ML-KEM
A post-quantum key encapsulation mechanism (KEM) standardized by NIST, based on the module learning with errors problem. It is used to replace traditional key exchange algorithms such as RSA.
Core Facts
Timeline (last 90 days)
For data in transit, the established migration pattern is hybrid key establishment: performing both a classical exchange (ECDH) and a post-quantum exchange (ML-KEM) and deriving the session key from both.
FIPS 203 (ML-KEM) is derived from CRYSTALS-Kyber and is used for key encapsulation, replacing the key exchange role currently played by ECDH and RSA.
The security of ML-KEM and ML-DSA is built on mathematical hard problems such as the 'shortest vector problem on lattices,' which to date are both quantum-resistant and have not been significantly accelerated by AI-based attacks.
JEP 527 builds post-quantum key exchange directly into TLS 1.3 and the JDK, adding hybrid key exchange for TLS 1.3 by running both X25519 and ML-KEM simultaneously and combining the shared secrets.
ML-KEM and ML-DSA use Module-LWE as their core construction; Module-LWE is a structured variant of LWE that improves computational efficiency and reduces key sizes.
The OpenJDK community has begun planning JEPs aimed at integrating NIST standard algorithms such as ML-KEM and ML-DSA as native implementations into the standard library.
ML-KEM was formerly known as CRYSTALS-Kyber and is a lattice-based key encapsulation mechanism; ML-DSA was formerly known as CRYSTALS-Dilithium and is a lattice-based digital signature algorithm; SLH-DSA was formerly known as SPHINCS+ and is a hash-based digital signature scheme.
All Facts (8)
NIST formally published three post-quantum cryptography Federal Information Processing Standards (FIPS) in August 2024.
65%UnverifiedFor data in transit, the established migration pattern is hybrid key establishment: performing both a classical exchange (ECDH) and a post-quantum exchange (ML-KEM) and deriving the session key from both.
50%UnverifiedFIPS 203 (ML-KEM) is derived from CRYSTALS-Kyber and is used for key encapsulation, replacing the key exchange role currently played by ECDH and RSA.
50%UnverifiedThe security of ML-KEM and ML-DSA is built on mathematical hard problems such as the 'shortest vector problem on lattices,' which to date are both quantum-resistant and have not been significantly accelerated by AI-based attacks.
50%UnverifiedJEP 527 builds post-quantum key exchange directly into TLS 1.3 and the JDK, adding hybrid key exchange for TLS 1.3 by running both X25519 and ML-KEM simultaneously and combining the shared secrets.
50%UnverifiedThe OpenJDK community has begun planning JEPs aimed at integrating NIST standard algorithms such as ML-KEM and ML-DSA as native implementations into the standard library.
50%UnverifiedML-KEM and ML-DSA use Module-LWE as their core construction; Module-LWE is a structured variant of LWE that improves computational efficiency and reduces key sizes.
50%UnverifiedML-KEM was formerly known as CRYSTALS-Kyber and is a lattice-based key encapsulation mechanism; ML-DSA was formerly known as CRYSTALS-Dilithium and is a lattice-based digital signature algorithm; SLH-DSA was formerly known as SPHINCS+ and is a hash-based digital signature scheme.
50%