ssh.rocks

Post-quantum readiness

The only property in SSH where upgrading protects traffic you have already sent.

ssh ssh.rocks pq

A web page cannot see your SSH handshake, so the answer for your client comes from the terminal. This page is the reasoning.

This server speaks it

ssh.rocks negotiates mlkem768x25519-sha256 — the NIST-standardised hybrid — with any client that offers it. A site arguing for post-quantum key exchange while not speaking it would deserve the criticism.

Why key exchange is the special case

Every SSH session negotiates a shared secret, then encrypts everything with it.
If an attacker records the whole session today, decrypting it later means
recovering that secret — and the classical hardness of X25519 is exactly the
kind of problem a large quantum computer would solve.

Your cipher choice does not help here. AES-256 is fine against quantum attack;
Grover's algorithm halves its effective key length, which leaves 128 bits, which
is plenty. The exposure is entirely in the key exchange.

The fix is a hybrid: do X25519 as usual, do a lattice KEM alongside it, and mix
both results into the session key. An attacker must break BOTH. That is why the
hybrids are rated above plain curve25519 here — they are strictly additive, and
the cost is a few kilobytes once per connection.

What nobody can tell you is when, or whether, a relevant quantum computer
arrives. The case for enabling this is not a prediction. It is that the upgrade
is free, already shipped, and is the one change that protects data you have
already sent.

Should you actually care?

Honestly: for most shell sessions, no. The question is not "is quantum computing real", it is "is anything I send over SSH still sensitive in fifteen years?" For a hobby server, no. For source code under embargo, credentials with long lifetimes, or anything covered by a retention obligation, quite possibly yes.

The reason to switch it on anyway is that it is free. The hybrids are X25519 plus a lattice KEM, so they are never weaker than what you already have, they are enabled by default in current OpenSSH, and the cost is a few kilobytes once per connection.