If you look at how big tech companies have rolled out post-quantum encryption, you’ll see the word “hybrid” again and again. Here’s what it means and why it matters.
The dilemma
Classical algorithms like X25519 have protected internet traffic for years and are trusted against today’s computers, but not against future quantum computers. New algorithms like ML-KEM are designed to resist quantum attack, but have had far less time in real-world use. Choosing only one means accepting one of those risks.
The hybrid solution
A hybrid key exchange runs both at once. Each produces its own secret, and the two are mixed together to create the final key. An attacker would have to break both algorithms to read the traffic.
Why caution is justified
Caution isn’t theoretical. During NIST’s competition, the candidate SIKE was broken in 2022 using an ordinary computer in about an hour, after years of study by experts. ML-KEM has survived far more scrutiny, but a hybrid means even an unexpected flaw would not expose traffic, because the classical half would still protect it against today’s attackers.
Where hybrids are used today
The most common web hybrid is X25519MLKEM768, which combines X25519 with ML-KEM-768. Google Chrome turned on hybrid post-quantum key exchange by default in 2024 and moved to the final ML-KEM standard later that year. OpenSSH, Signal and Apple’s iMessage also use hybrid designs.
What it costs
The main cost is size. A hybrid adds a little over a kilobyte to each side of the connection set-up, which occasionally trips up old network equipment that expects small messages. The computing cost is small, because ML-KEM is very fast on modern processors.
task_altKey takeaways
- check_circleA hybrid combines a classical and a post-quantum algorithm; both must be broken.
- check_circleIt protects against both quantum computers and undiscovered flaws in new algorithms.
- check_circleX25519MLKEM768 is the most widely used hybrid on the web today.