What is hybrid key exchange?
Hybrid key exchange combines a traditional method, usually elliptic-curve X25519, with a post-quantum one, usually ML-KEM, so that a connection stays secure as long as either of them holds. It's how most early post-quantum protection actually reaches people: major browsers and large networks turned it on by default during 2024 and 2025. In August 2026 the main hybrid options for TLS 1.3, the protocol behind secure web and API connections, were published as an internet standard, RFC 10024.
Why combine two methods
Traditional key exchange is well tested but would fall to a capable quantum computer. ML-KEM is designed to resist one, but it's newer, and new implementations can have bugs. Combining them means an attacker would have to break both. It's a hedge for the transition years, while confidence in the new algorithms and their implementations builds.
| What it protects against | |
|---|---|
| Traditional only (X25519) | Today's attackers, but not a future quantum computer |
| Post-quantum only (ML-KEM) | Both, provided the new algorithm and its implementation hold up |
| Hybrid (X25519 + ML-KEM) | Both, as long as either part holds |
What it looks like in practice
RFC 10024 defines three combinations for TLS 1.3: X25519 with ML-KEM-768, which is the one browsers use most widely; the NIST P-256 curve with ML-KEM-768; and P-384 with ML-KEM-1024. The cost is size, roughly an extra kilobyte each way when a connection starts. That's usually unnoticeable, but some older network equipment has mishandled the larger first message.
A connection only gets hybrid protection when both ends support it and agree to use it. For a bank, that means checking servers, load balancers, inspection appliances, partner connections and vendor products, not just browsers.
Common confusions
- "Hybrid means half quantum-safe." No. Against recorded traffic, a correctly negotiated hybrid is designed to be protected by its ML-KEM part.
- "Hybrid signatures are the same thing." No. Combining signatures, for example in certificates, is a separate problem and less settled than hybrid key exchange.
- "Everyone agrees hybrids are permanent." Security agencies differ on whether hybrids should be required long-term or are a transition step.
Sources and further reading
Tags show what kind of source each one is (how sources are used). Checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- StandardRFC 10024: Post-Quantum Traditional (PQ/T) Hybrid Key Agreement Mechanisms for TLS 1.3IETF, 2026
- StandardFIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)NIST, 2024
- Company announcementProtecting Chrome traffic with hybrid Kyber KEMChromium blog, 2023
- Company announcementThe state of the post-quantum InternetCloudflare, 2024