From: naddy@openbsd.org Date: Fri, 10 Jul 2026 17:21:19 +0000 (+0000) Subject: upstream: document mldsa44-ed25519 host key and public key X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0e546c658bb3d9c7cf727e43efa4e29bbbafe5a3;p=thirdparty%2Fopenssh-portable.git upstream: document mldsa44-ed25519 host key and public key algorithm OpenBSD-Commit-ID: c519ba7408cfb2700d184c9441de4ff01ecda726 --- diff --git a/ssh-keysign.8 b/ssh-keysign.8 index 3b4d35b09..e53c55a71 100644 --- a/ssh-keysign.8 +++ b/ssh-keysign.8 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-keysign.8,v 1.18 2024/06/17 08:30:29 djm Exp $ +.\" $OpenBSD: ssh-keysign.8,v 1.19 2026/07/10 17:21:19 naddy Exp $ .\" .\" Copyright (c) 2002 Markus Friedl. All rights reserved. .\" @@ -22,7 +22,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: June 17 2024 $ +.Dd $Mdocdate: July 10 2026 $ .Dt SSH-KEYSIGN 8 .Os .Sh NAME @@ -63,6 +63,7 @@ is enabled. .Pp .It Pa /etc/ssh/ssh_host_ecdsa_key .It Pa /etc/ssh/ssh_host_ed25519_key +.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key .It Pa /etc/ssh/ssh_host_rsa_key These files contain the private parts of the host keys used to generate the digital signature. @@ -74,6 +75,7 @@ must be set-uid root if host-based authentication is used. .Pp .It Pa /etc/ssh/ssh_host_ecdsa_key-cert.pub .It Pa /etc/ssh/ssh_host_ed25519_key-cert.pub +.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key-cert.pub .It Pa /etc/ssh/ssh_host_rsa_key-cert.pub If these files exist, they are assumed to contain public certificate information corresponding with the private keys above. diff --git a/ssh.1 b/ssh.1 index b5892d51e..42d483447 100644 --- a/ssh.1 +++ b/ssh.1 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: ssh.1,v 1.450 2026/07/09 01:16:37 djm Exp $ -.Dd $Mdocdate: July 9 2026 $ +.\" $OpenBSD: ssh.1,v 1.451 2026/07/10 17:21:19 naddy Exp $ +.Dd $Mdocdate: July 10 2026 $ .Dt SSH 1 .Os .Sh NAME @@ -1541,6 +1541,7 @@ The file format and configuration options are described in .Pp .It Pa /etc/ssh/ssh_host_ecdsa_key .It Pa /etc/ssh/ssh_host_ed25519_key +.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key .It Pa /etc/ssh/ssh_host_rsa_key These files contain the private parts of the host keys and are used for host-based authentication. diff --git a/ssh_config.5 b/ssh_config.5 index 4ac0d3d45..d7e09f994 100644 --- a/ssh_config.5 +++ b/ssh_config.5 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: ssh_config.5,v 1.426 2026/07/01 00:52:31 djm Exp $ -.Dd $Mdocdate: July 1 2026 $ +.\" $OpenBSD: ssh_config.5,v 1.427 2026/07/10 17:21:19 naddy Exp $ +.Dd $Mdocdate: July 10 2026 $ .Dt SSH_CONFIG 5 .Os .Sh NAME @@ -476,7 +476,8 @@ ssh-ed25519,ecdsa-sha2-nistp256, ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, -rsa-sha2-512,rsa-sha2-256 +rsa-sha2-512,rsa-sha2-256, +ssh-mldsa44-ed25519@openssh.com .Ed .Pp If the specified list begins with a @@ -1060,12 +1061,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, +ssh-mldsa44-ed25519-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, -rsa-sha2-512,rsa-sha2-256 +rsa-sha2-512,rsa-sha2-256, +ssh-mldsa44-ed25519@openssh.com .Ed .Pp The @@ -1108,12 +1111,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, +ssh-mldsa44-ed25519-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com sk-ssh-ed25519@openssh.com, -rsa-sha2-512,rsa-sha2-256 +rsa-sha2-512,rsa-sha2-256, +ssh-mldsa44-ed25519@openssh.com .Ed .Pp If hostkeys are known for the destination host then this default is modified @@ -1708,12 +1713,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, +ssh-mldsa44-ed25519-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, -rsa-sha2-512,rsa-sha2-256 +rsa-sha2-512,rsa-sha2-256, +ssh-mldsa44-ed25519@openssh.com .Ed .Pp The list of available signature algorithms may also be obtained using diff --git a/sshd.8 b/sshd.8 index 7fbca776a..84763b3dd 100644 --- a/sshd.8 +++ b/sshd.8 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd.8,v 1.328 2025/10/04 21:41:35 naddy Exp $ -.Dd $Mdocdate: October 4 2025 $ +.\" $OpenBSD: sshd.8,v 1.329 2026/07/10 17:21:19 naddy Exp $ +.Dd $Mdocdate: July 10 2026 $ .Dt SSHD 8 .Os .Sh NAME @@ -181,7 +181,8 @@ is not run as root (as the normal host key files are normally not readable by anyone but root). The default is .Pa /etc/ssh/ssh_host_ecdsa_key , -.Pa /etc/ssh/ssh_host_ed25519_key +.Pa /etc/ssh/ssh_host_ed25519_key , +.Pa /etc/ssh/ssh_host_mldsa44_ed25519_key and .Pa /etc/ssh/ssh_host_rsa_key . It is possible to have multiple host key files for @@ -469,6 +470,8 @@ sk-ssh-ed25519@openssh.com .It ssh-ed25519 .It +ssh-mldsa44-ed25519@openssh.com +.It ssh-rsa .El .Pp @@ -959,6 +962,7 @@ rlogin/rsh. .Pp .It Pa /etc/ssh/ssh_host_ecdsa_key .It Pa /etc/ssh/ssh_host_ed25519_key +.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key .It Pa /etc/ssh/ssh_host_rsa_key These files contain the private parts of the host keys. These files should only be owned by root, readable only by root, and not @@ -969,6 +973,7 @@ does not start if these files are group/world-accessible. .Pp .It Pa /etc/ssh/ssh_host_ecdsa_key.pub .It Pa /etc/ssh/ssh_host_ed25519_key.pub +.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key.pub .It Pa /etc/ssh/ssh_host_rsa_key.pub These files contain the public parts of the host keys. These files should be world-readable but writable only by diff --git a/sshd_config b/sshd_config index 0f4a3a724..57ecabb86 100644 --- a/sshd_config +++ b/sshd_config @@ -1,4 +1,4 @@ -# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $ +# $OpenBSD: sshd_config,v 1.106 2026/07/10 17:21:19 naddy Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. @@ -18,6 +18,7 @@ #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key +#HostKey /etc/ssh/ssh_host_mldsa44_ed25519_key # Ciphers and keying #RekeyLimit default none diff --git a/sshd_config.5 b/sshd_config.5 index 39a864dee..0d9c944b4 100644 --- a/sshd_config.5 +++ b/sshd_config.5 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd_config.5,v 1.399 2026/06/24 06:55:12 djm Exp $ -.Dd $Mdocdate: June 24 2026 $ +.\" $OpenBSD: sshd_config.5,v 1.400 2026/07/10 17:21:19 naddy Exp $ +.Dd $Mdocdate: July 10 2026 $ .Dt SSHD_CONFIG 5 .Os .Sh NAME @@ -391,7 +391,8 @@ ssh-ed25519,ecdsa-sha2-nistp256, ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, -rsa-sha2-512,rsa-sha2-256 +rsa-sha2-512,rsa-sha2-256, +ssh-mldsa44-ed25519@openssh.com .Ed .Pp If the specified list begins with a @@ -803,12 +804,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, +ssh-mldsa44-ed25519-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, -rsa-sha2-512,rsa-sha2-256 +rsa-sha2-512,rsa-sha2-256, +ssh-mldsa44-ed25519@openssh.com .Ed .Pp The list of available signature algorithms may also be obtained using @@ -850,7 +853,8 @@ Specifies a file containing a private host key used by SSH. The defaults are .Pa /etc/ssh/ssh_host_ecdsa_key , -.Pa /etc/ssh/ssh_host_ed25519_key +.Pa /etc/ssh/ssh_host_ed25519_key , +.Pa /etc/ssh/ssh_host_mldsa44_ed25519_key and .Pa /etc/ssh/ssh_host_rsa_key . .Pp @@ -889,12 +893,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, +ssh-mldsa44-ed25519-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, -rsa-sha2-512,rsa-sha2-256 +rsa-sha2-512,rsa-sha2-256, +ssh-mldsa44-ed25519@openssh.com .Ed .Pp The list of available signature algorithms may also be obtained using @@ -1757,12 +1763,14 @@ sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, +ssh-mldsa44-ed25519-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, -rsa-sha2-512,rsa-sha2-256 +rsa-sha2-512,rsa-sha2-256, +ssh-mldsa44-ed25519@openssh.com .Ed .Pp The list of available signature algorithms may also be obtained using