What is ML-KEM?

ML-KEM is the key-encapsulation standard that NIST published in August 2024 as FIPS 203. It was derived from CRYSTALS-Kyber, and its security rests on the Module Learning With Errors problem, a lattice problem that is believed to resist quantum attacks.

Also called Kyber, CRYSTALS-Kyber or FIPS 203.

What a key-encapsulation mechanism does

A key-encapsulation mechanism lets two parties agree on a shared secret over a public channel. One side keeps a decapsulation key private and publishes an encapsulation key. The other side uses that public key to create a shared secret and a ciphertext, sends the ciphertext back, and the first side recovers the same secret with its private key.

The shared secret then keys a fast symmetric cipher, which protects the messages themselves.

How it is built

ML-KEM is built on module lattices, and its security is tied to the Module Learning With Errors problem. The standard defines three parameter sets, ML-KEM-512, ML-KEM-768 and ML-KEM-1024, in order of increasing security strength and decreasing performance.

Where it comes from

NIST selected CRYSTALS-Kyber in July 2022 as its standard for general encryption, after a public competition that began in 2016. The standard calls the algorithm ML-KEM, and NIST published it in August 2024.

In Redacted

Bunker mode builds its notes, proofs and signatures with no curves and no lattices, and nothing it writes on chain is encrypted. ML-KEM is a lattice scheme, so it does not appear among its building blocks.

Bunker mode →

Related terms

ML-DSAML-DSA is the lattice-based digital signature standard that NIST published in August 2024 as FIPS 204. It was derived from CRYSTALS-Dilithium, and its signatures are much shorter than those of the hash-based standard SLH-DSA.FIPS 205FIPS 205 is the NIST standard for SLH-DSA, a digital signature scheme built on hash functions alone, published in August 2024. It sits beside FIPS 203 and FIPS 204 as one of NIST’s first three post-quantum standards.Post-quantum cryptographyPost-quantum cryptography is ordinary cryptography designed to stay secure when large quantum computers exist. It replaces the key exchanges and signatures that Shor’s algorithm breaks, such as RSA and elliptic curves, with schemes built on lattices, hash functions or error-correcting codes.Public-key cryptographyPublic-key cryptography gives each person a private key that stays secret and a public key that anyone can see. A signature made with the private key can be checked with the public key, so no secret has to be shared in advance.Harvest now, decrypt laterHarvest now, decrypt later means recording encrypted data today to decrypt it once quantum computers are strong enough. Anything encrypted on a public blockchain is stored for good, so it is open to this by design.Bunker modeBunker mode is Justin Drake’s name for a calm, early move of crypto to addresses whose public keys stay hidden behind a hash, in case elliptic curves break. In Redacted, one click puts your account on 25 words, with no wallet key behind it.

Sources: FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard, NIST, 2024 · NIST releases first 3 finalized post-quantum encryption standards, NIST, August 2024 · NIST announces first four quantum-resistant cryptographic algorithms, NIST, July 2022

Updated November 1, 2026. All terms