ML-KEM is the Module-Lattice-Based Key Encapsulation Mechanism, standardised by NIST as FIPS 203 in August 2024. It began life as CRYSTALS-Kyber, the winner of NIST's post-quantum standardisation process for key establishment.
ML-KEM-768 is the middle parameter set, targeting roughly the security of AES-192. It is the size used in the hybrid TLS group X25519MLKEM768.
What it replaces
Classical key exchange — RSA, Diffie-Hellman, and elliptic-curve variants like X25519 and P-256 — relies on factoring or discrete logarithms. Shor's algorithm solves both efficiently on a sufficiently large quantum computer.
ML-KEM instead rests on the hardness of problems over module lattices, for which no efficient quantum algorithm is known.
Parameter sets
| Parameter set | Approximate security | Typical use | |---|---|---| | ML-KEM-512 | AES-128 | Constrained environments | | ML-KEM-768 | AES-192 | The general-purpose default, used in TLS | | ML-KEM-1024 | AES-256 | Required by CNSA 2.0 |
Note the difference: ML-KEM-768 is what the web has converged on, while CNSA 2.0 requires ML-KEM-1024 for US national security systems. If you are subject to CNSA 2.0, the browser default is not sufficient.
It is a KEM, not a key exchange
A key encapsulation mechanism works differently from Diffie-Hellman. Rather than both parties combining public values, the client sends a public encapsulation key, and the server uses it to encapsulate a randomly generated shared secret.
This is why ML-KEM key shares are large: an ML-KEM-768 encapsulation key is 1,184 bytes, against 32 for X25519. In a hybrid TLS handshake the combined client share is 1,216 bytes, which is enough to push a ClientHello past a single packet — a practical reason some middleboxes struggle with post-quantum handshakes.
Deployment
ML-KEM is rarely deployed alone. In TLS it is almost always paired with a classical exchange in a hybrid group, so a failure in either component is survivable. Pure post-quantum key exchange codepoints exist in draft form but have essentially no production deployment today.