ML-KEM
Cryptographic algorithm in Privacy & security
Recommended as the post-quantum key exchange standard (FIPS 203) that won an open competition and has no known backdoor. Critics say it is too new to trust fully and should be combined with a classical algorithm.
Recommended as the post-quantum key exchange standard (FIPS 203) that won an open competition and has no known backdoor. Critics say it is too new to trust fully and should be combined with a classical algorithm.
21 people gave an opinion
- recommend it
- 12
- criticize it
- 9
- approval share
- 57%
Recommended in 5 of 13 months
- November 2025: recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 12 people recommend itNeeds 10 or more, met.
- 1.3 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 5 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Won open competition by reputable cryptographers
“MLKEM won an open competition; its entrants are among the most reputable cryptographers in the world.”
Comment from 7 Jul 2026 in “NSA and IETF: Fairness” “the fact that 3 independent teams all created something substantially similar to ML-KEM”
Comment from 7 Jul 2026 in “NSA and IETF: Fairness” “Their tweaks were good, and their analysis/exposition of it were good.”
Comment from 7 Jul 2026 in “NSA and IETF: Fairness” No known backdoor or NOBUS
“There is mathematically no place for a NOBUS backdoor in ML-KEM”
Comment from 28 Nov 2025 in “NSA and IETF, Part 2” “ML-KEM was specifically designed to make this impossible”
Comment from 7 Jul 2026 in “NSA and IETF: Fairness” “there has been no hint of a backdoor in ML-KEM”
Comment from 2 Jul 2026 in “NSA tries to weaken mlkem standardisation” Boring, high-quality, hard to misuse
“ML-KEM is boring, high-quality cryptography.”
Comment from 7 Jul 2026 in “NSA and IETF: Fairness” “It's really hard to implement ML-KEM wrong.”
Comment from 6 Apr 2026 in “A Cryptography Engineer's Perspective on Quantum Computing Timelines” “using pure ML-KEM is not a footgun”
Comment from 7 Jul 2026 in “NSA and IETF: Fairness” Performance close to X25519
“ML-KEM is faster than X25519. The only performance downside is public key/ciphertext size.”
Comment from 4 Jul 2026 in “Soatok's Informal Guide to Threat Models” “Apart from bytes on the wire, MLKEM is not in fact "much more expensive" than 25519.”
Comment from 6 Jul 2026 in “Web-based cryptography is always snake oil”
What people warn about
Each mark is one comment
Too new, security unproven
“ML-KEM is still too new for anyone to be able to claim that no way to break it will be discovered”
Comment from 2 Jul 2026 in “NSA tries to weaken mlkem standardisation” “For now, it is completely unknown how secure ML-KEM really is, because it is too new.”
Comment from 2 Jul 2026 in “NSA tries to weaken mlkem standardisation” Should not be used alone
“anyone who says that ML-KEM should be used alone is making a bet for which there exists no justification”
Comment from 2 Jul 2026 in “NSA tries to weaken mlkem standardisation” “Most cryptographers would still recommend the hybrid over pure ML-KEM”
Comment from 2 Jul 2026 in “NSA tries to weaken mlkem standardisation” “MLKEM is dangerous and shouldn't be used alone”
Comment from 15 Aug 2026 in “NSA and IETF, Part 9” Timing side-channel flaws in early implementations
“the reference implementation (and most other early implementations) for Kyber/ML-KEM included multiple timing side channel vulnerabilities that allowed for key recovery”
Comment from 24 Nov 2025 in “NSA and IETF, part 3: Dodging the issues at hand” “included multiple timing side channel vulnerabilities that allowed for key recovery.”
Comment from 24 Nov 2025 in “NSA and IETF, part 3: Dodging the issues at hand” NSA involvement raises backdoor suspicion
“why endorse and practically make everyone implement an algorithm that only the NSA wants”
Comment from 28 Nov 2025 in “ML-KEM Mythbusting” “Since ML-KEM is supported by the NSA, it should be assumed to have a NSA-known backdoor”
Comment from 24 Nov 2025 in “NSA and IETF, part 3: Dodging the issues at hand”
What people recommend instead
The same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| ML-KEMThis page | 12 | 9 | 57% | 5 | — | — |
| AES | 7 | 2 | 78% | 6 | — | — |
What people said
34 of the 35 comments that mention it, newest first. Each links to the original comment.
“MLKEM is dangerous and shouldn't be used alone”
“the fact that 3 independent teams all created something substantially similar to ML-KEM”
“Their tweaks were good, and their analysis/exposition of it were good.”
“ML-KEM was specifically designed to make this impossible”
“ML-KEM is boring, high-quality cryptography.”
“they already know how to break it”
“MLKEM won an open competition; its entrants are among the most reputable cryptographers in the world.”
“there are certain scenarios (e.g. hardware) where pure ML-KEM has significant performance benefits”
“using pure ML-KEM is not a footgun”
“On one hand MLKEM by itself seems like a better choice than DUAL-EC”
“Apart from bytes on the wire, MLKEM is not in fact "much more expensive" than 25519.”
“ML-KEM is faster than X25519. The only performance downside is public key/ciphertext size.”
“Wanting to standardize it's use without the secondary layer of protection provided by existing algorithms”
“there has been no hint of a backdoor in ML-KEM”
“Most cryptographers would still recommend the hybrid over pure ML-KEM”
“For now, it is completely unknown how secure ML-KEM really is, because it is too new.”
“anyone who says that ML-KEM should be used alone is making a bet for which there exists no justification”
“ML-KEM is still too new for anyone to be able to claim that no way to break it will be discovered”
“ML-KEM-768 and ML-KEM-1024 are also fine on their own”
“the way forward is ML-KEM 768 together with some classical algorithm”
“I believe ML-KEM is the standard algorithm for post-quantum asymmetric encryption.”
“It's really hard to implement ML-KEM wrong.”
“the priority is the deployment of FIPS 203 (ML-KEM) for the establishment of the secret session keys”
“There is mathematically no place for a NOBUS backdoor in ML-KEM”
“layer ML-KEM/ML-DSA on top of RSA/ECC for redundancy”
“why endorse and practically make everyone implement an algorithm that only the NSA wants”
“nothing we've learned since Kyber was chosen has materially weakened the construction itself”
“included multiple timing side channel vulnerabilities that allowed for key recovery.”
“it (and basically every other lattice based method) has lost a minimum of ~50-100 bits of security”
“lattice-based cryptography has stronger hardness foundations than RSA and EC”
“We think we've done it but even after extensive testing we're not quite sure.”
“Since ML-KEM is supported by the NSA, it should be assumed to have a NSA-known backdoor”
“an extremely concerning attempt to ram through a questionable algorithm that is not well understood”
“the reference implementation (and most other early implementations) for Kyber/ML-KEM included multiple timing side channel vulnerabilities that allowed for key recovery”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.