Algorithm 3 IND-CCA KEM Encapsulation

Input public key pk Output ciphertext c; shared key K   1: randomly chosen m   2: m = H(m)   3: ($\stackrel{-}{K}$, r)= G(m, pk)   4: c = IND-CPA PKE Encryption(pk, m, r)   5: K = KDF($\stackrel{-}{K}$||H(c))   6: return K