feat: add mldsa44_ed25519 key support

Author: quexten

ssh-key/Cargo.toml

@@ -52,7 +52,7 @@ default = ["ecdsa", "rand_core", "std"]
 alloc = ["encoding/alloc", "signature/alloc", "zeroize/alloc", ]
 std = ["alloc"]
 
-crypto = ["ed25519", "mldsa", "p256", "p384", "p521", "rsa"] # NOTE: `dsa` is obsolete/weak
+crypto = ["ed25519", "mldsa-eddsa", "p256", "p384", "p521", "rsa"] # NOTE: `dsa` is obsolete/weak
 dsa = ["dep:dsa", "dep:sha1", "alloc", "encoding/bigint", "signature/rand_core"]
 ecdsa = ["dep:sec1"]
 ed25519 = ["dep:ed25519-dalek", "rand_core"]
@@ -64,8 +64,9 @@ encryption = [
     "rand_core"
 ]
 getrandom = ["cipher/getrandom", "rand_core"]
-# This is based on draft-sfluhrer-ssh-mldsa, which is still in draft and has not been adopted
-mldsa = ["dep:ml-dsa", "alloc", "rand_core"]
+# MLDSA44-Ed25519-SHA512 composite signatures, as implemented by OpenSSH. Based on
+# draft-miller-sshm-mldsa44-ed25519-composite-sigs, which is still a draft
+mldsa-eddsa = ["dep:ml-dsa", "ed25519", "alloc", "rand_core"]
 p256 = ["dep:p256", "ecdsa"]
 p384 = ["dep:p384", "ecdsa"]
 p521 = ["dep:p521", "ecdsa"]

ssh-key/README.md

@@ -42,7 +42,7 @@ respective SSH key algorithm.
   - [x] OpenSSH certificate authority (CA) support i.e. cert builder/signer
 - [x] Private key encryption/decryption (`bcrypt-pbkdf` + `aes256-ctr` only)
 - [x] Private key generation support: DSA, Ed25519, ECDSA (P-256/P-384/P-521),
-      and RSA
+      RSA, and MLDSA44-Ed25519
 - [x] FIDO/U2F key support (`sk-*`) as specified in [PROTOCOL.u2f]
 - [x] Fingerprint support
   - [x] "randomart" fingerprint visualizations
@@ -73,6 +73,7 @@ respective SSH key algorithm.
 | `ssh‑rsa`                            | ✅     | ✅     | ✅   | ✅️     | ✅️   | ✅     | `rsa`     | `alloc`  |
 | `sk‑ecdsa‑sha2‑nistp256@openssh.com` | ✅     | ✅     | ✅   | ⛔     | ⛔️   | ✅️     | ⛔        | `alloc`  |
 | `sk‑ssh‑ed25519@openssh.com`         | ✅     | ✅     | ✅   | ⛔     | ⛔️   | ✅️️     | `ed25519` | `alloc`  |
+| `ssh‑mldsa44‑ed25519@openssh.com`    | ✅     | ✅     | ✅   | ✅️     | ✅️   | ✅️     | `mldsa-eddsa` | `alloc`  |
 
 By default *no SSH signature algorithms are enabled* and you will get an
 `Error::AlgorithmUnsupported` error if you try to use them.

ssh-key/src/algorithm.rs

@@ -47,14 +47,8 @@ const CERT_SK_ECDSA_SHA2_P256: &str = "sk-ecdsa-sha2-nistp256-cert-v01@openssh.c
 /// OpenSSH certificate for Ed25519 U2F/FIDO security key
 const CERT_SK_SSH_ED25519: &str = "sk-ssh-ed25519-cert-v01@openssh.com";
 
-/// OpenSSH certificate for ML-DSA-44 public key
-const CERT_MLDSA_44: &str = "ssh-mldsa-44-cert-v01@openssh.com";
-
-/// OpenSSH certificate for ML-DSA-65 public key
-const CERT_MLDSA_65: &str = "ssh-mldsa-65-cert-v01@openssh.com";
-
-/// OpenSSH certificate for ML-DSA-87 public key
-const CERT_MLDSA_87: &str = "ssh-mldsa-87-cert-v01@openssh.com";
+/// OpenSSH certificate for MLDSA44-Ed25519 composite public key
+const CERT_MLDSA44_ED25519: &str = "ssh-mldsa44-ed25519-cert-v01@openssh.com";
 
 /// ECDSA with SHA-256 + NIST P-256
 const ECDSA_SHA2_P256: &str = "ecdsa-sha2-nistp256";
@@ -95,14 +89,8 @@ const SK_ECDSA_SHA2_P256: &str = "sk-ecdsa-sha2-nistp256@openssh.com";
 /// U2F/FIDO security key with Ed25519
 const SK_SSH_ED25519: &str = "sk-ssh-ed25519@openssh.com";
 
-/// ML-DSA-44 (FIPS 204, security category 2)
-const SSH_MLDSA_44: &str = "ssh-mldsa-44";
-
-/// ML-DSA-65 (FIPS 204, security category 3)
-const SSH_MLDSA_65: &str = "ssh-mldsa-65";
-
-/// ML-DSA-87 (FIPS 204, security category 5)
-const SSH_MLDSA_87: &str = "ssh-mldsa-87";
+/// MLDSA44-Ed25519-SHA512 composite signature algorithm
+const SSH_MLDSA44_ED25519: &str = "ssh-mldsa44-ed25519@openssh.com";
 
 /// SSH key algorithms, i.e. digital signature algorithms used with SSH private/public keys.
 #[derive(Clone, Debug, Default, Eq, Hash, PartialEq, PartialOrd, Ord)]
@@ -139,11 +127,8 @@ pub enum Algorithm {
     /// FIDO/U2F key with Ed25519
     SkEd25519,
 
-    /// ML-DSA
-    MlDsa {
-        /// ML-DSA parameter set to use.
-        params: MlDsaParams,
-    },
+    /// MLDSA44-Ed25519-SHA512 composite signature algorithm.
+    MlDsa44Ed25519,
 
     /// Other
     #[cfg(feature = "alloc")]
@@ -162,9 +147,7 @@ impl Algorithm {
     /// - `ssh-rsa`
     /// - `sk-ecdsa-sha2-nistp256@openssh.com` (FIDO/U2F key)
     /// - `sk-ssh-ed25519@openssh.com` (FIDO/U2F key)
-    /// - `ssh-mldsa-44`
-    /// - `ssh-mldsa-65`
-    /// - `ssh-mldsa-87`
+    /// - `ssh-mldsa44-ed25519@openssh.com`
     ///
     /// Any other algorithms are mapped to the [`Algorithm::Other`] variant.
     ///
@@ -188,9 +171,7 @@ impl Algorithm {
     /// - `ssh-ed25519-cert-v01@openssh.com`
     /// - `sk-ecdsa-sha2-nistp256-cert-v01@openssh.com` (FIDO/U2F key)
     /// - `sk-ssh-ed25519-cert-v01@openssh.com` (FIDO/U2F key)
-    /// - `ssh-mldsa-44-cert-v01@openssh.com`
-    /// - `ssh-mldsa-65-cert-v01@openssh.com`
-    /// - `ssh-mldsa-87-cert-v01@openssh.com`
+    /// - `ssh-mldsa44-ed25519-cert-v01@openssh.com`
     ///
     /// Any other algorithms are mapped to the [`Algorithm::Other`] variant.
     ///
@@ -220,15 +201,7 @@ impl Algorithm {
             }),
             CERT_SK_ECDSA_SHA2_P256 => Ok(Algorithm::SkEcdsaSha2NistP256),
             CERT_SK_SSH_ED25519 => Ok(Algorithm::SkEd25519),
-            CERT_MLDSA_44 => Ok(Algorithm::MlDsa {
-                params: MlDsaParams::MlDsa44,
-            }),
-            CERT_MLDSA_65 => Ok(Algorithm::MlDsa {
-                params: MlDsaParams::MlDsa65,
-            }),
-            CERT_MLDSA_87 => Ok(Algorithm::MlDsa {
-                params: MlDsaParams::MlDsa87,
-            }),
+            CERT_MLDSA44_ED25519 => Ok(Algorithm::MlDsa44Ed25519),
             #[cfg(feature = "alloc")]
             _ => Ok(Algorithm::Other(AlgorithmName::from_certificate_type(id)?)),
             #[cfg(not(feature = "alloc"))]
@@ -254,11 +227,7 @@ impl Algorithm {
             },
             Algorithm::SkEcdsaSha2NistP256 => SK_ECDSA_SHA2_P256,
             Algorithm::SkEd25519 => SK_SSH_ED25519,
-            Algorithm::MlDsa { params } => match params {
-                MlDsaParams::MlDsa44 => SSH_MLDSA_44,
-                MlDsaParams::MlDsa65 => SSH_MLDSA_65,
-                MlDsaParams::MlDsa87 => SSH_MLDSA_87,
-            },
+            Algorithm::MlDsa44Ed25519 => SSH_MLDSA44_ED25519,
             #[cfg(feature = "alloc")]
             Algorithm::Other(algorithm) => algorithm.as_str(),
         }
@@ -291,11 +260,7 @@ impl Algorithm {
             } => CERT_RSA_SHA2_512,
             Algorithm::SkEcdsaSha2NistP256 => CERT_SK_ECDSA_SHA2_P256,
             Algorithm::SkEd25519 => CERT_SK_SSH_ED25519,
-            Algorithm::MlDsa { params } => match params {
-                MlDsaParams::MlDsa44 => CERT_MLDSA_44,
-                MlDsaParams::MlDsa65 => CERT_MLDSA_65,
-                MlDsaParams::MlDsa87 => CERT_MLDSA_87,
-            },
+            Algorithm::MlDsa44Ed25519 => CERT_MLDSA44_ED25519,
             Algorithm::Other(algorithm) => return algorithm.certificate_type(),
         }
         .to_owned()
@@ -325,10 +290,10 @@ impl Algorithm {
         matches!(self, Algorithm::Rsa { .. })
     }
 
-    /// Is the algorithm ML-DSA?
+    /// Is the algorithm the MLDSA44-Ed25519 composite scheme?
     #[must_use]
-    pub fn is_mldsa(self) -> bool {
-        matches!(self, Algorithm::MlDsa { .. })
+    pub fn is_mldsa44_ed25519(self) -> bool {
+        matches!(self, Algorithm::MlDsa44Ed25519)
     }
 
     /// Return an error indicating this algorithm is unsupported.
@@ -377,15 +342,7 @@ impl str::FromStr for Algorithm {
             SSH_RSA => Ok(Algorithm::Rsa { hash: None }),
             SK_ECDSA_SHA2_P256 => Ok(Algorithm::SkEcdsaSha2NistP256),
             SK_SSH_ED25519 => Ok(Algorithm::SkEd25519),
-            SSH_MLDSA_44 => Ok(Algorithm::MlDsa {
-                params: MlDsaParams::MlDsa44,
-            }),
-            SSH_MLDSA_65 => Ok(Algorithm::MlDsa {
-                params: MlDsaParams::MlDsa65,
-            }),
-            SSH_MLDSA_87 => Ok(Algorithm::MlDsa {
-                params: MlDsaParams::MlDsa87,
-            }),
+            SSH_MLDSA44_ED25519 => Ok(Algorithm::MlDsa44Ed25519),
             #[cfg(feature = "alloc")]
             _ => Ok(Algorithm::Other(AlgorithmName::from_str(id)?)),
             #[cfg(not(feature = "alloc"))]
@@ -476,108 +433,6 @@ impl str::FromStr for EcdsaCurve {
     }
 }
 
-/// ML-DSA parameter sets supported for use with SSH as specified in [FIPS204].
-///
-/// Each parameter set corresponds to a NIST security category.
-///
-/// [FIPS204]: https://csrc.nist.gov/pubs/fips/204/final
-#[derive(Copy, Clone, Debug, Eq, Hash, PartialEq, PartialOrd, Ord)]
-pub enum MlDsaParams {
-    /// ML-DSA-44 (security category 2).
-    MlDsa44,
-
-    /// ML-DSA-65 (security category 3)
-    MlDsa65,
-
-    /// ML-DSA-87 (security category 5).
-    MlDsa87,
-}
-
-impl MlDsaParams {
-    /// Decode an ML-DSA parameter set from the given SSH algorithm identifier.
-    ///
-    /// # Supported identifiers
-    ///
-    /// - `ssh-mldsa-44`
-    /// - `ssh-mldsa-65`
-    /// - `ssh-mldsa-87`
-    ///
-    /// # Errors
-    /// Returns [`Error::Encoding`] in the event the identifier is not known.
-    pub fn new(id: &str) -> Result<Self> {
-        Ok(id.parse()?)
-    }
-
-    /// Get the SSH algorithm identifier which corresponds to this parameter set.
-    #[must_use]
-    pub fn as_str(self) -> &'static str {
-        match self {
-            MlDsaParams::MlDsa44 => SSH_MLDSA_44,
-            MlDsaParams::MlDsa65 => SSH_MLDSA_65,
-            MlDsaParams::MlDsa87 => SSH_MLDSA_87,
-        }
-    }
-
-    /// Size in bytes of a FIPS 204 public key for this parameter set.
-    #[must_use]
-    pub const fn public_key_size(self) -> usize {
-        match self {
-            MlDsaParams::MlDsa44 => 1312,
-            MlDsaParams::MlDsa65 => 1952,
-            MlDsaParams::MlDsa87 => 2592,
-        }
-    }
-
-    /// Size in bytes of a FIPS 204 signature for this parameter set.
-    #[must_use]
-    pub const fn signature_size(self) -> usize {
-        match self {
-            MlDsaParams::MlDsa44 => 2420,
-            MlDsaParams::MlDsa65 => 3309,
-            MlDsaParams::MlDsa87 => 4627,
-        }
-    }
-
-    /// Size in bytes of the seed (ξ) used to derive an ML-DSA key.
-    ///
-    /// This is 32 bytes for all parameter sets.
-    #[must_use]
-    pub const fn seed_size(self) -> usize {
-        32
-    }
-}
-
-impl AsRef<str> for MlDsaParams {
-    fn as_ref(&self) -> &str {
-        self.as_str()
-    }
-}
-
-impl From<MlDsaParams> for Algorithm {
-    fn from(params: MlDsaParams) -> Algorithm {
-        Algorithm::MlDsa { params }
-    }
-}
-
-impl fmt::Display for MlDsaParams {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str(self.as_str())
-    }
-}
-
-impl str::FromStr for MlDsaParams {
-    type Err = LabelError;
-
-    fn from_str(id: &str) -> core::result::Result<Self, LabelError> {
-        match id {
-            SSH_MLDSA_44 => Ok(MlDsaParams::MlDsa44),
-            SSH_MLDSA_65 => Ok(MlDsaParams::MlDsa65),
-            SSH_MLDSA_87 => Ok(MlDsaParams::MlDsa87),
-            _ => Err(LabelError::new(id)),
-        }
-    }
-}
-
 /// Hashing algorithms a.k.a. digest functions.
 #[derive(Copy, Clone, Debug, Default, Eq, Hash, PartialEq, PartialOrd, Ord)]
 #[non_exhaustive]

ssh-key/src/lib.rs

@@ -139,6 +139,8 @@ mod kdf;
 mod comment;
 #[cfg(feature = "std")]
 mod dot_ssh;
+#[cfg(feature = "mldsa-eddsa")]
+mod mldsa_eddsa;
 #[cfg(feature = "ppk")]
 mod ppk;
 #[cfg(feature = "alloc")]
@@ -147,7 +149,7 @@ mod signature;
 mod sshsig;
 
 pub use crate::{
-    algorithm::{Algorithm, AssociatedHashAlg, EcdsaCurve, HashAlg, KdfAlg, MlDsaParams},
+    algorithm::{Algorithm, AssociatedHashAlg, EcdsaCurve, HashAlg, KdfAlg},
     authorized_keys::AuthorizedKeys,
     error::{Error, Result},
     fingerprint::Fingerprint,