I upgraded my openssh-client on MacOS and discovered this:
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
Theses algorithms were introduced in openssh 9.0. the openssh-server embedded in RHEL8 is 8.0p1.
We agree that there is no possibility to add a post-quantum algorithm in Rocky Linux 8 ?
You can install and use Rocky 10, which has all this quantum support already. As for Rocky 8 or 9, as I said it all depends on Red Hat. You could always open a bug with Red Hat if it bothers you so much. I don’t see a problem with it, and I certainly don’t have anxiety either.
As I’ve already explained, Rocky follows RHEL - if they have it, we have it. If they don’t, then we don’t either. This is no different for any other EL distro, be it Oracle 8 or 9, or Almalinux. Since Rocky 10 just like RHEL10 solves the problem, there is a solution for it already - upgrade. Either that, or wait and see if it gets added to EL8 or EL9.
From a quick google:
which leads to this:
TLDR:
update-crypto-policies --set DEFAULT:PQ
might work. Try it? But since that is RHEL 9.7, with EL8 you are going to have to upgrade.
I would deem post-quantum a new feature, so will not be added. Now is just bug fixes, etc. If you don’t want to upgrade from Rocky 8, well then that is not our fault. There are solutions in EL9 and EL10 to fix it - but as you can read from the above links, EL9 quantum support is limited. Full support is offered in EL10.
If you just want to remove the “anxiety inducing” warning, you can add the following line to the user’s ~/.ssh/config file:
WarnWeakCrypto no-pq-kex
Obviously this won’t fix the actual issue. Depending on your use case it may not matter, and it will prevent that scary warning from showing up and terrorizing your users.
First, let me “clarify one point”, the anxity, is not mine, but our “customers” which may not be aware about this nor the real possiblity of an attack.
Second, the upgrade of Rocky linux 8 → 9 is not always possible due to some package version which don’t exist at all in newer version. For example, php 5.6 ( yes, i know, it’s VERY old, but some applications still uses it, we can put them on a trash ).
For Rocky Linux 9.7, Thanks for the tips ! I’m gonna try it and test if it’s works.