Internet Engineering Task Force (IETF)                          D. Bider
Request for Comments: 6668                               Bitvise Limited
Updates: 4253                                                 M. Baushke
Category: Standards Track                         Juniper Networks, Inc.
ISSN: 2070-1721                                                July 2012
Internet Engineering Task Force (IETF)                          D. Bider
Request for Comments: 6668                               Bitvise Limited
Updates: 4253                                                 M. Baushke
Category: Standards Track                         Juniper Networks, Inc.
ISSN: 2070-1721                                                July 2012

SHA-2 Data Integrity Verification for the Secure Shell (SSH) Transport Layer Protocol




This memo defines algorithm names and parameters for use in some of the SHA-2 family of secure hash algorithms for data integrity verification in the Secure Shell (SSH) protocol. It also updates RFC 4253 by specifying a new RECOMMENDED data integrity algorithm.

本备忘录定义了用于安全Shell(SSH)协议中数据完整性验证的SHA-2安全哈希算法家族中的一些算法名称和参数。它还通过指定新的推荐数据完整性算法来更新RFC 4253。

Status of This Memo


This is an Internet Standards Track document.


This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741.

本文件是互联网工程任务组(IETF)的产品。它代表了IETF社区的共识。它已经接受了公众审查,并已被互联网工程指导小组(IESG)批准出版。有关互联网标准的更多信息,请参见RFC 5741第2节。

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at


Copyright Notice


Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved.

版权所有(c)2012 IETF信托基金和确定为文件作者的人员。版权所有。

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents ( in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(自本文件出版之日起生效。请仔细阅读这些文件,因为它们描述了您对本文件的权利和限制。从本文件中提取的代码组件必须包括信托法律条款第4.e节中所述的简化BSD许可证文本,并提供简化BSD许可证中所述的无担保。

1. Overview and Rationale
1. 概述和理由

The Secure Shell (SSH) [RFC4251] is a very common protocol for secure remote login on the Internet. Currently, SSH defines data integrity verification using SHA-1 and MD5 algorithms [RFC4253]. Due to recent security concerns with these two algorithms ([RFC6194] and [RFC6151], respectively), implementors and users request support for data integrity verification using some of the SHA-2 family of secure hash algorithms.

Secure Shell(SSH)[RFC4251]是Internet上安全远程登录的一种非常常见的协议。目前,SSH使用SHA-1和MD5算法定义数据完整性验证[RFC4253]。由于最近对这两种算法(分别为[RFC6194]和[RFC6151])的安全性担忧,实现者和用户请求支持使用一些SHA-2系列安全哈希算法进行数据完整性验证。

1.1. Requirements Terminology
1.1. 需求术语

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].


2. Data Integrity Algorithms
2. 数据完整性算法

This memo adopts the style and conventions of [RFC4253] in specifying how the use of new data integrity algorithms are indicated in SSH.


The following new data integrity algorithms are defined:


hmac-sha2-256 RECOMMENDED HMAC-SHA2-256 (digest length = 32 bytes, key length = 32 bytes)


hmac-sha2-512 OPTIONAL HMAC-SHA2-512 (digest length = 64 bytes, key length = 64 bytes)


Figure 1


The Hashed Message Authentication Code (HMAC) mechanism was originally defined in [RFC2104] and has been updated in [RFC6151].


The SHA-2 family of secure hash algorithms is defined in [FIPS-180-3].


Sample code for the SHA-based HMAC algorithms are available in [RFC6234]. The variants, HMAC-SHA2-224 and HMAC-SHA2-384 algorithms, were considered but not added to this list as they have the same computational requirements of HMAC-SHA2-256 and HMAC-SHA2-512, respectively, and do not seem to be much used in practice.


Test vectors for use of HMAC with SHA-2 are provided in [RFC4231]. Users, implementors, and administrators may choose to put these new MACs into the proposal ahead of the REQUIRED hmac-sha1 algorithm defined in [RFC4253] so that they are negotiated first.


3. IANA Considerations
3. IANA考虑

This document augments the MAC Algorithm Names in [RFC4253] and [RFC4250].


IANA has updated the "Secure Shell (SSH) Protocol Parameters" registry with the following entries:

IANA已使用以下条目更新了“Secure Shell(SSH)协议参数”注册表:

MAC Algorithm Name Reference Note hmac-sha2-256 RFC 6668 Section 2 hmac-sha2-512 RFC 6668 Section 2

MAC算法名称参考注释hmac-sha2-256 RFC 6668第2节hmac-sha2-512 RFC 6668第2节

Figure 2


4. Security Considerations
4. 安全考虑

The security considerations of RFC 4253 [RFC4253] apply to this document.

RFC 4253[RFC4253]的安全注意事项适用于本文件。

The National Institute of Standards and Technology (NIST) publications: NIST Special Publication (SP) 800-107 [800-107] and NIST SP 800-131A [800-131A] suggest that HMAC-SHA1 and HMAC-SHA2-256 have a security strength of 128 bits and 256 bits, respectively, which are considered acceptable key lengths.

美国国家标准与技术研究所(NIST)出版物:NIST特别出版物(SP)800-107[800-107]和NIST SP 800-131A[800-131A]建议HMAC-SHA1和HMAC-SHA2-256的安全强度分别为128位和256位,这两种安全强度被视为可接受的密钥长度。

Many users seem to be interested in the perceived safety of using the SHA2-based algorithms for hashing.


5. References
5. 工具书类
5.1. Normative References
5.1. 规范性引用文件

[FIPS-180-3] National Institute of Standards and Technology (NIST), United States of America, "Secure Hash Standard (SHS)", FIPS PUB 180-3, October 2008, < publications/fips/fips180-3/fips180-3_final.pdf>.

[FIPS-180-3]美国国家标准与技术研究所(NIST),“安全哈希标准(SHS)”,FIPS PUB 180-3,2008年10月< 出版物/fips/fips180-3/fips180-3_final.pdf>。

[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997.

[RFC2104]Krawczyk,H.,Bellare,M.,和R.Canetti,“HMAC:用于消息认证的键控哈希”,RFC 2104,1997年2月。

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2119]Bradner,S.,“RFC中用于表示需求水平的关键词”,BCP 14,RFC 2119,1997年3月。

[RFC4231] Nystrom, M., "Identifiers and Test Vectors for HMAC-SHA-224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512", RFC 4231, December 2005.

[RFC4231]Nystrom,M.“HMAC-SHA-224、HMAC-SHA-256、HMAC-SHA-384和HMAC-SHA-512的标识符和测试向量”,RFC 42312005年12月。

[RFC4253] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH) Transport Layer Protocol", RFC 4253, January 2006.

[RFC4253]Ylonen,T.和C.Lonvick,编辑,“安全外壳(SSH)传输层协议”,RFC 4253,2006年1月。

5.2. Informative References
5.2. 资料性引用

[800-107] National Institute of Standards and Technology (NIST), "Recommendation for Applications Using Approved Hash Algorithms", NIST Special Publication 800-107, February 2009, < nistpubs/800-107/NIST-SP-800-107.pdf>.

[800-107]国家标准与技术研究所(NIST),“使用经批准哈希算法的应用建议”,NIST特别出版物800-107,2009年2月< nistpubs/800-107/NIST-SP-800-107.pdf>。

[800-131A] National Institute of Standards and Technology (NIST), "Transitions: Recommendation for the Transitioning of the Use of Cryptographic Algorithms and Key Lengths", DRAFT NIST Special Publication 800-131A, January 2011, < sp800-131A.pdf>.

[800-131A]美国国家标准与技术研究所(NIST),“转换:密码算法和密钥长度使用转换的建议”,NIST特别出版物草案800-131A,2011年1月< sp800-131A.pdf>。

[RFC4250] Lehtinen, S. and C. Lonvick, Ed., "The Secure Shell (SSH) Protocol Assigned Numbers", RFC 4250, January 2006.

[RFC4250]Lehtinen,S.和C.Lonvick,Ed.,“安全外壳(SSH)协议分配编号”,RFC 4250,2006年1月。

[RFC4251] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH) Protocol Architecture", RFC 4251, January 2006.

[RFC4251]Ylonen,T.和C.Lonvick,编辑,“安全外壳(SSH)协议架构”,RFC 4251,2006年1月。

[RFC6151] Turner, S. and L. Chen, "Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms", RFC 6151, March 2011.

[RFC6151]Turner,S.和L.Chen,“MD5消息摘要和HMAC-MD5算法的更新安全注意事项”,RFC 61512011年3月。

[RFC6194] Polk, T., Chen, L., Turner, S., and P. Hoffman, "Security Considerations for the SHA-0 and SHA-1 Message-Digest Algorithms", RFC 6194, March 2011.

[RFC6194]Polk,T.,Chen,L.,Turner,S.,和P.Hoffman,“SHA-0和SHA-1消息摘要算法的安全考虑”,RFC 61942011年3月。

[RFC6234] Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)", RFC 6234, May 2011.

[RFC6234]Eastlake 3rd,D.和T.Hansen,“美国安全哈希算法(基于SHA和SHA的HMAC和HKDF)”,RFC 6234,2011年5月。

Authors' Addresses


Denis Bider Bitvise Limited Suites 41/42, Victoria House 26 Main Street GI


   Phone: +1 869 762 1410
   Phone: +1 869 762 1410

Mark D. Baushke Juniper Networks, Inc. 1194 N Mathilda Av Sunnyvale, CA 94089-1206 US


   Phone: +1 408 745 2952
   Phone: +1 408 745 2952