The SSH Page (Advanced Site Settings dialog)

The Enable compression checkbox enables data compression in the SSH connection: data sent by the server is compressed before sending, and decompressed at the client end.

The SSH protocol version selection allows you to select whether to use SSH protocol version 2 or the older version 1.

You should normally leave this at the default of 2. As well as having fewer features, the older SSH-1 protocol is no longer developed, has many known cryptographic weaknesses, and is generally not considered to be secure. WinSCP’s protocol 1 implementation is provided mainly for compatibility, and is no longer being enhanced.

If a server offers both versions, prefer 2. If you have some server or piece of equipment that only talks SSH-1, select 1 here, and do not treat the resulting connection as secure.

WinSCP will not automatically fall back to the other version of the protocol if the server turns out not to match your selection here; instead, it will put up an error message and abort the connection. This prevents an active attacker downgrading an intended SSH-2 connection to SSH-1.1

The SSH-1 support has been removed in the latest beta version.

WinSCP supports a variety of different encryption algorithms, and allows you to choose which one you prefer to use. You can do this by dragging the algorithms up and down in the list box (or moving them using the Up and Down buttons) to specify a preference order. When you make an SSH connection, WinSCP will search down the list from the top until it finds an algorithm supported by the server, and then use that.

WinSCP currently supports the following algorithms:

• AES (Rijndael) – 256, 192, or 128-bit SDCTR or CBC
• ChaCha20-Poly1305, a combined cipher and MAC
• Blowfish – 256-bit SDCTR or 128-bit CBC
• Triple-DES – 168-bit SDCTR or CBC
• Arcfour (RC4) – 256 or 128-bit stream cipher
• Single-DES – 56-bit CBC (see below for SSH-2)

If the algorithm WinSCP finds is below the warn below here line, you will see a warning box when you make the connection:

This warns you that the first available encryption is not a very secure one. Typically you would put the warn below here line between the encryptions you consider secure and the ones you consider substandard. By default, WinSCP supplies a preference order intended to reflect a reasonable preference in terms of security and speed.

In SSH-2, the encryption algorithm is negotiated independently for each direction of the connection, although WinSCP does not support separate configuration of the preference orders. As a result you may get two warnings similar to the one above, possibly with different encryptions.

Single-DES is not recommended in the SSH-2 protocol standards, but one or two server implementations do support it. WinSCP can use single-DES to interoperate with these servers if you enable the Enable legacy use of single-DES in SSH-2 option; by default this is disabled and WinSCP will stick to recommended ciphers.1

You can see actually used encryption algorithm on Server and Protocol Information Dialog.

Read more about Login dialog and Advanced Site Settings dialog.