ssh -o KexAlgorithms: add, remove or prefer SSH key exchange methods

ssh -o KexAlgorithms=+diffie-hellman-group14-sha1 user@host changes the list of key exchange methods the client offers. The key exchange creates the shared secret that encrypts the session, so if the server supports none of the client's methods the connection stops with no matching key exchange method found. Their offer: .... A value starting with + appends to the default list, - removes from it, ^ moves methods to the front, and a plain list replaces it.

The four forms

ssh -G resolves the option without connecting, so the effect of each form is visible:

kex() { ssh -G "$@" 2>/dev/null | awk '$1 == "kexalgorithms" { print $2 }' | tr ',' '\n'; }
echo "--- default (first three, total):"
kex host.example.org | head -3; kex host.example.org | wc -l
echo "--- +diffie-hellman-group14-sha1 (last entry):"
kex -o KexAlgorithms=+diffie-hellman-group14-sha1 host.example.org | tail -1
echo "--- ^curve25519-sha256 (first entry):"
kex -o KexAlgorithms=^curve25519-sha256 host.example.org | head -1
echo "--- -sntrup761x25519-sha512@openssh.com (still present?):"
kex -o KexAlgorithms=-sntrup761x25519-sha512@openssh.com host.example.org | grep -cx 'sntrup761x25519-sha512@openssh.com'
echo "--- replace with one method:"
kex -o KexAlgorithms=curve25519-sha256 host.example.org
echo "--- unknown name:"
ssh -G -o KexAlgorithms=+no-such-kex host.example.org 2>&1 >/dev/null | tail -1; echo "exit ${PIPESTATUS[0]}"

--- default (first three, total):
mlkem768x25519-sha256
sntrup761x25519-sha512
sntrup761x25519-sha512@openssh.com
12
--- +diffie-hellman-group14-sha1 (last entry):
diffie-hellman-group14-sha1
--- ^curve25519-sha256 (first entry):
curve25519-sha256
--- -sntrup761x25519-sha512@openssh.com (still present?):
0
--- replace with one method:
curve25519-sha256
--- unknown name:
command-line line 0: Bad SSH2 KexAlgorithms '+no-such-kex'.
exit 255

The default starts with the post-quantum hybrid mlkem768x25519-sha256. + adds the old SHA-1 group at the end, so it is used only when the server has nothing better. An unknown name is rejected before any connection is attempted, with exit code 255.

Common methods

ssh -Q kex prints every method your build supports; see list supported algorithms. RFC 9142 lists which methods SSH implementations should and should not use.

Scope legacy methods to one host

Host old-router
    HostName 192.0.2.1
    KexAlgorithms +diffie-hellman-group14-sha1

The OpenSSH project recommends the + form so that the client automatically moves to a better method once the server is upgraded.

Pitfalls

• One option per negotiation. If the error says no matching host key type found, you need HostKeyAlgorithms; for no matching cipher found, Ciphers (see the cipher error).
• Replacing the list by accident. KexAlgorithms diffie-hellman-group1-sha1 without + leaves only the weak method and breaks connections to every modern server.
• Removed methods cannot be re-enabled. If ssh -Q kex does not list a method, no option brings it back; use an older client in a container or upgrade the server.
• Server configuration. KexAlgorithms in sshd_config uses the same syntax; sshd -T | grep kexalgorithms prints what the server offers, which is the list quoted after Their offer: in the client error.

FAQ