Algorithm

ML-KEM

Family: lattice.

ML-KEM is the NIST standard for key encapsulation, derived from CRYSTALS-Kyber. One side publishes a public key. The other side uses it to wrap a fresh random secret that only the key owner can unwrap, and both then encrypt their traffic with that secret. It protects against attackers who record traffic now and decrypt it later with a quantum computer. It does not sign messages. Keys and ciphertexts are about one kilobyte.

Safety: Medium

Why this rating

Security rests on the hardness of Module-LWE, a structured-lattice problem. Years of public analysis have found no practical attack on the standardized parameters, but lattice cryptanalysis is less mature than that of hash functions. Implementations must resist timing and other side-channel leaks.

Standard

https://csrc.nist.gov/pubs/fips/203/final

Research

• CRYSTALS-Kyber (2017)
• FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard

Implemented by

• liboqs
• PQClean