rfc-8709

Ed25519 and Ed448 Public Key Algorithms for the Secure Shell (SSH) Protocol

B. Harris, L. Velvindron

date2020-02 streamIETF areasec wgcurdle statusPROPOSED STANDARD pages7 canonicalhttps://www.rfc-editor.org/rfc/rfc8709 doi10.17487/RFC8709 errataview

This document describes the use of the Ed25519 and Ed448 digital signature algorithms in the Secure Shell (SSH) protocol. Accordingly, this RFC updates RFC 4253.

updates

rfc-4253 — The Secure Shell (SSH) Transport Layer Protocol

Extracted elements (15)

design-rationale §1

This document formalizes the use of 'ssh-ed25519' as originally implemented by OpenSSH 6.5, and additionally introduces 'ssh-ed448' with the name 'ssh-ed448'. The formalization ensures interoperability across SSH implementations that had independently adopted the OpenSSH convention.

security, crypto

interoperability-note §1

The ssh-ed25519 algorithm name and wire format described here matches the implementation in OpenSSH 6.5 and subsequent implementations; this RFC updates RFC 4253 to formally register these algorithms.

security, crypto

normative-requirement §3 SHOULD

Standard implementations of SSH SHOULD implement the ssh-ed25519 and ssh-ed448 signature algorithms.

security, crypto

protocol-element §7

Ed25519 signatures are verified according to RFC 8032 Section 5.1.7; Ed448 signatures are verified according to RFC 8032 Section 5.2.7.

security, crypto

protocol-element §5

Signatures for ssh-ed25519 are generated according to the procedure in RFC 8032 Section 5.1.6; signatures for ssh-ed448 are generated per RFC 8032 Section 5.2.6.

security, crypto

protocol-element §8

SSHFP DNS resource records for 'ssh-ed448' keys use SSHFP algorithm value 6. The Ed448 public key is a 57-octet value representing a 455-bit y-coordinate and a sign bit for the x-coordinate.

dns, security, crypto

protocol-element §3

The 'ssh-ed25519' public key algorithm is defined for use with SSH per RFC 4253 Section 6.6. It supports signing only, not encryption.

security, crypto

protocol-element §3

The 'ssh-ed448' public key algorithm is defined for use with SSH. It supports signing only, not encryption.

security, crypto

registry §9

IANA added 'ssh-ed25519' and 'ssh-ed448' to the 'Public Key Algorithm Names' registry in the 'Secure Shell (SSH) Protocol Parameters' registry, both referencing RFC 8709.

registry, security

registry §9

IANA added value 6 (Ed448) to the 'SSHFP RR Types for public key algorithms' registry in the 'DNS SSHFP Resource Record Parameters' registry, referencing RFC 8709.

registry, dns, security

security-consideration §10

The security considerations in RFC 4251 Section 9 apply to all SSH implementations using Ed25519 and Ed448. Additionally, the security considerations in RFC 8032 Section 8 and RFC 7479 Section 3 apply to all uses of these algorithms in SSH.

security, crypto

wire-format §4

The 'ssh-ed25519' public key format encodes as two SSH strings: the literal 'ssh-ed25519' followed by the 32-octet Ed25519 public key as defined in RFC 8032 Section 5.1.5.

security, crypto

wire-format §6

The 'ssh-ed25519' signature format encodes as two SSH strings: the literal 'ssh-ed25519' followed by the 64-octet signature produced per RFC 8032 Section 5.1.6.

security, crypto

wire-format §4

The 'ssh-ed448' public key format encodes as two SSH strings: the literal 'ssh-ed448' followed by the 57-octet Ed448 public key as defined in RFC 8032 Section 5.2.5.

security, crypto

wire-format §6

The 'ssh-ed448' signature format encodes as two SSH strings: the literal 'ssh-ed448' followed by the 114-octet signature produced per RFC 8032 Section 5.2.6.

security, crypto