> ECDH curve choice: This eliminates 9-11 because NIST curves suck. They leak secrets through timing side channels and off-curve inputs. Also, NIST is considere

> ECDH curve choice: This eliminates 9-11 because NIST curves suck. They leak secrets through timing side channels and off-curve inputs. Also, NIST is considered harmful and cannot be trusted. This is FUD. If you have an off-curve attack of any kind, or a timing attack in OpenSSH's P-256 signing code, publish it or keep it to yourself. I appreciate that the article linked to a source, but the source talks about cache timing attacks in a different type of curve. Yes, X25519 is a better curve. Yes Ed25519 is a better signature algorithm. Yes, it's harder to get NIST curve implementations right. They also predate better curves by quite a few years. Technology improves. NIST FUD is not a good reason to hardcode ciphersuites in your ssh config. Go update your software and you'll be fine.