[Ssh] Re: PQ signatures - where do we want to end up?

[Roumen Petrov <[e-mail]>]

Hello Ryan,

На 28.04.26 г. в 19:00, Appel, Ryan написа:
> I do believe all the SSH RFCs only describe the way in which the public key is represented. I see no reference in any of the RSA or ECC definitions of keys that reference the way in which a private key is meant to be represented.
> 
> (https://datatracker.ietf.org/doc/html/rfc4253 - rsa and dsa)
> (https://datatracker.ietf.org/doc/html/rfc8709 - ed25519 and ed448)
> (https://datatracker.ietf.org/doc/html/rfc5656 - ecdsa)
> 
> ML-DSA public keys have to be represented as the fully expanded (compressed) key as defined in FIPS 204 due to the fact that the matrix A can be expanded from the public seed, and the vector t is computed from the private key (which can be stored in seed format as denoted by section 3.6.3 and 4).
> 
> Does it need to be the case where the newer specs specify the way in which ML-DSA keys (and others) are stored?

I do not think so.
Until now private keys are implementation dependent.
It seem to me cryptographic libraries store ML-DSA keys differently.

Only in PKCS#11 3.2 draft I could found ML-DSA standardised description.
The software that uses PKCS#11 ML-DSA keys is almost ready for use. It is tested by my PKIX-SSH MLDSA-DEMO implementation.


> 
> Thank you,
> 
> Ryan Appel, MS, BCS
> 
> Vice President; Security Architect
> GIS – Cyber Security Technology Architecture
> Bank of America
> 

Regards,
Roumen Petrov