nodejs · nodejs-github-bot · Aug 16, 2025 · Aug 13, 2025
diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
@@ -11,6 +11,22 @@
 #include <cstring>
 #if OPENSSL_VERSION_MAJOR >= 3
 #include <openssl/provider.h>
+#endif
+#if OPENSSL_WITH_PQC
+struct PQCMapping {
+  const char* name;
+  int nid;
+};
+
+constexpr static PQCMapping pqc_mappings[] = {
+    {"ML-DSA-44", EVP_PKEY_ML_DSA_44},
+    {"ML-DSA-65", EVP_PKEY_ML_DSA_65},
+    {"ML-DSA-87", EVP_PKEY_ML_DSA_87},
+    {"ML-KEM-512", EVP_PKEY_ML_KEM_512},
+    {"ML-KEM-768", EVP_PKEY_ML_KEM_768},
+    {"ML-KEM-1024", EVP_PKEY_ML_KEM_1024},
+};
+
 #endif
 
 // EVP_PKEY_CTX_set_dsa_paramgen_q_bits was added in OpenSSL 1.1.1e.
@@ -1969,11 +1985,21 @@ int EVPKeyPointer::id(const EVP_PKEY* key) {
   if (key == nullptr) return 0;
   int type = EVP_PKEY_id(key);
 #if OPENSSL_WITH_PQC
+  // EVP_PKEY_id returns -1 when EVP_PKEY_* is only implemented in a provider
+  // which is the case for all post-quantum NIST algorithms
+  // one suggested way would be to use a chain of `EVP_PKEY_is_a`
   // https://github.com/openssl/openssl/issues/27738#issuecomment-3013215870
+  // or, this way there are less calls to the OpenSSL provider, just
+  // getting the name once
   if (type == -1) {
-    if (EVP_PKEY_is_a(key, "ML-DSA-44")) return EVP_PKEY_ML_DSA_44;
-    if (EVP_PKEY_is_a(key, "ML-DSA-65")) return EVP_PKEY_ML_DSA_65;
-    if (EVP_PKEY_is_a(key, "ML-DSA-87")) return EVP_PKEY_ML_DSA_87;
+    const char* type_name = EVP_PKEY_get0_type_name(key);
+    if (type_name == nullptr) return -1;
+
+    for (const auto& mapping : pqc_mappings) {
+      if (strcmp(type_name, mapping.name) == 0) {
+        return mapping.nid;
+      }
+    }
   }
 #endif
   return type;

diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
@@ -31,6 +31,9 @@
 // Define OPENSSL_WITH_PQC for post-quantum cryptography support
 #if OPENSSL_VERSION_NUMBER >= 0x30500000L
 #define OPENSSL_WITH_PQC 1
+#define EVP_PKEY_ML_KEM_512 NID_ML_KEM_512
+#define EVP_PKEY_ML_KEM_768 NID_ML_KEM_768
+#define EVP_PKEY_ML_KEM_1024 NID_ML_KEM_1024
 #include <openssl/core_names.h>
 #endif
 

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
@@ -2024,6 +2024,9 @@ Other key details might be exposed via this API using additional attributes.
 <!-- YAML
 added: v11.6.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/59461
+    description: Add support for ML-KEM keys.
   - version: v24.6.0
     pr-url: https://github.com/nodejs/node/pull/59259
     description: Add support for ML-DSA keys.
@@ -2064,6 +2067,9 @@ types are:
 * `'ml-dsa-44'`[^openssl35] (OID 2.16.840.1.101.3.4.3.17)
 * `'ml-dsa-65'`[^openssl35] (OID 2.16.840.1.101.3.4.3.18)
 * `'ml-dsa-87'`[^openssl35] (OID 2.16.840.1.101.3.4.3.19)
+* `'ml-kem-512'`[^openssl35] (OID 2.16.840.1.101.3.4.4.1)
+* `'ml-kem-768'`[^openssl35] (OID 2.16.840.1.101.3.4.4.2)
+* `'ml-kem-1024'`[^openssl35] (OID 2.16.840.1.101.3.4.4.3)
 
 This property is `undefined` for unrecognized `KeyObject` types and symmetric
 keys.
@@ -3663,6 +3669,9 @@ underlying hash function. See [`crypto.createHmac()`][] for more information.
 <!-- YAML
 added: v10.12.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/59461
+    description: Add support for ML-KEM key pairs.
   - version: v24.6.0
     pr-url: https://github.com/nodejs/node/pull/59259
     description: Add support for ML-DSA key pairs.
@@ -3786,6 +3795,9 @@ a `Promise` for an `Object` with `publicKey` and `privateKey` properties.
 <!-- YAML
 added: v10.12.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/59461
+    description: Add support for ML-KEM key pairs.
   - version: v24.6.0
     pr-url: https://github.com/nodejs/node/pull/59259
     description: Add support for ML-DSA key pairs.

diff --git a/lib/internal/crypto/keygen.js b/lib/internal/crypto/keygen.js
@@ -22,6 +22,9 @@ const {
   EVP_PKEY_ML_DSA_44,
   EVP_PKEY_ML_DSA_65,
   EVP_PKEY_ML_DSA_87,
+  EVP_PKEY_ML_KEM_1024,
+  EVP_PKEY_ML_KEM_512,
+  EVP_PKEY_ML_KEM_768,
   EVP_PKEY_X25519,
   EVP_PKEY_X448,
   OPENSSL_EC_NAMED_CURVE,
@@ -173,6 +176,9 @@ const ids = {
   'ml-dsa-44': EVP_PKEY_ML_DSA_44,
   'ml-dsa-65': EVP_PKEY_ML_DSA_65,
   'ml-dsa-87': EVP_PKEY_ML_DSA_87,
+  'ml-kem-512': EVP_PKEY_ML_KEM_512,
+  'ml-kem-768': EVP_PKEY_ML_KEM_768,
+  'ml-kem-1024': EVP_PKEY_ML_KEM_1024,
 };
 
 function createJob(mode, type, options) {
@@ -294,6 +300,9 @@ function createJob(mode, type, options) {
     case 'ml-dsa-44':
     case 'ml-dsa-65':
     case 'ml-dsa-87':
+    case 'ml-kem-512':
+    case 'ml-kem-768':
+    case 'ml-kem-1024':
     {
       if (ids[type] === undefined) {
         throw new ERR_INVALID_ARG_VALUE('type', type, 'must be a supported key type');

diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
@@ -978,6 +978,12 @@ Local<Value> KeyObjectHandle::GetAsymmetricKeyType() const {
       return env()->crypto_ml_dsa_65_string();
     case EVP_PKEY_ML_DSA_87:
       return env()->crypto_ml_dsa_87_string();
+    case EVP_PKEY_ML_KEM_512:
+      return env()->crypto_ml_kem_512_string();
+    case EVP_PKEY_ML_KEM_768:
+      return env()->crypto_ml_kem_768_string();
+    case EVP_PKEY_ML_KEM_1024:
+      return env()->crypto_ml_kem_1024_string();
 #endif
     default:
       return Undefined(env()->isolate());
@@ -1258,6 +1264,9 @@ void Initialize(Environment* env, Local<Object> target) {
   NODE_DEFINE_CONSTANT(target, EVP_PKEY_ML_DSA_44);
   NODE_DEFINE_CONSTANT(target, EVP_PKEY_ML_DSA_65);
   NODE_DEFINE_CONSTANT(target, EVP_PKEY_ML_DSA_87);
+  NODE_DEFINE_CONSTANT(target, EVP_PKEY_ML_KEM_512);
+  NODE_DEFINE_CONSTANT(target, EVP_PKEY_ML_KEM_768);
+  NODE_DEFINE_CONSTANT(target, EVP_PKEY_ML_KEM_1024);
 #endif
   NODE_DEFINE_CONSTANT(target, EVP_PKEY_X25519);
   NODE_DEFINE_CONSTANT(target, EVP_PKEY_X448);

diff --git a/src/env_properties.h b/src/env_properties.h
@@ -118,6 +118,9 @@
   V(crypto_ml_dsa_44_string, "ml-dsa-44")                                      \
   V(crypto_ml_dsa_65_string, "ml-dsa-65")                                      \
   V(crypto_ml_dsa_87_string, "ml-dsa-87")                                      \
+  V(crypto_ml_kem_512_string, "ml-kem-512")                                    \
+  V(crypto_ml_kem_768_string, "ml-kem-768")                                    \
+  V(crypto_ml_kem_1024_string, "ml-kem-1024")                                  \
   V(crypto_x25519_string, "x25519")                                            \
   V(crypto_x448_string, "x448")                                                \
   V(crypto_rsa_string, "rsa")                                                  \

diff --git a/test/fixtures/keys/Makefile b/test/fixtures/keys/Makefile
@@ -110,6 +110,18 @@ all: \
   ml_dsa_87_private_seed_only.pem \
   ml_dsa_87_private_priv_only.pem \
   ml_dsa_87_public.pem \
+  ml_kem_512_private.pem \
+  ml_kem_512_private_seed_only.pem \
+  ml_kem_512_private_priv_only.pem \
+  ml_kem_512_public.pem \
+  ml_kem_768_private.pem \
+  ml_kem_768_private_seed_only.pem \
+  ml_kem_768_private_priv_only.pem \
+  ml_kem_768_public.pem \
+  ml_kem_1024_private.pem \
+  ml_kem_1024_private_seed_only.pem \
+  ml_kem_1024_private_priv_only.pem \
+  ml_kem_1024_public.pem \
 
 #
 # Create Certificate Authority: ca1
@@ -903,6 +915,42 @@ ml_dsa_87_private_priv_only.pem: ml_dsa_87_private.pem
 ml_dsa_87_public.pem: ml_dsa_87_private.pem
 	openssl pkey -in ml_dsa_87_private.pem -pubout -out ml_dsa_87_public.pem
 
+ml_kem_512_private.pem:
+	openssl genpkey -algorithm ml-kem-512 -out ml_kem_512_private.pem
+
+ml_kem_512_private_seed_only.pem: ml_kem_512_private.pem
+	openssl pkey -in ml_kem_512_private.pem -provparam ml-kem.output_formats=seed-only -out ml_kem_512_private_seed_only.pem
+
+ml_kem_512_private_priv_only.pem: ml_kem_512_private.pem
+	openssl pkey -in ml_kem_512_private.pem -provparam ml-kem.output_formats=priv-only -out ml_kem_512_private_priv_only.pem
+
+ml_kem_512_public.pem: ml_kem_512_private.pem
+	openssl pkey -in ml_kem_512_private.pem -pubout -out ml_kem_512_public.pem
+
+ml_kem_768_private.pem:
+	openssl genpkey -algorithm ml-kem-768 -out ml_kem_768_private.pem
+
+ml_kem_768_private_seed_only.pem: ml_kem_768_private.pem
+	openssl pkey -in ml_kem_768_private.pem -provparam ml-kem.output_formats=seed-only -out ml_kem_768_private_seed_only.pem
+
+ml_kem_768_private_priv_only.pem: ml_kem_768_private.pem
+	openssl pkey -in ml_kem_768_private.pem -provparam ml-kem.output_formats=priv-only -out ml_kem_768_private_priv_only.pem
+
+ml_kem_768_public.pem: ml_kem_768_private.pem
+	openssl pkey -in ml_kem_768_private.pem -pubout -out ml_kem_768_public.pem
+
+ml_kem_1024_private.pem:
+	openssl genpkey -algorithm ml-kem-1024 -out ml_kem_1024_private.pem
+
+ml_kem_1024_private_seed_only.pem: ml_kem_1024_private.pem
+	openssl pkey -in ml_kem_1024_private.pem -provparam ml-kem.output_formats=seed-only -out ml_kem_1024_private_seed_only.pem
+
+ml_kem_1024_private_priv_only.pem: ml_kem_1024_private.pem
+	openssl pkey -in ml_kem_1024_private.pem -provparam ml-kem.output_formats=priv-only -out ml_kem_1024_private_priv_only.pem
+
+ml_kem_1024_public.pem: ml_kem_1024_private.pem
+	openssl pkey -in ml_kem_1024_private.pem -pubout -out ml_kem_1024_public.pem
+
 x448_private.pem:
 	openssl genpkey -algorithm x448 -out x448_private.pem
 

diff --git a/test/fixtures/keys/ml_kem_1024_private.pem b/test/fixtures/keys/ml_kem_1024_private.pem
@@ -0,0 +1,71 @@
+-----BEGIN PRIVATE KEY-----
+MIIMvgIBADALBglghkgBZQMEBAMEggyqMIIMpgRAXwegslUGcMnzu1c1NccsyRmB
+aObWSESIGO+ftccj5MvAwjLDAJV/u5KhD/rnJLoLOu0eNGt4p3Oh6Mg5ttxICwSC
+DGC6yqqzFn2iimHWUAJ2YSO9yXGDFmUd95txwKHE6UP46qy3gU0zazze90sNekNS
+KsbeAVGIFarJLHF2tYKpUVw6CyXqR7+c1KJtGGFtF29xzGOi/CvpMx632HD4M1KT
+uVLXkSYTCgffBlHdcG10ysQg26VlC0UckAhiGEBUQBQL2DRlvLuR5RfVNgiSdAUU
+6rILpwGsZVY+MxbCwcU4IZVSuxq1QHpIxltZl2ZqEVQe/Gz1PJyyE34wKk4teB0g
+5j1MNBd8ZHMcG2gGmyeJZkHSgbyMhrod1ylwvABY6LqG6r6J9n0BUlwdJHvsolge
+qRzFzJrnpJE9C2Er836NRjdJKJrZUrfRsHy22XUIZiCyW0QwGY6pUGvWZ7c7+xxW
+NTA/Ikz2gl8KUmUya0WOpGzBZMGGZlEWVm5pXHMj+WHi63TZdwIpDF0h+cBhMYa+
+S8yZyTF6dlz3dkoHpLVjoYJBY6jmIRrUxSz/tiWkM21hAj9G5Zl8EBibcV9MWGcH
+27wdtDaZIUAlhpKC24AOHIx8ZztV0CiSvIAd6biRpzzhbGzBNQr1GbZQtc0nUETm
+y1x5gTu22YBCN8fB0WVsV8AHMGC5prgZN5Yt8JPSVyiAmpqw0QFj4EXEcnwCDHd4
+mqp4QitB/C8OpcKCBm2h91ECMpevJ49E1xe11UIFiLpaFy0jxxAgGYhRy3XXfM71
+PKuzcb+MMgGnBw9T6sMQts/JiHp78Ya6nL2bJ57DNHrt9zA255nYPI0zdKkMi8W5
+VFIgORRUSsGAKIaPayMagI6Nw2lHYoxtmr3ZmGf17LEZ2bK4RF2Q4ZN0iaUAWD6v
+9QbeQLeYZEiwyysty7NLV3ArqWQBcl1AMnx2hphd5hHIu55ZmIheapLRpsQAosz1
+m67Mhx4uylTzpIOGhZl0CwjK6rkXYzGKzHLcac3JRwrq8HKrJaTWoaTj9Qaq5k61
+Eo4mtaB463hHx5Q+SlzY8blBWzWqXIWikrvESSC32XwA+cezZXOYIAIM+Q+1dDSe
+VxCVpVcwF0g8MIHzonhfFgQiOYHZhmd1uR5bUc09QBRqpctUMMn4sbSexVmhAUM+
+WVnJhprIOkTSDB9QiSWZQ07+gTI+qYuKwT3QBGc2G4bZqgQhHIMzqLsTZpEmG3gD
+0cC8GSIceTfvkUUgGBR5iQ8Cu8TpFTyfO8N7dxCqZ59X16FKMLwOWnbsJEM94WoB
+AUBbJl9UB0dx24lvY6czAH7wxxVW6iQidHmp2VX4oqTEFAclOiQxFIh8/G0jyj2l
+WAKEl2vagmj5vCB50DIEEjda+7xZia/MTLCHFX3yAcXn0hRdIlkvMlTCcmXHMLI2
++6vCIjKhqXoj9HLb+GKk6ErGk5sapp7pXMYWFlTchjnszMOYUope2Sem6gW9FHYN
+KWLVOSAEIG5kZDxw4lU1aaMtBSyVGIA0C66rIRAdEmjD9IuftDif/D8ABylnupCy
+ZsXvRiIoa1b0mGOdNVXppl8hNJaW91yd+cIQiKisd7cGnDj2iBQ2trgsfKdWYLgC
+RE+fMGxgeXZBW0j6pTNXtQsJshkpyciqSKk7JDIJ1px+AKVEyA/ISD51Q2svSjb8
+YknxSGEdA5TIEwzMvLZccLwGhFkZFMZ+1ceReb/wpKiTA5rHXKMDMCQVjBbNlQaq
+W6MP8w2lXK1cVlWf6VmtCqfT/Dv3eCT2vAinfDL1i3KxRIR0aon1BzSK5nU1Rocq
+2hMcVT9gZLu1iGs0W7oVQFPbC45o3G/a57VMis5wqwDcRjQzx2bAhFrcpHNkhmrI
+Q283pK9zRBwy5V7b8avxi8zQGQJSM7X7yaYEmxoQZhnDhZ8XYaCAEqJT90oolErA
+6qs2Rc9Vawi5IZ/fLEvHKYTDNmv082S5CEvQSpX0ogbLGQ0E+hjKqhCnLKtNeHPo
+UwJyPH+UFat65D5CAQ42WJNLdzAoB77U54zh6wj6VQPX9GQ4pmfTWkVJ7C8Do4Fn
+kY5L8rSLFI++BJEjzAYxcoJlrA2gB3QwvDYeOMY1ojZduMhz1iajGn7xC1Vus2wQ
+qSwN14Enh6q9lyYxaF6hVYs2EQXzVrgZkKsTdlzZo2DK9jRp0nJyIISwWwS9/LdZ
+JcC5GQKHHJm1qV7VkLRFxVei4VscS3qYCKbN+BpcCiMSRXKWk4g6mk9RmRXwhGJn
+gi60+6sM2pFd1jd9CZhbATFVIV+hIUOBOCcJS8q9OTv3JCg1C5w5Fn0cXA+P8rv5
+OnIZuALsYSUy26LisEdKfLQEIkxl5p8bzCor0FxdE3TpKbGpE2qxHH0csk3CmGvs
+gVwyVlMIjGvGgxyR+Qx7QGJVICNU1ogHlG9yIltyZHbGpk8Rg1NVUoC4jJom+Ysd
+AS/45sp/BSfPpY3Q0ZmOGnv8pgDFijBeOm5OEwYa65JtXIaHwljMIzHaeD9PRnF4
+Mb+UByYcpFOlx3M1OFeey6H1hXMPppCnIJxpirF4ZVCh7H565ATI9zo+pyzJ8ctb
+GWA+6gLHin8EC6ckIBLP+2MKVSF6JBwJpgCYyZLKU4SVDCyi91f27L804n0GZj1w
+NIw+domEWG8jEVHWM2DT1kK5dFgkOIjJYErZzMDe+31lWj2jVCczVJmO9jIKgE7b
+cscZJkq4fD8hI55Nwy/vqoT/iQ2WlcuS0HHFeY80EnutkL/Fp6a+QZLzOMZfYGp/
+twYPMpBsSFaTei+m1XUWY3ZfKRHsOQRruk6fqIqkIHnII6vgAczRWIqqhrtnczKx
+KKdOJqcQpWxUsEfRPAq3hzyDSKEJBohNM60XZC2NgxIgbMeepU1pwnzI3ENFUsE6
+pjsbapctOnxhS5nZ8Jd68FwJBhA15hCVZRG08y+2Ii+kiIhmBzvfZ8UZOFnfxsfj
+EbkpHEPXGrWAtZBnCRgW+GgVI2xVKl+MgklJo8PvqcuT8p8CVAylBjRJcLOMoZV6
+h6FPt4evClDL6hmhOEKZhlMjwTmSFMKTqHx+KzxYDAqdMotVW4cvYFUNlUbfiWne
+5H9tQY0O2A1CMlbUty0LprDPScC2xlRW6RuzhUz8y36TNkE+2gM91MNkoYYaJDdQ
+kC7OKw2B2iaKWg4WVYNYCZK9xgT+oBWdXDrotyEy2QZmYQZIJa0hanFCU0M29jSe
+rAZSHMfyu6qWy2LfSMq7zITz8nZF2Q8qhCt7clxCVmdZos6+gn2eGmVztSAb97bb
+3HVeCJNJLL+8tMU9aD+ikzpmEYPAxnAUw5GBwTGPYcSeWTJUiZl4oC1T4ZEKAIEo
+U8smI14tIJ80VIa7U0WgFg/GQ4EKtQJfmVm3lSbWtil56ZHmi0rsqH+0YkhBSWiB
+4wlMgZLt1kvPQSKaYZpp5cDCE3kk8FeSIo+FWFdfi1hve5pJixBu1GLDRF0SHKyn
+oTJSuiV/46o4TBuIsmgmI3eGBw/625fxlch2E2abIzMPiUh2lmaSQDEP0zrgKQrp
+gUO2EICQe3YTqqAHaWLCLBtc12pTuAf31XbCXJxisoxoolTnHLPJpAwxQyxxqkYH
+wYZEo2FUnDPORrYDEba0qj6aGWUjxmtxC4c4xCjbWMliShvrGA6EW6UCVn7+JxNA
+Z1nj6DqnOTjSKH2sNZ/FRjIk03rv6DnSO8sg4mslARiNyDhNcMG4VqEy1M2o6m8B
+rMcUN6pXWJDPSYcGkww+8aL4azka8EbiQryb10xcW1Qe9FtOh6ZbaMDNcWPOZbQE
+SRaz5Yy9vAEvenyYSUdnO41kKynkSkTMioOyCS28scJrkhU3kKs9TMkL1WcxhisN
+cgEXjI4ua0XFCbFB0XxFQlzQ7LVooIDRtyGSK4siJbfm00x3rAMUly2kugwbEiU2
+2GhZNhhh4U0AR6m9l07+Izg0F3mUAJL2mrK69XHkaYakVKw8eXK4xYwdC7Ifm1/m
+0IxuBMKQWy8DGjRq21pJWRgrpq1IGVLxcHSktCp39yPhqA7LlhItsAKmwjYp8nV6
+koWDIHbv/JV/tprjFC3ySy77KauAG59WOD3ak3MbZ1ILRZlHiyZL9GZPFkmO8FNU
+Fs3CuKWmVlE4e1aOOQgE3LM1s27sOzVz4mjtYDf1YTRrDJhzgRUhMbWSE1LmhQuD
+4Be9dO3BeZSfsa0bFe2V8GkTftEmGbbU9iXtZCmkbdzQ+X9UGO0iaD48tdL3YyIk
+9kSBP9gy0nz+Aak/tD5v+9XiwMIywwCVf7uSoQ/65yS6CzrtHjRreKdzoejIObbc
+SAs=
+-----END PRIVATE KEY-----
diff --git a/test/fixtures/keys/ml_kem_1024_private_priv_only.pem b/test/fixtures/keys/ml_kem_1024_private_priv_only.pem
@@ -0,0 +1,69 @@
+-----BEGIN PRIVATE KEY-----
+MIIMeAIBADALBglghkgBZQMEBAMEggxkBIIMYLrKqrMWfaKKYdZQAnZhI73JcYMW
+ZR33m3HAocTpQ/jqrLeBTTNrPN73Sw16Q1Iqxt4BUYgVqskscXa1gqlRXDoLJepH
+v5zUom0YYW0Xb3HMY6L8K+kzHrfYcPgzUpO5UteRJhMKB98GUd1wbXTKxCDbpWUL
+RRyQCGIYQFRAFAvYNGW8u5HlF9U2CJJ0BRTqsgunAaxlVj4zFsLBxTghlVK7GrVA
+ekjGW1mXZmoRVB78bPU8nLITfjAqTi14HSDmPUw0F3xkcxwbaAabJ4lmQdKBvIyG
+uh3XKXC8AFjouobqvon2fQFSXB0ke+yiWB6pHMXMmuekkT0LYSvzfo1GN0komtlS
+t9GwfLbZdQhmILJbRDAZjqlQa9Zntzv7HFY1MD8iTPaCXwpSZTJrRY6kbMFkwYZm
+URZWbmlccyP5YeLrdNl3AikMXSH5wGExhr5LzJnJMXp2XPd2SgektWOhgkFjqOYh
+GtTFLP+2JaQzbWECP0blmXwQGJtxX0xYZwfbvB20NpkhQCWGkoLbgA4cjHxnO1XQ
+KJK8gB3puJGnPOFsbME1CvUZtlC1zSdQRObLXHmBO7bZgEI3x8HRZWxXwAcwYLmm
+uBk3li3wk9JXKICamrDRAWPgRcRyfAIMd3iaqnhCK0H8Lw6lwoIGbaH3UQIyl68n
+j0TXF7XVQgWIuloXLSPHECAZiFHLddd8zvU8q7Nxv4wyAacHD1PqwxC2z8mIenvx
+hrqcvZsnnsM0eu33MDbnmdg8jTN0qQyLxblUUiA5FFRKwYAoho9rIxqAjo3DaUdi
+jG2avdmYZ/XssRnZsrhEXZDhk3SJpQBYPq/1Bt5At5hkSLDLKy3Ls0tXcCupZAFy
+XUAyfHaGmF3mEci7nlmYiF5qktGmxACizPWbrsyHHi7KVPOkg4aFmXQLCMrquRdj
+MYrMctxpzclHCurwcqslpNahpOP1BqrmTrUSjia1oHjreEfHlD5KXNjxuUFbNapc
+haKSu8RJILfZfAD5x7Nlc5ggAgz5D7V0NJ5XEJWlVzAXSDwwgfOieF8WBCI5gdmG
+Z3W5HltRzT1AFGqly1QwyfixtJ7FWaEBQz5ZWcmGmsg6RNIMH1CJJZlDTv6BMj6p
+i4rBPdAEZzYbhtmqBCEcgzOouxNmkSYbeAPRwLwZIhx5N++RRSAYFHmJDwK7xOkV
+PJ87w3t3EKpnn1fXoUowvA5aduwkQz3hagEBQFsmX1QHR3HbiW9jpzMAfvDHFVbq
+JCJ0eanZVfiipMQUByU6JDEUiHz8bSPKPaVYAoSXa9qCaPm8IHnQMgQSN1r7vFmJ
+r8xMsIcVffIBxefSFF0iWS8yVMJyZccwsjb7q8IiMqGpeiP0ctv4YqToSsaTmxqm
+nulcxhYWVNyGOezMw5hSil7ZJ6bqBb0Udg0pYtU5IAQgbmRkPHDiVTVpoy0FLJUY
+gDQLrqshEB0SaMP0i5+0OJ/8PwAHKWe6kLJmxe9GIihrVvSYY501VemmXyE0lpb3
+XJ35whCIqKx3twacOPaIFDa2uCx8p1ZguAJET58wbGB5dkFbSPqlM1e1CwmyGSnJ
+yKpIqTskMgnWnH4ApUTID8hIPnVDay9KNvxiSfFIYR0DlMgTDMy8tlxwvAaEWRkU
+xn7Vx5F5v/CkqJMDmsdcowMwJBWMFs2VBqpbow/zDaVcrVxWVZ/pWa0Kp9P8O/d4
+JPa8CKd8MvWLcrFEhHRqifUHNIrmdTVGhyraExxVP2Bku7WIazRbuhVAU9sLjmjc
+b9rntUyKznCrANxGNDPHZsCEWtykc2SGashDbzekr3NEHDLlXtvxq/GLzNAZAlIz
+tfvJpgSbGhBmGcOFnxdhoIASolP3SiiUSsDqqzZFz1VrCLkhn98sS8cphMM2a/Tz
+ZLkIS9BKlfSiBssZDQT6GMqqEKcsq014c+hTAnI8f5QVq3rkPkIBDjZYk0t3MCgH
+vtTnjOHrCPpVA9f0ZDimZ9NaRUnsLwOjgWeRjkvytIsUj74EkSPMBjFygmWsDaAH
+dDC8Nh44xjWiNl24yHPWJqMafvELVW6zbBCpLA3XgSeHqr2XJjFoXqFVizYRBfNW
+uBmQqxN2XNmjYMr2NGnScnIghLBbBL38t1klwLkZAoccmbWpXtWQtEXFV6LhWxxL
+epgIps34GlwKIxJFcpaTiDqaT1GZFfCEYmeCLrT7qwzakV3WN30JmFsBMVUhX6Eh
+Q4E4JwlLyr05O/ckKDULnDkWfRxcD4/yu/k6chm4AuxhJTLbouKwR0p8tAQiTGXm
+nxvMKivQXF0TdOkpsakTarEcfRyyTcKYa+yBXDJWUwiMa8aDHJH5DHtAYlUgI1TW
+iAeUb3IiW3JkdsamTxGDU1VSgLiMmib5ix0BL/jmyn8FJ8+ljdDRmY4ae/ymAMWK
+MF46bk4TBhrrkm1chofCWMwjMdp4P09GcXgxv5QHJhykU6XHczU4V57LofWFcw+m
+kKcgnGmKsXhlUKHsfnrkBMj3Oj6nLMnxy1sZYD7qAseKfwQLpyQgEs/7YwpVIXok
+HAmmAJjJkspThJUMLKL3V/bsvzTifQZmPXA0jD52iYRYbyMRUdYzYNPWQrl0WCQ4
+iMlgStnMwN77fWVaPaNUJzNUmY72MgqATttyxxkmSrh8PyEjnk3DL++qhP+JDZaV
+y5LQccV5jzQSe62Qv8Wnpr5BkvM4xl9gan+3Bg8ykGxIVpN6L6bVdRZjdl8pEew5
+BGu6Tp+oiqQgecgjq+ABzNFYiqqGu2dzMrEop04mpxClbFSwR9E8CreHPINIoQkG
+iE0zrRdkLY2DEiBsx56lTWnCfMjcQ0VSwTqmOxtqly06fGFLmdnwl3rwXAkGEDXm
+EJVlEbTzL7YiL6SIiGYHO99nxRk4Wd/Gx+MRuSkcQ9catYC1kGcJGBb4aBUjbFUq
+X4yCSUmjw++py5PynwJUDKUGNElws4yhlXqHoU+3h68KUMvqGaE4QpmGUyPBOZIU
+wpOofH4rPFgMCp0yi1Vbhy9gVQ2VRt+Jad7kf21BjQ7YDUIyVtS3LQumsM9JwLbG
+VFbpG7OFTPzLfpM2QT7aAz3Uw2ShhhokN1CQLs4rDYHaJopaDhZVg1gJkr3GBP6g
+FZ1cOui3ITLZBmZhBkglrSFqcUJTQzb2NJ6sBlIcx/K7qpbLYt9IyrvMhPPydkXZ
+DyqEK3tyXEJWZ1mizr6CfZ4aZXO1IBv3ttvcdV4Ik0ksv7y0xT1oP6KTOmYRg8DG
+cBTDkYHBMY9hxJ5ZMlSJmXigLVPhkQoAgShTyyYjXi0gnzRUhrtTRaAWD8ZDgQq1
+Al+ZWbeVJta2KXnpkeaLSuyof7RiSEFJaIHjCUyBku3WS89BIpphmmnlwMITeSTw
+V5Iij4VYV1+LWG97mkmLEG7UYsNEXRIcrKehMlK6JX/jqjhMG4iyaCYjd4YHD/rb
+l/GVyHYTZpsjMw+JSHaWZpJAMQ/TOuApCumBQ7YQgJB7dhOqoAdpYsIsG1zXalO4
+B/fVdsJcnGKyjGiiVOccs8mkDDFDLHGqRgfBhkSjYVScM85GtgMRtrSqPpoZZSPG
+a3ELhzjEKNtYyWJKG+sYDoRbpQJWfv4nE0BnWePoOqc5ONIofaw1n8VGMiTTeu/o
+OdI7yyDiayUBGI3IOE1wwbhWoTLUzajqbwGsxxQ3qldYkM9JhwaTDD7xovhrORrw
+RuJCvJvXTFxbVB70W06HpltowM1xY85ltARJFrPljL28AS96fJhJR2c7jWQrKeRK
+RMyKg7IJLbyxwmuSFTeQqz1MyQvVZzGGKw1yAReMji5rRcUJsUHRfEVCXNDstWig
+gNG3IZIriyIlt+bTTHesAxSXLaS6DBsSJTbYaFk2GGHhTQBHqb2XTv4jODQXeZQA
+kvaasrr1ceRphqRUrDx5crjFjB0Lsh+bX+bQjG4EwpBbLwMaNGrbWklZGCumrUgZ
+UvFwdKS0Knf3I+GoDsuWEi2wAqbCNinydXqShYMgdu/8lX+2muMULfJLLvspq4Ab
+n1Y4PdqTcxtnUgtFmUeLJkv0Zk8WSY7wU1QWzcK4paZWUTh7Vo45CATcszWzbuw7
+NXPiaO1gN/VhNGsMmHOBFSExtZITUuaFC4PgF7107cF5lJ+xrRsV7ZXwaRN+0SYZ
+ttT2Je1kKaRt3ND5f1QY7SJoPjy10vdjIiT2RIE/2DLSfP4BqT+0Pm/71eLAwjLD
+AJV/u5KhD/rnJLoLOu0eNGt4p3Oh6Mg5ttxICw==
+-----END PRIVATE KEY-----
diff --git a/test/fixtures/keys/ml_kem_1024_private_seed_only.pem b/test/fixtures/keys/ml_kem_1024_private_seed_only.pem
@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MFQCAQAwCwYJYIZIAWUDBAQDBEKAQF8HoLJVBnDJ87tXNTXHLMkZgWjm1khEiBjv
+n7XHI+TLwMIywwCVf7uSoQ/65yS6CzrtHjRreKdzoejIObbcSAs=
+-----END PRIVATE KEY-----