ML-KEM
acronymcryptography
Stands for: Module-Lattice Key Encapsulation Mechanism
The NIST-standardized post-quantum key-encapsulation algorithm.
Module-Lattice Key Encapsulation Mechanism (NIST FIPS 203), derived from Kyber, is a lattice-based scheme designed to resist quantum attacks. It is deployed in hybrid TLS key exchanges alongside classical ECDHE.
ML-KEM is the post-quantum key establishment algorithm NIST standardized as FIPS 203 in August 2024, derived from the CRYSTALS-Kyber submission. It replaces the key exchange half of TLS, the part currently done by elliptic curve Diffie-Hellman, whose security rests on a problem a large quantum computer would solve efficiently.
The name describes the mechanism. It is a key encapsulation mechanism rather than a key exchange: one side generates a shared secret, encapsulates it using the recipient's public key, and only the holder of the private key can decapsulate it. Security rests on the hardness of the Module Learning With Errors problem, and three parameter sets exist, ML-KEM-512, 768 and 1024, with 768 the common default.
The urgency is harvest now, decrypt later. An adversary recording encrypted traffic today can decrypt it whenever a capable quantum computer arrives, so anything requiring long-term confidentiality is already exposed regardless of when that happens. This is why deployments pair ML-KEM with a classical algorithm in hybrid mode: if the lattice assumption were ever broken, the classical half still holds, and NIST selected the code-based HQC in 2025 as a structurally different backup for exactly that reason.
Also known as: ml-kem, Kyber