[Ssh] Re: Supporting pure ML-DSA as hostkey and authkey

[Damien Miller <[e-mail]>]

On Wed, 29 Apr 2026, Filippo Valsorda wrote:

> I can offer more data points about this, but is there a strong reason to
> conversely prefer Ed25519?

Ed25519 is the most popular SSH hostkey type. Most implementations
already support it, so it's the smallest lift from there to composite
PQ.

Ed25519 is out of the box the most misuse-resistant ECC signature
scheme and not "fine if you do all this extra stuff" like ECDSA.

It's also, for better or worse, the recommended algorithm by most of
the popular "SSH hardening guides" on the web.

> Again thinking about non-OpenSSH implementations: do they all support
> Ed25519? Because if not they will have to implement two new things to
> adopt the composite, and Ed25519 is IMHO trickier than ML-DSA.

No, the vast majority support ed25519. Some, like tinyssh or OpenSSH
compiled without libcrypto, *only* support ed25519.

> > I'm happy to take feedback on which ML-DSA variant to adopt in a
> > composite construction. In particular, ML-DSA 44 for the composite and
> > ML-DSA 87 for pure is a future I could envisage.
> 
> Again I would prefer ML-DSA-44 and ML-DSA-87, but I could live with
> ML-DSA-44 + ECDSA P-256 and ML-DSA-87, and the complexity cost would be
> offset by a year or two of hardware token availability.

I'll rework the draft and implementation I posted to target ML-DSA 44.
Stay tuned.

-d