diff --git a/stubs/paramiko/METADATA.toml b/stubs/paramiko/METADATA.toml
index 5c9238818..20ba790a4 100644
--- a/stubs/paramiko/METADATA.toml
+++ b/stubs/paramiko/METADATA.toml
@@ -1,4 +1,4 @@
-version = "3.0.*"
+version = "3.2.*"
 # Requires a version of cryptography where cryptography.hazmat.primitives.ciphers.Cipher is generic
 requires = ["cryptography>=37.0.0"]
 partial_stub = true
diff --git a/stubs/paramiko/paramiko/agent.pyi b/stubs/paramiko/paramiko/agent.pyi
index e7cbf16e0..0d1886ef3 100644
--- a/stubs/paramiko/paramiko/agent.pyi
+++ b/stubs/paramiko/paramiko/agent.pyi
@@ -62,7 +62,8 @@ class AgentKey(PKey):
     blob: bytes
     public_blob: None
     name: str
-    def __init__(self, agent: AgentSSH, blob: ReadableBuffer) -> None: ...
+    comment: str
+    def __init__(self, agent: AgentSSH, blob: ReadableBuffer, comment: str = "") -> None: ...
     def asbytes(self) -> bytes: ...
     def get_name(self) -> str: ...
     def sign_ssh_data(self, data: _LikeBytes, algorithm: str | None = None) -> Message: ...
diff --git a/stubs/paramiko/paramiko/auth_strategy.pyi b/stubs/paramiko/paramiko/auth_strategy.pyi
new file mode 100644
index 000000000..707dd0f3d
--- /dev/null
+++ b/stubs/paramiko/paramiko/auth_strategy.pyi
@@ -0,0 +1,57 @@
+import abc
+from collections.abc import Callable, Iterator
+from logging import Logger
+from pathlib import Path
+from typing import NamedTuple
+
+from paramiko.config import SSHConfig
+from paramiko.pkey import PKey
+from paramiko.ssh_exception import AuthenticationException
+from paramiko.transport import Transport
+
+class AuthSource:
+    username: str
+    def __init__(self, username: str) -> None: ...
+    @abc.abstractmethod
+    def authenticate(self, transport: Transport) -> list[str]: ...
+
+class NoneAuth(AuthSource):
+    def authenticate(self, transport: Transport) -> list[str]: ...
+
+class Password(AuthSource):
+    password_getter: Callable[[], str]
+    def __init__(self, username: str, password_getter: Callable[[], str]) -> None: ...
+    def authenticate(self, transport: Transport) -> list[str]: ...
+
+class PrivateKey(AuthSource):
+    def authenticate(self, transport: Transport) -> list[str]: ...
+
+class InMemoryPrivateKey(PrivateKey):
+    pkey: PKey
+    def __init__(self, username: str, pkey: PKey) -> None: ...
+
+class OnDiskPrivateKey(PrivateKey):
+    source: str
+    path: Path
+    pkey: PKey
+    def __init__(self, username: str, source: str, path: Path, pkey: PKey) -> None: ...
+
+class SourceResult(NamedTuple):
+    source: AuthSource
+    result: list[str] | Exception
+
+class AuthResult(list[SourceResult]):
+    strategy: AuthStrategy
+    def __init__(self, strategy: AuthStrategy, *args: SourceResult, **kwargs: object) -> None: ...
+
+class AuthFailure(AuthenticationException):
+    result: AuthResult
+    def __init__(self, result: AuthResult) -> None: ...
+
+class AuthStrategy:
+    ssh_config: SSHConfig
+    log: Logger
+    def __init__(self, ssh_config: SSHConfig) -> None: ...
+    @abc.abstractmethod
+    def get_sources(self) -> Iterator[AuthSource]: ...
+    def authenticate(self, transport: Transport) -> list[SourceResult]: ...
diff --git a/stubs/paramiko/paramiko/client.pyi b/stubs/paramiko/paramiko/client.pyi
index 413bf0fdb..c6fe88441 100644
--- a/stubs/paramiko/paramiko/client.pyi
+++ b/stubs/paramiko/paramiko/client.pyi
@@ -1,15 +1,14 @@
 from collections.abc import Iterable, Mapping
 from typing import NoReturn, Protocol
 
+from paramiko.auth_strategy import AuthStrategy
 from paramiko.channel import Channel, ChannelFile, ChannelStderrFile, ChannelStdinFile
 from paramiko.hostkeys import HostKeys
 from paramiko.pkey import PKey
 from paramiko.sftp_client import SFTPClient
-from paramiko.transport import Transport
+from paramiko.transport import Transport, _SocketLike
 from paramiko.util import ClosingContextManager
 
-from .transport import _SocketLike
-
 class _TransportFactory(Protocol):
     def __call__(
         self,
@@ -47,10 +46,12 @@ class SSHClient(ClosingContextManager):
         gss_host: str | None = None,
         banner_timeout: float | None = None,
         auth_timeout: float | None = None,
+        channel_timeout: float | None = None,
         gss_trust_dns: bool = True,
         passphrase: str | None = None,
         disabled_algorithms: Mapping[str, Iterable[str]] | None = None,
         transport_factory: _TransportFactory | None = None,
+        auth_strategy: AuthStrategy | None = None,
     ) -> None: ...
     def close(self) -> None: ...
     def exec_command(
diff --git a/stubs/paramiko/paramiko/rsakey.pyi b/stubs/paramiko/paramiko/rsakey.pyi
index 3ad9e14be..ade72fde4 100644
--- a/stubs/paramiko/paramiko/rsakey.pyi
+++ b/stubs/paramiko/paramiko/rsakey.pyi
@@ -27,7 +27,7 @@ class RSAKey(PKey):
     def get_name(self) -> str: ...
     def get_bits(self) -> int: ...
     def can_sign(self) -> bool: ...
-    def sign_ssh_data(self, data: bytes, algorithm: str = "ssh-rsa") -> Message: ...  # type: ignore[override]
+    def sign_ssh_data(self, data: bytes, algorithm: str | None = None) -> Message: ...  # type: ignore[override]
     def verify_ssh_sig(self, data: bytes, msg: Message) -> bool: ...
     def write_private_key_file(self, filename: str, password: str | None = None) -> None: ...
     def write_private_key(self, file_obj: IO[str], password: str | None = None) -> None: ...