[Ssh] Re: Supporting pure ML-DSA as hostkey and authkey

[Damien Miller <[e-mail]>]

On Mon, 27 Apr 2026, Watson Ladd wrote:

> Hello SSHM,
> 
> I would very much like to see adoption of the pure ML-DSA drafts for
> use as hostkey and authkey. Right now we have an issue where projects
> supporting SSH are reluctant to implement without an RFC due to a wish
> to only implement widely supported ciphers. There shouldn't be much of
> a problem in getting these drafts out given that ML-DSA drops in as a
> signature scheme. With recent news and the long time for customers and
> us to deploy and test this is pretty urgent for us.

FWIW I have a test implementation of hybrid ML-DSA 65 / Ed25519 for
OpenSSH using the draft-ietf-lamps-pq-composite-sigs construction
and was planning on writing it up as an I-D is anyone is interested.

https://github.com/djmdjm/openssh-portable-wip/pull/11

One thing that I think deserves some consideration for integrating
ML-DSA (and hybrids based on it) into SSH is the user of the context
parameter. Currently draft-sfluhrer-ssh-mldsa and my implementation
use the empty context string, but there might be some benefit to
using a context that relates to the role of the signature in the
SSH protocol, e.g. using "SSH-USERAUTH-PUBKEY" for public key
user authentication signatures, "SSH-HOST" for hostkey signatures
in KEX replies, etc.

This requires some more work in defining the specification, but
would improve SSH's mostly ad-hoc signature domain separation.

-d