please update Dropbear supported kex

[perkelix]

2025.87 - 5 March 2025

• Add post-quantum key exchange. These avoid the possibility of current
  stored traffic being decrypted using a possible future quantum
  computer.

  sntrup761 added by Matt Johnston, using sntrup761 implementation from
  Daniel J. Bernstein, Chitchanok Chuengsatiansup, Tanja Lange and
  Christine van Vredendaal, with integration work from OpenSSH.

  ML-KEM added by Loganaden Velvindron, Jaykishan Mutkawoa, Kavish Nadan,
  using libcrux, also based on OpenSSH work.

[perkelix]

FYI, this is what ssh-audit reports for current Dropbear:

$ ssh-audit.py -p 2222 u1400.internal
# general
(gen) banner: SSH-2.0-dropbear_2026.92
(gen) software: Dropbear SSH 2026.92
(gen) compatibility: OpenSSH 9.9+, Dropbear SSH 2020.79+
(gen) compression: enabled (zlib@openssh.com, zlib)

# key exchange algorithms
(kex) sntrup761x25519-sha512              -- [info] available since OpenSSH 9.9
                                          `- [info] default key exchange in OpenSSH 9.9
                                          `- [info] hybrid key exchange based on post-quantum resistant algorithm and proven conventional X25519 algorithm
(kex) sntrup761x25519-sha512@openssh.com  -- [info] available since OpenSSH 8.5
                                          `- [info] default key exchange from OpenSSH 9.0 to 9.8
                                          `- [info] hybrid key exchange based on post-quantum resistant algorithm and proven conventional X25519 algorithm
(kex) mlkem768x25519-sha256               -- [info] available since OpenSSH 9.9
                                          `- [info] default key exchange since OpenSSH 10.0
                                          `- [info] hybrid key exchange based on post-quantum resistant algorithm and proven conventional X25519 algorithm
(kex) curve25519-sha256                   -- [warn] does not provide protection against post-quantum attacks
                                          `- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76
                                          `- [info] default key exchange from OpenSSH 7.4 to 8.9
(kex) curve25519-sha256@libssh.org        -- [warn] does not provide protection against post-quantum attacks
                                          `- [info] available since OpenSSH 6.4, Dropbear SSH 2013.62
                                          `- [info] default key exchange from OpenSSH 6.5 to 7.3
(kex) ecdh-sha2-nistp521                  -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
                                          `- [warn] does not provide protection against post-quantum attacks
                                          `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(kex) ecdh-sha2-nistp384                  -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
                                          `- [warn] does not provide protection against post-quantum attacks
                                          `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(kex) ecdh-sha2-nistp256                  -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
                                          `- [warn] does not provide protection against post-quantum attacks
                                          `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(kex) diffie-hellman-group14-sha256       -- [warn] 2048-bit modulus only provides 112-bits of symmetric strength
                                          `- [warn] does not provide protection against post-quantum attacks
                                          `- [info] available since OpenSSH 7.3, Dropbear SSH 2016.73
(kex) kexguess2@matt.ucc.asn.au           -- [warn] does not provide protection against post-quantum attacks
                                          `- [info] available since Dropbear SSH 2013.57
(kex) kex-strict-s-v00@openssh.com        -- [info] pseudo-algorithm that denotes the peer supports a stricter key exchange method as a counter-measure to the Terrapin attack (CVE-2023-48795)

# host-key algorithms
(key) ssh-ed25519                         -- [info] available since OpenSSH 6.5, Dropbear SSH 2020.79
(key) ecdsa-sha2-nistp256                 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
                                          `- [warn] using weak random number generator could reveal the key
                                          `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(key) rsa-sha2-256 (4096-bit)             -- [info] available since OpenSSH 7.2, Dropbear SSH 2020.79

# encryption algorithms (ciphers)
(enc) chacha20-poly1305@openssh.com       -- [info] available since OpenSSH 6.5, Dropbear SSH 2020.79
                                          `- [info] default cipher since OpenSSH 6.9
(enc) aes256-ctr                          -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52
(enc) aes128-ctr                          -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52

# message authentication code algorithms
(mac) hmac-sha2-256                       -- [warn] using encrypt-and-MAC mode
                                          `- [info] available since OpenSSH 5.9, Dropbear SSH 2013.56

# fingerprints
(fin) ssh-ed25519: SHA256:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU
(fin) ssh-rsa: SHA256:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU

# algorithm recommendations (for Dropbear SSH 2026.92)
(rec) -ecdh-sha2-nistp256                 -- kex algorithm to remove 
(rec) -ecdh-sha2-nistp384                 -- kex algorithm to remove 
(rec) -ecdh-sha2-nistp521                 -- kex algorithm to remove 
(rec) -ecdsa-sha2-nistp256                -- key algorithm to remove 
(rec) +twofish128-ctr                     -- enc algorithm to append 
(rec) +twofish256-ctr                     -- enc algorithm to append 
(rec) -curve25519-sha256                  -- kex algorithm to remove 
(rec) -curve25519-sha256@libssh.org       -- kex algorithm to remove 
(rec) -diffie-hellman-group14-sha256      -- kex algorithm to remove 
(rec) -hmac-sha2-256                      -- mac algorithm to remove 
(rec) -kexguess2@matt.ucc.asn.au          -- kex algorithm to remove 

[perkelix]

src/default_options.h also suggests that the following are available, but disabled by default:

• diffie-hellman-group16-sha512 (group14-sha256 is the only DH enabled by default, and the minimal bit size correspondingly set at 2048).
• GCM ciphers.