RFC 4250
The Secure Shell (SSH) Protocol Assigned Numbers
RFC 4250 🎀
The Secure Shell (SSH) Protocol Assigned Numbers ✨
Okay so this one is the SSH Assigned Numbers doc, and it's giving "behind-the-scenes setup" 💅 It's the starter pack that fills in the IANA registries for SSH, so everyone's number lists start out the same.
- Written by: S. Lehtinen (SSH Communications Security Corp) and C. Lonvick, Ed. (Cisco Systems, Inc.) 🧚
- Category: Standards Track 👑
- Date: January 2006 🌸
- Obsoletes / Updates: the header doesn't list anything it obsoletes or updates 🫶
Status of This Memo ✨
This document is an Internet standards track protocol doc for the Internet community, and it's basically asking for discussion and suggestions for improvements 💖 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🦋
Copyright Notice 🌈
Copyright (C) The Internet Society (2006).
Abstract 💜
This doc lays out the instructions for the IANA and the starting state of the IANA assigned numbers for SSH. It's only meant for setting up the IANA registries that the SSH docs point to 🍓
Table of Contents 📋
1. Introduction ....................................................2
2. Contributors ....................................................3
3. Conventions Used in This Document ...............................3
3.1. RFC 2119 Keywords ..........................................3
3.2. RFC 2434 Keywords ..........................................3
3.3. Protocol Fields and Values .................................4
4. IANA Considerations .............................................5
4.1. Message Numbers ............................................5
4.1.1. Conventions .........................................5
4.1.2. Initial Assignments .................................6
4.1.3. Future Assignments ..................................6
4.2. Disconnection Messages Reason Codes and Descriptions .......7
4.2.1. Conventions .........................................7
4.2.2. Initial Assignments .................................7
4.2.3. Future Assignments ..................................8
4.3. Channel Connection Failure Reason Codes and Descriptions ...8
4.3.1. Conventions .........................................8
4.3.2. Initial Assignments .................................8
4.3.3. Future Assignments ..................................8
4.3.4. Notes about the PRIVATE USE Range ...................9
4.4. Extended Channel Data Transfer data_type_code and Data .....9
4.4.1. Conventions .........................................9
4.4.2. Initial Assignments ................................10
4.4.3. Future Assignments .................................10
4.5. Pseudo-Terminal Encoded Terminal Modes ....................10
4.5.1. Conventions ........................................10
4.5.2. Initial Assignments ................................10
4.5.3. Future Assignments .................................12
4.6. Names .....................................................12
4.6.1. Conventions for Names ..............................13
4.6.2. Future Assignments of Names ........................13
4.7. Service Names .............................................13
4.8. Authentication Method Names ...............................14
4.9. Connection Protocol Assigned Names ........................14
4.9.1. Connection Protocol Channel Types ..................14
4.9.2. Connection Protocol Global Request Names ...........14
4.9.3. Connection Protocol Channel Request Names ..........15
4.9.4. Initial Assignment of Signal Names .................15
4.9.5. Connection Protocol Subsystem Names ................15
4.10. Key Exchange Method Names ................................16
4.11. Assigned Algorithm Names .................................16
4.11.1. Encryption Algorithm Names ........................16
4.11.2. MAC Algorithm Names ...............................17
4.11.3. Public Key Algorithm Names ........................17
4.11.4. Compression Algorithm Names .......................17
5. Security Considerations ........................................17
6. References .....................................................18
6.1. Normative References ......................................18
6.2. Informative References ....................................18
Authors' Addresses ................................................19
Trademark Notice ..................................................191. Introduction ✨
This doc doesn't define any new protocols, bestie 🙈 It just sets up the starting IANA database values for SSH and also explains how future assignments work. The one exception is a single HISTORIC algorithm that's generally seen as obsolete. Other than that, no new protocols or number ranges get defined here that aren't already in: [SSH-ARCH], [SSH-TRANS], [SSH-USERAUTH], [SSH-CONNECT].
2. Contributors 🫶
The major original contributors to this set of docs were Tatu Ylonen, Tero Kivinen, Timo J. Rinne, Sami Lehtinen (all of SSH Communications Security Corp), and Markku-Juhani O. Saarinen (University of Jyvaskyla). Darren Moffat was the original editor of this set of docs and also made very substantial contributions 👑
So many people helped shape this doc over the years 😭 The people who should be acknowledged include Mats Andersson, Ben Harris, Bill Sommerfeld, Brent McClure, Niels Moller, Damien Miller, Derek Fawcus, Frank Cusack, Heikki Nousiainen, Jakob Schlyter, Jeff Van Dyke, Jeffrey Altman, Jeffrey Hutzelman, Jon Bright, Joseph Galbraith, Ken Hornstein, Markus Friedl, Martin Forssen, Nicolas Williams, Niels Provos, Perry Metzger, Peter Gutmann, Simon Josefsson, Simon Tatham, Wei Dai, Denis Bider, der Mouse, and Tadayoshi Kohno. Listing their names here does NOT mean they endorse this doc. It just means they contributed to it 🌸
3. Conventions Used in This Document 🎀
3.1. RFC 2119 Keywords 💅
All docs related to the SSH protocols shall use the keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" to describe requirements. These keywords get interpreted as described in [RFC2119]. Those are the big-deal words, so respect them 🔥
3.2. RFC 2434 Keywords 🦋
The keywords "PRIVATE USE", "HIERARCHICAL ALLOCATION", "FIRST COME FIRST SERVED", "EXPERT REVIEW", "SPECIFICATION REQUIRED", "IESG APPROVAL", "IETF CONSENSUS", and "STANDARDS ACTION" show up in this doc when they're describing namespace allocation. They're interpreted as described in [RFC2434]. They're repeated here so it's clear what each one means 💖
- PRIVATE USE - For private or local use only, with the type and purpose defined by the local site. No attempt is made to prevent multiple sites from using the same value in different (and incompatible) ways. There is no need for IANA to review such assignments, and assignments are not generally useful for interoperability.
- HIERARCHICAL ALLOCATION - Delegated managers can assign values provided they have been given control over that part of the name space. IANA controls the higher levels of the namespace according to one of the other policies.
- FIRST COME FIRST SERVED - Anyone can obtain an assigned number, so long as they provide a point of contact and a brief description of what the value would be used for. For numbers, the exact value is generally assigned by the IANA; with names, specific names are usually requested.
- EXPERT REVIEW - approval by a Designated Expert is required.
- SPECIFICATION REQUIRED - Values and their meaning must be documented in an RFC or other permanent and readily available reference, in sufficient detail so that interoperability between independent implementations is possible.
- IESG APPROVAL - New assignments must be approved by the IESG, but there is no requirement that the request be documented in an RFC (though the IESG has discretion to request documents or other supporting materials on a case-by-case basis).
- IETF CONSENSUS - New values are assigned through the IETF consensus process. Specifically, new assignments are made via RFCs approved by the IESG. Typically, the IESG will seek input on prospective assignments from appropriate persons (e.g., a relevant Working Group if one exists).
- STANDARDS ACTION - Values are assigned only for Standards Track RFCs approved by the IESG.
3.3. Protocol Fields and Values 🧚
Protocol fields and the possible values to fill them are defined in this set of docs. Protocol fields get defined in the message definitions. As an example, SSH_MSG_CHANNEL_DATA is defined like this:
byte SSH_MSG_CHANNEL_DATA
uint32 recipient channel
string dataAcross these docs, when fields are referenced, they appear within single quotes. When values to fill those fields are referenced, they appear within double quotes. Using the example above, possible values for 'data' are "foo" and "bar" ✨
4. IANA Considerations 🌈
This entire doc is the IANA considerations for the SSH protocol, as defined in [SSH-ARCH], [SSH-TRANS], [SSH-USERAUTH], [SSH-CONNECT]. This section has the conventions used for naming the namespaces, the initial state of the registry, and instructions for future assignments 💜
4.1. Message Numbers 🍓
The Message Number is a byte value that describes the payload of a packet. Main character energy 👑
4.1.1. Conventions 💖
Protocol packets have message numbers in the range 1 to 255. They're allocated like this 🦋
Transport layer protocol:
1 to 19 Transport layer generic (e.g., disconnect, ignore,
debug, etc.)
20 to 29 Algorithm negotiation
30 to 49 Key exchange method specific (numbers can be reused
for different authentication methods)
User authentication protocol:
50 to 59 User authentication generic
60 to 79 User authentication method specific (numbers can be
reused for different authentication methods)
Connection protocol:
80 to 89 Connection protocol generic
90 to 127 Channel related messages
Reserved for client protocols:
128 to 191 Reserved
Local extensions:
192 to 255 Local extensions4.1.2. Initial Assignments ✨
Okay, here are the starter Message ID values IANA hands out first. Everything in this table is copied exactly, so no cap 🧢
Message ID Value Reference
----------- ----- ---------
SSH_MSG_DISCONNECT 1 [SSH-TRANS]
SSH_MSG_IGNORE 2 [SSH-TRANS]
SSH_MSG_UNIMPLEMENTED 3 [SSH-TRANS]
SSH_MSG_DEBUG 4 [SSH-TRANS]
SSH_MSG_SERVICE_REQUEST 5 [SSH-TRANS]
SSH_MSG_SERVICE_ACCEPT 6 [SSH-TRANS]
SSH_MSG_KEXINIT 20 [SSH-TRANS]
SSH_MSG_NEWKEYS 21 [SSH-TRANS]
SSH_MSG_USERAUTH_REQUEST 50 [SSH-USERAUTH]
SSH_MSG_USERAUTH_FAILURE 51 [SSH-USERAUTH]
SSH_MSG_USERAUTH_SUCCESS 52 [SSH-USERAUTH]
SSH_MSG_USERAUTH_BANNER 53 [SSH-USERAUTH]
SSH_MSG_GLOBAL_REQUEST 80 [SSH-CONNECT]
SSH_MSG_REQUEST_SUCCESS 81 [SSH-CONNECT]
SSH_MSG_REQUEST_FAILURE 82 [SSH-CONNECT]
SSH_MSG_CHANNEL_OPEN 90 [SSH-CONNECT]
SSH_MSG_CHANNEL_OPEN_CONFIRMATION 91 [SSH-CONNECT]
SSH_MSG_CHANNEL_OPEN_FAILURE 92 [SSH-CONNECT]
SSH_MSG_CHANNEL_WINDOW_ADJUST 93 [SSH-CONNECT]
SSH_MSG_CHANNEL_DATA 94 [SSH-CONNECT]
SSH_MSG_CHANNEL_EXTENDED_DATA 95 [SSH-CONNECT]
SSH_MSG_CHANNEL_EOF 96 [SSH-CONNECT]
SSH_MSG_CHANNEL_CLOSE 97 [SSH-CONNECT]
SSH_MSG_CHANNEL_REQUEST 98 [SSH-CONNECT]
SSH_MSG_CHANNEL_SUCCESS 99 [SSH-CONNECT]
SSH_MSG_CHANNEL_FAILURE 100 [SSH-CONNECT]4.1.3. Future Assignments 🔮
New message numbers in the ranges 1 to 29, 50 to 59, and 80 to 127 MUST go through the STANDARDS ACTION method, as described in [RFC2434].
Message numbers from 30 to 49 are tied to whichever key exchange method is in use, so their meaning comes from the definition of that method. Totally fair 🙌
Message numbers from 60 to 79 work the same way, but for the user authentication method in use, and that method's definition spells out what they mean.
New message numbers in the range 128 to 191 MUST go through the IETF CONSENSUS method, as described in [RFC2434].
IANA is not going to control the message numbers from 192 through 255. That range is left for PRIVATE USE 🔒
4.2. Disconnection Messages Reason Codes and Descriptions 💌
Every Disconnection Message has a 'reason code', which is a uint32 value, plus a 'description'. The description is a human-readable message that explains why the disconnect happened. Think of it as the "why did you leave me on read" note 💀
4.2.1. Conventions
Protocol packets carrying the SSH_MSG_DISCONNECT message MUST use Disconnection Message 'reason code' values in the range of 0x00000001 to 0xFFFFFFFF. These are described in [SSH-TRANS].
4.2.2. Initial Assignments
Here's the table of starter values for the SSH_MSG_DISCONNECT 'description' and 'reason code' pairs, copied exactly 📋
Symbolic Name reason code
------------- -----------
SSH_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT 1
SSH_DISCONNECT_PROTOCOL_ERROR 2
SSH_DISCONNECT_KEY_EXCHANGE_FAILED 3
SSH_DISCONNECT_RESERVED 4
SSH_DISCONNECT_MAC_ERROR 5
SSH_DISCONNECT_COMPRESSION_ERROR 6
SSH_DISCONNECT_SERVICE_NOT_AVAILABLE 7
SSH_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED 8
SSH_DISCONNECT_HOST_KEY_NOT_VERIFIABLE 9
SSH_DISCONNECT_CONNECTION_LOST 10
SSH_DISCONNECT_BY_APPLICATION 11
SSH_DISCONNECT_TOO_MANY_CONNECTIONS 12
SSH_DISCONNECT_AUTH_CANCELLED_BY_USER 13
SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE 14
SSH_DISCONNECT_ILLEGAL_USER_NAME 154.2.3. Future Assignments 🌈
Disconnection Message 'reason code' values MUST be assigned sequentially. Requests for new 'reason code' values, and their matching 'description' text, in the range of 0x00000010 through 0xFDFFFFFF MUST be done through the IETF CONSENSUS method, as described in [RFC2434].
IANA won't assign 'reason code' values from 0xFE000000 through 0xFFFFFFFF. Those values are left for PRIVATE USE, as described in [RFC2434] 🔒
4.3. Channel Connection Failure Reason Codes and Descriptions 🚪
The Channel Connection Failure 'reason code' is a uint32 value. The matching 'description' text is a human-readable message that explains why the channel connection failed. This is described in [SSH-CONNECT].
4.3.1. Conventions
Protocol packets carrying the SSH_MSG_CHANNEL_OPEN_FAILURE message MUST use Channel Connection Failure 'reason code' values in the range of 0x00000001 to 0xFFFFFFFF.
4.3.2. Initial Assignments
The starter values for 'reason code' and 'description' are in the table below. The 'reason code' values are written in decimal so they're easier to read, but they're really uint32 values 🔢
Symbolic Name reason code
------------- -----------
SSH_OPEN_ADMINISTRATIVELY_PROHIBITED 1
SSH_OPEN_CONNECT_FAILED 2
SSH_OPEN_UNKNOWN_CHANNEL_TYPE 3
SSH_OPEN_RESOURCE_SHORTAGE 44.3.3. Future Assignments
Channel Connection Failure 'reason code' values MUST be assigned sequentially. Requests for new 'reason code' values, and their matching 'description string', in the range of 0x00000005 to 0xFDFFFFFF MUST be done through the IETF CONSENSUS method, as described in [RFC2434].
IANA won't assign 'reason code' values from 0xFE000000 to 0xFFFFFFFF. Those are left for PRIVATE USE, as described in [RFC2434] 🔒
4.3.4. Notes about the PRIVATE USE Range 🧪
Okay so we already know IANA has no control over 0xFE000000 to 0xFFFFFFFF. That range gets split into two parts with these rules:
- The range 0xFE000000 to 0xFEFFFFFF is for use with locally assigned channels. Say a channel gets proposed with a 'channel type' of
"example_session@example.com"and it fails. The server will reply with either a 'reason code' that IANA assigned (from the list above, in the range 0x00000001 to 0xFDFFFFFF), or a locally assigned value in the range 0xFE000000 to 0xFEFFFFFF. Now here's the tea ☕ If the server doesn't understand the proposed 'channel type', even a locally defined one, then the 'reason code' MUST be 0x00000003, as described above. If the server does understand the 'channel type' but the channel still won't open, then the server SHOULD reply with a locally assigned 'reason code' value that matches the proposed local 'channel type'. The assumption is that people will try the IANA-assigned 'reason code' values first and then document their locally assigned ones 📝 - There are no restrictions or suggestions for the range starting at 0xFF. No interoperability is expected for anything in this range. Basically, it's the experimentation zone 🧪✨
4.4. Extended Channel Data Transfer data_type_code and Data 📦
The Extended Channel Data Transfer 'data_type_code' is a uint32 value. The matching 'data' is a human-readable message that describes the kind of data that's allowed to move through the channel.
4.4.1. Conventions
Protocol packets carrying the SSH_MSG_CHANNEL_EXTENDED_DATA message MUST use Extended Channel Data Transfer 'data_type_code' values in the range of 0x00000001 to 0xFFFFFFFF. This is described in [SSH-CONNECT].
4.4.2. Initial Assignments
The starter values for 'data_type_code' and 'data' are in the table below. The 'data_type_code' value is written in decimal for readability, but the values are really uint32 values 🫶
Symbolic name data_type_code
------------- --------------
SSH_EXTENDED_DATA_STDERR 14.4.3. Future Assignments
Extended Channel Data Transfer 'data_type_code' values MUST be assigned sequentially. Requests for new 'data_type_code' values, and their matching Extended Channel Data Transfer 'data' strings, in the range of 0x00000002 to 0xFDFFFFFF MUST be done through the IETF CONSENSUS method, as described in [RFC2434].
IANA won't assign 'data_type_code' values from 0xFE000000 to 0xFFFFFFFF. Those are left for PRIVATE USE, as described in [RFC2434] 🔒
4.5. Pseudo-Terminal Encoded Terminal Modes 🖥️
SSH_MSG_CHANNEL_REQUEST messages carrying a "pty-req" string MUST include 'encoded terminal modes'. The 'encoded terminal modes' value is a byte stream of opcode-argument pairs. Very neat 💜
4.5.1. Conventions
Protocol packets carrying the SSH_MSG_CHANNEL_REQUEST message with a "pty-req" string MUST include an 'encoded terminal modes' value. Opcode values are a single byte each, in the range of 1 to 255. Opcodes 1 to 159 take a uint32 argument. Opcodes 160 to 255 aren't defined yet 🌸
4.5.2. Initial Assignments 🎀
okay so here are the starter opcodes that the 'encoded terminal modes' value uses 💅 Every one of them is a little instruction for how the terminal should behave, and the list is literally the cutest thing 🥹
opcode mnemonic description
------ -------- -----------
0 TTY_OP_END Indicates end of options.
1 VINTR Interrupt character; 255 if none. Similarly
for the other characters. Not all of these
characters are supported on all systems.
2 VQUIT The quit character (sends SIGQUIT signal on
POSIX systems).
3 VERASE Erase the character to left of the cursor.
4 VKILL Kill the current input line.
5 VEOF End-of-file character (sends EOF from the
terminal).
6 VEOL End-of-line character in addition to
carriage return and/or linefeed.
7 VEOL2 Additional end-of-line character.
8 VSTART Continues paused output (normally
control-Q).
9 VSTOP Pauses output (normally control-S).
10 VSUSP Suspends the current program.
11 VDSUSP Another suspend character.
12 VREPRINT Reprints the current input line.
13 VWERASE Erases a word left of cursor.
14 VLNEXT Enter the next character typed literally,
even if it is a special character
15 VFLUSH Character to flush output.
16 VSWTCH Switch to a different shell layer.
17 VSTATUS Prints system status line (load, command,
pid, etc).
18 VDISCARD Toggles the flushing of terminal output.
30 IGNPAR The ignore parity flag. The parameter
SHOULD be 0 if this flag is FALSE,
and 1 if it is TRUE.
31 PARMRK Mark parity and framing errors.
32 INPCK Enable checking of parity errors.
33 ISTRIP Strip 8th bit off characters.
34 INLCR Map NL into CR on input.
35 IGNCR Ignore CR on input.
36 ICRNL Map CR to NL on input.
37 IUCLC Translate uppercase characters to
lowercase.
38 IXON Enable output flow control.
39 IXANY Any char will restart after stop.
40 IXOFF Enable input flow control.
41 IMAXBEL Ring bell on input queue full.
50 ISIG Enable signals INTR, QUIT, [D]SUSP.
51 ICANON Canonicalize input lines.
52 XCASE Enable input and output of uppercase
characters by preceding their lowercase
equivalents with "\".
53 ECHO Enable echoing.
54 ECHOE Visually erase chars.
55 ECHOK Kill character discards current line.
56 ECHONL Echo NL even if ECHO is off.
57 NOFLSH Don't flush after interrupt.
58 TOSTOP Stop background jobs from output.
59 IEXTEN Enable extensions.
60 ECHOCTL Echo control characters as ^(Char).
61 ECHOKE Visual erase for line kill.
62 PENDIN Retype pending input.
70 OPOST Enable output processing.
71 OLCUC Convert lowercase to uppercase.
72 ONLCR Map NL to CR-NL.
73 OCRNL Translate carriage return to newline
(output).
74 ONOCR Translate newline to carriage
return-newline (output).
75 ONLRET Newline performs a carriage return
(output).
90 CS7 7 bit mode.
91 CS8 8 bit mode.
92 PARENB Parity enable.
93 PARODD Odd parity, else even.
128 TTY_OP_ISPEED Specifies the input baud rate in
bits per second.
129 TTY_OP_OSPEED Specifies the output baud rate in
bits per second.4.5.3. Future Assignments 🦋
okay so if anyone wants a brand new opcode (plus its arguments), they MUST go through the IETF CONSENSUS method, as described in [RFC2434]. no shortcuts, bestie 🙅♀️
4.6. Names 🌸
in the sections that follow, the name space values are textual. this section explains the rules and how the IANA handles future assignments, and the initial assignments live in their own sections 💖
4.6.1. Conventions for Names 💅
every name the IANA registers in the sections that follow MUST be a printable US-ASCII string. it MUST NOT contain the at-sign ("@"), the comma (","), whitespace, control characters (ASCII codes 32 or less), or ASCII code 127 (DEL). names are case-sensitive, and they MUST NOT be longer than 64 characters 🎀
there's also a little door left open for locally extensible names. the IANA won't register or control any name that has an at-sign in it 🫶
names with an at-sign follow the format "name@domainname" (without the double quotes), where the part before the at-sign is the name. the format of that first part isn't specified, but these names MUST be printable US-ASCII strings, and they MUST NOT contain the comma character (","), whitespace, control characters (ASCII codes 32 or less), or ASCII code 127 (DEL). they MUST have only a single at-sign in them. the part after the at-sign MUST be a valid, fully qualified internet domain name [RFC1034] controlled by the person or organization defining the name. names are case-sensitive, and they MUST NOT be longer than 64 characters. each domain gets to decide how it manages its own local namespace 👑
some people have pointed out that these names look a lot like STD 11 [RFC0822] email addresses. that's purely a coincidence and has nothing to do with STD 11 [RFC0822] 🙈 an example of a locally defined name is "ourcipher-cbc@example.com" (without the double quotes) ✨
4.6.2. Future Assignments of Names 🧚
if you want a brand new name, the request MUST be done through the IETF CONSENSUS method, as described in [RFC2434]. same energy as before, periodt 💅
4.7. Service Names 💖
the 'service name' is how you describe a protocol layer 🦋 here are the starter values:
Service Name Reference
------------- ---------
ssh-userauth [SSH-USERAUTH]
ssh-connection [SSH-CONNECT]4.8. Authentication Method Names 🔐
an Authentication Method Name describes an authentication method for the "ssh-userauth" service [SSH-USERAUTH]. here's the initial lineup 💜
Method Name Reference
------------ ---------
publickey [SSH-USERAUTH, Section 7]
password [SSH-USERAUTH, Section 8]
hostbased [SSH-USERAUTH, Section 9]
none [SSH-USERAUTH, Section 5.2]4.9. Connection Protocol Assigned Names 🌈
the following table lists the initial assignments to the Connection Protocol Type and Request names.
4.9.1. Connection Protocol Channel Types 🎀
here are the starter Connection Protocol Channel Types 🫧
Channel type Reference
------------ ---------
session [SSH-CONNECT, Section 6.1]
x11 [SSH-CONNECT, Section 6.3.2]
forwarded-tcpip [SSH-CONNECT, Section 7.2]
direct-tcpip [SSH-CONNECT, Section 7.2]4.9.2. Connection Protocol Global Request Names ✨
here are the starter Connection Protocol Global Request Names 🧚
Request type Reference
------------ ---------
tcpip-forward [SSH-CONNECT, Section 7.1]
cancel-tcpip-forward [SSH-CONNECT, Section 7.1]4.9.3. Connection Protocol Channel Request Names 🍓
here are the starter Connection Protocol Channel Request Names 💅
Request type Reference
------------ ---------
pty-req [SSH-CONNECT, Section 6.2]
x11-req [SSH-CONNECT, Section 6.3.1]
env [SSH-CONNECT, Section 6.4]
shell [SSH-CONNECT, Section 6.5]
exec [SSH-CONNECT, Section 6.5]
subsystem [SSH-CONNECT, Section 6.5]
window-change [SSH-CONNECT, Section 6.7]
xon-xoff [SSH-CONNECT, Section 6.8]
signal [SSH-CONNECT, Section 6.9]
exit-status [SSH-CONNECT, Section 6.10]
exit-signal [SSH-CONNECT, Section 6.10]4.9.4. Initial Assignment of Signal Names 💀
here are the starter Signal Names 🌸
Signal Reference
------ ---------
ABRT [SSH-CONNECT]
ALRM [SSH-CONNECT]
FPE [SSH-CONNECT]
HUP [SSH-CONNECT]
ILL [SSH-CONNECT]
INT [SSH-CONNECT]
KILL [SSH-CONNECT]
PIPE [SSH-CONNECT]
QUIT [SSH-CONNECT]
SEGV [SSH-CONNECT]
TERM [SSH-CONNECT]
USR1 [SSH-CONNECT]
USR2 [SSH-CONNECT]4.9.5. Connection Protocol Subsystem Names 🫶
there are no initial assignments of the Connection Protocol Subsystem Names. the list is empty for now, which is kinda iconic in its own way 🙈
4.10. Key Exchange Method Names 🔑
the name "diffie-hellman-group1-sha1" is used for a key exchange method that uses an Oakley group, as defined in [RFC2409]. SSH keeps its own group identifier space, which is logically separate from Oakley [RFC2412] and IKE. however, for one extra group, the Working Group adopted the number assigned by [RFC3526], and the name "diffie-hellman-group14-sha1" is used for that second defined group. implementations should treat these names as opaque identifiers and should not assume any relationship between the groups used by SSH and the groups defined for IKE 🧠
here are the initial assignments of the key exchange methods 🥹
Method name Reference
------------ ---------
diffie-hellman-group1-sha1 [SSH-TRANS, Section 8.1]
diffie-hellman-group14-sha1 [SSH-TRANS, Section 8.2]4.11. Assigned Algorithm Names ✨
4.11.1. Encryption Algorithm Names ✨
okay so here's the initial lineup for the Encryption Algorithm Names, and honestly the list is giving vintage 💿 with a few retired legends 🫶
Encryption Algorithm Name Reference
------------------------- ---------
3des-cbc [SSH-TRANS, Section 6.3]
blowfish-cbc [SSH-TRANS, Section 6.3]
twofish256-cbc [SSH-TRANS, Section 6.3]
twofish-cbc [SSH-TRANS, Section 6.3]
twofish192-cbc [SSH-TRANS, Section 6.3]
twofish128-cbc [SSH-TRANS, Section 6.3]
aes256-cbc [SSH-TRANS, Section 6.3]
aes192-cbc [SSH-TRANS, Section 6.3]
aes128-cbc [SSH-TRANS, Section 6.3]
serpent256-cbc [SSH-TRANS, Section 6.3]
serpent192-cbc [SSH-TRANS, Section 6.3]
serpent128-cbc [SSH-TRANS, Section 6.3]
arcfour [SSH-TRANS, Section 6.3]
idea-cbc [SSH-TRANS, Section 6.3]
cast128-cbc [SSH-TRANS, Section 6.3]
none [SSH-TRANS, Section 6.3]
des-cbc [FIPS-46-3] HISTORIC; See
page 4 of [FIPS-46-3]4.11.2. MAC Algorithm Names 🔐
the MAC crew is next, and it's a short, iconic lineup 💅
MAC Algorithm Name Reference
------------------ ---------
hmac-sha1 [SSH-TRANS, Section 6.4]
hmac-sha1-96 [SSH-TRANS, Section 6.4]
hmac-md5 [SSH-TRANS, Section 6.4]
hmac-md5-96 [SSH-TRANS, Section 6.4]
none [SSH-TRANS, Section 6.4]4.11.3. Public Key Algorithm Names 🗝️
these are the initial assignments for the Public Key Algorithm names, and yes, the PGP ones are in here too 🦋
Public Key Algorithm Name Reference
------------------------- ---------
ssh-dss [SSH-TRANS, Section 6.6]
ssh-rsa [SSH-TRANS, Section 6.6]
pgp-sign-rsa [SSH-TRANS, Section 6.6]
pgp-sign-dss [SSH-TRANS, Section 6.6]4.11.4. Compression Algorithm Names 🗜️
last one in this bunch! these are the initial assignments for the Compression Algorithm names 🌸
Compression Algorithm Name Reference
-------------------------- ---------
none [SSH-TRANS, Section 6.2]
zlib [SSH-TRANS, Section 6.2]5. Security Considerations 💀
okay, serious moment, bestie 🫶 this protocol gives you a secure encrypted channel, but it does that over a network that is totally insecure, so the channel is doing a lot of heavy lifting ✨
the full security considerations for this protocol live in [SSH-ARCH], so go read that one for the real tea 🍵
6. References 📚
6.1. Normative References 🎀
here are the normative references, every single one of them 💜
[SSH-ARCH] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell
(SSH) Protocol Architecture", RFC 4251, January 2006.
[SSH-TRANS] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell
(SSH) Transport Layer Protocol", RFC 4253, January
2006.
[SSH-USERAUTH] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell
(SSH) Authentication Protocol", RFC 4252, January
2006.
[SSH-CONNECT] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell
(SSH) Connection Protocol", RFC 4254, January 2006.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange
(IKE)", RFC 2409, November 1998.
[RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing
an IANA Considerations Section in RFCs", BCP 26, RFC
2434, October 1998.
[RFC3526] Kivinen, T. and M. Kojo, "More Modular Exponential
(MODP) Diffie-Hellman groups for Internet Key Exchange
(IKE)", RFC 3526, May 2003.6.2. Informative References 🦋
and these are the informative ones, the extra reading that's still totally worth your time ✨
[RFC0822] Crocker, D., "Standard for the format of ARPA Internet
text messages", STD 11, RFC 822, August 1982.
[RFC1034] Mockapetris, P., "Domain names - concepts and
facilities", STD 13, RFC 1034, November 1987.
[RFC2412] Orman, H., "The OAKLEY Key Determination Protocol",
RFC 2412, November 1998.
[FIPS-46-3] US National Institute of Standards and Technology,
"Data Encryption Standard (DES)", Federal Information
Processing Standards Publication 46-3, October 1999.Authors' Addresses 🧚
here's where you can find the authors, in case you want to slide into their inbox 💌
Sami Lehtinen
SSH Communications Security Corp
Valimotie 17
00380 Helsinki
Finland
EMail: sjl@ssh.com
Chris Lonvick (editor)
Cisco Systems, Inc.
12515 Research Blvd.
Austin 78759
USA
EMail: clonvick@cisco.comTrademark Notice 🏷️
"ssh" is a registered trademark in the United States and/or other countries. 💅
Full Copyright Statement ©️
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🔥
the IETF takes no position on the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or on the extent to which any license under such rights might or might not be available. it also doesn't say it has made any independent effort to identify any such rights. info on the procedures for rights in RFC documents is in BCP 78 and BCP 79.
copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the result of an attempt to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be found at the IETF online IPR repository:
http://www.ietf.org/iprthe IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology required to implement this standard. send that info to the IETF at:
ietf-ipr@ietf.orgAcknowledgement 🫶
funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). 🌈
📦 where this page comes from
- ietf: rfc4250 2006-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms