Short answer
The short answer
ML-KEM is a post-quantum cryptography standard from NIST, published as FIPS 203, that lets two devices agree on a secret key over the internet and is designed to withstand cyberattacks from a quantum computer.
The name is short for Module-Lattice-Based Key-Encapsulation Mechanism. This guide explains it in plain language, using NIST’s and the Canadian Centre for Cyber Security’s own words.
More guides: what two-factor authentication is, and why a code in an app beats a code by text message.
What it is
What ML-KEM is
NIST describes the idea this way: “A key-encapsulation mechanism (KEM) is a set of algorithms that, under certain conditions, can be used by two parties to establish a shared secret key over a public channel.” A KEM does not carry your message. It sets up the shared key, and ordinary encryption then does the rest: “A shared secret key that is securely established using a KEM can then be used with symmetric-key cryptographic algorithms to perform basic tasks in secure communications, such as encryption and authentication.”
ML-KEM is the KEM that NIST standardized. Of its security, the standard says: “At present, ML-KEM is believed to be secure, even against adversaries who possess a quantum computer.” NIST published the final standard on 13 August 2024. NIST’s page for FIPS 203 carries a planning note, dated 17 November 2025, that an issue will be corrected in a future revision.
Why it exists
Why it exists
Much of today’s cryptography depends on maths that ordinary computers find very hard. NIST says: “Sufficiently powerful quantum computers would not have this difficulty.” That is a statement about future machines. The Canadian Centre for Cyber Security says: “Existing quantum computers are not powerful enough to break cryptography.”
On timing, the sources are careful. NIST says: “No one knows how long it will take to build a cryptographically relevant quantum computer.” It adds: “Experts’ estimates range from a few years to a few decades.” The Cyber Centre says: “Although quantum computers cannot break cryptography now, a sufficiently powerful device could be available as early as the 2030s.”
The reason to act before then has a name, “harvest now, decrypt later”. The Cyber Centre explains: “Threat actors can store encrypted information now to decrypt in the future when a sufficiently powerful quantum computer exists.” NIST puts it this way: “Some secrets remain valuable for many years.”
Canada
Canada’s plan
The Cyber Centre’s roadmap for the Government of Canada (ITSM.40.001, June 2025) sets April 2026 for departments to develop an initial PQC (post-quantum cryptography) migration plan, the end of 2031 to complete migration of high-priority systems, and the end of 2035 for the remaining systems.
It recommends treating any system exposed to a harvest-now, decrypt-later threat as a high priority for migrating to PQC.
Our name
Where our name comes from
MELKEM takes its name from ML-KEM.
Our turn
What it means for our apps
MELKEM Authenticator doesn’t use ML-KEM. It makes standard TOTP codes on your iPhone, and its encrypted export is protected by a passphrase you choose.
We explain ML-KEM here because of our name, not because the app uses it. For what the app does with your codes, see the support page.
