secp256r1MLKEM768: Post-Quantum Hybrid Key Exchange Explained
Understand how SecP256r1MLKEM768 combines P-256 and ML-KEM-768 in TLS 1.3, including wire sizes, security limits, and deployment guidance.
SecP256r1MLKEM768 is a TLS 1.3 hybrid key-agreement group. It combines ephemeral NIST P-256 ECDHE with ML-KEM-768, the post-quantum key-encapsulation mechanism standardized in NIST FIPS 203. The two component secrets are combined and then passed into the normal TLS 1.3 key schedule. It does not encrypt application data by itself, and it does not make TLS authentication post-quantum.
The group is defined by RFC 10024, published in August 2026, alongside X25519MLKEM768 and SecP384r1MLKEM1024.
1. What SecP256r1MLKEM768 means
| Part | Role |
|---|---|
| secp256r1 (P-256) | Ephemeral elliptic-curve Diffie-Hellman exchange |
| ML-KEM-768 | Post-quantum key encapsulation mechanism defined by NIST FIPS 203 |
| Hybrid combiner | Concatenates the two shared secrets in the order specified by RFC 10024 |
| TLS 1.3 key schedule | Derives handshake and application traffic keys from the combined result |
RFC 10024 describes the design as combining ML-KEM with ECDHE. The purpose is migration resilience: a connection can retain security if at least one component remains secure, subject to the protocol’s assumptions, implementation quality, validation, randomness, and transcript binding.
2. How the TLS 1.3 handshake works
- ClientHello: the client advertises the supported group and sends a hybrid key share.
- Client key share contents: an ephemeral P-256 public point followed by an ML-KEM-768 encapsulation key.
- ServerHello: the server sends its ephemeral P-256 point and an ML-KEM ciphertext produced for the client’s encapsulation key.
- Secret computation: both sides compute the P-256 ECDHE secret. The server obtains the ML-KEM shared secret during encapsulation; the client obtains the same value by decapsulation.
- Combining: the two component secrets are concatenated in the prescribed order.
- Key schedule: TLS 1.3 consumes the resulting 64-byte hybrid secret to derive handshake and application traffic keys.
The combined secret establishes keys; symmetric encryption of HTTP or other application data remains a separate TLS function. Do not implement the wire format from this summary. RFC 10024 specifies serialization, length checks, validation, and error handling normatively.
Published byte lengths
| Object | Length | What it contains |
|---|---|---|
| Client key share | 1,249 bytes | 65-byte P-256 point plus 1,184-byte ML-KEM-768 encapsulation key |
| Server key share | 1,153 bytes | 65-byte P-256 point plus 1,088-byte ML-KEM ciphertext |
| Hybrid shared secret | 64 bytes | Concatenated P-256 and ML-KEM component secrets |
These are protocol encoding lengths, not end-to-end packet sizes or performance benchmarks. A ClientHello also contains extensions, cipher-suite information, and other TLS fields, so it can exceed one network packet.
3. Why use P-256 with ML-KEM-768?
P-256 is useful where both component shared-secret mechanisms must come from FIPS-approved algorithm families. Naming this group alone does not make a deployment FIPS compliant: certification depends on the exact implementation, cryptographic module, operating environment, and validation status.
ML-KEM supplies the post-quantum component. P-256 preserves a widely deployed traditional mechanism during migration. The hybrid construction is specific to TLS 1.3 and its transcript and key schedule. RFC 10024 does not establish that the same combiner is secure when copied into an unrelated protocol.
4. Comparison with the other RFC 10024 groups
| Group | Classical component | ML-KEM parameter set | Typical rationale in RFC 10024 |
|---|---|---|---|
| X25519MLKEM768 | X25519 | ML-KEM-768 | Hybrid migration using X25519 |
| SecP256r1MLKEM768 | P-256 | ML-KEM-768 | Contexts seeking two FIPS-approved shared-secret mechanisms |
| SecP384r1MLKEM1024 | P-384 | ML-KEM-1024 | Higher-security contexts seeking a larger margin |
Do not claim a universal speed ranking. Actual latency, CPU use, memory use, and packet behavior depend on the TLS library, hardware, operating system, concurrency, and network path.
5. Inspecting support safely
Support is implementation-specific. RFC 10024 does not imply that a particular browser, server, proxy, or language runtime enables this group. Check the current documentation for the exact TLS stack you deploy, then verify negotiated parameters in a controlled environment.
OpenSSL command-line check
openssl version -a
openssl s_client -connect example.com:443 -tls1_3 -groups SecP256r1MLKEM768 -servername example.com
The command is a diagnostic template. It succeeds only when the installed OpenSSL build and the remote endpoint recognize the group. A failure can mean unsupported local code, unsupported peer code, a policy restriction, or an intermediary that cannot pass the larger handshake.
Record what was negotiated
openssl s_client -connect example.com:443 -tls1_3 -servername example.com Do not infer hybrid negotiation merely from TLS 1.3 or from the cipher-suite name. Key agreement groups and symmetric cipher suites are separate parameters.
6. Implementation checklist
- Use a TLS 1.3 implementation that explicitly documents RFC 10024 support.
- Enable the group through the library’s supported-groups or key-share configuration.
- Keep a compatible fallback group during staged rollout.
- Validate both component encodings and all length fields through the library’s standard APIs.
- Use a cryptographically secure randomness source and side-channel-resistant implementations.
- Capture negotiated-group telemetry without logging private keys or shared secrets.
- Test direct connections, proxies, load balancers, session resumption, and failure paths.
- Measure ClientHello size and fragmentation on the networks your clients actually use.
- Review authentication separately; hybrid key exchange does not provide post-quantum signatures.
7. Common errors and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| “unsupported group” or “no suitable key share” | One endpoint or the local policy does not enable SecP256r1MLKEM768 | Check both TLS stacks, group spelling, provider/module loading, and policy configuration. Keep a fallback during rollout. |
| Handshake works without the hybrid group but fails with it | Middlebox, proxy, or firewall mishandles a larger ClientHello | Test the path directly, inspect fragmentation, update the intermediary, or use a staged compatibility policy. |
| Unexpected cipher-suite output | Cipher suites identify symmetric protection, not the key-agreement group | Inspect the negotiated group separately using your TLS library’s diagnostics. |
| FIPS audit rejects the deployment | The algorithm name was treated as certification evidence | Document the certified module and exact build. Group selection alone is insufficient. |
| Security claim says the connection is “quantum-proof” | Hybrid key exchange was confused with complete post-quantum TLS | State the narrower property: key establishment combines P-256 and ML-KEM-768. Authentication remains outside RFC 9954’s scope. |
| Copied construction used in another protocol | TLS transcript and key-schedule assumptions were omitted | Use RFC 10024 only as specified for TLS 1.3; obtain a separate security analysis for another protocol. |
8. Performance, reliability, and cost considerations
Performance
The hybrid shares are larger than traditional ECDHE shares, increasing handshake bytes and potentially causing fragmentation. ML-KEM and P-256 also add computation compared with a single classical exchange. Measure CPU time, allocations, handshake latency, and connection concurrency with your own library and hardware. The RFC’s byte lengths are not benchmarks.
Reliability
Roll out with observability and fallback. Track negotiation success, alerts, retries, handshake duration, and failures by client, server, proxy, and network path. Test resumed sessions as well as full handshakes. Never weaken certificate validation or silently ignore authentication errors to make a hybrid rollout pass.
Operational cost
There is no universal per-connection price for the group. Cost comes from extra bandwidth, cryptographic CPU, memory, and possible retries. Estimate these from production-like traffic, including peak concurrent handshakes and fragmented packets.
9. What hybrid does and does not protect
| Question | Answer |
|---|---|
| Does it combine two key exchanges? | Yes: ephemeral P-256 ECDHE and ML-KEM-768. |
| Does it encrypt application data directly? | No. TLS 1.3 derives symmetric traffic keys and then encrypts application records. |
| Does it provide post-quantum authentication? | No. RFC 9954 excludes post-quantum authentication from its scope. |
| Is every future attack covered? | No. Security depends on the specified combiner, algorithms, implementation, randomness, validation, and TLS context. |
| Can the recipe be copied into any protocol? | No. RFC 10024’s analysis relies on the TLS 1.3 transcript and key schedule. |
10. Documenting a handshake diagram
A practical way to explain rollout behavior to a team is to render a diagram or test page that shows the ClientHello, ServerHello, component shares, and derived-secret flow. You can build that page yourself with HTML and a browser automation tool, or capture a public documentation page for review.
Minimal browser-based capture idea
<!doctype html>
<meta charset="utf-8">
<title>Hybrid TLS flow</title>
<style>body{font:16px system-ui;max-width:760px;margin:40px auto} .row{display:flex;gap:12px;align-items:center}.box{padding:16px;border:2px solid #246;border-radius:8px}.arrow{font-size:28px}</style>
<div class="row">
<div class="box">ClientHello<br>P-256 + ML-KEM key</div>
<div class="arrow">→</div>
<div class="box">ServerHello<br>P-256 + ML-KEM ciphertext</div>
<div class="arrow">→</div>
<div class="box">TLS 1.3 keys</div>
</div>
11. Or skip the browser setup
ScreenshotNeo can capture a clean image or PDF with one GET request. Cookie and consent banners are accepted and removed before capture, along with more than 60 known consent platforms, newsletter popups, and chat widgets. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and the response identifies the result with X-Page-Verdict and X-Billed headers. Its MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients.
See the ScreenshotNeo documentation for all options.
cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)
Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
ScreenshotNeo includes full-page capture, element selectors, custom CSS and JavaScript, waits, request blocking, headers, cookies, user agents, timezone and geolocation controls, PDF output, caching, signed links, asynchronous jobs, bulk capture, and a usage API. Every feature is available on every plan. The Free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000 screenshots.
Create a free ScreenshotNeo account and start with 1,000 screenshots per month without a card.
12. FAQ
Is SecP256r1MLKEM768 a cipher suite?
No. It is a TLS 1.3 supported group for key agreement. Cipher suites separately select symmetric record protection and hashing.
Why is the client share larger than the server share?
The client sends the 1,184-byte ML-KEM encapsulation key, while the server returns the 1,088-byte ciphertext. Both also contain a 65-byte P-256 point.
Does choosing P-256 guarantee FIPS compliance?
No. Compliance depends on the certified cryptographic module and implementation details, not the group name alone.
Should every service enable this group immediately?
Use a staged rollout. Confirm library and peer support, test intermediaries, measure handshake behavior, and retain a compatible fallback while you gather telemetry.
Are older Kyber768 experimental names equivalent?
No. RFC 10024 obsoletes experimental draft code points for pre-standard variants. Use the standardized group name and current implementation documentation.
Where should I read the normative details?
Read RFC 10024 for the hybrid groups and RFC 9954 for the TLS post-quantum hybrid guidance and authentication scope.
