Supported Key Exchange Algorithms
Key exchange (KEX) algorithms establish the shared secret used to derive encryption keys for the SSH session. ZestSSH’s SSH engine (zest_ssh_core) supports the algorithms below.
ZestSSH offers a modern-only set by default. A per-connection Compatibility mode toggle adds the SHA-1 group variants for older or hardened servers. Within each list, algorithms are offered in ZestSSH’s preference order (most preferred first).
Offered by Default
Section titled “Offered by Default”| Algorithm | Type | Hash |
|---|---|---|
[email protected] | ECDH (Curve25519) | SHA-256 |
ecdh-sha2-nistp521 | ECDH (NIST P-521) | SHA-512 |
ecdh-sha2-nistp384 | ECDH (NIST P-384) | SHA-384 |
ecdh-sha2-nistp256 | ECDH (NIST P-256) | SHA-256 |
diffie-hellman-group-exchange-sha256 | DH group exchange | SHA-256 |
diffie-hellman-group14-sha256 | Fixed-group DH (2048-bit) | SHA-256 |
| Property | Value |
|---|---|
| Type | Elliptic Curve Diffie-Hellman |
| Curve | Curve25519 |
| Hash | SHA-256 |
The recommended default. Curve25519 is a modern elliptic curve designed for speed, security, and resistance to side-channel attacks. It provides ~128 bits of security with a fast, constant-time implementation, and is the most widely deployed KEX in modern SSH servers (OpenSSH 6.5+).
ecdh-sha2-nistp256
Section titled “ecdh-sha2-nistp256”| Property | Value |
|---|---|
| Type | Elliptic Curve Diffie-Hellman |
| Curve | NIST P-256 (secp256r1) |
| Hash | SHA-256 |
ECDH with the NIST P-256 curve. ~128 bits of security. Widely supported, including on FIPS-compliant systems where Curve25519 may not be available.
ecdh-sha2-nistp384
Section titled “ecdh-sha2-nistp384”| Property | Value |
|---|---|
| Type | Elliptic Curve Diffie-Hellman |
| Curve | NIST P-384 (secp384r1) |
| Hash | SHA-384 |
ECDH with the NIST P-384 curve. ~192 bits of security.
ecdh-sha2-nistp521
Section titled “ecdh-sha2-nistp521”| Property | Value |
|---|---|
| Type | Elliptic Curve Diffie-Hellman |
| Curve | NIST P-521 (secp521r1) |
| Hash | SHA-512 |
ECDH with the NIST P-521 curve. ~256 bits of security. Slightly slower than P-256 due to the larger curve.
diffie-hellman-group-exchange-sha256
Section titled “diffie-hellman-group-exchange-sha256”| Property | Value |
|---|---|
| Type | Diffie-Hellman Group Exchange |
| Hash | SHA-256 |
| Group Exchange | Yes |
The server selects a DH group of an appropriate size (typically 2048-8192 bits). Provides flexibility for high-security environments. Group exchange negotiation adds a round trip to the handshake.
diffie-hellman-group14-sha256
Section titled “diffie-hellman-group14-sha256”| Property | Value |
|---|---|
| Type | Fixed-Group Diffie-Hellman |
| Group | Group 14 (2048-bit) |
| Hash | SHA-256 |
Fixed 2048-bit DH group with SHA-256. Good compatibility with servers that support RFC 4253 but not elliptic-curve algorithms.
Compatibility Mode
Section titled “Compatibility Mode”These SHA-1 variants are only offered when a connection has Compatibility mode enabled. SHA-1 is deprecated for collision resistance but is not directly exploitable in the KEX exchange-hash context; they exist for older servers.
diffie-hellman-group14-sha1
Section titled “diffie-hellman-group14-sha1”| Property | Value |
|---|---|
| Type | Fixed-Group Diffie-Hellman |
| Group | Group 14 (2048-bit) |
| Hash | SHA-1 |
Fixed 2048-bit DH group with SHA-1. A widely supported baseline, less preferred than the SHA-256 variant.
diffie-hellman-group-exchange-sha1
Section titled “diffie-hellman-group-exchange-sha1”| Property | Value |
|---|---|
| Type | Diffie-Hellman Group Exchange |
| Hash | SHA-1 |
| Group Exchange | Yes |
Group exchange using SHA-1 for the exchange hash. Included for compatibility with older servers.
Not Offered
Section titled “Not Offered”diffie-hellman-group1-sha1 (Group 1, 1024-bit DH with SHA-1) is not offered, even in Compatibility mode. 1024-bit DH is considered weak against well-funded adversaries, and Group 14 (2048-bit) is universally supported by anything speaking SSH-2, so Group 1 buys no real compatibility. Modern OpenSSH also disables it by default.
Recommendation
Section titled “Recommendation”For most connections, [email protected] is the best choice — fast, secure, and supported by virtually all modern SSH servers. On FIPS-compliant systems, use ecdh-sha2-nistp256 or ecdh-sha2-nistp384. For legacy servers, diffie-hellman-group14-sha256 provides acceptable security with wide compatibility; enable Compatibility mode only if the server needs the SHA-1 variants.
Negotiation
Section titled “Negotiation”ZestSSH presents its KEX algorithms to the server in preference order. The first algorithm supported by both sides is used. If negotiation fails (no common algorithm), the connection is rejected — try enabling Compatibility mode.
To check which KEX algorithms a server supports:
ssh -Q kex # on the server