ML-KEM(FIPS 203)

ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) is the algorithm NIST finalized as FIPS 203 in August 2024. It is the standard most implementations mean when they say "post-quantum key exchange" today.

What it replaces

ML-KEM is a drop-in functional replacement for the key-exchange step that RSA and elliptic-curve Diffie-Hellman (ECDH) currently perform in protocols like TLS: two parties use it to agree on a shared secret over an insecure channel. It does not replace signatures. That is a separate algorithm, ML-DSA (FIPS 204).

ML-KEM is derived from CRYSTALS-Kyber, the finalist that won NIST's multi-year post-quantum standardization competition in this category. Its security rests on the hardness of certain lattice problems, a different mathematical foundation than the factoring and discrete-logarithm problems RSA and ECDH rely on, and one that is not known to be efficiently solvable by Shor's algorithm.

How it is actually being deployed

Almost no production system swaps to ML-KEM alone. Chrome, Firefox, and OpenSSH have already shipped hybrid key exchange: a classical algorithm such as X25519 combined with ML-KEM in the same handshake, so that an attacker must break both to recover the shared secret. This hedges against the possibility that a weakness is later found in the newer, less battle-tested lattice math.

Why it shows up across country pages on this site

Several jurisdictions scored on this tracker name ML-KEM or its NIST designation (FIPS 203) directly in their primary source, most often as the specific algorithm a migration deadline or inventory requirement is measured against. Where a country's regulator cites a concrete algorithm rather than "post-quantum cryptography" in general, that specificity is one input into this site's deadline-concreteness scoring axis.