pub static KEX_ORDER: &[Name]Expand description
The key exchanges gunnar’s SSH door offers, post-quantum FIRST (2026-10-06, the PQ transport lane).
mlkem768x25519-sha256 (draft-ietf-sshm-mlkem-hybrid-kex: ML-KEM-768 and
X25519, the session key from both) is what OpenSSH ≥ 9.9 offers first and
10.0 makes its default — russh 0.63 runs it on RustCrypto’s ml-kem. The
classical exchanges stay after it, so an older client still connects
(preferred, never required). sntrup761x25519-sha512 is not here: russh
does not implement it.
gunnar’s own list, not russh’s default, though the two agree today:
a russh bump that reorders or drops its Preferred::DEFAULT must not
change what this door offers without a red test here. SSH lets the
CLIENT’s order decide; the server’s job is to offer the hybrid at all.