X25519MLKEM768 is a hybrid key exchange for TLS 1.3. It performs two key exchanges at once — classical X25519 and post-quantum ML-KEM-768 — and combines both results into the session key.
It is the single most important thing to look for when assessing post-quantum
readiness, because it is what the major browsers and CDNs actually negotiate
today. Its IANA codepoint is 0x11EC.
Why hybrid rather than post-quantum alone
The session is secure if either component holds.
That matters in both directions. ML-KEM is young by cryptographic standards, and a lattice break would be catastrophic if it were the only protection. X25519 is extremely well studied but falls to Shor's algorithm on a sufficiently capable quantum computer. Combining them means an attacker must break both.
This is also why hybrid deployment is not a half-measure to be replaced later. NIST's draft transition guidance explicitly does not catch hybrid modes in its 2035 disallowance of quantum-vulnerable algorithms.
What it protects against
Classical key exchange is exposed to harvest-now-decrypt-later: an attacker records the encrypted session today and decrypts it years later once quantum hardware matures. The recording happens now, so the exposure is present tense.
A session that negotiated X25519MLKEM768 cannot be opened that way. Traffic captured today stays closed.
How to tell whether you have it
You need TLS 1.3. Hybrid groups do not exist below it, so a server that only speaks TLS 1.2 cannot negotiate post-quantum key exchange at all, regardless of configuration.
Supporting it is not the same as using it. A server can have the group enabled but still prefer classical X25519, in which case ordinary clients get no post-quantum protection. What matters is what is negotiated by default, not what appears in a configuration file.
Getting it
Broadly, you need a TLS stack built against OpenSSL 3.5 or later, BoringSSL, or Go 1.24+, and TLS 1.3 enabled. Many CDNs and load balancers enable it by default once the underlying stack supports it — if you terminate TLS at a CDN, you may already have it at the edge while origin connections remain classical.