Nicolas Williams wrote:
This would require the use of extra packets after kex to verify that one's peer truly did not support the new packets.
Sorry, on this occasion, I meant an extra packet sent after receiving the other side's key if the reserved field from the remote side is non-zero (as Markus suggested). It's an extra round-trip, but should be fairly foolproof. Basically, both sides, upon receiving non-zero from the other side, embark on new-and-shiny-kex and forget about whatever they would have done with current-kex.
-- Jon Bright Lead Programmer, Silicon Circus Ltd. http://www.siliconcircus.com