Lion Cipher Lab
Deploy hybrid post-quantum key exchange in OpenSSH and TLS
- Cyber / Security Engineer
- Advanced
- ~90 min
- Free · no account required
Why it matters
An adversary who records your encrypted traffic today can store it and decrypt it years from now, once a cryptographically-relevant quantum computer can break the classical elliptic-curve key exchange that protects almost every SSH and TLS session. That is the 'harvest now, decrypt later' (HNDL) threat, and it makes long-lived confidential data — source code, health records, state secrets, credentials — vulnerable right now, before any quantum computer exists. The defense is available today: hybrid post-quantum key exchange, already shipping and on by default in modern OpenSSH and OpenSSL.…
What you'll learn
- Post-quantum cryptography deployment
- Threat modeling harvest-now-decrypt-later
- OpenSSH KexAlgorithms hardening
- TLS key-exchange group configuration
- Verifying negotiated crypto instead of assuming it
- Reasoning about crypto-agility and migration order
Steps in this lab
- The threat: harvest now, decrypt later
- Why HYBRID, not pure post-quantum
- Check your versions — this is the whole game
- List the KEX algorithms your OpenSSH actually supports
- Configure the hybrid KEX in sshd_config and ssh_config
- PROVE the SSH session negotiated PQ — do not assume
- Now TLS: force the X25519MLKEM768 hybrid group
- Configure your own server's group preference
- The failure mode that actually blocks deployments: fragmentation
- The judgment: encrypt-now is urgent, sign-later can wait