Summary

  • Tatu Ylonen later recalled that a password-sniffing attack on a Finnish university network captured thousands of credentials, including some from his company; the surviving evidence for the incident is his account, not an independent incident log.
  • In July 1995, SSH moved through distinct steps: beta testing, IANA’s assignment of port 22, a public source release, and a protocol draft months later. None alone proves universal deployment or standards approval.

In an interview first published in February 2001 and updated in April 2002, Tatu Ylonen recalled that he wanted to log into company and university servers without fearing that someone on the network could capture his password. He said the sniffer database contained several thousand username-password pairs, including credentials from his company. The source set has no independent incident log that identifies the attacker, fixes the intrusion date or verifies the count; this is the developer’s retrospective account, not a forensic report.

The first visible response was a program, not a standards committee. Ylonen later dated his initial work to spring 1995. Before release, he asked the Internet Assigned Numbers Authority for a privileged service port. In the request reproduced on his company’s site, he described a program for securely logging in over an insecure network, said it had already been in local use for months, and noted that his beta used port 22. Joyce Reynolds replied that IANA had assigned that number to ssh. The assignment gave the new service a recognizable point in a shared registry. It did not install clients or servers on other systems.

On 12 July, Ylonen announced SSH 1.0 to the Cypherpunks mailing list and offered source archives for anonymous FTP. The contemporary notice presented the software as a replacement for rlogin, rsh and rcp. It described encrypted communication, RSA-based host authentication, user authentication, X11 forwarding and the ability to carry other TCP connections. Those are the author’s feature claims, not the results of an independent security review. The notice also called the program freely available while warning about patent and export restrictions. “Free” therefore describes the announced distribution terms; it does not mean that every use was free of legal limits or that the licensing would never change.

The sequence was unusually compressed: a private beta, a port request dated 10 July, and a public announcement two days later. It was not yet an Internet standard. On 15 November, Ylonen submitted an individual Internet-Draft describing the protocol. The IETF Datatracker now labels that document expired and states that an individual draft is not endorsed by the IETF and has no formal standing in its standards process. A working program, a registered port, a published draft and a standard were four different things.

Tatu Ylonen later recalled receiving as many as 150 support emails a day by the end of 1995. SSH Communications Security’s 2020 annual report retrospectively dates the company’s formation to 31 December 1995. That corporate record documents a move toward an organization able to maintain the software; it does not establish SSH’s user count or explain adoption.

That distinction became consequential when licensing terms narrowed. OpenBSD’s project history says that, in 1999, developers chose the original SSH 1.2.12 as the last version they could reuse, then removed components with restrictive licensing or patent constraints and continued the work as OpenSSH. The project did not simply inherit an unchanged program: it forked, replaced components and maintained a separate codebase. The surviving OpenSSH license also preserves Ylonen’s permission for his own code while warning that third-party rights and components had separate terms.

SSH’s origin is therefore better described as a chain than a single invention date. A credential incident prompted a researcher to build a substitute; a service number made it addressable; source publication made it obtainable; a later draft documented a protocol; and company and community decisions shaped who could maintain the code. The record does not establish immediate universal adoption, a perfect defense or a single owner of every later SSH implementation.

Sources: Ylonen’s July 1995 SSH 1.0 announcement; Tatu Ylonen’s account of the IANA port-22 exchange; SSH protocol Internet-Draft, 15 November 1995; Tatu Ylonen interview page (published 2001, updated 2002); SSH Communications Security 2020 annual report; OpenSSH project history; OpenSSH licence file preserving component terms.