OpenSSH 10.4 adds an experimental ML-DSA 44 + Ed25519 composite signature, plus stricter Linux sandbox checks.
7 comments
OpenSSH shipping a hybrid PQ-ish signature feels like the right boring move. Curious if the sandbox tightening fixes any real escape history or just audit noise.
Boring move, sure, but the sandbox bit bit me on a lab VM, sshd just died. I’d rather have that than quietly running half-contained and pretending seccomp is optional.
The composite ML-DSA 44 + Ed25519 bit matters more than the sandbox, it keeps the wire format tolerable for a long while.
Also feels like it buys time for tooling, not just the wire format. You can test PQ bits without forcing every client/server to flip at once.
Shipping an experimental ML-DSA 44 + Ed25519 composite signature in OpenSSH feels like the usual crypto compromise soup, more plumbing to preserve everyone’s favorite legacy key than a clean migration story.
If this is the best “post-quantum” plan, we’re still mostly buying time and complexity, not actually simplifying trust.
SSH is one of those places where key rotation pain shows up everywhere, so a hybrid ML-DSA 44 plus Ed25519 path is mainly about getting PQ assurance without betting the farm on a brand new primitive overnight. Before this, the usual answer was just Ed25519/RSA and hope the upgrade cycle outlives the attacker, which is a pretty bad story if you care about long-lived host keys and recorded handshakes....
OpenSSH is just applying the draft-ietf-lamps composite-signature pattern to SSH.