alexandrejbr opened a new issue, #928: URL: https://github.com/apache/mina-sshd/issues/928
### Description Support for the pure ML-DSA signatures and pure ML-KEM key exchanges, so implementing: - ML-DSA https://datatracker.ietf.org/doc/draft-sfluhrer-ssh-mldsa/ - ML-KEM https://datatracker.ietf.org/doc/draft-harrison-sshm-mlkem/ ### Motivation My understanding is that the status of PQC adoption in SSH protocols is a bit weird given that the standards and openssh moved faster in the hybrid approaches. But unfortunately, some government requirements are very specific about pure ML-DSA signatures and pure ML-KEM key exchanges. There are current drafts for these: - ML-DSA https://datatracker.ietf.org/doc/draft-sfluhrer-ssh-mldsa/ - ML-KEM https://datatracker.ietf.org/doc/draft-harrison-sshm-mlkem/ Pure ML-DSA is implemented in a few places already and there's others work in progress. Bellow there are 2 examples: - WolfSSH (https://github.com/wolfSSL/wolfssh); - oqs-openssh (https://github.com/open-quantum-safe/openssh) Pure ML-KEM implementation is a bit harder to find, but it's present at least in the 2 bellow: - oqs-openssh - CycloneSSH (https://github.com/Oryx-Embedded/CycloneSSH) ### Alternatives considered There's no workaround as some government requirements demand pure ML-DSA and pure ML-KEM. For instance CNSA 2.0 https://datatracker.ietf.org/doc/draft-becker-cnsa2-ssh-profile/ For some governments requirements are as early as 2027, mainly for procurement. ### Additional context https://github.com/apache/mina-sshd/issues/915 mentions ML-DSA, but I decide to create a new issue with the appropriate context. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
