SSHM

Summary

The SSH Maintenance (SSHM) Working Group met at IETF 126 in Vienna. The session was chaired by Stephen Farrell and Job Snijders, with Rich Salz taking notes. The working group discussed the status of active documents, non-post-quantum (PQ) drafts, and upcoming post-quantum capabilities for the SSH protocol.

Significant progress was made on planning the transition to post-quantum signatures, evaluating the results of a recent hackathon, and deciding on adoption paths for several active and proposed drafts.

Key Discussion Points

1. Active Working Group Drafts

draft-ietf-sshm-chacha20-poly1305
- The draft was discussed in the context of dependencies on strict key exchange mechanisms to mitigate the Terrapin attack.
- Damien Miller noted that subsequent security research showed many other ciphers are vulnerable, indicating that strict checks are required globally and do not uniquely impede this draft.
- The chairs will suggest a minor wording tweak on the mailing list to clarify the strict key exchange reference before proceeding.
draft-ietf-sshm-hostkey-update
- Damien Miller noted that a new revision is needed due to expiration, which was delayed by the datatracker freeze.
- Rich Salz and Caspar Schutijser volunteered to review the upcoming refreshed version.
draft-ietf-sshm-cert
- Damien Miller requested additional reviews to build confidence before initiating a Working Group Last Call (WGLC).
- Sean Turner noted in the chat that the draft is helpful for demonstrating that SSH certificates are distinct from X.509 certificates.
- Bob Beck and Caspar Schutijser committed to reviewing the draft.

2. Non-PQ Drafts and Proposals

Pre-authentication Mechanism for SSH (Peter Goodman)
- This draft proposes a challenge-response mechanism prior to authentication to deter scanning robots.
- Bob Beck questioned if this was in-scope as it is new work rather than documenting existing deployment. Damien Miller noted that it would break at least one private SSH extension and suggested a backward-compatible alternative relaxing rules for pre-banner text. No immediate adoption was planned.
Fixed AES-GCM Modes for SSH (Damien Miller)
- This draft fixes a negotiation phase bug in RFC 5647 that can cause compliant peers to fail negotiation.
- Deb Cooley noted that referencing RFC 5647 (an Informational document) from a Proposed Standard draft will require a downref in the shepherd write-up.
- John Preuß Mattsson asked about compatibility with existing OpenSSH GCM implementations. Damien Miller confirmed this draft standardizes the widely deployed OpenSSH behavior.
- Decision: The chairs will initiate a call for adoption.
Lightweight Secure Shell Signature Formats (SSH SIG) (Simon Josefsson / Damien Miller)
- This proposal documents the existing format used for detached SSH signatures (e.g., in Git commit signing).
- Stephen Farrell raised whether detached signatures fell strictly within the WG charter. Rich Salz clarified that the charter's scope is not strictly exclusive to the core protocol.
- A session poll was conducted to gauge WG support:
Poll: do people think taking on the ssh sig work is a reasonable thing?
- Yes: 22
- No: 2
- No opinion: 6
- Total: 56
- Decision: The authors will refresh the expired draft, and the chairs will initiate an adoption call.

3. Post-Quantum Signatures for SSH

Scott Fluhrer presented Postquantum Signatures for SSH. The discussion focused on whether the WG should adopt pure ML-DSA, hybrid/composite signatures, or both.

Pure vs. Hybrid: Scott Fluhrer and John Preuß Mattsson argued for adopting both pure ML-DSA and hybrid options to let the market decide. Damien Miller advocated for composite hybrids (specifically draft-miller-sshm-mldsa44-ed25519-composite-sigs) for transitional security, emphasizing the need to limit combinatorial algorithm choices.
Malleability: Sophie Schmieg argued against delaying standardization for strong unforgeability (SUF-CMA) over existential unforgeability (EUF-CMA), noting that SUF-CMA rarely impacts SSH practical deployments.
Key Formats: There was strong agreement from participants (including Nicola Tuveri, Bob Beck, David Benjamin, and Damien Miller) to mandate "seed-only" private key formats to prevent interoperability issues.
Decision: The WG will issue adoption calls for both a pure ML-DSA draft (the chairs will coordinate with the authors on which draft to put forward) and the hybrid draft-miller-sshm-mldsa44-ed25519-composite-sigs. An interim meeting will be planned later in the year to address key formats (seed-only), unforgeability, key lengths, and fallback algorithms (such as SLH-DSA).

4. Adding PQ Capabilities to the SSH Protocol

Dmitry Belyavskiy and Alicja Kario presented Adding PQ capabilities to SSH protocol, summarizing results from the IETF 126 Hackathon.

Hackathon Outcomes: Successful interoperability testing was conducted for pure ML-DSA across four independent implementations (downstream OpenSSH, downstream libssh, Python SSH, and OQS provider).
GSS-API Hybrid KEX: The authors demonstrated GSS-API key exchange using hybrid ML-KEM, which requires new SSH code points. They have two working implementations and plan to ask the mailing list for adoption of the GSS-API hybrid KEX draft.

5. Other Business

SFTP v6/v3 Consolidation: Tero Kivinen reported that he is working on a unified draft combining SFTP v6 and v3 to better support non-Unix platforms (e.g., Windows and mainframes). Stephen Farrell advised him to publish the new draft directly to initiate list discussion.

Decisions and Action Items

draft-ietf-sshm-chacha20-poly1305: Chairs to suggest wording updates on the mailing list; authors to submit a refreshed draft.
draft-ietf-sshm-hostkey-update: Damien Miller to upload a refreshed version. Rich Salz and Caspar Schutijser to review.
draft-ietf-sshm-cert: Bob Beck and Caspar Schutijser to submit reviews of the current draft.
Fixed AES-GCM Modes: Chairs to initiate a call for adoption.
SSH SIG Draft: Simon Josefsson and Damien Miller to refresh the draft; chairs to initiate a call for adoption.
Post-Quantum Signatures:
- Chairs to initiate adoption calls for a pure ML-DSA draft and the hybrid draft-miller-sshm-mldsa44-ed25519-composite-sigs.
- Scott Fluhrer to post a query to the mailing list regarding restricting private key formats to "seed-only".
File Transfer: Tero Kivinen to publish a new consolidated SFTP draft.

Next Steps

The WG will proceed with the adoption calls outlined in the decisions above.
The chairs will schedule an interim meeting later in the year to resolve outstanding post-quantum signature design details (including key formats, SLH-DSA, and parameter lengths).

Automatic IETF Minutes