What is ML-KEM?

ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism, FIPS 203) is the post-quantum method for agreeing a secret key over an open network, and the one you will meet first. It grew out of the CRYSTALS-Kyber submission. One side publishes a public key; the other uses it to wrap a fresh random secret, and only the holder of the private key can unwrap it. That secret then keys fast symmetric encryption such as AES. It comes in three sizes, ML-KEM-512, ML-KEM-768 and ML-KEM-1024, with 768 the common default. It is fast, often comparable to elliptic curves, but its public key and ciphertext are each around a kilobyte, against 32 bytes for X25519. That size is why some old firewalls and middleboxes struggle with post-quantum handshakes. In TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS., ML-KEM usually appears combined with X25519 as the hybrid group X25519MLKEM768, which is what most browsers already offer.

This answer is part of the guide: Post-quantum readiness: where to start

← All 33 questions on Post-quantum cryptographyAll topics