Confusing Concepts about SFTP: SSH2 vs OpenSSH

Credit and copied from https://dada.tw/2008/01/03/70/


Terminology: SSH Protocols and Products
SSH
    A generic term referring to SSH protocols or software products.
SSH-1
    The SSH protocol, Version 1. This protocol went through several
    revisions, of which 1.3 and 1.5 are the best known, and we will
    write SSH-1.3 and SSH-1.5 should the distinction be necessary.
SSH-2
    The SSH protocol, Version 2, as defined by several draft standards
    documents of the IETF SECSH working group.
SSH1
    Tatu Ylönen's software implementing the SSH-1 protocol; the original
    SSH. Now distributed and maintained (minimally) by SSH
    Communications Security, Inc.
SSH2
    The "SSH Secure Shell" product from SSH Communications Security, Inc.
    This is a commercial SSH-2 protocol implementation, though it is
    licensed free of charge in some circumstances.
ssh (all lowercase letters)
    A client program included in SSH1, SSH2, OpenSSH, F-Secure SSH, and
    other products, for running secure terminal sessions and remote
    commands. In SSH1 and SSH2, it is also named ssh1/ssh2, respectively.
OpenSSH
    The product OpenSSH from the OpenBSD project,
    which implements both the SSH-1 and SSH-2 protocols.
OpenSSH/1
    OpenSSH, referring specifically to its behavior
    when using the SSH-1 protocol.
OpenSSH/2
    OpenSSH, referring specifically to its behavior
    when using the SSH-2 protocol.
Please note: 

1. SSH2 is a name of a product of SSH Communications Security, Inc., https://www.ssh.com, a commercial SSH-2 implementation.

2. SSH2 and OpenSSH use similar private key format(RFC 4716 format, https://www.ietf.org/rfc/rfc4716.txt), but there are still slight differences, e.g. no Subject line in OpenSSH private key format, https://stackoverflow.com/questions/43915130/does-ssh-net-accept-only-openssh-format-of-private-key-if-not-what-are-the-res

3. However, the public key format is very different. SSH2 still uses RFC 4716 format for public key, but OpenSSH doesn't.



(1) OpenSSH public key example


ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+J/TF1ekKflC3Pn0ilOncacTA+koUrZ9/CoLQf0zaeMLvUFVeHUEK40j/WRNni2yCdHxfoA2GIPB2k4AU6Q124Gcje/ekjyn3gSj5E2Lf4W8Ih/fDbBBFP4WswL4UZkFLaGeq7+Jmz1iaV0QWgNn3oK2mZclTRVTn4bXAsWauTdnXiiYdiUR3wQu1VPW13zD9T6DvQB8tIXeghxsEdFe8vSa8H1tN6JpOMBucSzK5PudRcAW8aaMxRNavf5Uln5cSM6qjZNj51VpQtjax58Hoaqimq1wEDDdU+0/ee+aVyecqzu4Y7k9JB+NeMR+j64o13p6Duugg7rmT66JC1ZIf user@domain@client



(2)SSH2 public key example(SSH2.com or RFC 4716 Format)


---- BEGIN SSH2 PUBLIC KEY ----

Comment: "rsa-key-20171003"

AAAAB3NzaC1yc2EAAAABJQAAAQEAq0reEUNW7jxasNUaRHtKO+t9Yi1moEdFL7Tw


nuhPVcF6qOgW+MAT7/Taf1N/5jwueVTRU7t+5i5FyOIIqZ/XMZlWDoqmf75hV1Vi


BXVz3z2XhMINK2fqYKxZquF/RGRiVx8gRu6Bq05OOqaQmBv9uwoIurFLQFLOX8Ob


VvGn35824ZBQH3yDUcFItwUomdN6CPV83XeoDM3EGQAhVehBLFhpqeKqf+23EN8d


KsUvJ90/9ncqbccQrT+vCEIhB9mn1BOaUCUbYYZaGNZmonwR8okrecxxJCZQVR/N


INW/D4XHPNFjEFO60fVVKMjWBt27EWP7zjhDgs3FXyYlea04kw==


---- END SSH2 PUBLIC KEY ----


3. SSH Client Tools

If you see the suffix "2", it's SSH2.

For example, ssh2.exe is for SSH2 only. For OpenSSH, the name always is ssh.exe

Other tools like ssh-keygen2.exe/ssh-keygen.exe are similar. 

Comments

Popular posts from this blog

Use GnuPG Tools or C# Code for PGP Encryption and Signature

Errors in Net Core Add-Migration