SSH

SSH algorithm names: key exchange, ciphers, MACs, keys

Key exchange, encryption, MAC and public key algorithm names of the SSH transport protocol from the IANA registry, with the RFC 9142 implementation guidance.

112 of 112 shown

SSH key exchange methods · 41 entries

Key exchange method names of the SSH transport protocol, with RFC 9142 implementation guidance.

Name	Description	References
`curve25519-sha256`Note	curve25519-sha256 is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD.	RFC 8731
`curve448-sha512`	curve448-sha512 is an SSH key exchange method. Implementation guidance (RFC 9142): MAY.	RFC 8731
`diffie-hellman-group-exchange-sha1`	diffie-hellman-group-exchange-sha1 is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD NOT.	RFC 4419 RFC 8270
`diffie-hellman-group-exchange-sha256`	diffie-hellman-group-exchange-sha256 is an SSH key exchange method. Implementation guidance (RFC 9142): MAY.	RFC 4419 RFC 8270
`diffie-hellman-group1-sha1`Note	diffie-hellman-group1-sha1 is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD NOT.	RFC 4253
`diffie-hellman-group14-sha1`	diffie-hellman-group14-sha1 is an SSH key exchange method. Implementation guidance (RFC 9142): MAY.	RFC 4253
`diffie-hellman-group14-sha256`	diffie-hellman-group14-sha256 is an SSH key exchange method. Implementation guidance (RFC 9142): MUST.	RFC 8268
`diffie-hellman-group15-sha512`	diffie-hellman-group15-sha512 is an SSH key exchange method. Implementation guidance (RFC 9142): MAY.	RFC 8268
`diffie-hellman-group16-sha512`	diffie-hellman-group16-sha512 is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD.	RFC 8268
`diffie-hellman-group17-sha512`	diffie-hellman-group17-sha512 is an SSH key exchange method. Implementation guidance (RFC 9142): MAY.	RFC 8268
`diffie-hellman-group18-sha512`	diffie-hellman-group18-sha512 is an SSH key exchange method. Implementation guidance (RFC 9142): MAY.	RFC 8268
`ecdh-sha2-*`	ecdh-sha2-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): MAY.	RFC 5656
`ecdh-sha2-nistp256`	ecdh-sha2-nistp256 is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD.	RFC 5656
`ecdh-sha2-nistp384`	ecdh-sha2-nistp384 is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD.	RFC 5656
`ecdh-sha2-nistp521`	ecdh-sha2-nistp521 is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD.	RFC 5656
`ecmqv-sha2`	ecmqv-sha2 is an SSH key exchange method. Implementation guidance (RFC 9142): MAY.	RFC 5656
`ext-info-c`	ext-info-c is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD.	RFC 8308
`ext-info-s`	ext-info-s is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD.	RFC 8308
`gss-`	gss- is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): reserved.	RFC 4462
`gss-curve25519-sha256-*`	gss-curve25519-sha256-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): SHOULD.	RFC 8732
`gss-curve448-sha512-*`	gss-curve448-sha512-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): MAY.	RFC 8732
`gss-gex-sha1-*`	gss-gex-sha1-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): SHOULD NOT.	RFC 4462 RFC 8732
`gss-group1-sha1-*`	gss-group1-sha1-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): SHOULD NOT.	RFC 4462 RFC 8732
`gss-group14-sha1-*`	gss-group14-sha1-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): SHOULD NOT.	RFC 4462 RFC 8732
`gss-group14-sha256-*`	gss-group14-sha256-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): SHOULD.	RFC 8732
`gss-group15-sha512-*`	gss-group15-sha512-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): MAY.	RFC 8732
`gss-group16-sha512-*`	gss-group16-sha512-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): MAY.	RFC 8732
`gss-group17-sha512-*`	gss-group17-sha512-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): MAY.	RFC 8732
`gss-group18-sha512-*`	gss-group18-sha512-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): MAY.	RFC 8732
`gss-nistp256-sha256-*`	gss-nistp256-sha256-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): SHOULD.	RFC 8732
`gss-nistp384-sha384-*`	gss-nistp384-sha384-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): SHOULD.	RFC 8732
`gss-nistp521-sha512-*`	gss-nistp521-sha512-* is an SSH key exchange method family; the rest of the name is defined by the referenced document. Implementation guidance (RFC 9142): SHOULD.	RFC 8732
`mlkem1024-sha384`	mlkem1024-sha384 is an SSH key exchange method. Implementation guidance (RFC 9142): MAY.	draft-harrison-mlkem-ssh-01
`mlkem1024nistp384-sha384`	mlkem1024nistp384-sha384 is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD.	RFC 10042
`mlkem512-sha256`	mlkem512-sha256 is an SSH key exchange method. Implementation guidance (RFC 9142): MAY.	draft-harrison-mlkem-ssh-01
`mlkem768-sha256`	mlkem768-sha256 is an SSH key exchange method. Implementation guidance (RFC 9142): MAY.	draft-harrison-mlkem-ssh-01
`mlkem768nistp256-sha256`	mlkem768nistp256-sha256 is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD.	RFC 10042
`mlkem768x25519-sha256`Note	mlkem768x25519-sha256 is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD.	RFC 10042
`rsa1024-sha1`	rsa1024-sha1 is an SSH key exchange method. Implementation guidance (RFC 9142): MUST NOT.	RFC 4432
`rsa2048-sha256`	rsa2048-sha256 is an SSH key exchange method. Implementation guidance (RFC 9142): MAY.	RFC 4432
`sntrup761x25519-sha512`	sntrup761x25519-sha512 is an SSH key exchange method. Implementation guidance (RFC 9142): SHOULD.	RFC 9941

Source: Secure Shell (SSH) Protocol Parameters (IANA), retrieved 2026-10-20. Data license: CC0-1.0. Key Exchange Method Names

Notes on notable entries

curve25519-sha256

X25519 key exchange for SSH (RFC 8731), the classical default of most SSH implementations.

OpenSSH introduced it in 2014 as curve25519-sha256@libssh.org; RFC 8731 standardised the name without the suffix. RFC 9142 says implementations SHOULD support it. It remains the usual fallback when a peer lacks the post-quantum hybrids.

diffie-hellman-group1-sha1

1024-bit Oakley group 2 with SHA-1, the original SSH key exchange, now 'SHOULD NOT' (RFC 9142).

The 1024-bit group is within reach of nation-state precomputation (Logjam, 2015), and SHA-1 is weak. OpenSSH disabled it by default in version 7.0 (2015); old network equipment that offers only this method needs the method to be re-enabled explicitly — upgrading the equipment is the real fix.

mlkem768x25519-sha256

The hybrid ML-KEM-768 + X25519 key exchange that OpenSSH uses by default since version 10.0.

mlkem768x25519-sha256 (RFC 10042) combines ML-KEM-768 with X25519 and hashes the result with SHA-256. OpenSSH 9.9 added it and OpenSSH 10.0 (April 2025) made it the default, replacing sntrup761x25519-sha512; it protects recorded sessions against future quantum computers.

SSH encryption algorithms · 35 entries

Cipher names of the SSH transport protocol.

Name	Description	References
`3des-cbc`	3des-cbc is an SSH encryption algorithm.	RFC 4253
`3des-ctr`	3des-ctr is an SSH encryption algorithm.	RFC 4344
`AEAD_AES_128_GCM`	AEAD_AES_128_GCM is an SSH encryption algorithm.	RFC 5647
`AEAD_AES_256_GCM`	AEAD_AES_256_GCM is an SSH encryption algorithm.	RFC 5647
`aes128-cbc`	aes128-cbc is an SSH encryption algorithm.	RFC 4253
`aes128-ctr`	aes128-ctr is an SSH encryption algorithm.	RFC 4344
`aes192-cbc`	aes192-cbc is an SSH encryption algorithm.	RFC 4253
`aes192-ctr`	aes192-ctr is an SSH encryption algorithm.	RFC 4344
`aes256-cbc`	aes256-cbc is an SSH encryption algorithm.	RFC 4253
`aes256-ctr`	aes256-ctr is an SSH encryption algorithm.	RFC 4344
`arcfour`	arcfour is an SSH encryption algorithm. It is marked historic.	RFC 8758
`arcfour128`	arcfour128 is an SSH encryption algorithm. It is marked historic.	RFC 8758
`arcfour256`	arcfour256 is an SSH encryption algorithm. It is marked historic.	RFC 8758
`blowfish-cbc`	blowfish-cbc is an SSH encryption algorithm.	RFC 4253
`blowfish-ctr`	blowfish-ctr is an SSH encryption algorithm.	RFC 4344
`cast128-cbc`	cast128-cbc is an SSH encryption algorithm.	RFC 4253
`cast128-ctr`	cast128-ctr is an SSH encryption algorithm.	RFC 4344
`chacha20-poly1305`	chacha20-poly1305 is an SSH encryption algorithm.	draft-josefsson-ssh-chacha20-poly1305-openssh-01
`des-cbc`	des-cbc is an SSH encryption algorithm. It is marked historic.	FIPS 46-3
`idea-cbc`	idea-cbc is an SSH encryption algorithm.	RFC 4253
`idea-ctr`	idea-ctr is an SSH encryption algorithm.	RFC 4344
`none`	none is an SSH encryption algorithm.	RFC 4253
`serpent128-cbc`	serpent128-cbc is an SSH encryption algorithm.	RFC 4253
`serpent128-ctr`	serpent128-ctr is an SSH encryption algorithm.	RFC 4344
`serpent192-cbc`	serpent192-cbc is an SSH encryption algorithm.	RFC 4253
`serpent192-ctr`	serpent192-ctr is an SSH encryption algorithm.	RFC 4344
`serpent256-cbc`	serpent256-cbc is an SSH encryption algorithm.	RFC 4253
`serpent256-ctr`	serpent256-ctr is an SSH encryption algorithm.	RFC 4344
`twofish-cbc`	twofish-cbc is an SSH encryption algorithm.	RFC 4253
`twofish128-cbc`	twofish128-cbc is an SSH encryption algorithm.	RFC 4253
`twofish128-ctr`	twofish128-ctr is an SSH encryption algorithm.	RFC 4344
`twofish192-cbc`	twofish192-cbc is an SSH encryption algorithm.	RFC 4253
`twofish192-ctr`	twofish192-ctr is an SSH encryption algorithm.	RFC 4344
`twofish256-cbc`	twofish256-cbc is an SSH encryption algorithm.	RFC 4253
`twofish256-ctr`	twofish256-ctr is an SSH encryption algorithm.	RFC 4344

Source: Secure Shell (SSH) Protocol Parameters (IANA), retrieved 2026-10-20. Data license: CC0-1.0. Encryption Algorithm Names

SSH MAC algorithms · 9 entries

MAC algorithm names of the SSH transport protocol.

Name	Description	References
`AEAD_AES_128_GCM`	AEAD_AES_128_GCM is an SSH MAC algorithm.	RFC 5647
`AEAD_AES_256_GCM`	AEAD_AES_256_GCM is an SSH MAC algorithm.	RFC 5647
`hmac-md5`	hmac-md5 is an SSH MAC algorithm.	RFC 4253
`hmac-md5-96`	hmac-md5-96 is an SSH MAC algorithm.	RFC 4253
`hmac-sha1`	hmac-sha1 is an SSH MAC algorithm.	RFC 4253
`hmac-sha1-96`	hmac-sha1-96 is an SSH MAC algorithm.	RFC 4253
`hmac-sha2-256`	hmac-sha2-256 is an SSH MAC algorithm.	RFC 6668
`hmac-sha2-512`	hmac-sha2-512 is an SSH MAC algorithm.	RFC 6668
`none`	none is an SSH MAC algorithm.	RFC 4253

Source: Secure Shell (SSH) Protocol Parameters (IANA), retrieved 2026-10-20. Data license: CC0-1.0. MAC Algorithm Names

SSH public key algorithms · 27 entries

Public key and signature algorithm names used by SSH host and user keys.

Name	Description	References
`ecdsa-sha2-*`	ecdsa-sha2-* is an SSH public key algorithm family; the rest of the name is defined by the referenced document.	RFC 5656
`ecdsa-sha2-nistp256`	ecdsa-sha2-nistp256 is an SSH public key algorithm. It is a member of the ecdsa-sha2-* family.	RFC 5656, Section 10.1
`ecdsa-sha2-nistp384`	ecdsa-sha2-nistp384 is an SSH public key algorithm. It is a member of the ecdsa-sha2-* family.	RFC 5656, Section 10.1
`ecdsa-sha2-nistp521`	ecdsa-sha2-nistp521 is an SSH public key algorithm. It is a member of the ecdsa-sha2-* family.	RFC 5656, Section 10.1
`null`	null is an SSH public key algorithm.	RFC 4462
`pgp-sign-dss`	pgp-sign-dss is an SSH public key algorithm.	RFC 4253
`pgp-sign-rsa`	pgp-sign-rsa is an SSH public key algorithm.	RFC 4253
`rsa-sha2-256`	rsa-sha2-256 is an SSH public key algorithm.	RFC 8332
`rsa-sha2-512`	rsa-sha2-512 is an SSH public key algorithm.	RFC 8332
`spki-sign-dss`	spki-sign-dss is an SSH public key algorithm.	RFC 4253
`spki-sign-rsa`	spki-sign-rsa is an SSH public key algorithm.	RFC 4253
`ssh-dss`Note	ssh-dss is an SSH public key algorithm.	RFC 4253
`ssh-ed25519`Note	ssh-ed25519 is an SSH public key algorithm.	RFC 8709
`ssh-ed448`	ssh-ed448 is an SSH public key algorithm.	RFC 8709
`ssh-mldsa-44`	ssh-mldsa-44 is an SSH public key algorithm.	draft-sfluhrer-ssh-mldsa-08
`ssh-mldsa-65`	ssh-mldsa-65 is an SSH public key algorithm.	draft-sfluhrer-ssh-mldsa-08
`ssh-mldsa-87`	ssh-mldsa-87 is an SSH public key algorithm.	draft-sfluhrer-ssh-mldsa-08
`ssh-mldsa44-ed25519`	ssh-mldsa44-ed25519 is an SSH public key algorithm.	draft-ietf-sshm-composite-sigs-00
`ssh-mldsa87-p384`	ssh-mldsa87-p384 is an SSH public key algorithm.	draft-ietf-sshm-composite-sigs-00
`ssh-rsa`Note	ssh-rsa is an SSH public key algorithm.	RFC 4253
`x509v3-ecdsa-sha2-*`	x509v3-ecdsa-sha2-* is an SSH public key algorithm family; the rest of the name is defined by the referenced document.	RFC 6187
`x509v3-ecdsa-sha2-nistp256`	x509v3-ecdsa-sha2-nistp256 is an SSH public key algorithm. It is a member of the x509v3-ecdsa-sha2-* family.	RFC 6187, Section 3.3
`x509v3-ecdsa-sha2-nistp384`	x509v3-ecdsa-sha2-nistp384 is an SSH public key algorithm. It is a member of the x509v3-ecdsa-sha2-* family.	RFC 6187, Section 3.3
`x509v3-ecdsa-sha2-nistp521`	x509v3-ecdsa-sha2-nistp521 is an SSH public key algorithm. It is a member of the x509v3-ecdsa-sha2-* family.	RFC 6187, Section 3.3
`x509v3-rsa2048-sha256`	x509v3-rsa2048-sha256 is an SSH public key algorithm.	RFC 6187
`x509v3-ssh-dss`	x509v3-ssh-dss is an SSH public key algorithm.	RFC 6187
`x509v3-ssh-rsa`	x509v3-ssh-rsa is an SSH public key algorithm.	RFC 6187

Source: Secure Shell (SSH) Protocol Parameters (IANA), retrieved 2026-10-20. Data license: CC0-1.0. Public Key Algorithm Names

Notes on notable entries

ssh-dss

DSA keys for SSH, limited to 1024 bits and SHA-1; OpenSSH 10.0 removed support entirely.

SSH's DSA profile fixes the key size at 1024 bits and the hash at SHA-1. OpenSSH disabled DSA by default in 7.0 (2015) and removed it in 10.0 (2025). Replace ssh-dss keys with Ed25519 or ECDSA keys.

ssh-ed25519

Ed25519 SSH keys (RFC 8709), the type ssh-keygen creates by default since OpenSSH 9.5.

An ssh-ed25519 public key is 32 bytes, and authorized_keys lines stay short. OpenSSH 9.5 (October 2023) made Ed25519 the default key type of ssh-keygen. See edwards25519.

ssh-rsa

The RSA key format of SSH — and also the name of the old RSA signature with SHA-1, which OpenSSH disabled in 8.8.

The name is ambiguous: as a key type, ssh-rsa still describes every RSA key; as a signature algorithm it means PKCS#1 v1.5 with SHA-1. OpenSSH 8.8 (2021) disabled ssh-rsa signatures by default; RSA keys keep working with the rsa-sha2-256 and rsa-sha2-512 signature algorithms (RFC 8332), which servers advertise through the server-sig-algs extension.

All registries