Source-verifiedLevel 3

ML-KEM (Module-Lattice Key Encapsulation)

ML-KEM (formerly CRYSTALS-Kyber) is a NIST-standardized post-quantum key encapsulation mechanism based on the Module Learning With Errors (MLWE) problem, designed to resist both classical and quantum attacks.

What it means

ML-KEM is the first post-quantum key encapsulation mechanism standardized by NIST (FIPS 203, 2024).It replaces RSA and elliptic curve key exchange protocols that are vulnerable to Shor's algorithm.ML-KEM's security is based on the hardness of the Module Learning With Errors (MLWE) problem over polynomial lattices.It offers three security levels: ML-KEM-512 (equivalent to AES-128), ML-KEM-768 (AES-192), and ML-KEM-1024 (AES-256).The algorithm is efficient, with small key sizes and fast computation compared to other post-quantum candidates.ML-KEM uses the NTT (Number Theoretic Transform) for efficient polynomial multiplication and includes an implicit rejection mechanism for CCA security.

Everyday analogy

ML-KEM is like building a lock from a mathematical maze (lattice) that is easy to navigate with the key but exponentially hard to solve for anyone who doesn't have it, even with a quantum computer.
Think of it as upgrading from a lock that quantum lockpicks can crack (RSA) to a new quantum-resistant lock design based on a completely different mathematical structure.

Common misconceptions

  • ML-KEM does NOT use quantum computing -- it is a CLASSICAL algorithm designed to resist attacks from quantum computers.
  • ML-KEM does NOT encrypt data directly -- it is a key encapsulation mechanism that establishes shared secret keys, which are then used with symmetric encryption.

Key takeaways

  • NIST-standardized (FIPS 203) post-quantum key encapsulation mechanism.
  • Based on the Module Learning With Errors (MLWE) lattice problem.
  • Replaces RSA/ECDH key exchange to protect against Shor's algorithm.

Check your understanding

What mathematical problem is ML-KEM's security based on?

  1. A.Integer factoring
  2. B.Discrete logarithm
  3. C.Module Learning With Errors (MLWE)
  4. D.Hash collision
Show the answer

Answer: C. Module Learning With Errors (MLWE)

Why: ML-KEM's security relies on the hardness of the Module Learning With Errors problem over polynomial lattices, which is believed to be hard for both classical and quantum computers.

Builds on

QubitShor's Algorithm

Primary source: NIST FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard (2024), doi:10.6028/NIST.FIPS.203

Standardization fact is dated in text (2024); the standard document is fixed. PQC context as of 2026-07-10: NIST selected HQC as a 5th, non-lattice backup KEM (2025-03-11); FN-DSA (FIPS 206) not yet final; US EO 14412 (2026-06-22) sets federal migration deadlines of 2030/2031. Text scope (ML-KEM/FIPS 203) unaffected.

Learn it hands-on

This concept is part of a 46-level curriculum with an interactive simulator and Lumen, a tutor whose answers are verified before you see them. Levels 1–5 are free.

Start freeSee the curriculum