[Ssh] Re: PQ signatures - where do we want to end up?

[Matt Johnston <[e-mail]>]

On 2026-04-29 1:46 am, Appel, Ryan wrote:
> Hey Roumen,
> 
> I don't believe it needs to be specified either.
> 
> OpenSSH and Putty for example have completely different ways of
> representing key files (which is obviously different than pkixssh
> which uses certificates), and specifying a specific way to store the
> key (either in expanded / seed form) is likely unnecessary. This is my
> perspective, I just wanted to gather consensus.

In the case of OpenSSH and Putty key files, it's possible to convert 
between formats, the underlying key components are the same.
For server keys in particular it's desirable to keep stable host keys, 
even if switching software implementations.

If only the expanded ML-DSA key is stored by an implementation, that 
can't be converted to other implementations that expect a seed.
That would be a change to behaviour SSH users expect with key files.

Matt