RFC 10024: the TLS handshake that runs two hard problems at once
In April 2024, Google Chrome began negotiating a new kind of TLS handshake with every server it connected to — one that solved two separate hard mathematical problems in parallel, not one. There was no published standard for this yet. Chrome shipped it anyway, because the harvest-now-decrypt-later threat doesn’t wait for the IETF’s schedule. Two and a half years later, in August 2026, the Internet Engineering Task Force published RFC 10024, and gave the arrangement a number compliance lawyers could finally cite.
The document is nine pages long, roughly four of which contain actual specification. Its four authors — Kris Kwiatkowski of PQShield, Panos Kampanakis of AWS, Bas Westerbaan of Cloudflare, and Douglas Stebila of the University of Waterloo — formalized three hybrid key agreement mechanisms for TLS 1.3. Each mechanism pairs a classical elliptic-curve exchange with ML-KEM, the lattice-based key encapsulation algorithm NIST standardized in August 2024. The recommended option, X25519MLKEM768, marries X25519 (which has anchored secure web connections since around 2013) with ML-KEM-768. Two others exist for regulated environments that specifically require named NIST curves: SecP256r1MLKEM768 and SecP384r1MLKEM1024.
The idea is straightforward in principle. A hybrid handshake computes two shared secrets and combines them. Breaking the connection requires defeating both algorithms simultaneously — the elliptic curve and the lattice. The extra key exchange adds roughly 1,100 bytes to a TLS session, about the weight of a medium-resolution thumbnail. Every major browser decided that was a price worth paying.
The reason for the urgency is an attack that has not happened yet. An adversary recording encrypted traffic today, planning to decrypt it with a quantum computer in a decade, is not hypothetical in signals-intelligence circles — it has a name. Data protected only by X25519 has a vulnerability window that opens the moment a capable quantum machine exists. Data protected by the hybrid does not, because a quantum computer that cracks the elliptic-curve problem still has to break the lattice independently.
There is a stranger chapter behind the design. In 2019, Google ran an experiment called CECPQ2, testing post-quantum algorithms alongside X25519 in Chrome’s connections to Google’s own servers. One candidate, SIKE, had compact keys — around 330 bytes, compared to ML-KEM’s 1,184 — and was considered a serious contender. The experiments found that key size mattered less than feared; the latency cost was modest and shrinking. SIKE’s arithmetic, though, was a fixed tax on every handshake. Lattice-based algorithms won. Then in July 2022, Belgian researchers Wouter Castryck and Thomas Decru published an attack that broke SIKE entirely using classical computation — a single-core process running over a weekend. Any SIKE-only session from the 2019 experiments was theoretically exposed. The hybrid sessions were not, because X25519 had been running beside SIKE the entire time. The hedge against quantum computers turned out to be a hedge against broken mathematics, too.
By the time RFC 10024 appeared, Cloudflare was reporting that over 71% of human web traffic was already flowing over hybrid key exchange. Firefox had followed Chrome in November 2024; Apple shipped support in late 2025. The standard formalized what the internet had already decided to do. Whether the next hard problem waiting in the lattice is as sturdy as everyone hopes remains, by definition, an open question.
Sources
- RFC 10024 — IETF RFC Editor — formal specification, authors, the three hybrid mechanisms, IANA assignments, and August 2026 publication date.
- Post-quantum TLS 1.3 hybrid is now RFC 10024 — Quanta Krypto — browser deployment timeline (Chrome April 2024, Firefox November 2024, Apple late 2025), Cloudflare traffic statistics, and background on CECPQ2 and the SIKE break.
- RFC 10024: Hybrid ML-KEM TLS 1.3 Standard Finalized — PostQuantum.com — technical overview of X25519MLKEM768 recommended status and the standards-track designation.
- An efficient key recovery attack on SIDH — Castryck and Decru, IACR ePrint 2022/975 — the July 2022 paper that broke SIKE using classical computation.