MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Message-ID: <27121.65513.156640.328203@fireball.acr.fi>
Date: Wed, 29 Apr 2026 15:56:09 +0300
From: Tero Kivinen <kivinen@iki.fi>
To: Roumen Petrov <pkixssh@roumenpetrov.info>
In-Reply-To: <48747b8d-9f5a-4e8f-b844-f3bdfa5d8b22@roumenpetrov.info>
References: 
 <177694026124.1167663.14342393855069278288@dt-datatracker-b45949c58-5szpr>
	<1777012657-sup-6689@thyestes.tartarus.org>
	<27119.42744.866989.598921@fireball.acr.fi>
	<48747b8d-9f5a-4e8f-b844-f3bdfa5d8b22@roumenpetrov.info>
Message-ID-Hash: 6VA7Z5QK4QWD44ASWRE5OV7ROCCBIGX6
CC: ssh@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BSsh=5D_Re=3A_I-D_Action=3A_draft-ietf-sshm-cert-00=2Etxt?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/ssh/-cSI0WNaQW5Ct7JbhfxeMbZEcVY>

Roumen Petrov writes:
> =D0=9D=D0=B0 27.04.26 =D0=B3. =D0=B2 21:12, Tero Kivinen =D0=BD=D0=B0=
=D0=BF=D0=B8=D1=81=D0=B0:
> >>[]
> > It does not do that, or more exactly it does even more. My
> > understanding is that the existing implementations use
> > "ssh-rsa-cert-v01@openssh.com" name not the "ssh-rsa-cert" name.
>=20
>    Names that do not contain an at-sign ("@") are reserved to be
>    assigned by IETF CONSENSUS.  Examples include "3des-cbc", "sha-1",=

>    "hmac-sha1", and "zlib" (the doublequotes are not part of the
>    name).  Names of this format are only valid if they are first
>    registered with the IANA.  Registered names MUST NOT contain an
>    at-sign ("@"), comma (","), whitespace, control characters (ASCII
>    codes 32 or less), or the ASCII code 127 (DEL).  Names are case-
>    sensitive, and MUST NOT be longer than 64 characters.
>=20
> Doesn't this working group want to follow "Secure Shell (SSH)
> protocol architecture"=3F=20

This text is not relevat as the name does contain '@'. The second
bullet is relevant:

   o  Anyone can define additional algorithms or methods by using names=

      in the format name@domainname, e.g., "ourcipher-cbc@example.com".=

      The format of the part preceding the at-sign is not specified;
      however, these names MUST be printable US-ASCII strings, and MUST=

      NOT contain the comma character (","), whitespace, control
      characters (ASCII codes 32 or less), or the ASCII code 127 (DEL).=

      They MUST have only a single at-sign in them.  The part following=

      the at-sign MUST be a valid, fully qualified domain name [RFC1034=
]
      controlled by the person or organization defining the name.  Name=
s
      are case-sensitive, and MUST NOT be longer than 64 characters.  I=
t
      is up to each domain how it manages its local namespace.  It
      should be noted that these names resemble STD 11 [RFC0822] email
      addresses.  This is purely coincidental and has nothing to do wit=
h
      STD 11 [RFC0822].

The name ssh-rsa-cert-v01@openssh.com follows rules specified there.
Nothing in the architecture says we can't use IETF CONSENSUS to
allocate these types of names too if we want (there is no need, but we
can use it if we like). We are documenting protocol defined by
external body and making it backward compatible with that one, and
that is the reason we want to keep the same name.

We might need to create new sub registry Public Key Algorithm Names
for commonly used private space names for public key algorithm names,
as iana registry do say that in existing registry the names MUST NOT
contain at-sign.
--=20
kivinen@iki.fi