Is the OpenSSH server using a fallback, hard-coded DH parameter for 2048bits?

Question

I'm toying around with OpenSSH configs and poking at the Diffie-Hellman parameters. I'm using GDSSecurity's tool to check DH settings and this page to view other SSH settings.

For funsies, I removed all moduli smaller than 4096 bits from /etc/ssh/moduli:

$ awk '{print $5}' /etc/ssh/moduli | sort | uniq
4095
6143
8191

I'd expect that the key-exchange should fail if the client accepts only 2048 bit or 3072 bit groups. Interestingly, it does fail in the latter case, but does not in the former, 2048 bit case.

KEX proposal client: diffie-hellman-group-exchange-sha256
KEX proposal server: [email protected],diffie-hellman-group-exchange-sha256
KEX algorithm chosen: diffie-hellman-group-exchange-sha256
KEX client group sizes: min = 2048, nbits = 2048, max = 2048
KEX server-chosen group size in bits: 2048
Warning: Permanently added 'test,x.x.x.x' (ED25519) to the list of known hosts.
KEX proposal client: diffie-hellman-group-exchange-sha256
KEX proposal server: [email protected],diffie-hellman-group-exchange-sha256
KEX algorithm chosen: diffie-hellman-group-exchange-sha256
KEX client group sizes: min = 3072, nbits = 3072, max = 3072
ssh_dispatch_run_fatal: Connection to x.x.x.x: DH GEX group out of range

The aforementioned site also claims a successful key exchange using a 2048 bit group.

I know too little about the details of neither the SSH protocol or OpenSSH to understand what's going on here. Does OpenSSH use a fallback parameter if no appropriate group is available from the moduli file?

Answer 1

Fallback DH groups are defined in source code here. The current group can be 2k or 4k. But it really depends on which version are you using (there were some changes recently).

Note the RFC 4419, which specifies:

Servers and clients SHOULD support groups with a modulus length of k bits, where 1024 <= k <= 8192. The recommended values for min and max are 1024 and 8192, respectively.

And the recent release notes for future openssh-7.2:

• ssh(1), sshd(8): increase the minimum modulus size supported for diffie-hellman-group-exchange to 2048 bits.