[ssh_x509] PKIX-SSH release 17.0

[ssh_x509 at roumenpetrov.info]

Hello,

New feature release 17.0 has just been published.


(x) Features:

(*) add hybrid key exchange algorithms based on ML-KEM and traditional 
Elliptic-curve Diffie-Hellman
Support all ML-KEM algorithms described in 
"draft-kampanakis-curdle-ssh-pq-ke" internet draft i.e., 
mlkem768nistp256-sha256, mlkem1024nistp384-sha384, 
mlkem768x25519-sha256. Note requires OpenSSL 3.* that provides ML-KEM 
algorithms i.e., OpenSSL 3.5* or OpenSSL 3.* with activated Open Quantum 
Safe provider.

(*) limiting default Diffie-Hellman key exchange algorithms

(*) change IPQoS defaults
Use Expedited Forwarding (EF) as default IPQoS for interactive sessions. 
Use the operating system default DSCP marking for non-interactive traffic.

(*) remove support for IPv4 type-of-service IPQoS keyword arguments
Deprecated in PKIX-SSH 11.4 (24 Aug 2018). System default is used instead.

(*) add client option RefuseConnection


(x) Misc:

(*) unify ecdh and ecx key exchange functionality
Prepare ECDH and ECX for use as traditional keys in hybrid key exchange.

(*) add key exchange based on encapsulation mechanism
Support ML-KEM-768 and ML-KEM-1024 algorithms provided by cryptographic 
library as post-quantum ephemeral keys of hybrid key exchange.

(*) add benchmarking capability for unit tests

(*) add benchmark support to key exchange unit tests

(*) allows disabling Diffie-Hellman key exchange algorithms at configure 
time


Regards,
Roumen Petrov