[Contents] [Index]

About This Document>>     Introduction to SSH Secure Shell >>     Configuring SSH Secure Shell >>         Basic Configuration>>             Default Locations of Secure Shell Files             Generating the Host Key             Ciphers and MACs             Compression             Configuring Root Logins             Restricting User Logins         Subconfigurations >>         Configuring SSH Secure Shell for TCP Wrappers Support>>         Configuring SSH2 for SSH1 Compatibility         Forwarding>>     Authentication >>     Log Messages >>     Using SSH Secure Shell >>     Tool Syntax>>     Technical Specifications >>

Ciphers and MACs

The algorithm(s) used for symmetric session encryption can be chosen in the sshd2_config and ssh2_config files:

        Ciphers         twofish,blowfish

The system will attempt to use the different encryption ciphers in the sequence specified on the line. Currently supported cipher names are the following:

• des
• 3des
• blowfish
• twofish
• cast
• arcfour
• aes.

Of these ciphers, Blowfish and Twofish are especially suitable for file transfers.

Special values for this option are the following:

• Any: allows all the cipher values including none
• AnyStd: allows only standard ciphers and none
• none: forbids any use of encryption
• AnyCipher: allows any available cipher apart from the non-encrypting cipher mode none
• AnyStdCipher: the same as AnyCipher, but includes only those ciphers mentioned in IETF-SecSH-draft (excluding none). This is the default value.

The MAC (Message Authentication Code) algorithm(s) used for data integrity verification can be chosen in the sshd2_config and ssh2_config files:

        MACs            hmac-sha1,hmac-md5

The system will attempt to use the different MAC algorithms in the sequence they are specified on the line. Supported MAC names are the following:

• hmac-sha1
• hmac-sha1-96
• hmac-md5
• hmac-md5-96
• hmac-ripemd160
• hmac-ripemd160-96.

Special values for this option are the following:

• Any: allows all the MAC values including none
• AnyStd: allows only standard MACs and none
• none: forbids any use of MACs
• AnyMac: allows any available MAC apart from none
• AnyStdMac: the same as AnyMac, but includes only those MACs mentioned in IETF-SecSH-draft (excluding none). This is the default value.

Both cipher and MAC can also be defined using command line arguments with ssh2 and scp2:

 $ scp2 -c twofish -m hmac-md5 foobar user@remote:./tmp  

Note: Algorithm names are case sensitive.