Key exchange method (KEX)

wikipedia:Key exchange method

• Diffie–Hellman key exchange
• PSK
• Elliptic-curve Diffie–Hellman (ECDH)

OpenSSH changelog

• OpenSSH 9.0 Aug 2022 Use the hybrid Streamlined NTRU Prime + x25519 key exchange method by default
• OpenSSH 8.5 03 March 2021 update/replace the experimental post-quantum hybrid key exchange method

• Added curve25519-sha256@libssh.org key exchange

ssh -V
OpenSSH_8.2p1 Ubuntu-4ubuntu0.2, OpenSSL 1.1.1f  31 Mar 2020
ssh -o PreferredAuthentications=keyboard-interactive -o PubkeyAuthentication=no [email protected]
Unable to negotiate with 10.10.10.2 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 123.123.123.123
ssh_dispatch_run_fatal: Connection to 123.123.123.123 port 22: Invalid key length

Cisco IOS

show ip ssh

KEX Algorithms:diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1

Errors

• kex_exchange_identification: banner line 0: Not allowed at this time

Related terms

• KexAlgorithms directive
• ssh -Q kex

See also

• KEX, KexAlgorithms, Diffie–Hellman, PSK, Elliptic-curve Diffie–Hellman (ECDH), ssh -Q kex
• Public key cryptography, private key, public key, key length, ssh-keygen, ssh-keyscan, ssh-copy-id, Root certificate, KEX, Generate a key
• Post-Quantum Cryptography (PQC), NTRU, Lattice-based cryptography, KexAlgorithms, Mlkem, Qubit