ML-KEM explained in five minutes

In August 2024, the US National Institute of Standards and Technology published FIPS 203, the standard for ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism). You may know it under its earlier name, CRYSTALS-Kyber. It is the algorithm QuorVault uses to make key exchange resistant to quantum computers.

What a KEM does

A key-encapsulation mechanism lets two parties end up with the same secret key, even if everything they send each other is observed. It has three steps:

• Key generation: the recipient creates a public key and a private key.
• Encapsulation: the sender uses the public key to produce a ciphertext and a shared secret.
• Decapsulation: the recipient uses the private key on the ciphertext and recovers the same shared secret.

Why lattices resist quantum computers

RSA and elliptic curves rely on problems (factoring, discrete logarithms) that Shor's algorithm solves efficiently on a quantum computer. ML-KEM relies on a different problem: learning with errors over module lattices. Roughly, it's about recovering a secret from a set of linear equations to which small random errors have been added. No efficient algorithm, classical or quantum, is known for it.

ML-KEM-768 in numbers

• Public key: 1,184 bytes.
• Ciphertext: 1,088 bytes.
• Shared secret: 32 bytes.
• Security category 3 in NIST's classification, roughly comparable to AES-192.

The keys are larger than with elliptic curves (32 bytes for X25519), but the computation is very fast, often faster than classical algorithms.

Why combine it with X25519

ML-KEM is recent. It has been studied intensively, but X25519 has a much longer track record. Hybrid encryption runs both key exchanges and derives the final key from both secrets, here with HKDF-SHA256. An attacker then has to break both: X25519 for today's security, ML-KEM for tomorrow's. This is the approach recommended by several European security agencies during the transition, including France's ANSSI.

Hybrid means you never trade proven security for new security. You add them.

Want to see it run? Our Lab encrypts a value with ML-KEM-768 + X25519 + AES-256-GCM directly in your browser.