IETF Standardizes Hybrid ML-KEM TLS 1.3 Key Exchange

IETF RFC 10024 establishes three hybrid post-quantum TLS 1.3 key-agreement groups that combine ML-KEM with elliptic-curve Diffie-Hellman. X25519MLKEM768 is the only group designated Recommended in IANA’s TLS Supported Groups registry; NIST-curve variants remain available for compliance-focused deployments. The standard formalizes an approach already used by browsers, CDNs, and TLS libraries and discourages use of earlier Kyber768 draft code points, reducing a standards barrier to mitigating harvest-now-decrypt-later exposure.

Cloudflare has deployed Automatic Key Exchange to probe origin-server capabilities and select the strongest mutually supported TLS 1.3 group, prioritizing X25519MLKEM768. The rollout increased post-quantum traffic across scanned origins from roughly 25 billion to 45 billion daily connections, with 99.2% of post-quantum handshakes completing in one network round trip; retry-dependent handshakes fell from about 52% to 3.7%, cutting 90th-percentile handshake latency by more than 150 ms. Organizations still need origins that support X25519MLKEM768 to receive end-to-end hybrid key-establishment protection, while post-quantum TLS authentication remains constrained by limited public WebPKI support for ML-DSA certificates and trusted roots.