Which is mitigated in SSH by two things: 1) The DH group is negotiated by both peers from fixed list. 2) output of key exchange is hashed with various values t

Which is mitigated in SSH by two things: 1) The DH group is negotiated by both peers from fixed list. 2) output of key exchange is hashed with various values that are not all controlled by same side of connection Also after reading the relevant part of RFC4253 I've found out that the session id is conceptually an output of key exchange, but in the DH case it's derived from contents of key exchange messages and not from the result itself (not that it makes much of an difference).