Content:

• News
• Support
• Features
• Downloads ^{(on other page)}
• History
• Todo
• News archives
• Miscellaneous

News:

9 Jul 2026 : Official version 19.0.1

What's new:

• Misc:
  
  • compatibility with different versions of the cryptographic library
    Declare random bytes for build-in curve25519 i.e., restore build with OpenSSL before 1.1.0. Use constant X509_PURPOSE i.e., build with OpenSSL compatible libraries. More uses of OpenSSL compatible error messages.

8 Jul 2026 : Official version 19.0

What's new:

• Security:
  
  • fix off-by-one when sftp split a string into arguments
    
  • fix off-by-one read when sftp "strips" path
    
  • defend against user enumeration timing attacks
    Add in keyboard-interactive and gssapi-with-mic authentication methods as well.
  • X11 channel
    Avoid crash if an X11 channel was created before the channel request was sent.
• Features:
  
  • support ML-DSA identities
    Support ML-DSA keys and certificates. This feature requires OpenSSL 3.5 or later.
  • support OpenSSL 4.0
    Harden detection of "ENGINE" functions. Add a layer of ASN1 compatibility - opaque structure, constant arguments, etc.
  • do not check self-issued certificates for revocation
    
  • secure random number generator
    To generate a sequence of random bytes, use only the random number generator provided by the cryptography library. Note on some OS-es arc4random stuff are not secure.
• Bugs:
  
  • proper implementation of RFC-4256, by displaying instructions to users when requested by PAM
    
  • do not restrict arguments to the internal-sftp server
    Previously, the ones after the ninth were quietly removed.
  • dynamic allocation of path when sftp process a directory
    Avoids path name truncation on system where PATH_MAX is not the actual maximum.
  • do not search for cipher or mac if the name is an empty string
    Improved cipher/mac list validation.
  • sftp processing
    Prevent a situation in which the sftp download might enter an infinite loop if a malfunctioning server repeatedly returns a length of zero when reading a file. Fixed the sftp command "ls -n" to show numeric uid/gid instead of user/group name. "Close of exec" pipes between secure file transfer utility and secure shell client Properly implement "get" command in sftp interactive loop.
  • properly set extended type for client-side "session" channels
    
  • disable tunnel device forwarding if the daemon configuration disables forwarding globally
    
  • use POSIX rules to check return value of mktime or timegm when is parsed absolute time
    
  • checks the maximum file size when loading keys from files
    Correctly check the size of private keys and add a new check for public keys.
• Misc:
  
  • stricter validation when state is transferred
    
  • precise failure when subsystem request fail
    Print different text when execution fail or subsystem not found.
  • add duration the the information for the current secure shell connection
    
  • better preserve accuracy for large exponents
    
  • log client exit code
    This should be the last message in the log from the client program.
  • immediate exit when client cannot prepare multiplexed connection
    
  • revise PAM authentication logging messages
    
  • support logging to file in helper for host-based authentication
    
  • explicit initialization and cleanup of the cryptographic library in the agent and in the pkcs helper#11
    Also initialize default X.509 algorithms.
  • various improvement to the regression tests
    
  • various improvement to the manual pages
    
  • check some allocations to avoid NULL pointer dereference
    
  • delay connection to agent
    Open connection to agent after argument processing.
  • precise validation of EC public keys
    This modification is required if cofactor != 1. As all supported EC curves have a cofactor of 1, so this is not an option.

5 Jun 2026 : Official version 18.0.3

What's new:

• Security:
  
  • properly clear setuid/setgid bits
    Ensure consistent behavior if secure copy downloads without preserve mode are from multiple sources.
• Features:
  
  • do not use OpenSSL based arc4random_buf on Android
    Avoids early and unexpected initialization of the cryptographic library.
• Bugs:
  
  • unify events mask if socket is waiting for I/O
    Use computed mask as for other descriptors.
  • use complete open() variant to load password file in Android port
    Allows to "wrap" of function calls i.e., to redirect to installed location.
• Misc:
  
  • split hardening rules
    Use separate configuration arguments for pre-processor flags(fortify source) and linker flags. Note that by default, when "hardening" is activated, "fortification" is also activated.

5 Apr 2026 : Official version 18.0.2

What's new:

• Security:
  
  • confirmation in proxy mode
    Add missing confirmation when a client connects to a running multiplexing master in proxy mode that requires it.
• Features:
  
  • Support FIPS 3.0 module
    Now PKIX-SSH supports FIPS provider also in FIPS mode. Algorithm and digest availability depends on provider and FIPS. Note that OpenSSL FIPS provider restricts operations even in non-FIPS mode. For instance minimum key size is 2048, key operation with SHA1 signatures are not allowed, and etcetera. Also test cases are adapted to pass when FIPS provider is activated and when is run in FIPS mode.
  • SHA-256 support is required
    Minimum supported version is OpenSSL 0.9.8.
  • Enable ML-KEM key exchange by default
    Also disable Diffie-Hellman(DH) key exchange by default.
  • match Version
    Support "Version" as criteria-pattern for conditional blocks in client or daemon configuration.
• Bugs:
  
  • correct handling multi-byte characters on sftp prompt tab completion
    Ensure that completion does not end in the middle of a multi-byte character sequence. Note sftp tab completion requires build with libedit.
  • proper error handling when the utility fails to add additional key data to the agent
    
  • properly construct failed login records
    PKIX-SSH 15.3 regression.
  • require all custom certificates to include non-empty principals sections
    
  • allow riscv_hwprobe in secure secure computing mode
    
  • use long long for bandwidth calculations
    Note fixes rate display when rate > 2GB/s.
  • single argument for MaxStartups
    Correctly parse the single-valued form of the MaxStartups daemon configuration option.
  • correct regression from "check PAM user against saved one"
    Restoring a return statement that was accidentally deleted in release 17.2.2.
  • always respond to monitor "moduli" request
    Avoids potential hang if "moduli" file does not contain the requested Diffie-Hellman group values. Note Diffie-Hellman functionality is disabled by default.
• Misc:
  
  • prefer OpenSSL 3* API
    Rewrite RSA and EC key generation and private key serialisation to use OpenSSL 3* API. The public key serialisation is part of 16.2 (25 Jun 2025) which supports provider managed identities. Note that DSA algorithms are disabled by default since 15.0 (12 Mar 2024) and code will not be updated to OpenSSL 3* API. Also program code continue to use pre 3* API for non-provider keys. For instance this ensures use of identities obtained from engine.
  • update client to list information for active providers, in addition to version information
    
  • fill in sntrup761 entropy at once
    Improve performance.
  • set key bindings when sftp command line editor is in vi mode
    
  • improved documentation
    
  • revise use of some system headers
    
  • implement agent extension mechanism with support for "query" extension
    
  • ensure that channel "local window" does not underflow when output is closing
    
  • allow getsockname(2), getpeername(2) and getsockopt(2) in secure secure computing mode
    
  • File or directory bits in transfers
    Keep directory permissions in remote to remote secure copy or file transfer. Update secure copy to clear setuid/setgid bits from downloaded as root files unless is specified preserve mode.
  • аvoid duplicate PAM messages
    

27 Dec 2025 : Official version 17.2.2

What's new:

• Security:
  
  • user name validation
    Add control character check for remote user validation. Impacts usernames passed on the command line.
  • disable EtM algorithms
    EtM(Encrypt then MAC) algorithms are subject to "prefix truncation". The so called "strict key exchange" negotiation functionality does not mitigate attack. The existing implementation is reserved for future. New configuration option "--enable-etm" allows to add support at build them. Use preprocessor WITHOUT_ETM_FUNCTIONALITY definition to exclude these algorithms from defaults.
  • properly compare email address in distinguished name
    
• Features:
  
  • export XDG_RUNTIME_DIR to secure shell sessions
    
  • use argument string tokeniser to process match directive
    It allows to use shell-like quoting in client or daemon match directives. Note new processing in not compatible with previous one.
  • print information about the current secsh connection
    Use either escape option ~I or multiplexing command "conninfo". Command "chaninfo" prints currently open forwarded connections.
  • add a GssDelegateCreds to daemon options
    This option is with the similar functionality as client option.
• Bugs:
  
  • increase maximum number of key exchange items
    Refuse connection is remote offers too many proposals.
  • check PAM user against saved one
    Avoids fatal when user does not exist.
  • properly count groups when processing the sftp extension "users-groups-by-id"
    
  • get rid of sftp server limit from client
    
  • detect missing subsystem command
    Also avoid daemon crash if subsystem directive is defined in match block only.
• Misc:
  
  • generalize "key-type implementation"
    Rewrite key implementations to avoid remaining uses of key identifiers in switch statements. This allows for easy addition of new key types and management of public key algorithms availability at run time depending on capability of the cryptographic library. Sample is ML-DSA demo branch with complete key-type support including X.509 certificates and with some SLH-DSA key-types.
  • remove DSA from README and configuration files
    Note DSA public key algorithms are still supported if enabled at build time.
  • use prefix for all keys generated by regression test
    Allows easy to clean and exclude from repository new key types.
  • use of pre OpenSSL 3 API in unit tests
    Update key unit tests to use OpenSSL 3 API PKEY based compatible accessors.
  • activate UnusedConnectionTimeout only after closing the last channel
    
  • escape authentication agent "socket path"
    
  • correct a number of memory leaks
    For instance when replacing "hostfile", in auth options unit test, and etc..
  • special handling of path that ends with ..
    Update secure file transfer to upload/download such path to destination.
  • describe "X509 store" option CAStore
    Experimental X.509 look-up "By Store" was implemented in PKIX-SSH 13.2. Now it is available officially. For instance it is used in LDAP X.509 look-up. This functionality still relies on engine module and "By Store" LDAP look-up is excluded from tests if engines are not allowed.

11 Oct 2025 : Official version 17.1.2

What's new:

• Features:
  
  • allow the authentication key utility to "export" keys stored "externally"
    This allows to export public part of store: or engine: identities in "The Secure Shell (SSH) Public Key File Format", see RFC4716, or PKCS8, or PEM. Note that OpenSSL utilites also allows exports in PEM formats either PKCS#8 or traditional.
• Bugs:
  
  • fix regression in "Protocol Version Exchange"
    Restore output of "Version Addendum" broken in 17.1.* releases.
• Misc:
  
  • do not set PAM_RHOST if hostname is UNKNOWN
    Avoids reverse DNS query from a PAM module.
  • add clock_gettime() compatible implementation
    Fixes the builds on old OS-es like macOS before 10.12 (Sierra).
  • allows building key-shielding on operating systems without memory mapped pages
    Note feature is not enabled.

7 Oct 2025 : Official version 17.1.1

What's new:

• Security:
  
  • do not allow NUL characters in url-encoded string
    
• Features:
  
  • use pattern "PACKAGE_NAME[PACKAGE_VERSION]" as software version in "Protocol Version Exchange"
    Note PACKAGE_NAME is PKIX_SSH and PACKAGE_VERSION is 17.1.1 for this release.
  • check the user did not change during PAM transaction
    
  • use address family compatible IP tunnel on FreeBSD
    
  • always shutdown cryptographic library in authentication key utility
    
  • log active channels/sessions if client or "session" daemon receive "usr1" signal
    
  • allows enabling build-in ML-KEM key exchange algorithm at configure time
    
• Bugs:
  
  • continue fetch PKCS#11 keys loop if cannot recognise key material
    
  • use first obtained value for MaxStartups
    
  • during sftp uploads, avoid a condition where a failed write could be ignored if a subsequent write succeeded
    
  • do not log audit messages with UNKNOWN hostname
    
  • wait unprivileged daemon authentication process to exist before to close file descriptors
    
  • check only major versions to match for OpenSSL >= 3.0
    
• Misc:
  
  • get rid of the malfunctioning XMSS key algorithm
    
  • fix a number of memory leaks
    
  • describe "X509 store" option CAStoreURI
    
  • log if PKCS#11 does not support known key type
    
  • correct typographical and spelling errors
    
  • support logging to file in authentication agent utility and PKCS#11 helper utility
    
  • add GSSAPIStrictAcceptorCheck to output daemon configuration
    

29 Aug 2025 : Official version 17.0

What's new:

• Features:
  
  • add hybrid key exchange algorithms based on ML-KEM and traditional Elliptic-curve Diffie-Hellman
    Support all ML-KEM algorithms described in "draft-kampanakis-curdle-ssh-pq-ke" internet draft i.e., mlkem768nistp256-sha256, mlkem1024nistp384-sha384, mlkem768x25519-sha256. Note requires OpenSSL 3.* that provides ML-KEM algorithms i.e., OpenSSL 3.5* or OpenSSL 3.* with activated Open Quantum Safe provider.
  • limiting default Diffie-Hellman key exchange algorithms
    
  • change IPQoS defaults
    Use Expedited Forwarding (EF) as default IPQoS for interactive sessions. Use the operating system default DSCP marking for non-interactive traffic.
  • remove support for IPv4 type-of-service IPQoS keyword arguments
    Deprecated in PKIX-SSH 11.4 (24 Aug 2018). System default is used instead.
  • add client option RefuseConnection
    
• Misc:
  
  • unify ecdh and ecx key exchange functionality
    Prepare ECDH and ECX for use as traditional keys in hybrid key exchange.
  • add key exchange based on encapsulation mechanism
    Support ML-KEM-768 and ML-KEM-1024 algorithms provided by cryptographic library as post-quantum ephemeral keys of hybrid key exchange.
  • add benchmarking capability for unit tests
    
  • add benchmark support to key exchange unit tests
    
  • allows disabling Diffie-Hellman key exchange algorithms at configure time
    

Support:

• Issue tracking
  Development process is public hosted on GitLab. For mode details see project repository page. From project page you could monitor development process, propose enhancement or just report an issue.
• Mailing list
  Project supports mailing list where you could share ideas, discuss your problems, receive project news and etc. The list is moderated, i.e. available only for list members. For more information about list (subscription, list archives) please visit this page.

Features _{(valid for latest version)} :

• X.509 certificate based public-key algorithms:
  
  • x509v3-mldsa-44
  • x509v3-mldsa-65
  • x509v3-mldsa-87
  • x509v3-ecdsa-sha2-nistp256
  • x509v3-ecdsa-sha2-nistp384
  • x509v3-ecdsa-sha2-nistp521
  • x509v3-rsa2048-sha256
  • x509v3-sign-rsa
  • x509v3-ssh-rsa
  • x509v3-ssh-ed25519
  • x509v3-sign-dss (**)
  • x509v3-ssh-dss (**)
  ECDSA, RSA, Ed25519, ML-DSA, or DSA X.509 certificates could be used as "user identity" and/or "host key" in SSH "Public Key" and "Host-Based" authentications.
  • different "x509v3-sign-rsa" signatures
    As support for SHA-1 and MD5 signature format PKIX-SSH is interoperable with implementations from multiple vendors. Both formats are supported because "SSH Transport Layer Protocol" internet drafts does not specify signature format in case of X.509 certificate for RSA key.
  • different packing of "x509v3-sign-dss" signature
    PKIX-SSH is interoperable with implementations from multiple vendors. It support DSA signatures packed in format as is described in [RFC2459] and "dss_signature_blob" format as is specified in "SecSH Transport" draft and [RFC4253].
    Note "SSH Transport Layer Protocol" internet draft before version 12 specify "x509v3-sign-dss" public key algorithm to use signature format as is described in [RFC2459], i.e. r and s packed in ASN.1 SEQUENCE. Some vendors pack DSA signature values in "dss_signature_blob" as is specified in "SecSH transport" draft for "ssh-dss" signature.
  • use key and certificate stored in "external devices"
    Implementation requires working OpenSSL loadable module(provider or engine). The identity used in client authentication could refer to external key and/or certificate in two formats:
    
    • store:[SCHEME:][URI],
      where [SCHEME] is specify OpenSSL STORE provider and [URI] is specific to that provider. Note by default is assumed file: scheme. This format allows load of user identify from unsupported file formats like PKCS#12.
    • engine:[ENGINE_NAME]:[CERT_CRITERIA],
      where [ENGINE_NAME] is name of OpenSSL engine and [CERT_CRITERIA] is specific to engine search criteria to find the key and certicate.
    For instance you could use "friendly name" to access key and certificate stored in "Network Security Services (NSS)" database using loadable modules either provider or engine. Remark: NSS is used in programs(web-browser. e-mail client) like Firefox, SeaMonkey, Thunderbird.
    The engine: scheme allows use or certificates or keys provided by number of OpenSSL PKCS#11 engines.TPM engine should work as well.
    Use PKCS#11 providers or TPM provider with store: scheme to access certificates or keys from respective security device.
  • "PKCS#11"module
    As second option PKIX-SSH could use PKCS#11 shared library(module) to use ECDSA or RSA X.509 certificates and private key provided by PKCS#11 tokens.
  Note the algorithm availablity depends on OpenSSL release, installed providers, build(*) or configuration(**) settings.
• Key based only public-key algorithms:
  
  • mldsa-44
  • mldsa-65
  • mldsa-87
  • ssh-ed25519
  • ecdsa-sha2-nistp256
  • ecdsa-sha2-nistp384
  • ecdsa-sha2-nistp521
  • rsa-sha2-256
  • rsa-sha2-512
  • ssh-rsa
  • ssh-dss (**)
  Note the algorithm availablity depends on OpenSSL release, installed providers, build(*) or configuration(**) settings.
• Key exchange algorithms:
  
  • mlkem768nistp256-sha256
  • mlkem1024nistp384-sha384
  • mlkem768x25519-sha256
  • curve448-sha512
  • curve25519-sha256
  • curve25519-sha256@libssh.org
  • ecdh-sha2-nistp256
  • ecdh-sha2-nistp384
  • ecdh-sha2-nistp521
  • diffie-hellman-group-exchange-sha256 (**)
  • diffie-hellman-group-exchange-sha1 (**)
  • diffie-hellman-group18-sha512 (**)
  • diffie-hellman-group16-sha512 (**)
  • diffie-hellman-group14-sha256 (**)
  • diffie-hellman-group17-sha512 (**)
  • diffie-hellman-group15-sha512 (**)
  • diffie-hellman-group14-sha1
  • diffie-hellman-group1-sha1 (**)
  • sntrup761x25519-sha512 (*)
  Note the algorithm availablity depends on OpenSSL release, installed providers, build(*) or configuration(**) settings.
• verification (default feature)
  By default server(sshd) and clients(ssh,scp,sftp) always verify signatures and validity of certificates in chain when a X.509 certificate based public-key algorithm is used in authentication process. When verification fail that public-key is disallowed.
  In additional client is able to verify remote key using DNS with CERT RR (resource record).
• validation
  • CRL (default feature)
    When a X.509 certificate is used in authentication, server and client always verify signatures and validity of existing CRLs issued by authorities in certificate chain. Certificate is allowed only when no one of certificates in the chain is revoked.
  • OCSP (default feature)
    Additional validation is performed when PKIX-SSH is configured to use OCSP and a X.509 certificate is used in authentication.
• CERT RR
  ssh can verify host identification using CERT Resource Record published in DNS.
• PKIX-SSH Agent (ssh-agent and ssh-add programs)
  Authentication agent can hold X.509 certificates.
• ssh-keyscan
  This tools can gather all above listed public-key algorithms including those with X.509 certificate as host key:
  • x509v3-mldsa-44
  • x509v3-mldsa-65
  • x509v3-mldsa-87
  • x509v3-ecdsa-sha2-nistp256
  • x509v3-ecdsa-sha2-nistp384
  • x509v3-ecdsa-sha2-nistp521
  • x509v3-sign-rsa
  • x509v3-ssh-rsa
  • x509v3-rsa2048-sha256
  • x509v3-ssh-ed25519
  • x509v3-sign-dss (**)
  • x509v3-ssh-dss (**)
• ssh-keysign
  This tools used in "Host-Based Authentication" can sign "host keys" containing either X.509 certificate (ECDSA, RSA, Ed25519, ML-DSA or DSA) or "plain keys".
• ssh-keygen
  when user identity contain a X.509 certificate, command:
  • creates public key and proposed "SECSH Public Key File Format" for that certificate.
  • shows fingerprint of certificate.
  • prints CERT RR (resource record) for specified hostname.
• regression tests
  Strong.
• manual pages
  Detailed.
• README.x509v3
  Brief description of server and client configuration, regression tests, troubleshooting and FAQ.

Get your version from download pages.

Todo:

• to implement wildcards(patterns) for DN in "authorized keys" and "known hosts" files;
• to extend "time limits" with specified time for given revoked certificates.

History:

1. Initial
   Initial support began from 4 Apr 2002 with version "a". Version "b" issued on 11 Jun 2002 add "X509 store". The store is in use in verification process when a certificate is used as user's identity is ssh session. The store allow use of "distinguished name" in authorized keys file.
2. Second stage
   In this phase certificate support is implemented in other PKIX-SSH executables. For first ssh-keygen support certificates since version "c" (20 Jun 2002). This version introduce regression tests. Later in version "d" (30 Jul 2002) support is added to ssh agent.
   As result PKIX-SSH support certificates as user identity entirely.
3. Complete support
   Since version "e" (21 Nov 2002) manual pages are updated with information about X.509 certificate support. As well support for certificates as host key in introduced. As version "f" (30 Jan 2003) CRL are supported. Because certificate support is complete as version "f" client prefer algorithms with certificates for host key.
4. Compatibility
   Compatibility phase begin with version "g" (3 Feb 2003). In version "g1" (30 Apr 2003) regression test scripts are updated to work well with various shells. Since version "g2" (12 Jun 2003) public key algorithm "x509v3-sign-rsa" accept "sha1" signatures in addition to "md5" and now PKIX-SSH is interoperable with all major ssh implementations. This version work fine with OpenSSL 0.9.7+. Later in versions "g3" (25 Feb 2004) and "g4" (9 Maj 2004) code, documentation and regression test are cleaned up.
5. Validator
   Fifth phase began with OCSP (Online Certificate Status Protocol) support added in version "h" (6 Apr 2004). Later version schema is changed to more common format with numbers N.N{.N} and next version is 5.1. In version 5.3 compatibility is enhanced to support (in addition to [RFC3279] DSA signatures) format defined for "ssh-dss" signature. Self issued certificates can be permitted by "autorized keys" file since version 5.4 if configuration allow this. Correction for OCSP responder location obtained from certificate is added in version 5.4 and OCSP SSL support is enabled in 5.5.
6. International
   Since version 6.0 (7 Aug 2007) PKIX-SSH can deal with "distinguished name" stored in autorized keys file as UTF-8 string or escaped. Before to compare printable attributes are converted to utf-8.
7. Integration
   Starting from version 7.0 (22 Aug 2011) PKIX-SSH can communicate with other applications by using OpenSSL engines. For instance client could use certificates and keys stored in external devices.
   Version 7.1 (15 Jan. 2012) support build with FIPS enabled OpenSSL library and adds direct support of X.509 certificates(RSA) from PKCS11 module. Since this version sha1 is preferred algorithm and programs start to identify as PKIX in comment from ssh identification string.
   Build for android host is supported since version 7.2 (22 Apr. 2012). With version 7.5(19 May 2013) "known hosts" file may contain distinguished name of host X.509 certificate.
8. Elliptic
   Version 8.0 (11 Aug.2014) is first secure shell implementation that support X.509 ECDSA algorithm as defined in [RFC6187] - initially for client and server. It is first version that provides complete tar archive for download. With version 8.2 (23 Nov. 2014) adds support of X.509 ECDSA algorithm in agent. From version 8.4 (1 Jul 2015) EC keys or X.509 certificates stored on external device could be used with loadable cryptographic modules - OpenSSL engines.
   Support for FIPS environments is enhanced in version 8.1 (29 Sep. 2014) with fipscheck for "Red Hat" FIPS validated environment. Version 8.2 (23 Nov. 2014) is successfully tested with Solaris 11.2 FIPS validated OpenSSL module.
   Lists with allowed algorithms support patterns since version 8.3 (18 Mart 2015).
   Support for EC keys and certificates stored in PKCS#11 tokens is added in version 8.8 (29 Feb 2016).
9. New OpenSSL API
   Starting with version 9.0 code that uses OpenSSL is updated to use OpenSSL API introduced with version 1.1.0. Local accessor functions ensure compatibility with previous versions of cryptographic library.
10. True RFC6187
    Version 10.0 (25 Feb 2017) correctly implements ecdsa X.509 algorithms according RFC6187. This is reason daemon to start to advertise PKIX-SSH release in connections. Also version adds rsa and dss algorithms according RFC6187 as well.
    In 10.1 (25 Mar 2017) is implemented adaptive public key algorithm selection functionality. It uses server extension "publickey-algorithms@roumenpetrov.info" (preferred) or "server-sig-algs" to find most suitable algorithm for user identity.
    With 10.2 (21 May 2017) Android port is considered complete and is packaged as application - SecureBox.
11. Prefer RFC6187
    Version 11.0 (8 Oct 2017) prefer X.509 algorithms a described in RFC6187 over legacy one described in draft-ietf-secsh-transport-12.txt. Release starts to use more advanced adaptive algorithm selection based on extension "publickey-algorithms@roumenpetrov" with fail-back to "server-sig-algs". In addition daemon for each hostkey offers all supported public key algorithms based on key material.
12. Modern
    Version 12.0 (18 Apr 2019) increase default RSA key size to 3072 bits, removes "insecure" key exchange methods from defaults and adds a post-quantum cryptography key exchange method. In 12.1 (29 Apr 2019) is added algorithm x509v3-rsa2048-sha256 (RFC 6187). Release 12.2 (26 Sep 2019) is prepared for packaging according Android 10 (API Level 29) requirements. Since 12.3 (13 Oct 2019) keys are stored using industrial standard PKCS#8 and use aes256 algorithm.

News archives:

• 19 Jul 2025 (15-16.x-series)
• 13 Jan 2024 (14.x-series)
• 5 Oct 2022 (13.x-series)
• 3 Oct 2020 (12.x/Modern-series)
• 18 Dec 2018 (11.x/Prefer RFC6187-series)
• 21 May 2017 (10.x/True RFC6187-series)
• 19 Dec 2016 (9.x/New OpenSSL API-series)
• 10 Mar 2016 (8.x/Elliptic-series)
• 16 Mar 2014 (7.x/Integration-series)
• 17 Aug 2011 (6.x/International-series)
• 10 Mar 2007 (5.x/Validator-series)
• 19 Aug 2004 (h/Compatibility-series)
• 9 Mar 2004 (g-series)
• 30 Jan 2003 (f and e-series)
• 30 Jul 2002 (d-series and early)

Miscellaneous:

Cryptography

Recommended cryptographic library is OpenSSL. Before to use PKIX-SSH please read
OpenSSL security advisories. In addition to cryptographic algorithms library allows to be used externally managed user identities(keys). Access is based on engine or store functionality. Fully supported releases start from ancient 0.9.7 up to recent stable 1.1.1.
Note: PKIX-SSH builds with OpenSSL releases 3.0* and 3.1* and pass regression tests. It does not support "provider" interface as is not considered stable enough. Also use of such builds is not yet recommended due to overall issues.