pub fn decapsulate(c: &[u8], sk: &Zeroizing<[u8; 1518]>) -> Zeroizing<[u8; 32]>Expand description
Decapsulate c using sk. Returns the shared secret, zeroized on drop.
sk must be a Zeroizing-wrapped secret key (exactly what keypair()
returns) rather than a bare &[u8], so the type system rules out
passing a secret key that was never protected by Zeroizing in the
first place; its length is therefore already guaranteed by the type,
with nothing left to check at runtime.
Per the Streamlined NTRU Prime KEM spec this always returns some 32-byte value, even for an invalid/malformed ciphertext (implicit rejection) – it does not signal failure via the return value, by design, to avoid a decryption-failure oracle.