Algorithm Guide · FIPS 203
What is ML-KEM-768?
ML-KEM-768 is the NIST-standardized lattice-based key encapsulation mechanism (KEM) at security category 3, published as FIPS 203 in August 2024. It lets two parties establish a shared symmetric key over an untrusted channel in a way that remains secure against both classical and known quantum attacks.
What is ML-KEM-768 used for?
ML-KEM-768 is used to establish session keys for TLS, VPNs, API gateways, and encrypted messaging without relying on elliptic-curve Diffie-Hellman (ECDH), which a sufficiently large quantum computer could break. In production, teams typically deploy it in a hybrid mode — ML-KEM plus ECDH — so traffic stays protected even if one algorithm is later weakened.
Common deployment patterns include:
- Hybrid TLS 1.3 — combine ML-KEM-768 with X25519 for payment and banking APIs
- Key wrapping — encapsulate AES-256 data keys for custody and HSM paths
- VPN / remote access — quantum-safe tunnel establishment (e.g. QSSL-style stacks)
How does ML-KEM-768 relate to Kyber?
ML-KEM-768 is the standardized name for CRYSTALS-Kyber at the 768-byte parameter set. NIST selected Kyber in July 2022 as part of its post-quantum cryptography standardization project and finalized it as ML-KEM in FIPS 203. If you see "Kyber-768" in older documentation, it maps to ML-KEM-768.
What security level does ML-KEM-768 provide?
ML-KEM-768 targets NIST security category 3, which NIST describes as comparable to AES-192 against both classical and quantum adversaries. ML-KEM-512 (category 1) and ML-KEM-1024 (category 5) cover lighter and heavier threat models respectively; ML-KEM-768 is the most common default for enterprise TLS.
| Parameter set | NIST category | Typical use |
|---|---|---|
| ML-KEM-512 | 1 | IoT, constrained devices |
| ML-KEM-768 | 3 | TLS, APIs, enterprise default |
| ML-KEM-1024 | 5 | Long-term secrets, high assurance |
Why are Indian payment networks piloting ML-KEM-768?
India's national payment infrastructure faces long-lived TLS channels and stored transaction metadata. NPCI and regulated entities are evaluating ML-KEM-768 TLS pilots ahead of broader production targets from late 2027, aligned with RBI quantum-safe (Q-SAFE) planning and national phased adoption through 2033.
The risk driver is harvest now, decrypt later (HNDL): adversaries capture encrypted traffic today and decrypt it once quantum computers mature. Payment rails with 10+ year data retention are especially exposed.
How do I test ML-KEM-768 without a production migration?
Use a sandbox API that exposes key generation, encapsulation, and decapsulation endpoints. VajraShield's developer portal provides OTP signup, API keys, and live ML-KEM-768 encrypt/decrypt calls on IBM Cloud — typically under 2 minutes to first successful operation.
Frequently asked questions
Is ML-KEM-768 approved for government use?
NIST published FIPS 203 as a Federal Information Processing Standard in August 2024. Agencies and vendors aligning to NIST PQC standards treat ML-KEM as the approved KEM family for new quantum-safe designs.
Do I need to replace RSA and ECDH immediately?
No — responsible migration uses hybrid key exchange during a transition window. Classical algorithms remain while ML-KEM is validated in staging, monitoring, and HSM integrations.
What pairs with ML-KEM for digital signatures?
NIST standardized ML-DSA (FIPS 204, formerly Dilithium) and SLH-DSA (FIPS 205, formerly SPHINCS+) for post-quantum signatures. KEM and signature algorithms serve different roles in a full PQC stack.