More Modular Exponentiation (MODP) Diffie-Hellman (DH) Key Exchange (KEX) Groups for Secure Shell (SSH)
updates
Extracted elements (16)
All new MODP groups introduced (group15 through group18) are 'safe primes' where p = 2q + 1 and q is also prime. This property prevents forcing the local system into a two-element subgroup, which the corrected public key range check also guards against.
'diffie-hellman-group14-sha256' was added as a pragmatic transition aid: group14 is already present in most SSH implementations and SHA256 is widely available, making this an easy first step away from SHA-1-based key exchange before moving to larger groups.
SHA512 was chosen over SHA256 for the new groups (group15–group18) based on NSA Commercial National Security Algorithm Suite guidance, which recommends SHA384 or SHA512 and a minimum DH prime modulus of 3072 bits for national security systems.
RFC 4253 Section 8, point 3 incorrectly specifies the valid range for DH Public Key values as the closed interval [1, p-1]; the correct range is the open interval (1, p-1), i.e., strictly greater than 1 and strictly less than p-1.
The new MODP groups with SHA-2-based hashes defined in this document are intended to update Section 6.4 of RFC 4253 and Section 4.10 of RFC 4250, replacing or supplementing the original DH group definitions in those documents.
DH Public Key values MUST be checked so that both 1 < e < p-1 and 1 < f < p-1 are true. Values not within these bounds MUST NOT be sent or accepted by either side; if either condition is violated, the key exchange fails.
It is recommended that 'diffie-hellman-group14-sha256' SHOULD be supported to smooth the transition to newer group sizes, since group14 is already present in most SSH implementations and SHA256 is widely available.
'diffie-hellman-group14-sha256' uses the existing 2048-bit MODP group14 with the SHA256 hash algorithm instead of SHA1, following the same key exchange method as 'diffie-hellman-group14-sha1'.
'diffie-hellman-group15-sha512' uses the 3072-bit MODP group15 (from RFC 3526) with the SHA512 hash algorithm for SSH key exchange.
'diffie-hellman-group16-sha512' uses the 4096-bit MODP group16 (from RFC 3526) with the SHA512 hash algorithm for SSH key exchange.
'diffie-hellman-group17-sha512' uses the 6144-bit MODP group17 (from RFC 3526) with the SHA512 hash algorithm for SSH key exchange.
'diffie-hellman-group18-sha512' uses the 8192-bit MODP group18 (from RFC 3526) with the SHA512 hash algorithm for SSH key exchange.
IANA has added five entries to the 'Key Exchange Method Names' registry: diffie-hellman-group14-sha256, diffie-hellman-group15-sha512, diffie-hellman-group16-sha512, diffie-hellman-group17-sha512, and diffie-hellman-group18-sha512, all referencing RFC 8268.
Due to security concerns with SHA-1 (RFC 6194) and MODP groups with fewer than 2048 bits (NIST SP 800-131Ar1), implementers should use larger DH MODP group sizes with SHA-2 data-integrity verification.
MODP groups 14 through 18 provide security strengths ranging from approximately 110 bits (group14) to 310 bits (group18). Sufficient entropy and/or DRBG algorithms must be used to maximize true security strength of the key exchange and ciphers selected.
Using a fixed set of Diffie-Hellman parameters makes them high-value targets for pre-computation attacks. Generating additional sets of primes or moving to larger values mitigates this risk.