How Public Key Encryption (PKE) Differs From Key Encapsulation Methods (KEMs)

I got into a big debate today with someone who just didn’t understand the difference between PKE and KEM, so here’s a basic explanation. Overall, KEM is used to replace our existing PKE (such as with RSA OAEP) and Key Exchange methods (such as ECDH). So first, we have RSA encryption:

The process is:

• Key generation: (pk,sk) := Gen()⁡.
• Encapsulation: c := Enc(m,pk)
• Decapsulation: m:= Dec(sk,c)

With this, Alice generates a key pair, and passes her public key to Bob. Bob then generates a message (m) and encrypts the message with Alice’s public key. Bob passes the cipher to Alice, and who decrypts with her private key. Of course, Bob could have generated an encryption key instead of a message, which is a way to pass a secret key. For KEM, we do not use a message as the input data, but where a secret will be generated from the encapsulation of Alice’s public key:

• Key generation: (pk,sk) := Gen()⁡.
• Encapsulation: (k,c) := Encap(pk)
• Decapsulation: k:= Decap(sk,c)