You cannot enable post-quantum signature authentication in upstream OpenSSH just by changing sshd_config. OpenSSH’s official guidance says support for post-quantum signature algorithms is future work; the post-quantum algorithms it currently documents are for key exchange, a different part of SSH. Before changing a server, check the exact OpenSSH build and its supported algorithms. Do not add an unverified algorithm name to HostKeyAlgorithms or PubkeyAcceptedAlgorithms.
Why post-quantum key exchange is not post-quantum signature authentication
SSH uses key exchange to establish the session’s shared encryption keys. It uses signatures to authenticate the server’s host key and, when public-key login is used, the client’s user key. A post-quantum key-exchange method therefore does not make SSH host or user authentication post-quantum.
As an Amazon Associate I earn from qualifying purchases.
OpenSSH documents post-quantum key agreement in its mainline releases: support began with sntrup761x25519-sha512 in OpenSSH 9.0; mlkem768x25519-sha256 was added in 9.9 and became the default in 10.0, according to the project’s post-quantum guidance. These are key-exchange algorithms, not signature key types.
The same guidance states: “OpenSSH will add support for post-quantum signature algorithms in the future.” As of that guidance, there is no supported upstream sshd setting that enables post-quantum signature authentication where the installed implementation does not support it.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What the sshd algorithm settings can—and cannot—do
HostKeyAlgorithms governs the server host-key signature algorithms, while PubkeyAcceptedAlgorithms governs algorithms accepted for public-key authentication. They select or constrain algorithms the running daemon already implements; they do not add cryptographic code or make an unsupported key format usable. The Debian testing sshd_config(5) manual documents these directives, but its details are specific to that distribution’s package and version.
Do not paste a speculative post-quantum signature name into either directive. An unsupported value may cause configuration validation or daemon startup to fail, or simply fail to provide the authentication behavior you intended. A signature identifier appearing in a specification list is not, by itself, evidence that your installed server can use it or that a deployment recipe is ready.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check the exact server before changing policy
- Identify the implementation and version. On the server, run
sshd -Vif supported by that build, or consult the package manager’s installed-version information and the daemon’s release notes. Do not assume a distribution package has every feature listed for another release. - Read the matching manual. Use the
sshd_config(5)manual shipped for that package and the relevant release notes, rather than relying on a manual for a different distribution or version. - Inspect the algorithms the installation reports. Check the installed
sshdand client documentation or supported-algorithm output where available. Confirm that the exact signature algorithm is listed and supported for the authentication role you need; a key-exchange algorithm is not sufficient. - Validate before reloading. If you change any supported policy, run
sshd -tto check the configuration, keep an existing administrative session open, and test a separate login before closing it. Use only algorithm names confirmed by the installed daemon’s documentation.
For upstream status, recheck the project’s release notes and post-quantum page before planning a production migration. Release and distribution availability can change independently, so verify the package actually deployed on each server.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIf you are evaluating experimental post-quantum signatures
Open Quantum Safe publishes instructions for a separate experimental OpenSSH fork, including fork-specific key generation and test-server commands. That workflow applies to the OQS-OpenSSH build described in its OQS-v10 README; it is not proof that ordinary distribution OpenSSH accepts those keys or options.
Treat a fork as a distinct implementation: test its client/server compatibility, key handling, interoperability, maintenance, and operational support in an isolated environment. The cited instructions do not establish that the fork is suitable for production, so do not present it as a routine sshd_config change or substitute it for a supported upstream feature.
What the quantum risk means for SSH
The immediate “store now, decrypt later” concern applies to key exchange: an attacker who records encrypted traffic could try to decrypt it in the future if the classical key agreement is broken. OpenSSH distinguishes that confidentiality risk from signatures. A future ability to forge classical signatures would threaten authentication going forward; it would not, by itself, decrypt SSH sessions recorded in the past. The project’s stated direction is to retire classical signature keys before cryptographically relevant quantum computers become practical.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
