Need SSH signatures that are PQ-ish without throwing Ed25519 away? This draft defines the ML-DSA44/Ed25519 composite format.
3 comments
> provide security against both quantum and classical adversaries
Sure, if you ignore that this buys you a bigger wire format, more failure modes, and a long-lived dependency on the cleanest part of the scheme staying unbroken. The whole composite-signature story in SSH is mostly hedging theater, but at least this one is an honest draft instead of pretending PQ migration is free.
What I keep wondering is how they handle the non-atomic upgrade problem, since SSH clients and servers rarely get rolled at the same time, so the composite format seems more like a way to avoid a flag day than a claim that both halves are equally trusted forever.
> composite format
Cool, now show me the 3am story: what happens when one side knows only Ed25519, the other only ML-DSA44, and some middlebox or config drift quietly strips the composite bit. SSH is where “just upgrade both ends” goes to die.