# Post-Quantum Ecosystem Comparison
## Overview
This document positions QSSH within the broader post-quantum security ecosystem, particularly in relation to PQConnect and other emerging PQ solutions.
## Architectural Layers
### Network Stack Positioning
```
┌─────────────────────────────────────────────────────┐
│ Application Layer (L7) │
│ ┌─────────────────────────────────────────────────┐ │
│ │ QSSH: SSH replacement with QKD integration │ │
│ │ - Direct application control │ │
│ │ - Hardware token support │ │
│ │ - P2P mode │ │
│ └─────────────────────────────────────────────────┘ │
├───────────────────────────────────────────────────────┤
│ Transport Layer (L4) │
│ ┌─────────────────────────────────────────────────┐ │
│ │ Standard TCP/UDP │ │
│ └─────────────────────────────────────────────────┘ │
├───────────────────────────────────────────────────────┤
│ Network Layer (L3) │
│ ┌─────────────────────────────────────────────────┐ │
│ │ PQConnect: Transparent PQ tunneling │ │
│ │ - Automatic discovery via DNS │ │
│ │ - Works with all applications │ │
│ │ - No application changes needed │ │
│ └─────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────┘
```
## Comparison with PQConnect
### Fundamental Differences
| **OSI Layer** | Application (7) | Network (3) |
| **Scope** | SSH protocol only | All IP traffic |
| **Transparency** | Explicit usage (qssh command) | Automatic interception |
| **Discovery** | Manual/blockchain | DNS announcements |
| **QKD Support** | Native integration | Not included |
| **Hardware Support** | TPM, HSM, PKCS#11 | System-level only |
| **P2P Mode** | Built-in | Not applicable |
| **Configuration** | Per-connection | System-wide |
### Use Case Differentiation
#### QSSH Optimal For:
- SSH-specific workflows requiring advanced features
- Direct quantum hardware integration (QKD, QRNG)
- Explicit security control and audit trails
- P2P connections without central infrastructure
- DevOps and system administration tasks
#### PQConnect Optimal For:
- Protecting legacy applications transparently
- Organization-wide deployment
- Mixed protocol environments
- Minimal configuration scenarios
- Applications unaware of quantum threats
## Complementary Deployment
### Layered Security Model
Rather than competing, QSSH and PQConnect provide complementary protection:
```
┌──────────────────────────────────────────────────────┐
│ User Application (e.g., database client) │
└────────────────┬─────────────────────────────────────┘
│
┌────────────────▼─────────────────────────────────────┐
│ QSSH Layer (if SSH protocol) │
│ - Application-specific PQ crypto │
│ - QKD integration │
│ - Hardware token support │
└────────────────┬─────────────────────────────────────┘
│
┌────────────────▼─────────────────────────────────────┐
│ PQConnect Layer (all traffic) │
│ - Network-level PQ crypto │
│ - Automatic protection │
│ - Defense in depth │
└────────────────┬─────────────────────────────────────┘
│
┌────────────────▼─────────────────────────────────────┐
│ Network Infrastructure │
└──────────────────────────────────────────────────────┘
```
### Benefits of Combined Deployment
1. **Defense in Depth**: Two independent layers of PQ protection
2. **Comprehensive Coverage**: PQConnect protects everything, QSSH adds SSH-specific features
3. **Gradual Migration**: PQConnect provides immediate protection while applications adopt PQ
4. **Specialized Features**: QSSH's QKD and hardware support remain accessible
## Integration with PQ-QKD-Proxy
### Complete Quantum Security Stack
```
[QSSH Client] → [PQConnect Tunnel] → [PQ-QKD-Proxy] → [QKD Hardware]
↓ ↓ ↓ ↓
Application Network-layer API Gateway Hardware
PQ Crypto PQ Crypto PQ Wrapper Protection
```
### Security Layers
1. **QSSH**: Application-layer PQ with QKD key consumption
2. **PQConnect**: Network-layer PQ for all traffic
3. **PQ-QKD-Proxy**: Protects QKD vendor APIs from quantum attacks
4. **QKD Hardware**: Quantum key generation
## Algorithm Compatibility
Both QSSH and PQConnect use compatible PQ algorithms:
| Key Exchange | Falcon-512 | Falcon-512 | Fast ephemeral keys |
| Signatures | SPHINCS+ | SPHINCS+ | Long-term identity |
| Symmetric | AES-256-GCM | AES-256-GCM | Data encryption |
| KDF | SHA3-256 | SHA3-256 | Key derivation |
This compatibility ensures:
- No algorithm conflicts when both are deployed
- Consistent security levels across layers
- Potential for shared cryptographic libraries
## Deployment Recommendations
### For Organizations
1. **Phase 1**: Deploy PQConnect for immediate baseline protection
2. **Phase 2**: Deploy QSSH for SSH-specific use cases
3. **Phase 3**: Add PQ-QKD-Proxy if using QKD hardware
4. **Phase 4**: Integrate with quantum networks as available
### For Developers
1. Continue using QSSH for SSH-specific features
2. Assume PQConnect may be present at network layer
3. Design for defense-in-depth rather than single-layer security
4. Document which layer provides which security properties
## Future Interoperability
### Potential Integration Points
1. **Shared Key Management**: Coordinate key rotation between layers
2. **QKD Distribution**: PQConnect could consume QKD keys via QSSH infrastructure
3. **Discovery Mechanisms**: Unified discovery for PQ-capable endpoints
4. **Performance Optimization**: Avoid redundant crypto operations
### Standards Alignment
Both projects should align with:
- NIST PQC standards
- ETSI QKD standards
- IETF post-quantum protocols
- Common threat models
## Conclusion
QSSH and PQConnect represent complementary approaches to post-quantum security:
- **PQConnect** provides transparent, network-level protection for all applications
- **QSSH** provides application-specific features for SSH with quantum hardware integration
- **PQ-QKD-Proxy** protects the quantum infrastructure itself
Organizations should view these as layers in a comprehensive post-quantum security strategy rather than competing solutions. The combination provides both immediate protection (PQConnect) and advanced quantum-specific features (QSSH) while securing the underlying quantum infrastructure (PQ-QKD-Proxy).