Archivecryptography
ML-KEM: The Post-Quantum Key Exchange Standard
Kyber became ML-KEM. Here is what changes in a TLS handshake and why hybrid mode is the migration path.
- Published
- Reading time
- 1 min read
ML-KEM (FIPS 203, derived from CRYSTALS-Kyber) is a lattice-based key encapsulation mechanism. It replaces the Diffie-Hellman role in a hybrid handshake: X25519 for classical security, ML-KEM for post-quantum.
The mechanics
- Key generation: public key (encapsulation key) and secret key.
- Encapsulation: sender produces a ciphertext and a shared secret using the public key.
- Decapsulation: recipient recovers the same shared secret.
Security rests on module-learning-with-errors hardness, not factoring or discrete logs.
Hybrid deployment
shared = KDF(X25519(sk, pk) || ML-KEM.Decaps(ct, sk))
The hybrid is secure if either component is. TLS 1.3 has a defined hybrid group (X25519MLKEM768), and major browsers already negotiate it.
Caveats
- Larger keys and ciphertexts (roughly 1–1.5 KB) than X25519.
- Side-channel resistance depends on constant-time implementations.
- Store-and-now-decrypt-later is the threat; migrate before the quantum computer exists.
Takeaway: adopt hybrid ML-KEM now where the stack supports it. The cost is bytes and CPU, not a protocol redesign.