Advertise the RFC 8731 kex name curve25519-sha256 - #187
Merged
vicajilau merged 1 commit intoJul 27, 2026
Merged
Conversation
The kex is offered under two names: the original curve25519-sha256@libssh.org and the RFC 8731 name curve25519-sha256. Only the former was advertised, so a server hardened down to a single kex (KexAlgorithms curve25519-sha256, a common hardening recipe) shares no name with us and the handshake fails with "no matching key exchange method found" — even though both sides implement the very same X25519 exchange. Add SSHKexType.x25519Rfc with the RFC name, offer it right after the libssh.org spelling, and route it to the same SSHKexX25519 in the transport switch. No wire-format change: same digest, same exchange.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #187 +/- ##
==========================================
- Coverage 55.93% 55.92% -0.02%
==========================================
Files 66 66
Lines 5472 5473 +1
==========================================
Hits 3061 3061
- Misses 2411 2412 +1
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
curve25519-sha256@libssh.organdcurve25519-sha256are two names for the same key exchange — the latter is the name RFC 8731 standardised. dartssh2 only ever advertises the libssh.org spelling.OpenSSH matches algorithm names literally, so a server hardened down to a single kex:
shares no name with us and the handshake dies with
Bad state: No matching key exchange algorithm, even though both sides implement exactly the same X25519 exchange. That configuration is a common hardening recipe, so this is not an exotic server.Reproduced against OpenSSH 9.9 offering
kexAlgorithms: [curve25519-sha256, ext-info-s, kex-strict-s-v00@openssh.com].Change
SSHKexType.x25519Rfc— samedigestSha256, RFC name.x25519in the defaultSSHAlgorithms.kexlist.casein the transport switch, falling through to the sameSSHKexX25519().No wire-format change: identical exchange, identical digest, only the negotiated name differs. The default-algorithm-list assertion in
test/src/algorithm/ssh_cipher_type_test.dartis updated for the new entry;dart testpasses (292 tests).Verified end to end: with this patch (plus
aes*-gcm@openssh.comin the cipher list) an SFTP session against the hardened server above connects and lists directories; unpatched it fails at KEXINIT.