Note
某些信息与预发行产品有关，该产品在商业发布之前可能会进行大幅修改。 Microsoft对此处提供的信息不作任何明示或暗示的保证。 本主题中所述的功能在 Windows Insider Preview的预发行版本中提供。
The BCRYPT_MLKEM_KEY_BLOB structure is used as a header for an ML-KEM public key (byte-encoded encapsulation key) or private keyBLOB in memory.
Syntax
typedef struct _BCRYPT_MLKEM_KEY_BLOB {
ULONG dwMagic;
ULONG cbParameterSet; // Byte size of parameterSet[]
ULONG cbKey; // Byte size of key[]
// WCHAR parameterSet[cbParameterSet / sizeof(WCHAR)]; // Including \0-terminated
// BYTE key[cbKey]; // Key material
} BCRYPT_MLKEM_KEY_BLOB, *PBCRYPT_MLKEM_KEY_BLOB;
Fields
dwMagic
The dwMagic field is a 4-byte value that indicates the format of the key being used. 定义了以下值：
| Value | Meaning |
|---|---|
BCRYPT_MLKEM_PUBLIC_MAGIC0x504B4C4D |
结构表示公钥。 |
BCRYPT_MLKEM_PRIVATE_MAGIC0x524B4C4D |
结构表示扩展的私钥。 |
BCRYPT_MLKEM_PRIVATE_SEED_MAGIC0x534B4C4D |
结构表示私有种子。 |
cbParameterSet
The length, in bytes, of the buffer parameterSet directly following the struct. 此缓冲区包含一个以 null 结尾的 Unicode 字符串，用于标识密钥的参数集。 The following values (per FIPS 203) are currently supported:
| parameterSet | cbParameterSet | Meaning |
|---|---|---|
BCRYPT_MLKEM_PARAMETER_SET_512L"512" |
8 | ML-KEM-512，安全类别 1。 |
BCRYPT_MLKEM_PARAMETER_SET_768L"768" |
8 | ML-KEM-768，安全类别 3。 |
BCRYPT_MLKEM_PARAMETER_SET_1024L"1024" |
10 | ML-KEM-1024，安全类别 5。 |
cbKey
The length, in bytes, of the buffer key directly following parameterSet. 此大小是静态的，取决于所使用的密钥格式和参数集。
Remarks
BCRYPT_MLKEM_PRIVATE_SEED_BLOB supports import and export of ML-KEM seeds. The blob has dwMagic value BCRYPT_MLKEM_PRIVATE_SEED_MAGIC and the key field contains the KEM seed (defined as the 64-byte concatenation of d || z per FIPS 203), so cbKey is currently always 64.
BCRYPT_MLKEM_PRIVATE_BLOB (also aliased as BCRYPT_MLKEM_DECAPSULATION_BLOB) supports import and export of standard byte-encoded ML-KEM decapsulation keys per FIPS 203. The blob has dwMagic value BCRYPT_MLKEM_PRIVATE_MAGIC and the key field contains the byte-encoded key.
BCRYPT_MLKEM_PUBLIC_BLOB (also aliased as BCRYPT_MLKEM_ENCAPSULATION_BLOB) supports import and export of standard byte-encoded ML-KEM encapsulation keys per FIPS 203. The blob has dwMagic value BCRYPT_MLKEM_PUBLIC_MAGIC and the key field contains the byte-encoded key.
The byte sizes of the byte-encoded keys can be found in FIPS 203 Section 8 Table 3. Many callers can instead dynamically query the required blob sizes using BCryptExportKey with NULLpbOutput.
Requirements
| Requirement | Value |
|---|---|
| 最低支持的客户端 | Windows 预览体验成员（内部版本 27843）： 开始对 ML-KEM 的支持。 [仅限桌面应用] |
| 支持的最低服务器 | Windows 预览体验成员（内部版本 27843）： 开始对 ML-KEM 的支持。 [仅限桌面应用] |
| Header | bcrypt.h |