OpenSSH 10.6p1-2 just made it to the stable repos in Arch Linux. This is exciting for two reasons:

Repartage — contenu de Iyán M.

OpenSSH 10.6p1-2 just made it to the stable repos in Arch Linux. This is exciting for two reasons:

1. OpenSSH 10.6 is the first version that enables, **by default**, support for post-quantum ssh-mldsa44-ed25519 signature algorithm.

2. Notice the "-2" at the end of the version? That's Arch Linux' release number. This second release includes this patch (https://lnkd.in/eWWf4Nku) I submitted last week to generate hybrid ML-DSA host keys.

This means that Arch Linux just became the first operating system, as far as I know, (please, do correct me!) to support, by default, fully quantum-safe ssh. I guess OpenBSD 8.0 will follow soon 😉

Note that classical keys are still preferred to authenticate by default, but this will probably change in future releases. In the meantime, you can move move ssh-mldsa44-ed25519 to the top of the preference list by adding `HostKeyAlgorithms ^ssh-mldsa44-ed25519` to both your ssh and sshd config files.

By the way, if you are wondering why hybrid signatures instead of pure ML-DSA-44, you are not alone here. Filippo Valsorda started an interesting discussion in this IETF mail list (https://lnkd.in/eT4fjj8f), but didn't manage to convince them to stay simpler and arguably equally secure.

#PQC #ssh #ArchLinux

125

23

5

125 reactions

Sources LinkedIn

• Profil : Pierre Jean Duvivier dit Sage (LinkedIn)
• Auteur partagé : Iyán M. (LinkedIn)