Subject: [apps-discuss] SSH WG/protocol additions

From: Phil Lello <[email-masked]>
Date: Mon, 20 Apr 2015 09:17:56 +0100

Hi,

I believe the SSH protocol falls under applications rather than security;
what would be the appropriate place to discuss standardising additions?

I am approaching this from the perspective of applications using ssh as a
transport, rather than for system shells. Specifically, the areas I am
looking at are:

- Authentication integration with federated identities
- Using web sockets as a transport

Best wishes,

Phil Lello

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 20 Apr 2015 10:43:49 +0100

The secsh WG [1] was in the security area so it might be better
to use the [email-masked] list to discuss this. Or at least be a
good idea to send a mail there.

S.

On 20/04/15 09:17, Phil Lello wrote:
> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss
>

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 20 Apr 2015 10:44:38 +0100

Sorry, omitted the URL

> good idea to send a mail there.

[1]
https://tools.ietf.org/wg/secsh/charters?item=./charter.d/charter.2009-10-16_0859,1.txt

---

From: Tony Finch <[email-masked]>
Date: Mon, 20 Apr 2015 11:19:07 +0100

> - Authentication integration with federated identities

Is this related to Project Moonshot?
https://www.ja.net/products-services/janet-futures/moonshot
https://community.jisc.ac.uk/groups/moonshot

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
South Biscay: Cyclonic, becoming easterly, 4 or 5. Moderate or rough. Fair.
Good.

---

From: Phil Lello <[email-masked]>
Date: Mon, 20 Apr 2015 14:36:54 +0100

> https://community.jisc.ac.uk/groups/moonshot

I have grazed the documentation for Moonshot, and whilst it is certainly an
interesting and potentially useful technology, it seems to require more
infrastructure (e.g. Radius/RadSec) than I am looking at. However, I
haven't yet had an opportunity to spin up a Moonshot test environment, and
it's possible I may have misunderstood the minimum requirements vs.
reference implementation.

I'll try moving discussion over to the saag list, however I am envisaging a
lightweight Authentication Protocol "asserted-identity", which passes a
namespace (e.g. "urn:oasis:names:tc:SAML:2.0:protocol") and assertion (e.g.
a urn:oasis:names:tc:SAML:2.0:assertion xml message) from the client to the
server. Local policy would be responsible for deciding supported
protocol(s), support for encypted/unencypted and signed/unsigned assertions.

Phil