Post-quantum cryptography
Post-quantum cryptography
Posted Mar 16, 2023 17:38 UTC (Thu) by tialaramex (subscriber, #21167)In reply to: Post-quantum cryptography by proski
Parent article: OpenSSH 9.3 released
So if your server and clients are both new enough, you get the PQ key exchange. Since there is no reason to believe anybody has or is likely soon to obtain a working Quantum Computer powerful enough to attack real world cryptography, there is no reason to protect anything beyond the KEX.
[Protecting the KEX matters because you can keep encrypted transcripts and decrypt them later once you have a suitable attack on the KEX. If you never obtain such an attack, most other breaks are worthless to you for these transcripts]
sntrup761x25519-sha512@tinyssh.org is a hybrid approach, if it turns out the NTRU algorithm is busted, you're not really worse off than if you'd stayed with a conventional KEX algorithm except that you wasted some CPU cycles and bandwidth.