# kyber_length_leak.py - Leaks secret key bit based on ciphertext length
import random

# Simulate encapsulation: ciphertext length depends on message bit
def encapsulate(pk, bit):
    # In a flawed implementation, the ciphertext size varies based on a secret bit
    if bit:
        return b'\x00' * 800  # long ciphertext
    else:
        return b'\x00' * 768  # short ciphertext

# Attacker observes lengths
lengths = []
for _ in range(100):
    ct = encapsulate(None, random.randint(0,1))
    lengths.append(len(ct))
# Histogram reveals two clusters -> secret bit leakage
print("Ciphertext lengths leak secret bit.")

python kyber_length_leak.py