modernssh

Standards coverage

This page maps the SSH standards implemented by modernssh to the production code and tests that currently support each claim. It is an evidence index, not a claim that every optional algorithm or extension in every cited document is implemented.

The audit uses the RFC text kept in ../rfcs as its primary source corpus. Links below point to the same documents at the RFC Editor so the table remains useful outside the development checkout. Fixed-vector evidence means the expected bytes or cryptographic result were written independently of the codec or primitive under test. Integration evidence means two library roles communicate over a real encrypted TCP connection. OpenSSH evidence uses the system tools or the digest-pinned test fixture described in interoperability.md.

Core protocol

StandardImplemented surfaceEvidenceStatus and limits
RFC 4250 and RFC 4251SSH names, name-lists, strings, booleans, integers, and canonical mpint values in src/utils/ and src/packets/__tests__/utils/NameList.ts, __tests__/utils/Mpint.ts, __tests__/packets/TransportText.tsFixed boundary and malformed-input evidence is present. RFC 9519 only changes registry administration and has no runtime behavior to implement.
RFC 3066Language-tag fields through src/utils/SSHText.ts__tests__/packets/KexInit.ts, __tests__/packets/UserAuthVectors.ts, __tests__/packets/TransportText.tsThe RFC grammar, empty SSH value, length limits, and non-ASCII rejection are covered.
RFC 5646SFTP status language tags through src/utils/SSHText.ts and src/sftp/codec.ts__tests__/sftp/CodecVectors.tsFixed complex, private-use, and grandfathered tags plus malformed extension, duplicate variant, duplicate singleton, and non-ASCII cases are covered. The empty SFTP value remains accepted for an unspecified language.
RFC 4252none, public-key, host-based, and password authentication in src/auth/, src/Client.ts, and src/ServerClient.ts__tests__/packets/UserAuthVectors.ts, __tests__/integration/Authentication.ts, __tests__/integration/AuthenticationBanner.ts, __tests__/integration/AuthenticationSignatureAlgorithms.ts, __tests__/openssh/OpenSSH.tsFixed frames, exact signed fields, possession before partial success, strict host identity text, target-service and partial-identity isolation, policy ordering, signature allowlisting, failure limits, password changes, and both OpenSSH peer roles are covered.
RFC 4256Keyboard-interactive authentication in src/auth/keyboard-interactive.ts and both connection roles__tests__/packets/UserAuthVectors.ts, __tests__/integration/Authentication.ts, __tests__/openssh/OpenSSH.tsMulti-prompt exchanges, opcode reuse, retry behavior, and both OpenSSH peer roles are covered.
RFC 4253Identification, negotiation, packet protection, service negotiation, key exchange, rekey, diagnostics, disconnect, compression, and legacy opt-in algorithms across src/ProtocolVersionExchange.ts, src/BinaryPacket.ts, src/algorithms/, and connection roles__tests__/transport/, including LegacyFixedGroups.ts; __tests__/packets/KexInit.ts, ServiceVectors.ts, and Unimplemented.ts; __tests__/integration/Handshake.ts, HigherLayerPhases.ts, ReplyTimeouts.ts, AutomaticRekey.ts, InboundTransportBackpressure.ts, BlowfishCBC.ts, Cast128CBC.ts, Disconnect.ts, and FixedGroups.ts; __tests__/utils/RekeyQueue.ts; __tests__/openssh/OpenSSH.ts and FixedGroups.tsBroad fixed-frame, encrypted lifecycle, verified-erratum reserved-field hashing, sequence-correlated unimplemented replies, localized disconnect, bounded and backpressured rekey traffic, malformed-input, and OpenSSH evidence exists. Optional algorithms are documented individually in transport.md.
RFC 4254Global requests, channel flow control, sessions, TCP forwarding, X11, agent forwarding, exit metadata, EOF, and close across src/Channel.ts, src/channels/, src/Client.ts, and src/ServerClient.ts__tests__/packets/ChannelVectors.ts, __tests__/packets/ForwardingVectors.ts, __tests__/channels/, __tests__/integration/AsyncEventOperations.ts, ChannelIdentifiers.ts, IncomingChannelPolicy.ts, RemoteForwardLimits.ts, SessionEnvironmentLimits.ts, SessionExit.ts, Handshake.ts, Tunnel.ts, and __tests__/openssh/OpenSSH.tsBoth channel directions, bounded active, pending, listener, and retained environment work, strict request direction and signal text, awaited admission, exact-once exit results, closed-proposal rejection, localized private-use failures, half-close, forwarding, and OpenSSH sessions are covered.

Standardized extensions and algorithms

StandardImplemented surfaceEvidenceStatus and limits
RFC 4335Session BREAK requests in src/channels/ClientSessionChannel.ts and src/channels/SessionChannel.ts__tests__/packets/ChannelVectors.ts, __tests__/integration/Handshake.ts, __tests__/integration/AuthorizationPolicy.ts, __tests__/openssh/OpenSSH.tsFixed framing, awaited policy, failure, and a real PTY peer are covered.
RFC 8160The IUTF8 PTY terminal mode in src/TerminalModes.ts and both session-channel roles__tests__/utils/TerminalModes.ts, __tests__/packets/ChannelVectors.ts, __tests__/integration/Handshake.ts, __tests__/package/Exports.tsThe assigned opcode, literal PTY request bytes, root export, and an encrypted client/server request are covered.
RFC 4344Stateful AES-128, AES-192, and AES-256 counter-mode encryption in src/algorithms/encryption/aesN-ctr.ts__tests__/transport/CTR.ts, __tests__/transport/BinaryPacket.ts, __tests__/integration/Handshake.ts, __tests__/openssh/OpenSSH.tsPublished NIST vectors, split stream updates, exact key and IV sizes, encrypted traffic, rekey, and both OpenSSH peer roles are covered.
RFC 4418 plus draft-miller-secsh-umac-01UMAC primitive and SSH MAC bindings in src/utils/UMAC.ts and src/algorithms/mac/umac.ts__tests__/transport/MAC.ts, __tests__/openssh/UMAC.tsPublished vectors, the verified long-message erratum, all four deployed SSH variants, traffic, and rekey are covered.
RFC 4419 and its RFC 8270 group-size updateDiffie-Hellman group exchange in src/algorithms/kex/diffie-hellman-group-exchange.ts and src/packets/KexDHGex*.ts__tests__/packets/KexDHGex.ts, __tests__/transport/GroupExchange.ts, __tests__/openssh/OpenSSH.tsFixed messages, safe-group validation, both hashes, rekey, and both OpenSSH peer roles are covered.
RFC 4255, RFC 6594, and RFC 7479SSHFP binary and presentation RDATA, RSA, DSA, ECDSA, Ed25519, SHA-1, SHA-256 preference, and RRset verification in src/SSHFP.ts__tests__/utils/SSHFP.ts, __tests__/package/Exports.tsPublished fingerprints for all four key families, malformed and ownership cases, downgrade-resistant set matching, package use, and system ssh-keygen -r generation are covered. DNS lookup and DNSSEC authentication remain an explicit application trust boundary.
RFC 4432Opt-in rsa2048-sha256 key exchange in src/algorithms/kex/rsa2048-sha256.ts__tests__/transport/RSAKeyExchange.ts, __tests__/interop/AsyncSSH.tsLiteral frames, an independent exchange-hash value, RSA bounds, encrypted in-process traffic, rekey, and independent-peer traffic in both roles are covered.
RFC 4462 and RFC 8732GSS-API authentication and finite-field, ECDH, Curve25519, and Curve448 GSS key exchange through src/GSSAPI.ts, src/algorithms/kex/gssapi-key-exchange.ts, and both connection roles__tests__/packets/GSSAPIVectors.ts, __tests__/packets/KexGSSAPI.ts, __tests__/integration/GSSAPIAuthentication.ts, __tests__/integration/GSSAPIKeyExchange.tsFixed protocol bytes and an independent multi-round test mechanism cover both roles and failure states. Gap: no system GSS provider or independent SSH peer is exercised.
RFC 5647Registered AES-GCM encryption/MAC pairs in src/algorithms/encryption/aead-aes-gcm.ts__tests__/transport/AESGCM.ts, __tests__/transport/AlgorithmNegotiation.ts, __tests__/integration/RFC5647.ts, __tests__/interop/AsyncSSH.tsPublished primitive data, a fixed SSH packet, paired-list negotiation, both key sizes, traffic, rekey, and an independent peer in both roles are covered.
RFC 5656NIST ECDH and ECDSA keys/signatures in src/algorithms/kex/ecdh-sha2-nist.ts, src/utils/PublicKey.ts, and src/utils/PrivateKey.ts__tests__/transport/ECDH.ts, __tests__/utils/ECDSA.ts, __tests__/integration/Authentication.ts, __tests__/openssh/OpenSSH.tsPublished curve vectors, exact curve identifiers, malformed points and key blobs, deterministic signatures, all required curves, encrypted authentication, rekey, and both OpenSSH peer roles are covered.
RFC 6668hmac-sha2-256 and hmac-sha2-512 in src/algorithms/mac/__tests__/transport/MAC.ts, __tests__/transport/BinaryPacket.ts, __tests__/openssh/OpenSSH.tsPublished SHA-256 and SHA-512 HMAC data, RFC key and tag sizes, key ownership, SSH packet protection, traffic, and OpenSSH negotiation are covered.
RFC 6979Deterministic DSA and ECDSA nonces in src/utils/RFC6979.ts, src/utils/DSA.ts, and src/utils/PrivateKey.ts__tests__/utils/DSA.ts, __tests__/utils/ECDSA.tsPublished DSA and all three ECDSA vectors plus negative scalar cases are covered.
RFC 8268SHA-2 fixed-group Diffie-Hellman methods in src/algorithms/kex/diffie-hellman-group*.ts__tests__/transport/FixedGroups.ts, __tests__/integration/FixedGroups.ts, __tests__/openssh/FixedGroups.tsPublished group constants, corrected public-value bounds, encrypted traffic, rekey, and both OpenSSH peer roles are covered.
RFC 8308Extension negotiation, server-sig-algs, delayed compression, no-flow-control, elevation, and registered transport ping behavior across src/packets/ExtInfo.ts, src/DelayCompression.ts, and both connection roles__tests__/packets/ExtInfo.ts, __tests__/utils/NameList.ts, __tests__/transport/DelayCompression.ts, __tests__/transport/NoFlowControl.ts, __tests__/transport/Elevation.ts, matching __tests__/integration/ suites, and __tests__/openssh/MLKEM.tsLiteral values, strict name-lists, ordering, replacement sets, encrypted malformed input, rekey, and failures are covered. A pinned peer covers delayed compression, no-flow-control, and elevation in both roles; OpenSSH 10 covers ping.
RFC 8332RSA SHA-2 host and user signatures while retaining the ssh-rsa key format__tests__/packets/UserAuthVectors.ts, __tests__/transport/AlgorithmNegotiation.ts, __tests__/openssh/OpenSSH.tsFixed request bytes, negotiation, invalid signatures, rekey, and both OpenSSH peer roles are covered.
RFC 8709Ed25519 and opt-in Ed448 SSH key/signature formats in src/utils/PublicKey.ts and src/utils/PrivateKey.ts, plus their SSHFP assignments in src/SSHFP.ts__tests__/utils/Ed25519.ts, __tests__/utils/Ed448.ts, __tests__/utils/SSHFP.ts, __tests__/transport/Ed448.ts, __tests__/interop/AsyncSSH.tsRFC 8032 primitive vectors, exact SSH frames, the published Ed25519 fingerprint, bounds, generation, encrypted traffic, rekey, and Ed448 host signatures with an independent peer in both roles are covered. Ed448 SSHFP generation still lacks tool interoperability because current ssh-keygen does not support that key family.
RFC 8731Curve25519 and Curve448 key exchange in src/algorithms/kex/rfc8731.ts__tests__/transport/Curve25519.ts, __tests__/transport/Curve448.ts, __tests__/integration/Curve448.ts, __tests__/openssh/OpenSSH.ts, __tests__/interop/AsyncSSH.tsRFC 7748 vectors, length and low-order rejection, encrypted traffic and rekey, Curve25519 OpenSSH interoperability, and Curve448 independent-peer traffic in both roles are covered.
RFC 9142Key-exchange implementation policy, secure defaults, and explicit legacy opt-ins in src/algorithms.ts and src/AlgorithmOptions.ts__tests__/transport/RFC9142.ts, __tests__/transport/AlgorithmNegotiation.ts, and __tests__/integration/Handshake.tsThe complete fixed-name table, configured GSS families, prohibited RSA-1024 method, and initial ext-info-c/ext-info-s advertisements are covered against the RFC guidance.
RFC 9941sntrup761x25519-sha512 and its wire-equivalent deployed name in src/algorithms/kex/sntrup761x25519-sha512.ts__tests__/transport/SNTRUP761.ts, __tests__/integration/SNTRUP761.ts, __tests__/openssh/SNTRUP761.tsPublished combiner data, KEM rejection behavior, exact sizes, both names, traffic, rekey, and both OpenSSH peer roles are covered.

Auxiliary SSH protocols

StandardImplemented surfaceEvidenceStatus and limits
RFC 4716Public-key file import and serialization, header preservation, and legacy MD5 fingerprint display in src/utils/RFC4716.ts, src/utils/PublicKey.ts, and src/KeyParsing.ts__tests__/utils/KeyParsing.ts, __tests__/package/Exports.tsThe RFC's literal key, malformed files, UTF-8-aware line folding, package entry point, and bidirectional ssh-keygen exchange are covered.
RFC 4819Version 2 public-key management client/server in src/publickey/PublicKeySubsystem*.ts__tests__/publickey/PublicKeySubsystemCodec.ts, __tests__/publickey/PublicKeySubsystemClient.ts, __tests__/publickey/PublicKeySubsystemServer.ts, __tests__/integration/PublicKeySubsystem.ts, __tests__/integration/PublicKeySubsystemTimeouts.ts, and __tests__/interop/AsyncSSH.tsFixed frames, bounded parsing and request lifetimes, cancellable async policy, serialized acknowledgements, failure, rekey, and both independent-peer roles are covered. The peer fragments version frames, coalesces multi-response writes, and completes capability listing plus add/list/remove state transitions.
RFC 7076Version 3 namespaces, certificate management, and version-2 downgrade in src/publickey/PublicKeySubsystem*.ts__tests__/publickey/PublicKeySubsystemCodec.ts, __tests__/publickey/PublicKeySubsystemClient.ts, __tests__/publickey/PublicKeySubsystemServer.ts, __tests__/integration/PublicKeySubsystem.ts, __tests__/integration/PublicKeySubsystemTimeouts.ts, and __tests__/interop/AsyncSSH.tsLiteral version-3 frames, strict namespace validation and bounds, awaited deny-by-default policy, localized request timeouts, encrypted rekey, version-2 layout downgrade, and both independent-peer roles cover namespaced key and opaque certificate state transitions.
RFC 9987Agent protocol, management operations, constraints, extensions, and standardized forwarding in src/publickey/SSHAgentProtocol.ts, src/publickey/SSHAgent.ts, and src/AgentForwarding.ts__tests__/publickey/SSHAgentProtocol.ts, __tests__/publickey/SSHAgentManagement.ts, __tests__/publickey/SSHAgent.ts, __tests__/publickey/SSHAgentTokenInterop.ts, __tests__/integration/AgentForwarding.ts, __tests__/openssh/OpenSSH.ts, __tests__/openssh/MLKEM.tsFixed frames, fragmentation, bounds, abortable and bounded async policy, cross-stream ordering, late-state suppression, lifecycle, real agent listing/signing, constrained SoftHSM token loading/signing/removal, compatibility-name forwarding, and standard query, agent-req, and agent-connect interoperability with OpenSSH 10.4p1 are covered.

Supporting specifications

The SSH implementations above also have primitive evidence from RFC 1950 (zlib), RFC 2144 (CAST-128), RFC 2202 and RFC 4231 (HMAC), RFC 2286 (HMAC-RIPEMD160), RFC 2409 (Oakley Group 2), RFC 3447 (RSA), RFC 3526 (MODP groups), RFC 5903 (NIST ECDH), RFC 7748 (X25519/X448), RFC 8032 (EdDSA), and RFC 8439 (ChaCha20/Poly1305). These documents support algorithm tests but do not define separate public SSH protocol surfaces. See __tests__/transport/Compression.ts, __tests__/transport/MAC.ts, __tests__/transport/FixedGroups.ts, __tests__/transport/ECDH.ts, __tests__/transport/Curve25519.ts, __tests__/transport/Curve448.ts, __tests__/utils/Ed25519.ts, __tests__/utils/Ed448.ts, and __tests__/utils/ChaCha20.ts.

Non-RFC protocol documents

Primary documentImplemented surfaceEvidenceStatus and limits
draft-ietf-secsh-filexfer-02 and the deployed-v3 restatement draft-spaghetti-sshm-filexfer-00SFTP version 3 client/server, streams, attributes, request ordering, and extensions under src/sftp/__tests__/sftp/CodecVectors.ts, __tests__/sftp/OpenSSHExtensionVectors.ts, __tests__/sftp/SFTPClient.ts, __tests__/sftp/SFTPServer.ts, __tests__/integration/SFTPServerConcurrency.ts, __tests__/integration/SFTPTimeouts.ts, __tests__/integration/Handshake.ts, __tests__/openssh/OpenSSH.tsLiteral baseline and extension frames, negotiated server limits, count- and byte-bounded cancellable requests, fatal semantic-response and status-context validation, bidirectional issued-handle validity and type checks, same-resource ordering, and both OpenSSH peer roles are covered. Distinct wire paths that alias the same backend object still require an application-owned backend lock.
draft-dbider-sha2-mac-for-ssh-05Historical hmac-sha2-256-96 and hmac-sha2-512-96 compatibility names in src/algorithms/mac/__tests__/transport/MAC.ts, __tests__/transport/AlgorithmNegotiation.ts, __tests__/integration/TruncatedSHA2MAC.tsRFC 4231-derived tags, explicit-only negotiation, encrypted traffic, and rekey are covered. The final RFC 6668 and IANA registry omit these names, so they remain outside defaults.
draft-ietf-sshm-strict-kex-01Strict key exchange markers, initial-exchange restrictions, sequence reset, and duplicate rejection in src/StrictKeyExchange.ts and the transport state machine__tests__/transport/StrictKeyExchange.ts and encrypted handshake/phase testsStandard and deployed marker names and both roles are covered.
draft-ietf-sshm-chacha20-poly1305-04 and PROTOCOL.chacha20poly1305Standard chacha20-poly1305 and its wire-identical deployed alias in src/algorithms/encryption/chacha20-poly1305-openssh.ts__tests__/utils/ChaCha20.ts, __tests__/transport/ChaCha20Poly1305.ts, __tests__/integration/ChaCha20Poly1305.ts, __tests__/openssh/OpenSSH.tsRFC 8439 primitive vectors, the draft's published SSH packet, both names, both peer roles, traffic, rekey, and deployed-name OpenSSH interoperability are covered.
draft-ietf-sshm-cert-01Standard certificate key formats, roles, principals, validity, options, signatures, host/user authentication, restriction enforcement, and private-certificate agent encoding through src/utils/PublicKey.ts, src/utils/PrivateKey.ts, and both connection roles__tests__/utils/CertificateKey.ts, __tests__/utils/UserCertificateAuthorization.ts, __tests__/publickey/SSHAgentManagement.ts, __tests__/integration/CertificateAuthentication.ts, __tests__/integration/CertificateHostAuthentication.ts, __tests__/integration/UserCertificateAuthorization.ts, and __tests__/openssh/CertificateAuthentication.tsPublished fields and independent vectors verify the encoding. Encrypted tests cover deny-by-default feature permissions, source restrictions, forced commands, security-key assertions, multi-factor composition, and explicit application enforcement of vendor critical options. Standard names remain explicit-only until registered.
draft-ietf-sshm-hostkey-update-00Version-0 extension negotiation, configurable standard and compatibility advertisements, session-bound possession proofs, and RSA proof selection in both connection roles__tests__/transport/HostKeysProof.ts, __tests__/integration/HostKeyUpdate.ts, __tests__/integration/Authentication.ts, __tests__/openssh/OpenSSH.tsFixed standard and compatibility proof preimages, production-path encrypted standard flows, strict bounds and uniqueness, RSA-SHA2 binding, RSA-SHA1 refusal, and compatibility interoperability are covered. The protocol body defines request hostkeys-prove and signed domain hostkeys-prove-0; the inconsistent IANA-table request entry is not used as wire authority.
draft-ssh-global-requests-ok-00Empty global-requests-ok advertisements and narrow peer-capability accessors in both connection roles__tests__/packets/ExtInfo.ts, __tests__/integration/Handshake.ts, __tests__/integration/Authentication.ts, __tests__/interop/AsyncSSH.tsA fixed frame, encrypted bidirectional advertisements, opaque future values, replacement-set clearing, traffic, rekey, and an independent peer in both roles are covered. The extension does not relax the post-authentication phase boundary or authorize application requests.
PROTOCOL.opensshEncrypt-then-MAC, certificates, ping, end-of-write, no-more-sessions, stream-local forwarding, SIGINFO, host-key rotation, host-bound authentication, and documented SFTP extensionsFocused packet/transport/integration suites, __tests__/sftp/OpenSSHExtensionVectors.ts, __tests__/sftp/SFTPClient.ts, and __tests__/openssh/OpenSSH.tsImplemented extensions have fixed or integration evidence indexed in interoperability.md. SFTP helpers strictly decode published request layouts, enforce positional identity-reply cardinality, and encode exact filesystem and identity replies; a real system client exercises seven negotiated extensions against the server role. The separate connection-multiplex control protocol is outside the current implementation.
PROTOCOL.krlBinary key and certificate revocation lists in src/KeyRevocationList.ts__tests__/utils/KeyRevocationList.ts, __tests__/package/Exports.tsFixed SHA-256 and consecutive Ed25519 signature sections plus system-generated explicit-key, serial, range, bitmap, key-ID, embedded-key, and authority revocations are covered. Critical extensions, invalid signatures, and malformed inputs fail closed.
PROTOCOL.sshsig and the allowed-signers formatNamespace-bound detached signature creation, agent signing, armor, parsing, cryptographic verification, signer authorization, and principal lookup in src/SSHSignature.ts and src/AllowedSigners.ts__tests__/utils/SSHSignature.ts, __tests__/utils/AllowedSigners.ts, __tests__/package/Exports.tsA fixed cryptographic blob, malformed framing, ownership, both hashes, RSA-SHA2, awaited agents, byte-oriented principal/namespace patterns, validity, CA certificates, revocation, package use, and bidirectional signing, verification, and principal-lookup interoperability are covered.
PROTOCOL.u2fP-256 and Ed25519 security-key identities, certificates, raw/WebAuthn signatures, private key handles, v00/v01 attestation records, and agent provider constraints in src/__tests__/utils/SecurityKey.ts, __tests__/utils/SecurityKeyPrivateKey.ts, __tests__/utils/SecurityKeyAttestation.ts, __tests__/publickey/SecurityKeyAgent.ts, __tests__/integration/SecurityKeyAuthentication.tsFixed signed values, negative verification, containers, opaque attestation records, agent handling, and authentication are covered. Direct hardware enrollment is outside the library; authentication.md documents that provider boundary.
draft-ietf-sshm-mlkem-hybrid-kex-10 and draft-harrison-sshm-mlkem-02Registered hybrid and standalone ML-KEM key exchanges in src/algorithms/kex/mlkem-hybrid.ts and src/algorithms/kex/mlkem.ts__tests__/transport/MLKEM.ts, __tests__/transport/MLKEMStandalone.ts, matching encrypted integration suites, __tests__/openssh/MLKEM.ts, and __tests__/interop/AsyncSSH.tsNIST ACVP-derived data, exact sizes, malformed values, implicit rejection, both roles, and rekey are covered. Pinned peers cover the X25519, NIST P-256, and NIST P-384 hybrids and all three standalone methods in both roles.

RFC 8758 prohibits all three RC4 SSH names. __tests__/transport/RFC8758.ts keeps them out of the production and default catalogs and verifies that explicit client configuration cannot enable them. RFC 9519 changes IANA registration policy only and therefore requires no wire implementation. RFCs present in ../rfcs but used solely as primitive dependencies are covered by the supporting-specification paragraph above rather than duplicated in the protocol tables.

Open evidence work

The remaining evidence gaps are therefore bounded and explicit:

  1. Add independent-peer or system-provider coverage for GSS-API when a capable fixture is available.

On this page