[openssh-commits] [openssh] 06/12: upstream: document mldsa44-ed25519 host key and public key
git+noreply at mindrot.org
git+noreply at mindrot.org
Tue Jul 21 15:23:35 AEST 2026
This is an automated email from the git hooks/post-receive script.
djm pushed a commit to branch master
in repository openssh.
commit 0e546c658bb3d9c7cf727e43efa4e29bbbafe5a3
Author: naddy at openbsd.org <naddy at openbsd.org>
AuthorDate: Fri Jul 10 17:21:19 2026 +0000
upstream: document mldsa44-ed25519 host key and public key
algorithm
OpenBSD-Commit-ID: c519ba7408cfb2700d184c9441de4ff01ecda726
---
ssh-keysign.8 | 6 ++++--
ssh.1 | 5 +++--
ssh_config.5 | 19 +++++++++++++------
sshd.8 | 11 ++++++++---
sshd_config | 3 ++-
sshd_config.5 | 22 +++++++++++++++-------
6 files changed, 45 insertions(+), 21 deletions(-)
diff --git a/ssh-keysign.8 b/ssh-keysign.8
index 3b4d35b09..e53c55a71 100644
--- a/ssh-keysign.8
+++ b/ssh-keysign.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-keysign.8,v 1.18 2024/06/17 08:30:29 djm Exp $
+.\" $OpenBSD: ssh-keysign.8,v 1.19 2026/07/10 17:21:19 naddy Exp $
.\"
.\" Copyright (c) 2002 Markus Friedl. All rights reserved.
.\"
@@ -22,7 +22,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: June 17 2024 $
+.Dd $Mdocdate: July 10 2026 $
.Dt SSH-KEYSIGN 8
.Os
.Sh NAME
@@ -63,6 +63,7 @@ is enabled.
.Pp
.It Pa /etc/ssh/ssh_host_ecdsa_key
.It Pa /etc/ssh/ssh_host_ed25519_key
+.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
.It Pa /etc/ssh/ssh_host_rsa_key
These files contain the private parts of the host keys used to
generate the digital signature.
@@ -74,6 +75,7 @@ must be set-uid root if host-based authentication is used.
.Pp
.It Pa /etc/ssh/ssh_host_ecdsa_key-cert.pub
.It Pa /etc/ssh/ssh_host_ed25519_key-cert.pub
+.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key-cert.pub
.It Pa /etc/ssh/ssh_host_rsa_key-cert.pub
If these files exist, they are assumed to contain public certificate
information corresponding with the private keys above.
diff --git a/ssh.1 b/ssh.1
index b5892d51e..42d483447 100644
--- a/ssh.1
+++ b/ssh.1
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh.1,v 1.450 2026/07/09 01:16:37 djm Exp $
-.Dd $Mdocdate: July 9 2026 $
+.\" $OpenBSD: ssh.1,v 1.451 2026/07/10 17:21:19 naddy Exp $
+.Dd $Mdocdate: July 10 2026 $
.Dt SSH 1
.Os
.Sh NAME
@@ -1541,6 +1541,7 @@ The file format and configuration options are described in
.Pp
.It Pa /etc/ssh/ssh_host_ecdsa_key
.It Pa /etc/ssh/ssh_host_ed25519_key
+.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
.It Pa /etc/ssh/ssh_host_rsa_key
These files contain the private parts of the host keys
and are used for host-based authentication.
diff --git a/ssh_config.5 b/ssh_config.5
index 4ac0d3d45..d7e09f994 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh_config.5,v 1.426 2026/07/01 00:52:31 djm Exp $
-.Dd $Mdocdate: July 1 2026 $
+.\" $OpenBSD: ssh_config.5,v 1.427 2026/07/10 17:21:19 naddy Exp $
+.Dd $Mdocdate: July 10 2026 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@@ -476,7 +476,8 @@ ssh-ed25519,ecdsa-sha2-nistp256,
ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519 at openssh.com
.Ed
.Pp
If the specified list begins with a
@@ -1060,12 +1061,14 @@ sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
rsa-sha2-512-cert-v01 at openssh.com,
rsa-sha2-256-cert-v01 at openssh.com,
+ssh-mldsa44-ed25519-cert-v01 at openssh.com,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256 at openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519 at openssh.com
.Ed
.Pp
The
@@ -1108,12 +1111,14 @@ sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
rsa-sha2-512-cert-v01 at openssh.com,
rsa-sha2-256-cert-v01 at openssh.com,
+ssh-mldsa44-ed25519-cert-v01 at openssh.com,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ecdsa-sha2-nistp256 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256 at openssh.com
sk-ssh-ed25519 at openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519 at openssh.com
.Ed
.Pp
If hostkeys are known for the destination host then this default is modified
@@ -1708,12 +1713,14 @@ sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
rsa-sha2-512-cert-v01 at openssh.com,
rsa-sha2-256-cert-v01 at openssh.com,
+ssh-mldsa44-ed25519-cert-v01 at openssh.com,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256 at openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519 at openssh.com
.Ed
.Pp
The list of available signature algorithms may also be obtained using
diff --git a/sshd.8 b/sshd.8
index 7fbca776a..84763b3dd 100644
--- a/sshd.8
+++ b/sshd.8
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: sshd.8,v 1.328 2025/10/04 21:41:35 naddy Exp $
-.Dd $Mdocdate: October 4 2025 $
+.\" $OpenBSD: sshd.8,v 1.329 2026/07/10 17:21:19 naddy Exp $
+.Dd $Mdocdate: July 10 2026 $
.Dt SSHD 8
.Os
.Sh NAME
@@ -181,7 +181,8 @@ is not run as root (as the normal
host key files are normally not readable by anyone but root).
The default is
.Pa /etc/ssh/ssh_host_ecdsa_key ,
-.Pa /etc/ssh/ssh_host_ed25519_key
+.Pa /etc/ssh/ssh_host_ed25519_key ,
+.Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
and
.Pa /etc/ssh/ssh_host_rsa_key .
It is possible to have multiple host key files for
@@ -469,6 +470,8 @@ sk-ssh-ed25519 at openssh.com
.It
ssh-ed25519
.It
+ssh-mldsa44-ed25519 at openssh.com
+.It
ssh-rsa
.El
.Pp
@@ -959,6 +962,7 @@ rlogin/rsh.
.Pp
.It Pa /etc/ssh/ssh_host_ecdsa_key
.It Pa /etc/ssh/ssh_host_ed25519_key
+.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
.It Pa /etc/ssh/ssh_host_rsa_key
These files contain the private parts of the host keys.
These files should only be owned by root, readable only by root, and not
@@ -969,6 +973,7 @@ does not start if these files are group/world-accessible.
.Pp
.It Pa /etc/ssh/ssh_host_ecdsa_key.pub
.It Pa /etc/ssh/ssh_host_ed25519_key.pub
+.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key.pub
.It Pa /etc/ssh/ssh_host_rsa_key.pub
These files contain the public parts of the host keys.
These files should be world-readable but writable only by
diff --git a/sshd_config b/sshd_config
index 0f4a3a724..57ecabb86 100644
--- a/sshd_config
+++ b/sshd_config
@@ -1,4 +1,4 @@
-# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $
+# $OpenBSD: sshd_config,v 1.106 2026/07/10 17:21:19 naddy Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
@@ -18,6 +18,7 @@
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key
+#HostKey /etc/ssh/ssh_host_mldsa44_ed25519_key
# Ciphers and keying
#RekeyLimit default none
diff --git a/sshd_config.5 b/sshd_config.5
index 39a864dee..0d9c944b4 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: sshd_config.5,v 1.399 2026/06/24 06:55:12 djm Exp $
-.Dd $Mdocdate: June 24 2026 $
+.\" $OpenBSD: sshd_config.5,v 1.400 2026/07/10 17:21:19 naddy Exp $
+.Dd $Mdocdate: July 10 2026 $
.Dt SSHD_CONFIG 5
.Os
.Sh NAME
@@ -391,7 +391,8 @@ ssh-ed25519,ecdsa-sha2-nistp256,
ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519 at openssh.com
.Ed
.Pp
If the specified list begins with a
@@ -803,12 +804,14 @@ sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
rsa-sha2-512-cert-v01 at openssh.com,
rsa-sha2-256-cert-v01 at openssh.com,
+ssh-mldsa44-ed25519-cert-v01 at openssh.com,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256 at openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519 at openssh.com
.Ed
.Pp
The list of available signature algorithms may also be obtained using
@@ -850,7 +853,8 @@ Specifies a file containing a private host key
used by SSH.
The defaults are
.Pa /etc/ssh/ssh_host_ecdsa_key ,
-.Pa /etc/ssh/ssh_host_ed25519_key
+.Pa /etc/ssh/ssh_host_ed25519_key ,
+.Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
and
.Pa /etc/ssh/ssh_host_rsa_key .
.Pp
@@ -889,12 +893,14 @@ sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
rsa-sha2-512-cert-v01 at openssh.com,
rsa-sha2-256-cert-v01 at openssh.com,
+ssh-mldsa44-ed25519-cert-v01 at openssh.com,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256 at openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519 at openssh.com
.Ed
.Pp
The list of available signature algorithms may also be obtained using
@@ -1757,12 +1763,14 @@ sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
rsa-sha2-512-cert-v01 at openssh.com,
rsa-sha2-256-cert-v01 at openssh.com,
+ssh-mldsa44-ed25519-cert-v01 at openssh.com,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256 at openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519 at openssh.com
.Ed
.Pp
The list of available signature algorithms may also be obtained using
--
To stop receiving notification emails like this one, please contact
djm at mindrot.org.
More information about the openssh-commits
mailing list