What is hybrid key exchange (X25519MLKEM768)?

Hybrid key exchange combines a classical method (X25519, an elliptic-curve exchange) with a post-quantum one (ML-KEM-768) in the same TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake, and derives the session key from both. The key stays secret as long as either method holds: if a flaw were found in the still young ML-KEM, X25519 would still keep today's attackers out; against a future quantum computer, ML-KEM would. That is why most guidance, including from European agencies such as BSI and ANSSI, prefers hybrid during the transition. X25519MLKEM768 is the name of this combination in TLS. Major browsers already offer it by default, and large content-delivery networks and many cloud services accept it, so part of your web traffic may already use it without you having changed anything. A connection that uses it makes recorded traffic far harder to decrypt later. The ones to plan for are connections that still use only classical key exchange: older servers, appliances, VPNs and internal applications.

← All 33 questions on Post-quantum cryptographyAll topics