OpenSSH Post Quantum KEM

[Andy8025]

In the release notes for OpenBSD 7.7 https://www.openbsd.org/77.html one item stood out to me:

OpenSSH 10.0
ssh(1): the hybrid post-quantum algorithm mlkem768x25519-sha256 is now used by default for key agreement.

Does anyone know why the OpenSSH devs chose the NIST/NSA recommended algorithm ML-KEM-768 (aka Kyber-768)? And not even its strongest version? Signal, for example, uses Kyber-1024. Why didn't they chose McEliece, as recommended by cryptographers like Dan Bernstein.

I checked the mailing list at https://marc.info/?l=openssh-unix-dev&r=1&w=2 but did not see any discussion there on this subject.

[jmccue]

To me with openssh, I try and keep the defaults because when it comes to encryption, it all goes over my head

But I would think "post-quantum" is the reason, maybe that means it could inhibit a future quantum computer from breaking the key.

[jggimi]

Looking through the commit history, I can see that the decision to make this particular key exchange the default occurred on October 25 of last year. You could ask these developers directly about the decision.

https://cvsweb.openbsd.org/src/usr.bin/ssh/myproposal.h

https://cvsweb.openbsd.org/src/usr.bin/ssh/ssh_config.5