v131 · security

X25519Kyber768 key encapsulation for TLS

Chrome 124 enabled by default on all desktop platforms a new post-quantum secure TLS key encapsulation mechanism [X25519Kyber768](https://developer.chrome.com/blog/chrome-124-beta#x25519kyber768_key_encapsulation_for_tls), based on a NIST standard (ML-KEM). This protects network traffic from Chrome with servers that also support ML-KEM from decryption by a f

concepts

  1. Kyber TLS

    X25519Kyber768 post-quantum hybrid TLS key encapsulation rolling out.

  2. Harvest-now timeline

    The motivating threat model: drag the expected-quantum-readiness year and secret-lifetime sliders to see when today's handshake stops being safe.

  3. Handshake bytes: classical vs hybrid

    Visualise the 32B vs 1,216B keyshare size delta and what it means for TCP and QUIC.

  4. Server readiness matrix

    Which TLS server software, which version, which flag, plus copy-paste openssl test commands.

why it shipped

In order to protect today’s network traffic against future quantum cryptanalytic attacks, we need to begin migrating network security protocols, like TLS, to use quantum-resistant cryptography. TLS will need to update to quantum-resistant cryptography in three separate areas: - Establishing, or agreeing upon a symmetric session key - Authenticating the server’s identity (e.g. X.509 certificate validation) - Authenticating the connection was established by the holder of the server’s private key This feature makes incremental progress on “External Encryption in Transit” by migrating TL

references