X-Wing Hybrid KEM

[FAlbertDev]

This pull request introduces the X-Wing Hybrid Key Encapsulation Mechanism (KEM), which combines X25519 and ML-KEM-768 into a single KEM. The implementation uses the abstract KEM interface internally, even if only one composition is used.

The current specification of X-Wing is draft-connolly-cfrg-xwing-kem-02. Because it's still a draft, I've marked the x_wing module as experimental (i.e., configure.py --enable-experimental-features ... is required).

State of this Pull Request

This is a draft pull request as X-Wing relies on ML-KEM-768, which is not yet available in Botan. I will wait until the clean ML_KEM implementation is merged to avoid any rebase issues. Currently, the implementation uses Kyber-768 for roundtrip testing. The KATs provided in the draft have not yet been implemented.

Pull Request Dependencies

• #3893
• #4067