> Key exchange in TLS 1.3 is phrased in terms of Diffie-Hellman key exchange in a group. DH key exchange can be modeled as a KEM, with `KeyGen` corresponding to selecting an exponent $x$ as the secret key and computing the public key $g^x$; encapsulation corresponding to selecting an exponent $y$, computing the ciphertext $g^y$ and the shared secret $g^{xy}$, and decapsulation as computing the shared secret $g^{xy}$. Connolly (2024), ["ML-KEM Post-Quantum Key Agreement for TLS 1.3"](https://datatracker.ietf.org/doc/html/draft-connolly-tls-mlkem-key-agreement-05#section-6.2-2)