Advancing post-quantum capabilities of SSH in Red Hat Enterprise Linux

The post-quantum cryptography (PQC) transition is well underway in Red Hat Enterprise Linux (RHEL). In May 2025, RHEL 10 delivered post-quantum key exchange algorithms in three major cryptography libraries (OpenSSL, GnuTLS, and NSS), making post-quantum key exchange usable in TLS 1.3 connections. RHEL 10.1 followed, setting the new key exchange algorithms as default in TLS, and introducing post-quantum signatures for RPM packages.The secure shell (SSH) protocol was not left behind. RHEL 10 shipped with OpenSSH 9.9, supporting two hybrid post-quantum key exchange methods: sntrup761x25519-sha512