Find out the least insecure mutual cipher algorithm

Question

I have set the cipher algorithms for ssh on my server to just [email protected], [email protected] and [email protected]

Now my IntelliJ fails with this error:

failed: unable to reach a settlement: [aes128-cbc, aes128-ctr, aes192-cbc, aes192-ctr, aes256-cbc, aes256-ctr, blowfish-cbc, blowfish-ctr, cast128-cbc, cast128-ctr, idea-cbc, idea-ctr, serpent128-cbc, serpent128-ctr, serpent192-cbc, serpent192-ctr, serpent256-cbc, serpent256-ctr, 3des-cbc, 3des-ctr, twofish128-cbc, twofish128-ctr, twofish192-cbc, twofish192-ctr, twofish256-cbc, twofish256-ctr, twofish-cbc, arcfour, arcfour128, arcfour256] and [[email protected], [email protected], [email protected]]

So I will have to enable one of the ciphers that IntelliJ uses, but how do I find out which of this list is the least insecure?

aes128-cbc, aes128-ctr, aes192-cbc, aes192-ctr, aes256-cbc, aes256-ctr, blowfish-cbc, blowfish-ctr, cast128-cbc, cast128-ctr, idea-cbc, idea-ctr, serpent128-cbc, serpent128-ctr, serpent192-cbc, serpent192-ctr, serpent256-cbc, serpent256-ctr, 3des-cbc, 3des-ctr, twofish128-cbc, twofish128-ctr, twofish192-cbc, twofish192-ctr, twofish256-cbc, twofish256-ctr, twofish-cbc, arcfour, arcfour128, arcfour256

---

Update: I guess, that would be aes256-ctr, but that is just a guess

Answer 1

Yes, aes256-ctr is the right cipher to choose from those available to you.

Since it's not an AEAD, you need to choose a MAC. You should choose an '-etm' one if you can, and among those I'd choose the fastest.

Also make sure you have a strong key exchange (in descending order of preference: curve25519, ecdh-sha2-nistp256, diffie-hellman-group18/16/14, not something with sha1) and strong host key (in descending order of preference: ed25519, ecdsa with nistp256, RSA, nothing with sha1 or DSS).

If IntelliJ doesn't support a secure ssh configuration, complain to JetBrains.