qssh 0.4.4

Post-quantum secure shell with NIST PQC algorithms (Falcon, SPHINCS+, ML-KEM), configurable security tiers, and quantum-resistant protocol design
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74

# QSSH QKD Integration Status

## Current Status (September 16, 2025)

### ✅ Completed Features

1. **Post-Quantum Cryptography (PQC)**
   - Fully working with Falcon-512 and SPHINCS+ algorithms
   - Pure PQC implementation (no classical crypto fallback)
   - Key rotation and quantum-secure session management

2. **QKD Framework Integration**
   - ETSI GS QKD 014 compliant client implementation
   - Certificate-based mTLS authentication support
   - Command-line options for QKD configuration
   - Modular design supporting multiple QKD vendors

3. **Build System**
   - Fixed workspace configuration issues
   - Added native-tls support for certificate authentication
   - Excluded qkd_client from parent workspace to avoid Substrate dependencies

### 🚧 Pending Issues

1. **Toshiba QKD Device (192.168.0.4)**
   - Device returns "400 Bad Request - SSL certificate error"
   - SSL/TLS handshake completes successfully but application layer rejects certificate
   - Likely requires certificate enrollment on the device side
   - Working example code exists in qkd_client but uses same certificates
   - **Update**: Found working PKCS#12 certificate with password "MySecret" in qkd_client
   - **Update**: Implemented PKCS#12 support in QSSH ETSI client
   - **Update**: Server now advertises QKD endpoint to client for key retrieval

2. **IDQ Devices (192.168.101.202/207)**
   - Currently unreachable on the network
   - Example code targets these devices with different certificates

### 📝 Configuration

Example command to test with Toshiba device using PKCS#12:
```bash
# Start server with QKD support
./target/debug/qsshd -l 0.0.0.0:2222 -v --qkd

# Connect with QKD enabled (PKCS#12 certificate)
./target/debug/qssh \
    -p 2222 \
    --qkd \
    --qkd-endpoint "https://192.168.0.4/api/v1" \
    --qkd-cert "/home/paraxiom/qkd_client/certificate/Toshiba/certs/client_alice.p12" \
    --qkd-ca "/home/paraxiom/qkd_client/certificate/Toshiba/certs/ca_crt.pem" \
    user@host
```

### 🔍 Next Steps

1. **Certificate Resolution**
   - Work with device administrator to enroll client certificates
   - Or obtain pre-enrolled certificates from the QKD device
   - Check if device expects specific CN/SAE ID in certificates

2. **Testing with Accessible Devices**
   - Try IDQ devices when they become reachable
   - Consider testing with QKD simulator if available

3. **Continue Feature Development**
   - Item #12: Session multiplexing
   - Item #13-19: Remaining SSH features from the 19-point list

### 📊 Summary

- **PQC**: ✅ Fully operational
- **QKD**: ⏳ Framework complete, awaiting device certificate configuration
- **Overall**: System provides quantum-secure communication via PQC, with QKD ready to enhance security once certificates are resolved