{
  "id": 8413475,
  "title": "Caddy 2.11's default post-quantum key exchange sends six times more handshake bytes",
  "url": "https://urgent.news/2026/09/19/caddy-2-11s-default-post-quantum-key-exchange-sends-six-times-more",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-19T08:00:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/alexgeorgiev17/caddy-211s-default-post-quantum-key-exchange-sends-six-times-more-handshake-bytes-38g3"
  },
  "original_language": "en",
  "account": "Caddy 2.10 enabled a post-quantum key exchange by default in April, but the author assumed it would be slower. They ran Caddy 2.11.4 against a modern TLS client and measured the handshake, discovering that the hybrid group X25519MLKEM768 uses six times more handshake bytes compared to classical X25519. This increase is a real cost and can cause extra round trips on slow or lossy networks. The CPU cost of ML-KEM-768 is minimal, about 37% slower than X25519 for key generation, but encapsulation is over twice as fast. Overall, the end-to-end performance difference is negligible. However, the byte cost is significant and can impact mobile-heavy audiences. The default remains compatible with older clients, which is a key advantage of the hybrid approach.",
  "summary": "Caddy 2.10 switched on a post-quantum key exchange by default back in April, and I'd assumed, without checking, that \"post-quantum\" meant \"slower\". I ran Caddy 2.11.4 against a modern TLS client and measured the handshake instead of guessing. Post-quantum key exchange matters because a sufficiently capable quantum computer could break the classical Diffie-Hellman maths (X25519, the elliptic-curve…",
  "key_points": [
    "Caddy 2.11 default post-quantum key exchange uses hybrid group X25519MLKEM768",
    "Hybrid group increases handshake bytes six times compared to classical X25519",
    "Increased byte cost may impact mobile-heavy audiences and slow networks"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}