No-Regret First Moves: Hybrid TLS And Cleaning Up Cryptographic Antipatterns

Most of a post-quantum programme is planning and coordination that will run for years. A few tasks, though, can start almost immediately, cost little and reduce risk whatever happens next. Practitioners call these no-regret moves.

This article covers the two most widely recommended: turning on hybrid post-quantum key exchange for web traffic, and fixing the cryptographic habits that make every later change harder. It also covers where official positions on hybrid cryptography differ.

How Hybrid Key Exchange Works In TLS 1.3

In a hybrid key exchange, the two sides run a classical key agreement and a post-quantum one at the same time and combine the results. An attacker would have to break both to recover the session keys. OMB’s memorandum M-26-15 outlines how this works in TLS 1.3.¹

The post-quantum half is not a mirror of the classical one. ML-KEM, defined in FIPS 203, is a key encapsulation mechanism: the server does not send a public value of its own but uses the client’s public key to wrap a secret, which only the client can unwrap.²

Because the recorded handshake can only be decrypted by breaking both components, hybrid key exchange protects traffic against harvest now, decrypt later attacks while keeping a classical safety net in case a flaw is found in the newer algorithm. OMB also notes that TLS 1.3’s redesigned handshake is well suited to hybrid exchange, and requires US federal agencies to support TLS 1.3 no later than 2 January 2030.¹

Where It Is Already Available

For public websites, the hybrid scheme X25519MLKEM768 is the obvious first candidate. Europol’s financial services report, published in 2026, says it is already the default in the latest versions of most major cryptographic libraries, that most web browsers have supported it since November 2024, and that the largest content delivery networks support it or have short-term plans to.³ The report also cites F5 Labs research, published in June 2025, which found hybrid post-quantum key exchange on five of the world’s ten most visited websites at that time.⁴ Europol scores public websites as low migration time and calls them the earliest practical opportunity to run post-quantum protection in production. It also sees a side benefit: an early, visible deployment helps technical teams, decision-makers and customers understand that preparing now is feasible.³

SSH has moved in the same direction. OpenSSH 10.0, released on 9 April 2025, made the hybrid algorithm mlkem768x25519-sha256 its default for key agreement.⁵

CISA’s product category list, published on 23 January 2026, shows how far support has spread. It lists cloud platforms (infrastructure and platform as a service), chat and messaging software, web browsers and servers, and full disk encryption as categories where post-quantum capable products are widely available, and says organisations, federal civilian agencies included, should buy only post-quantum capable products in those categories.⁶ CISA notes that most of these products protect key establishment with post-quantum algorithms but not yet signatures.⁶ Networking equipment, software as a service (SaaS), operating systems, storage, identity and access management, and hardware security modules are listed as still transitioning.⁶

Official Positions On Hybrid Differ

Agencies do not agree on how much weight to give hybrid cryptography. OMB says it can be useful during migration but warns that it is “an intricate and resource-intensive stopgap” and asks agencies to evaluate the trade-offs carefully.¹ The joint statement from France, Germany, the Netherlands and other EU member states, by contrast, says deploying hybrid post-quantum solutions is becoming urgent.⁷

In our view the difference matters less than it first appears for most organisations. On the web, hybrid key exchange is usually an option that suppliers have already built and tested, so much of the effort OMB warns about falls on systems an organisation builds itself. Where you do build your own cryptography, the trade-off deserves a proper assessment.

Clean Up The Antipatterns

An antipattern is a common practice that looks convenient but creates risk and technical debt. Europol’s report argues that removing cryptographic antipatterns early improves security now and speeds later migration, even for systems that are not ready for post-quantum algorithms.³ For public websites it lists five.

The same report recommends that cryptography leaders catalogue known antipatterns with architects and operations teams, write them into security policy and development guidelines, and track remediation with clear metrics.³ Hard-coded keys and parameters in code, covered in the crypto-agility article, belong on the same list.