ML-KEM is NIST's standardized post-quantum key-encapsulation mechanism in FIPS 203. No practical classical or quantum break is known, but security still depends on its assumptions, parameter set, implementation, protocol profile, and key handling.
Key Takeaway: ML-KEM is considered quantum safe. NIST finalized ML-KEM in FIPS 203 in August 2024. CNSA 2.0 selects ML-KEM-1024 within its NSS scope.
ML-KEM is a NIST-standardized post-quantum key-encapsulation mechanism.
ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), formerly known as CRYSTALS-Kyber, is a post-quantum cryptographic algorithm standardized by NIST as FIPS 203 in August 2024. It replaces RSA and ECDH for establishing shared symmetric keys between two parties. Unlike traditional key exchange where both parties contribute to key generation, KEM uses a simpler encapsulation model: the recipient generates a public/private keypair, the sender encapsulates a random symmetric key using the public key, and the recipient decapsulates it using the private key.
ML-KEM's security is based on the Module Learning With Errors problem. No efficient classical or quantum algorithm is known for the standardized parameter sets, but that is an evidence-based hardness assumption rather than a mathematical guarantee.
FIPS 203 defines ML-KEM-512, ML-KEM-768, and ML-KEM-1024, aligned with NIST security categories 1, 3, and 5. Those categories are comparison targets, not direct bit-security or break-cost claims, and the numeric suffixes do not simply denote polynomial-ring size. CNSA 2.0 selects ML-KEM-1024 within its NSS scope.
No practical quantum attack is known against the standardized ML-KEM parameter sets. Cryptanalytic estimates evolve, and implementation failures, side channels, randomness, validation, and protocol composition remain separate risks.
ML-KEM-768 targets NIST security category 3. The category is defined by comparison to reference attacks and must not be converted into a universal 2192 classical or 296 quantum break estimate.
ML-KEM received extensive public cryptanalysis during NIST standardization. Continue to track NIST errata, validation guidance, cryptanalytic results, and implementation advisories rather than treating standardization as a permanent guarantee.
ML-KEM is an algorithmic migration target for key establishment, but deployment requires an approved application profile:
FIPS 203 encodings are larger than classical X25519 values. Measure the complete protocol messages, fragmentation, latency, memory, middleboxes, and failure behavior on the actual path.
HNDL materiality is path-specific. Prioritize ML-KEM evaluation where measured classical key establishment, capture exposure, data lifetime, and migration lead time justify it:
Financial systems should measure each key-establishment path and set control dates from applicable requirements, capture exposure, data lifetime, provider support, and interoperability. Do not assume active capture or a universal immediate deployment mandate.
Healthcare entities should derive confidentiality periods and safeguards from actual records, applicable law, contracts, and documented risk analysis. HIPAA does not impose a universal 50-year retention period or mandate ML-KEM.
CNSA 2.0 selects ML-KEM-1024 for its NSS scope and stages acquisition, phaseout, and algorithm-use milestones through 2031 unless otherwise noted. It is not a universal 2030 ML-KEM mandate.
Provider support is product-, release-, region-, configuration-, and path-specific. Verify current primary documentation and the negotiated or invoked algorithm; do not infer platform-wide ML-KEM coverage from a feature announcement.
Select ML-KEM only through a supported, approved application profile and set the deployment date from measured risk, interoperability, validation, and rollback evidence.
| Full Name | Module-Lattice-Based Key-Encapsulation Mechanism (FIPS 203) |
| Category | pqc |
| Key Size | ML-KEM-512 / 768 / 1024 (NIST security categories 1 / 3 / 5) |
| Quantum Vulnerability | No known quantum vulnerability. Security relies on lattice hardness assumptions. |
| NIST Status | NIST finalized ML-KEM in FIPS 203 in August 2024. CNSA 2.0 selects ML-KEM-1024 within its NSS scope. |
| Deprecation Timeline | Current standard. No deprecation planned. |
| Replaced By | N/A — this IS the post-quantum standard |
Algorithm-level classification. Standards status and known cryptanalysis are separated from implementation, module-validation, protocol-composition, key-management, and policy evidence.
Evidence-scope review: 2026-07-10
Select the parameter set and construction through the approved application profile. Verify the exact library or module, validation status, endpoints, negotiation, downgrade behavior, interoperability, telemetry, and rollback.
ML-KEM is quantum safe, but your cryptographic posture is only as strong as its weakest link. QScout maps cryptographic inventory within approved scope under a governed engagement.