summaryrefslogtreecommitdiff
path: root/PROTOCOL
diff options
context:
space:
mode:
Diffstat (limited to 'PROTOCOL')
-rw-r--r--PROTOCOL53
1 files changed, 39 insertions, 14 deletions
diff --git a/PROTOCOL b/PROTOCOL
index 8150c577b..f9560839e 100644
--- a/PROTOCOL
+++ b/PROTOCOL
@@ -40,8 +40,8 @@ http://www.openssh.com/txt/draft-miller-secsh-compression-delayed-00.txt
40 "ecdsa-sha2-nistp521-cert-v01@openssh.com" 40 "ecdsa-sha2-nistp521-cert-v01@openssh.com"
41 41
42OpenSSH introduces new public key algorithms to support certificate 42OpenSSH introduces new public key algorithms to support certificate
43authentication for users and hostkeys. These methods are documented in 43authentication for users and host keys. These methods are documented
44the file PROTOCOL.certkeys 44in the file PROTOCOL.certkeys
45 45
461.4. transport: Elliptic Curve cryptography 461.4. transport: Elliptic Curve cryptography
47 47
@@ -283,26 +283,51 @@ by the client cancel the forwarding of a Unix domain socket.
283 string socket path 283 string socket path
284 284
2852.5. connection: hostkey update and rotation "hostkeys@openssh.com" 2852.5. connection: hostkey update and rotation "hostkeys@openssh.com"
286and "hostkeys-prove@openssh.com"
286 287
287OpenSSH supports a protocol extension allowing a server to inform 288OpenSSH supports a protocol extension allowing a server to inform
288a client of all its protocol v.2 hostkeys after user-authentication 289a client of all its protocol v.2 host keys after user-authentication
289has completed. 290has completed.
290 291
291 byte SSH_MSG_GLOBAL_REQUEST 292 byte SSH_MSG_GLOBAL_REQUEST
292 string "hostkeys@openssh.com" 293 string "hostkeys@openssh.com"
293 string[] hostkeys 294 string[] hostkeys
294 295
295Upon receiving this message, a client may update its known_hosts 296Upon receiving this message, a client should check which of the
296file, adding keys that it has not seen before and deleting keys 297supplied host keys are present in known_hosts. For keys that are
297for the server host that are no longer offered. 298not present, it should send a "hostkeys-prove@openssh.com" message
299to request the server prove ownership of the private half of the
300key.
298 301
299This extension allows a client to learn key types that it had 302 byte SSH_MSG_GLOBAL_REQUEST
300not previously encountered, thereby allowing it to potentially 303 string "hostkeys-prove@openssh.com"
301upgrade from weaker key algorithms to better ones. It also 304 char 1 /* want-reply */
302supports graceful key rotation: a server may offer multiple keys 305 string[] hostkeys
303of the same type for a period (to give clients an opportunity to 306
304learn them using this extension) before removing the deprecated 307When a server receives this message, it should generate a signature
305key from those offered. 308using each requested key over the following:
309
310 string session identifier
311 string "hostkeys-prove@openssh.com"
312 string hostkey
313
314These signatures should be included in the reply, in the order matching
315the hostkeys in the request:
316
317 byte SSH_MSG_REQUEST_SUCCESS
318 string[] signatures
319
320When the client receives this reply (and not a failure), it should
321validate the signatures and may update its known_hosts file, adding keys
322that it has not seen before and deleting keys for the server host that
323are no longer offered.
324
325These extensions let a client learn key types that it had not previously
326encountered, thereby allowing it to potentially upgrade from weaker
327key algorithms to better ones. It also supports graceful key rotation:
328a server may offer multiple keys of the same type for a period (to
329give clients an opportunity to learn them using this extension) before
330removing the deprecated key from those offered.
306 331
3073. SFTP protocol changes 3323. SFTP protocol changes
308 333
@@ -428,4 +453,4 @@ respond with a SSH_FXP_STATUS message.
428This extension is advertised in the SSH_FXP_VERSION hello with version 453This extension is advertised in the SSH_FXP_VERSION hello with version
429"1". 454"1".
430 455
431$OpenBSD: PROTOCOL,v 1.25 2015/01/26 03:04:45 djm Exp $ 456$OpenBSD: PROTOCOL,v 1.26 2015/02/16 22:13:32 djm Exp $