Warning from OpenSSH Client when connecting to Dropbear SSH Server in OpenWrt: connection is not using a post-quantum key exchange algorithm

Installing and Using OpenWrt
1

SSH Server :

dropbear - 2024.86-r1 (opkg pkg)
OpenWrt 24.10.3, r28872-daca7c049b

SSH Client :

OpenSSH_10.2p1, OpenSSL 3.6.0
Arch Linux x86_64

I am currently using ed25519 keys.

Warning Message:

** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html

I connect to some remote OpenWrt devices over their WAN (non standard ports).
Should I be worried ?

2

did you see ^ ?

1 Like
3

I am not, quantum computers are not here yet besides why would any one store my traffic for future analysis?
If I was an enemy of state that might change and I would use something like https://datatracker.ietf.org/doc/draft-ietf-sshm-mlkem-hybrid-kex/ :slight_smile:

But Dropbear does not support that yet so you need to install the full SSH server if you are worried and want to use such a key

2 Likes
4

If you are not opening SSH to the internet you definitely can ignore that.

If you have SSH open to the internet, ypu probably can ignore the warning unless you think you are a high value target :slight_smile:

You can ways follow the link and generate the new post-quantum keys

3 Likes
5

IRL you still need RSA for what is called “network infrastructure”

6

I just had a quick look at it seems that Main/Snapshot build has Dropbear 2025.88 with:
CONFIG_DROPBEAR_MLKEM768 CONFIG_DROPBEAR_SNTRUP761
So that should have post quantum keys enabled

2 Likes