The "S" in HTTPS: it sets up a private, authenticated connection to a website.
The idea: In one round trip, your browser and the server do a key exchange (today usually X25519 combined with ML-KEM), the server signs the conversation with the key in its certificate to prove it's really that site, and a certificate authority's signature on the certificate vouches for that key. HKDF derives keys from the shared secret, and everything after that is sent with authenticated encryption. Break the key exchange and recorded traffic can be read. Break the signatures and someone can impersonate the site.
Why it matters: It's behind the padlock in your browser bar.
What happens when you open an HTTPS site
A TLS 1.3 connection in one round trip. The key shares (purple) set up a shared secret, which is why breaking key exchange would expose recorded traffic. The certificate and signature (pink) prove you are talking to the real site, which is why breaking signatures would allow impersonation. Everything after the website's hello is already encrypted.
The details
On the map: hybridKEM + RSA/ECDSA certificates + AES-GCM + HKDF falls if ANY part falls
Key exchange: ephemeral Diffie-Hellman, by default the X25519 + ML-KEM hybrid in current browsers[2, 3].
Server identity: a certificate signature, RSA or ECDSA.
Traffic: AES-GCM or ChaCha20-Poly1305, with keys derived by HKDF[4].
The certificates are still classical: a future quantum computer couldn't decrypt recorded traffic protected by the hybrid, but could impersonate servers in real time until post-quantum certificates arrive.
Nothing on the map depends on it: it is an end point, something people use directly.
References
E. Rescorla. The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446, 2018. rfc-editor.org/rfc/rfc8446
Kris Kwiatkowski, Panos Kampanakis, Bas Westerbaan and Douglas Stebila. Post-quantum hybrid ECDHE-MLKEM Key Agreement for TLSv1.3 (Internet-Draft draft-ietf-tls-ecdhe-mlkem). IETF TLS working group, 2024. datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem