diff --git a/.gitignore b/.gitignore
index 542abd54..aa8607a0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -134,10 +134,11 @@ test/default/kdf_hkdf2
test/default/kdf_hkdf3
test/default/kdf_hkdf4
test/default/keygen
-test/default/kx
-test/default/metamorphic
+test/default/kem
test/default/kem_mlkem768
test/default/kem_xwing
+test/default/kx
+test/default/metamorphic
test/default/misuse
test/default/onetimeauth
test/default/onetimeauth2
diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj b/builds/msvc/vs2010/libsodium/libsodium.vcxproj
index 41bab1cc..bc3ccf75 100644
--- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj
@@ -193,6 +193,7 @@
+
@@ -261,6 +262,7 @@
+
diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters
index 782789d5..541fa348 100644
--- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,9 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem
+
crypto_kem\xwing
@@ -599,6 +602,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj b/builds/msvc/vs2012/libsodium/libsodium.vcxproj
index c977d707..32ceed9c 100644
--- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj
@@ -193,6 +193,7 @@
+
@@ -261,6 +262,7 @@
+
diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters
index 782789d5..541fa348 100644
--- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,9 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem
+
crypto_kem\xwing
@@ -599,6 +602,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj b/builds/msvc/vs2013/libsodium/libsodium.vcxproj
index de545c1e..739b0174 100644
--- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj
@@ -193,6 +193,7 @@
+
@@ -261,6 +262,7 @@
+
diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters
index 782789d5..541fa348 100644
--- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,9 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem
+
crypto_kem\xwing
@@ -599,6 +602,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj b/builds/msvc/vs2015/libsodium/libsodium.vcxproj
index 674e8da2..bfcf7b89 100644
--- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj
@@ -193,6 +193,7 @@
+
@@ -261,6 +262,7 @@
+
diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters
index 782789d5..541fa348 100644
--- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,9 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem
+
crypto_kem\xwing
@@ -599,6 +602,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj b/builds/msvc/vs2017/libsodium/libsodium.vcxproj
index e33db251..61b4c67b 100644
--- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj
@@ -193,6 +193,7 @@
+
@@ -261,6 +262,7 @@
+
diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters
index 782789d5..541fa348 100644
--- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,9 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem
+
crypto_kem\xwing
@@ -599,6 +602,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj b/builds/msvc/vs2019/libsodium/libsodium.vcxproj
index 432da651..dcaf7383 100644
--- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj
@@ -217,6 +217,7 @@
+
@@ -285,6 +286,7 @@
+
diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters
index 782789d5..541fa348 100644
--- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,9 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem
+
crypto_kem\xwing
@@ -599,6 +602,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj b/builds/msvc/vs2022/libsodium/libsodium.vcxproj
index c8ca1ac4..1b6cb380 100644
--- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj
@@ -217,6 +217,7 @@
+
@@ -285,6 +286,7 @@
+
diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters
index 782789d5..541fa348 100644
--- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,9 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem
+
crypto_kem\xwing
@@ -599,6 +602,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
diff --git a/builds/msvc/vs2026/libsodium/libsodium.vcxproj b/builds/msvc/vs2026/libsodium/libsodium.vcxproj
index cdeb634d..87c68e16 100644
--- a/builds/msvc/vs2026/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2026/libsodium/libsodium.vcxproj
@@ -217,6 +217,7 @@
+
@@ -285,6 +286,7 @@
+
diff --git a/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters
index 782789d5..541fa348 100644
--- a/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,9 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem
+
crypto_kem\xwing
@@ -599,6 +602,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
diff --git a/ci/appveyor/libsodium.vcxproj b/ci/appveyor/libsodium.vcxproj
index 70b9430d..bfcd1a30 100644
--- a/ci/appveyor/libsodium.vcxproj
+++ b/ci/appveyor/libsodium.vcxproj
@@ -441,6 +441,7 @@
+
@@ -509,6 +510,7 @@
+
diff --git a/ci/appveyor/libsodium.vcxproj.filters b/ci/appveyor/libsodium.vcxproj.filters
index b98f5e2b..2362ef4d 100644
--- a/ci/appveyor/libsodium.vcxproj.filters
+++ b/ci/appveyor/libsodium.vcxproj.filters
@@ -390,6 +390,9 @@
Source Files
+
+ Source Files
+
Source Files
@@ -590,6 +593,9 @@
Header Files
+
+ Header Files
+
Header Files
diff --git a/src/libsodium/Makefile.am b/src/libsodium/Makefile.am
index 8c0fdaa1..7bd94c92 100644
--- a/src/libsodium/Makefile.am
+++ b/src/libsodium/Makefile.am
@@ -57,6 +57,7 @@ libsodium_la_SOURCES = \
crypto_kdf/crypto_kdf.c \
crypto_kdf/hkdf/kdf_hkdf_sha256.c \
crypto_kdf/hkdf/kdf_hkdf_sha512.c \
+ crypto_kem/crypto_kem.c \
crypto_kem/mlkem768/kem_mlkem768.c \
crypto_kem/mlkem768/ref/kem_mlkem768_ref.c \
crypto_kem/mlkem768/ref/kem_mlkem768_ref.h \
diff --git a/src/libsodium/Makefile.in b/src/libsodium/Makefile.in
index dca767ba..cc75e619 100644
--- a/src/libsodium/Makefile.in
+++ b/src/libsodium/Makefile.in
@@ -324,7 +324,8 @@ am__libsodium_la_SOURCES_DIST = \
crypto_kem/mlkem768/kem_mlkem768.c \
crypto_kem/mlkem768/ref/kem_mlkem768_ref.c \
crypto_kem/mlkem768/ref/kem_mlkem768_ref.h \
- crypto_kx/crypto_kx.c crypto_onetimeauth/crypto_onetimeauth.c \
+ crypto_kem/xwing/kem_xwing.c crypto_kx/crypto_kx.c \
+ crypto_onetimeauth/crypto_onetimeauth.c \
crypto_onetimeauth/poly1305/onetimeauth_poly1305.c \
crypto_onetimeauth/poly1305/onetimeauth_poly1305.h \
crypto_onetimeauth/poly1305/donna/poly1305_donna.h \
@@ -514,6 +515,7 @@ am_libsodium_la_OBJECTS = \
crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha512.lo \
crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo \
crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo \
+ crypto_kem/xwing/libsodium_la-kem_xwing.lo \
crypto_kx/libsodium_la-crypto_kx.lo \
crypto_onetimeauth/libsodium_la-crypto_onetimeauth.lo \
crypto_onetimeauth/poly1305/libsodium_la-onetimeauth_poly1305.lo \
@@ -672,6 +674,7 @@ am__depfiles_remade = crypto_aead/aegis128l/$(DEPDIR)/libaesni_la-aegis128l_aesn
crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha512.Plo \
crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo \
crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo \
+ crypto_kem/xwing/$(DEPDIR)/libsodium_la-kem_xwing.Plo \
crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo \
crypto_onetimeauth/$(DEPDIR)/libsodium_la-crypto_onetimeauth.Plo \
crypto_onetimeauth/poly1305/$(DEPDIR)/libsodium_la-onetimeauth_poly1305.Plo \
@@ -1090,7 +1093,8 @@ libsodium_la_SOURCES = crypto_aead/aegis128l/aead_aegis128l.c \
crypto_kem/mlkem768/kem_mlkem768.c \
crypto_kem/mlkem768/ref/kem_mlkem768_ref.c \
crypto_kem/mlkem768/ref/kem_mlkem768_ref.h \
- crypto_kx/crypto_kx.c crypto_onetimeauth/crypto_onetimeauth.c \
+ crypto_kem/xwing/kem_xwing.c crypto_kx/crypto_kx.c \
+ crypto_onetimeauth/crypto_onetimeauth.c \
crypto_onetimeauth/poly1305/onetimeauth_poly1305.c \
crypto_onetimeauth/poly1305/onetimeauth_poly1305.h \
crypto_onetimeauth/poly1305/donna/poly1305_donna.h \
@@ -1786,6 +1790,15 @@ crypto_kem/mlkem768/ref/$(DEPDIR)/$(am__dirstamp):
crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo: \
crypto_kem/mlkem768/ref/$(am__dirstamp) \
crypto_kem/mlkem768/ref/$(DEPDIR)/$(am__dirstamp)
+crypto_kem/xwing/$(am__dirstamp):
+ @$(MKDIR_P) crypto_kem/xwing
+ @: >>crypto_kem/xwing/$(am__dirstamp)
+crypto_kem/xwing/$(DEPDIR)/$(am__dirstamp):
+ @$(MKDIR_P) crypto_kem/xwing/$(DEPDIR)
+ @: >>crypto_kem/xwing/$(DEPDIR)/$(am__dirstamp)
+crypto_kem/xwing/libsodium_la-kem_xwing.lo: \
+ crypto_kem/xwing/$(am__dirstamp) \
+ crypto_kem/xwing/$(DEPDIR)/$(am__dirstamp)
crypto_kx/$(am__dirstamp):
@$(MKDIR_P) crypto_kx
@: >>crypto_kx/$(am__dirstamp)
@@ -2425,6 +2438,8 @@ mostlyclean-compile:
-rm -f crypto_kem/mlkem768/*.lo
-rm -f crypto_kem/mlkem768/ref/*.$(OBJEXT)
-rm -f crypto_kem/mlkem768/ref/*.lo
+ -rm -f crypto_kem/xwing/*.$(OBJEXT)
+ -rm -f crypto_kem/xwing/*.lo
-rm -f crypto_kx/*.$(OBJEXT)
-rm -f crypto_kx/*.lo
-rm -f crypto_onetimeauth/*.$(OBJEXT)
@@ -2593,6 +2608,7 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha512.Plo@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@crypto_kem/xwing/$(DEPDIR)/libsodium_la-kem_xwing.Plo@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@crypto_onetimeauth/$(DEPDIR)/libsodium_la-crypto_onetimeauth.Plo@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@crypto_onetimeauth/poly1305/$(DEPDIR)/libsodium_la-onetimeauth_poly1305.Plo@am__quote@ # am--include-marker
@@ -3151,6 +3167,13 @@ crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo: crypto_kem/mlkem768/re
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo `test -f 'crypto_kem/mlkem768/ref/kem_mlkem768_ref.c' || echo '$(srcdir)/'`crypto_kem/mlkem768/ref/kem_mlkem768_ref.c
+crypto_kem/xwing/libsodium_la-kem_xwing.lo: crypto_kem/xwing/kem_xwing.c
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_kem/xwing/libsodium_la-kem_xwing.lo -MD -MP -MF crypto_kem/xwing/$(DEPDIR)/libsodium_la-kem_xwing.Tpo -c -o crypto_kem/xwing/libsodium_la-kem_xwing.lo `test -f 'crypto_kem/xwing/kem_xwing.c' || echo '$(srcdir)/'`crypto_kem/xwing/kem_xwing.c
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_kem/xwing/$(DEPDIR)/libsodium_la-kem_xwing.Tpo crypto_kem/xwing/$(DEPDIR)/libsodium_la-kem_xwing.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_kem/xwing/kem_xwing.c' object='crypto_kem/xwing/libsodium_la-kem_xwing.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_kem/xwing/libsodium_la-kem_xwing.lo `test -f 'crypto_kem/xwing/kem_xwing.c' || echo '$(srcdir)/'`crypto_kem/xwing/kem_xwing.c
+
crypto_kx/libsodium_la-crypto_kx.lo: crypto_kx/crypto_kx.c
@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_kx/libsodium_la-crypto_kx.lo -MD -MP -MF crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Tpo -c -o crypto_kx/libsodium_la-crypto_kx.lo `test -f 'crypto_kx/crypto_kx.c' || echo '$(srcdir)/'`crypto_kx/crypto_kx.c
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Tpo crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo
@@ -3762,6 +3785,7 @@ clean-libtool:
-rm -rf crypto_kdf/hkdf/.libs crypto_kdf/hkdf/_libs
-rm -rf crypto_kem/mlkem768/.libs crypto_kem/mlkem768/_libs
-rm -rf crypto_kem/mlkem768/ref/.libs crypto_kem/mlkem768/ref/_libs
+ -rm -rf crypto_kem/xwing/.libs crypto_kem/xwing/_libs
-rm -rf crypto_kx/.libs crypto_kx/_libs
-rm -rf crypto_onetimeauth/.libs crypto_onetimeauth/_libs
-rm -rf crypto_onetimeauth/poly1305/.libs crypto_onetimeauth/poly1305/_libs
@@ -4107,6 +4131,8 @@ distclean-generic:
-$(am__rm_f) crypto_kem/mlkem768/$(am__dirstamp)
-$(am__rm_f) crypto_kem/mlkem768/ref/$(DEPDIR)/$(am__dirstamp)
-$(am__rm_f) crypto_kem/mlkem768/ref/$(am__dirstamp)
+ -$(am__rm_f) crypto_kem/xwing/$(DEPDIR)/$(am__dirstamp)
+ -$(am__rm_f) crypto_kem/xwing/$(am__dirstamp)
-$(am__rm_f) crypto_kx/$(DEPDIR)/$(am__dirstamp)
-$(am__rm_f) crypto_kx/$(am__dirstamp)
-$(am__rm_f) crypto_onetimeauth/$(DEPDIR)/$(am__dirstamp)
@@ -4281,6 +4307,7 @@ distclean: distclean-recursive
-rm -f crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha512.Plo
-rm -f crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo
-rm -f crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo
+ -rm -f crypto_kem/xwing/$(DEPDIR)/libsodium_la-kem_xwing.Plo
-rm -f crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo
-rm -f crypto_onetimeauth/$(DEPDIR)/libsodium_la-crypto_onetimeauth.Plo
-rm -f crypto_onetimeauth/poly1305/$(DEPDIR)/libsodium_la-onetimeauth_poly1305.Plo
@@ -4467,6 +4494,7 @@ maintainer-clean: maintainer-clean-recursive
-rm -f crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha512.Plo
-rm -f crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo
-rm -f crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo
+ -rm -f crypto_kem/xwing/$(DEPDIR)/libsodium_la-kem_xwing.Plo
-rm -f crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo
-rm -f crypto_onetimeauth/$(DEPDIR)/libsodium_la-crypto_onetimeauth.Plo
-rm -f crypto_onetimeauth/poly1305/$(DEPDIR)/libsodium_la-onetimeauth_poly1305.Plo
diff --git a/src/libsodium/crypto_kem/crypto_kem.c b/src/libsodium/crypto_kem/crypto_kem.c
new file mode 100644
index 00000000..68a430b9
--- /dev/null
+++ b/src/libsodium/crypto_kem/crypto_kem.c
@@ -0,0 +1,62 @@
+#include "crypto_kem.h"
+
+size_t
+crypto_kem_publickeybytes(void)
+{
+ return crypto_kem_PUBLICKEYBYTES;
+}
+
+size_t
+crypto_kem_secretkeybytes(void)
+{
+ return crypto_kem_SECRETKEYBYTES;
+}
+
+size_t
+crypto_kem_ciphertextbytes(void)
+{
+ return crypto_kem_CIPHERTEXTBYTES;
+}
+
+size_t
+crypto_kem_sharedsecretbytes(void)
+{
+ return crypto_kem_SHAREDSECRETBYTES;
+}
+
+size_t
+crypto_kem_seedbytes(void)
+{
+ return crypto_kem_SEEDBYTES;
+}
+
+const char *
+crypto_kem_primitive(void)
+{
+ return crypto_kem_PRIMITIVE;
+}
+
+int
+crypto_kem_seed_keypair(unsigned char *pk, unsigned char *sk,
+ const unsigned char *seed)
+{
+ return crypto_kem_xwing_seed_keypair(pk, sk, seed);
+}
+
+int
+crypto_kem_keypair(unsigned char *pk, unsigned char *sk)
+{
+ return crypto_kem_xwing_keypair(pk, sk);
+}
+
+int
+crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk)
+{
+ return crypto_kem_xwing_enc(ct, ss, pk);
+}
+
+int
+crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk)
+{
+ return crypto_kem_xwing_dec(ss, ct, sk);
+}
diff --git a/src/libsodium/include/Makefile.am b/src/libsodium/include/Makefile.am
index 3fdadfbb..81b75298 100644
--- a/src/libsodium/include/Makefile.am
+++ b/src/libsodium/include/Makefile.am
@@ -33,6 +33,7 @@ SODIUM_EXPORT = \
sodium/crypto_kdf_hkdf_sha256.h \
sodium/crypto_kdf_hkdf_sha512.h \
sodium/crypto_kdf_blake2b.h \
+ sodium/crypto_kem.h \
sodium/crypto_kem_mlkem768.h \
sodium/crypto_kem_xwing.h \
sodium/crypto_kx.h \
diff --git a/src/libsodium/include/Makefile.in b/src/libsodium/include/Makefile.in
index 3c4ae2db..c23afd2e 100644
--- a/src/libsodium/include/Makefile.in
+++ b/src/libsodium/include/Makefile.in
@@ -384,6 +384,7 @@ SODIUM_EXPORT = \
sodium/crypto_kdf_hkdf_sha512.h \
sodium/crypto_kdf_blake2b.h \
sodium/crypto_kem_mlkem768.h \
+ sodium/crypto_kem_xwing.h \
sodium/crypto_kx.h \
sodium/crypto_onetimeauth.h \
sodium/crypto_onetimeauth_poly1305.h \
diff --git a/src/libsodium/include/sodium.h b/src/libsodium/include/sodium.h
index f1f48f39..702977a2 100644
--- a/src/libsodium/include/sodium.h
+++ b/src/libsodium/include/sodium.h
@@ -33,6 +33,7 @@
#include "sodium/crypto_kdf_blake2b.h"
#include "sodium/crypto_kdf_hkdf_sha256.h"
#include "sodium/crypto_kdf_hkdf_sha512.h"
+#include "sodium/crypto_kem.h"
#include "sodium/crypto_kem_mlkem768.h"
#include "sodium/crypto_kem_xwing.h"
#include "sodium/crypto_kx.h"
diff --git a/src/libsodium/include/sodium/crypto_kem.h b/src/libsodium/include/sodium/crypto_kem.h
new file mode 100644
index 00000000..ff289e87
--- /dev/null
+++ b/src/libsodium/include/sodium/crypto_kem.h
@@ -0,0 +1,70 @@
+#ifndef crypto_kem_H
+#define crypto_kem_H
+
+/*
+ * THREAD SAFETY: crypto_kem_keypair() is thread-safe,
+ * provided that sodium_init() was called before.
+ *
+ * Other functions are always thread-safe.
+ */
+
+#include
+
+#include "crypto_kem_xwing.h"
+#include "export.h"
+
+#ifdef __cplusplus
+# ifdef __GNUC__
+# pragma GCC diagnostic ignored "-Wlong-long"
+# endif
+extern "C" {
+#endif
+
+#define crypto_kem_PUBLICKEYBYTES crypto_kem_xwing_PUBLICKEYBYTES
+SODIUM_EXPORT
+size_t crypto_kem_publickeybytes(void);
+
+#define crypto_kem_SECRETKEYBYTES crypto_kem_xwing_SECRETKEYBYTES
+SODIUM_EXPORT
+size_t crypto_kem_secretkeybytes(void);
+
+#define crypto_kem_CIPHERTEXTBYTES crypto_kem_xwing_CIPHERTEXTBYTES
+SODIUM_EXPORT
+size_t crypto_kem_ciphertextbytes(void);
+
+#define crypto_kem_SHAREDSECRETBYTES crypto_kem_xwing_SHAREDSECRETBYTES
+SODIUM_EXPORT
+size_t crypto_kem_sharedsecretbytes(void);
+
+#define crypto_kem_SEEDBYTES crypto_kem_xwing_SEEDBYTES
+SODIUM_EXPORT
+size_t crypto_kem_seedbytes(void);
+
+#define crypto_kem_PRIMITIVE "xwing"
+SODIUM_EXPORT
+const char *crypto_kem_primitive(void);
+
+SODIUM_EXPORT
+int crypto_kem_seed_keypair(unsigned char *pk, unsigned char *sk,
+ const unsigned char *seed)
+ __attribute__ ((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_keypair(unsigned char *pk, unsigned char *sk)
+ __attribute__ ((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_enc(unsigned char *ct, unsigned char *ss,
+ const unsigned char *pk)
+ __attribute__ ((warn_unused_result)) __attribute__ ((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_dec(unsigned char *ss, const unsigned char *ct,
+ const unsigned char *sk)
+ __attribute__ ((warn_unused_result)) __attribute__ ((nonnull));
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/test/default/Makefile.am b/test/default/Makefile.am
index 8820548f..aec41f87 100644
--- a/test/default/Makefile.am
+++ b/test/default/Makefile.am
@@ -264,6 +264,7 @@ TESTS_TARGETS = \
hash_sha3512 \
ipcrypt \
kdf \
+ kem \
kem_mlkem768 \
kem_xwing \
keygen \
diff --git a/test/default/Makefile.in b/test/default/Makefile.in
index ec6e0d39..563b1c98 100644
--- a/test/default/Makefile.in
+++ b/test/default/Makefile.in
@@ -159,16 +159,16 @@ am__EXEEXT_3 = aead_aegis128l$(EXEEXT) aead_aegis256$(EXEEXT) \
generichash$(EXEEXT) generichash2$(EXEEXT) \
generichash3$(EXEEXT) hash$(EXEEXT) hash3$(EXEEXT) \
hash_sha3256$(EXEEXT) hash_sha3512$(EXEEXT) ipcrypt$(EXEEXT) \
- kdf$(EXEEXT) kem_mlkem768$(EXEEXT) keygen$(EXEEXT) kx$(EXEEXT) \
- metamorphic$(EXEEXT) misuse$(EXEEXT) onetimeauth$(EXEEXT) \
- onetimeauth2$(EXEEXT) onetimeauth7$(EXEEXT) \
- pwhash_argon2i$(EXEEXT) pwhash_argon2id$(EXEEXT) \
- pwhash_argon2id2$(EXEEXT) randombytes$(EXEEXT) \
- scalarmult$(EXEEXT) scalarmult2$(EXEEXT) scalarmult5$(EXEEXT) \
- scalarmult6$(EXEEXT) scalarmult7$(EXEEXT) scalarmult8$(EXEEXT) \
- secretbox$(EXEEXT) secretbox2$(EXEEXT) secretbox7$(EXEEXT) \
- secretbox8$(EXEEXT) secretbox_easy$(EXEEXT) \
- secretbox_easy2$(EXEEXT) \
+ kdf$(EXEEXT) kem_mlkem768$(EXEEXT) kem_xwing$(EXEEXT) \
+ keygen$(EXEEXT) kx$(EXEEXT) metamorphic$(EXEEXT) \
+ misuse$(EXEEXT) onetimeauth$(EXEEXT) onetimeauth2$(EXEEXT) \
+ onetimeauth7$(EXEEXT) pwhash_argon2i$(EXEEXT) \
+ pwhash_argon2id$(EXEEXT) pwhash_argon2id2$(EXEEXT) \
+ randombytes$(EXEEXT) scalarmult$(EXEEXT) scalarmult2$(EXEEXT) \
+ scalarmult5$(EXEEXT) scalarmult6$(EXEEXT) scalarmult7$(EXEEXT) \
+ scalarmult8$(EXEEXT) secretbox$(EXEEXT) secretbox2$(EXEEXT) \
+ secretbox7$(EXEEXT) secretbox8$(EXEEXT) \
+ secretbox_easy$(EXEEXT) secretbox_easy2$(EXEEXT) \
secretstream_xchacha20poly1305$(EXEEXT) shorthash$(EXEEXT) \
sign$(EXEEXT) sodium_core$(EXEEXT) sodium_utils$(EXEEXT) \
sodium_version$(EXEEXT) stream$(EXEEXT) stream2$(EXEEXT) \
@@ -327,6 +327,9 @@ kdf_hkdf4_DEPENDENCIES = $(TESTS_LDADD)
kem_mlkem768_SOURCES = kem_mlkem768.c
kem_mlkem768_OBJECTS = kem_mlkem768.$(OBJEXT)
kem_mlkem768_DEPENDENCIES = $(TESTS_LDADD)
+kem_xwing_SOURCES = kem_xwing.c
+kem_xwing_OBJECTS = kem_xwing.$(OBJEXT)
+kem_xwing_DEPENDENCIES = $(TESTS_LDADD)
keygen_SOURCES = keygen.c
keygen_OBJECTS = keygen.$(OBJEXT)
keygen_DEPENDENCIES = $(TESTS_LDADD)
@@ -518,17 +521,17 @@ am__depfiles_remade = ./$(DEPDIR)/aead_aegis128l.Po \
./$(DEPDIR)/ipcrypt.Po ./$(DEPDIR)/kdf.Po \
./$(DEPDIR)/kdf_hkdf.Po ./$(DEPDIR)/kdf_hkdf2.Po \
./$(DEPDIR)/kdf_hkdf3.Po ./$(DEPDIR)/kdf_hkdf4.Po \
- ./$(DEPDIR)/kem_mlkem768.Po ./$(DEPDIR)/keygen.Po \
- ./$(DEPDIR)/kx.Po ./$(DEPDIR)/metamorphic.Po \
- ./$(DEPDIR)/misuse.Po ./$(DEPDIR)/onetimeauth.Po \
- ./$(DEPDIR)/onetimeauth2.Po ./$(DEPDIR)/onetimeauth7.Po \
- ./$(DEPDIR)/pwhash_argon2i.Po ./$(DEPDIR)/pwhash_argon2id.Po \
- ./$(DEPDIR)/pwhash_argon2id2.Po ./$(DEPDIR)/pwhash_scrypt.Po \
- ./$(DEPDIR)/pwhash_scrypt_ll.Po ./$(DEPDIR)/randombytes.Po \
- ./$(DEPDIR)/scalarmult.Po ./$(DEPDIR)/scalarmult2.Po \
- ./$(DEPDIR)/scalarmult5.Po ./$(DEPDIR)/scalarmult6.Po \
- ./$(DEPDIR)/scalarmult7.Po ./$(DEPDIR)/scalarmult8.Po \
- ./$(DEPDIR)/scalarmult_ed25519.Po \
+ ./$(DEPDIR)/kem_mlkem768.Po ./$(DEPDIR)/kem_xwing.Po \
+ ./$(DEPDIR)/keygen.Po ./$(DEPDIR)/kx.Po \
+ ./$(DEPDIR)/metamorphic.Po ./$(DEPDIR)/misuse.Po \
+ ./$(DEPDIR)/onetimeauth.Po ./$(DEPDIR)/onetimeauth2.Po \
+ ./$(DEPDIR)/onetimeauth7.Po ./$(DEPDIR)/pwhash_argon2i.Po \
+ ./$(DEPDIR)/pwhash_argon2id.Po ./$(DEPDIR)/pwhash_argon2id2.Po \
+ ./$(DEPDIR)/pwhash_scrypt.Po ./$(DEPDIR)/pwhash_scrypt_ll.Po \
+ ./$(DEPDIR)/randombytes.Po ./$(DEPDIR)/scalarmult.Po \
+ ./$(DEPDIR)/scalarmult2.Po ./$(DEPDIR)/scalarmult5.Po \
+ ./$(DEPDIR)/scalarmult6.Po ./$(DEPDIR)/scalarmult7.Po \
+ ./$(DEPDIR)/scalarmult8.Po ./$(DEPDIR)/scalarmult_ed25519.Po \
./$(DEPDIR)/scalarmult_ristretto255.Po \
./$(DEPDIR)/secretbox.Po ./$(DEPDIR)/secretbox2.Po \
./$(DEPDIR)/secretbox7.Po ./$(DEPDIR)/secretbox8.Po \
@@ -575,8 +578,8 @@ SOURCES = aead_aegis128l.c aead_aegis256.c aead_aes256gcm.c \
core_ristretto255.c ed25519_convert.c generichash.c \
generichash2.c generichash3.c hash.c hash3.c hash_sha3256.c \
hash_sha3512.c ipcrypt.c kdf.c kdf_hkdf.c kdf_hkdf2.c \
- kdf_hkdf3.c kdf_hkdf4.c kem_mlkem768.c keygen.c kx.c \
- metamorphic.c misuse.c onetimeauth.c onetimeauth2.c \
+ kdf_hkdf3.c kdf_hkdf4.c kem_mlkem768.c kem_xwing.c keygen.c \
+ kx.c metamorphic.c misuse.c onetimeauth.c onetimeauth2.c \
onetimeauth7.c pwhash_argon2i.c pwhash_argon2id.c \
pwhash_argon2id2.c pwhash_scrypt.c pwhash_scrypt_ll.c \
randombytes.c scalarmult.c scalarmult2.c scalarmult5.c \
@@ -599,8 +602,8 @@ DIST_SOURCES = aead_aegis128l.c aead_aegis256.c aead_aes256gcm.c \
core_ristretto255.c ed25519_convert.c generichash.c \
generichash2.c generichash3.c hash.c hash3.c hash_sha3256.c \
hash_sha3512.c ipcrypt.c kdf.c kdf_hkdf.c kdf_hkdf2.c \
- kdf_hkdf3.c kdf_hkdf4.c kem_mlkem768.c keygen.c kx.c \
- metamorphic.c misuse.c onetimeauth.c onetimeauth2.c \
+ kdf_hkdf3.c kdf_hkdf4.c kem_mlkem768.c kem_xwing.c keygen.c \
+ kx.c metamorphic.c misuse.c onetimeauth.c onetimeauth2.c \
onetimeauth7.c pwhash_argon2i.c pwhash_argon2id.c \
pwhash_argon2id2.c pwhash_scrypt.c pwhash_scrypt_ll.c \
randombytes.c scalarmult.c scalarmult2.c scalarmult5.c \
@@ -1248,11 +1251,11 @@ TESTS_TARGETS = aead_aegis128l aead_aegis256 aead_aes256gcm \
codecs codecs2 codecs3 core_keccak1600 core1 core2 core3 core4 \
core5 core6 ed25519_convert generichash generichash2 \
generichash3 hash hash3 hash_sha3256 hash_sha3512 ipcrypt kdf \
- kem_mlkem768 keygen kx metamorphic misuse onetimeauth \
- onetimeauth2 onetimeauth7 pwhash_argon2i pwhash_argon2id \
- pwhash_argon2id2 randombytes scalarmult scalarmult2 \
- scalarmult5 scalarmult6 scalarmult7 scalarmult8 secretbox \
- secretbox2 secretbox7 secretbox8 secretbox_easy \
+ kem_mlkem768 kem_xwing keygen kx metamorphic misuse \
+ onetimeauth onetimeauth2 onetimeauth7 pwhash_argon2i \
+ pwhash_argon2id pwhash_argon2id2 randombytes scalarmult \
+ scalarmult2 scalarmult5 scalarmult6 scalarmult7 scalarmult8 \
+ secretbox secretbox2 secretbox7 secretbox8 secretbox_easy \
secretbox_easy2 secretstream_xchacha20poly1305 shorthash sign \
sodium_core sodium_utils sodium_version stream stream2 stream3 \
stream4 verify1 xof_shake128 xof_shake256 xof_turboshake128 \
@@ -1697,6 +1700,10 @@ kem_mlkem768$(EXEEXT): $(kem_mlkem768_OBJECTS) $(kem_mlkem768_DEPENDENCIES) $(EX
@rm -f kem_mlkem768$(EXEEXT)
$(AM_V_CCLD)$(LINK) $(kem_mlkem768_OBJECTS) $(kem_mlkem768_LDADD) $(LIBS)
+kem_xwing$(EXEEXT): $(kem_xwing_OBJECTS) $(kem_xwing_DEPENDENCIES) $(EXTRA_kem_xwing_DEPENDENCIES)
+ @rm -f kem_xwing$(EXEEXT)
+ $(AM_V_CCLD)$(LINK) $(kem_xwing_OBJECTS) $(kem_xwing_LDADD) $(LIBS)
+
keygen$(EXEEXT): $(keygen_OBJECTS) $(keygen_DEPENDENCIES) $(EXTRA_keygen_DEPENDENCIES)
@rm -f keygen$(EXEEXT)
$(AM_V_CCLD)$(LINK) $(keygen_OBJECTS) $(keygen_LDADD) $(LIBS)
@@ -1952,6 +1959,7 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kdf_hkdf3.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kdf_hkdf4.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kem_mlkem768.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kem_xwing.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/keygen.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kx.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/metamorphic.Po@am__quote@ # am--include-marker
@@ -2558,6 +2566,13 @@ kem_mlkem768.log: kem_mlkem768$(EXEEXT)
--log-file $$b.log --trs-file $$b.trs \
$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
"$$tst" $(AM_TESTS_FD_REDIRECT)
+kem_xwing.log: kem_xwing$(EXEEXT)
+ @p='kem_xwing$(EXEEXT)'; \
+ b='kem_xwing'; \
+ $(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \
+ --log-file $$b.log --trs-file $$b.trs \
+ $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
+ "$$tst" $(AM_TESTS_FD_REDIRECT)
keygen.log: keygen$(EXEEXT)
@p='keygen$(EXEEXT)'; \
b='keygen'; \
@@ -3093,6 +3108,7 @@ distclean: distclean-am
-rm -f ./$(DEPDIR)/kdf_hkdf3.Po
-rm -f ./$(DEPDIR)/kdf_hkdf4.Po
-rm -f ./$(DEPDIR)/kem_mlkem768.Po
+ -rm -f ./$(DEPDIR)/kem_xwing.Po
-rm -f ./$(DEPDIR)/keygen.Po
-rm -f ./$(DEPDIR)/kx.Po
-rm -f ./$(DEPDIR)/metamorphic.Po
@@ -3237,6 +3253,7 @@ maintainer-clean: maintainer-clean-am
-rm -f ./$(DEPDIR)/kdf_hkdf3.Po
-rm -f ./$(DEPDIR)/kdf_hkdf4.Po
-rm -f ./$(DEPDIR)/kem_mlkem768.Po
+ -rm -f ./$(DEPDIR)/kem_xwing.Po
-rm -f ./$(DEPDIR)/keygen.Po
-rm -f ./$(DEPDIR)/kx.Po
-rm -f ./$(DEPDIR)/metamorphic.Po
diff --git a/test/default/kem.c b/test/default/kem.c
new file mode 100644
index 00000000..79a55eac
--- /dev/null
+++ b/test/default/kem.c
@@ -0,0 +1,70 @@
+#define TEST_NAME "kem"
+#include "cmptest.h"
+
+static void
+tv_kem(void)
+{
+ unsigned char *pk;
+ unsigned char *sk;
+ unsigned char *seed;
+ unsigned char *ct;
+ unsigned char *ss_enc;
+ unsigned char *ss_dec;
+ int i;
+
+ pk = (unsigned char *) sodium_malloc(crypto_kem_PUBLICKEYBYTES);
+ sk = (unsigned char *) sodium_malloc(crypto_kem_SECRETKEYBYTES);
+ seed = (unsigned char *) sodium_malloc(crypto_kem_SEEDBYTES);
+ ct = (unsigned char *) sodium_malloc(crypto_kem_CIPHERTEXTBYTES);
+ ss_enc = (unsigned char *) sodium_malloc(crypto_kem_SHAREDSECRETBYTES);
+ ss_dec = (unsigned char *) sodium_malloc(crypto_kem_SHAREDSECRETBYTES);
+
+ printf("primitive: %s\n", crypto_kem_primitive());
+
+ assert(crypto_kem_publickeybytes() == crypto_kem_PUBLICKEYBYTES);
+ assert(crypto_kem_secretkeybytes() == crypto_kem_SECRETKEYBYTES);
+ assert(crypto_kem_ciphertextbytes() == crypto_kem_CIPHERTEXTBYTES);
+ assert(crypto_kem_sharedsecretbytes() == crypto_kem_SHAREDSECRETBYTES);
+ assert(crypto_kem_seedbytes() == crypto_kem_SEEDBYTES);
+
+ printf("constants: ok\n");
+
+ for (i = 0; i < (int) crypto_kem_SEEDBYTES; i++) {
+ seed[i] = (unsigned char) i;
+ }
+ crypto_kem_seed_keypair(pk, sk, seed);
+
+ assert(crypto_kem_enc(ct, ss_enc, pk) == 0);
+ assert(crypto_kem_dec(ss_dec, ct, sk) == 0);
+
+ if (memcmp(ss_enc, ss_dec, crypto_kem_SHAREDSECRETBYTES) != 0) {
+ printf("ERROR: shared secrets don't match!\n");
+ } else {
+ printf("shared secrets match: ok\n");
+ }
+
+ crypto_kem_keypair(pk, sk);
+ assert(crypto_kem_enc(ct, ss_enc, pk) == 0);
+ assert(crypto_kem_dec(ss_dec, ct, sk) == 0);
+
+ if (memcmp(ss_enc, ss_dec, crypto_kem_SHAREDSECRETBYTES) != 0) {
+ printf("ERROR: shared secrets don't match (random keys)!\n");
+ } else {
+ printf("random keypair test: ok\n");
+ }
+
+ sodium_free(ss_dec);
+ sodium_free(ss_enc);
+ sodium_free(ct);
+ sodium_free(seed);
+ sodium_free(sk);
+ sodium_free(pk);
+}
+
+int
+main(void)
+{
+ tv_kem();
+
+ return 0;
+}
diff --git a/test/default/kem.exp b/test/default/kem.exp
new file mode 100644
index 00000000..b2d52334
--- /dev/null
+++ b/test/default/kem.exp
@@ -0,0 +1,4 @@
+primitive: xwing
+constants: ok
+shared secrets match: ok
+random keypair test: ok