Short answer: ML-KEM is the post-quantum key-establishment method standardised by NIST in FIPS 203 (13 August 2024). It lets two parties agree on a shared secret key over a public network in a way that is designed to resist quantum attack, and it replaces RSA and elliptic curve key exchange in this role.
Two computers that have never met need to agree on a secret key over an open network. That is the first step of almost every secure connection you use, from online banking to a company VPN. Today it is done with RSA or elliptic curve methods. A large quantum computer is expected to break both.
What ML-KEM is
NIST published FIPS 203 on 13 August 2024. It standardises ML-KEM, which stands for Module-Lattice-Based Key-Encapsulation Mechanism. The design is derived from CRYSTALS-Kyber, one of the candidates that came through NIST's multi-year public selection process.
A key-encapsulation mechanism, or KEM, is a set of algorithms that lets two parties establish a shared secret key over a public channel. In simple terms:
- The receiver creates a pair of keys, one public and one private, and shares the public one.
- The sender uses the public key to "encapsulate" a fresh random secret. This produces a ciphertext to send across and a secret the sender keeps.
- The receiver uses the private key to "decapsulate" the ciphertext and recover the same secret.
- Both sides now hold the same key, and they use it with fast symmetric encryption such as AES.
An eavesdropper sees the public key and the ciphertext, but cannot get the secret without the private key.
Why lattices
ML-KEM is built on lattice problems, specifically a problem over structured lattices called module learning with errors. These problems are not known to be easy for quantum computers, unlike the factoring and discrete logarithm problems behind RSA and elliptic curves. That is the core reason NIST chose this family for key establishment.
It is worth being careful about the claim. "Not known to be easy" is not a proof of hardness. It means years of public analysis have not found an efficient attack, classical or quantum. This is also why migration plans should be flexible and why a fallback signature family exists in the same set of standards.
Why it matters most for key exchange
The harvest-now-decrypt-later threat hits key exchange hardest. If an attacker records a connection today and later breaks the key exchange, they can recover the session key and read the traffic. So protecting key establishment is the first priority, ahead of signatures. That is why ML-KEM is the standard most vendors are likely to implement first for data in transit.
Hybrid mode
Many early deployments pair ML-KEM with a classical method, such as an elliptic curve exchange, and combine the two results. The connection stays secure if either method holds. For organisations that cannot yet rely on a new algorithm alone, hybrid is a sensible bridge.
What to ask your suppliers
- Do your products support ML-KEM, and in which versions?
- Is there a hybrid option, and can we turn it on?
- What is the performance impact? ML-KEM public keys and ciphertexts are larger than elliptic curve equivalents, which can matter for constrained devices and network limits.
- When will it be the default?
What this means for Irish organisations
For an Irish bank, hospital or software company, this is a procurement and configuration question as much as a cryptography one. You do not need to implement ML-KEM yourself. You need to know which of your systems use key exchange, which suppliers will ship support, and in what order to move.
We write about this at Quantum Ireland from Clonmel, Tipperary. These are our own views, not a government position, and we will keep covering the standards as vendors adopt them.
FAQ
What does ML-KEM stand for?
Module-Lattice-Based Key-Encapsulation Mechanism. It is defined in NIST FIPS 203 and is derived from CRYSTALS-Kyber.
What is a key-encapsulation mechanism?
A set of algorithms that lets two parties establish a shared secret key over a public channel. One side encapsulates a fresh secret under the other's public key, and the other side decapsulates it with the private key.
Why is ML-KEM considered quantum-resistant?
It is based on lattice problems that are not known to be easy for quantum computers, unlike the factoring and discrete logarithm problems behind RSA and elliptic curves. "Not known to be easy" is not a proof, which is why migration plans stay flexible.
Should I use ML-KEM on its own or in hybrid mode?
Many early deployments pair it with a classical exchange, so the connection stays secure if either holds. Ask suppliers which options they support.
Are ML-KEM keys bigger than elliptic curve keys?
Yes, public keys and ciphertexts are larger, which can matter for constrained devices and network limits.
All field notes