Here's a Mini How-to for openssh with curve25519
Config of /etc/.ssh/ssh_config
Host *
IdentityFile ~/.ssh/id_ed25519
IdentityFile ~/.ssh/id_rsa
PasswordAuthentication no
PubkeyAuthentication yes
KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
MACs [email protected],[email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,[email protected]
# Github needs diffie-hellman-group-exchange-sha1 some of the time but not always.
Host github.com
KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1
At upper level of /etc/.ssh/sshd_config review HostKey settings:
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
And append the following at the end of config of /etc/.ssh/sshd_config
KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
MACs [email protected],[email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,[email protected]
Then generate a RSA server keys on each site as root
ssh-keygen -t ed25519 -f ssh_host_ed25519_key < /dev/null
Restart openssh-Daemon - /etc/init.d/ssh restart
But please leave a ssh clienct connection open to that ssh site, if there's something wrong with the configuration!
User configuration for each user:
Delete RSA (or DSA) fingerprints of site, which you would like to connect primarily with ED25519 elliptic curves:
Or just remove all fingerprints:
Generate a new curve25519 client key:
ssh-keygen -t ed25519 -o -a 100
First ssh connection to each site should look like:
ED25519 key fingerprint is 00:db:08:ab:ca:ff:0e:11:21:93:b2:ad:37:47:b3:c4:df.
Are you sure you want to continue connecting (yes/no)? yes
Enter passphrase for key '/home/user/.ssh/id_ed25519':
If all of this doesn't work, maybe you didn't set the appropriate HostKey order: ssh_host_ed25519_key should be at first position at sshd_config!