Quantum adapter

Connect hybrid-PQC clients to a pure ML-KEM-768 server.

client offers hybrid (X25519MLKEM768) → TLS Lane → server demands pure ML-KEM-768

When you need it: CNSA 2.0 strict-mode origins reject hybrid and require pure ML-KEM-768 — but browsers and clients only speak hybrid. Increasingly common in federal and defense acquisitions.
How it works: TLS Lane terminates the client's hybrid handshake and re-offers pure ML-KEM-768 on the outbound leg, so the strict server accepts. This is the live demo at pqc.tlslane.com.
Good to know: TLS 1.3 only. The server must support pure ML-KEM-768.
TLS version: TLS 1.3

Enable sudo tlslane splice --pure-pqc