OpenSSH 10.4 Released with Critical Security Fixes and Post-Quantum Support
OpenSSH 10.4/10.4p1 Released
We are excited to release OpenSSH 10.4, featuring critical security patches for sftp and scp to prevent malicious file placement. This update introduces experimental post-quantum signature schemes combining ML-DSA 44 and Ed25519, while enforcing stricter transport protocols to block memory exhaustion attacks. We also fixed numerous bugs, including use-after-free vulnerabilities and configuration parsing errors, ensuring a more robust and secure experience for all users.
Previously a malicious peer could continue sending non-key exchange messages without penalty, causing memory to be wasted up until the connection terminated or the server/client hit a memory limit.
- Panino
Among other changes 10.4 adds post-quantum keys (composite ML-DSA 44 and Ed25519), not enabled by default.
When pq key agreement was added in 2019, it took almost 3 years for it to become enabled by default. This isn't criticism, just an observation. I don't have a pressing need for pq sigs. Always happy for new OpenSSH releases though!
- throw0101a
HTML version of release notes:
- lousken
Is hmac-sha1 and umac-64 still enabled by default?