tree b00fbb7370c201766027406ff719b1307ae7ff9d
parent de3f3b2dce16f1e03d30f66008150b8955e17388
author Thomas Wolf <twolf@apache.org> 1715279135 +0200
committer Thomas Wolf <twolf@apache.org> 1715286596 +0200

Implement the "sntrup761x25519-sha512@openssh.com" KEX method

This uses a post-quantum key encapsulation method (KEM) to make key
exchange future-proof against quantum attacks. It is to be preferred
over curve25519-sha256 "when the extra communication size and
computational requirements are acceptable."[1] (curve25519-sha256
exchanged 32 bytes where sntrup761x25519-sha512 exchanges 1190 or 1071
bytes.)

This KEX method changes the encoding of the key from 'mpint' to
'string'. To make the handling of the K value more uniform, change
it to 'string' everywhere, and convert mpints with the high bit set
explicitly by prepending a zero byte.

Separate the digest from MontgomeryCurve; handle combining curves and
hashes (and KEMs) in the BuiltinDHFactories instead.

In the BaseBuilder, add "sntrup761x25519-sha512@openssh.com" as first
(i.e., preferred) KEX algorithm.

[1] https://www.ietf.org/archive/id/draft-josefsson-ntruprime-ssh-02.html