OpenSSH 6.2 offers the following key exchange algorithms by default


The group size of the first three is obvious. The same holds for the last two. But it's unclear which group the two algorithms


operate on. It's hard to accept that such an important point of security is undocumented. The RFC 4419 says nothing about it and so does the manpage of openSSH. Can someone put some light on this please?

  • I'd guess that this depends on the implementations. I'm not familiar with SSH, but with many protocols one of the two end points chooses a group. Commented Jul 26, 2013 at 14:27

1 Answer 1


A DH group is defined by a prime modulus and a generator. The prime modulus is a bit expensive to generate, so OpenSSH will not do that on a general basis. Instead, sshd will, upon receiving a connection, use one of the groups in the /etc/ssh/moduli files. That file contains pre-generated moduli of various sizes. You can use the one provided with OpenSSH, or generate your own with ssh-keygen; see the man page (there is no security issue in using the same group as other people, but nevertheless, for some psychological reason, some sysadmins experience a feeling of higher security when they generate their own moduli).

The actual selection process is, in OpenSSH source code, in the choose_dh() function in the dh.c file. Roughly speaking, if the client wants at least min bits, at most max bits, and preferably n bits, then the server will choose among the moduli in the min..max range; it will try to get the smallest modulus which exceeds n, and, if there is none, the biggest modulus it has (still in the min..max range, of course). If the server finds several modulus of the same "optimal" length, then it selects one randomly. If the server knows of no modulus in the min..max range, then connection fails.

The default /etc/ssh/moduli, at least on my server, appears to have moduli of size 1023 to 8191 bits.

  • Are the min and max bits configurable?
    – Siyuan Ren
    Commented May 25, 2015 at 16:41
  • @SiyuanRen You can simply remove the entries you do not want to be used from /etc/ssh/moduli.
    – fr00tyl00p
    Commented Jun 20, 2015 at 13:00
  • @fr00tyl00p That is only on the server side, right?
    – Siyuan Ren
    Commented Jun 20, 2015 at 15:07
  • @SiyuanRen The documentation says it's the "system wide" moduli database. So maybe this also restricts moduli the client uses. But I'm not sure about this.
    – fr00tyl00p
    Commented Jun 21, 2015 at 11:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .