From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: "D. J. Bernstein" <djb@cr.yp.to>, "ssh@ietf.org" <ssh@ietf.org>
Thread-Topic: [Ssh] Re: PQ signatures - where do we want to end up?
Thread-Index: AQHc1051j39rzG8Y3EuqRsw754p94LX1axSMgAFD1gCAAoxzQg==
Date: Fri, 1 May 2026 14:19:10 +0000
Message-ID: 
 <SYBPR01MB63363BB88E3B83F6C0AF8D48EE322@SYBPR01MB6336.ausprd01.prod.outlook.com>
References: 
 <SYBPR01MB6336F2F619074BA29A50E326EE342@SYBPR01MB6336.ausprd01.prod.outlook.com>
 <20260429232028.9577.qmail@cr.yp.to>
In-Reply-To: <20260429232028.9577.qmail@cr.yp.to>
Accept-Language: en-NZ, en-US
Content-Language: en-NZ
msip_labels: 
authentication-results: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=cs.auckland.ac.nz;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: SYBPR01MB6336:EE_|SYBPR01MB5886:EE_
x-ms-office365-filtering-correlation-id: ed1ef14a-ffb2-421d-8ae2-08dea78c9d5b
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: 
 BCL:0;ARA:13230040|376014|1800799024|10070799003|366016|786006|38070700021|18002099003|56012099003|22082099003;
x-microsoft-antispam-message-info: 
 RnILLMJT9ylBoFK8377A+22WbId0VAtkw+Vqa8pxG9q2+zjB7c0eZ8KCaShldXNiqbx5CtROo4oaS3tbID3QmVZ5WujNs7jKUGld0E5o8X6doudzQwYS7xcZ6fxWWyf1j0Ht//rC8FLm1VvkViJAnyyF0VXo85lgcaLYRSeDYgIgV9mLRnMCvqePmxWIKmo1joebzaWzE4QL3ZYh93fWWjBKKFd9fjDxtvvmUSPeaSVO3BwqecQKhubkYWucHrevUc2x66/sBE5R6K+EN7HG5TotIMPXaeQyJiV9Eyeklm8uF3IhUjr0SwPykWcrqHy5rgtPCSyaf8b5yWNaucbowOzPO4mtOmlomOS6bo7v1f6OkLdY1EWEzNSBueCgVANS81d0Vk1obUq+0h5XOknASi5QwCIjp3IruaRM+YcRcAf5qYPYosGQPpQSYexlhl0JKYr2qvzXuVOY1s1AiS5nJld7Ho8BXSjAqg5W4Tu+mha3XuflAmVa5ctrOkQVmQ/XDgB17Xm6oV1r68ERKHcvnh0jayRRoXt5tlahwrSbUrbKI7DroOHtO6L5M7jyz4tIw0NNv4BFcitNWK9kvtXMZIdICmL1+yA+YsAiWNXrdFo63y5iKibS3r2fbyKqpNjHiGs5fleqTgea2veHbZbePKDlWeZs9y/Rlkxc14S6c0PYnZasrxsrsfHzxU/sG3KW
x-forefront-antispam-report: 
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SYBPR01MB6336.ausprd01.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(1800799024)(10070799003)(366016)(786006)(38070700021)(18002099003)(56012099003)(22082099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: 
 =?iso-8859-1?Q?AM+fqo/7g5Wbp9IHt14Ket5O8XSuALimnVU0Hm3Ltp4d8vjNCCTWuscSbe?=
 =?iso-8859-1?Q?+5liUk+XsHQSVxWivQg5zhpmXCe9PnW3fAcIyfr3eERcGfkNyCLBboX5Ch?=
 =?iso-8859-1?Q?3vW3j/Pk7S4kdUzeATXzl/oz5yhe5KWrpf970adeYfnIddg7sSWcEwTCjF?=
 =?iso-8859-1?Q?UYYHDGB5SuJK7ESx5bGzcNLKoigoagfh00nuPvO1PdX+vI/N7y84x5crKx?=
 =?iso-8859-1?Q?k+G7GTx7v4ydCKfx7H+zESwS/TaDsx85Kt81SQ3wT9jo3t5Jm+iZ+zRTd5?=
 =?iso-8859-1?Q?lk3kZL5iFuBCHRgGO5ndhg5uDnBBsdYUDzRYcW8fTU8BLNtRn7M0lw2Sfj?=
 =?iso-8859-1?Q?eZmc61xxWwAYqg8kzLZ2AkARMz75Hy8mIwd1B9hD026y3RpuhiwdfvYISl?=
 =?iso-8859-1?Q?RKGfAt6tpFs26+LTovacc099iqnu2FJQtI0j9YcaUNQOLWuPb+sxRjWy6k?=
 =?iso-8859-1?Q?ZPP+70IdxeBS8RIbpqxHhOR5j55dwOZ97xxuQjOTilLTrKwuAim2e+fSzO?=
 =?iso-8859-1?Q?hK5WoIQ6rYLQw3Ri5XJCMXE1QFSYawq0oct9Jqwy4RWvIMNhdtsnNHSd7e?=
 =?iso-8859-1?Q?EM6mjPegHHn3iY1Hsvdy2ayJLS/8k5AjQbmUL+ubvYU+NcDRj7Zth53emj?=
 =?iso-8859-1?Q?4OV8gF0whPDugOhXXKZ/T6xiFiTup9ZRXybN1sl1JHHGqvgS934UVXFbDL?=
 =?iso-8859-1?Q?ucD0akTLH2VtpkAcm06T7SoGH490RxHALRYY1anfqM+Iygu4gA7opdUjEi?=
 =?iso-8859-1?Q?6BBgdpF9CB1HSfPk9ZEWm+Kmky3d4nPEBOy0U9eM0q3TEc2y6Ph7UvEc/P?=
 =?iso-8859-1?Q?3dg+ACbHFKdo3d3rEOzzF0DrDoDV2T014cM7cS8riJdY4LsaLgusifinUp?=
 =?iso-8859-1?Q?fNYyVYjdwYFXB6iV2QAg3l3Vca374GiJctsM+/Iolf7i6TzErBQuLZpTqM?=
 =?iso-8859-1?Q?WljVOge9bfLxaIrBJbIWZzvbJFJLlqxU6NZeeU7To3tPLNOMG49SZFCQqx?=
 =?iso-8859-1?Q?uDrnHMwY/0DahwUHcGAg9xNQ0UhE62SSVfTwi5r25Pjxx5bV7P5CUegPcU?=
 =?iso-8859-1?Q?nx5JxTSjNdtjK9noMOArn2kC5WiY0OdCMh/k0mU14RRMmIqcHO20dTaByz?=
 =?iso-8859-1?Q?/8RvoPriXYXCHYTfTytFS8vW3lW6WXbfeAApGD94YUcBKu8gziHJQJrKj/?=
 =?iso-8859-1?Q?W/EngMq1o0N5Mgo8k+8Qxh7SziSHbgYpGDtZHFWh9k9fL2VUO/6FmRsAAg?=
 =?iso-8859-1?Q?pgDtvlXEuiyrMuWgpWQPt7M3rpss/clWJAhmTpeEELMbTXBvldsQ3cSxNF?=
 =?iso-8859-1?Q?V6KDrfEq6/VMN7PFB2h8tUUhmCMkQUmTPiEGSGeuDnbFnBdMBDBIW3VrS9?=
 =?iso-8859-1?Q?HQkuuy7IS3j7sNjQ0IC6E0VszFsr6S/Axs+NPtdktx1vwj66Km3XNHjlWR?=
 =?iso-8859-1?Q?NE+8YEGXIxQXfl+k9ifgFbPf92b1aXqH8wdPSWQ9/UYIsUDelBWBsErr+7?=
 =?iso-8859-1?Q?P8BTvzSATGGOF+/j/GNWB87epogbnu5W2RZdryEgO4UCEVY2+0OMBof4JV?=
 =?iso-8859-1?Q?foSJHufNROhyZocpARB0kHq5fAOnhhmBBF+7MrMkQHKQ7UbzGuig4Vv8QR?=
 =?iso-8859-1?Q?GBHDruEyZw5w9irCzLUxx+WjOAkER9OVTsA970aBgDhxZ5bmEovTLnb9B+?=
 =?iso-8859-1?Q?Ib8pjZWfHVnOsIH/6XGHzuW3f9W173nsf5atOD58BuevKe0SgfWtLMRpRe?=
 =?iso-8859-1?Q?rqr7q1AcgRU6qpJ57M3NqAMbTQ+04AjwIytutwgr5P6cPE/kiAnj/vKud0?=
 =?iso-8859-1?Q?47X6rbHBihk850PiNvjn0MjMfgeL+JgAp3sYf0RwBDN3JLPz5XHCVPhSx1?=
 =?iso-8859-1?Q?hC?=
x-ms-exchange-antispam-messagedata-1: 22VAkpkNu2XAug==
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: cs.auckland.ac.nz
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SYBPR01MB6336.ausprd01.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 ed1ef14a-ffb2-421d-8ae2-08dea78c9d5b
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 May 2026 14:19:10.9899
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d1b36e95-0d50-42e9-958f-b63fa906beaa
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 
 rWBgFxZt6FV1gW18ek0DJ89/H6oIjNdWqTqT6laib6/f9LhsE0MWGcy6Co4arEipu/QtI2N9wdu5AY8QaGJOiH+Ki7dHB0ny3ALRbsGoo/Q=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SYBPR01MB5886
Message-ID-Hash: L3MZIHXQPNKONYDIFJVOHDZULZ65WHQS
X-Message-ID-Hash: L3MZIHXQPNKONYDIFJVOHDZULZ65WHQS
X-MailFrom: pgut001@cs.auckland.ac.nz
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency;
 loop; banned-address; member-moderation; nonmember-moderation; administrivia;
 implicit-dest; max-recipients; max-size; news-moderation; no-subject;
 digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: =?utf-8?q?=5BSsh=5D_Re=3A_PQ_signatures_-_where_do_we_want_to_end_up=3F?=
List-Id: "The SSH mail list will allow discussions on improving aspects of the
 Secure Shell (SSH) protocol." <ssh.ietf.org>
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/ssh/II2SknZgT85vLBqlHpeFd28VPj8>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ssh>
List-Help: <mailto:ssh-request@ietf.org?subject=help>
List-Owner: <mailto:ssh-owner@ietf.org>
List-Post: <mailto:ssh@ietf.org>
List-Subscribe: <mailto:ssh-join@ietf.org>
List-Unsubscribe: <mailto:ssh-leave@ietf.org>

D. J. Bernstein <djb@cr.yp.to> writes:=0A=
=0A=
>  "Cryptanalytic capabilities are now coming on line"=0A=
=0A=
That's just handwaving, it doesn't tell you anything about what they're rea=
lly=0A=
doing.  In particular people expect the NSA to do codebreaking so they say=
=0A=
they're doing codebreaking, and everyone's so busy focusing on that that no=
-=0A=
one notices that their Cisco routers have had supplementary functionality=
=0A=
added to them during the shipping process.  The NSA is reading our traffic?=
=0A=
Must be those cryptanalytic capabilities they keep going on about.  If you=
=0A=
look at the NSA Fun Toys catalogue, that was all crypto being bypassed, not=
=0A=
broken.=0A=
=0A=
And as if on demand:=0A=
=0A=
 https://copy.fail/=0A=
=0A=
 The same 732-byte Python script roots every Linux distribution shipped sin=
ce=0A=
 2017 [...] The kernel crypto API (AF_ALG) ships enabled in essentially eve=
ry=0A=
 mainstream distro's default config, so the entire 2017 -> patch window is =
in=0A=
 play out of the box.=0A=
=0A=
That's not just "Crypto is bypassed, not attacked", it's "It's the crypto t=
hat=0A=
enables the attack in the first place".=0A=
=0A=
>  "Flame is the first known example of an MD5 collision attack being used=
=0A=
>   maliciously in a real-world environment"=0A=
=0A=
Yup, that just shows how truly rare it is, an algorithm that was known at t=
he=0A=
time to be insecure/broken for between ten and twenty years (depending on=
=0A=
whether you start the count at pseudocollisions or actual ones) still had n=
o=0A=
attacks for, well, ten to twenty years.=0A=
=0A=
Of the algorithm shopping list you gave, none of them are known to be broke=
n=0A=
right now, let alone have been known to be broken for between ten and twent=
y=0A=
years.  So it's not asking someone to deploy or keep using a known-broken=
=0A=
algorithm as MD5 was, it's asking someone to deploy... I can't remember wha=
t=0A=
the whole list was but let's say a dozen different algorithms all of which=
=0A=
offer security that's identical as far as an attacker is concerned, in the=
=0A=
same way that AES-128, AES-192, and AES-256 are identical, SHA-256, SHA-384=
=0A=
and SHA-512 are identical, and ECDSA P256, P384, and P521 are identical -=
=0A=
there's no attack on any of them, and it's irrelevant whether you use -128,=
=0A=
-256, or -512 as far as the attacker is concerned.  You do however lose a f=
air=0A=
bit of performance and, in embedded, hardware support, if you go for the mo=
re=0A=
exotic options.=0A=
=0A=
Thus my argument that all we need is a single combination, ML-DSA (the most=
=0A=
common/widely-supported) and Ed25519 (for when ML-DSA is broken).  You don'=
t=0A=
need every exotic option under the sun just because this other one over the=
re=0A=
has a slightly tighter bound on its mathematical proof.  The attackers won'=
t=0A=
notice, or care.=0A=
=0A=
Peter.=