RFC 6668

SHA-2 Data Integrity Verification for the Secure Shell (SSH) Transport Layer Protocol

📅 published July 2012, from ietf

RFC 6668: SHA-2 Data Integrity Verification for the Secure Shell (SSH) Transport Layer Protocol 💖

okay bestie, so this is an IETF doc (Internet Engineering Task Force, the group that writes the rules for how the internet talks to itself 🌐). It's RFC 6668, a Standards Track document from July 2012, with ISSN 2070-1721. It updates RFC 4253, which means it adds to the SSH rulebook instead of replacing it 🎀

The authors are Denis Bider from Bitvise Limited and Mark D. Baushke from Juniper Networks, Inc. ✨ Their full addresses are at the very end of the doc.

Abstract

This memo defines algorithm names and parameters for some of the SHA-2 family of secure hash algorithms, used for data integrity verification in the Secure Shell (SSH) protocol. It also updates RFC 4253 by specifying a new RECOMMENDED data integrity algorithm 🦋

Status of This Memo

This is an Internet Standards Track document 🌸

It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 5741 📚

For the current status, any errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc6668 💅

Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved 🔒

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were in effect on the date of publication. Read these carefully, because they spell out your rights and restrictions for this doc. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes 🧾

1. Overview and Rationale ✨

okay so SSH [RFC4251] is seriously everywhere for secure remote login on the Internet 🌍 Right now SSH defines data integrity verification using SHA-1 and MD5 [RFC4253]. But those two have had some scary security news ([RFC6194] and [RFC6151], respectively) 😭 So implementors and users have been asking for data integrity verification built on some of the SHA-2 family of secure hash algorithms. Main character energy 👑

1.1. Requirements Terminology 🎀

Here's the vocab for the key words. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🫶

2. Data Integrity Algorithms 🔥

This memo copies the style and conventions of [RFC4253] for showing how new data integrity algorithms get indicated in SSH. It's giving consistency 💜

These new data integrity algorithms are defined:

   hmac-sha2-256     RECOMMENDED   HMAC-SHA2-256
                                   (digest length = 32 bytes,
                                    key length    = 32 bytes)

   hmac-sha2-512     OPTIONAL      HMAC-SHA2-512
                                   (digest length = 64 bytes,
                                    key length    = 64 bytes)

                          Figure 1

HMAC (Hashed Message Authentication Code) was first defined in [RFC2104] and later updated in [RFC6151] 🧚

The SHA-2 family of secure hash algorithms is defined in [FIPS-180-3] 🌈

You can find sample code for the SHA-based HMAC algorithms in [RFC6234] 💻 HMAC-SHA2-224 and HMAC-SHA2-384 were considered too, but they didn't make the list. They have the same computational requirements as HMAC-SHA2-256 and HMAC-SHA2-512, respectively, and they don't seem to be used much in practice 🙈

Test vectors for HMAC with SHA-2 are in [RFC4231] 🍓 And here's the tea: users, implementors, and administrators may choose to put these new MACs into the proposal ahead of the REQUIRED hmac-sha1 algorithm defined in [RFC4253], so they get negotiated first ✨

3. IANA Considerations 🦋

This document augments the MAC Algorithm Names in [RFC4253] and [RFC4250] 🌸

IANA updated the "Secure Shell (SSH) Protocol Parameters" registry with these entries:

   MAC Algorithm Name      Reference       Note
   hmac-sha2-256           RFC 6668        Section 2
   hmac-sha2-512           RFC 6668        Section 2

                        Figure 2

4. Security Considerations 💀

The security considerations of RFC 4253 [RFC4253] apply to this document. Don't skip them 😤

NIST (National Institute of Standards and Technology) has the NIST Special Publication (SP) 800-107 [800-107] and NIST SP 800-131A [800-131A]. They suggest that HMAC-SHA1 and HMAC-SHA2-256 have a security strength of 128 bits and 256 bits, respectively, which are considered acceptable key lengths 🔐

Many users seem curious about how safe the SHA2-based algorithms are for hashing. Fair question, bestie 🙈

5. References 📚

5.1. Normative References 💜

  • [FIPS-180-3]: National Institute of Standards and Technology (NIST), United States of America, "Secure Hash Standard (SHS)", FIPS PUB 180-3, October 2008, http://csrc.nist.gov/publications/fips/fips180-3/fips180-3_final.pdf.
  • [RFC2104]: Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997.
  • [RFC2119]: Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
  • [RFC4231]: Nystrom, M., "Identifiers and Test Vectors for HMAC-SHA-224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512", RFC 4231, December 2005.
  • [RFC4253]: Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH) Transport Layer Protocol", RFC 4253, January 2006.

5.2. Informative References 🧚

  • [800-107]: National Institute of Standards and Technology (NIST), "Recommendation for Applications Using Approved Hash Algorithms", NIST Special Publication 800-107, February 2009, http://csrc.nist.gov/publications/nistpubs/800-107/NIST-SP-800-107.pdf.
  • [800-131A]: National Institute of Standards and Technology (NIST), "Transitions: Recommendation for the Transitioning of the Use of Cryptographic Algorithms and Key Lengths", DRAFT NIST Special Publication 800-131A, January 2011, http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-131A.pdf.
  • [RFC4250]: Lehtinen, S. and C. Lonvick, Ed., "The Secure Shell (SSH) Protocol Assigned Numbers", RFC 4250, January 2006.
  • [RFC4251]: Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH) Protocol Architecture", RFC 4251, January 2006.
  • [RFC6151]: Turner, S. and L. Chen, "Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms", RFC 6151, March 2011.
  • [RFC6194]: Polk, T., Chen, L., Turner, S., and P. Hoffman, "Security Considerations for the SHA-0 and SHA-1 Message-Digest Algorithms", RFC 6194, March 2011.
  • [RFC6234]: Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)", RFC 6234, May 2011.

Authors' Addresses 🫶

   Denis Bider
   Bitvise Limited
   Suites 41/42, Victoria House
   26 Main Street
   GI

   Phone: +1 869 762 1410
   EMail: ietf-ssh2@denisbider.com
   URI:   http://www.bitvise.com/


   Mark D. Baushke
   Juniper Networks, Inc.
   1194 N Mathilda Av
   Sunnyvale, CA 94089-1206
   US

   Phone: +1 408 745 2952
   EMail: mdb@juniper.net
   URI:   http://www.juniper.net/

That's the whole doc, bestie! You're officially an SSH data integrity expert now 🌈💖

📦 where this page comes from