The papers behind GHOSTSHELL's cryptography.

Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer

Peter W. Shor. SIAM Journal on Computing 26(5):1484–1509 (journal version of the FOCS 1994 paper). doi:10.1137/S0097539795293172

Gave quantum algorithms that factor integers and solve discrete logarithms in polynomial time, so a large quantum computer would break RSA, Diffie–Hellman and elliptic-curve cryptography. Each GHOSTSHELL hybrid pairs X25519, P-256, P-384 or Ed25519 with ML-KEM, sntrup761 or ML-DSA, so breaking the classical half alone is not enough.

A fast quantum mechanical algorithm for database search

Lov K. Grover. Proceedings of the 28th Annual ACM Symposium on Theory of Computing (STOC '96), pp. 212–219. doi:10.1145/237814.237866

Showed that a quantum computer can search N possibilities in about the square root of N steps, which halves the effective length of a symmetric key without breaking it. GhostVault, history and logs therefore use 256-bit AES keys, which keep about 128-bit strength against such a search.

How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits

Craig Gidney and Martin Ekerå. Quantum, vol. 5, article 433. doi:10.22331/q-2021-04-15-433

Estimated that about 20 million noisy qubits could factor a 2048-bit RSA number in about eight hours, with a hundredth of the spacetime volume earlier estimates needed. A concrete hardware estimate like this is a reason to ship post-quantum key exchange and signatures before such a machine exists.

How to factor 2048 bit RSA integers with less than a million noisy qubits

Craig Gidney. arXiv preprint 2505.15917 [quant-ph]

Cut the estimate for factoring RSA-2048 to under a million noisy qubits and under a week, on the same hardware assumptions as the Gidney–Ekerå estimate. A drop of more than twentyfold in qubits, at the cost of a longer run, strengthens the case for protecting traffic recorded today. It is still a preprint.

NTRU: A ring-based public key cryptosystem

Jeffrey Hoffstein, Jill Pipher and Joseph H. Silverman. Algorithmic Number Theory (ANTS-III), Lecture Notes in Computer Science vol. 1423, pp. 267–288. doi:10.1007/BFb0054868

Introduced NTRU, public-key encryption built from products of small polynomials in a ring, whose security rests on the difficulty of finding short vectors in a lattice; it is widely regarded as the first practical lattice cryptosystem. Its descendant, Streamlined NTRU Prime, is the post-quantum half of GHOSTSHELL's sntrup761x25519 key exchange.

On lattices, learning with errors, random linear codes, and cryptography

Oded Regev. Journal of the ACM 56(6), 2009 (journal version of the STOC 2005 paper). doi:10.1145/1568318.1568324

Defined learning with errors (LWE), showed that solving it efficiently would solve hard worst-case lattice problems on a quantum computer, and built public-key encryption on it. ML-KEM and ML-DSA, which carry most of GHOSTSHELL's post-quantum protection, build on its module form.

On Ideal Lattices and Learning with Errors over Rings

Vadim Lyubashevsky, Chris Peikert and Oded Regev. EUROCRYPT 2010, Lecture Notes in Computer Science vol. 6110, pp. 1–23 (full version in Journal of the ACM 60(6), 2013). doi:10.1007/978-3-642-13190-5_1

Defined ring-LWE and proved it as hard as worst-case problems on ideal lattices for quantum computers, making lattice cryptography compact and fast with a security proof. ML-KEM's module lattices are built on this ring structure, which keeps an ML-KEM-768 public key at 1,184 bytes and its ciphertext at 1,088, small enough for SSH and TLS handshakes.

Worst-case to average-case reductions for module lattices

Adeline Langlois and Damien Stehlé. Designs, Codes and Cryptography 75(3):565–599 (June 2015 issue; online February 2014). doi:10.1007/s10623-014-9938-4

Defined Module-LWE and Module-SIS, between the plain and the ring problems, and proved them as hard on average as worst-case module-lattice problems. ML-KEM's strength is set by its module rank: rank 3 (ML-KEM-768) in GHOSTSHELL's first SSH and HTTPS choices, rank 4 (ML-KEM-1024) in mlkem1024nistp384, the MLKEM1024 TLS group and GhostVault.

NTRU Prime: Reducing Attack Surface at Low Cost

Daniel J. Bernstein, Chitchanok Chuengsatiansup, Tanja Lange and Christine van Vredendaal. Selected Areas in Cryptography – SAC 2017, Lecture Notes in Computer Science vol. 10719, pp. 235–260 (online December 2017; print volume 2018). doi:10.1007/978-3-319-72565-9_12

Argued that the extra algebraic structure in the rings of NTRU and ring-LWE is needless attack surface, and proposed NTRU Prime without it, including the chosen-ciphertext-secure Streamlined variant. Streamlined NTRU Prime, revised during NIST's process as sntrup761, is the post-quantum half of sntrup761x25519 (RFC 9941), OpenSSH's default from 9.0 until 10.0, which GHOSTSHELL offers after its ML-KEM hybrids as a second lattice design.

CRYSTALS – Kyber: A CCA-Secure Module-Lattice-Based KEM

Joppe Bos, Léo Ducas, Eike Kiltz, Tancrède Lepoint, et al. 2018 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 353–367. doi:10.1109/EuroSP.2018.00032

Designed Kyber, a Module-LWE key encapsulation made chosen-ciphertext secure by a variant of the Fujisaki–Okamoto transform; NIST standardized it as ML-KEM. It is the post-quantum half of three GHOSTSHELL SSH key exchanges (RFC 10042) and of X25519MLKEM768 for HTTPS, and with P-384 it seals GhostVault's recovery and escrow slots and its shared bundles.

CRYSTALS-Dilithium: A Lattice-Based Digital Signature Scheme

Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, et al. IACR Transactions on Cryptographic Hardware and Embedded Systems (TCHES) 2018(1):238–268. doi:10.46586/tches.v2018.i1.238-268

Designed Dilithium, a module-lattice signature built on Fiat–Shamir with aborts that needs no Gaussian sampling, which makes constant-time implementation straightforward; NIST standardized it as ML-DSA. As ML-DSA paired with Ed25519, it signs GHOSTSHELL's releases and is the post-quantum half of the hybrid SSH host and user keys GHOSTSHELL supports; paired with P-384, it signs GhostVault's shared bundles.

Module-Lattice-Based Key-Encapsulation Mechanism Standard

National Institute of Standards and Technology. Federal Information Processing Standards Publication 203 (FIPS 203). doi:10.6028/NIST.FIPS.203

Made ML-KEM, derived from CRYSTALS-Kyber, a U.S. federal standard at three strengths: ML-KEM-512, -768 and -1024. GHOSTSHELL uses two: ML-KEM-768, NIST's recommended default, in mlkem768x25519, mlkem768nistp256 and X25519MLKEM768, and ML-KEM-1024 in mlkem1024nistp384, the MLKEM1024 TLS group and GhostVault.

Module-Lattice-Based Digital Signature Standard

National Institute of Standards and Technology. Federal Information Processing Standards Publication 204 (FIPS 204). doi:10.6028/NIST.FIPS.204

Made ML-DSA, derived from CRYSTALS-Dilithium, a U.S. federal standard at three strengths: ML-DSA-44, -65 and -87. GHOSTSHELL uses ML-DSA-44 in its release key and its hybrid SSH host and user keys, all three alone as SSH key types, and ML-DSA-87 for GhostVault's bundle signatures.

Transition to Post-Quantum Cryptography Standards

Dustin Moody, Ray Perlner, Andrew Regenscheid, Angela Robinson and David Cooper. NIST Internal Report 8547, final (initial public draft November 2024). doi:10.6028/NIST.IR.8547

Sets NIST's timetable for retiring quantum-vulnerable public-key cryptography (RSA, ECDSA, EdDSA, finite-field and elliptic-curve Diffie–Hellman): deprecated after 2030, disallowed after 2035. It accepts hybrid key establishment when one component is NIST-approved and names ML-KEM-768 the default, the pattern of GHOSTSHELL's first SSH and HTTPS choices.

Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange

Nina Bindel, Jacqueline Brendel, Marc Fischlin, Brian Goncalves and Douglas Stebila. Post-Quantum Cryptography – PQCrypto 2019, Lecture Notes in Computer Science vol. 11505, pp. 206–226. doi:10.1007/978-3-030-25510-7_12

Gave hybrid key exchange a formal footing, modeling attackers whose quantum power may come later and proving which combinations of a classical and a post-quantum KEM stay secure while either holds. RFC 9954 ties the TLS construction behind X25519MLKEM768, the first group GHOSTSHELL offers for HTTPS, to this paper's dual-PRF combiner.

Hybrid Key Exchange in TLS 1.3

Douglas Stebila, Scott Fluhrer and Shay Gueron. IETF RFC 9954 (Informational). doi:10.17487/RFC9954

Specifies how TLS 1.3 runs two or more key exchanges at once and feeds their concatenated secrets into the usual key schedule, so a connection stays private unless every component is broken. RFC 10024 defines X25519MLKEM768, the first group GHOSTSHELL offers for HTTPS, on this framework.

Breaking Rainbow Takes a Weekend on a Laptop

Ward Beullens. Advances in Cryptology – CRYPTO 2022, Lecture Notes in Computer Science vol. 13508, pp. 464–479. doi:10.1007/978-3-031-15979-4_16

Recovered a key for Rainbow's lowest security level, then one of NIST's three finalist signature schemes, in about 53 hours on a laptop. Such a late break is what a classical half insures against: GHOSTSHELL's release and vault signatures pair ML-DSA with Ed25519 or P-384, and it prefers hybrid SSH host keys to ML-DSA alone.

An Efficient Key Recovery Attack on SIDH

Wouter Castryck and Thomas Decru. Advances in Cryptology – EUROCRYPT 2023, Lecture Notes in Computer Science vol. 14008, pp. 423–447. doi:10.1007/978-3-031-30589-4_15

Broke the isogeny-based SIDH key exchange with a classical attack in heuristic polynomial time, recovering a SIKEp434 key in about ten minutes on one core while SIKE was in NIST's fourth round. Hence the hybrids: every post-quantum SSH key exchange GHOSTSHELL offers keeps X25519, P-256 or P-384, and for HTTPS X25519MLKEM768 comes before ML-KEM-1024 alone.

Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation

Fabian Bäumer, Marcus Brinkmann and Jörg Schwenk. 33rd USENIX Security Symposium (USENIX Security 2024), pp. 7463–7480

Showed that a network attacker can silently drop an SSH connection's first encrypted packets under ChaCha20-Poly1305 or CBC with encrypt-then-MAC, and so downgrade its extensions, because part of the handshake is unauthenticated and sequence numbers are not reset when keys change. GHOSTSHELL always offers strict key exchange, the countermeasure, which takes effect when the server supports it too.

KyberSlash: Exploiting secret-dependent division timings in Kyber implementations

Daniel J. Bernstein, Karthikeyan Bhargavan, Shivam Bhasin, Anupam Chattopadhyay, et al. IACR Transactions on Cryptographic Hardware and Embedded Systems (TCHES) 2025(2):209–234. doi:10.46586/tches.v2025.i2.209-234

Found that secret-dependent divisions in several Kyber implementations, the reference code among them, leak timing that gave up keys in minutes to hours on a Raspberry Pi 2 and an Arm Cortex-M4. ML-KEM is only as safe as its code: the ML-KEM libraries behind GHOSTSHELL's SSH and GhostVault, RustCrypto's ml-kem and @noble/post-quantum, have had no independent audit, and @noble makes no constant-time claim.