ML-KEM·Key encapsulation·NIST level 1

ML-KEM-512

ML-KEM (FIPS 203) is a lattice-based key encapsulation mechanism, standardized by NIST in August 2024. It replaces RSA and elliptic-curve Diffie-Hellman for establishing shared secrets in a post-quantum world.

ML-KEM-512 targets NIST security level 1 — the lowest of the standardized parameter sets. Most deployments choosing a post-quantum KEM today select ML-KEM-768 (level 3) as the default; 512 is benchmarked here for completeness and for constrained environments, not as a general recommendation.

Latest run2026-09-21 11:47 UTC

commit6ed429a

CPU: Xeon Platinum 8488C
Measured on: c7i.large
OS / Kernel: 24.04.4 LTS
liboqs: 0.15.0
Wall clock: 32m 32s
CPU steal: <0.01%

Parameters

Family: ML-KEM
Parameter set: 512
Public key: 800 B
Private key: 1.59 KB
Ciphertext: 768 B
Iterations / op: 1,000
liboqs key: ML-KEM-512

Regulatory approval status

Whether this algorithm family is approved/recommended for use under three regimes. Every badge links to its source — click through before citing this elsewhere.

CNSA 2.0 (US/NSA)Approved

CNSA 2.0 replaces ECDH/RSA key establishment with ML-KEM. Commercial equipment follows CNSA 1.0 until the CNSSP 156-mandated transition (~2025–2030 depending on equipment type).

NSA CNSA 2.0 Cybersecurity Advisory · not directly verified this session, spot-check the source

BSI TR-02102-1 (DE)Recommended

Listed under §2.4.3 "ML-KEM Key Agreement", one of BSI's recommended quantum-safe asymmetric mechanisms.

BSI TR-02102-1 "Cryptographic Mechanisms: Recommendations and Key Lengths", Version 2026-01 (23 Jan 2026)

ANSSI (FR)Conditional

Recommended at NIST level 5 (preferred) or level 3, using the IND-CCA (active) variant with ephemeral keys where possible — not the parameters modified, and hybridization "strongly emphasized as necessary" in the short/medium term.

ANSSI views on the Post-Quantum Cryptography transition (2023 follow up), §2

keygenGenerate a fresh key pair.

131 of 131 runs

Mean: 7.7 µs
95% CI on mean: ±2.21%
Median: 7.3 µs
p95: 9.3 µs
p99: 16.8 µs
Stdev: 2.8 µs
Min: 6.9 µs
Ops/sec: 129,419

Mean is known to 7.56–7.90 µs across 1,000 iterations. A 95% confidence interval on the mean, not a prediction interval for a single operation. It says how precisely the average is known from this run's samples; the standard deviation says how much the individual samples scattered.

Mean over time

Click any point to view the GitHub Actions run that produced it.

encapEncapsulate: produce a shared secret and ciphertext under the recipient's public key.

131 of 131 runs

Mean: 8.8 µs
95% CI on mean: ±2.40%
Median: 8.5 µs
p95: 9.9 µs
p99: 18.1 µs
Stdev: 3.4 µs
Min: 8.1 µs
Ops/sec: 113,728

Mean is known to 8.58–9.00 µs across 1,000 iterations. A 95% confidence interval on the mean, not a prediction interval for a single operation. It says how precisely the average is known from this run's samples; the standard deviation says how much the individual samples scattered.

Mean over time

Click any point to view the GitHub Actions run that produced it.

decapDecapsulate: recover the shared secret from the ciphertext using the private key.

131 of 131 runs

Mean: 13.9 µs
95% CI on mean: ±1.33%
Median: 13.6 µs
p95: 15.1 µs
p99: 33.7 µs
Stdev: 3.0 µs
Min: 10.3 µs
Ops/sec: 71,897

Mean is known to 13.72–14.09 µs across 1,000 iterations. A 95% confidence interval on the mean, not a prediction interval for a single operation. It says how precisely the average is known from this run's samples; the standard deviation says how much the individual samples scattered.

Mean over time

Click any point to view the GitHub Actions run that produced it.

ML-KEM-512

Know the cost of post-quantum migration.