One Identity Safeguard for Privileged Sessions 6.9.3 - Administration Guide

Supported encryption algorithms

The following tables contain all the encryption algorithms you can configure One Identity Safeguard for Privileged Sessions (SPS) to recognize. If you use a configuration that is only partially supported, SPS might ignore the connection without warning.

Key exchange algorithms

The default SPS configuration for both the client and the server is the following:

ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256

The following key exchange (KEX) algorithms are recognized:

Figure 229: Key exchange (KEX) algorithms

During an SSH session, SPS performs a key re-exchange after each gigabyte of transmitted data or after each hour of connection time, whichever comes sooner.

Cipher algorithms

The default SPS configuration for both the client and the server is the following:

aes128-ctr,aes192-ctr,aes256-ctr

The following cipher algorithms are recognized:

Figure 230: Cipher algorithms

Message authentication code (MAC) algorithms

The default SPS configuration for both the client and the server is the following:

hmac-sha2-256,hmac-sha2-512

The following MAC algorithms are recognized:

Figure 231: Message Authentication Code (MAC) algorithms

SSH compression algorithms

The default SPS configuration for both the client and the server is the following:

none

The following SSH compression algorithms are recognized:

Figure 232: SSH compression algorithms

Host key algorithms

The default SPS configuration for both the client and the server is the following:

ecdsa-sha2-nistp256,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

The following host key algorithms are recognized:

Figure 233: Host key algorithms