ssh client key-exchange
Function
The ssh client key-exchange command configures a key exchange algorithm list for an SSH client.
The undo ssh client key-exchange command restores the default configuration.
By default, an SSH client supports all key exchange algorithms.
Format
ssh client key-exchange { dh_group14_sha256 | dh_group15_sha512 | dh_group16_sha512 | dh_group_exchange_sha256 }*
undo ssh client key-exchange
Parameters
| Parameter | Description | Value |
|---|---|---|
dh_group14_sha256 |
Specifies that the Diffie-hellman-group14_sha256 algorithm is contained in the key exchange algorithm list configured on the SSH client. |
- |
dh_group15_sha512 |
Specifies that the Diffie-hellman-group15_sha512 algorithm is contained in the key exchange algorithm list configured on the SSH client. |
- |
dh_group16_sha512 |
Specifies that the Diffie-hellman-group16_sha512 algorithm is contained in the key exchange algorithm list configured on the SSH client. |
- |
dh_group_exchange_sha256 |
Specifies that the Diffie-hellman-group_exchange_sha256 algorithm is contained in the key exchange algorithm list configured on the SSH client. |
- |
Usage Guidelines
Usage Scenario
The client and server negotiate the key exchange algorithm used for packet transmission. You can run the ssh client key-exchange command to configure a key exchange algorithm list for the SSH client. The SSH server compares the configured key exchange algorithm list with the counterpart sent by the client and then selects the first matched key exchange algorithm for packet transmission. If the key exchange algorithm list sent by the client does not match any algorithm in the key exchange algorithm list configured on the server, the negotiation fails.
Precautions
The security levels of key exchange algorithms are as follows, from high to low: dh_group16_sha512, dh_group15_sha512, dh_group_exchange_sha256, and dh_group14_sha256. The system software does not support the dh_group_exchange_sha1, dh_group14_sha1, and dh_group1_sha1 parameters. To use the dh_group_exchange_sha1, dh_group14_sha1, or dh_group1_sha1 parameter, you need to install the WEAKEA plug-in. For higher security purposes, you are advised to use other parameters.
The higher the security level of a key exchange algorithm, the longer the time required by the device to calculate the key.