Settings that make a server prefer a hybrid key exchange group. Group names differ by product, and hybrid groups need a TLS library that includes them (OpenSSL 3.5 or later, BoringSSL, Go 1.24 or later).
Prefer the hybrid group
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.com,curve25519-sha256Allow only post-quantum groups
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.comNotes for OpenSSH sshd
KexAlgorithms cannot be set inside a Match block, so run a second sshd on another port for legacy clients. sshd does not log the negotiated algorithm at LogLevel VERBOSE; check from a client with ssh -v. Both listed algorithms are hybrids; OpenSSH has no native ML-KEM key exchange.
Checked in a lab with OpenSSH 10.6p1 on Oct 18, 2026.
Other servers
nginx, Apache httpd, HAProxy, Envoy, OpenSSL, Go crypto/tls, Java JSSE, IIS (Windows Schannel).