gbucchino/openssh-portable
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upstream: document mldsa44-ed25519 host key and public key

Browse Source 
algorithm

OpenBSD-Commit-ID: c519ba7408cfb2700d184c9441de4ff01ecda726
This commit is contained in:
[email protected] authored and Damien Miller committed 2026-07-21 15:23:04 +10:00
1 parent df67bcaf56
commit 0e546c658b
6 files changed
+45 -21
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ssh-keysign.8
+4 -2
View File
@@ -1,4 +1,4 @@
.\" $OpenBSD: ssh-keysign.8,v 1.18 2024/06/17 08:30:29 djm Exp $
.\" $OpenBSD: ssh-keysign.8,v 1.19 2026/07/10 17:21:19 naddy Exp $
.\"
.\" Copyright (c) 2002 Markus Friedl. All rights reserved.
.\"
@@ -22,7 +22,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd $Mdocdate: June 17 2024 $
.Dd $Mdocdate: July 10 2026 $
.Dt SSH-KEYSIGN 8
.Os
.Sh NAME
@@ -63,6 +63,7 @@ is enabled.
.Pp
.It Pa /etc/ssh/ssh_host_ecdsa_key
.It Pa /etc/ssh/ssh_host_ed25519_key
.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
.It Pa /etc/ssh/ssh_host_rsa_key
These files contain the private parts of the host keys used to
generate the digital signature.
@@ -74,6 +75,7 @@ must be set-uid root if host-based authentication is used.
.Pp
.It Pa /etc/ssh/ssh_host_ecdsa_key-cert.pub
.It Pa /etc/ssh/ssh_host_ed25519_key-cert.pub
.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key-cert.pub
.It Pa /etc/ssh/ssh_host_rsa_key-cert.pub
If these files exist, they are assumed to contain public certificate
information corresponding with the private keys above.
ssh.1
+3 -2
View File
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" $OpenBSD: ssh.1,v 1.450 2026/07/09 01:16:37 djm Exp $
.Dd $Mdocdate: July 9 2026 $
.\" $OpenBSD: ssh.1,v 1.451 2026/07/10 17:21:19 naddy Exp $
.Dd $Mdocdate: July 10 2026 $
.Dt SSH 1
.Os
.Sh NAME
@@ -1541,6 +1541,7 @@ The file format and configuration options are described in
.Pp
.It Pa /etc/ssh/ssh_host_ecdsa_key
.It Pa /etc/ssh/ssh_host_ed25519_key
.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
.It Pa /etc/ssh/ssh_host_rsa_key
These files contain the private parts of the host keys
and are used for host-based authentication.
ssh_config.5
+13 -6
View File
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" $OpenBSD: ssh_config.5,v 1.426 2026/07/01 00:52:31 djm Exp $
.Dd $Mdocdate: July 1 2026 $
.\" $OpenBSD: ssh_config.5,v 1.427 2026/07/10 17:21:19 naddy Exp $
.Dd $Mdocdate: July 10 2026 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@@ -476,7 +476,8 @@ ssh-ed25519,ecdsa-sha2-nistp256,
ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[email protected],
[email protected],
rsa-sha2-512,rsa-sha2-256
rsa-sha2-512,rsa-sha2-256,
[email protected]
.Ed
.Pp
If the specified list begins with a
@@ -1060,12 +1061,14 @@ [email protected],
[email protected],
[email protected],
[email protected],
[email protected],
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[email protected],
[email protected],
[email protected],
rsa-sha2-512,rsa-sha2-256
rsa-sha2-512,rsa-sha2-256,
[email protected]
.Ed
.Pp
The
@@ -1108,12 +1111,14 @@ [email protected],
[email protected],
[email protected],
[email protected],
[email protected],
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[email protected],
[email protected]
[email protected],
rsa-sha2-512,rsa-sha2-256
rsa-sha2-512,rsa-sha2-256,
[email protected]
.Ed
.Pp
If hostkeys are known for the destination host then this default is modified
@@ -1708,12 +1713,14 @@ [email protected],
[email protected],
[email protected],
[email protected],
[email protected],
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[email protected],
[email protected],
[email protected],
rsa-sha2-512,rsa-sha2-256
rsa-sha2-512,rsa-sha2-256,
[email protected]
.Ed
.Pp
The list of available signature algorithms may also be obtained using
sshd.8
+8 -3
View File
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" $OpenBSD: sshd.8,v 1.328 2025/10/04 21:41:35 naddy Exp $
.Dd $Mdocdate: October 4 2025 $
.\" $OpenBSD: sshd.8,v 1.329 2026/07/10 17:21:19 naddy Exp $
.Dd $Mdocdate: July 10 2026 $
.Dt SSHD 8
.Os
.Sh NAME
@@ -181,7 +181,8 @@ is not run as root (as the normal
host key files are normally not readable by anyone but root).
The default is
.Pa /etc/ssh/ssh_host_ecdsa_key ,
.Pa /etc/ssh/ssh_host_ed25519_key
.Pa /etc/ssh/ssh_host_ed25519_key ,
.Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
and
.Pa /etc/ssh/ssh_host_rsa_key .
It is possible to have multiple host key files for
@@ -469,6 +470,8 @@ [email protected]
.It
ssh-ed25519
.It
[email protected]
.It
ssh-rsa
.El
.Pp
@@ -959,6 +962,7 @@ rlogin/rsh.
.Pp
.It Pa /etc/ssh/ssh_host_ecdsa_key
.It Pa /etc/ssh/ssh_host_ed25519_key
.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
.It Pa /etc/ssh/ssh_host_rsa_key
These files contain the private parts of the host keys.
These files should only be owned by root, readable only by root, and not
@@ -969,6 +973,7 @@ does not start if these files are group/world-accessible.
.Pp
.It Pa /etc/ssh/ssh_host_ecdsa_key.pub
.It Pa /etc/ssh/ssh_host_ed25519_key.pub
.It Pa /etc/ssh/ssh_host_mldsa44_ed25519_key.pub
.It Pa /etc/ssh/ssh_host_rsa_key.pub
These files contain the public parts of the host keys.
These files should be world-readable but writable only by
sshd_config
+2 -1
View File
@@ -1,4 +1,4 @@
# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $
# $OpenBSD: sshd_config,v 1.106 2026/07/10 17:21:19 naddy Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
@@ -18,6 +18,7 @@
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key
#HostKey /etc/ssh/ssh_host_mldsa44_ed25519_key
# Ciphers and keying
#RekeyLimit default none
sshd_config.5
+15 -7
View File
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" $OpenBSD: sshd_config.5,v 1.399 2026/06/24 06:55:12 djm Exp $
.Dd $Mdocdate: June 24 2026 $
.\" $OpenBSD: sshd_config.5,v 1.400 2026/07/10 17:21:19 naddy Exp $
.Dd $Mdocdate: July 10 2026 $
.Dt SSHD_CONFIG 5
.Os
.Sh NAME
@@ -391,7 +391,8 @@ ssh-ed25519,ecdsa-sha2-nistp256,
ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[email protected],
[email protected],
rsa-sha2-512,rsa-sha2-256
rsa-sha2-512,rsa-sha2-256,
[email protected]
.Ed
.Pp
If the specified list begins with a
@@ -803,12 +804,14 @@ [email protected],
[email protected],
[email protected],
[email protected],
[email protected],
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[email protected],
[email protected],
[email protected],
rsa-sha2-512,rsa-sha2-256
rsa-sha2-512,rsa-sha2-256,
[email protected]
.Ed
.Pp
The list of available signature algorithms may also be obtained using
@@ -850,7 +853,8 @@ Specifies a file containing a private host key
used by SSH.
The defaults are
.Pa /etc/ssh/ssh_host_ecdsa_key ,
.Pa /etc/ssh/ssh_host_ed25519_key
.Pa /etc/ssh/ssh_host_ed25519_key ,
.Pa /etc/ssh/ssh_host_mldsa44_ed25519_key
and
.Pa /etc/ssh/ssh_host_rsa_key .
.Pp
@@ -889,12 +893,14 @@ [email protected],
[email protected],
[email protected],
[email protected],
[email protected],
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[email protected],
[email protected],
[email protected],
rsa-sha2-512,rsa-sha2-256
rsa-sha2-512,rsa-sha2-256,
[email protected]
.Ed
.Pp
The list of available signature algorithms may also be obtained using
@@ -1757,12 +1763,14 @@ [email protected],
[email protected],
[email protected],
[email protected],
[email protected],
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[email protected],
[email protected],
[email protected],
rsa-sha2-512,rsa-sha2-256
rsa-sha2-512,rsa-sha2-256,
[email protected]
.Ed
.Pp
The list of available signature algorithms may also be obtained using