[This feature is a licensed version feature]

If you need a license, you can obtain a 30-day license from the Program Key Issuance page. This feature can be tested with BerEditor version 2.5.0 or later.

Let’s use the BerEditor tool to generate a ML-KEM key pair and encrypt/decrypt a symmetric key using the PQC algorithm. The execution environment for this example is set to English. If the language is Korean, the message will be displayed in Korean.

In this example, the execution environment is set to English. If the language is Korean, the message will be displayed in Korean.

Generating an ML-KEM Key Pair

First, to create an electronic signature, you must create an ML-KEM key pair. To create a key pair, run BerEditor -> Service -> KeyPair Manager. Select Gen KeyPair in KeyPair Manager.

In the KeyPair window, enter the key pair name, select ML KEM in the PQC section, and select one of the three (KEM_512, KEM_768, KEM_1024) for KeyLength.

Once the key pair is created, you can check the key pair with the name you entered in KeyPair Manager. To view the detailed key value, double-click the key to view the key value.

In fact, the key pair generated by KeyPair Manager is for testing purposes, so the private key is stored in PEM format as a pure value. KeyPair Manager should be considered for testing purposes rather than for safe storage.

ML-KEM Encapsulation

To encrypt a key with the generated ML-KEM key pair, select BerEditor->Cryptography->Key Manage. When the window opens, select the KEM tab. Then, click the Encapsulate radio button (selected by default). There’s no special input data; select the previously generated ML-KEM key from the KeyPair Manager (double-click). Selecting the key will display the Wrapped Key and the generated key value. Internally, the KeyPair Manager reads the public key and encrypts it.

Here, Wrapped Key is encrypted data, so this value is sent to the side with the private key, and the generated key value is a concept that you use.

ML-KEM Key Decapsulation

To decrypt a key using the generated ML-KEM key pair, select BerEditor->Cryptography->Key Management. In the opened window, open the KEM tab and click the Decapsulate radio button. Enter the Wrapped Key value in the input data field and click the Run button. The KeyPair Manager window will appear, allowing you to select the key to verify. Selecting the previously generated ML-KEM key in the KeyPair Manager will display the decrypted key. Internally, the KeyPair Manager reads the private key and decrypts it.

Conclusion

In the current PQC algorithm, in order for both sides to share a symmetric key, the ML-KEM key is used. At this time, the resulting 32-byte key is used to share the key with each other.