Support for Quantum Resistant Key Exchange

[Nummer378 (Max)]

I recently dug into this topic. While go 1.24 supports PQC by default, it doesn’t seem to work for syncthing yet.

What could a malicious discovery or relay server do?

Go (the language syncthing is written in) supports the Post-Quantum hybrid key exchange X25519MLKEM768 in current Go releases (1.24+). As such, if you trust Kyber to be secure in a PQ-environment, Go TLS handshakes can be reasonably secure. Recent syncthing releases (1.29.3+) are using Go 1.24. However, I had a look with Wireshark, and all of my syncthing instances do not announce ML-KEM (Kyber) capabilities. All handshakes are still “traditional” X25519 (which is not PQ-secure). I could not id…

@calmh suggested that this may be related to syncthing “targeting” an older go version while building with a newer version. Otherwise, there should be nothing to configure.