Implement ML-DSA signature algorithms per draft-sfluhrer-ssh-mldsa-06

Add ssh-mldsa-44, ssh-mldsa-65, and ssh-mldsa-87 public key algorithms
using FIPS 204 (ML-DSA) via OpenSSL 3.5+ EVP API. Includes certificate
variants and FIPS mode support.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: beldmit

Makefile.in

@@ -103,7 +103,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
 	msg.o dns.o entropy.o gss-genr.o umac.o umac128.o \
 	smult_curve25519_ref.o \
 	poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \
-	ssh-ed25519.o digest-openssl.o digest-libc.o \
+	ssh-ed25519.o ssh-mldsa.o digest-openssl.o digest-libc.o \
 	hmac.o ed25519.o ed25519-openssl.o \
 	kex.o kex-names.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
 	kexgexc.o kexgexs.o \

authfd.c

@@ -605,6 +605,14 @@ ssh_add_identity_constrained(int sock, struct sshkey *key,
 	case KEY_ECDSA_CERT:
 	case KEY_ECDSA_SK:
 	case KEY_ECDSA_SK_CERT:
+#ifdef OPENSSL_HAS_MLDSA
+	case KEY_MLDSA44:
+	case KEY_MLDSA44_CERT:
+	case KEY_MLDSA65:
+	case KEY_MLDSA65_CERT:
+	case KEY_MLDSA87:
+	case KEY_MLDSA87_CERT:
+#endif
 #endif
 	case KEY_ED25519:
 	case KEY_ED25519_CERT:

configure.ac

@@ -13,7 +13,7 @@
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-AC_INIT([OpenSSH], [Portable], [openssh-unix-dev@mindrot.org])
+AC_INIT([OpenSSH],[Portable],[openssh-unix-dev@mindrot.org])
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_SRCDIR([ssh.c])
 
@@ -845,29 +845,22 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 	AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 	    [Prepend the address family to IP tunnel traffic])
 	AC_MSG_CHECKING([if we have the Security Authorization Session API])
-	AC_TRY_COMPILE([#include <Security/AuthSession.h>],
-		[SessionCreate(0, 0);],
-		[ac_cv_use_security_session_api="yes"
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <Security/AuthSession.h>]], [[SessionCreate(0, 0);]])],[ac_cv_use_security_session_api="yes"
 		 AC_DEFINE([USE_SECURITY_SESSION_API], [1],
 			[platform has the Security Authorization Session API])
 		 LIBS="$LIBS -framework Security"
-		 AC_MSG_RESULT([yes])],
-		[ac_cv_use_security_session_api="no"
+		 AC_MSG_RESULT([yes])],[ac_cv_use_security_session_api="no"
 		 AC_MSG_RESULT([no])])
 	AC_MSG_CHECKING([if we have an in-memory credentials cache])
-	AC_TRY_COMPILE(
-		[#include <Kerberos/Kerberos.h>],
-		[cc_context_t c;
-		 (void) cc_initialize (&c, 0, NULL, NULL);],
-		[AC_DEFINE([USE_CCAPI], [1],
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <Kerberos/Kerberos.h>]], [[cc_context_t c;
+		 (void) cc_initialize (&c, 0, NULL, NULL);]])],[AC_DEFINE([USE_CCAPI], [1],
 			[platform uses an in-memory credentials cache])
 		 LIBS="$LIBS -framework Security"
 		 AC_MSG_RESULT([yes])
 		 if test "x$ac_cv_use_security_session_api" = "xno"; then
 			AC_MSG_ERROR([*** Need a security framework to use the credentials cache API ***])
-		fi],
-		[AC_MSG_RESULT([no])]
-	)
+		fi],[AC_MSG_RESULT([no])
+	])
 	m4_pattern_allow([AU_IPv])
 	AC_CHECK_DECL([AU_IPv4], [],
 	    AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
@@ -3494,6 +3487,26 @@ if test "x$openssl" = "xyes" ; then
 			AC_MSG_RESULT([no])
 		]
 	)
+
+	AC_MSG_CHECKING([whether OpenSSL has ML-DSA support])
+	AC_LINK_IFELSE(
+		[AC_LANG_PROGRAM([[
+#include <openssl/evp.h>
+		]], [[
+		EVP_PKEY_CTX *ctx;
+		ctx = EVP_PKEY_CTX_new_from_name(NULL, "ML-DSA-44", NULL);
+		if (ctx == NULL) return 1;
+		EVP_PKEY_CTX_free(ctx);
+		]])],
+		[
+			AC_MSG_RESULT([yes])
+			AC_DEFINE([OPENSSL_HAS_MLDSA], [1],
+			    [libcrypto has ML-DSA support])
+		],
+		[
+			AC_MSG_RESULT([no])
+		]
+	)
 fi
 
 # PKCS11/U2F depend on OpenSSL and dlopen().

myproposal.h

@@ -60,7 +60,13 @@
 	"sk-ecdsa-sha2-nistp256@openssh.com," \
 	"webauthn-sk-ecdsa-sha2-nistp256@openssh.com," \
 	"rsa-sha2-512," \
-	"rsa-sha2-256"
+	"rsa-sha2-256," \
+	"ssh-mldsa-44-cert-v01@openssh.com," \
+	"ssh-mldsa-65-cert-v01@openssh.com," \
+	"ssh-mldsa-87-cert-v01@openssh.com," \
+	"ssh-mldsa-44," \
+	"ssh-mldsa-65," \
+	"ssh-mldsa-87"
 
 #define	KEX_FIPS_PK_ALG	\
 	"ecdsa-sha2-nistp256-cert-v01@openssh.com," \
@@ -72,7 +78,13 @@
 	"ecdsa-sha2-nistp384," \
 	"ecdsa-sha2-nistp521," \
 	"rsa-sha2-512," \
-	"rsa-sha2-256"
+	"rsa-sha2-256," \
+	"ssh-mldsa-44-cert-v01@openssh.com," \
+	"ssh-mldsa-65-cert-v01@openssh.com," \
+	"ssh-mldsa-87-cert-v01@openssh.com," \
+	"ssh-mldsa-44," \
+	"ssh-mldsa-65," \
+	"ssh-mldsa-87"
 
 #define	KEX_SERVER_ENCRYPT \
 	"chacha20-poly1305@openssh.com," \

pathnames.h

@@ -39,6 +39,9 @@
 #define _PATH_HOST_ECDSA_KEY_FILE	SSHDIR "/ssh_host_ecdsa_key"
 #define _PATH_HOST_RSA_KEY_FILE		SSHDIR "/ssh_host_rsa_key"
 #define _PATH_HOST_ED25519_KEY_FILE	SSHDIR "/ssh_host_ed25519_key"
+#define _PATH_HOST_MLDSA44_KEY_FILE	SSHDIR "/ssh_host_mldsa44_key"
+#define _PATH_HOST_MLDSA65_KEY_FILE	SSHDIR "/ssh_host_mldsa65_key"
+#define _PATH_HOST_MLDSA87_KEY_FILE	SSHDIR "/ssh_host_mldsa87_key"
 #define _PATH_DH_MODULI			SSHDIR "/moduli"
 #define _PATH_SCP_KILL_SWITCH		SSHDIR "/disable_scp"
 
@@ -91,6 +94,9 @@
 #define _PATH_SSH_CLIENT_ID_ED25519	_PATH_SSH_USER_DIR "/id_ed25519"
 #define _PATH_SSH_CLIENT_ID_ECDSA_SK	_PATH_SSH_USER_DIR "/id_ecdsa_sk"
 #define _PATH_SSH_CLIENT_ID_ED25519_SK	_PATH_SSH_USER_DIR "/id_ed25519_sk"
+#define _PATH_SSH_CLIENT_ID_MLDSA44	_PATH_SSH_USER_DIR "/id_mldsa44"
+#define _PATH_SSH_CLIENT_ID_MLDSA65	_PATH_SSH_USER_DIR "/id_mldsa65"
+#define _PATH_SSH_CLIENT_ID_MLDSA87	_PATH_SSH_USER_DIR "/id_mldsa87"
 
 /*
  * Configuration file in user's home directory.  This file need not be

ssh-keygen.c

@@ -279,6 +279,17 @@ ask_filename(struct passwd *pw, const char *prompt)
 		case KEY_ED25519_SK_CERT:
 			name = _PATH_SSH_CLIENT_ID_ED25519_SK;
 			break;
+#ifdef OPENSSL_HAS_MLDSA
+		case KEY_MLDSA44:
+			name = _PATH_SSH_CLIENT_ID_MLDSA44;
+			break;
+		case KEY_MLDSA65:
+			name = _PATH_SSH_CLIENT_ID_MLDSA65;
+			break;
+		case KEY_MLDSA87:
+			name = _PATH_SSH_CLIENT_ID_MLDSA87;
+			break;
+#endif
 		default:
 			fatal("bad key type");
 		}
@@ -1024,6 +1035,11 @@ do_gen_all_hostkeys(struct passwd *pw)
 #endif /* OPENSSL_HAS_ECC */
 #endif /* WITH_OPENSSL */
 		{ "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE },
+#ifdef OPENSSL_HAS_MLDSA
+		{ "mldsa44", "MLDSA44",_PATH_HOST_MLDSA44_KEY_FILE },
+		{ "mldsa65", "MLDSA65",_PATH_HOST_MLDSA65_KEY_FILE },
+		{ "mldsa87", "MLDSA87",_PATH_HOST_MLDSA87_KEY_FILE },
+#endif
 		{ NULL, NULL, NULL }
 	};
 

ssh-keyscan.c

@@ -65,12 +65,25 @@ int ssh_port = SSH_DEFAULT_PORT;
 #define KT_ED25519	(1<<2)
 #define KT_ECDSA_SK	(1<<4)
 #define KT_ED25519_SK	(1<<5)
+#ifdef OPENSSL_HAS_MLDSA
+#define KT_MLDSA44	(1<<6)
+#define KT_MLDSA65	(1<<7)
+#define KT_MLDSA87	(1<<8)
+#endif
 
 #define KT_MIN		KT_RSA
+#ifdef OPENSSL_HAS_MLDSA
+#define KT_MAX		KT_MLDSA87
+#else
 #define KT_MAX		KT_ED25519_SK
+#endif
 
 int get_cert = 0;
-int get_keytypes = KT_RSA|KT_ECDSA|KT_ED25519|KT_ECDSA_SK|KT_ED25519_SK;
+int get_keytypes = KT_RSA|KT_ECDSA|KT_ED25519|KT_ECDSA_SK|KT_ED25519_SK
+#ifdef OPENSSL_HAS_MLDSA
+    |KT_MLDSA44|KT_MLDSA65|KT_MLDSA87
+#endif
+    ;
 
 int hash_hosts = 0;		/* Hash hostname on output */
 
@@ -276,6 +289,20 @@ keygrab_ssh2(con *c)
 		    "sk-ssh-ed25519-cert-v01@openssh.com" :
 		    "sk-ssh-ed25519@openssh.com";
 		break;
+#ifdef OPENSSL_HAS_MLDSA
+	case KT_MLDSA44:
+		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
+		    "ssh-mldsa-44-cert-v01@openssh.com" : "ssh-mldsa-44";
+		break;
+	case KT_MLDSA65:
+		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
+		    "ssh-mldsa-65-cert-v01@openssh.com" : "ssh-mldsa-65";
+		break;
+	case KT_MLDSA87:
+		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
+		    "ssh-mldsa-87-cert-v01@openssh.com" : "ssh-mldsa-87";
+		break;
+#endif
 	default:
 		fatal("unknown key type %d", c->c_keytype);
 		break;
@@ -756,6 +783,17 @@ main(int argc, char **argv)
 				case KEY_ECDSA_SK:
 					get_keytypes |= KT_ECDSA_SK;
 					break;
+#ifdef OPENSSL_HAS_MLDSA
+				case KEY_MLDSA44:
+					get_keytypes |= KT_MLDSA44;
+					break;
+				case KEY_MLDSA65:
+					get_keytypes |= KT_MLDSA65;
+					break;
+				case KEY_MLDSA87:
+					get_keytypes |= KT_MLDSA87;
+					break;
+#endif
 				case KEY_UNSPEC:
 				default:
 					fatal("Unknown key type \"%s\"", tname);