I want to know the type of symmetric encryption (after authentication) used by ssh in a connection client-server. I'm not sure who determines the encryption. Client or Server?.

I have looked in /etc/ssh/ssh_config (on client) and /etc/ssh/sshd_config (on server) and nothing.

2 Answers 2


Both ssh_config (client configuration) and sshd_config (server configuration) have a Ciphers option that determine the supported ciphers. If the option doesn't appear in the configuration file, a built-in default applies. It is mentioned in the manual page for your version (unless your distribution tweaked the list at compile time without updated the man page). The actual cipher for a given connection is determined according to RFC 4253:

The chosen encryption algorithm to each direction MUST be the first algorithm on the client's name-list that is also on the server's name-list.

You can see what both parties had to offer and which cipher was chosen for a given connection by running ssh -vv.


The client and server both have to agree about which cipher to use, so nobody really "determines" the encryption -- both config files have a Ciphers option.

You can see which cipher is used using ssh -vv:

$ ssh -vv guthrie
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .