A research protocol for post-quantum remote shells, built from scratch. It does not speak the SSH protocol. Selected components carry machine-checked proofs, scoped below.
17 capabilities that don't exist in OpenSSH at any configuration level. Not extensions — architectural differences.
OpenSSH uses RSA/ECDSA/Ed25519 — all broken by Shor's algorithm. qssh uses Falcon-512 (lattice-based, 666-byte signatures) and SPHINCS+ (hash-based, stateless) — both NIST-selected, both quantum-resistant.
Every packet on the wire is exactly 768 bytes. Data, keepalives, control messages — all identical size. OpenSSH leaks metadata through variable packet sizes (keystrokes vs file transfers are distinguishable). qssh frames are indistinguishable to network observers.
qssh combines ML-KEM-768 (post-quantum lattice KEM) with X25519 (classical ECC) — if either is broken, the other still protects the session. Recent OpenSSH versions also use a hybrid post-quantum key exchange by default.
Pluggable hardware entropy sources (quantum or classical random number generators) — always mixed with OS entropy for defense in depth. OpenSSH uses the OS RNG.
Experimental integration with quantum key distribution systems, mixed with post-quantum key exchange rather than relied on alone. OpenSSH has no QKD integration.
Six progressive security levels from classical compatibility through full hybrid quantum. OpenSSH has a single security model.
Dummy frame injection (30% probability), encrypted timestamps and sequence numbers in frame headers, random padding fills all unused payload space, configurable stealth mode. OpenSSH leaks timing, packet count, and size metadata constantly.
Falcon-512 and SPHINCS+ signed certificates for both users and hosts — with serial numbers, principal constraints, validity periods, and revocation. OpenSSH certificates exist but use quantum-vulnerable RSA/ECDSA.
71 Lean 4 mathematical theorems, zero sorry, rebuilt on 7 September 2026 (lake build exit 0). The Kani and Verus tiers are counted from source and are not re-executed here. OpenSSH has zero formal verification.
Signal-style ratcheting key derivation — compromising one session key doesn't decrypt past or future messages. OpenSSH lacks per-message forward secrecy.
Emergency fallback using pure hash-based signatures (no number theory). If Falcon and SPHINCS+ are ever broken, Lamport OTS provides last-resort quantum resistance using only SHA-256.
Unix socket signing daemon with mlock(2) preventing key swap to disk, per-key rate limiting (60 signs/minute), JSONL audit log with SHA-256 hash chain, and Argon2id passphrase protection. OpenSSH's ssh-agent has none of these.
qssh can use a SHA3-256 counter-mode stream cipher, a symmetric option with no AES dependency. AES-256 also remains quantum-safe (about 128-bit security against Grover's algorithm).
Direct peer-to-peer connections with NAT traversal (STUN/TURN) — no sshd daemon needed. OpenSSH always requires a listening server.
Encrypted session tickets for fast reconnection — designed for mobile networks where connections drop. OpenSSH recreates the full handshake on every disconnect.
The entire crypto stack is pure Rust. No C reference implementations, no FFI, no segfaults, no memory corruption class. OpenSSH is C with decades of CVEs.
qssh does not speak the SSH wire protocol. This is intentional — SSH's variable-length records, plaintext version strings, and algorithm negotiation all leak metadata. qssh was designed post-quantum from scratch with no legacy constraints.
Data, keepalives, control messages — all identical on the wire. Encrypted headers, encrypted sequence numbers, random padding. No metadata leakage.
A direct comparison across the dimensions that matter for post-quantum readiness.
| Feature | OpenSSH | qssh |
|---|---|---|
| Signatures | RSA, ECDSA, Ed25519 | Falcon-512, SPHINCS+ |
| Key Exchange | Hybrid PQ by default (10.0+) | ML-KEM + X25519 hybrid |
| Frame Size | Variable (leaks metadata) | Constant 768 bytes |
| Quantum Entropy | No | Pluggable hardware RNG |
| QKD | No | BB84, E91, ETSI-QKD-014 |
| Security Tiers | One | Six (T0–T5) |
| Formal Verification | None | 117 proofs (Kani + Verus + Lean 4) |
| Forward Secrecy | Per-session only | Per-message (Double Ratchet) |
| P2P Mode | No | Yes (NAT traversal) |
| Certificates | RSA-signed | Falcon / SPHINCS+ signed |
| Language | C | Pure Rust |
Progressive security from classical compatibility to full quantum assurance. T2 is the default — post-quantum with constant-size frames out of the box.
Three independent verification tiers — from bounded model checking to deductive proofs to pure mathematics. Zero sorries. Zero axiomatized results.
Patent-free. Open source. A research protocol.