diff --git a/myproposal.h b/myproposal.h index a2a1f991e..1e7aacfe8 100644 --- a/myproposal.h +++ b/myproposal.h @@ -1,4 +1,4 @@ -/* $OpenBSD: myproposal.h,v 1.80 2026/08/10 23:27:04 djm Exp $ */ +/* $OpenBSD: myproposal.h,v 1.81 2026/09/02 00:37:59 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. @@ -58,7 +58,7 @@ "sk-ecdsa-sha2-nistp256@openssh.com," \ "webauthn-sk-ecdsa-sha2-nistp256@openssh.com," \ "rsa-sha2-512," \ - "rsa-sha2-256" \ + "rsa-sha2-256" #define KEX_SERVER_ENCRYPT \ "chacha20-poly1305@openssh.com," \ diff --git a/ssh-keyscan.c b/ssh-keyscan.c index f093b0108..c43bebf12 100644 --- a/ssh-keyscan.c +++ b/ssh-keyscan.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keyscan.c,v 1.170 2026/08/10 23:24:03 djm Exp $ */ +/* $OpenBSD: ssh-keyscan.c,v 1.171 2026/09/02 00:37:59 djm Exp $ */ /* * Copyright 1995, 1996 by David Mazieres . * @@ -263,8 +263,8 @@ keygrab_ssh2(con *c) break; case KT_MLDSA44_ED25519: myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ? - "ssh-mldsa44-ed25519-cert-v01@openssh.com" : - "ssh-mldsa44-ed25519@openssh.com"; + "ssh-mldsa44-ed25519-cert" : + "ssh-mldsa44-ed25519"; break; case KT_ECDSA_SK: myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ? diff --git a/ssh-mldsa-eddsa.c b/ssh-mldsa-eddsa.c index 390b471db..26e2cdeca 100644 --- a/ssh-mldsa-eddsa.c +++ b/ssh-mldsa-eddsa.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-mldsa-eddsa.c,v 1.4 2026/07/30 07:40:48 brynet Exp $ */ +/* $OpenBSD: ssh-mldsa-eddsa.c,v 1.5 2026/09/02 00:37:59 djm Exp $ */ /* * Copyright (c) 2026 Damien Miller * @@ -36,7 +36,7 @@ #define COMPOSITE_PREFIX "CompositeAlgorithmSignatures2025" #define COMPOSITE_LABEL "COMPSIG-MLDSA44-Ed25519-SHA512" -#define SSH_MLDSA44_ED25519_ALG_NAME "ssh-mldsa44-ed25519@openssh.com" +#define SSH_MLDSA44_ED25519_ALG_NAME "ssh-mldsa44-ed25519" /* * raw_* functions implement the draft-ietf-lamps-pq-composite-sigs-18 @@ -483,7 +483,7 @@ const struct sshkey_impl_funcs sshkey_mldsa44_ed25519_funcs = { }; const struct sshkey_impl sshkey_mldsa44_ed25519_impl = { - /* .name = */ "ssh-mldsa44-ed25519@openssh.com", + /* .name = */ "ssh-mldsa44-ed25519", /* .shortname = */ "MLDSA44-ED25519", /* .sigalg = */ NULL, /* .type = */ KEY_MLDSA44_ED25519, @@ -495,7 +495,7 @@ const struct sshkey_impl sshkey_mldsa44_ed25519_impl = { }; const struct sshkey_impl sshkey_mldsa44_ed25519_cert_impl = { - /* .name = */ "ssh-mldsa44-ed25519-cert-v01@openssh.com", + /* .name = */ "ssh-mldsa44-ed25519-cert", /* .shortname = */ "MLDSA44-ED25519-CERT", /* .sigalg = */ NULL, /* .type = */ KEY_MLDSA44_ED25519_CERT, diff --git a/ssh_config.5 b/ssh_config.5 index bdaa49c81..3240732e7 100644 --- a/ssh_config.5 +++ b/ssh_config.5 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: ssh_config.5,v 1.428 2026/07/11 11:15:03 naddy Exp $ -.Dd $Mdocdate: July 11 2026 $ +.\" $OpenBSD: ssh_config.5,v 1.429 2026/09/02 00:37:59 djm Exp $ +.Dd $Mdocdate: September 2 2026 $ .Dt SSH_CONFIG 5 .Os .Sh NAME @@ -477,7 +477,7 @@ ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256, -ssh-mldsa44-ed25519@openssh.com +ssh-mldsa44-ed25519 .Ed .Pp If the specified list begins with a @@ -1061,14 +1061,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, -ssh-mldsa44-ed25519-cert-v01@openssh.com, +ssh-mldsa44-ed25519-cert, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256, -ssh-mldsa44-ed25519@openssh.com +ssh-mldsa44-ed25519 .Ed .Pp The @@ -1111,14 +1111,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, -ssh-mldsa44-ed25519-cert-v01@openssh.com, +ssh-mldsa44-ed25519-cert, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com sk-ssh-ed25519@openssh.com, rsa-sha2-512,rsa-sha2-256, -ssh-mldsa44-ed25519@openssh.com +ssh-mldsa44-ed25519 .Ed .Pp If hostkeys are known for the destination host then this default is modified @@ -1714,14 +1714,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, -ssh-mldsa44-ed25519-cert-v01@openssh.com, +ssh-mldsa44-ed25519-cert, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256, -ssh-mldsa44-ed25519@openssh.com +ssh-mldsa44-ed25519 .Ed .Pp The list of available signature algorithms may also be obtained using diff --git a/sshd.8 b/sshd.8 index f3cc41837..92842e345 100644 --- a/sshd.8 +++ b/sshd.8 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd.8,v 1.331 2026/08/15 01:10:32 dtucker Exp $ -.Dd $Mdocdate: August 15 2026 $ +.\" $OpenBSD: sshd.8,v 1.332 2026/09/02 00:37:59 djm Exp $ +.Dd $Mdocdate: September 2 2026 $ .Dt SSHD 8 .Os .Sh NAME @@ -470,7 +470,7 @@ sk-ssh-ed25519@openssh.com .It ssh-ed25519 .It -ssh-mldsa44-ed25519@openssh.com +ssh-mldsa44-ed25519 .It ssh-rsa .El diff --git a/sshd_config.5 b/sshd_config.5 index a7d300139..24a6f1e2a 100644 --- a/sshd_config.5 +++ b/sshd_config.5 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd_config.5,v 1.402 2026/08/08 07:27:54 djm Exp $ -.Dd $Mdocdate: August 8 2026 $ +.\" $OpenBSD: sshd_config.5,v 1.403 2026/09/02 00:37:59 djm Exp $ +.Dd $Mdocdate: September 2 2026 $ .Dt SSHD_CONFIG 5 .Os .Sh NAME @@ -392,7 +392,7 @@ ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256, -ssh-mldsa44-ed25519@openssh.com +ssh-mldsa44-ed25519 .Ed .Pp If the specified list begins with a @@ -804,14 +804,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, -ssh-mldsa44-ed25519-cert-v01@openssh.com, +ssh-mldsa44-ed25519-cert, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256, -ssh-mldsa44-ed25519@openssh.com +ssh-mldsa44-ed2551 .Ed .Pp The list of available signature algorithms may also be obtained using @@ -893,14 +893,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, -ssh-mldsa44-ed25519-cert-v01@openssh.com, +ssh-mldsa44-ed25519-cert, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256, -ssh-mldsa44-ed25519@openssh.com +ssh-mldsa44-ed25519 .Ed .Pp The list of available signature algorithms may also be obtained using @@ -1765,14 +1765,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, -ssh-mldsa44-ed25519-cert-v01@openssh.com, +ssh-mldsa44-ed25519-cert, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256, -ssh-mldsa44-ed25519@openssh.com +ssh-mldsa44-ed25519 .Ed .Pp The list of available signature algorithms may also be obtained using