Skip to content
NOQTIS

noqtis-enc(1)

noqtis-enc — encapsulate a shared secret to an ML-KEM or HQC public key

noqtis enc -p key.pub -o ct [-f | --force] ss | --stdout

noqtis enc runs the encapsulation of the KEM named in key.pub with fresh randomness. It writes the ciphertext (raw bytes, the standard's encoding) to ct and the 32-byte shared secret to ss, created owner-only (mode 0600). Send ct to the holder of the secret key; they recover the same secret with noqtis-dec(1).

key.pub, --pub=key.pub
A public KEM key file (‘noqtis-key-1 ML-KEM-768 pub, for example’). A signature key is refused.
ct, --out=ct
The ciphertext file.
Print the shared secret in hex (64 digits and a newline) on standard output instead of writing ss.
, --force
Replace existing files.

The shared secret is key material: feed it to a key derivation function or an authenticated cipher; it is not a password.

0 on success; 2 on a usage error, a key that is not a public KEM key, an existing file without --force, or a file that cannot be written.

$ noqtis keygen -a ML-KEM-768 -o box
ML-KEM-768 key pair: box (secret), box.pub (public)
$ noqtis enc -p box.pub -o msg.ct sender.ss
$ noqtis dec -k box -o receiver.ss msg.ct
$ cmp sender.ss receiver.ss && echo same
same

noqtis(1), noqtis-dec(1), noqtis-keygen(1), nqenc(3)