SSH Public Key / Host Key - Can Client Request Key Length?

Question

In SSH, does the client have any power in determining the key size of the host key, or is it completely dependent on what the servers host key is?

For instance, say the client and server agree on using ssh-rsa or ssh-dss. Is the connection automatically secured with the key size of the SSH server?

Is it possible for the client to disconnect if the servers public key is ssh-rsa 1024-bit, but the client needs ssh-rsa 2048 - bit?

Or does the client not have any power besides negotiating what host key algorithm is used?

Answer 1

For RSA and 'dss' hostkey pkalgs yes the server uses whatever key size it has; in general a client can fail the handshake if it considers the hostkey too small or otherwise cryptographically unsatisfactory, although I don't know any that does. (Whereas of course most do reject a hostkey that mismatches the pre-configured or previously-accepted one.) For ecdsa-$hash-$curve ssh-ed25519 ssh-ed448 the size (and other curve parameters) are fixed by the registered name, and the client can negotiate for only some -- although all are at least roughly 128-bit strength, which NIST considers adequate beyond 2030 (although this will almost certainly change if quantum happens) whereas RSA and DSA 2048 are rated at only 112-bit strength and you need 3072 for 128-bit strength.

'Secure[d]' normally includes both confidentiality and integrity/authenticity, and of course (in v2) the hostkey is only for authentication. For 'kex' (key exchange) for confidentiality, the client can specify named DH groups (of known sizes) or 'group exchange' (DHGEX) with minimum, preferred and maximum bitsize, or specific curves for ECDH (including the Bernstein X-only variant).