Core engineering and protocols for Ephemeral Key Lifecycle & Scrubbing.
Unlike classical ECC private keys which require only 32 bytes of storage, an ML-KEM-768 private key occupies 2,400 bytes, dramatically expanding the attack surface for memory remanence, swap paging, and inadvertent core dumps. MLKEMKey wraps key generation inside locked memory enclaves with non-dumpable flags.
Standard memset calls are frequently optimized away by optimizing compilers (GCC/Clang) when the buffer is no longer referenced. MLKEMKey utilizes assembly-level memory barriers and volatile function pointers to guarantee that all intermediate polynomial vectors, seeds, and NTT scratch buffers are thoroughly overwritten with zeros.