[{"data":1,"prerenderedAt":774},["ShallowReactive",2],{"blog-\u002Fblog\u002Fhybrid-vs-pure-post-quantum":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":7,"body":8,"canonical":7,"category":703,"date":704,"description":705,"draft":706,"extension":707,"faqs":708,"findingsSource":7,"geo":721,"howto":7,"howtoTitle":7,"image":7,"industries":723,"keyFindings":7,"meta":726,"modified":727,"navigation":728,"path":729,"pullquote":7,"recommendations":7,"references":730,"related":752,"seo":758,"seoTitle":759,"signposts":7,"slug":760,"stats":761,"stem":764,"tags":765,"tldr":772,"__hash__":773},"blog\u002Fblog\u002Fhybrid-vs-pure-post-quantum.md","Hybrid vs. Pure Post-Quantum Key Exchange: Which Approach Should You Use?","ArcQubit Team",null,{"type":9,"value":10,"toc":685},"minimark",[11,16,39,45,49,57,63,66,70,166,179,183,192,198,202,231,234,238,243,342,346,349,388,391,395,433,439,443,448,528,532,535,562,565,569,631,635,638,648,651,660,664,670,674],[12,13,15],"h2",{"id":14},"the-answer-up-front","The answer, up front",[17,18,19,20,24,25,28,29,24,32,24,35,38],"p",{},"For internet-facing TLS today, use hybrid key exchange: a classical algorithm combined with ML-KEM, such as X25519MLKEM768. Browsers and CDNs already support it, and it stays secure if either component holds ",[21,22,23],"span",{},"1",", ",[21,26,27],{},"2",". Governments differ: OMB calls hybrid a stopgap, NSA will not require it, and ASD does not recommend it ",[21,30,31],{},"3",[21,33,34],{},"4",[21,36,37],{},"5",".",[17,40,41],{},[42,43,44],"em",{},"Last verified: Sep. 30, 2026.",[12,46,48],{"id":47},"what-hybrid-means","What hybrid means",[17,50,51,52,54,55,38],{},"A hybrid key exchange runs two key-establishment algorithms at once and combines their outputs into one shared secret. In TLS 1.3, the common pairing is X25519 (classical, elliptic curve) with ML-KEM-768 (post-quantum, standardized in FIPS 203). RFC 10024, a Proposed Standard published in August 2026, defines three hybrid groups: X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024 ",[21,53,23],{},". The IANA registry marks X25519MLKEM768 as recommended; the other two carry no recommendation ",[21,56,23],{},[17,58,59,60,62],{},"The security goal is simple: the combined secret stays safe as long as at least one component stays safe ",[21,61,23],{},". If a flaw appears in ML-KEM, the classical half still protects the session against today's attackers. If a quantum computer breaks X25519, ML-KEM protects the session.",[17,64,65],{},"A pure post-quantum exchange uses only the post-quantum algorithm, such as ML-KEM-768 or ML-KEM-1024, with no classical partner.",[12,67,69],{"id":68},"trade-offs","Trade-offs",[71,72,73,89],"table",{},[74,75,76],"thead",{},[77,78,79,83,86],"tr",{},[80,81,82],"th",{},"Factor",[80,84,85],{},"Hybrid",[80,87,88],{},"Pure post-quantum",[90,91,92,104,114,125,138,151],"tbody",{},[77,93,94,98,101],{},[95,96,97],"td",{},"Security if ML-KEM has an undiscovered flaw",[95,99,100],{},"Classical half still protects against classical attackers",[95,102,103],{},"Depends on ML-KEM alone",[77,105,106,109,112],{},[95,107,108],{},"Security against a quantum attacker",[95,110,111],{},"Depends on ML-KEM",[95,113,111],{},[77,115,116,119,122],{},[95,117,118],{},"Complexity",[95,120,121],{},"Two algorithms, more negotiation, more error handling",[95,123,124],{},"One algorithm",[77,126,127,130,135],{},[95,128,129],{},"Handshake size",[95,131,132,133],{},"Larger than classical; RFC 10024 gives a 1,216-byte client key share and 1,120-byte server key share for X25519MLKEM768 ",[21,134,23],{},[95,136,137],{},"Similar to the post-quantum component alone",[77,139,140,143,148],{},[95,141,142],{},"Deployment today",[95,144,145,146],{},"Widely deployed on the public web ",[21,147,27],{},[95,149,150],{},"Rare on the public web",[77,152,153,156,161],{},[95,154,155],{},"Standards path",[95,157,158,159],{},"RFC 10024 (Proposed Standard) ",[21,160,23],{},[95,162,163,164],{},"Government profiles such as CNSA 2.0 ",[21,165,34],{},[17,167,168,169,171,172,174,175,178],{},"Two costs deserve attention. Hybrid adds engineering and testing work: the NSA FAQ says hybrid solutions \"add complexity to protocols and crypt libraries, as designers need to incorporate additional negotiation and error handling\" ",[21,170,34],{},". OMB calls hybrid architecture \"an intricate and resource-intensive stopgap\" and asks agencies to evaluate its trade-offs ",[21,173,31],{},". Larger handshakes can also affect latency. The Go 1.24 release notes say that buggy TLS servers that do not handle large records correctly can cause a handshake timeout, and they document a GODEBUG setting (tlsmlkem=0) that turns the hybrid default off ",[21,176,177],{},"7",". Test on your own network.",[12,180,182],{"id":181},"how-widely-deployed-is-hybrid","How widely deployed is hybrid?",[17,184,185,186,188,189,38],{},"Cloudflare reported on Sep. 29, 2026 that about 70% of browser-generated traffic reaching its network, measured on the visitor-to-Cloudflare connection, used hybrid ML-KEM key exchange ",[21,187,27],{},". That figure describes Cloudflare's traffic, not the whole internet. It shows that mainstream browsers and at least one large CDN have moved to hybrid. Cloudflare also targets full post-quantum security, including authentication, across its product suite by 2029, a goal it announced on Apr. 7, 2026 ",[21,190,191],{},"6",[17,193,194,195,197],{},"Server-side adoption lags browser-side adoption. In the same Sep. 29, 2026 post, Cloudflare said that just about 15% of the origin servers it connects to use hybrid ML-KEM ",[21,196,27],{},". That is an aggregate across Cloudflare's origin connections, not a count of all servers on the internet.",[12,199,201],{"id":200},"what-governments-say","What governments say",[203,204,205,215,223],"ul",{},[206,207,208,212,213,38],"li",{},[209,210,211],"strong",{},"United States, civilian agencies."," OMB tells agencies to evaluate hybrid's trade-offs, calls it a stopgap, and requires TLS 1.3 support by Jan. 2, 2030, because post-quantum key exchange in TLS depends on it ",[21,214,31],{},[206,216,217,220,221,38],{},[209,218,219],{},"United States, national security systems."," NSA states that it has confidence in the CNSA 2.0 algorithms and \"will not require NSS developers to use hybrid certified products for security purposes.\" CNSA 2.0 calls for ML-KEM-1024 at all classification levels ",[21,222,34],{},[206,224,225,228,229,38],{},[209,226,227],{},"Australia."," ASD does not recommend hybrid and does not prohibit it, and it expects an eventual move to purely post-quantum algorithms ",[21,230,37],{},[17,232,233],{},"Read together, these positions leave hybrid as an allowed but not universally favored choice. The public web has moved ahead of government guidance because compatibility and hedging matter more for browsers than for closed government systems.",[12,235,237],{"id":236},"decision-guide","Decision guide",[17,239,240],{},[42,241,242],{},"This table is ArcQubit guidance built on the cited sources.",[71,244,245,258],{},[74,246,247],{},[77,248,249,252,255],{},[80,250,251],{},"Situation",[80,253,254],{},"Recommendation",[80,256,257],{},"Basis",[90,259,260,275,287,299,311,322],{},[77,261,262,265,268],{},[95,263,264],{},"Public web and API TLS",[95,266,267],{},"Hybrid X25519MLKEM768",[95,269,270,271,24,273],{},"Deployed by browsers and CDNs ",[21,272,23],{},[21,274,27],{},[77,276,277,280,283],{},[95,278,279],{},"Federal civilian systems",[95,281,282],{},"Hybrid allowed after evaluation; plan for post-quantum-only",[95,284,285],{},[21,286,31],{},[77,288,289,292,295],{},[95,290,291],{},"National security systems",[95,293,294],{},"Follow CNSA 2.0: ML-KEM-1024; hybrid not required",[95,296,297],{},[21,298,34],{},[77,300,301,304,307],{},[95,302,303],{},"Australian government context",[95,305,306],{},"Pure post-quantum preferred over the long run",[95,308,309],{},[21,310,37],{},[77,312,313,316,319],{},[95,314,315],{},"Internal systems with strict performance limits",[95,317,318],{},"Pilot both; measure",[95,320,321],{},"Our recommendation",[77,323,324,327,330],{},[95,325,326],{},"Signatures and PKI",[95,328,329],{},"Separate decision; hybrid key exchange does not solve it",[95,331,332,337,338],{},[333,334,336],"a",{"href":335},"\u002Fblog\u002Fnist-pqc-standards-guide","NIST Post-Quantum Standards Guide"," and ",[333,339,341],{"href":340},"\u002Fblog\u002Fpqc-mandates-deadlines","Global Mandates and Deadlines",[12,343,345],{"id":344},"what-this-means-for-executives-and-the-board","What this means for executives and the board",[17,347,348],{},"You do not need to pick an algorithm. You do need to own the decision about who picks it, and on what evidence. The choice between hybrid and pure post-quantum key exchange is a risk trade-off, and your leadership team should frame it that way.",[203,350,351,357,366,379],{},[206,352,353,356],{},[209,354,355],{},"Your CISO owns the recommendation."," The CISO should say which systems use hybrid, which wait, and why. Regulators and auditors will ask for that reasoning, not for a brand name.",[206,358,359,362,363,365],{},[209,360,361],{},"Your CIO or CTO owns the rollout."," Hybrid adds engineering and testing work ",[21,364,34],{},". That work needs budget and a named owner.",[206,367,368,371,372,24,374,24,376,378],{},[209,369,370],{},"Your general counsel owns the regulatory map."," The three governments cited here disagree ",[21,373,31],{},[21,375,34],{},[21,377,37],{},". If you sell to government customers in more than one country, you may face conflicting expectations.",[206,380,381,384,385,387],{},[209,382,383],{},"Your CFO owns the cost of a wrong turn."," Hybrid is a stopgap in OMB's words ",[21,386,31],{},". Plan for a second migration, from hybrid to post-quantum-only, rather than treating hybrid as the end state.",[17,389,390],{},"ArcQubit guidance: frame hybrid as insurance. You pay a modest complexity cost now to protect against a flaw in a young algorithm. Pure post-quantum removes that insurance and simplifies the design. Governments with closed systems and strong internal review may accept that trade. A public website with millions of unknown clients usually cannot.",[12,392,394],{"id":393},"questions-to-ask-your-team-this-week","Questions to ask your team this week",[396,397,398,401,404,410,419,424,427,430],"ol",{},[206,399,400],{},"Which of our TLS and VPN endpoints already negotiate a hybrid group, and how do we know?",[206,402,403],{},"Which endpoints still offer only classical key exchange, and which of those carry data with a long shelf life?",[206,405,406,407,409],{},"Do any of our services or vendors still use pre-standard group names such as X25519Kyber768Draft00 ",[21,408,23],{},"?",[206,411,412,413,24,415,24,417,409],{},"Which of our government customers or regulators publish guidance, and does it say hybrid, pure, or neither ",[21,414,31],{},[21,416,34],{},[21,418,37],{},[206,420,421,422,409],{},"Have we tested handshakes on our own network, including older servers and middleboxes that might mishandle large records ",[21,423,177],{},[206,425,426],{},"Can we turn hybrid off quickly if a problem appears, and who decides?",[206,428,429],{},"Which vendors control our TLS termination, and what do their roadmaps say?",[206,431,432],{},"What is our plan for signatures and certificates, which hybrid key exchange does not solve?",[17,434,435,436,438],{},"Ask for written answers. Vague answers to questions 1 and 7 usually point to a visibility gap. Cloudflare's own post on this topic is titled around helping you see whether your domain uses post-quantum encryption ",[21,437,27],{},", which shows that basic visibility is a live problem.",[12,440,442],{"id":441},"decisions-leadership-must-make-in-the-next-90-days","Decisions leadership must make in the next 90 days",[17,444,445],{},[42,446,447],{},"ArcQubit guidance. The timeline is our recommendation, not a mandate.",[71,449,450,463],{},[74,451,452],{},[77,453,454,457,460],{},[80,455,456],{},"Decision",[80,458,459],{},"Owner",[80,461,462],{},"Suggested timing",[90,464,465,476,487,497,508,518],{},[77,466,467,470,473],{},[95,468,469],{},"Set the default: hybrid for public-facing TLS unless a written exception applies",[95,471,472],{},"CISO",[95,474,475],{},"Within 30 days",[77,477,478,481,484],{},[95,479,480],{},"Inventory key-exchange use on public endpoints, VPNs and internal services",[95,482,483],{},"Security engineering",[95,485,486],{},"Within 60 days",[77,488,489,492,495],{},[95,490,491],{},"Identify systems where a regulator or customer sets a different rule",[95,493,494],{},"General counsel",[95,496,486],{},[77,498,499,502,505],{},[95,500,501],{},"Approve a pilot of hybrid and pure post-quantum on one internal system, with measurement",[95,503,504],{},"CIO or CTO",[95,506,507],{},"Within 90 days",[77,509,510,513,516],{},[95,511,512],{},"Require vendors to state their supported groups and their plan to move beyond hybrid",[95,514,515],{},"Procurement",[95,517,507],{},[77,519,520,523,525],{},[95,521,522],{},"Report status and open risks to the board",[95,524,472],{},[95,526,527],{},"Next scheduled board meeting",[12,529,531],{"id":530},"how-to-brief-your-board","How to brief your board",[17,533,534],{},"Keep the message short. Here are four talking points you can adapt.",[396,536,537,543,549,559],{},[206,538,539,540,542],{},"\"Browsers and large content networks already use hybrid key exchange. Cloudflare reported that about 70% of browser-generated traffic to its network used it on Sep. 29, 2026 ",[21,541,27],{},". That is one network, not the whole internet.\"",[206,544,545,546,548],{},"\"Hybrid combines a classical algorithm with ML-KEM. It stays secure if either part holds ",[21,547,23],{},".\"",[206,550,551,552,24,554,24,556,558],{},"\"Governments disagree. OMB calls hybrid a stopgap, NSA will not require it, and ASD does not recommend it ",[21,553,31],{},[21,555,34],{},[21,557,37],{},". We will follow the rule that applies to each system.\"",[206,560,561],{},"\"We will use hybrid for public traffic, test on our own network, and plan a later move to post-quantum-only where our regulators point that way.\"",[17,563,564],{},"Then state what you need from the board: support for the budget, and agreement that management will report progress on a fixed schedule.",[12,566,568],{"id":567},"common-mistakes-and-how-to-avoid-them","Common mistakes and how to avoid them",[203,570,571,585,598,607,616,622],{},[206,572,573,576,577,579,580,584],{},[209,574,575],{},"Treating hybrid as permanent."," OMB calls it a stopgap ",[21,578,31],{},". Build systems so you can change the key-exchange group without a rewrite. Our ",[333,581,583],{"href":582},"\u002Fblog\u002Fcrypto-agility","Crypto-Agility"," article explains how.",[206,586,587,590,591,24,593,24,595,597],{},[209,588,589],{},"Assuming one rule fits every country."," The US civilian, US national security and Australian positions differ ",[21,592,31],{},[21,594,34],{},[21,596,37],{},". Map each system to the rule that governs it.",[206,599,600,603,604,606],{},[209,601,602],{},"Deploying draft group names."," RFC 10024 obsoletes the earlier draft names ",[21,605,23],{},". Use the standardized ones.",[206,608,609,612,613,615],{},[209,610,611],{},"Skipping the test."," Larger handshakes can expose buggy servers ",[21,614,177],{},". Test before a broad rollout, and keep a way to turn hybrid off.",[206,617,618,621],{},[209,619,620],{},"Confusing key exchange with signatures."," Hybrid key exchange protects the secret a session derives. It does not replace certificates or signatures, which are a separate migration.",[206,623,624,627,628,630],{},[209,625,626],{},"Quoting a vendor figure without its context."," The Cloudflare number describes one network on one day ",[21,629,27],{},". Do not present it to your board as an internet-wide statistic.",[12,632,634],{"id":633},"a-worked-example","A worked example",[17,636,637],{},"Consider a mid-sized company with three kinds of systems: a public web application, a VPN for staff, and an internal system that exchanges records with a government customer.",[17,639,640,641,24,643,645,646,38],{},"The CISO reviews the public web application first. Browsers and CDNs already support X25519MLKEM768 ",[21,642,23],{},[21,644,27],{},", so the team enables it at the edge and tests handshakes on its own network. It keeps a setting to turn hybrid off if a legacy server misbehaves ",[21,647,177],{},[17,649,650],{},"Next, the team checks the VPN. It asks the vendor which groups the product supports and when it will move beyond hybrid. The answer decides whether the company renews or opens a tender.",[17,652,653,654,656,657,659],{},"Last, general counsel reads the government customer's contract. If the customer operates a national security system, the CNSA 2.0 profile applies, which calls for ML-KEM-1024 and does not require hybrid ",[21,655,34],{},". If the customer is a civilian US agency, OMB expects an evaluation of hybrid's trade-offs ",[21,658,31],{},". The company now has three different answers for three different systems, each with a written reason. That is the outcome the board should expect: not one algorithm everywhere, but a documented decision per system.",[12,661,663],{"id":662},"which-name-should-i-use","Which name should I use?",[17,665,666,667,669],{},"Use the standardized names from RFC 10024. Earlier drafts used names such as X25519Kyber768Draft00, which the RFC obsoletes ",[21,668,23],{},". Do not deploy pre-standard groups in new systems.",[12,671,673],{"id":672},"where-ml-kem-comes-from","Where ML-KEM comes from",[17,675,676,677,679,680,684],{},"ML-KEM is the key-encapsulation mechanism in NIST FIPS 203, finalized in August 2024. ",[333,678,336],{"href":335},", covers FIPS 203, 204, and 205 and what comes next. ",[333,681,683],{"href":682},"\u002Fblog\u002Fharvest-now-decrypt-later","Harvest Now, Decrypt Later",", explains why key exchange is the first priority.",{"title":686,"searchDepth":687,"depth":687,"links":688},"",2,[689,690,691,692,693,694,695,696,697,698,699,700,701,702],{"id":14,"depth":687,"text":15},{"id":47,"depth":687,"text":48},{"id":68,"depth":687,"text":69},{"id":181,"depth":687,"text":182},{"id":200,"depth":687,"text":201},{"id":236,"depth":687,"text":237},{"id":344,"depth":687,"text":345},{"id":393,"depth":687,"text":394},{"id":441,"depth":687,"text":442},{"id":530,"depth":687,"text":531},{"id":567,"depth":687,"text":568},{"id":633,"depth":687,"text":634},{"id":662,"depth":687,"text":663},{"id":672,"depth":687,"text":673},"Engineering","2026-08-11","Hybrid or pure post-quantum key exchange? Trade-offs, deployment status, what governments say, and a decision guide for your TLS and VPN traffic.",false,"md",[709,712,715,718],{"q":710,"a":711},"What is hybrid key exchange?","It combines a classical key exchange with a post-quantum one and derives one shared secret from both. The result stays secure as long as at least one component holds [1].",{"q":713,"a":714},"What is X25519MLKEM768?","It is a TLS 1.3 hybrid group that pairs X25519 with ML-KEM-768. RFC 10024 defines it and the IANA registry marks it as recommended [1].",{"q":716,"a":717},"Should I use hybrid or pure post-quantum for TLS?","For public internet TLS, hybrid is the deployed choice today [2]. NSA does not require hybrid for national security systems, and ASD expects a long-term move to pure post-quantum [4], [5].",{"q":719,"a":720},"Does hybrid slow down connections?","It adds bytes. RFC 10024 lists a 1,216-byte client key share and a 1,120-byte server key share for X25519MLKEM768 [1]. Measure the effect on your own network.",[722],"global",[724,725],"Cross-Sector","Information Technology",{},"2026-09-30",true,"\u002Fblog\u002Fhybrid-vs-pure-post-quantum",[731,734,737,740,743,746,749],{"label":732,"url":733},"K. Kwiatkowski, P. Kampanakis, B. E. Westerbaan, and D. Stebila, \"Post-Quantum Traditional (PQ\u002FT) Hybrid Key Agreement Mechanisms for TLS 1.3,\" RFC 10024, Aug. 2026","https:\u002F\u002Fwww.rfc-editor.org\u002Finfo\u002Frfc10024",{"label":735,"url":736},"Cloudflare, \"Is your domain using post-quantum encryption? Now you can see for yourself,\" Cloudflare Blog, Sep. 29, 2026","https:\u002F\u002Fblog.cloudflare.com\u002Fpost-quantum-visibility\u002F",{"label":738,"url":739},"Office of Management and Budget, \"Execution of the Migration to Post-Quantum Cryptography,\" Memorandum M-26-15, Jun. 24, 2026","https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FM-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf",{"label":741,"url":742},"National Security Agency, \"The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ,\" Ver. 2.1, Dec. 2024","https:\u002F\u002Fmedia.defense.gov\u002F2022\u002FSep\u002F07\u002F2003071836\u002F-1\u002F-1\u002F0\u002FCSI_CNSA_2.0_FAQ_.PDF",{"label":744,"url":745},"Australian Signals Directorate, \"Planning for post-quantum cryptography,\" Australian Cyber Security Centre","https:\u002F\u002Fwww.cyber.gov.au\u002Fbusiness-government\u002Fsecure-design\u002Fquantum\u002Fplanning-for-post-quantum-cryptography",{"label":747,"url":748},"Cloudflare, \"Cloudflare targets 2029 for full post-quantum security,\" Cloudflare Blog, Apr. 7, 2026","https:\u002F\u002Fblog.cloudflare.com\u002Fpost-quantum-roadmap\u002F",{"label":750,"url":751},"The Go Authors, \"Go 1.24 Release Notes,\" Feb. 2025","https:\u002F\u002Fgo.dev\u002Fdoc\u002Fgo1.24",[753,754,756],{"label":683,"url":682},{"label":755,"url":335},"NIST PQC Standards Guide",{"label":757,"url":582},"Crypto Agility",{"title":5,"description":705},"Hybrid vs. Pure Post-Quantum Key Exchange","hybrid-vs-pure-post-quantum",[762,763],"Cloudflare reported that about 70% of browser-generated traffic reaching its network used hybrid ML-KEM key exchange on Sep. 29, 2026 (Cloudflare, 2026).","OMB requires federal agencies to support TLS 1.3 by Jan. 2, 2030 (Office of Management and Budget, 2026).","blog\u002Fhybrid-vs-pure-post-quantum",[766,767,768,769,770,771],"hybrid key exchange","ML-KEM","post-quantum cryptography","quantum-safe algorithms","for developers","how-to","For internet-facing TLS today, use hybrid key exchange, a classical algorithm combined with ML-KEM such as X25519MLKEM768, because it is widely deployed and stays secure if either component holds.","Y-IA2K1tR7PjAFVQyifh1G8_Tr3P2gzKiLpowgsVgKo",1792182884084]