Does CoreSSH Server Support Post-Quantum Key Exchange

Question:

Does CoreSSH Server support post-quantum cryptography? Can I configure it to use a quantum-resistant key exchange?

Answer:

Yes. CoreSSH Server supports the mlkem768x25519-sha256 hybrid key exchange algorithm, which combines the NIST-standardized ML-KEM768 (Kyber) post-quantum key encapsulation mechanism with the classical X25519 elliptic-curve exchange. This protects SSH sessions against "harvest now, decrypt later" attacks, in which an adversary records encrypted traffic today with the intention of decrypting it once a sufficiently powerful quantum computer is available.

Because the exchange is hybrid, the shared secret can only be recovered if both the classical and post-quantum components are broken, so enabling it does not reduce security even if weaknesses are later found in ML-KEM.

Enabling Post-Quantum Key Exchange

Support for mlkem768x25519-sha256 is included by default in the list of supported key exchange algorithms, but it is not prioritized ahead of classical elliptic-curve algorithms. To prefer it, add it to the front of the SSHKeyExchangeAlgorithms setting:

mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521

The setting accepts an ordered, comma-separated list of algorithms, with the most preferred algorithm listed first. During negotiation, the server and client agree on the first algorithm in the server's list that the client also supports, so listing mlkem768x25519-sha256 first only takes effect once the connecting client also supports it.

Client Compatibility

Post-quantum key exchange requires a client that also supports mlkem768x25519-sha256, such as OpenSSH 9.9 or later. If the connecting client does not offer this algorithm, CoreSSH Server automatically falls back to the next mutually supported algorithm in the list (typically curve25519-sha256), so enabling this setting does not break compatibility with older clients.