News for hackers. Stuff that matters.

A comment on SSH3: SSHv2 using HTTP/3 and QUIC. Parent comment

Re:SSH3: SSHv2 using HTTP/3 and QUIC by sargun on Saturday December 16, 2023 @03:11PM (#38667270)
You can already use certificates to login via SSH. Usually you setup your own certificate authority and sign your own certs because they need special attributes.
[ Parent | on HN ]
Re:SSH3: SSHv2 using HTTP/3 and QUIC by adontz on Saturday December 16, 2023 @03:32PM (#38667420)
SSH certificates (I encourage using them!) are not x509, absolutely incompatible.
[ Parent | on HN ]
Re:SSH3: SSHv2 using HTTP/3 and QUIC by dilyevsky on Saturday December 16, 2023 @04:22PM (#38667810)
It’s same general principle and same security model just different way of going about it. It supports CAs and extensions just like x509
[ Parent | on HN ]
Re:SSH3: SSHv2 using HTTP/3 and QUIC by adontz on Sunday December 17, 2023 @07:02AM (#38672290)
No. For instance SSH certificates are one level only, do not support trust chains, cross signing, and a lot of other x509 complexity.
[ Parent | on HN ]
Re:SSH3: SSHv2 using HTTP/3 and QUIC by ReK_ on Sunday December 17, 2023 @01:27AM (#38670809)
You're thinking of SSH keys, which are not certificates. SSH certificates are indeed x.509: https://datatracker.ietf.org/doc/html/rfc6187
[ Parent | on HN ]
Re:SSH3: SSHv2 using HTTP/3 and QUIC by adontz on Sunday December 17, 2023 @06:59AM (#38672278)
No, I'm thinking of SSH certificates.

Here is the description of file format, it's nothing like x509

https://github.com/openssh/openssh-portable/blob/master/PROT...

[ Parent | on HN ]