tomaswolf commented on issue #903: URL: https://github.com/apache/mina-sshd/issues/903#issuecomment-5277670533
> In terms of security, it is required that everything be hidden; otherwise, it may expose the risk of the SSH version. This is nonsense and not doable. The SSH protocol includes initial plaintext messages at the beginning before an encryption is negotiated, and as part of that this identification string is exchanged, and it _must_ start with "SSH-2.0-". See [RFC 4253, section 4.2](https://datatracker.ietf.org/doc/html/rfc4253#section-4.2) This is not a security issue and other protocols also do so. For instance, the initial message in a TLS handshake is also unencrypted and also includes the TLS version. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
