Supported Ciphers
ZestSSH’s SSH engine (zest_ssh_core) supports the following symmetric encryption algorithms for the SSH transport layer. During the handshake, the client and server negotiate the strongest mutually supported cipher.
ZestSSH offers a modern-only set by default. A per-connection Compatibility mode toggle adds legacy CBC ciphers for older or hardened servers. A few additional ciphers are implemented in the engine but are not part of either negotiation list. Each group is called out below.
Within each list, algorithms are offered in ZestSSH’s preference order (most preferred first).
Offered by Default
Section titled “Offered by Default”| Cipher | Key Size | Mode | AEAD |
|---|---|---|---|
[email protected] | 512-bit (2x256) | Stream + Poly1305 | Yes |
aes256-ctr | 256-bit | CTR | No |
aes128-ctr | 128-bit | CTR | No |
| Property | Value |
|---|---|
| Algorithm | ChaCha20 stream cipher + Poly1305 MAC |
| Key Size | 512 bits (two 256-bit keys) |
| Nonce | 8 bytes (derived from packet sequence number) |
| Tag Size | 16 bytes |
| Block Size | 8 bytes |
| AEAD | Yes |
The recommended cipher and ZestSSH’s first choice. This is an AEAD (Authenticated Encryption with Associated Data) construction: it provides both encryption and integrity in a single operation, so no separate MAC is negotiated. It uses two separate 256-bit keys — one for the packet payload and one for encrypting the packet length separately. Introduced by OpenSSH, it has become the de facto standard for modern SSH.
ChaCha20-Poly1305 is constant-time on all platforms and does not require hardware AES acceleration, making it consistently fast on mobile devices and ARM servers.
aes256-ctr
Section titled “aes256-ctr”| Property | Value |
|---|---|
| Algorithm | AES-256 in Counter Mode |
| Key Size | 256 bits |
| IV Size | 16 bytes |
| Block Size | 16 bytes |
| AEAD | No |
256-bit CTR. Counter mode turns AES into a stream cipher, avoiding the padding oracle issues of CBC. Paired with an HMAC for integrity (see MAC algorithms). ZestSSH prefers the 256-bit key over the 128-bit one when a server offers both.
aes128-ctr
Section titled “aes128-ctr”| Property | Value |
|---|---|
| Algorithm | AES-128 in Counter Mode |
| Key Size | 128 bits |
| IV Size | 16 bytes |
| Block Size | 16 bytes |
| AEAD | No |
128-bit CTR. Widely supported and secure; a strong fallback when a server does not offer ChaCha20-Poly1305 or AES-256-CTR.
Compatibility Mode Ciphers (Legacy)
Section titled “Compatibility Mode Ciphers (Legacy)”These CBC (Cipher Block Chaining) ciphers are only offered when a connection has Compatibility mode enabled. They exist for older OpenSSH builds and appliance/LXC templates that predate CTR/AEAD. Prefer CTR or AEAD whenever the server supports it.
aes256-cbc / aes192-cbc / aes128-cbc
Section titled “aes256-cbc / aes192-cbc / aes128-cbc”| Property | Value |
|---|---|
| Algorithm | AES in Cipher Block Chaining Mode |
| Key Sizes | 256-bit, 192-bit, 128-bit |
| IV Size | 16 bytes |
| Block Size | 16 bytes |
| AEAD | No |
Legacy ciphers. CBC mode is subject to the SSH CBC plaintext-recovery attack (CVE-2008-5161) when not paired with an Encrypt-then-MAC algorithm; exploitation in practice is difficult, but this is why CBC is off by default. Enable Compatibility mode only for servers that genuinely need it.
Implemented but Not Negotiated
Section titled “Implemented but Not Negotiated”The following ciphers are implemented in the engine but are not part of the default or compatibility negotiation lists, so ZestSSH does not currently offer them to servers:
| Cipher | Notes |
|---|---|
[email protected] | AES-256 in Galois/Counter Mode (AEAD). Fully implemented (RFC 5647 framing). |
[email protected] | AES-128 in Galois/Counter Mode (AEAD). Fully implemented. |
aes192-ctr | AES-192 Counter Mode. Implemented; 192-bit keys are rarely required. |
AES-GCM performs well on hardware with AES-NI (most modern x86 CPUs). It is not offered today because ChaCha20-Poly1305 and AES-CTR already cover the modern and fallback cases; on ARM devices without hardware AES, ChaCha20 is typically faster anyway.
Not Supported
Section titled “Not Supported”The following ciphers are intentionally not supported:
| Cipher | Reason |
|---|---|
3des-cbc | Insecure, small block size (64-bit), slow |
arcfour / arcfour128 / arcfour256 | RC4 is cryptographically broken |
blowfish-cbc | 64-bit block size, deprecated |
cast128-cbc | 64-bit block size, deprecated |
none | Disabling encryption entirely is a security risk |
Cipher Negotiation
Section titled “Cipher Negotiation”ZestSSH offers its ciphers to the server in the preference order above; the first cipher supported by both sides is selected. If you cannot connect, check which ciphers the server supports:
ssh -Q cipher # on the serverIf the server only offers legacy CBC ciphers, enable Compatibility mode on the connection. If it offers nothing ZestSSH supports (for example only 3des-cbc), update the server’s SSH configuration to enable at least one modern cipher.