7.1. Algorithm Negotiation

Key exchange begins by each side sending the following packet:

byte         SSH_MSG_KEXINIT
byte[16]     cookie (random bytes)
name-list    kex_algorithms
name-list    server_host_key_algorithms
name-list    encryption_algorithms_client_to_server
name-list    encryption_algorithms_server_to_client
name-list    mac_algorithms_client_to_server
name-list    mac_algorithms_server_to_client
name-list    compression_algorithms_client_to_server
name-list    compression_algorithms_server_to_client
name-list    languages_client_to_server
name-list    languages_server_to_client
boolean      first_kex_packet_follows
uint32       0 (reserved for future extension)

Each of the algorithm name-lists MUST be a comma-separated list of algorithm names. Each supported (allowed) algorithm MUST be listed in order of preference, from most to least.

The first algorithm in each name-list MUST be the preferred (guessed) algorithm. Each name-list MUST contain at least one algorithm name.

Algorithm selection: Iterate over client's algorithms, one at a time. Choose the first algorithm that satisfies the requirements and is also supported by the server. If no algorithm satisfying all conditions can be found, the connection fails, and both sides MUST disconnect.

Once a party has sent a SSH_MSG_KEXINIT message for key exchange, until it has sent a SSH_MSG_NEWKEYS message (Section 7.3), it MUST NOT send any messages other than:

Transport layer generic messages (1 to 19) (but SSH_MSG_SERVICE_REQUEST and SSH_MSG_SERVICE_ACCEPT MUST NOT be sent)
Algorithm negotiation messages (20 to 29) (but further SSH_MSG_KEXINIT messages MUST NOT be sent)
Specific key exchange method messages (30 to 49)

7.1. Algorithm Negotiation​

7.1. Algorithm Negotiation