ML-KEM (Kyber)

ML-KEM is the most consequential piece of post-quantum cryptography deployed so far. Standardised by the United States National Institute of Standards and Technology as FIPS 203 in August 2024, and known through its long competition years as CRYSTALS-Kyber, it is the algorithm now taking over the job RSA and elliptic-curve cryptography have done for decades: agreeing a secret key between two parties who have never met.

What it does

The letters stand for Module-Lattice-based Key-Encapsulation Mechanism. A key-encapsulation mechanism solves a specific problem: your browser and a website need a shared secret key to encrypt the conversation, but everything they send to establish it is visible to anyone watching the wire.

The classical answer, Diffie-Hellman key exchange and its elliptic-curve descendants, relies on mathematics a quantum computer running Shor’s algorithm would demolish. ML-KEM does the same job using a problem quantum computers are not known to solve efficiently.

The mathematics, briefly

ML-KEM rests on lattice problems, specifically module learning with errors. A lattice is a regular grid of points stretching through many dimensions, and the underlying hard problem is that finding the grid point closest to an arbitrary position becomes intractable when the number of dimensions is large. The scheme deliberately adds small errors to its equations, and recovering the secret means separating signal from that deliberate distortion.

Crucially, no efficient quantum algorithm is known for these problems. That is a weaker statement than a proof: post-quantum cryptography is not proven unbreakable, it is built on problems that have resisted attack from both classical and quantum methods for decades.

Why it won

ML-KEM was chosen partly for security margin and partly for practicality. Its keys and ciphertexts are small enough to fit existing network protocols without redesign, and it is fast, in some configurations faster than the elliptic-curve cryptography it replaces. That combination made large-scale rollout feasible rather than merely theoretical.

Where it stands

ML-KEM is already in production at internet scale. Major browsers, content delivery networks and messaging platforms have deployed it, usually in hybrid mode: the connection is protected by ML-KEM and a classical algorithm together, so a break in either alone is not fatal. That hedge reflects sensible caution about a young standard.

For anyone planning a migration, ML-KEM is the settled answer for key exchange, paired with ML-DSA for signatures. The remaining work is not choosing an algorithm but finding every system in an organisation that uses the old ones, which is invariably the harder half of the job.