Jsch Algorithm Negotiation Fail

JSchException: Algorithm negotiation fail

There are a couple of places that SSH clients and servers try and agree on a common implementation. Two I know of are encryption and compression. The server and client produce a list of available options and then the best available option in both lists is chosen.

If there is no acceptable option in the lists then it fails with the error you got. I'm guessing from the debug output here but it looks like the only server options for encryption are "aes256-cbc hmac-md5 none".

JSch doesn't do hmac-md5 and aes256-cbc is disabled because of your Java policy files. Two things you could try are...

1. To increase the available encryption libraries on the server, install unrestricted policy files on your client, enabling aes256-cbc (make sure the message saying it is disabled goes away, those policy files are notoriously easy to install on the wrong JVM) from the site:

   For JDK 1.6: http://www.oracle.com/technetwork/java/javase/downloads/jce-6-download-429243.html

   For JDK 1.7: http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html

   For JDK 1.8: http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html

2. or try and disable encryption.

The first is ideal if you have access to the server (trust me aes128-cbc is plenty of encryption), but the second is easy enough to quickly test out the theory.

JSch connection issue: JSchException: Algorithm negotiation fail – Even with JCE installed

INFO: kex: server: curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512

JSch (as of 0.1.55) does not support any of those KEX algorithms.

You will have to have the server support some of the algorithms that JSch supports or switch to another SSH client library.

---

Obligatory warning: Do not use StrictHostKeyChecking=no to blindly accept all host keys. That is a security flaw. You lose a protection against MITM attacks.

For the correct (and secure) approach, see:

How to resolve Java UnknownHostKey, while using JSch SFTP library?

JSch Algorithm negotiation fail

As you can see, the server offers these ciphers:

INFO: kex: server: aes256-cbc,aes192-cbc

But JSch accepts only these:

INFO: kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc

There's no common cipher to choose from.

---

Note that JSch does support both aes256-cbc and aes192-cbc, but requires JCE (Java Cryptography Extension) to allow them.

You probably do not have JCE, so these ciphers are not available. That's why there's

INFO: aes256-cbc is not available.

---

Download Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 8 (or other version if other JDK – 1.7, 1.6, IBM JDK 1.6).

See also an answer to The cipher 'aes256-cbc' is required, but it is not available.

---

Related Topics