t.Fatal(err)
	}
	c, Ke, err := Encapsulate(dk.EncapsulationKey())
	if err != nil {
		t.Fatal(err)
	}
	Kd, err := Decapsulate(dk, c)
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Equal(Ke, Kd) {
		t.Fail()
	}

	dk1, err := GenerateKey()
	if err != nil {
		t.Fatal(err)
	}
	if bytes.Equal(dk.EncapsulationKey(), dk1.EncapsulationKey()) {
		t.Fail()
	}

func Encapsulate(encapsulationKey []byte) (ciphertext, sharedKey []byte, err error) {
	// The actual logic is in a separate function to outline this allocation.
	var cc [CiphertextSize]byte
	return encapsulate(&cc, encapsulationKey)
}

func encapsulate(cc *[CiphertextSize]byte, encapsulationKey []byte) (ciphertext, sharedKey []byte, err error) {
	if len(encapsulationKey) != EncapsulationKeySize {

		t.Fatalf("got %x, want %x", ss, exp)
	}
}

func TestKyberEncapsulate(t *testing.T) {
	dk, err := mlkem768.GenerateKey()
	if err != nil {
		t.Fatal(err)
	}
	ct, ss, err := kyberEncapsulate(dk.EncapsulationKey())
	if err != nil {
		t.Fatal(err)
	}
	dkSS, err := kyberDecapsulate(dk, ct)
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Equal(ss, dkSS) {
		t.Fatalf("got %x, want %x", ss, dkSS)
	}

			// both, as allowed by draft-ietf-tls-hybrid-design-09, Section 3.2.
			hello.keyShares = []keyShare{
				{group: x25519Kyber768Draft00, data: append(keyShareKeys.ecdhe.PublicKey().Bytes(),
					keyShareKeys.kyber.EncapsulationKey()...)},
				{group: X25519, data: keyShareKeys.ecdhe.PublicKey().Bytes()},
			}
		} else {
			if _, ok := curveForCurveID(curveID); !ok {