PostQuantumKeyAgreementEnabled

Enable post-quantum key agreement for TLS.

Firefox offers hybrid X25519 + ML-KEM-768 key agreement by default, so most deployments do not need this policy. The policy covers TLS, HTTP/3 as of Firefox 128, and WebRTC.

Caution

Disabling post-quantum key agreement removes protection against later decryption of recorded traffic. Only set this policy to false as a temporary workaround if there are cases of failure, such as a middlebox, proxy, or legacy server that cannot handle the ClientHello.

Setting this policy locks the preferences, whether the value is true or false, so users cannot change them. This policy is independent of CNSA2KeyAgreementEnabled: setting it to false does not stop Firefox from offering ML-KEM-1024 if that policy is enabled.

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 127	Available since 128	Available since 149

CCK2 Equivalent: N/A
OMA-URI: PostQuantumKeyAgreementEnabled
Preferences Affected: security.tls.enable_kyber, network.http.http3.enable_kyber (Firefox 128), media.webrtc.enable_pq_hybrid_kex

Examples

policies.json

{
  "policies": {
    "PostQuantumKeyAgreementEnabled": false
  }
}

JSON schema

PostQuantumKeyAgreementEnabled JSON schema

{
  "type": "boolean"
}

Windows (GPO)

Software\Policies\Mozilla\Firefox\PostQuantumKeyAgreementEnabled = 0x1 | 0x0

macOS

<dict>
  <key>PostQuantumKeyAgreementEnabled</key>
  <true/> | <false/>
</dict>

See also

• CNSA2KeyAgreementEnabled policy, which controls the CNSA 2.0 ML-KEM-1024 key agreement for TLS.