[openssh-commits] [openssh] 07/12: upstream: read ~/.ssh/id_mldsa44_ed25519 private key files by
git+noreply at mindrot.org
git+noreply at mindrot.org
Tue Jul 21 15:23:36 AEST 2026
This is an automated email from the git hooks/post-receive script.
djm pushed a commit to branch master
in repository openssh.
commit 1ae9eeb18d13650f26ccfd9648f46d3a3b6b2b81
Author: naddy at openbsd.org <naddy at openbsd.org>
AuthorDate: Sat Jul 11 11:15:03 2026 +0000
upstream: read ~/.ssh/id_mldsa44_ed25519 private key files by
default
ok djm@
OpenBSD-Commit-ID: c45683d341d7dce6c126903bf9a37393f2b75839
---
readconf.c | 4 +++-
ssh-add.1 | 13 ++++++++-----
ssh-add.c | 3 ++-
ssh-keygen.1 | 10 +++++-----
ssh.1 | 15 +++++++++++----
ssh_config.5 | 9 +++++----
sshd.8 | 5 +++--
7 files changed, 37 insertions(+), 22 deletions(-)
diff --git a/readconf.c b/readconf.c
index 0218ed128..cf60b5445 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.413 2026/06/29 08:16:46 djm Exp $ */
+/* $OpenBSD: readconf.c,v 1.414 2026/07/11 11:15:03 naddy Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -2926,6 +2926,8 @@ fill_default_options(Options * options)
_PATH_SSH_CLIENT_ID_ED25519, 0);
add_identity_file(options, "~/",
_PATH_SSH_CLIENT_ID_ED25519_SK, 0);
+ add_identity_file(options, "~/",
+ _PATH_SSH_CLIENT_ID_MLDSA44_ED25519, 0);
}
if (options->escape_char == -1)
options->escape_char = '~';
diff --git a/ssh-add.1 b/ssh-add.1
index af5f8f7b0..d9b469c90 100644
--- a/ssh-add.1
+++ b/ssh-add.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-add.1,v 1.89 2026/03/05 05:44:15 djm Exp $
+.\" $OpenBSD: ssh-add.1,v 1.90 2026/07/11 11:15:03 naddy Exp $
.\"
.\" Author: Tatu Ylonen <ylo at cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: March 5 2026 $
+.Dd $Mdocdate: July 11 2026 $
.Dt SSH-ADD 1
.Os
.Sh NAME
@@ -69,9 +69,10 @@ When run without arguments, it adds the files
.Pa ~/.ssh/id_rsa ,
.Pa ~/.ssh/id_ecdsa ,
.Pa ~/.ssh/id_ecdsa_sk ,
-.Pa ~/.ssh/id_ed25519
+.Pa ~/.ssh/id_ed25519 ,
+.Pa ~/.ssh/id_ed25519_sk
and
-.Pa ~/.ssh/id_ed25519_sk .
+.Pa ~/.ssh/id_mldsa44_ed25519 .
After loading a private key,
.Nm
will try to load corresponding certificate information from the
@@ -329,9 +330,11 @@ the built-in USB HID support.
.It Pa ~/.ssh/id_ecdsa_sk
.It Pa ~/.ssh/id_ed25519
.It Pa ~/.ssh/id_ed25519_sk
+.It Pa ~/.ssh/id_mldsa44_ed25519
.It Pa ~/.ssh/id_rsa
Contains the ECDSA, authenticator-hosted ECDSA, Ed25519,
-authenticator-hosted Ed25519 or RSA authentication identity of the user.
+authenticator-hosted Ed25519, MLDSA44-ED25519
+or RSA authentication identity of the user.
.El
.Pp
Identity files should not be readable by anyone but the user.
diff --git a/ssh-add.c b/ssh-add.c
index 7ce451036..f2055df36 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-add.c,v 1.187 2026/06/29 02:13:05 djm Exp $ */
+/* $OpenBSD: ssh-add.c,v 1.188 2026/07/11 11:15:03 naddy Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -87,6 +87,7 @@ static char *default_files[] = {
#endif /* WITH_OPENSSL */
_PATH_SSH_CLIENT_ID_ED25519,
_PATH_SSH_CLIENT_ID_ED25519_SK,
+ _PATH_SSH_CLIENT_ID_MLDSA44_ED25519,
NULL
};
diff --git a/ssh-keygen.1 b/ssh-keygen.1
index 33f78fe39..d48a05f0b 100644
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-keygen.1,v 1.238 2026/07/01 01:14:39 djm Exp $
+.\" $OpenBSD: ssh-keygen.1,v 1.239 2026/07/11 11:15:03 naddy Exp $
.\"
.\" Author: Tatu Ylonen <ylo at cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: July 1 2026 $
+.Dd $Mdocdate: July 11 2026 $
.Dt SSH-KEYGEN 1
.Os
.Sh NAME
@@ -209,7 +209,7 @@ key in
.Pa ~/.ssh/id_ecdsa_sk ,
.Pa ~/.ssh/id_ed25519 ,
.Pa ~/.ssh/id_ed25519_sk ,
-.Pa ~/.ssh/id_mldsa44-ed25519
+.Pa ~/.ssh/id_mldsa44_ed25519
or
.Pa ~/.ssh/id_rsa .
Additionally, the system administrator may use this to generate host keys,
@@ -1301,7 +1301,7 @@ the built-in USB HID support.
.It Pa ~/.ssh/id_ecdsa_sk
.It Pa ~/.ssh/id_ed25519
.It Pa ~/.ssh/id_ed25519_sk
-.It Pa ~/.ssh/id_mldsa44-ed25519
+.It Pa ~/.ssh/id_mldsa44_ed25519
.It Pa ~/.ssh/id_rsa
Contains the ECDSA, authenticator-hosted ECDSA, Ed25519,
authenticator-hosted Ed25519 or RSA authentication identity of the user.
@@ -1319,7 +1319,7 @@ will read this file when a login attempt is made.
.It Pa ~/.ssh/id_ecdsa_sk.pub
.It Pa ~/.ssh/id_ed25519.pub
.It Pa ~/.ssh/id_ed25519_sk.pub
-.It Pa ~/.ssh/id_mldsa44-ed25519.pub
+.It Pa ~/.ssh/id_mldsa44_ed25519.pub
.It Pa ~/.ssh/id_rsa.pub
Contains the ECDSA, authenticator-hosted ECDSA, Ed25519,
authenticator-hosted Ed25519 or RSA public key for authentication.
diff --git a/ssh.1 b/ssh.1
index 42d483447..747a126a1 100644
--- a/ssh.1
+++ b/ssh.1
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh.1,v 1.451 2026/07/10 17:21:19 naddy Exp $
-.Dd $Mdocdate: July 10 2026 $
+.\" $OpenBSD: ssh.1,v 1.452 2026/07/11 11:15:03 naddy Exp $
+.Dd $Mdocdate: July 11 2026 $
.Dt SSH 1
.Os
.Sh NAME
@@ -304,9 +304,10 @@ The default is
.Pa ~/.ssh/id_rsa ,
.Pa ~/.ssh/id_ecdsa ,
.Pa ~/.ssh/id_ecdsa_sk ,
-.Pa ~/.ssh/id_ed25519
+.Pa ~/.ssh/id_ed25519 ,
+.Pa ~/.ssh/id_ed25519_sk
and
-.Pa ~/.ssh/id_ed25519_sk .
+.Pa ~/.ssh/id_mldsa44_ed25519 .
Identity files may also be specified on
a per-host basis in the configuration file.
It is possible to have multiple
@@ -877,6 +878,8 @@ This stores the private key in
(Ed25519),
.Pa ~/.ssh/id_ed25519_sk
(authenticator-hosted Ed25519),
+.Pa ~/.ssh/id_mldsa44_ed25519
+(MLDSA44-ED25519),
or
.Pa ~/.ssh/id_rsa
(RSA)
@@ -889,6 +892,8 @@ and stores the public key in
(Ed25519),
.Pa ~/.ssh/id_ed25519_sk.pub
(authenticator-hosted Ed25519),
+.Pa ~/.ssh/id_mldsa44_ed25519.pub
+(MLDSA44-ED25519),
or
.Pa ~/.ssh/id_rsa.pub
(RSA)
@@ -1488,6 +1493,7 @@ above.
.It Pa ~/.ssh/id_ecdsa_sk
.It Pa ~/.ssh/id_ed25519
.It Pa ~/.ssh/id_ed25519_sk
+.It Pa ~/.ssh/id_mldsa44_ed25519
.It Pa ~/.ssh/id_rsa
Contains the private key for authentication.
These files
@@ -1503,6 +1509,7 @@ sensitive part of this file using AES-128.
.It Pa ~/.ssh/id_ecdsa_sk.pub
.It Pa ~/.ssh/id_ed25519.pub
.It Pa ~/.ssh/id_ed25519_sk.pub
+.It Pa ~/.ssh/id_mldsa44_ed25519.pub
.It Pa ~/.ssh/id_rsa.pub
Contains the public key for authentication.
These files are not
diff --git a/ssh_config.5 b/ssh_config.5
index d7e09f994..bdaa49c81 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh_config.5,v 1.427 2026/07/10 17:21:19 naddy Exp $
-.Dd $Mdocdate: July 10 2026 $
+.\" $OpenBSD: ssh_config.5,v 1.428 2026/07/11 11:15:03 naddy Exp $
+.Dd $Mdocdate: July 11 2026 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@@ -1208,9 +1208,10 @@ The default is
.Pa ~/.ssh/id_rsa ,
.Pa ~/.ssh/id_ecdsa ,
.Pa ~/.ssh/id_ecdsa_sk ,
-.Pa ~/.ssh/id_ed25519
+.Pa ~/.ssh/id_ed25519 ,
+.Pa ~/.ssh/id_ed25519_sk
and
-.Pa ~/.ssh/id_ed25519_sk .
+.Pa ~/.ssh/id_mldsa44_ed25519 .
Additionally, any identities represented by the authentication agent
will be used for authentication unless
.Cm IdentitiesOnly
diff --git a/sshd.8 b/sshd.8
index 84763b3dd..a65aae75d 100644
--- a/sshd.8
+++ b/sshd.8
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: sshd.8,v 1.329 2026/07/10 17:21:19 naddy Exp $
-.Dd $Mdocdate: July 10 2026 $
+.\" $OpenBSD: sshd.8,v 1.330 2026/07/11 11:15:03 naddy Exp $
+.Dd $Mdocdate: July 11 2026 $
.Dt SSHD 8
.Os
.Sh NAME
@@ -486,6 +486,7 @@ You don't want to type them in; instead, copy the
.Pa id_ecdsa_sk.pub ,
.Pa id_ed25519.pub ,
.Pa id_ed25519_sk.pub ,
+.Pa id_mldsa44_ed25519 ,
or the
.Pa id_rsa.pub
file and edit it.
--
To stop receiving notification emails like this one, please contact
djm at mindrot.org.
More information about the openssh-commits
mailing list