STDA060 October   2026 MSPM0G3519 , MSPM0G3519-Q1 , MSPM33C321A , MSPM33C321A-Q1

 

  1.   1
  2.   Abstract
  3.   Trademarks
  4. 1 Introduction
  5. 2 Security Goals in Embedded Systems
  6. 3 Cryptographic Primitives
  7. 4 The Potential Effects of CRQCs
  8. 5 New Algorithms and Standards for the Future
  9. 6 CNSA Compliance
  10. 7 Symmetric Encryption and Hash Functions
  11. 8 PQC Digital Signatures: ML-DSA
  12. 9 Is Hardware Acceleration Necessary?
  13. 10Is Pre-Hash Necessary?
  14. 11Other NIST-Selected PQC Digital Signature Schemes
  15. 12Stateful Digital Signature Schemes
  16. 13What About Key Agreement?
  17. 14Future-Proofing Embedded Systems
  18. 15References

13 What About Key Agreement?

Key agreement is a necessary step to establish a shared secret between two entities over an unsecure channel. Like digital signatures, key agreement algorithms relying on today's popular primitives such as finite-field Diffie-Hellman (FFDH) or elliptic curve Diffie-Hellman (ECDH) are also vulnerable to quantum based attacks using Shor's algorithm. To address this, NIST has standardized ML-KEM (the module lattice key encapsulation mechanism) in FIPS 203. ML-KEM is a post quantum secure key encapsulation mechanism (KEM) designed to be used in scenarios where FFDH or ECDH are used today.

Unlike Diffie-Hellman style designs that derive a shared secret from randomness on both sides of the handshake, a KEM has a key generation step, an encapsulation step, and a decapsulation step. In a client-server model, the process for key agreement with ML-KEM is as follows:

  1. A key pair is first generated by the server. The encapsulation (or "public") key is distributed to clients. The decapsulation (or "private") key is held back by the server.
  2. When a client wants to establish a secure channel with the server and agree on a symmetric key, it performs an ML-KEM encapsulation operation based on a random seed, out of which it obtains a ciphertext and the shared secret. It then sends the ciphertext to the server.
  3. The server receives the ciphertext and performs a decapsulation operation, giving the same shared secret as the client.
  4. The server and client may now communicate using the shared secret key.

ML-KEM can be performant in software, with encapsulation times as low as 7ms on a 160MHz Cortex-M33 MCU. Figure 13-1 compares the encapsulation performance for each security level on Arm Cortex-M0+ and Arm Cortex-M33 target MCUs.


ML-KEM Encapsulation Performance for TI MSPM0, MSPM33 Microcontrollers

Figure 13-1 ML-KEM Encapsulation Performance for TI MSPM0, MSPM33 Microcontrollers

ML-KEM has other desirable security properties beyond being designed to be quantum secure. Notably, it supports IND-CCA2 (indistinguishability under a chosen ciphertext attack). This means that even if an attacker can manipulate the ciphertext in transit from the client to the server (between encapsulation and decapsulation), the attacker would not gain an advantage or additional knowledge because the output of decapsulation is always indistinguishable from random. Additionally, the output of ML-KEM is usable directly as a symmetric encryption key, bringing simplicity to embedded applications and potentially removing the need for extra key derivation steps.