Hybrid TLS 1.3 key exchange (X25519MLKEM768) (ECDHE-MLKEM)

Type

Protocol integration (hybrid KEM)

Family

Hybrid: X25519 or NIST P-curves combined with ML-KEM

Standard

RFC 10024

Standardized by

IETF TLS Working Group

Date

2026-08

Status

Final (Proposed Standard)

Last reviewed 2026-09-12 by the PQC Audit Index editors.

Parameter sets and sizes (bytes)

NIST security categories: 1 ≈ AES-128, 2 ≈ SHA-256 collision, 3 ≈ AES-192, 5 ≈ AES-256.

Where Hybrid TLS 1.3 key exchange (X25519MLKEM768) is deployed

• Enabled by default in Chrome 131+, Firefox 132+, Safari 26+, Go 1.24+, OpenSSL 3.5+, BoringSSL, and Cloudflare's edge
• Roughly half of all TLS connections at large CDNs already negotiate a hybrid post-quantum key exchange

What an audit of Hybrid TLS 1.3 key exchange (X25519MLKEM768) checks

• Key-share encoding order: X25519MLKEM768 places the ML-KEM encapsulation key before the X25519 key, the reverse of the P-curve variants. Getting this wrong is a common interop and security bug
• Shared-secret concatenation order into the TLS key schedule and that both components are bound
• Downgrade behavior when the peer does not support hybrid groups; HelloRetryRequest handling
• ML-KEM encapsulation-key validation on the server side (modulus check) and ciphertext length checks
• Middlebox and MTU issues from the 1,216-byte client key share (ClientHello now spans multiple TCP segments)

See the full post-quantum cryptography audit checklist.

Who audits Hybrid TLS 1.3 key exchange (X25519MLKEM768) implementations

Firms with a cryptography practice that review Hybrid TLS 1.3 key exchange (X25519MLKEM768) implementations and protocol integrations, in the order this index lists them:

1. zkSecurity — Cryptography audits: post-quantum, zero-knowledge proofs, MPC, FHE, TEEs
2. Trail of Bits — Software assurance with a dedicated cryptography practice
3. NCC Group (Cryptography Services) — Large security consultancy with a specialist Cryptography Services team
4. Cryspen — Formally verified cryptography and high-assurance post-quantum implementations
5. Kudelski Security — Cryptography audits and quantum-readiness assessments
6. Quarkslab — Reverse engineering, cryptography, and secure implementation research
7. Least Authority — Security audits of cryptographic protocols and privacy-preserving systems
8. Galois — Formal verification of cryptographic code
9. atsec information security — FIPS 140-3 and CAVP validation laboratory
10. Riscure (Keysight) — Side-channel and fault-injection evaluation of hardware implementations
11. Cure53 — Penetration testing and code audits of open-source and web software
12. X41 D-Sec — Source-code audits of open-source security and cryptographic software

Primary sources

• RFC 10024, Post-quantum hybrid ECDHE-MLKEM key agreement for TLS 1.3
• IETF TLS working group draft history

Machine-readable: data.json · summary.txt