Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Note that the above post-quantum key exchange method was removed in OpenSSH 8.5 (released March 3, 2021) in favor of a newer one:

sntrup761x25519-sha512@openssh.com

So if you add the previous one to your server config, sshd may fail to start after upgrading to 8.5 or newer (8.7 is the most recent release).

I started using sntrup4591761x25519-sha512@tinyssh.org about two years ago, and the new one when OpenSSH 8.5 came out. They've both worked flawlessly for me. Thank you to TinySSH and OpenSSH, and of course cryptographers, for making this possible.



I actually filed the github request for Jan Mojžíš to update TinySSH with the new KEX.

I run tinysshd on some RedHat 5 servers, and I rely upon the latest post-quantum exchange. I also jack all my putty users into it with an agent, and I don't assign them passwords.

It would be nice if I was allowed to upgrade from RedHat 5, but I am not.


Thanks for the update, guessing this is the round 2 submission?

Despite being sidelined in NIST's post quantum standardisation project it's interesting to see their Streamlined NTRU Prime algorithm still being the main real world adoption out there right now. I'd be interested if anyone knows of a more utilised post-quantum algo irl.


Do you compile your own OpenSSH? From what I can tell, the distributions have not really caught up yet.

Bullseye is still on 8.4. OpenSSH on Windows appears to be 8.1.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: