IETF Logo Mail Archive

[Ssh] Re: I-D Action: draft-ietf-sshm-cert-00.txt

Peter Gutmann <pgut001@cs.auckland.ac.nz> Fri, 24 April 2026 11:27 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: ssh@mail2.ietf.org
Delivered-To: ssh@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 32D47E252567 for <ssh@mail2.ietf.org>; Fri, 24 Apr 2026 04:27:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1777030035; bh=kZ9X3oaufAzt7rp2UQloEbBfv4m+281qU7h79tDy8FY=; h=From:To:Subject:Date:References:In-Reply-To; b=LJ2Sjdi6Pky+NnMKohyyXG2eH2MzRo7qX3Aa14DVCbga7Ed/ucB2YH3lT0WND4Ti1 6QUPx9dGL1GmxG+8mxJmr+fnDc99/D/7V27tzsImYPt7f5E+dgvzquGxaDmPK7n4dR uBwxlCAKqlGP58QrGltsqYNUmv8lZiYO4H0Rb4f0=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cs.auckland.ac.nz
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JDS1vwsdT48v for <ssh@mail2.ietf.org>; Fri, 24 Apr 2026 04:27:14 -0700 (PDT)
Received: from SY2PR01CU004.outbound.protection.outlook.com (mail-australiaeastazon11021127.outbound.protection.outlook.com [40.107.39.127]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 432A3E2523CC for <ssh@ietf.org>; Fri, 24 Apr 2026 04:25:20 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=yvnQBV2OQghxoWizuCLLqvZlgldOdJr7kazCN6gAj++SCMkqPy0xDcK7vlB0pfFvJ1m9CTeyfLWqdFpURWMzBrJzU2gBIxs3nq0g4wKk6FjLF9JYNmTYLwxYkUx+qs5a8h/8KbaTJmS/yEKNJ/+UMvVz1vRNMwvK9R/05kfR8cXlIblaUVRwC1X5t/vBadGMAPY3v7n/ZsSqXgfej1VENpAkW4jxA5hqCB9yT2oSMpYesqwb7xQAug18DHAlHgyC+4mrdU7p1/dLjKAGHS0FVfDtdAABbon50AXXhEd0ddcCGNMneLbgp01/5UTJLSG3gXPKNAZ+0RCYzwGphys+nw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=IEJQpaCVWfNYS9EtjK/kn3xjSiqjhvNsbbAOoXCzvwA=; b=WCjuC7dxuh9IR5xUSkB53XAujFn+7fjxJnzTCCVLOiCcyqvH9u0n0t5qM7Ec0VBjbEgVxlseJeUXncmmmSakh7e3lkdT/ZnP7XtYqHuhTryjknGqqRm1A2zmIih0nDd18e6UkhBfVIB+WOpJoz6g7zxjznliN9jUGxq2ruCBLy6B9LFasRxDnuaVu+EAn6AzPKcJ/iEfpZBtxMB3Af88s+yCIqZQecTTCOi1ctHt1XqEK5u/vVzaeUCBFRXST27Qx7gl8f9EIeh3FttQQ9Tpsx+dfuSIT0EpNlQJCoAWtUuzkAMyp0G8PYfmCwj8l5TRPDY373WjNZ4+76bqgrAuoA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cs.auckland.ac.nz; dmarc=pass action=none header.from=cs.auckland.ac.nz; dkim=pass header.d=cs.auckland.ac.nz; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.auckland.ac.nz; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IEJQpaCVWfNYS9EtjK/kn3xjSiqjhvNsbbAOoXCzvwA=; b=Cb0gCdezatJoO+LDcFcyUHFKzZ9qGukAWArztwHxnp1e4CYU2oHC97R6/lt8Fa2G9+dxh9pKtgYgEYkB4AF3Uqxv9Awfdzh0EDoK/xMYm5TeVMnwXXjNcnCxi6c2pTvOphuXHi1gqVSrAqnLxVeGN805EkTEqFfl9nauixtDu/6+FW/Zczq64k/6NanUo8V+Yj0XePJQLv3pdcwaeiTtzudBdE8hQ63Ur4TqIQFai9aLapycaF85Kiwbus6mp4/L1feyjnn11Os5RyP5ts1V+/yt71s7eU9eKoFusSY8T0OkjLFB7UsbgagbzW90TbnewdiqJv4gD85zUxsnEehOPQ==
Received: from MEAPR01MB3654.ausprd01.prod.outlook.com (2603:10c6:201:38::9) by SY7PR01MB9713.ausprd01.prod.outlook.com (2603:10c6:10:301::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9846.22; Fri, 24 Apr 2026 11:25:08 +0000
Received: from MEAPR01MB3654.ausprd01.prod.outlook.com ([fe80::e2ae:955b:18b7:3064]) by MEAPR01MB3654.ausprd01.prod.outlook.com ([fe80::e2ae:955b:18b7:3064%5]) with mapi id 15.20.9846.021; Fri, 24 Apr 2026 11:25:08 +0000
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: S Moonesamy <sm+ietf@elandsys.com>, "ssh@ietf.org" <ssh@ietf.org>
Thread-Topic: [Ssh] Re: I-D Action: draft-ietf-sshm-cert-00.txt
Thread-Index: AQHc08BSXoeLnurxVEqPAB62XtZMJ7XuEWaH
Date: Fri, 24 Apr 2026 11:25:08 +0000
Message-ID: <MEAPR01MB365416EBFADEAE65601618A7EE2B2@MEAPR01MB3654.ausprd01.prod.outlook.com>
References: <177694026124.1167663.14342393855069278288@dt-datatracker-b45949c58-5szpr> <MEAPR01MB3654F1EF26DA7E72A3F96E21EE2B2@MEAPR01MB3654.ausprd01.prod.outlook.com> <6.2.5.6.2.20260424004507.146f6398@elandnews.com>
In-Reply-To: <6.2.5.6.2.20260424004507.146f6398@elandnews.com>
Accept-Language: en-NZ, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cs.auckland.ac.nz;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MEAPR01MB3654:EE_|SY7PR01MB9713:EE_
x-ms-office365-filtering-correlation-id: 86c6693d-838f-4484-12b8-08dea1f42434
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|376014|1800799024|10070799003|786006|366016|38070700021|56012099003|18002099003|22082099003;
x-microsoft-antispam-message-info: QSny7J3Xt+3aVxAXmbGoTljFNHaBbag1vjBomoWEZUcBbV1ku5ZLxUJqloHVM7WL0XzEOi7C5jwxFVN7nZ2tN4AthNC4rEmqfe7kMYg7ET7i7a2EFYEPbwEbi+l/4uq/7RrCdvDlbfvmbrC2d+9qJREyl1XDNWkzc0fNpXqbYfk+VQ+MZAPeUd8vMDeKF+NU80+zWJNLxxC7x7kVvJ+Jj2LpcPOeIhGTTEk1JFcQGD8WhxqM+jrmh7mhRjHWC1EVdm8O4hkocNIlLU63tEZEi/oZ0IlyiFQYl594Yr+UsoSEA6wZU7JcsxpWaR9pQUQ85PDAEGBmxq6gKRGzrIPS3+SLj+0FltxpJOB2Se8zBzp4Ew6BQ9BY6WRAXL9j9c4hi9tdWoI7Hv1IyiNVHbqrnYaXVLO26vfANyQaq6XJ3v8NHiM9F3THnsTQdxyuIQNsAqS1YtmWPzD0WvTXIMGPJhf9o+XTwiNctTbODd6u9Mnh1gfX1ynvfWR/NXaVfXrXasgcaX1S0eefFL/YuzgTr62Veh9YfcTX6Z5gdyypU9nL/PZvlxNs66gXcd5rgBcFiTgEmn5YI5rJH37KQw1FDa2InI/+D3IGl+hYXtoZrmAu6jOqyLStNllGpdcScgW1FiZkukHl5/oJEy2tIDHU+XloG8dnyukb/shiXAVbFq/q15l8/S4zlYUpRdd+2xhzKAVu/DwSxSF9gEF6/yok5KxfVqpPfBHuMlKq939ae2/o+SUYdRZmUgPxlCQK5uPVYUs30F7t29K5/mzbHhQYElyYl7fH77/k3L/Uz6z/1GE=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MEAPR01MB3654.ausprd01.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(1800799024)(10070799003)(786006)(366016)(38070700021)(56012099003)(18002099003)(22082099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: TMkhKnbwiEY1OgcuDbIZsxScTFCNvBauhUSt3bGc12d/N3rghlNTKE6zSbXbcqQ/INquNTJ8h3tzDifkhQp8fu9T9NtiwjJFi34uShwMxkZIMT8mF023XkH33jz9dAuu8tqRERXLXAZd2CMMAD8kjArlN98VXSnvr4x2hvCqSRWxxCk30fuyDW9NhFeUCgst/FrZ3HB/9h88beGKBS54zVd+mepkS084pbxFBhkhEoHfyGFYTY0NOp++mk04qpfD8JuZHS3T0rt9DSf5hNV7yLLT48TvFaUjDoU02ZD9ok0TRWJKvBA29YdZkwAQ9z5lzpLxcqyUbgYYoSeAlZZztmcIvXreQKkkaSCiITx6OV0EAIzeOsNSMTsoDNkXLlDieTwNSiO1qhkyBLC1HVy2EwWugHoMWQefAo53CHDU9z/xMprpJjr2m+bxIxkUXrX+WKCNI6Gf3YYH0wtZ8aeHooxXQiU4tmIKcSmjrcyk3mNnX6GqkhuWNTcQK4Wo+RCaeltnRnAG5XHCof4a0CfhBRGzO4cgHjNEu1GMoy7bdJKCaGZxMTRh84XoAjn9z4tbYHRR+TfLemyeuBA8FL5Zr67Z5xKz0u3Ps4r8GLI0OUDgJvr+olH6HvArwPXj97qpUxRO2jw1aGqYSMWgLClxQrABvBuBWxSc5u9Eqa0bdu2PCwIIltOcX6X6vmLVmU1kaPvA4sMFUGqZ2UKnXi1RYp743CUxm1WhWJGRVY5Ht17Xz+xf0+cWKWbnc7DwUE7cM14yVsJ8aorK/9lAVh5aBYBFIKtjJz0LiMcjxTPSBFJ5RMq5q7Ryv7BaQsGn3X5YW91UygghyoHbbWSTDdn8jApKhABctqco/CJ+quRN1xkEJJKwf2g91CrN0aqnXDxErcYclw1CJRAmZIhL+mGBSpFf2giBo32S3Q7kLT5tuK7M57Uu3F83FyL1Q/00pSqzbFQNCUs+MkAIqLBNql0/Fb2z85Lc4T/B5NnpbslLHGxjAKLQrR/ZH9GzWV505Yga9MeiLfAvgAPuPTolXhjmvzPrOB7c8YqapLl8UDnkkotmRQ6cESfa6fr2LCufDhKtr8wWsBgZqMjrxmJEAtUoiR+l9hvBZRli6hoiZ5kJod5kYJPPoTd9/xgVIQn+hrECf1c6aw2QgOa8Rz8ZgZlTJAMaKItBV3RyksF9CFPEVwY5/40D+t/co6dbaCTl0nVJzC8AR90m7kU6Ew6DhVcSuvvJPLFbFuKE3iJWq7m4LMAIF0iV2+BCtadXl/rMFoFSkn+b/44GPaRhe6rg1/BExo+JXnuBUNjW22Z1bgDvDgetV7y+NDqawyYcIx7nM6+iq/WCr7gwEfDMWu5hjdVuChXMVF8Dm8NP4x1D9wmUaxGBKYazSBqQizc8Tfk9Zel//fpDD/JbMPRnrZqD/7wYXIc4qTDn4ZZ+/0jPeDifby0/xQ900zBd5xhZNt/l8TYoad8lSj205Z0+HqWusLRDLq5b1/5XS6qqCjj9kG/zgvcWedothuOTjKSNNPrRTEfsEotlHhEOSRizEVJ7kewGrE3Us8CPiRXokq/z6OgvuLHWt+an/l+Lfqk8b5eA6RUl36LgrD9wQmwDaC2aNrXZVRAZq8Z7hVFPe64hUq7Z1T4qVMLUne7kAG27Qs/eO7giMXw0WRhm9K3jh21JKJ6Oeif77Ivun36uWXvFzgCWTf0ynV662W079dWqa5J6c4fIRK2kvTTxqMydMQJQ5QFmUunoqIK8ogJv4r7Ad4JiP6ckcNF7JzxLlPcFTMZz847vJgeOG204
x-ms-exchange-antispam-messagedata-1: Z58TP0p8j1w2pw==
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: cs.auckland.ac.nz
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MEAPR01MB3654.ausprd01.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 86c6693d-838f-4484-12b8-08dea1f42434
X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Apr 2026 11:25:08.4559 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d1b36e95-0d50-42e9-958f-b63fa906beaa
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: x1TZL3S1i2X/ono5jMwxRfBpJ6fvgShg2Gvo/CPHa+k3CRs3yjIu/fz4ohewuce6Ydy9oc4gYR1AbJSf5TM0+EqqJJEw5y7/5o384Pt1nj4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SY7PR01MB9713
Message-ID-Hash: NP5DYA52YYFG33JEWDHV2NU7CSVITGBQ
X-Message-ID-Hash: NP5DYA52YYFG33JEWDHV2NU7CSVITGBQ
X-MailFrom: pgut001@cs.auckland.ac.nz
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Ssh] Re: I-D Action: draft-ietf-sshm-cert-00.txt
List-Id: "The SSH mail list will allow discussions on improving aspects of the Secure Shell (SSH) protocol." <ssh.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ssh/YU5TTZht7TU1uzeRc8VDg7TPP4s>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ssh>
List-Help: <mailto:ssh-request@ietf.org?subject=help>
List-Owner: <mailto:ssh-owner@ietf.org>
List-Post: <mailto:ssh@ietf.org>
List-Subscribe: <mailto:ssh-join@ietf.org>
List-Unsubscribe: <mailto:ssh-leave@ietf.org>

S Moonesamy <sm+ietf@elandsys.com> writes:

>I did a search and I found RFC 6187.  That document "specifies how to use
>X.509 version 3 public key certificates in public key algorithms in the
>Secure Shell protocol".

Right, but that's simply using X.509 certs in SSH, not reinventing X.509 with
SSH encoding.

As an aside, did anything other than the VanDyke implementation ever support
this for its USG clients?  Just curious if there's more support out there,
it's not too hard to add but I've both never seen it used and never had any
requests for it.

Peter.

v2.46.0 | Report a Bug | By Email | System Status