ML-KEM-1024 is a way for two phones to agree on a shared secret that not even a future quantum computer can figure out. It is the mathematical lock that protects the initial handshake when you start a beChat conversation. NIST, the same body that standardized AES, chose it after a years-long public competition. beChat uses the strongest version.
What is a key encapsulation mechanism?
A Key Encapsulation Mechanism (KEM) is a cryptographic primitive that lets two parties agree on a shared secret over an insecure channel. One party (the initiator) generates a public/private key pair, sends the public key to the other party (the responder), and the responder uses it to encapsulate a fresh shared secret and send it back. Both parties now have the same secret, and anyone who intercepted the exchange only sees noise.
The "encapsulation" part is key: the responder doesn't encrypt a chosen secret and send it. Instead, the KEM itself generates the secret as part of the encapsulation process. This is safer than letting the application choose the secret, because the KEM guarantees the secret is uniformly random.
Imagine Alice puts a locked box inside another locked box and sends it to Bob. Bob puts a secret note inside a third box, locks it with Alice's key, and sends it back. Both now have the note. Anyone who intercepted the delivery only sees locked boxes. ML-KEM is the mathematical version of this exchange, using lattice-based math instead of physical locks.
Why "post-quantum"?
Classical key exchange algorithms like RSA and ECDH (Elliptic Curve Diffie-Hellman) rely on math problems that are hard for today's computers but easy for a sufficiently large quantum computer. Specifically, Shor's algorithm can break both factoring (RSA) and discrete logarithms (ECDH) in polynomial time on a quantum computer.
ML-KEM is built on a different mathematical problem — the Module Learning With Errors (MLWE) problem — that no one has found a way to solve quickly, not even with a quantum computer. This is what makes it "post-quantum": it is designed to remain secure even after quantum computers are built.
The NIST standardization process
NIST is the U.S. National Institute of Standards and Technology, the same body that standardized AES (the encryption standard used everywhere today) and SHA-3 (a hashing standard). In 2016, NIST opened a public competition to select post-quantum cryptography standards. Cryptographers from all over the world submitted 69 candidates.
The process took years. Each candidate was publicly analyzed, attacked, and refined over multiple rounds. NIST narrowed the field through several rounds of public review:
- Round 1 (2017-2019): 69 submissions reviewed.
- Round 2 (2019-2020): 26 candidates advanced.
- Round 3 (2020-2022): Finalists and alternates selected.
- Standardization (2024): ML-KEM (formerly Kyber) finalized as FIPS 203.
The surviving algorithms went through the cryptographic equivalent of a clinical trial. Thousands of experts whose job was to try to break them tested them publicly. ML-KEM survived. That is why beChat uses it.
Why ML-KEM-1024 specifically?
ML-KEM comes in three parameter sets, each offering a different trade-off between security and performance:
| Parameter | Security level | Public key size | Ciphertext size |
|---|---|---|---|
| ML-KEM-512 | AES-128 equivalent | 800 bytes | 768 bytes |
| ML-KEM-768 | AES-192 equivalent | 1184 bytes | 1088 bytes |
| ML-KEM-1024 | AES-256 equivalent | 1568 bytes | 1568 bytes |
beChat uses ML-KEM-1024, the highest security level, equivalent to AES-256. The larger key and ciphertext sizes (1568 bytes vs 768 bytes for ML-KEM-512) mean slightly more bandwidth for the initial handshake. But the handshake runs once per conversation, not once per message, so the performance impact is negligible during ongoing chat.
Signal uses Kyber-1024 for PQXDH (the initial handshake) and ML-KEM-768 for SPQR (continuous ratcheting). SimpleX uses sntrup761. beChat uses ML-KEM-1024 for both the handshake and every ratchet step, providing the highest security level throughout the conversation.
How beChat uses ML-KEM-1024 in the Double Ratchet
beChat doesn't just use ML-KEM-1024 once at the start. It uses it in every ratchet step of the Double Ratchet. Here is the full chain:
- When you start a conversation, ML-KEM-1024 carries a fresh shared secret between your phone and your contact's phone, resistant to a future quantum computer.
- ML-DSA-87 signs the device and message keys, proving who you are and that nothing was tampered with.
- The shared secret seeds the Double Ratchet, which generates a brand-new key for every single message (forward secrecy).
- Each ratchet step re-runs ML-KEM-1024, so the post-quantum protection is continuous, not just at the start.
- Each message is then encrypted with AES-256-GCM-SIV and sent to the server, which stores only the scrambled blob.
This is what "continuous post-quantum ratcheting" means. The post-quantum protection doesn't stop after the handshake. It runs through the entire conversation.
What ML-KEM-1024 does not do
- It does not provide anonymity on its own. Anonymity requires not collecting personal identifiers, which is why beChat also uses PIN-based accounts.
- It does not hide that two accounts are talking. The server still routes messages between accounts. ML-KEM protects the content, not the metadata of who is talking to whom.
- It is not proven permanently unbreakable. No encryption is. ML-KEM-1024 is the best current answer to a known future threat, chosen through the most rigorous public process we have.
- It does not protect a compromised device. If malware is reading your screen before encryption, no cryptography helps.
Frequently asked questions
What is ML-KEM-1024?
ML-KEM-1024 is the highest security parameter set of ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism), standardized by NIST as FIPS 203 in 2024. It allows two parties to agree on a shared secret over an insecure channel using post-quantum cryptography that a future quantum computer cannot break. The "1024" refers to the security level, which provides the strongest protection in the ML-KEM family.
Is ML-KEM the same as Kyber?
Yes. ML-KEM was originally called Kyber during the NIST standardization process. When NIST finalized it as a federal standard (FIPS 203) in 2024, it was renamed to ML-KEM. The underlying algorithm is the same.
Why does beChat use ML-KEM-1024 instead of ML-KEM-768?
beChat uses ML-KEM-1024, the highest security parameter set, for maximum post-quantum protection. ML-KEM-512 and ML-KEM-768 are lower security levels with smaller key sizes and faster performance. beChat prioritizes security over performance for the initial handshake. The ongoing ratchet reuses derived keys, so the performance cost of the larger key size is only paid once per conversation.
Has ML-KEM been broken?
No. As of 2026, no attack has broken ML-KEM at any security level. The algorithm went through years of public cryptanalysis during the NIST standardization process, with the world's top cryptographers attempting to break it. ML-KEM is considered secure against both classical and quantum attacks by the current consensus of the cryptographic community.
Keep reading
Read the plain-English guide to post-quantum encryption, the full how beChat works walkthrough, or the glossary for definitions of every technical term used here.