Приложение G: SSH-2 names specified for PuTTY
- G.1 Connection protocol channel request names
- G.2 Key exchange method names
- G.3 Encryption algorithm names
- G.4 Agent extension request names
There are various parts of the SSH-2 protocol where things are specified using a textual name. Names ending in
@putty.projects.tartarus.org are reserved for allocation by the PuTTY team. Allocated names are documented here.
G.1 Connection protocol channel request names
These names can be sent in a
- This is sent by a client to announce that it will not have more than one channel open at a time in the current connection (that one being the one the request is sent on). The intention is that the server, knowing this, can set the window on that one channel to something very large, and leave flow control to TCP. There is no message-specific data.
- PuTTY sends this request along with some
SSH_MSG_CHANNEL_WINDOW_ADJUSTmessages as part of its window-size tuning. It can be sent on any type of channel. There is no message-specific data. Servers MUST treat it as an unrecognised request and respond with
(Some SSH servers get confused by this message, so there is a bug-compatibility mode for disabling it. See section 4.27.3.)
G.2 Key exchange method names
- These appeared in various drafts of what eventually became RFC 4432. They have been superseded by
G.3 Encryption algorithm names
- These were used in drafts of what eventually became RFC 4345. They have been superseded by
G.4 Agent extension request names
The SSH agent protocol, which is only specified in an Internet-Draft at the time of writing (draft-miller-ssh-agent), defines an extension mechanism. These names can be sent in an
- The payload is a single SSH-2
stringcontaining a keypair in the PPK format defined in приложение C. Compared to the standard
SSH_AGENTC_ADD_IDENTITY, this extension allows adding keys in encrypted form, with the agent requesting a decryption passphrase from the user on demand, and able to revert the key to encrypted form.
- The payload is a single SSH-2
stringspecifying a public key blob, as in
SSH_AGENTC_REMOVE_IDENTITY. Requests that the agent forget any cleartext form of a specific key.
SSH_AGENT_SUCCESSif the agent ended up holding the key only in encrypted form (even if it was already encrypted); returns
SSH_AGENT_EXTENSION_FAILUREif not (if it wasn't held by the agent at all, or only in cleartext form).
- No payload. Requests that the agent forget the cleartext form of any keys for which it holds an encrypted form.
If the agent holds any keys with an encrypted form (or no keys at all), returns
SSH_AGENT_SUCCESSto indicate that no such keys are now held in cleartext form, followed by a
uint32specifying how many keys remain in cleartext form (because the agent didn't hold an encrypted form for them). If the agent holds nothing but keys in cleartext form, returns
- No payload. Returns
SSH_AGENT_SUCCESSfollowed by a list of identities similar to
SSH_AGENT_IDENTITIES_ANSWER, except that each key has an extra SSH-2
stringat the end. Currently that
stringcontains a single
uint32flags word, with the following bits defined:
- Bit 0
- If set, key is held with an encrypted form (so that the
reencryptextension can do something useful with it).
- Bit 1
- If set, key's cleartext form is not currently held (so the user will have to supply a passphrase before the key can be used).