dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: IANA has allocated a non-vendor codepoint for

Browse Source 
ssh-mldsa44-ed25519, so use it instead of the vendored "@openssh.com" name.

Note: this replaces the vendored name, which was only marked as
experimental and not enabled by default.cw

If you have ssh-mldsa44-ed25519@openssh.com keys manually configured
in sshd, then you will need to remove them from sshd_config and
restart.

OpenBSD-Commit-ID: bace7031444413274b6414df576c00f38801fd6e
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-09-02 19:14:52 +10:00
1 parent a17337d558
commit 27eaaf0e0a
6 files changed
+30 -30
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

myproposal.h
+2 -2
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: myproposal.h,v 1.80 2026/08/10 23:27:04 djm Exp $ */
/* $OpenBSD: myproposal.h,v 1.81 2026/09/02 00:37:59 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -58,7 +58,7 @@
"sk-ecdsa-sha2-nistp256@openssh.com," \
"webauthn-sk-ecdsa-sha2-nistp256@openssh.com," \
"rsa-sha2-512," \
"rsa-sha2-256" \
"rsa-sha2-256"
#define KEX_SERVER_ENCRYPT \
"chacha20-poly1305@openssh.com," \
ssh-keyscan.c
+3 -3
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: ssh-keyscan.c,v 1.170 2026/08/10 23:24:03 djm Exp $ */
/* $OpenBSD: ssh-keyscan.c,v 1.171 2026/09/02 00:37:59 djm Exp $ */
/*
* Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
*
@@ -263,8 +263,8 @@ keygrab_ssh2(con *c)
break;
case KT_MLDSA44_ED25519:
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
"ssh-mldsa44-ed25519-cert-v01@openssh.com" :
"ssh-mldsa44-ed25519@openssh.com";
"ssh-mldsa44-ed25519-cert" :
"ssh-mldsa44-ed25519";
break;
case KT_ECDSA_SK:
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
ssh-mldsa-eddsa.c
+4 -4
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: ssh-mldsa-eddsa.c,v 1.4 2026/07/30 07:40:48 brynet Exp $ */
/* $OpenBSD: ssh-mldsa-eddsa.c,v 1.5 2026/09/02 00:37:59 djm Exp $ */
/*
* Copyright (c) 2026 Damien Miller <djm@mindrot.org>
*
@@ -36,7 +36,7 @@
#define COMPOSITE_PREFIX "CompositeAlgorithmSignatures2025"
#define COMPOSITE_LABEL "COMPSIG-MLDSA44-Ed25519-SHA512"
#define SSH_MLDSA44_ED25519_ALG_NAME "ssh-mldsa44-ed25519@openssh.com"
#define SSH_MLDSA44_ED25519_ALG_NAME "ssh-mldsa44-ed25519"
/*
* raw_* functions implement the draft-ietf-lamps-pq-composite-sigs-18
@@ -483,7 +483,7 @@ const struct sshkey_impl_funcs sshkey_mldsa44_ed25519_funcs = {
};
const struct sshkey_impl sshkey_mldsa44_ed25519_impl = {
/* .name = */ "ssh-mldsa44-ed25519@openssh.com",
/* .name = */ "ssh-mldsa44-ed25519",
/* .shortname = */ "MLDSA44-ED25519",
/* .sigalg = */ NULL,
/* .type = */ KEY_MLDSA44_ED25519,
@@ -495,7 +495,7 @@ const struct sshkey_impl sshkey_mldsa44_ed25519_impl = {
};
const struct sshkey_impl sshkey_mldsa44_ed25519_cert_impl = {
/* .name = */ "ssh-mldsa44-ed25519-cert-v01@openssh.com",
/* .name = */ "ssh-mldsa44-ed25519-cert",
/* .shortname = */ "MLDSA44-ED25519-CERT",
/* .sigalg = */ NULL,
/* .type = */ KEY_MLDSA44_ED25519_CERT,
ssh_config.5
+9 -9
View File
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" $OpenBSD: ssh_config.5,v 1.428 2026/07/11 11:15:03 naddy Exp $
.Dd $Mdocdate: July 11 2026 $
.\" $OpenBSD: ssh_config.5,v 1.429 2026/09/02 00:37:59 djm Exp $
.Dd $Mdocdate: September 2 2026 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@@ -477,7 +477,7 @@ ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519@openssh.com,
sk-ecdsa-sha2-nistp256@openssh.com,
rsa-sha2-512,rsa-sha2-256,
ssh-mldsa44-ed25519@openssh.com
ssh-mldsa44-ed25519
.Ed
.Pp
If the specified list begins with a
@@ -1061,14 +1061,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,
rsa-sha2-256-cert-v01@openssh.com,
ssh-mldsa44-ed25519-cert-v01@openssh.com,
ssh-mldsa44-ed25519-cert,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519@openssh.com,
sk-ecdsa-sha2-nistp256@openssh.com,
webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
rsa-sha2-512,rsa-sha2-256,
ssh-mldsa44-ed25519@openssh.com
ssh-mldsa44-ed25519
.Ed
.Pp
The
@@ -1111,14 +1111,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,
rsa-sha2-256-cert-v01@openssh.com,
ssh-mldsa44-ed25519-cert-v01@openssh.com,
ssh-mldsa44-ed25519-cert,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ecdsa-sha2-nistp256@openssh.com,
webauthn-sk-ecdsa-sha2-nistp256@openssh.com
sk-ssh-ed25519@openssh.com,
rsa-sha2-512,rsa-sha2-256,
ssh-mldsa44-ed25519@openssh.com
ssh-mldsa44-ed25519
.Ed
.Pp
If hostkeys are known for the destination host then this default is modified
@@ -1714,14 +1714,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,
rsa-sha2-256-cert-v01@openssh.com,
ssh-mldsa44-ed25519-cert-v01@openssh.com,
ssh-mldsa44-ed25519-cert,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519@openssh.com,
sk-ecdsa-sha2-nistp256@openssh.com,
webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
rsa-sha2-512,rsa-sha2-256,
ssh-mldsa44-ed25519@openssh.com
ssh-mldsa44-ed25519
.Ed
.Pp
The list of available signature algorithms may also be obtained using
sshd.8
+3 -3
View File
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" $OpenBSD: sshd.8,v 1.331 2026/08/15 01:10:32 dtucker Exp $
.Dd $Mdocdate: August 15 2026 $
.\" $OpenBSD: sshd.8,v 1.332 2026/09/02 00:37:59 djm Exp $
.Dd $Mdocdate: September 2 2026 $
.Dt SSHD 8
.Os
.Sh NAME
@@ -470,7 +470,7 @@ sk-ssh-ed25519@openssh.com
.It
ssh-ed25519
.It
ssh-mldsa44-ed25519@openssh.com
ssh-mldsa44-ed25519
.It
ssh-rsa
.El
sshd_config.5
+9 -9
View File
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" $OpenBSD: sshd_config.5,v 1.402 2026/08/08 07:27:54 djm Exp $
.Dd $Mdocdate: August 8 2026 $
.\" $OpenBSD: sshd_config.5,v 1.403 2026/09/02 00:37:59 djm Exp $
.Dd $Mdocdate: September 2 2026 $
.Dt SSHD_CONFIG 5
.Os
.Sh NAME
@@ -392,7 +392,7 @@ ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519@openssh.com,
sk-ecdsa-sha2-nistp256@openssh.com,
rsa-sha2-512,rsa-sha2-256,
ssh-mldsa44-ed25519@openssh.com
ssh-mldsa44-ed25519
.Ed
.Pp
If the specified list begins with a
@@ -804,14 +804,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,
rsa-sha2-256-cert-v01@openssh.com,
ssh-mldsa44-ed25519-cert-v01@openssh.com,
ssh-mldsa44-ed25519-cert,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519@openssh.com,
sk-ecdsa-sha2-nistp256@openssh.com,
webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
rsa-sha2-512,rsa-sha2-256,
ssh-mldsa44-ed25519@openssh.com
ssh-mldsa44-ed2551
.Ed
.Pp
The list of available signature algorithms may also be obtained using
@@ -893,14 +893,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,
rsa-sha2-256-cert-v01@openssh.com,
ssh-mldsa44-ed25519-cert-v01@openssh.com,
ssh-mldsa44-ed25519-cert,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519@openssh.com,
sk-ecdsa-sha2-nistp256@openssh.com,
webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
rsa-sha2-512,rsa-sha2-256,
ssh-mldsa44-ed25519@openssh.com
ssh-mldsa44-ed25519
.Ed
.Pp
The list of available signature algorithms may also be obtained using
@@ -1765,14 +1765,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,
rsa-sha2-256-cert-v01@openssh.com,
ssh-mldsa44-ed25519-cert-v01@openssh.com,
ssh-mldsa44-ed25519-cert,
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
sk-ssh-ed25519@openssh.com,
sk-ecdsa-sha2-nistp256@openssh.com,
webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
rsa-sha2-512,rsa-sha2-256,
ssh-mldsa44-ed25519@openssh.com
ssh-mldsa44-ed25519
.Ed
.Pp
The list of available signature algorithms may also be obtained using