From fa7ce6bc7ffb66c4a0762faa58589a3424749901 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 10 May 2022 23:16:52 +0200 Subject: [PATCH] nixos/openssh: Add sntrup761x25519-sha512 kexAlgo Introduced in OpenSSH 9.0 it became the part of the default kexAlgorithm selection, visibile in sshd_config(5). It is also enabled by default in the OpenSSH client, as can be seen from $ ssh -Q KexAlgorithms Also clarifies that we use the referenced documents as the lower bound, given that they haven't been updated for 5-7y. --- nixos/modules/services/networking/ssh/sshd.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix index d467c3c0471..6b69d559748 100644 --- a/nixos/modules/services/networking/ssh/sshd.nix +++ b/nixos/modules/services/networking/ssh/sshd.nix @@ -293,6 +293,7 @@ in kexAlgorithms = mkOption { type = types.listOf types.str; default = [ + "sntrup761x25519-sha512@openssh.com" "curve25519-sha256" "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" @@ -301,7 +302,7 @@ in Allowed key exchange algorithms - Defaults to recommended settings from both + Uses the lower bound recommended in both and