ML-KEM

ML-KEM-1024

ML-KEM-1024 required for all classification levels on National Security Systems.

“Use ML-KEM-1024 for all classification levels.”

ML-KEM-512 · ML-KEM-768 · ML-KEM-1024

ML-KEM-768 (Category 3) · ML-KEM-1024 (Category 5)

Added to the CRYPTREC Ciphers List for the first time on 30 March 2026, as a brand-new PQC table separate from the long-standing classical e-Government Recommended Ciphers List. Only key-establishment algorithms were added; the signature-algorithm row in the same table is an explicit placeholder, with a footnote stating that adding a PQC signature algorithm "is under consideration." The existing classical list (RSA, ECDSA, EdDSA, DH, ECDH) carries no sunset date — this is additive, not a replacement.

ML-KEM-768 (until 2030) · ML-KEM-1024 (no sunset stated)

ML-KEM-768 and ML-KEM-1024 are both approved today, but ASD states explicitly that ML-KEM-768 "will not be approved beyond 2030," for interoperability and maintainability reasons — Australia is sunsetting its own weaker approved PQC parameter set on the same 2030 horizon most jurisdictions use only for retiring classical algorithms.

“The use of ML-KEM-768 and ML-KEM-1024 are approved. However, for interoperability and maintainability reasons, ML-KEM-768 will not be approved beyond 2030.”

ML-KEM-768

“The NCSC recommends ML-KEM-768 and ML-DSA-65 as providing appropriate levels of security and efficiency for most use cases.”

level-5 preferred, level-3 acceptable

Hybridation with a classical algorithm required for products seeking a French security visa.

“We recommend to use the highest NIST security level as possible, preferably level-5 (i.e. equivalent to AES-256) or level-3.”

ML-KEM-768 · ML-KEM-1024

Recommended only in hybrid combination with a classical algorithm.

“Derzeit wird ausschließlich der hybride Einsatz von quantensicheren Verfahren in Kombination mit klassischen Verfahren empfohlen.”

ML-KEM-1024 recommended · ML-KEM-768 acceptable

Recommended in hybrid-AND combination with ECDH.

“The ML-KEM standard specifies security level 3 as the default option; thus, our recommendations can be considered slightly more conservative.”

X25519MLKEM768 · SecP256r1MLKEM768 · SecP384r1MLKEM1024

Only in named hybrid groups; pure ML-KEM not yet in the recommended tier.

“si raccomanda l'utilizzo di schemi ibridi, cioè X25519MLKEM768, SecP256r1MLKEM768 e SecP384r1MLKEM1024.”

ML-KEM-512 · ML-KEM-768 · ML-KEM-1024

ML-KEM-768 (NIST default per the guide)

“NIST 建議預設使用 ML-KEM-768”

“Recommended ... Public-Key Asymmetric Encryption/KEMs: FIPS-203 (CRYSTALS-KYBER)”

ML-KEM-512 · ML-KEM-768 · ML-KEM-1024