I recently found out, that according to the RFC, SSH can negotiate two different cipher (and MAC) algorithms for server-to-client-encryption and for client-to-server-encryption (check section 7.1. for reference).
In section 6.3 this is also asserted:
The ciphers in each direction MUST run independently of each other. Implementations MUST allow the algorithm for each direction to be independently selected, if multiple algorithms are allowed by local policy. In practice however, it is RECOMMENDED that the same algorithm be used in both directions.
I am now wondering:
- Why was this allowed? Has there been a use-case for this odd behaviour back in 2006 when the RFC was published?
- Is there any SSH server out there which actually implements this? OpenSSH appears not to do so.