caption: Enable post-quantum key agreement for TLS
default: null
deprecated: true
desc: |-
  This policy configures whether <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will offer a post-quantum key agreement algorithm in TLS, using the ML-KEM NIST standard. Prior to <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> 131, the algorithm was Kyber, an earlier draft iteration of the standard. This allows supporting servers to protect user traffic from being later decrypted by quantum computers.

  If this policy is Enabled or not set, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will offer a post-quantum key agreement in TLS connections. User traffic will then be protected from quantum computers when communicating with compatible servers.

  If this policy is Disabled, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will not offer a post-quantum key agreement in TLS connections. User traffic will then be unprotected from quantum computers.

  Offering a post-quantum key agreement is backwards-compatible. Existing TLS servers and networking middleware are expected to ignore the new option and continue selecting previous options.

  However, devices that do not correctly implement TLS may malfunction when offered the new option. For example, they may disconnect in response to unrecognized options or the resulting larger messages. Such devices are not post-quantum-ready and will interfere with an enterprise's post-quantum transition. If encountered, administrators should contact the vendor for a fix.

  This policy is a temporary measure and will be removed sometime after <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> version 145. It may be Enabled to allow you to test for issues, and may be Disabled while issues are being resolved.

example_value: true
features:
  dynamic_refresh: true
  per_profile: false
future_on:
- fuchsia
items:
- caption: Use Default Value for post-quantum key agreement for TLS
  value: null
- caption: Enable post-quantum key agreement for TLS
  value: true
- caption: Disable post-quantum key agreement for TLS
  value: false
owners:
- file://crypto/OWNERS
- trusty-transport@chromium.org
schema:
  type: boolean
supported_on:
- chrome.*:116-146
- chrome_os:116-146
- android:116-146
tags:
- system-security
type: main
