feat: add support for mldsa44-ed25519 (draft-miller-sshm-composite-sigs) - #583
feat: add support for mldsa44-ed25519 (draft-miller-sshm-composite-sigs)#583quexten wants to merge 3 commits into
Conversation
| @@ -0,0 +1 @@ | |||
| The lethargic, colorless dog sat beneath the energetic, stationary fox. No newline at end of file | |||
There was a problem hiding this comment.
| let mldsa_sig = | ||
| ml_dsa::Signature::<MlDsa44>::try_from(mldsa_sig).map_err(|_| Error::Signature)?; | ||
|
|
||
| if !VerifyingKey::<MlDsa44>::decode(&mldsa_pk).verify_with_context(&m_prime, LABEL, &mldsa_sig) |
There was a problem hiding this comment.
Is this okay? Or should we verify both sigs first, then do a const time comparison of the results?
|
|
||
| let mldsa_sig = mldsa_signing_key(sk) | ||
| .expanded_key() | ||
| .sign_deterministic(&m_prime, LABEL) |
There was a problem hiding this comment.
The ML-DSA and Ed25519 signatures are calculated as:
mldsa_sig = ML-DSA-44.Sign(mldsa_sk, M', ctx=Label)
ed25519_sig = Ed25519.Sign(ed25519_sk, M')
|
If I read the draft correctly, public keys, private keys and signature are just "append mldsa(44|87) with (eddsa|ecdsa) (public|private|signature)" together. Would it be possible to make those composite using a macro or something and reuse the existing ed25519/ecdsa keys? I haven't tried it. Happy to. |
|
well, openssh doesn't appear to have mldsa87-p384 support at the moment. |
|
@baloo I'm happy to make the changes, but currently really only mldsa44-ed25519 is supported. Openssh specifically state that they have no plans to add pure mldsa (though as mentioned in the original PR some ssh clients have added it), so I feel that unless there is a change of direction from openssh to make it likely that pure mldsa will be supported, it's not worth introducing the complexity currently. openssh/openssh-portable#703 (comment) Openssh also does not currently support As to the question; yes private key seeds, public keys, and signatures are just concatenated respectively in the encoding, however for signatures specifically 1. the mldsa context is set to a specific label that is composite specific, and 2. they both don't directly sign the data, but they sign a commitment to a prefix, the label, the ctx (and length of it), and the data. So the sign operations from the underlying SSH keys are not directly usable / we would at minimum have to expose a private function for the mldsa keys that exposes the context parameter, but macros could do a lot of the lifting when adding mldsa87-p384 support. LMK which path you prefer |
|
Yeah, I've missed the message it signed was not similar. I'm just worried about the code duplication you're introducing here. |
2 participants
Adds support for https://www.ietf.org/archive/id/draft-miller-sshm-composite-sigs-01.html mldsa44-ed25519 composite keys. Given that openssh currently does not have plans to support raw mldsa keys, this superseeds my other PR.
I've tested support for interoperability on
OpenSSH_10.5p1, OpenSSL 3.6.3 9 Jun 2026in SSH agent (I signed and verified a file signature via SSH agent using this PR's implementation).(With some further patches in Bitwarden's SSH Agent):
