Implement ML-DSA

[quexten]

No description provided.

[baloo]

That's still a draft in https://www.ietf.org/archive/id/draft-sfluhrer-ssh-mldsa-02.html right?
That's not implemented in openssh itself as far as I can see.

[quexten]

@baloo Yes.

OpenSSH implements experimental support for draft-miller-sshm-mldsa44-ed25519-composite-sigs as of yesterdays release. A tool called SmartFTP https://www.smartftp.com/en-us/client/features/ssh implements experimental support for draft-sfluhrer-ssh-mldsa. Termius apparently also implements support for draft-sfluhrer-ssh-mldsa.

The current IETF discussion seems to lean towards implementing the pure PQ-sigs first, then later adopting / standardizing a hybrid construction. https://mailarchive.ietf.org/arch/msg/ssh/ys0vs2HtcPNSsJVLyGzN2vnXmQE/. There is an experimental set of patches for openssh and libssh too: https://mailarchive.ietf.org/arch/msg/ssh/rOlwUqiVbUueYh_BVkOzG5pLv4U/ / https://github.com/beldmit/openssh-ietf126-hackathon .

From my perspective, I'd like to test and verify that the implementation interoperates correctly with the above implementations. Then, I'm happy to upstream, given that it's behind a compile time flag / opt-in.

From RustCrypto's side, would you prefer this only to be upstreamed once the standard is finalized, or is it fine to upstream as long as we are reasonable certain that draft-sfluhrer-ssh-mldsa (or slight modifications of it) will be adopted?

[baloo]

Speaking personally, I'm fine with merging a draft. I appreciate the draft to be behind a feature-flag (to track what comes from the draft mostly).

We might want to comment about the draft in the Cargo.toml feature flag.