[ssh_x509] Post-Quantum Traditional (PQ/T) hybrid key exchange methods - phase3

[ssh_x509 at roumenpetrov.info]

Hello,

Result is visible in PKIX-SSH 17.0.

Instead to use hybrid key from cryptographic library concatenation is 
managed by PKIX-SSH code.
Investigation from phase 2 shows that ML-KEM public format is usable 
without "work-around".
I guess that concatenation managed by PKIX-SSH code could allows easy to 
implement another hybrid model.


PKIX-SSH 17.0 adds benchmark to kex unit tests and I would like to share 
performance results:
method | 3.5* | 3.3* | 3.0* |
curve25519-sha256 | 823.83 | 817.14 | 808.35 | kex/s
curve448-sha512 | 318.87 | 320.22 | 322.35 | kex/s
ecdh-sha2-nistp256 | 539.04 | 422.09 | 423.12 | kex/s
ecdh-sha2-nistp384 | 61.12 | 51.27 | 52.44 | kex/s
ecdh-sha2-nistp521 | 27.47 | 22.61 | 23.3 | kex/s
sntrup761x25519-sha512 | 6.61 | 6.08 | 7.02 | kex/s
mlkem768nistp256-sha256 | 447.92 | 169.21 | - | kex/s
mlkem1024nistp384-sha384 | 58.81 | 42.86 | - | kex/s
mlkem768x25519-sha256 | 636.55 | 215.11 | 134.55 | kex/s
mlkem768-sha256 | 875.72 | 240.93 | - | kex/s
mlkem1024-sha384 | 750.69 | 236.87 | - | kex/s
diffie-hellman-group18-sha512 | 9.80 | 1.17 | 1.22 | kex/s
diffie-hellman-group17-sha512 | 17.13 | 2.65 | 2.76 | kex/s
diffie-hellman-group16-sha512 | 36.99 | 8.07 | 8.41 | kex/s
diffie-hellman-group15-sha512 | 62.63 | 17.31 | 18.02 | kex/s
diffie-hellman-group14-sha256 | 126.64 | 47.79 | 49.65 | kex/s
diffie-hellman-group14-sha1 | 126.37 | 47.76 | 49.69 | kex/s
diffie-hellman-group1-sha1 | 352.59 | 337.99 | 344.42 | kex/s
diffie-hellman-group-exchange-sha256 | 8.62 | 8.13 | 8.69 | kex/s
diffie-hellman-group-exchange-sha1 | 8.61 | 8.13 | 8.71 | kex/s

Legend:
3.5*: OpenSSL 3.5.* with ML-KEM
3.3*: OpenSSL 3.3.* with ML-KEM from oqs-provider
3.0*: OpenSSL 3.0.* with build-in ML-KEM

Notes:
- Concatenation managed by PKIX-SSH code allows easy to test ML-KEM 
algorithms independently.
- OpenSSL 3.5 has speed improvements and some of them are significant.
- mlkem768x25519-sha256 speed is 4.7:1.6:1 between 
openssl:osq-provider:build-in.
- sntrup761: NO COMMENT! The speed is unacceptable.
Except diffie-hellman-group1{8|7}-sha512 in OpenSSL 3.3 and 3.0 it is 
always slowest. DH-GEX are well known slow algorithms but SNTRUP761 
speed is 0.75-0.8 of DH-GEX speed.


And now 3.5* results sorted by speed:
	(*) mlkem768-sha256 | 875.72
curve25519-sha256 | 823.83
	(*) mlkem1024-sha384 | 750.69
mlkem768x25519-sha256 | 636.55
ecdh-sha2-nistp256 | 539.04
mlkem768nistp256-sha256 | 447.92
	(**) diffie-hellman-group1-sha1 | 352.59
curve448-sha512 | 318.87
diffie-hellman-group14-sha256 | 126.64
diffie-hellman-group14-sha1 | 126.37
diffie-hellman-group15-sha512 | 62.63
ecdh-sha2-nistp384 | 61.12
mlkem1024nistp384-sha384 | 58.81
diffie-hellman-group16-sha512 | 36.99
ecdh-sha2-nistp521 | 27.47
diffie-hellman-group17-sha512 | 17.13
diffie-hellman-group18-sha512 | 9.80
diffie-hellman-group-exchange-sha256 | 8.62
	(**) diffie-hellman-group-exchange-sha1 | 8.61
sntrup761x25519-sha512 | 6.61

(*) available only for testing purposes.
(**) deprecated in RFC-9142.


Regards,
Roumen Petrov