Managing SSH Key Exchange Algorithms: A How-To Guide

By /

SSH (Secure Shell) is the go-to protocol for secure remote login and file transfer over a network. Although it’s designed with security in mind, the security level you get depends on a variety of factors, including the cryptographic algorithms used for the key exchange. In this article, we will look at how to set key exchange algorithms using the SSH command line and configuration files. We’ll also delve into the differences between some recommended and non-recommended algorithms.

SSH Key Exchange Algorithms (KexAlgorithms)

When an SSH connection is established between a client and a server, the two parties need to agree on a symmetric encryption key for securing the communication. This process is called the key exchange and is facilitated by key exchange algorithms, specified in the SSH configuration using the KexAlgorithms option.

How to Set KexAlgorithms via Command Line

When connecting to an SSH server, you can specify the key exchange algorithms directly in the command line using the -o option followed by KexAlgorithms. For example:

ssh -oKexAlgorithms=curve25519-sha256@libssh.org user@hostname

In this example, we specify using curve25519-sha256@libssh.org as our preferred key exchange algorithm.

How to Set KexAlgorithms in SSH Config File

If you find yourself connecting to the same servers often or just want to set default options, editing the SSH client configuration file might be more convenient.

  1. Open your SSH configuration file, usually found at ~/.ssh/config, in a text editor.
  2. Add a new section or find the existing section for your host, then add the KexAlgorithms line:textCopy codeHost example.com KexAlgorithms curve25519-sha256@libssh.org

After saving the file, every new SSH connection to example.com will use the specified key exchange algorithms.

Good vs. Bad KexAlgorithms

Good KexAlgorithms

  • curve25519-sha256@libssh.org: Uses Curve25519 elliptic curve and SHA-256 for hash. This is currently one of the most secure and recommended options.
  • diffie-hellman-group-exchange-sha256: Uses the Diffie-Hellman algorithm with SHA-256 hashing, which is secure and widely supported.

Bad KexAlgorithms

  • diffie-hellman-group1-sha1: Uses SHA-1 hashing, which is considered weak due to vulnerabilities that allow for collision attacks.
  • diffie-hellman-group14-sha1: While it uses a 2048-bit key, it still relies on the SHA-1 hash algorithm, which is not recommended.

Examples

Good Example:

ssh -oKexAlgorithms=curve25519-sha256@libssh.org user@hostname

Bad Example:

ssh -oKexAlgorithms=diffie-hellman-group1-sha1 user@hostname

Remember that using weak algorithms can make your SSH connection susceptible to various types of attacks. Always ensure that both your SSH client and server configurations are up-to-date with the latest security best practices.

Conclusion

Setting the right key exchange algorithms is crucial for SSH security. While you can easily specify these when initiating an SSH connection, a more scalable and long-term approach would be to define them in the SSH configuration files. Always opt for secure, modern algorithms and consult up-to-date security guidelines to ensure that your SSH communications are as secure as possible.

Scroll to Top