The SSH handshake is the first protocol exchange between a client and a server. During this phase, the peers identify the SSH version, negotiate cryptographic algorithms, exchange key material, and derive session keys that protect the rest of the connection. It is the setup step that turns an outbound TCP connection into an encrypted SSH session.
This stage matters because it happens before normal application logic can check or filter much of the data. A flaw in handshake parsing or negotiation can let a hostile SSH server send crafted responses that crash a client, trigger memory corruption, or bypass expected security checks. Defenders care about handshake behavior when reviewing client libraries, patching embedded dependencies, and enforcing strict host-key verification. If the handshake fails safely, the rest of the session never starts; if it fails badly, the protocol itself becomes the attack surface.