ML-KEM key and ciphertext sizes
ML-KEM-512: 800-byte public (encapsulation) key, 768-byte ciphertext.
ML-KEM-768: 1,184-byte public (encapsulation) key, 1,088-byte ciphertext.
ML-KEM-1024: 1,568-byte public (encapsulation) key, 1,568-byte ciphertext. The shared secret is always 32 bytes.
The hybrid TLS key share X25519MLKEM768 is 1,216 bytes from the client and 1,120 bytes from the server, against 32 bytes for X25519 alone.
Raw sizes (FIPS 203)
| Parameter set | Security | Encapsulation key | Decapsulation key | Ciphertext | Shared secret |
|---|---|---|---|---|---|
| ML-KEM-512 | NIST level 1 | 800 | 1,632 | 768 | 32 |
| ML-KEM-768 | NIST level 3 | 1,184 | 2,400 | 1,088 | 32 |
| ML-KEM-1024 | NIST level 5 | 1,568 | 3,168 | 1,568 | 32 |
| X25519 | classical | 32 | 32 | 32 (peer key) | 32 |
Bytes. The decapsulation key is the expanded FIPS 203 encoding; implementations may store a 64-byte seed instead.
Hybrid key exchange in TLS: X25519MLKEM768
Browsers and TLS libraries deploy ML-KEM as a hybrid with X25519, so a connection stays secure if either algorithm holds. Each side's key share concatenates both:
| Key share | ML-KEM-768 part | X25519 part | Total | vs. X25519 alone |
|---|---|---|---|---|
| Client (ClientHello) | 1,184 (encapsulation key) | 32 | 1,216 | 38× |
| Server (ServerHello) | 1,088 (ciphertext) | 32 | 1,120 | 35× |
That pushes a typical ClientHello past 1,200 bytes. It no longer fits in a single QUIC Initial packet, and on many paths it no longer fits in one TCP segment either. Middleboxes and servers that assumed a ClientHello arrives in one packet have broken when browsers enabled hybrid key exchange. Test your load balancers, WAFs and TLS-terminating proxies before you rely on it.
Storing ML-KEM keys
| Parameter set | Base64 public key | Column | Base64 ciphertext | Column |
|---|---|---|---|---|
| ML-KEM-512 | 1,068 | VARCHAR(2048) | 1,024 | VARCHAR(2048) |
| ML-KEM-768 | 1,580 | VARCHAR(2048) | 1,452 | VARCHAR(2048) |
| ML-KEM-1024 | 2,092 | VARCHAR(4096) | 2,092 | VARCHAR(4096) |
Column sizes use Tokenkeep's policy: Base64 length +25%, rounded up to a power of two.
Find every limit these sizes break in your stack
Paste a migration, an nginx.conf or an mbedTLS header into the checker, or ask us for a free scan of the whole repository.