I want to know the type of symmetric encryption (after authentication) used by ssh in a connection client-server. I'm not sure who determines the encryption. Client or Server?.

I have looked in /etc/ssh/ssh_config (on client) and /etc/ssh/sshd_config (on server) and nothing.


Both ssh_config (client configuration) and sshd_config (server configuration) have a Ciphers option that determine the supported ciphers. If the option doesn't appear in the configuration file, a built-in default applies. It is mentioned in the manual page for your version (unless your distribution tweaked the list at compile time without updated the man page). The actual cipher for a given connection is determined according to RFC 4253:

The chosen encryption algorithm to each direction MUST be the first algorithm on the client's name-list that is also on the server's name-list.

You can see what both parties had to offer and which cipher was chosen for a given connection by running ssh -vv.


The client and server both have to agree about which cipher to use, so nobody really "determines" the encryption -- both config files have a Ciphers option.

You can see which cipher is used using ssh -vv:

$ ssh -vv guthrie
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.