RFC 6594

Use of the SHA-256 Algorithm with RSA, Digital Signature Algorithm (DSA), and Elliptic Curve DSA (ECDSA) in SSHFP Resource Records

📅 published April 2012, from ietf

RFC 6594: Use of the SHA-256 Algorithm with RSA, Digital Signature Algorithm (DSA), and Elliptic Curve DSA (ECDSA) in SSHFP Resource Records 💖

Request for Comments: 6594
Author: O. Sury, CZ.NIC 🎀
Category: Standards Track (this is an Internet Standards Track document 🔥)
Date: April 2012
ISSN: 2070-1721
Updates: RFC 4255 (it updates the IANA registries in that RFC 🦋)
Obsoletes: not listed in the header

Okay bestie, the title block is basically the ID card for this doc. It's an official Standards Track thing from Sury at CZ.NIC, and it's from April 2012. It doesn't obsolete anything, but it does update the IANA registries in RFC 4255 🌸

Abstract

Okay so the vibe here is: RFC 4255 gave us SSHFP, which is a DNS Resource Record (RR) that stores a standard Secure Shell (SSH) key fingerprint, so you can verify SSH host keys using DNS Security Extensions (DNSSEC) 🔐. This doc adds two new things. First, it adds options for SSH public keys that use the Elliptic Curve Digital Signature Algorithm (ECDSA). Second, it lets you compute fingerprints with the SHA-256 message digest algorithm for SSHFP Resource Records. Iconic glow-up 💅✨

Status of This Memo

This is an Internet Standards Track document. 🎀

This doc is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community, it went through public review, and the Internet Engineering Steering Group (IESG) approved it for publication. If you want more info about Internet Standards, check out Section 2 of RFC 5741 📚

Info about the current status of this document, any errata, and how to give feedback is at http://www.rfc-editor.org/info/rfc6594 🔗

Copyright Notice

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info), as they stood on the publication date. Please read these carefully, because they explain your rights and restrictions for this doc 🧾. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. They're also provided without warranty, as described in the Simplified BSD License 💜.

   1. Introduction ....................................................3
   2. Requirements Language ...........................................4
   3. SSHFP Resource Records ..........................................4
      3.1. SSHFP Fingerprint Type Specification .......................4
           3.1.1. SHA-256 SSHFP Fingerprint Type Specification ........4
      3.2. SSHFP Algorithm Number Specification .......................4
           3.2.1. ECDSA SSHFP Algorithm Number Specification ..........4
   4. Implementation Considerations ...................................4
      4.1. Support for SHA-256 Fingerprints ...........................4
      4.2. Support for ECDSA ..........................................4
   5. Examples ........................................................5
      5.1. RSA Public Key .............................................5
           5.1.1. RSA Public Key with SHA1 Fingerprint ................5
           5.1.2. RSA Public Key with SHA-256 Fingerprint .............5
      5.2. DSA Public Key .............................................6
           5.2.1. DSA Public Key with SHA1 Fingerprint ................6
           5.2.2. DSA Public Key with SHA-256 Fingerprint .............6
      5.3. ECDSA Public Key ...........................................6
           5.3.1. ECDSA Public Key with SHA1 Fingerprint ..............7
           5.3.2. ECDSA Public Key with SHA-256 Fingerprint ...........7
   6. IANA Considerations .............................................7
      6.1. SSHFP RR Types for Public Key Algorithms ...................7
      6.2. SSHFP RR Types for Fingerprint Types .......................7
   7. Security Considerations .........................................8
   8. References ......................................................8
      8.1. Normative References .......................................8
      8.2. Informative References .....................................9

1. Introduction 🧚

Okay so the Domain Name System (DNS) is the global, hierarchical, distributed database for Internet naming 🌍. The Secure Shell (SSH) is a protocol for secure remote login and other secure network services over an insecure network 🔒. RFC 4253 [RFC4253] defines the Public Key Algorithms for Secure Shell server public keys.

The DNS got extended to store fingerprints in a DNS Resource Record called SSHFP [RFC4255]. That gives you out-of-band verification: you look up a fingerprint of the server public key in the DNS [RFC1034][RFC1035], and you use DNS Security Extensions (DNSSEC) [RFC4033][RFC4034][RFC4035] to verify the lookup. It's giving layered security 🫶

RFC 4255 [RFC4255] explains how to store the cryptographic fingerprint of SSH public keys in SSHFP Resource Records. An SSHFP Resource Record contains the fingerprint plus two index numbers that identify the cryptographic algorithms used:

to link the fingerprinted public key with the corresponding private key, and
to derive the message digest stored as the fingerprint in the record.

RFC 4255 [RFC4255] then specifies lists of cryptographic algorithms, along with the index numbers used to identify them in SSHFP Resource Records 📋

This document updates the IANA registry "SSHFP RR Types for public key algorithms" and "SSHFP RR types for fingerprint types" [SSHFPVALS] by adding a new option to each list 💅:

the Elliptic Curve Digital Signature Algorithm (ECDSA) [RFC6090], which RFC 5656 [RFC5656] added to the Secure Shell Public Key list in the public key algorithms list, and
the SHA-256 algorithm [FIPS.180-3.2008] in the SSHFP fingerprint type list.

Familiarity with DNSSEC, the SSH Protocol [RFC4251][RFC4253][RFC4250], SSHFP [RFC4255], and the SHA-2 [FIPS.180-3.2008] family of algorithms is assumed in this document 🧠

2. Requirements Language 🎀

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 📖

3. SSHFP Resource Records 🦋

The format of the SSHFP RR can be found in RFC 4255 [RFC4255] ✨

3.1. SSHFP Fingerprint Type Specification

The fingerprint type octet identifies the message digest algorithm used to calculate the fingerprint of the public key 🔑

3.1.1. SHA-256 SSHFP Fingerprint Type Specification

SHA-256 fingerprints of public keys are stored in SSHFP Resource Records with fingerprint type 2 🌈

3.2. SSHFP Algorithm Number Specification

The SSHFP Resource Record algorithm number octet describes the algorithm of the public key 🔢

3.2.1. ECDSA SSHFP Algorithm Number Specification

ECDSA public keys are stored in SSHFP Resource Records with algorithm number 3 💜

4. Implementation Considerations ⭐

4.1. Support for SHA-256 Fingerprints

Okay, this part is important, so listen up 👑. SSHFP-aware Secure Shell implementations SHOULD support SHA-256 fingerprints for verifying the public key. Secure Shell implementations that support SHA-256 fingerprints MUST prefer a SHA-256 fingerprint over SHA-1 when both are available for a server. If the SHA-256 fingerprint gets tested and doesn't match the SSH public key the server sent, then the key MUST be rejected. It MUST NOT go on to test the alternative SHA-1 fingerprint 🚫

4.2. Support for ECDSA

SSHFP-aware Secure Shell implementations that also implement ECDSA for the public key SHOULD support SSHFP fingerprints for ECDSA public keys 🌸

Part 2 of 2 is coming next, with the examples, IANA Considerations, Security Considerations, and References, so stay tuned bestie 🫶💖

6.1. SSHFP RR Types for Public Key Algorithms 🎀

okay so IANA got some new entries for the "SSHFP RR Types for public key algorithms" registry, and the new one is ECDSA 💅

+-------+-------------+------------+
| Value | Description |  Reference |
+-------+-------------+------------+
|   3   |    ECDSA    | [This doc] |
+-------+-------------+------------+

6.2. SSHFP RR Types for Fingerprint Types 🧚

same energy here! The "SSHFP RR types for fingerprint types" registry also got a new entry, and it's SHA-256 🔥

+-------+-------------+------------+
| Value | Description |  Reference |
+-------+-------------+------------+
|   2   |   SHA-256   | [This doc] |
+-------+-------------+------------+

7. Security Considerations 🔐

bestie, this part is SERIOUS 😭 Go read the security considerations in [RFC4255] for SSHFP Resource Records and [RFC5656] for the ECDSA stuff first. Those are the must-reads 🫶

Users of SSHFP are encouraged to switch to SHA-256 as soon as their implementations can handle it. The SHA-2 family is widely believed to be tougher to attack than SHA-1, and people are lowkey losing faith in SHA-1 because of recently announced attacks [IACR2007/474]. Whether or not those attacks end up affecting SSHFP, it is believed (at the time of this writing) that SHA-256 is the better pick for SSHFP records. Choose wisely, queen 👑

SHA-256 is considered strong enough for the immediate future. Predictions about where cryptography and cryptanalysis are headed are beyond the scope of this document, so we're not going there today 🙈

8. References 📚

8.1. Normative References 💜

[FIPS.180-3.2008] National Institute of Standards and Technology, "Secure Hash Standard (SHS)", FIPS PUB 180-3, October 2008, <http://csrc.nist.gov/publications/fips/fips180-3/fips180-3_final.pdf>.
[RFC1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, November 1987.
[RFC1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, November 1987.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4250] Lehtinen, S. and C. Lonvick, "The Secure Shell (SSH) Protocol Assigned Numbers", RFC 4250, January 2006.
[RFC4251] Ylonen, T. and C. Lonvick, "The Secure Shell (SSH) Protocol Architecture", RFC 4251, January 2006.
[RFC4253] Ylonen, T. and C. Lonvick, "The Secure Shell (SSH) Transport Layer Protocol", RFC 4253, January 2006.
[RFC4255] Schlyter, J. and W. Griffin, "Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints", RFC 4255, January 2006.
[RFC5656] Stebila, D. and J. Green, "Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer", RFC 5656, December 2009.

8.2. Informative References 🌸

[IACR2007/474] Cochran, M., "Notes on the Wang et al. 2^63 SHA-1 Differential Path", IACR 2007/474, <http://eprint.iacr.org/2007/474.pdf>.
[RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "DNS Security Introduction and Requirements", RFC 4033, March 2005.
[RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Resource Records for the DNS Security Extensions", RFC 4034, March 2005.
[RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Protocol Modifications for the DNS Security Extensions", RFC 4035, March 2005.
[RFC4716] Galbraith, J. and R. Thayer, "The Secure Shell (SSH) Public Key File Format", RFC 4716, November 2006.
[RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic Curve Cryptography Algorithms", RFC 6090, February 2011.
[SSHFPVALS] IANA, "DNS SSHFP Resource Records Parameters", <http://www.iana.org/assignments/dns-sshfp-rr-parameters>.

Author's Address 🦋

Ondrej Sury
CZ.NIC
Americka 23
120 00 Praha 2
Czech Republic

Phone: +420 222 745 110
EMail: ondrej.sury@nic.cz

📦 where this page comes from

ietf: rfc6594 2012-04
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms