Hybrid key exchange in Envoy

Settings that make a server prefer a hybrid key exchange group. Group names differ by product, and hybrid groups need a TLS library that includes them (OpenSSL 3.5 or later, BoringSSL, Go 1.24 or later).

Prefer the hybrid group

common_tls_context:
  tls_params:
    tls_minimum_protocol_version: TLSv1_2
    ecdh_curves: ["X25519MLKEM768", "X25519", "P-256"]

Allow only post-quantum groups

common_tls_context:
  tls_params:
    tls_minimum_protocol_version: TLSv1_3
    ecdh_curves: ["X25519MLKEM768"]

Log the negotiated group

log_format:
  text_format_source:
    inline_string: "%DOWNSTREAM_REMOTE_ADDRESS% %DOWNSTREAM_TLS_VERSION% %DOWNSTREAM_TLS_CIPHER% %DOWNSTREAM_TLS_GROUP%\n"

Notes for Envoy

%DOWNSTREAM_TLS_GROUP% logs the negotiated group in the access log. Envoy uses BoringSSL, which has no native ML-KEM TLS group, so the list is the hybrid group alone.

Checked in a lab with Envoy 1.39.4, BoringSSL on Oct 18, 2026.

Other servers

nginx, Apache httpd, HAProxy, OpenSSL, Go crypto/tls, OpenSSH sshd, Java JSSE, IIS (Windows Schannel).

Back to perspectives