Okay its easy to create a ssh pair with ssh-keygen, but how do I generate with ssh-keygen a ssh pair which allows me to use AES-256-CBC?The default one is always AES-128-CBC, I tried already different parameters but they didn't function like:ssh-keygen -b 4096 -t rsa -Z aes-256-cbcBut they didn't work, any idea how to do so?
Generate a SSH pair with AES-256-CBC
linux;debian;ssh
You do not generate the key used by aes when you use ssh-keygen. Since aes is a symmetric cipher, its keys do not come in pairs.  Both ends of the communication use the same key.The key generated by ssh-keygen uses public key cryptography for authentication. From the ssh-keygen manual: ssh-keygen generates, manages and converts authentication keys for ssh(1).  ssh-keygen can create RSA keys for use by SSH protocol version 1 and DSA, ECDSA, Ed25519 or RSA keys for use by SSH protocol version 2.From the ssh manual: Public key authentication works as follows: The scheme is based on public-key cryptography, using cryptosystems where encryption and decryption are done using separate keys, and it is unfeasible to derive the decryption key from the encryption key.  The idea is that each user creates a public/private key pair for authentication purposes.  The server knows the public key, and only the user knows the private key. ssh implements public key authentication protocol automatically, using one of the DSA, ECDSA, Ed25519 or RSA algorithms.The  problem with public key cryptography is that it is quite slow.  Symmetric key cryptography is much faster and is used by ssh for the actual data transfer. The key used for the symmetric cryptography is generated on the fly after the connection was established (quoting from the sshd manual): For protocol 2, forward security is provided through a Diffie-Hellman key agreement.  This key agreement results in a shared session key.  The rest of the session is encrypted using a symmetric cipher, currently 128-bit AES, Blowfish, 3DES, CAST128, Arcfour, 192-bit AES, or 256-bit AES.  The client selects the encryption algorithm to use from those offered by the server.  Additionally, session integrity is provided through a cryptographic message authentication code (hmac-md5, hmac-sha1, umac-64, umac-128, hmac-ripemd160, hmac-sha2-256 or hmac-sha2-512).If you wish to use aes256-cbc you need to specify it on the command line using the -c option, in its most basic form this would look like this:$ ssh -c aes256-cbc user@hostYou can also specify your preferred selection of ciphers in ssh_config, using a comma-separated list.  Tinkering with the defaults, is, however, not recommended since this is best left to the experts.  There are lots of considerations and years of experience that went into the choice of defaults by the OpenSSH developers.