[ssh_x509] SSH-2.0-PKIX_SSH[17.1.1] or next PKIX-SSH release

ssh_x509 at roumenpetrov.info ssh_x509 at roumenpetrov.info
Tue Oct 7 10:07:37 EEST 2025


Hello,

It seems to me next release pass build tests - 
https://build.opensuse.org/package/show/home:petrov_r/pkixssh .
Remark: by-ldap tests are out of scope.


The main change is update of "identification string", see RFC4253 
chapter "Protocol Version Exchange" .


Starting with 17.1 "softwareversion" match product release i.e., for 
instance PKIX_SSH[17.1.1]. As dash is used to separate items software 
name uses underscore i.e., PKIX-SSH -> PKIX_SSH.

So now "identification string" is in format SSH-2.0-PKIX_SSH[<release>] 
that match secure shell implementation.

Compatibility with other implementations is moved to comment part of 
identification string. It is used only in daemon and client.
Utility that "gather public keys"(keyscan) does not output 
"compatibility" part.


Soon compressed source archive will be published to site along with 
implementation changes.


Regards,
Roumen Petrov



More information about the ssh_x509 mailing list