IETF Logo Mail Archive

[Ssh] Re: I-D Action: draft-ietf-sshm-cert-00.txt

Tero Kivinen <kivinen@iki.fi> Wed, 29 April 2026 12:44 UTC

Return-Path: <kivinen@iki.fi>
X-Original-To: ssh@mail2.ietf.org
Delivered-To: ssh@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 65E4DE5A0E00 for <ssh@mail2.ietf.org>; Wed, 29 Apr 2026 05:44:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1777466681; bh=mOBGft9N5GgMxs60TtemHla2a9kDb3mMjd9LowyOQLo=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=D5H88k1HYSHr2PNG21FLFIYZdxzt9lqTM1W4RKr1YUOHgDwkVubim8NqG3GG9SrpS ScXZU3ZhIW/4lXjtdiv6HupXnRtah9hxvT7Q9G8PnnSY5Zui8rUMhlbHwCMzu5j1e/ LwnXV0WDRrqOvvToGFeyXGHelRA4ZRXS3768NpKc=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.8
X-Spam-Level:
X-Spam-Status: No, score=-2.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=iki.fi
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LnDDsvIH1iLO for <ssh@mail2.ietf.org>; Wed, 29 Apr 2026 05:44:41 -0700 (PDT)
Received: from lahtoruutu.iki.fi (lahtoruutu.iki.fi [IPv6:2a0b:5c81:1c1::37]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 04FCDE5A0DFB for <ssh@ietf.org>; Wed, 29 Apr 2026 05:44:41 -0700 (PDT)
Received: from fireball.acr.fi (fireball.acr.fi [83.145.195.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: kivinen@iki.fi) by lahtoruutu.iki.fi (Postfix) with ESMTPSA id 4g5H7K2dRcz49PxH; Wed, 29 Apr 2026 15:44:29 +0300 (EEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=lahtoruutu; t=1777466669; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aLud7RgRVZiLvFwwSnjvbm8/GE0fTJ8FnVcPOmvK4sA=; b=jgb5/wcwODmF41TLS6RX6mDAu0xPTVNfYHYeOT+ul9bvPJBcER1w6ZqlmFGr69T1scXJ/r qvsQw6oREPyja/QqGOxiReg9HXGjp/3ZMZ92YB/06D1yjUOv5fuuKJtLUBttRirilYTayg Nu/fOlGOLXzapVAvc30R2+zNyBZcxou4VQyEEiIj/r6z/5QCDPVFbZ6aQZZMYyHyyQQmhb EvACRJzi8GGdqZOMC0pAbx9eCrVmntnZ4lk1xNC8tkWkJiepOCdKAKa4PlRzhMJoRmvi07 Y/KHyu3P1rTIrTrOQcOnWVFY5vUfVvYQXaGAUtnpPH9giI1fgBzPXZlmOdUjJQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=lahtoruutu; t=1777466669; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aLud7RgRVZiLvFwwSnjvbm8/GE0fTJ8FnVcPOmvK4sA=; b=OX8e4oZ6SKisI3GdbeKamNS2BmGtzWiWzF+6smz0oVAuEdSMdRMCGQDWhdSeLJcgnP3RmI qjMYdjcShTDll9NhsCv8oDZZ/D8kCZw5q9pP0bwamqcF/aMNILZauFKHX9mxp5CfDOynET wu0rscGOduWJlGphsu6jQTVUzmC01tvfGFeL0r250wQFvIvAgxtNpulwhf2+yciIM07eyM GlVAwsurEa2vTFSTjK8KOcOiw4wMncGjYaVaQQrAgCj3jYfTG0kaLABha0FGoqlGGzlxSC 4GWDPrxBnKPyUlEoNuNqdMXXkhGoTGamPCSGWzF+KUpkbZ2wS6wdabtUrg8bxA==
ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=kivinen@iki.fi smtp.mailfrom=kivinen@iki.fi
ARC-Seal: i=1; a=rsa-sha256; d=iki.fi; s=lahtoruutu; cv=none; t=1777466669; b=dNeJYr/tEH4cy8xe3G7d6CP1abwS80CQG04QbsMl/XqiVRivhmoJ3zarRAS8W65Cj6kAF0 KBst6hiAyA1J9WSUjKUtmD5xm0orQluISJAB/VNaBn6TYwx2p5ZMFKlKQHNX0lILCtNdR3 NnMcm7iv42Jbzvenq1b8dGILfd8y2RIdBzCxDLQS/2YseFOGn/btb1lst3Y0/yf9Ai8sCP Cad/sHhchvEfACplIVbsZVeTu7zkmmw82/5saLyZzzK0oBPinDvuuGZHm4IyQ6S0UbvsIE 6FnXW4EiX3IfUvsmL8+0CymVqw7ZQAsIRLRc0ggdiIzUKSWJ1/bHpx+c/FCW9A==
Received: by fireball.acr.fi (Postfix, from userid 15204) id BD6CF25C1394; Wed, 29 Apr 2026 15:44:24 +0300 (EEST)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Message-ID: <27121.64808.580379.214602@fireball.acr.fi>
Date: Wed, 29 Apr 2026 15:44:24 +0300
From: Tero Kivinen <kivinen@iki.fi>
To: Ran Atkinson <ran.atkinson@gmail.com>
In-Reply-To: <A6C50332-FFB8-42B2-8664-94A79D7753B9@gmail.com>
References: <177694026124.1167663.14342393855069278288@dt-datatracker-b45949c58-5szpr> <1777012657-sup-6689@thyestes.tartarus.org> <27119.42744.866989.598921@fireball.acr.fi> <A6C50332-FFB8-42B2-8664-94A79D7753B9@gmail.com>
X-Mailer: VM 8.2.0b under 26.3 (x86_64--netbsd)
X-Edit-Time: 6 min
X-Total-Time: 13 min
Message-ID-Hash: LQKXE4UXFD2Y4D5Q72SAUPMTW5U22BP7
X-Message-ID-Hash: LQKXE4UXFD2Y4D5Q72SAUPMTW5U22BP7
X-MailFrom: kivinen@iki.fi
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Simon Tatham <anakin@pobox.com>, ssh <ssh@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Ssh] Re: I-D Action: draft-ietf-sshm-cert-00.txt
List-Id: "The SSH mail list will allow discussions on improving aspects of the Secure Shell (SSH) protocol." <ssh.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ssh/Ml_epeW3dN__Er6x6AGmJ1UaS6E>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ssh>
List-Help: <mailto:ssh-request@ietf.org?subject=help>
List-Owner: <mailto:ssh-owner@ietf.org>
List-Post: <mailto:ssh@ietf.org>
List-Subscribe: <mailto:ssh-join@ietf.org>
List-Unsubscribe: <mailto:ssh-leave@ietf.org>

Ran Atkinson writes:
> If Tero’s approach is taken, then correct process means the OpenSSH
> maintainers explicit prior approval is needed — because it is using
> their namespace.

If we are just documenting what openssh has been using, and not
changing it, then we should document it exactly so it is compatible
with what the existing implementations, and that includes using the id
they are using.

If we are going to change something in the ssh certificates then we
must use new name anyway, but my understanding was that we are not
changing anything as we want to be backward compatible.

> I think it is very worthwhile to have a documented approach for
> handling X.509 certs in SSH.  I’m indifferent on which particular
> approach is taken.   

My understanding RFC6187 "509v3 Certificates for Secure Shell
Authentication" already does that.
-- 
kivinen@iki.fi

v2.46.0 | Report a Bug | By Email | System Status