The Secure Shell (SSH) Protocol Assigned Numbers
updated by
Extracted elements (27)
SSH maintains its own group identifier space for key exchange, which is logically distinct from the Oakley [RFC2412] and IKE group spaces. Although 'diffie-hellman-group14-sha1' adopts the number from RFC 3526, implementations SHOULD treat SSH key exchange method names as opaque identifiers and not assume any relationship between SSH groups and IKE groups.
The local name extension format 'name@domainname' resembles RFC 822 (STD 11) email addresses, but the RFC notes this is purely coincidental and has no relationship to email addressing. The '@' convention was chosen solely as a scoping mechanism for vendor-private namespace delegation.
The encryption algorithm 'des-cbc' is listed as HISTORIC and is generally regarded as obsolete per FIPS-46-3. It is the one historic algorithm included in RFC 4250 solely for registry completeness; implementations should not use it.
All IANA-registered SSH names MUST be printable US-ASCII strings and MUST NOT contain '@', ',', whitespace, control characters (ASCII ≤ 32), or DEL (127). Names are case-sensitive and MUST NOT be longer than 64 characters.
Requests for new message numbers in the ranges 1–29, 50–59, and 80–127 MUST be done through the STANDARDS ACTION method. New numbers in the range 128–191 MUST be done through IETF CONSENSUS. The range 192–255 is left for PRIVATE USE and IANA will not control it.
SSH_MSG_CHANNEL_OPEN_FAILURE packets MUST have Channel Connection Failure 'reason code' values in the range of 0x00000001 to 0xFFFFFFFF, and new values MUST be assigned sequentially.
SSH_MSG_CHANNEL_REQUEST messages with a 'pty-req' string MUST contain an 'encoded terminal modes' value. Requests for new opcode assignments MUST be done through the IETF CONSENSUS method.
SSH_MSG_DISCONNECT packets MUST carry a 'reason code' value in the range 0x00000001 to 0xFFFFFFFF. Disconnection Message reason code values MUST be assigned sequentially.
A local name extension mechanism uses the format 'name@domainname', where the part following '@' MUST be a valid, fully qualified internet domain name controlled by the defining party. IANA does not register or control names containing '@'. Names MUST have only a single '@' sign and MUST NOT exceed 64 characters.
Pseudo-Terminal Encoded Terminal Modes is a byte stream of opcode-argument pairs carried in SSH_MSG_CHANNEL_REQUEST 'pty-req' messages. Opcodes are single bytes in the range 1–255; opcodes 1–159 carry a uint32 argument. Opcodes 160–255 are not yet defined. Opcode 0 (TTY_OP_END) marks the end of options.
The PRIVATE USE range for Channel Connection Failure reason codes (0xFE000000–0xFFFFFFFF) is split: 0xFE000000–0xFEFFFFFF is for locally assigned channels (if the server understands the channel type but fails to open it, it SHOULD respond with a value from this sub-range); 0xFF000000–0xFFFFFFFF is reserved for experimentation with no interoperability guarantee.
The SSH Message Number is a single byte in the packet payload header that identifies the message type. Values 30–49 and 60–79 are method-specific and reusable across different key exchange and authentication methods respectively.
IANA registry for Authentication Method Names used by the 'ssh-userauth' service. Initial assignments: 'publickey', 'password', 'hostbased', and 'none'. New names require IETF CONSENSUS.
IANA registry for Channel Connection Failure 'reason code' (uint32) used in SSH_MSG_CHANNEL_OPEN_FAILURE. Initial assignments: SSH_OPEN_ADMINISTRATIVELY_PROHIBITED (1), SSH_OPEN_CONNECT_FAILED (2), SSH_OPEN_UNKNOWN_CHANNEL_TYPE (3), SSH_OPEN_RESOURCE_SHORTAGE (4). New values 0x00000005–0xFDFFFFFF require IETF CONSENSUS.
IANA registry for Compression Algorithm Names. Initial assignments: 'none' and 'zlib'. New names require IETF CONSENSUS.
IANA registry for Connection Protocol Channel Request Names. Initial assignments include: 'pty-req', 'x11-req', 'env', 'shell', 'exec', 'subsystem', 'window-change', 'xon-xoff', 'signal', 'exit-status', and 'exit-signal'. Global request names include 'tcpip-forward' and 'cancel-tcpip-forward'.
IANA registry for Connection Protocol Channel Types. Initial assignments: 'session', 'x11', 'forwarded-tcpip', and 'direct-tcpip'. No initial assignments for Connection Protocol Subsystem Names.
IANA registry for Encryption Algorithm Names. Initial assignments include: '3des-cbc', 'blowfish-cbc', 'twofish256-cbc', 'aes256-cbc', 'aes192-cbc', 'aes128-cbc', 'serpent256-cbc', 'arcfour', 'cast128-cbc', 'none', and 'des-cbc' (HISTORIC per FIPS-46-3).
IANA registry for Extended Channel Data Transfer 'data_type_code' (uint32) used in SSH_MSG_CHANNEL_EXTENDED_DATA. Only one initial assignment: SSH_EXTENDED_DATA_STDERR (1). New codes in 0x00000002–0xFDFFFFFF require IETF CONSENSUS; 0xFE000000–0xFFFFFFFF is PRIVATE USE.
IANA registry for Key Exchange Method Names. Initial assignments: 'diffie-hellman-group1-sha1' (Oakley group 1) and 'diffie-hellman-group14-sha1' (using the group number assigned by RFC 3526).
IANA registry for MAC Algorithm Names. Initial assignments: 'hmac-sha1', 'hmac-sha1-96', 'hmac-md5', 'hmac-md5-96', and 'none'. New names require IETF CONSENSUS.
IANA registry for Public Key Algorithm Names. Initial assignments: 'ssh-dss', 'ssh-rsa', 'pgp-sign-rsa', and 'pgp-sign-dss'. New names require IETF CONSENSUS.
IANA registry for Signal Names used in the SSH connection protocol. Initial assignments include ABRT, ALRM, FPE, HUP, ILL, INT, KILL, PIPE, QUIT, SEGV, TERM, USR1, and USR2.
IANA registry for SSH Message Numbers: byte values 1–255 allocated in bands — transport layer generic (1–19), algorithm negotiation (20–29), key exchange method specific (30–49), user authentication generic (50–59), auth method specific (60–79), connection protocol generic (80–89), channel-related (90–127), reserved (128–191), local extensions (192–255). Initial assignments include SSH_MSG_DISCONNECT (1) through SSH_MSG_CHANNEL_FAILURE (100).
IANA registry for SSH_MSG_DISCONNECT 'reason code' (uint32) and associated human-readable 'description'. Initial assignments define 15 reason codes including SSH_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT (1) through SSH_DISCONNECT_ILLEGAL_USER_NAME (15). New values in 0x00000010–0xFDFFFFFF require IETF CONSENSUS; 0xFE000000–0xFFFFFFFF is PRIVATE USE.
IANA registry for SSH Service Names, identifying protocol layers. Initial assignments: 'ssh-userauth' (SSH Authentication Protocol) and 'ssh-connection' (SSH Connection Protocol). New names require IETF CONSENSUS.
The SSH protocol provides a secure encrypted channel over an insecure network. Full security considerations are deferred to the SSH Architecture document (RFC 4251); RFC 4250 itself only establishes IANA registries and does not define new cryptographic mechanisms.