Post-Quantum SSH
OpenSSH was an early mover on post-quantum security and already ships a quantum-safe key exchange by default. As with TLS, the upgrade is a hybrid key exchange that pairs a PQC KEM with X25519; host-key signatures remain classical for now.
Deployed: sntrup761x25519-sha512 and the current default mlkem768x25519-sha256
Through the OpenSSH 9.x series, the default or widely deployed key exchange was sntrup761x25519-sha512: Streamlined NTRU Prime (sntrup761) combined with X25519. Both shared secrets are hashed together, so the session key is safe unless an attacker breaks both the lattice KEM and X25519. This protects SSH sessions against Harvest Now, Decrypt Later. This method is now documented in RFC 9941 (Informational) ("SSH Key Exchange Using Hybrid sntrup761 + X25519").
OpenSSH 9.9 added the NIST-standardized option mlkem768x25519-sha256, pairing ML-KEM-768 (FIPS 203) with X25519, and OpenSSH 10.0 (April 2025) made it the default key-agreement algorithm. This binding is being specified by the IETF SSHM working group in draft-ietf-sshm-mlkem-hybrid-kex (still an Internet-Draft). sntrup761x25519-sha512 remains an important deployed hybrid, but the long-term direction has shifted to the NIST-standardized ML-KEM combination.
Check what your client supports
List the key exchange algorithms your OpenSSH build knows about:
# Show all supported key exchange algorithms
ssh -Q kex
# Filter for the post-quantum hybrids
ssh -Q kex | grep -E 'sntrup|mlkem'
# sntrup761x25519-sha512
# sntrup761x25519-sha512@openssh.com
# mlkem768x25519-sha256
# See the negotiated kex for a real connection
ssh -vv user@host 2>&1 | grep 'kex: algorithm'Pinning the algorithm in configuration
To require a PQC hybrid (and refuse to fall back to classical-only kex), set KexAlgorithms. On the client, in ~/.ssh/config or /etc/ssh/ssh_config:
Host secure-gateway
HostName gw.example.com
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512On the server, in /etc/ssh/sshd_config:
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.comAfter editing the server config, validate and reload:
sshd -t # test the config for syntax errors
systemctl reload ssh # or: systemctl reload sshdKexAlgorithms to PQC-only hybrids will lock out older clients that do not support them. Confirm every client (including automation, backups, and jump hosts) is upgraded before removing classical fallbacks, and keep an out-of-band recovery path open.Host-key signatures: still classical
SSH authenticates the server with a host key signature, and authenticates users with key or password methods. These signatures are still classical (Ed25519, ECDSA, RSA) today — the same "key exchange first, authentication later" pattern seen in TLS. The forward-secret session key from the hybrid kex is what protects against HNDL; PQC host-key and user-key signature algorithms are expected as the ecosystem matures.
Standards & references
后量子 SSH
OpenSSH 在后量子安全上行动较早，目前已默认启用量子安全密钥交换。与 TLS 一样，这次升级是把后量子 KEM 与 X25519 配对的混合密钥交换；主机密钥签名暂时仍为经典算法。
已部署方案 sntrup761x25519-sha512 与当前默认 mlkem768x25519-sha256
OpenSSH 9.x 期间默认或广泛部署的混合密钥交换是 sntrup761x25519-sha512：将 Streamlined NTRU Prime（sntrup761）与 X25519 组合。两个共享密钥一并哈希，因此除非攻击者同时攻破格 KEM 与 X25519，否则会话密钥安全无虞，从而保护 SSH 会话抵御先收集、后解密（Harvest Now, Decrypt Later, HNDL）。该方法已由 RFC 9941（Informational，信息性 RFC）记录（"SSH 中基于 sntrup761 + X25519 的混合密钥交换"）。
OpenSSH 9.9 加入了 NIST 标准化选项 mlkem768x25519-sha256，将 ML-KEM-768（FIPS 203）与 X25519 配对；OpenSSH 10.0（2025 年 4 月）起将其作为默认密钥协商算法。该绑定正由 IETF SSHM 工作组在 draft-ietf-sshm-mlkem-hybrid-kex（仍为 Internet-Draft）中制定。sntrup761x25519-sha512 仍是重要的已部署混合方案，但长期方向已转向 NIST 标准化的 ML-KEM 组合。
查看客户端支持情况
列出当前 OpenSSH 构建已知的密钥交换算法：
# 显示全部支持的密钥交换算法
ssh -Q kex
# 筛选出后量子混合算法
ssh -Q kex | grep -E 'sntrup|mlkem'
# sntrup761x25519-sha512
# sntrup761x25519-sha512@openssh.com
# mlkem768x25519-sha256
# 查看一次真实连接协商出的 kex
ssh -vv user@host 2>&1 | grep 'kex: algorithm'在配置中固定算法
若要强制使用后量子混合算法，并拒绝回退到纯经典 kex，可设置 KexAlgorithms。客户端在 ~/.ssh/config 或 /etc/ssh/ssh_config 中：
Host secure-gateway
HostName gw.example.com
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512服务器端在 /etc/ssh/sshd_config 中：
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.com修改服务器配置后 校验并重载：
sshd -t # 测试配置语法是否有误
systemctl reload ssh # 或：systemctl reload sshdKexAlgorithms 限制为纯后量子混合算法，会把不支持它们的老客户端挡在门外。在移除经典回退项之前，务必确认每个客户端（含自动化脚本、备份、跳板机）都已升级，并保留一条带外恢复通道。主机密钥签名 仍为经典
SSH 用主机密钥签名认证服务器，用密钥或密码方式认证用户。这些签名目前仍是经典算法（Ed25519、ECDSA、RSA）——与 TLS 中"先密钥交换、后认证"的模式一致。真正抵御 HNDL 的是混合 kex 产出的前向保密会话密钥；随着生态成熟，后量子主机密钥与用户密钥签名算法有望陆续登场。