The harvest-now-decrypt-later threat
Public-key cryptography relies on mathematical problems that are hard for classical computers - factoring large integers (RSA), or the elliptic curve discrete log problem (ECDH, Ed25519). A sufficiently powerful quantum computer running Shor's algorithm could solve these in polynomial time.
No such computer exists today. But the timeline is shrinking, and the threat is already active: nation-state adversaries are intercepting and archiving encrypted traffic at scale, waiting for quantum hardware to catch up. This is the "harvest now, decrypt later" (HNDL) attack. Data with a long secrecy requirement (private keys, long-lived credentials, sensitive documents) is at risk even from threats that are years away.
X-Wing: the hybrid KEM Pock uses
Pock uses X-Wing, a hybrid key-encapsulation mechanism that combines two KEMs:
- X25519 - the standard Diffie-Hellman key exchange over Curve25519. Fast, widely deployed, classical security.
- ML-KEM-768 - the Module Lattice KEM standardised as NIST FIPS 203 in 2024. Based on the CRYSTALS-Kyber submission. Designed to be secure against quantum adversaries.
X-Wing runs both KEMs and combines their shared secrets into a single combined key using a defined combiner. The resulting key is used to derive the final encryption key via HKDF, then passed into the AEAD cipher (AES-256-GCM or XChaCha20-Poly1305).
Why hybrid, not just ML-KEM?
ML-KEM-768 is new. The confidence behind X25519 comes from decades of analysis and deployment. Combining them means:
The hybrid ciphertext is secure if either X25519 or ML-KEM-768 is unbroken. An attacker must compromise both simultaneously to recover plaintext.
This matters because post-quantum algorithms are newer and have seen less public cryptanalysis. If a flaw is found in ML-KEM (as happened with earlier lattice schemes), the X25519 component still holds. If a quantum computer breaks X25519, ML-KEM still holds. Pure ML-KEM would lose if any flaw were found. The hybrid eliminates that single point of failure.
NIST standardization
NIST finalized the post-quantum cryptography standards in 2024. ML-KEM (FIPS 203) and ML-DSA (FIPS 204) are the primary algorithms. ML-KEM-768 offers 128-bit post-quantum security - equivalent to AES-128 against a quantum adversary - with public keys and ciphertexts small enough for practical use (1,184 and 1,088 bytes respectively).
Key sizes at a glance
| Algorithm | Public key | Ciphertext |
|---|---|---|
X25519 | 32 bytes | 32 bytes |
ML-KEM-768 | 1,184 bytes | 1,088 bytes |
X-Wing | 1,216 bytes | 1,120 bytes |
Where it's used in Pock
X-Wing is used for all asymmetric encryption operations: secure sharing (the default cipher option in the web and CLI), vault key wrapping, and multi-recipient envelopes. Symmetric-only paths (like a single passphrase wrapping a data key) use XChaCha20-Poly1305 directly since there is no public-key exchange to attack.
Read more: zero-knowledge design, secure sharing ciphers, or go to try a share.