Re: Unable to exchange encryption keys

--===============7909380820151617548==
Content-Type: multipart/alternative; boundary="000000000000390cc206446d8544"

--000000000000390cc206446d8544
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Nov 25, 2025 at 9:50=E2=80=AFAM Werner Stolz via curl-users <
[email protected]> wrote:

> I have made a tiny bit of progress.
>
>
>
> For this particular file transfer partner, I can log in manually using th=
e
> sftp command if I use the following command line option: -o
> HostKeyAlgorithms=3D+ssh-dss
>
>
You should have two (maybe three) keys nowadays.  The first two are ed25519
and ecdsa keys.  They should work just about everywhere.  The third key is
a RSA key to connect to old SSH servers.  If you don't connect to old
servers, then don't have a RSA key.

You should not be using DSS keys.  They were deprecated about 10 years ago
in OpenSSH 7.0 (2015-08-11).  From <
https://www.openssh.org/releasenotes.html>:

 * Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled
   by default at run-time. These may be re-enabled using the
   instructions at http://www.openssh.com/legacy.html


> This actually confuses me even more, because I am already using the =E2=
=80=98-k=E2=80=99
> option on the curl command line, which has always allowed
> this to work in the past.
>
>
>
> Also, when I remove the =E2=80=98-k=E2=80=99 option from curl, I get a di=
fferent error
> message:
>
>
>
> * Unknown host key type: 3932160
>
> * closing connection #0
>
> curl: (79) Unknown host key type: 3932160
>
>
>
> It almost seems like someone broke the =E2=80=98-k=E2=80=99 option in thi=
s version of
> curl.  Which seems unlikely, at the least.
>

--000000000000390cc206446d8544
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g=
mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Nov 25,=
 2025 at 9:50=E2=80=AFAM Werner Stolz via curl-users &lt;<a href=3D"mailto:=
[email protected]">[email protected]</a>&gt; wrote:<br></div>=
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left:1px solid rgb(204,204,204);padding-left:1ex"><div class=3D"msg-4067310=
601102690031">





<div lang=3D"EN-US" style=3D"overflow-wrap: break-word;">
<div class=3D"m_-4067310601102690031WordSection1">
<p class=3D"MsoNormal"><span style=3D"font-size:11pt">I have made a tiny bi=
t of progress.<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11pt"><u></u>=C2=A0<u></u><=
/span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11pt">For this particular f=
ile transfer partner, I can log in manually using the sftp command if I use=
 the following command line option: -o HostKeyAlgorithms=3D+ssh-dss<u></u><=
u></u></span></p><p class=3D"MsoNormal"><span style=3D"font-size:11pt"></sp=
an></p></div></div></div></blockquote><div><br></div><div>You should have t=
wo (maybe three) keys nowadays.=C2=A0 The first two are ed25519 and ecdsa k=
eys.=C2=A0 They should work just about everywhere.=C2=A0 The third=C2=A0key=
 is a RSA key to connect to old SSH servers.=C2=A0 If you don&#39;t connect=
 to old servers, then don&#39;t have a RSA key.</div><div><br></div><div>Yo=
u should not be using DSS keys.=C2=A0 They were deprecated about 10 years a=
go in OpenSSH 7.0 (2015-08-11).=C2=A0 From &lt;<a href=3D"https://www.opens=
sh.org/releasenotes.html">https://www.openssh.org/releasenotes.html</a>&gt;=
:</div><div><br></div><div>=C2=A0* Support for ssh-dss, ssh-dss-cert-* host=
 and user keys is disabled<br>=C2=A0 =C2=A0by default at run-time. These ma=
y be re-enabled using the<br>=C2=A0 =C2=A0instructions at <a href=3D"http:/=
/www.openssh.com/legacy.html">http://www.openssh.com/legacy.html</a></div><=
div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0=
px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div clas=
s=3D"msg-4067310601102690031"><div lang=3D"EN-US" style=3D"overflow-wrap: b=
reak-word;"><div class=3D"m_-4067310601102690031WordSection1"><p class=3D"M=
soNormal"><span style=3D"font-size:11pt">This actually confuses me even mor=
e, because I am already using the =E2=80=98-k=E2=80=99 option on the curl c=
ommand line, which has always allowed<br>
this to work in the past.<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11pt"><u></u>=C2=A0<u></u><=
/span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11pt">Also, when I remove t=
he =E2=80=98-k=E2=80=99 option from curl, I get a different error message:<=
u></u><u></u></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11pt"><u></u>=C2=A0<u></u><=
/span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11pt">* Unknown host key ty=
pe: 3932160<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11pt">* closing connection =
#0<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11pt">curl: (79) Unknown ho=
st key type: 3932160<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11pt"><u></u>=C2=A0<u></u><=
/span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11pt">It almost seems like =
someone broke the =E2=80=98-k=E2=80=99 option in this version of curl.=C2=
=A0 Which seems unlikely, at the least.=C2=A0</span><br></p></div></div></d=
iv></blockquote></div></div>

--000000000000390cc206446d8544--

--===============7909380820151617548==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users
Etiquette:   https://curl.se/mail/etiquette.html

--===============7909380820151617548==--