What is ML-KEM?
ML-KEM is NIST's principal standardised post-quantum key-encapsulation mechanism, used for agreeing on secret keys. NIST published it in August 2024 as FIPS 203. It does the job that elliptic-curve and RSA key exchange do today, letting two systems that have never met agree on a shared secret over an open network, but it's designed to resist attacks by quantum computers as well as ordinary ones. It runs on ordinary computers; no quantum hardware is involved. For organisations, the practical task is to find where key establishment happens and check which systems and partners can support it.
What the name means
ML stands for module lattice, the family of mathematical problems it's built on. KEM stands for key encapsulation mechanism: one side uses the other's public key to wrap up a fresh random secret, and only the holder of the matching private key can unwrap it. The result is a shared secret that both sides then use with fast symmetric encryption such as AES. ML-KEM was developed from an algorithm called CRYSTALS-Kyber, which won NIST's open international competition.
How it compares with today's key exchange
| Elliptic curve (X25519) | ML-KEM-768 | |
|---|---|---|
| Public key size | 32 bytes | 1,184 bytes |
| Speed | Fast | Also fast |
| Resists a quantum computer | No: broken by Shor's algorithm | Designed to |
FIPS 203 defines three parameter sets, ML-KEM-512, ML-KEM-768 and ML-KEM-1024, trading size for security margin. ML-KEM-768 is the common middle choice. NIST's FIPS 203 page also lists errata, including a correction planned for a future revision, so implementers should check it.
Where it's used already
Most early deployments use a hybrid: ML-KEM combined with a traditional method, most commonly X25519, so a connection stays secure as long as either one holds. Major browsers and large networks switched hybrid key agreement on by default during 2024 and 2025. A connection only gets that protection when both ends support it and agree to use it, so coverage depends on servers, apps and corporate networks catching up.
ML-KEM is the main fix for harvest now, decrypt later. When it's correctly implemented and actually negotiated, alone or in a hybrid, recorded traffic is designed to stay protected against future quantum attacks. That depends on the whole protocol and implementation, not the algorithm alone.
What ML-KEM doesn't do
- Signatures. Proving who sent something is a different job, handled by ML-DSA (FIPS 204) and SLH-DSA (FIPS 205).
- Encrypting bulk data. That stays with symmetric algorithms like AES.
- Guarantees forever. Like all cryptography, it remains under public analysis. That's why NIST selected HQC in 2025 for standardisation as a backup built on different mathematics, with a final standard expected around 2027, and why crypto-agility matters.
Common confusions
- "ML-KEM is quantum cryptography." No. It's ordinary software. Quantum cryptography, such as quantum key distribution, is a different thing.
- "Hybrid is a NIST standard." The individual algorithms are standardised; how to combine them is covered by transition guidance and internet standards.
- "Kyber and ML-KEM are identical." ML-KEM is the standardised version, with small changes from the competition entry, so implementations should target FIPS 203.
Sources and further reading
Tags show what kind of source each one is (how sources are used). Checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- StandardFIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)NIST, 2024
- StandardNIST releases first 3 finalized post-quantum encryption standardsNIST, 2024
- StandardNIST selects HQC as fifth algorithm for post-quantum encryptionNIST, 2025
- Company announcementProtecting Chrome traffic with hybrid Kyber KEMChromium blog, 2023
- Company announcementThe state of the post-quantum InternetCloudflare, 2024