The tinyssh server only uses DJB cipher suites; the [email protected] implementation has been in place for quite some time without any major issues.

https://www.libssh.org/2013/11/03/openssh-introduces-curve25...

"This algorithm does not rely on NIST-based curves and gives us more security confidence against a possible backdoor in nistp-256 curve. Today is a big day for us because OpenSSH team approved my patch and made [email protected] the default key exchange!"

Also, the original RSA keys used in SSH have a sha-1 problem, and have been deprecated.

https://www.zdnet.com/article/openssh-to-deprecate-sha-1-log...

https://www.openssh.com/releasenotes.html

    This release disables RSA signatures using the SHA-1 hash algorithm
    by default. This change has been made as the SHA-1 hash algorithm is
    cryptographically broken, and it is possible to create chosen-prefix
    hash collisions for <USD$50K [1]

    For most users, this change should be invisible and there is
    no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
    RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
    will automatically use the stronger algorithm where possible.

    Incompatibility is more likely when connecting to older SSH
    implementations that have not been upgraded or have not closely tracked
    improvements in the SSH protocol.

The concerns about the nist curves and the dual ec issue are two completely separate things.

Furthermore:

> Also, the original RSA keys used in SSH have a sha-1 problem, and have been deprecated.

This is wrong. What's correct is that openssh plans to deprecate sha1 signatures, but you can still use your RSA keys with sha2-based signatures.

Ironically I lately had a payment service provider handing me newly generated ecdsa ssh keys where ed25519 should be supported to the best of my knowledge. And fluxcd moved from rsa to ecdsa by https://github.com/fluxcd/flux2/releases/tag/v0.21.0.

Kinda strange people are moving on to EC cipher - which is good, but to the cipher which has the NIST/NSA smell.

I have upgraded all of my ECDSA host keys to the 521 curve, which has some praise from DJB, unlike the 256 and 384 curves (ssh-keygen -b #: "For ECDSA keys, the -b flag determines the key length by selecting from one of three elliptic curve sizes: 256, 384 or 521 bits").

http://blog.cr.yp.to/20140323-ecdsa.html

"To be fair I should mention that there's one standard NIST curve using a nice prime, namely 2^521 - 1; but the sheer size of this prime makes it much slower than NIST P-256."