Detections
Analytics

5.1.23 Ensure sshd post-quantum cryptography key exchange algorithms are configured

Information

OpenSSH has integrated post-quantum cryptography (PQC) to secure SSH connections against potential attacks from future quantum computers. This includes the adoption of hybrid key agreement algorithms that combine classical cryptographic methods with quantum-resistant ones.

More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

PQC helps secure SSH connections against potential attacks from future quantum computers providing protection against both classical and quantum adversaries.

The combination of established classical algorithms with the forward-looking security of PQC algorithms, offers a robust solution during the transition phase to fully quantum-resistant cryptography.

Solution

Create or edit a *.conf file in the /etc/ssh/sshd_config.d/ and add/modify the KexAlgorithms line above any Include and Match statements.

Example:

KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

Note: If local site policy has stricter requirements, add any additional MACs that are not authorized by local site policy to the list in the example.

Impact:

A restrictive list of key exchange algorithms available to the SSH server may prevent some clients from being able to connect.

Including a non-supported key exchange algorithm in the kexalgorithms option, may prevent the SSH server from starting.

Note: The list of supported key exchange algorithms may also be obtained using the ssh -Q KexAlgorithms command.

See Also

https://workbench.cisecurity.org/benchmarks/26893

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: Unix

Control ID: ceb93620617d78cd8a52dca39240dca9331417624a055196dc4789e56a4e09e6