9. IANA 注意事项 (IANA Considerations)
第 9 节的 IANA 注册表定义和新增项原样保留如下. 本协议建立五个新注册表: 消息类型编号、约束编号、签名请求标志、约束扩展名称和扩展请求名称. 此外, 文档还请求在三个现有注册表中增加新的 codepoints.
Designated Expert (DE) 审查新增注册项时, 需要确认存在符合 [RFC8126] 要求、永久且公开可用的文档, 并检查所请求 codepoints 的目的和用法是否清楚. 对 IETF 内产生的规范, 还应确保已提交 SSHM Working Group 和 [email protected] 邮件列表审阅. IETF 外部规范请求 codepoints 时, 不应与正在进行的 IETF 工作或既有 IETF 规范冲突.
由于 SSH agent protocol 消息编号、约束编号和签名标志的可用编号有限, DE 需要确认固定数值分配有充分理由. 对许多用途而言, 具名扩展请求或约束扩展机制可以作为替代, 避免消耗有限 codepoint 空间. 下方表格中的 registry 名称、Identifier、Number、Reference 和十六进制 flag 值属于 IANA 注册数据, 必须保持原样.
从实现者角度看, 本节把第 8 节的 wire protocol 常量转化为 IANA 可维护的注册表. message type numbers 决定客户端请求和 agent 响应的首字节语义; constraint numbers 决定 key constraint 字段的解释; signature flags 决定签名请求的算法选择提示; extension name registries 则为未来扩展提供可读名称, 避免过早耗尽数值空间.
新增注册项时应优先考虑可扩展名称空间. 如果扩展只需要表达新的操作名称, SSH_AGENTC_EXTENSION 加 extension request name 通常比申请新的 message type number 更合适. 如果扩展只需要表达新的 key constraint, SSH_AGENT_CONSTRAIN_EXTENSION 加 constraint extension name 通常比申请新的 constraint number 更合适. 只有当互操作、性能或编码兼容性确实需要固定数值时, 才应申请有限的 codepoint.
表格中的 Reserved 项表示该数值已经被保留, 不能被普通实现复用. Private Use 范围允许私有协议实验, 但这类值没有全局互操作保证. Reference 列用于把每个注册项回溯到 RFC 9987 的对应章节, 因而本地化文本应保持英文和章节编号不变.
以下 text 块保留 RFC 原始 IANA 指令和 ASCII 表格. 注册表正式名称、列名、注册项名称、请求类型、通道类型和引用列需要与 IANA 记录精确一致, 因此保持英文; 中文导读用于说明注册策略和实现含义.
9. IANA Considerations
This protocol describes the establishment of five registries: one for
message type numbers, one for constraint numbers, one for signature
request flags, one for constraint extension names, and one for
extension request names. Additionally, new codepoints are requested
in three existing registries.
9.1. Guidance for Designated Experts
When a Designated Expert (DE) is asked to review additions to the new
registries described in this document (Section 9.2, Section 9.3,
Section 9.5, and Section 9.6), they are requested to verify that
suitable documentation as described in [RFC8126] exists and is
permanently and publicly available. The DE is also requested to
check the clarity of purpose and use of the requested codepoints.
The DE should also verify that specifications produced in the IETF
that request codepoints in these registries have been made available
to the SSHM Working Group and the [email protected] mailing list for
review. Requests for codepoints made for specifications produced
outside the IETF should not conflict with active IETF work or prior
IETF specifications.
The available number of codepoints in the SSH agent protocol numbers
(Section 9.2), constraint numbers (Section 9.3), and SSH agent
signature flags (Section 9.5) registries are limited, so the DE is
requested to ensure the use of codepoints is very well justified.
For the SSH agent protocol message numbers, named extension requests
(Section 9.6) provide an alternative for most uses with no practical
limitation on the number of available codepoints. For key constraint
numbers, the constraint extension mechanism (Section 5.2.7.3)
provides a similar alternative that is not limited by available
codepoints.
9.2. "SSH Agent Protocol Message Type Numbers" Registry
The "SSH Agent Protocol Message Type Numbers" registry records the
message type numbers for client requests and agent responses. It is
located in the "Secure Shell (SSH) Protocol Parameters" registry
group [IANA-SSH]. Its initial state consists of the following
numbers and reservations. Future message number allocations shall
occur via Expert Review as per [RFC8126].
+=========+==========================================+=============+
| Number | Identifier | Reference |
+=========+==========================================+=============+
| 0 | Reserved | RFC 9987, |
| | | Section |
| | | 8.1.1 |
+---------+------------------------------------------+-------------+
| 1 | Reserved | RFC 9987, |
| | | Section |
| | | 8.1.1 |
+---------+------------------------------------------+-------------+
| 2 | Reserved | RFC 9987, |
| | | Section |
| | | 8.1.1 |
+---------+------------------------------------------+-------------+
| 3 | Reserved | RFC 9987, |
| | | Section |
| | | 8.1.1 |
+---------+------------------------------------------+-------------+
| 4 | Reserved | RFC 9987, |
| | | Section |
| | | 8.1.1 |
+---------+------------------------------------------+-------------+
| 5 | SSH_AGENT_FAILURE | RFC 9987, |
| | | Sections |
| | | 5.1 and 8.1 |
+---------+------------------------------------------+-------------+
| 6 | SSH_AGENT_SUCCESS | RFC 9987, |
| | | Sections |
| | | 5.1 and 8.1 |
+---------+------------------------------------------+-------------+
| 7 | Reserved | RFC 9987, |
| | | Section |
| | | 8.1.1 |
+---------+------------------------------------------+-------------+
| 8 | Reserved | RFC 9987, |
| | | Section |
| | | 8.1.1 |
+---------+------------------------------------------+-------------+
| 9 | Reserved | RFC 9987, |
| | | Section |
| | | 8.1.1 |
+---------+------------------------------------------+-------------+
| 10 | Reserved | RFC 9987, |
| | | Section |
| | | 8.1.1 |
+---------+------------------------------------------+-------------+
| 11 | SSH_AGENTC_REQUEST_IDENTITIES | RFC 9987, |
| | | Sections |
| | | 5.5 and 8.1 |
+---------+------------------------------------------+-------------+
| 12 | SSH_AGENT_IDENTITIES_ANSWER | RFC 9987, |
| | | Sections |
| | | 5.5 and 8.1 |
+---------+------------------------------------------+-------------+
| 13 | SSH_AGENTC_SIGN_REQUEST | RFC 9987, |
| | | Sections |
| | | 5.6 and 8.1 |
+---------+------------------------------------------+-------------+
| 14 | SSH_AGENT_SIGN_RESPONSE | RFC 9987, |
| | | Sections |
| | | 5.6 and 8.1 |
+---------+------------------------------------------+-------------+
| 15 | Reserved | RFC 9987, |
| | | Section |
| | | 8.1.1 |
+---------+------------------------------------------+-------------+
| 16 | Reserved | RFC 9987, |
| | | Section |
| | | 8.1.1 |
+---------+------------------------------------------+-------------+
| 17 | SSH_AGENTC_ADD_IDENTITY | RFC 9987, |
| | | Sections |
| | | 5.2 and 8.1 |
+---------+------------------------------------------+-------------+
| 18 | SSH_AGENTC_REMOVE_IDENTITY | RFC 9987, |
| | | Sections |
| | | 5.4 and 8.1 |
+---------+------------------------------------------+-------------+
| 19 | SSH_AGENTC_REMOVE_ALL_IDENTITIES | RFC 9987, |
| | | Sections |
| | | 5.4 and 8.1 |
+---------+------------------------------------------+-------------+
| 20 | SSH_AGENTC_ADD_SMARTCARD_KEY | RFC 9987, |
| | | Sections |
| | | 5.2.6 and |
| | | 8.1 |
+---------+------------------------------------------+-------------+
| 21 | SSH_AGENTC_REMOVE_SMARTCARD_KEY | RFC 9987, |
| | | Sections |
| | | 5.4 and 8.1 |
+---------+------------------------------------------+-------------+
| 22 | SSH_AGENTC_LOCK | RFC 9987, |
| | | Sections |
| | | 5.7 and 8.1 |
+---------+------------------------------------------+-------------+
| 23 | SSH_AGENTC_UNLOCK | RFC 9987, |
| | | Sections |
| | | 5.7 and 8.1 |
+---------+------------------------------------------+-------------+
| 24 | Reserved | RFC 9987, |
| | | Section |
| | | 8.1.1 |
+---------+------------------------------------------+-------------+
| 25 | SSH_AGENTC_ADD_ID_CONSTRAINED | RFC 9987, |
| | | Sections |
| | | 5.2 and 8.1 |
+---------+------------------------------------------+-------------+
| 26 | SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED | RFC 9987, |
| | | Sections |
| | | 5.2.6 and |
| | | 8.1 |
+---------+------------------------------------------+-------------+
| 27 | SSH_AGENTC_EXTENSION | RFC 9987, |
| | | Sections |
| | | 5.8 and 8.1 |
+---------+------------------------------------------+-------------+
| 28 | SSH_AGENT_EXTENSION_FAILURE | RFC 9987, |
| | | Sections |
| | | 5.8 and 8.1 |
+---------+------------------------------------------+-------------+
| 29 | SSH_AGENT_EXTENSION_RESPONSE | RFC 9987, |
| | | Sections |
| | | 5.8 and 8.1 |
+---------+------------------------------------------+-------------+
| 240-255 | Private Use | RFC 9987, |
| | | Section 8.1 |
+---------+------------------------------------------+-------------+
Table 5
9.3. "SSH Agent Key Constraint Numbers" Registry
The "SSH Agent Key Constraint Numbers" registry records the message
numbers for key use constraints. It is located in the "Secure Shell
(SSH) Protocol Parameters" registry group [IANA-SSH]. Its initial
state is as follows. Future key constraint number allocations shall
occur via Expert Review as per [RFC8126].
+========+===============================+=======================+
| Number | Identifier | Reference |
+========+===============================+=======================+
| 0 | Reserved | RFC 9987, Section 8.2 |
+--------+-------------------------------+-----------------------+
| 1 | SSH_AGENT_CONSTRAIN_LIFETIME | RFC 9987, Section 8.2 |
+--------+-------------------------------+-----------------------+
| 2 | SSH_AGENT_CONSTRAIN_CONFIRM | RFC 9987, Section 8.2 |
+--------+-------------------------------+-----------------------+
| 255 | SSH_AGENT_CONSTRAIN_EXTENSION | RFC 9987, Section 8.2 |
+--------+-------------------------------+-----------------------+
Table 6
9.4. "SSH Agent Key Constraint Extension Names" Registry
The "SSH Agent Key Constraint Extension Names" registry records the
names used in the SSH_AGENT_CONSTRAIN_EXTENSION constraint extension
type (Section 5.2.7.3). It is located in the "Secure Shell (SSH)
Protocol Parameters" registry group [IANA-SSH]. Its initial state is
empty. Future key constraint extension name allocations shall occur
via Expert Review as per [RFC8126].
9.5. "SSH Agent Signature Flags" Registry
The "SSH Agent Signature Flags" registry records the values for
signature request (SSH_AGENTC_SIGN_REQUEST) flag values. It is
located in the "Secure Shell (SSH) Protocol Parameters" registry
group [IANA-SSH]. Its initial state consists of the following
numbers. Note that as the flags are combined by bitwise OR, all flag
values must be powers of two and the maximum available flag value is
0x80000000.
Future signature flag allocations shall occur via Expert Review as
per [RFC8126].
+========+========================+=======================+
| Number | Identifier | Reference |
+========+========================+=======================+
| 0x01 | Reserved | RFC 9987, Section 8.3 |
+--------+------------------------+-----------------------+
| 0x02 | SSH_AGENT_RSA_SHA2_256 | RFC 9987, Section 8.3 |
+--------+------------------------+-----------------------+
| 0x04 | SSH_AGENT_RSA_SHA2_512 | RFC 9987, Section 8.3 |
+--------+------------------------+-----------------------+
Table 7
9.6. "SSH Agent Extension Request Names" Registry
The "SSH Agent Extension Request Names" registry records the names
used in the generic extension request message (SSH_AGENTC_EXTENSION).
It is located in the "Secure Shell (SSH) Protocol Parameters"
registry group [IANA-SSH]. Its initial state consists of the
following names.
Future name allocations shall occur via Expert Review as per
[RFC8126].
+================+=========================+
| Extension Name | Reference |
+================+=========================+
| query | RFC 9987, Section 5.8.1 |
+----------------+-------------------------+
Table 8
9.7. Additions to the "Extension Names" Registry
IANA has added the following entries to the "Extension Names"
registry [IANA-SSH-EXT] in the "Secure Shell (SSH) Protocol
Parameters" registry group [IANA-SSH].
+================+=======================+
| Extension Name | Reference |
+================+=======================+
| agent-forward | RFC 9987, Section 7.1 |
+----------------+-----------------------+
Table 9
9.8. Additions to the "Connection Protocol Channel Request Names"
Registry
IANA has added the following entries to the "Connection Protocol
Channel Request Names" registry [IANA-SSH-CHANREQ] in the "Secure
Shell (SSH) Protocol Parameters" registry group [IANA-SSH].
+==============+=======================+
| Request Type | Reference |
+==============+=======================+
| agent-req | RFC 9987, Section 7.2 |
+--------------+-----------------------+
Table 10
9.9. Additions to the "Connection Protocol Channel Types" Registry
IANA has added the following entries to the "Connection Protocol
Channel Types" registry [IANA-SSH-CHANTYPE] under the "Secure Shell
(SSH) Protocol Parameters" registry group [IANA-SSH].
+===============+=======================+
| Channel Type | Reference |
+===============+=======================+
| agent-connect | RFC 9987, Section 7.3 |
+---------------+-----------------------+
Table 11