modularot 0.1.0__py3-none-any.whl

modularot/custom_kems/ggh_fo/ggh_fo.py

@@ -0,0 +1,280 @@
+import functools
+import hashlib
+import math
+import secrets
+import struct
+from typing import Dict, List, Optional, Tuple
+
+from flint import fmpz_mat, fmpq_mat
+
+from GGH_crypto import GGHHNFCryptosystem
+
+
+# ── domain-separation tags ────────────────────────────────────────────────────
+
+_TAG_KEY    = b"GGH-HNF-FO-KEY-V1\x00"
+_TAG_REJECT = b"GGH-HNF-FO-REJECT-V1\x00"
+
+_R_ENTRY = 8    # bytes per private-basis entry (|R[i,j]| << 2^63)
+_MAX_TRIES = 25
+
+
+# ── public parameters (functions of n only) ───────────────────────────────────
+
+def sigma_e(n: int) -> int:
+    """Public error magnitude; key-independent so nothing leaks about R."""
+    return max(1, n // 2)
+
+
+def keygen_k(n: int) -> int:
+    """The library's GGH_private=True diagonal shift k = n*ceil(sqrt(n)+1)."""
+    return n * math.ceil(math.sqrt(n) + 1)
+
+
+# ── serialisation ─────────────────────────────────────────────────────────────
+
+def _entry_width(d: int) -> int:
+    """Fixed byte width for values in [0, d), d > 1."""
+    return ((d - 1).bit_length() + 7) // 8
+
+
+def _ser_pk(n: int, diag: List[int], cols: Dict[int, List[int]]) -> bytes:
+    out = bytearray(struct.pack(">i", n))
+    for d in diag:
+        db = d.to_bytes((d.bit_length() + 7) // 8 or 1, "big")
+        out += struct.pack(">H", len(db)) + db
+    for i in range(n):
+        if diag[i] > 1:
+            w = _entry_width(diag[i])
+            for v in cols[i]:
+                out += v.to_bytes(w, "big")
+    return bytes(out)
+
+
+def _des_pk(buf: bytes) -> Tuple[int, List[int], Dict[int, List[int]], int]:
+    """Parse a serialised pk (or the pk prefix of an sk).
+    Returns (n, diag, cols, total_pk_length)."""
+    (n,) = struct.unpack_from(">i", buf, 0)
+    if not 1 <= n <= 1 << 20:
+        raise ValueError("GGH-HNF pk: implausible dimension")
+    off = 4
+    diag = []
+    for _ in range(n):
+        (ln,) = struct.unpack_from(">H", buf, off)
+        off += 2
+        diag.append(int.from_bytes(buf[off:off + ln], "big"))
+        off += ln
+    cols: Dict[int, List[int]] = {}
+    for i in range(n):
+        if diag[i] > 1:
+            w = _entry_width(diag[i])
+            col = []
+            for _ in range(i):
+                col.append(int.from_bytes(buf[off:off + w], "big"))
+                off += w
+            cols[i] = col
+    return n, diag, cols, off
+
+
+def _ct_len(n: int, diag: List[int]) -> int:
+    return sum(_entry_width(diag[i]) for i in range(n) if diag[i] > 1)
+
+
+def _ser_ct(c: List[int], n: int, diag: List[int]) -> bytes:
+    out = bytearray()
+    for i in range(n):
+        if diag[i] > 1:
+            out += c[i].to_bytes(_entry_width(diag[i]), "big")
+    return bytes(out)
+
+
+def _des_ct(ct: bytes, n: int, diag: List[int]) -> Optional[List[int]]:
+    if len(ct) != _ct_len(n, diag):
+        return None
+    c, off = [], 0
+    for i in range(n):
+        if diag[i] > 1:
+            w = _entry_width(diag[i])
+            v = int.from_bytes(ct[off:off + w], "big")
+            if v >= diag[i]:
+                return None      # outside the fundamental region: malformed
+            c.append(v)
+            off += w
+        else:
+            c.append(0)
+    return c
+
+
+def _ser_R(R: fmpz_mat, n: int) -> bytes:
+    return b"".join(int(R[i, j]).to_bytes(_R_ENTRY, "big", signed=True)
+                    for i in range(n) for j in range(n))
+
+
+def _des_R(buf: bytes, off: int, n: int) -> fmpz_mat:
+    return fmpz_mat([
+        [int.from_bytes(buf[off + (i * n + j) * _R_ENTRY:
+                             off + (i * n + j + 1) * _R_ENTRY], "big", signed=True)
+         for j in range(n)]
+        for i in range(n)
+    ])
+
+
+def _hnf_to_diag_cols(H: fmpz_mat, n: int) -> Tuple[List[int], Dict[int, List[int]]]:
+    diag = [int(H[i, i]) for i in range(n)]
+    cols = {i: [int(H[k, i]) for k in range(i)] for i in range(n) if diag[i] > 1}
+    return diag, cols
+
+
+# ── HNF arithmetic ────────────────────────────────────────────────────────────
+
+def _reduce_mod_hnf(e: List[int], n: int, diag: List[int],
+                    cols: Dict[int, List[int]]) -> List[int]:
+    """Reduce a vector into the fundamental region of an upper-triangular HNF
+    (flint's form): ascending sweep c -= floor(c_i / d_i) * row_i. The
+    library's reduce_mod_B assumes a lower-triangular HNF, hence this copy.
+    Result: c_i in [0, d_i), so c_i = 0 wherever d_i = 1."""
+    c = list(e)
+    dense = [i for i in range(n) if diag[i] > 1]
+    for i in range(n):
+        q = c[i] // diag[i]
+        if q:
+            c[i] -= q * diag[i]
+            for j in dense:
+                if j > i:
+                    c[j] -= q * cols[j][i]
+    return c
+
+
+def _sigma_ok(R: fmpz_mat, n: int) -> bool:
+    """Zero-failure condition for Babai rounding: for every j,
+    2*sigma_e * sum_i |R^-1[i,j]| < 1 (column L1, as e is a row vector)."""
+    s = sigma_e(n)
+    Rinv = fmpq_mat(R).inv()
+    for j in range(n):
+        col = sum(abs(Rinv[i, j]) for i in range(n))
+        if 2 * s * col >= 1:
+            return False
+    return True
+
+
+# ── cryptographic helpers ─────────────────────────────────────────────────────
+
+def _pack_signs(e: List[int]) -> bytes:
+    """Pack sign(e_i) as bit i (LSB-first within each byte): the KEM coin m."""
+    out = bytearray((len(e) + 7) // 8)
+    for i, v in enumerate(e):
+        if v > 0:
+            out[i // 8] |= 1 << (i % 8)
+    return bytes(out)
+
+
+def _h_key(m_bytes: bytes, ct: bytes) -> bytes:
+    return hashlib.sha3_256(_TAG_KEY + m_bytes + ct).digest()
+
+
+def _h_reject(reject_key: bytes, ct: bytes) -> bytes:
+    return hashlib.sha3_256(_TAG_REJECT + reject_key + ct).digest()
+
+
+# ── oblivious-sampling support ────────────────────────────────────────────────
+
+def draw_lattice_diag(n: int, randint=None) -> List[int]:
+    """One accepted keygen draw, returning only diag(HNF(R)). Follows the
+    GGH_private=True law plus gen()'s rejection rules, so det and cokernel match
+    keygen exactly; R itself is discarded and unrelated to the published key.
+    `randint(a, b)` defaults to the crypto RNG."""
+    if randint is None:
+        rng = secrets.SystemRandom()
+        randint = rng.randint
+    k = keygen_k(n)
+    for _ in range(_MAX_TRIES):
+        R = fmpz_mat([[randint(-n, n - 1) for _ in range(n)] for _ in range(n)])
+        for i in range(n):
+            R[i, i] = int(R[i, i]) + k
+        if R.det() == 0 or not _sigma_ok(R, n):
+            continue
+        H = R.hnf()
+        diag = [int(H[i, i]) for i in range(n)]
+        if all(d == 1 for d in diag):
+            continue  # same rejection rule as gen()
+        return diag
+    raise ValueError(f"no accepted GGH-HNF draw in {_MAX_TRIES} tries (n={n} too small?)")
+
+
+# ── KEM primitives ────────────────────────────────────────────────────────────
+
+def gen(dimension: int = 200) -> Tuple[bytes, bytes]:
+    """Generate (pk, sk) via GGH_private=True keygen, rejecting bases that fail
+    the sigma bound."""
+    n = dimension
+    for _ in range(_MAX_TRIES):
+        ggh = GGHHNFCryptosystem(dimension=n, GGH_private=True)
+        R = ggh.private_basis
+        if not _sigma_ok(R, n):
+            continue
+        H = ggh.public_basis  # already R.hnf()
+        diag, cols = _hnf_to_diag_cols(H, n)
+        if all(d == 1 for d in diag):
+            continue  # det = +-1: nothing to hide in
+        pk = _ser_pk(n, diag, cols)
+        sk = pk + _ser_R(R, n) + secrets.token_bytes(32)
+        return pk, sk
+    raise ValueError(
+        f"no sigma-accepted GGH-HNF key in {_MAX_TRIES} tries; "
+        f"increase the dimension (sigma_max ~ 0.7*n must exceed n//2)."
+    )
+
+
+def encaps(pk: bytes) -> Tuple[bytes, bytes]:
+    """Return (shared_secret, ciphertext)."""
+    n, diag, cols, _ = _des_pk(pk)
+    s = sigma_e(n)
+
+    raw = secrets.token_bytes((n + 7) // 8)
+    e = [s if (raw[i // 8] >> (i % 8)) & 1 else -s for i in range(n)]
+
+    c = _reduce_mod_hnf(e, n, diag, cols)
+    ct = _ser_ct(c, n, diag)
+    return _h_key(_pack_signs(e), ct), ct
+
+
+@functools.lru_cache(maxsize=16)
+def _load_sk(sk: bytes) -> Tuple[int, List[int], Dict[int, List[int]],
+                                 fmpz_mat, bytes]:
+    """Parse an sk into (n, diag, cols, R, reject_key) (memoised)."""
+    n, diag, cols, pk_len = _des_pk(sk)
+    R = _des_R(sk, pk_len, n)
+    reject_key = sk[pk_len + n * n * _R_ENTRY: pk_len + n * n * _R_ENTRY + 32]
+    return n, diag, cols, R, reject_key
+
+
+def decaps(sk: bytes, ct: bytes) -> bytes:
+    """Return shared_secret (or the implicit-rejection value on failure)."""
+    n, diag, cols, R, reject_key = _load_sk(sk)
+    s = sigma_e(n)
+
+    c = _des_ct(ct, n, diag)
+    if c is None:
+        return _h_reject(reject_key, ct)
+
+    # Babai rounding: solve x R = c (cheaper than forming R^-1), then
+    # e = c - round(x) R
+    try:
+        xt = fmpq_mat(R).transpose().solve(fmpq_mat(n, 1, [int(v) for v in c]))
+        rounded = fmpz_mat([[round(xt[j, 0]) for j in range(n)]])
+        closest = rounded * R
+        e = [c[j] - int(closest[0, j]) for j in range(n)]
+    except Exception:
+        return _h_reject(reject_key, ct)
+
+    # FO re-encryption check; accumulate both conditions before branching
+    valid = 0
+    for v in e:
+        valid |= (abs(v) != s)
+    c2 = _reduce_mod_hnf(e, n, diag, cols)
+    for a, b in zip(c, c2):
+        valid |= (a != b)
+
+    if valid == 0:
+        return _h_key(_pack_signs(e), ct)
+    return _h_reject(reject_key, ct)

modularot/custom_kems/ntru_fo/ntru_fo.py

@@ -0,0 +1,347 @@
+import numpy as np
+import logging
+import hashlib
+import secrets
+import hmac
+from typing import Tuple, Optional, List
+from flint import nmod_poly, fmpz_poly
+import os
+import sys
+import math
+import time
+
+log = logging.getLogger("ntru_fo")
+
+
+def center_lift(poly, modulus):
+    """Center lift coefficients to range [-(q-1)/2, (q-1)/2]."""
+    half_mod = modulus // 2
+    coeffs = poly.coeffs()
+    centered = [((int(c) + half_mod) % modulus) - half_mod for c in coeffs]
+    return fmpz_poly(centered)
+
+def poly_mod_coeffs(poly, modulus):
+    """Reduce polynomial coefficients modulo 'modulus'."""
+    coeffs = [int(c) % modulus for c in poly.coeffs()]
+    return fmpz_poly(coeffs)
+
+
+def is_prime(n):
+    if n < 2:
+        return False
+    for i in range(2, int(n ** 0.5) + 1):
+        if n % i == 0:
+            return False
+    return True
+
+
+def is_2_power(n):
+    return n != 0 and (n & (n - 1)) == 0
+
+
+def random_poly_flint(length, d, neg_ones_diff=0):
+    coeffs = np.random.permutation(
+        np.concatenate((
+            np.zeros(length - 2 * d - neg_ones_diff),
+            np.ones(d),
+            -np.ones(d + neg_ones_diff)
+        ))
+    )
+    return fmpz_poly([int(x) for x in coeffs])
+
+
+def invert_nmod_poly(f, R, p):
+    """Inverse of f mod R over Z/pZ (p prime) via xgcd: s*f + t*R = g, so
+    f^-1 = g^-1 * s. Raises if f is not invertible."""
+    g, s, _ = f.xgcd(R)
+
+    # f is invertible mod R iff gcd(f, R) is a nonzero constant.
+    if g.degree() != 0:
+        raise Exception("Polynomial is not invertible")
+    const = int(g.coeffs()[0]) if g.length() > 0 else 0
+    if const % p == 0:
+        raise Exception("Polynomial is not invertible")
+
+    # xgcd does not force g monic; invert g by Fermat
+    const_inv = pow(const % p, p - 2, p)
+    return (s * nmod_poly([const_inv], p)) % R
+
+
+def invert_poly_flint(f_poly, R_poly, p):
+    """Inverse of f_poly mod R_poly (x^N - 1) over Z_p, p prime or a power of 2."""
+
+    if is_prime(p):
+        log.debug(f"Inverting mod prime p={p}")
+
+        f_mod = nmod_poly(f_poly.coeffs(), p)
+        R_mod = nmod_poly(R_poly.coeffs(), p)
+
+        inv = invert_nmod_poly(f_mod, R_mod, p)
+
+        return fmpz_poly([int(c) for c in inv.coeffs()])
+
+    elif is_2_power(p):
+        log.debug(f"Inverting mod 2-power p={p}")
+
+        e = p.bit_length() - 1  # p = 2^e
+
+        # seed: inverse mod 2
+        f_mod2 = nmod_poly(f_poly.coeffs(), 2)
+        R_mod2 = nmod_poly(R_poly.coeffs(), 2)
+        inv = invert_nmod_poly(f_mod2, R_mod2, 2)
+
+        # Newton lift: inv' = inv*(2 - f*inv) mod R doubles the precision each step
+        f_mod = nmod_poly([int(c) for c in f_poly.coeffs()], p)
+        R_mod = nmod_poly([int(c) for c in R_poly.coeffs()], p)
+        inv = nmod_poly([int(c) for c in inv.coeffs()], p)
+        two = nmod_poly([2], p)
+
+        prec = 1
+        while prec < e:
+            inv = (inv * (two - (f_mod * inv) % R_mod)) % R_mod
+            prec *= 2
+
+        return fmpz_poly([int(c) for c in inv.coeffs()])
+
+    else:
+        raise Exception(f"Cannot invert polynomial in Z_{p}")
+
+
+class NTRU_FO:
+    """
+    Stable NTRU-FO-CCA2 KEM (research-grade).
+
+    Fixes:
+    - Proper invertibility rejection loop
+    - Canonical polynomial ordering (no reversals)
+    - SHAKE-based deterministic randomness
+    - Implicit rejection
+    """
+
+    TAG_RANDOMNESS = b"NTRU-FO-RAND-V1"
+    TAG_SESSION_KEY = b"NTRU-FO-KEY-V1"
+    TAG_MESSAGE = b"NTRU-FO-MSG-V1"
+    TAG_IMPLICIT_REJECT = b"NTRU-FO-REJECT-V1"
+
+    def __init__(self, N: int = 701, p: int = 3, q: int = 8192):
+        self.N = N
+        self.p = p
+        self.q = q
+        self.sigma_bytes = 32
+
+        coeffs = [0] * (N + 1)
+        coeffs[0] = -1
+        coeffs[N] = 1
+        self.R_poly = fmpz_poly(coeffs)
+
+        self.f_poly = None
+        self.f_p_poly = None
+        self.f_q_poly = None
+        self.g_poly = None
+        self.h_poly = None
+        # placeholder until generate_keys(); keeps decapsulate() from crashing keyless
+        self._implicit_reject_key = secrets.token_bytes(32)
+
+        logging.info(f"NTRU-FO initialized (N={N}, p={p}, q={q})")
+
+    # ============================================================
+    # KEY GENERATION (FIXED)
+    # ============================================================
+
+    def generate_keys(self) -> Tuple[fmpz_poly, fmpz_poly]:
+        logging.info("Generating keys...")
+        start = time.perf_counter()
+
+        while True:
+            try:
+                self.g_poly = random_poly_flint(self.N, self.N // 4)
+                self.f_poly = random_poly_flint(
+                    self.N, self.N // 3, neg_ones_diff=-1
+                )
+
+                self.f_p_poly = invert_poly_flint(
+                    self.f_poly, self.R_poly, self.p
+                )
+                self.f_q_poly = invert_poly_flint(
+                    self.f_poly, self.R_poly, self.q
+                )
+
+                if self.f_p_poly is None or self.f_q_poly is None:
+                    continue
+
+                # Verify inversion correctness
+                test_p = poly_mod_coeffs(
+                    (self.f_poly * self.f_p_poly) % self.R_poly,
+                    self.p,
+                )
+                test_q = poly_mod_coeffs(
+                    (self.f_poly * self.f_q_poly) % self.R_poly,
+                    self.q,
+                )
+
+                if list(test_p.coeffs())[:1] != [1]:
+                    continue
+                if list(test_q.coeffs())[:1] != [1]:
+                    continue
+
+                break
+
+            except Exception:
+                continue
+
+        p_f_q = poly_mod_coeffs(self.p * self.f_q_poly, self.q)
+        h_tmp = poly_mod_coeffs(p_f_q * self.g_poly, self.q)
+        self.h_poly = poly_mod_coeffs(h_tmp % self.R_poly, self.q)
+
+        self._implicit_reject_key = self._derive_reject_key()
+
+        logging.info(f"Keygen done in {time.perf_counter() - start:.4f}s")
+        return self._poly_to_bytes(self.h_poly), b""  # sk stays internal
+
+    # ============================================================
+    # ENCAPSULATION
+    # ============================================================
+
+    def encapsulate(self, public_key=None):
+        if public_key is None:
+            public_key = self.h_poly
+        elif isinstance(public_key, bytes):
+            public_key = self._bytes_to_poly(public_key)
+
+        message = np.array(
+            [secrets.randbelow(self.p) for _ in range(self.N)]
+        )
+
+        sigma = secrets.token_bytes(self.sigma_bytes)
+        m_bytes = self._encode_message(message)
+
+        r_poly = self._hash_to_randomness(m_bytes, sigma)
+
+        msg_poly = fmpz_poly([int(c) for c in message])
+
+        c_poly = poly_mod_coeffs(
+            (poly_mod_coeffs(r_poly * public_key, self.q) + msg_poly)
+            % self.R_poly,
+            self.q,
+        )
+
+        c_bytes = self._poly_to_bytes(c_poly)
+        ciphertext = c_bytes + sigma
+
+        session_key = self._hash_h(m_bytes, ciphertext)
+        return session_key, ciphertext  # (shared_secret, ciphertext)
+
+    # ============================================================
+    # DECAPSULATION
+    # ============================================================
+
+    def decapsulate(self, sk, ciphertext: bytes) -> bytes:
+        c_len = self.N * 4
+        if len(ciphertext) != c_len + self.sigma_bytes:
+            return self._implicit_rejection(ciphertext)
+
+        c_bytes = ciphertext[:c_len]
+        sigma = ciphertext[c_len:]
+
+        try:
+            c_poly = self._bytes_to_poly(c_bytes)
+        except Exception:
+            return self._implicit_rejection(ciphertext)
+
+        try:
+            decrypted = self._decrypt(c_poly)
+        except Exception:
+            return self._implicit_rejection(ciphertext)
+
+        message = np.array(decrypted[: self.N])
+        m_bytes = self._encode_message(message)
+
+        r_prime = self._hash_to_randomness(m_bytes, sigma)
+
+        msg_poly = fmpz_poly([int(c) for c in message])
+
+        c_prime = poly_mod_coeffs(
+            (poly_mod_coeffs(r_prime * self.h_poly, self.q) + msg_poly)
+            % self.R_poly,
+            self.q,
+        )
+
+        c_prime_bytes = self._poly_to_bytes(c_prime)
+
+        if hmac.compare_digest(c_bytes, c_prime_bytes):
+            return self._hash_h(m_bytes, ciphertext)
+        else:
+            return self._implicit_rejection(ciphertext)
+
+    # ============================================================
+    # INTERNALS
+    # ============================================================
+
+    def _decrypt(self, ciphertext_poly: fmpz_poly) -> List[int]:
+        a = poly_mod_coeffs(self.f_poly * ciphertext_poly, self.q)
+        a = poly_mod_coeffs(a % self.R_poly, self.q)
+        a = center_lift(a, self.q)
+        b = poly_mod_coeffs(a, self.p)
+
+        result = poly_mod_coeffs(
+            (self.f_p_poly * b) % self.R_poly, self.p
+        )
+
+        # .coeffs() drops trailing zeros; pad to N so m_bytes stays canonical
+        coeffs = list(result.coeffs())
+        return [int(coeffs[i]) if i < len(coeffs) else 0 for i in range(self.N)]
+
+    def _hash_to_randomness(self, m_bytes: bytes, sigma: bytes):
+        # digest(n) returns a prefix of the XOF stream, so longer draws stay
+        # deterministic (the re-encryption check in decapsulate() needs this)
+        shake = hashlib.shake_256()
+        shake.update(self.TAG_RANDOMNESS + m_bytes + sigma)
+
+        take = self.N * 2
+        while True:
+            buf = shake.digest(take)
+            coeffs = []
+            for b in buf:
+                if b >= 255:  # reject 255 so 0..254 maps to {0,1,2} unbiased
+                    continue
+                v = b % 3
+                coeffs.append(0 if v == 0 else (1 if v == 1 else -1))
+                if len(coeffs) == self.N:
+                    return fmpz_poly(coeffs)
+            take *= 2  # practically unreachable
+
+    def _encode_message(self, message: np.ndarray) -> bytes:
+        out = bytearray(self.TAG_MESSAGE)
+        for c in message:
+            out.extend(int(c % self.p).to_bytes(2, "big"))
+        return bytes(out)
+
+    def _hash_h(self, m_bytes: bytes, data: bytes) -> bytes:
+        return hashlib.sha3_256(self.TAG_SESSION_KEY + m_bytes + data).digest()
+
+    def _derive_reject_key(self) -> bytes:
+        return hashlib.sha3_256(
+            self.TAG_IMPLICIT_REJECT + self._poly_to_bytes(self.f_poly)
+        ).digest()
+
+    def _implicit_rejection(self, ciphertext: bytes) -> bytes:
+        return hashlib.sha3_256(
+            self._implicit_reject_key + ciphertext
+        ).digest()
+
+    def _poly_to_bytes(self, poly: fmpz_poly) -> bytes:
+        coeffs = list(poly.coeffs())
+        out = bytearray()
+        for i in range(self.N):
+            c = int(coeffs[i]) if i < len(coeffs) else 0
+            out.extend((c % self.q).to_bytes(4, "big"))
+        return bytes(out)
+
+    def _bytes_to_poly(self, data: bytes) -> fmpz_poly:
+        if len(data) != self.N * 4:
+            raise ValueError("Invalid polynomial encoding")
+        coeffs = [
+            int.from_bytes(data[i:i + 4], "big") % self.q
+            for i in range(0, len(data), 4)
+        ]
+        return fmpz_poly(coeffs)

modularot/kem_adapter/adapter.py

@@ -0,0 +1,58 @@
+from abc import ABC, abstractmethod
+from dataclasses import dataclass
+from typing import Tuple
+
+
+@dataclass(frozen=True)
+class KEMInfo:
+    name: str
+    is_quantum_safe: bool
+    security_level: int   # classical security bits
+    pk_bytes: int
+    ct_bytes: int
+    ss_bytes: int
+
+
+class KEM(ABC):
+    """Abstract Key Encapsulation Mechanism interface."""
+
+    @property
+    @abstractmethod
+    def info(self) -> KEMInfo: ...
+
+    @abstractmethod
+    def generate_keypair(self) -> Tuple[bytes, bytes]:
+        """Return (public_key, secret_key)."""
+
+    @abstractmethod
+    def encapsulate(self, pk: bytes) -> Tuple[bytes, bytes]:
+        """Return (shared_secret, ciphertext)."""
+
+    @abstractmethod
+    def decapsulate(self, sk: bytes, ct: bytes) -> bytes:
+        """Return shared_secret."""
+
+
+class KEMAdapter(KEM):
+
+    def __init__(self, gen, encap, decap, info: KEMInfo = None):
+        self._gen   = gen
+        self._encap = encap
+        self._decap = decap
+        self._info  = info or KEMInfo("generic", False, 0, 0, 0, 0)
+        self.Gen    = gen
+        self.encaps = encap
+        self.decaps = decap
+
+    @property
+    def info(self) -> KEMInfo:
+        return self._info
+
+    def generate_keypair(self) -> Tuple[bytes, bytes]:
+        return self._gen()
+
+    def encapsulate(self, pk: bytes) -> Tuple[bytes, bytes]:
+        return self._encap(pk)
+
+    def decapsulate(self, sk: bytes, ct: bytes) -> bytes:
+        return self._decap(sk, ct)