%!PS-Adobe-3.0
%%BoundingBox: 75 0 595 747
%%Title: Enscript Output
%%For: Magnus Thoang
%%Creator: GNU enscript 1.6.1
%%CreationDate: Fri Oct 31 13:31:26 2003
%%Orientation: Portrait
%%Pages: 15 0
%%DocumentMedia: A4 595 842 0 () ()
%%DocumentNeededResources: (atend)
%%EndComments
%%BeginProlog
%%BeginProcSet: PStoPS 1 15
userdict begin
[/showpage/erasepage/copypage]{dup where{pop dup load
type/operatortype eq{1 array cvx dup 0 3 index cvx put
bind def}{pop}ifelse}{pop}ifelse}forall
[/letter/legal/executivepage/a4/a4small/b5/com10envelope
/monarchenvelope/c5envelope/dlenvelope/lettersmall/note
/folio/quarto/a5]{dup where{dup wcheck{exch{}put}
{pop{}def}ifelse}{pop}ifelse}forall
/setpagedevice {pop}bind 1 index where{dup wcheck{3 1 roll put}
{pop def}ifelse}{def}ifelse
/PStoPSmatrix matrix currentmatrix def
/PStoPSxform matrix def/PStoPSclip{clippath}def
/defaultmatrix{PStoPSmatrix exch PStoPSxform exch concatmatrix}bind def
/initmatrix{matrix defaultmatrix setmatrix}bind def
/initclip[{matrix currentmatrix PStoPSmatrix setmatrix
[{currentpoint}stopped{$error/newerror false put{newpath}}
{/newpath cvx 3 1 roll/moveto cvx 4 array astore cvx}ifelse]
{[/newpath cvx{/moveto cvx}{/lineto cvx}
{/curveto cvx}{/closepath cvx}pathforall]cvx exch pop}
stopped{$error/errorname get/invalidaccess eq{cleartomark
$error/newerror false put cvx exec}{stop}ifelse}if}bind aload pop
/initclip dup load dup type dup/operatortype eq{pop exch pop}
{dup/arraytype eq exch/packedarraytype eq or
{dup xcheck{exch pop aload pop}{pop cvx}ifelse}
{pop cvx}ifelse}ifelse
{newpath PStoPSclip clip newpath exec setmatrix} bind aload pop]cvx def
/initgraphics{initmatrix newpath initclip 1 setlinewidth
0 setlinecap 0 setlinejoin []0 setdash 0 setgray
10 setmiterlimit}bind def
end
%%EndProcSet
%%BeginResource: procset Enscript-Prolog 1.6 1
%
% Procedures.
%
/_S { % save current state
/_s save def
} def
/_R { % restore from saved state
_s restore
} def
/S { % showpage protecting gstate
gsave
showpage
grestore
} bind def
/MF { % fontname newfontname -> - make a new encoded font
/newfontname exch def
/fontname exch def
/fontdict fontname findfont def
/newfont fontdict maxlength dict def
fontdict {
exch
dup /FID eq {
% skip FID pair
pop pop
} {
% copy to the new font dictionary
exch newfont 3 1 roll put
} ifelse
} forall
newfont /FontName newfontname put
% insert only valid encoding vectors
encoding_vector length 256 eq {
newfont /Encoding encoding_vector put
} if
newfontname newfont definefont pop
} def
/SF { % fontname width height -> - set a new font
/height exch def
/width exch def
findfont
[width 0 0 height 0 0] makefont setfont
} def
/SUF { % fontname width height -> - set a new user font
/height exch def
/width exch def
/F-gs-user-font MF
/F-gs-user-font width height SF
} def
/M {moveto} bind def
/s {show} bind def
/Box { % x y w h -> - define box path
/d_h exch def /d_w exch def /d_y exch def /d_x exch def
d_x d_y moveto
d_w 0 rlineto
0 d_h rlineto
d_w neg 0 rlineto
closepath
} def
/bgs { % x y height blskip gray str -> - show string with bg color
/str exch def
/gray exch def
/blskip exch def
/height exch def
/y exch def
/x exch def
gsave
x y blskip sub str stringwidth pop height Box
gray setgray
fill
grestore
x y M str s
} def
% Highlight bars.
/highlight_bars { % nlines lineheight output_y_margin gray -> -
gsave
setgray
/ymarg exch def
/lineheight exch def
/nlines exch def
% This 2 is just a magic number to sync highlight lines to text.
0 d_header_y ymarg sub 2 sub translate
/cw d_output_w cols div def
/nrows d_output_h ymarg 2 mul sub lineheight div cvi def
% for each column
0 1 cols 1 sub {
cw mul /xp exch def
% for each rows
0 1 nrows 1 sub {
/rn exch def
rn lineheight mul neg /yp exch def
rn nlines idiv 2 mod 0 eq {
% Draw highlight bar. 4 is just a magic indentation.
xp 4 add yp cw 8 sub lineheight neg Box fill
} if
} for
} for
grestore
} def
% Line highlight bar.
/line_highlight { % x y width height gray -> -
gsave
/gray exch def
Box gray setgray fill
grestore
} def
% Column separator lines.
/column_lines {
gsave
.1 setlinewidth
0 d_footer_h translate
/cw d_output_w cols div def
1 1 cols 1 sub {
cw mul 0 moveto
0 d_output_h rlineto stroke
} for
grestore
} def
% Column borders.
/column_borders {
gsave
.1 setlinewidth
0 d_footer_h moveto
0 d_output_h rlineto
d_output_w 0 rlineto
0 d_output_h neg rlineto
closepath stroke
grestore
} def
% Do the actual underlay drawing
/draw_underlay {
ul_style 0 eq {
ul_str true charpath stroke
} {
ul_str show
} ifelse
} def
% Underlay
/underlay { % - -> -
gsave
0 d_page_h translate
d_page_h neg d_page_w atan rotate
ul_gray setgray
ul_font setfont
/dw d_page_h dup mul d_page_w dup mul add sqrt def
ul_str stringwidth pop dw exch sub 2 div ul_h_ptsize -2 div moveto
draw_underlay
grestore
} def
/user_underlay { % - -> -
gsave
ul_x ul_y translate
ul_angle rotate
ul_gray setgray
ul_font setfont
0 0 ul_h_ptsize 2 div sub moveto
draw_underlay
grestore
} def
% Page prefeed
/page_prefeed { % bool -> -
statusdict /prefeed known {
statusdict exch /prefeed exch put
} {
pop
} ifelse
} def
% Wrapped line markers
/wrapped_line_mark { % x y charwith charheight type -> -
/type exch def
/h exch def
/w exch def
/y exch def
/x exch def
type 2 eq {
% Black boxes (like TeX does)
gsave
0 setlinewidth
x w 4 div add y M
0 h rlineto w 2 div 0 rlineto 0 h neg rlineto
closepath fill
grestore
} {
type 3 eq {
% Small arrows
gsave
.2 setlinewidth
x w 2 div add y h 2 div add M
w 4 div 0 rlineto
x w 4 div add y lineto stroke
x w 4 div add w 8 div add y h 4 div add M
x w 4 div add y lineto
w 4 div h 8 div rlineto stroke
grestore
} {
% do nothing
} ifelse
} ifelse
} def
% EPSF import.
/BeginEPSF {
/b4_Inc_state save def % Save state for cleanup
/dict_count countdictstack def % Count objects on dict stack
/op_count count 1 sub def % Count objects on operand stack
userdict begin
/showpage { } def
0 setgray 0 setlinecap
1 setlinewidth 0 setlinejoin
10 setmiterlimit [ ] 0 setdash newpath
/languagelevel where {
pop languagelevel
1 ne {
false setstrokeadjust false setoverprint
} if
} if
} bind def
/EndEPSF {
count op_count sub { pos } repeat % Clean up stacks
countdictstack dict_count sub { end } repeat
b4_Inc_state restore
} bind def
% Check PostScript language level.
/languagelevel where {
pop /gs_languagelevel languagelevel def
} {
/gs_languagelevel 1 def
} ifelse
%%EndResource
%%BeginResource: procset Enscript-Encoding-88591 1.6 1
/encoding_vector [
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/space /exclam /quotedbl /numbersign
/dollar /percent /ampersand /quoteright
/parenleft /parenright /asterisk /plus
/comma /hyphen /period /slash
/zero /one /two /three
/four /five /six /seven
/eight /nine /colon /semicolon
/less /equal /greater /question
/at /A /B /C
/D /E /F /G
/H /I /J /K
/L /M /N /O
/P /Q /R /S
/T /U /V /W
/X /Y /Z /bracketleft
/backslash /bracketright /asciicircum /underscore
/quoteleft /a /b /c
/d /e /f /g
/h /i /j /k
/l /m /n /o
/p /q /r /s
/t /u /v /w
/x /y /z /braceleft
/bar /braceright /tilde /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/.notdef /.notdef /.notdef /.notdef
/space /exclamdown /cent /sterling
/currency /yen /brokenbar /section
/dieresis /copyright /ordfeminine /guillemotleft
/logicalnot /hyphen /registered /macron
/degree /plusminus /twosuperior /threesuperior
/acute /mu /paragraph /bullet
/cedilla /onesuperior /ordmasculine /guillemotright
/onequarter /onehalf /threequarters /questiondown
/Agrave /Aacute /Acircumflex /Atilde
/Adieresis /Aring /AE /Ccedilla
/Egrave /Eacute /Ecircumflex /Edieresis
/Igrave /Iacute /Icircumflex /Idieresis
/Eth /Ntilde /Ograve /Oacute
/Ocircumflex /Otilde /Odieresis /multiply
/Oslash /Ugrave /Uacute /Ucircumflex
/Udieresis /Yacute /Thorn /germandbls
/agrave /aacute /acircumflex /atilde
/adieresis /aring /ae /ccedilla
/egrave /eacute /ecircumflex /edieresis
/igrave /iacute /icircumflex /idieresis
/eth /ntilde /ograve /oacute
/ocircumflex /otilde /odieresis /divide
/oslash /ugrave /uacute /ucircumflex
/udieresis /yacute /thorn /ydieresis
] def
%%EndResource
%%EndProlog
%%BeginSetup
%%IncludeResource: font Courier-Bold
%%IncludeResource: font Courier
/HFpt_w 10 def
/HFpt_h 10 def
/Courier-Bold /HF-gs-font MF
/HF /HF-gs-font findfont [HFpt_w 0 0 HFpt_h 0 0] makefont def
/Courier /F-gs-font MF
/F-gs-font 10 10 SF
/#copies 1 def
/d_page_w 520 def
/d_page_h 747 def
/d_header_x 0 def
/d_header_y 747 def
/d_header_w 520 def
/d_header_h 0 def
/d_footer_x 0 def
/d_footer_y 0 def
/d_footer_w 520 def
/d_footer_h 0 def
/d_output_w 520 def
/d_output_h 747 def
/cols 1 def
userdict/PStoPSxform PStoPSmatrix matrix currentmatrix
matrix invertmatrix matrix concatmatrix
matrix invertmatrix put
%%EndSetup
%%Page: (0,1) 1
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 1 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 701 M
(Network Working Group T. Ylonen) s
5 690 M
(Internet-Draft SSH Communications Security Corp) s
5 679 M
(Expires: March 31, 2004 D. Moffat, Ed.) s
5 668 M
( Sun Microsystems, Inc) s
5 657 M
( Oct 2003) s
5 624 M
( SSH Protocol Architecture) s
5 613 M
( draft-ietf-secsh-architecture-15.txt) s
5 591 M
(Status of this Memo) s
5 569 M
( This document is an Internet-Draft and is in full conformance with) s
5 558 M
( all provisions of Section 10 of RFC2026.) s
5 536 M
( Internet-Drafts are working documents of the Internet Engineering) s
5 525 M
( Task Force \(IETF\), its areas, and its working groups. Note that other) s
5 514 M
( groups may also distribute working documents as Internet-Drafts.) s
5 492 M
( Internet-Drafts are draft documents valid for a maximum of six months) s
5 481 M
( and may be updated, replaced, or obsoleted by other documents at any) s
5 470 M
( time. It is inappropriate to use Internet-Drafts as reference) s
5 459 M
( material or to cite them other than as "work in progress.") s
5 437 M
( The list of current Internet-Drafts can be accessed at http://) s
5 426 M
( www.ietf.org/ietf/1id-abstracts.txt.) s
5 404 M
( The list of Internet-Draft Shadow Directories can be accessed at) s
5 393 M
( http://www.ietf.org/shadow.html.) s
5 371 M
( This Internet-Draft will expire on March 31, 2004.) s
5 349 M
(Copyright Notice) s
5 327 M
( Copyright \(C\) The Internet Society \(2003\). All Rights Reserved.) s
5 305 M
(Abstract) s
5 283 M
( SSH is a protocol for secure remote login and other secure network) s
5 272 M
( services over an insecure network. This document describes the) s
5 261 M
( architecture of the SSH protocol, as well as the notation and) s
5 250 M
( terminology used in SSH protocol documents. It also discusses the SSH) s
5 239 M
( algorithm naming system that allows local extensions. The SSH) s
5 228 M
( protocol consists of three major components: The Transport Layer) s
5 217 M
( Protocol provides server authentication, confidentiality, and) s
5 206 M
( integrity with perfect forward secrecy. The User Authentication) s
5 195 M
( Protocol authenticates the client to the server. The Connection) s
5 184 M
( Protocol multiplexes the encrypted tunnel into several logical) s
5 173 M
( channels. Details of these protocols are described in separate) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 1]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 2 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( documents.) s
5 668 M
(Table of Contents) s
5 646 M
( 1. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 3) s
5 635 M
( 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3) s
5 624 M
( 3. Specification of Requirements . . . . . . . . . . . . . . . 3) s
5 613 M
( 4. Architecture . . . . . . . . . . . . . . . . . . . . . . . . 3) s
5 602 M
( 4.1 Host Keys . . . . . . . . . . . . . . . . . . . . . . . . . 4) s
5 591 M
( 4.2 Extensibility . . . . . . . . . . . . . . . . . . . . . . . 5) s
5 580 M
( 4.3 Policy Issues . . . . . . . . . . . . . . . . . . . . . . . 5) s
5 569 M
( 4.4 Security Properties . . . . . . . . . . . . . . . . . . . . 6) s
5 558 M
( 4.5 Packet Size and Overhead . . . . . . . . . . . . . . . . . . 6) s
5 547 M
( 4.6 Localization and Character Set Support . . . . . . . . . . . 7) s
5 536 M
( 5. Data Type Representations Used in the SSH Protocols . . . . 8) s
5 525 M
( 6. Algorithm Naming . . . . . . . . . . . . . . . . . . . . . . 10) s
5 514 M
( 7. Message Numbers . . . . . . . . . . . . . . . . . . . . . . 11) s
5 503 M
( 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . 11) s
5 492 M
( 9. Security Considerations . . . . . . . . . . . . . . . . . . 12) s
5 481 M
( 9.1 Pseudo-Random Number Generation . . . . . . . . . . . . . . 12) s
5 470 M
( 9.2 Transport . . . . . . . . . . . . . . . . . . . . . . . . . 13) s
5 459 M
( 9.2.1 Confidentiality . . . . . . . . . . . . . . . . . . . . . . 13) s
5 448 M
( 9.2.2 Data Integrity . . . . . . . . . . . . . . . . . . . . . . . 16) s
5 437 M
( 9.2.3 Replay . . . . . . . . . . . . . . . . . . . . . . . . . . . 16) s
5 426 M
( 9.2.4 Man-in-the-middle . . . . . . . . . . . . . . . . . . . . . 17) s
5 415 M
( 9.2.5 Denial-of-service . . . . . . . . . . . . . . . . . . . . . 19) s
5 404 M
( 9.2.6 Covert Channels . . . . . . . . . . . . . . . . . . . . . . 19) s
5 393 M
( 9.2.7 Forward Secrecy . . . . . . . . . . . . . . . . . . . . . . 20) s
5 382 M
( 9.3 Authentication Protocol . . . . . . . . . . . . . . . . . . 20) s
5 371 M
( 9.3.1 Weak Transport . . . . . . . . . . . . . . . . . . . . . . . 21) s
5 360 M
( 9.3.2 Debug messages . . . . . . . . . . . . . . . . . . . . . . . 21) s
5 349 M
( 9.3.3 Local security policy . . . . . . . . . . . . . . . . . . . 21) s
5 338 M
( 9.3.4 Public key authentication . . . . . . . . . . . . . . . . . 22) s
5 327 M
( 9.3.5 Password authentication . . . . . . . . . . . . . . . . . . 22) s
5 316 M
( 9.3.6 Host based authentication . . . . . . . . . . . . . . . . . 23) s
5 305 M
( 9.4 Connection protocol . . . . . . . . . . . . . . . . . . . . 23) s
5 294 M
( 9.4.1 End point security . . . . . . . . . . . . . . . . . . . . . 23) s
5 283 M
( 9.4.2 Proxy forwarding . . . . . . . . . . . . . . . . . . . . . . 23) s
5 272 M
( 9.4.3 X11 forwarding . . . . . . . . . . . . . . . . . . . . . . . 24) s
5 261 M
( Normative References . . . . . . . . . . . . . . . . . . . . 24) s
5 250 M
( Informative References . . . . . . . . . . . . . . . . . . . 25) s
5 239 M
( Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 27) s
5 228 M
( Intellectual Property and Copyright Statements . . . . . . . 28) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 2]) s
_R
S
PStoPSsaved restore
%%Page: (2,3) 2
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 3 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
(1. Contributors) s
5 668 M
( The major original contributors of this document were: Tatu Ylonen,) s
5 657 M
( Tero Kivinen, Timo J. Rinne, Sami Lehtinen \(all of SSH Communications) s
5 646 M
( Security Corp\), and Markku-Juhani O. Saarinen \(University of) s
5 635 M
( Jyvaskyla\)) s
5 613 M
( The document editor is: [email protected]. Comments on this) s
5 602 M
( internet draft should be sent to the IETF SECSH working group,) s
5 591 M
( details at: http://ietf.org/html.charters/secsh-charter.html) s
5 569 M
(2. Introduction) s
5 547 M
( SSH is a protocol for secure remote login and other secure network) s
5 536 M
( services over an insecure network. It consists of three major) s
5 525 M
( components:) s
5 514 M
( o The Transport Layer Protocol [SSH-TRANS] provides server) s
5 503 M
( authentication, confidentiality, and integrity. It may optionally) s
5 492 M
( also provide compression. The transport layer will typically be) s
5 481 M
( run over a TCP/IP connection, but might also be used on top of any) s
5 470 M
( other reliable data stream.) s
5 459 M
( o The User Authentication Protocol [SSH-USERAUTH] authenticates the) s
5 448 M
( client-side user to the server. It runs over the transport layer) s
5 437 M
( protocol.) s
5 426 M
( o The Connection Protocol [SSH-CONNECT] multiplexes the encrypted) s
5 415 M
( tunnel into several logical channels. It runs over the user) s
5 404 M
( authentication protocol.) s
5 382 M
( The client sends a service request once a secure transport layer) s
5 371 M
( connection has been established. A second service request is sent) s
5 360 M
( after user authentication is complete. This allows new protocols to) s
5 349 M
( be defined and coexist with the protocols listed above.) s
5 327 M
( The connection protocol provides channels that can be used for a wide) s
5 316 M
( range of purposes. Standard methods are provided for setting up) s
5 305 M
( secure interactive shell sessions and for forwarding \("tunneling"\)) s
5 294 M
( arbitrary TCP/IP ports and X11 connections.) s
5 272 M
(3. Specification of Requirements) s
5 250 M
( All documents related to the SSH protocols shall use the keywords) s
5 239 M
( "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD",) s
5 228 M
( "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" to describe) s
5 217 M
( requirements. They are to be interpreted as described in [RFC2119].) s
5 195 M
(4. Architecture) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 3]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 4 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
(4.1 Host Keys) s
5 668 M
( Each server host SHOULD have a host key. Hosts MAY have multiple) s
5 657 M
( host keys using multiple different algorithms. Multiple hosts MAY) s
5 646 M
( share the same host key. If a host has keys at all, it MUST have at) s
5 635 M
( least one key using each REQUIRED public key algorithm \(DSS) s
5 624 M
( [FIPS-186]\).) s
5 602 M
( The server host key is used during key exchange to verify that the) s
5 591 M
( client is really talking to the correct server. For this to be) s
5 580 M
( possible, the client must have a priori knowledge of the server's) s
5 569 M
( public host key.) s
5 547 M
( Two different trust models can be used:) s
5 536 M
( o The client has a local database that associates each host name \(as) s
5 525 M
( typed by the user\) with the corresponding public host key. This) s
5 514 M
( method requires no centrally administered infrastructure, and no) s
5 503 M
( third-party coordination. The downside is that the database of) s
5 492 M
( name-to-key associations may become burdensome to maintain.) s
5 481 M
( o The host name-to-key association is certified by some trusted) s
5 470 M
( certification authority. The client only knows the CA root key,) s
5 459 M
( and can verify the validity of all host keys certified by accepted) s
5 448 M
( CAs.) s
5 426 M
( The second alternative eases the maintenance problem, since) s
5 415 M
( ideally only a single CA key needs to be securely stored on the) s
5 404 M
( client. On the other hand, each host key must be appropriately) s
5 393 M
( certified by a central authority before authorization is possible.) s
5 382 M
( Also, a lot of trust is placed on the central infrastructure.) s
5 360 M
( The protocol provides the option that the server name - host key) s
5 349 M
( association is not checked when connecting to the host for the first) s
5 338 M
( time. This allows communication without prior communication of host) s
5 327 M
( keys or certification. The connection still provides protection) s
5 316 M
( against passive listening; however, it becomes vulnerable to active) s
5 305 M
( man-in-the-middle attacks. Implementations SHOULD NOT normally allow) s
5 294 M
( such connections by default, as they pose a potential security) s
5 283 M
( problem. However, as there is no widely deployed key infrastructure) s
5 272 M
( available on the Internet yet, this option makes the protocol much) s
5 261 M
( more usable during the transition time until such an infrastructure) s
5 250 M
( emerges, while still providing a much higher level of security than) s
5 239 M
( that offered by older solutions \(e.g. telnet [RFC-854] and rlogin) s
5 228 M
( [RFC-1282]\).) s
5 206 M
( Implementations SHOULD try to make the best effort to check host) s
5 195 M
( keys. An example of a possible strategy is to only accept a host key) s
5 184 M
( without checking the first time a host is connected, save the key in) s
5 173 M
( a local database, and compare against that key on all future) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 4]) s
_R
S
PStoPSsaved restore
%%Page: (4,5) 3
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 5 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( connections to that host.) s
5 668 M
( Implementations MAY provide additional methods for verifying the) s
5 657 M
( correctness of host keys, e.g. a hexadecimal fingerprint derived from) s
5 646 M
( the SHA-1 hash of the public key. Such fingerprints can easily be) s
5 635 M
( verified by using telephone or other external communication channels.) s
5 613 M
( All implementations SHOULD provide an option to not accept host keys) s
5 602 M
( that cannot be verified.) s
5 580 M
( We believe that ease of use is critical to end-user acceptance of) s
5 569 M
( security solutions, and no improvement in security is gained if the) s
5 558 M
( new solutions are not used. Thus, providing the option not to check) s
5 547 M
( the server host key is believed to improve the overall security of) s
5 536 M
( the Internet, even though it reduces the security of the protocol in) s
5 525 M
( configurations where it is allowed.) s
5 503 M
(4.2 Extensibility) s
5 481 M
( We believe that the protocol will evolve over time, and some) s
5 470 M
( organizations will want to use their own encryption, authentication) s
5 459 M
( and/or key exchange methods. Central registration of all extensions) s
5 448 M
( is cumbersome, especially for experimental or classified features.) s
5 437 M
( On the other hand, having no central registration leads to conflicts) s
5 426 M
( in method identifiers, making interoperability difficult.) s
5 404 M
( We have chosen to identify algorithms, methods, formats, and) s
5 393 M
( extension protocols with textual names that are of a specific format.) s
5 382 M
( DNS names are used to create local namespaces where experimental or) s
5 371 M
( classified extensions can be defined without fear of conflicts with) s
5 360 M
( other implementations.) s
5 338 M
( One design goal has been to keep the base protocol as simple as) s
5 327 M
( possible, and to require as few algorithms as possible. However, all) s
5 316 M
( implementations MUST support a minimal set of algorithms to ensure) s
5 305 M
( interoperability \(this does not imply that the local policy on all) s
5 294 M
( hosts would necessary allow these algorithms\). The mandatory) s
5 283 M
( algorithms are specified in the relevant protocol documents.) s
5 261 M
( Additional algorithms, methods, formats, and extension protocols can) s
5 250 M
( be defined in separate drafts. See Section Algorithm Naming \(Section) s
5 239 M
( 6\) for more information.) s
5 217 M
(4.3 Policy Issues) s
5 195 M
( The protocol allows full negotiation of encryption, integrity, key) s
5 184 M
( exchange, compression, and public key algorithms and formats.) s
5 173 M
( Encryption, integrity, public key, and compression algorithms can be) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 5]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 6 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( different for each direction.) s
5 668 M
( The following policy issues SHOULD be addressed in the configuration) s
5 657 M
( mechanisms of each implementation:) s
5 646 M
( o Encryption, integrity, and compression algorithms, separately for) s
5 635 M
( each direction. The policy MUST specify which is the preferred) s
5 624 M
( algorithm \(e.g. the first algorithm listed in each category\).) s
5 613 M
( o Public key algorithms and key exchange method to be used for host) s
5 602 M
( authentication. The existence of trusted host keys for different) s
5 591 M
( public key algorithms also affects this choice.) s
5 580 M
( o The authentication methods that are to be required by the server) s
5 569 M
( for each user. The server's policy MAY require multiple) s
5 558 M
( authentication for some or all users. The required algorithms MAY) s
5 547 M
( depend on the location where the user is trying to log in from.) s
5 536 M
( o The operations that the user is allowed to perform using the) s
5 525 M
( connection protocol. Some issues are related to security; for) s
5 514 M
( example, the policy SHOULD NOT allow the server to start sessions) s
5 503 M
( or run commands on the client machine, and MUST NOT allow) s
5 492 M
( connections to the authentication agent unless forwarding such) s
5 481 M
( connections has been requested. Other issues, such as which TCP/) s
5 470 M
( IP ports can be forwarded and by whom, are clearly issues of local) s
5 459 M
( policy. Many of these issues may involve traversing or bypassing) s
5 448 M
( firewalls, and are interrelated with the local security policy.) s
5 426 M
(4.4 Security Properties) s
5 404 M
( The primary goal of the SSH protocol is improved security on the) s
5 393 M
( Internet. It attempts to do this in a way that is easy to deploy,) s
5 382 M
( even at the cost of absolute security.) s
5 371 M
( o All encryption, integrity, and public key algorithms used are) s
5 360 M
( well-known, well-established algorithms.) s
5 349 M
( o All algorithms are used with cryptographically sound key sizes) s
5 338 M
( that are believed to provide protection against even the strongest) s
5 327 M
( cryptanalytic attacks for decades.) s
5 316 M
( o All algorithms are negotiated, and in case some algorithm is) s
5 305 M
( broken, it is easy to switch to some other algorithm without) s
5 294 M
( modifying the base protocol.) s
5 272 M
( Specific concessions were made to make wide-spread fast deployment) s
5 261 M
( easier. The particular case where this comes up is verifying that) s
5 250 M
( the server host key really belongs to the desired host; the protocol) s
5 239 M
( allows the verification to be left out \(but this is NOT RECOMMENDED\).) s
5 228 M
( This is believed to significantly improve usability in the short) s
5 217 M
( term, until widespread Internet public key infrastructures emerge.) s
5 195 M
(4.5 Packet Size and Overhead) s
5 173 M
( Some readers will worry about the increase in packet size due to new) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 6]) s
_R
S
PStoPSsaved restore
%%Page: (6,7) 4
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 7 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( headers, padding, and MAC. The minimum packet size is in the order) s
5 679 M
( of 28 bytes \(depending on negotiated algorithms\). The increase is) s
5 668 M
( negligible for large packets, but very significant for one-byte) s
5 657 M
( packets \(telnet-type sessions\). There are, however, several factors) s
5 646 M
( that make this a non-issue in almost all cases:) s
5 635 M
( o The minimum size of a TCP/IP header is 32 bytes. Thus, the) s
5 624 M
( increase is actually from 33 to 51 bytes \(roughly\).) s
5 613 M
( o The minimum size of the data field of an Ethernet packet is 46) s
5 602 M
( bytes [RFC-894]. Thus, the increase is no more than 5 bytes. When) s
5 591 M
( Ethernet headers are considered, the increase is less than 10) s
5 580 M
( percent.) s
5 569 M
( o The total fraction of telnet-type data in the Internet is) s
5 558 M
( negligible, even with increased packet sizes.) s
5 536 M
( The only environment where the packet size increase is likely to have) s
5 525 M
( a significant effect is PPP [RFC-1134] over slow modem lines \(PPP) s
5 514 M
( compresses the TCP/IP headers, emphasizing the increase in packet) s
5 503 M
( size\). However, with modern modems, the time needed to transfer is in) s
5 492 M
( the order of 2 milliseconds, which is a lot faster than people can) s
5 481 M
( type.) s
5 459 M
( There are also issues related to the maximum packet size. To) s
5 448 M
( minimize delays in screen updates, one does not want excessively) s
5 437 M
( large packets for interactive sessions. The maximum packet size is) s
5 426 M
( negotiated separately for each channel.) s
5 404 M
(4.6 Localization and Character Set Support) s
5 382 M
( For the most part, the SSH protocols do not directly pass text that) s
5 371 M
( would be displayed to the user. However, there are some places where) s
5 360 M
( such data might be passed. When applicable, the character set for the) s
5 349 M
( data MUST be explicitly specified. In most places, ISO 10646 with) s
5 338 M
( UTF-8 encoding is used [RFC-2279]. When applicable, a field is also) s
5 327 M
( provided for a language tag [RFC-3066].) s
5 305 M
( One big issue is the character set of the interactive session. There) s
5 294 M
( is no clear solution, as different applications may display data in) s
5 283 M
( different formats. Different types of terminal emulation may also be) s
5 272 M
( employed in the client, and the character set to be used is) s
5 261 M
( effectively determined by the terminal emulation. Thus, no place is) s
5 250 M
( provided for directly specifying the character set or encoding for) s
5 239 M
( terminal session data. However, the terminal emulation type \(e.g.) s
5 228 M
( "vt100"\) is transmitted to the remote site, and it implicitly) s
5 217 M
( specifies the character set and encoding. Applications typically use) s
5 206 M
( the terminal type to determine what character set they use, or the) s
5 195 M
( character set is determined using some external means. The terminal) s
5 184 M
( emulation may also allow configuring the default character set. In) s
5 173 M
( any case, the character set for the terminal session is considered) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 7]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 8 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( primarily a client local issue.) s
5 668 M
( Internal names used to identify algorithms or protocols are normally) s
5 657 M
( never displayed to users, and must be in US-ASCII.) s
5 635 M
( The client and server user names are inherently constrained by what) s
5 624 M
( the server is prepared to accept. They might, however, occasionally) s
5 613 M
( be displayed in logs, reports, etc. They MUST be encoded using ISO) s
5 602 M
( 10646 UTF-8, but other encodings may be required in some cases. It) s
5 591 M
( is up to the server to decide how to map user names to accepted user) s
5 580 M
( names. Straight bit-wise binary comparison is RECOMMENDED.) s
5 558 M
( For localization purposes, the protocol attempts to minimize the) s
5 547 M
( number of textual messages transmitted. When present, such messages) s
5 536 M
( typically relate to errors, debugging information, or some externally) s
5 525 M
( configured data. For data that is normally displayed, it SHOULD be) s
5 514 M
( possible to fetch a localized message instead of the transmitted) s
5 503 M
( message by using a numerical code. The remaining messages SHOULD be) s
5 492 M
( configurable.) s
5 470 M
(5. Data Type Representations Used in the SSH Protocols) s
5 459 M
( byte) s
5 437 M
( A byte represents an arbitrary 8-bit value \(octet\) [RFC-1700].) s
5 426 M
( Fixed length data is sometimes represented as an array of bytes,) s
5 415 M
( written byte[n], where n is the number of bytes in the array.) s
5 393 M
( boolean) s
5 371 M
( A boolean value is stored as a single byte. The value 0) s
5 360 M
( represents FALSE, and the value 1 represents TRUE. All non-zero) s
5 349 M
( values MUST be interpreted as TRUE; however, applications MUST NOT) s
5 338 M
( store values other than 0 and 1.) s
5 316 M
( uint32) s
5 294 M
( Represents a 32-bit unsigned integer. Stored as four bytes in the) s
5 283 M
( order of decreasing significance \(network byte order\). For) s
5 272 M
( example, the value 699921578 \(0x29b7f4aa\) is stored as 29 b7 f4) s
5 261 M
( aa.) s
5 239 M
( uint64) s
5 217 M
( Represents a 64-bit unsigned integer. Stored as eight bytes in) s
5 206 M
( the order of decreasing significance \(network byte order\).) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 8]) s
_R
S
PStoPSsaved restore
%%Page: (8,9) 5
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 9 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( string) s
5 668 M
( Arbitrary length binary string. Strings are allowed to contain) s
5 657 M
( arbitrary binary data, including null characters and 8-bit) s
5 646 M
( characters. They are stored as a uint32 containing its length) s
5 635 M
( \(number of bytes that follow\) and zero \(= empty string\) or more) s
5 624 M
( bytes that are the value of the string. Terminating null) s
5 613 M
( characters are not used.) s
5 591 M
( Strings are also used to store text. In that case, US-ASCII is) s
5 580 M
( used for internal names, and ISO-10646 UTF-8 for text that might) s
5 569 M
( be displayed to the user. The terminating null character SHOULD) s
5 558 M
( NOT normally be stored in the string.) s
5 536 M
( For example, the US-ASCII string "testing" is represented as 00 00) s
5 525 M
( 00 07 t e s t i n g. The UTF8 mapping does not alter the encoding) s
5 514 M
( of US-ASCII characters.) s
5 492 M
( mpint) s
5 470 M
( Represents multiple precision integers in two's complement format,) s
5 459 M
( stored as a string, 8 bits per byte, MSB first. Negative numbers) s
5 448 M
( have the value 1 as the most significant bit of the first byte of) s
5 437 M
( the data partition. If the most significant bit would be set for a) s
5 426 M
( positive number, the number MUST be preceded by a zero byte.) s
5 415 M
( Unnecessary leading bytes with the value 0 or 255 MUST NOT be) s
5 404 M
( included. The value zero MUST be stored as a string with zero) s
5 393 M
( bytes of data.) s
5 371 M
( By convention, a number that is used in modular computations in) s
5 360 M
( Z_n SHOULD be represented in the range 0 <= x < n.) s
5 338 M
( Examples:) s
5 327 M
( value \(hex\) representation \(hex\)) s
5 316 M
( ---------------------------------------------------------------) s
5 305 M
( 0 00 00 00 00) s
5 294 M
( 9a378f9b2e332a7 00 00 00 08 09 a3 78 f9 b2 e3 32 a7) s
5 283 M
( 80 00 00 00 02 00 80) s
5 272 M
( -1234 00 00 00 02 ed cc) s
5 261 M
( -deadbeef 00 00 00 05 ff 21 52 41 11) s
5 217 M
( name-list) s
5 195 M
( A string containing a comma separated list of names. A name list) s
5 184 M
( is represented as a uint32 containing its length \(number of bytes) s
5 173 M
( that follow\) followed by a comma-separated list of zero or more) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 9]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 10 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( names. A name MUST be non-zero length, and it MUST NOT contain a) s
5 679 M
( comma \(','\). Context may impose additional restrictions on the) s
5 668 M
( names; for example, the names in a list may have to be valid) s
5 657 M
( algorithm identifier \(see Algorithm Naming below\), or [RFC-3066]) s
5 646 M
( language tags. The order of the names in a list may or may not be) s
5 635 M
( significant, also depending on the context where the list is is) s
5 624 M
( used. Terminating NUL characters are not used, neither for the) s
5 613 M
( individual names, nor for the list as a whole.) s
5 591 M
( Examples:) s
5 580 M
( value representation \(hex\)) s
5 569 M
( ---------------------------------------) s
5 558 M
( \(\), the empty list 00 00 00 00) s
5 547 M
( \("zlib"\) 00 00 00 04 7a 6c 69 62) s
5 536 M
( \("zlib", "none"\) 00 00 00 09 7a 6c 69 62 2c 6e 6f 6e 65) s
5 481 M
(6. Algorithm Naming) s
5 459 M
( The SSH protocols refer to particular hash, encryption, integrity,) s
5 448 M
( compression, and key exchange algorithms or protocols by names.) s
5 437 M
( There are some standard algorithms that all implementations MUST) s
5 426 M
( support. There are also algorithms that are defined in the protocol) s
5 415 M
( specification but are OPTIONAL. Furthermore, it is expected that) s
5 404 M
( some organizations will want to use their own algorithms.) s
5 382 M
( In this protocol, all algorithm identifiers MUST be printable) s
5 371 M
( US-ASCII non-empty strings no longer than 64 characters. Names MUST) s
5 360 M
( be case-sensitive.) s
5 338 M
( There are two formats for algorithm names:) s
5 327 M
( o Names that do not contain an at-sign \(@\) are reserved to be) s
5 316 M
( assigned by IETF consensus \(RFCs\). Examples include `3des-cbc',) s
5 305 M
( `sha-1', `hmac-sha1', and `zlib' \(the quotes are not part of the) s
5 294 M
( name\). Names of this format MUST NOT be used without first) s
5 283 M
( registering them. Registered names MUST NOT contain an at-sign) s
5 272 M
( \(@\) or a comma \(,\).) s
5 261 M
( o Anyone can define additional algorithms by using names in the) s
5 250 M
( format name@domainname, e.g. "[email protected]". The) s
5 239 M
( format of the part preceding the at sign is not specified; it MUST) s
5 228 M
( consist of US-ASCII characters except at-sign and comma. The part) s
5 217 M
( following the at-sign MUST be a valid fully qualified internet) s
5 206 M
( domain name [RFC-1034] controlled by the person or organization) s
5 195 M
( defining the name. It is up to each domain how it manages its) s
5 184 M
( local namespace.) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 10]) s
_R
S
PStoPSsaved restore
%%Page: (10,11) 6
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 11 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
(7. Message Numbers) s
5 668 M
( SSH packets have message numbers in the range 1 to 255. These numbers) s
5 657 M
( have been allocated as follows:) s
5 624 M
( Transport layer protocol:) s
5 602 M
( 1 to 19 Transport layer generic \(e.g. disconnect, ignore, debug,) s
5 591 M
( etc.\)) s
5 580 M
( 20 to 29 Algorithm negotiation) s
5 569 M
( 30 to 49 Key exchange method specific \(numbers can be reused for) s
5 558 M
( different authentication methods\)) s
5 536 M
( User authentication protocol:) s
5 514 M
( 50 to 59 User authentication generic) s
5 503 M
( 60 to 79 User authentication method specific \(numbers can be) s
5 492 M
( reused for different authentication methods\)) s
5 470 M
( Connection protocol:) s
5 448 M
( 80 to 89 Connection protocol generic) s
5 437 M
( 90 to 127 Channel related messages) s
5 415 M
( Reserved for client protocols:) s
5 393 M
( 128 to 191 Reserved) s
5 371 M
( Local extensions:) s
5 349 M
( 192 to 255 Local extensions) s
5 305 M
(8. IANA Considerations) s
5 283 M
( The initial state of the IANA registry is detailed in [SSH-NUMBERS].) s
5 261 M
( Allocation of the following types of names in the SSH protocols is) s
5 250 M
( assigned by IETF consensus:) s
5 239 M
( o SSH encryption algorithm names,) s
5 228 M
( o SSH MAC algorithm names,) s
5 217 M
( o SSH public key algorithm names \(public key algorithm also implies) s
5 206 M
( encoding and signature/encryption capability\),) s
5 195 M
( o SSH key exchange method names, and) s
5 184 M
( o SSH protocol \(service\) names.) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 11]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 12 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( These names MUST be printable US-ASCII strings, and MUST NOT contain) s
5 679 M
( the characters at-sign \('@'\), comma \(','\), or whitespace or control) s
5 668 M
( characters \(ASCII codes 32 or less\). Names are case-sensitive, and) s
5 657 M
( MUST NOT be longer than 64 characters.) s
5 635 M
( Names with the at-sign \('@'\) in them are allocated by the owner of) s
5 624 M
( DNS name after the at-sign \(hierarchical allocation in [RFC-2343]\),) s
5 613 M
( otherwise the same restrictions as above.) s
5 591 M
( Each category of names listed above has a separate namespace.) s
5 580 M
( However, using the same name in multiple categories SHOULD be avoided) s
5 569 M
( to minimize confusion.) s
5 547 M
( Message numbers \(see Section Message Numbers \(Section 7\)\) in the) s
5 536 M
( range of 0..191 are allocated via IETF consensus; message numbers in) s
5 525 M
( the 192..255 range \(the "Local extensions" set\) are reserved for) s
5 514 M
( private use.) s
5 492 M
(9. Security Considerations) s
5 470 M
( In order to make the entire body of Security Considerations more) s
5 459 M
( accessible, Security Considerations for the transport,) s
5 448 M
( authentication, and connection documents have been gathered here.) s
5 426 M
( The transport protocol [1] provides a confidential channel over an) s
5 415 M
( insecure network. It performs server host authentication, key) s
5 404 M
( exchange, encryption, and integrity protection. It also derives a) s
5 393 M
( unique session id that may be used by higher-level protocols.) s
5 371 M
( The authentication protocol [2] provides a suite of mechanisms which) s
5 360 M
( can be used to authenticate the client user to the server.) s
5 349 M
( Individual mechanisms specified in the in authentication protocol use) s
5 338 M
( the session id provided by the transport protocol and/or depend on) s
5 327 M
( the security and integrity guarantees of the transport protocol.) s
5 305 M
( The connection protocol [3] specifies a mechanism to multiplex) s
5 294 M
( multiple streams [channels] of data over the confidential and) s
5 283 M
( authenticated transport. It also specifies channels for accessing an) s
5 272 M
( interactive shell, for 'proxy-forwarding' various external protocols) s
5 261 M
( over the secure transport \(including arbitrary TCP/IP protocols\), and) s
5 250 M
( for accessing secure 'subsystems' on the server host.) s
5 228 M
(9.1 Pseudo-Random Number Generation) s
5 206 M
( This protocol binds each session key to the session by including) s
5 195 M
( random, session specific data in the hash used to produce session) s
5 184 M
( keys. Special care should be taken to ensure that all of the random) s
5 173 M
( numbers are of good quality. If the random data here \(e.g., DH) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 12]) s
_R
S
PStoPSsaved restore
%%Page: (12,13) 7
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 13 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( parameters\) are pseudo-random then the pseudo-random number generator) s
5 679 M
( should be cryptographically secure \(i.e., its next output not easily) s
5 668 M
( guessed even when knowing all previous outputs\) and, furthermore,) s
5 657 M
( proper entropy needs to be added to the pseudo-random number) s
5 646 M
( generator. RFC 1750 [1750] offers suggestions for sources of random) s
5 635 M
( numbers and entropy. Implementors should note the importance of) s
5 624 M
( entropy and the well-meant, anecdotal warning about the difficulty in) s
5 613 M
( properly implementing pseudo-random number generating functions.) s
5 591 M
( The amount of entropy available to a given client or server may) s
5 580 M
( sometimes be less than what is required. In this case one must) s
5 569 M
( either resort to pseudo-random number generation regardless of) s
5 558 M
( insufficient entropy or refuse to run the protocol. The latter is) s
5 547 M
( preferable.) s
5 525 M
(9.2 Transport) s
5 503 M
(9.2.1 Confidentiality) s
5 481 M
( It is beyond the scope of this document and the Secure Shell Working) s
5 470 M
( Group to analyze or recommend specific ciphers other than the ones) s
5 459 M
( which have been established and accepted within the industry. At the) s
5 448 M
( time of this writing, ciphers commonly in use include 3DES, ARCFOUR,) s
5 437 M
( twofish, serpent and blowfish. AES has been accepted by The) s
5 426 M
( published as a US Federal Information Processing Standards [FIPS-197]) s
5 415 M
( and the cryptographic community as being acceptable for this purpose) s
5 404 M
( as well has accepted AES. As always, implementors and users should) s
5 393 M
( check current literature to ensure that no recent vulnerabilities) s
5 382 M
( have been found in ciphers used within products. Implementors should) s
5 371 M
( also check to see which ciphers are considered to be relatively) s
5 360 M
( stronger than others and should recommend their use to users over) s
5 349 M
( relatively weaker ciphers. It would be considered good form for an) s
5 338 M
( implementation to politely and unobtrusively notify a user that a) s
5 327 M
( stronger cipher is available and should be used when a weaker one is) s
5 316 M
( actively chosen.) s
5 294 M
( The "none" cipher is provided for debugging and SHOULD NOT be used) s
5 283 M
( except for that purpose. It's cryptographic properties are) s
5 272 M
( sufficiently described in RFC 2410, which will show that its use does) s
5 261 M
( not meet the intent of this protocol.) s
5 239 M
( The relative merits of these and other ciphers may also be found in) s
5 228 M
( current literature. Two references that may provide information on) s
5 217 M
( the subject are [SCHNEIER] and [KAUFMAN,PERLMAN,SPECINER]. Both of) s
5 206 M
( these describe the CBC mode of operation of certain ciphers and the) s
5 195 M
( weakness of this scheme. Essentially, this mode is theoretically) s
5 184 M
( vulnerable to chosen cipher-text attacks because of the high) s
5 173 M
( predictability of the start of packet sequence. However, this attack) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 13]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 14 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( is still deemed difficult and not considered fully practicable) s
5 679 M
( especially if relatively longer block sizes are used.) s
5 657 M
( Additionally, another CBC mode attack may be mitigated through the) s
5 646 M
( insertion of packets containing SSH_MSG_IGNORE. Without this) s
5 635 M
( technique, a specific attack may be successful. For this attack) s
5 624 M
( \(commonly known as the Rogaway attack) s
5 613 M
( [ROGAWAY],[DAI],[BELLARE,KOHNO,NAMPREMPRE]\) to work, the attacker) s
5 602 M
( would need to know the IV of the next block that is going to be) s
5 591 M
( encrypted. In CBC mode that is the output of the encryption of the) s
5 580 M
( previous block. If the attacker does not have any way to see the) s
5 569 M
( packet yet \(i.e it is in the internal buffers of the ssh) s
5 558 M
( implementation or even in the kernel\) then this attack will not work.) s
5 547 M
( If the last packet has been sent out to the network \(i.e the attacker) s
5 536 M
( has access to it\) then he can use the attack.) s
5 514 M
( In the optimal case an implementor would need to add an extra packet) s
5 503 M
( only if the packet has been sent out onto the network and there are) s
5 492 M
( no other packets waiting for transmission. Implementors may wish to) s
5 481 M
( check to see if there are any unsent packets awaiting transmission,) s
5 470 M
( but unfortunately it is not normally easy to obtain this information) s
5 459 M
( from the kernel or buffers. If there are not, then a packet) s
5 448 M
( containing SSH_MSG_IGNORE SHOULD be sent. If a new packet is added) s
5 437 M
( to the stream every time the attacker knows the IV that is supposed) s
5 426 M
( to be used for the next packet, then the attacker will not be able to) s
5 415 M
( guess the correct IV, thus the attack will never be successfull.) s
5 393 M
( As an example, consider the following case:) s
5 360 M
( Client Server) s
5 349 M
( ------ ------) s
5 338 M
( TCP\(seq=x, len=500\) ->) s
5 327 M
( contains Record 1) s
5 305 M
( [500 ms passes, no ACK]) s
5 283 M
( TCP\(seq=x, len=1000\) ->) s
5 272 M
( contains Records 1,2) s
5 250 M
( ACK) s
5 217 M
( 1. The Nagle algorithm + TCP retransmits mean that the two records) s
5 206 M
( get coalesced into a single TCP segment) s
5 195 M
( 2. Record 2 is *not* at the beginning of the TCP segment and never) s
5 184 M
( will be, since it gets ACKed.) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 14]) s
_R
S
PStoPSsaved restore
%%Page: (14,15) 8
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 15 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( 3. Yet, the attack is possible because Record 1 has already been) s
5 679 M
( seen.) s
5 657 M
( As this example indicates, it's totally unsafe to use the existence) s
5 646 M
( of unflushed data in the TCP buffers proper as a guide to whether you) s
5 635 M
( need an empty packet, since when you do the second write\(\), the) s
5 624 M
( buffers will contain the un-ACKed Record 1.) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 15]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 16 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( On the other hand, it's perfectly safe to have the following) s
5 679 M
( situation:) s
5 646 M
( Client Server) s
5 635 M
( ------ ------) s
5 624 M
( TCP\(seq=x, len=500\) ->) s
5 613 M
( contains SSH_MSG_IGNORE) s
5 591 M
( TCP\(seq=y, len=500\) ->) s
5 580 M
( contains Data) s
5 558 M
( Provided that the IV for second SSH Record is fixed after the data for) s
5 547 M
( the Data packet is determined -i.e. you do:) s
5 536 M
( read from user) s
5 525 M
( encrypt null packet) s
5 514 M
( encrypt data packet) s
5 481 M
(9.2.2 Data Integrity) s
5 459 M
( This protocol does allow the Data Integrity mechanism to be disabled.) s
5 448 M
( Implementors SHOULD be wary of exposing this feature for any purpose) s
5 437 M
( other than debugging. Users and administrators SHOULD be explicitly) s
5 426 M
( warned anytime the "none" MAC is enabled.) s
5 404 M
( So long as the "none" MAC is not used, this protocol provides data) s
5 393 M
( integrity.) s
5 371 M
( Because MACs use a 32 bit sequence number, they might start to leak) s
5 360 M
( information after 2**32 packets have been sent. However, following) s
5 349 M
( the rekeying recommendations should prevent this attack. The) s
5 338 M
( transport protocol [1] recommends rekeying after one gigabyte of) s
5 327 M
( data, and the smallest possible packet is 16 bytes. Therefore,) s
5 316 M
( rekeying SHOULD happen after 2**28 packets at the very most.) s
5 294 M
(9.2.3 Replay) s
5 272 M
( The use of a MAC other than 'none' provides integrity and) s
5 261 M
( authentication. In addition, the transport protocol provides a) s
5 250 M
( unique session identifier \(bound in part to pseudo-random data that) s
5 239 M
( is part of the algorithm and key exchange process\) that can be used) s
5 228 M
( by higher level protocols to bind data to a given session and prevent) s
5 217 M
( replay of data from prior sessions. For example, the authentication) s
5 206 M
( protocol uses this to prevent replay of signatures from previous) s
5 195 M
( sessions. Because public key authentication exchanges are) s
5 184 M
( cryptographically bound to the session \(i.e., to the initial key) s
5 173 M
( exchange\) they cannot be successfully replayed in other sessions.) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 16]) s
_R
S
PStoPSsaved restore
%%Page: (16,17) 9
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 17 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( Note that the session ID can be made public without harming the) s
5 679 M
( security of the protocol.) s
5 657 M
( If two session happen to have the same session ID [hash of key) s
5 646 M
( exchanges] then packets from one can be replayed against the other.) s
5 635 M
( It must be stressed that the chances of such an occurrence are,) s
5 624 M
( needless to say, minimal when using modern cryptographic methods.) s
5 613 M
( This is all the more so true when specifying larger hash function) s
5 602 M
( outputs and DH parameters.) s
5 580 M
( Replay detection using monotonically increasing sequence numbers as) s
5 569 M
( input to the MAC, or HMAC in some cases, is described in [RFC2085] />) s
5 558 M
( [RFC2246], [RFC2743], [RFC1964], [RFC2025], and [RFC1510]. The) s
5 547 M
( underlying construct is discussed in [RFC2104]. Essentially a) s
5 536 M
( different sequence number in each packet ensures that at least this) s
5 525 M
( one input to the MAC function will be unique and will provide a) s
5 514 M
( nonrecurring MAC output that is not predictable to an attacker. If) s
5 503 M
( the session stays active long enough, however, this sequence number) s
5 492 M
( will wrap. This event may provide an attacker an opportunity to) s
5 481 M
( replay a previously recorded packet with an identical sequence number) s
5 470 M
( but only if the peers have not rekeyed since the transmission of the) s
5 459 M
( first packet with that sequence number. If the peers have rekeyed,) s
5 448 M
( then the replay will be detected as the MAC check will fail. For) s
5 437 M
( this reason, it must be emphasized that peers MUST rekey before a) s
5 426 M
( wrap of the sequence numbers. Naturally, if an attacker does attempt) s
5 415 M
( to replay a captured packet before the peers have rekeyed, then the) s
5 404 M
( receiver of the duplicate packet will not be able to validate the MAC) s
5 393 M
( and it will be discarded. The reason that the MAC will fail is) s
5 382 M
( because the receiver will formulate a MAC based upon the packet) s
5 371 M
( contents, the shared secret, and the expected sequence number. Since) s
5 360 M
( the replayed packet will not be using that expected sequence number) s
5 349 M
( \(the sequence number of the replayed packet will have already been) s
5 338 M
( passed by the receiver\) then the calculated MAC will not match the) s
5 327 M
( MAC received with the packet.) s
5 305 M
(9.2.4 Man-in-the-middle) s
5 283 M
( This protocol makes no assumptions nor provisions for an) s
5 272 M
( infrastructure or means for distributing the public keys of hosts. It) s
5 261 M
( is expected that this protocol will sometimes be used without first) s
5 250 M
( verifying the association between the server host key and the server) s
5 239 M
( host name. Such usage is vulnerable to man-in-the-middle attacks.) s
5 228 M
( This section describes this and encourages administrators and users) s
5 217 M
( to understand the importance of verifying this association before any) s
5 206 M
( session is initiated.) s
5 184 M
( There are three cases of man-in-the-middle attacks to consider. The) s
5 173 M
( first is where an attacker places a device between the client and the) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 17]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 18 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( server before the session is initiated. In this case, the attack) s
5 679 M
( device is trying to mimic the legitimate server and will offer its) s
5 668 M
( public key to the client when the client initiates a session. If it) s
5 657 M
( were to offer the public key of the server, then it would not be able) s
5 646 M
( to decrypt or sign the transmissions between the legitimate server) s
5 635 M
( and the client unless it also had access to the private-key of the) s
5 624 M
( host. The attack device will also, simultaneously to this, initiate) s
5 613 M
( a session to the legitimate server masquerading itself as the client.) s
5 602 M
( If the public key of the server had been securely distributed to the) s
5 591 M
( client prior to that session initiation, the key offered to the) s
5 580 M
( client by the attack device will not match the key stored on the) s
5 569 M
( client. In that case, the user SHOULD be given a warning that the) s
5 558 M
( offered host key does not match the host key cached on the client.) s
5 547 M
( As described in Section 3.1 of [ARCH], the user may be free to accept) s
5 536 M
( the new key and continue the session. It is RECOMMENDED that the) s
5 525 M
( warning provide sufficient information to the user of the client) s
5 514 M
( device so they may make an informed decision. If the user chooses to) s
5 503 M
( continue the session with the stored public-key of the server \(not) s
5 492 M
( the public-key offered at the start of the session\), then the session) s
5 481 M
( specific data between the attacker and server will be different) s
5 470 M
( between the client-to-attacker session and the attacker-to-server) s
5 459 M
( sessions due to the randomness discussed above. From this, the) s
5 448 M
( attacker will not be able to make this attack work since the attacker) s
5 437 M
( will not be able to correctly sign packets containing this session) s
5 426 M
( specific data from the server since he does not have the private key) s
5 415 M
( of that server.) s
5 393 M
( The second case that should be considered is similar to the first) s
5 382 M
( case in that it also happens at the time of connection but this case) s
5 371 M
( points out the need for the secure distribution of server public) s
5 360 M
( keys. If the server public keys are not securely distributed then) s
5 349 M
( the client cannot know if it is talking to the intended server. An) s
5 338 M
( attacker may use social engineering techniques to pass off server) s
5 327 M
( keys to unsuspecting users and may then place a man-in-the-middle) s
5 316 M
( attack device between the legitimate server and the clients. If this) s
5 305 M
( is allowed to happen then the clients will form client-to-attacker) s
5 294 M
( sessions and the attacker will form attacker-to-server sessions and) s
5 283 M
( will be able to monitor and manipulate all of the traffic between the) s
5 272 M
( clients and the legitimate servers. Server administrators are) s
5 261 M
( encouraged to make host key fingerprints available for checking by) s
5 250 M
( some means whose security does not rely on the integrity of the) s
5 239 M
( actual host keys. Possible mechanisms are discussed in Section 3.1) s
5 228 M
( of [SSH-ARCH] and may also include secured Web pages, physical pieces) s
5 217 M
( of paper, etc. Implementors SHOULD provide recommendations on how) s
5 206 M
( best to do this with their implementation. Because the protocol is) s
5 195 M
( extensible, future extensions to the protocol may provide better) s
5 184 M
( mechanisms for dealing with the need to know the server's host key) s
5 173 M
( before connecting. For example, making the host key fingerprint) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 18]) s
_R
S
PStoPSsaved restore
%%Page: (18,19) 10
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 19 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( available through a secure DNS lookup, or using kerberos over gssapi) s
5 679 M
( during key exchange to authenticate the server are possibilities.) s
5 657 M
( In the third man-in-the-middle case, attackers may attempt to) s
5 646 M
( manipulate packets in transit between peers after the session has) s
5 635 M
( been established. As described in the Replay part of this section, a) s
5 624 M
( successful attack of this nature is very improbable. As in the) s
5 613 M
( Replay section, this reasoning does assume that the MAC is secure and) s
5 602 M
( that it is infeasible to construct inputs to a MAC algorithm to give) s
5 591 M
( a known output. This is discussed in much greater detail in Section) s
5 580 M
( 6 of RFC 2104. If the MAC algorithm has a vulnerability or is weak) s
5 569 M
( enough, then the attacker may be able to specify certain inputs to) s
5 558 M
( yield a known MAC. With that they may be able to alter the contents) s
5 547 M
( of a packet in transit. Alternatively the attacker may be able to) s
5 536 M
( exploit the algorithm vulnerability or weakness to find the shared) s
5 525 M
( secret by reviewing the MACs from captured packets. In either of) s
5 514 M
( those cases, an attacker could construct a packet or packets that) s
5 503 M
( could be inserted into an SSH stream. To prevent that, implementors) s
5 492 M
( are encouraged to utilize commonly accepted MAC algorithms and) s
5 481 M
( administrators are encouraged to watch current literature and) s
5 470 M
( discussions of cryptography to ensure that they are not using a MAC) s
5 459 M
( algorithm that has a recently found vulnerability or weakness.) s
5 437 M
( In summary, the use of this protocol without a reliable association) s
5 426 M
( of the binding between a host and its host keys is inherently) s
5 415 M
( insecure and is NOT RECOMMENDED. It may however be necessary in) s
5 404 M
( non-security critical environments, and will still provide protection) s
5 393 M
( against passive attacks. Implementors of protocols and applications) s
5 382 M
( running on top of this protocol should keep this possibility in mind.) s
5 360 M
(9.2.5 Denial-of-service) s
5 338 M
( This protocol is designed to be used over a reliable transport. If) s
5 327 M
( transmission errors or message manipulation occur, the connection is) s
5 316 M
( closed. The connection SHOULD be re-established if this occurs.) s
5 305 M
( Denial of service attacks of this type \("wire cutter"\) are almost) s
5 294 M
( impossible to avoid.) s
5 272 M
( In addition, this protocol is vulnerable to Denial of Service attacks) s
5 261 M
( because an attacker can force the server to go through the CPU and) s
5 250 M
( memory intensive tasks of connection setup and key exchange without) s
5 239 M
( authenticating. Implementors SHOULD provide features that make this) s
5 228 M
( more difficult. For example, only allowing connections from a subset) s
5 217 M
( of IPs known to have valid users.) s
5 195 M
(9.2.6 Covert Channels) s
5 173 M
( The protocol was not designed to eliminate covert channels. For) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 19]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 20 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( example, the padding, SSH_MSG_IGNORE messages, and several other) s
5 679 M
( places in the protocol can be used to pass covert information, and) s
5 668 M
( the recipient has no reliable way to verify whether such information) s
5 657 M
( is being sent.) s
5 635 M
(9.2.7 Forward Secrecy) s
5 613 M
( It should be noted that the Diffie-Hellman key exchanges may provide) s
5 602 M
( perfect forward secrecy \(PFS\). PFS is essentially defined as the) s
5 591 M
( cryptographic property of a key-establishment protocol in which the) s
5 580 M
( compromise of a session key or long-term private key after a given) s
5 569 M
( session does not cause the compromise of any earlier session. [ANSI) s
5 558 M
( T1.523-2001] SSHv2 sessions resulting from a key exchange using) s
5 547 M
( diffie-hellman-group1-sha1 are secure even if private keying/) s
5 536 M
( authentication material is later revealed, but not if the session) s
5 525 M
( keys are revealed. So, given this definition of PFS, SSHv2 does have) s
5 514 M
( PFS. It is hoped that all other key exchange mechanisms proposed and) s
5 503 M
( used in the future will also provide PFS. This property is not) s
5 492 M
( commuted to any of the applications or protocols using SSH as a) s
5 481 M
( transport however. The transport layer of SSH provides) s
5 470 M
( confidentiality for password authentication and other methods that) s
5 459 M
( rely on secret data.) s
5 437 M
( Of course, if the DH private parameters for the client and server are) s
5 426 M
( revealed then the session key is revealed, but these items can be) s
5 415 M
( thrown away after the key exchange completes. It's worth pointing) s
5 404 M
( out that these items should not be allowed to end up on swap space) s
5 393 M
( and that they should be erased from memory as soon as the key) s
5 382 M
( exchange completes.) s
5 360 M
(9.3 Authentication Protocol) s
5 338 M
( The purpose of this protocol is to perform client user) s
5 327 M
( authentication. It assumes that this run over a secure transport) s
5 316 M
( layer protocol, which has already authenticated the server machine,) s
5 305 M
( established an encrypted communications channel, and computed a) s
5 294 M
( unique session identifier for this session.) s
5 272 M
( Several authentication methods with different security) s
5 261 M
( characteristics are allowed. It is up to the server's local policy) s
5 250 M
( to decide which methods \(or combinations of methods\) it is willing to) s
5 239 M
( accept for each user. Authentication is no stronger than the weakest) s
5 228 M
( combination allowed.) s
5 206 M
( The server may go into a "sleep" period after repeated unsuccessful) s
5 195 M
( authentication attempts to make key search more difficult for) s
5 184 M
( attackers. Care should be taken so that this doesn't become a) s
5 173 M
( self-denial of service vector.) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 20]) s
_R
S
PStoPSsaved restore
%%Page: (20,21) 11
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 21 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
(9.3.1 Weak Transport) s
5 668 M
( If the transport layer does not provide confidentiality,) s
5 657 M
( authentication methods that rely on secret data SHOULD be disabled.) s
5 646 M
( If it does not provide strong integrity protection, requests to) s
5 635 M
( change authentication data \(e.g. a password change\) SHOULD be) s
5 624 M
( disabled to prevent an attacker from modifying the ciphertext) s
5 613 M
( without being noticed, or rendering the new authentication data) s
5 602 M
( unusable \(denial of service\).) s
5 580 M
( The assumption as stated above that the Authentication Protocol only) s
5 569 M
( run over a secure transport that has previously authenticated the) s
5 558 M
( server is very important to note. People deploying SSH are reminded) s
5 547 M
( of the consequences of man-in-the-middle attacks if the client does) s
5 536 M
( not have a very strong a priori association of the server with the) s
5 525 M
( host key of that server. Specifically for the case of the) s
5 514 M
( Authentication Protocol the client may form a session to a) s
5 503 M
( man-in-the-middle attack device and divulge user credentials such as) s
5 492 M
( their username and password. Even in the cases of authentication) s
5 481 M
( where no user credentials are divulged, an attacker may still gain) s
5 470 M
( information they shouldn't have by capturing key-strokes in much the) s
5 459 M
( same way that a honeypot works.) s
5 437 M
(9.3.2 Debug messages) s
5 415 M
( Special care should be taken when designing debug messages. These) s
5 404 M
( messages may reveal surprising amounts of information about the host) s
5 393 M
( if not properly designed. Debug messages can be disabled \(during) s
5 382 M
( user authentication phase\) if high security is required.) s
5 371 M
( Administrators of host machines should make all attempts to) s
5 360 M
( compartmentalize all event notification messages and protect them) s
5 349 M
( from unwarranted observation. Developers should be aware of the) s
5 338 M
( sensitive nature of some of the normal event messages and debug) s
5 327 M
( messages and may want to provide guidance to administrators on ways) s
5 316 M
( to keep this information away from unauthorized people. Developers) s
5 305 M
( should consider minimizing the amount of sensitive information) s
5 294 M
( obtainable by users during the authentication phase in accordance) s
5 283 M
( with the local policies. For this reason, it is RECOMMENDED that) s
5 272 M
( debug messages be initially disabled at the time of deployment and) s
5 261 M
( require an active decision by an administrator to allow them to be) s
5 250 M
( enabled. It is also RECOMMENDED that a message expressing this) s
5 239 M
( concern be presented to the administrator of a system when the action) s
5 228 M
( is taken to enable debugging messages.) s
5 206 M
(9.3.3 Local security policy) s
5 184 M
( Implementer MUST ensure that the credentials provided validate the) s
5 173 M
( professed user and also MUST ensure that the local policy of the) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 21]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 22 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( server permits the user the access requested. In particular, because) s
5 679 M
( of the flexible nature of the SSH connection protocol, it may not be) s
5 668 M
( possible to determine the local security policy, if any, that should) s
5 657 M
( apply at the time of authentication because the kind of service being) s
5 646 M
( requested is not clear at that instant. For example, local policy) s
5 635 M
( might allow a user to access files on the server, but not start an) s
5 624 M
( interactive shell. However, during the authentication protocol, it is) s
5 613 M
( not known whether the user will be accessing files or attempting to) s
5 602 M
( use an interactive shell, or even both. In any event, where local) s
5 591 M
( security policy for the server host exists, it MUST be applied and) s
5 580 M
( enforced correctly.) s
5 558 M
( Implementors are encouraged to provide a default local policy and) s
5 547 M
( make its parameters known to administrators and users. At the) s
5 536 M
( discretion of the implementors, this default policy may be along the) s
5 525 M
( lines of 'anything goes' where there are no restrictions placed upon) s
5 514 M
( users, or it may be along the lines of 'excessively restrictive' in) s
5 503 M
( which case the administrators will have to actively make changes to) s
5 492 M
( this policy to meet their needs. Alternatively, it may be some) s
5 481 M
( attempt at providing something practical and immediately useful to) s
5 470 M
( the administrators of the system so they don't have to put in much) s
5 459 M
( effort to get SSH working. Whatever choice is made MUST be applied) s
5 448 M
( and enforced as required above.) s
5 426 M
(9.3.4 Public key authentication) s
5 404 M
( The use of public-key authentication assumes that the client host has) s
5 393 M
( not been compromised. It also assumes that the private-key of the) s
5 382 M
( server host has not been compromised.) s
5 360 M
( This risk can be mitigated by the use of passphrases on private keys;) s
5 349 M
( however, this is not an enforceable policy. The use of smartcards,) s
5 338 M
( or other technology to make passphrases an enforceable policy is) s
5 327 M
( suggested.) s
5 305 M
( The server could require both password and public-key authentication,) s
5 294 M
( however, this requires the client to expose its password to the) s
5 283 M
( server \(see section on password authentication below.\)) s
5 261 M
(9.3.5 Password authentication) s
5 239 M
( The password mechanism as specified in the authentication protocol) s
5 228 M
( assumes that the server has not been compromised. If the server has) s
5 217 M
( been compromised, using password authentication will reveal a valid) s
5 206 M
( username / password combination to the attacker, which may lead to) s
5 195 M
( further compromises.) s
5 173 M
( This vulnerability can be mitigated by using an alternative form of) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 22]) s
_R
S
PStoPSsaved restore
%%Page: (22,23) 12
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 23 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( authentication. For example, public-key authentication makes no) s
5 679 M
( assumptions about security on the server.) s
5 657 M
(9.3.6 Host based authentication) s
5 635 M
( Host based authentication assumes that the client has not been) s
5 624 M
( compromised. There are no mitigating strategies, other than to use) s
5 613 M
( host based authentication in combination with another authentication) s
5 602 M
( method.) s
5 580 M
(9.4 Connection protocol) s
5 558 M
(9.4.1 End point security) s
5 536 M
( End point security is assumed by the connection protocol. If the) s
5 525 M
( server has been compromised, any terminal sessions, port forwarding,) s
5 514 M
( or systems accessed on the host are compromised. There are no) s
5 503 M
( mitigating factors for this.) s
5 481 M
( If the client end point has been compromised, and the server fails to) s
5 470 M
( stop the attacker at the authentication protocol, all services) s
5 459 M
( exposed \(either as subsystems or through forwarding\) will be) s
5 448 M
( vulnerable to attack. Implementors SHOULD provide mechanisms for) s
5 437 M
( administrators to control which services are exposed to limit the) s
5 426 M
( vulnerability of other services.) s
5 404 M
( These controls might include controlling which machines and ports can) s
5 393 M
( be target in 'port-forwarding' operations, which users are allowed to) s
5 382 M
( use interactive shell facilities, or which users are allowed to use) s
5 371 M
( exposed subsystems.) s
5 349 M
(9.4.2 Proxy forwarding) s
5 327 M
( The SSH connection protocol allows for proxy forwarding of other) s
5 316 M
( protocols such as SNMP, POP3, and HTTP. This may be a concern for) s
5 305 M
( network administrators who wish to control the access of certain) s
5 294 M
( applications by users located outside of their physical location.) s
5 283 M
( Essentially, the forwarding of these protocols may violate site) s
5 272 M
( specific security policies as they may be undetectably tunneled) s
5 261 M
( through a firewall. Implementors SHOULD provide an administrative) s
5 250 M
( mechanism to control the proxy forwarding functionality so that site) s
5 239 M
( specific security policies may be upheld.) s
5 217 M
( In addition, a reverse proxy forwarding functionality is available,) s
5 206 M
( which again can be used to bypass firewall controls.) s
5 184 M
( As indicated above, end-point security is assumed during proxy) s
5 173 M
( forwarding operations. Failure of end-point security will compromise) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 23]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 24 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( all data passed over proxy forwarding.) s
5 668 M
(9.4.3 X11 forwarding) s
5 646 M
( Another form of proxy forwarding provided by the ssh connection) s
5 635 M
( protocol is the forwarding of the X11 protocol. If end-point) s
5 624 M
( security has been compromised, X11 forwarding may allow attacks) s
5 613 M
( against the X11 server. Users and administrators should, as a matter) s
5 602 M
( of course, use appropriate X11 security mechanisms to prevent) s
5 591 M
( unauthorized use of the X11 server. Implementors, administrators and) s
5 580 M
( users who wish to further explore the security mechanisms of X11 are) s
5 569 M
( invited to read [SCHEIFLER] and analyze previously reported problems) s
5 558 M
( with the interactions between SSH forwarding and X11 in CERT) s
5 547 M
( vulnerabilities VU#363181 and VU#118892 [CERT].) s
5 525 M
( X11 display forwarding with SSH, by itself, is not sufficient to) s
5 514 M
( correct well known problems with X11 security [VENEMA]. However, X11) s
5 503 M
( display forwarding in SSHv2 \(or other, secure protocols\), combined) s
5 492 M
( with actual and pseudo-displays which accept connections only over) s
5 481 M
( local IPC mechanisms authorized by permissions or ACLs, does correct) s
5 470 M
( many X11 security problems as long as the "none" MAC is not used. It) s
5 459 M
( is RECOMMENDED that X11 display implementations default to allowing) s
5 448 M
( display opens only over local IPC. It is RECOMMENDED that SSHv2) s
5 437 M
( server implementations that support X11 forwarding default to) s
5 426 M
( allowing display opens only over local IPC. On single-user systems) s
5 415 M
( it might be reasonable to default to allowing local display opens) s
5 404 M
( over TCP/IP.) s
5 382 M
( Implementors of the X11 forwarding protocol SHOULD implement the) s
5 371 M
( magic cookie access checking spoofing mechanism as described in) s
5 360 M
( [ssh-connect] as an additional mechanism to prevent unauthorized use) s
5 349 M
( of the proxy.) s
5 327 M
(Normative References) s
5 305 M
( [SSH-ARCH]) s
5 294 M
( Ylonen, T., "SSH Protocol Architecture", I-D) s
5 283 M
( draft-ietf-architecture-15.txt, Oct 2003.) s
5 261 M
( [SSH-TRANS]) s
5 250 M
( Ylonen, T., "SSH Transport Layer Protocol", I-D) s
5 239 M
( draft-ietf-transport-17.txt, Oct 2003.) s
5 217 M
( [SSH-USERAUTH]) s
5 206 M
( Ylonen, T., "SSH Authentication Protocol", I-D) s
5 195 M
( draft-ietf-userauth-18.txt, Oct 2003.) s
5 173 M
( [SSH-CONNECT]) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 24]) s
_R
S
PStoPSsaved restore
%%Page: (24,25) 13
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 25 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( Ylonen, T., "SSH Connection Protocol", I-D) s
5 679 M
( draft-ietf-connect-18.txt, Oct 2003.) s
5 657 M
( [SSH-NUMBERS]) s
5 646 M
( Lehtinen, S. and D. Moffat, "SSH Protocol Assigned) s
5 635 M
( Numbers", I-D draft-ietf-secsh-assignednumbers-05.txt, Oct) s
5 624 M
( 2003.) s
5 602 M
( [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate) s
5 591 M
( Requirement Levels", BCP 14, RFC 2119, March 1997.) s
5 569 M
(Informative References) s
5 547 M
( [FIPS-186]) s
5 536 M
( Federal Information Processing Standards Publication,) s
5 525 M
( "FIPS PUB 186, Digital Signature Standard", May 1994.) s
5 503 M
( [FIPS-197]) s
5 492 M
( National Institue of Standards and Technology, "FIPS 197,) s
5 481 M
( Specification for the Advanced Encryption Standard",) s
5 470 M
( November 2001.) s
5 448 M
( [ANSI T1.523-2001]) s
5 437 M
( American National Standards Insitute, Inc., "Telecom) s
5 426 M
( Glossary 2000", February 2001.) s
5 404 M
( [SCHEIFLER]) s
5 393 M
( Scheifler, R., "X Window System : The Complete Reference) s
5 382 M
( to Xlib, X Protocol, Icccm, Xlfd, 3rd edition.", Digital) s
5 371 M
( Press ISBN 1555580882, Feburary 1992.) s
5 349 M
( [RFC0854] Postel, J. and J. Reynolds, "Telnet Protocol) s
5 338 M
( Specification", STD 8, RFC 854, May 1983.) s
5 316 M
( [RFC0894] Hornig, C., "Standard for the transmission of IP datagrams) s
5 305 M
( over Ethernet networks", STD 41, RFC 894, April 1984.) s
5 283 M
( [RFC1034] Mockapetris, P., "Domain names - concepts and facilities",) s
5 272 M
( STD 13, RFC 1034, November 1987.) s
5 250 M
( [RFC1134] Perkins, D., "Point-to-Point Protocol: A proposal for) s
5 239 M
( multi-protocol transmission of datagrams over) s
5 228 M
( Point-to-Point links", RFC 1134, November 1989.) s
5 206 M
( [RFC1282] Kantor, B., "BSD Rlogin", RFC 1282, December 1991.) s
5 184 M
( [RFC1510] Kohl, J. and B. Neuman, "The Kerberos Network) s
5 173 M
( Authentication Service \(V5\)", RFC 1510, September 1993.) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 25]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 26 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( [RFC1700] Reynolds, J. and J. Postel, "Assigned Numbers", RFC 1700,) s
5 679 M
( October 1994.) s
5 657 M
( [RFC1750] Eastlake, D., Crocker, S. and J. Schiller, "Randomness) s
5 646 M
( Recommendations for Security", RFC 1750, December 1994.) s
5 624 M
( [RFC3066] Alvestrand, H., "Tags for the Identification of) s
5 613 M
( Languages", BCP 47, RFC 3066, January 2001.) s
5 591 M
( [RFC1964] Linn, J., "The Kerberos Version 5 GSS-API Mechanism", RFC) s
5 580 M
( 1964, June 1996.) s
5 558 M
( [RFC2025] Adams, C., "The Simple Public-Key GSS-API Mechanism) s
5 547 M
( \(SPKM\)", RFC 2025, October 1996.) s
5 525 M
( [RFC2085] Oehler, M. and R. Glenn, "HMAC-MD5 IP Authentication with) s
5 514 M
( Replay Prevention", RFC 2085, February 1997.) s
5 492 M
( [RFC2104] Krawczyk, H., Bellare, M. and R. Canetti, "HMAC:) s
5 481 M
( Keyed-Hashing for Message Authentication", RFC 2104,) s
5 470 M
( February 1997.) s
5 448 M
( [RFC2246] Dierks, T., Allen, C., Treese, W., Karlton, P., Freier, A.) s
5 437 M
( and P. Kocher, "The TLS Protocol Version 1.0", RFC 2246,) s
5 426 M
( January 1999.) s
5 404 M
( [RFC2279] Yergeau, F., "UTF-8, a transformation format of ISO) s
5 393 M
( 10646", RFC 2279, January 1998.) s
5 371 M
( [RFC2410] Glenn, R. and S. Kent, "The NULL Encryption Algorithm and) s
5 360 M
( Its Use With IPsec", RFC 2410, November 1998.) s
5 338 M
( [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an) s
5 327 M
( IANA Considerations Section in RFCs", BCP 26, RFC 2434,) s
5 316 M
( October 1998.) s
5 294 M
( [RFC2743] Linn, J., "Generic Security Service Application Program) s
5 283 M
( Interface Version 2, Update 1", RFC 2743, January 2000.) s
5 261 M
( [SCHNEIER]) s
5 250 M
( Schneier, B., "Applied Cryptography Second Edition:) s
5 239 M
( protocols algorithms and source in code in C", 1996.) s
5 217 M
( [KAUFMAN,PERLMAN,SPECINER]) s
5 206 M
( Kaufman, C., Perlman, R. and M. Speciner, "Network) s
5 195 M
( Security: PRIVATE Communication in a PUBLIC World", 1995.) s
5 173 M
( [CERT] CERT Coordination Center, The., "http://www.cert.org/nav/) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 26]) s
_R
S
PStoPSsaved restore
%%Page: (26,27) 14
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 27 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( index_red.html".) s
5 668 M
( [VENEMA] Venema, W., "Murphy's Law and Computer Security",) s
5 657 M
( Proceedings of 6th USENIX Security Symposium, San Jose CA) s
5 646 M
( http://www.usenix.org/publications/library/proceedings/) s
5 635 M
( sec96/venema.html, July 1996.) s
5 613 M
( [ROGAWAY] Rogaway, P., "Problems with Proposed IP Cryptography",) s
5 602 M
( Unpublished paper http://www.cs.ucdavis.edu/~rogaway/) s
5 591 M
( papers/draft-rogaway-ipsec-comments-00.txt, 1996.) s
5 569 M
( [DAI] Dai, W., "An attack against SSH2 protocol", Email to the) s
5 558 M
( SECSH Working Group [email protected] ftp://) s
5 547 M
( ftp.ietf.org/ietf-mail-archive/secsh/2002-02.mail, Feb) s
5 536 M
( 2002.) s
5 514 M
( [BELLARE,KOHNO,NAMPREMPRE]) s
5 503 M
( Bellaire, M., Kohno, T. and C. Namprempre, "Authenticated) s
5 492 M
( Encryption in SSH: Fixing the SSH Binary Packet Protocol",) s
5 481 M
( , Sept 2002.) s
5 448 M
(Authors' Addresses) s
5 426 M
( Tatu Ylonen) s
5 415 M
( SSH Communications Security Corp) s
5 404 M
( Fredrikinkatu 42) s
5 393 M
( HELSINKI FIN-00100) s
5 382 M
( Finland) s
5 360 M
( EMail: [email protected]) s
5 327 M
( Darren J. Moffat \(editor\)) s
5 316 M
( Sun Microsystems, Inc) s
5 305 M
( 17 Network Circle) s
5 294 M
( Menlo Park CA 94025) s
5 283 M
( USA) s
5 261 M
( EMail: [email protected]) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 27]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 28 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
(Intellectual Property Statement) s
5 668 M
( The IETF takes no position regarding the validity or scope of any) s
5 657 M
( intellectual property or other rights that might be claimed to) s
5 646 M
( pertain to the implementation or use of the technology described in) s
5 635 M
( this document or the extent to which any license under such rights) s
5 624 M
( might or might not be available; neither does it represent that it) s
5 613 M
( has made any effort to identify any such rights. Information on the) s
5 602 M
( IETF's procedures with respect to rights in standards-track and) s
5 591 M
( standards-related documentation can be found in BCP-11. Copies of) s
5 580 M
( claims of rights made available for publication and any assurances of) s
5 569 M
( licenses to be made available, or the result of an attempt made to) s
5 558 M
( obtain a general license or permission for the use of such) s
5 547 M
( proprietary rights by implementors or users of this specification can) s
5 536 M
( be obtained from the IETF Secretariat.) s
5 514 M
( The IETF invites any interested party to bring to its attention any) s
5 503 M
( copyrights, patents or patent applications, or other proprietary) s
5 492 M
( rights which may cover technology that may be required to practice) s
5 481 M
( this standard. Please address the information to the IETF Executive) s
5 470 M
( Director.) s
5 448 M
( The IETF has been notified of intellectual property rights claimed in) s
5 437 M
( regard to some or all of the specification contained in this) s
5 426 M
( document. For more information consult the online list of claimed) s
5 415 M
( rights.) s
5 382 M
(Full Copyright Statement) s
5 360 M
( Copyright \(C\) The Internet Society \(2003\). All Rights Reserved.) s
5 338 M
( This document and translations of it may be copied and furnished to) s
5 327 M
( others, and derivative works that comment on or otherwise explain it) s
5 316 M
( or assist in its implementation may be prepared, copied, published) s
5 305 M
( and distributed, in whole or in part, without restriction of any) s
5 294 M
( kind, provided that the above copyright notice and this paragraph are) s
5 283 M
( included on all such copies and derivative works. However, this) s
5 272 M
( document itself may not be modified in any way, such as by removing) s
5 261 M
( the copyright notice or references to the Internet Society or other) s
5 250 M
( Internet organizations, except as needed for the purpose of) s
5 239 M
( developing Internet standards in which case the procedures for) s
5 228 M
( copyrights defined in the Internet Standards process must be) s
5 217 M
( followed, or as required to translate it into languages other than) s
5 206 M
( English.) s
5 184 M
( The limited permissions granted above are perpetual and will not be) s
5 173 M
( revoked by the Internet Society or its successors or assignees.) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 28]) s
_R
S
PStoPSsaved restore
%%Page: (28,29) 15
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 0.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
/showpage{}def/copypage{}def/erasepage{}def
PStoPSxform concat
%%BeginPageSetup
_S
75 0 translate
/pagenum 29 def
/fname () def
/fdir () def
/ftail () def
/user_header_p false def
%%EndPageSetup
5 723 M
(Internet-Draft SSH Protocol Architecture Oct 2003) s
5 690 M
( This document and the information contained herein is provided on an) s
5 679 M
( "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING) s
5 668 M
( TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING) s
5 657 M
( BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION) s
5 646 M
( HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF) s
5 635 M
( MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.) s
5 602 M
(Acknowledgment) s
5 580 M
( Funding for the RFC Editor function is currently provided by the) s
5 569 M
( Internet Society.) s
5 129 M
(Ylonen & Moffat Expires March 31, 2004 [Page 29]) s
_R
S
PStoPSsaved restore
userdict/PStoPSsaved save put
PStoPSmatrix setmatrix
595.000000 421.271378 translate
90 rotate
0.706651 dup scale
userdict/PStoPSmatrix matrix currentmatrix put
userdict/PStoPSclip{0 0 moveto
595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto
closepath}put initclip
PStoPSxform concat
showpage
PStoPSsaved restore
%%Trailer
%%Pages: 29
%%DocumentNeededResources: font Courier-Bold Courier
%%EOF
