Re: Unable to exchange encryption keys

--===============3368843947179993368==
Content-Type: multipart/alternative; boundary="0000000000006d5c83064464f0ba"

--0000000000006d5c83064464f0ba
Content-Type: text/plain; charset="UTF-8"

Hi,

I can also improve on that answer.

Check your targets sshd config.
In the config file you can find exactly which encryption keys are allowed
by the server.
You could also try and see with ssh -vvv what encryption keys your ssh
offers, and what the target server will allow.

Most likely libssh is offering keys which are disabled by the target.

I do remember that there were (recent == 1y+) some ssh exploits. To combat
those, the fix was to reduce the number of allowed encryption keys, as only
some of the keys were flawed.

Potentially this is also affecting you.


Bastian

On Mon, 24 Nov 2025, 23:17 Daniel Stenberg via curl-users, <
[email protected]> wrote:

> On Mon, 24 Nov 2025, Werner Stolz via curl-users wrote:
>
> > We first encountered this error in 2022, and the only suggestion was to
> > upgrade our version of curl.  We have now done that, and the problem
> > actually seems WORSE.
>
> As you're using SFTP, I think this problem is within libssh2 and that a
> curl
> update does almost nothing for improving this case.
>
> > * libssh2 cryptography backend: openssl compatible
> > * User: USER
> > * Failure establishing ssh session: -5, Unable to exchange encryption
> keys
> > * closing connection #0
> > curl: (2) Failure establishing ssh session: -5, Unable to exchange
> encryption keys
>
> This is libssh2 returning an error when it fails to establish an SSH
> session
> with the server.
>
> libssh2 is an understaffed and resource drained project. I propose you
> roll up
> your sleeves and do some debugging of your own, and maybe check with other
> libssh2 users if they have seen something similar.
>
> --
>
>   / daniel.haxx.se || https://rock-solid.curl.dev
> --
> Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users
> Etiquette:   https://curl.se/mail/etiquette.html
>

--0000000000006d5c83064464f0ba
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Hi,=C2=A0<div dir=3D"auto"><br></div><div dir=3D"auto">I =
can also improve on that answer.=C2=A0</div><div dir=3D"auto"><br></div><di=
v dir=3D"auto">Check your targets sshd config.=C2=A0</div><div dir=3D"auto"=
>In the config=C2=A0file you can find exactly which encryption keys are all=
owed by the server.=C2=A0</div><div dir=3D"auto">You could also try and see=
 with ssh -vvv what encryption keys your ssh offers, and what the target se=
rver will allow.=C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"auto">M=
ost likely libssh is offering keys which are disabled by the target.=C2=A0<=
/div><div dir=3D"auto"><br></div><div dir=3D"auto">I do remember that there=
 were (recent =3D=3D 1y+) some ssh exploits. To combat those, the fix was t=
o reduce the number of allowed encryption keys, as only some of the keys we=
re flawed.=C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"auto">Potenti=
ally this is also affecting you.</div><div dir=3D"auto"><br></div><div dir=
=3D"auto"><br></div><div dir=3D"auto">Bastian</div></div><br><div class=3D"=
gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On=
 Mon, 24 Nov 2025, 23:17 Daniel Stenberg via curl-users, &lt;<a href=3D"mai=
lto:[email protected]">[email protected]</a>&gt; wrote:<br></=
div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-lef=
t:1px #ccc solid;padding-left:1ex">On Mon, 24 Nov 2025, Werner Stolz via cu=
rl-users wrote:<br>
<br>
&gt; We first encountered this error in 2022, and the only suggestion was t=
o <br>
&gt; upgrade our version of curl.=C2=A0 We have now done that, and the prob=
lem <br>
&gt; actually seems WORSE.<br>
<br>
As you&#39;re using SFTP, I think this problem is within libssh2 and that a=
 curl <br>
update does almost nothing for improving this case.<br>
<br>
&gt; * libssh2 cryptography backend: openssl compatible<br>
&gt; * User: USER<br>
&gt; * Failure establishing ssh session: -5, Unable to exchange encryption =
keys<br>
&gt; * closing connection #0<br>
&gt; curl: (2) Failure establishing ssh session: -5, Unable to exchange enc=
ryption keys<br>
<br>
This is libssh2 returning an error when it fails to establish an SSH sessio=
n <br>
with the server.<br>
<br>
libssh2 is an understaffed and resource drained project. I propose you roll=
 up <br>
your sleeves and do some debugging of your own, and maybe check with other =
<br>
libssh2 users if they have seen something similar.<br>
<br>
-- <br>
<br>
=C2=A0 / <a href=3D"http://daniel.haxx.se" rel=3D"noreferrer noreferrer" ta=
rget=3D"_blank">daniel.haxx.se</a> || <a href=3D"https://rock-solid.curl.de=
v" rel=3D"noreferrer noreferrer" target=3D"_blank">https://rock-solid.curl.=
dev</a><br>
-- <br>
Unsubscribe: <a href=3D"https://lists.haxx.se/mailman/listinfo/curl-users" =
rel=3D"noreferrer noreferrer" target=3D"_blank">https://lists.haxx.se/mailm=
an/listinfo/curl-users</a><br>
Etiquette:=C2=A0 =C2=A0<a href=3D"https://curl.se/mail/etiquette.html" rel=
=3D"noreferrer noreferrer" target=3D"_blank">https://curl.se/mail/etiquette=
.html</a><br>
</blockquote></div>

--0000000000006d5c83064464f0ba--

--===============3368843947179993368==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users
Etiquette:   https://curl.se/mail/etiquette.html

--===============3368843947179993368==--