throughout this document.

𝑞

Denotes the prime integer 3329 = 28 ⋅ 13 + 1 throughout this document.

𝜁

Denotes the integer 17, which is a primitive 𝑛-th root of unity modulo 𝑞.

𝔹

The set {0, 1, … , 255} of unsigned 8-bit integers (bytes).

ℚ

The set of rational numbers.

ℤ

The set of integers.

ℤ𝑚

The ring of integers modulo 𝑚 (i.e., the set {0, 1, … , 𝑚 − 1} equipped with
the operations of addition and multiplication modulo 𝑚.)

ℤ𝑛𝑚

The set of 𝑛-tuples over ℤ𝑚 equipped with ℤ𝑚 -module structure. As a data
type, this is the set of length-𝑛 arrays whose entries are in ℤ𝑚 .

𝑅𝑞

The ring ℤ𝑞 [𝑋]/(𝑋 𝑛 + 1) consisting of polynomials of the form 𝑓 = 𝑓0 +
𝑓1 𝑋 + ⋯ + 𝑓255 𝑋 255 , where 𝑓𝑗 ∈ ℤ𝑞 for all 𝑗. The ring operations are addition and multiplication modulo 𝑋 𝑛 + 1.

𝑇𝑞

The image of 𝑅𝑞 under the number-theoretic transform. Its elements are
called “NTT representations” of polynomials in 𝑅𝑞 . (See Section 4.3.)

D𝜂 (𝑅𝑞 )

A certain distribution of polynomials in 𝑅𝑞 with small coefficients, from
which noise is sampled. The distribution is parameterized by 𝜂 ∈ {2, 3}. (See
Section 4.2.2.)

𝑆∗

If 𝑆 is a set, this denotes the set of finite-length tuples (or arrays) of elements
from the set 𝑆, including the empty tuple (or empty array).

𝑆𝑘

If 𝑆 is a set, this denotes the set of 𝑘-tuples (or length-𝑘 arrays) of elements
from the set 𝑆.

𝑓𝑗

The coefficient of 𝑋 𝑗 of a polynomial 𝑓 = 𝑓0 + 𝑓1 𝑋 + ⋯ + 𝑓255 𝑋 255 ∈ 𝑅𝑞 .

𝑓̂

The element of 𝑇𝑞 that is equal to the NTT representation of a polynomial
𝑓 ∈ 𝑅𝑞 . (See Sections 2.4.4 and 4.3.)

𝐯𝑇 , 𝐀𝑇

The transpose of a row or column vector 𝐯. In general, the transpose of a
matrix 𝐀.

5

FIPS 203

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

∘

Denotes linear-algebraic composition with coefficients in 𝑅𝑞 or 𝑇𝑞 (e.g.,
𝐀 ∘ 𝐯 denotes the vector resulting from applying matrix 𝐀 to vector 𝐯). (See
Section 2.4.7.)

×𝑇𝑞

Denotes the operation on coefficient arrays that implements product in the
ring 𝑇𝑞 . (See Sections 2.4.5 and 4.3.1.)

𝐴‖𝐵

The concatenation of two arrays or bit strings 𝐴 and 𝐵.

𝐵[𝑖]

The entry at index 𝑖 in the array 𝐵. All arrays have indices that begin at zero.

𝐵[𝑘 ∶ 𝑚]

The subarray (𝐵[𝑘], 𝐵[𝑘 + 1], … , 𝐵[𝑚 − 1]) of the array 𝐵.

|𝐵|

If 𝐵 is a number, this denotes the absolute value of 𝐵. If 𝐵 is an array, this
denotes its length.

⌈𝑥⌉

The ceiling of 𝑥 (i.e., the smallest integer greater than or equal to 𝑥).

⌊𝑥⌋

The floor of 𝑥 (i.e., the largest integer less than or equal to 𝑥).

⌈𝑥⌋

The rounding of 𝑥 to the nearest integer. If 𝑥 = 𝑦 + 1/2 for some 𝑦 ∈ ℤ, then
⌈𝑥⌋ = 𝑦 + 1.

∶=

Denotes that the left-hand side is defined to be the expression on the righthand side.

𝑟 mod 𝑚

The unique integer 𝑟′ in {0, 1, … , 𝑚 − 1} such that 𝑚 divides 𝑟 − 𝑟′ .

BitRev7 (𝑟)

Bit reversal of a seven-bit integer 𝑟. Specifically, if 𝑟 = 𝑟0 + 2𝑟1 + 4𝑟2 + ⋯ +
64𝑟6 with 𝑟𝑖 ∈ {0, 1}, then BitRev7 (𝑟) = 𝑟6 + 2𝑟5 + 4𝑟4 + ⋯ + 64𝑟0 .

𝑠←𝑥

In pseudocode, this notation means that the variable 𝑠 is assigned the value
of the expression 𝑥.

$

𝑠 ←− 𝔹ℓ

In pseudocode, this notation means that the variable 𝑠 is assigned the value
of an array of ℓ random bytes. The bytes must be freshly generated using
randomness from an approved RBG. (See Section 3.3.)

⊥

A symbol indicating failure or the lack of output from an algorithm.

2.4 Interpreting the Pseudocode
This section outlines the conventions of the pseudocode used to describe the algorithms in
this standard. All algorithms are understood to have access to two global integer constants:
𝑛 = 256 and 𝑞 = 3329. There are also five global integer variables: 𝑘, 𝜂1 , 𝜂2 , 𝑑𝑢 , and 𝑑𝑣 . All
other variables are local. The five global variables are set to particular values when a parameter
set is selected (see Section 8).
When algorithms in this specification invoke other algorithms as subroutines, all arguments (i.e.,
inputs) are passed by value. In other words, a copy of the inputs is created, and the subroutine
is invoked with the copy. There is no “passing by reference.”
Pseudocode assignments are performed using the symbol “←.” For example, the statement
𝑧 ← 𝑦 means that the variable 𝑧 is assigned the value of variable 𝑦. Pseudocode comparisons
6

FIPS 203

MODULE-LATTICE-BASED KEY-ENCAPSULATION MECHANISM

are performed via the symbol “==.” For example, the expression 𝑥 == 𝑤 is a boolean value
that is TRUE if and only if the variables 𝑥 and 𝑤 have the same value.
In regular text (i.e., outside of the pseudocode), a different convention is applied. There, the
“=” symbol is used both for assigning values and for comparisons, in keeping with standard
mathematical notation. When emphasis is needed, assignments will be made with “∶=” instead.
Variables will always have a valid value that is appropriate to their data type, with two exceptions:
1. The outputs of a random bit generator (RBG) have the byte array data type but are also
allowed to have the special value NULL. This value indicates that randomness generation
failed. This can only occur in ML-KEM.KeyGen and ML-KEM.Encaps.
2. The outputs of ML-KEM.KeyGen and ML-KEM.Encaps have the byte array data type but
are also allowed to have the special value ⊥. When ML-KEM.KeyGen or ML-KEM.Encaps
return the value ⊥, this indicates that the algorithm failed due to a failure of randomness
generation.
2.4.1 Data Types
For variables that represent the input or output of an algorithm, the data type (e.g., bit, byte,
array of bits) will be explicitly described at the start of the algorithm. For most local variables
in the pseudocode, the data type is easily deduced from context. For all other variables, the
