# What Is X25519MLKEM768? Definition and Examples

> X25519MLKEM768 is a hybrid TLS 1.3 key-exchange group that combines classical X25519 with post-quantum ML-KEM-768, used by Chrome since version 131.

Source: https://ssl.sh/glossary/x25519mlkem768/
Last updated: 2026-11-10

X25519MLKEM768 is a TLS 1.3 named group (codepoint 0x11EC), standardized in [RFC 10024](https://www.rfc-editor.org/rfc/rfc10024) (August 2026), that runs two key exchanges at once: X25519 elliptic-curve Diffie-Hellman and [ML-KEM](https://ssl.sh/glossary/ml-kem/)-768. The client's key share is an ML-KEM-768 encapsulation key followed by an X25519 public key (1,184 + 32 = 1,216 bytes); the server replies with an ML-KEM ciphertext and its own X25519 share (1,088 + 32 = 1,120 bytes). The two shared secrets are concatenated and fed into the normal TLS 1.3 key schedule.

## Why it matters
It is the most widely deployed [hybrid key exchange](https://ssl.sh/glossary/hybrid-key-exchange/) on the web. Chrome 131 (November 2024) switched to it from the earlier experimental X25519Kyber768Draft00 group, and OpenSSL supports it from version 3.5. Because breaking the result requires breaking both X25519 and ML-KEM-768, it protects today's traffic against future quantum decryption without betting everything on a young algorithm. It exists only in [TLS 1.3](https://ssl.sh/glossary/tls-1-3/); servers that do not support it simply negotiate plain X25519 or P-256.

## Example
Check support from the command line (OpenSSL 3.5 or later), and prefer it in nginx built against such an OpenSSL:

```bash
openssl s_client -connect example.com:443 -groups X25519MLKEM768
```

```nginx
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1;
```

In Chrome, the DevTools Security panel shows X25519MLKEM768 as the key exchange when it is negotiated.

## Common misconceptions
- **"It makes the connection fully quantum-safe."** It protects key establishment; server authentication still uses classical RSA or ECDSA signatures.
- **"Hybrid means only half as strong."** An attacker must break both components, so it is at least as hard to break as either one alone.
- **"It is the same as X25519Kyber768Draft00."** That was an earlier experimental group based on pre-standard Kyber, with a different codepoint.

## Related terms

- [混合密钥交换](https://ssl.sh/zh/glossary/hybrid-key-exchange/): 混合密钥交换把 X25519 等经典算法与 ML-KEM 等后量子 KEM 组合使用，只要其中一个未被攻破，得到的会话密钥就仍然安全。
- [ML-KEM](https://ssl.sh/zh/glossary/ml-kem/): ML-KEM 是 NIST 于 2024 年 8 月在 FIPS 203 中标准化的后量子密钥封装机制，源自 CRYSTALS-Kyber，用于抗量子的密钥建立。
- [ECDHE](https://ssl.sh/zh/glossary/ecdhe/): ECDHE 是椭圆曲线上的临时 Diffie-Hellman 密钥交换，TLS 双方每次握手都生成新的椭圆曲线密钥对，并据此协商出共享密钥。
- [后量子密码](https://ssl.sh/zh/glossary/post-quantum-cryptography/): 后量子密码（PQC）是专为抵御大规模量子计算机攻击而设计的公钥密码算法，用来替代可能被量子计算机破解的 RSA 和 ECC。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。
- [密钥交换](https://ssl.sh/zh/glossary/key-exchange/): 密钥交换是 TLS 握手中客户端与服务器建立共享秘密的步骤，保护连接的对称密钥都由这个共享秘密派生而来。