Chrome clears Intent to Ship post-quantum WebCrypto algorithms
ML-KEM, ML-DSA, ChaCha20-Poly1305, and the X-Wing hybrid KEM will become available through the browser Web Cryptography API once the change lands.
Chromium plans to ship several new cryptographic algorithms in the Web Cryptography API, giving web developers browser-backed access to NIST-standardized post-quantum primitives and a widely used symmetric AEAD.
The set covers ML-KEM at the 768 and 1024 parameter sets, ML-DSA at the 44, 65, and 87 security levels, ChaCha20-Poly1305, and X-Wing (the ML-KEM-768 plus X25519 hybrid key encapsulation mechanism). Hubert Chao filed the Intent to Ship on behalf of the WebCrypto work, arguing that none of the public-key algorithms exposed today are quantum-resistant. Libraries that already prefer WebCrypto when present could then call into BoringSSL-backed implementations instead of shipping pure JavaScript or compiling OpenSSL to WebAssembly, or skipping post-quantum support entirely.
The algorithms are defined in the WICG Modern Algorithms in Web Crypto draft rather than the core Web Cryptography specification. Javier Fernandez asked whether shipping should wait for incorporation into an official draft. Chao cited developer demand and noted that the same algorithms, aside from X-Wing, already appear in various server runtimes and smaller browsers. WebCrypto editor Daniel Huigens subsequently merged hybrid KEM text into the WICG draft after WebKit recorded a supportive standards position, with the path into the main Web Crypto spec still gated on broader support.
Rick Byers initially sought confirmation that Chromium’s surface matched a written specification so other browsers could interoperate. Chao clarified that Chrome is shipping MLKEM768-X25519 from the newly merged hybrid text, not the P-256 or P-384 hybrids, and that ML-KEM, ML-DSA, and ChaCha20-Poly1305 were already specified in the WICG draft. Byers, Chris Harrelson, and Philip Jägenstedt then recorded LGTMs for the full intent.
An origin trial under the Additional WebCrypto Algorithms banner preceded the ship decision, aimed at catching integration issues on real sites rather than re-validating BoringSSL’s cryptography.