# What Is ML-KEM? Definition and Examples

> ML-KEM is the post-quantum key-encapsulation mechanism standardized by NIST in FIPS 203 (August 2024), derived from CRYSTALS-Kyber.

Source: https://ssl.sh/glossary/ml-kem/
Last updated: 2026-11-10

ML-KEM is a key-encapsulation mechanism (KEM) whose security rests on the Module Learning With Errors lattice problem. A KEM has three operations: key generation produces an encapsulation key and a decapsulation key; encapsulation takes the encapsulation key and outputs a ciphertext plus a 32-byte shared secret; decapsulation recovers the same secret from the ciphertext with the decapsulation key. FIPS 203 defines three parameter sets, ML-KEM-512, ML-KEM-768 and ML-KEM-1024, in increasing order of strength.

## Why it matters
ML-KEM is the main [post-quantum](https://ssl.sh/glossary/post-quantum-cryptography/) algorithm for TLS key establishment, deployed inside the hybrid group [X25519MLKEM768](https://ssl.sh/glossary/x25519mlkem768/), which Chrome has used since version 131. It is computationally fast; its cost is size. An ML-KEM-768 encapsulation key is 1,184 bytes, compared with 32 bytes for an X25519 public key, so the ClientHello grows by more than a kilobyte. During rollout, some middleboxes and servers that mishandled larger ClientHello messages had to be fixed.

## Example
Sizes of the three parameter sets in FIPS 203:

```text
Parameter set   Encapsulation key   Ciphertext    Shared secret
ML-KEM-512      800 bytes           768 bytes     32 bytes
ML-KEM-768      1,184 bytes         1,088 bytes   32 bytes
ML-KEM-1024     1,568 bytes         1,568 bytes   32 bytes
```

## Common misconceptions
- **"ML-KEM is just Kyber with a new name."** The final FIPS 203 standard differs in details from earlier Kyber versions and does not interoperate with them, which is why Chrome moved from the X25519Kyber768Draft00 group to X25519MLKEM768.
- **"A KEM works exactly like Diffie-Hellman."** In a KEM one side encapsulates to the other's public key rather than both sides contributing symmetric shares; TLS carries the encapsulation key in the client's key_share and the ciphertext in the server's.
- **"ML-KEM makes certificates quantum-safe."** It protects key establishment only; authentication still depends on signatures, for which [ML-DSA](https://ssl.sh/glossary/ml-dsa/) is the post-quantum standard.

## Related terms

- [后量子密码](https://ssl.sh/zh/glossary/post-quantum-cryptography/): 后量子密码（PQC）是专为抵御大规模量子计算机攻击而设计的公钥密码算法，用来替代可能被量子计算机破解的 RSA 和 ECC。
- [X25519MLKEM768](https://ssl.sh/zh/glossary/x25519mlkem768/): X25519MLKEM768 是把经典的 X25519 与后量子算法 ML-KEM-768 组合起来的 TLS 1.3 混合密钥交换群，Chrome 从 131 版起使用。
- [混合密钥交换](https://ssl.sh/zh/glossary/hybrid-key-exchange/): 混合密钥交换把 X25519 等经典算法与 ML-KEM 等后量子 KEM 组合使用，只要其中一个未被攻破，得到的会话密钥就仍然安全。
- [密钥交换](https://ssl.sh/zh/glossary/key-exchange/): 密钥交换是 TLS 握手中客户端与服务器建立共享秘密的步骤，保护连接的对称密钥都由这个共享秘密派生而来。
- [ML-DSA](https://ssl.sh/zh/glossary/ml-dsa/): ML-DSA 是 NIST 于 2024 年 8 月在 FIPS 204 中标准化的基于格的后量子数字签名算法，源自 CRYSTALS-Dilithium。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。