THE QUANTUM INTELLIGENCER

A new method for user authentication in the Secure Shell protocol has been proposed, implemented, and evaluated: a key-encapsulation mechanism that replaces client public-key signatures with a session-bound challenge-response proof. The method fits within SSH's existing user-authentication framework, preserving the public-key credential model and enabling incremental deployment. The authors present a reduction-based security argument in the post-quantum ACCE framework and have built the design into OpenSSH using liboqs. Under representative network conditions, they find the approach competitive with compact signature-based authentication, cutting median handshake latency by up to ten percent against large-signature hybrid baselines. With small TCP initial windows, the gains are more pronounced: a 7.3 percent reduction in median latency versus ML-DSA, and 17.9 percent versus SLH-DSA. Server-side online cryptographic cost is 59.1 percent lower than that of ML-DSA in the same NIST security category. As the transition to post-quantum cryptography continues, this development offers administrators a lighter and more flexible credential for the long migration. —Dr. Octavia Blythe Dispatch from The Prepared E0