If your server doesn’t support GSSAPI key exchange, it may still support GSSAPI in the SSH user authentication phase. (This feature is commonly referred to as “cascading credentials”.)

The SSH key exchange can be repeated later in the session, and this allows your Kerberos V5 credentials (which are typically short-lived) to be automatically re-delegated to the server when they are refreshed on the client. The advantage of doing GSSAPI authentication as part of the SSH key exchange is apparent when you are using credential delegation. If the user running WinSCP has current Kerberos V5 credentials, then WinSCP will select the GSSAPI key exchange methods in preference to any of the ordinary SSH key exchange methods configured in the preference list. WinSCP can only perform the GSSAPI-authenticated key exchange methods when using Kerberos V5, and not other GSSAPI mechanisms. They are enabled with the Attempt GSSAPI key exchange checkbox.

WinSCP supports a set of key exchange methods that also incorporates GSSAPI-based authentication. We no longer recommend using this method, and it’s not used by default however, it may be the only method supported by very old server software.

Group 1: Diffie-Hellman key exchange with a well-known 1024-bit group.

RSA key exchange: this requires much less computational effort on the part of the client, and somewhat less on the part of the server, than Diffie-Hellman key exchange.

Group 14: Diffie-Hellman key exchange with a well-known 2048-bit group.

We recommend use of this method instead of the well-known groups, if possible.

Group exchange: with this method, instead of using a fixed group, WinSCP requests that the server suggest a group to use for key exchange the server can avoid groups known to be weak, and possibly invent new ones over time, without any changes required to WinSCP’s configuration.ECDH: elliptic curve Diffie-Hellman key exchange.WinSCP currently supports the following key exchange methods: WinSCP supports a variety of key exchange methods, and allows you to choose which one you prefer to use configuration is similar to cipher selection.

Windows terminal ssh no kex alg