ML-KEM.
The post-quantum key encapsulation mechanism NIST standardised in FIPS 203, previously known as Kyber. AgePony uses the ML-KEM-768 parameter set to establish a file key that a quantum computer should not be able to recover.
ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) is the post-quantum KEM specified in FIPS 203. Its security rests on the hardness of module lattice problems rather than on discrete logarithms or factoring.
What it is
A KEM does not encrypt your message. It encapsulates: given a recipient's public key, the sender runs an encapsulation that outputs two things, a fresh shared secret and a ciphertext carrying it. The recipient runs decapsulation with their private key on that ciphertext and recovers the same shared secret. The actual file is then encrypted symmetrically under a key derived from that secret, exactly the role X25519 key agreement plays in classical age. ML-KEM-768 is the middle parameter set of the three in FIPS 203, and is the one AgePony uses.
Why it matters
ML-KEM is the algorithm the rest of the industry is converging on, which matters more than any individual design choice: a standardised, widely reviewed primitive with interoperable implementations beats a clever bespoke one. It is also worth being precise about what it does not do. ML-KEM is not a signature scheme. It has no sign or verify operation at all, so a post-quantum identity in AgePony can receive files but cannot sign them. Signing remains the job of an Ed25519 key under SSHSIG. NIST standardised a separate post-quantum signature family for that role, and it is not ML-KEM.
Both sides end up holding the same secret; the file key is derived from it.
Related terms
Common questions.
Is ML-KEM the same thing as Kyber?
Effectively yes. Kyber was the submission name; ML-KEM is the standardised version published as FIPS 203. The parameter sets are named ML-KEM-512, ML-KEM-768 and ML-KEM-1024.
Why can a post-quantum identity receive files but not sign them?
ML-KEM is a key encapsulation mechanism, not a signature scheme. It can establish a shared secret with you, but it cannot produce a signature over a file, so AgePony post-quantum identities are encryption-only and signing stays with SSHSIG.
Get AgePony
Free file encryption for iOS and Android. No accounts, no tracking, no servers.