Hybrid key exchange

Combining a classical and a post-quantum key exchange so breaking one is not enough to recover the session key.

Hybrid key exchange performs two key exchanges in one handshake — one classical, one post-quantum — and derives the session key from both.

An attacker must break both to recover the session. Breaking either alone achieves nothing.

Why not post-quantum alone

Two risks are hedged simultaneously.

Classical algorithms like X25519 are extremely well studied but fall to Shor's algorithm on a capable quantum computer.

Post-quantum algorithms like ML-KEM are believed secure against quantum attack but are young. Lattice cryptography has received serious scrutiny, though not the decades elliptic curves have had. If a classical break of ML-KEM were found, anyone who had already removed X25519 would be worse off than when they started.

Hybrid means neither failure is fatal.

Not a temporary measure

It is tempting to read hybrid as a stepping stone to discard once post-quantum algorithms are trusted. The standards do not treat it that way: NIST's draft transition guidance explicitly does not catch hybrid modes in its 2035 disallowance of quantum-vulnerable algorithms.

Hybrid is a defensible long-term position, and it is what X25519MLKEM768 provides on the web today.

Requires TLS 1.3

Hybrid groups exist only in TLS 1.3. A server limited to TLS 1.2 cannot negotiate post-quantum key exchange at all, whatever its library supports — which is why "no TLS 1.3" acts as a hard ceiling on any post-quantum readiness grade.

Related

AlgorithmX25519MLKEM768The hybrid post-quantum key exchange used by default in Chrome, Firefox, Cloudflare and OpenSSL 3.5. What it is and how to tell if you have it.TermKEMA KEM establishes a shared secret by encapsulating it to a public key, rather than combining public values as Diffie-Hellman does.FrameworkFIPS 203The NIST standard for ML-KEM, the post-quantum key encapsulation mechanism. What it covers, what it does not, and how it shows up in TLS.TermForward secrecyWhy a stolen server key should not decrypt past sessions, and why static RSA key exchange is the worst case for harvest-now-decrypt-later.

Last reviewed 2026-07-21.