[Ssh] Re: Supporting pure ML-DSA as hostkey and authkey

[Dennis Jackson <[e-mail]>]

My point is that you *can* revoke trust for authentication material. For 
example, in the event of worrying cryptanalytic progress towards 
breaking ML-DSA, you have a window in which you can ship an update and 
migrate, rendering it a non-issue.

You can't do that for ML-KEM or any other key exchange. Once you've 
picked it you're crossing your fingers it never gets broken.

Best,
Dennis

On 29/04/2026 19:16, Simon Josefsson wrote:
> Dennis Jackson <ietf=[e-mail]> writes:
>
>> There's no analogue operation for 'revoking' a past encryption to a
>> now-broken public key cryptosystem. That's why confidentiality matters
>> pretty much indefinitely, but authentication only matters until you
>> can ship an update to your clients.
> That's backwards.  Updates to clients needs to be authenticated,
> otherwise anyone can send you a rogue update.  Authenticated with what,
> you ask?  Well, often a signature, and it may be a SSH signature (some
> projects are moving to use SSH signing for artifact protection).  You
> can't have encryption between Alice and Bob without authentication,
> that's crypto 101.
>
> /Simon