Read this first
A hybrid key exchange runs a classical elliptic-curve exchange and a post-quantum KEM side by side and derives one session key from both shared secrets. The connection stays secure as long as either half is unbroken — so it defends against a future quantum break of the curve and against an as-yet-undiscovered flaw in the young post-quantum algorithm at the same time. Most commercial post-quantum deployments today are hybrid.
When people picture the post-quantum migration, they imagine ripping out RSA or elliptic-curve Diffie–Hellman and dropping in a shiny new algorithm. Almost nobody does that in one move. The dominant pattern is hybrid: keep the classical key exchange, add a post-quantum KEM alongside it, and combine the two resulting shared secrets into a single session key.
Two defences from one handshake
A hybrid combines two key-establishment methods — a classical (elliptic-curve) Diffie–Hellman such as X25519 and a post-quantum KEM such as ML-KEM — and feeds both shared secrets into the key derivation. The session key is secure as long as either input is secure. That single handshake covers two very different risks at once:
- **A future quantum computer that breaks the classical curve.** Traffic recorded today can be decrypted retroactively — the harvest-now-decrypt-later threat — and the post-quantum half defeats it.
- **An undiscovered weakness in the post-quantum algorithm itself.** ML-KEM is young by cryptographic standards; the classical curve has two decades of analysis behind it and acts as the safety net if the new scheme is found to be flawed.
The combiner is where it goes wrong
Having two shared secrets is not enough — how you combine them matters, and it is the easiest part to get wrong. The two secrets must be mixed through a proper key-derivation function, not naively XORed or concatenated in a way an attacker can influence. The TLS hybrid group X25519MLKEM768 concatenates the two shares and runs them through the TLS 1.3 key schedule; X-Wing is a distinct construction that binds the two secrets with a SHA3-256-based combiner. Both are designed so that neither component can be stripped or downgraded — a homegrown combiner that skips this binding can silently undo the whole benefit.
A hybrid is only as safe as its combiner
Adding a post-quantum KEM does not make you post-quantum secure on its own. If the two shared secrets are combined without a proper KDF binding — a bare XOR, or a concatenation an attacker can manipulate — the construction may end up no stronger than its weaker half. Use a standardized hybrid such as X25519MLKEM768 or X-Wing, not a bespoke one.
Where hybrids are used — and where pure PQC wins
Hybrid key exchange is already deployed in TLS 1.3, SSH, IKEv2/IPsec, and secure messaging protocols; in practice most commercial post-quantum rollouts are hybrid today, because they add quantum resistance without betting everything on a young algorithm. There is one notable exception. CNSA 2.0, the US suite for national-security systems, does not require hybrids — the NSA prefers validated standalone PQC there, on the view that an extra classical component adds implementation complexity and attack surface without adding assurance it trusts. For everyone else, hybrid remains the pragmatic default through the transition.
The cost you are paying for
Hybrids are not free. You send more bytes on the wire — the ML-KEM ciphertext and public key dwarf an X25519 share — spend more CPU on two operations, and, most importantly, you now depend on two implementations both being correct, with the combiner as a genuine place to introduce a bug. That is a real trade-off, but for anything protecting data with a long shelf life it is the conservative choice.
How quantakrypto helps
We help you deploy hybrids where they belong and skip them where they do not. Our audit finds every key exchange that needs protecting and ranks it by exposure, our migration engineering rolls out standardized hybrids like X25519MLKEM768 without breaking existing clients, and our training makes sure your engineers understand why the combiner matters before they touch a config. Start with the audit — the right hybrid is the one aimed at your actual risk.