up:: Hybrid Cryptography
Hybrid vs Pure PQC
What is the difference between hybrid and pure post-quantum cryptography?
Hybrid runs a classical algorithm and a post-quantum algorithm together and derives one key from both, so the connection holds as long as either half survives. Pure runs the post-quantum algorithm alone. The choice is a bet on which failure is more likely: a quantum computer breaking the classical half, or an undiscovered flaw in the young post-quantum half.
The short version:
- Hybrid is secure if either component holds, so it fails only when both fail together.
- Pure is smaller, simpler, and depends entirely on the post-quantum algorithm being sound.
- The classical half of a hybrid is quantum-vulnerable by definition, so hybrid is a bridge that has to retire its classical component before Q-Day rather than a permanent state.
- Four national authorities have published three different positions, from France requiring hybrid to the NSA permitting it while favoring standalone. See ANSSI vs BSI vs NCSC vs NSA on Hybrid.
- Deployment has gone overwhelmingly hybrid. In a 4,665-organization measurement, 1,787 of 1,788 post-quantum-supporting web endpoints supported the hybrid
X25519MLKEM768, against 3 that supported pureMLKEM1024.
What is hybrid?
A classical algorithm and a post-quantum algorithm, feeding a single session key. The common construction is X25519MLKEM768: the classical X25519 key exchange plus ML-KEM-768, with both shared secrets concatenated and run through the key schedule into one key.
The security property is “secure if either holds,” and it only holds when the secrets are combined correctly through the key-derivation function and the protocol refuses to silently fall back. Full mechanism at Hybrid Cryptography.
What is pure post-quantum?
A single standardized post-quantum algorithm doing the job alone, with no classical component. Smaller artifacts, a simpler handshake, and a single algorithm to implement and audit.
Its security rests entirely on the post-quantum algorithm being sound, which is a young assumption compared to the decades of scrutiny behind the classical algorithms it replaces.
Hybrid vs pure at a glance
| Dimension | Hybrid | Pure post-quantum |
|---|---|---|
| Construction | Classical plus post-quantum, both feeding one key | Post-quantum alone |
| Secure when | Either component holds | The post-quantum algorithm holds |
| Broken when | Both fail together | The post-quantum algorithm fails |
| Protects against | An undiscovered flaw in the young post-quantum algorithm | Nothing extra. It carries no hedge |
| Handshake size | Larger. Carries both key shares | Smaller |
| Known deployment trap | The oversized first message can spill past a single packet and trip middleboxes that assumed handshakes stay small | Fewer size surprises |
| Implementation complexity | 2 algorithms, plus the combiner and the fallback logic | 1 algorithm |
| Permanence | A bridge. The classical half is quantum-vulnerable and has to be removed before Q-Day | The end state the transition is heading toward |
| France (ANSSI) | Required for certified products, in its words a product “shall implement hybridation,” with hash-based signatures excepted | Not permitted for certified products |
| Germany (BSI) | Recommended for long-term confidentiality, explicitly aligned with France | Not the recommendation |
| UK (NCSC) | An “interim measure” inside a framework enabling a straightforward later move | The destination |
| US (NSA, CNSA 2.0) | Permitted rather than required. Hybrids are allowed for national security systems | Favored. CNSA 2.0 prefers standalone post-quantum |
| Measured deployment (UK, 2026) | 1,787 of 1,788 post-quantum-supporting web endpoints supported X25519MLKEM768 | 3 endpoints offered pure MLKEM1024, and at most one of them offered no hybrid group |
Sources: authority positions per ANSSI vs BSI vs NCSC vs NSA on Hybrid, each traced to its own published paper. Deployment figures: Loizou and Ghadafi, Measuring Post-Quantum TLS Deployment Across UK Internet Sectors, arXiv 2608.02147, 2026, Table 4, across 4,063 reachable HTTPS endpoints.
How do they actually differ?
They hedge opposite risks, and that is the entire disagreement.
Hybrid hedges against the post-quantum algorithm being wrong. The lattice mathematics behind ML-KEM is well studied and young next to RSA and elliptic curves. If a flaw surfaces, a hybrid connection still has its classical half standing, and the classical half only falls to a quantum computer that does not yet exist.
Pure hedges against carrying dead weight. Every hybrid handshake pays size and complexity for a component that is guaranteed to become worthless. A deployment that never retires its classical half is running an unfinished migration while looking finished, which is the failure mode the UK position is built around.
And the size cost is a real operational risk rather than an aesthetic one. A hybrid key share is much larger than a classical one, and the oversized first message can exceed a single packet and be dropped by a middlebox that neither endpoint controls. Hybrid support at both ends is necessary and not sufficient; the whole path has to tolerate the larger messages.
Where do they agree?
Both replace the classical-only key exchange that Shor’s algorithm destroys, and either one closes the harvest-now-decrypt-later window on new traffic.
Both use the same standardized post-quantum algorithms. The disagreement is about what accompanies them.
Both point at the same destination. Every published position treats standalone post-quantum as the end state, and differs only on whether to travel through hybrid to get there.
And neither addresses authentication, which remains classical in almost all deployment.
When is hybrid the right answer?
Where the requirement is protection against an undiscovered flaw in a young algorithm, and where the path can carry the larger handshake. It is required for ANSSI-certified products, recommended by BSI for long-term confidentiality, and is the construction essentially all real deployment has chosen.
When is pure the right answer?
Where a national-security regime favors standalone, as CNSA 2.0 does, or where size constraints make a hybrid handshake impractical, or where the deployment is late enough that the classical half is a liability rather than a hedge.
Why do the authorities disagree?
Because each is hedging a different failure, which is covered in full at ANSSI vs BSI vs NCSC vs NSA on Hybrid.
The compressed version: France and Germany hedge against a post-quantum algorithm turning out to be broken. The UK hedges against organizations carrying a permanent transitional state. The US favors standalone for national security systems. All four are internally coherent, and they conflict on interoperability.
Is one replacing the other?
Yes, and the direction is settled even where the timing is not. Hybrid is transitional by construction, since its classical component is exactly what a quantum computer breaks. Every published position treats pure post-quantum as the destination. The disagreement is about how long the bridge should be and whether it is mandatory to cross it.
Common misconceptions
“Hybrid means twice the security.” Security comes from the composition rather than the count. It is “secure if either holds” only when the secrets are combined correctly through the key schedule.
“Hybrid extends the deadline.” It does the opposite. Hybrid closes the harvest-now window on new data immediately, and the classical half still has to be removed before Q-Day, so the migration deadline is unchanged.
“Hybrid is the permanent answer.” It is sized for the transition window. A hybrid that never retires its classical half is hiding an unfinished migration.
“If both endpoints support hybrid, we’re done.” The oversized handshake can be dropped by a middlebox neither endpoint controls.
“NIST and NSA both require hybrid.” CNSA 2.0 permits hybrids without requiring them and favors standalone post-quantum for national security systems.
“Hybrid and crypto-agility are the same thing.” Hybrid runs two families at once for redundancy. Crypto-agility is the ability to change algorithm centrally through configuration. They are related and distinct.
Questions people ask
Which should we deploy? The regulatory answer depends on jurisdiction and certification regime, and the deployed answer has overwhelmingly been hybrid. This page teaches the distinction rather than selecting for a particular estate.
Why do France and the NSA disagree? They are hedging different failures. See ANSSI vs BSI vs NCSC vs NSA on Hybrid.
Is hybrid slower? It carries more bytes in the handshake, and the operational risk is the packet-size effect on the path rather than raw computation.
Can a hybrid connection be downgraded? The protocol has to refuse silent fallback for the “secure if either holds” property to be real, which is a property of the implementation.
When does the classical half come out? Before a quantum computer capable of breaking it exists. No published position treats the classical component as permanent.
Does hybrid help with signatures? Hybrid as described here is a key-exchange construction. The signature lane has its own composite and dual-certificate approaches, and ANSSI excepts hash-based signatures from its hybrid requirement.
What does everyone actually run? In a 2026 measurement of 4,665 UK organizations, 1,787 of 1,788 post-quantum-supporting web endpoints supported X25519MLKEM768. Pure MLKEM1024 was offered by 3, almost all of which also offered the hybrid. The study measures which groups an endpoint supports rather than which one a handshake selects.
Last verified 2026-08-10 · Maintained by Addie LaMarr, LaMarr Labs. Work with Addie at lamarrlabs.com.