Feature request: adding mlkem768x25519-sha256 post-quantum key exchange

[gkroon]

Hello,

Are there any plans for SSHJ to support the new mlkem768x25519-sha256 key exchange algorithm?

OpenSSH 9.9 (2024-09-19) introduced support for the new FIPS 203 Module-Lattice Key Encapsulation Mechanism (ML-KEM) post-quantum key exchange algorithm. ML-KEM (formally known as CRYSTALS Kyber) has been formally standardized by NIST earlier last year, and is designed to be secure against quantum attacks. OpenSSH has chosen to support ML-KEM by using a PQ/T hybrid implementation: mlkem768x25519-sha256. Efforts are already underway standardising this via an IETF Draft.

OpenSSH 10.0 (2025-04-09) is now using this new quantum-resistant key exchange algorithm by default.

And, as recently announced, OpenSSH 10.1 will start warning if no post-quantum key exchange algorithm is supported by the server. This in an effort to speed-up adoption and help thwart "store now, decrypt later" attacks.