Algorithm 4 IND-CCA KEM Decapsulation

Input private key skKEM = (sk, pk, H(pk), z); ciphertext c Output shared key K   1: m′ = IND-CPA PKE Decryption(sk, c)   2: ($\stackrel{-}{K^{\prime }}$, r′) = G(m′, H(pk))   3: c′ = IND-CPA PKE Encryption(pk, m′, r′)   4: if c′ = c     return K = KDF($\stackrel{-}{K^{\prime }}$||H(c))   5: else     return K = KDF(z$\left|\right|$H(c))