Niels suggested: > ssh://user at host.example.com?fingerprint=ssh-dss-c1b13029d7b8de6c977710d746416387 I like that proposal because I think the separator characters in the fingerprint (such as '-' or ':') are superfluous, unnecessary, redundant. :) I suggest the following variation - wrapped for clarity: ssh://user at host.example.com ?fp-md5-ssh-dss=c1b13029d7b8de6c977710d746416387 &fp-sha1-ssh-rsa=0c112b31435062798d7b8de6c977710d746416387 Nice, short, and to the point. Everything after "fp-" and before the second dash is the hash algorithm. Everything after the second dash is the host key algorithm. This allows more freedom for the host key algorithm than the hash. I expect it's more likely that important use cases will require unusual host key algorithms (e.g. certificates, eliptic curves) than that they will require unexpected hashes. I suppose you need the "ssh-dss" or "ssh-rsa" part so that you can pick the right algorithm(s) for host key negotiation. denis
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.