Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

OpenSSH 6.2 offers the following key exchange algorithms by default


The group size of the first three is obvious. The same holds for the last two. But it's unclear which group the two algorithms


operate on. It's hard to accept that such an important point of security is undocumented. The RFC 4419 says nothing about it and so does the manpage of openSSH. Can someone put some light on this please?

share|improve this question

migrated from Jul 26 '13 at 14:22

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems.

I'd guess that this depends on the implementations. I'm not familiar with SSH, but with many protocols one of the two end points chooses a group. – CodesInChaos Jul 26 '13 at 14:27
up vote 4 down vote accepted

A DH group is defined by a prime modulus and a generator. The prime modulus is a bit expensive to generate, so OpenSSH will not do that on a general basis. Instead, sshd will, upon receiving a connection, use one of the groups in the /etc/ssh/moduli files. That file contains pre-generated moduli of various sizes. You can use the one provided with OpenSSH, or generate your own with ssh-keygen; see the man page (there is no security issue in using the same group as other people, but nevertheless, for some psychological reason, some sysadmins experience a feeling of higher security when they generate their own moduli).

The actual selection process is, in OpenSSH source code, in the choose_dh() function in the dh.c file. Roughly speaking, if the client wants at least min bits, at most max bits, and preferably n bits, then the server will choose among the moduli in the min..max range; it will try to get the smallest modulus which exceeds n, and, if there is none, the biggest modulus it has (still in the min..max range, of course). If the server finds several modulus of the same "optimal" length, then it selects one randomly. If the server knows of no modulus in the min..max range, then connection fails.

The default /etc/ssh/moduli, at least on my server, appears to have moduli of size 1023 to 8191 bits.

share|improve this answer
Are the min and max bits configurable? – Siyuan Ren May 25 '15 at 16:41
@SiyuanRen You can simply remove the entries you do not want to be used from /etc/ssh/moduli. – fr00tyl00p Jun 20 '15 at 13:00
@fr00tyl00p That is only on the server side, right? – Siyuan Ren Jun 20 '15 at 15:07
@SiyuanRen The documentation says it's the "system wide" moduli database. So maybe this also restricts moduli the client uses. But I'm not sure about this. – fr00tyl00p Jun 21 '15 at 11:35

From the RFC4419:

The client requests a modulus from the server indicating the
preferred size. In the following description (C is the client, S is
the server, the modulus p is a large safe prime, and g is a generator for a subgroup of GF(p), min is the minimal size of p in bits that is acceptable to the client, n is the size of the modulus p in bits that the client would like to receive from the server, max is the maximal
size of p in bits that the client can accept, V_S is S's version
string, V_C is C's version string, K_S is S's public host key, I_C is C's KEXINIT message, and I_S is S's KEXINIT message that has been
exchanged before this part begins):

  1. C sends "min || n || max" to S, indicating the minimal acceptable group size, the preferred size of the group, and the maximal group size in bits the client will accept.

  2. S finds a group that best matches the client's request, and sends "p || g" to C.

  3. C generates a random number x, where 1 < x < (p-1)/2. It computes e = g^x mod p, and sends "e" to S.

So the client asks for the key to be between a minimum and a maximum and the server decides which of his groups matches.

share|improve this answer
Ok. But this does not answer the question about which min and max openssh uses. – fr00tyl00p Jul 26 '13 at 15:28
Thomas has answered that with 1023 to 8191 bits and on FreeBSD the same is standard. – Raphael Ahrens Jul 26 '13 at 17:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.