The post-quantum toolkit
Hybrid key exchange, certificates, and signatures
What a hybrid TLS handshake protects today, the gap between confidentiality and authentication, and why bigger keys and signatures are a real constraint.
7 min read
What you'll be able to do
- Explain what hybrid key exchange is, and what X25519MLKEM768 protects today.
- State the asymmetry between key exchange and authentication in most current deployments.
- Describe why larger post-quantum keys and signatures are a genuine migration constraint, not a rounding error.
Hybrid key exchange combines a classical mechanism, such as X25519 (an elliptic-curve Diffie-Hellman variant), with a post-quantum KEM (ML-KEM), and derives the session's shared secret from both. The connection stays confidential unless both algorithms are broken, so a future weakness discovered in one does not, by itself, expose the session.
That protects handshake confidentiality — the part exposed to harvest-now-decrypt-later, where an adversary records ciphertext today and waits for a capable machine. It says nothing yet about authentication: the certificate that tells a browser it is really talking to the server it expects. In most deployments today, that certificate is still signed with a classical algorithm, typically RSA or ECDSA.
| What | Protected by hybrid key exchange today? | What still relies on classical cryptography |
|---|---|---|
| Handshake confidentiality (the session key) | Yes, where X25519MLKEM768 or similar is negotiated | Nothing — this is the part hybrid exchange addresses |
| Server authentication (the certificate) | Not yet, in most deployments | Certificate signatures, typically RSA or ECDSA, and the certificate authority chain behind them |
Post-quantum keys, ciphertexts, and especially signatures are measurably larger than their classical equivalents. A lattice-based signature such as ML-DSA is several times the size of a comparable ECDSA signature, and a hash-based SLH-DSA signature is larger still. That is not a rounding error: certificate chains, protocol message-size limits, and embedded systems with fixed buffer sizes all have real ceilings, and a migration plan has to check them rather than assume a drop-in swap.
Marking a lesson complete only updates this browser.