[Ssh] Re: I-D Action: draft-ietf-sshm-cert-01.txt

Phillip Hallam-Baker <phill@hallambaker.com> Fri, 03 July 2026 20:31 UTC

MIME-Version: 1.0
References: <c55356d6-d015-193a-8e4d-18af1764fb1d@mindrot.org> <CH2PR17MB4022E47D9680CD64A533F6BCCDEB2@CH2PR17MB4022.namprd17.prod.outlook.com> <CAMm+LwgYyxH+K2ObwCoLpy8YUU-dtMyBuXzAvEWcAfZz9xr5-g@mail.gmail.com> <CAMm+LwjgbzED5kEYzt4fX+K=DXP1KgqEBJSZc7bEcBk0+KxPUg@mail.gmail.com>
In-Reply-To: <CAMm+LwjgbzED5kEYzt4fX+K=DXP1KgqEBJSZc7bEcBk0+KxPUg@mail.gmail.com>
From: Phillip Hallam-Baker <phill@hallambaker.com>
Date: Fri, 03 Jul 2026 16:30:50 -0400
Message-ID: <CAMm+LwiMLRR0axrpuZ_1wFGi-YgvxHVaAwv-+srH_UqMaVMAww@mail.gmail.com>
To: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>
Content-Type: multipart/alternative; boundary="000000000000fc5fcd0655bacd8c"
Message-ID-Hash: LC7FWR3YNWZNAIU56QSUW3TZB2R77KI6
CC: Damien Miller <djm@mindrot.org>, "ssh@ietf.org" <ssh@ietf.org>
Precedence: list
Subject: [Ssh] Re: I-D Action: draft-ietf-sshm-cert-01.txt
Archived-At: <https://mailarchive.ietf.org/arch/msg/ssh/XY3eGRb6P0nbPIAxLZmc0pakvZ0>

Likewise, there should be an IANA media type defined.

On Fri, Jul 3, 2026 at 2:19 PM Phillip Hallam-Baker <phill@hallambaker.com>
wrote:

> There really should be some mention of RFC6187 even if it is 'nobody uses
> that'.
>
>
> On Fri, Jul 3, 2026 at 2:06 PM Phillip Hallam-Baker <phill@hallambaker.com>
> wrote:
>
>> I really like this document as I have been trying to find the RFC
>> describing SSH user certs and simply could not. And that was because...
>>
>> I would like to propose an addition however and that is defining JWK
>> (JSON Web Key) tags allowing SSH user certs to be spliced in as base64
>> encoded blobs. This would make the certificate format a lot more useful in
>> applications and in particular in JSContact.
>>
>> This would only require a specification and expert review:
>> https://www.iana.org/assignments/jose/jose.xhtml#web-key-parameters
>>
>> The security end goal I would like to pursue is to encourage people to
>> have different keys for all their devices so that if there is a breach, it
>> is easier to close it and remediate. People should have a separate SSH key
>> pair for every client device. You would not believe some of the advice that
>> is out there on how to transfer private keys between devices (or maybe you
>> would but just get very depressed).
>>
>> We can come back and define a slot later but much better to do it here
>> and now.
>>
>>
>>
>> On Fri, Jun 26, 2026 at 4:32 PM Salz, Rich <rsalz=
>> 40akamai.com@dmarc.ietf.org> wrote:
>>
>>> On 6/15/26, 1:02 AM, "Damien Miller" <djm@mindrot.org> wrote:
>>>
>>>    - This as some examples of public and private certificates that Rich
>>>    - requested.
>>>
>>>
>>> I find the use of mnemonic names in like SSH2_CERT_TYPE_USER rather than
>>> the actual value (1) confusing, but happy to leave it to the RPC to figure
>>> out. I also don’t understand how things like the “principals” or
>>> “key-value” arrays are terminated, but that’s probably because I’m
>>> forgetting; a reference to the doc should be included I think.
>>>
>>> Those are minor, this seems ready for WGLC.
>>> _______________________________________________
>>> Ssh mailing list -- ssh@ietf.org
>>> To unsubscribe send an email to ssh-leave@ietf.org
>>>
>>

[Ssh] I-D Action: draft-ietf-sshm-cert-01.txt internet-drafts
[Ssh] Re: I-D Action: draft-ietf-sshm-cert-01.txt Damien Miller
[Ssh] Re: I-D Action: draft-ietf-sshm-cert-01.txt Damien Miller
[Ssh] Re: I-D Action: draft-ietf-sshm-cert-01.txt Salz, Rich
[Ssh] Re: I-D Action: draft-ietf-sshm-cert-01.txt Phillip Hallam-Baker
[Ssh] Re: I-D Action: draft-ietf-sshm-cert-01.txt Phillip Hallam-Baker
[Ssh] Re: I-D Action: draft-ietf-sshm-cert-01.txt Phillip Hallam-Baker