RFC: PROTOCOL.authrec, a structured authentication record from sshd

[Avinash Duduskar]

On Fri, 7 Aug 2026, Damien Miller wrote:

> As well as a per-auth attempt gate that runs at the start of
> auth2.c:userauth_finish() that can reject an otherwise-successful
> authentication.

Both look inexpensive. A July probe showed AKC holds the satisfied
steps and keys; a userauth_finish gate should also see transport.

> IMO these could be nicer to implement complex authz logic than
> PAM modules.

Much nicer for the gates, which sshd feeds directly. $SSH_USER_AUTH
is user-owned since 7.6 and forgeable.
Happy to prototype a trusted channel; did you have a design in mind?

> I think you could state this more succinctly and idiomatically as:
>  	byte[8]   MAGIC_PREAMBLE
>  	uint32    FORMAT_VERSION
>  	string    contents

Adopted. It also removes the one field a producer had to compute by
hand; sshbuf_put_stringb() writes the bound itself.

> >    methods is an sshbuf carrying one entry per authentication step,
> >    in the order the steps were satisfied:
>
> Only for the authentication that succeeded, right?

Correct, successes and satisfied AuthenticationMethods steps only.
The spec will say so. Failed attempts stay deferred as in 4.1.

> Generally I avoid using counts for structured data and instead prefer
> using a self-delimiting format, e.g.

Adopted. This lets the per-step fields deferred in 4.1 be added
later without a version bump; the flat count grammar could not.

> IMO the credential and certificate blocks are redundant to the key_blob
> here and should be removed for simplicity.

Fair enough, both go.

> I think this should be a `uint32 kex_options` bitfield to make this
> trivially extensible.

Done, bit 0 = strict KEX; other bits zero and ignored if unknown.

One correction of my own: uid and gid are uint32 with no empty
encoding, so a producer without POSIX identities writes four bytes
that read as a real uid, and zero is root. sshd is never bitten.
If the record is OpenSSH-only this is a producer requirement and no
wire change; if it should stay emittable elsewhere it needs an
out-of-band value, and 0xFFFFFFFF has the chown and setreuid
precedent. I will assume OpenSSH-only unless you say otherwise.

> Anyway, it would be good to see a prototype of this.

I will revise the spec first, then send the marshaller and
ExposeAuthInfo=structured patch. The AKC record and the gate patches
follow separately.

Thanks,
Avi