--- a/cli-session.c	Sun Mar 24 00:02:20 2013 +0800
+++ b/cli-session.c	Fri Mar 29 20:44:13 2013 +0800
@@ -109,6 +109,12 @@
 
 }
 
+static void cli_send_kex_first_guess() {
+	send_msg_kexdh_init();
+	dropbear_log(LOG_INFO, "kexdh_init guess sent");
+	//cli_ses.kex_state = KEXDH_INIT_SENT;			
+}
+
 static void cli_session_init() {
 
 	cli_ses.state = STATE_NOTHING;
@@ -148,6 +154,9 @@
 	ses.packettypes = cli_packettypes;
 
 	ses.isserver = 0;
+
+	ses.send_kex_first_guess = cli_send_kex_first_guess;
+
 }
 
 /* This function drives the progress of the session - it initiates KEX,
@@ -157,15 +166,13 @@
 	TRACE(("enter cli_sessionloop"))
 
 	if (ses.lastpacket == SSH_MSG_KEXINIT && cli_ses.kex_state == KEX_NOTHING) {
-		cli_ses.kex_state = KEXINIT_RCVD;
-	}
-
-	if (cli_ses.kex_state == KEXINIT_RCVD) {
-
 		/* We initiate the KEXDH. If DH wasn't the correct type, the KEXINIT
 		 * negotiation would have failed. */
-		send_msg_kexdh_init();
-		cli_ses.kex_state = KEXDH_INIT_SENT;
+		if (!ses.kexstate.our_first_follows_matches) {
+			dropbear_log(LOG_INFO, "kexdh_init after remote's kexinit");
+			send_msg_kexdh_init();
+		}
+		cli_ses.kex_state = KEXDH_INIT_SENT;			
 		TRACE(("leave cli_sessionloop: done with KEXINIT_RCVD"))
 		return;
 	}