Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to know the type of symmetric encryption (after authentication) used by ssh in a connection client-server. I'm not sure who determines the encryption. Client or Server?.

I have looked in /etc/ssh/ssh_config (on client) and /etc/ssh/sshd_config (on server) and nothing.

share|improve this question
up vote 7 down vote accepted

Both ssh_config (client configuration) and sshd_config (server configuration) have a Ciphers option that determine the supported ciphers. If the option doesn't appear in the configuration file, a built-in default applies. It is mentioned in the manual page for your version (unless your distribution tweaked the list at compile time without updated the man page). The actual cipher for a given connection is determined according to RFC 4253:

The chosen encryption algorithm to each direction MUST be the first algorithm on the client's name-list that is also on the server's name-list.

You can see what both parties had to offer and which cipher was chosen for a given connection by running ssh -vv.

share|improve this answer

The client and server both have to agree about which cipher to use, so nobody really "determines" the encryption -- both config files have a Ciphers option.

You can see which cipher is used using ssh -vv:

$ ssh -vv guthrie
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.