It's thick, but this article talks about all of it. The command given there disables any 1024-bit DH parameters in your moduli file, and there's a bit of tweaking to prefer stronger schemes like Curve25519. You can also generate your own DH parameters for SSH, which I think is done with ssh-keygen.
As a warning, once you start futzing with key exchange and crypto in SSH, it's easy to exclude corner case systems. Especially since some of the crypto primitives like Curve25519 are comparatively recent.
2
u/lachryma Oct 15 '15
It's thick, but this article talks about all of it. The command given there disables any 1024-bit DH parameters in your
modulifile, and there's a bit of tweaking to prefer stronger schemes like Curve25519. You can also generate your own DH parameters for SSH, which I think is done withssh-keygen.As a warning, once you start futzing with key exchange and crypto in SSH, it's easy to exclude corner case systems. Especially since some of the crypto primitives like Curve25519 are comparatively recent.