ML-DSA Composite Signature Support by stenslae · Pull Request #1109 · wolfSSL/wolfssh

stenslae · 2026-07-16T21:45:45Z

Introduced support for ML-DSA composite signatures for hybrid post-quantum authentication.

Added ML-DSA44-Ed25519 as per draft-miller-sshm-mldsa44-ed25519-composite-sigs
Added ML-DSA44-ECDSA-P256, ML-DSA65-ED25519, ML-DSA65-ECDSA-P256, ML-DSA87-ED448, ML-DSA87-ECDSA-P384 as per draft-sun-ssh-composite-sigs-02

Added all sig types as auth options into the test echoservers, new CI tests, and interop tested mldsa44-ed25519 wtih openssh-portable.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

No new issues found in the changed files. ✅

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src
Findings: 1

Medium (1)

Composite ML-DSA host-key algorithms missing from client's accepted host-key list

File: src/internal.c:1136
Function: cannedKeyAlgoNamesHostKey
Category: Copy-paste errors

When WOLFSSH_OSSH_CERTS is defined, cannedKeyAlgoNamesHostKey (used as the client's algoListKey for KEXINIT host-key negotiation) was not updated with the new ssh-mldsa*-* composite names, unlike its counterpart cannedKeyAlgoNames. A wolfSSH client built with WOLFSSH_OSSH_CERTS can never propose/accept a composite ML-DSA host key, so KEX with such a server fails.

Recommendation: Add the same ssh-mldsa44-es256/ssh-mldsa65-es256/ssh-mldsa87-es384/ssh-mldsa44-ed25519@openssh.com/ssh-mldsa65-ed25519/ssh-mldsa87-ed448 entries used in cannedKeyAlgoNames to cannedKeyAlgoNamesHostKey.

Referenced code: src/internal.c:1136-1140 (5 lines)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

No new issues found in the changed files. ✅

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #1109

Scan targets checked: wolfssh-bugs, wolfssh-src

No new issues found in the changed files. ✅

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 21:45

stenslae self-assigned this Jul 16, 2026

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/internal.c

Comment thread examples/echoserver/echoserver.c

stenslae commented Jul 17, 2026

View reviewed changes

Comment thread src/internal.c

stenslae commented Jul 17, 2026

View reviewed changes

Comment thread examples/echoserver/echoserver.c

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch 2 times, most recently from 9753775 to b1fec5b Compare July 20, 2026 16:46

stenslae requested a review from wolfSSL-Fenrir-bot July 20, 2026 16:46

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from b1fec5b to 5af710c Compare July 20, 2026 16:50

stenslae marked this pull request as ready for review July 20, 2026 16:53

wolfSSL-Fenrir-bot reviewed Jul 20, 2026

View reviewed changes

Comment thread examples/echoserver/echoserver.c

Comment thread examples/echoserver/echoserver.c

stenslae commented Jul 20, 2026

View reviewed changes

Comment thread examples/echoserver/echoserver.c

stenslae commented Jul 20, 2026

View reviewed changes

Comment thread examples/echoserver/echoserver.c

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from 5af710c to 1050ef1 Compare July 20, 2026 20:45

stenslae requested a review from wolfSSL-Fenrir-bot July 20, 2026 20:45

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from 1050ef1 to a1fddf0 Compare July 20, 2026 21:52

stenslae requested review from wolfSSL-Fenrir-bot and removed request for wolfSSL-Fenrir-bot July 20, 2026 22:29

wolfSSL-Fenrir-bot reviewed Jul 20, 2026

View reviewed changes

Comment thread wolfssh/internal.h Outdated

stenslae commented Jul 21, 2026

View reviewed changes

Comment thread wolfssh/internal.h Outdated

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from a1fddf0 to 2137136 Compare July 21, 2026 17:51

stenslae requested a review from wolfSSL-Fenrir-bot July 21, 2026 17:52

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from 2137136 to 145e2cf Compare July 21, 2026 18:15

wolfSSL-Fenrir-bot reviewed Jul 21, 2026

View reviewed changes

Comment thread src/internal.c Outdated

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from 145e2cf to 7228798 Compare July 21, 2026 18:23

stenslae commented Jul 21, 2026

View reviewed changes

Comment thread src/internal.c Outdated

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from 7228798 to 47dd078 Compare July 21, 2026 18:24

stenslae requested a review from wolfSSL-Fenrir-bot July 21, 2026 18:25

wolfSSL-Fenrir-bot reviewed Jul 21, 2026

View reviewed changes

Comment thread src/internal.c

Comment thread src/internal.c

stenslae commented Jul 21, 2026

View reviewed changes

Comment thread src/internal.c

wolfSSL-Fenrir-bot reviewed Jul 23, 2026

View reviewed changes

Comment thread tests/unit.c Outdated

stenslae commented Jul 27, 2026

View reviewed changes

Comment thread tests/unit.c Outdated

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch 2 times, most recently from 2cb7c21 to ad7546c Compare July 27, 2026 20:57

stenslae requested a review from wolfSSL-Fenrir-bot July 27, 2026 20:57

wolfSSL-Fenrir-bot reviewed Jul 27, 2026

View reviewed changes

Comment thread keys/include.am Outdated

stenslae commented Jul 27, 2026

View reviewed changes

Comment thread keys/include.am Outdated

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from ad7546c to f898eb2 Compare July 27, 2026 21:24

stenslae requested a review from wolfSSL-Fenrir-bot July 27, 2026 21:24

wolfSSL-Fenrir-bot reviewed Jul 27, 2026

View reviewed changes

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from f898eb2 to 3d78c13 Compare July 29, 2026 20:54

stenslae requested review from wolfSSL-Fenrir-bot and removed request for wolfSSL-Fenrir-bot July 29, 2026 21:38

wolfSSL-Fenrir-bot reviewed Jul 29, 2026

View reviewed changes

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from 3d78c13 to c48edf2 Compare August 4, 2026 22:06

stenslae requested a review from wolfSSL-Fenrir-bot August 4, 2026 22:07

wolfSSL-Fenrir-bot reviewed Aug 4, 2026

View reviewed changes

Comment thread apps/wolfsshd/test/run_all_sshd_tests.sh Outdated

Comment thread src/internal.c Outdated

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from c48edf2 to 28c692a Compare August 4, 2026 22:32

stenslae commented Aug 4, 2026

View reviewed changes

Comment thread src/internal.c Outdated

stenslae commented Aug 4, 2026

View reviewed changes

Comment thread apps/wolfsshd/test/run_all_sshd_tests.sh Outdated

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from 28c692a to 2377668 Compare August 4, 2026 22:38

Add ML-DSA44-Ed25519 composite signature support

26f167d

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from 2377668 to f2c9f9e Compare August 5, 2026 21:06

stenslae requested a review from wolfSSL-Fenrir-bot August 5, 2026 21:08

wolfSSL-Fenrir-bot reviewed Aug 5, 2026

View reviewed changes

Add remaining ML-DSA composite signature algorithms

7bb31f6

stenslae force-pushed the ml-dsa-hybrid-support-rebased branch from af6ba68 to 7bb31f6 Compare August 5, 2026 22:24

stenslae requested a review from wolfSSL-Fenrir-bot August 5, 2026 22:24

wolfSSL-Fenrir-bot reviewed Aug 5, 2026

View reviewed changes

Uh oh!

Conversation

stenslae commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1109

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1109

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1109

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1109

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1109

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1109

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1109

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1109

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1109

Medium (1)

Composite ML-DSA host-key algorithms missing from client's accepted host-key list

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1109

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1109

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #1109

Uh oh!

Reviewers

Assignees

stenslae commented Jul 16, 2026 •

edited

Loading