The Secure Shell (SSH) protocol is one of the first security protocols on the Internet to upgrade itself to resist attacks against future quantum computers, with the default adoption of the “quantum (otherwise, classically)” secure hybrid key exchange in OpenSSH from April 2022. However, there is a lack of a comprehensive security analysis of this quantum-resistant version of SSH in the literature: related works either focus on the hybrid key exchange in isolation and do not consider security of the overall protocol, or analyze the protocol in security models which are not appropriate for SSH, especially in the “post-quantum” setting. In this paper, we remedy the state of affairs by providing a thorough post-quantum cryptographic analysis of SSH. We follow a “top-down” approach wherein we first prove security of SSH in a more appropriate model, namely, our post-quantum extension of the so-called authenticated and confidential channel establishment (ACCE) protocol security model; our extension which captures “harvest now, decrypt later” attacks could be of independent interest. Then we establish the cryptographic properties of SSH's underlying primitives, as concretely instantiated in practice, based on our protocol-level ACCE security analysis: for example, we prove relevant cryptographic properties of “Streamlined NTRU Prime”, a key encapsulation mechanism (KEM) which is used in recent versions of OpenSSH and TinySSH, in the quantum random oracle model, and address open problems related to its analysis in the literature. Notably, our ACCE security analysis of post-quantum SSH relies on the weaker notion of IND-CPA security of the ephemeral KEMs used in the hybrid key exchange. This is in contrast to prior works which rely on the stronger assumption of IND-CCA secure ephemeral KEMs. Hence we conclude the paper with a discussion on potentially replacing IND-CCA secure KEMs in current post-quantum implementations of SSH with simpler and faster IND-CPA secure counterparts, and also provide the corresponding benchmarks.
The Secure Shell (SSH) protocol is one of the first security protocols on the Internet to upgrade itself to resist attacks against future quantum computers, with the default adoption of the “quantum (otherwise, classically)” secure hybrid key exchange in OpenSSH from April 2022. However, there is a lack of a comprehensive security analysis of this quantum-resistant version of SSH in the literature: related works either focus on the hybrid key exchange in isolation and do not consider security of the overall protocol, or analyze the protocol in security models which are not appropriate for SSH, especially in the “post-quantum” setting. In this paper, we remedy the state of affairs by providing a thorough post-quantum cryptographic analysis of SSH. We follow a “top-down” approach wherein we first prove security of SSH in a more appropriate model, namely, our post-quantum extension of the so-called authenticated and confidential channel establishment (ACCE) protocol security model; our extension which captures “harvest now, decrypt later” attacks could be of independent interest. Then we establish the cryptographic properties of SSH's underlying primitives, as concretely instantiated in practice, based on our protocol-level ACCE security analysis: for example, we prove relevant cryptographic properties of “Streamlined NTRU Prime”, a key encapsulation mechanism (KEM) which is used in recent versions of OpenSSH and TinySSH, in the quantum random oracle model, and address open problems related to its analysis in the literature. Notably, our ACCE security analysis of post-quantum SSH relies on the weaker notion of IND-CPA security of the ephemeral KEMs used in the hybrid key exchange. This is in contrast to prior works which rely on the stronger assumption of IND-CCA secure ephemeral KEMs. Hence we conclude the paper with a discussion on potentially replacing IND-CCA secure KEMs in current post-quantum implementations of SSH with simpler and faster IND-CPA secure counterparts, and also provide the corresponding benchmarks.
Secure Shell (SSH) is a widely used cryptographic protocol that establishes secure and encrypted communication over potentially untrusted networks, primarily supporting remote login and command-line execution. The SSH Transport Layer Protocol relies on the classical Elliptic Curve Diffie-Hellman (ECDH) key exchange mechanism, which derives its security from the computational hardness of the Elliptic Curve Discrete Logarithm Problem (ECDLP). However, with the emergence of quantum computing, the ECDLP can be solved efficiently, making traditional SSH protocols vulnerable to quantum attacks. To mitigate this threat, several approaches combining classical and post-quantum cryptographic techniques have been proposed; however, security analyses have revealed vulnerabilities to critical attacks. In response, we propose a post-quantum key exchange protocol for SSH, utilising the Split-Key Encapsulation Mechanism (KEM). The key generated through this protocol can then be used for subsequent communication tasks, such as authentication. The security of the proposed protocol is formally validated using the Real-Or-Random (ROR) model and the Scyther tool. Furthermore, we perform a comparative evaluation in terms of computational and communication costs to assess execution time and conduct a testbed analysis, demonstrating that the proposed scheme can be efficiently implemented in real-world applications. The comparative analysis reveals that the designed post-quantum secure protocol reduces computational cost by up to 98% compared to its competitors.
The transition to post-quantum cryptography is reshaping the Secure Shell (SSH) protocol for remote administration. Post-quantum key exchange has been deployed in OpenSSH and is being standardized, while SSH authentication largely remains a signature-replacement effort. This path preserves the familiar public-key credential model, but inherits the size and computation overhead of post-quantum signatures, which can increase latency, traffic, and server-side load. KEM-based authentication offers a natural alternative to this signature-centric path, and SSH makes this especially attractive at the user-authentication layer, which is method-extensible, separated from transport-layer key exchange and host-key authentication, and already protected by the established channel. We present a drop-in KEM-based user-authentication method for SSH that replaces client public-key signatures with a session-bound challenge-response proof. The method fits into SSH's existing user-authentication framework, preserving the public-key credential model and enabling incremental deployment alongside existing methods. We provide a reduction-based security argument in the post-quantum ACCE framework, implement the design in OpenSSH using liboqs, and evaluate it under representative RTTs, TCP initial-window settings, and post-quantum migration configurations. Our results show that KEM-based authentication is competitive with compact signature-based authentication under representative network settings, while reducing median handshake latency by up to about 10% against large-signature hybrid baselines. The advantages are clearer when post-quantum signatures stress transmission or computation: median latency under small TCP initial windows falls by up to 7.3% versus ML-DSA and 17.9% versus SLH-DSA, while server-side online cryptographic cost is 59.1% lower than that for ML-DSA in the same NIST category.
The security of traditional cryptographic schemes is based on mathematical puzzles that cannot be cracked by current computers. However, the rapid development of quantum computers has the potential to greatly reduce the time and resources required to crack these encryption schemes. Although true quantum supremacy may still be years away, it is imperative to adopt anti-quantum algorithms proactively. This preemptive approach aims to thwart "catch first, decrypt later" attacks, wherein attackers intercept and store encrypted data with the intent of decrypting it once quantum computing becomes sufficiently advanced. This threat is particularly critical for protocols like Secure Shell (SSH), which is widely used for secure communication over unsecured networks. In this paper, we propose an innovative approach to enhance the security of public-key distribution within the SSH protocol. Our method integrates quantum-resistant algorithms to ensure that even with the advent of quantum computing, the confidentiality and integrity of SSH sessions are maintained. We emphasize the importance of using cryptographic protocols that operate over open channels, which, while not necessarily confidential, must be authenticated to prevent tampering. In such scenarios, attackers may be able to intercept and even extract information, but they should not be able to alter the data.
Internet public-key cryptography faces long-term risk from quantum computers, especially when traffic can be collected now and decrypted later. After the NIST post-quantum cryptography standards, the deployment task has shifted from algorithm selection to protocol migration. This paper reviews ML-KEM hybrid key exchange in TLS and SSH through a standards-first narrative review and protocol comparison. It synthesizes NIST standards, RFCs and IETF drafts, experiments, measurements, and primary deployment reports. The paper develops a deployment-readiness framework with four layers: security continuity, protocol integration, operational observability, and crypto-agility. The analysis shows hybrid key exchange represents the most feasible short-term solution, as it introduces post-quantum confidentiality without discarding existing elliptic curve security guarantees. However, hybrid deployment does not provide full post-quantum security. The review argues that readiness depends on protocol binding, implementation behavior, monitoring, and governance as much as on algorithm strength. Handshake size, middlebox compatibility, implementation safety, telemetry, authentication migration, and organizational crypto-agility determine whether migration can progress without weakening current Internet security.
The migration of remote-access and industrial communication systems from classical public-key cryptography to post-quantum cryptography (PQC) requires careful evaluation at both the protocol and system levels. This paper presents PQC-E2E-CA, a system-level evaluation framework for reviewing post-quantum and hybrid cryptographic configurations in Secure Shell (SSH). The framework integrates OQS-enabled OpenSSH and OpenSSL with Linux netem network emulation, automated experiment execution, SCP integrity verification, and statistical post-processing. The evaluation separates key exchange behavior from host key authentication. Specifically, it measures ML-KEM and hybrid ML-KEM as SSH key exchange mechanisms, and ML-DSA as a host-key signature mechanism. Experiments are conducted under controlled RTT and packet-loss conditions using a gateway virtualised client-server testbed. The results show that ML-KEM and hybrid ML-KEM can be integrated into SSH without prohibitive application-level session setup overhead in the evaluated environment. Among the evaluated configurations, ML-KEM-768 demonstrates comparatively lower SSH session establishment latency at 50 ms RTT with 0% packet loss. ML-DSA-44 achieves the lowest host-key authentication latency under the same conditions and maintains relatively stable performance at 150 ms RTT with 5% packet loss. SCP throughput results for 100 MB and 200 MB transfers indicate that sustained transfer performance is mainly influenced by RTT and transport-layer dynamics using a single dominant key exchange configuration. These findings support migration toward standardized post-quantum mechanisms in SSH-based gateway and remote-access environments, provided that algorithm choice and system configuration are validated under representative workloads and network conditions.
The advances in quantum computing present a threat to public key primitives due to their ability to solve hard cryptographic problems in polynomial time. To address this threat to critical Internet security protocols like the Transfer Layer Security (TLS), and Secure Shell (SSH), the National Institute of Standards and Technology (NIST) is currently working on the new generation of quantum-resistant key encapsulation and authentication schemes. In this paper, we evaluate protocol handshake performance when both post-quantum key exchange and authentication are integrated into TLS and SSH. Our experiments consider realistic network conditions and reveal that the introduced handshake latency ranges between 1-300% for TLS and 0.5-50% for SSH depending on the post-quantum algorithms used. In addition, we examine how the initial TCP window size affects post-quantum TLS and SSH performance, and show that even a small size increase can reduce the observed post-quantum slowdown by 50%. Finally, we discuss alternatives that can encourage the early adoption of post-quantum cryptography with minimum protocol performance degradation.