7

OpenSSH 6.2 offers the following key exchange algorithms by default

ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group-exchange-sha256
diffie-hellman-group-exchange-sha1
diffie-hellman-group14-sha1
diffie-hellman-group1-sha1

The group size of the first three is obvious. The same holds for the last two. But it's unclear which group the two algorithms

diffie-hellman-group-exchange-sha256
diffie-hellman-group-exchange-sha1

operate on. It's hard to accept that such an important point of security is undocumented. The RFC 4419 says nothing about it and so does the manpage of openSSH. Can someone put some light on this please?

migrated from unix.stackexchange.com Jul 26 '13 at 14:22

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems.

  • I'd guess that this depends on the implementations. I'm not familiar with SSH, but with many protocols one of the two end points chooses a group. – CodesInChaos Jul 26 '13 at 14:27
4

A DH group is defined by a prime modulus and a generator. The prime modulus is a bit expensive to generate, so OpenSSH will not do that on a general basis. Instead, sshd will, upon receiving a connection, use one of the groups in the /etc/ssh/moduli files. That file contains pre-generated moduli of various sizes. You can use the one provided with OpenSSH, or generate your own with ssh-keygen; see the man page (there is no security issue in using the same group as other people, but nevertheless, for some psychological reason, some sysadmins experience a feeling of higher security when they generate their own moduli).

The actual selection process is, in OpenSSH source code, in the choose_dh() function in the dh.c file. Roughly speaking, if the client wants at least min bits, at most max bits, and preferably n bits, then the server will choose among the moduli in the min..max range; it will try to get the smallest modulus which exceeds n, and, if there is none, the biggest modulus it has (still in the min..max range, of course). If the server finds several modulus of the same "optimal" length, then it selects one randomly. If the server knows of no modulus in the min..max range, then connection fails.

The default /etc/ssh/moduli, at least on my server, appears to have moduli of size 1023 to 8191 bits.

  • Are the min and max bits configurable? – Siyuan Ren May 25 '15 at 16:41
  • @SiyuanRen You can simply remove the entries you do not want to be used from /etc/ssh/moduli. – fr00tyl00p Jun 20 '15 at 13:00
  • @fr00tyl00p That is only on the server side, right? – Siyuan Ren Jun 20 '15 at 15:07
  • @SiyuanRen The documentation says it's the "system wide" moduli database. So maybe this also restricts moduli the client uses. But I'm not sure about this. – fr00tyl00p Jun 21 '15 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.