# 40. `example_composite_mlkem.py` — Composite ML-KEM key encapsulation
[← Example index](index.md) · [`example_composite_mlkem.py` on Codeberg](https://codeberg.org/abbra/synta/src/branch/main/examples/example_composite_mlkem.py)
Bindings: `PrivateKey.generate_composite_kem`, `PublicKey.composite_kem_encapsulate`,
`PrivateKey.composite_kem_decapsulate`, `PrivateKey.to_der`, `PrivateKey.from_der`,
`CertificateBuilder`, `Certificate.public_key_algorithm` /
`Certificate.public_key_algorithm_oid`, `synta.oids` composite ML-KEM constants
(`COMPOSITE_KEM_ARC`, `MLKEM768_RSA2048_SHA3_256` … `MLKEM1024_ECDH_P521_SHA3_256`).
Requires the `openssl` + `pqc` Cargo features (OpenSSL 3.2+ with ML-KEM support).
Unlike composite ML-DSA, there is no NSS backend for composite ML-KEM.
- Verify all 12 composite ML-KEM OID constants in `synta.oids` (`COMPOSITE_KEM_ARC`
prefix, sub-arcs 55–66) against their expected dotted-decimal values.
- Generate a composite ML-KEM private key with
`PrivateKey.generate_composite_kem(sub_arc)` for each of the 12 variants (RSA-OAEP,
ECDH, X25519, X448); show a `SKIP` line (instead of an assertion error) when the
current build does not support a variant.
- Round-trip each generated key through PKCS#8 DER (`to_der()` / `from_der()`);
assert byte equality.
- Encapsulate with `PublicKey.composite_kem_encapsulate()` and decapsulate with
`PrivateKey.composite_kem_decapsulate(ciphertext)`; assert both sides agree on a
32-byte shared secret.
- Perform a detailed walk-through of sub-arc 59 (MLKEM768-ECDH-P256-SHA3-256):
- Print PKCS#8 DER length and SPKI length, and the ciphertext length.
- Confirm independently generated keypairs produce different shared secrets.
- Embed the composite ML-KEM public key as a certificate's `SubjectPublicKeyInfo`,
signed by a separate classical (EC P-256) CA key — a KEM key cannot sign, so the
signing and subject keys are necessarily different algorithms.
- Verify `Certificate.public_key_algorithm_oid` matches `1.3.6.1.5.5.7.6.<sub_arc>`
and `Certificate.public_key_algorithm` reports the friendly composite name.
- Confirm the certificate DER round-trip via `Certificate.from_der`.