Add initial support for MLKEM768

aws · Oct 3, 2024 · b4cc63a · b4cc63a
1 parent ead40c5
commit b4cc63a
Show file tree

Hide file tree

Showing 18 changed files with 553 additions and 172 deletions.
diff --git a/crypto/s2n_pq.c b/crypto/s2n_pq.c
@@ -33,3 +33,15 @@ bool s2n_pq_is_enabled()
 {
     return s2n_libcrypto_supports_evp_kem();
 }
+
+bool s2n_libcrypto_supports_mlkem()
+{
+    /* S2N_LIBCRYPTO_SUPPORTS_MLKEM will be auto-detected and #defined if
+     * ./tests/features/S2N_LIBCRYPTO_SUPPORTS_MLKEM.c successfully compiles
+     */
+#if defined(S2N_LIBCRYPTO_SUPPORTS_MLKEM)
+    return true;
+#else
+    return false;
+#endif
+}
diff --git a/crypto/s2n_pq.h b/crypto/s2n_pq.h
@@ -23,3 +23,4 @@
 
 bool s2n_pq_is_enabled(void);
 bool s2n_libcrypto_supports_evp_kem(void);
+bool s2n_libcrypto_supports_mlkem(void);
diff --git a/tests/unit/kats/generate_pq_hybrid_tls13_handshake_kats.py b/tests/unit/kats/generate_pq_hybrid_tls13_handshake_kats.py
@@ -208,6 +208,34 @@
         "pq_shared_secret": "B10F7394926AD3B49C5D62D5AEB531D5757538BCC0DA9E550D438F1B61BD7419",
         "transcript_hash": "35412cebcf35cb8a7af8f78278a486fc798f8702eaebd067c97acb27bffe13524d8426a4ed57956b4fd0ffdc4c90be52",
     },
+    {
+        "group_name": "X25519MLKEM768",
+        "cipher_suite": "TLS_AES_128_GCM_SHA256",
+        "ec_shared_secret": "519be87fa0599077e5673d6f2d910aa150d7fef783c5e1491961fdf63b255910",
+        "pq_shared_secret": "B408D5D115713F0A93047DBBEA832E4340787686D59A9A2D106BD662BA0AA035",
+        "transcript_hash": "f5f7f7867668be4b792159d4d194a03ec5cfa238b6409b5ca2ddccfddcc92a2b",
+    },
+    {
+        "group_name": "X25519MLKEM768",
+        "cipher_suite": "TLS_AES_256_GCM_SHA384",
+        "ec_shared_secret": "519be87fa0599077e5673d6f2d910aa150d7fef783c5e1491961fdf63b255910",
+        "pq_shared_secret": "B408D5D115713F0A93047DBBEA832E4340787686D59A9A2D106BD662BA0AA035",
+        "transcript_hash": "35412cebcf35cb8a7af8f78278a486fc798f8702eaebd067c97acb27bffe13524d8426a4ed57956b4fd0ffdc4c90be52",
+    },
+    {
+        "group_name": "SecP256r1MLKEM768",
+        "cipher_suite": "TLS_AES_128_GCM_SHA256",
+        "ec_shared_secret": "9348e27655539e08fffe46b35f863dd634e7437cc6bc11c7d329ef5484ec3b60",
+        "pq_shared_secret": "B408D5D115713F0A93047DBBEA832E4340787686D59A9A2D106BD662BA0AA035",
+        "transcript_hash": "f5f7f7867668be4b792159d4d194a03ec5cfa238b6409b5ca2ddccfddcc92a2b",
+    },
+    {
+        "group_name": "SecP256r1MLKEM768",
+        "cipher_suite": "TLS_AES_256_GCM_SHA384",
+        "ec_shared_secret": "9348e27655539e08fffe46b35f863dd634e7437cc6bc11c7d329ef5484ec3b60",
+        "pq_shared_secret": "B408D5D115713F0A93047DBBEA832E4340787686D59A9A2D106BD662BA0AA035",
+        "transcript_hash": "35412cebcf35cb8a7af8f78278a486fc798f8702eaebd067c97acb27bffe13524d8426a4ed57956b4fd0ffdc4c90be52",
+    },
 ]
 
 
@@ -233,6 +261,9 @@ def hkdf_expand_label(key: bytes, label: str, context: bytes, hash_alg: str):
 
 def compute_secrets(input_vector: dict):
     shared_secret = bytes.fromhex(input_vector["ec_shared_secret"] + input_vector["pq_shared_secret"])
+    if (input_vector["group_name"] == "X25519MLKEM768"):
+        shared_secret = bytes.fromhex(input_vector["pq_shared_secret"] + input_vector["ec_shared_secret"])
+
     hash_alg = input_vector["cipher_suite"].split("_")[-1].lower()
     zeros = bytearray([0] * hashlib.new(hash_alg).digest_size)
     transcript_hash = bytes.fromhex(input_vector["transcript_hash"])

diff --git a/tests/unit/s2n_client_key_share_extension_pq_test.c b/tests/unit/s2n_client_key_share_extension_pq_test.c
diff --git a/tests/unit/s2n_kem_preferences_test.c b/tests/unit/s2n_kem_preferences_test.c
@@ -25,6 +25,8 @@ int main(int argc, char **argv)
     BEGIN_TEST();
     EXPECT_SUCCESS(s2n_disable_tls13_in_test());
 
+    EXPECT_FALSE(s2n_kem_preferences_includes_tls13_kem_group(&kem_preferences_null, TLS_PQ_KEM_GROUP_ID_SECP256R1_MLKEM_768));
+    EXPECT_FALSE(s2n_kem_preferences_includes_tls13_kem_group(&kem_preferences_null, TLS_PQ_KEM_GROUP_ID_X25519_MLKEM_768));
     EXPECT_FALSE(s2n_kem_preferences_includes_tls13_kem_group(&kem_preferences_null, TLS_PQ_KEM_GROUP_ID_X25519_KYBER_512_R3));
     EXPECT_FALSE(s2n_kem_preferences_includes_tls13_kem_group(&kem_preferences_null, TLS_PQ_KEM_GROUP_ID_X25519_KYBER_768_R3));
     EXPECT_FALSE(s2n_kem_preferences_includes_tls13_kem_group(&kem_preferences_null, TLS_PQ_KEM_GROUP_ID_SECP256R1_KYBER_512_R3));
@@ -34,6 +36,8 @@ int main(int argc, char **argv)
 
     {
         const struct s2n_kem_group *test_kem_groups[] = {
+            &s2n_secp256r1_mlkem_768,
+            &s2n_x25519_mlkem_768,
             &s2n_secp256r1_kyber_512_r3,
             &s2n_x25519_kyber_512_r3,
             &s2n_secp384r1_kyber_768_r3,
@@ -49,6 +53,8 @@ int main(int argc, char **argv)
             .tls13_kem_groups = test_kem_groups,
         };
 
+        EXPECT_TRUE(s2n_kem_preferences_includes_tls13_kem_group(&test_prefs, TLS_PQ_KEM_GROUP_ID_SECP256R1_MLKEM_768));
+        EXPECT_TRUE(s2n_kem_preferences_includes_tls13_kem_group(&test_prefs, TLS_PQ_KEM_GROUP_ID_X25519_MLKEM_768));
         EXPECT_TRUE(s2n_kem_preferences_includes_tls13_kem_group(&test_prefs, TLS_PQ_KEM_GROUP_ID_X25519_KYBER_512_R3));
         EXPECT_TRUE(s2n_kem_preferences_includes_tls13_kem_group(&test_prefs, TLS_PQ_KEM_GROUP_ID_X25519_KYBER_768_R3));
         EXPECT_TRUE(s2n_kem_preferences_includes_tls13_kem_group(&test_prefs, TLS_PQ_KEM_GROUP_ID_SECP256R1_KYBER_512_R3));
@@ -69,13 +75,24 @@ int main(int argc, char **argv)
                 EXPECT_FALSE(s2n_kem_group_is_available(&s2n_x25519_kyber_512_r3));
                 EXPECT_FALSE(s2n_kem_group_is_available(&s2n_x25519_kyber_768_r3));
             }
+
+            if (s2n_libcrypto_supports_mlkem()) {
+                EXPECT_TRUE(s2n_kem_group_is_available(&s2n_secp256r1_mlkem_768));
+                if (s2n_is_evp_apis_supported()) {
+                    EXPECT_TRUE(s2n_kem_group_is_available(&s2n_x25519_mlkem_768));
+                } else {
+                    EXPECT_FALSE(s2n_kem_group_is_available(&s2n_x25519_mlkem_768));
+                }
+            }
         } else {
             EXPECT_FALSE(s2n_kem_group_is_available(&s2n_secp256r1_kyber_512_r3));
             EXPECT_FALSE(s2n_kem_group_is_available(&s2n_x25519_kyber_512_r3));
             EXPECT_FALSE(s2n_kem_group_is_available(&s2n_x25519_kyber_768_r3));
             EXPECT_FALSE(s2n_kem_group_is_available(&s2n_secp256r1_kyber_768_r3));
             EXPECT_FALSE(s2n_kem_group_is_available(&s2n_secp384r1_kyber_768_r3));
             EXPECT_FALSE(s2n_kem_group_is_available(&s2n_secp521r1_kyber_1024_r3));
+            EXPECT_FALSE(s2n_kem_group_is_available(&s2n_secp256r1_mlkem_768));
+            EXPECT_FALSE(s2n_kem_group_is_available(&s2n_x25519_mlkem_768));
         }
     };
 

diff --git a/tests/unit/s2n_pq_kem_test.c b/tests/unit/s2n_pq_kem_test.c
@@ -24,6 +24,7 @@
 #include "utils/s2n_safety.h"
 
 static const struct s2n_kem *test_vectors[] = {
+    &s2n_mlkem_768,
     &s2n_kyber_512_r3,
     &s2n_kyber_768_r3,
     &s2n_kyber_1024_r3,
@@ -47,6 +48,8 @@ int main()
 
     for (size_t i = 0; i < s2n_array_len(test_vectors); i++) {
         const struct s2n_kem *kem = test_vectors[i];
+        bool expect_success = s2n_libcrypto_supports_evp_kem()
+                && ((kem != &s2n_mlkem_768) || s2n_libcrypto_supports_mlkem());
 
         DEFER_CLEANUP(struct s2n_blob public_key = { 0 }, s2n_free);
         EXPECT_SUCCESS(s2n_alloc(&public_key, kem->public_key_length));
@@ -63,7 +66,7 @@ int main()
         DEFER_CLEANUP(struct s2n_blob ciphertext = { 0 }, s2n_free);
         EXPECT_SUCCESS(s2n_alloc(&ciphertext, kem->ciphertext_length));
 
-        if (s2n_pq_is_enabled()) {
+        if (expect_success) {
             /* Test a successful round-trip: keygen->enc->dec */
             EXPECT_PQ_KEM_SUCCESS(kem->generate_keypair(kem, public_key.data, private_key.data));
             EXPECT_PQ_KEM_SUCCESS(kem->encapsulate(kem, ciphertext.data, client_shared_secret.data, public_key.data));

diff --git a/tests/unit/s2n_security_policies_test.c b/tests/unit/s2n_security_policies_test.c
@@ -198,15 +198,23 @@ int main(int argc, char **argv)
         EXPECT_EQUAL(1, security_policy->kem_preferences->kem_count);
         EXPECT_NOT_NULL(security_policy->kem_preferences->kems);
         EXPECT_EQUAL(&s2n_kyber_512_r3, security_policy->kem_preferences->kems[0]);
-        EXPECT_EQUAL(security_policy->kem_preferences->tls13_kem_groups, pq_kem_groups_r3_2023_06);
+        EXPECT_EQUAL(security_policy->kem_preferences->tls13_kem_groups, pq_kem_groups_2024_10_all);
         /* All supported kem groups should be in the preference list, but not all of them may be available. */
-        EXPECT_EQUAL(6, security_policy->kem_preferences->tls13_kem_group_count);
+        EXPECT_EQUAL(8, security_policy->kem_preferences->tls13_kem_group_count);
         uint32_t available_groups = 0;
         EXPECT_OK(s2n_kem_preferences_groups_available(security_policy->kem_preferences, &available_groups));
         if (s2n_libcrypto_supports_evp_kem() && s2n_is_evp_apis_supported()) {
-            EXPECT_EQUAL(6, available_groups);
+            if (s2n_libcrypto_supports_mlkem()) {
+                EXPECT_EQUAL(8, available_groups);
+            } else {
+                EXPECT_EQUAL(6, available_groups);
+            }
         } else if (s2n_libcrypto_supports_evp_kem() && !s2n_is_evp_apis_supported()) {
-            EXPECT_EQUAL(4, available_groups);
+            if (s2n_libcrypto_supports_mlkem()) {
+                EXPECT_EQUAL(5, available_groups);
+            } else {
+                EXPECT_EQUAL(4, available_groups);
+            }
         } else {
             EXPECT_EQUAL(0, available_groups);
         }

diff --git a/tests/unit/s2n_server_key_share_extension_test.c b/tests/unit/s2n_server_key_share_extension_test.c
@@ -885,15 +885,25 @@ int main(int argc, char **argv)
                     S2N_STUFFER_READ_EXPECT_EQUAL(&stuffer, kem_group->iana_id, uint16);
                     S2N_STUFFER_READ_EXPECT_EQUAL(&stuffer, expected_hybrid_share_size, uint16);
 
-                    if (len_prefixed) {
-                        S2N_STUFFER_READ_EXPECT_EQUAL(&stuffer, kem_group->curve->share_size, uint16);
-                    }
-                    EXPECT_SUCCESS(s2n_stuffer_skip_read(&stuffer, kem_group->curve->share_size));
-
-                    if (len_prefixed) {
-                        S2N_STUFFER_READ_EXPECT_EQUAL(&stuffer, kem_group->kem->ciphertext_length, uint16);
+                    if (kem_group->send_kem_first) {
+                        if (len_prefixed) {
+                            S2N_STUFFER_READ_EXPECT_EQUAL(&stuffer, kem_group->kem->ciphertext_length, uint16);
+                        }
+                        EXPECT_SUCCESS(s2n_stuffer_skip_read(&stuffer, kem_group->kem->ciphertext_length));
+                        if (len_prefixed) {
+                            S2N_STUFFER_READ_EXPECT_EQUAL(&stuffer, kem_group->curve->share_size, uint16);
+                        }
+                        S2N_STUFFER_LENGTH_WRITTEN_EXPECT_EQUAL(&stuffer, kem_group->curve->share_size);
+                    } else {
+                        if (len_prefixed) {
+                            S2N_STUFFER_READ_EXPECT_EQUAL(&stuffer, kem_group->curve->share_size, uint16);
+                        }
+                        EXPECT_SUCCESS(s2n_stuffer_skip_read(&stuffer, kem_group->curve->share_size));
+                        if (len_prefixed) {
+                            S2N_STUFFER_READ_EXPECT_EQUAL(&stuffer, kem_group->kem->ciphertext_length, uint16);
+                        }
+                        S2N_STUFFER_LENGTH_WRITTEN_EXPECT_EQUAL(&stuffer, kem_group->kem->ciphertext_length);
                     }
-                    S2N_STUFFER_LENGTH_WRITTEN_EXPECT_EQUAL(&stuffer, kem_group->kem->ciphertext_length);
 
                     EXPECT_NULL(conn->kex_params.server_ecc_evp_params.negotiated_curve);
                     EXPECT_EQUAL(server_params->kem_group, kem_group);

diff --git a/tests/unit/s2n_tls13_hybrid_shared_secret_test.c b/tests/unit/s2n_tls13_hybrid_shared_secret_test.c
@@ -137,14 +137,16 @@ struct hybrid_test_vector {
 #define KYBER512R3_SECRET  "0A6925676F24B22C286F4C81A4224CEC506C9B257D480E02E3B49F44CAA3237F"
 #define KYBER768R3_SECRET  "914CB67FE5C38E73BF74181C0AC50428DEDF7750A98058F7D536708774535B29"
 #define KYBER1024R3_SECRET "B10F7394926AD3B49C5D62D5AEB531D5757538BCC0DA9E550D438F1B61BD7419"
+#define MLKEM768_SECRET    "B408D5D115713F0A93047DBBEA832E4340787686D59A9A2D106BD662BA0AA035"
 
-/* Hybrid shared secrets are the concatenation: ECDHE || PQ */
 #define X25519_KYBER512R3_HYBRID_SECRET     (X25519_SHARED_SECRET KYBER512R3_SECRET)
 #define X25519_KYBER768R3_HYBRID_SECRET     (X25519_SHARED_SECRET KYBER768R3_SECRET)
 #define SECP256R1_KYBER512R3_HYBRID_SECRET  (SECP256R1_SHARED_SECRET KYBER512R3_SECRET)
 #define SECP256R1_KYBER768R3_HYBRID_SECRET  (SECP256R1_SHARED_SECRET KYBER768R3_SECRET)
 #define SECP384R1_KYBER768R3_HYBRID_SECRET  (SECP384R1_SHARED_SECRET KYBER768R3_SECRET)
 #define SECP521R1_KYBER1024R3_HYBRID_SECRET (SECP521R1_SHARED_SECRET KYBER1024R3_SECRET)
+#define X25519_MLKEM768_HYBRID_SECRET       (MLKEM768_SECRET X25519_SHARED_SECRET)
+#define SECP256R1_MLKEM768_HYBRID_SECRET    (SECP256R1_SHARED_SECRET MLKEM768_SECRET)
 
 /* The expected traffic secrets were calculated from an independent Python implementation located in the KAT directory,
  * using the ECDHE & PQ secrets defined above. */
@@ -178,6 +180,16 @@ struct hybrid_test_vector {
 #define AES_256_SECP521R1_KYBER1024R3_CLIENT_TRAFFIC_SECRET "660838cb79c4852258346112f481b75463b39aec83b961cd999741d720b18c95df0c3eabc1ec6b1505703ce1925bf396"
 #define AES_256_SECP521R1_KYBER1024R3_SERVER_TRAFFIC_SECRET "19cb80a0d66c0e616891370273b92cf700d1cf32146be6402eb3de62eab6d1ce2d259b404ff29249e8c2af6df416d503"
 
+#define AES_128_SECP256R1_MLKEM768_CLIENT_TRAFFIC_SECRET "e3b086562f8dc237a9dc8710f345821c871417bd57a64a1966860f1f06bcd5dc"
+#define AES_128_SECP256R1_MLKEM768_SERVER_TRAFFIC_SECRET "eb3f47d5cc09234957543e1160dde10cc86b817f31c43d5e8af8cdd6167b0336"
+#define AES_256_SECP256R1_MLKEM768_CLIENT_TRAFFIC_SECRET "9e65803eeb8324eb5faea82be52c266e0bf8ac398f091db73a48e68ee2ff0a91915b3f1f4e9907e33543a9ebb1f7a748"
+#define AES_256_SECP256R1_MLKEM768_SERVER_TRAFFIC_SECRET "cb8fc8707f294e3ab9b98f0d873b1e1c5d740ecd254c67fcca44b5444742bf958102be17beb5c89ae08b8b31191d9137"
+
+#define AES_128_X25519_MLKEM768_CLIENT_TRAFFIC_SECRET "8bf7f5f36cdece4ca1439e14e9b585cd5c2c11753ce53733da771c89ba7d8162"
+#define AES_128_X25519_MLKEM768_SERVER_TRAFFIC_SECRET "c9221c9f9fad66ac7ae568e46695229eaf95196819c2bb997469f010075b953e"
+#define AES_256_X25519_MLKEM768_CLIENT_TRAFFIC_SECRET "44eb9e15ef082936fe7a2c169be644ff16b47fb2a91f7223069cbd8d9b063a034f0936234e60a733a30db6d7226d984d"
+#define AES_256_X25519_MLKEM768_SERVER_TRAFFIC_SECRET "852b46f0e3cdc222badc0b85f4cfb4f332c2d8ea8c9695d6024e129b5056d2c534191ee76bff50148f19a88f81897112"
+
 /* A fake transcript string to hash when deriving handshake secrets */
 #define FAKE_TRANSCRIPT "client_hello || server_hello"
 
@@ -385,6 +397,70 @@ int main(int argc, char **argv)
         .expected_server_traffic_secret = &aes_256_x25519_kyber768r3_server_secret,
     };
 
+    S2N_BLOB_FROM_HEX(mlkem768_secret, MLKEM768_SECRET);
+    S2N_BLOB_FROM_HEX(secp256r1_mlkem768_hybrid_secret, SECP256R1_MLKEM768_HYBRID_SECRET);
+    S2N_BLOB_FROM_HEX(x25519_mlkem768_hybrid_secret, X25519_MLKEM768_HYBRID_SECRET);
+
+    S2N_BLOB_FROM_HEX(aes_128_secp256r1_mlkem768_client_secret, AES_128_SECP256R1_MLKEM768_CLIENT_TRAFFIC_SECRET);
+    S2N_BLOB_FROM_HEX(aes_128_secp256r1_mlkem768_server_secret, AES_128_SECP256R1_MLKEM768_SERVER_TRAFFIC_SECRET);
+
+    const struct hybrid_test_vector aes_128_sha_256_secp256r1_mlkem768_vector = {
+        .cipher_suite = &s2n_tls13_aes_128_gcm_sha256,
+        .transcript = FAKE_TRANSCRIPT,
+        .kem_group = &s2n_secp256r1_mlkem_768,
+        .client_ecc_key = CLIENT_SECP256R1_PRIV_KEY,
+        .server_ecc_key = SERVER_SECP256R1_PRIV_KEY,
+        .pq_secret = &mlkem768_secret,
+        .expected_hybrid_secret = &secp256r1_mlkem768_hybrid_secret,
+        .expected_client_traffic_secret = &aes_128_secp256r1_mlkem768_client_secret,
+        .expected_server_traffic_secret = &aes_128_secp256r1_mlkem768_server_secret,
+    };
+
+    S2N_BLOB_FROM_HEX(aes_256_secp256r1_mlkem768_client_secret, AES_256_SECP256R1_MLKEM768_CLIENT_TRAFFIC_SECRET);
+    S2N_BLOB_FROM_HEX(aes_256_secp256r1_mlkem768_server_secret, AES_256_SECP256R1_MLKEM768_SERVER_TRAFFIC_SECRET);
+
+    const struct hybrid_test_vector aes_256_sha_384_secp256r1_mlkem768_vector = {
+        .cipher_suite = &s2n_tls13_aes_256_gcm_sha384,
+        .transcript = FAKE_TRANSCRIPT,
+        .kem_group = &s2n_secp256r1_mlkem_768,
+        .client_ecc_key = CLIENT_SECP256R1_PRIV_KEY,
+        .server_ecc_key = SERVER_SECP256R1_PRIV_KEY,
+        .pq_secret = &mlkem768_secret,
+        .expected_hybrid_secret = &secp256r1_mlkem768_hybrid_secret,
+        .expected_client_traffic_secret = &aes_256_secp256r1_mlkem768_client_secret,
+        .expected_server_traffic_secret = &aes_256_secp256r1_mlkem768_server_secret,
+    };
+
+    S2N_BLOB_FROM_HEX(aes_128_x25519_mlkem768_client_secret, AES_128_X25519_MLKEM768_CLIENT_TRAFFIC_SECRET);
+    S2N_BLOB_FROM_HEX(aes_128_x25519_mlkem768_server_secret, AES_128_X25519_MLKEM768_SERVER_TRAFFIC_SECRET);
+
+    const struct hybrid_test_vector aes_128_sha_256_x25519_mlkem768_vector = {
+        .cipher_suite = &s2n_tls13_aes_128_gcm_sha256,
+        .transcript = FAKE_TRANSCRIPT,
+        .kem_group = &s2n_x25519_mlkem_768,
+        .client_ecc_key = CLIENT_X25519_PRIV_KEY,
+        .server_ecc_key = SERVER_X25519_PRIV_KEY,
+        .pq_secret = &mlkem768_secret,
+        .expected_hybrid_secret = &x25519_mlkem768_hybrid_secret,
+        .expected_client_traffic_secret = &aes_128_x25519_mlkem768_client_secret,
+        .expected_server_traffic_secret = &aes_128_x25519_mlkem768_server_secret,
+    };
+
+    S2N_BLOB_FROM_HEX(aes_256_x25519_mlkem768_client_secret, AES_256_X25519_MLKEM768_CLIENT_TRAFFIC_SECRET);
+    S2N_BLOB_FROM_HEX(aes_256_x25519_mlkem768_server_secret, AES_256_X25519_MLKEM768_SERVER_TRAFFIC_SECRET);
+
+    const struct hybrid_test_vector aes_256_sha_384_x25519_mlkem768_vector = {
+        .cipher_suite = &s2n_tls13_aes_256_gcm_sha384,
+        .transcript = FAKE_TRANSCRIPT,
+        .kem_group = &s2n_x25519_mlkem_768,
+        .client_ecc_key = CLIENT_X25519_PRIV_KEY,
+        .server_ecc_key = SERVER_X25519_PRIV_KEY,
+        .pq_secret = &mlkem768_secret,
+        .expected_hybrid_secret = &x25519_mlkem768_hybrid_secret,
+        .expected_client_traffic_secret = &aes_256_x25519_mlkem768_client_secret,
+        .expected_server_traffic_secret = &aes_256_x25519_mlkem768_server_secret,
+    };
+
     const struct hybrid_test_vector *all_test_vectors[] = {
         &aes_128_sha_256_secp256r1_kyber512r3_vector,
         &aes_256_sha_384_secp256r1_kyber512r3_vector,
@@ -398,6 +474,10 @@ int main(int argc, char **argv)
         &aes_256_sha_384_secp521r1_kyber1024r3_vector,
         &aes_128_sha_256_x25519_kyber768r3_vector,
         &aes_256_sha_384_x25519_kyber768r3_vector,
+        &aes_128_sha_256_secp256r1_mlkem768_vector,
+        &aes_256_sha_384_secp256r1_mlkem768_vector,
+        &aes_128_sha_256_x25519_mlkem768_vector,
+        &aes_256_sha_384_x25519_mlkem768_vector,
     };
 
     EXPECT_EQUAL(s2n_array_len(all_test_vectors), (2 * S2N_KEM_GROUPS_COUNT));