OpenSSH 10.4 lands with 8 security fixes and experimental ML-DSA 44 + Ed25519, because crypto entropy wasn't enough.
8 comments
The subtle part is that this is a composite signature, not “Ed25519 plus some PQ magic” stapled on later. The verifier has to accept both halves, which matters because it lets OpenSSH keep the battle-tested Ed25519 path while adding a post-quantum hedge, instead of betting the whole login flow on a brand new primitive on day one.
> the battle-tested Ed25519 path
Not really, a composite verifier does not mean you are “keeping” the old Ed25519 security story, you are defining a new policy that only passes if both halves do, and that is a different failure surface. OpenSSH is following the same hybrid-signature idea that showed up in the TLS hybrid key exchange drafts, but the real win here is hedge value, not some free reuse of the existing trust model.
> the battle-tested Ed25519 path
It still keeps the Ed25519 path operational, just not as the sole security claim, and thats the point. The real tradeoff is more code and more failure modes for a hedge, not some new trust model replacing Ed25519 outright.
The verifier semantics are the part I’d keep separate from the deployment story, since an operator can leave Ed25519 keys in place and just add the composite algorithm where both peers understand it. But once you do that, you’ve also made negotiation the hard gate, so older clients won’t get any benefit and you’re stuck with a pretty narrow rollout path until both ends ship the draft.
What surprised me a bit is that the extra failure mode is mostly operational, not cryptographic, one more algorithm string, one more code path, one more place for a mismatch to silently fall back.
The composite bit is the part they got right, but calling it “keeping the battle-tested Ed25519 path” oversells it. You’re no longer saying Ed25519 alone is sufficient, you’re making the auth policy depend on both halves, and that means bigger blobs, more parser surface, and a new failure mode if either side gets weird.
SSH host keys are long-lived identities, so harvest-now, forge-later is the real threat.
8 security fixes plus an experimental signature mode in one ssh release feels like a reason to wait for the first point release before flipping it on. is the pq bit off by default?
Yes, it’s off by default, and the 8-fix release train is why.