attachment
<div dir="ltr"><div>Hi,</div><div><br></div><div>Interesting new direction for SSH (widely used for system admin of printers), which hasn't</div><div>had an active IETF WG for 20 years now - updating it and moving it to run over HTTP/3 </div><div>and take advantage of QUIC prior art.</div><div><br></div><div>Cheers,</div><div>- Ira</div><div><br></div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">---------- Forwarded message ---------<br>From: <b class="gmail_sendername" dir="auto">François Michel</b> <span dir="auto"><francois.michel=<a href="mailto:40uclouvain.be@dmarc.ietf.org">40uclouvain.be@dmarc.ietf.org</a>></span><br>Date: Wed, Feb 28, 2024 at 7:49 AM<br>Subject: [Secdispatch] Fwd: New Version Notification for draft-michel-ssh3-00.txt<br>To: <<a href="mailto:alldispatch@ietf.org">alldispatch@ietf.org</a>><br>Cc: Olivier Bonaventure <<a href="mailto:olivier.bonaventure@uclouvain.be">olivier.bonaventure@uclouvain.be</a>>, <<a href="mailto:secdispatch@ietf.org">secdispatch@ietf.org</a>><br></div><br><br>Hi all,<br>
<br>
We're happy to announce that we recently submitted a first design draft <br>
for running SSH/Secure Shells over HTTP, with a focus on HTTP/3. We <br>
would love being able to discuss this document during the ALLDISPATCH <br>
session (I will attend remotely).<br>
<br>
We have an open-source working prototype in Go here: <br>
<a href="https://github.com/francoismichel/ssh3" rel="noreferrer" target="_blank">https://github.com/francoismichel/ssh3</a><br>
<br>
Coming from our recent research article, the solution is named SSH3. <br>
We'd be happy to discuss the name/renaming in the future, but we would <br>
first like to discuss the protocol, its architecture and use-cases <br>
before any long naming discussions take place. :-) Its final name will <br>
depend on the path taken by the solution anyway, i.e. whether it will <br>
become a concrete candidate for a new version, an alternate layer for <br>
RFC4252 and RFC4253 or integrated as part of ongoing IETF work (e.g. as <br>
stated in the draft, we can observe synergies with MASQUE).<br>
<br>
Among other benefits of this evolution of SSH, we can list UDP port <br>
forwarding (or other protocols such as IP), focusing the specification <br>
on the Connection protocol, reduced connection establishment, better <br>
integration with existing web authentication infrastructures, URL <br>
multiplexing and others. I recommend you to look at the draft for a more <br>
detailed (but still concise) list of the interesting aspects.<br>
<br>
The idea is getting quite some public traction (the repo is quite <br>
popular) but we're still in an embryonic state of the proposal. We would <br>
love to have feedback from IETF folks and work together on the future of <br>
the protocol and its architecture. The document is introductory and <br>
there is room for people to participate.<br>
For instance, the short section 7 only introduces the topic of making <br>
this proposal coexist with existing SSHv2 deployments. Defining <br>
mechanisms inspired by how QUIC and HTTP/3 coexist with TCP and HTTP/2 <br>
would be really interesting !<br>
<br>
I know some people already look at providing other implementations of <br>
the proposal. If it is your case let us know and we can work together <br>
and reach interop. :-)<br>
In case you look at refactoring your existing SSH implementation for <br>
other reasons, it might be easy to also make it compatible with this <br>
proposal since most of the Connection protocol is reused. Existing <br>
QUIC/HTTP libs can be used for the remaining parts.<br>
<br>
Don't hesitate to let us know your thoughts, feedback and use-cases !<br>
<br>
Regards,<br>
<br>
François<br>
<br>
<br>
<br>
<br>
<br>
-------- Message transféré --------<br>
Sujet : New Version Notification for draft-michel-ssh3-00.txt<br>
Date : Wed, 28 Feb 2024 03:27:39 -0800<br>
De : <a href="mailto:internet-drafts@ietf.org" target="_blank">internet-drafts@ietf.org</a><br>
Pour : François Michel <<a href="mailto:francois.michel@uclouvain.be" target="_blank">francois.michel@uclouvain.be</a>>, Francois Michel <br>
<<a href="mailto:francois.michel@uclouvain.be" target="_blank">francois.michel@uclouvain.be</a>>, Olivier Bonaventure <br>
<<a href="mailto:Olivier.Bonaventure@uclouvain.be" target="_blank">Olivier.Bonaventure@uclouvain.be</a>>, Olivier Bonaventure <br>
<<a href="mailto:olivier.bonaventure@uclouvain.be" target="_blank">olivier.bonaventure@uclouvain.be</a>><br>
<br>
A new version of Internet-Draft draft-michel-ssh3-00.txt has been <br>
successfully<br>
submitted by François Michel and posted to the<br>
IETF repository.<br>
<br>
Name: draft-michel-ssh3<br>
Revision: 00<br>
Title: Secure shell over HTTP/3 connections<br>
Date: 2024-02-28<br>
Group: Individual Submission<br>
Pages: 18<br>
URL: <br>
<a href="https://www.ietf.org/archive/id/draft-michel-ssh3-00.txt" rel="noreferrer" target="_blank">https://www.ietf.org/archive/id/draft-michel-ssh3-00.txt</a><br>
Status: <br>
<a href="https://datatracker.ietf.org/doc/draft-michel-ssh3/" rel="noreferrer" target="_blank">https://datatracker.ietf.org/doc/draft-michel-ssh3/</a><br>
HTML: <br>
<a href="https://www.ietf.org/archive/id/draft-michel-ssh3-00.html" rel="noreferrer" target="_blank">https://www.ietf.org/archive/id/draft-michel-ssh3-00.html</a><br>
HTMLized: <br>
<a href="https://datatracker.ietf.org/doc/html/draft-michel-ssh3" rel="noreferrer" target="_blank">https://datatracker.ietf.org/doc/html/draft-michel-ssh3</a><br>
<br>
<br>
Abstract:<br>
<br>
The secure shell (SSH) traditionally offers its secure services over<br>
an insecure network using the TCP transport protocol. This document<br>
defines mechanisms to run the SSH protocol over HTTP/3 using Extended<br>
CONNECT. Running SSH over HTTP/3 enables additional benefits such as<br>
the scalability offered by HTTP multiplexing, relying on TLS for<br>
secure channel establishment leveraging X.509 certificates, HTTP<br>
Authentication schemes for client and server authentication, UDP port<br>
forwarding and stronger resilience against packet injection attacks<br>
and middlebox interference.<br>
<br>
<br>
<br>
The IETF Secretariat<br>
<br>
<br>
_______________________________________________<br>
Secdispatch mailing list<br>
<a href="mailto:Secdispatch@ietf.org" target="_blank">Secdispatch@ietf.org</a><br>
<a href="https://www.ietf.org/mailman/listinfo/secdispatch" rel="noreferrer" target="_blank">https://www.ietf.org/mailman/listinfo/secdispatch</a><br>
</div></div></div>