# What is ML-KEM?

ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism, FIPS 203) is the post-quantum method for agreeing a secret key over an open network, and the one you will meet first. It grew out of the CRYSTALS-Kyber submission. One side publishes a public key; the other uses it to wrap a fresh random secret, and only the holder of the private key can unwrap it. That secret then keys fast symmetric encryption such as AES. It comes in three sizes, ML-KEM-512, ML-KEM-768 and ML-KEM-1024, with 768 the common default. It is fast, often comparable to elliptic curves, but its public key and ciphertext are each around a kilobyte, against 32 bytes for X25519. That size is why some old firewalls and middleboxes struggle with post-quantum handshakes. In TLS, ML-KEM usually appears combined with X25519 as the hybrid group X25519MLKEM768, which is what most browsers already offer.

FAQ: [Post-quantum cryptography](https://netsenx.com/en/faq/pqc) · https://netsenx.com/en/faq/what-is-ml-kem

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/features
- https://netsenx.com/en/blog/2026-10-27_harvest-now-decrypt-later

## Related questions

- [What are ML-DSA and SLH-DSA?](https://netsenx.com/en/faq/what-are-ml-dsa-and-slh-dsa)
- [What are HQC and FN-DSA?](https://netsenx.com/en/faq/what-are-hqc-and-fn-dsa)
- [What is hybrid key exchange (X25519MLKEM768)?](https://netsenx.com/en/faq/what-is-hybrid-key-exchange-x25519mlkem768)
- [Is quantum key distribution an alternative to post-quantum cryptography?](https://netsenx.com/en/faq/is-quantum-key-distribution-an-alternative-to-pqc)
- [What does harvest now, decrypt later mean?](https://netsenx.com/en/faq/what-is-harvest-now-decrypt-later)