KEM (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.hpke

## Class KEM

- java.lang.Object
- - org.bouncycastle.crypto.hpke.KEM

-     public abstract class KEM
      extends java.lang.Object

  Abstract base for HPKE Key Encapsulation Mechanisms per RFC 9180 §4.

  Concrete subclass `DHKEM` implements the five DHKEM variants registered by RFC 9180 (P-256/P-384/P-521/X25519/X448). External implementations — e.g. post-quantum KEMs such as ML-KEM or the hybrid X25519+Kyber768 used by MLS — can be plugged in by subclassing this class and passing the instance to the `HPKE(mode, kemId, kdfId, aeadId, KEM, encSize)` constructor; the framework only requires:

  - `Encap` / `Decap` — the basic KEM encapsulate / decapsulate pair returning `[enc, sharedSecret]`.
  - `Encap(pkR, kpE)` — a sender-supplied-ephemeral variant used by the OHTTP test vectors and any deterministic KAT.
  - `AuthEncap` / `AuthDecap` — the authenticated variant used by `mode_auth` / `mode_auth_psk`.
  - `GeneratePrivateKey` / `DeriveKeyPair(ikm)` — fresh and deterministic key generation respectively.
  - `SerializePublicKey` / `DeserializePublicKey` / `SerializePrivateKey` / `DeserializePrivateKey` — the KEM-specific wire encoding.
  - `getEncryptionSize` — the byte-length of the `enc` output, used by the facade to allocate space.

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `KEM()`

  - ### Method Summary

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### KEM

          public KEM()