Skip to content
QubitWire
SECURITY · INTERNET SECURITY STANDARDS

IETF Publishes Hybrid ML-KEM Key Agreement for TLS 1.3

RFC 10024 specifies three combinations of ML-KEM and elliptic-curve key agreement at Proposed Standard maturity.

QubitWire editorial desk2 min readSources & context
Updated Source report Sources checked
My reading list
NIST paired-photon source and microstructured optical fiber used in quantum communications research
A NIST paired-photon source with microstructured fiber, used as quantum-secure communications context.Photo: A. Migdall / NIST · NIST public information / U.S. Government workFull image credit

A common specification for connections

Implementers of TLS 1.3 have a common specification for combining ML-KEM with existing elliptic-curve key agreement. RFC 10024 gives interoperability and migration work a shared target. IETF history records publication on August 10. The Standards Track RFC has Proposed Standard maturity.[1]

The specification defines three combinations: X25519MLKEM768, SecP256r1MLKEM768 and SecP384r1MLKEM1024.[1]

Proposed Standard describes the specification's maturity, not the extent of adoption. Publication does not mean every browser, server or certificate system has migrated.[1]

Implementations still need interoperability testing and measured rollout. These changes concern key agreement; migrating signatures is separate work that operators need to distinguish from this update.[1]

October 15 update: guidance for deployment

The UK's NCSC now recommends configurations for both hybrid and pure post-quantum key exchange in TLS. Its October 15 guidance treats hybrid schemes as an interim migration measure and says TLS 1.3 is the version to move to: earlier TLS versions will not gain PQC support. Enabling TLS 1.3 alone does not establish which key exchange a connection negotiated.[2][3]

The guidance also separates key exchange from authentication. Work on post-quantum authentication in TLS and the public certificate ecosystem is still progressing. For readers, the useful question is therefore specific: did an upgrade protect the session's shared secret, its authentication, or both? A general claim of quantum safety should identify that boundary.[3]

Keep your reading trail

Your Updates →

Evidence & context

3 linked sources

Published IETF Standards Track RFC; adoption remains an implementation question.

How to read the evidence and dates

An announcement records what an organization stated. An experiment reports an observation. A simulation or resource estimate depends on its assumptions. QubitWire’s analysis connects these sources; the labels are not quality scores.

Published is the article’s first QubitWire publication. Updated marks a substantive content change. Sources checked records a review of the underlying evidence. An older paper can support a new explanation, and another press release about the same work is not independent replication.

For material corrections, check the article’s context note and source trail. A routine formatting or link change does not create a new scientific result.

Sources

  1. IETF RFC 10024: Hybrid ML-KEM key agreement for TLS 1.3

    IETF Standards Track RFC published in August 2026, at Proposed Standard maturity. Specifies hybrid ML-KEM key agreement for TLS 1.3.

  2. NCSC: Post-quantum updates to TLS guidance

    Primary update dated October 15 2026; reviewed October 21. Explains TLS 1.3 migration and hybrid/pure PQC options.

  3. NCSC: Using TLS to protect data

    Primary implementation guidance updated October 15 2026; reviewed October 21. Distinguishes key exchange from ongoing authentication standards work.

READ NEXT

Continue exploring

All Security stories
  1. Explore cryptography migration

    IETF Publishes Post-Quantum Algorithms for OpenPGP

    RFC 9980 adds composite encryption and signatures, plus standalone hash-based signatures, to the OpenPGP protocol.

    Source report
  2. Explore cryptography migration

    Kaspersky finds post-quantum key exchange in a reported Lazarus malware chain

    Operation FlashHole illustrates an unexpected use for ML-KEM. The vendor’s disclosure concerns malware delivery, with activity evidence dating to July 2025.

    Published · Source report · Sources checked
THE QUANTUM BRIEFING

A clearer signal.
Read the latest edition.

A little perspective on a fast-moving field.

Read the on-site briefing →

Read selected quantum coverage in the on-site briefing, or register your interest below.