Implement ML-DSA signature algorithms per draft-sfluhrer-ssh-mldsa-06

Add ssh-mldsa-44, ssh-mldsa-65, and ssh-mldsa-87 public key algorithms
using FIPS 204 (ML-DSA) via OpenSSL 3.5+ EVP API. Includes certificate
variants and FIPS mode support.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: beldmit

Makefile.in

@@ -103,7 +103,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
 	msg.o dns.o entropy.o gss-genr.o umac.o umac128.o \
 	smult_curve25519_ref.o \
 	poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \
-	ssh-ed25519.o digest-openssl.o digest-libc.o \
+	ssh-ed25519.o ssh-mldsa.o digest-openssl.o digest-libc.o \
 	libcrux-mlkem-mldsa.o ssh-mldsa-eddsa.o \
 	hmac.o ed25519.o ed25519-openssl.o \
 	kex.o kex-names.o kexdh.o kexgex.o kexecdh.o kexc25519.o \

authfd.c

@@ -605,6 +605,14 @@ ssh_add_identity_constrained(int sock, struct sshkey *key,
 	case KEY_ECDSA_CERT:
 	case KEY_ECDSA_SK:
 	case KEY_ECDSA_SK_CERT:
+#ifdef OPENSSL_HAS_MLDSA
+	case KEY_MLDSA44:
+	case KEY_MLDSA44_CERT:
+	case KEY_MLDSA65:
+	case KEY_MLDSA65_CERT:
+	case KEY_MLDSA87:
+	case KEY_MLDSA87_CERT:
+#endif
 #endif
 	case KEY_ED25519:
 	case KEY_ED25519_CERT:

configure.ac

@@ -13,7 +13,7 @@
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-AC_INIT([OpenSSH], [Portable], [openssh-unix-dev@mindrot.org])
+AC_INIT([OpenSSH],[Portable],[openssh-unix-dev@mindrot.org])
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_SRCDIR([ssh.c])
 
@@ -845,29 +845,22 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 	AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 	    [Prepend the address family to IP tunnel traffic])
 	AC_MSG_CHECKING([if we have the Security Authorization Session API])
-	AC_TRY_COMPILE([#include <Security/AuthSession.h>],
-		[SessionCreate(0, 0);],
-		[ac_cv_use_security_session_api="yes"
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <Security/AuthSession.h>]], [[SessionCreate(0, 0);]])],[ac_cv_use_security_session_api="yes"
 		 AC_DEFINE([USE_SECURITY_SESSION_API], [1],
 			[platform has the Security Authorization Session API])
 		 LIBS="$LIBS -framework Security"
-		 AC_MSG_RESULT([yes])],
-		[ac_cv_use_security_session_api="no"
+		 AC_MSG_RESULT([yes])],[ac_cv_use_security_session_api="no"
 		 AC_MSG_RESULT([no])])
 	AC_MSG_CHECKING([if we have an in-memory credentials cache])
-	AC_TRY_COMPILE(
-		[#include <Kerberos/Kerberos.h>],
-		[cc_context_t c;
-		 (void) cc_initialize (&c, 0, NULL, NULL);],
-		[AC_DEFINE([USE_CCAPI], [1],
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <Kerberos/Kerberos.h>]], [[cc_context_t c;
+		 (void) cc_initialize (&c, 0, NULL, NULL);]])],[AC_DEFINE([USE_CCAPI], [1],
 			[platform uses an in-memory credentials cache])
 		 LIBS="$LIBS -framework Security"
 		 AC_MSG_RESULT([yes])
 		 if test "x$ac_cv_use_security_session_api" = "xno"; then
 			AC_MSG_ERROR([*** Need a security framework to use the credentials cache API ***])
-		fi],
-		[AC_MSG_RESULT([no])]
-	)
+		fi],[AC_MSG_RESULT([no])
+	])
 	m4_pattern_allow([AU_IPv])
 	AC_CHECK_DECL([AU_IPv4], [],
 	    AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
@@ -3485,6 +3478,26 @@ if test "x$openssl" = "xyes" ; then
 			AC_MSG_RESULT([no])
 		]
 	)
+
+	AC_MSG_CHECKING([whether OpenSSL has ML-DSA support])
+	AC_LINK_IFELSE(
+		[AC_LANG_PROGRAM([[
+#include <openssl/evp.h>
+		]], [[
+		EVP_PKEY_CTX *ctx;
+		ctx = EVP_PKEY_CTX_new_from_name(NULL, "ML-DSA-44", NULL);
+		if (ctx == NULL) return 1;
+		EVP_PKEY_CTX_free(ctx);
+		]])],
+		[
+			AC_MSG_RESULT([yes])
+			AC_DEFINE([OPENSSL_HAS_MLDSA], [1],
+			    [libcrypto has ML-DSA support])
+		],
+		[
+			AC_MSG_RESULT([no])
+		]
+	)
 fi
 
 # PKCS11/U2F depend on OpenSSL and dlopen().

myproposal.h

@@ -60,7 +60,13 @@
 	"sk-ecdsa-sha2-nistp256@openssh.com," \
 	"webauthn-sk-ecdsa-sha2-nistp256@openssh.com," \
 	"rsa-sha2-512," \
-	"rsa-sha2-256"
+	"rsa-sha2-256," \
+	"ssh-mldsa-44-cert-v01@openssh.com," \
+	"ssh-mldsa-65-cert-v01@openssh.com," \
+	"ssh-mldsa-87-cert-v01@openssh.com," \
+	"ssh-mldsa-44," \
+	"ssh-mldsa-65," \
+	"ssh-mldsa-87"
 
 #define	KEX_FIPS_PK_ALG	\
 	"ecdsa-sha2-nistp256-cert-v01@openssh.com," \
@@ -72,7 +78,13 @@
 	"ecdsa-sha2-nistp384," \
 	"ecdsa-sha2-nistp521," \
 	"rsa-sha2-512," \
-	"rsa-sha2-256"
+	"rsa-sha2-256," \
+	"ssh-mldsa-44-cert-v01@openssh.com," \
+	"ssh-mldsa-65-cert-v01@openssh.com," \
+	"ssh-mldsa-87-cert-v01@openssh.com," \
+	"ssh-mldsa-44," \
+	"ssh-mldsa-65," \
+	"ssh-mldsa-87"
 
 #define	KEX_SERVER_ENCRYPT \
 	"chacha20-poly1305@openssh.com," \

pathnames.h

@@ -40,6 +40,9 @@
 #define _PATH_HOST_RSA_KEY_FILE		SSHDIR "/ssh_host_rsa_key"
 #define _PATH_HOST_ED25519_KEY_FILE	SSHDIR "/ssh_host_ed25519_key"
 #define _PATH_HOST_MLDSA44_ED25519_KEY_FILE SSHDIR "/ssh_host_mldsa44_ed25519_key"
+#define _PATH_HOST_MLDSA44_KEY_FILE	SSHDIR "/ssh_host_mldsa44_key"
+#define _PATH_HOST_MLDSA65_KEY_FILE	SSHDIR "/ssh_host_mldsa65_key"
+#define _PATH_HOST_MLDSA87_KEY_FILE	SSHDIR "/ssh_host_mldsa87_key"
 #define _PATH_DH_MODULI			SSHDIR "/moduli"
 #define _PATH_SCP_KILL_SWITCH		SSHDIR "/disable_scp"
 
@@ -93,6 +96,9 @@
 #define _PATH_SSH_CLIENT_ID_ECDSA_SK	_PATH_SSH_USER_DIR "/id_ecdsa_sk"
 #define _PATH_SSH_CLIENT_ID_ED25519_SK	_PATH_SSH_USER_DIR "/id_ed25519_sk"
 #define _PATH_SSH_CLIENT_ID_MLDSA44_ED25519 _PATH_SSH_USER_DIR "/id_mldsa44_ed25519"
+#define _PATH_SSH_CLIENT_ID_MLDSA44	_PATH_SSH_USER_DIR "/id_mldsa44"
+#define _PATH_SSH_CLIENT_ID_MLDSA65	_PATH_SSH_USER_DIR "/id_mldsa65"
+#define _PATH_SSH_CLIENT_ID_MLDSA87	_PATH_SSH_USER_DIR "/id_mldsa87"
 
 /*
  * Configuration file in user's home directory.  This file need not be

regress/cert-userkey.sh

@@ -36,6 +36,7 @@ kname() {
 	sk-ecdsa-*) n="sk-ecdsa" ;;
 	sk-ssh-ed25519*) n="sk-ssh-ed25519" ;;
 	ssh-mldsa*) n=`echo "$1" | sed 's/@.*//'` ;;
+	mldsa-*) n="ssh-$1" ;;
 	# subshell because some seds will add a newline
 	*) n=$(echo $1 | sed 's/^rsa/ssh-rsa/;s/^ed/ssh-ed/') ;;
 	esac

regress/hostkey-agent.sh

@@ -108,7 +108,7 @@ echo "UpdateHostkeys=yes" >> $OBJ/ssh_proxy
 echo "GlobalKnownHostsFile=none" >> $OBJ/ssh_proxy
 
 HOSTKEYALGS=""
-for k in $SSH_KEYTYPES ; do
+for k in $SSH_ACCEPTED_KEYTYPES ; do
 	verbose "Addkey type $k"
 	echo "Hostkey $OBJ/agent-key.${k}" >> $OBJ/sshd_proxy
 	test -z "$HOSTKEYALGS" || HOSTKEYALGS="${HOSTKEYALGS},"

regress/keygen-comment.sh

@@ -31,6 +31,7 @@ for fmt in '' RFC4716 PKCS8 PEM; do
 		# stored in old formats.
 		case "$t" in
 		ssh-ed25519|*openssh.com) test -z "$oldfmt" || continue ;;
+		ssh-mldsa-*) test "$fmt" = "PEM" && continue ;;
 		esac
 		comment="foo bar"
 		fmtarg=""

regress/keytype.sh

@@ -18,6 +18,9 @@ for i in ${SSH_KEYTYPES}; do
 		sk-ssh-ed25519*)	ktypes="$ktypes ed25519-sk" ;;
 		sk-ecdsa-sha2-nistp256*) ktypes="$ktypes ecdsa-sk" ;;
 		ssh-mldsa44-ed25519*)	ktypes="$ktypes mldsa44-ed25519" ;;
+		ssh-mldsa-44)		ktypes="$ktypes mldsa-44" ;;
+		ssh-mldsa-65)		ktypes="$ktypes mldsa-65" ;;
+		ssh-mldsa-87)		ktypes="$ktypes mldsa-87" ;;
 	esac
 done
 
@@ -44,6 +47,9 @@ kname_to_ktype() {
 	ed25519-sk)	echo sk-ssh-ed25519@openssh.com;;
 	ecdsa-sk)	echo sk-ecdsa-sha2-nistp256@openssh.com;;
 	mldsa44-ed25519) echo ssh-mldsa44-ed25519@openssh.com ;;
+	mldsa-44)	echo ssh-mldsa-44;;
+	mldsa-65)	echo ssh-mldsa-65;;
+	mldsa-87)	echo ssh-mldsa-87;;
 	esac
 }
 

regress/krl.sh

@@ -11,6 +11,7 @@ for t in $SSH_KEYTYPES; do
 	case "$t" in
 		ecdsa*)		ktype2=ecdsa ;;
 		ssh-rsa)	ktype3=rsa ;;
+		ssh-mldsa-44)	ktype4=mldsa-44 ;;
 		sk-ssh-ed25519@openssh.com)		ktype5=ed25519-sk ;;
 		sk-ecdsa-sha2-nistp256@openssh.com)	ktype6=ecdsa-sk ;;
 	esac