[Ssh] Re: PQ signatures - where do we want to end up?

["Appel, Ryan" <[e-mail]>]

Hey Roumen, 

I don't believe it needs to be specified either. 

OpenSSH and Putty for example have completely different ways of representing key files (which is obviously different than pkixssh which uses certificates), and specifying a specific way to store the key (either in expanded / seed form) is likely unnecessary. This is my perspective, I just wanted to gather consensus.

Thank you,

Ryan Appel



 



-----Original Message-----
From: Roumen Petrov <[e-mail]> 
Sent: Tuesday, April 28, 2026 12:41 PM
To: [e-mail]
Subject: [Ssh] Re: PQ signatures - where do we want to end up?

Hello Ryan,

На 28.04.26 г. в 19:00, Appel, Ryan написа:
> I do believe all the SSH RFCs only describe the way in which the public key is represented. I see no reference in any of the RSA or ECC definitions of keys that reference the way in which a private key is meant to be represented.
> 
> (https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/rfc4253__;!!I2XIyG2ANlwasLbx!VaRonR8BbQpO0xj5WScDBI5GYv3vD0QT_9a4m1fb6E9q4dWtcGT1kyInMhIm8WJ-nvRVd6tl1RQ61hHVXXTZZ8fT$  - rsa and dsa)
> (https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/rfc8709__;!!I2XIyG2ANlwasLbx!VaRonR8BbQpO0xj5WScDBI5GYv3vD0QT_9a4m1fb6E9q4dWtcGT1kyInMhIm8WJ-nvRVd6tl1RQ61hHVXap64jqw$  - ed25519 and ed448)
> (https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/rfc5656__;!!I2XIyG2ANlwasLbx!VaRonR8BbQpO0xj5WScDBI5GYv3vD0QT_9a4m1fb6E9q4dWtcGT1kyInMhIm8WJ-nvRVd6tl1RQ61hHVXaFsYYS0$  - ecdsa)
> 
> ML-DSA public keys have to be represented as the fully expanded (compressed) key as defined in FIPS 204 due to the fact that the matrix A can be expanded from the public seed, and the vector t is computed from the private key (which can be stored in seed format as denoted by section 3.6.3 and 4).
> 
> Does it need to be the case where the newer specs specify the way in which ML-DSA keys (and others) are stored?

I do not think so.
Until now private keys are implementation dependent.
It seem to me cryptographic libraries store ML-DSA keys differently.

Only in PKCS#11 3.2 draft I could found ML-DSA standardised description.
The software that uses PKCS#11 ML-DSA keys is almost ready for use. It is tested by my PKIX-SSH MLDSA-DEMO implementation.


> 
> Thank you,
> 
> Ryan Appel, MS, BCS
> 
> Vice President; Security Architect
> GIS – Cyber Security Technology Architecture
> Bank of America
> 

Regards,
Roumen Petrov

_______________________________________________
Ssh mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]

----------------------------------------------------------------------
This message, and any attachment(s), is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/electronic-disclaimer. If you are not the intended recipient, please delete this message. For more information about how Bank of America protects your privacy, including specific rights that may apply, please visit the following pages: https://business.bofa.com/en-us/content/global-privacy-notices.html (which includes global privacy notices) and https://www.bankofamerica.com/security-center/privacy-overview/ (which includes US State specific privacy notices such as the http://www.bankofamerica.com/ccpa-notice)