Hybrid Post-Quantum Cryptography In Practice: X25519MLKEM768, Composites And Agency Views

A hybrid scheme combines a post-quantum algorithm with a classical one so that an attacker has to break both. The idea is a hedge. If the new algorithm turns out to have a flaw, the classical one still protects today’s traffic. If a quantum computer arrives, the post-quantum one still protects it. NIST’s draft transition guidance describes hybrids in exactly these terms, while warning that they add complexity and are usually expected to be temporary.¹

Hybrid key establishment is already the default in much of the software that secures the internet. This article explains how it works in TLS, where else it has shipped, how hybrid signatures differ, and where national security agencies part ways.

How Hybrid TLS Works

The TLS 1.3 handshake lets a client offer a “key share” for a named group, and the server answers with its own. In August 2026 the IETF published RFC 10024, a Proposed Standard that defines three hybrid groups combining ML-KEM with elliptic curve Diffie-Hellman.² The first of them, X25519MLKEM768, pairs ML-KEM-768 with X25519. The RFC describes it as widely deployed, and it is the only one of the three marked as recommended in the IANA registry.

RFC 10024 also defines SecP256r1MLKEM768 and SecP384r1MLKEM1024, which use NIST curves. In those two groups the elliptic curve secret comes first; in X25519MLKEM768 the ML-KEM secret comes first. The ordering lets each variant fit FIPS-approved key derivation, so that a FIPS-validated component sits in the expected position.² The RFC also marks the earlier pre-standard Kyber groups, such as X25519Kyber768Draft00, as obsolete.

Who Has Shipped It

Deployment ran well ahead of the final RFC, based on earlier IETF drafts.

• Chrome added support for hybrid X25519Kyber768 in Chrome 116 in 2023³ and announced in 2024 a switch to the standard ML-KEM group from Chrome 131.⁴
• OpenSSL 3.5.0, released on 8 April 2025, added ML-KEM, ML-DSA and SLH-DSA and made X25519MLKEM768 one of its default TLS key shares.⁵
• OpenSSH made the hybrid sntrup761x25519-sha512 method its default in version 9.0 in April 2022, citing the risk of traffic being captured now and decrypted later.⁶ Version 10.0, released on 9 April 2025, switched the default to mlkem768x25519-sha256.⁷
• Apple announced iMessage PQ3 on 21 February 2024, starting with iOS 17.4. It combines Kyber with elliptic curve keys at setup and adds periodic post-quantum rekeying, roughly every 50 messages and at least every seven days.⁸
• Signal added Kyber to its initial key agreement with PQXDH in September 2023.⁹ On 2 October 2025 it announced SPQR, an ML-KEM-768 ratchet that runs beside its existing Double Ratchet, with keys from both mixed so that an attacker must break both.¹⁰

Hybrid Signatures And Composite Certificates

Hybrid key establishment protects confidentiality. Hybrid signatures protect authenticity, and they are harder. A certificate that carries two public keys and two signatures is larger, and every relying party has to understand the format.

The IETF’s main effort here is composite ML-DSA for X.509 certificates. It defines 18 combinations that pair ML-DSA-44, 65 or 87 with RSA, ECDSA, Ed25519 or Ed448, so that one composite key and signature behave like a single algorithm. As of 7 October 2026 the latest version is draft 19, dated 21 April 2026; it has been submitted for publication and is with the RFC Editor, but it is not yet an RFC.¹¹

Where Agencies Disagree

National agencies agree on the destination, which is post-quantum cryptography, but not on whether hybrids are needed along the way.

The NSA’s reasoning is set out in its CNSA 2.0 FAQ. It is confident in ML-KEM and ML-DSA, will not require hybrids for security, and notes that more products fail through implementation or configuration errors than through broken algorithms, so extra complexity can reduce security. It also tells national security system owners not to use hybrid or other non-standard post-quantum solutions on mission systems, apart from exceptions that NSA itself recommends for standards or interoperability reasons. IKEv2 is one: its message size limits mean NSA expects to keep classical key establishment there, reinforced with ML-KEM-1024.¹² The UK NCSC takes a middle position: if an organisation chooses a hybrid, it should treat it as interim.¹³

France and Germany are more cautious about the new algorithms themselves. ANSSI’s December 2023 paper says end products that include post-quantum protection shall implement hybridation, with an exception for hash-based signatures.¹⁴ Its current FAQ stresses hybridation in the short and medium term, makes it mandatory within its regulated scope (including certified products) and recommends it, without imposing it, everywhere else.¹⁵ BSI’s technical guideline, version 2026-01, recommends post-quantum key agreement and signatures only in combination with classical schemes, noting that these methods are comparatively new and less studied, especially in terms of implementation security.¹⁶

Outside US national security systems, hybrids fit the European guidance and are already the default in much mainstream software, so they are the usual starting point. Whatever the choice, it helps to keep the configuration flexible enough to drop the classical half later, and anyone supplying national security systems should check NSA’s specific profiles and approved exceptions rather than assume a hybrid is acceptable.