FIPS 203 Illustrated
FIPS 203 Illustrated is a visual walkthrough of how ML-KEM works, one animation per step, from the polynomial arithmetic underneath it to the full key exchange on top. It’s the companion to the written FIPS 203 (ML-KEM) reference: the reference gives you the precise mechanics and citations, and this page lets you watch each one happen.
The short version:
- ML-KEM’s math lives in a polynomial ring, and the animations build it up one layer at a time: the ring, the fast multiplication trick, the noise, and then the KEM around all of it.
- The NTT is the speed trick that turns an expensive polynomial multiplication into cheap pointwise products.
- The security rests on one relation you can see:
t = As + e, the secret’s structure hidden under a cloak of noise. - The Fujisaki-Okamoto transform is what upgrades a simple encryption routine into a KEM that stands up to an attacker who submits chosen ciphertexts.
- Every animation traces to its exact step in NIST FIPS 203, and the values shown are teaching-scale so each one stays readable.
Each section below is one step, with the animation and a short explanation. Watch them in order for the full arc, or jump to the one you came for.
How does ML-KEM multiply polynomials?
ML-KEM packs its numbers into polynomials and multiplies them. In the teaching-scale ring R = Z[x]/(X⁴+1) shown here, two polynomials multiply into a longer one, which then folds back down into the ring (ML-KEM itself uses degree 256). Multiplying two degree-n polynomials the schoolbook way costs on the order of n² coefficient products, which is the cost the next step drives down.
Why does the ring wrap around with a sign flip?
The ring is negacyclic: X⁴ ≡ −1, so a term that runs off the top comes back with its sign flipped. A full lap around the ring returns with a flip, and the truest picture of that half-twist is a Möbius strip, one surface with a single half-turn. That sign flip is the reason the arithmetic behaves the way it does.
How does the NTT make multiplication fast?
The Number-Theoretic Transform (FIPS 203 Algorithm 9) fans a polynomial through log2(n) rounds of butterfly mixing. For ML-KEM’s 256 coefficients that’s 8 rounds. Each butterfly takes two values (a, b) and produces (a + ζb, a − ζb), where ζ is a root of unity, so multiplying by it is a clean rotation.
Once both polynomials sit in the NTT domain, the expensive multiplication collapses into cheap coordinate-by-coordinate products. That’s the payoff: the same result as schoolbook multiplication, at a fraction of the work.
Where does ML-KEM’s noise come from?
The security depends on small, controlled noise sampled from a centered binomial distribution (SamplePolyCBD, FIPS 203 §4.2.2). Each noise value is nothing but a run of coin flips, usually landing small and near zero. Watch thousands of them pile into the centered bell that hides the secret.
How does the public key hide the secret?
The public key is the relation t = As + e. The secret s combined with the public matrix A gives a structured quantity As, and structure can be unraveled, so a cloak of noise e gets thrown over it. What gets published is t. An attacker holds A and t and still can’t tear the noise off to reach s. That hardness is the Module Learning With Errors problem, and it’s the security the whole scheme stands on.
How does ML-KEM encrypt and recover a message?
K-PKE encryption (FIPS 203 §5.2) lifts the message into a polynomial μ, each bit a coefficient, then adds it into a large noisy quantity. The result v reads like pure noise, with the message buried inside it.
Decryption (FIPS 203 §5.3) reverses it with the secret key. It builds the exact anti-noise from s, sweeps it through v to leave w ≈ μ, and rounds each coefficient back to a bit. Alice’s message comes back out.
Why are ML-KEM ciphertexts compressed?
Compression (Compress_d, FIPS 203 §4.2.1) keeps only 2^d evenly-spaced positions on the coefficient wheel, and each coefficient snaps to its nearest one. Fewer positions means fewer bits per coefficient, so the ciphertext shrinks. The sliver each value jumps when it snaps becomes rounding error that joins the noise budget, so it has to stay small enough that decryption still succeeds. ML-KEM uses du of 10 or 11 and dv of 4 or 5.
How does ML-KEM stand up to chosen-ciphertext attacks?
The Fujisaki-Okamoto transform is the wax seal. Encapsulation hashes the public key to a fingerprint H(ek), lays the random message m and that fingerprint together, and derives the shared secret and the encryption randomness in one stroke as (K, r) = G(m ‖ H(ek)), where G is SHA3-512 and H is SHA3-256. Binding r to m by hashing means a valid ciphertext could only have been produced honestly, which is what closes the door on chosen-ciphertext manipulation.
How does decapsulation reject a bad ciphertext?
Decapsulation (FIPS 203 §6.3) re-encrypts the message it recovers and compares the rebuilt ciphertext to the one it received. If they match coefficient for coefficient, the ciphertext is genuine and out comes the true shared secret K. If a single coefficient differs, decapsulation returns a pseudorandom K̄ = J(z ‖ c) instead, where J is SHAKE256 and z is a secret baked into the decapsulation key. This is implicit rejection: accepted and rejected runs look identical, and a forgery is never announced.
How does the whole exchange fit together?
The full KEM is a public lockbox. Bob runs key generation and publishes an open box ek that anyone can snap shut, keeping the one key dk that opens it. Alice seals a fresh shared secret inside, and the closed box is the ciphertext c. The locked box crosses the open channel where an eavesdropper sees it and can’t open it. Bob opens it with dk and lifts out the very same secret. The ring, the noise, the lattice, the cloak, and the seal all live inside this one exchange.
The sequence at a glance
| Step | Animation shows | FIPS 203 anchor |
|---|---|---|
| Polynomial multiplication | Multiply in the ring, fold back mod X⁴+1 | §2.4.5 |
| Negacyclic ring | X⁴ ≡ −1, the Möbius half-twist | §2.4.4 |
| Forward NTT | log2(n) rounds of butterflies, 8 for n=256 | Algorithm 9 |
| NTT multiplication | Cheap pointwise products in the spectrum | §2.4.5 |
| CBD sampling | Coin flips piling into the centered bell | §4.2.2 |
| Key generation | The relation t = As + e, structure under noise | §5.1 |
| K-PKE encryption | Message μ buried in a noisy quantity | §5.2 |
| K-PKE decryption | w = v − sᵀu ≈ μ, rounded back to bits | §5.3 |
| Compression | Coefficients snapping to 2^d notches | §4.2.1 |
| FO transform | (K, r) = G(m ‖ H(ek)), the binding seal | §6.2 |
| Decapsulation | Re-encrypt, compare, implicit rejection | §6.3 |
| Full exchange | KeyGen, Encaps, Decaps as a lockbox | §6.1 to §6.3 |
For the precise mechanics, the parameter sizes, and every citation, see the written reference at FIPS 203 (ML-KEM).
A note from me
The order on this page is my own. When I first tried to learn FIPS 203 in the sequence the standard lays it out, the pieces didn’t click for me, so I’ve taken the liberty of rearranging them into the order that actually built my understanding, from the arithmetic underneath up to the full key exchange.
I made these animations because I needed them. I have complete aphantasia, a blind mind’s eye, so I can’t picture any of this in my head. The only way I could truly understand FIPS 203 was to code every step into a Manim render and watch it move, and once they existed it was obvious they’d help anyone else trying to see how this works.
I’m building a render for every concept here, and more are on the way, so check back. Each one takes a long time to code and get right, so if these helped you, tell me which topics you want next. Your recommendations are how I decide what to build first, and I genuinely appreciate your patience while I make them.
Everything here is the map, given freely. When your team needs ML-KEM sized and sequenced into your own protocols and estate, that’s the work I do.
Last verified 26 July 2026 · Updated 25 August 2026 · Maintained by Addie LaMarr, LaMarr Labs. Animations from the LaMarr Labs FIPS 203 series, each traced to its step in NIST FIPS 203.