# ML-KEM

12 Hacker News commenters recommended ML-KEM and 9 criticized it, November 2025 to November 2026. It was recommended in 5 of 13 months.

**Verdict:** Recommended as the post-quantum key exchange standard (FIPS 203) that won an open competition and has no known backdoor. Critics say it is too new to trust fully and should be combined with a classical algorithm.

## Why people recommend it

- Won open competition by reputable cryptographers (3 comments): "MLKEM won an open competition; its entrants are among the most reputable cryptographers in the world." ([source](https://news.ycombinator.com/item?id=48819782)) "the fact that 3 independent teams all created something substantially similar to ML-KEM" ([source](https://news.ycombinator.com/item?id=48821094)) "Their tweaks were good, and their analysis/exposition of it were good." ([source](https://news.ycombinator.com/item?id=48820825))
- No known backdoor or NOBUS (3 comments): "There is mathematically no place for a NOBUS backdoor in ML-KEM" ([source](https://news.ycombinator.com/item?id=46080347)) "ML-KEM was specifically designed to make this impossible" ([source](https://news.ycombinator.com/item?id=48820720)) "there has been no hint of a backdoor in ML-KEM" ([source](https://news.ycombinator.com/item?id=48768323))
- Boring, high-quality, hard to misuse (3 comments): "ML-KEM is boring, high-quality cryptography." ([source](https://news.ycombinator.com/item?id=48820671)) "It's really hard to implement ML-KEM wrong." ([source](https://news.ycombinator.com/item?id=47667779)) "using pure ML-KEM is not a footgun" ([source](https://news.ycombinator.com/item?id=48818559))
- Performance close to X25519 (2 comments): "ML-KEM is faster than X25519. The only performance downside is public key/ciphertext size." ([source](https://news.ycombinator.com/item?id=48784664)) "Apart from bytes on the wire, MLKEM is not in fact "much more expensive" than 25519." ([source](https://news.ycombinator.com/item?id=48800513))

## What people warn about

- Too new, security unproven (2 comments): "ML-KEM is still too new for anyone to be able to claim that no way to break it will be discovered" ([source](https://news.ycombinator.com/item?id=48765409)) "For now, it is completely unknown how secure ML-KEM really is, because it is too new." ([source](https://news.ycombinator.com/item?id=48766034))
- Should not be used alone (3 comments): "anyone who says that ML-KEM should be used alone is making a bet for which there exists no justification" ([source](https://news.ycombinator.com/item?id=48765729)) "Most cryptographers would still recommend the hybrid over pure ML-KEM" ([source](https://news.ycombinator.com/item?id=48766144)) "MLKEM is dangerous and shouldn't be used alone" ([source](https://news.ycombinator.com/item?id=49307436))
- Timing side-channel flaws in early implementations (2 comments): "the reference implementation (and most other early implementations) for Kyber/ML-KEM included multiple timing side channel vulnerabilities that allowed for key recovery" ([source](https://news.ycombinator.com/item?id=46034275)) "included multiple timing side channel vulnerabilities that allowed for key recovery." ([source](https://news.ycombinator.com/item?id=46039708))
- NSA involvement raises backdoor suspicion (2 comments): "why endorse and practically make everyone implement an algorithm that only the NSA wants" ([source](https://news.ycombinator.com/item?id=46076898)) "Since ML-KEM is supported by the NSA, it should be assumed to have a NSA-known backdoor" ([source](https://news.ycombinator.com/item?id=46034844))

## Alternatives hackers recommend

- [AES](https://hackerapproved.com/p/aes.md): 7 recommend

## Cite as

Hacker Approved, "ML-KEM", https://hackerapproved.com/p/ml-kem/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).