FIPS 203 is the NIST Federal Information Processing Standard for ML-KEM, the Module-Lattice-Based Key Encapsulation Mechanism. It was published in August 2024 alongside FIPS 204 (ML-DSA, signatures) and FIPS 205 (SLH-DSA, hash-based signatures).
It is the standard that made post-quantum key establishment deployable rather than experimental.
What it specifies
Three parameter sets — ML-KEM-512, ML-KEM-768 and ML-KEM-1024 — derived from CRYSTALS-Kyber with changes made during standardisation. Implementations following the earlier Kyber drafts are not FIPS 203 compliant, which is why the draft TLS codepoints are distinct from the standardised ones.
If a scan reports a host negotiating X25519Kyber768Draft00, that host has
post-quantum protection but is running a pre-standard implementation and should
migrate to the standardised group.
What it does not specify
FIPS 203 defines the KEM. It does not say how to use it in TLS. The hybrid TLS groups that combine ML-KEM with a classical exchange are specified separately in the IETF's ECDHE-MLKEM work, which is where X25519MLKEM768 and its codepoint come from.
This is a common source of confusion in compliance conversations: "we support FIPS 203" and "our TLS endpoints negotiate post-quantum key exchange" are different claims, and only the second is observable from outside.
Hybrid and FIPS
A hybrid construction combining an approved post-quantum algorithm with a classical one is generally acceptable under NIST's transition guidance, and hybrid modes are explicitly not caught by the 2035 disallowance of quantum-vulnerable algorithms in the IR 8547 draft.
Hybrid is a destination you can stay at for a long time, not a waypoint you must hurry through.