upstream: document mldsa44-ed25519 host key and public key

algorithm

OpenBSD-Commit-ID: c519ba7408cfb2700d184c9441de4ff01ecda726

diff --git a/ssh-keysign.8 b/ssh-keysign.8
index 3b4d35b090c615b984131df0e60ca84b345f9287..e53c55a712f7594912ee7701c33d9e86cb9698e6 100644 (file)
--- a/ssh-keysign.8
+++ b/ssh-keysign.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-keysign.8,v 1.18 2024/06/17 08:30:29 djm Exp $
+.\" $OpenBSD: ssh-keysign.8,v 1.19 2026/07/10 17:21:19 naddy Exp $
 .\"
 .\" Copyright (c) 2002 Markus Friedl.  All rights reserved.
 .\"
@@ -22,7 +22,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 17 2024 $
+.Dd $Mdocdate: July 10 2026 $
 .Dt SSH-KEYSIGN 8
 .Os
 .Sh NAME
@@ -63,6 +63,7 @@ is enabled.
 .Pp
 .It Pa /etc/ssh/ssh_host_ecdsa_key
 .It Pa /etc/ssh/ssh_host_ed25519_key
+.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
 .It Pa /etc/ssh/ssh_host_rsa_key
 These files contain the private parts of the host keys used to
 generate the digital signature.
@@ -74,6 +75,7 @@ must be set-uid root if host-based authentication is used.
 .Pp
 .It Pa /etc/ssh/ssh_host_ecdsa_key-cert.pub
 .It Pa /etc/ssh/ssh_host_ed25519_key-cert.pub
+.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key-cert.pub
 .It Pa /etc/ssh/ssh_host_rsa_key-cert.pub
 If these files exist, they are assumed to contain public certificate
 information corresponding with the private keys above.

diff --git a/ssh.1 b/ssh.1
index b5892d51ef31c52ae96da6b70cebeada832a5830..42d48344760a1f0e95308db9fc6ce1b38904f245 100644 (file)
--- a/ssh.1
+++ b/ssh.1
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh.1,v 1.450 2026/07/09 01:16:37 djm Exp $
-.Dd $Mdocdate: July 9 2026 $
+.\" $OpenBSD: ssh.1,v 1.451 2026/07/10 17:21:19 naddy Exp $
+.Dd $Mdocdate: July 10 2026 $
 .Dt SSH 1
 .Os
 .Sh NAME
@@ -1541,6 +1541,7 @@ The file format and configuration options are described in
 .Pp
 .It Pa /etc/ssh/ssh_host_ecdsa_key
 .It Pa /etc/ssh/ssh_host_ed25519_key
+.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
 .It Pa /etc/ssh/ssh_host_rsa_key
 These files contain the private parts of the host keys
 and are used for host-based authentication.

diff --git a/ssh_config.5 b/ssh_config.5
index 4ac0d3d45d047bc24cf914ac5fe72e6ed96daa30..d7e09f99445b96706fa50a33963463d3af6d4354 100644 (file)
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.426 2026/07/01 00:52:31 djm Exp $
-.Dd $Mdocdate: July 1 2026 $
+.\" $OpenBSD: ssh_config.5,v 1.427 2026/07/10 17:21:19 naddy Exp $
+.Dd $Mdocdate: July 10 2026 $
 .Dt SSH_CONFIG 5
 .Os
 .Sh NAME
@@ -476,7 +476,8 @@ ssh-ed25519,ecdsa-sha2-nistp256,
 ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
 sk-ssh-ed25519@openssh.com,
 sk-ecdsa-sha2-nistp256@openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519@openssh.com
 .Ed
 .Pp
 If the specified list begins with a
@@ -1060,12 +1061,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 rsa-sha2-512-cert-v01@openssh.com,
 rsa-sha2-256-cert-v01@openssh.com,
+ssh-mldsa44-ed25519-cert-v01@openssh.com,
 ssh-ed25519,
 ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
 sk-ssh-ed25519@openssh.com,
 sk-ecdsa-sha2-nistp256@openssh.com,
 webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519@openssh.com
 .Ed
 .Pp
 The
@@ -1108,12 +1111,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 rsa-sha2-512-cert-v01@openssh.com,
 rsa-sha2-256-cert-v01@openssh.com,
+ssh-mldsa44-ed25519-cert-v01@openssh.com,
 ssh-ed25519,
 ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
 sk-ecdsa-sha2-nistp256@openssh.com,
 webauthn-sk-ecdsa-sha2-nistp256@openssh.com
 sk-ssh-ed25519@openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519@openssh.com
 .Ed
 .Pp
 If hostkeys are known for the destination host then this default is modified
@@ -1708,12 +1713,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 rsa-sha2-512-cert-v01@openssh.com,
 rsa-sha2-256-cert-v01@openssh.com,
+ssh-mldsa44-ed25519-cert-v01@openssh.com,
 ssh-ed25519,
 ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
 sk-ssh-ed25519@openssh.com,
 sk-ecdsa-sha2-nistp256@openssh.com,
 webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519@openssh.com
 .Ed
 .Pp
 The list of available signature algorithms may also be obtained using

diff --git a/sshd.8 b/sshd.8
index 7fbca776aa2253ba72c43acb90e1b16aa5b1acf3..84763b3dda53ad708a55f889b9f77dec3675170e 100644 (file)
--- a/sshd.8
+++ b/sshd.8
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd.8,v 1.328 2025/10/04 21:41:35 naddy Exp $
-.Dd $Mdocdate: October 4 2025 $
+.\" $OpenBSD: sshd.8,v 1.329 2026/07/10 17:21:19 naddy Exp $
+.Dd $Mdocdate: July 10 2026 $
 .Dt SSHD 8
 .Os
 .Sh NAME
@@ -181,7 +181,8 @@ is not run as root (as the normal
 host key files are normally not readable by anyone but root).
 The default is
 .Pa /etc/ssh/ssh_host_ecdsa_key ,
-.Pa /etc/ssh/ssh_host_ed25519_key
+.Pa /etc/ssh/ssh_host_ed25519_key ,
+.Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
 and
 .Pa /etc/ssh/ssh_host_rsa_key .
 It is possible to have multiple host key files for
@@ -469,6 +470,8 @@ sk-ssh-ed25519@openssh.com
 .It
 ssh-ed25519
 .It
+ssh-mldsa44-ed25519@openssh.com
+.It
 ssh-rsa
 .El
 .Pp
@@ -959,6 +962,7 @@ rlogin/rsh.
 .Pp
 .It Pa /etc/ssh/ssh_host_ecdsa_key
 .It Pa /etc/ssh/ssh_host_ed25519_key
+.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
 .It Pa /etc/ssh/ssh_host_rsa_key
 These files contain the private parts of the host keys.
 These files should only be owned by root, readable only by root, and not
@@ -969,6 +973,7 @@ does not start if these files are group/world-accessible.
 .Pp
 .It Pa /etc/ssh/ssh_host_ecdsa_key.pub
 .It Pa /etc/ssh/ssh_host_ed25519_key.pub
+.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key.pub
 .It Pa /etc/ssh/ssh_host_rsa_key.pub
 These files contain the public parts of the host keys.
 These files should be world-readable but writable only by

diff --git a/sshd_config b/sshd_config
index 0f4a3a7247a65e2d79efb4bd6ad56f8630247fb8..57ecabb8641e08a4985591fc1ee580670f02dd68 100644 (file)
--- a/sshd_config
+++ b/sshd_config
@@ -1,4 +1,4 @@
-#      $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $
+#      $OpenBSD: sshd_config,v 1.106 2026/07/10 17:21:19 naddy Exp $
 
 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.
@@ -18,6 +18,7 @@
 #HostKey /etc/ssh/ssh_host_rsa_key
 #HostKey /etc/ssh/ssh_host_ecdsa_key
 #HostKey /etc/ssh/ssh_host_ed25519_key
+#HostKey /etc/ssh/ssh_host_mldsa44_ed25519_key
 
 # Ciphers and keying
 #RekeyLimit default none

diff --git a/sshd_config.5 b/sshd_config.5
index 39a864dee6d73a7ad5110567e70da7df41a85f3b..0d9c944b45344d9408a4e53f1527758a7be9f260 100644 (file)
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.399 2026/06/24 06:55:12 djm Exp $
-.Dd $Mdocdate: June 24 2026 $
+.\" $OpenBSD: sshd_config.5,v 1.400 2026/07/10 17:21:19 naddy Exp $
+.Dd $Mdocdate: July 10 2026 $
 .Dt SSHD_CONFIG 5
 .Os
 .Sh NAME
@@ -391,7 +391,8 @@ ssh-ed25519,ecdsa-sha2-nistp256,
 ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
 sk-ssh-ed25519@openssh.com,
 sk-ecdsa-sha2-nistp256@openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519@openssh.com
 .Ed
 .Pp
 If the specified list begins with a
@@ -803,12 +804,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 rsa-sha2-512-cert-v01@openssh.com,
 rsa-sha2-256-cert-v01@openssh.com,
+ssh-mldsa44-ed25519-cert-v01@openssh.com,
 ssh-ed25519,
 ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
 sk-ssh-ed25519@openssh.com,
 sk-ecdsa-sha2-nistp256@openssh.com,
 webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519@openssh.com
 .Ed
 .Pp
 The list of available signature algorithms may also be obtained using
@@ -850,7 +853,8 @@ Specifies a file containing a private host key
 used by SSH.
 The defaults are
 .Pa /etc/ssh/ssh_host_ecdsa_key ,
-.Pa /etc/ssh/ssh_host_ed25519_key
+.Pa /etc/ssh/ssh_host_ed25519_key ,
+.Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
 and
 .Pa /etc/ssh/ssh_host_rsa_key .
 .Pp
@@ -889,12 +893,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 rsa-sha2-512-cert-v01@openssh.com,
 rsa-sha2-256-cert-v01@openssh.com,
+ssh-mldsa44-ed25519-cert-v01@openssh.com,
 ssh-ed25519,
 ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
 sk-ssh-ed25519@openssh.com,
 sk-ecdsa-sha2-nistp256@openssh.com,
 webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519@openssh.com
 .Ed
 .Pp
 The list of available signature algorithms may also be obtained using
@@ -1757,12 +1763,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 rsa-sha2-512-cert-v01@openssh.com,
 rsa-sha2-256-cert-v01@openssh.com,
+ssh-mldsa44-ed25519-cert-v01@openssh.com,
 ssh-ed25519,
 ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
 sk-ssh-ed25519@openssh.com,
 sk-ecdsa-sha2-nistp256@openssh.com,
 webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
-rsa-sha2-512,rsa-sha2-256
+rsa-sha2-512,rsa-sha2-256,
+ssh-mldsa44-ed25519@openssh.com
 .Ed
 .Pp
 The list of available signature algorithms may also be obtained using