ssh: add mlkem768x25519-sha256 Key Exchange algorithm

mlkem768x25519-sha256 requires the crypto/mlkem package introduced in
Go 1.24.

Thanks to Damien Miller for posting an early version to the OpenSSH
mailing list.

Co-authored-by: Damien Miller <djm@mindrot.org>
Change-Id: I4235cf906903524a9a97283834cc8f43b5f76f91
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/646075
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Auto-Submit: Nicola Murino <nicola.murino@gmail.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

ssh/test/recording_client_test.go

@@ -232,6 +232,11 @@ func (test *clientTest) run(t *testing.T, write bool) {
 
 func recordingsClientConfig() *ssh.ClientConfig {
 	config := clientConfig()
+	// Remove ML-KEM since it only works with Go 1.24.
+	config.SetDefaults()
+	if config.KeyExchanges[0] == "mlkem768x25519-sha256" {
+		config.KeyExchanges = config.KeyExchanges[1:]
+	}
 	config.Rand = sha3.NewShake128()
 	config.Auth = []ssh.AuthMethod{
 		ssh.PublicKeys(testSigners["rsa"]),

ssh/test/recording_server_test.go

@@ -218,6 +218,12 @@ func recordingsServerConfig() *ssh.ServerConfig {
 			return nil, nil
 		},
 	}
+	config.SetDefaults()
+	// Remove ML-KEM since it only works with Go 1.24.
+	config.SetDefaults()
+	if config.KeyExchanges[0] == "mlkem768x25519-sha256" {
+		config.KeyExchanges = config.KeyExchanges[1:]
+	}
 	config.AddHostKey(testSigners["rsa"])
 	return config
 }
@@ -230,7 +236,8 @@ func TestServerKeyExchanges(t *testing.T) {
 	for _, kex := range config.KeyExchanges {
 		// Exclude ecdh for now, to make them determistic we should use see a
 		// stream of fixed bytes as the random source.
-		if !strings.HasPrefix(kex, "ecdh-") {
+		// Exclude ML-KEM because server side is not deterministic.
+		if !strings.HasPrefix(kex, "ecdh-") && !strings.HasPrefix(kex, "mlkem") {
 			keyExchanges = append(keyExchanges, kex)
 		}
 	}