OpenSSH

🚧 UNDER CONSTRUCTION 🚧

This page is mostly about OpenSSH's various cryptographic algorithms and primitives.

OpenSSH: Post-Quantum Cryptography

• Introduced in OpenSSH 9.9
• "New default scheme in OpenSSH 10.0 (April 2025)"
• "Is guaranteed to be no less strong than the popular curve25519-sha256 algorithm"
• PQ

OpenSSH 10.0:

sshd(8): this release disables finite field (a.k.a modp) Diffie-Hellman key exchange in sshd by default. Specifically, this removes the "diffie-hellman-group*" and "diffie-hellman-group-exchange-*" methods from the default KEXAlgorithms list. The client is unchanged and continues to support these methods by default. Finite field Diffie Hellman is slow and computationally expensive for the same security level as Elliptic Curve DH or PQ key agreement while offering no redeeming advantages. ECDH has been specified for the SSH protocol for 15 years and some form of ECDH has been the default key exchange in OpenSSH for the last 14 years.

OpenSSH 7.4 (New Features):

sshd(8), ssh(1): Support the "curve25519-sha256" key exchange method. This is identical to the currently-supported method named "curve25519-sha256@libssh.org".

OpenSSH 8.5:

ssh(1), sshd(8): this release changes the first-preference signature algorithm from ECDSA to ED25519.

OpenSSH 8.8:

This release disables RSA signatures using the SHA-1 hash algorithm by default. This change has been made as the SHA-1 hash algorithm is cryptographically broken, and it is possible to create chosen-prefix hash collisions for <USD50ドルK [1]

[1] "SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust" Leurent, G and Peyrin, T (2020) https://eprint.iacr.org/2020/014.pdf