EncapsulateResponse

The key encapsulation algorithm used to generate the shared secret.

The identifier of the ML-KEM KMS key used to encapsulate the shared secret.

The plaintext shared secret. It is a 32-byte cryptographically random value that both parties can use directly as key material or pass through a key derivation function to generate multiple keys and nonces. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.

The encapsulated form of the shared secret. Pass this value to the Decapsulate operation to recover the shared secret. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded. The length of SharedSecretCiphertextBlob depends on the ML-KEM key spec. Before Base64 encoding, the encapsulated shared secret is 768 bytes for ML_KEM_512, 1088 bytes for ML_KEM_768, and 1568 bytes for ML_KEM_1024.