TLS 1.3 now has standardized hybrid key-agreement groups that combine post-quantum ML-KEM with classical elliptic-curve Diffie–Hellman. That is a major step toward protecting session confidentiality from future quantum attacks—but it does not make every TLS connection post-quantum, and it does not solve post-quantum certificates or authentication.
What “the easy half” means
In August 2026, the IETF published RFC 10024, a Standards Track specification defining three hybrid key-agreement groups for TLS 1.3. Each combines a post-quantum key encapsulation mechanism, ML-KEM, with ephemeral elliptic-curve Diffie–Hellman (ECDHE).
As an Amazon Associate I earn from qualifying purchases.
In a hybrid exchange, the two sides derive shared secrets using both mechanisms and combine them for TLS traffic-key derivation. The point is to retain classical security during the transition while adding protection against an attacker who records encrypted traffic today and can break the classical key exchange with a sufficiently capable quantum computer in the future. This is the “harvest now, decrypt later” risk.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The milestone is comparatively tractable because it changes how a TLS session establishes shared secrets. It does not complete the broader work of authenticating endpoints with post-quantum signatures and certificates, nor does standardization alone make the new groups available on every client-server connection.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Which hybrid TLS groups RFC 10024 defines
The group names identify the classical curve and the ML-KEM parameter set used together. RFC 10024 describes X25519MLKEM768 as widely deployed and often the most practical single hybrid option. The other groups serve particular FIPS-related or higher-security requirements; they should not be treated as interchangeable in every compliance environment.
| TLS 1.3 hybrid group | Classical component | Post-quantum component | Intended context in RFC 10024 |
|---|---|---|---|
| X25519MLKEM768 | X25519 ECDHE | ML-KEM-768 | Widely deployed and often the most practical single hybrid choice. |
| SecP256r1MLKEM768 | SecP256r1 ECDHE | ML-KEM-768 | For cases requiring both shared secrets to use FIPS-approved mechanisms. |
| SecP384r1MLKEM1024 | SecP384r1 ECDHE | ML-KEM-1024 | For higher-security environments requiring FIPS-approved mechanisms with an increased margin. |
The group is used during TLS 1.3 key agreement. Its presence in a standard does not establish that a particular application, server, load balancer, or cryptographic library supports it, or that a connection actually negotiated it.
Is TLS 1.3 post-quantum now?
No—not as a blanket statement. A TLS 1.3 connection has hybrid post-quantum key agreement only when the client and server both support a compatible hybrid group and successfully negotiate it. If either side cannot use the group, that connection may use another supported key-agreement method instead.
Deployment must also be considered one network leg at a time. A visitor-to-edge connection, an edge-to-origin connection, and an internal service-to-service connection are separate TLS sessions. Support on one does not prove support on the others.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Examples of provider-specific support
- Cloudflare reports hybrid support for TLS 1.3 on websites and APIs it serves. That describes those provider endpoints, not all sites on the internet.
- Google Cloud says its application and proxy load balancers support X25519MLKEM768 initially on an opt-in basis. Its published roadmap is a vendor plan, and the provider notes that timelines can shift with engineering requirements and dependencies.
For an operator, the useful question is not whether a vendor offers a feature in general, but whether the actual client, endpoint, and intervening infrastructure negotiated the hybrid group on the connection that matters.
Why key agreement does not solve post-quantum authentication
Key agreement helps establish confidential session keys. Authentication answers a different question: is the endpoint really the party the client intended to reach? TLS authentication relies on signatures, certificates, and the public-key infrastructure and operational tooling that issue, validate, renew, and manage them.
Those pieces need their own post-quantum transition. Cloudflare reports ML-DSA authentication support on some Cloudflare-to-origin connections, while its documentation reviewed for this topic described visitor-to-edge and internal post-quantum authentication as still under development. It also cautions that a visitor-to-edge connection is not actually post-quantum secured unless the client supports PQC. A hybrid key exchange should therefore not be mistaken for a complete post-quantum identity system.
What a deployment team should verify
Standard publication is the start of deployment work, not evidence that a given application path is protected. Check compatibility and negotiation on real paths before treating hybrid key agreement as active.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
- Map the TLS legs. Identify the client-to-edge, edge-to-origin, and service-to-service connections relevant to the application. Treat each as a separate negotiation.
- Check both endpoints. Confirm that the client and server implementations support a compatible hybrid TLS 1.3 group. A server-side setting cannot add support to an incompatible client.
- Verify the negotiated group. Test representative real client-server paths and confirm the key-agreement group actually selected. Do not infer negotiation from a product announcement or configuration alone.
- Test compatibility before broad rollout. Because hybrid negotiation depends on both ends of a connection, validate application paths and client populations before relying on the feature for production protection.
- Plan authentication separately. Track post-quantum signature, certificate, PKI, and operational-tooling needs independently from hybrid key agreement.
Deadlines and software support have different scopes
The White House memorandum Execution of the Migration to Post-Quantum Cryptography, issued in June 2026, says U.S. agencies must support TLS 1.3 or a successor as soon as practicable and no later than January 2, 2030. That is a federal-agency requirement, not a worldwide deadline for every organization.
For teams selecting implementation components, OpenSSL Corporation identifies OpenSSL 3.5 as its current LTS release, with support through April 2030. That is the vendor’s support statement; it is not an independent performance finding or proof that every application using OpenSSL has hybrid TLS enabled. OpenSSL Corporation also describes migration-planning and extended-LTS support. No cross-vendor performance figure established here supports a general claim about the cost or speed of hybrid TLS across workloads.
Standards, government requirements, provider roadmaps, and software support schedules answer different questions. An operator should apply the deadline relevant to its jurisdiction and organization, then verify actual client and server behavior rather than equating a roadmap date with universal deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
