Ssh warning post-quantum key exchange algorithm

1

When I ssh into almalinux 9.8 from my macbook I am getting a warning about

‘connection is not using a post-quantum key exchange algorithm’

I have had a look at the suggested web-site (OpenSSH: Post-Quantum Cryptography) but I am still a little confused about how to set this up.

Do you have any suggestions about what needs to be done to configure ssh to utilise these new algorithms?

2

Hello

According to the Red Hat blog below, I believe the only option is to upgrade to AlmaLinux 10.

Upgrade Instructions

AlmaLinux ELevate

*Please test thoroughly and be sure to back up your data before proceeding.

Thank you

3

Thanks for the link, but quoting from that link:
”As protection against “harvest now, decrypt later” threats, and to support the requirements for FIPS environments, components based on OpenSSL in RHEL 9.7 can use a hybrid ML-KEM key exchange even in FIPS mode while using a certified module.”

I take that to mean that you can use a ‘hybrid’ post-quantum key exchange whatever that is in RHEL 9.7. What certified module are they referring to? Are they being deliberately combobulating?

Upgrading to RHEL10 is not an option because it does not support my CPU chip.

4

Hi,

AlmaLinux 10 provides an x86_64_v2 build for older CPUs that do not support x86_64-v3.

You may be able to use it on your hardware:

An upgrade from AlmaLinux 9 is possible with ELevate NG, but it currently uses the testing repository.

Thanks.

5

You can enable PQ for SSHD on 9, the ciphers it uses are controlled by crypto-policies if you not changed it will be set to DEFAULT you can check it using sudo update-crypto-policies --show , there is a sub policy you can enable that add extra ones to it PQ ones.

/usr/share/crypto-policies/policies/modules/PQ.pmod
group = +MLKEM1024-X448
group = +P384-MLKEM1024
group = +P256-MLKEM768
group = +MLKEM768-X25519

sign = +MLDSA87-ED448
sign = +MLDSA65-ED25519
sign = +MLDSA87
sign = +MLDSA65
sign = +MLDSA44

key_exchange = +KEM-ECDH

You can enable it using sudo update-crypto-policies --set DEFAULT:PQ and sudo systemctl restart sshd that should get rid of the warning.

1 Like