Discussion summary
OpenSSH 10.4/10.4p1 introduces post-quantum keys like ML-DSA 44 and Ed25519, but they are not enabled by default. Default configurations still include hmac-sha1 and umac-64. The release notes and configuration details are available on the OpenSSH website.
What the discussion says
- Some users question the formatting of release notes and suggest PRs for improvement.
- Discussion about default security algorithms like hmac-sha1 and umac-64.
- Interest in enabling post-quantum keys in SSH and FIDO2 support.
“Post-quantum keys like ML-DSA 44 are added but not enabled by default.”
“The release notes are in RST markup, which some find hard to read.”
Comments
Hacker News
Is hmac-sha1 and umac-64 still enabled by default?
by lousken
HTML version of release notes:
by throw0101a
Among other changes 10.4 adds post-quantum keys (composite ML-DSA 44 and Ed25519), not enabled by default.
When pq key agreement was added in 2019, it took almost 3 years for it to become enabled by default. This isn't criticism, just an observation. I don't have a pressing need for pq sigs. Always happy for new OpenSSH releases though!
by Panino
Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Is hmac-sha1 and umac-64 still enabled by default?by lousken
- HTML version of release notes:by throw0101a
- Among other changes 10.4 adds post-quantum keys (composite ML-DSA 44 and Ed25519), not enabled by default.
When pq key agreement was added in 2019, it took almost 3 years for it to become enabled by default. This isn't criticism, just an observation. I don't have a pressing need for pq sigs. Always happy for new OpenSSH releases though!
by Panino