Meta-Conclusion (2026-07-15)
After analyzing Kyber (ML-KEM) from its mathematical foundations to its industrial adoption — passing through algorithmic structure, parameters, attacks, and standardization — the following conclusions inform my position as a writer and researcher.
Summary of Findings
| Aspect | Verdict |
|---|---|
| Mathematical maturity | High — LWE has 20+ years of analysis |
| Implementation maturity | High — multiple audited implementations |
| Quantum resistance | High — no known quantum attack is practical |
| Risk of future break | Low-Medium — plausible but not imminent |
| Implementation risk | High — the greatest real risk today |
| Protocol risk | High — hybrid mitigates but does not eliminate |
| Industrial adoption | High and accelerating — Chrome, Cloudflare, Signal, Apple |
What I Find Important
1. The Elegance of Module-LWE
Kyber elegantly resolves the dilemma between security and efficiency. Standard LWE is too slow (huge keys). Ring-LWE is efficient but concentrates security in a single ring, which some see as a risk. Module-LWE interpolates between both: it allows increasing security by scaling k without sacrificing NTT efficiency.
It is a modular design in both the literal and figurative sense.
2. The FO Transform as Philosophy
The Fujisaki-Okamoto transformation — reprocess and verify before trusting — is a pattern that transcends cryptography. It is the same principle that appears in my fingerprinting analyses: do not trust what you receive without verifying it from scratch.
The FO transform converts an insecure system into a secure one not by adding complexity, but by demanding internal consistency. Like the identity profile in Obscura: all signals must match or the system fails safely.
3. The Defender-Attacker Asymmetry
Kyber does not escape the asymmetry I have documented in Obscura and Chat Control:
- The defender (Kyber's designer) must choose parameters that resist all known attacks and those not yet known.
- The attacker only needs to find one attack the defender did not anticipate.
The history of cryptography is the history of this asymmetry. Each generation believes its algorithm is definitive. None has been.
4. The Irony of Post-Quantum
Post-quantum cryptography exists because Shor proved that RSA/ECC are fundamentally insecure against quantum computers. But the security of the replacements (lattices, codes, hash) also rests on unproven hardness conjectures.
There is no "definitive refuge." Only better-founded conjectures.
Implications for My Projects
| Project | Relevance of Kyber |
|---|---|
| Obscura | Obscura should consider migrating to TLS 1.3 with X25519Kyber768 to protect proxy traffic against post-quantum recording and replay |
| Chat Control | Encryption regulation (Chat Control) does not explicitly mention post-quantum, but the "strong encryption" argument changes when Kyber is the norm: if all traffic uses hybrid PQ, client-side scanning is even harder to justify |
| xKyber Crypto | xkyber_crypto — personal implementation in Dart/Flutter during the learning phase. Archived after first-hand verification of the impossibility of guaranteeing constant time in the Dart VM, validating in practice the thesis of The Layer That Fails [II] |
| Writing | The RSA→ECC→Kyber→? narrative arc is a powerful story about the provisional nature of security |
Open Questions
How long will Kyber last? No one knows. The optimistic conjecture: 30-50 years. The pessimistic: 10-15, until a quantum algorithm for lattices is found.
Will we migrate to something else? Probably. Isogeny-based cryptography (SQIsign) or code-based (Classic McEliece) could be the next step if lattices fall.
What does "secure" mean when it is provisional? Perhaps the most honest conclusion is that cryptographic security is never definitive, only good enough for the foreseeable present.
Final Word
Kyber is the best post-quantum cryptography we have today. It is mathematically sound, efficient, well-analyzed, and in the process of mass adoption. But it is not eternal. No cryptography is.
The interesting question is not "is Kyber secure?" (yes, by current standards), but "what happens when it ceases to be?"
"Encryption is not a destination. It is a process of deferral."
Related Documents
- Research Index — All Kyber documents
- Obscura — Conclusions — The defender-attacker asymmetry in fingerprinting
- Chat Control — Encryption and Surveillance — How post-quantum encryption changes the regulatory debate