PQC Hybrid (Bare Post-Quantum Algorithm Without a Classical Partner)

Flags a bare (pure) post-quantum key-establishment or signature primitive — for example ML-KEM or ML-DSA used on its own — where post-quantum transition guidance recommends a hybrid construction that combines the PQC scheme with a classical one. This is the hybrid-transition axis of post-quantum readiness, separate from pqc_readiness (classical public-key that must migrate) and pqc_weak_keylength (symmetric/hash sizing).

Post-quantum algorithms are young; confidence in their long-term security is still maturing. To hedge that risk during the migration period, national standards bodies — notably Germany’s BSI (TR-02102) and France’s ANSSI — recommend deploying PQC key establishment and signatures in a hybrid construction: the shared secret (or signature assurance) is derived from both a classical algorithm (e.g. X25519, ECDSA) and a PQC algorithm (e.g. ML-KEM, ML-DSA), so a future break in either component alone does not compromise the protection.

A finding is emitted only for a bare PQC primitive; an algorithm that is already a hybrid construction (e.g. X25519MLKEM768) is compliant and is not flagged. Because the underlying algorithm is already quantum-safe, this is an advisory, policy-gated signal: regions whose policy mandates pure PQC rather than hybrid (e.g. NSA CNSA 2.0) disable it with requireHybrid: false.

In Go, the Cloudflare CIRCL library exposes ML-KEM (kem/mlkem/…​) and ML-DSA (sign/mldsa/…​) key generation. A bare PQC key-pair generator is flagged under hybrid-transition guidance, while a hybrid construction is the recommended target:

Where transition guidance applies, replace the bare PQC primitive with a hybrid construction that combines it with a classical algorithm — for key establishment, a hybrid KEM such as X25519+ML-KEM-768; for signatures, a classical (EdDSA/ECDSA) + ML-DSA dual signature. Where policy instead mandates pure PQC, set requireHybrid: false to disable this rule.