# What Is Hybrid Key Exchange? Definition and Examples

> Hybrid key exchange combines a classical algorithm such as X25519 with a post-quantum KEM such as ML-KEM, so the result is secure unless both are broken.

Source: https://ssl.sh/glossary/hybrid-key-exchange/
Last updated: 2026-11-10

Hybrid key exchange runs a classical and a post-quantum key establishment together and derives the session keys from both results. In TLS 1.3 each hybrid is simply a new named group: the key_share carries the concatenated classical and post-quantum values, and the two shared secrets are concatenated before entering the HKDF key schedule. Registered examples include [X25519MLKEM768](https://ssl.sh/glossary/x25519mlkem768/), SecP256r1MLKEM768 and SecP384r1MLKEM1024.

## Why it matters
Post-quantum algorithms are young, and their cryptanalysis is less mature than that of elliptic curves. SIKE, a candidate in NIST's process, was broken in 2022 by an attack that ran on an ordinary computer. A hybrid hedges in both directions: the classical part ([ECDHE](https://ssl.sh/glossary/ecdhe/)) protects against an undiscovered flaw in the post-quantum algorithm or its implementation, and the [ML-KEM](https://ssl.sh/glossary/ml-kem/) part protects against a future quantum computer. The costs are larger handshake messages, over a kilobyte extra, and a small amount of extra computation.

## Example
An illustrative TLS 1.3 negotiation with a hybrid group:

```text
ClientHello
  supported_groups: X25519MLKEM768, X25519, secp256r1
  key_share:        X25519MLKEM768 (1,216 bytes), X25519 (32 bytes)
ServerHello
  key_share:        X25519MLKEM768 (1,120 bytes)
shared secret = ML-KEM-768 secret || X25519 secret -> TLS 1.3 key schedule
```

## Common misconceptions
- **"Hybrid is weaker than pure post-quantum."** It is designed so that an attacker must break both components; it is at least as strong as the stronger one.
- **"Hybrid key exchange also makes certificates post-quantum."** It covers only key establishment; signatures are a separate migration.
- **"Turning it on is a flag day."** Clients offer hybrid and classical groups side by side, and servers without hybrid support keep negotiating X25519 or P-256.

## Related terms

- [X25519MLKEM768](https://ssl.sh/zh/glossary/x25519mlkem768/): X25519MLKEM768 是把经典的 X25519 与后量子算法 ML-KEM-768 组合起来的 TLS 1.3 混合密钥交换群，Chrome 从 131 版起使用。
- [ML-KEM](https://ssl.sh/zh/glossary/ml-kem/): ML-KEM 是 NIST 于 2024 年 8 月在 FIPS 203 中标准化的后量子密钥封装机制，源自 CRYSTALS-Kyber，用于抗量子的密钥建立。
- [ECDHE](https://ssl.sh/zh/glossary/ecdhe/): ECDHE 是椭圆曲线上的临时 Diffie-Hellman 密钥交换，TLS 双方每次握手都生成新的椭圆曲线密钥对，并据此协商出共享密钥。
- [后量子密码](https://ssl.sh/zh/glossary/post-quantum-cryptography/): 后量子密码（PQC）是专为抵御大规模量子计算机攻击而设计的公钥密码算法，用来替代可能被量子计算机破解的 RSA 和 ECC。
- [密钥交换](https://ssl.sh/zh/glossary/key-exchange/): 密钥交换是 TLS 握手中客户端与服务器建立共享秘密的步骤，保护连接的对称密钥都由这个共享秘密派生而来。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。