Patching

OpenSSH 10.6 turns on post-quantum signatures

By Yaali. October 12, 2026, 6 min read, Patching, Identity, Resilience.

OpenSSH 10.6 ships ssh-mldsa44-ed25519 and breaks keys made with the experimental version. What to check, what to regenerate, and the NSA and GAO deadlines.

OpenSSH 10.6, released on October 6, 2026, enables ssh-mldsa44-ed25519, a hybrid post-quantum signature algorithm for host keys and user keys. Anyone who tried the experimental version added in OpenSSH 10.4 (July 2026) has a problem: the algorithm name changed, and the release notes say keys generated with the experimental support "must be regenerated and/or removed". The same release fixes several security bugs, and the OpenSSH team says it will now ship releases more often.

This matters to two groups. Teams that tested post-quantum SSH keys on 10.4 or 10.5 hosts need to clean up before or during the upgrade, because an old algorithm name left in sshd_config stops sshd from starting. Everyone else should note the date: a post-quantum signature option now ships enabled in OpenSSH, and US government deadlines for post-quantum systems start in 2027.

What changed in 10.6

SSH uses cryptography in two places. Key agreement sets up the session keys that encrypt traffic, and OpenSSH has made a post-quantum hybrid the default there since 9.0 in April 2022 (sntrup761x25519), switching to mlkem768x25519-sha256 as the default in 10.0 (April 2025). Signatures prove identity: the server signs to prove it is the host you expect, and your key signs to log you in. Until now those signatures were classical (Ed25519, ECDSA or RSA), which a large enough quantum computer could forge.

ssh-mldsa44-ed25519 combines ML-DSA-44, the lattice-based signature scheme NIST standardised in FIPS 204, with Ed25519. Each signature carries both parts and both must verify, so a forger has to break ML-DSA and Ed25519 together; if a flaw turns up in the newer scheme, Ed25519 still holds. In 10.4 this lived under the vendor name ssh-mldsa44-ed25519@openssh.com and was off unless you added it to HostKeyAlgorithms and PubkeyAcceptedAlgorithms. In 10.6 the @openssh.com suffix is gone, and the OpenSSH 10.6 source lists the new name (and its certificate form) in the default host key and public key algorithm lists, placed after the classical algorithms.

The urgency differs from key agreement. OpenSSH's own post-quantum page points out that broken signatures do not expose recorded traffic, because there is no "store now, decrypt later" equivalent for authentication. The job is to have classical keys retired before a quantum computer that can forge them exists. Key agreement is the part that protects traffic being recorded today.

Why old experimental keys break

The key type name is written into every public key line (.pub files, authorized_keys, known_hosts) and into the private key file. Keys created on 10.4 or 10.5 carry ssh-mldsa44-ed25519@openssh.com, a name 10.6 no longer recognises, so those keys stop working after the upgrade.

The config files are the bigger risk. sshd checks every name in HostKeyAlgorithms, PubkeyAcceptedAlgorithms and the related options when it reads its configuration. In the 10.6 source, an unknown name ends in a fatal "Bad key types" error, so a line such as PubkeyAcceptedAlgorithms +ssh-mldsa44-ed25519@openssh.com left over from testing keeps sshd from starting after the package upgrade. On a remote host with no console access, that means a lockout.

Host keys deserve a check too. When sshd_config has no HostKey lines, both 10.4 and 10.6 load /etc/ssh/ssh_host_mldsa44_ed25519_key along with the RSA, ECDSA and Ed25519 keys, and ssh-keygen -A creates that file when it is missing. A host that ran ssh-keygen -A on 10.4 or 10.5 may already hold an experimental key at that path.

The rest of the release

10.6 also fixes security bugs. sftp now validates paths returned by the server more strictly, so a malicious server cannot steer a recursive download outside its target directory. sshd only stores GSSAPI credentials after authentication succeeds. The LZ77 dictionary compressor is disabled in ssh and sshd after researchers showed that one channel in a multiplexed session could recover secrets from another through the shared compression context, which makes the Compression option less effective. ssh also refuses $ and \ in usernames typed on the command line, to stop injection through ProxyCommand and Match exec, and sshd_config gains WarnWeakCrypto, which logs clients that connect without a post-quantum key agreement.

The cadence change has a stated reason. The team says it is receiving many AI-assisted bug reports and has seen bugs found by AI tools independently rediscovered by other researchers, which suggests attackers can find them too. It will release more often rather than batching fixes, so plan for shorter OpenSSH update cycles.

The government deadlines

At the start of October, the NSA announced post-quantum measures for national security systems. Under Committee on National Security Systems Policy 15, all new commercial national security systems must support quantum-resistant algorithms from 2027, and legacy systems that cannot will be phased out by 2030. These dates bind US national security systems and their suppliers, but they set expectations for vendors that sell to everyone.

On October 6, the GAO published GAO-27-108740, the public version of an audit of the 24 largest federal agencies. Only one had completed the first step, an inventory of systems that use quantum-vulnerable cryptography. None had identified all the funding needed and none had tested post-quantum algorithms. Only five used automated tools to find vulnerable cryptography, and 18 reported a lack of cryptography expertise.

What to do

1. Find out what you run. ssh -V prints the client version and sshd -V the server version. Distribution packages lag upstream and backport fixes, so check your vendor's advisories too. Only hosts on 10.4 or 10.5 can hold experimental keys.
2. Find experimental keys and settings. Run grep -rn "mldsa44-ed25519@openssh.com" /etc/ssh ~/.ssh on each host, and the same search against every user's .ssh directory and any configuration management repository. Hits in authorized_keys or known_hosts are stale entries. Hits in sshd_config, ssh_config or files under sshd_config.d must be removed before the upgrade. Private keys are base64 encoded, so grep will not match them; look for files named id_mldsa44_ed25519 and ssh_host_mldsa44_ed25519_key instead.
3. Test the config before restarting. After editing, run sshd -t (exit code 0 means the config parses) and keep your current session open until a new login succeeds. sshd -T | grep -i -E "hostkeyalgorithms|pubkeyacceptedalgorithms|kexalgorithms" shows the effective lists, and ssh -Q key | grep mldsa shows which name a build uses.
4. Regenerate after upgrading. For a host key, delete /etc/ssh/ssh_host_mldsa44_ed25519_key and its .pub, run ssh-keygen -A, and restart sshd; clients will see a new host key for that algorithm. For a user key, run ssh-keygen -t mldsa44-ed25519 (the default file is ~/.ssh/id_mldsa44_ed25519) and add the new public key to authorized_keys. Keep an Ed25519 key alongside it, because servers older than 10.6 and other SSH implementations will not recognise the new name.
5. Make sure key agreement is post-quantum. That is the part protecting traffic recorded today. Since 10.1 (October 2025) the client warns when a connection falls back to a classical key exchange, and with 10.6 the server can log it too. Use those warnings to find servers and network appliances that only offer curve25519-sha256 or older.
6. Start the inventory. The GAO finding is a warning for any organisation. For SSH, the inventory is a list of every host, its SSH implementation and version, its host key types and the key exchange algorithms it offers. ssh-keyscan -t rsa,ecdsa,ed25519 -f hosts.txt collects host keys from a list of hosts, and nmap -p 22 --script ssh2-enum-algos <range> lists the key exchange and host key algorithms each server offers.

We review SSH and crypto settings in our safeguarding and hardening work and map exposed SSH services in attack surface management. If you want help planning the upgrade or building the inventory, open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: OpenSSH release notes, OpenSSH post-quantum cryptography, OpenSSH 10.6 default algorithms (myproposal.h), OpenSSH 10.6 config parsing (servconf.c), Help Net Security, Risky Bulletin, ExecutiveGov, OODA Loop, GAO-27-108740, Cybersecurity Dive.