Hybrid cryptography (PQ/T hybrid)

Hybrid cryptography, often written PQ/T hybrid (post-quantum/traditional), combines a classical algorithm and a post-quantum algorithm in a single operation so that the result remains secure as long as at least one component is unbroken. Hybrids hedge two risks at once: quantum computers breaking classical public-key cryptography, and undiscovered flaws in the much younger post-quantum schemes.

#Rationale

The case for hybrids runs in both directions. Classical key agreement (elliptic curve Diffie-Hellman, RSA) falls to Shor's algorithm on a large quantum computer, and traffic captured today is already exposed through harvest now, decrypt later. But the post-quantum replacements have decades less cryptanalysis behind them, and the risk is not hypothetical: SIKE, an isogeny-based finalist in the NIST Post-Quantum Cryptography Standardization process, was broken in 2022 with a classical attack that recovered keys in hours on a laptop. A hybrid of X25519 and ML-KEM stays secure against a quantum adversary (via ML-KEM) and against a hypothetical lattice break (via X25519), because an attacker must defeat both.

#KEM combiners

The standard construction combines two KEMs by running both and deriving the final key from both shared secrets. The simplest secure pattern concatenates the secrets, usually together with the ciphertexts or public keys, and feeds them through a key derivation function; TLS does exactly this inside its key schedule, as analyzed in draft-ietf-tls-hybrid-design. Getting the details right matters: a combiner should preserve IND-CCA security when either component is sound, which motivates binding the ciphertexts into the derivation. The IETF CFRG has a dedicated combiner draft, and X-Wing defines a concrete, formally analyzed hybrid of X25519 and ML-KEM-768 that exploits ML-KEM's internal structure to keep the combiner cheap. NIST's key derivation recommendation, SP 800-56C Rev. 2, already accommodates a hybrid shared secret, so hybrids can be used inside FIPS-validated deployments.

Hybrid signatures also exist, chiefly as composite certificates studied for PKI migration to post-quantum, but they have less momentum: signatures carry no harvest-time urgency, and running two signature schemes adds size and validation complexity for a smaller benefit.

#Where hybrids ship today

Hybrids are the dominant deployment pattern for post-quantum cryptography as of early 2026:

#Standards positions

National authorities disagree on whether hybrids are a transition tool or an unnecessary complication. Germany's BSI recommends deploying ML-KEM in hybrid combinations with classical algorithms in its TR-02102-1 recommendations, and France's ANSSI has taken a similar position for the transition period. The United States is more permissive than prescriptive: NIST allows hybrid key establishment within its existing frameworks, while the NSA's CNSA 2.0 notably specifies pure post-quantum algorithms (ML-KEM-1024, ML-DSA-87) for national security systems and states that hybrid solutions are not required, citing the added complexity. In practice the Internet has voted with its deployments: virtually all shipped post-quantum key exchange is hybrid, and pure ML-KEM modes exist mainly for CNSA-aligned environments.

#Costs and criticisms

A hybrid runs two algorithms, so handshakes carry both key shares (roughly 1.2 KB extra for ML-KEM-768 on top of 32 bytes for X25519) and both computations, though the classical component is the cheaper part. The deeper criticisms are engineering ones: combiners add protocol surface that can be misdesigned, negotiation grows more complex, and hybrids can entrench classical code paths that must eventually be removed anyway, a cryptographic agility cost paid later. Proponents answer that the insurance is worth it while post-quantum schemes accumulate cryptanalytic history, and that removal is a planned second step, not a flaw in the design.