使用JSch连接AWS Transfer Family SFTP遇Algorithm negotiation fail问题

连接SFTP服务器时抛出异常：

com.jcraft.jsch.JSchException: Algorithm negotiation fail

使用的连接代码：

final JSch jsch = new JSch();
jsch.addIdentity(
        username,
        privateKey.getBytes(),
        publicKey.getBytes(),
        null
);

Session jschSession = jsch.getSession("username", "server.com");
jschSession.setConfig("StrictHostKeyChecking", "no");
jschSession.connect();

Channel channel = jschSession.openChannel("sftp");
channel.connect();

return (ChannelSftp) channel;

错误日志：

Connecting to server.com port 22
Connection established
Remote version string: SSH-2.0-AWS_SFTP_1.1
Local version string: SSH-2.0-JSCH-0.1.54
CheckCiphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,arcfour,arcfour128,arcfour256
CheckKexes: diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
CheckSignatures: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
SSH_MSG_KEXINIT sent
SSH_MSG_KEXINIT received
kex: server: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
kex: server: rsa-sha2-512,rsa-sha2-256
kex: server: aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr
kex: server: aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr
kex: server: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
kex: server: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
kex: server: none,zlib@openssh.com
kex: server: none,zlib@openssh.com
kex: server: 
kex: server: 
kex: client: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
kex: client: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc
kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc
kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
kex: client: none
kex: client: none
kex: client: 
kex: client: 
Disconnecting from server.com port 22

com.jcraft.jsch.JSchException: Algorithm negotiation fail

环境说明：

• 目标服务器为采用TransferSecurityPolicy-2022-03的AWS Transfer Family SFTP服务器
• 使用JSch 0.1.55版本
• 运行环境为默认启用无限强度加密的Corretto v17

1. 修正KEX算法匹配问题 #

从日志可见，服务器优先使用的curve25519系列密钥交换算法JSch 0.1.55默认不支持，但双方共有的diffie-hellman-group-exchange-sha256可用。手动指定客户端优先使用兼容的KEX算法：

jschSession.setConfig("kex", "diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521");

2. 修复签名算法不匹配 #

服务器仅认可rsa-sha2-512和rsa-sha2-256签名算法，但JSch默认配置中未包含这两项，需手动添加：

jschSession.setConfig("server_host_key", "ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521");
jschSession.setConfig("PubkeyAcceptedKeyTypes", "rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521");

3. 同步MAC算法配置 #

服务器支持的MAC算法包含hmac-sha2-512、hmac-sha2-256，客户端已有这些选项，但明确指定可确保匹配优先级：

jschSession.setConfig("mac.c2s", "hmac-sha2-512,hmac-sha2-256,hmac-sha1");
jschSession.setConfig("mac.s2c", "hmac-sha2-512,hmac-sha2-256,hmac-sha1");

4. 验证JSch版本实际生效 #

日志显示本地使用的是JSCH-0.1.54，与你声明的0.1.55不符，说明存在依赖冲突。检查Maven/Gradle依赖树，排除旧版本JSch，确保0.1.55被正确加载。

5. 替代方案：更换SFTP库 #

若JSch配置调整仍无法解决，建议改用支持现代加密算法的活跃库：

• Apache MINA SSHD：原生支持AWS Transfer 2022-03政策要求的所有算法，配置灵活
• Spring Integration SFTP：基于Apache MINA，适合Spring生态项目

内容的提问来源于stack exchange，提问作者John Russell