Summary
Kyber is the result of a seven-year selection process (2017-2024) by NIST to standardize post-quantum cryptography. Originally part of the CRYSTALS (Cryptographic Suite for Algebraic Lattices) family, it was selected as the primary KEM and renamed to ML-KEM in the FIPS 203 standard.
The NIST Process
Timeline
| Date | Event |
|---|---|
| Dec 2016 | NIST announces the PQC competition |
| Nov 2017 | 69 candidates submitted (including Kyber) |
| Jan 2019 | 26 candidates advance to round 2 (Kyber included) |
| Jul 2020 | 15 candidates advance to round 3 (Kyber included) |
| Jul 2022 | NIST announces Kyber as winner for KEM |
| Aug 2023 | Draft FIPS 203 published for comments |
| Aug 2024 | Final FIPS 203 published — Kyber becomes ML-KEM |
| Nov 2024 | Transition begins in US federal systems |
| 2035 | Target for full migration of government systems |
Finalist Candidates for KEM
| Algorithm | Type | Result |
|---|---|---|
| Kyber | Module-LWE | Selected (ML-KEM, FIPS 203) |
| Classic McEliece | Goppa codes | Finalist, not yet standardized |
| NTRU | NTRU | Finalist, not standardized |
| Saber | Module-LWR | Finalist, merged with Kyber |
| FrodoKEM | Standard LWE | Recommended alternative |
Why Did Kyber Win?
| Factor | Kyber | Competitors |
|---|---|---|
| Key size | Small (1-3 KB) | Classic McEliece: ~1 MB |
| Speed | Very fast (NTT, optimized) | NTRU: comparable |
| Conservative security | Conservative parameters | Saber: more aggressive |
| Analysis simplicity | Well-studied Module-LWE | NTRU: more complex structure |
| Ecosystem | Multiple implementations | FrodoKEM: slow, large keys |
The CRYSTALS Family
Kyber is half of the CRYSTALS family:
| Algorithm | Purpose | Standard |
|---|---|---|
| Kyber (ML-KEM) | Key Encapsulation Mechanism | FIPS 203 |
| Dilithium (ML-DSA) | Digital Signature Algorithm | FIPS 204 |
Both based on lattices, both selected by NIST. They share the same mathematical structure (Module-LWE / Module-SIS) and can share NTT implementation.
Current Adoption (July 2026)
Confirmed Integrations
| Product/Project | Algorithm | Status |
|---|---|---|
| Cloudflare | X25519Kyber768 | In production since 2023 |
| Google Chrome | X25519Kyber768 | In TLS 1.3 since Chrome 116 |
| AWS Key Management Service | ML-KEM-768 | In preview |
| Signal | PQXDH (with Kyber) | In production |
| Apple iMessage | PQ3 (with Kyber) | In production since 2024 |
| OpenSSL 3.5+ | ML-KEM-768/1024 | Support added |
| BoringSSL | ML-KEM-768 | Support added |
| liboqs | All levels | Reference library |
| WireGuard | Post-quantum planned | In development |
Hybrid Mode
The unanimous industry recommendation is to use hybrid mode: Kyber + a classical KEM (X25519). This ensures that:
- If Kyber is broken: classical security still protects
- If ECC is broken (Shor): quantum security still protects
- While both are intact: security is the sum of both
TLS 1.3 with X25519Kyber768:
- ClientHello offers X25519 + Kyber768
- Server chooses both
- Shared key = HKDF(X25519_result || Kyber_result)
Controversies
Debate on Trust in Lattices
Some cryptographers (Bernstein, Lange) argue that trust in lattices is excessive: there is no proof that LWE is hard for quantum computers, and history shows that new cryptographic paradigms typically last ~20 years before serious weaknesses are found.
The Absence of Classic McEliece
Classic McEliece (based on Goppa codes) offers more conservative security (40+ years of analysis without serious advances), but its keys (~1 MB) make it impractical for most applications. NIST did not standardize it but recommends it as an alternative for high-security applications with sufficient bandwidth.
Centralization of the NIST Process
Critics point out that the process favored algorithms with fast implementations and small sizes, possibly at the expense of wider security margins.
References
- NIST (2024). "FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard."
- NIST (2022). "Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process."
- Cloudflare (2023). "Post-quantum cryptography goes GA."
- Google Security Blog (2023). "Google Chrome deploys post-quantum cryptography."
- Signal Blog (2023). "PQXDH: Post-Quantum Key Agreement for the Signal Protocol."
- Bernstein, D. J. (2022). "The argument against lattice-based cryptography."