Hybrid Key Exchange: Combining the Best of Different Worlds

The term hybrid is becoming increasingly common across many areas of technology. A prominent example can be found in electric mobility, where hybrid electric vehicles continue to gain market share. The concept is equally prevalent in cybersecurity and quantum-safe cryptography.

When we speak of a hybrid cryptographic key, we are referring to hybrid key establishment, that is, the process of key exchange or key agreement. Multiple key exchange mechanisms—such as classical and Post-Quantum Cryptography (PQC) schemes—are combined to increase resilience against different attack vectors. The security of the resulting key is preserved as long as at least one of the underlying component schemes remains secure.

Consider a bicycle lock as an analogy. When we park a bicycle, we secure it with a lock and use a key to unlock it later. A thief would need either to break the lock or obtain the corresponding key to steal the bike. If we secure the bicycle using both a chain lock and a U-lock in a well-designed manner, the thief would need to defeat two different types of protection mechanisms or obtain two keys. On the other hand, we would also need to carry two locks and manage two keys to gain this additional level of security.

The benefit of a hybrid approach—whether in hybrid vehicles, bicycle locks, or cryptographic key exchange—is immediately apparent: different techniques are combined to leverage their individual strengths. A closer look, however, also reveals that redundancy introduces additional costs, as the overhead of multiple approaches accumulates.

Consequently, the design of hybrid systems raises two fundamental questions:

1. How can different approaches be combined in a way that maximizes their strengths while minimizing additional overhead?
2. Is the added complexity justified by the resulting security benefits?

Approaches to Combining Cryptographic Schemes

Several approaches to hybridizing cryptographic key exchange mechanisms have been proposed in the literature [1]. Broadly speaking, these approaches can be categorized into two types, referred to here as sequential hybridization and parallel hybridization.

Sequential Hybridization

In sequential hybridization, component schemes are executed one after another and build logically upon each other. This approach is therefore also known as layered or cascading hybridization. Returning to the bicycle lock analogy, we would first secure the bicycle with one lock, store the key safely, and then repeat the process using a second lock. In the context of key exchange, a key is first established using scheme A and subsequently applied, for example, within an encryption algorithm. The same procedure is then repeated using scheme B.

Two variants can be distinguished:

• The keys derived from the component schemes can be applied directly to the payload data. In this case, the data is first encrypted using the key from scheme A, and the resulting ciphertext is then encrypted again using the key from scheme B.
• Alternatively, the key derived from scheme A can be used to protect the communication associated with the key establishment of scheme B.

Parallel Hybridization

In contrast, parallel hybridization executes the component schemes side by side and combines their outputs. In the bicycle lock analogy, this would resemble two different chains or cables connected to a common locking point. For cryptographic key exchange, independent keys are established using different schemes, combined into a single shared key, and then used by the application.

One example is our parallel hybrid authenticated key exchange protocol, developed by our co-founder Johanna Henrich together with Sebastian Clermont from TU Darmstadt [6]. The protocol guarantees that the final key remains secure as long as at least one of the underlying schemes remains secure. It can even preserve the information-theoretic security of the QKD-generated key.

Comparing Parallel and Sequential Approaches

Both approaches offer distinct advantages and disadvantages. Some key characteristics are summarized in Table 1.

A large number of widely deployed and standardized security protocols, such as TLS and SSH, perform authenticated key exchange before communicating over the established secure channel. Sequential hybridization can often make use of these protocols without requiring protocol modifications. Parallel hybridization, by contrast, generally requires additional processing steps and modifications. Specifically, parallel hybridization requires an explicit key-combination mechanism. This may introduce additional implementation complexity, increase memory requirements, complicate software maintenance, and create new opportunities for implementation errors. Furthermore, the operations performed during key combination may alter the security properties of the original key material.

Sequential hybridization presents its own challenges. All component keys must remain available individually and be applied in the correct order during encryption and decryption. This can increase memory consumption and complicate key management. Moreover, the hybridization process becomes intertwined with the actual use of the keys, since the hybrid security properties emerge only when the keys are applied to protect data. This can make both security analysis and formal security proofs more difficult.

Table 1: Comparison of Sequential and Parallel Hybrid Key Exchange

Is Hybridization Worth the Effort?

Despite the additional complexity, the advantages of hybrid key exchange mechanisms outweigh their costs in many practical scenarios.

By combining classical and PQC schemes, organizations can reduce the risk that unforeseen weaknesses in any single scheme compromise confidentiality. This assumes, of course, that implementations are carefully designed to avoid security vulnerabilities and potential downgrade attacks.

At the same time, scientific studies have shown that the additional overhead introduced by hybridization—in terms of runtime, bandwidth consumption, and memory requirements—is often negligible in realistic deployment scenarios. This has been investigated, among others, in the work of Johanna Henrich and colleagues [4,5].

This assessment is also reflected in recommendations from European cybersecurity authorities. Both the German Federal Office for Information Security (BSI) [2] and the French National Cybersecurity Agency (ANSSI) [3] recommend hybrid approaches as an important building block for the transition to PQC.

In future blog posts, we will take a closer look at the costs and benefits of hybrid key exchange mechanisms and examine the specific recommendations issued by the BSI in greater detail.

References

1. N. Bindel, J. Brendel, M. Fischlin, B. Goncalves, and D. Stebila, “Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange,” in Post-Quantum Cryptography (PQCrypto 2019), J. Ding and R. Steinwandt, Eds., Lecture Notes in Computer Science, vol. 11505. Cham, Switzerland: Springer, 2019, pp. 206–226. doi: 10.1007/978-3-030-25510-7_12.
2. Federal Office for Information Security (BSI), BSI TR-02102-1: Cryptographic Mechanisms – Recommendations and Key Lengths, Version 2025-01. Bonn, Germany: BSI, March 2025.
3. French National Agency for the Security of Information Systems (ANSSI), ANSSI Views on the Post-Quantum Cryptography Transition. Paris, France: ANSSI, January 2022.
4. J. Henrich, A. Heinemann, A. Wiesmaier, and N. Schmitt, “Performance Impact of PQC KEMs on TLS 1.3 Under Varying Network Characteristics,” in Information Security (ISC 2023), Lecture Notes in Computer Science, vol. 14411. Springer, 2023.
5. J. Henrich, N. Schmitt, N. Alnahawi, and A. Heinemann, “A Lot of Data and Added Complexity: How Does PQC Affect the Performance of My TLS Connection?,” in Information Security (ISC 2025), 28th International Conference, Seoul, South Korea, 2025, pp. 107–128.
6. S. Clermont, and J. Henrich, “The Best of Both Worlds: Hybrid Authenticated Key Exchange for QKD(N) without Signatures” in Progress in Cryptology - AFRICACRYPT 2026. Lecture Notes in Computer Science, vol 16832. Springer, Cham. doi: 10.1007/978-3-032-31130-6_4.