Every handshake that secures a web connection today could, in principle, be recorded and cracked open decades from now by a machine that doesn't exist yet. That is the quiet premise behind ML-KEM, a newly standardized algorithm now spreading through browsers, cloud platforms, and operating systems. It does one narrow job: it lets two parties agree on a shared secret over a public network without a future quantum computer being able to recover it later.
Confusion sets in quickly because people hear "post-quantum encryption" and picture a sturdier RSA. That's not what's happening. ML-KEM doesn't touch the files, videos, or messages themselves - those still get sealed with a conventional symmetric cipher such as AES-256-GCM, which a quantum computer barely dents. What actually breaks under quantum attack is the handshake that establishes the symmetric key in the first place, and that handshake is precisely what ML-KEM replaces. The distinction matters for ordinary users too: the same logic that governs whether a decades-old recorded session stays private also shapes smaller everyday puzzles, like what happens to Peacock when you travel and your streaming session suddenly looks like it's coming from a different key exchange entirely. what happens to Peacock when you travel
A different shape of cryptography
ML-KEM - Module-Lattice-Based Key-Encapsulation Mechanism - was standardized by NIST as FIPS 203 in August 2024. It is the finalized, renamed version of CRYSTALS-Kyber, the winner of NIST's long-running post-quantum competition. Older material still refers to it as Kyber; treat the two names as the same family of algorithm.
The structural break from RSA is easy to miss but central to understanding why migration isn't a simple swap. A key-encapsulation mechanism generates a key pair, then lets one party encapsulate a freshly generated shared secret into a ciphertext using the other's public key, and lets the holder of the private key decapsulate that ciphertext to recover the identical secret. Nobody chooses the secret in advance, as one does when encrypting a message with RSA. The secret simply emerges from the mechanism, ready to feed a symmetric cipher. Any protocol built around "encrypt this specific value" has to be restructured around encapsulate and decapsulate instead. The underlying hardness comes from lattice mathematics - specifically the Module Learning With Errors problem - which has no known weakness against Shor's algorithm, the quantum routine that dismantles RSA and elliptic-curve cryptography.
Bigger keys, hybrid deployments, and a cautious industry
Lattice-based security isn't free. ML-KEM-768, the parameter set most organizations are adopting, produces a public key roughly 37 times larger than a classical X25519 key, and pushes wire data per handshake from around 64 bytes to more than two kilobytes. That overhead is tolerable for most connections, though it has occasionally pushed handshake messages past a single network packet, exposing fragmentation bugs in older middleboxes. The output shared secret, notably, stays at a compact 32 bytes - exactly what a symmetric cipher expects.
Major providers are not trusting lattice cryptography alone. Browsers, cloud key-management services, and operating system cryptographic libraries are pairing ML-KEM with a classical algorithm such as X25519 in a hybrid construction, so that a session remains secure if either half holds up. The caution is earned: post-quantum candidates have failed before under cryptanalysis despite surviving multiple rounds of public review. Hybrid deployment means a newly discovered weakness in lattice math cannot leave a connection worse off than conventional encryption does today.
Why the urgency precedes the threat
The migration is driven by a strategy known as harvest now, decrypt later: adversaries can record encrypted traffic today and simply wait for quantum hardware capable of breaking the original key exchange. Anything meant to stay confidential for years - financial records, medical data, government communications - is exposed retroactively the moment such a machine becomes viable. Key exchange is the logical starting point for defense, because a recorded handshake is exactly what a patient attacker is banking on. Securing that exchange now means the contents stay sealed even if the recording survives for decades.
What remains unsettled
ML-KEM itself is a finished standard, implemented across major cryptographic libraries and treated as the safe default choice for new systems. What's still being worked out is how it gets combined with classical algorithms in each protocol, how certificate chains and digital signatures migrate to post-quantum equivalents, and how quickly legacy systems catch up. None of this amounts to a guarantee of permanent safety - "quantum-resistant" describes the best attacks cryptographers currently know, not a mathematical proof. That honesty is itself part of the discipline the field is relearning after past candidates collapsed under scrutiny they initially survived.