Hybrid Key Exchange in TLS 1.3

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 18
Abstract: Hybrid key exchange refers to using multiple key exchange algorithms simultaneously and combining the result with the goal of providing security even if a way is found to defeat the encryption for all but one of the component algorithms. It is motivated by the transition to post-quantum cryptography. This document provides a construction for hybrid key exchange in the Transport Layer Security (TLS) protocol version 1.3.
Publication Date: 2026-07-01
Status Note: Informational
DOI: 10.17487/RFC9954
Link: https://doi.org/10.17487/RFC9954
Author(s): Douglas Stebila
Scott Fluhrer
Shay Gueron
Keyword(s): Post-quantum Cryptography

Latest version of IETF RFC 9954

Document Versions — IETF RFC 9954

▶ IETF RFC 9954 (2026-07-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

10.1007-978-3-319-70500-2_12 — HHK EXTERNAL
10.1007-s00145-011-9114-1 — FO EXTERNAL
IETF RFC 2119 [Active*]
IETF RFC 8174 [Active*]
IETF RFC 9846 [Active*]

Bibliographic Reference(s)

10.1007-978-1-4684-4730-9_4 — EVEN EXTERNAL
10.1007-978-3-030-25510-7_12 — BINDEL EXTERNAL
10.1007-978-3-030-44223-1_5 — PST EXTERNAL
10.1007-978-3-319-76578-5_7 — GIACON EXTERNAL
10.1007-978-3-540-24632-9_26 — ZHANG EXTERNAL
10.1007-978-3-540-30576-7_11 — DODIS EXTERNAL
10.1007-978-3-540-88702-7 — PQC EXTERNAL
10.1007-11426639_6 — HARNIK EXTERNAL
10.1007-s00145-021-09384-1 — DOWLING EXTERNAL
10.1109-SP.2013.42 — LUCKY13 EXTERNAL
10.1109-SP.2015.40 — BCNS15 EXTERNAL
10.1145-2976749.2978425 — FRODO EXTERNAL
GITHUB.open-quantum-safe.oqs-provider — OQS-PROV EXTERNAL
IETF.draft-campagna-tls-bike-sike-hybrid-07 — I-D.campagna-tls-bike-sike-hybrid EXTERNAL
IETF.draft-ietf-tls-ecdhe-mlkem-05 — I-D.ietf-tls-ecdhe-mlkem EXTERNAL
IETF.draft-josefsson-mceliece-05 — I-D.josefsson-mceliece EXTERNAL
IETF.draft-kiefer-tls-ecdhe-sidh-00 — I-D.kiefer-tls-ecdhe-sidh EXTERNAL
IETF.draft-schanck-tls-additional-keyshare-00 — I-D.schanck-tls-additional-keyshare EXTERNAL
IETF.draft-whyte-qsh-tls12-02 — I-D.whyte-qsh-tls12 EXTERNAL
IETF.draft-whyte-qsh-tls13-06 — I-D.whyte-qsh-tls13 EXTERNAL
NIST.FIPS.203 — ML-KEM EXTERNAL
NIST.SP.800-56Cr2 — NIST-SP-800-56C EXTERNAL
NIST.SP.800-135r1 — NIST-SP-800-135 EXTERNAL
Nimrod Aviram, Benjamin Dowling, Ilan Komargodski, Kenny Paterson, Eyal Ronen, and Eylon Yogev, "[TLS] Combining Secrets in Hybrid Key Exchange in TLS 1.3", 1 September 2021, <https://mailarchive.ietf.org/arch/msg/tls/F4SVeL2xbGPaPB2GW_GkBbD_a5M/>. EXTERNAL
Braithwaite, M., "Experimenting with Post-Quantum Cryptography", Google Security Blog, 7 July 2016, <https://security.googleblog.com/2016/07/experimenting-with-post-quantum.html>. EXTERNAL
Nielsen, M. A. and I. L. Chuang, "Quantum Computation and Quantum Information", Cambridge University Press, 2000. EXTERNAL
Merget, R., Brinkmann, M., Aviram, N., Somorovsky, J., Mittmann, J., and J. Schwenk, "Raccoon Attack: Finding and Exploiting Most-Significant-Bit-Oracles in TLS-DH(E)", September 2020, <https://raccoon-attack.com/>. EXTERNAL
Fluhrer, S., "Cryptanalysis of ring-LWE based key exchange with key share reuse", Cryptology ePrint Archive, Paper 2016/085, 2016, <https://eprint.iacr.org/2016/085>. EXTERNAL
Hopkins, A. and M. Campagna, "Post-quantum TLS now supported in AWS KMS", AWS Security Blog, 4 November 2019, <https://aws.amazon.com/blogs/security/post-quantum-tls-now-supported-in-aws-kms/>. EXTERNAL
"OQS-OpenSSL-1-1-1_stable", commit 5f49b7a, 8 January 2025, <https://github.com/open-quantum-safe/openssl/tree/OQS-OpenSSL_1_1_1-stable>. EXTERNAL
"OQS-OpenSSL-1-0-2_stable", commit 537b2f9, 31 January 2020, <https://github.com/open-quantum-safe/openssl/tree/OQS-OpenSSL_1_0_2-stable>. EXTERNAL
Langley, A., "CECPQ2", 12 December 2018, <https://www.imperialviolet.org/2018/12/12/cecpq2.html>. EXTERNAL
Campagna, M., Ed., et al., "Quantum Safe Cryptography and Security: An introduction, benefits, enablers and challenges", ETSI White Paper No. 8, June 2015, <https://www.etsi.org/images/files/ETSIWhitePapers/QuantumSafeWhitepaper.pdf>. EXTERNAL
Katz, J. and Y. Lindell, "Introduction to Modern Cryptography", Third Edition, CRC Press, 2021. EXTERNAL
Langley, A., "Post-quantum confidentiality for TLS", 11 April 2018, <https://www.imperialviolet.org/2018/04/11/pqconftls.html>. EXTERNAL
IANA, "TLS Supported Groups", <https://www.iana.org/assignments/tls-parameters>. EXTERNAL
NIST, "Post-Quantum Cryptography", <https://www.nist.gov/pqcrypto>. EXTERNAL
IETF RFC 8391 [Active*]
IETF RFC 8773 [Superseded*]
IETF RFC 8784 [Active*]
IETF RFC 9180 [Active*]
IETF RFC 9370 [Active*]
IETF RFC 9794 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9954.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9954, Hybrid Key Exchange in TLS 1.3. Available at https://doi.org/10.17487/RFC9954

Snippet:

IETF RFC 9954, Hybrid Key Exchange in TLS 1.3. Available at https://doi.org/10.17487/RFC9954

HTML (ISO 690 compliant)

Preview:

IETF RFC 9954, Hybrid Key Exchange in TLS 1.3. Available at https://doi.org/10.17487/RFC9954

Snippet:

<span class="citation"><cite>IETF RFC 9954</cite>, Hybrid Key Exchange in TLS 1.3. Available at <a href="https://doi.org/10.17487/RFC9954" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9954</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9954, Hybrid Key Exchange in TLS 1.3
doi: 10.17487/RFC9954
url: https://doi.org/10.17487/RFC9954

Snippet:

<li>
<cite id="bib-rfc9954">IETF RFC 9954</cite>, Hybrid Key Exchange in TLS 1.3
<span class="doi">10.17487/RFC9954</span>
</li>

Referenced By

IETF RFC 9963 [Active*]