Commit 2dba5eaa64

@@ -274,18 +274,18 @@ fn Kyber(comptime p: Params) type {
                 g.update(&pk.hpk);
                 g.final(&kr);
 
-                // c = innerEncrypy(pk, m, r)
+                // c = innerEncrypt(pk, m, r)
                 const ct = pk.pk.encrypt(&m, kr[32..64]);
 
-                // Compute H(c) and put in second slot of kr, which will be (K', H(c)).
-                sha3.Sha3_256.hash(&ct, kr[32..], .{});
-
                 if (p.ml_kem) {
                     return EncapsulatedSecret{
                         .shared_secret = kr[0..shared_length].*, // ML-KEM: K = K'
                         .ciphertext = ct,
                     };
                 } else {
+                    // Compute H(c) and put in second slot of kr, which will be (K', H(c)).
+                    sha3.Sha3_256.hash(&ct, kr[32..], .{});
+
                     var ss: [shared_length]u8 = undefined;
                     sha3.Shake256.hash(&kr, &ss, .{});
                     return EncapsulatedSecret{