Applied Cryptography
Which of the following correctly describes the idea of hybrid key exchange, used during the migration to post-quantum cryptography, that combines X25519 (Diffie–Hellman key exchange using an elliptic curve) with ML-KEM?
- ABoth shared secrets obtained from the two schemes are fed into key derivation, so the resulting key is secure as long as either one is secure
- BOf the two schemes, only the shared secret of whichever finishes first in the handshake is used and the other is discarded
- CML-KEM is not used until quantum computers become a reality, and both are prepared so that the switch happens automatically when they do
Show answer and explanation
Answer: A. Both shared secrets obtained from the two schemes are fed into key derivation, so the resulting key is secure as long as either one is secure
ML-KEM is a new scheme, and the possibility of implementation errors or new attacks being found cannot yet be fully ruled out. X25519, on the other hand, is weak against quantum computers but has a long track record of security against classical computers. In hybrid key exchange both shared secrets are concatenated and fed into a key derivation function, so an attacker must break both to obtain the key, and communications recorded today are also protected against decryption by future quantum computers. As of 2025, this combination (such as X25519MLKEM768) has started to be used in TLS 1.3.
- A. Correct. Even if one is broken, the key is protected as long as the other is secure.
- B. Using only one means security is lost when that scheme is broken, defeating the purpose of combining them.
- C. To prevent recorded communications from being decrypted in the future, post-quantum cryptography must be used before quantum computers become a reality.