Can a KEM shared secret be used directly as a symmetric key? As an example, both Classic-McEliece and Kyber KEMs produce 32 byte shared secrets. How convenient since that's exactly the size I need for an AES-256 key!
Is this safe to do? My question can be formalized into these (I believe) equivalent questions about the definition of KEMs (I'm mostly interested in NIST Round 3 PQC KEMs, but more general answers are ok too)

Does an $X$-bit KEM shared secret contain $X$ bits of entropy?
Are the bits of a KEM shared secret guaranteed to be IID?
Can a KEM shared secret be used directly as a symmetric key?


Background to explain how I arrived at this question; not actually part of the question.
I am expecting the answer to be &quot;No, you need to run the SS though a KDF&quot;, but I'm looking for citations to back that up. That would align with this answer that @poncho gave about ECDH, which would also be true of DH, but maybe those are not formally KEMs?:

Can a raw ECDH shared secret be used directly for encryption?
The algorithms you mentioned use a secure hash function to derive this convenient 32-byte shared secret, but it is not necessarily true that all KEMs will do so. The answer to your three general questions would thus be all &quot;it depends on the actual algorithm&quot;. In general, they use KDFs.
The Kyber KEM submission, for example, uses SHAKE-256:

As a modification in round-2, we decided to derive the final key using SHAKE-256 instead of SHA3-256. This is an advantage for protocols that need keys of more than 256 bits. Instead of first requesting a 256-bit key from Kyber and then expanding it, they can pass an additional key-length parameter to Kyber and obtain a key of the desired length. This feature is not supported by the NIST API, so in our implementations we set the keylength to a fixed length of 32 bytes in api.h.

The McEliece submission uses the same hash function:

3.1 Parameter set kem/mceliece348864
KEM with $m = 12$, $n = 3488$, $t = 64$, $\ell = 256$.
Field polynomial $f(z) = z^{12} + z^3 + 1$.
Hash function: SHAKE256 with 32-byte output.
This parameter set is proposed and implemented in this submission.