To add to the answer above and your comment,
There are four building blocks for ssh session
- Encryption( symmetric keys derived after key exhange per session)
- Data integrity (MAC using eg SHA,HMAC )
- Key exchange methods
- Public key methods or host key methods
the SSH algorithm negotiation involves a key exchange state machine
which begins when the SSH_MSG_KEXINIT message along with algorithms list is sent.
The key exchange method or simply kex specifies session keys for encryption and host authentication host public keys(ssh-rsa, ssh-dss ..) that are sent to the client. The step below are the basic steps that take place for kex using Diffie hellman key exchange algorithm
quoting the RFC https://tools.ietf.org/html/rfc4253
The following steps are used to exchange a key. In this, C is the
client; S is the server; p is a large safe prime; g is a generator
for a subgroup of GF(p); q is the order of the subgroup; V_S is S's
identification string; V_C is C's identification string; K_S is S's
public host key; I_C is C's SSH_MSG_KEXINIT message and I_S is S's
SSH_MSG_KEXINIT message that have been exchanged before this part
begins.
C generates a random number x (1 < x < q) and computes
e = g^x mod p. C sends e to S.
S generates a random number y (0 < y < q) and computes
f = g^y mod p. S receives e. It computes K = e^y mod p,
H = hash(V_C || V_S || I_C || I_S || K_S || e || f || K)
(these elements are encoded according to their types; see below),
and signature s on H with its private host key. S sends
(K_S || f || s) to C. The signing operation may involve a
second hashing operation.
C verifies that K_S really is the host key for S (e.g., using
certificates or a local database). C is also allowed to accept
the key without verification; however, doing so will render the
protocol insecure against active attacks (but may be desirable for
practical reasons in the short term in many environments). C then
computes K = f^x mod p, H = hash(V_C || V_S || I_C || I_S || K_S
|| e || f || K), and verifies the signature s on H.
the local database mentioned in step three in certain systems could be the .ssh/known_hosts file.
So to answer your question the public key is sent to the client by the host during the key-exchange.
The following public key and/or certificate formats are currently defined:
ssh-dss REQUIRED sign Raw DSS Key
ssh-rsa RECOMMENDED sign Raw RSA Key
pgp-sign-rsa OPTIONAL sign OpenPGP certificates (RSA key)
pgp-sign-dss OPTIONAL sign OpenPGP certificates (DSS key)
