diff --git a/ssh/client.go b/ssh/client.go
index 7a12abca..90a18cb8 100644
--- a/ssh/client.go
+++ b/ssh/client.go
@@ -76,12 +76,21 @@ func NewClientConn(c net.Conn, addr string, config *ClientConfig) (Conn, <-chan
 		return nil, nil, nil, fmt.Errorf("ssh: handshake failed: %v", err)
 	}
 	conn.mux = newMux(conn.transport)
+	go conn.mux.loop()
+
 	return conn, conn.mux.incomingChannels, conn.mux.incomingRequests, nil
 }
 
+func (c *connection) clientHandshake(dialAddress string, config *ClientConfig) error {
+	if err := c.clientHandshakeNoAuth(dialAddress, config); err != nil {
+		return err
+	}
+	return c.clientAuthenticate(config)
+}
+
 // clientHandshake performs the client side key exchange. See RFC 4253 Section
 // 7.
-func (c *connection) clientHandshake(dialAddress string, config *ClientConfig) error {
+func (c *connection) clientHandshakeNoAuth(dialAddress string, config *ClientConfig) error {
 	c.clientVersion = []byte(packageVersion)
 	if config.ClientVersion != "" {
 		c.clientVersion = []byte(config.ClientVersion)
diff --git a/ssh/mux_test.go b/ssh/mux_test.go
index 52303896..d144a084 100644
--- a/ssh/mux_test.go
+++ b/ssh/mux_test.go
@@ -15,7 +15,9 @@ func muxPair() (*mux, *mux) {
 	a, b := memPipe()
 
 	s := newMux(a)
+	go s.loop()
 	c := newMux(b)
+	go c.loop()
 
 	return s, c
 }
diff --git a/ssh/server.go b/ssh/server.go
index 85500bd3..b7a96abc 100644
--- a/ssh/server.go
+++ b/ssh/server.go
@@ -157,8 +157,23 @@ func signAndMarshal(k Signer, rand io.Reader, data []byte) ([]byte, error) {
 	return Marshal(sig), nil
 }
 
-// handshake performs key exchange and user authentication.
 func (s *connection) serverHandshake(config *ServerConfig) (*Permissions, error) {
+	if _, err := s.serverHandshakeNoAuth(config); err != nil {
+		return nil, err
+	}
+
+	perms, err := s.serverAuthenticate(config)
+	if err != nil {
+		return nil, err
+	}
+	s.mux = newMux(s.transport)
+	go s.mux.loop()
+
+	return perms, nil
+}
+
+// handshake performs key exchange and user authentication.
+func (s *connection) serverHandshakeNoAuth(config *ServerConfig) (*Permissions, error) {
 	if len(config.hostKeys) == 0 {
 		return nil, errors.New("ssh: server has no host keys")
 	}
diff --git a/ssh/sshpiper.go b/ssh/sshpiper.go
index 931623d9..971ad6af 100644
--- a/ssh/sshpiper.go
+++ b/ssh/sshpiper.go
@@ -375,7 +375,7 @@ func newDownstream(c net.Conn, config *ServerConfig) (*downstream, error) {
 		sshConn: sshConn{conn: c},
 	}
 
-	_, err := s.serverHandshake(&fullConf)
+	_, err := s.serverHandshakeNoAuth(&fullConf)
 	if err != nil {
 		c.Close()
 		return nil, err
@@ -392,7 +392,7 @@ func newUpstream(c net.Conn, addr string, config *ClientConfig) (*upstream, erro
 		sshConn: sshConn{conn: c},
 	}
 
-	if err := conn.clientHandshake(addr, &fullConf); err != nil {
+	if err := conn.clientHandshakeNoAuth(addr, &fullConf); err != nil {
 		c.Close()
 		return nil, err
 	}