EL 10: Post-quantum cryptography

EL 10 brings post-quantum cryptography (PQC) into the default installation: OpenSSL 3.5 provides the new NIST-standard quantum-resistant algorithms, and OpenSSH enables a hybrid ML-KEM plus classical scheme in key exchange by default. For most users all of this happens in the background, with no configuration at all.

What changed

A quantum computer could, in theory, break today’s public-key systems (RSA, ECDSA/ECDH). An attacker can capture encrypted traffic now, archive it, and decrypt it later once quantum machines mature (“harvest now, decrypt later”). Post-quantum algorithms replace factoring and discrete-log hardness with new mathematical problems such as lattices.

In 2024 NIST published three post-quantum standards:

• ML-KEM (FIPS 203): key encapsulation, used for key exchange;
• ML-DSA (FIPS 204): digital signatures;
• SLH-DSA (FIPS 205): stateless hash-based signatures.

EL 10’s OpenSSL 3.5 adds these algorithms to the available set, and OpenSSH enables a hybrid of ML-KEM 768 and X25519 (mlkem768x25519-sha256) in key exchange by default — even if the quantum-resistant half were ever broken, the classical half still holds. That is what “hybrid” buys you.

EL 9 vs EL 10

Item	EL 9	EL 10
OpenSSL	3.0.x (no NIST PQC algorithms)	3.5.x (ML-KEM / ML-DSA / SLH-DSA)
OpenSSH KEX default	classical (curve25519, etc.)	hybrid KEX preferred (mlkem768x25519-sha256)
Configuration needed	—	none; on by default

What it means for you

• Everyday SSH logins: completely transparent — client and server negotiate the hybrid KEX automatically. Older clients without PQC support fall back to classical algorithms without losing connectivity.
• Compliance and audit: for teams tracking post-quantum migration roadmaps (CNSA 2.0 and similar), EL 10 is the first EL major release that ships NIST PQC standards out of the box.
• Certificates and signatures: ML-DSA certificates are not yet common in public PKI, so TLS certificates remain classical for now; PQC protects the key-exchange layer first.

Note

Post-quantum does not mean “everything replaced”. EL 10’s strategy is hybrid-first: quantum-resistant algorithms are layered onto key exchange, while the migration of signatures and the certificate ecosystem will take years.

Checking and verifying

List the key-exchange algorithms your SSH client supports

ssh -Q kex | grep -i mlkem

See which KEX a connection actually negotiated

ssh -v user@host 2>&1 | grep -i 'kex:'

If mlkem768x25519-sha256 shows up, that session is using hybrid post-quantum key exchange.

Further reading

• SSH hardening — keys, algorithm policies, hardening practice
• EL 8: System-wide crypto policies — where update-crypto-policies came from
• EL 10 changes overview — other EL 10 security changes (SHA-1 disabled by default, among them)