English
Menu

What is ML-KEM?

A lattice-based key encapsulation mechanism (KEM) standardized by the US NIST in August 2024 as FIPS 203. The name stands for Module-Lattice-Based Key-Encapsulation Mechanism, and it is based on CRYSTALS-Kyber. Its security rests on the difficulty of the Module-LWE problem, recovering a secret from a system of linear equations with small errors added, which is believed to be hard even for quantum computers. There are three parameter sets: ML-KEM-512, ML-KEM-768 and ML-KEM-1024. It is used in protocols such as TLS to replace, or be combined with, ECDHE key exchange.

Japanese name: ML-KEM

ML-KEM appears in 7 practice questions across 3 topics, including Applied Cryptography, Hardware Security: Advanced Topics and Trends, Quantum Computing Hardware.

Field: Applied Cryptography

What a key encapsulation mechanism is

A KEM consists of three operations: key generation, encapsulation and decapsulation. The sender encapsulates with the recipient's public key, obtaining a random shared secret together with a ciphertext that wraps it, and sends the ciphertext. The recipient decapsulates with the private key and obtains the same shared secret. Unlike Diffie–Hellman key exchange, the sender does not need a long-term key pair of its own.

Typical sizes

For ML-KEM-768 the public key (encapsulation key) is 1,184 bytes, the ciphertext 1,088 bytes and the shared secret 32 bytes. The public value of the elliptic-curve key exchange X25519 is 32 bytes, so much more data is sent. The computation itself, on the other hand, is light and is said to be no slower than elliptic-curve key exchange.

Hybrid use

As a hedge against concerns about a new scheme, hybrid key exchange that feeds both the X25519 and the ML-KEM-768 shared secrets into key derivation (such as X25519MLKEM768) has started to be used in TLS 1.3 as of 2025. As long as either one is secure, the resulting key is protected.

Try it: questions about ML-KEM

Which of the following correctly describes how a key encapsulation mechanism (KEM) such as ML-KEM is used?

  1. AThe sender signs the shared secret with its own private key and sends it, and the receiver verifies the signature with the sender's public key and receives the secret
  2. BThe sender creates a shared secret and a ciphertext wrapping it from the receiver's public key, and the receiver extracts the same secret with its private key
  3. CThe sender and receiver hold the same symmetric key in advance and encrypt messages directly with it
Show answer and explanation

Answer: B. The sender creates a shared secret and a ciphertext wrapping it from the receiver's public key, and the receiver extracts the same secret with its private key

A KEM consists of three operations: key generation, encapsulation and decapsulation. The sender encapsulates with the receiver's public key, obtaining a random shared secret together with a ciphertext that wraps it, and sends only the ciphertext. The receiver decapsulates with its private key to obtain the same shared secret, after which they use symmetric-key encryption with keys based on it. A KEM is a mechanism for sharing keys, so a separate signature such as ML-DSA is used to authenticate the other party.

Which of the following correctly describes the idea of hybrid key exchange, used during the migration to post-quantum cryptography, that combines X25519 (Diffie–Hellman key exchange using an elliptic curve) with ML-KEM?

  1. ABoth shared secrets obtained from the two schemes are fed into key derivation, so the resulting key is secure as long as either one is secure
  2. BOf the two schemes, only the shared secret of whichever finishes first in the handshake is used and the other is discarded
  3. CML-KEM is not used until quantum computers become a reality, and both are prepared so that the switch happens automatically when they do
Show answer and explanation

Answer: A. Both shared secrets obtained from the two schemes are fed into key derivation, so the resulting key is secure as long as either one is secure

ML-KEM is a new scheme, and the possibility of implementation errors or new attacks being found cannot yet be fully ruled out. X25519, on the other hand, is weak against quantum computers but has a long track record of security against classical computers. In hybrid key exchange both shared secrets are concatenated and fed into a key derivation function, so an attacker must break both to obtain the key, and communications recorded today are also protected against decryption by future quantum computers. As of 2025, this combination (such as X25519MLKEM768) has started to be used in TLS 1.3.

FAQ

Can ML-KEM be used for signatures?

No. ML-KEM is a mechanism for sharing keys. For post-quantum signatures, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), standardized together with it in August 2024, are used.

Is it the same as quantum key distribution (QKD)?

No. ML-KEM rests on the difficulty of a mathematical problem and runs unchanged on ordinary computers and networks. Quantum key distribution shares keys by using quantum properties of photons and the like, and needs dedicated equipment and channels.

ML-KEM in the explanations

Questions that mention ML-KEM (7)

  1. Which of the following correctly describes how a key encapsulation mechanism (KEM) such as ML-KEM is used?
  2. Which of the following correctly describes the idea of hybrid key exchange, used during the migration to post-quantum cryptography, that combines X25519 (Diffie–Hellman key exchange using an elliptic curve) with ML-KEM?
  3. The public key of ML-KEM-768 is 1,184 bytes and its ciphertext 1,088 bytes, while the public value of the elliptic-curve key exchange X25519 is 32 bytes. How many times larger than the X25519 public value is the ML-KEM-768 public key?
  4. In ML-KEM decapsulation, the ciphertext is rebuilt from the result of decrypting the received ciphertext with the private key and compared with the received ciphertext. Which is a correct implementation precaution for this part?
  5. Which correctly describes post-quantum cryptography (PQC)?
  6. Which of the following correctly pairs the post-quantum cryptography standards published by the US NIST in August 2024 with their types?
  7. Lattice-based post-quantum cryptography repeatedly multiplies polynomials of degree n = 256. If the naive method of multiplying every pair of coefficients needs about n² multiplications and the method using the number-theoretic transform (NTT) needs about n log₂ n, which is closest to the factor by which the NTT reduces the number of multiplications?

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

Comparisons that include this term

Related terms

Post-quantum cryptography Diffie–Hellman key exchange TLS Shor's algorithm RSA cryptosystem Elliptic-curve cryptography Digital signature Number-theoretic transform Fast Fourier transform (FFT) Modulo operation

Back to the glossary