Key Encapsulation Mechanism API

Java 21 Course · lesson 12 of 15 · 3 min read

A standard API for the key exchange that post-quantum cryptography depends on.

Open this lesson in the learning hub

Key points

  • A KEM lets two parties agree a shared secret using only the receiver's public key.
  • It is the building block most post-quantum algorithms use instead of classic Diffie-Hellman.
  • JEP 452 finalised javax.crypto.KEM in 21, so providers expose it through one interface.
  • The flow is: encapsulate with the public key, send the ciphertext, decapsulate with the private key.
  • You rarely call it directly - it matters because TLS libraries need a standard place to plug algorithms in.

The KEM API is plumbing for post-quantum TLS - standardised in 21 so libraries stopped inventing their own.

Unnamed patterns and variables (preview) What 21 deprecated and restricted

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the Java 21 Course course, and every lesson in it is listed on the Java 21 Course contents page.