Appendix C. ML-KEM CMS Authenticated-Enveloped-Data Example
This section preserves the RFC text for using ML-KEM with CMS, including KEMRecipientInfo, HKDF, AES Key Wrap, ASN.1 identifiers, IANA registration, and the authenticated-enveloped-data example.
Appendix C. ML-KEM CMS Authenticated-Enveloped-Data Example
This example shows the establishment of an AES-128 content-encryption
key using:
* ML-KEM-512;
* KEMRecipientInfo key derivation using HKDF with SHA-256; and
* KEMRecipientInfo key wrap using AES-128-KEYWRAP.
In real-world use, the originator would encrypt the content-
encryption key in a manner that would allow decryption with their own
private key as well as the recipient's private key. This is omitted
in an attempt to simplify the example.
C.1. Originator CMS Processing
Alice obtains Bob's ML-KEM-512 public key:
-----BEGIN PUBLIC KEY-----
MIIDMjALBglghkgBZQMEBAEDggMhADmVgV5ZfRBDVc8pqlMzyTJRhp1bzb5IcST2
Ari2pmwWxHYWSK12XPXYAGtRXpBafwrAdrDGLvoygVPnylcBaZ8TBfHmvG+QsOSb
aTUSts6ZKouAFt38GmYsfj+WGcvYad13GvMIlszVkYrGy3dGbF53mZbWf/mqvJdQ
Pyx7fi0ADYZFD7GAfKTKvaRlgloxx4mht6SRqzhydl0yDQtxkg+iE8lAk0Frg7gS
Tmn2XmLLUADcw3qpoP/3OXDEdy81fSQYnKb1MFVowOI3ajdipoxgXlY8XSCVcuD8
dTLKKUcpU1VntfxBPF6HktJGRTbMgI+YrddGZPFBVm+QFqkKVBgpqYoEZM5BqLtE
wtT6PCwglGByjvFKGnxMm5jRIgO0zDUpFgqasteDj3/2tTrgWqMafWRrevpsRZMl
JqPDdVYZvplMIRwqMcBbNEeDbLIVC+GCna5rBMVTXP9Ubjkrp5dBFyD5JPSQpaxU
lfITVtVQt4KmTBaItrZVvMeEIZekNML2Vjtbfwmni8xIgjJ4NWHRb0y6tnVUAAUH
gVcMZmBLgXrRJSKUc26LAYYaS1p0UZuLb+UUiaUHI5Llh2JscTd2V10zgGocjicy
r5fCaA9RZmMxxOuLvAQxxPloMtrxs8RVKPuhU/bHixwZhwKUfM0zdyekb7U7oR3l
y0GRNGhZUWy2rXJADzzyCbI2rvNaWArIfrPjD6/WaXPKin3SZ1r0H3oXthQzzRr4
D3cIhp9mVIhJeYCxrBCgzctjagDthoGzXkKRJMqANQcluF+DperDpKPMFgCQPmUp
NWC5szblrw1SnawaBIEZMCy3qbzBELlIUb8CEX8ZncSFqFK3Rz8JuDGmgx1bVMC3
kNIlz2u5LZRiomzbM92lEjx6rw4moLg2Ve6ii/OoB0clAY/WuuS2Ac9huqtxp6PT
UZejQ+dLSicsEl1UCJZCbYW3lY07OKa6mH7DciXHtEzbEt3kU5tKsII2NoPwS/eg
nMXEHf6DChsWLgsyQzQ2LwhKFEZ3IzRLrdAA+NjFN8SPmY8FMHzr0e3guBw7xZoG
WhttY7Js
-----END PUBLIC KEY-----
Bob's ML-KEM-512 public key has the following key identifier:
599788C37AED400EE405D1B2A3366AB17D824A51
Alice generates a shared secret and ciphertext using Bob's ML-KEM-512
public key:
Shared secret:
7DF12D412AE299A24FDE6D7C3BB8E3194C80AD3C733DCF2775E09FE8BEDB86D8
Ciphertext:
3EA40FC6CA090E2C8AF76E2727AB38E0652D9515986FE186827FE84E596E421B
85FD459CC78997372C9DE31D191B39C1D5A3EB6DDB56AADEDE765CC390FDBBC2
F88CB175681D4201B81CCDFCB24FEF13AF2F5A1ABCF8D8AF384F02A010A6E919
F1987A5E9B1C0E2D3F07F58A9FA539CE86CC149910A1692C0CA4CE0ECE4EEED2
E6699CB976332452DE4A2EB5CA61F7B081330C34798EF712A24E59C33CEA1F1F
9E6D4FBF3743A38467430011336F62D870792B866BEFCD1D1B365BED1952673D
3A5B0C20B386B4EFD1CF63FD376BD47CCC46AC4DD8EC66B047C4C95ACFF1CFD0
28A419B002FDA1B617CBA61D2E91CFE8FFFBCB8FFD4D5F6AD8B158C219E36DC5
1405DC0C0B234979AC658E72BDDF1B6773B96B2AE3E4D07BE86048040C016743
6FA839E7529B00CC9AB55A2F25DB63CC9F557594E691C11E553D4A3EBC760F5F
19E5FE144838B4C7D1591DA9B5D467494FD9CAC52CC5504060399DBDB72298EB
9A4C017B00786FDC7D9D7AA57ADBB8B61C34DE1E288B2AB728171DCE143CD169
53F984C1AED559E56BAA0CE658D32CCE42F4407504CD7A579AD0EF9B77135EAA
39B6F93A3A2E5997807F06361C83F4E67F8E3F9CF68316011514F5D85A181CEA
D714CD4940E4EBAC01D66528DA32F89CEA0428E8EBCADCF8AA188C9F62E85B19
57655B7FE2B8D7973B7A7226B66D93BF7B232F3DCF653C84B4ECF1A9920DB194
9AD750B546A5552A20E54909719B8C0C07056FCB7E574AD2A32EC95001DDE844
81BE77D039ED5BF74262ECF3981F1B00D3366A9C2E061C47E241A061C6249560
D2B8446A480C38C28BA989D9F68ADC4BBAF2A20B47E4923128C72342D597FDA2
59DE0B83C2056D6B77E799B319324AA50B1D659C2A56029B7453C5F3BA5243D9
FA749D917C40D9D101E453BC8B10E42A7C089323C026F783E100B9FA6E701442
4DA6FA3792BC957EE8219D016B773F28FEDCC962A485ABAFFEC023281971E29A
A689839ECFD2619E92287CD230DB26A2507CC500EB1C7A5293B5FE917AE29BF1
AD350124F8A311635214B411DB9F67D3B85BD715018537EA45B41F41B4C66051
Alice encodes the CMSORIforKEMOtherInfo:
3010300B0609608648016503040105020110
Alice derives the key-encryption key from the shared secret and
CMSORIforKEMOtherInfo using HKDF with SHA-256:
CF453A3E2BAE0A78701B8206C185A008
Alice randomly generates a 128-bit content-encryption key:
C5153005588269A0A59F3C01943FDD56
Alice uses AES-128-KEYWRAP to encrypt the content-encryption key with
the key-encryption key:
C050E4392F9C14DD0AC2220203F317D701F94F9DD92778F5
Alice encrypts the padded content using AES-128-GCM with the content-
encryption key and encodes the AuthEnvelopedData (using
KEMRecipientInfo) and ContentInfo, and then sends the result to Bob.
The Base64-encoded result is:
-----BEGIN CMS-----
MIID4gYLKoZIhvcNAQkQARegggPRMIIDzQIBADGCA3ikggN0BgsqhkiG9w0BCRAN
AzCCA2MCAQCAFFmXiMN67UAO5AXRsqM2arF9gkpRMAsGCWCGSAFlAwQEAQSCAwA+
pA/GygkOLIr3bicnqzjgZS2VFZhv4YaCf+hOWW5CG4X9RZzHiZc3LJ3jHRkbOcHV
o+tt21aq3t52XMOQ/bvC+IyxdWgdQgG4HM38sk/vE68vWhq8+NivOE8CoBCm6Rnx
mHpemxwOLT8H9YqfpTnOhswUmRChaSwMpM4Ozk7u0uZpnLl2MyRS3koutcph97CB
Mww0eY73EqJOWcM86h8fnm1PvzdDo4RnQwARM29i2HB5K4Zr780dGzZb7RlSZz06
Wwwgs4a079HPY/03a9R8zEasTdjsZrBHxMlaz/HP0CikGbAC/aG2F8umHS6Rz+j/
+8uP/U1fatixWMIZ423FFAXcDAsjSXmsZY5yvd8bZ3O5ayrj5NB76GBIBAwBZ0Nv
qDnnUpsAzJq1Wi8l22PMn1V1lOaRwR5VPUo+vHYPXxnl/hRIOLTH0VkdqbXUZ0lP
2crFLMVQQGA5nb23IpjrmkwBewB4b9x9nXqletu4thw03h4oiyq3KBcdzhQ80WlT
+YTBrtVZ5WuqDOZY0yzOQvRAdQTNelea0O+bdxNeqjm2+To6LlmXgH8GNhyD9OZ/
jj+c9oMWARUU9dhaGBzq1xTNSUDk66wB1mUo2jL4nOoEKOjrytz4qhiMn2LoWxlX
ZVt/4rjXlzt6cia2bZO/eyMvPc9lPIS07PGpkg2xlJrXULVGpVUqIOVJCXGbjAwH
BW/LfldK0qMuyVAB3ehEgb530DntW/dCYuzzmB8bANM2apwuBhxH4kGgYcYklWDS
uERqSAw4woupidn2itxLuvKiC0fkkjEoxyNC1Zf9olneC4PCBW1rd+eZsxkySqUL
HWWcKlYCm3RTxfO6UkPZ+nSdkXxA2dEB5FO8ixDkKnwIkyPAJveD4QC5+m5wFEJN
pvo3kryVfughnQFrdz8o/tzJYqSFq6/+wCMoGXHimqaJg57P0mGekih80jDbJqJQ
fMUA6xx6UpO1/pF64pvxrTUBJPijEWNSFLQR259n07hb1xUBhTfqRbQfQbTGYFEw
DQYLKoZIhvcNAQkQAxwCARAwCwYJYIZIAWUDBAEFBBjAUOQ5L5wU3QrCIgID8xfX
AflPndknePUwOgYJKoZIhvcNAQcBMB4GCWCGSAFlAwQBBjARBAxcpXRouBvwO42n
GGwCARCADZTIaJqZ0sOOGS+muggEEFzxeGxXx0ArVPyTwwpKRTM=
-----END CMS-----
This result decodes to:
0 994: SEQUENCE {
4 11: OBJECT IDENTIFIER
: authEnvelopedData (1 2 840 113549 1 9 16 1 23)
17 977: [0] {
21 973: SEQUENCE {
25 1: INTEGER 0
28 888: SET {
32 884: [4] {
36 11: OBJECT IDENTIFIER '1 2 840 113549 1 9 16 13 3'
49 867: SEQUENCE {
53 1: INTEGER 0
56 20: [0]
: 59 97 88 C3 7A ED 40 0E E4 05 D1 B2 A3 36 6A B1
: 7D 82 4A 51
78 11: SEQUENCE {
80 9: OBJECT IDENTIFIER '2 16 840 1 101 3 4 4 1'
: }
91 768: OCTET STRING
: 3E A4 0F C6 CA 09 0E 2C 8A F7 6E 27 27 AB 38 E0
: 65 2D 95 15 98 6F E1 86 82 7F E8 4E 59 6E 42 1B
: 85 FD 45 9C C7 89 97 37 2C 9D E3 1D 19 1B 39 C1
: D5 A3 EB 6D DB 56 AA DE DE 76 5C C3 90 FD BB C2
: F8 8C B1 75 68 1D 42 01 B8 1C CD FC B2 4F EF 13
: AF 2F 5A 1A BC F8 D8 AF 38 4F 02 A0 10 A6 E9 19
: F1 98 7A 5E 9B 1C 0E 2D 3F 07 F5 8A 9F A5 39 CE
: 86 CC 14 99 10 A1 69 2C 0C A4 CE 0E CE 4E EE D2
: E6 69 9C B9 76 33 24 52 DE 4A 2E B5 CA 61 F7 B0
: 81 33 0C 34 79 8E F7 12 A2 4E 59 C3 3C EA 1F 1F
: 9E 6D 4F BF 37 43 A3 84 67 43 00 11 33 6F 62 D8
: 70 79 2B 86 6B EF CD 1D 1B 36 5B ED 19 52 67 3D
: 3A 5B 0C 20 B3 86 B4 EF D1 CF 63 FD 37 6B D4 7C
: CC 46 AC 4D D8 EC 66 B0 47 C4 C9 5A CF F1 CF D0
: 28 A4 19 B0 02 FD A1 B6 17 CB A6 1D 2E 91 CF E8
: FF FB CB 8F FD 4D 5F 6A D8 B1 58 C2 19 E3 6D C5
: 14 05 DC 0C 0B 23 49 79 AC 65 8E 72 BD DF 1B 67
: 73 B9 6B 2A E3 E4 D0 7B E8 60 48 04 0C 01 67 43
: 6F A8 39 E7 52 9B 00 CC 9A B5 5A 2F 25 DB 63 CC
: 9F 55 75 94 E6 91 C1 1E 55 3D 4A 3E BC 76 0F 5F
: 19 E5 FE 14 48 38 B4 C7 D1 59 1D A9 B5 D4 67 49
: 4F D9 CA C5 2C C5 50 40 60 39 9D BD B7 22 98 EB
: 9A 4C 01 7B 00 78 6F DC 7D 9D 7A A5 7A DB B8 B6
: 1C 34 DE 1E 28 8B 2A B7 28 17 1D CE 14 3C D1 69
: 53 F9 84 C1 AE D5 59 E5 6B AA 0C E6 58 D3 2C CE
: 42 F4 40 75 04 CD 7A 57 9A D0 EF 9B 77 13 5E AA
: 39 B6 F9 3A 3A 2E 59 97 80 7F 06 36 1C 83 F4 E6
: 7F 8E 3F 9C F6 83 16 01 15 14 F5 D8 5A 18 1C EA
: D7 14 CD 49 40 E4 EB AC 01 D6 65 28 DA 32 F8 9C
: EA 04 28 E8 EB CA DC F8 AA 18 8C 9F 62 E8 5B 19
: 57 65 5B 7F E2 B8 D7 97 3B 7A 72 26 B6 6D 93 BF
: 7B 23 2F 3D CF 65 3C 84 B4 EC F1 A9 92 0D B1 94
: 9A D7 50 B5 46 A5 55 2A 20 E5 49 09 71 9B 8C 0C
: 07 05 6F CB 7E 57 4A D2 A3 2E C9 50 01 DD E8 44
: 81 BE 77 D0 39 ED 5B F7 42 62 EC F3 98 1F 1B 00
: D3 36 6A 9C 2E 06 1C 47 E2 41 A0 61 C6 24 95 60
: D2 B8 44 6A 48 0C 38 C2 8B A9 89 D9 F6 8A DC 4B
: BA F2 A2 0B 47 E4 92 31 28 C7 23 42 D5 97 FD A2
: 59 DE 0B 83 C2 05 6D 6B 77 E7 99 B3 19 32 4A A5
: 0B 1D 65 9C 2A 56 02 9B 74 53 C5 F3 BA 52 43 D9
: FA 74 9D 91 7C 40 D9 D1 01 E4 53 BC 8B 10 E4 2A
: 7C 08 93 23 C0 26 F7 83 E1 00 B9 FA 6E 70 14 42
: 4D A6 FA 37 92 BC 95 7E E8 21 9D 01 6B 77 3F 28
: FE DC C9 62 A4 85 AB AF FE C0 23 28 19 71 E2 9A
: A6 89 83 9E CF D2 61 9E 92 28 7C D2 30 DB 26 A2
: 50 7C C5 00 EB 1C 7A 52 93 B5 FE 91 7A E2 9B F1
: AD 35 01 24 F8 A3 11 63 52 14 B4 11 DB 9F 67 D3
: B8 5B D7 15 01 85 37 EA 45 B4 1F 41 B4 C6 60 51
863 13: SEQUENCE {
865 11: OBJECT IDENTIFIER
: hkdfWithSha256 (1 2 840 113549 1 9 16 3 28)
: }
878 1: INTEGER 16
881 11: SEQUENCE {
883 9: OBJECT IDENTIFIER
: aes128-wrap (2 16 840 1 101 3 4 1 5)
: }
894 24: OCTET STRING
: C0 50 E4 39 2F 9C 14 DD 0A C2 22 02 03 F3 17 D7
: 01 F9 4F 9D D9 27 78 F5
: }
: }
: }
920 58: SEQUENCE {
922 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
933 30: SEQUENCE {
935 9: OBJECT IDENTIFIER
: aes128-GCM (2 16 840 1 101 3 4 1 6)
946 17: SEQUENCE {
948 12: OCTET STRING 5C A5 74 68 B8 1B F0 3B 8D A7 18 6C
962 1: INTEGER 16
: }
: }
965 13: [0] 94 C8 68 9A 99 D2 C3 8E 19 2F A6 BA 08
: }
980 16: OCTET STRING
: 5C F1 78 6C 57 C7 40 2B 54 FC 93 C3 0A 4A 45 33
: }
: }
: }
C.2. Recipient CMS Processing
Bob's ML-KEM-512 private key:
-----BEGIN PRIVATE KEY-----
MFQCAQAwCwYJYIZIAWUDBAQBBEKAQAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZ
GhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj8=
-----END PRIVATE KEY-----
Bob decapsulates the ciphertext in the KEMRecipientInfo to get the
ML-KEM-512 shared secret, encodes the CMSORIforKEMOtherInfo, derives
the key-encryption key from the shared secret and the DER-encoded
CMSORIforKEMOtherInfo using HKDF with SHA-256, uses AES-128-KEYWRAP
to decrypt the content-encryption key with the key-encryption key,
and decrypts the encrypted contents with the content-encryption key,
revealing the plaintext content:
Hello, world!