Post-Quantum Cryptography in Practice: ML-KEM + X25519 in KeibiDrop

        Symmetric cryptography (AES-256, ChaCha20) holds up well against quantum computers. Grover's algorithm halves the effective key length, so a 256-bit key still provides 128-bit security. The problem is public key cryptography: RSA, ECDSA, ECDH, and X25519 are all vulnerable to Shor's algorithm. No quantum computer can run Shor at meaningful scale today, but data encrypted now can be stored and decrypted later ("harvest now, decrypt later").
      

What We Use in KEIBIDROP

KEIBIDROP uses a hybrid key exchange combining two KEMs:

ML-KEM-1024 (formerly Kyber-1024, NIST FIPS 203) -- lattice-based, post-quantum secure
X25519 -- elliptic curve Diffie-Hellman, classical security

Both KEMs produce independent shared secrets. These are combined with HKDF-SHA512 under a label that is specific to the cipher suite, so ChaCha20-Poly1305 and AES-256-GCM derive different keys from the same pair of secrets. If ML-KEM is broken then X25519 still protects the session, and if X25519 is broken by a quantum computer, ML-KEM still protects it. Both must be broken simultaneously to compromise a session.

The handshake runs inside custom gRPC transport credentials, adding about 3 ms of overhead per connection, measured on one machine over loopback and paid once at connect. Details in the gRPC post-quantum blog post.

What We Don't Use (Yet)

HQC (code-based KEM) was selected by NIST in March 2025 as a backup KEM, chosen because its security rests on different mathematics from the lattice problems behind ML-KEM. The FIPS is not published yet. Adding it as a third KEM would diversify the cryptographic assumptions (lattice + code + elliptic curve). We have not put it in KEIBIDROP, where two KEMs already provide defense in depth, though we have worked with HQC before, integrated as FFI into Go on an earlier contract.

ML-DSA (formerly Dilithium, NIST FIPS 204) for post-quantum signatures is planned but not implemented. Currently, peer identity is verified through out-of-band fingerprint comparison, not digital signatures. Adding ML-DSA would allow signature-based authentication without a certificate authority.

ML-KEM is new, so running it alone would be a bet we are not making

ML-KEM is still new. The lattice problems it relies on have been studied for decades, but the specific parameter sets are recent. Running ML-KEM alone would be a bet that no classical attack surfaces in the coming years. Running X25519 alone ignores the quantum threat. The hybrid approach means we don't have to bet on either assumption being correct.

This is the same approach recommended by NIST, BSI, and ANSSI for transition-period systems.