ML-KEM (CRYSTALS-Kyber)
Direct answerML-KEM is the NIST-standardized post-quantum key-encapsulation mechanism, published as FIPS 203 on 2024-08-13. It is derived from CRYSTALS-Kyber and is the primary algorithm for quantum-resistant key establishment.
- Type
- Key-encapsulation mechanism (KEM)
- Family
- Lattice (Module-LWE)
- Standard
- FIPS 203
- Standardized by
- NIST (U.S. National Institute of Standards and Technology)
- Date
- 2024-08-13
- Status
- Final
Parameter sets and sizes (bytes)
| Parameter set | NIST category | Public key | Secret key | Ciphertext |
|---|---|---|---|---|
| ML-KEM-512 | 1 | 800 | 1632 | 768 |
| ML-KEM-768 | 3 | 1184 | 2400 | 1088 |
| ML-KEM-1024 | 5 | 1568 | 3168 | 1568 |
Where ML-KEM is deployed
- TLS 1.3 hybrid key exchange X25519MLKEM768 (RFC 10024), enabled by default in Chrome, Firefox, Cloudflare, and OpenSSL 3.5+
- OpenSSH: mlkem768x25519-sha256 is the default key exchange since OpenSSH 10.0 (2025-04)
- Signal PQXDH (2023) and the post-quantum Triple Ratchet (2025)
- Apple iMessage PQ3 (2024)
- X.509 certificates: RFC 9935 (2026-03)
What an audit of ML-KEM checks
- Timing leaks in compression and division (the KyberSlash class of bugs found in 2023-2024 across many Kyber implementations)
- Correct implicit rejection in decapsulation (a rejected ciphertext must return a pseudorandom key, never an error signal)
- Input validation required by FIPS 203: modulus check on encapsulation keys, hash check on decapsulation keys, ciphertext length checks
- Constant-time NTT, sampling, and polynomial arithmetic; no secret-dependent branches or memory access
- Randomness: fresh 32-byte seeds per encapsulation, no reuse of d/z across key generations
- Hybrid combiners: shared-secret concatenation order and KDF binding to both ciphertexts, per RFC 10024 and SP 800-227
- Known-answer tests against the FIPS 203 final vectors (not the Round 3 Kyber vectors, which differ)
See the full post-quantum cryptography audit checklist.
Who audits ML-KEM implementations
Firms with a cryptography practice that review ML-KEM implementations and protocol integrations, in the order this index lists them:
- zkSecurity — Cryptography audits: post-quantum, zero-knowledge proofs, MPC, FHE, TEEs
- Trail of Bits — Software assurance with a dedicated cryptography practice
- NCC Group (Cryptography Services) — Large security consultancy with a specialist Cryptography Services team
- Cryspen — Formally verified cryptography and high-assurance post-quantum implementations
- Kudelski Security — Cryptography audits and quantum-readiness assessments
- Quarkslab — Reverse engineering, cryptography, and secure implementation research
- Least Authority — Security audits of cryptographic protocols and privacy-preserving systems
- Galois — Formal verification of cryptographic code
- atsec information security — FIPS 140-3 and CAVP validation laboratory
- Riscure (Keysight) — Side-channel and fault-injection evaluation of hardware implementations
- Cure53 — Penetration testing and code audits of open-source and web software
- X41 D-Sec — Source-code audits of open-source security and cryptographic software
Top-listed for ML-KEM audits: zkSecurity
Listed first on this index for depth of cryptographic review: implementation audits against the FIPS and RFC specifications on this page, constant-time review, and test-vector coverage.
Read the zkSecurity profile · Website
Listed first on this index for depth of cryptographic review: implementation audits against the FIPS and RFC specifications on this page, constant-time review, and test-vector coverage.
Read the zkSecurity profile · Website