Detail of GM/T 0129-2023

Introduction of GM/T 0129-2023

GM/T 0129-2023 Secure shell cryptography protocol specification 1 Scope This document specifies the secure shell cryptography protocol, the encrypted transport protocol, the authentication protocol, the connection protocol of the interactive tunnel, and the usage method of the cryptographic algorithm in the protocol. This document is applicable to the development and testing of SSH server and SSH client products. 2 Normative references The following documents contain provisions which, through reference in this text, constitute provisions of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. GB/T 15852.1 Information technology - Security techniques - Message authentication codes - Part 1: Mechanisms using a block cipher GB/T 15852.2 Information technology - Security techniques - Message Authentication Codes (MACs) - Part 2: Mechanisms using a dedicated hash-function GB/T 33560 Information security technology - Cryptographic application identifier criterion specification GB/T 35275 Information security technology - SM2 cryptographic algorithm encrypted signature message syntax specification GB/T 35276 Information security technology - SM2 cryptographic algorithm usage specification GM/T 0015 Digital certificate format based on SM2 algorithm GM/Z 4001 Cryptology terminology 3 Terms and definitions For the purposes of this document, the terms and definitions given in GM/Z 4001 apply. 4 Abbreviations For the purposes of this document, the following abbreviations apply. CR: Carriage-Return LF: Line-Feed SP: Space SSH: Secure Shell 5 Protocol framework 5.1 General The SSH cryptography protocol is a protocol suite composed of the transport layer protocol, authentication protocol, and connection protocol. It is used for secure remote login and secure network service on insecure networks. The transport layer protocol and authentication protocol may also form security application services such as sftp and scp together with other services. In the process of establishing the SSH cryptography protocol, firstly, a secure communication channel is established by the transport layer protocol; then, the authentication protocol is used to authenticate the identities of the client and server on this secure communication channel; finally, after the authentication is completed, the corresponding SSH service is established on the secure communication channel by the connection protocol. 5.2 Transport layer protocol The transport layer protocol provides server authentication, confidentiality, and integrity. The transport layer protocol may run on a TCP connection and may also be used on other reliable data streams. 5.3 Authentication protocol The authentication protocol is used by the server to authenticate the identity of the client user. The authentication protocol runs on the transport layer protocol. 5.4 Connection protocol The connection protocol is used to multiplex an encrypted tunnel into several logical channels. The connection protocol runs on the authentication protocol. The connection protocol may be used to provide various network services, including the interactive environment (shell), port forwarding, and X11 connection.

Contents of GM/T 0129-2023

Foreword i Introduction ii 1 Scope 2 Normative references 3 Terms and definitions 4 Abbreviations 5 Protocol framework 5.1 General 5.2 Transport layer protocol 5.3 Authentication protocol 5.4 Connection protocol 6 Cryptographic algorithms and key types 6.1 Cryptographic algorithm 6.2 Key types 7 Definitions of data types 7.1 Algorithm identifier 7.2 Basic data types 8 Transport layer protocol 8.1 General 8.2 Protocol flow 8.3 Protocol version 8.4 Packet 8.5 Key agreement 8.6 Service request 8.7 Disconnection 9 Authentication protocol 9.1 General 9.2 Protocol flow 9.3 Packet 9.4 Password-based authentication method 9.5 Authentication method based on the asymmetric key 9.6 Authentication method based on the digital certificate 10 Connection protocol 10.1 General 10.2 Connection channel 10.3 Packet Bibliography