KEX and Host Key Algorithms in SSH
What are KEX and Host Key Algorithms?
KEX is the short form of Key Exchange: The algorithm is chosen to compute the secret encryption key. Examples would be diffie-hellman-group-exchange-sha1' and modern 'ecdh-sha2-nistp512'.
Public_key or Server Host key: The asymmetric encryption algorithm used in the server's private-public host key pair. Examples would be 'ssh-rsa' and elliptic curve 'ecdsa-sha2-nistp521'.
How to find the KEX (Key Exchange) and Host Key Algorithms in SSH?
1. SSH from one linux machine to another in verbose mode to get the detailed process.
root@linux ~]# ssh username@linux_machine_IP -vvv
2. KEX and host key algorithms used to SSH can be found in debug 1 level logs. Refer below example of KEX and host key algorithms.
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
How to change the KEX and host key algorithm on the server machine?
1. Edit sshd_config file and append the below lines with KexAlgorithms and HostKeyAlgorithms.
root@server ~]# vim /etc/ssh/sshd_config
KexAlgorithms diffie-hellman-group16-sha512
HostKeyAlgorithms rsa-sha2-512
2. Restart sshd service to affect the changes made in sshd_config.
root@server ~]# systemctl restart sshd
3. SSH from the client machine to the server machine to view the changed KEX and host key algorithms.
root@linux ~]# ssh username@linux_machine_IP -vvv
debug1: kex: algorithm: diffie-hellman-group16-sha512
debug1: kex: host key algorithm: rsa-sha2-512
How to view the list of KEX and Keys in the Linux server?
- How to list keys in the Linux server?
root@linux ~]# ssh -Q key
ssh-ed25519
[email protected]
ssh-rsa
ssh-dss
ecdsa-sha2-nistp256
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
- How to list KEX in the Linux server?
root@linux ~]# ssh -Q kex
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
curve25519-sha256
[email protected]
Related Articles
DSA key based authentication is not working