In ML-KEM decapsulation, the ciphertext is rebuilt from the result of decrypting the received ciphertext with the private key and compared with the received ciphertext. Which is a correct implementation precaution for this part?

Answer: C. The comparison takes the same time regardless of secrets, and on a mismatch no error is returned; an unrelated key derived from a secret value is returned instead, so the cases cannot be told apart

The step of comparing with the rebuilt ciphertext exists to stop attacks that send crafted ciphertexts and watch the reaction (chosen-ciphertext attacks). If match or mismatch leaks through the timing of the comparison or through an error signalling a mismatch, that itself becomes a clue for an attack, and the private key may be inferred bit by bit. FIPS 203 therefore specifies that on a mismatch no error is returned and a different key derived from a secret value and the ciphertext is returned instead (implicit rejection), and implementations perform the comparison and the selection of the result in constant time. Even if a scheme resists quantum computers, its security is lost if secrets leak through implementation timing or power, and around 2024 an implementation problem in which the time of a division depended on secrets (KyberSlash) was also reported.

• A. Detailed errors and early termination give outsiders clues about whether the values matched.
• B. The mathematical strength of a scheme and the information leaking from an implementation are separate issues.
• C. Correct. Whether the values matched is revealed neither by timing nor by an error.