The internet as we know it is built on a bedrock of encryption. From your online banking to your private messages, complex mathematical problems keep your data safe from prying eyes. But a new kind of computational power is looming on the horizon – quantum computers – and they threaten to turn that bedrock into sand. This isn't a far-off sci-fi scenario; it's a challenge demanding action today. Fortunately, a quiet revolution is already underway in your web browser, a crucial first step known as hybrid key exchange.
For decades, the security of our online world has relied on cryptographic algorithms like RSA and Elliptic Curve Cryptography (ECC). Their strength lies in mathematical problems that are incredibly difficult for even the most powerful classical computers to solve. Think of it like trying to find two specific grains of sand on all the world's beaches. But quantum computers, operating on the mind-bending principles of quantum mechanics, are poised to solve these problems with relative ease, potentially rendering much of our current encryption obsolete. Experts estimate that cryptographically relevant quantum computers could emerge within the next decade, possibly making widely used encryption like RSA vulnerable by 2030 and even 128-bit AES by 2029.
This brings us to a critical and immediate threat: "Harvest Now, Decrypt Later" (HNDL). Even before quantum computers are powerful enough to break current encryption in real-time, malicious actors can intercept and store the encrypted data flowing across the internet today. Their plan? To hold onto this data until a capable quantum computer arrives, at which point they can decrypt it retroactively. Imagine all your currently secure communications, financial transactions, and sensitive personal information suddenly laid bare. This HNDL threat makes the transition to Post-Quantum Cryptography (PQC) – new cryptographic methods designed to resist quantum attacks – an urgent necessity, not a future problem.
Enter Hybrid Key Exchange: The Best of Both Worlds
So, how do we start protecting ourselves now, even as PQC standards are being evaluated for adoption ? The answer lies in a clever transitional strategy called hybrid key exchange.
In simple terms, hybrid key exchange involves using two different key agreement algorithms simultaneously to establish a secure connection: one tried-and-true classical algorithm (like the X25519 elliptic curve algorithm many browsers use today) and one new PQC algorithm. When your browser connects to a website that supports this, both algorithms independently generate a secret key. These two secret keys are then combined, typically by concatenating them, to create the final session key that encrypts your traffic.
The beauty of this hybrid approach is its resilience. The resulting connection remains secure as long as at least one of the component algorithms remains unbroken. If an unforeseen flaw is found in the new PQC algorithm, the classical algorithm still provides robust protection. Conversely, when quantum computers eventually break the classical algorithm, the PQC component will ensure your data remains secure. This "belt and suspenders" method allows for the early adoption of quantum-resistant security while retaining the proven guarantees of classical cryptography. It’s a pragmatic way to gain immediate protection against HNDL attacks without abandoning well-understood security measures.
The U.S. National Institute of Standards and Technology (NIST) has been leading a global effort to identify and standardize PQC algorithms. One of the leading PQC candidates frequently used in these hybrid schemes is ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), formerly known as CRYSTALS-Kyber. ML-KEM is designed for general encryption and is favored for its relatively good performance and strong security properties against quantum attacks.
X25519MLKEM768: The Hybrid Frontrunner in Your Browser
One specific hybrid key agreement you'll increasingly see (or rather, your browser will see) is X25519MLKEM768. This combines the widely used classical X25519 algorithm with the ML-KEM-768 variant of the PQC standard (offering a strong security level).
When your browser initiates a secure connection using TLS 1.3 (the latest version of the protocol that secures HTTPS), it signals its support for various key exchange mechanisms. If it supports X25519MLKEM768, it includes a specific identifier (a NamedGroup value, 0x11ec for this particular hybrid) in its initial "ClientHello" message. This message also contains the public key materials for both X25519 and ML-KEM-768, concatenated together. If the server also supports this hybrid, it responds in kind, and both sides then derive the final shared secret from the combination of the two individual secrets.
One noticeable aspect of these PQC algorithms is that their key materials are significantly larger than their classical counterparts. For instance, the client's public key share for X25519MLKEM768 is 1216 bytes, a substantial increase from the 32 bytes needed for X25519 alone. This can add a small amount of overhead and latency to the initial connection handshake, a factor browser developers are carefully managing, especially for mobile devices.
The Quiet Adoption of Quantum Resistant Algorithms Browsers Adopting PQC
The good news is that modern browsers and security solutions are actively adapting to this new cryptographic landscape, making quantum-resistant connections and secure access increasingly common.
- Prisma Access Browser: For enterprises navigating the complexities of modern threats and evolving encryption standards, solutions like Palo Alto Networks Prisma Access Browser are emerging. This secure enterprise browser is designed to provide visibility and enforce security policies at the browser level, which is particularly relevant as new encryption methods like PQC are adopted. A key aspect is its ability to offer protection and control over web and SaaS application interactions, even for encrypted traffic that might be challenging for traditional network security tools to decrypt or inspect. This approach helps organizations maintain security posture for all browser activity, including access to sensitive data and applications, complementing traditional network and SASE defenses in a world increasingly moving towards PQC.
- Google Chrome: Chrome has been a frontrunner in direct PQC implementation. After initially experimenting with a draft version (X25519Kyber768), Chrome began rolling out the standardized X25519MLKEM768 as the default key agreement mechanism in versions like Chrome 131 and newer for desktop platforms (Windows, Mac, Linux). The rollout on Android has been more cautious due to the potential performance impact of larger key sizes on mobile networks, with plans to enable it as optimizations are developed (Kyber was initially planned for Android around Milestone 128). To help enterprises manage potential compatibility issues with network middleboxes (like firewalls) that might not handle the larger PQC key shares, Chrome introduced a PostQuantumKeyAgreementEnabled enterprise policy that allows administrators to temporarily disable the feature if needed.
- Mozilla Firefox: Firefox is also on board. It supported an earlier draft version of the hybrid (X25519Kyber768) via a manual configuration flag in versions like Firefox 124+. With Firefox 132 and newer on desktop, X25519MLKEM768 became the default. For connections using QUIC/HTTP3, Firefox 135 or newer is required for this hybrid support. Efforts are also underway to enable PQC by default in the privacy-focused Tor Browser, which is built on Firefox.
- Microsoft Edge: Being based on the Chromium engine, Microsoft Edge's adoption timeline generally mirrors Chrome's. X25519MLKEM768 is the default hybrid key agreement for Edge version 131 and newer, following earlier support for the draft version in Edge 124-130.
- Apple Safari: The situation with Safari's adoption of X25519MLKEM768 for general web browsing (TLS connections) is less publicly detailed compared to other major browsers. While Apple has made significant strides with PQC in its iMessage service (introducing the PQ3 protocol, which uses PQC for both key establishment and message exchange starting with iOS 17.4, macOS 14.4, etc.), broad default enablement in Safari for all TLS traffic wasn't explicitly confirmed in the available information as of early 2025. However, Cloudflare has reported observing a small percentage of mobile Safari traffic utilizing some form of post-quantum cryptography, indicating that work is likely in progress.
- Other Chromium-based browsers like Opera and Brave are also reported to support X25519MLKEM768 by default in their recent versions, aligning with the broader Chromium trend.
If you're curious whether your current connection to a website is using PQC, you can often check. For example, in Google Chrome, you can use the Developer Tools (Inspect → Privacy and Security tab) to see if "X25519MLKEM768" is listed as the key exchange mechanism.
Figure 1: Developer mode in Google Chrome shows you the TLS version, Key Exchange Mechanism, and Cipher used for the connection. We can see that Google Search uses X25519MLKEM768 as the key exchange mechanism.
Figure 2: Websites like Cloudflare's pq.cloudflareresearch.com can also test your browser's connection.
Operating Systems Adopting PQC
The shift towards quantum-resistant cryptography isn't limited to web browsers. A broader ecosystem of operating systems, applications, and cloud services is also beginning to integrate PQC to protect data at various levels.
Operating Systems Embrace PQC:
- Microsoft Windows: Microsoft has been actively integrating PQC capabilities into Windows. Early access builds for Windows Insiders now include support for ML-KEM (for key encapsulation) and ML-DSA (for digital signatures) within the Windows Cryptography API: Next Generation (CNG). This allows developers to experiment with hybrid deployments, combining PQC with traditional algorithms. Microsoft is also working on PQC-enabled certificate chains and plans to extend PQC support to the Windows TLS stack (Schannel) and Active Directory Certificate Services (ADCS).
- Linux: The Linux ecosystem is also actively preparing for PQC.
- Red Hat Enterprise Linux (RHEL): RHEL 10.0 marks a significant step by including NIST-approved PQC algorithms. ML-KEM is available for TLS connections through libraries like OpenSSL, GnuTLS, and NSS. Users can enable PQC system-wide by installing crypto-policies-pq-preview and switching to the TEST-PQ module. This enables hybrid algorithms such as X25519MLKEM768, SecP256r1MLKEM768 (compatible with OpenSSL, GnuTLS, NSS), and SecP384r1MLKEM1024 (OpenSSL, GnuTLS).
- Fedora Linux: Often a proving ground for new technologies, Fedora has been incorporating PQC support, leveraging liboqs and the oqsprovider for OpenSSL. Newer versions, like Fedora Rawhide (the basis for future releases), provide recent NIST-standardized algorithms such as ML-DSA and ML-KEM, alongside hybrid Kyber-based options for interoperability. Fedora also implements system-wide crypto policies that apply to core crypto libraries, including OpenSSL, NSS, and GnuTLS, facilitating consistent PQC configuration.
- Ubuntu: PQC capabilities in newer cryptographic libraries like OpenSSL 3.5 and later, which include PQC support. Security vendors are also targeting Ubuntu LTS releases (e.g., Ubuntu 22.04 LTS) for PQC-compliant function support, indicating a pathway for PQC integration.
- General Linux Efforts: The Linux Foundation has launched the Post-Quantum Cryptography Alliance (PQCA) to drive the advancement and adoption of PQC, highlighting the broad community effort.
Applications Adopting PQC:
- Zoom: Recognizing the "harvest now, decrypt later" threat, Zoom has proactively launched post-quantum end-to-end encryption (E2EE) for Zoom Meetings, with plans to extend it to Zoom Phone and Zoom Rooms. Their solution utilizes Kyber 768 (the algorithm now standardized as ML-KEM) to protect communications.
- Meta: Meta (parent company of Facebook, Instagram, and WhatsApp) is also preparing for the post-quantum era. They have begun deploying PQC across their internal service communications and are actively working on post-quantum readiness for TLS. While specific PQC deployment details for end-user data on platforms like Instagram and WhatsApp are part of this broader strategy, the company is focused on protecting user data from future quantum attacks.
SaaS and Hyperscalers Leading the Charge:
- Google Cloud & Workspace: Google has been a significant proponent of PQC, testing it in Chrome since 2016 and using it for internal communications. They are actively working to make Google Cloud KMS (Key Management Service) quantum-safe, offering quantum-safe digital signatures (FIPS 204/ML-DSA and FIPS 205/SLH-DSA) in preview. Their roadmap includes full support for NIST PQC standards in both software (Cloud KMS) and hardware (Cloud HSM). While default encryption for Google Workspace data at rest and in transit uses current robust standards like AES-256 , Google's broader PQC strategy aims to protect user data across its services, including Google Drive, against future quantum threats.
- Amazon Web Services (AWS): AWS has introduced support for ML-KEM post-quantum key agreement in several key services, including AWS Key Management Service (AWS KMS), AWS Certificate Manager (ACM), and AWS Secrets Manager. AWS KMS supports hybrid post-quantum TLS, combining ECDH with ML-KEM, allowing customers to protect their data in transit to KMS endpoints. AWS emphasizes that while these hybrid cipher suites protect data in transit, data encrypted by KMS keys at rest already uses AES-256, which is considered quantum-resistant.
- Microsoft Azure: Microsoft Azure is also addressing PQC. Azure Key Vault, for instance, supports various key types and protection methods, as algorithms resistant to both classical and quantum attacks. NIST-recommended algorithms like ML-KEM and ML-DSA and hybrid encryption approaches. While specific timelines for PQC adoption across all Azure services (like Azure Storage, SQL Database, App Service) are part of an ongoing evolution, the focus is on crypto-agility and preparing for future standards.
This broader adoption across operating systems, popular applications, and major cloud providers signifies a collective move towards a quantum-secure future, extending protection beyond just web browsing.
How Palo Alto Networks is Helping Enterprises with Their Quantum Readiness
As modern browsers and applications increasingly shift to using PQC hybrid schemes or even pure PQC, enterprises need visibility and control over these new cryptographic methods within their environments. This is where network security solutions play a crucial role. For instance, Palo Alto Networks Next-Generation Firewalls (NGFWs), starting with PAN-OS 11.1, are equipped to support this transition. These firewalls can seamlessly detect and bring visibility to PQC SSL sessions in your environment.
This capability is vital for several reasons. It gives organizations crucial visibility into which applications and connections have started using PQC or hybrid PQC. The NGFW achieves this by inspecting the supported_groups TLS extension in the ClientHello message, comparing the values against a list of known PQC and hybrid PQC algorithms using threat signatures, which allow you to detect, log, and block PQC. See more information on this blog.
Palo Alto Networks has also made the transition to Hybrid PQCs, Starting with Quantum Safe VPN following multiple RFCs like RFC 8784(Mixing Preshared Keys in Internet Key Exchange Protocol Version 2 (IKEv2) for Post-quantum Security), RFC 9242(Intermediate Key Exchange) and RFC 9370 (IETF Multi-key Implementation in IKEv2), you can find all the blogs, videos and webinars on our Live Community Quantum Security page.
The transition to a fully quantum-resistant internet is a marathon, not a sprint. Hybrid key exchange is a critical first leg of this race, primarily focused on protecting the confidentiality of your data in transit against the "harvest now, decrypt later" threat. While challenges like performance impacts and ensuring compatibility with all network equipment exist, they are being actively addressed by the internet community. Adoption of PQCs is a significant, albeit often invisible upgrade that is making your online life more secure against the computing paradigms of tomorrow, starting today. So, the next time you browse the web, know that there's some incredibly sophisticated, forward-looking cryptography working silently in the background to protect your digital future.
