ML-KEM — the new key exchange

Every time your browser connects to a website over HTTPS, something remarkable happens before a single byte of content is transferred: your browser and the server must agree on a shared secret key, a string of random bits that will be used to encrypt everything that follows, over a channel that an attacker could be watching. The attacker can see every message exchanged during this negotiation. Yet somehow, at the end of it, both sides know a secret that the attacker does not.

This is the key exchange problem. RSA and Diffie-Hellman (ECDH) solve it today using mathematical problems, prime factoring and discrete logarithms, that are hard for classical computers but easy for a quantum computer running Shor's algorithm. ML-KEM solves the same problem using a different mathematical foundation: the hardness of certain problems involving lattices, which quantum computers cannot solve efficiently.

A KEM is slightly different from classic Diffie-Hellman key exchange, though it accomplishes the same goal. In ECDH, both parties contribute randomness and the shared secret emerges from their interaction. In a KEM, the sender generates the shared secret, encrypts it under the recipient's public key, and sends the ciphertext. The recipient decrypts it. The shared secret is then used as the key material for a symmetric cipher (like AES). The result is the same: both parties share a secret that no eavesdropper can compute.

ML-KEM has three operations: key generation, encapsulation, and decapsulation. Walk through each step below.

The table below compares the two approaches across the dimensions that matter most for migration planning.

The larger key and ciphertext sizes are the main practical implication of ML-KEM. Public keys are roughly 4× larger than RSA-2048 public keys and far larger than EC keys. In most TLS handshake contexts this adds a small but measurable overhead, typically one extra network round trip in constrained environments. For most applications, this is an acceptable trade-off. For IoT devices, smart cards, and other constrained hardware, key size is a genuine design constraint that Unit 4 addresses in detail.

When you see ML-KEM deployed in TLS today, it is almost always deployed in "hybrid" mode, combining ML-KEM with a classical algorithm like X25519. A typical hybrid key share label is X25519MLKEM768. This means the TLS handshake performs both a classical ECDH key exchange and an ML-KEM encapsulation, then combines both shared secrets cryptographically.

The reason for hybrid deployment is belt-and-suspenders security during the transition period. If a catastrophic weakness were found in ML-KEM, a scenario considered unlikely but not impossible for a relatively new standard, the classical component would still protect the session. Conversely, the ML-KEM component protects against Shor's algorithm. A session protected by both is secure against both classical and quantum adversaries, and against unknown weaknesses in either algorithm alone.

Hybrid mode is not permanent. As confidence in ML-KEM grows and the deprecation of classical algorithms takes effect post-2030, deployments will transition to ML-KEM-only. But for now, hybrid is the responsible deployment strategy, and it is what you should expect to see in any serious PQC TLS deployment.

You do not need to understand the mathematics deeply to work with ML-KEM. But a plain-language picture of why it is hard for quantum computers to break is worth having, because you will be asked this question.

A lattice is a regular, grid-like arrangement of points in many dimensions. Imagine a chessboard, a two-dimensional lattice of squares. Now imagine that same structure in 256 dimensions. The hard problem ML-KEM uses is called the Learning With Errors (LWE) problem: given a noisy version of a set of linear equations over this lattice, find the hidden solution. The "with errors" part is critical, small random noise is added to every equation, which makes finding the exact answer dramatically harder.

Why can't quantum computers solve this efficiently? Shor's algorithm works by exploiting the periodic structure of factoring and discrete logarithm problems, it finds patterns. LWE problems do not have that exploitable periodic structure. The best known quantum algorithms for LWE offer no meaningful advantage over classical algorithms. This is why lattice-based cryptography is the leading candidate for post-quantum security: the problems it relies on appear to be hard for both classical and quantum computation.