Update to the IANA SSH Protocol Parameters Registry Requirements

Multiple designated experts are suggested to be appointed, representing the perspectives of different applications using SSH, in order to enable broadly informed review of registration decisions and mitigate conflicts of interest.

registry, process

The change from IETF Review to Expert Review is aligned with similar policy changes undertaken for certain IPsec and TLS registries, and was motivated by a February 2021 discussion on the CURDLE mailing list. The previous IETF Review policy was considered too burdensome for routine SSH parameter registrations.

registry, security, process

The Channel Connection Failure Reason Codes, Disconnection Messages Reason Codes, and Extended Channel Data Transfer data_type_code registries have the Expert Review policy applied only to the range 0x00000001–0xFDFFFFFF (inclusive); values outside this range retain their prior policy.

registry, security

The SSH Public-Key File Header Tags registry transitions to Expert Review with the exclusion of header-tags beginning with 'x-', which continue to be available without registration (Private Use).

registry, security

Criteria that SHOULD be applied by designated experts include: whether the proposed registration duplicates existing functionality (not permitted), whether it is likely to be of general applicability or useful only for a single application, and whether the registration description is clear.

registry, process

Denials of registration requests MUST include an explanation and, if applicable, suggestions as to how to make the request successful. Registration requests undetermined for more than 21 days may be escalated to the IESG.

registry, process

Expert Review registry requests are registered after a three-week review period on the [email protected] mailing list, on the advice of one or more designated experts. Designated experts may approve registration prior to publication if satisfied that a specification will be published.

registry, process

IANA MUST only accept registry updates from the designated experts and the IESG. It SHOULD direct all requests for registration from other sources to the review mailing list.

registry, process

In cases where a registration decision could be perceived as creating a conflict of interest for a particular expert, that expert SHOULD defer to the judgment of the other experts.

registry, process

Registration requests sent to the mailing list for review SHOULD use an appropriate subject line, such as 'Request to register value in SSH protocol parameters <specific parameter> registry'.

registry, process

RFC 9519 changes the registration policy for 21 registries within the IANA 'Secure Shell (SSH) Protocol Parameters' group from IETF Review to Expert Review. Affected registries include Authentication Method Names, Encryption Algorithm Names, Key Exchange Method Names, MAC Algorithm Names, Public Key Algorithm Names, and others defined in RFCs 4250, 4716, 4819, and 8308.

registry, security

The 'Message Numbers' and 'Publickey Subsystem Status Codes' registries are not affected by this change and remain under the Standards Action policy due to their limited resources as one-byte registry values.

registry, security

This memo does not change the Security Considerations for any of the updated RFCs (4250, 4716, 4819, 8308). The registration policy change from IETF Review to Expert Review has no impact on the security properties of the SSH protocol itself.

security, registry