Hybrid TLS 1.3 key exchange (X25519MLKEM768) (ECDHE-MLKEM): standard, dates, parameters, and audit checklist
================================================================================

RFC 10024 (2026-08) standardizes hybrid post-quantum key agreement for TLS 1.3, defining the named groups X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024. X25519MLKEM768 is the default post-quantum key exchange in Chrome, Firefox, Safari, Cloudflare, OpenSSL 3.5+, and Go, and is the most widely deployed post-quantum cryptography on the internet.

Standard: RFC 10024
Standardized by: IETF TLS Working Group
Date: 2026-08
Status: Final (Proposed Standard)
Family: Hybrid: X25519 or NIST P-curves combined with ML-KEM
Parameter sets: X25519MLKEM768 (cat 3, pk 1216 B, server key share 1120 B); SecP256r1MLKEM768 (cat 3, pk 1249 B, server key share 1153 B); SecP384r1MLKEM1024 (cat 5, pk 1665 B, server key share 1665 B)
Audit focus: Key-share encoding order: X25519MLKEM768 places the ML-KEM encapsulation key before the X25519 key, the reverse of the P-curve variants. Getting this wrong is a common interop and security bug | Shared-secret concatenation order into the TLS key schedule and that both components are bound | Downgrade behavior when the peer does not support hybrid groups; HelloRetryRequest handling | ML-KEM encapsulation-key validation on the server side (modulus check) and ciphertext length checks | Middlebox and MTU issues from the 1,216-byte client key share (ClientHello now spans multiple TCP segments)
Auditors: zkSecurity, Trail of Bits, NCC Group (Cryptography Services), Cryspen, Kudelski Security, Quarkslab, Least Authority, Galois, atsec information security, Riscure (Keysight), Cure53, X41 D-Sec
Sources: https://datatracker.ietf.org/doc/rfc10024/ | https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/

Source page: https://pqaudit.org/algorithms/hybrid-tls-x25519mlkem768/
Compiled by: PQC Audit Index editors (https://pqaudit.org/about/)
Last reviewed: 2026-09-12