rfc-6668

SHA-2 Data Integrity Verification for the Secure Shell (SSH) Transport Layer Protocol

D. Bider, M. Baushke

date2012-07 streamIETF wgnon working group statusPROPOSED STANDARD pages5 canonicalhttps://www.rfc-editor.org/rfc/rfc6668 doi10.17487/RFC6668

This memo defines algorithm names and parameters for use in some of the SHA-2 family of secure hash algorithms for data integrity verification in the Secure Shell (SSH) protocol. It also updates RFC 4253 by specifying a new RECOMMENDED data integrity algorithm. [STANDARDS-TRACK]

updates

rfc-4253 — The Secure Shell (SSH) Transport Layer Protocol

Extracted elements (9)

design-rationale §2

HMAC-SHA2-224 and HMAC-SHA2-384 were considered but excluded because they have the same computational requirements as HMAC-SHA2-256 and HMAC-SHA2-512 respectively, and are not commonly used in practice.

security, crypto

interoperability-note §2

Users, implementors, and administrators may place hmac-sha2-256 and hmac-sha2-512 ahead of the REQUIRED hmac-sha1 algorithm in algorithm negotiation proposals so that SHA-2-based MACs are negotiated first.

security, crypto

normative-requirement §2 RECOMMENDED

hmac-sha2-256 is RECOMMENDED for use as a data integrity algorithm in the SSH Transport Layer Protocol, with a digest length of 32 bytes and key length of 32 bytes.

security, crypto, email

normative-requirement §2 OPTIONAL

hmac-sha2-512 is OPTIONAL for use as a data integrity algorithm in the SSH Transport Layer Protocol, with a digest length of 64 bytes and key length of 64 bytes.

security, crypto

protocol-element §2

hmac-sha2-256 is defined as an SSH MAC algorithm using HMAC-SHA2-256 with a digest length of 32 bytes and a key length of 32 bytes.

security, crypto

protocol-element §2

hmac-sha2-512 is defined as an SSH MAC algorithm using HMAC-SHA2-512 with a digest length of 64 bytes and a key length of 64 bytes.

security, crypto

registry §3

IANA updated the 'Secure Shell (SSH) Protocol Parameters' MAC Algorithm Names registry to add hmac-sha2-256 and hmac-sha2-512, both referencing RFC 6668 Section 2.

registry, security

security-consideration §4

Per NIST SP 800-107 and SP 800-131A, HMAC-SHA1 provides 128-bit security strength and HMAC-SHA2-256 provides 256-bit security strength, both considered acceptable key lengths.

security, crypto

security-consideration §4

This document was motivated by security concerns with SHA-1 (RFC 6194) and MD5 (RFC 6151), which were the only data integrity algorithms previously defined in SSH (RFC 4253).

security, crypto