FIPS 203 — the post-quantum key encapsulation.
ML-KEM-768 is the NIST-standardized key-encapsulation mechanism UltimaOS uses to establish fresh symmetric session keys. Standardized as FIPS 203 in August 2024, it is the lattice-based successor to ECDH for the post-quantum era.
Like RSA, ECDH relies on the hardness of elliptic-curve discrete logarithm, which Shor's algorithm solves in polynomial time on a quantum computer. Any forward-secret conversation negotiated today with ECDH can be retroactively decrypted once a quantum computer exists.
ML-KEM (formerly Kyber) is the lattice-based key-encapsulation mechanism standardized by NIST as FIPS 203 in August 2024. It is the most studied and most performant of the NIST post-quantum KEM candidates.
When two UltimaOS users start a conversation, ML-KEM-768 encapsulates a fresh 256-bit AES session key. Even if the entire conversation is recorded today, no future quantum computer can derive that session key from the recording.
Every conversation, file share, or call on UltimaOS begins with an ML-KEM-768 key encapsulation. The encapsulated session key seeds an XChaCha20-Poly1305 symmetric channel that carries the actual content.
When user A opens a chat with user B, the client requests B's ML-KEM-768 public key from the server. The client encapsulates a fresh 256-bit key against it, sends the ciphertext to B, and both sides derive the same session key.
File uploads generate a per-file 256-bit key. The file is encrypted with XChaCha20-Poly1305, and the file key is encapsulated with ML-KEM-768 against each recipient's public key. Recipients decapsulate to recover the file key.
Voice and video calls establish a fresh ML-KEM-768 session every 60 seconds, providing cryptographic forward secrecy even within a long call. A passive recorder of one segment cannot decrypt previous or subsequent segments.
Chat messages are encrypted per message with ML-KEM-768: each message carries its own key encapsulation, rather than relying on a single long-lived group key.
ML-KEM-768 encapsulation takes about 0.07 ms. Opening a new conversation completes in under 50 ms including the network round-trip.
An ML-KEM-768 ciphertext is 1,088 bytes — small enough to fit in a single TCP segment. For group chats with N recipients, the client sends N ciphertexts in a single batch.
Every conversation uses a fresh session key. There are no long-term asymmetric keys used directly for symmetric encryption — the post-quantum KEM is always used to derive a one-time key.
UltimaOS is structured to combine ML-KEM-768 with classical ECDH in a hybrid construction if NIST ever recommends it. The current single-algorithm deployment is preferred because it removes the downgrade-attack surface.
Short answer
ML-KEM-768 (Module-Lattice-Based Key-Encapsulation Mechanism, parameter set 768) is the NIST-standardized post-quantum key-encapsulation mechanism specified in FIPS 203. It replaces ECDH for the post-quantum era. (FIPS 203 spec)
Short answer
The "768" refers to the dimension of the underlying module lattice. ML-KEM-768 targets NIST security level 3, equivalent in classical security terms to breaking AES-192.
Short answer
Yes. ML-KEM-768 is the standardized name; Kyber was the name used during the NIST competition. The mathematical construction is identical; only minor parameter tweaks were made during standardization.
Short answer
ML-KEM's security is based on the hardness of the Module Learning-with-Errors (M-LWE) problem. No efficient quantum algorithm is known for M-LWE, unlike Shor's algorithm which breaks RSA and ECDH in polynomial time.
Short answer
ML-KEM-768 is slightly slower than ECDH at the cryptographic operation level, but the difference is invisible at the application level — both complete in fractions of a millisecond. The handshake adds a few milliseconds of latency overall.
Short answer
No. The current deployment uses pure ML-KEM-768 for key encapsulation. Hybrid KEM+ECDH is structurally supported but not enabled, because single-algorithm deployment eliminates downgrade attacks.
Short answer
FIPS 203 is the Federal Information Processing Standard published by NIST in August 2024 that specifies ML-KEM. It is the formal standardization of the scheme.
Short answer
If a fundamental break is ever found in lattice-based cryptography, UltimaOS would migrate to the next NIST-standardized KEM. The cryptographic stack is designed so individual algorithm replacement is feasible without protocol redesign.
No ads, no data mining, no trial clock. Individual and family accounts are free — permanently. Organisations pay per seat, and that is what funds it.