OpenSSH and Post Quantum Cryptography: RFC 9941, ML-KEM Hybrid, and the Quantum Safe SSH Migration

OpenSSH's PQC Path

OpenSSH has been shipping a post-quantum hybrid key exchange since late 2022 with sntrup761x25519-sha512@openssh.com as an experimental option. This was standardized as RFC 9941 in April 2026. A parallel IETF draft (draft-ietf-sshm-mlkem-hybrid-kex) adds ML-KEM hybrid KEX to SSH.

RFC 9941: sntrup761x25519

The RFC 9941 hybrid KEX combines:

• Streamlined NTRU Prime (sntrup761): a lattice-based KEM proposed by Daniel J. Bernstein et al.
• X25519: classical elliptic curve Diffie-Hellman.
• SHA-512 for KDF.

Session key is derived from both KEMs. This is the default in OpenSSH 9.x through 2026.

ML-KEM in SSH

The IETF draft draft-ietf-sshm-mlkem-hybrid-kex specifies hybrid ML-KEM-768 + X25519 or similar combinations for SSH. Once finalized and OpenSSH implements, SSH will default to NIST-standardized ML-KEM, superseding sntrup761.

Host Key Signature Migration

SSH uses Ed25519 or RSA for host key and user authentication. These remain classical (Shor-vulnerable). Migration to ML-DSA requires:

1. New SSH_MSG_USERAUTH_REQUEST semantics for ML-DSA.
2. New ssh_host_ed25519_key analogues with ML-DSA.
3. Client-side known_hosts updates.

This work is ongoing in IETF.

Practical Steps for Administrators

1. Update OpenSSH to 9.x or later with sntrup761x25519 enabled.
2. Set KexAlgorithms sntrup761x25519-sha512@openssh.com,... in sshd_config.
3. Monitor IETF for ML-KEM SSH finalization.
4. Plan host key migration to ML-DSA once IETF drafts are finalized.

Frequently Asked Questions

Is OpenSSH quantum-safe today?

The key exchange is quantum-safe when sntrup761x25519 or future ML-KEM hybrids are used. Host keys and user auth keys remain classical (Ed25519, RSA) pending IETF finalization of PQ signatures in SSH.

What is RFC 9941?

The IETF RFC published April 2026 standardizing sntrup761x25519-sha512 hybrid key exchange in SSH.

Why not ML-KEM in SSH first?

OpenSSH shipped sntrup761 before NIST finalized ML-KEM. The IETF work on ML-KEM in SSH is ongoing. Both will coexist during transition.

Should I disable RSA host keys?

For new deployments prefer Ed25519 host keys today, and plan migration to ML-DSA once SSH ML-DSA drafts finalize. RSA should be retired on the NIST 2035 timeline.

Sources

1. RFC 9941
2. draft-ietf-sshm-mlkem-hybrid-kex

Related Articles

• IETF PQC Drafts
• OpenSSL PQC Status
• ML-KEM Explained
• TLS PQC Migration
• Hybrid Encryption