Sizes in bytes (FIPS 203 Table 3), encapsulation key / ciphertext: ML-KEM-512 800 / 768 (category 1), ML-KEM-768 1,184 / 1,088 (category 3), ML-KEM-1024 1,568 / 1,568 (category 5); the shared secret is always 32 bytes. Decapsulation keys can be stored as the 64-byte seed d ‖ z. On one Apple M4 Max core, OpenSSL 3.6.5 runs about 41,000 ML-KEM-768 key generations, 63,000 encapsulations and 40,000 decapsulations per second.
A Fujisaki–Okamoto transform with implicit rejection makes it secure against chosen-ciphertext attacks: an invalid ciphertext yields a pseudorandom secret instead of an error. FIPS 203 requires input checks on encapsulation keys (§7.2) and decapsulation keys (§7.3); implementations must also avoid the timing leaks that affected early Kyber code (KyberSlash, 2024).
ML-KEM-768 is the workhorse of hybrid key exchange: TLS X25519MLKEM768, SSH mlkem768x25519-sha256, HPKE and X-Wing, Apple's iMessage PQ3 and Signal's PQXDH. ML-KEM-1024 is the CNSA 2.0 choice. It is not interoperable with round-3 Kyber.