tech · quantum risk

Is SSH host keys Quantum Proof? Network Security & PQC

Risk: high · Confidence: high · Reviewed: 2026-07-19

Verdict

SSH host keys are not quantum-proof when they use classical public-key algorithms. Rotate toward modern algorithms, prefer certificate-based host identity where operable, and inventory every bastion and jump host.

Overview

Users trust SSH servers via host keys. A break of a classical host key enables impersonation of that server to clients that still trust the fingerprint.

Ed25519 is excellent classically but still elliptic-curve under Shor’s algorithm. Quantum safety needs post-quantum SSH work and operational agility—not only “disable RSA.”

See ssh-bastion and ssh-certificates for operational patterns.

Cryptographic profile

Signatures: SSH host key algorithms (RSA/ECDSA/Ed25519 common), Optional SSH certificates for hosts
Hash: key fingerprints
Public-key exposure: Host keys are long-lived server identities users pin in known_hosts or via CA.

What breaks

Decade-old RSA host keys on internet-facing SSH
No central inventory of host key algorithms
TOFU known_hosts at scale without CA

Mitigations

Inventory host key types and ages
SSH certificate authorities for hosts
Follow OpenSSH/vendor PQC developments

FAQ

Is Ed25519 quantum-safe?

No. It is strong classically but not post-quantum.

Rebuild all known_hosts?

Use host certificates or orchestrated rotation with clear user comms.

Key concepts (technical dictionary)

Terms used on this page — open a definition:

Full technical dictionary →