rfc4250 assigned numbers (e.g. message numbers)
rfc4251 architecture
rfc4252 authentication protocol; authenticate client to server
rfc4253 transport protocol; server authentication, confidentiality, and integrity with perfect forward secrecy
rfc4254 connection protocol; multiplexes the encrypted tunnel into several logical channels
rfc4256	Generic Message Exchange Authentication for the Secure Shell Protocol (SSH)
rfc4344 The Secure Shell (SSH) Transport Layer Encryption Modes
rfc4345	Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer Protocol
rfc4335	The Secure Shell (SSH) Session Channel Break Extension
rfc4419	Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol
rfc4432	RSA Key Exchange for the Secure Shell (SSH) Transport Layer Protocol
rfc4716	The Secure Shell (SSH) Public Key File Format

rfc2409	The Internet Key Exchange (IKE)
rfc3447	Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography
rfc3526 More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)
rfc4255	Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints
rfc4335	The Secure Shell (SSH) Session Channel Break Extension


# data types

byte
byte[n]	array of byte
boolean	byte 0 == false, byte 1 == true, other values must be seen as true as well
uint64	8 bytes unsigned integer, network order
uint32	4 bytes unsigned integer, network order
string	arbitrary length, can contain any character, even null's.  starts with uint32 holding length, followed by length bytes.
mpint	multiple precision.  two's complement, msb first.  negative numbers have msb of first byte set to 1.  starts with uint32 holding length in bytes.
name-list
	like string, but value (after the uint32 length) is a comma-separated list with zero or more elements.  string is us-ascii.

# names

hash, encryption, integrity, compression, and key exchange algorithms
referenced by name of max 64 characters, case-sensitive.  names
with an @ in it are not ietf-assigned, all others are.


# layers

ssh messages (of each "layer" (auth, transport, connection)) have a type number from 1 to 255.  they share the same space.

transport:
	1 to 19		Transport layer generic (e.g., disconnect, ignore, debug, etc.)
	20 to 29	Algorithm negotiation
	30 to 49	Key exchange method specific (numbers can be reused for different authentication methods)

userauth:
	50 to 59	User authentication generic
	60 to 79	User authentication method specific (numbers can be reused for different authentication methods)

connection:
	80 to 89	Connection protocol generic
	90 to 127	Channel related messages

reserved for client protocols:
	128 to 191	Reserved

local extensions:
	192 to 255	Local extensions


# packets

packets look like this (rfc4253, section 6):

	uint32		packet_length
	byte		padding_length
	byte[n1]	payload; n1 = packet_length - padding_length - 1
	byte[n2]	random padding; n2 = padding_length
	byte[m]		mac (Message Authentication Code - MAC); m = mac_length

packet_length
	length in bytes, excluding packet_length itself or the mac
padding_length
	length in bytes of random padding
payload
	useful contents of packet.  may be compressed, but initially it is not.
random padding
        arbitrary-length padding, such that the total length of
        (packet_length || padding_length || payload || random
        padding) is a multiple of the cipher block size or 8,
        whichever is larger.  There MUST be at least four bytes of
        padding.  The padding SHOULD consist of random bytes.  The
        maximum amount of padding is 255 bytes.
mac
        Message Authentication Code.  If message authentication has
        been negotiated, this field contains the MAC bytes.  Initially,
        the MAC algorithm MUST be "none".


packets of 35000 bytes have to be supported.

compression is done only on the payload.  the mac will be over the
compressed payload.  compression is independent for each direction.
none are:  none, zlib.

encryption is done on whole packets except the mac, including the
packet length.  the length should be decrypted as one of the first
things.


# algorithms

known encryption algorithms:
	3des-cbc         REQUIRED          three-key 3DES in CBC mode
	blowfish-cbc     OPTIONAL          Blowfish in CBC mode
	twofish256-cbc   OPTIONAL          Twofish in CBC mode, with a 256-bit key
	twofish-cbc      OPTIONAL          alias for "twofish256-cbc" (this is being retained for historical reasons)
	twofish192-cbc   OPTIONAL          Twofish with a 192-bit key
	twofish128-cbc   OPTIONAL          Twofish with a 128-bit key
	aes256-cbc       OPTIONAL          AES in CBC mode, with a 256-bit key
	aes192-cbc       OPTIONAL          AES with a 192-bit key
	aes128-cbc       RECOMMENDED       AES with a 128-bit key
	serpent256-cbc   OPTIONAL          Serpent in CBC mode, with a 256-bit key
	serpent192-cbc   OPTIONAL          Serpent with a 192-bit key
	serpent128-cbc   OPTIONAL          Serpent with a 128-bit key
	arcfour          OPTIONAL          the ARCFOUR stream cipher with a 128-bit key
	idea-cbc         OPTIONAL          IDEA in CBC mode
	cast128-cbc      OPTIONAL          CAST-128 in CBC mode
	none             OPTIONAL          no encryption; NOT RECOMMENDED

the mac is computed from a shared secret, packet sequence number,
and the contents of the packet:

	mac = MAC(key, sequence_number || unencrypted_packet)

sequence number is a uint32 starting at 0 and increased for each packet.
unencrypted_packet is the packet without the mac.

known macs:
	hmac-sha1    REQUIRED        HMAC-SHA1 (digest length = key length = 20)
	hmac-sha1-96 RECOMMENDED     first 96 bits of HMAC-SHA1 (digest length = 12, key length = 20)
	hmac-md5     OPTIONAL        HMAC-MD5 (digest length = key length = 16)
	hmac-md5-96  OPTIONAL        first 96 bits of HMAC-MD5 (digest length = 12, key length = 16)
	none         OPTIONAL        no MAC; NOT RECOMMENDED

key exchange methods:
	diffie-hellman-group1-sha1	REQUIRED
	diffie-hellman-group14-sha1	REQUIRED


public/private key/certificate formats:
	ssh-dss           REQUIRED     sign   Raw DSS Key
	ssh-rsa           RECOMMENDED  sign   Raw RSA Key
	pgp-sign-rsa      OPTIONAL     sign   OpenPGP certificates (RSA key)
	pgp-sign-dss      OPTIONAL     sign   OpenPGP certificates (DSS key)

encoded as:
	string    certificate or public key format identifier
	byte[n]   key/certificate data

the "ssh-dss" key format has the following specific encoding:
	string    "ssh-dss"
	mpint     p
	mpint     q
	mpint     g
	mpint     y



# kex exchange

rfc2409, ike.
ssh with diffie-hellman-group1-sha1 uses it.
6.2 Second Oakley Group

   IKE implementations SHOULD support a MODP group with the following
   prime and generator. This group is assigned id 2 (two).

   The prime is 2^1024 - 2^960 - 1 + 2^64 * { [2^894 pi] + 129093 }.
   Its hexadecimal value is

         FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
         29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
         EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
         E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
         EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE65381
         FFFFFFFF FFFFFFFF

   The generator is 2 (decimal)


# authentication

service "ssh-userauth"
use sessionid, first hash from dh exchange.

auth methods:

         publickey                     [SSH-USERAUTH, Section 7]
         password                      [SSH-USERAUTH, Section 8]
         hostbased                     [SSH-USERAUTH, Section 9]
         none                          [SSH-USERAUTH, Section 5.2]



byte      SSH_MSG_USERAUTH_REQUEST
string    user name in ISO-10646 UTF-8 encoding [RFC3629]
string    service name in US-ASCII
string    method name in US-ASCII
....      method specific fields


byte         SSH_MSG_USERAUTH_FAILURE
name-list    authentications that can continue
boolean      partial success

byte      SSH_MSG_USERAUTH_SUCCESS

byte      SSH_MSG_USERAUTH_BANNER
string    message in ISO-10646 UTF-8 encoding [RFC3629]
string    language tag [RFC3066]


example:
byte      SSH_MSG_USERAUTH_REQUEST
string    user name
string    service name
string    "password"
boolean   FALSE
string    plaintext password in ISO-10646 UTF-8 encoding [RFC3629]


# 

byte      SSH_MSG_CHANNEL_OPEN
string    channel type in US-ASCII only
uint32    sender channel
uint32    initial window size
uint32    maximum packet size
....      channel type specific data follows
"session"
0
winsize
maxpacketsize


byte      SSH_MSG_CHANNEL_OPEN_CONFIRMATION
uint32    recipient channel
uint32    sender channel
uint32    initial window size
uint32    maximum packet size
....      channel type specific data follows


byte      SSH_MSG_CHANNEL_OPEN_FAILURE
uint32    recipient channel
uint32    reason code
string    description in ISO-10646 UTF-8 encoding [RFC3629]
string    language tag [RFC3066]


byte      SSH_MSG_CHANNEL_REQUEST
uint32    recipient channel
string    "exec"
boolean   want reply
string    command

