Every SSH connection you make from your iPhone today could be quietly recorded and stored somewhere. The point of recording isn't to break it now, but to wait until quantum computers are mature enough, then decrypt it all retroactively in bulk. The security industry has given this attack a blunt name: Harvest Now, Decrypt Later.

The good news is that the defense is now an official standard: NIST finalized the post-quantum key encapsulation algorithm ML-KEM (FIPS 203) in 2024, and OpenSSH has already incorporated it into its default key exchange. Now, NeoServer brings ML-KEM to iOS—your iPhone can initiate genuine post-quantum SSH connections, with zero configuration required.

Harvest Now, Decrypt Later: Why You Should Care Today

Traditional SSH confidentiality rests on classical mathematical problems like ECDH and RSA. They're secure enough against today's computers, but once quantum computers run Shor's algorithm, these problems can be broken efficiently. The real trouble is the time gap:

1. The recording happens today. Airport and café Wi-Fi, compromised routers, any hop along the path—all can store encrypted traffic at nearly zero cost to the recorder.
2. The decryption happens in the future. Once a sufficiently large quantum computer exists, every classical key exchange recorded today can be broken retroactively—no further mistakes on your part required.
3. Once an SSH session is cracked, it's cracked entirely. The sudo password you typed, the config files and keys you cat'ed out, tokens in deployment scripts, internal network topology—all laid bare in plaintext.

For server administrators, NAS users, and ops engineers, SSH traffic is precisely the recording target with the highest long-term value. And the strategy of "worrying about it when quantum computers actually arrive" is irreversible for traffic that has already been recorded.

What Is ML-KEM: The Three-Minute Version

ML-KEM (Module-Lattice-based Key Encapsulation Mechanism) is the post-quantum cryptography standard FIPS 203 finalized by NIST in August 2024, descended from the Kyber algorithm. Its security rests on mathematical problems over lattices—for all known quantum algorithms, these problems have no efficient solution.

It does exactly one thing, but it happens to be the most critical thing: key exchange. When a connection is established, both sides negotiate a session key using ML-KEM; from then on, even if a quantum computer replays the entire traffic, it cannot recover that key.

Two facts worth knowing:

• OpenSSH, since version 9.9 (September 2024), enables the hybrid key exchange mlkem768x25519-sha256 by default. It bundles ML-KEM-768 with classical X25519: two mathematical problems protect the same session simultaneously, and breaking either one alone is insufficient to decrypt. Most newer Linux distributions and macOS SSH servers from the past year support it by default.
• Apple is rolling out post-quantum encryption across the board. iMessage introduced post-quantum protection with the PQ3 protocol, and iOS 26 goes further, using ML-KEM to encrypt communication between iPhone and Apple Watch. Your phone and watch are already post-quantum encrypted—what about your SSH client?

The iPhone Is Often the Weakest Link

The server side is ready by default, but clients often lag behind: most iOS SSH clients still offer only classical key exchange to this day. This creates an awkward situation—the server fully supports post-quantum negotiation, but the handshake gets downgraded to classical algorithms on the phone side.

And phones are precisely the most exposed devices: café, airport, and hotel Wi-Fi, sketchy networks, connections made on the fly. On your Mac you might still wrap things in WireGuard, but that quick SSH session from your iPhone is often a bare connection.

NeoServer closes this gap. When connecting, NeoServer automatically prioritizes negotiating mlkem768x25519-sha256:

• Server supports it → immediately enters a post-quantum session; the entire connection is quantum-safe from the handshake onward
• Older server → smoothly falls back to classical algorithms; the connection works as usual, interrupting no workflows
• Zero configuration: no settings need changing; it takes effect as soon as you update the app

Verify Your Server's Readiness in 30 Seconds

Run this on your server (running it in NeoServer's terminal works just as well):

ssh -Q kex | grep mlkem
# If the output is mlkem768x25519-sha256, it's supported

To see the negotiated result with your own eyes, add -vv when connecting from a desktop:

ssh -vv user@your-server 2>&1 | grep "kex:"
# debug1: kex: algorithm: mlkem768x25519-sha256

If the first command produces no output, the server's OpenSSH is still on a pre-9.9 version; upgrading the system or OpenSSH will add support. After that, connections from NeoServer will automatically settle on ML-KEM.

Beyond Key Exchange: NeoServer's Security Model

Post-quantum key exchange solves "the link being recorded"; NeoServer makes no compromises elsewhere either:

• Private keys exist only on your iPhone, protected by Face ID / Touch ID; when you need multiple devices, they sync via your private iCloud
• SSH Agent Forwarding: remote servers temporarily "borrow" the keys on your phone for authentication—the private key never lands on the server. See the earlier in-depth introduction for details
• Full authentication capabilities: passwords, private keys, 2FA, Jump Server (bastion host), failover, Socks5 proxy
• Zero third-party analytics, zero ad SDKs: NeoServer doesn't communicate with any server you haven't configured; your data belongs only to you

On top of that, Mosh keeps you connected across network switches, tmux/zellij sessions survive disconnects, and SFTP, server monitoring, Docker/Podman management, and batch script execution are all included. NeoServer isn't just "a terminal that supports ML-KEM"—it's a complete mobile ops workstation on the iPhone.

Who It's For

• Home server enthusiasts and NAS users (Synology, QNAP, TrueNAS, etc.)
• Web administrators and ops engineers
• Developers and programmers
• Those managing AI compute nodes and cloud servers
• And everyone who believes "replay-and-decrypt in ten years" shouldn't threaten today's traffic

Quantum-Safe Starting from Your Next Connection

The terrifying thing about harvest-now-decrypt-later attacks is their asymmetry: defenders only need to upgrade the handshake once today, while attackers can hold on to yesterday's recorded traffic forever. Your server has long been ready by default; all that's missing is an iOS client that supports ML-KEM.

Open the App Store and search for NeoServer, or head directly to the App Store to download it—so that your next SSH connection from your iPhone is quantum-safe from the moment of the handshake.