PQC Algorithms for SSH Access (SWG)
To achieve full Post-Quantum Cryptography (PQC) compliance across your infrastructure, you may want to secure the management plane of your Secure Web Gateway (SWG) appliances. This guide outlines the manual steps required to enable and verify PQC algorithms for SSH connections to the SWG backend.
NOTE: Modifying SSH configurations requires command-line access and should be performed carefully to avoid administrative lockouts.
Configure Post-Quantum Cryptography for SSH
This section explains how to configure SSH to use Post-Quantum Cryptography (PQC) and suppress related warnings.
You should deploy PQC key exchange for SSH if you handle sensitive data that needs to stay secure for many years, work in a highly regulated industry, or operate critical infrastructure.
You must implement this configuration when running the following software versions:
- OpenSSH: Version 9.0 or later (For Client Only)
- Skyhigh Web Gateway: Version 13.0.x or later
When connecting via SSH, the following warning message may display indicating that your SSH connection uses traditional cryptography that could theoretically be broken by future quantum computers.
WARNING:
Connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
This issue can be fixed by enabling the post-quantum key exchange algorithms. For details to enable PQC, see Enable PQC for SSH Server.
Enable PQC for SSH Server
To enable PQC for SSH Server, perform the following steps:
- Edit or create the SSH server configuration file via text editor.
- To edit the SSH server configuration, navigate to the following file location:
/etc/ssh/sshd_config
Configure SSH Interface (OnPrem Only)
For SWG 13.0, manually configure the PQC.
Insert KexAlgorithms +sntrup761x25519-sha512@openssh.com at the beginning of /etc/ssh/sshd_config and restart SSHD via service sshd restart:
For SWG > 13.0, PQC is enabled by default.
To enforce PQS key exchange modify /etc/ssh/sshd_config and add KexAlgorithms sntrup761x25519-sha512@openssh.com (same as above without the '+') at the beginning of the file. Afterwards call service sshd restart to make the effective changes.
Configure the SSH Client (Optional)
Configure your local client to prefer post-quantum algorithms during handshake negotiations.
To check if PQC is already enabled, run the below command from the SWG CLI:
ssh -Q kex | grep -E "mlkem|sntrup"
If the above command does not return any value, then perform the following steps to enable PQC.
- Open and edit your local ~/.ssh/config file via text editor.
- Append the hybrid key exchange algorithms to your host configuration rules:
Host * KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org