NIST's main quantum-safe way to set up a shared key, standardized in 2024.
The idea: ML-KEM's public key is a set of noisy equations about a small secret s (an LWE instance). To send a key, you combine the public equations using your own small random numbers and hide the key's bits as big jumps in the result, blurred by more noise. The recipient, who knows s, removes almost everything and is left with the key bits plus a little noise, which rounding cleans up. An eavesdropper sees only noisy equations, which look random without s.
Why it matters: Already protects much of your web traffic, paired with the classic X25519.
Noise that only the key holder can see through
Think of numbers modulo q as positions on a clock. Each dot is one encrypted bit. To an eavesdropper (left) the values land anywhere. The key holder (right) subtracts what the secret explains and is left with just a little noise: bits that were 0 end up near 0 (blue), bits that were 1 near q/2 (red). As long as the noise stays small, rounding to the nearer half reads every bit correctly.
Apple Security Engineering and Architecture. iMessage with PQ3: The new state of the art in quantum-secure messaging at scale. Apple Security Research, 2024. security.apple.com/blog/imessage-pq3