IETF Logo Mail Archive

[Ssh] Re: Supporting pure ML-DSA as hostkey and authkey

Filippo Valsorda <filippo@ml.filippo.io> Wed, 29 April 2026 22:41 UTC

Return-Path: <filippo@ml.filippo.io>
X-Original-To: ssh@mail2.ietf.org
Delivered-To: ssh@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 13000E601F85 for <ssh@mail2.ietf.org>; Wed, 29 Apr 2026 15:41:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1777502475; bh=bEXkpS8NLiv6Wb+VltCyIv2RYSXWDMNDv80kxy+uj0g=; h=Date:From:To:Cc:In-Reply-To:References:Subject; b=k2gfeqbuq67l6MvQm5lhVf+XIkzmAUe2xUyh6+ZfChknBEMGsO8un20kywB1gKE2L 5HSeH7emJoPKWJUCCA+ivZJBIvSSxE+ZJnxIUrVAbqk3CmbNebVaaQlQd8aDN2Mag9 s45c5Q0WxkzU57rHWf5S/BiYSWukPS+tlAegYnYA=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.698
X-Spam-Level:
X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=filippo.io header.b="Ll7vB21T"; dkim=pass (2048-bit key) header.d=messagingengine.com header.b="PbaceHW5"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZMKDxwzHqcwe for <ssh@mail2.ietf.org>; Wed, 29 Apr 2026 15:41:11 -0700 (PDT)
Received: from fout-a1-smtp.messagingengine.com (fout-a1-smtp.messagingengine.com [103.168.172.144]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 165E9E601EA1 for <SSH@ietf.org>; Wed, 29 Apr 2026 15:40:17 -0700 (PDT)
Received: from phl-compute-09.internal (phl-compute-09.internal [10.202.2.49]) by mailfout.phl.internal (Postfix) with ESMTP id D1003EC0198; Wed, 29 Apr 2026 18:40:16 -0400 (EDT)
Received: from phl-imap-02 ([10.202.2.81]) by phl-compute-09.internal (MEProxy); Wed, 29 Apr 2026 18:40:16 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=filippo.io; h=cc :cc:content-transfer-encoding:content-type:content-type:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to; s=fm1; t=1777502416; x=1777588816; bh=D5zLfIiAOhFP3kPG4zIqql9X6VjTaO9Wllu7J5ULbjI=; b= Ll7vB21T5PP4t3WPLUL/ui7VTF0+ni9FvphG0i178TXWhD2LoqXBQkcfQnoBBSfg 4MGqFhGU2piAJVGjjAPDtUXVL63xILTw9a/px/UNULJLqRkwDjkrWUfuwePOEC1m n4059RBmpPYZISD2AvgcetgohvpQ+OE5mFc2lrmzu5m7c2/KHiL9upPr6h63cVzo 280vWb/Y7bDFAjM6DtBKjAbinroYcqqs84XAsxB80qWIX/FFU2pq7zZw/VTRqpBp DtW2H9HDIifqWQDPFJRPphTSXlEp8qmPURsg3AbN7PmjEWx7JRwIXGztSVsy2V2z JGkutxJQLpex6gdA6rBSww==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1777502416; x= 1777588816; bh=D5zLfIiAOhFP3kPG4zIqql9X6VjTaO9Wllu7J5ULbjI=; b=P baceHW5sZUc/FMsEOnxR/CzIDK7mc/3PQ4PLiZk6/CYk7A2peS5YG4JxrV3wua5x Eotu0FO2zlQKSx4DQisf5vAoCQDm/S8u0kaE5iW1PvHhLnpeA1u67X+bbBGWbAne bRMvldpHHAbEw2RVyPxlHhzeIVzoMOOvT4DIvHOz2xnA22kza8ttcOmjDuEEVCMi ThmvVLXHZSHIp/gQ92FiFuneVSmu/VKkthFQnTSWMSCX4+Aegiyws6G29aQSjrCx NCFeUeaNn5ZyCmTgD3KBMfVs3L8Tka66/HaRhUuccGzUbSiOGG6W7x7SURJUtD0C X7Ni9enNXmp/NFiCpfPwA==
X-ME-Sender: <xms:0IjyaXpzFZ1h27peEMs_xzBHqNh2fy5Wu1CwSURhwuqqUr6aRUx4Bw> <xme:0Ijyacea6EPGvvlkjSPdNu-O2dLDAqXq-2pLnAvYehnZ26hG4ffv9Vgd4BFv19fZK DA1Ag1szb6qtm2UGPbH0_JWUKiFNmbzIKIJKXNyoHDfkbqoKejv7A>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefhedrtddtgdekheeiiecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpuffrtefokffrpgfnqfghnecuuegr ihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjug hrpefoggffhffvvefkjghfufgtgfesthhqredtredtjeenucfhrhhomhepfdfhihhlihhp phhoucggrghlshhorhgurgdfuceofhhilhhiphhpohesmhhlrdhfihhlihhpphhordhioh eqnecuggftrfgrthhtvghrnhepgfevgeffteeijeegleduhfelleeigeegtdegvdekhfeh vefgleelheehheeuhfetnecuffhomhgrihhnpeihuhgsihgtohdrtghomhdpghhithhhuh gsrdgtohhmpdgrphhplhgvrdgtohhmnecuvehluhhsthgvrhfuihiivgeptdenucfrrghr rghmpehmrghilhhfrhhomhepfhhilhhiphhpohesmhhlrdhfihhlihhpphhordhiohdpnh gspghrtghpthhtohepgedpmhhouggvpehsmhhtphhouhhtpdhrtghpthhtohepnhhitgho lhgrrdhmuhhrihhnohesghhmrghilhdrtghomhdprhgtphhtthhopeifrghtshhonhgslh gruggusehgmhgrihhlrdgtohhmpdhrtghpthhtohepshhshhesihgvthhfrdhorhhgpdhr tghpthhtohepughjmhesmhhinhgurhhothdrohhrgh
X-ME-Proxy: <xmx:0IjyacOeLvMUbC_lMzhE-iZ-Mo0rGlKv2TKHK_3oOol6qNjvU4cQow> <xmx:0IjyaZ-Lb0bbTnVC7NYFRa6XHUwS714EoWaRNq8MJYyKRQSfDSDyqA> <xmx:0IjyaYRabTtZr04dWhHcKESUcbIMy56TIy4d4rhhU2ERcuZYCOyTvA> <xmx:0IjyaTkwsk-DHPy-Zj1dCTBRtflnNET6xER47n9mnvEEDvBd97ocUA> <xmx:0IjyaT-n0uMIpJ950zmMJvr08vhzhY3zli3JgPv8LzbBF4zXcww40s8h>
Feedback-ID: i2e91459c:Fastmail
Received: by mailuser.phl.internal (Postfix, from userid 501) id 1341A700065; Wed, 29 Apr 2026 18:40:16 -0400 (EDT)
X-Mailer: MessagingEngine.com Webmail Interface
MIME-Version: 1.0
X-ThreadId: A_AVEdQZ0ntZ
Date: Thu, 30 Apr 2026 00:38:01 +0200
From: Filippo Valsorda <filippo@ml.filippo.io>
To: Damien Miller <djm@mindrot.org>
Message-Id: <bbd44eab-e980-4a0c-9c78-68e8532c3788@app.fastmail.com>
In-Reply-To: <b3047f6f-1b17-4832-86b2-d2878221ea06@app.fastmail.com>
References: <68bc138c-ccfc-2d97-0f25-64271655c23b@mindrot.org> <CACsn0ckzxMZRN6MxmkUjByzzgbgJdH3eRxVT1dA37TYQHeUq2Q%mail.gmail.com@mailhub.eait.uq.edu.au> <461a8358-8bd8-4f45-f8f3-073f993fb18f@mindrot.org> <ba9669a6-65a6-4276-8306-bd55ef0d146f@app.fastmail.com> <534410e1-5a26-f610-ba68-1f0595ab7a64@mindrot.org> <b3047f6f-1b17-4832-86b2-d2878221ea06@app.fastmail.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Message-ID-Hash: NCTOBKAWCPHJVTU23IEBJIQY3GHHQSWP
X-Message-ID-Hash: NCTOBKAWCPHJVTU23IEBJIQY3GHHQSWP
X-MailFrom: filippo@ml.filippo.io
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Watson Ladd <watsonbladd@gmail.com>, "ssh@ietf.org" <SSH@ietf.org>, Nicola Murino <nicola.murino@gmail.com>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Ssh] Re: Supporting pure ML-DSA as hostkey and authkey
List-Id: "The SSH mail list will allow discussions on improving aspects of the Secure Shell (SSH) protocol." <ssh.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ssh/UJXfAdTpgMVA6-kxwuo6xD3wyiM>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ssh>
List-Help: <mailto:ssh-request@ietf.org?subject=help>
List-Owner: <mailto:ssh-owner@ietf.org>
List-Post: <mailto:ssh@ietf.org>
List-Subscribe: <mailto:ssh-join@ietf.org>
List-Unsubscribe: <mailto:ssh-leave@ietf.org>

2026-04-29 19:32 GMT+02:00 Filippo Valsorda <filippo@ml.filippo.io>:
> 2026-04-29 18:16 GMT+02:00 Damien Miller <djm@mindrot.org>:
> > I'll also observe that there are many hardware devices that support
> > Ed25519. It's specified for both FIDO and PKCS#11 and indeed OpenSSH
> > supports it for both of them.
> 
> I don't have a YubiKey that can do Ed25519 over PIV, and I have a lot of
> YubiKeys. Ed25519 is indeed specified and supported in software, but that
> doesn't mean it's supported in hardware.

Had a minute to look up the precise dates and the situation in other
hardware, and ECDSA P-256 is overwhelmingly more available.

 * YubiKeys shipped 2015–2024 support only ECDSA P-256, YubiKeys
   shipped 2024 onwards support both.

   https://www.yubico.com/blog/now-available-for-purchase-yubikey-5-series-and-security-key-series-with-new-5-7-firmware/

   (Note that this is about PIV applet support. FIDO2 support came
   earlier in 2019 but is irrelevant because you can't compose a FIDO2
   signature into an ietf-lamps-pq-composite-sigs composite AFAIK.)

 * TPMs (used either via https://github.com/Foxboron/ssh-tpm-agent or via
   a PKCS11Provider) in practice only support ECDSA P-256:

   https://github.com/Foxboron/ssh-tpm-agent/issues/106

 * The Apple Secure Enclave (used via https://github.com/maxgoedjen/secretive)
   only supports ECDSA P-256:

   https://developer.apple.com/documentation/security/protecting-keys-with-the-secure-enclave

*If* we take the complexity of hybrids, at least they should let us
hybridize PQ and HW properties.

v2.46.0 | Report a Bug | By Email | System Status