Re: Enabling all ciphers, HMACs, keyex & host key algos for ssh connections

[Jakub Jelen <jjelen@xxxxxxxxxx>]

Hi,
We do not plan to bring DSA back into the currently supported release
branches because it is no longer considered secure and is not allowed or
recommended by any authorities, not even by NIST (see FIPS 186-5 from 2023).

If you are looking for commercial support of older versions, please
consider reaching out to support@xxxxxxxxxx.

Best regards,
Jakub



On Thu, Sep 24, 2026 at 12:33 PM Kerrison, Adam <adam.kerrison@xxxxxxxxxxx>
wrote:

> Thanks for the information. Sadly some of the old things do use DSA keys
> so we are stuck on 0.10.x for now. The trouble is that there are documented
> CVEs and our security teams are pushing for all CVEs addressed ... so we
> need to move to a later release, but we cannot do so without breaking
> support for legacy things.
>
> Adam
>
>
> ------------------------------
> *From:* Jakub Jelen <jjelen@xxxxxxxxxx>
> *Sent:* Wednesday, September 23, 2026 10:13 AM
> *To:* libssh@xxxxxxxxxx <libssh@xxxxxxxxxx>
> *Subject:* Re: Enabling all ciphers, HMACs, keyex & host key algos for
> ssh connections
>
> Hi Adam, There are algorithms that are disabled by default (mostly SHA-1
> based) and there are algorithms that were removed already (DSA). If you are
> up to getting DSA, you would have to fetch some older libssh version ( < 0.
> 11. 0 for DSA).
> Hi Adam,
> There are algorithms that are disabled by default (mostly SHA-1 based) and
> there are algorithms that were removed already (DSA). If you are up to
> getting DSA, you would have to fetch some older libssh version ( < 0.11.0
> for DSA).
>
> For algorithms not enabled by default, we do in interoperability test
> programs (ping and pkd), which are enabling all supported algorithms from
> hostkey algorithms, key exchange, ciphers and macs:
>
>
> https://gitlab.com/libssh/libssh-mirror/-/blob/master/tests/ssh_ping.c?ref_type=heads#L75
> <https://urldefense.com/v3/__https://gitlab.com/libssh/libssh-mirror/-/blob/master/tests/ssh_ping.c?ref_type=heads*L75__;Iw!!OmxWZm2fcg!XH1j0aXCHQYqRaaWIQIYKvRJx86CP-Hf7-lr5s91KVpGjs2Wdq42suWDCsmUhvJn3Ekp7F_kzsZBTOdFcV1U$>
>
> https://gitlab.com/libssh/libssh-mirror/-/blob/master/tests/pkd/pkd_daemon.c#L299
> <https://urldefense.com/v3/__https://gitlab.com/libssh/libssh-mirror/-/blob/master/tests/pkd/pkd_daemon.c*L299__;Iw!!OmxWZm2fcg!XH1j0aXCHQYqRaaWIQIYKvRJx86CP-Hf7-lr5s91KVpGjs2Wdq42suWDCsmUhvJn3Ekp7F_kzsZBTCQGR8GJ$>
>
> This API (ssh_get_supported_methods) is available since libssh 0.12.0.
>
> Hope it helps.
> Jakub
>
> On Tue, Sep 22, 2026 at 2:53 PM Kerrison, Adam <adam.kerrison@xxxxxxxxxxx>
> wrote:
>
> Slightly mad request but is it possible to enable all ciphers, HMACs,
> keyex & host key algos for an ssh connection?
>
> Yes I know its insecure but I need to ensure that I can connect to a
> target system no matter how old and legacy its ssh set up - we have targets
> which are potential 10 or more years old so they only support poor crypto
> by modern standards.
>
> I've tried to do this before by trying to list all the supported options
> (I even forked the code to expose a way to query those options) but it was
> complex and time consuming and I just ran out of cycles to get it all done.
>
> Really what I am looking for is a way to "enable everything"
>
> Adam
>
> PS. Yes those old legacy things should be upgraded but I am not in
> position to make that happen. Some are embedded things which are seriously
> expensive to replace just because the controller is potentially "insecure"
>
>