Mastering Linux Security and Hardening - Second Edition

Configuring Secure Shell with strong encryption algorithms

As I mentioned previously, the current set of NIST recommendations, the Commercial National Security Algorithm Suite (CNSA Suite), involves using stronger algorithms and longer keys than what we needed to use previously. I'll summarize the new recommendations here in this table:

Algorithm	Usage
RSA, 3,072 bits or larger	Key establishment and digital signatures
Diffie-Hellman (DH), 3,072 bits or larger	Key establishment
ECDH with NIST P-384	Key establishment
ECDSA with NIST P-384	Digital signatures
SHA-384	Integrity
AES-256	Confidentiality

 

In other publications, you might see that NIST Suite B is the recommended standard for encryption ...