go.crypto/ssh: implement ECDH.

Implement elliptic-curve Diffie-Hellman, including host key signature
verification.

Moves host key cryptographic verification to ClientConn.handshake(), so
RSA host keys are also verified.

Fixes golang/go#6158.

R=dave, agl
CC=golang-dev
https://golang.org/cl/13021045

ssh/messages.go

@@ -29,6 +29,9 @@ const (
 	msgKexDHInit  = 30
 	msgKexDHReply = 31
 
+	msgKexECDHInit  = 30
+	msgKexECDHReply = 31
+
 	// Standard authentication messages
 	msgUserAuthRequest  = 50
 	msgUserAuthFailure  = 51
@@ -94,6 +97,16 @@ type kexDHInitMsg struct {
 	X *big.Int
 }
 
+type kexECDHInitMsg struct {
+	ClientPubKey []byte
+}
+
+type kexECDHReplyMsg struct {
+	HostKey         []byte
+	EphemeralPubKey []byte
+	Signature       []byte
+}
+
 type kexDHReplyMsg struct {
 	HostKey   []byte
 	Y         *big.Int