Cipher suite mystery

Hi Alex.
My client doesn't seem to be able to find some of the slightly more modern algorithms - even though they were explicitly compiled. How can I convince the client to find them ?

I want to be able to specify a strong ciphersuite upon request.
//sess.method_pref(MethodType::Kex, "curve25519-sha256").unwrap();
//sess.method_pref(MethodType::CryptCs,"aes128-gcm@openssh.com").unwrap();
//sess.method_pref(MethodType::MacCs,"hmac-sha2-256-etm@openssh.com").unwrap();

Steps taken

• compiled openssl 3.0.x from scratch using -fPIC
• statically linked openssl
• checked the cipher suite using strace
• observed that modern algos such as gcm appear to be missing

sendto(3, "\0\0\4\254\v\24\t\211 \320JbT\275\375\374\35 ^\30B\235\0\0\1Kcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c\0\0\1\tecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-rsa-cert-v01@openssh.com,ssh-dss\0\0\0\222aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc\0\0\0\222aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc\0\0\0qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com\0\0\0qhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com\0\0\0\4none\0\0\0\4none\0\0\0\0\0\0\0\0\0\0\0\0\0:3\254a\363\252\254SK\321\227", 1200, MSG_NOSIGNAL, NULL, 0) = 1200
recvfrom(3, "\0\0\2\334\5\24\313\26_\220VK\230\25;K\277\303\243\362}\26\0\0\0\255curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha256\0\0\0%rsa-sha2-512,rsa-sha2-256,ssh-ed25519\0\0\0laes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes192-ctr,aes128-ctr\0\0\0laes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes192-ctr,aes128-ctr\0\0\0bhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512\0\0\0bhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512\0\0\0\25none,zlib@openssh.com\0\0\0\25none,zlib@openssh.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 16384, MSG_NOSIGNAL, NULL, NULL) = 736

Start by examining the libssh2 cipher and method preference path associated with the shown method_pref calls, then compare the client’s advertised algorithms with the OpenSSL 3.0.x build described in the report. Done means the cause of the missing algorithms is identified and the requested cipher suite can be selected or the limitation is documented.