Hacker News discussion: RFC 9987: Secure Shell (SSH) Agent Protocol

RFC 9987 is a newly published Internet Standards Track document that formally defines the Secure Shell (SSH) Agent Protocol. It standardizes how SSH clients and servers interact with a key management component (an 'agent') that holds private keys, enabling operations like signing without exposing key material. The protocol supports adding keys with constraints, removing keys, listing keys, signing data, and forwarding agent access over SSH connections. It covers key types including DSA, ECDSA, EdDSA, and RSA, and includes an extension mechanism for vendor-specific messages. Security considerations address agent forwarding risks, token-hosted key security, and brute-force attack countermeasures. This standardization matters because the agent protocol has been widely deployed for years without a formal specification, and the new RFC provides a clear, interoperable foundation for future implementations and improved security.