{
  "slug": "ml-kem",
  "name": "ML-KEM",
  "aka": "CRYSTALS-Kyber",
  "kind": "Key-encapsulation mechanism (KEM)",
  "family": "Lattice (Module-LWE)",
  "standard": "FIPS 203",
  "standard_url": "https://csrc.nist.gov/pubs/fips/203/final",
  "body": "NIST (U.S. National Institute of Standards and Technology)",
  "date": "2024-08-13",
  "status": "Final",
  "summary": "ML-KEM is the NIST-standardized post-quantum key-encapsulation mechanism, published as FIPS 203 on 2024-08-13. It is derived from CRYSTALS-Kyber and is the primary algorithm for quantum-resistant key establishment.",
  "parameter_sets": [
    {
      "name": "ML-KEM-512",
      "category": 1,
      "pk": 800,
      "sk": 1632,
      "ct_or_sig": 768
    },
    {
      "name": "ML-KEM-768",
      "category": 3,
      "pk": 1184,
      "sk": 2400,
      "ct_or_sig": 1088
    },
    {
      "name": "ML-KEM-1024",
      "category": 5,
      "pk": 1568,
      "sk": 3168,
      "ct_or_sig": 1568
    }
  ],
  "size_label": "Ciphertext",
  "deployments": [
    "TLS 1.3 hybrid key exchange X25519MLKEM768 (RFC 10024), enabled by default in Chrome, Firefox, Cloudflare, and OpenSSL 3.5+",
    "OpenSSH: mlkem768x25519-sha256 is the default key exchange since OpenSSH 10.0 (2025-04)",
    "Signal PQXDH (2023) and the post-quantum Triple Ratchet (2025)",
    "Apple iMessage PQ3 (2024)",
    "X.509 certificates: RFC 9935 (2026-03)"
  ],
  "audit_focus": [
    "Timing leaks in compression and division (the KyberSlash class of bugs found in 2023-2024 across many Kyber implementations)",
    "Correct implicit rejection in decapsulation (a rejected ciphertext must return a pseudorandom key, never an error signal)",
    "Input validation required by FIPS 203: modulus check on encapsulation keys, hash check on decapsulation keys, ciphertext length checks",
    "Constant-time NTT, sampling, and polynomial arithmetic; no secret-dependent branches or memory access",
    "Randomness: fresh 32-byte seeds per encapsulation, no reuse of d/z across key generations",
    "Hybrid combiners: shared-secret concatenation order and KDF binding to both ciphertexts, per RFC 10024 and SP 800-227",
    "Known-answer tests against the FIPS 203 final vectors (not the Round 3 Kyber vectors, which differ)"
  ],
  "references": [
    [
      "FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard",
      "https://csrc.nist.gov/pubs/fips/203/final"
    ],
    [
      "NIST SP 800-227, Recommendations for Key-Encapsulation Mechanisms (2025-09)",
      "https://csrc.nist.gov/pubs/sp/800/227/final"
    ],
    [
      "RFC 10024, Post-quantum hybrid ECDHE-MLKEM key agreement for TLS 1.3 (2026-08)",
      "https://datatracker.ietf.org/doc/rfc10024/"
    ],
    [
      "RFC 9935, ML-KEM in X.509 (2026-03)",
      "https://datatracker.ietf.org/doc/rfc9935/"
    ],
    [
      "KyberSlash timing vulnerabilities",
      "https://kyberslash.cr.yp.to/"
    ]
  ],
  "url": "https://pqaudit.org/algorithms/ml-kem/",
  "updated": "2026-09-12"
}