ALightVPN Announces a Post-Quantum Security Upgrade: ML-KEM-1024, NIST Category 5

 

                                                   ALightVPN now uses SecP384r1MLKEM1024, advancing my hybrid post-quantum VPN key agreement to combine the P-384 elliptic curve with ML-KEM-1024. 15 testers can get 2 years of VPN for free for helping submit SecSMS, ALightVPN profile downloader in Android store. Contact admin@alightservices.com.

   I thank Microsoft for Startup Founders, Corporate Vision Magazine, Government of U.K, Perplexity, NASSCOM 10000, my parents, my elder sister.

For customers, the central change is adoption of ML-KEM-1024—the NIST Security Category 5 parameter set standardized in FIPS 203. This is the highest security category among the three ML-KEM parameter sets in that standard.

Focus remains straightforward: building a VPN service around security and making the technology behind that protection understandable.

What has changed?

ALightVPN previously used SecP256r1MLKEM768. Now moved to SecP384r1MLKEM1024.

Component	Previous configuration	New configuration
Hybrid key agreement	SecP256r1MLKEM768	SecP384r1MLKEM1024
Traditional component	P-256 ECDHE	P-384 ECDHE
Post-quantum component	ML-KEM-768	ML-KEM-1024
NIST category of the ML-KEM component	Category 3	Category 5

The upgrade changes both components of the hybrid key agreement. It brings a higher-category post-quantum parameter set into the process used to establish connection secrets.

Understanding FIPS 203 and “Level 5”

FIPS 203 is NIST’s standard for ML-KEM, a mechanism for establishing a shared secret over a public network. It specifies ML-KEM-512, ML-KEM-768 and ML-KEM-1024, associated with Security Categories 1, 3 and 5 respectively.

You may see Category 5 described informally as “Level 5.” The precise description of this announcement is:

ALightVPN now uses hybrid key agreement incorporating FIPS 203 ML-KEM-1024, a NIST Security Category 5 algorithm.

Here, “203” identifies the standard and “5” identifies the security category of the ML-KEM parameter set. The designation applies to that cryptographic component; it does not assign one security rating to every part of a VPN.

Why prepare for quantum threats now?

Some information needs to remain private long after it is transmitted. NIST describes a threat known as “harvest now, decrypt later”: an adversary collects encrypted data today and retains it in the hope that future quantum capabilities will make decryption possible.

Post-quantum key establishment is designed to address that future threat to connection secrecy. For ALightVPN, adopting ML-KEM-1024 reflects our decision to invest in that protection now, alongside the security needs customers already have today.

Why use a hybrid approach?

SecP384r1MLKEM1024 brings together two different cryptographic foundations:

• P-384 ECDHE: the traditional elliptic-curve component.
• ML-KEM-1024: the post-quantum component.

Their shared secrets are combined within the TLS key schedule. The purpose of this hybrid design is to preserve protection if one component is broken while the other remains secure, subject to correct implementation and the protocol’s security assumptions.

This gives ALightVPN a way to adopt post-quantum key establishment while retaining traditional cryptography alongside it. We see that combination as a practical approach to evolving our security architecture.

Key establishment and traffic encryption have different jobs

The new algorithm’s name describes how connection secrets are established. It does not mean every packet is encrypted directly with ML-KEM-1024.

ALightVPN continues to use AES-256 or ChaCha20-Poly1305 for VPN traffic encryption. The hybrid key agreement protects a different part of the connection: the establishment of secret material used by the secure channel.

For customers comparing VPN services, that distinction matters. A meaningful security description should explain both the handshake and the protection applied to traffic, rather than relying on a single impressive number.

What this announcement means for customers

For people choosing ALightVPN because security matters to them, this upgrade is another concrete step in the direction we have chosen for the service.

It is particularly relevant when evaluating post-quantum VPN technology: customers can identify the exact hybrid group and the exact ML-KEM parameter set being used.

Compatibility also matters. A connection must actually negotiate SecP384r1MLKEM1024 to receive the protection described here. Customers should use an ALightVPN configuration and client version that support the upgraded group.

Clear claims are part of security

Using a standardized algorithm does not, by itself, establish FIPS 140-3 validation of a product. This announcement describes ALightVPN’s cryptographic upgrade, rather than claiming certification of the whole service.

Likewise, post-quantum key agreement and post-quantum certificate authentication are separate capabilities. Changing the key agreement does not automatically change the certificate signatures used to authenticate a connection.

I believe customers deserve this level of clarity when choosing a security service.

ALightVPN now combines P-384 with ML-KEM-1024, bringing NIST Category 5 post-quantum key establishment into our hybrid VPN configuration.

If you don’t need a VPN at home, not a frequent traveller – use ALightVPN TravelPass starts at $1.49, $0.49 per day for upto 10 days, $4.99 for 30 days and no subscription or cancellation or any unexpected renewal. If you need VPN at home or plan to travel for more than 50 days in 2 years, get the subscription (renews at same price) for a discount - $23.76 for 2 years. ALightVPN

Explore ALightVPN and get started at vpn.alightservices.com.

 

Follow on social media to stay updated on the latest developments:

ALight Technologies USA Inc | Facebook

https://www.facebook.com/ALightTechnologyAndServicesLimited

Web Veta | Facebook

WebVeta Saas | LinkedIn

https://www.linkedin.com/company/alight-technologies-usa-inc/

https://www.linkedin.com/company/alight-technology-and-services-limited/

https://twitter.com/ALightTech

https://www.youtube.com/@alighttechnologyandservicesltd

https://blog.alightservices.com/

https://medium.com/@ALlightTechnologyAndServices

-

Best regards,

Mr. Kanti Arumilli 

I don’t have any fake aliases, nor any virtual aliases like some of the the psycho spy R&AW traitors of India. NOT associated with the “ass”, “es”, “eka”, “ok”, “okay”, “is”, erra / yerra karan, kamalakar, diwakar, kareem, karan, erra / yerra sowmya, erra / yerra, zinnabathuni, bojja srinivas (was a friend and batchmate 1998 – 2002, not anymore – if he joined Mafia), mukesh golla (was a friend and classmate 1998 – 2002, if he joined Mafia), erra, erra, thota veera, uttam’s, bandhavi’s, bhattaru’s, thota’s, bojja’s, bhattaru’s or Arumilli srinivas or Arumilli uttam(may be they are part of a different Arumilli family – not my Arumilli family).