TL;DR
ECDH is broken by Shor's algorithm. ML-KEM is the quantum-safe replacement. The deployed production pattern as of 2026 is hybrid X25519+ML-KEM-768, used by Chrome 131+, Signal PQXDH, iMessage PQ3, Cloudflare, and AWS KMS.
The Two Algorithms
ECDH (Elliptic Curve Diffie-Hellman): Both parties exchange public curve points. Shared secret is computed from each side's private scalar and the other's public point. Security rests on the Elliptic Curve Discrete Logarithm Problem (ECDLP). Broken by Shor in polynomial time.
ML-KEM (Module-Lattice KEM, FIPS 203): One party publishes a lattice-based public key. The other encapsulates a random value to produce a shared secret and a ciphertext. Security rests on Module Learning With Errors (MLWE).
Side by Side
| Aspect | ECDH (X25519) | ML-KEM-768 |
|---|---|---|
| Public key size | 32 B | 1184 B |
| Ciphertext / response | 32 B | 1088 B |
| Round trips | 1 | 1 |
| Quantum-safe | No | Yes |
| Security level | ~128-bit classical | ~192-bit classical (cat 3) |
Why Hybrid
The deployed hybrid pattern combines both:
- Run X25519 and ML-KEM-768 in parallel during handshake.
- Derive session key from both shared secrets: KDF(S_ECDH || S_KEM, context).
An attacker must break both to read session traffic. This protects against:
- A bug in ML-KEM implementation (X25519 preserves security).
- A future math breakthrough against lattices (X25519 preserves security).
- A CRQC breaking X25519 (ML-KEM preserves security).
Production Deployment
- Chrome 131 (Nov 2024): X25519MLKEM768 default.
- Cloudflare: >60% of human-generated TLS traffic uses hybrid ML-KEM.
- Signal PQXDH (Sept 2023): X25519+Kyber-1024.
- iMessage PQ3 (Feb 2024): hybrid PQ.
- AWS KMS, ACM, Secrets Manager: ML-KEM hybrid TLS.
Frequently Asked Questions
Is X25519 broken today?
No. X25519 is secure against classical attacks. It is broken only by a sufficiently large quantum computer running Shor's algorithm, which does not yet exist.
Why deploy hybrid instead of pure ML-KEM?
Belt and suspenders. If a bug or breakthrough attacks ML-KEM, the classical X25519 half preserves security until the vulnerability is fixed.
What is the TLS 1.3 codepoint for hybrid?
X25519MLKEM768 uses codepoint 0x11EC. Earlier experimental X25519Kyber768Draft00 used 0x6399.
Is ML-KEM-768 the right parameter set?
Category 3 (~192-bit classical level) is the recommended balance for general use. Use ML-KEM-1024 for CNSA 2.0 compliance or very long-lived data.
Sources
Related Articles
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.
Try QNSQYOriginally published at quantumsequrity.com/blog/ecdh-vs-ml-kem.