[openssh-commits] [openssh] 03/04: upstream: IANA has allocated a non-vendor codepoint for
git+noreply at mindrot.org
git+noreply at mindrot.org
Wed Sep 2 19:14:59 AEST 2026
This is an automated email from the git hooks/post-receive script.
djm pushed a commit to branch master
in repository openssh.
commit 27eaaf0e0a88da77b4a46678152d55c04f629b60
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Wed Sep 2 00:37:59 2026 +0000
upstream: IANA has allocated a non-vendor codepoint for
ssh-mldsa44-ed25519, so use it instead of the vendored "@openssh.com" name.
Note: this replaces the vendored name, which was only marked as
experimental and not enabled by default.cw
If you have ssh-mldsa44-ed25519 at openssh.com keys manually configured
in sshd, then you will need to remove them from sshd_config and
restart.
OpenBSD-Commit-ID: bace7031444413274b6414df576c00f38801fd6e
---
myproposal.h | 4 ++--
ssh-keyscan.c | 6 +++---
ssh-mldsa-eddsa.c | 8 ++++----
ssh_config.5 | 18 +++++++++---------
sshd.8 | 6 +++---
sshd_config.5 | 18 +++++++++---------
6 files changed, 30 insertions(+), 30 deletions(-)
diff --git a/myproposal.h b/myproposal.h
index a2a1f991e..1e7aacfe8 100644
--- a/myproposal.h
+++ b/myproposal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: myproposal.h,v 1.80 2026/08/10 23:27:04 djm Exp $ */
+/* $OpenBSD: myproposal.h,v 1.81 2026/09/02 00:37:59 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -58,7 +58,7 @@
"sk-ecdsa-sha2-nistp256 at openssh.com," \
"webauthn-sk-ecdsa-sha2-nistp256 at openssh.com," \
"rsa-sha2-512," \
- "rsa-sha2-256" \
+ "rsa-sha2-256"
#define KEX_SERVER_ENCRYPT \
"chacha20-poly1305 at openssh.com," \
diff --git a/ssh-keyscan.c b/ssh-keyscan.c
index f093b0108..c43bebf12 100644
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keyscan.c,v 1.170 2026/08/10 23:24:03 djm Exp $ */
+/* $OpenBSD: ssh-keyscan.c,v 1.171 2026/09/02 00:37:59 djm Exp $ */
/*
* Copyright 1995, 1996 by David Mazieres <dm at lcs.mit.edu>.
*
@@ -263,8 +263,8 @@ keygrab_ssh2(con *c)
break;
case KT_MLDSA44_ED25519:
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
- "ssh-mldsa44-ed25519-cert-v01 at openssh.com" :
- "ssh-mldsa44-ed25519 at openssh.com";
+ "ssh-mldsa44-ed25519-cert" :
+ "ssh-mldsa44-ed25519";
break;
case KT_ECDSA_SK:
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
diff --git a/ssh-mldsa-eddsa.c b/ssh-mldsa-eddsa.c
index 390b471db..26e2cdeca 100644
--- a/ssh-mldsa-eddsa.c
+++ b/ssh-mldsa-eddsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-mldsa-eddsa.c,v 1.4 2026/07/30 07:40:48 brynet Exp $ */
+/* $OpenBSD: ssh-mldsa-eddsa.c,v 1.5 2026/09/02 00:37:59 djm Exp $ */
/*
* Copyright (c) 2026 Damien Miller <djm at mindrot.org>
*
@@ -36,7 +36,7 @@
#define COMPOSITE_PREFIX "CompositeAlgorithmSignatures2025"
#define COMPOSITE_LABEL "COMPSIG-MLDSA44-Ed25519-SHA512"
-#define SSH_MLDSA44_ED25519_ALG_NAME "ssh-mldsa44-ed25519 at openssh.com"
+#define SSH_MLDSA44_ED25519_ALG_NAME "ssh-mldsa44-ed25519"
/*
* raw_* functions implement the draft-ietf-lamps-pq-composite-sigs-18
@@ -483,7 +483,7 @@ const struct sshkey_impl_funcs sshkey_mldsa44_ed25519_funcs = {
};
const struct sshkey_impl sshkey_mldsa44_ed25519_impl = {
- /* .name = */ "ssh-mldsa44-ed25519 at openssh.com",
+ /* .name = */ "ssh-mldsa44-ed25519",
/* .shortname = */ "MLDSA44-ED25519",
/* .sigalg = */ NULL,
/* .type = */ KEY_MLDSA44_ED25519,
@@ -495,7 +495,7 @@ const struct sshkey_impl sshkey_mldsa44_ed25519_impl = {
};
const struct sshkey_impl sshkey_mldsa44_ed25519_cert_impl = {
- /* .name = */ "ssh-mldsa44-ed25519-cert-v01 at openssh.com",
+ /* .name = */ "ssh-mldsa44-ed25519-cert",
/* .shortname = */ "MLDSA44-ED25519-CERT",
/* .sigalg = */ NULL,
/* .type = */ KEY_MLDSA44_ED25519_CERT,
diff --git a/ssh_config.5 b/ssh_config.5
index bdaa49c81..3240732e7 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh_config.5,v 1.428 2026/07/11 11:15:03 naddy Exp $
-.Dd $Mdocdate: July 11 2026 $
+.\" $OpenBSD: ssh_config.5,v 1.429 2026/09/02 00:37:59 djm Exp $
+.Dd $Mdocdate: September 2 2026 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@@ -477,7 +477,7 @@ ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
rsa-sha2-512,rsa-sha2-256,
-ssh-mldsa44-ed25519 at openssh.com
+ssh-mldsa44-ed25519
.Ed
.Pp
If the specified list begins with a
@@ -1061,14 +1061,14 @@ sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
rsa-sha2-512-cert-v01 at openssh.com,
rsa-sha2-256-cert-v01 at openssh.com,
-ssh-mldsa44-ed25519-cert-v01 at openssh.com,
+ssh-mldsa44-ed25519-cert,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256 at openssh.com,
rsa-sha2-512,rsa-sha2-256,
-ssh-mldsa44-ed25519 at openssh.com
+ssh-mldsa44-ed25519
.Ed
.Pp
The
@@ -1111,14 +1111,14 @@ sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
rsa-sha2-512-cert-v01 at openssh.com,
rsa-sha2-256-cert-v01 at openssh.com,
-ssh-mldsa44-ed25519-cert-v01 at openssh.com,
+ssh-mldsa44-ed25519-cert,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ecdsa-sha2-nistp256 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256 at openssh.com
sk-ssh-ed25519 at openssh.com,
rsa-sha2-512,rsa-sha2-256,
-ssh-mldsa44-ed25519 at openssh.com
+ssh-mldsa44-ed25519
.Ed
.Pp
If hostkeys are known for the destination host then this default is modified
@@ -1714,14 +1714,14 @@ sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
rsa-sha2-512-cert-v01 at openssh.com,
rsa-sha2-256-cert-v01 at openssh.com,
-ssh-mldsa44-ed25519-cert-v01 at openssh.com,
+ssh-mldsa44-ed25519-cert,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256 at openssh.com,
rsa-sha2-512,rsa-sha2-256,
-ssh-mldsa44-ed25519 at openssh.com
+ssh-mldsa44-ed25519
.Ed
.Pp
The list of available signature algorithms may also be obtained using
diff --git a/sshd.8 b/sshd.8
index f3cc41837..92842e345 100644
--- a/sshd.8
+++ b/sshd.8
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: sshd.8,v 1.331 2026/08/15 01:10:32 dtucker Exp $
-.Dd $Mdocdate: August 15 2026 $
+.\" $OpenBSD: sshd.8,v 1.332 2026/09/02 00:37:59 djm Exp $
+.Dd $Mdocdate: September 2 2026 $
.Dt SSHD 8
.Os
.Sh NAME
@@ -470,7 +470,7 @@ sk-ssh-ed25519 at openssh.com
.It
ssh-ed25519
.It
-ssh-mldsa44-ed25519 at openssh.com
+ssh-mldsa44-ed25519
.It
ssh-rsa
.El
diff --git a/sshd_config.5 b/sshd_config.5
index a7d300139..24a6f1e2a 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: sshd_config.5,v 1.402 2026/08/08 07:27:54 djm Exp $
-.Dd $Mdocdate: August 8 2026 $
+.\" $OpenBSD: sshd_config.5,v 1.403 2026/09/02 00:37:59 djm Exp $
+.Dd $Mdocdate: September 2 2026 $
.Dt SSHD_CONFIG 5
.Os
.Sh NAME
@@ -392,7 +392,7 @@ ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
rsa-sha2-512,rsa-sha2-256,
-ssh-mldsa44-ed25519 at openssh.com
+ssh-mldsa44-ed25519
.Ed
.Pp
If the specified list begins with a
@@ -804,14 +804,14 @@ sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
rsa-sha2-512-cert-v01 at openssh.com,
rsa-sha2-256-cert-v01 at openssh.com,
-ssh-mldsa44-ed25519-cert-v01 at openssh.com,
+ssh-mldsa44-ed25519-cert,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256 at openssh.com,
rsa-sha2-512,rsa-sha2-256,
-ssh-mldsa44-ed25519 at openssh.com
+ssh-mldsa44-ed2551
.Ed
.Pp
The list of available signature algorithms may also be obtained using
@@ -893,14 +893,14 @@ sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
rsa-sha2-512-cert-v01 at openssh.com,
rsa-sha2-256-cert-v01 at openssh.com,
-ssh-mldsa44-ed25519-cert-v01 at openssh.com,
+ssh-mldsa44-ed25519-cert,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256 at openssh.com,
rsa-sha2-512,rsa-sha2-256,
-ssh-mldsa44-ed25519 at openssh.com
+ssh-mldsa44-ed25519
.Ed
.Pp
The list of available signature algorithms may also be obtained using
@@ -1765,14 +1765,14 @@ sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01 at openssh.com,
rsa-sha2-512-cert-v01 at openssh.com,
rsa-sha2-256-cert-v01 at openssh.com,
-ssh-mldsa44-ed25519-cert-v01 at openssh.com,
+ssh-mldsa44-ed25519-cert,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519 at openssh.com,
sk-ecdsa-sha2-nistp256 at openssh.com,
webauthn-sk-ecdsa-sha2-nistp256 at openssh.com,
rsa-sha2-512,rsa-sha2-256,
-ssh-mldsa44-ed25519 at openssh.com
+ssh-mldsa44-ed25519
.Ed
.Pp
The list of available signature algorithms may also be obtained using
--
To stop receiving notification emails like this one, please contact
djm at mindrot.org.
More information about the openssh-commits
mailing list