[Curdle] Advice on SFTP toward RFC?

[denis bider <[e-mail]>]

Hey everyone,

I understand this is not covered by Curdle's charter, but we've made some
progress with SSH here, and I would like to seek any advice folks might
have about the SFTP situation. I would be happy to receive any responses
privately since prolonged discussion would not be relevant to the group.

SFTP is a widely used internet protocol that exists in two main versions:
SFTP v3 with OpenSSH extensions, and SFTP v6. SFTP v4 is also widely
supported, but most v4 implementations now seem to also include v6.

The schism happened over a decade ago when OpenSSH refused to adopt
protocol enhancements to support non-Unix platforms. They argued SFTP v3
has everything it needs, which it does on Unix. But from a non-Unix
perspective, everyone else thought it's not good enough, and better support
for other platforms is needed. Because of this, there wasn't consensus, and
SFTP did not become an RFC.

Now, the result is that SFTP is a major internet protocol, and anyone who
wants to implement it needs to follow this:

https://tools.ietf.org/html/draft-ietf-secsh-filexfer-02

... for SFTP version 3, and this:

https://tools.ietf.org/html/draft-ietf-secsh-filexfer-13

https://tools.ietf.org/html/draft-galb-filexfer-extensions-00

... for SFTP version 6.

In addition, a number of details are unclear and not documented fully. For
example, OpenSSH encodes some packets differently than SFTP v3 prescribes,
and implementations of check-file extensions are not compatible in practice
due to different restrictions on their usage.

I would think it worthwhile for SFTP to receive better treatment, and I
think practical use justifies documenting both version 3 and version 6.
Since both are widely used, I think it would be reasonable for this to be
Standards track, not Informational.

However, if I write a draft - or perhaps two drafts - I'm not sure who to
turn to. I'm not sure there's a working group that this could be made part
of. Is it possible to pursue Standards track as an individual submission?
Should we create a working group with the purpose to document existing
practice?

denis