What is ML-KEM (CRYSTALS-Kyber, FIPS 203)?
ML-KEM — standardized by NIST in 2024 as FIPS 203, based on CRYSTALS-Kyber — is the primary post-quantum key encapsulation mechanism (KEM). It replaces the elliptic-curve and RSA key exchange that establishes the shared secrets behind almost every encrypted connection, both of which a large quantum computer would break with Shor’s algorithm.
What a KEM does
A KEM is how two parties agree on a shared secret over an insecure channel. With ML-KEM, one side publishes a public key; the other encapsulates a random secret to it, producing a ciphertext; the first side decapsulates the ciphertext to recover the same secret. That shared secret then keys a symmetric cipher like AES. It is the post-quantum replacement for Diffie-Hellman and RSA key transport — same job, quantum-resistant math.
The practical numbers
For ML-KEM-768, the security level most implementations default to, the public key is about 1.2 KB, the ciphertext about 1.1 KB, and the shared secret 32 bytes. That is larger than classical key exchange, so you budget a little extra handshake bandwidth, but operations are fast. Security rests on the Module Learning-With-Errors problem, which has no known efficient quantum attack.
Deploy it in hybrid mode
The prudent default today is hybrid: combine ML-KEM with a classical key exchange so the session is secure unless both are broken. You lose nothing against classical attackers and gain protection against quantum ones. ML-KEM is resistant to known classical and quantum attacks per NIST — a rigorous standard, not a permanent guarantee — and it is the key-exchange half of the migration you can adopt now.
Try it yourself — live, free, verifiable in 30 seconds:
Use ML-KEM via the PQC API →