Subject: New draft of X.509v3 Certificates for Secure Shell Authentication

From: Douglas Stebila <[email-masked]>
Date: Thu, 12 Aug 2010 12:07:42 +1000

We have just posted a new version of the draft for using X.509v3 certificates in SSH.  The main change in this new version is the addition of x509v3-rsa2048-sha256 public key format; see section 3.3.  

The motivation for adding this public key format is to provide an RSA solution that is compatible with the NIST draft SP800-131 recommendations on key lengths, which deprecate RSA<2048 and SHA-1 for signature generation after 2010.

While there is value in considering revising the plain RSA public key format as well to support SHA-256, we have refrained from doing so in this document so it stays focused on X.509v3 certificates only.

Feedback is welcome.

Douglas

> Filename:	 draft-igoe-secsh-x509v3
> Revision:	 05
> Title:		 X.509v3 Certificates for Secure Shell Authentication
> Creation_date:	 2010-08-12
> WG ID:		 Independent Submission
> Number_of_pages: 19
> 
> Abstract:
> X.509 public key certificates use a signature by a trusted
> certification authority to bind a given public key to a given digital
> identity.  This document specifies how to use X.509 version 3 public
> key certificates in public key algorithms in the Secure Shell
> protocol.
> 
> http://www.ietf.org/id/draft-igoe-secsh-x509v3-05.txt