Supported Key Exchange Algorithms
Key exchange (KEX) algorithms establish the shared secret used to derive encryption keys for the SSH session. ZestSSH’s SSH engine (zest_ssh_core) supports the algorithms below.
ZestSSH offers a modern-only set by default, with the two post-quantum hybrids first. A per-connection Compatibility mode toggle adds the SHA-1 group variants for older or hardened servers. Within each list, algorithms are offered in ZestSSH’s preference order (most preferred first).
Offered by Default
Section titled “Offered by Default”| Algorithm | Type | Hash |
|---|---|---|
mlkem768x25519-sha256 | Post-quantum hybrid (ML-KEM-768 + Curve25519) | SHA-256 |
sntrup761x25519-sha512 | Post-quantum hybrid (sntrup761 + Curve25519) | SHA-512 |
[email protected] | Same exchange, original OpenSSH name | SHA-512 |
[email protected] | ECDH (Curve25519) | SHA-256 |
curve25519-sha256 | ECDH (Curve25519), RFC 8731 name | SHA-256 |
ecdh-sha2-nistp521 | ECDH (NIST P-521) | SHA-512 |
ecdh-sha2-nistp384 | ECDH (NIST P-384) | SHA-384 |
ecdh-sha2-nistp256 | ECDH (NIST P-256) | SHA-256 |
diffie-hellman-group-exchange-sha256 | DH group exchange | SHA-256 |
diffie-hellman-group14-sha256 | Fixed-group DH (2048-bit) | SHA-256 |
Post-Quantum Hybrids
Section titled “Post-Quantum Hybrids”Both hybrids pair a post-quantum key encapsulation mechanism (KEM) with the classic Curve25519 exchange in one handshake. The session secret is a hash of the two secrets together, so the session is only as weak as the stronger of the two: a future quantum computer that breaks Curve25519 still faces the KEM, and any weakness found in the newer KEM leaves the Curve25519 protection intact. This is what protects a session against “harvest now, decrypt later”, where traffic recorded today is decrypted years from now.
A server that does not list either hybrid simply negotiates one of the classic exchanges below. Nothing about the offer weakens the fallback, and every KEM key pair is created for one handshake and thrown away with it.
When a hybrid was used, the session details (the info panel on the right of a desktop session) show a Post-quantum badge on the Key exchange row.
mlkem768x25519-sha256
Section titled “mlkem768x25519-sha256”| Property | Value |
|---|---|
| Type | Hybrid: ML-KEM-768 (FIPS 203) + Curve25519 |
| Hash | SHA-256 |
| Servers | OpenSSH 9.9 and later (the OpenSSH 10 default) |
The NIST-standardised post-quantum KEM (ML-KEM, formerly Kyber) at its 768 parameter set, combined with X25519. ZestSSH’s implementation is checked against the NIST FIPS 203 known-answer vectors and was verified end to end against an OpenSSH 10.2 server. This is the exchange a current Debian, Fedora or Ubuntu 25.04+ server picks.
sntrup761x25519-sha512
Section titled “sntrup761x25519-sha512”| Property | Value |
|---|---|
| Type | Hybrid: Streamlined NTRU Prime 761 + Curve25519 |
| Hash | SHA-512 |
| Servers | OpenSSH 9.0 and later (the default from 9.0 to 9.8; offered since 8.5 under the @openssh.com name) |
The post-quantum exchange OpenSSH shipped first, and the one an Ubuntu 22.04 (OpenSSH 8.9, opt-in) or Ubuntu 24.04 (OpenSSH 9.6, default) server negotiates. ZestSSH’s implementation is a port of the same public-domain reference code OpenSSH uses. Both spellings are offered so that servers of either vintage match.
Classic Exchanges
Section titled “Classic Exchanges”[email protected] and curve25519-sha256
Section titled “[email protected] and curve25519-sha256”| Property | Value |
|---|---|
| Type | Elliptic Curve Diffie-Hellman |
| Curve | Curve25519 |
| Hash | SHA-256 |
The classic default. Curve25519 is a modern elliptic curve designed for speed, security, and resistance to side-channel attacks. It provides ~128 bits of security with a fast, constant-time implementation, and is the most widely deployed classic KEX in modern SSH servers (OpenSSH 6.5+). curve25519-sha256 is the standardised (RFC 8731) name of the same exchange; ZestSSH offers both.
ecdh-sha2-nistp256
Section titled “ecdh-sha2-nistp256”| Property | Value |
|---|---|
| Type | Elliptic Curve Diffie-Hellman |
| Curve | NIST P-256 (secp256r1) |
| Hash | SHA-256 |
ECDH with the NIST P-256 curve. ~128 bits of security. Widely supported, including on FIPS-compliant systems where Curve25519 may not be available.
ecdh-sha2-nistp384
Section titled “ecdh-sha2-nistp384”| Property | Value |
|---|---|
| Type | Elliptic Curve Diffie-Hellman |
| Curve | NIST P-384 (secp384r1) |
| Hash | SHA-384 |
ECDH with the NIST P-384 curve. ~192 bits of security.
ecdh-sha2-nistp521
Section titled “ecdh-sha2-nistp521”| Property | Value |
|---|---|
| Type | Elliptic Curve Diffie-Hellman |
| Curve | NIST P-521 (secp521r1) |
| Hash | SHA-512 |
ECDH with the NIST P-521 curve. ~256 bits of security. Slightly slower than P-256 due to the larger curve.
diffie-hellman-group-exchange-sha256
Section titled “diffie-hellman-group-exchange-sha256”| Property | Value |
|---|---|
| Type | Diffie-Hellman Group Exchange |
| Hash | SHA-256 |
| Group Exchange | Yes |
The server selects a DH group of an appropriate size (typically 2048-8192 bits). Provides flexibility for high-security environments. Group exchange negotiation adds a round trip to the handshake. OpenSSH 10 no longer offers finite-field DH by default on the server side, so this mostly matters for older or non-OpenSSH servers.
diffie-hellman-group14-sha256
Section titled “diffie-hellman-group14-sha256”| Property | Value |
|---|---|
| Type | Fixed-Group Diffie-Hellman |
| Group | Group 14 (2048-bit) |
| Hash | SHA-256 |
Fixed 2048-bit DH group with SHA-256. Good compatibility with servers that support RFC 4253 but not elliptic-curve algorithms.
Compatibility Mode
Section titled “Compatibility Mode”These SHA-1 variants are only offered when a connection has Compatibility mode enabled. SHA-1 is deprecated for collision resistance but is not directly exploitable in the KEX exchange-hash context; they exist for older servers. Compatibility mode only appends them: the post-quantum hybrids and the modern set stay first in the offer.
diffie-hellman-group14-sha1
Section titled “diffie-hellman-group14-sha1”| Property | Value |
|---|---|
| Type | Fixed-Group Diffie-Hellman |
| Group | Group 14 (2048-bit) |
| Hash | SHA-1 |
Fixed 2048-bit DH group with SHA-1. A widely supported baseline, less preferred than the SHA-256 variant.
diffie-hellman-group-exchange-sha1
Section titled “diffie-hellman-group-exchange-sha1”| Property | Value |
|---|---|
| Type | Diffie-Hellman Group Exchange |
| Hash | SHA-1 |
| Group Exchange | Yes |
Group exchange using SHA-1 for the exchange hash. Included for compatibility with older servers.
Not Offered
Section titled “Not Offered”diffie-hellman-group1-sha1 (Group 1, 1024-bit DH with SHA-1) is not offered, even in Compatibility mode. 1024-bit DH is considered weak against well-funded adversaries, and Group 14 (2048-bit) is universally supported by anything speaking SSH-2, so Group 1 buys no real compatibility. Modern OpenSSH also disables it by default.
Recommendation
Section titled “Recommendation”You do not need to choose: ZestSSH offers the post-quantum hybrids first and the server picks the best exchange it supports. Against OpenSSH 9.9 or later that is mlkem768x25519-sha256; against OpenSSH 9.0 to 9.8 it is sntrup761x25519-sha512; older servers fall back to [email protected]. On FIPS-compliant systems the server will typically select ecdh-sha2-nistp256 or ecdh-sha2-nistp384. For legacy servers, diffie-hellman-group14-sha256 provides acceptable security with wide compatibility; enable Compatibility mode only if the server needs the SHA-1 variants.
Negotiation
Section titled “Negotiation”ZestSSH presents its KEX algorithms to the server in preference order. The first algorithm supported by both sides is used. If negotiation fails (no common algorithm), the connection is rejected. Try enabling Compatibility mode.
To check which KEX algorithms a server supports:
ssh -Q kex # on the serverTo see which one a session negotiated, open the session details panel: the Key exchange row names it, with a Post-quantum badge when a hybrid was used.