Why not just use the post-quantum algorithm alone?

Because ML-KEM and ML-DSA are young: they have fewer years of cryptanalysis than RSA or elliptic curves. If a classical attack against them appeared, a pure system would fall; a hybrid one would still be protected by the classical component. The cost of hybrid is minimal and the insurance is large.

How are the two secrets combined?

You derive both shared secrets —the classical and the post-quantum one— and pass them TOGETHER through a key-derivation function (HKDF), also binding a 'transcript' with the public keys (X-Wing style). The final key depends on both: without both, it can't be reconstructed.

Does hybrid protect against 'harvest now, decrypt later'?

Yes, that's the point. Even if an attacker records the traffic today and later breaks X25519 with a quantum computer, they'd still need to break ML-KEM-1024 (lattice-based), which resists Shor. They need to break both.

Hybrid encryption: why combine classical and post-quantum cryptography

When a new cryptographic algorithm appears, a tension arises: classical algorithms (like X25519 or Ed25519) have resisted attacks for years but are vulnerable to a future quantum computer; post-quantum ones (like ML-KEM or ML-DSA) resist the quantum threat but are newer and less battle-tested. Hybrid encryption resolves the tension: use both at once.

The idea in one sentence

Combine a classical and a post-quantum algorithm so the system only breaks if both fail at the same time.

A classical attacker would have to break the post-quantum algorithm; a quantum attacker would have to break the classical one and the post-quantum one. You gain protection against the future without betting everything on a young algorithm.

Two places to apply it

Key exchange (encrypting for a recipient). You combine:

X25519 — classical key exchange, fast and well-tested.
ML-KEM-1024 — NIST's post-quantum encapsulation mechanism, at its highest level.

The two resulting keys are mixed with a context-bound key-derivation function (HKDF), so neither alone is enough.

Digital signatures (authenticity). You combine:

Ed25519 — classical signature.
ML-DSA-87 — NIST's post-quantum signature.

The message is accepted only if both signatures verify (an AND-style combiner).

A principle that never breaks

There's a golden rule in cryptography, Kerckhoffs's principle: a system must be secure even if the attacker knows its entire design; security lives in the key, not in hiding the format. A good hybrid system uses public, audited primitives (XChaCha20-Poly1305 to encrypt, Argon2id to derive keys from passwords, HKDF to separate domains) and never rolls its own cryptography.

How Quipu applies it

Quipu is a free library that implements exactly this approach for data at rest: hybrid X25519 + ML-KEM-1024 encryption, hybrid Ed25519 + ML-DSA-87 signatures, and only verified primitives underneath. It targets NIST security level 5 (CNSA 2.0) and is open source, so anyone can review how it works.

Honest note: Quipu composes standard primitives, but the composition has not yet passed an independent cryptographic audit. For real high-value secrets, that external audit is the seal worth waiting for.

Do you need to protect data at rest with a future-proof approach? Let's talk.