The client sends an ML-KEM-768 encapsulation key (1,184 bytes) followed by a 32-byte X25519 public key; the server returns an ML-KEM ciphertext (1,088 bytes) and its X25519 key, and the shared secret is SHA-256 of the ML-KEM secret concatenated with the X25519 secret. RFC 10042 also defines mlkem768nistp256-sha256 and mlkem1024nistp384-sha384 for deployments that need NIST curves.
OpenSSH added it in 9.9 (September 2024) and made it the default in 10.0; OpenSSH 10.1 (October 2025) prints WARNING: connection is not using a post-quantum key exchange algorithm when a session falls back to a classical method, adjustable with WarnWeakCrypto. Check what a server negotiates with ssh -v or the SSH server audit.
Only the key exchange is post-quantum: host and user authentication still use classical signatures, which a future quantum computer could forge only live, not retroactively.