How Firefox Implements Post-Quantum TLS Key Exchange

This article provides an overview of how Mozilla implemented post-quantum hybrid key exchange algorithms within the Firefox web browser to secure TLS 1.3 connections against future quantum computer attacks. It covers the concept of hybrid cryptography, the specific integration of the X25519Kyber768 algorithm into Firefox's Network Security Services (NSS) library, the mechanics of the upgraded TLS handshake, and how Mozilla overcame network engineering challenges to enable this security feature by default.

The Hybrid Approach to Post-Quantum Security

Quantum computers will eventually break the classical public-key cryptography currently used to secure the internet. To prevent "harvest now, decrypt later" attacks—where adversaries record encrypted traffic today to decrypt it with a quantum computer in the future—Firefox utilizes a hybrid key exchange.

A hybrid key exchange combines a battle-tested classical algorithm with a new post-quantum algorithm. The resulting connection remains secure as long as at least one of the two algorithms remains unbroken. This ensures that even if the new post-quantum algorithm has an undiscovered flaw, the connection is still as secure as standard classical traffic.

The Algorithm: X25519Kyber768

To achieve this hybrid security in TLS 1.3, Mozilla implemented the X25519Kyber768 (and subsequently its final standardized form, X25519MLKEM768) key exchange mechanism. This mechanism fuses two distinct algorithms:

  • X25519: A widely used, fast, and secure classical elliptic-curve Diffie-Hellman (ECDH) key exchange.
  • Kyber-768 (ML-KEM): A lattice-based Key Encapsulation Mechanism (KEM) selected by the National Institute of Standards and Technology (NIST) as the primary standard for post-quantum key establishment.

Integration into Network Security Services (NSS)

Unlike many browsers that rely on BoringSSL or OpenSSL, Firefox relies on its own cryptographic library called Network Security Services (NSS). Mozilla implemented the post-quantum hybrid key exchange by updating NSS to support the Internet Engineering Task Force (IETF) draft specifications for hybrid TLS.

To ensure memory safety and prevent vulnerabilities, Mozilla integrated verified, high-performance implementations of the Kyber algorithm into NSS. When Firefox initiates a secure connection, NSS handles the mathematical operations required to generate both the classical and post-quantum keys simultaneously.

Mechanics of the Upgraded TLS 1.3 Handshake

Firefox restricts post-quantum key exchanges exclusively to TLS 1.3. The implementation modifies the standard TLS handshake in the following way:

  1. Client Hello: When Firefox connects to a server, it sends a ClientHello message. Inside the key_share extension of this message, Firefox includes a single hybrid key share containing both an X25519 public key and a Kyber-768 public key.
  2. Server Hello: If the server (such as those run by Cloudflare or Google) supports the hybrid algorithm, it responds with a ServerHello. This contains the server's X25519 public key and a Kyber-768 ciphertext.
  3. Secret Calculation: Firefox computes the classical shared secret using X25519 and decapsulates the Kyber-768 ciphertext to reveal the post-quantum shared secret.
  4. Key Concatenation: NSS concatenates (joins together) both secrets into a single buffer. This combined secret is then fed into the standard TLS 1.3 Key Schedule (HKDF) to generate the symmetric keys used to encrypt the actual browsing session.

If the server does not support the hybrid algorithm, it ignores the post-quantum data and requests a fallback to a standard X25519 key exchange, ensuring websites do not break.

Overcoming Network Intolerance and Rollout

The primary challenge in Firefox's implementation was data size. A classical X25519 public key is only 32 bytes, whereas a Kyber-768 public key is 1,184 bytes. Combining them pushes the ClientHello message over the maximum size of a single TCP packet (typically 1,500 bytes).

Splitting the ClientHello across multiple packets caused older, misconfigured network firewalls and middleboxes to drop the connection, resulting in failed page loads. To solve this, Mozilla rolled out the feature gradually:

  • Experimental Phase: Beginning in Firefox 118, the feature was hidden behind an opt-in configuration flag (security.tls.enable_kyber in the about:config menu).
  • Telemetry Testing: Mozilla enabled the feature for small percentages of Firefox Nightly and Beta users to identify and work with vendors of broken middleboxes.
  • Default Deployment: After confirming that connection failure rates had dropped to negligible levels, Mozilla enabled post-quantum hybrid key exchange by default starting in Firefox 124 for desktop users.