Hybrid KEM KeyGen

Category: Post-Quantum Cryptography · Node Type ID: pqc-hybridkem-keygen

Generates Post-Quantum Hybrid Keypair (X25519 + ML-KEM-768)

Overview

Generates a composite Post-Quantum Hybrid KEM keypair combining classical X25519 (RFC 7748, 32B) with post-quantum ML-KEM-768 (NIST FIPS 203 Level 3, 1,184B public / 2,400B secret), following the IETF X25519MLKEM768 hybrid key exchange design used in TLS 1.3 and Chrome/Cloudflare PQ deployments.

The output Hybrid Public Key is 1,216 bytes ($32 + 1184$) and the Hybrid Secret Key is 2,432 bytes ($32 + 2400$). Security holds as long as at least one of Curve25519 or ML-KEM-768 remains unbroken.

When to Use

Deploying defense-in-depth post-quantum hybrid key establishment with Hybrid KEM Encapsulate and Hybrid KEM Decapsulate.

Parameter Configuration

Hybrid KEM KeyGen has no configurable parameters; it fixes the industry-standard X25519 + ML-KEM-768 hybrid suite.

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

This node has no input ports.

Output Ports

Port Nature: Fixed Output Ports (2 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Hybrid Public Key`	`publicKey`	`Bytes`	Always visible	1,216-byte composite public key (32B X25519 public key \|\| 1,184B ML-KEM-768 public key).
`Hybrid Secret Key`	`secretKey`	`Bytes`	Always visible	2,432-byte composite secret key (32B X25519 secret key \|\| 2,400B ML-KEM-768 secret key).

Error Cases

This node has no runtime failure cases (errorProfile: none) and always succeeds for any valid typed input.

Examples

Generating an X25519 + ML-KEM-768 Hybrid Keypair

Create a composite hybrid keypair for quantum-resilient key exchange.

Place Hybrid KEM KeyGen and wire Hybrid Public Key to Hybrid KEM Encapsulate and Hybrid Secret Key to Hybrid KEM Decapsulate.