← Back to Blog Comparison

TLS 1.2 vs TLS 1.3 vs Post Quantum TLS: The Quantum Safe Migration

7 min read

Why TLS Version Matters for PQC

TLS 1.2 is the older protocol widely used from 2008 to 2018. TLS 1.3 (RFC 8446, published August 2018) is the modern protocol. Post Quantum Cryptography in TLS requires TLS 1.3 or later. TLS 1.2 cannot be retrofit with hybrid ML-KEM key exchange; the protocol's key-share negotiation is too rigid.

Deployed Status

TLS 1.2: widely deployed but being phased out. No PQC path.
TLS 1.3: modern standard. Supports hybrid KEM via new key_share groups.
PQ-TLS 1.3: TLS 1.3 with hybrid X25519MLKEM768 (codepoint 0x11EC) or similar groups.

Chrome Defaults

Chrome 116 (August 2023): X25519Kyber768Draft00 experimental, default.
Chrome 131 (November 2024): X25519MLKEM768 default using NIST-standardized ML-KEM.
Chrome 131+ continues with hybrid by default for all TLS 1.3 connections.

Cloudflare Status

Cloudflare enabled hybrid post-quantum key agreement for customer TLS 1.3 in October 2022 (draft Kyber) and upgraded to ML-KEM in 2024. As of 2025, >60% of human-generated TLS traffic to Cloudflare uses hybrid ML-KEM per Cloudflare Radar.

AWS, Apple, Microsoft

AWS KMS, ACM, Secrets Manager: ML-KEM hybrid TLS supported through 2024-2025.
iMessage PQ3 (Feb 2024): hybrid PQ using Kyber/ML-KEM (on iMessage protocol, not TLS).
Microsoft SymCrypt: ML-KEM, ML-DSA available GA on Windows Server 2025, Windows 11 24H2/25H2, .NET 10.

Migration Checklist

Upgrade all TLS endpoints to TLS 1.3.
Enable hybrid key_share groups (X25519MLKEM768 preferred).
Test with Chrome, curl with OpenSSL 3.5+, or oqs-provider.
Monitor successful handshake negotiation rates.
Plan deprecation of TLS 1.2 on the NIST 2035 timeline.

Frequently Asked Questions

Can TLS 1.2 support PQC?

Not cleanly. TLS 1.2's key exchange structure does not accommodate hybrid KEMs. Migrating to TLS 1.3 is a prerequisite for PQC TLS.

What is codepoint 0x11EC?

X25519MLKEM768, the standardized hybrid key exchange in TLS 1.3 using X25519 + ML-KEM-768 (NIST FIPS 203). Default in Chrome 131+.

Is TLS 1.3 required for PQ-TLS?

Yes. PQ hybrid key exchange adds new key_share groups defined only for TLS 1.3.

Does HTTP/3 (QUIC) support PQC?

Yes. QUIC uses TLS 1.3 for cryptographic negotiation, so QUIC inherits PQC key exchange from TLS 1.3.

Sources

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY

Originally published at quantumsequrity.com/blog/tls-1-2-vs-tls-1-3-pqc.