Post-quantumRecommended
ML-KEM (FIPS 203)
Post-quantum key encapsulation
How it works
ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) is derived from CRYSTALS-Kyber. A sender uses the recipient's public key to encapsulate a random shared secret, which only the private key can recover. Its security rests on lattice problems that are not known to be solvable efficiently by quantum computers.
Sizes: Parameter sets ML-KEM-512, ML-KEM-768 and ML-KEM-1024
Status: Finalised by NIST in August 2024; often deployed in hybrid with ECDH.
Strengths
- Designed to resist both classical and quantum attacks
- Fast, with keys and ciphertexts of a manageable size
- Already deployed in hybrid TLS key exchange by major browsers and providers
Weaknesses and known attacks
- Much less real-world history than RSA and ECC
- Larger keys and ciphertexts than ECDH
- Implementations still need side-channel care
Use it for
- Key establishment that must stay confidential for many years (counters 'harvest now, decrypt later')
Don't use it for
- Signatures (use ML-DSA or SLH-DSA)
Exam tip
ML-KEM replaces key exchange/encapsulation (the job of RSA and ECDH). Remember: FIPS 203 = ML-KEM = Kyber.