Summary

  • RFC 10042 defines three SSH key-exchange names that combine ML-KEM with P-256, P-384 or X25519 and derive one shared secret from both results.
  • Fleet protection depends on what each connection negotiates, how failures are handled and whether authentication remains sound; support in a binary is not proof of use.

Two algorithms, one negotiated method

RFC 10042 responds to the harvest-now-decrypt-later problem: an adversary could retain encrypted traffic and try to decrypt it if sufficiently capable quantum computers become available. It defines mlkem768nistp256-sha256, mlkem1024nistp384-sha384 and mlkem768x25519-sha256. Each is a single SSH method name, but each runs two schemes: a traditional ECDH exchange and an ML-KEM encapsulation.

The client sends the concatenation of its post-quantum and traditional public material. The server replies with an ML-KEM ciphertext, its traditional public key, its host key and a signature over the exchange. Both sides must verify the expected message lengths; defined validation or decapsulation failures terminate the key exchange. The component secrets become K = HASH(K_PQ || K_CL), using fixed-length encodings before SSH key derivation.

Those are protocol facts. The operational inference is that a fleet has crossed the migration boundary only when the hybrid name wins negotiation and the complete exchange succeeds. An implementation may contain the code while policy lists, version skew or a rollback setting continue selecting a classical method.

Hybrid does not replace authentication

The exchange protects key establishment. The server host key and its signature remain part of the transcript. A hybrid key exchange therefore does not repair weak host-key management, an unverified known-host decision or compromised endpoint credentials. Nor does RFC publication establish deployment by any vendor or operator.

RFC 10042 requires fresh ephemeral key pairs for both ECDH and ML-KEM on every connection and forbids reuse of randomness when producing ML-KEM ciphertexts. It also specifies fixed-length secret encodings to avoid variable-length behavior that could expose information through timing. These requirements put implementation quality and randomness within the control surface, not outside it.

Size is bounded, operations are not free

The three defined methods fit within SSH's minimum packet-size requirements. That does not mean their operating cost is zero. Leaders still need compatibility testing, CPU and latency measurements, capacity margins, failure telemetry and rollback rules. The sources do not quantify those costs for a named fleet.

The beneficiaries are sessions whose confidentiality must survive beyond today's classical assumptions. The costs fall on teams that maintain clients, servers, bastions, automation, cryptographic libraries and incident response. A classical-only counterfactual is simpler and widely compatible, but it lacks the ML-KEM component. A post-quantum-only design would remove the classical hedge; it is not the design specified here.

Sources