{
  "slug": "hybrid-tls-x25519mlkem768",
  "name": "Hybrid TLS 1.3 key exchange (X25519MLKEM768)",
  "aka": "ECDHE-MLKEM",
  "kind": "Protocol integration (hybrid KEM)",
  "family": "Hybrid: X25519 or NIST P-curves combined with ML-KEM",
  "standard": "RFC 10024",
  "standard_url": "https://datatracker.ietf.org/doc/rfc10024/",
  "body": "IETF TLS Working Group",
  "date": "2026-08",
  "status": "Final (Proposed Standard)",
  "summary": "RFC 10024 (2026-08) standardizes hybrid post-quantum key agreement for TLS 1.3, defining the named groups X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024. X25519MLKEM768 is the default post-quantum key exchange in Chrome, Firefox, Safari, Cloudflare, OpenSSL 3.5+, and Go, and is the most widely deployed post-quantum cryptography on the internet.",
  "parameter_sets": [
    {
      "name": "X25519MLKEM768",
      "category": 3,
      "pk": 1216,
      "sk": "n/a",
      "ct_or_sig": 1120
    },
    {
      "name": "SecP256r1MLKEM768",
      "category": 3,
      "pk": 1249,
      "sk": "n/a",
      "ct_or_sig": 1153
    },
    {
      "name": "SecP384r1MLKEM1024",
      "category": 5,
      "pk": 1665,
      "sk": "n/a",
      "ct_or_sig": 1665
    }
  ],
  "size_label": "Server key share",
  "deployments": [
    "Enabled by default in Chrome 131+, Firefox 132+, Safari 26+, Go 1.24+, OpenSSL 3.5+, BoringSSL, and Cloudflare's edge",
    "Roughly half of all TLS connections at large CDNs already negotiate a hybrid post-quantum key exchange"
  ],
  "audit_focus": [
    "Key-share encoding order: X25519MLKEM768 places the ML-KEM encapsulation key before the X25519 key, the reverse of the P-curve variants. Getting this wrong is a common interop and security bug",
    "Shared-secret concatenation order into the TLS key schedule and that both components are bound",
    "Downgrade behavior when the peer does not support hybrid groups; HelloRetryRequest handling",
    "ML-KEM encapsulation-key validation on the server side (modulus check) and ciphertext length checks",
    "Middlebox and MTU issues from the 1,216-byte client key share (ClientHello now spans multiple TCP segments)"
  ],
  "references": [
    [
      "RFC 10024, Post-quantum hybrid ECDHE-MLKEM key agreement for TLS 1.3",
      "https://datatracker.ietf.org/doc/rfc10024/"
    ],
    [
      "IETF TLS working group draft history",
      "https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/"
    ]
  ],
  "url": "https://pqaudit.org/algorithms/hybrid-tls-x25519mlkem768/",
  "updated": "2026-09-12"
}