Skip to main content
RelixQ
Menu
Course outline

The post-quantum toolkit

Hybrid key exchange, certificates, and signatures

What a hybrid TLS handshake protects today, the gap between confidentiality and authentication, and why bigger keys and signatures are a real constraint.

7 min read

What you'll be able to do

  • Explain what hybrid key exchange is, and what X25519MLKEM768 protects today.
  • State the asymmetry between key exchange and authentication in most current deployments.
  • Describe why larger post-quantum keys and signatures are a genuine migration constraint, not a rounding error.

Hybrid key exchange combines a classical mechanism, such as X25519 (an elliptic-curve Diffie-Hellman variant), with a post-quantum KEM (ML-KEM), and derives the session's shared secret from both. The connection stays confidential unless both algorithms are broken, so a future weakness discovered in one does not, by itself, expose the session.

That protects handshake confidentiality — the part exposed to harvest-now-decrypt-later, where an adversary records ciphertext today and waits for a capable machine. It says nothing yet about authentication: the certificate that tells a browser it is really talking to the server it expects. In most deployments today, that certificate is still signed with a classical algorithm, typically RSA or ECDSA.

WhatProtected by hybrid key exchange today?What still relies on classical cryptography
Handshake confidentiality (the session key)Yes, where X25519MLKEM768 or similar is negotiatedNothing — this is the part hybrid exchange addresses
Server authentication (the certificate)Not yet, in most deploymentsCertificate signatures, typically RSA or ECDSA, and the certificate authority chain behind them

Post-quantum keys, ciphertexts, and especially signatures are measurably larger than their classical equivalents. A lattice-based signature such as ML-DSA is several times the size of a comparable ECDSA signature, and a hash-based SLH-DSA signature is larger still. That is not a rounding error: certificate chains, protocol message-size limits, and embedded systems with fixed buffer sizes all have real ceilings, and a migration plan has to check them rather than assume a drop-in swap.

Knowledge check

A CDN dashboard reports that a large share of TLS handshakes to the main site negotiated X25519MLKEM768 last week. A colleague concludes the site is now fully protected against a future quantum computer.

What is missing from that conclusion?

Marking a lesson complete only updates this browser.