diff --git a/ssh/common.go b/ssh/common.go
index b03a3df..0a9df1f 100644
--- a/ssh/common.go
+++ b/ssh/common.go
@@ -53,7 +53,7 @@ var supportedHostKeyAlgos = []string{
 // This is based on RFC 4253, section 6.4, but with hmac-md5 variants removed
 // because they have reached the end of their useful life.
 var supportedMACs = []string{
-	"hmac-sha1", "hmac-sha1-96",
+	"hmac-sha2-256", "hmac-sha1", "hmac-sha1-96",
 }
 
 var supportedCompressions = []string{compressionNone}
diff --git a/ssh/mac.go b/ssh/mac.go
index aff4042..07744ad 100644
--- a/ssh/mac.go
+++ b/ssh/mac.go
@@ -9,6 +9,7 @@ package ssh
 import (
 	"crypto/hmac"
 	"crypto/sha1"
+	"crypto/sha256"
 	"hash"
 )
 
@@ -44,6 +45,9 @@ func (t truncatingMAC) Size() int {
 func (t truncatingMAC) BlockSize() int { return t.hmac.BlockSize() }
 
 var macModes = map[string]*macMode{
+	"hmac-sha2-256": {32, func(key []byte) hash.Hash {
+		return hmac.New(sha256.New, key)
+	}},
 	"hmac-sha1": {20, func(key []byte) hash.Hash {
 		return hmac.New(sha1.New, key)
 	}},