Skip to content
ecdsa.com

Kyber (CRYSTALS-Kyber)

The round-3 NIST submission from which ML-KEM was derived; deployed early in hybrid TLS (X25519Kyber768Draft00) and not interoperable with standardized ML-KEM.
Also written asCRYSTALS-KyberKyber768X25519Kyber768Draft00Kyber-768

FIPS 203 Appendix C lists the changes that alter input and output behavior: the shared secret is fixed at 256 bits; the Fujisaki–Okamoto variant no longer hashes the ciphertext into the shared secret; encapsulation no longer hashes its initial randomness; explicit input checks were added; and, after the 2023 draft, domain separation was added to key generation so a seed cannot be reused across security levels.

Because of these changes Kyber and ML-KEM produce different secrets from the same inputs. In TLS the pre-standard group X25519Kyber768Draft00 (0x6399) was replaced by X25519MLKEM768 (0x11EC); Chrome switched in version 131 (November 2024). Libraries and configuration files that still say "Kyber" may mean either, so check the codepoint or parameter names.

Standards and references

All terms