go.mod: update golang.org/x dependencies

Update golang.org/x dependencies to their latest tagged versions.

Change-Id: I0f64669e7c813611f71b1381d9e6fdaba1a39712
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/719641
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: David Chase <drchase@google.com>

acme/acme.go

@@ -31,12 +31,11 @@ import (
 	"crypto/x509/pkix"
 	"encoding/asn1"
 	"encoding/base64"
-	"encoding/hex"
 	"encoding/json"
-	"encoding/pem"
 	"errors"
 	"fmt"
 	"math/big"
+	"net"
 	"net/http"
 	"strings"
 	"sync"
@@ -353,6 +352,10 @@ func (c *Client) authorize(ctx context.Context, typ, val string) (*Authorization
 	if _, err := c.Discover(ctx); err != nil {
 		return nil, err
 	}
+	if c.dir.AuthzURL == "" {
+		// Pre-Authorization is unsupported
+		return nil, errPreAuthorizationNotSupported
+	}
 
 	type authzID struct {
 		Type  string `json:"type"`
@@ -467,7 +470,7 @@ func (c *Client) WaitAuthorization(ctx context.Context, url string) (*Authorizat
 		// while waiting for a final authorization status.
 		d := retryAfter(res.Header.Get("Retry-After"))
 		if d == 0 {
-			// Given that the fastest challenges TLS-SNI and HTTP-01
+			// Given that the fastest challenges TLS-ALPN and HTTP-01
 			// require a CA to make at least 1 network round trip
 			// and most likely persist a challenge state,
 			// this default delay seems reasonable.
@@ -568,50 +571,28 @@ func (c *Client) HTTP01ChallengePath(token string) string {
 }
 
 // TLSSNI01ChallengeCert creates a certificate for TLS-SNI-01 challenge response.
+// Always returns an error.
 //
-// Deprecated: This challenge type is unused in both draft-02 and RFC versions of the ACME spec.
-func (c *Client) TLSSNI01ChallengeCert(token string, opt ...CertOption) (cert tls.Certificate, name string, err error) {
-	ka, err := keyAuth(c.Key.Public(), token)
-	if err != nil {
-		return tls.Certificate{}, "", err
-	}
-	b := sha256.Sum256([]byte(ka))
-	h := hex.EncodeToString(b[:])
-	name = fmt.Sprintf("%s.%s.acme.invalid", h[:32], h[32:])
-	cert, err = tlsChallengeCert([]string{name}, opt)
-	if err != nil {
-		return tls.Certificate{}, "", err
-	}
-	return cert, name, nil
+// Deprecated: This challenge type was only present in pre-standardized ACME
+// protocol drafts and is insecure for use in shared hosting environments.
+func (c *Client) TLSSNI01ChallengeCert(token string, opt ...CertOption) (tls.Certificate, string, error) {
+	return tls.Certificate{}, "", errPreRFC
 }
 
 // TLSSNI02ChallengeCert creates a certificate for TLS-SNI-02 challenge response.
+// Always returns an error.
 //
-// Deprecated: This challenge type is unused in both draft-02 and RFC versions of the ACME spec.
-func (c *Client) TLSSNI02ChallengeCert(token string, opt ...CertOption) (cert tls.Certificate, name string, err error) {
-	b := sha256.Sum256([]byte(token))
-	h := hex.EncodeToString(b[:])
-	sanA := fmt.Sprintf("%s.%s.token.acme.invalid", h[:32], h[32:])
-
-	ka, err := keyAuth(c.Key.Public(), token)
-	if err != nil {
-		return tls.Certificate{}, "", err
-	}
-	b = sha256.Sum256([]byte(ka))
-	h = hex.EncodeToString(b[:])
-	sanB := fmt.Sprintf("%s.%s.ka.acme.invalid", h[:32], h[32:])
-
-	cert, err = tlsChallengeCert([]string{sanA, sanB}, opt)
-	if err != nil {
-		return tls.Certificate{}, "", err
-	}
-	return cert, sanA, nil
+// Deprecated: This challenge type was only present in pre-standardized ACME
+// protocol drafts and is insecure for use in shared hosting environments.
+func (c *Client) TLSSNI02ChallengeCert(token string, opt ...CertOption) (tls.Certificate, string, error) {
+	return tls.Certificate{}, "", errPreRFC
 }
 
 // TLSALPN01ChallengeCert creates a certificate for TLS-ALPN-01 challenge response.
 // Servers can present the certificate to validate the challenge and prove control
-// over a domain name. For more details on TLS-ALPN-01 see
-// https://tools.ietf.org/html/draft-shoemaker-acme-tls-alpn-00#section-3
+// over an identifier (either a DNS name or the textual form of an IPv4 or IPv6
+// address). For more details on TLS-ALPN-01 see
+// https://www.rfc-editor.org/rfc/rfc8737 and https://www.rfc-editor.org/rfc/rfc8738
 //
 // The token argument is a Challenge.Token value.
 // If a WithKey option is provided, its private part signs the returned cert,
@@ -619,9 +600,13 @@ func (c *Client) TLSSNI02ChallengeCert(token string, opt ...CertOption) (cert tl
 // If no WithKey option is provided, a new ECDSA key is generated using P-256 curve.
 //
 // The returned certificate is valid for the next 24 hours and must be presented only when
-// the server name in the TLS ClientHello matches the domain, and the special acme-tls/1 ALPN protocol
+// the server name in the TLS ClientHello matches the identifier, and the special acme-tls/1 ALPN protocol
 // has been specified.
-func (c *Client) TLSALPN01ChallengeCert(token, domain string, opt ...CertOption) (cert tls.Certificate, err error) {
+//
+// Validation requests for IP address identifiers will use the reverse DNS form in the server name
+// in the TLS ClientHello since the SNI extension is not supported for IP addresses.
+// See RFC 8738 Section 6 for more information.
+func (c *Client) TLSALPN01ChallengeCert(token, identifier string, opt ...CertOption) (cert tls.Certificate, err error) {
 	ka, err := keyAuth(c.Key.Public(), token)
 	if err != nil {
 		return tls.Certificate{}, err
@@ -651,7 +636,7 @@ func (c *Client) TLSALPN01ChallengeCert(token, domain string, opt ...CertOption)
 	}
 	tmpl.ExtraExtensions = append(tmpl.ExtraExtensions, acmeExtension)
 	newOpt = append(newOpt, WithTemplate(tmpl))
-	return tlsChallengeCert([]string{domain}, newOpt)
+	return tlsChallengeCert(identifier, newOpt)
 }
 
 // popNonce returns a nonce value previously stored with c.addNonce
@@ -769,11 +754,15 @@ func defaultTLSChallengeCertTemplate() *x509.Certificate {
 	}
 }
 
-// tlsChallengeCert creates a temporary certificate for TLS-SNI challenges
-// with the given SANs and auto-generated public/private key pair.
-// The Subject Common Name is set to the first SAN to aid debugging.
+// tlsChallengeCert creates a temporary certificate for TLS-ALPN challenges
+// for the given identifier, using an auto-generated public/private key pair.
+//
+// If the provided identifier is a domain name, it will be used as a DNS type SAN and for the
+// subject common name. If the provided identifier is an IP address it will be used as an IP type
+// SAN.
+//
 // To create a cert with a custom key pair, specify WithKey option.
-func tlsChallengeCert(san []string, opt []CertOption) (tls.Certificate, error) {
+func tlsChallengeCert(identifier string, opt []CertOption) (tls.Certificate, error) {
 	var key crypto.Signer
 	tmpl := defaultTLSChallengeCertTemplate()
 	for _, o := range opt {
@@ -797,9 +786,12 @@ func tlsChallengeCert(san []string, opt []CertOption) (tls.Certificate, error) {
 			return tls.Certificate{}, err
 		}
 	}
-	tmpl.DNSNames = san
-	if len(san) > 0 {
-		tmpl.Subject.CommonName = san[0]
+
+	if ip := net.ParseIP(identifier); ip != nil {
+		tmpl.IPAddresses = []net.IP{ip}
+	} else {
+		tmpl.DNSNames = []string{identifier}
+		tmpl.Subject.CommonName = identifier
 	}
 
 	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, key.Public(), key)
@@ -812,11 +804,5 @@ func tlsChallengeCert(san []string, opt []CertOption) (tls.Certificate, error) {
 	}, nil
 }
 
-// encodePEM returns b encoded as PEM with block of type typ.
-func encodePEM(typ string, b []byte) []byte {
-	pb := &pem.Block{Type: typ, Bytes: b}
-	return pem.EncodeToMemory(pb)
-}
-
 // timeNow is time.Now, except in tests which can mess with it.
 var timeNow = time.Now

acme/acme_test.go

@@ -9,20 +9,18 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/rsa"
-	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"math/big"
 	"net/http"
 	"net/http/httptest"
 	"reflect"
-	"sort"
-	"strings"
 	"testing"
 	"time"
 )
@@ -254,6 +252,57 @@ func TestAuthorizeValid(t *testing.T) {
 	}
 }
 
+func TestAuthorizeUnsupported(t *testing.T) {
+	const (
+		nonce       = "https://example.com/acme/new-nonce"
+		reg         = "https://example.com/acme/new-acct"
+		order       = "https://example.com/acme/new-order"
+		revoke      = "https://example.com/acme/revoke-cert"
+		keychange   = "https://example.com/acme/key-change"
+		metaTerms   = "https://example.com/acme/terms/2017-5-30"
+		metaWebsite = "https://www.example.com/"
+		metaCAA     = "example.com"
+	)
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Replay-Nonce", "nonce")
+		if r.Method == http.MethodHead {
+			return
+		}
+		switch r.URL.Path {
+		case "/": // Directory
+			w.Header().Set("Content-Type", "application/json")
+			fmt.Fprintf(w, `{
+                "newNonce": %q,
+                "newAccount": %q,
+                "newOrder": %q,
+                "revokeCert": %q,
+                "keyChange": %q,
+                "meta": {
+                    "termsOfService": %q,
+                    "website": %q,
+                    "caaIdentities": [%q],
+                    "externalAccountRequired": true
+                }
+            }`, nonce, reg, order, revoke, keychange, metaTerms, metaWebsite, metaCAA)
+			w.WriteHeader(http.StatusOK)
+		case "/acme/new-authz":
+			w.WriteHeader(http.StatusBadRequest)
+		}
+	}))
+	defer ts.Close()
+	client := &Client{Key: testKey, DirectoryURL: ts.URL}
+	dir, err := client.Discover(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if dir.AuthzURL != "" {
+		t.Fatalf("expected AuthzURL to be empty, got %q", dir.AuthzURL)
+	}
+	if _, err := client.Authorize(context.Background(), "example.com"); !errors.Is(err, errPreAuthorizationNotSupported) {
+		t.Errorf("expected err to indicate pre-authorization is unsupported, got %+v", err)
+	}
+}
+
 func TestWaitAuthorization(t *testing.T) {
 	t.Run("wait loop", func(t *testing.T) {
 		var count int
@@ -640,71 +689,6 @@ func TestLinkHeader(t *testing.T) {
 	}
 }
 
-func TestTLSSNI01ChallengeCert(t *testing.T) {
-	const (
-		token = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA"
-		// echo -n <token.testKeyECThumbprint> | shasum -a 256
-		san = "dbbd5eefe7b4d06eb9d1d9f5acb4c7cd.a27d320e4b30332f0b6cb441734ad7b0.acme.invalid"
-	)
-
-	tlscert, name, err := newTestClient().TLSSNI01ChallengeCert(token)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if n := len(tlscert.Certificate); n != 1 {
-		t.Fatalf("len(tlscert.Certificate) = %d; want 1", n)
-	}
-	cert, err := x509.ParseCertificate(tlscert.Certificate[0])
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(cert.DNSNames) != 1 || cert.DNSNames[0] != san {
-		t.Fatalf("cert.DNSNames = %v; want %q", cert.DNSNames, san)
-	}
-	if cert.DNSNames[0] != name {
-		t.Errorf("cert.DNSNames[0] != name: %q vs %q", cert.DNSNames[0], name)
-	}
-	if cn := cert.Subject.CommonName; cn != san {
-		t.Errorf("cert.Subject.CommonName = %q; want %q", cn, san)
-	}
-}
-
-func TestTLSSNI02ChallengeCert(t *testing.T) {
-	const (
-		token = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA"
-		// echo -n evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA | shasum -a 256
-		sanA = "7ea0aaa69214e71e02cebb18bb867736.09b730209baabf60e43d4999979ff139.token.acme.invalid"
-		// echo -n <token.testKeyECThumbprint> | shasum -a 256
-		sanB = "dbbd5eefe7b4d06eb9d1d9f5acb4c7cd.a27d320e4b30332f0b6cb441734ad7b0.ka.acme.invalid"
-	)
-
-	tlscert, name, err := newTestClient().TLSSNI02ChallengeCert(token)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if n := len(tlscert.Certificate); n != 1 {
-		t.Fatalf("len(tlscert.Certificate) = %d; want 1", n)
-	}
-	cert, err := x509.ParseCertificate(tlscert.Certificate[0])
-	if err != nil {
-		t.Fatal(err)
-	}
-	names := []string{sanA, sanB}
-	if !reflect.DeepEqual(cert.DNSNames, names) {
-		t.Fatalf("cert.DNSNames = %v;\nwant %v", cert.DNSNames, names)
-	}
-	sort.Strings(cert.DNSNames)
-	i := sort.SearchStrings(cert.DNSNames, name)
-	if i >= len(cert.DNSNames) || cert.DNSNames[i] != name {
-		t.Errorf("%v doesn't have %q", cert.DNSNames, name)
-	}
-	if cn := cert.Subject.CommonName; cn != sanA {
-		t.Errorf("CommonName = %q; want %q", cn, sanA)
-	}
-}
-
 func TestTLSALPN01ChallengeCert(t *testing.T) {
 	const (
 		token   = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA"
@@ -761,6 +745,7 @@ func TestTLSChallengeCertOpt(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	domain := "example.com"
 	tmpl := &x509.Certificate{
 		SerialNumber: big.NewInt(2),
 		Subject:      pkix.Name{Organization: []string{"Test"}},
@@ -769,52 +754,43 @@ func TestTLSChallengeCertOpt(t *testing.T) {
 	opts := []CertOption{WithKey(key), WithTemplate(tmpl)}
 
 	client := newTestClient()
-	cert1, _, err := client.TLSSNI01ChallengeCert("token", opts...)
-	if err != nil {
-		t.Fatal(err)
-	}
-	cert2, _, err := client.TLSSNI02ChallengeCert("token", opts...)
+	cert, err := client.TLSALPN01ChallengeCert("token", domain, opts...)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	for i, tlscert := range []tls.Certificate{cert1, cert2} {
-		// verify generated cert private key
-		tlskey, ok := tlscert.PrivateKey.(*rsa.PrivateKey)
-		if !ok {
-			t.Errorf("%d: tlscert.PrivateKey is %T; want *rsa.PrivateKey", i, tlscert.PrivateKey)
-			continue
-		}
-		if tlskey.D.Cmp(key.D) != 0 {
-			t.Errorf("%d: tlskey.D = %v; want %v", i, tlskey.D, key.D)
-		}
-		// verify generated cert public key
-		x509Cert, err := x509.ParseCertificate(tlscert.Certificate[0])
-		if err != nil {
-			t.Errorf("%d: %v", i, err)
-			continue
-		}
-		tlspub, ok := x509Cert.PublicKey.(*rsa.PublicKey)
-		if !ok {
-			t.Errorf("%d: x509Cert.PublicKey is %T; want *rsa.PublicKey", i, x509Cert.PublicKey)
-			continue
-		}
-		if tlspub.N.Cmp(key.N) != 0 {
-			t.Errorf("%d: tlspub.N = %v; want %v", i, tlspub.N, key.N)
-		}
-		// verify template option
-		sn := big.NewInt(2)
-		if x509Cert.SerialNumber.Cmp(sn) != 0 {
-			t.Errorf("%d: SerialNumber = %v; want %v", i, x509Cert.SerialNumber, sn)
-		}
-		org := []string{"Test"}
-		if !reflect.DeepEqual(x509Cert.Subject.Organization, org) {
-			t.Errorf("%d: Subject.Organization = %+v; want %+v", i, x509Cert.Subject.Organization, org)
-		}
-		for _, v := range x509Cert.DNSNames {
-			if !strings.HasSuffix(v, ".acme.invalid") {
-				t.Errorf("%d: invalid DNSNames element: %q", i, v)
-			}
+	// verify generated cert private key
+	tlskey, ok := cert.PrivateKey.(*rsa.PrivateKey)
+	if !ok {
+		t.Fatalf("tlscert.PrivateKey is %T; want *rsa.PrivateKey", cert.PrivateKey)
+	}
+	if tlskey.D.Cmp(key.D) != 0 {
+		t.Errorf("tlskey.D = %v; want %v", tlskey.D, key.D)
+	}
+	// verify generated cert public key
+	x509Cert, err := x509.ParseCertificate(cert.Certificate[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	tlspub, ok := x509Cert.PublicKey.(*rsa.PublicKey)
+	if !ok {
+		t.Fatalf("x509Cert.PublicKey is %T; want *rsa.PublicKey", x509Cert.PublicKey)
+	}
+	if tlspub.N.Cmp(key.N) != 0 {
+		t.Errorf("tlspub.N = %v; want %v", tlspub.N, key.N)
+	}
+	// verify template option
+	sn := big.NewInt(2)
+	if x509Cert.SerialNumber.Cmp(sn) != 0 {
+		t.Errorf("SerialNumber = %v; want %v", x509Cert.SerialNumber, sn)
+	}
+	org := []string{"Test"}
+	if !reflect.DeepEqual(x509Cert.Subject.Organization, org) {
+		t.Errorf("Subject.Organization = %+v; want %+v", x509Cert.Subject.Organization, org)
+	}
+	for _, v := range x509Cert.DNSNames {
+		if v != domain {
+			t.Errorf("invalid DNSNames element: %q", v)
 		}
 	}
 }

acme/autocert/autocert_test.go

@@ -561,9 +561,9 @@ func TestHTTPHandlerDefaultFallback(t *testing.T) {
 		{"GET", "http://example.org/foo?a=b", 302, "https://example.org/foo?a=b"},
 		{"GET", "http://example.org:80/foo?a=b", 302, "https://example.org:443/foo?a=b"},
 		{"GET", "http://example.org:80/foo%20bar", 302, "https://example.org:443/foo%20bar"},
-		{"GET", "http://[2602:d1:xxxx::c60a]:1234", 302, "https://[2602:d1:xxxx::c60a]:443/"},
-		{"GET", "http://[2602:d1:xxxx::c60a]", 302, "https://[2602:d1:xxxx::c60a]/"},
-		{"GET", "http://[2602:d1:xxxx::c60a]/foo?a=b", 302, "https://[2602:d1:xxxx::c60a]/foo?a=b"},
+		{"GET", "http://[2602:d1:abcd::c60a]:1234", 302, "https://[2602:d1:abcd::c60a]:443/"},
+		{"GET", "http://[2602:d1:abcd::c60a]", 302, "https://[2602:d1:abcd::c60a]/"},
+		{"GET", "http://[2602:d1:abcd::c60a]/foo?a=b", 302, "https://[2602:d1:abcd::c60a]/foo?a=b"},
 		{"HEAD", "http://example.org", 302, "https://example.org/"},
 		{"HEAD", "http://example.org/foo", 302, "https://example.org/foo"},
 		{"HEAD", "http://example.org/foo/bar/", 302, "https://example.org/foo/bar/"},

acme/autocert/internal/acmetest/ca.go

@@ -145,7 +145,7 @@ func (ca *CAServer) URL() string {
 	return ca.url
 }
 
-// Roots returns a pool cointaining the CA root.
+// Roots returns a pool containing the CA root.
 func (ca *CAServer) Roots() *x509.CertPool {
 	if ca.url == "" {
 		panic("Roots called before Start")
@@ -782,15 +782,3 @@ func decodePayload(v interface{}, r io.Reader) error {
 func challengeToken(domain, challType string, authzID int) string {
 	return fmt.Sprintf("token-%s-%s-%d", domain, challType, authzID)
 }
-
-func unique(a []string) []string {
-	seen := make(map[string]bool)
-	var res []string
-	for _, s := range a {
-		if s != "" && !seen[s] {
-			seen[s] = true
-			res = append(res, s)
-		}
-	}
-	return res
-}

acme/autocert/listener.go

@@ -10,7 +10,6 @@ import (
 	"net"
 	"os"
 	"path/filepath"
-	"runtime"
 	"time"
 )
 
@@ -124,32 +123,13 @@ func (ln *listener) Close() error {
 	return ln.tcpListener.Close()
 }
 
-func homeDir() string {
-	if runtime.GOOS == "windows" {
-		return os.Getenv("HOMEDRIVE") + os.Getenv("HOMEPATH")
-	}
-	if h := os.Getenv("HOME"); h != "" {
-		return h
-	}
-	return "/"
-}
-
 func cacheDir() string {
 	const base = "golang-autocert"
-	switch runtime.GOOS {
-	case "darwin":
-		return filepath.Join(homeDir(), "Library", "Caches", base)
-	case "windows":
-		for _, ev := range []string{"APPDATA", "CSIDL_APPDATA", "TEMP", "TMP"} {
-			if v := os.Getenv(ev); v != "" {
-				return filepath.Join(v, base)
-			}
-		}
-		// Worst case:
-		return filepath.Join(homeDir(), base)
+	cache, err := os.UserCacheDir()
+	if err != nil {
+		// Fall back to the root directory.
+		cache = "/.cache"
 	}
-	if xdg := os.Getenv("XDG_CACHE_HOME"); xdg != "" {
-		return filepath.Join(xdg, base)
-	}
-	return filepath.Join(homeDir(), ".cache", base)
+
+	return filepath.Join(cache, base)
 }

acme/http.go

@@ -66,7 +66,7 @@ func (c *Client) retryTimer() *retryTimer {
 // The n argument is always bounded between 1 and 30.
 // The returned value is always greater than 0.
 func defaultBackoff(n int, r *http.Request, res *http.Response) time.Duration {
-	const max = 10 * time.Second
+	const maxVal = 10 * time.Second
 	var jitter time.Duration
 	if x, err := rand.Int(rand.Reader, big.NewInt(1000)); err == nil {
 		// Set the minimum to 1ms to avoid a case where
@@ -86,10 +86,7 @@ func defaultBackoff(n int, r *http.Request, res *http.Response) time.Duration {
 		n = 30
 	}
 	d := time.Duration(1<<uint(n-1))*time.Second + jitter
-	if d > max {
-		return max
-	}
-	return d
+	return min(d, maxVal)
 }
 
 // retryAfter parses a Retry-After HTTP header value,

acme/jws.go

@@ -92,7 +92,7 @@ func jwsEncodeJSON(claimset interface{}, key crypto.Signer, kid KeyID, nonce, ur
 	if err != nil {
 		return nil, err
 	}
-	phead := base64.RawURLEncoding.EncodeToString([]byte(phJSON))
+	phead := base64.RawURLEncoding.EncodeToString(phJSON)
 	var payload string
 	if val, ok := claimset.(string); ok {
 		payload = val

acme/pebble_test.go

@@ -0,0 +1,809 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package acme_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/acme"
+)
+
+const (
+	// pebbleModVersion is the module version used for Pebble and Pebble's
+	// challenge test server. It is ignored if `-pebble-local-dir` is provided.
+	pebbleModVersion = "v2.7.0"
+	// startingPort is the first port number used for binding interface
+	// addresses. Each call to takeNextPort() will increment a port number
+	// starting at this value.
+	startingPort = 5555
+)
+
+var (
+	pebbleLocalDir = flag.String(
+		"pebble-local-dir",
+		"",
+		"Local Pebble to use, instead of fetching from source",
+	)
+	nextPort atomic.Uint32
+)
+
+func init() {
+	nextPort.Store(startingPort)
+}
+
+func TestWithPebble(t *testing.T) {
+	// We want to use process groups w/ syscall.Kill, and the acme package
+	// is very platform-agnostic, so skip on non-Linux.
+	if runtime.GOOS != "linux" {
+		t.Skip("skipping pebble tests on non-linux OS")
+	}
+
+	if testing.Short() {
+		t.Skip("skipping pebble tests in short mode")
+	}
+
+	tests := []struct {
+		name     string
+		challSrv func(*environment) (challengeServer, string)
+	}{
+		{
+			name: "TLSALPN01-Issuance",
+			challSrv: func(env *environment) (challengeServer, string) {
+				bindAddr := fmt.Sprintf(":%d", env.config.TLSPort)
+				return newChallTLSServer(bindAddr), bindAddr
+			},
+		},
+
+		{
+			name: "HTTP01-Issuance",
+			challSrv: func(env *environment) (challengeServer, string) {
+				bindAddr := fmt.Sprintf(":%d", env.config.HTTPPort)
+				return newChallHTTPServer(bindAddr), bindAddr
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := startPebbleEnvironment(t, nil)
+			challSrv, challSrvAddr := tt.challSrv(&env)
+			challSrv.Run()
+
+			t.Cleanup(func() {
+				challSrv.Shutdown()
+			})
+
+			waitForServer(t, challSrvAddr)
+			testIssuance(t, &env, challSrv)
+		})
+	}
+}
+
+// challengeServer abstracts over the details of running a challenge response
+// server for some supported acme.Challenge type. Responses are provisioned
+// during the test issuance process to be presented to the ACME server's
+// validation authority.
+type challengeServer interface {
+	Run()
+	Shutdown() error
+	Supported(chal *acme.Challenge) bool
+	Provision(client *acme.Client, ident acme.AuthzID, chal *acme.Challenge) error
+}
+
+// challTLSServer is a simple challenge response server that listens for TLS
+// connections on a specific port and if they are TLS-ALPN-01 challenge
+// requests, completes the handshake using the configured challenge response
+// certificate for the SNI value provided.
+type challTLSServer struct {
+	*http.Server
+	// mu protects challCerts.
+	mu sync.RWMutex
+	// challCerts is a map from SNI domain name to challenge response certificate.
+	challCerts map[string]*tls.Certificate
+}
+
+// https://datatracker.ietf.org/doc/html/rfc8737#section-4
+const acmeTLSAlpnProtocol = "acme-tls/1"
+
+func newChallTLSServer(address string) *challTLSServer {
+	challServer := &challTLSServer{Server: &http.Server{
+		Addr:         address,
+		ReadTimeout:  5 * time.Second,
+		WriteTimeout: 5 * time.Second,
+	}, challCerts: make(map[string]*tls.Certificate)}
+
+	// Configure the server to support the TLS-ALPN-01 challenge protocol
+	// and to use a callback for selecting the handshake certificate.
+	challServer.Server.TLSConfig = &tls.Config{
+		NextProtos:     []string{acmeTLSAlpnProtocol},
+		GetCertificate: challServer.getCertificate,
+	}
+
+	return challServer
+}
+
+func (c *challTLSServer) Shutdown() error {
+	log.Printf("challTLSServer: shutting down")
+	ctx, cancel := context.WithTimeout(context.Background(), 10)
+	defer cancel()
+	return c.Server.Shutdown(ctx)
+}
+
+func (c *challTLSServer) Run() {
+	go func() {
+		// Note: certFile and keyFile are empty because our config uses a
+		// GetCertificate callback.
+		if err := c.Server.ListenAndServeTLS("", ""); err != nil {
+			if !errors.Is(err, http.ErrServerClosed) {
+				log.Printf("challTLSServer error: %v", err)
+			}
+		}
+	}()
+}
+
+func (c *challTLSServer) Supported(chal *acme.Challenge) bool {
+	return chal.Type == "tls-alpn-01"
+}
+
+func (c *challTLSServer) Provision(client *acme.Client, ident acme.AuthzID, chal *acme.Challenge) error {
+	respCert, err := client.TLSALPN01ChallengeCert(chal.Token, ident.Value)
+	if err != nil {
+		return fmt.Errorf("challTLSServer: failed to generate challlenge response cert for %s: %w",
+			ident.Value, err)
+	}
+
+	log.Printf("challTLSServer: setting challenge response certificate for %s", ident.Value)
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.challCerts[ident.Value] = &respCert
+
+	return nil
+}
+
+func (c *challTLSServer) getCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	// Verify the request looks like a TLS-ALPN-01 challenge request.
+	if len(clientHello.SupportedProtos) != 1 || clientHello.SupportedProtos[0] != acmeTLSAlpnProtocol {
+		return nil, fmt.Errorf(
+			"challTLSServer: non-TLS-ALPN-01 challenge request received with SupportedProtos: %s",
+			clientHello.SupportedProtos)
+	}
+
+	serverName := clientHello.ServerName
+
+	// TLS-ALPN-01 challenge requests for IP addresses are encoded in the SNI
+	// using the reverse-DNS notation. See RFC 8738 Section 6:
+	//   https://www.rfc-editor.org/rfc/rfc8738.html#section-6
+	if strings.HasSuffix(serverName, ".in-addr.arpa") {
+		serverName = strings.TrimSuffix(serverName, ".in-addr.arpa")
+		parts := strings.Split(serverName, ".")
+		for i, j := 0, len(parts)-1; i < j; i, j = i+1, j-1 {
+			parts[i], parts[j] = parts[j], parts[i]
+		}
+		serverName = strings.Join(parts, ".")
+	}
+
+	log.Printf("challTLSServer: selecting certificate for request from %s for %s",
+		clientHello.Conn.RemoteAddr(), serverName)
+
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	cert := c.challCerts[serverName]
+	if cert == nil {
+		return nil, fmt.Errorf("challTLSServer: no challenge response certificate configured for %s", serverName)
+	}
+
+	return cert, nil
+}
+
+// challHTTPServer is a simple challenge response server that listens for HTTP
+// connections on a specific port and if they are HTTP-01 challenge requests,
+// serves the challenge response key authorization.
+type challHTTPServer struct {
+	*http.Server
+	// mu protects challMap
+	mu sync.RWMutex
+	// challMap is a mapping from request path to response body.
+	challMap map[string]string
+}
+
+func newChallHTTPServer(address string) *challHTTPServer {
+	challServer := &challHTTPServer{
+		Server: &http.Server{
+			Addr:         address,
+			ReadTimeout:  5 * time.Second,
+			WriteTimeout: 5 * time.Second,
+		},
+		challMap: make(map[string]string),
+	}
+
+	challServer.Server.Handler = challServer
+
+	return challServer
+}
+
+func (c *challHTTPServer) Supported(chal *acme.Challenge) bool {
+	return chal.Type == "http-01"
+}
+
+func (c *challHTTPServer) Provision(client *acme.Client, ident acme.AuthzID, chall *acme.Challenge) error {
+	path := client.HTTP01ChallengePath(chall.Token)
+	body, err := client.HTTP01ChallengeResponse(chall.Token)
+	if err != nil {
+		return fmt.Errorf("failed to generate HTTP-01 challenge response for %v challenge %s token %s: %w",
+			ident, chall.URI, chall.Token, err)
+	}
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	log.Printf("challHTTPServer: setting challenge response for %s", path)
+	c.challMap[path] = body
+
+	return nil
+}
+
+func (c *challHTTPServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	log.Printf("challHTTPServer: handling %s to %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
+	if r.Method != http.MethodGet {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	response, exists := c.challMap[r.URL.Path]
+
+	if !exists {
+		http.NotFound(w, r)
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/plain")
+	w.Write([]byte(response))
+}
+
+func (c *challHTTPServer) Shutdown() error {
+	log.Printf("challHTTPServer: shutting down")
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	return c.Server.Shutdown(ctx)
+}
+
+func (c *challHTTPServer) Run() {
+	go func() {
+		if err := c.Server.ListenAndServe(); err != nil {
+			if !errors.Is(err, http.ErrServerClosed) {
+				log.Printf("challHTTPServer error: %v", err)
+			}
+		}
+	}()
+}
+
+func testIssuance(t *testing.T, env *environment, challSrv challengeServer) {
+	t.Helper()
+
+	// Bound the total issuance process by a timeout of 60 seconds.
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+
+	// Create a new ACME account.
+	client := env.client
+	acct, err := client.Register(ctx, &acme.Account{}, acme.AcceptTOS)
+	if err != nil {
+		t.Fatalf("failed to register account: %v", err)
+	}
+	if acct.Status != acme.StatusValid {
+		t.Fatalf("expected new account status to be valid, got %v", acct.Status)
+	}
+	log.Printf("registered account: %s", acct.URI)
+
+	// Create a new order for some example identifiers
+	identifiers := []acme.AuthzID{
+		{
+			Type:  "dns",
+			Value: "example.com",
+		},
+		{
+			Type:  "dns",
+			Value: "www.example.com",
+		},
+		{
+			Type:  "ip",
+			Value: "127.0.0.1",
+		},
+	}
+	order, err := client.AuthorizeOrder(ctx, identifiers)
+	if err != nil {
+		t.Fatalf("failed to create order for %v: %v", identifiers, err)
+	}
+	if order.Status != acme.StatusPending {
+		t.Fatalf("expected new order status to be pending, got %v", order.Status)
+	}
+	orderURL := order.URI
+	log.Printf("created order: %v", orderURL)
+
+	// For each pending authz provision a supported challenge type's response
+	// with the test challenge server, and tell the ACME server to verify it.
+	for _, authzURL := range order.AuthzURLs {
+		authz, err := client.GetAuthorization(ctx, authzURL)
+		if err != nil {
+			t.Fatalf("failed to get order %s authorization %s: %v",
+				orderURL, authzURL, err)
+		}
+
+		if authz.Status != acme.StatusPending {
+			continue
+		}
+
+		for _, challenge := range authz.Challenges {
+			if challenge.Status != acme.StatusPending || !challSrv.Supported(challenge) {
+				continue
+			}
+
+			if err := challSrv.Provision(client, authz.Identifier, challenge); err != nil {
+				t.Fatalf("failed to provision challenge %s: %v", challenge.URI, err)
+			}
+
+			_, err = client.Accept(ctx, challenge)
+			if err != nil {
+				t.Fatalf("failed to accept order %s challenge %s: %v",
+					orderURL, challenge.URI, err)
+			}
+		}
+	}
+
+	// Wait for the order to become ready for finalization.
+	order, err = client.WaitOrder(ctx, order.URI)
+	if err != nil {
+		var orderErr *acme.OrderError
+		if errors.Is(err, orderErr) {
+			t.Fatalf("failed to wait for order %s: %s: %s", orderURL, err, orderErr.Problem)
+		} else {
+			t.Fatalf("failed to wait for order %s: %s", orderURL, err)
+		}
+	}
+	if order.Status != acme.StatusReady {
+		t.Fatalf("expected order %s status to be ready, got %v",
+			orderURL, order.Status)
+	}
+
+	// Generate a certificate keypair and a CSR for the order identifiers.
+	certKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("failed to generate certificate key: %v", err)
+	}
+	var dnsNames []string
+	var ipAddresses []net.IP
+	for _, ident := range identifiers {
+		switch ident.Type {
+		case "dns":
+			dnsNames = append(dnsNames, ident.Value)
+		case "ip":
+			ipAddresses = append(ipAddresses, net.ParseIP(ident.Value))
+		default:
+			t.Fatalf("unsupported identifier type: %s", ident.Type)
+		}
+	}
+	csrDer, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
+		DNSNames:    dnsNames,
+		IPAddresses: ipAddresses,
+	}, certKey)
+	if err != nil {
+		t.Fatalf("failed to create CSR: %v", err)
+	}
+
+	// Finalize the order by creating a certificate with our CSR.
+	chain, _, err := client.CreateOrderCert(ctx, order.FinalizeURL, csrDer, true)
+	if err != nil {
+		t.Fatalf("failed to finalize order %s with finalize URL %s: %v",
+			orderURL, order.FinalizeURL, err)
+	}
+
+	// Split the chain into the leaf and any intermediates.
+	leaf := chain[0]
+	intermediatesDER := chain[1:]
+	leafCert, err := x509.ParseCertificate(leaf)
+	if err != nil {
+		t.Fatalf("failed to parse order %s leaf certificate: %v", orderURL, err)
+	}
+	intermediates := x509.NewCertPool()
+	for i, intermediateDER := range intermediatesDER {
+		intermediate, err := x509.ParseCertificate(intermediateDER)
+		if err != nil {
+			t.Fatalf("failed to parse intermediate %d: %v", i, err)
+		}
+		intermediates.AddCert(intermediate)
+	}
+
+	// Verify there is a valid path from the leaf certificate to Pebble's
+	// issuing root using the provided intermediate certificates.
+	roots, err := env.RootCert()
+	if err != nil {
+		t.Fatalf("failed to get Pebble issuer root certs: %v", err)
+	}
+	paths, err := leafCert.Verify(x509.VerifyOptions{
+		Intermediates: intermediates,
+		Roots:         roots,
+	})
+	if err != nil {
+		t.Fatalf("failed to verify order %s leaf certificate: %v", orderURL, err)
+	}
+	log.Printf("verified %d path(s) from issued leaf certificate to Pebble root CA", len(paths))
+
+	// Also verify that the leaf cert is valid for each of the DNS names
+	// and IP addresses from our order's identifiers.
+	for _, name := range dnsNames {
+		if err := leafCert.VerifyHostname(name); err != nil {
+			t.Fatalf("failed to verify order %s leaf certificate for order DNS name %s: %v",
+				orderURL, name, err)
+		}
+	}
+	for _, ip := range ipAddresses {
+		if err := leafCert.VerifyHostname(ip.String()); err != nil {
+			t.Fatalf("failed to verify order %s leaf certificate for order IP address %s: %v",
+				orderURL, ip, err)
+		}
+	}
+}
+
+type environment struct {
+	config *environmentConfig
+	client *acme.Client
+}
+
+// RootCert returns the Pebble CA's primary issuing hierarchy root certificate.
+// This is generated randomly at each startup and can be used to verify
+// certificate chains issued by Pebble's ACME interface. Note that this
+// is separate from the static root certificate used by the Pebble ACME
+// HTTPS interface.
+func (e *environment) RootCert() (*x509.CertPool, error) {
+	// NOTE: in the future we may want to consider the alternative chains
+	// 		 returned as Link alternative headers.
+	rootURL := fmt.Sprintf("https://%s/roots/0", e.config.pebbleConfig.ManagementListenAddress)
+	resp, err := e.client.HTTPClient.Get(rootURL)
+	if err != nil || resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("failed to GET Pebble root CA from %s: %v", rootURL, err)
+	}
+
+	roots := x509.NewCertPool()
+	rootPEM, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse Pebble root CA PEM: %v", err)
+	}
+	rootDERBlock, _ := pem.Decode(rootPEM)
+	rootCA, err := x509.ParseCertificate(rootDERBlock.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse Pebble root CA DER: %v", err)
+	}
+	roots.AddCert(rootCA)
+
+	return roots, nil
+}
+
+// environmentConfig describes the Pebble configuration, and configuration
+// shared between pebble and pebble-challtestsrv.
+type environmentConfig struct {
+	pebbleConfig
+	dnsPort uint32
+}
+
+// defaultConfig returns an environmentConfig populated with default values.
+// The provided pebbleDir is used to specify certificate/private key paths
+// for the HTTPS ACME interface.
+func defaultConfig(pebbleDir string) environmentConfig {
+	return environmentConfig{
+		pebbleConfig: pebbleConfig{
+			ListenAddress:                  fmt.Sprintf("127.0.0.1:%d", takeNextPort()),
+			ManagementListenAddress:        fmt.Sprintf("127.0.0.1:%d", takeNextPort()),
+			HTTPPort:                       takeNextPort(),
+			TLSPort:                        takeNextPort(),
+			Certificate:                    fmt.Sprintf("%s/test/certs/localhost/cert.pem", pebbleDir),
+			PrivateKey:                     fmt.Sprintf("%s/test/certs/localhost/key.pem", pebbleDir),
+			OCSPResponderURL:               "",
+			ExternalAccountBindingRequired: false,
+			ExternalAccountMACKeys:         make(map[string]string),
+			DomainBlocklist:                []string{"blocked-domain.example"},
+			Profiles: map[string]struct {
+				Description    string
+				ValidityPeriod uint64
+			}{
+				"default": {
+					Description:    "default profile",
+					ValidityPeriod: 3600,
+				},
+			},
+			RetryAfter: struct {
+				Authz int
+				Order int
+			}{
+				3,
+				5,
+			},
+		},
+		dnsPort: takeNextPort(),
+	}
+}
+
+// pebbleConfig matches the JSON structure of the Pebble configuration file.
+type pebbleConfig struct {
+	ListenAddress                  string
+	ManagementListenAddress        string
+	HTTPPort                       uint32
+	TLSPort                        uint32
+	Certificate                    string
+	PrivateKey                     string
+	OCSPResponderURL               string
+	ExternalAccountBindingRequired bool
+	ExternalAccountMACKeys         map[string]string
+	DomainBlocklist                []string
+	Profiles                       map[string]struct {
+		Description    string
+		ValidityPeriod uint64
+	}
+	RetryAfter struct {
+		Authz int
+		Order int
+	}
+}
+
+func takeNextPort() uint32 {
+	return nextPort.Add(1) - 1
+}
+
+// startPebbleEnvironment is a test helper that spawns Pebble and Pebble
+// challenge test server processes based on the provided environmentConfig. The
+// processes will be torn down when the test ends.
+func startPebbleEnvironment(t *testing.T, config *environmentConfig) environment {
+	t.Helper()
+
+	var pebbleDir string
+	if *pebbleLocalDir != "" {
+		pebbleDir = *pebbleLocalDir
+	} else {
+		pebbleDir = fetchModule(t, "github.com/letsencrypt/pebble/v2", pebbleModVersion)
+	}
+
+	binDir := prepareBinaries(t, pebbleDir)
+
+	if config == nil {
+		cfg := defaultConfig(pebbleDir)
+		config = &cfg
+	}
+
+	marshalConfig := struct {
+		Pebble pebbleConfig
+	}{
+		Pebble: config.pebbleConfig,
+	}
+
+	configData, err := json.Marshal(marshalConfig)
+	if err != nil {
+		t.Fatalf("failed to marshal config: %v", err)
+	}
+
+	configFile, err := os.CreateTemp("", "pebble-config-*.json")
+	if err != nil {
+		t.Fatalf("failed to create temp config file: %v", err)
+	}
+	t.Cleanup(func() { os.Remove(configFile.Name()) })
+
+	if _, err := configFile.Write(configData); err != nil {
+		t.Fatalf("failed to write config file: %v", err)
+	}
+	configFile.Close()
+
+	log.Printf("pebble dir: %s", pebbleDir)
+	log.Printf("config file: %s", configFile.Name())
+
+	// Spawn the Pebble CA server. It answers ACME requests and performs
+	// outbound validations. We configure it to use a mock DNS server that
+	// always answers 127.0.0.1 for all A queries so that validation
+	// requests for any domain name will resolve to our local challenge
+	// server instances.
+	spawnServerProcess(t, binDir, "pebble", "-config", configFile.Name(),
+		"-dnsserver", fmt.Sprintf("127.0.0.1:%d", config.dnsPort),
+		"-strict")
+
+	// Spawn the Pebble challenge test server. We'll use it to mock DNS
+	// responses but disable all the other interfaces. We want to stand
+	// up our own challenge response servers for TLS-ALPN-01,
+	// etc.
+	// Note: we specify -defaultIPv6 "" so that no AAAA records are served.
+	// The LUCI CI runners have issues with IPv6 connectivity on localhost.
+	spawnServerProcess(t, binDir, "pebble-challtestsrv",
+		"-dns01", fmt.Sprintf(":%d", config.dnsPort),
+		"-defaultIPv6", "",
+		"-management", fmt.Sprintf(":%d", takeNextPort()),
+		"-doh", "",
+		"-http01", "",
+		"-tlsalpn01", "",
+		"-https01", "")
+
+	waitForServer(t, config.pebbleConfig.ListenAddress)
+	waitForServer(t, fmt.Sprintf("127.0.0.1:%d", config.dnsPort))
+
+	log.Printf("pebble environment ready")
+
+	// Construct a cert pool that contains the CA certificate used by the ACME
+	// interface's certificate chain. This is separate from the issuing
+	// hierarchy and is used for the ACME client to interact with the ACME
+	// interface without cert verification error.
+	caCertPath := filepath.Join(pebbleDir, "test/certs/pebble.minica.pem")
+	caCert, err := os.ReadFile(caCertPath)
+	if err != nil {
+		t.Fatalf("failed to read CA certificate %s: %v", caCertPath, err)
+	}
+	caCertPool := x509.NewCertPool()
+	if !caCertPool.AppendCertsFromPEM(caCert) {
+		t.Fatalf("failed to parse CA certificate %s", caCertPath)
+	}
+	httpClient := &http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				RootCAs: caCertPool,
+			},
+		},
+	}
+
+	// Create an ACME account keypair/client and verify it can discover
+	// the Pebble server's ACME directory without error.
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("failed to generate account key: %v", err)
+	}
+	client := &acme.Client{
+		Key:          key,
+		HTTPClient:   httpClient,
+		DirectoryURL: fmt.Sprintf("https://%s/dir", config.ListenAddress),
+	}
+	_, err = client.Discover(context.TODO())
+	if err != nil {
+		t.Fatalf("failed to discover ACME directory: %v", err)
+	}
+
+	return environment{
+		config: config,
+		client: client,
+	}
+}
+
+func waitForServer(t *testing.T, addr string) {
+	t.Helper()
+
+	for i := 0; i < 20; i++ {
+		if conn, err := net.Dial("tcp", addr); err == nil {
+			conn.Close()
+			return
+		}
+		time.Sleep(time.Duration(i*100) * time.Millisecond)
+	}
+	t.Fatalf("failed to connect to %q after 20 tries", addr)
+}
+
+// fetchModule fetches the module at the given version and returns the directory
+// containing its source tree. It skips the test if fetching modules is not
+// possible in this environment.
+//
+// Copied from the stdlib cryptotest.FetchModule and adapted to not rely on the
+// stdlib internal testenv package.
+func fetchModule(t *testing.T, module, version string) string {
+	// If the default GOMODCACHE doesn't exist, use a temporary directory
+	// instead. (For example, run.bash sets GOPATH=/nonexist-gopath.)
+	out, err := exec.Command("go", "env", "GOMODCACHE").Output()
+	if err != nil {
+		t.Errorf("go env GOMODCACHE: %v\n%s", err, out)
+		if ee, ok := err.(*exec.ExitError); ok {
+			t.Logf("%s", ee.Stderr)
+		}
+		t.FailNow()
+	}
+	modcacheOk := false
+	if gomodcache := string(bytes.TrimSpace(out)); gomodcache != "" {
+		if _, err := os.Stat(gomodcache); err == nil {
+			modcacheOk = true
+		}
+	}
+	if !modcacheOk {
+		t.Setenv("GOMODCACHE", t.TempDir())
+		// Allow t.TempDir() to clean up subdirectories.
+		t.Setenv("GOFLAGS", os.Getenv("GOFLAGS")+" -modcacherw")
+	}
+
+	t.Logf("fetching %s@%s\n", module, version)
+
+	output, err := exec.Command("go", "mod", "download", "-json", module+"@"+version).CombinedOutput()
+	if err != nil {
+		t.Fatalf("failed to download %s@%s: %s\n%s\n", module, version, err, output)
+	}
+	var j struct {
+		Dir string
+	}
+	if err := json.Unmarshal(output, &j); err != nil {
+		t.Fatalf("failed to parse 'go mod download': %s\n%s\n", err, output)
+	}
+
+	return j.Dir
+}
+
+func prepareBinaries(t *testing.T, pebbleDir string) string {
+	t.Helper()
+
+	// We don't want to build in the module cache dir, which might not be
+	// writable or to pollute the user's clone with binaries if pebbleLocalDir
+	// is used.
+	binDir := t.TempDir()
+
+	build := func(cmd string) {
+		log.Printf("building %s", cmd)
+		buildCmd := exec.Command(
+			"go",
+			"build", "-o", filepath.Join(binDir, cmd), "-mod", "mod", "./cmd/"+cmd)
+		buildCmd.Dir = pebbleDir
+		output, err := buildCmd.CombinedOutput()
+		if err != nil {
+			t.Fatalf("failed to build %s: %s\n%s\n", cmd, err, output)
+		}
+	}
+
+	build("pebble")
+	build("pebble-challtestsrv")
+
+	return binDir
+}
+
+func spawnServerProcess(t *testing.T, dir string, cmd string, args ...string) {
+	t.Helper()
+
+	var stdout, stderr bytes.Buffer
+
+	cmdInstance := exec.Command("./"+cmd, args...)
+	cmdInstance.Dir = dir
+	cmdInstance.Stdout = &stdout
+	cmdInstance.Stderr = &stderr
+
+	if err := cmdInstance.Start(); err != nil {
+		t.Fatalf("failed to start %s: %v", cmd, err)
+	}
+
+	t.Cleanup(func() {
+		cmdInstance.Process.Kill()
+		cmdInstance.Wait()
+
+		if t.Failed() || testing.Verbose() {
+			t.Logf("=== %s output ===", cmd)
+			if stdout.Len() > 0 {
+				t.Logf("stdout:\n%s", strings.TrimSpace(stdout.String()))
+			}
+			if stderr.Len() > 0 {
+				t.Logf("stderr:\n%s", strings.TrimSpace(stderr.String()))
+			}
+		}
+	})
+}

acme/rfc8555.go

@@ -232,7 +232,7 @@ func (c *Client) AuthorizeOrder(ctx context.Context, id []AuthzID, opt ...OrderO
 	return responseOrder(res)
 }
 
-// GetOrder retrives an order identified by the given URL.
+// GetOrder retrieves an order identified by the given URL.
 // For orders created with AuthorizeOrder, the url value is Order.URI.
 //
 // If a caller needs to poll an order until its status is final,
@@ -272,7 +272,7 @@ func (c *Client) WaitOrder(ctx context.Context, url string) (*Order, error) {
 		case err != nil:
 			// Skip and retry.
 		case o.Status == StatusInvalid:
-			return nil, &OrderError{OrderURL: o.URI, Status: o.Status}
+			return nil, &OrderError{OrderURL: o.URI, Status: o.Status, Problem: o.Error}
 		case o.Status == StatusReady || o.Status == StatusValid:
 			return o, nil
 		}
@@ -369,7 +369,7 @@ func (c *Client) CreateOrderCert(ctx context.Context, url string, csr []byte, bu
 	}
 	// The only acceptable status post finalize and WaitOrder is "valid".
 	if o.Status != StatusValid {
-		return nil, "", &OrderError{OrderURL: o.URI, Status: o.Status}
+		return nil, "", &OrderError{OrderURL: o.URI, Status: o.Status, Problem: o.Error}
 	}
 	crt, err := c.fetchCertRFC(ctx, o.CertURL, bundle)
 	return crt, o.CertURL, err

acme/rfc8555_test.go

@@ -885,11 +885,17 @@ func TestRFC_WaitOrderError(t *testing.T) {
 	s.handle("/orders/1", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Location", s.url("/orders/1"))
 		w.WriteHeader(http.StatusOK)
-		s := StatusPending
 		if count > 0 {
-			s = StatusInvalid
+			// https://www.rfc-editor.org/rfc/rfc8555#section-7.3.3
+			errorData := `{
+				"type": "urn:ietf:params:acme:error:userActionRequired",
+				"detail": "Terms of service have changed",
+				"instance": "https://example.com/acme/agreement/?token=W8Ih3PswD-8"
+			}`
+			fmt.Fprintf(w, `{"status": %q, "error": %s}`, StatusInvalid, errorData)
+		} else {
+			fmt.Fprintf(w, `{"status": %q}`, StatusPending)
 		}
-		fmt.Fprintf(w, `{"status": %q}`, s)
 		count++
 	})
 	s.start()
@@ -910,6 +916,13 @@ func TestRFC_WaitOrderError(t *testing.T) {
 	if e.Status != StatusInvalid {
 		t.Errorf("e.Status = %q; want %q", e.Status, StatusInvalid)
 	}
+	if e.Problem == nil {
+		t.Errorf("e.Problem = nil")
+	}
+	expectedProbType := "urn:ietf:params:acme:error:userActionRequired"
+	if e.Problem.ProblemType != expectedProbType {
+		t.Errorf("e.Problem.ProblemType = %q; want %q", e.Problem.ProblemType, expectedProbType)
+	}
 }
 
 func TestRFC_CreateOrderCert(t *testing.T) {

acme/types.go

@@ -56,6 +56,10 @@ var (
 
 	// ErrNoAccount indicates that the Client's key has not been registered with the CA.
 	ErrNoAccount = errors.New("acme: account does not exist")
+
+	// errPreAuthorizationNotSupported indicates that the server does not
+	// support pre-authorization of identifiers.
+	errPreAuthorizationNotSupported = errors.New("acme: pre-authorization is not supported")
 )
 
 // A Subproblem describes an ACME subproblem as reported in an Error.
@@ -150,13 +154,16 @@ func (a *AuthorizationError) Error() string {
 
 // OrderError is returned from Client's order related methods.
 // It indicates the order is unusable and the clients should start over with
-// AuthorizeOrder.
+// AuthorizeOrder. A Problem description may be provided with details on
+// what caused the order to become unusable.
 //
 // The clients can still fetch the order object from CA using GetOrder
 // to inspect its state.
 type OrderError struct {
 	OrderURL string
 	Status   string
+	// Problem is the error that occurred while processing the order.
+	Problem *Error
 }
 
 func (oe *OrderError) Error() string {
@@ -615,7 +622,7 @@ func (*certOptKey) privateCertOpt() {}
 //
 // In TLS ChallengeCert methods, the template is also used as parent,
 // resulting in a self-signed certificate.
-// The DNSNames field of t is always overwritten for tls-sni challenge certs.
+// The DNSNames or IPAddresses fields of t are always overwritten for tls-alpn challenge certs.
 func WithTemplate(t *x509.Certificate) CertOption {
 	return (*certOptTemplate)(t)
 }

argon2/argon2.go

@@ -6,7 +6,7 @@
 // Argon2 was selected as the winner of the Password Hashing Competition and can
 // be used to derive cryptographic keys from passwords.
 //
-// For a detailed specification of Argon2 see [1].
+// For a detailed specification of Argon2 see [argon2-specs.pdf].
 //
 // If you aren't sure which function you need, use Argon2id (IDKey) and
 // the parameter recommendations for your scenario.
@@ -17,7 +17,7 @@
 // It uses data-independent memory access, which is preferred for password
 // hashing and password-based key derivation. Argon2i requires more passes over
 // memory than Argon2id to protect from trade-off attacks. The recommended
-// parameters (taken from [2]) for non-interactive operations are time=3 and to
+// parameters (taken from [RFC 9106 Section 7.3]) for non-interactive operations are time=3 and to
 // use the maximum available memory.
 //
 // # Argon2id
@@ -27,11 +27,11 @@
 // half of the first iteration over the memory and data-dependent memory access
 // for the rest. Argon2id is side-channel resistant and provides better brute-
 // force cost savings due to time-memory tradeoffs than Argon2i. The recommended
-// parameters for non-interactive operations (taken from [2]) are time=1 and to
+// parameters for non-interactive operations (taken from [RFC 9106 Section 7.3]) are time=1 and to
 // use the maximum available memory.
 //
-// [1] https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf
-// [2] https://tools.ietf.org/html/draft-irtf-cfrg-argon2-03#section-9.3
+// [argon2-specs.pdf]: https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf
+// [RFC 9106 Section 7.3]: https://www.rfc-editor.org/rfc/rfc9106.html#section-7.3
 package argon2
 
 import (
@@ -59,7 +59,7 @@ const (
 //
 //	key := argon2.Key([]byte("some password"), salt, 3, 32*1024, 4, 32)
 //
-// The draft RFC recommends[2] time=3, and memory=32*1024 is a sensible number.
+// [RFC 9106 Section 7.3] recommends time=3, and memory=32*1024 as a sensible number.
 // If using that amount of memory (32 MB) is not possible in some contexts then
 // the time parameter can be increased to compensate.
 //
@@ -69,6 +69,8 @@ const (
 // adjusted to the number of available CPUs. The cost parameters should be
 // increased as memory latency and CPU parallelism increases. Remember to get a
 // good random salt.
+//
+// [RFC 9106 Section 7.3]: https://www.rfc-editor.org/rfc/rfc9106.html#section-7.3
 func Key(password, salt []byte, time, memory uint32, threads uint8, keyLen uint32) []byte {
 	return deriveKey(argon2i, password, salt, nil, nil, time, memory, threads, keyLen)
 }
@@ -83,7 +85,7 @@ func Key(password, salt []byte, time, memory uint32, threads uint8, keyLen uint3
 //
 //	key := argon2.IDKey([]byte("some password"), salt, 1, 64*1024, 4, 32)
 //
-// The draft RFC recommends[2] time=1, and memory=64*1024 is a sensible number.
+// [RFC 9106 Section 7.3] recommends time=1, and memory=64*1024 as a sensible number.
 // If using that amount of memory (64 MB) is not possible in some contexts then
 // the time parameter can be increased to compensate.
 //
@@ -93,6 +95,8 @@ func Key(password, salt []byte, time, memory uint32, threads uint8, keyLen uint3
 // adjusted to the numbers of available CPUs. The cost parameters should be
 // increased as memory latency and CPU parallelism increases. Remember to get a
 // good random salt.
+//
+// [RFC 9106 Section 7.3]: https://www.rfc-editor.org/rfc/rfc9106.html#section-7.3
 func IDKey(password, salt []byte, time, memory uint32, threads uint8, keyLen uint32) []byte {
 	return deriveKey(argon2id, password, salt, nil, nil, time, memory, threads, keyLen)
 }

bcrypt/bcrypt.go

@@ -50,7 +50,7 @@ func (ih InvalidHashPrefixError) Error() string {
 type InvalidCostError int
 
 func (ic InvalidCostError) Error() string {
-	return fmt.Sprintf("crypto/bcrypt: cost %d is outside allowed range (%d,%d)", int(ic), MinCost, MaxCost)
+	return fmt.Sprintf("crypto/bcrypt: cost %d is outside allowed inclusive range %d..%d", int(ic), MinCost, MaxCost)
 }
 
 const (

blake2b/blake2x.go

@@ -12,6 +12,8 @@ import (
 
 // XOF defines the interface to hash functions that
 // support arbitrary-length output.
+//
+// New callers should prefer the standard library [hash.XOF].
 type XOF interface {
 	// Write absorbs more data into the hash's state. It panics if called
 	// after Read.
@@ -47,6 +49,8 @@ const maxOutputLength = (1 << 32) * 64
 //
 // A non-nil key turns the hash into a MAC. The key must between
 // zero and 32 bytes long.
+//
+// The result can be safely interface-upgraded to [hash.XOF].
 func NewXOF(size uint32, key []byte) (XOF, error) {
 	if len(key) > Size {
 		return nil, errKeySize
@@ -93,6 +97,10 @@ func (x *xof) Clone() XOF {
 	return &clone
 }
 
+func (x *xof) BlockSize() int {
+	return x.d.BlockSize()
+}
+
 func (x *xof) Reset() {
 	x.cfg[0] = byte(Size)
 	binary.LittleEndian.PutUint32(x.cfg[4:], uint32(Size)) // leaf length

blake2b/go125.go

@@ -0,0 +1,11 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.25
+
+package blake2b
+
+import "hash"
+
+var _ hash.XOF = (*xof)(nil)

chacha20/chacha_arm64.s

@@ -29,7 +29,7 @@ loop:
 	MOVD	$NUM_ROUNDS, R21
 	VLD1	(R11), [V30.S4, V31.S4]
 
-	// load contants
+	// load constants
 	// VLD4R (R10), [V0.S4, V1.S4, V2.S4, V3.S4]
 	WORD	$0x4D60E940
 

chacha20poly1305/_asm/chacha20poly1305_amd64_asm.go

@@ -641,7 +641,7 @@ func hashADDone() {
 // ----------------------------------------------------------------------------
 // ----------------------------------------------------------------------------
 
-// Implements the following function fignature:
+// Implements the following function signature:
 //
 //	func chacha20Poly1305Open(dst []byte, key []uint32, src []byte, ad []byte) bool
 func chacha20Poly1305Open() {
@@ -2967,7 +2967,7 @@ func openAVX2Tail512HashEnd() {
 // ----------------------------------------------------------------------------
 // ----------------------------------------------------------------------------
 
-// Implements the following function fignature:
+// Implements the following function signature:
 //
 //	func chacha20Poly1305Seal(dst []byte, key []uint32, src, ad []byte)
 func chacha20Poly1305Seal() {

chacha20poly1305/chacha20poly1305_amd64.go

@@ -56,7 +56,10 @@ func (c *chacha20poly1305) seal(dst, nonce, plaintext, additionalData []byte) []
 
 	ret, out := sliceForAppend(dst, len(plaintext)+16)
 	if alias.InexactOverlap(out, plaintext) {
-		panic("chacha20poly1305: invalid buffer overlap")
+		panic("chacha20poly1305: invalid buffer overlap of output and input")
+	}
+	if alias.AnyOverlap(out, additionalData) {
+		panic("chacha20poly1305: invalid buffer overlap of output and additional data")
 	}
 	chacha20Poly1305Seal(out[:], state[:], plaintext, additionalData)
 	return ret
@@ -73,7 +76,10 @@ func (c *chacha20poly1305) open(dst, nonce, ciphertext, additionalData []byte) (
 	ciphertext = ciphertext[:len(ciphertext)-16]
 	ret, out := sliceForAppend(dst, len(ciphertext))
 	if alias.InexactOverlap(out, ciphertext) {
-		panic("chacha20poly1305: invalid buffer overlap")
+		panic("chacha20poly1305: invalid buffer overlap of output and input")
+	}
+	if alias.AnyOverlap(out, additionalData) {
+		panic("chacha20poly1305: invalid buffer overlap of output and additional data")
 	}
 	if !chacha20Poly1305Open(out, state[:], ciphertext, additionalData) {
 		for i := range out {

chacha20poly1305/chacha20poly1305_generic.go

@@ -31,7 +31,10 @@ func (c *chacha20poly1305) sealGeneric(dst, nonce, plaintext, additionalData []b
 	ret, out := sliceForAppend(dst, len(plaintext)+poly1305.TagSize)
 	ciphertext, tag := out[:len(plaintext)], out[len(plaintext):]
 	if alias.InexactOverlap(out, plaintext) {
-		panic("chacha20poly1305: invalid buffer overlap")
+		panic("chacha20poly1305: invalid buffer overlap of output and input")
+	}
+	if alias.AnyOverlap(out, additionalData) {
+		panic("chacha20poly1305: invalid buffer overlap of output and additional data")
 	}
 
 	var polyKey [32]byte
@@ -67,7 +70,10 @@ func (c *chacha20poly1305) openGeneric(dst, nonce, ciphertext, additionalData []
 
 	ret, out := sliceForAppend(dst, len(ciphertext))
 	if alias.InexactOverlap(out, ciphertext) {
-		panic("chacha20poly1305: invalid buffer overlap")
+		panic("chacha20poly1305: invalid buffer overlap of output and input")
+	}
+	if alias.AnyOverlap(out, additionalData) {
+		panic("chacha20poly1305: invalid buffer overlap of output and additional data")
 	}
 	if !p.Verify(tag) {
 		for i := range out {

chacha20poly1305/chacha20poly1305_test.go

@@ -153,7 +153,7 @@ func TestRandom(t *testing.T) {
 	t.Run("X", func(t *testing.T) { f(t, NonceSizeX) })
 }
 
-func benchamarkChaCha20Poly1305Seal(b *testing.B, buf []byte, nonceSize int) {
+func benchmarkChaCha20Poly1305Seal(b *testing.B, buf []byte, nonceSize int) {
 	b.ReportAllocs()
 	b.SetBytes(int64(len(buf)))
 
@@ -176,7 +176,7 @@ func benchamarkChaCha20Poly1305Seal(b *testing.B, buf []byte, nonceSize int) {
 	}
 }
 
-func benchamarkChaCha20Poly1305Open(b *testing.B, buf []byte, nonceSize int) {
+func benchmarkChaCha20Poly1305Open(b *testing.B, buf []byte, nonceSize int) {
 	b.ReportAllocs()
 	b.SetBytes(int64(len(buf)))
 
@@ -204,17 +204,17 @@ func benchamarkChaCha20Poly1305Open(b *testing.B, buf []byte, nonceSize int) {
 func BenchmarkChacha20Poly1305(b *testing.B) {
 	for _, length := range []int{64, 1350, 8 * 1024} {
 		b.Run("Open-"+strconv.Itoa(length), func(b *testing.B) {
-			benchamarkChaCha20Poly1305Open(b, make([]byte, length), NonceSize)
+			benchmarkChaCha20Poly1305Open(b, make([]byte, length), NonceSize)
 		})
 		b.Run("Seal-"+strconv.Itoa(length), func(b *testing.B) {
-			benchamarkChaCha20Poly1305Seal(b, make([]byte, length), NonceSize)
+			benchmarkChaCha20Poly1305Seal(b, make([]byte, length), NonceSize)
 		})
 
 		b.Run("Open-"+strconv.Itoa(length)+"-X", func(b *testing.B) {
-			benchamarkChaCha20Poly1305Open(b, make([]byte, length), NonceSizeX)
+			benchmarkChaCha20Poly1305Open(b, make([]byte, length), NonceSizeX)
 		})
 		b.Run("Seal-"+strconv.Itoa(length)+"-X", func(b *testing.B) {
-			benchamarkChaCha20Poly1305Seal(b, make([]byte, length), NonceSizeX)
+			benchmarkChaCha20Poly1305Seal(b, make([]byte, length), NonceSizeX)
 		})
 	}
 }

cryptobyte/asn1.go

@@ -234,7 +234,7 @@ func (b *Builder) AddASN1(tag asn1.Tag, f BuilderContinuation) {
 	// Identifiers with the low five bits set indicate high-tag-number format
 	// (two or more octets), which we don't support.
 	if tag&0x1f == 0x1f {
-		b.err = fmt.Errorf("cryptobyte: high-tag number identifier octects not supported: 0x%x", tag)
+		b.err = fmt.Errorf("cryptobyte: high-tag number identifier octets not supported: 0x%x", tag)
 		return
 	}
 	b.AddUint8(uint8(tag))

curve25519/curve25519.go

@@ -3,11 +3,14 @@
 // license that can be found in the LICENSE file.
 
 // Package curve25519 provides an implementation of the X25519 function, which
-// performs scalar multiplication on the elliptic curve known as Curve25519.
-// See RFC 7748.
+// performs scalar multiplication on the elliptic curve known as Curve25519
+// according to [RFC 7748].
 //
-// This package is a wrapper for the X25519 implementation
-// in the crypto/ecdh package.
+// The curve25519 package is a wrapper for the X25519 implementation in the
+// crypto/ecdh package. It is [frozen] and is not accepting new features.
+//
+// [RFC 7748]: https://datatracker.ietf.org/doc/html/rfc7748
+// [frozen]: https://go.dev/wiki/Frozen
 package curve25519
 
 import "crypto/ecdh"
@@ -36,7 +39,7 @@ func ScalarBaseMult(dst, scalar *[32]byte) {
 	curve := ecdh.X25519()
 	priv, err := curve.NewPrivateKey(scalar[:])
 	if err != nil {
-		panic("curve25519: internal error: scalarBaseMult was not 32 bytes")
+		panic("curve25519: " + err.Error())
 	}
 	copy(dst[:], priv.PublicKey().Bytes())
 }

ed25519/ed25519.go

@@ -2,16 +2,19 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package ed25519 implements the Ed25519 signature algorithm. See
-// https://ed25519.cr.yp.to/.
+// Package ed25519 implements the Ed25519 signature algorithm.
 //
 // These functions are also compatible with the “Ed25519” function defined in
-// RFC 8032. However, unlike RFC 8032's formulation, this package's private key
+// [RFC 8032]. However, unlike RFC 8032's formulation, this package's private key
 // representation includes a public key suffix to make multiple signing
 // operations with the same key more efficient. This package refers to the RFC
 // 8032 private key as the “seed”.
 //
-// This package is a wrapper around the standard library crypto/ed25519 package.
+// The ed25519 package is a wrapper for the Ed25519 implementation in the
+// crypto/ed25519 package. It is [frozen] and is not accepting new features.
+//
+// [RFC 8032]: https://datatracker.ietf.org/doc/html/rfc8032
+// [frozen]: https://go.dev/wiki/Frozen
 package ed25519
 
 import (

go.mod

@@ -1,11 +1,11 @@
 module golang.org/x/crypto
 
-go 1.23.0
+go 1.24.0
 
 require (
-	golang.org/x/net v0.21.0 // tagx:ignore
-	golang.org/x/sys v0.30.0
-	golang.org/x/term v0.29.0
+	golang.org/x/net v0.46.0 // tagx:ignore
+	golang.org/x/sys v0.38.0
+	golang.org/x/term v0.37.0
 )
 
-require golang.org/x/text v0.22.0 // indirect
+require golang.org/x/text v0.31.0 // indirect

go.sum

@@ -1,8 +1,8 @@
-golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
-golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
-golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4=
+golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=

internal/poly1305/mac_noasm.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (!amd64 && !ppc64le && !ppc64 && !s390x) || !gc || purego
+//go:build (!amd64 && !loong64 && !ppc64le && !ppc64 && !s390x) || !gc || purego
 
 package poly1305
 

internal/poly1305/sum_asm.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build gc && !purego
+//go:build gc && !purego && (amd64 || loong64 || ppc64 || ppc64le)
 
 package poly1305
 

internal/poly1305/sum_loong64.s

@@ -0,0 +1,123 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc && !purego
+
+// func update(state *macState, msg []byte)
+TEXT ·update(SB), $0-32
+	MOVV	state+0(FP), R4
+	MOVV	msg_base+8(FP), R5
+	MOVV	msg_len+16(FP), R6
+
+	MOVV	$0x10, R7
+
+	MOVV	(R4), R8	// h0
+	MOVV	8(R4), R9	// h1
+	MOVV	16(R4), R10	// h2
+	MOVV	24(R4), R11	// r0
+	MOVV	32(R4), R12	// r1
+
+	BLT	R6, R7, bytes_between_0_and_15
+
+loop:
+	MOVV	(R5), R14	// msg[0:8]
+	MOVV	8(R5), R16	// msg[8:16]
+	ADDV	R14, R8, R8	// h0 (x1 + y1 = z1', if z1' < x1 then z1' overflow)
+	ADDV	R16, R9, R27
+	SGTU	R14, R8, R24	// h0.carry
+	SGTU	R9, R27, R28
+	ADDV	R27, R24, R9	// h1
+	SGTU	R27, R9, R24
+	OR	R24, R28, R24	// h1.carry
+	ADDV	$0x01, R24, R24
+	ADDV	R10, R24, R10	// h2
+
+	ADDV	$16, R5, R5	// msg = msg[16:]
+
+multiply:
+	MULV	R8, R11, R14	// h0r0.lo
+	MULHVU	R8, R11, R15	// h0r0.hi
+	MULV	R9, R11, R13	// h1r0.lo
+	MULHVU	R9, R11, R16	// h1r0.hi
+	ADDV	R13, R15, R15
+	SGTU	R13, R15, R24
+	ADDV	R24, R16, R16
+	MULV	R10, R11, R25
+	ADDV	R16, R25, R25
+	MULV	R8, R12, R13	// h0r1.lo
+	MULHVU	R8, R12, R16	// h0r1.hi
+	ADDV	R13, R15, R15
+	SGTU	R13, R15, R24
+	ADDV	R24, R16, R16
+	MOVV	R16, R8
+	MULV	R10, R12, R26	// h2r1
+	MULV	R9, R12, R13	// h1r1.lo
+	MULHVU	R9, R12, R16	// h1r1.hi
+	ADDV	R13, R25, R25
+	ADDV	R16, R26, R27
+	SGTU	R13, R25, R24
+	ADDV	R27, R24, R26
+	ADDV	R8, R25, R25
+	SGTU	R8, R25, R24
+	ADDV	R24, R26, R26
+	AND	$3, R25, R10
+	AND	$-4, R25, R17
+	ADDV	R17, R14, R8
+	ADDV	R26, R15, R27
+	SGTU	R17, R8, R24
+	SGTU	R26, R27, R28
+	ADDV	R27, R24, R9
+	SGTU	R27, R9, R24
+	OR	R24, R28, R24
+	ADDV	R24, R10, R10
+	SLLV	$62, R26, R27
+	SRLV	$2, R25, R28
+	SRLV	$2, R26, R26
+	OR	R27, R28, R25
+	ADDV	R25, R8, R8
+	ADDV	R26, R9, R27
+	SGTU	R25, R8, R24
+	SGTU	R26, R27, R28
+	ADDV	R27, R24, R9
+	SGTU	R27, R9, R24
+	OR	R24, R28, R24
+	ADDV	R24, R10, R10
+
+	SUBV	$16, R6, R6
+	BGE	R6, R7, loop
+
+bytes_between_0_and_15:
+	BEQ	R6, R0, done
+	MOVV	$1, R14
+	XOR	R15, R15
+	ADDV	R6, R5, R5
+
+flush_buffer:
+	MOVBU	-1(R5), R25
+	SRLV	$56, R14, R24
+	SLLV	$8, R15, R28
+	SLLV	$8, R14, R14
+	OR	R24, R28, R15
+	XOR	R25, R14, R14
+	SUBV	$1, R6, R6
+	SUBV	$1, R5, R5
+	BNE	R6, R0, flush_buffer
+
+	ADDV	R14, R8, R8
+	SGTU	R14, R8, R24
+	ADDV	R15, R9, R27
+	SGTU	R15, R27, R28
+	ADDV	R27, R24, R9
+	SGTU	R27, R9, R24
+	OR	R24, R28, R24
+	ADDV	R10, R24, R10
+
+	MOVV	$16, R6
+	JMP	multiply
+
+done:
+	MOVV	R8, (R4)
+	MOVV	R9, 8(R4)
+	MOVV	R10, 16(R4)
+	RET

internal/poly1305/sum_ppc64x.go

@@ -1,47 +0,0 @@
-// Copyright 2019 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build gc && !purego && (ppc64 || ppc64le)
-
-package poly1305
-
-//go:noescape
-func update(state *macState, msg []byte)
-
-// mac is a wrapper for macGeneric that redirects calls that would have gone to
-// updateGeneric to update.
-//
-// Its Write and Sum methods are otherwise identical to the macGeneric ones, but
-// using function pointers would carry a major performance cost.
-type mac struct{ macGeneric }
-
-func (h *mac) Write(p []byte) (int, error) {
-	nn := len(p)
-	if h.offset > 0 {
-		n := copy(h.buffer[h.offset:], p)
-		if h.offset+n < TagSize {
-			h.offset += n
-			return nn, nil
-		}
-		p = p[n:]
-		h.offset = 0
-		update(&h.macState, h.buffer[:])
-	}
-	if n := len(p) - (len(p) % TagSize); n > 0 {
-		update(&h.macState, p[:n])
-		p = p[n:]
-	}
-	if len(p) > 0 {
-		h.offset += copy(h.buffer[h.offset:], p)
-	}
-	return nn, nil
-}
-
-func (h *mac) Sum(out *[16]byte) {
-	state := h.macState
-	if h.offset > 0 {
-		update(&state, h.buffer[:h.offset])
-	}
-	finalize(out, &state.h, &state.s)
-}

internal/wycheproof/rsa_pss_test.go

@@ -141,7 +141,7 @@ func TestRsaPss(t *testing.T) {
 			}
 			// Run all the tests twice: the first time with the salt length
 			// as PSSSaltLengthAuto, and the second time with the salt length
-			// explictily set to tg.SLen.
+			// explicitly set to tg.SLen.
 			for i := 0; i < 2; i++ {
 				for _, sig := range tg.Tests {
 					h.Reset()

nacl/auth/auth.go

@@ -2,25 +2,16 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-/*
-Package auth authenticates a message using a secret key.
-
-The Sum function, viewed as a function of the message for a uniform random
-key, is designed to meet the standard notion of unforgeability. This means
-that an attacker cannot find authenticators for any messages not authenticated
-by the sender, even if the attacker has adaptively influenced the messages
-authenticated by the sender. For a formal definition see, e.g., Section 2.4
-of Bellare, Kilian, and Rogaway, "The security of the cipher block chaining
-message authentication code," Journal of Computer and System Sciences 61 (2000),
-362–399; http://www-cse.ucsd.edu/~mihir/papers/cbc.html.
-
-auth does not make any promises regarding "strong" unforgeability; perhaps
-one valid authenticator can be converted into another valid authenticator for
-the same message. NaCl also does not make any promises regarding "truncated
-unforgeability."
-
-This package is interoperable with NaCl: https://nacl.cr.yp.to/auth.html.
-*/
+// Package auth authenticates a message using a secret key.
+//
+// This package is interoperable with [NaCl].
+//
+// The auth package is essentially a wrapper for HMAC-SHA-512 (implemented by
+// crypto/hmac and crypto/sha512), truncated to 32 bytes. It is [frozen] and is
+// not accepting new features.
+//
+// [NaCl]: https://nacl.cr.yp.to/auth.html
+// [frozen]: https://go.dev/wiki/Frozen
 package auth
 
 import (

nacl/box/box_test.go

@@ -114,7 +114,7 @@ func TestSealOpenAnonymous(t *testing.T) {
 		t.Fatal("expected out to be unchanged")
 	}
 	if !bytes.HasPrefix(box, orig) {
-		t.Fatal("expected out to be coppied to returned slice")
+		t.Fatal("expected out to be copied to returned slice")
 	}
 	_, ok = OpenAnonymous(nil, box[len(out):], publicKey, privateKey)
 	if !ok {

nacl/sign/sign.go

@@ -4,20 +4,15 @@
 
 // Package sign signs small messages using public-key cryptography.
 //
-// Sign uses Ed25519 to sign messages. The length of messages is not hidden.
-// Messages should be small because:
-// 1. The whole message needs to be held in memory to be processed.
-// 2. Using large messages pressures implementations on small machines to process
-// plaintext without verifying the signature. This is very dangerous, and this API
-// discourages it, but a protocol that uses excessive message sizes might present
-// some implementations with no other choice.
-// 3. Performance may be improved by working with messages that fit into data caches.
-// Thus large amounts of data should be chunked so that each message is small.
+// This package is interoperable with [libsodium], as well as [TweetNaCl].
 //
-// This package is not interoperable with the current release of NaCl
-// (https://nacl.cr.yp.to/sign.html), which does not support Ed25519 yet. However,
-// it is compatible with the NaCl fork libsodium (https://www.libsodium.org), as well
-// as TweetNaCl (https://tweetnacl.cr.yp.to/).
+// The sign package is essentially a wrapper for the Ed25519 signature
+// algorithm (implemented by crypto/ed25519). It is [frozen] and is not accepting
+// new features.
+//
+// [libsodium]: https://libsodium.gitbook.io/doc/public-key_cryptography/public-key_signatures
+// [TweetNaCl]: https://tweetnacl.cr.yp.to/
+// [frozen]: https://go.dev/wiki/Frozen
 package sign
 
 import (

nacl/sign/sign_test.go

@@ -69,6 +69,6 @@ func TestGenerateSignOpen(t *testing.T) {
 	}
 
 	if !bytes.Equal(message, testMessage) {
-		t.Fatalf("verified message does not match signed messge, got\n%x\n, expected\n%x", message, testMessage)
+		t.Fatalf("verified message does not match signed message, got\n%x\n, expected\n%x", message, testMessage)
 	}
 }

openpgp/packet/opaque_test.go

@@ -51,7 +51,7 @@ func TestOpaqueParseReason(t *testing.T) {
 	const expectedBad = 3
 	// Test post-conditions, make sure we actually parsed packets as expected.
 	if badPackets != expectedBad {
-		t.Errorf("unexpected # unparseable packets: %d (want %d)", badPackets, expectedBad)
+		t.Errorf("unexpected # unparsable packets: %d (want %d)", badPackets, expectedBad)
 	}
 	if uid == nil {
 		t.Errorf("failed to find expected UID in unsupported keyring")

openpgp/s2k/s2k.go

@@ -53,7 +53,7 @@ func (c *Config) hash() crypto.Hash {
 
 func (c *Config) encodedCount() uint8 {
 	if c == nil || c.S2KCount == 0 {
-		return 96 // The common case. Correspoding to 65536
+		return 96 // The common case. Corresponding to 65536
 	}
 
 	i := c.S2KCount

otr/otr.go

@@ -8,6 +8,10 @@
 // The version of OTR implemented by this package has been deprecated
 // (https://bugs.otr.im/lib/libotr/issues/140). An implementation of OTRv3 is
 // available at https://github.com/coyim/otr3.
+//
+// The otr package is [frozen] and is not accepting new features.
+//
+// [frozen]: https://go.dev/wiki/Frozen
 package otr
 
 import (

otr/otr_test.go

@@ -75,8 +75,8 @@ const libOTRPrivateKey = `(privkeys
  (account
 (name "foo@example.com")
 (protocol prpl-jabber)
-(private-key 
- (dsa 
+(private-key
+ (dsa
   (p #00FC07ABCF0DC916AFF6E9AE47BEF60C7AB9B4D6B2469E436630E36F8A489BE812486A09F30B71224508654940A835301ACC525A4FF133FC152CC53DCC59D65C30A54F1993FE13FE63E5823D4C746DB21B90F9B9C00B49EC7404AB1D929BA7FBA12F2E45C6E0A651689750E8528AB8C031D3561FECEE72EBB4A090D450A9B7A857#)
   (q #00997BD266EF7B1F60A5C23F3A741F2AEFD07A2081#)
   (g #535E360E8A95EBA46A4F7DE50AD6E9B2A6DB785A66B64EB9F20338D2A3E8FB0E94725848F1AA6CC567CB83A1CC517EC806F2E92EAE71457E80B2210A189B91250779434B41FC8A8873F6DB94BEA7D177F5D59E7E114EE10A49CFD9CEF88AE43387023B672927BA74B04EB6BBB5E57597766A2F9CE3857D7ACE3E1E3BC1FC6F26#)
@@ -402,7 +402,7 @@ func TestAgainstLibOTR(t *testing.T) {
 	// This test requires otr.c.test to be built as /tmp/a.out.
 	// If enabled, this tests runs forever performing OTR handshakes in a
 	// loop.
-	return
+	t.Skip("This test requires otr.c.test to be built as /tmp/a.out")
 
 	alicePrivateKey, _ := hex.DecodeString(alicePrivateKeyHex)
 	var alice Conversation

pkcs12/pkcs12.go

@@ -4,12 +4,16 @@
 
 // Package pkcs12 implements some of PKCS#12.
 //
-// This implementation is distilled from https://tools.ietf.org/html/rfc7292
-// and referenced documents. It is intended for decoding P12/PFX-stored
-// certificates and keys for use with the crypto/tls package.
+// This implementation is distilled from [RFC 7292] and referenced documents.
+// It is intended for decoding P12/PFX-stored certificates and keys for use
+// with the crypto/tls package.
 //
-// This package is frozen. If it's missing functionality you need, consider
-// an alternative like software.sslmate.com/src/go-pkcs12.
+// The pkcs12 package is [frozen] and is not accepting new features.
+// If it's missing functionality you need, consider an alternative like
+// software.sslmate.com/src/go-pkcs12.
+//
+// [RFC 7292]: https://datatracker.ietf.org/doc/html/rfc7292
+// [frozen]: https://go.dev/wiki/Frozen
 package pkcs12
 
 import (

salsa20/salsa/hsalsa20.go

@@ -3,6 +3,10 @@
 // license that can be found in the LICENSE file.
 
 // Package salsa provides low-level access to functions in the Salsa family.
+//
+// Deprecated: this package exposes unsafe low-level operations. New applications
+// should consider using the AEAD construction in golang.org/x/crypto/chacha20poly1305
+// instead. Existing users should migrate to golang.org/x/crypto/salsa20.
 package salsa
 
 import "math/bits"

sha3/_asm/go.mod

@@ -1,15 +0,0 @@
-module sha3/_asm
-
-go 1.22
-
-require (
-	github.com/mmcloughlin/avo v0.6.0
-	golang.org/x/crypto v0.33.0
-)
-
-require (
-	golang.org/x/mod v0.19.0 // indirect
-	golang.org/x/sync v0.7.0 // indirect
-	golang.org/x/sys v0.30.0 // indirect
-	golang.org/x/tools v0.23.0 // indirect
-)

sha3/_asm/go.sum

@@ -1,12 +0,0 @@
-github.com/mmcloughlin/avo v0.6.0 h1:QH6FU8SKoTLaVs80GA8TJuLNkUYl4VokHKlPhVDg4YY=
-github.com/mmcloughlin/avo v0.6.0/go.mod h1:8CoAGaCSYXtCPR+8y18Y9aB/kxb8JSS6FRI7mSkvD+8=
-golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
-golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
-golang.org/x/mod v0.19.0 h1:fEdghXQSo20giMthA7cd28ZC+jts4amQ3YMXiP5oMQ8=
-golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/tools v0.23.0 h1:SGsXPZ+2l4JsgaCKkx+FQ9YZ5XEtA1GZYuoDjenLjvg=
-golang.org/x/tools v0.23.0/go.mod h1:pnu6ufv6vQkll6szChhK3C3L/ruaIv5eBeztNG8wtsI=

sha3/_asm/keccakf_amd64_asm.go

@@ -1,438 +0,0 @@
-// Copyright 2024 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// This code was translated into a form compatible with 6a from the public
-// domain sources at https://github.com/gvanas/KeccakCodePackage
-
-package main
-
-import (
-	. "github.com/mmcloughlin/avo/build"
-	. "github.com/mmcloughlin/avo/operand"
-	. "github.com/mmcloughlin/avo/reg"
-	_ "golang.org/x/crypto/sha3"
-)
-
-//go:generate go run . -out ../keccakf_amd64.s -pkg sha3
-
-// Round Constants for use in the ι step.
-var RoundConstants = [24]uint64{
-	0x0000000000000001,
-	0x0000000000008082,
-	0x800000000000808A,
-	0x8000000080008000,
-	0x000000000000808B,
-	0x0000000080000001,
-	0x8000000080008081,
-	0x8000000000008009,
-	0x000000000000008A,
-	0x0000000000000088,
-	0x0000000080008009,
-	0x000000008000000A,
-	0x000000008000808B,
-	0x800000000000008B,
-	0x8000000000008089,
-	0x8000000000008003,
-	0x8000000000008002,
-	0x8000000000000080,
-	0x000000000000800A,
-	0x800000008000000A,
-	0x8000000080008081,
-	0x8000000000008080,
-	0x0000000080000001,
-	0x8000000080008008,
-}
-
-var (
-	// Temporary registers
-	rT1 GPPhysical = RAX
-
-	// Round vars
-	rpState = Mem{Base: RDI}
-	rpStack = Mem{Base: RSP}
-
-	rDa = RBX
-	rDe = RCX
-	rDi = RDX
-	rDo = R8
-	rDu = R9
-
-	rBa = R10
-	rBe = R11
-	rBi = R12
-	rBo = R13
-	rBu = R14
-
-	rCa = RSI
-	rCe = RBP
-	rCi = rBi
-	rCo = rBo
-	rCu = R15
-)
-
-const (
-	_ba = iota * 8
-	_be
-	_bi
-	_bo
-	_bu
-	_ga
-	_ge
-	_gi
-	_go
-	_gu
-	_ka
-	_ke
-	_ki
-	_ko
-	_ku
-	_ma
-	_me
-	_mi
-	_mo
-	_mu
-	_sa
-	_se
-	_si
-	_so
-	_su
-)
-
-func main() {
-	Package("golang.org/x/crypto/sha3")
-	ConstraintExpr("amd64,!purego,gc")
-	keccakF1600()
-	Generate()
-}
-
-func MOVQ_RBI_RCE() { MOVQ(rBi, rCe) }
-func XORQ_RT1_RCA() { XORQ(rT1, rCa) }
-func XORQ_RT1_RCE() { XORQ(rT1, rCe) }
-func XORQ_RBA_RCU() { XORQ(rBa, rCu) }
-func XORQ_RBE_RCU() { XORQ(rBe, rCu) }
-func XORQ_RDU_RCU() { XORQ(rDu, rCu) }
-func XORQ_RDA_RCA() { XORQ(rDa, rCa) }
-func XORQ_RDE_RCE() { XORQ(rDe, rCe) }
-
-type ArgMacro func()
-
-func mKeccakRound(
-	iState, oState Mem,
-	rc U64,
-	B_RBI_RCE, G_RT1_RCA, G_RT1_RCE, G_RBA_RCU,
-	K_RT1_RCA, K_RT1_RCE, K_RBA_RCU, M_RT1_RCA,
-	M_RT1_RCE, M_RBE_RCU, S_RDU_RCU, S_RDA_RCA,
-	S_RDE_RCE ArgMacro,
-) {
-	Comment("Prepare round")
-	MOVQ(rCe, rDa)
-	ROLQ(Imm(1), rDa)
-
-	MOVQ(iState.Offset(_bi), rCi)
-	XORQ(iState.Offset(_gi), rDi)
-	XORQ(rCu, rDa)
-	XORQ(iState.Offset(_ki), rCi)
-	XORQ(iState.Offset(_mi), rDi)
-	XORQ(rDi, rCi)
-
-	MOVQ(rCi, rDe)
-	ROLQ(Imm(1), rDe)
-
-	MOVQ(iState.Offset(_bo), rCo)
-	XORQ(iState.Offset(_go), rDo)
-	XORQ(rCa, rDe)
-	XORQ(iState.Offset(_ko), rCo)
-	XORQ(iState.Offset(_mo), rDo)
-	XORQ(rDo, rCo)
-
-	MOVQ(rCo, rDi)
-	ROLQ(Imm(1), rDi)
-
-	MOVQ(rCu, rDo)
-	XORQ(rCe, rDi)
-	ROLQ(Imm(1), rDo)
-
-	MOVQ(rCa, rDu)
-	XORQ(rCi, rDo)
-	ROLQ(Imm(1), rDu)
-
-	Comment("Result b")
-	MOVQ(iState.Offset(_ba), rBa)
-	MOVQ(iState.Offset(_ge), rBe)
-	XORQ(rCo, rDu)
-	MOVQ(iState.Offset(_ki), rBi)
-	MOVQ(iState.Offset(_mo), rBo)
-	MOVQ(iState.Offset(_su), rBu)
-	XORQ(rDe, rBe)
-	ROLQ(Imm(44), rBe)
-	XORQ(rDi, rBi)
-	XORQ(rDa, rBa)
-	ROLQ(Imm(43), rBi)
-
-	MOVQ(rBe, rCa)
-	MOVQ(rc, rT1)
-	ORQ(rBi, rCa)
-	XORQ(rBa, rT1)
-	XORQ(rT1, rCa)
-	MOVQ(rCa, oState.Offset(_ba))
-
-	XORQ(rDu, rBu)
-	ROLQ(Imm(14), rBu)
-	MOVQ(rBa, rCu)
-	ANDQ(rBe, rCu)
-	XORQ(rBu, rCu)
-	MOVQ(rCu, oState.Offset(_bu))
-
-	XORQ(rDo, rBo)
-	ROLQ(Imm(21), rBo)
-	MOVQ(rBo, rT1)
-	ANDQ(rBu, rT1)
-	XORQ(rBi, rT1)
-	MOVQ(rT1, oState.Offset(_bi))
-
-	NOTQ(rBi)
-	ORQ(rBa, rBu)
-	ORQ(rBo, rBi)
-	XORQ(rBo, rBu)
-	XORQ(rBe, rBi)
-	MOVQ(rBu, oState.Offset(_bo))
-	MOVQ(rBi, oState.Offset(_be))
-	B_RBI_RCE()
-
-	Comment("Result g")
-	MOVQ(iState.Offset(_gu), rBe)
-	XORQ(rDu, rBe)
-	MOVQ(iState.Offset(_ka), rBi)
-	ROLQ(Imm(20), rBe)
-	XORQ(rDa, rBi)
-	ROLQ(Imm(3), rBi)
-	MOVQ(iState.Offset(_bo), rBa)
-	MOVQ(rBe, rT1)
-	ORQ(rBi, rT1)
-	XORQ(rDo, rBa)
-	MOVQ(iState.Offset(_me), rBo)
-	MOVQ(iState.Offset(_si), rBu)
-	ROLQ(Imm(28), rBa)
-	XORQ(rBa, rT1)
-	MOVQ(rT1, oState.Offset(_ga))
-	G_RT1_RCA()
-
-	XORQ(rDe, rBo)
-	ROLQ(Imm(45), rBo)
-	MOVQ(rBi, rT1)
-	ANDQ(rBo, rT1)
-	XORQ(rBe, rT1)
-	MOVQ(rT1, oState.Offset(_ge))
-	G_RT1_RCE()
-
-	XORQ(rDi, rBu)
-	ROLQ(Imm(61), rBu)
-	MOVQ(rBu, rT1)
-	ORQ(rBa, rT1)
-	XORQ(rBo, rT1)
-	MOVQ(rT1, oState.Offset(_go))
-
-	ANDQ(rBe, rBa)
-	XORQ(rBu, rBa)
-	MOVQ(rBa, oState.Offset(_gu))
-	NOTQ(rBu)
-	G_RBA_RCU()
-
-	ORQ(rBu, rBo)
-	XORQ(rBi, rBo)
-	MOVQ(rBo, oState.Offset(_gi))
-
-	Comment("Result k")
-	MOVQ(iState.Offset(_be), rBa)
-	MOVQ(iState.Offset(_gi), rBe)
-	MOVQ(iState.Offset(_ko), rBi)
-	MOVQ(iState.Offset(_mu), rBo)
-	MOVQ(iState.Offset(_sa), rBu)
-	XORQ(rDi, rBe)
-	ROLQ(Imm(6), rBe)
-	XORQ(rDo, rBi)
-	ROLQ(Imm(25), rBi)
-	MOVQ(rBe, rT1)
-	ORQ(rBi, rT1)
-	XORQ(rDe, rBa)
-	ROLQ(Imm(1), rBa)
-	XORQ(rBa, rT1)
-	MOVQ(rT1, oState.Offset(_ka))
-	K_RT1_RCA()
-
-	XORQ(rDu, rBo)
-	ROLQ(Imm(8), rBo)
-	MOVQ(rBi, rT1)
-	ANDQ(rBo, rT1)
-	XORQ(rBe, rT1)
-	MOVQ(rT1, oState.Offset(_ke))
-	K_RT1_RCE()
-
-	XORQ(rDa, rBu)
-	ROLQ(Imm(18), rBu)
-	NOTQ(rBo)
-	MOVQ(rBo, rT1)
-	ANDQ(rBu, rT1)
-	XORQ(rBi, rT1)
-	MOVQ(rT1, oState.Offset(_ki))
-
-	MOVQ(rBu, rT1)
-	ORQ(rBa, rT1)
-	XORQ(rBo, rT1)
-	MOVQ(rT1, oState.Offset(_ko))
-
-	ANDQ(rBe, rBa)
-	XORQ(rBu, rBa)
-	MOVQ(rBa, oState.Offset(_ku))
-	K_RBA_RCU()
-
-	Comment("Result m")
-	MOVQ(iState.Offset(_ga), rBe)
-	XORQ(rDa, rBe)
-	MOVQ(iState.Offset(_ke), rBi)
-	ROLQ(Imm(36), rBe)
-	XORQ(rDe, rBi)
-	MOVQ(iState.Offset(_bu), rBa)
-	ROLQ(Imm(10), rBi)
-	MOVQ(rBe, rT1)
-	MOVQ(iState.Offset(_mi), rBo)
-	ANDQ(rBi, rT1)
-	XORQ(rDu, rBa)
-	MOVQ(iState.Offset(_so), rBu)
-	ROLQ(Imm(27), rBa)
-	XORQ(rBa, rT1)
-	MOVQ(rT1, oState.Offset(_ma))
-	M_RT1_RCA()
-
-	XORQ(rDi, rBo)
-	ROLQ(Imm(15), rBo)
-	MOVQ(rBi, rT1)
-	ORQ(rBo, rT1)
-	XORQ(rBe, rT1)
-	MOVQ(rT1, oState.Offset(_me))
-	M_RT1_RCE()
-
-	XORQ(rDo, rBu)
-	ROLQ(Imm(56), rBu)
-	NOTQ(rBo)
-	MOVQ(rBo, rT1)
-	ORQ(rBu, rT1)
-	XORQ(rBi, rT1)
-	MOVQ(rT1, oState.Offset(_mi))
-
-	ORQ(rBa, rBe)
-	XORQ(rBu, rBe)
-	MOVQ(rBe, oState.Offset(_mu))
-
-	ANDQ(rBa, rBu)
-	XORQ(rBo, rBu)
-	MOVQ(rBu, oState.Offset(_mo))
-	M_RBE_RCU()
-
-	Comment("Result s")
-	MOVQ(iState.Offset(_bi), rBa)
-	MOVQ(iState.Offset(_go), rBe)
-	MOVQ(iState.Offset(_ku), rBi)
-	XORQ(rDi, rBa)
-	MOVQ(iState.Offset(_ma), rBo)
-	ROLQ(Imm(62), rBa)
-	XORQ(rDo, rBe)
-	MOVQ(iState.Offset(_se), rBu)
-	ROLQ(Imm(55), rBe)
-
-	XORQ(rDu, rBi)
-	MOVQ(rBa, rDu)
-	XORQ(rDe, rBu)
-	ROLQ(Imm(2), rBu)
-	ANDQ(rBe, rDu)
-	XORQ(rBu, rDu)
-	MOVQ(rDu, oState.Offset(_su))
-
-	ROLQ(Imm(39), rBi)
-	S_RDU_RCU()
-	NOTQ(rBe)
-	XORQ(rDa, rBo)
-	MOVQ(rBe, rDa)
-	ANDQ(rBi, rDa)
-	XORQ(rBa, rDa)
-	MOVQ(rDa, oState.Offset(_sa))
-	S_RDA_RCA()
-
-	ROLQ(Imm(41), rBo)
-	MOVQ(rBi, rDe)
-	ORQ(rBo, rDe)
-	XORQ(rBe, rDe)
-	MOVQ(rDe, oState.Offset(_se))
-	S_RDE_RCE()
-
-	MOVQ(rBo, rDi)
-	MOVQ(rBu, rDo)
-	ANDQ(rBu, rDi)
-	ORQ(rBa, rDo)
-	XORQ(rBi, rDi)
-	XORQ(rBo, rDo)
-	MOVQ(rDi, oState.Offset(_si))
-	MOVQ(rDo, oState.Offset(_so))
-}
-
-// keccakF1600 applies the Keccak permutation to a 1600b-wide
-// state represented as a slice of 25 uint64s.
-func keccakF1600() {
-	Implement("keccakF1600")
-	AllocLocal(200)
-
-	Load(Param("a"), rpState.Base)
-
-	Comment("Convert the user state into an internal state")
-	NOTQ(rpState.Offset(_be))
-	NOTQ(rpState.Offset(_bi))
-	NOTQ(rpState.Offset(_go))
-	NOTQ(rpState.Offset(_ki))
-	NOTQ(rpState.Offset(_mi))
-	NOTQ(rpState.Offset(_sa))
-
-	Comment("Execute the KeccakF permutation")
-	MOVQ(rpState.Offset(_ba), rCa)
-	MOVQ(rpState.Offset(_be), rCe)
-	MOVQ(rpState.Offset(_bu), rCu)
-
-	XORQ(rpState.Offset(_ga), rCa)
-	XORQ(rpState.Offset(_ge), rCe)
-	XORQ(rpState.Offset(_gu), rCu)
-
-	XORQ(rpState.Offset(_ka), rCa)
-	XORQ(rpState.Offset(_ke), rCe)
-	XORQ(rpState.Offset(_ku), rCu)
-
-	XORQ(rpState.Offset(_ma), rCa)
-	XORQ(rpState.Offset(_me), rCe)
-	XORQ(rpState.Offset(_mu), rCu)
-
-	XORQ(rpState.Offset(_sa), rCa)
-	XORQ(rpState.Offset(_se), rCe)
-	MOVQ(rpState.Offset(_si), rDi)
-	MOVQ(rpState.Offset(_so), rDo)
-	XORQ(rpState.Offset(_su), rCu)
-
-	for i, rc := range RoundConstants[:len(RoundConstants)-1] {
-		var iState, oState Mem
-		if i%2 == 0 {
-			iState, oState = rpState, rpStack
-		} else {
-			iState, oState = rpStack, rpState
-		}
-		mKeccakRound(iState, oState, U64(rc), MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
-	}
-	mKeccakRound(rpStack, rpState, U64(RoundConstants[len(RoundConstants)-1]), NOP, NOP, NOP, NOP, NOP, NOP, NOP, NOP, NOP, NOP, NOP, NOP, NOP)
-
-	Comment("Revert the internal state to the user state")
-	NOTQ(rpState.Offset(_be))
-	NOTQ(rpState.Offset(_bi))
-	NOTQ(rpState.Offset(_go))
-	NOTQ(rpState.Offset(_ki))
-	NOTQ(rpState.Offset(_mi))
-	NOTQ(rpState.Offset(_sa))
-
-	RET()
-}

sha3/allocations_test.go

@@ -1,61 +0,0 @@
-// Copyright 2023 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build !noopt
-
-package sha3_test
-
-import (
-	"runtime"
-	"testing"
-
-	"golang.org/x/crypto/sha3"
-)
-
-var sink byte
-
-func TestAllocations(t *testing.T) {
-	want := 0.0
-
-	if runtime.GOARCH == "s390x" {
-		// On s390x the returned hash.Hash is conditional so it escapes.
-		want = 3.0
-	}
-
-	t.Run("New", func(t *testing.T) {
-		if allocs := testing.AllocsPerRun(10, func() {
-			h := sha3.New256()
-			b := []byte("ABC")
-			h.Write(b)
-			out := make([]byte, 0, 32)
-			out = h.Sum(out)
-			sink ^= out[0]
-		}); allocs > want {
-			t.Errorf("expected zero allocations, got %0.1f", allocs)
-		}
-	})
-	t.Run("NewShake", func(t *testing.T) {
-		if allocs := testing.AllocsPerRun(10, func() {
-			h := sha3.NewShake128()
-			b := []byte("ABC")
-			h.Write(b)
-			out := make([]byte, 0, 32)
-			out = h.Sum(out)
-			sink ^= out[0]
-			h.Read(out)
-			sink ^= out[0]
-		}); allocs > want {
-			t.Errorf("expected zero allocations, got %0.1f", allocs)
-		}
-	})
-	t.Run("Sum", func(t *testing.T) {
-		if allocs := testing.AllocsPerRun(10, func() {
-			b := []byte("ABC")
-			out := sha3.Sum256(b)
-			sink ^= out[0]
-		}); allocs > want {
-			t.Errorf("expected zero allocations, got %0.1f", allocs)
-		}
-	})
-}

sha3/doc.go

@@ -1,66 +0,0 @@
-// Copyright 2014 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package sha3 implements the SHA-3 fixed-output-length hash functions and
-// the SHAKE variable-output-length hash functions defined by FIPS-202.
-//
-// All types in this package also implement [encoding.BinaryMarshaler],
-// [encoding.BinaryAppender] and [encoding.BinaryUnmarshaler] to marshal and
-// unmarshal the internal state of the hash.
-//
-// Both types of hash function use the "sponge" construction and the Keccak
-// permutation. For a detailed specification see http://keccak.noekeon.org/
-//
-// # Guidance
-//
-// If you aren't sure what function you need, use SHAKE256 with at least 64
-// bytes of output. The SHAKE instances are faster than the SHA3 instances;
-// the latter have to allocate memory to conform to the hash.Hash interface.
-//
-// If you need a secret-key MAC (message authentication code), prepend the
-// secret key to the input, hash with SHAKE256 and read at least 32 bytes of
-// output.
-//
-// # Security strengths
-//
-// The SHA3-x (x equals 224, 256, 384, or 512) functions have a security
-// strength against preimage attacks of x bits. Since they only produce "x"
-// bits of output, their collision-resistance is only "x/2" bits.
-//
-// The SHAKE-256 and -128 functions have a generic security strength of 256 and
-// 128 bits against all attacks, provided that at least 2x bits of their output
-// is used.  Requesting more than 64 or 32 bytes of output, respectively, does
-// not increase the collision-resistance of the SHAKE functions.
-//
-// # The sponge construction
-//
-// A sponge builds a pseudo-random function from a public pseudo-random
-// permutation, by applying the permutation to a state of "rate + capacity"
-// bytes, but hiding "capacity" of the bytes.
-//
-// A sponge starts out with a zero state. To hash an input using a sponge, up
-// to "rate" bytes of the input are XORed into the sponge's state. The sponge
-// is then "full" and the permutation is applied to "empty" it. This process is
-// repeated until all the input has been "absorbed". The input is then padded.
-// The digest is "squeezed" from the sponge in the same way, except that output
-// is copied out instead of input being XORed in.
-//
-// A sponge is parameterized by its generic security strength, which is equal
-// to half its capacity; capacity + rate is equal to the permutation's width.
-// Since the KeccakF-1600 permutation is 1600 bits (200 bytes) wide, this means
-// that the security strength of a sponge instance is equal to (1600 - bitrate) / 2.
-//
-// # Recommendations
-//
-// The SHAKE functions are recommended for most new uses. They can produce
-// output of arbitrary length. SHAKE256, with an output length of at least
-// 64 bytes, provides 256-bit security against all attacks.  The Keccak team
-// recommends it for most applications upgrading from SHA2-512. (NIST chose a
-// much stronger, but much slower, sponge instance for SHA3-512.)
-//
-// The SHA-3 functions are "drop-in" replacements for the SHA-2 functions.
-// They produce output of the same length, with the same security strengths
-// against all attacks. This means, in particular, that SHA3-256 only has
-// 128-bit collision resistance, because its output length is 32 bytes.
-package sha3

sha3/hashes.go

@@ -2,127 +2,94 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package sha3 implements the SHA-3 hash algorithms and the SHAKE extendable
+// output functions defined in FIPS 202.
+//
+// Most of this package is a wrapper around the crypto/sha3 package in the
+// standard library. The only exception is the legacy Keccak hash functions.
 package sha3
 
-// This file provides functions for creating instances of the SHA-3
-// and SHAKE hash functions, as well as utility functions for hashing
-// bytes.
-
 import (
-	"crypto"
+	"crypto/sha3"
 	"hash"
 )
 
 // New224 creates a new SHA3-224 hash.
 // Its generic security strength is 224 bits against preimage attacks,
 // and 112 bits against collision attacks.
+//
+// It is a wrapper for the [sha3.New224] function in the standard library.
+//
+//go:fix inline
 func New224() hash.Hash {
-	return new224()
+	return sha3.New224()
 }
 
 // New256 creates a new SHA3-256 hash.
 // Its generic security strength is 256 bits against preimage attacks,
 // and 128 bits against collision attacks.
+//
+// It is a wrapper for the [sha3.New256] function in the standard library.
+//
+//go:fix inline
 func New256() hash.Hash {
-	return new256()
+	return sha3.New256()
 }
 
 // New384 creates a new SHA3-384 hash.
 // Its generic security strength is 384 bits against preimage attacks,
 // and 192 bits against collision attacks.
+//
+// It is a wrapper for the [sha3.New384] function in the standard library.
+//
+//go:fix inline
 func New384() hash.Hash {
-	return new384()
+	return sha3.New384()
 }
 
 // New512 creates a new SHA3-512 hash.
 // Its generic security strength is 512 bits against preimage attacks,
 // and 256 bits against collision attacks.
+//
+// It is a wrapper for the [sha3.New512] function in the standard library.
+//
+//go:fix inline
 func New512() hash.Hash {
-	return new512()
-}
-
-func init() {
-	crypto.RegisterHash(crypto.SHA3_224, New224)
-	crypto.RegisterHash(crypto.SHA3_256, New256)
-	crypto.RegisterHash(crypto.SHA3_384, New384)
-	crypto.RegisterHash(crypto.SHA3_512, New512)
-}
-
-const (
-	dsbyteSHA3   = 0b00000110
-	dsbyteKeccak = 0b00000001
-	dsbyteShake  = 0b00011111
-	dsbyteCShake = 0b00000100
-
-	// rateK[c] is the rate in bytes for Keccak[c] where c is the capacity in
-	// bits. Given the sponge size is 1600 bits, the rate is 1600 - c bits.
-	rateK256  = (1600 - 256) / 8
-	rateK448  = (1600 - 448) / 8
-	rateK512  = (1600 - 512) / 8
-	rateK768  = (1600 - 768) / 8
-	rateK1024 = (1600 - 1024) / 8
-)
-
-func new224Generic() *state {
-	return &state{rate: rateK448, outputLen: 28, dsbyte: dsbyteSHA3}
-}
-
-func new256Generic() *state {
-	return &state{rate: rateK512, outputLen: 32, dsbyte: dsbyteSHA3}
-}
-
-func new384Generic() *state {
-	return &state{rate: rateK768, outputLen: 48, dsbyte: dsbyteSHA3}
-}
-
-func new512Generic() *state {
-	return &state{rate: rateK1024, outputLen: 64, dsbyte: dsbyteSHA3}
-}
-
-// NewLegacyKeccak256 creates a new Keccak-256 hash.
-//
-// Only use this function if you require compatibility with an existing cryptosystem
-// that uses non-standard padding. All other users should use New256 instead.
-func NewLegacyKeccak256() hash.Hash {
-	return &state{rate: rateK512, outputLen: 32, dsbyte: dsbyteKeccak}
-}
-
-// NewLegacyKeccak512 creates a new Keccak-512 hash.
-//
-// Only use this function if you require compatibility with an existing cryptosystem
-// that uses non-standard padding. All other users should use New512 instead.
-func NewLegacyKeccak512() hash.Hash {
-	return &state{rate: rateK1024, outputLen: 64, dsbyte: dsbyteKeccak}
+	return sha3.New512()
 }
 
 // Sum224 returns the SHA3-224 digest of the data.
-func Sum224(data []byte) (digest [28]byte) {
-	h := New224()
-	h.Write(data)
-	h.Sum(digest[:0])
-	return
+//
+// It is a wrapper for the [sha3.Sum224] function in the standard library.
+//
+//go:fix inline
+func Sum224(data []byte) [28]byte {
+	return sha3.Sum224(data)
 }
 
 // Sum256 returns the SHA3-256 digest of the data.
-func Sum256(data []byte) (digest [32]byte) {
-	h := New256()
-	h.Write(data)
-	h.Sum(digest[:0])
-	return
+//
+// It is a wrapper for the [sha3.Sum256] function in the standard library.
+//
+//go:fix inline
+func Sum256(data []byte) [32]byte {
+	return sha3.Sum256(data)
 }
 
 // Sum384 returns the SHA3-384 digest of the data.
-func Sum384(data []byte) (digest [48]byte) {
-	h := New384()
-	h.Write(data)
-	h.Sum(digest[:0])
-	return
+//
+// It is a wrapper for the [sha3.Sum384] function in the standard library.
+//
+//go:fix inline
+func Sum384(data []byte) [48]byte {
+	return sha3.Sum384(data)
 }
 
 // Sum512 returns the SHA3-512 digest of the data.
-func Sum512(data []byte) (digest [64]byte) {
-	h := New512()
-	h.Write(data)
-	h.Sum(digest[:0])
-	return
+//
+// It is a wrapper for the [sha3.Sum512] function in the standard library.
+//
+//go:fix inline
+func Sum512(data []byte) [64]byte {
+	return sha3.Sum512(data)
 }

sha3/hashes_noasm.go

@@ -1,23 +0,0 @@
-// Copyright 2023 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build !gc || purego || !s390x
-
-package sha3
-
-func new224() *state {
-	return new224Generic()
-}
-
-func new256() *state {
-	return new256Generic()
-}
-
-func new384() *state {
-	return new384Generic()
-}
-
-func new512() *state {
-	return new512Generic()
-}

sha3/keccakf_amd64.go

@@ -1,13 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build amd64 && !purego && gc
-
-package sha3
-
-// This function is implemented in keccakf_amd64.s.
-
-//go:noescape
-
-func keccakF1600(a *[25]uint64)

sha3/legacy_hash.go

@@ -4,15 +4,46 @@
 
 package sha3
 
+// This implementation is only used for NewLegacyKeccak256 and
+// NewLegacyKeccak512, which are not implemented by crypto/sha3.
+// All other functions in this package are wrappers around crypto/sha3.
+
 import (
 	"crypto/subtle"
 	"encoding/binary"
 	"errors"
+	"hash"
 	"unsafe"
 
 	"golang.org/x/sys/cpu"
 )
 
+const (
+	dsbyteKeccak = 0b00000001
+
+	// rateK[c] is the rate in bytes for Keccak[c] where c is the capacity in
+	// bits. Given the sponge size is 1600 bits, the rate is 1600 - c bits.
+	rateK256  = (1600 - 256) / 8
+	rateK512  = (1600 - 512) / 8
+	rateK1024 = (1600 - 1024) / 8
+)
+
+// NewLegacyKeccak256 creates a new Keccak-256 hash.
+//
+// Only use this function if you require compatibility with an existing cryptosystem
+// that uses non-standard padding. All other users should use New256 instead.
+func NewLegacyKeccak256() hash.Hash {
+	return &state{rate: rateK512, outputLen: 32, dsbyte: dsbyteKeccak}
+}
+
+// NewLegacyKeccak512 creates a new Keccak-512 hash.
+//
+// Only use this function if you require compatibility with an existing cryptosystem
+// that uses non-standard padding. All other users should use New512 instead.
+func NewLegacyKeccak512() hash.Hash {
+	return &state{rate: rateK1024, outputLen: 64, dsbyte: dsbyteKeccak}
+}
+
 // spongeDirection indicates the direction bytes are flowing through the sponge.
 type spongeDirection int
 
@@ -173,12 +204,9 @@ func (d *state) Sum(in []byte) []byte {
 }
 
 const (
-	magicSHA3   = "sha\x08"
-	magicShake  = "sha\x09"
-	magicCShake = "sha\x0a"
 	magicKeccak = "sha\x0b"
 	// magic || rate || main state || n || sponge direction
-	marshaledSize = len(magicSHA3) + 1 + 200 + 1 + 1
+	marshaledSize = len(magicKeccak) + 1 + 200 + 1 + 1
 )
 
 func (d *state) MarshalBinary() ([]byte, error) {
@@ -187,12 +215,6 @@ func (d *state) MarshalBinary() ([]byte, error) {
 
 func (d *state) AppendBinary(b []byte) ([]byte, error) {
 	switch d.dsbyte {
-	case dsbyteSHA3:
-		b = append(b, magicSHA3...)
-	case dsbyteShake:
-		b = append(b, magicShake...)
-	case dsbyteCShake:
-		b = append(b, magicCShake...)
 	case dsbyteKeccak:
 		b = append(b, magicKeccak...)
 	default:
@@ -210,12 +232,9 @@ func (d *state) UnmarshalBinary(b []byte) error {
 		return errors.New("sha3: invalid hash state")
 	}
 
-	magic := string(b[:len(magicSHA3)])
-	b = b[len(magicSHA3):]
+	magic := string(b[:len(magicKeccak)])
+	b = b[len(magicKeccak):]
 	switch {
-	case magic == magicSHA3 && d.dsbyte == dsbyteSHA3:
-	case magic == magicShake && d.dsbyte == dsbyteShake:
-	case magic == magicCShake && d.dsbyte == dsbyteCShake:
 	case magic == magicKeccak && d.dsbyte == dsbyteKeccak:
 	default:
 		return errors.New("sha3: invalid hash state identifier")

sha3/legacy_keccakf.go

@@ -2,10 +2,12 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !amd64 || purego || !gc
-
 package sha3
 
+// This implementation is only used for NewLegacyKeccak256 and
+// NewLegacyKeccak512, which are not implemented by crypto/sha3.
+// All other functions in this package are wrappers around crypto/sha3.
+
 import "math/bits"
 
 // rc stores the round constants for use in the ι step.

sha3/sha3_s390x.go

@@ -1,303 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build gc && !purego
-
-package sha3
-
-// This file contains code for using the 'compute intermediate
-// message digest' (KIMD) and 'compute last message digest' (KLMD)
-// instructions to compute SHA-3 and SHAKE hashes on IBM Z.
-
-import (
-	"hash"
-
-	"golang.org/x/sys/cpu"
-)
-
-// codes represent 7-bit KIMD/KLMD function codes as defined in
-// the Principles of Operation.
-type code uint64
-
-const (
-	// function codes for KIMD/KLMD
-	sha3_224  code = 32
-	sha3_256       = 33
-	sha3_384       = 34
-	sha3_512       = 35
-	shake_128      = 36
-	shake_256      = 37
-	nopad          = 0x100
-)
-
-// kimd is a wrapper for the 'compute intermediate message digest' instruction.
-// src must be a multiple of the rate for the given function code.
-//
-//go:noescape
-func kimd(function code, chain *[200]byte, src []byte)
-
-// klmd is a wrapper for the 'compute last message digest' instruction.
-// src padding is handled by the instruction.
-//
-//go:noescape
-func klmd(function code, chain *[200]byte, dst, src []byte)
-
-type asmState struct {
-	a         [200]byte       // 1600 bit state
-	buf       []byte          // care must be taken to ensure cap(buf) is a multiple of rate
-	rate      int             // equivalent to block size
-	storage   [3072]byte      // underlying storage for buf
-	outputLen int             // output length for full security
-	function  code            // KIMD/KLMD function code
-	state     spongeDirection // whether the sponge is absorbing or squeezing
-}
-
-func newAsmState(function code) *asmState {
-	var s asmState
-	s.function = function
-	switch function {
-	case sha3_224:
-		s.rate = 144
-		s.outputLen = 28
-	case sha3_256:
-		s.rate = 136
-		s.outputLen = 32
-	case sha3_384:
-		s.rate = 104
-		s.outputLen = 48
-	case sha3_512:
-		s.rate = 72
-		s.outputLen = 64
-	case shake_128:
-		s.rate = 168
-		s.outputLen = 32
-	case shake_256:
-		s.rate = 136
-		s.outputLen = 64
-	default:
-		panic("sha3: unrecognized function code")
-	}
-
-	// limit s.buf size to a multiple of s.rate
-	s.resetBuf()
-	return &s
-}
-
-func (s *asmState) clone() *asmState {
-	c := *s
-	c.buf = c.storage[:len(s.buf):cap(s.buf)]
-	return &c
-}
-
-// copyIntoBuf copies b into buf. It will panic if there is not enough space to
-// store all of b.
-func (s *asmState) copyIntoBuf(b []byte) {
-	bufLen := len(s.buf)
-	s.buf = s.buf[:len(s.buf)+len(b)]
-	copy(s.buf[bufLen:], b)
-}
-
-// resetBuf points buf at storage, sets the length to 0 and sets cap to be a
-// multiple of the rate.
-func (s *asmState) resetBuf() {
-	max := (cap(s.storage) / s.rate) * s.rate
-	s.buf = s.storage[:0:max]
-}
-
-// Write (via the embedded io.Writer interface) adds more data to the running hash.
-// It never returns an error.
-func (s *asmState) Write(b []byte) (int, error) {
-	if s.state != spongeAbsorbing {
-		panic("sha3: Write after Read")
-	}
-	length := len(b)
-	for len(b) > 0 {
-		if len(s.buf) == 0 && len(b) >= cap(s.buf) {
-			// Hash the data directly and push any remaining bytes
-			// into the buffer.
-			remainder := len(b) % s.rate
-			kimd(s.function, &s.a, b[:len(b)-remainder])
-			if remainder != 0 {
-				s.copyIntoBuf(b[len(b)-remainder:])
-			}
-			return length, nil
-		}
-
-		if len(s.buf) == cap(s.buf) {
-			// flush the buffer
-			kimd(s.function, &s.a, s.buf)
-			s.buf = s.buf[:0]
-		}
-
-		// copy as much as we can into the buffer
-		n := len(b)
-		if len(b) > cap(s.buf)-len(s.buf) {
-			n = cap(s.buf) - len(s.buf)
-		}
-		s.copyIntoBuf(b[:n])
-		b = b[n:]
-	}
-	return length, nil
-}
-
-// Read squeezes an arbitrary number of bytes from the sponge.
-func (s *asmState) Read(out []byte) (n int, err error) {
-	// The 'compute last message digest' instruction only stores the digest
-	// at the first operand (dst) for SHAKE functions.
-	if s.function != shake_128 && s.function != shake_256 {
-		panic("sha3: can only call Read for SHAKE functions")
-	}
-
-	n = len(out)
-
-	// need to pad if we were absorbing
-	if s.state == spongeAbsorbing {
-		s.state = spongeSqueezing
-
-		// write hash directly into out if possible
-		if len(out)%s.rate == 0 {
-			klmd(s.function, &s.a, out, s.buf) // len(out) may be 0
-			s.buf = s.buf[:0]
-			return
-		}
-
-		// write hash into buffer
-		max := cap(s.buf)
-		if max > len(out) {
-			max = (len(out)/s.rate)*s.rate + s.rate
-		}
-		klmd(s.function, &s.a, s.buf[:max], s.buf)
-		s.buf = s.buf[:max]
-	}
-
-	for len(out) > 0 {
-		// flush the buffer
-		if len(s.buf) != 0 {
-			c := copy(out, s.buf)
-			out = out[c:]
-			s.buf = s.buf[c:]
-			continue
-		}
-
-		// write hash directly into out if possible
-		if len(out)%s.rate == 0 {
-			klmd(s.function|nopad, &s.a, out, nil)
-			return
-		}
-
-		// write hash into buffer
-		s.resetBuf()
-		if cap(s.buf) > len(out) {
-			s.buf = s.buf[:(len(out)/s.rate)*s.rate+s.rate]
-		}
-		klmd(s.function|nopad, &s.a, s.buf, nil)
-	}
-	return
-}
-
-// Sum appends the current hash to b and returns the resulting slice.
-// It does not change the underlying hash state.
-func (s *asmState) Sum(b []byte) []byte {
-	if s.state != spongeAbsorbing {
-		panic("sha3: Sum after Read")
-	}
-
-	// Copy the state to preserve the original.
-	a := s.a
-
-	// Hash the buffer. Note that we don't clear it because we
-	// aren't updating the state.
-	switch s.function {
-	case sha3_224, sha3_256, sha3_384, sha3_512:
-		klmd(s.function, &a, nil, s.buf)
-		return append(b, a[:s.outputLen]...)
-	case shake_128, shake_256:
-		d := make([]byte, s.outputLen, 64)
-		klmd(s.function, &a, d, s.buf)
-		return append(b, d[:s.outputLen]...)
-	default:
-		panic("sha3: unknown function")
-	}
-}
-
-// Reset resets the Hash to its initial state.
-func (s *asmState) Reset() {
-	for i := range s.a {
-		s.a[i] = 0
-	}
-	s.resetBuf()
-	s.state = spongeAbsorbing
-}
-
-// Size returns the number of bytes Sum will return.
-func (s *asmState) Size() int {
-	return s.outputLen
-}
-
-// BlockSize returns the hash's underlying block size.
-// The Write method must be able to accept any amount
-// of data, but it may operate more efficiently if all writes
-// are a multiple of the block size.
-func (s *asmState) BlockSize() int {
-	return s.rate
-}
-
-// Clone returns a copy of the ShakeHash in its current state.
-func (s *asmState) Clone() ShakeHash {
-	return s.clone()
-}
-
-// new224 returns an assembly implementation of SHA3-224 if available,
-// otherwise it returns a generic implementation.
-func new224() hash.Hash {
-	if cpu.S390X.HasSHA3 {
-		return newAsmState(sha3_224)
-	}
-	return new224Generic()
-}
-
-// new256 returns an assembly implementation of SHA3-256 if available,
-// otherwise it returns a generic implementation.
-func new256() hash.Hash {
-	if cpu.S390X.HasSHA3 {
-		return newAsmState(sha3_256)
-	}
-	return new256Generic()
-}
-
-// new384 returns an assembly implementation of SHA3-384 if available,
-// otherwise it returns a generic implementation.
-func new384() hash.Hash {
-	if cpu.S390X.HasSHA3 {
-		return newAsmState(sha3_384)
-	}
-	return new384Generic()
-}
-
-// new512 returns an assembly implementation of SHA3-512 if available,
-// otherwise it returns a generic implementation.
-func new512() hash.Hash {
-	if cpu.S390X.HasSHA3 {
-		return newAsmState(sha3_512)
-	}
-	return new512Generic()
-}
-
-// newShake128 returns an assembly implementation of SHAKE-128 if available,
-// otherwise it returns a generic implementation.
-func newShake128() ShakeHash {
-	if cpu.S390X.HasSHA3 {
-		return newAsmState(shake_128)
-	}
-	return newShake128Generic()
-}
-
-// newShake256 returns an assembly implementation of SHAKE-256 if available,
-// otherwise it returns a generic implementation.
-func newShake256() ShakeHash {
-	if cpu.S390X.HasSHA3 {
-		return newAsmState(shake_256)
-	}
-	return newShake256Generic()
-}

sha3/sha3_s390x.s

@@ -1,33 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build gc && !purego
-
-#include "textflag.h"
-
-// func kimd(function code, chain *[200]byte, src []byte)
-TEXT ·kimd(SB), NOFRAME|NOSPLIT, $0-40
-	MOVD function+0(FP), R0
-	MOVD chain+8(FP), R1
-	LMG  src+16(FP), R2, R3 // R2=base, R3=len
-
-continue:
-	WORD $0xB93E0002 // KIMD --, R2
-	BVS  continue    // continue if interrupted
-	MOVD $0, R0      // reset R0 for pre-go1.8 compilers
-	RET
-
-// func klmd(function code, chain *[200]byte, dst, src []byte)
-TEXT ·klmd(SB), NOFRAME|NOSPLIT, $0-64
-	// TODO: SHAKE support
-	MOVD function+0(FP), R0
-	MOVD chain+8(FP), R1
-	LMG  dst+16(FP), R2, R3 // R2=base, R3=len
-	LMG  src+40(FP), R4, R5 // R4=base, R5=len
-
-continue:
-	WORD $0xB93F0024 // KLMD R2, R4
-	BVS  continue    // continue if interrupted
-	MOVD $0, R0      // reset R0 for pre-go1.8 compilers
-	RET

sha3/sha3_test.go

@@ -16,7 +16,6 @@ import (
 	"encoding"
 	"encoding/hex"
 	"encoding/json"
-	"fmt"
 	"hash"
 	"io"
 	"math/rand"
@@ -523,124 +522,3 @@ func testMarshalUnmarshal(t *testing.T, h hash.Hash) {
 		t.Errorf("got %x, want %x", got, want)
 	}
 }
-
-// BenchmarkPermutationFunction measures the speed of the permutation function
-// with no input data.
-func BenchmarkPermutationFunction(b *testing.B) {
-	b.SetBytes(int64(200))
-	var lanes [25]uint64
-	for i := 0; i < b.N; i++ {
-		keccakF1600(&lanes)
-	}
-}
-
-// benchmarkHash tests the speed to hash num buffers of buflen each.
-func benchmarkHash(b *testing.B, h hash.Hash, size, num int) {
-	b.StopTimer()
-	h.Reset()
-	data := sequentialBytes(size)
-	b.SetBytes(int64(size * num))
-	b.StartTimer()
-
-	var state []byte
-	for i := 0; i < b.N; i++ {
-		for j := 0; j < num; j++ {
-			h.Write(data)
-		}
-		state = h.Sum(state[:0])
-	}
-	b.StopTimer()
-	h.Reset()
-}
-
-// benchmarkShake is specialized to the Shake instances, which don't
-// require a copy on reading output.
-func benchmarkShake(b *testing.B, h ShakeHash, size, num int) {
-	b.StopTimer()
-	h.Reset()
-	data := sequentialBytes(size)
-	d := make([]byte, 32)
-
-	b.SetBytes(int64(size * num))
-	b.StartTimer()
-
-	for i := 0; i < b.N; i++ {
-		h.Reset()
-		for j := 0; j < num; j++ {
-			h.Write(data)
-		}
-		h.Read(d)
-	}
-}
-
-func BenchmarkSha3_512_MTU(b *testing.B) { benchmarkHash(b, New512(), 1350, 1) }
-func BenchmarkSha3_384_MTU(b *testing.B) { benchmarkHash(b, New384(), 1350, 1) }
-func BenchmarkSha3_256_MTU(b *testing.B) { benchmarkHash(b, New256(), 1350, 1) }
-func BenchmarkSha3_224_MTU(b *testing.B) { benchmarkHash(b, New224(), 1350, 1) }
-
-func BenchmarkShake128_MTU(b *testing.B)  { benchmarkShake(b, NewShake128(), 1350, 1) }
-func BenchmarkShake256_MTU(b *testing.B)  { benchmarkShake(b, NewShake256(), 1350, 1) }
-func BenchmarkShake256_16x(b *testing.B)  { benchmarkShake(b, NewShake256(), 16, 1024) }
-func BenchmarkShake256_1MiB(b *testing.B) { benchmarkShake(b, NewShake256(), 1024, 1024) }
-
-func BenchmarkSha3_512_1MiB(b *testing.B) { benchmarkHash(b, New512(), 1024, 1024) }
-
-func Example_sum() {
-	buf := []byte("some data to hash")
-	// A hash needs to be 64 bytes long to have 256-bit collision resistance.
-	h := make([]byte, 64)
-	// Compute a 64-byte hash of buf and put it in h.
-	ShakeSum256(h, buf)
-	fmt.Printf("%x\n", h)
-	// Output: 0f65fe41fc353e52c55667bb9e2b27bfcc8476f2c413e9437d272ee3194a4e3146d05ec04a25d16b8f577c19b82d16b1424c3e022e783d2b4da98de3658d363d
-}
-
-func Example_mac() {
-	k := []byte("this is a secret key; you should generate a strong random key that's at least 32 bytes long")
-	buf := []byte("and this is some data to authenticate")
-	// A MAC with 32 bytes of output has 256-bit security strength -- if you use at least a 32-byte-long key.
-	h := make([]byte, 32)
-	d := NewShake256()
-	// Write the key into the hash.
-	d.Write(k)
-	// Now write the data.
-	d.Write(buf)
-	// Read 32 bytes of output from the hash into h.
-	d.Read(h)
-	fmt.Printf("%x\n", h)
-	// Output: 78de2974bd2711d5549ffd32b753ef0f5fa80a0db2556db60f0987eb8a9218ff
-}
-
-func ExampleNewCShake256() {
-	out := make([]byte, 32)
-	msg := []byte("The quick brown fox jumps over the lazy dog")
-
-	// Example 1: Simple cshake
-	c1 := NewCShake256([]byte("NAME"), []byte("Partition1"))
-	c1.Write(msg)
-	c1.Read(out)
-	fmt.Println(hex.EncodeToString(out))
-
-	// Example 2: Different customization string produces different digest
-	c1 = NewCShake256([]byte("NAME"), []byte("Partition2"))
-	c1.Write(msg)
-	c1.Read(out)
-	fmt.Println(hex.EncodeToString(out))
-
-	// Example 3: Longer output length produces longer digest
-	out = make([]byte, 64)
-	c1 = NewCShake256([]byte("NAME"), []byte("Partition1"))
-	c1.Write(msg)
-	c1.Read(out)
-	fmt.Println(hex.EncodeToString(out))
-
-	// Example 4: Next read produces different result
-	c1.Read(out)
-	fmt.Println(hex.EncodeToString(out))
-
-	// Output:
-	//a90a4c6ca9af2156eba43dc8398279e6b60dcd56fb21837afe6c308fd4ceb05b
-	//a8db03e71f3e4da5c4eee9d28333cdd355f51cef3c567e59be5beb4ecdbb28f0
-	//a90a4c6ca9af2156eba43dc8398279e6b60dcd56fb21837afe6c308fd4ceb05b9dd98c6ee866ca7dc5a39d53e960f400bcd5a19c8a2d6ec6459f63696543a0d8
-	//85e73a72228d08b46515553ca3a29d47df3047e5d84b12d6c2c63e579f4fd1105716b7838e92e981863907f434bfd4443c9e56ea09da998d2f9b47db71988109
-}

sha3/shake.go

@@ -4,24 +4,10 @@
 
 package sha3
 
-// This file defines the ShakeHash interface, and provides
-// functions for creating SHAKE and cSHAKE instances, as well as utility
-// functions for hashing bytes to arbitrary-length output.
-//
-//
-// SHAKE implementation is based on FIPS PUB 202 [1]
-// cSHAKE implementations is based on NIST SP 800-185 [2]
-//
-// [1] https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
-// [2] https://doi.org/10.6028/NIST.SP.800-185
-
 import (
-	"bytes"
-	"encoding/binary"
-	"errors"
+	"crypto/sha3"
 	"hash"
 	"io"
-	"math/bits"
 )
 
 // ShakeHash defines the interface to hash functions that support
@@ -32,7 +18,7 @@ type ShakeHash interface {
 	hash.Hash
 
 	// Read reads more output from the hash; reading affects the hash's
-	// state. (ShakeHash.Read is thus very different from Hash.Sum)
+	// state. (ShakeHash.Read is thus very different from Hash.Sum.)
 	// It never returns an error, but subsequent calls to Write or Sum
 	// will panic.
 	io.Reader
@@ -41,115 +27,18 @@ type ShakeHash interface {
 	Clone() ShakeHash
 }
 
-// cSHAKE specific context
-type cshakeState struct {
-	*state // SHA-3 state context and Read/Write operations
-
-	// initBlock is the cSHAKE specific initialization set of bytes. It is initialized
-	// by newCShake function and stores concatenation of N followed by S, encoded
-	// by the method specified in 3.3 of [1].
-	// It is stored here in order for Reset() to be able to put context into
-	// initial state.
-	initBlock []byte
-}
-
-func bytepad(data []byte, rate int) []byte {
-	out := make([]byte, 0, 9+len(data)+rate-1)
-	out = append(out, leftEncode(uint64(rate))...)
-	out = append(out, data...)
-	if padlen := rate - len(out)%rate; padlen < rate {
-		out = append(out, make([]byte, padlen)...)
-	}
-	return out
-}
-
-func leftEncode(x uint64) []byte {
-	// Let n be the smallest positive integer for which 2^(8n) > x.
-	n := (bits.Len64(x) + 7) / 8
-	if n == 0 {
-		n = 1
-	}
-	// Return n || x with n as a byte and x an n bytes in big-endian order.
-	b := make([]byte, 9)
-	binary.BigEndian.PutUint64(b[1:], x)
-	b = b[9-n-1:]
-	b[0] = byte(n)
-	return b
-}
-
-func newCShake(N, S []byte, rate, outputLen int, dsbyte byte) ShakeHash {
-	c := cshakeState{state: &state{rate: rate, outputLen: outputLen, dsbyte: dsbyte}}
-	c.initBlock = make([]byte, 0, 9+len(N)+9+len(S)) // leftEncode returns max 9 bytes
-	c.initBlock = append(c.initBlock, leftEncode(uint64(len(N))*8)...)
-	c.initBlock = append(c.initBlock, N...)
-	c.initBlock = append(c.initBlock, leftEncode(uint64(len(S))*8)...)
-	c.initBlock = append(c.initBlock, S...)
-	c.Write(bytepad(c.initBlock, c.rate))
-	return &c
-}
-
-// Reset resets the hash to initial state.
-func (c *cshakeState) Reset() {
-	c.state.Reset()
-	c.Write(bytepad(c.initBlock, c.rate))
-}
-
-// Clone returns copy of a cSHAKE context within its current state.
-func (c *cshakeState) Clone() ShakeHash {
-	b := make([]byte, len(c.initBlock))
-	copy(b, c.initBlock)
-	return &cshakeState{state: c.clone(), initBlock: b}
-}
-
-// Clone returns copy of SHAKE context within its current state.
-func (c *state) Clone() ShakeHash {
-	return c.clone()
-}
-
-func (c *cshakeState) MarshalBinary() ([]byte, error) {
-	return c.AppendBinary(make([]byte, 0, marshaledSize+len(c.initBlock)))
-}
-
-func (c *cshakeState) AppendBinary(b []byte) ([]byte, error) {
-	b, err := c.state.AppendBinary(b)
-	if err != nil {
-		return nil, err
-	}
-	b = append(b, c.initBlock...)
-	return b, nil
-}
-
-func (c *cshakeState) UnmarshalBinary(b []byte) error {
-	if len(b) <= marshaledSize {
-		return errors.New("sha3: invalid hash state")
-	}
-	if err := c.state.UnmarshalBinary(b[:marshaledSize]); err != nil {
-		return err
-	}
-	c.initBlock = bytes.Clone(b[marshaledSize:])
-	return nil
-}
-
 // NewShake128 creates a new SHAKE128 variable-output-length ShakeHash.
 // Its generic security strength is 128 bits against all attacks if at
 // least 32 bytes of its output are used.
 func NewShake128() ShakeHash {
-	return newShake128()
+	return &shakeWrapper{sha3.NewSHAKE128(), 32, false, sha3.NewSHAKE128}
 }
 
 // NewShake256 creates a new SHAKE256 variable-output-length ShakeHash.
 // Its generic security strength is 256 bits against all attacks if
 // at least 64 bytes of its output are used.
 func NewShake256() ShakeHash {
-	return newShake256()
-}
-
-func newShake128Generic() *state {
-	return &state{rate: rateK256, outputLen: 32, dsbyte: dsbyteShake}
-}
-
-func newShake256Generic() *state {
-	return &state{rate: rateK512, outputLen: 64, dsbyte: dsbyteShake}
+	return &shakeWrapper{sha3.NewSHAKE256(), 64, false, sha3.NewSHAKE256}
 }
 
 // NewCShake128 creates a new instance of cSHAKE128 variable-output-length ShakeHash,
@@ -159,10 +48,9 @@ func newShake256Generic() *state {
 // computations on same input with different S yield unrelated outputs.
 // When N and S are both empty, this is equivalent to NewShake128.
 func NewCShake128(N, S []byte) ShakeHash {
-	if len(N) == 0 && len(S) == 0 {
-		return NewShake128()
-	}
-	return newCShake(N, S, rateK256, 32, dsbyteCShake)
+	return &shakeWrapper{sha3.NewCSHAKE128(N, S), 32, false, func() *sha3.SHAKE {
+		return sha3.NewCSHAKE128(N, S)
+	}}
 }
 
 // NewCShake256 creates a new instance of cSHAKE256 variable-output-length ShakeHash,
@@ -172,10 +60,9 @@ func NewCShake128(N, S []byte) ShakeHash {
 // computations on same input with different S yield unrelated outputs.
 // When N and S are both empty, this is equivalent to NewShake256.
 func NewCShake256(N, S []byte) ShakeHash {
-	if len(N) == 0 && len(S) == 0 {
-		return NewShake256()
-	}
-	return newCShake(N, S, rateK512, 64, dsbyteCShake)
+	return &shakeWrapper{sha3.NewCSHAKE256(N, S), 64, false, func() *sha3.SHAKE {
+		return sha3.NewCSHAKE256(N, S)
+	}}
 }
 
 // ShakeSum128 writes an arbitrary-length digest of data into hash.
@@ -191,3 +78,42 @@ func ShakeSum256(hash, data []byte) {
 	h.Write(data)
 	h.Read(hash)
 }
+
+// shakeWrapper adds the Size, Sum, and Clone methods to a sha3.SHAKE
+// to implement the ShakeHash interface.
+type shakeWrapper struct {
+	*sha3.SHAKE
+	outputLen int
+	squeezing bool
+	newSHAKE  func() *sha3.SHAKE
+}
+
+func (w *shakeWrapper) Read(p []byte) (n int, err error) {
+	w.squeezing = true
+	return w.SHAKE.Read(p)
+}
+
+func (w *shakeWrapper) Clone() ShakeHash {
+	s := w.newSHAKE()
+	b, err := w.MarshalBinary()
+	if err != nil {
+		panic(err) // unreachable
+	}
+	if err := s.UnmarshalBinary(b); err != nil {
+		panic(err) // unreachable
+	}
+	return &shakeWrapper{s, w.outputLen, w.squeezing, w.newSHAKE}
+}
+
+func (w *shakeWrapper) Size() int { return w.outputLen }
+
+func (w *shakeWrapper) Sum(b []byte) []byte {
+	if w.squeezing {
+		panic("sha3: Sum after Read")
+	}
+	out := make([]byte, w.outputLen)
+	// Clone the state so that we don't affect future Write calls.
+	s := w.Clone()
+	s.Read(out)
+	return append(b, out...)
+}

sha3/shake_noasm.go

@@ -1,15 +0,0 @@
-// Copyright 2023 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build !gc || purego || !s390x
-
-package sha3
-
-func newShake128() *state {
-	return newShake128Generic()
-}
-
-func newShake256() *state {
-	return newShake256Generic()
-}

ssh/agent/client.go

@@ -430,8 +430,9 @@ func (c *client) List() ([]*Key, error) {
 		return keys, nil
 	case *failureAgentMsg:
 		return nil, errors.New("agent: failed to list keys")
+	default:
+		return nil, fmt.Errorf("agent: failed to list keys, unexpected message type %T", msg)
 	}
-	panic("unreachable")
 }
 
 // Sign has the agent sign the data using a protocol 2 key as defined
@@ -462,8 +463,9 @@ func (c *client) SignWithFlags(key ssh.PublicKey, data []byte, flags SignatureFl
 		return &sig, nil
 	case *failureAgentMsg:
 		return nil, errors.New("agent: failed to sign challenge")
+	default:
+		return nil, fmt.Errorf("agent: failed to sign challenge, unexpected message type %T", msg)
 	}
-	panic("unreachable")
 }
 
 // unmarshal parses an agent message in packet, returning the parsed
@@ -555,7 +557,7 @@ func (c *client) insertKey(s interface{}, comment string, constraints []byte) er
 		})
 	case *dsa.PrivateKey:
 		req = ssh.Marshal(dsaKeyMsg{
-			Type:        ssh.KeyAlgoDSA,
+			Type:        ssh.InsecureKeyAlgoDSA,
 			P:           k.P,
 			Q:           k.Q,
 			G:           k.G,
@@ -803,16 +805,16 @@ var _ ssh.AlgorithmSigner = &agentKeyringSigner{}
 //
 // This map must be kept in sync with the one in certs.go.
 var certKeyAlgoNames = map[string]string{
-	ssh.CertAlgoRSAv01:        ssh.KeyAlgoRSA,
-	ssh.CertAlgoRSASHA256v01:  ssh.KeyAlgoRSASHA256,
-	ssh.CertAlgoRSASHA512v01:  ssh.KeyAlgoRSASHA512,
-	ssh.CertAlgoDSAv01:        ssh.KeyAlgoDSA,
-	ssh.CertAlgoECDSA256v01:   ssh.KeyAlgoECDSA256,
-	ssh.CertAlgoECDSA384v01:   ssh.KeyAlgoECDSA384,
-	ssh.CertAlgoECDSA521v01:   ssh.KeyAlgoECDSA521,
-	ssh.CertAlgoSKECDSA256v01: ssh.KeyAlgoSKECDSA256,
-	ssh.CertAlgoED25519v01:    ssh.KeyAlgoED25519,
-	ssh.CertAlgoSKED25519v01:  ssh.KeyAlgoSKED25519,
+	ssh.CertAlgoRSAv01:         ssh.KeyAlgoRSA,
+	ssh.CertAlgoRSASHA256v01:   ssh.KeyAlgoRSASHA256,
+	ssh.CertAlgoRSASHA512v01:   ssh.KeyAlgoRSASHA512,
+	ssh.InsecureCertAlgoDSAv01: ssh.InsecureKeyAlgoDSA,
+	ssh.CertAlgoECDSA256v01:    ssh.KeyAlgoECDSA256,
+	ssh.CertAlgoECDSA384v01:    ssh.KeyAlgoECDSA384,
+	ssh.CertAlgoECDSA521v01:    ssh.KeyAlgoECDSA521,
+	ssh.CertAlgoSKECDSA256v01:  ssh.KeyAlgoSKECDSA256,
+	ssh.CertAlgoED25519v01:     ssh.KeyAlgoED25519,
+	ssh.CertAlgoSKED25519v01:   ssh.KeyAlgoSKED25519,
 }
 
 // underlyingAlgo returns the signature algorithm associated with algo (which is

ssh/agent/client_test.go

@@ -7,6 +7,7 @@ package agent
 import (
 	"bytes"
 	"crypto/rand"
+	"encoding/binary"
 	"errors"
 	"io"
 	"net"
@@ -347,6 +348,53 @@ func TestServerResponseTooLarge(t *testing.T) {
 	}
 }
 
+func TestInvalidResponses(t *testing.T) {
+	a, b, err := netPipe()
+	if err != nil {
+		t.Fatalf("netPipe: %v", err)
+	}
+	done := make(chan struct{})
+	defer func() { <-done }()
+
+	defer a.Close()
+	defer b.Close()
+
+	agent := NewClient(a)
+	go func() {
+		defer close(done)
+
+		resp := []byte{agentSuccess}
+		msg := make([]byte, 4+len(resp))
+		binary.BigEndian.PutUint32(msg[:4], uint32(len(resp)))
+		copy(msg[4:], resp)
+
+		if _, err := b.Write(msg); err != nil {
+			t.Errorf("unexpected error sending agent reply: %v", err)
+			b.Close()
+			return
+		}
+
+		if _, err := b.Write(msg); err != nil {
+			t.Errorf("unexpected error sending agent reply: %v", err)
+			b.Close()
+		}
+	}()
+	_, err = agent.List()
+	if err == nil {
+		t.Fatal("error expected")
+	}
+	if !strings.Contains(err.Error(), "failed to list keys, unexpected message type") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	_, err = agent.Sign(testPublicKeys["rsa"], []byte("message"))
+	if err == nil {
+		t.Fatal("error expected")
+	}
+	if !strings.Contains(err.Error(), "failed to sign challenge, unexpected message type") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
 func TestAuth(t *testing.T) {
 	agent, _, cleanup := startOpenSSHAgent(t)
 	defer cleanup()

ssh/agent/keyring.go

@@ -112,7 +112,7 @@ func (r *keyring) Unlock(passphrase []byte) error {
 }
 
 // expireKeysLocked removes expired keys from the keyring. If a key was added
-// with a lifetimesecs contraint and seconds >= lifetimesecs seconds have
+// with a lifetimesecs constraint and seconds >= lifetimesecs seconds have
 // elapsed, it is removed. The caller *must* be holding the keyring mutex.
 func (r *keyring) expireKeysLocked() {
 	for _, k := range r.keys {

ssh/agent/keyring_test.go

@@ -30,7 +30,7 @@ func validateListedKeys(t *testing.T, a Agent, expectedKeys []string) {
 		return
 	}
 	if len(listedKeys) != len(expectedKeys) {
-		t.Fatalf("expeted %d key, got %d", len(expectedKeys), len(listedKeys))
+		t.Fatalf("expected %d key, got %d", len(expectedKeys), len(listedKeys))
 		return
 	}
 	actualKeys := make(map[string]bool)

ssh/agent/server.go

@@ -506,7 +506,7 @@ func (s *server) insertIdentity(req []byte) error {
 	switch record.Type {
 	case ssh.KeyAlgoRSA:
 		addedKey, err = parseRSAKey(req)
-	case ssh.KeyAlgoDSA:
+	case ssh.InsecureKeyAlgoDSA:
 		addedKey, err = parseDSAKey(req)
 	case ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521:
 		addedKey, err = parseECDSAKey(req)
@@ -514,7 +514,7 @@ func (s *server) insertIdentity(req []byte) error {
 		addedKey, err = parseEd25519Key(req)
 	case ssh.CertAlgoRSAv01:
 		addedKey, err = parseRSACert(req)
-	case ssh.CertAlgoDSAv01:
+	case ssh.InsecureCertAlgoDSAv01:
 		addedKey, err = parseDSACert(req)
 	case ssh.CertAlgoECDSA256v01, ssh.CertAlgoECDSA384v01, ssh.CertAlgoECDSA521v01:
 		addedKey, err = parseECDSACert(req)

ssh/certs.go

@@ -20,14 +20,19 @@ import (
 // returned by MultiAlgorithmSigner and don't appear in the Signature.Format
 // field.
 const (
-	CertAlgoRSAv01        = "ssh-rsa-cert-v01@openssh.com"
-	CertAlgoDSAv01        = "ssh-dss-cert-v01@openssh.com"
-	CertAlgoECDSA256v01   = "ecdsa-sha2-nistp256-cert-v01@openssh.com"
-	CertAlgoECDSA384v01   = "ecdsa-sha2-nistp384-cert-v01@openssh.com"
-	CertAlgoECDSA521v01   = "ecdsa-sha2-nistp521-cert-v01@openssh.com"
-	CertAlgoSKECDSA256v01 = "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com"
-	CertAlgoED25519v01    = "ssh-ed25519-cert-v01@openssh.com"
-	CertAlgoSKED25519v01  = "sk-ssh-ed25519-cert-v01@openssh.com"
+	CertAlgoRSAv01 = "ssh-rsa-cert-v01@openssh.com"
+	// Deprecated: DSA is only supported at insecure key sizes, and was removed
+	// from major implementations.
+	CertAlgoDSAv01 = InsecureCertAlgoDSAv01
+	// Deprecated: DSA is only supported at insecure key sizes, and was removed
+	// from major implementations.
+	InsecureCertAlgoDSAv01 = "ssh-dss-cert-v01@openssh.com"
+	CertAlgoECDSA256v01    = "ecdsa-sha2-nistp256-cert-v01@openssh.com"
+	CertAlgoECDSA384v01    = "ecdsa-sha2-nistp384-cert-v01@openssh.com"
+	CertAlgoECDSA521v01    = "ecdsa-sha2-nistp521-cert-v01@openssh.com"
+	CertAlgoSKECDSA256v01  = "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com"
+	CertAlgoED25519v01     = "ssh-ed25519-cert-v01@openssh.com"
+	CertAlgoSKED25519v01   = "sk-ssh-ed25519-cert-v01@openssh.com"
 
 	// CertAlgoRSASHA256v01 and CertAlgoRSASHA512v01 can't appear as a
 	// Certificate.Type (or PublicKey.Type), but only in
@@ -228,7 +233,11 @@ func parseCert(in []byte, privAlgo string) (*Certificate, error) {
 	if err != nil {
 		return nil, err
 	}
-
+	// The Type() function is intended to return only certificate key types, but
+	// we use certKeyAlgoNames anyway for safety, to match [Certificate.Type].
+	if _, ok := certKeyAlgoNames[k.Type()]; ok {
+		return nil, fmt.Errorf("ssh: the signature key type %q is invalid for certificates", k.Type())
+	}
 	c.SignatureKey = k
 	c.Signature, rest, ok = parseSignatureBody(g.Signature)
 	if !ok || len(rest) > 0 {
@@ -296,16 +305,13 @@ type CertChecker struct {
 	SupportedCriticalOptions []string
 
 	// IsUserAuthority should return true if the key is recognized as an
-	// authority for the given user certificate. This allows for
-	// certificates to be signed by other certificates. This must be set
-	// if this CertChecker will be checking user certificates.
+	// authority for user certificate. This must be set if this CertChecker
+	// will be checking user certificates.
 	IsUserAuthority func(auth PublicKey) bool
 
 	// IsHostAuthority should report whether the key is recognized as
-	// an authority for this host. This allows for certificates to be
-	// signed by other keys, and for those other keys to only be valid
-	// signers for particular hostnames. This must be set if this
-	// CertChecker will be checking host certificates.
+	// an authority for this host. This must be set if this CertChecker
+	// will be checking host certificates.
 	IsHostAuthority func(auth PublicKey, address string) bool
 
 	// Clock is used for verifying time stamps. If nil, time.Now
@@ -442,12 +448,19 @@ func (c *CertChecker) CheckCert(principal string, cert *Certificate) error {
 // SignCert signs the certificate with an authority, setting the Nonce,
 // SignatureKey, and Signature fields. If the authority implements the
 // MultiAlgorithmSigner interface the first algorithm in the list is used. This
-// is useful if you want to sign with a specific algorithm.
+// is useful if you want to sign with a specific algorithm. As specified in
+// [SSH-CERTS], Section 2.1.1, authority can't be a [Certificate].
 func (c *Certificate) SignCert(rand io.Reader, authority Signer) error {
 	c.Nonce = make([]byte, 32)
 	if _, err := io.ReadFull(rand, c.Nonce); err != nil {
 		return err
 	}
+	// The Type() function is intended to return only certificate key types, but
+	// we use certKeyAlgoNames anyway for safety, to match [Certificate.Type].
+	if _, ok := certKeyAlgoNames[authority.PublicKey().Type()]; ok {
+		return fmt.Errorf("ssh: certificates cannot be used as authority (public key type %q)",
+			authority.PublicKey().Type())
+	}
 	c.SignatureKey = authority.PublicKey()
 
 	if v, ok := authority.(MultiAlgorithmSigner); ok {
@@ -485,16 +498,16 @@ func (c *Certificate) SignCert(rand io.Reader, authority Signer) error {
 //
 // This map must be kept in sync with the one in agent/client.go.
 var certKeyAlgoNames = map[string]string{
-	CertAlgoRSAv01:        KeyAlgoRSA,
-	CertAlgoRSASHA256v01:  KeyAlgoRSASHA256,
-	CertAlgoRSASHA512v01:  KeyAlgoRSASHA512,
-	CertAlgoDSAv01:        KeyAlgoDSA,
-	CertAlgoECDSA256v01:   KeyAlgoECDSA256,
-	CertAlgoECDSA384v01:   KeyAlgoECDSA384,
-	CertAlgoECDSA521v01:   KeyAlgoECDSA521,
-	CertAlgoSKECDSA256v01: KeyAlgoSKECDSA256,
-	CertAlgoED25519v01:    KeyAlgoED25519,
-	CertAlgoSKED25519v01:  KeyAlgoSKED25519,
+	CertAlgoRSAv01:         KeyAlgoRSA,
+	CertAlgoRSASHA256v01:   KeyAlgoRSASHA256,
+	CertAlgoRSASHA512v01:   KeyAlgoRSASHA512,
+	InsecureCertAlgoDSAv01: InsecureKeyAlgoDSA,
+	CertAlgoECDSA256v01:    KeyAlgoECDSA256,
+	CertAlgoECDSA384v01:    KeyAlgoECDSA384,
+	CertAlgoECDSA521v01:    KeyAlgoECDSA521,
+	CertAlgoSKECDSA256v01:  KeyAlgoSKECDSA256,
+	CertAlgoED25519v01:     KeyAlgoED25519,
+	CertAlgoSKED25519v01:   KeyAlgoSKED25519,
 }
 
 // underlyingAlgo returns the signature algorithm associated with algo (which is

ssh/certs_test.go

@@ -297,7 +297,7 @@ func TestCertTypes(t *testing.T) {
 		{"legacyRSASigner", &legacyRSASigner{testSigners["rsa"]}, KeyAlgoRSA},
 		{"multiAlgoRSASignerSHA256", multiAlgoSignerSHA256, KeyAlgoRSASHA256},
 		{"multiAlgoRSASignerSHA512", multiAlgoSignerSHA512, KeyAlgoRSASHA512},
-		{CertAlgoDSAv01, testSigners["dsa"], ""},
+		{InsecureCertAlgoDSAv01, testSigners["dsa"], ""},
 	}
 
 	k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
@@ -338,7 +338,9 @@ func TestCertTypes(t *testing.T) {
 				CertType: UserCert,
 				Key:      priv.PublicKey(),
 			}
-			cert.SignCert(rand.Reader, priv)
+			if err := cert.SignCert(rand.Reader, priv); err != nil {
+				t.Fatalf("error signing certificate: %v", err)
+			}
 
 			certSigner, err := NewCertSigner(cert, priv)
 			if err != nil {
@@ -404,3 +406,32 @@ func TestCertSignWithMultiAlgorithmSigner(t *testing.T) {
 		})
 	}
 }
+
+func TestCertSignWithCertificate(t *testing.T) {
+	cert := &Certificate{
+		Key:         testPublicKeys["rsa"],
+		ValidBefore: CertTimeInfinity,
+		CertType:    UserCert,
+	}
+	if err := cert.SignCert(rand.Reader, testSigners["ecdsa"]); err != nil {
+		t.Fatalf("SignCert: %v", err)
+	}
+	signer, err := NewSignerWithAlgorithms(testSigners["rsa"].(AlgorithmSigner), []string{KeyAlgoRSASHA256})
+	if err != nil {
+		t.Fatal(err)
+	}
+	certSigner, err := NewCertSigner(cert, signer)
+	if err != nil {
+		t.Fatalf("NewCertSigner: %v", err)
+	}
+
+	cert1 := &Certificate{
+		Key:         testPublicKeys["ecdsa"],
+		ValidBefore: CertTimeInfinity,
+		CertType:    UserCert,
+	}
+
+	if err := cert1.SignCert(rand.Reader, certSigner); err == nil {
+		t.Fatal("successfully signed a certificate using another certificate, it is expected to fail")
+	}
+}

ssh/cipher.go

@@ -8,6 +8,7 @@ import (
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/des"
+	"crypto/fips140"
 	"crypto/rc4"
 	"crypto/subtle"
 	"encoding/binary"
@@ -15,6 +16,7 @@ import (
 	"fmt"
 	"hash"
 	"io"
+	"slices"
 
 	"golang.org/x/crypto/chacha20"
 	"golang.org/x/crypto/internal/poly1305"
@@ -58,11 +60,11 @@ func newRC4(key, iv []byte) (cipher.Stream, error) {
 type cipherMode struct {
 	keySize int
 	ivSize  int
-	create  func(key, iv []byte, macKey []byte, algs directionAlgorithms) (packetCipher, error)
+	create  func(key, iv []byte, macKey []byte, algs DirectionAlgorithms) (packetCipher, error)
 }
 
-func streamCipherMode(skip int, createFunc func(key, iv []byte) (cipher.Stream, error)) func(key, iv []byte, macKey []byte, algs directionAlgorithms) (packetCipher, error) {
-	return func(key, iv, macKey []byte, algs directionAlgorithms) (packetCipher, error) {
+func streamCipherMode(skip int, createFunc func(key, iv []byte) (cipher.Stream, error)) func(key, iv []byte, macKey []byte, algs DirectionAlgorithms) (packetCipher, error) {
+	return func(key, iv, macKey []byte, algs DirectionAlgorithms) (packetCipher, error) {
 		stream, err := createFunc(key, iv)
 		if err != nil {
 			return nil, err
@@ -93,41 +95,41 @@ func streamCipherMode(skip int, createFunc func(key, iv []byte) (cipher.Stream,
 }
 
 // cipherModes documents properties of supported ciphers. Ciphers not included
-// are not supported and will not be negotiated, even if explicitly requested in
-// ClientConfig.Crypto.Ciphers.
-var cipherModes = map[string]*cipherMode{
-	// Ciphers from RFC 4344, which introduced many CTR-based ciphers. Algorithms
-	// are defined in the order specified in the RFC.
-	"aes128-ctr": {16, aes.BlockSize, streamCipherMode(0, newAESCTR)},
-	"aes192-ctr": {24, aes.BlockSize, streamCipherMode(0, newAESCTR)},
-	"aes256-ctr": {32, aes.BlockSize, streamCipherMode(0, newAESCTR)},
+// are not supported and will not be negotiated, even if explicitly configured.
+// When FIPS mode is enabled, only FIPS-approved algorithms are included.
+var cipherModes = map[string]*cipherMode{}
 
-	// Ciphers from RFC 4345, which introduces security-improved arcfour ciphers.
-	// They are defined in the order specified in the RFC.
-	"arcfour128": {16, 0, streamCipherMode(1536, newRC4)},
-	"arcfour256": {32, 0, streamCipherMode(1536, newRC4)},
+func init() {
+	cipherModes[CipherAES128CTR] = &cipherMode{16, aes.BlockSize, streamCipherMode(0, newAESCTR)}
+	cipherModes[CipherAES192CTR] = &cipherMode{24, aes.BlockSize, streamCipherMode(0, newAESCTR)}
+	cipherModes[CipherAES256CTR] = &cipherMode{32, aes.BlockSize, streamCipherMode(0, newAESCTR)}
+	//  Use of GCM with arbitrary IVs is not allowed in FIPS 140-only mode,
+	// we'll wire it up to NewGCMForSSH in Go 1.26.
+	//
+	// For now it means we'll work with fips140=on but not fips140=only.
+	cipherModes[CipherAES128GCM] = &cipherMode{16, 12, newGCMCipher}
+	cipherModes[CipherAES256GCM] = &cipherMode{32, 12, newGCMCipher}
 
-	// Cipher defined in RFC 4253, which describes SSH Transport Layer Protocol.
-	// Note that this cipher is not safe, as stated in RFC 4253: "Arcfour (and
-	// RC4) has problems with weak keys, and should be used with caution."
-	// RFC 4345 introduces improved versions of Arcfour.
-	"arcfour": {16, 0, streamCipherMode(0, newRC4)},
-
-	// AEAD ciphers
-	gcm128CipherID:     {16, 12, newGCMCipher},
-	gcm256CipherID:     {32, 12, newGCMCipher},
-	chacha20Poly1305ID: {64, 0, newChaCha20Cipher},
+	if fips140.Enabled() {
+		defaultCiphers = slices.DeleteFunc(defaultCiphers, func(algo string) bool {
+			_, ok := cipherModes[algo]
+			return !ok
+		})
+		return
+	}
 
+	cipherModes[CipherChaCha20Poly1305] = &cipherMode{64, 0, newChaCha20Cipher}
+	// Insecure ciphers not included in the default configuration.
+	cipherModes[InsecureCipherRC4128] = &cipherMode{16, 0, streamCipherMode(1536, newRC4)}
+	cipherModes[InsecureCipherRC4256] = &cipherMode{32, 0, streamCipherMode(1536, newRC4)}
+	cipherModes[InsecureCipherRC4] = &cipherMode{16, 0, streamCipherMode(0, newRC4)}
 	// CBC mode is insecure and so is not included in the default config.
 	// (See https://www.ieee-security.org/TC/SP2013/papers/4977a526.pdf). If absolutely
 	// needed, it's possible to specify a custom Config to enable it.
 	// You should expect that an active attacker can recover plaintext if
 	// you do.
-	aes128cbcID: {16, aes.BlockSize, newAESCBCCipher},
-
-	// 3des-cbc is insecure and is not included in the default
-	// config.
-	tripledescbcID: {24, des.BlockSize, newTripleDESCBCCipher},
+	cipherModes[InsecureCipherAES128CBC] = &cipherMode{16, aes.BlockSize, newAESCBCCipher}
+	cipherModes[InsecureCipherTripleDESCBC] = &cipherMode{24, des.BlockSize, newTripleDESCBCCipher}
 }
 
 // prefixLen is the length of the packet prefix that contains the packet length
@@ -307,7 +309,7 @@ type gcmCipher struct {
 	buf    []byte
 }
 
-func newGCMCipher(key, iv, unusedMacKey []byte, unusedAlgs directionAlgorithms) (packetCipher, error) {
+func newGCMCipher(key, iv, unusedMacKey []byte, unusedAlgs DirectionAlgorithms) (packetCipher, error) {
 	c, err := aes.NewCipher(key)
 	if err != nil {
 		return nil, err
@@ -429,7 +431,7 @@ type cbcCipher struct {
 	oracleCamouflage uint32
 }
 
-func newCBCCipher(c cipher.Block, key, iv, macKey []byte, algs directionAlgorithms) (packetCipher, error) {
+func newCBCCipher(c cipher.Block, key, iv, macKey []byte, algs DirectionAlgorithms) (packetCipher, error) {
 	cbc := &cbcCipher{
 		mac:        macModes[algs.MAC].new(macKey),
 		decrypter:  cipher.NewCBCDecrypter(c, iv),
@@ -443,7 +445,7 @@ func newCBCCipher(c cipher.Block, key, iv, macKey []byte, algs directionAlgorith
 	return cbc, nil
 }
 
-func newAESCBCCipher(key, iv, macKey []byte, algs directionAlgorithms) (packetCipher, error) {
+func newAESCBCCipher(key, iv, macKey []byte, algs DirectionAlgorithms) (packetCipher, error) {
 	c, err := aes.NewCipher(key)
 	if err != nil {
 		return nil, err
@@ -457,7 +459,7 @@ func newAESCBCCipher(key, iv, macKey []byte, algs directionAlgorithms) (packetCi
 	return cbc, nil
 }
 
-func newTripleDESCBCCipher(key, iv, macKey []byte, algs directionAlgorithms) (packetCipher, error) {
+func newTripleDESCBCCipher(key, iv, macKey []byte, algs DirectionAlgorithms) (packetCipher, error) {
 	c, err := des.NewTripleDESCipher(key)
 	if err != nil {
 		return nil, err
@@ -635,8 +637,6 @@ func (c *cbcCipher) writeCipherPacket(seqNum uint32, w io.Writer, rand io.Reader
 	return nil
 }
 
-const chacha20Poly1305ID = "chacha20-poly1305@openssh.com"
-
 // chacha20Poly1305Cipher implements the chacha20-poly1305@openssh.com
 // AEAD, which is described here:
 //
@@ -650,7 +650,7 @@ type chacha20Poly1305Cipher struct {
 	buf        []byte
 }
 
-func newChaCha20Cipher(key, unusedIV, unusedMACKey []byte, unusedAlgs directionAlgorithms) (packetCipher, error) {
+func newChaCha20Cipher(key, unusedIV, unusedMACKey []byte, unusedAlgs DirectionAlgorithms) (packetCipher, error) {
 	if len(key) != 64 {
 		panic(len(key))
 	}

ssh/cipher_test.go

@@ -22,7 +22,7 @@ func TestDefaultCiphersExist(t *testing.T) {
 			t.Errorf("supported cipher %q is unknown", cipherAlgo)
 		}
 	}
-	for _, cipherAlgo := range preferredCiphers {
+	for _, cipherAlgo := range defaultCiphers {
 		if _, ok := cipherModes[cipherAlgo]; !ok {
 			t.Errorf("preferred cipher %q is unknown", cipherAlgo)
 		}
@@ -30,8 +30,8 @@ func TestDefaultCiphersExist(t *testing.T) {
 }
 
 func TestPacketCiphers(t *testing.T) {
-	defaultMac := "hmac-sha2-256"
-	defaultCipher := "aes128-ctr"
+	defaultMac := HMACSHA256
+	defaultCipher := CipherAES128CTR
 	for cipher := range cipherModes {
 		t.Run("cipher="+cipher,
 			func(t *testing.T) { testPacketCipher(t, cipher, defaultMac) })
@@ -44,10 +44,10 @@ func TestPacketCiphers(t *testing.T) {
 
 func testPacketCipher(t *testing.T, cipher, mac string) {
 	kr := &kexResult{Hash: crypto.SHA1}
-	algs := directionAlgorithms{
+	algs := DirectionAlgorithms{
 		Cipher:      cipher,
 		MAC:         mac,
-		Compression: "none",
+		compression: compressionNone,
 	}
 	client, err := newPacketCipher(clientKeys, algs, kr)
 	if err != nil {
@@ -77,10 +77,10 @@ func testPacketCipher(t *testing.T, cipher, mac string) {
 
 func TestCBCOracleCounterMeasure(t *testing.T) {
 	kr := &kexResult{Hash: crypto.SHA1}
-	algs := directionAlgorithms{
-		Cipher:      aes128cbcID,
-		MAC:         "hmac-sha1",
-		Compression: "none",
+	algs := DirectionAlgorithms{
+		Cipher:      InsecureCipherAES128CBC,
+		MAC:         HMACSHA1,
+		compression: compressionNone,
 	}
 	client, err := newPacketCipher(clientKeys, algs, kr)
 	if err != nil {
@@ -141,7 +141,7 @@ func TestCVE202143565(t *testing.T) {
 		constructPacket func(packetCipher) io.Reader
 	}{
 		{
-			cipher: gcm128CipherID,
+			cipher: CipherAES128GCM,
 			constructPacket: func(client packetCipher) io.Reader {
 				internalCipher := client.(*gcmCipher)
 				b := &bytes.Buffer{}
@@ -159,7 +159,7 @@ func TestCVE202143565(t *testing.T) {
 			},
 		},
 		{
-			cipher: chacha20Poly1305ID,
+			cipher: CipherChaCha20Poly1305,
 			constructPacket: func(client packetCipher) io.Reader {
 				internalCipher := client.(*chacha20Poly1305Cipher)
 				b := &bytes.Buffer{}
@@ -201,13 +201,13 @@ func TestCVE202143565(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		mac := "hmac-sha2-256"
+		mac := HMACSHA256
 
 		kr := &kexResult{Hash: crypto.SHA1}
-		algs := directionAlgorithms{
+		algs := DirectionAlgorithms{
 			Cipher:      tc.cipher,
 			MAC:         mac,
-			Compression: "none",
+			compression: compressionNone,
 		}
 		client, err := newPacketCipher(clientKeys, algs, kr)
 		if err != nil {

ssh/client.go

@@ -110,6 +110,7 @@ func (c *connection) clientHandshake(dialAddress string, config *ClientConfig) e
 	}
 
 	c.sessionID = c.transport.getSessionID()
+	c.algorithms = c.transport.getAlgorithms()
 	return c.clientAuthenticate(config)
 }
 

ssh/client_auth.go

@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"slices"
 	"strings"
 )
 
@@ -83,7 +84,7 @@ func (c *connection) clientAuthenticate(config *ClientConfig) error {
 			// success
 			return nil
 		} else if ok == authFailure {
-			if m := auth.method(); !contains(tried, m) {
+			if m := auth.method(); !slices.Contains(tried, m) {
 				tried = append(tried, m)
 			}
 		}
@@ -97,7 +98,7 @@ func (c *connection) clientAuthenticate(config *ClientConfig) error {
 	findNext:
 		for _, a := range config.Auth {
 			candidateMethod := a.method()
-			if contains(tried, candidateMethod) {
+			if slices.Contains(tried, candidateMethod) {
 				continue
 			}
 			for _, meth := range methods {
@@ -117,15 +118,6 @@ func (c *connection) clientAuthenticate(config *ClientConfig) error {
 	return fmt.Errorf("ssh: unable to authenticate, attempted methods %v, no supported methods remain", tried)
 }
 
-func contains(list []string, e string) bool {
-	for _, s := range list {
-		if s == e {
-			return true
-		}
-	}
-	return false
-}
-
 // An AuthMethod represents an instance of an RFC 4252 authentication method.
 type AuthMethod interface {
 	// auth authenticates user over transport t.
@@ -255,7 +247,7 @@ func pickSignatureAlgorithm(signer Signer, extensions map[string][]byte) (MultiA
 		// Fallback to use if there is no "server-sig-algs" extension or a
 		// common algorithm cannot be found. We use the public key format if the
 		// MultiAlgorithmSigner supports it, otherwise we return an error.
-		if !contains(as.Algorithms(), underlyingAlgo(keyFormat)) {
+		if !slices.Contains(as.Algorithms(), underlyingAlgo(keyFormat)) {
 			return "", fmt.Errorf("ssh: no common public key signature algorithm, server only supports %q for key type %q, signer only supports %v",
 				underlyingAlgo(keyFormat), keyFormat, as.Algorithms())
 		}
@@ -284,12 +276,12 @@ func pickSignatureAlgorithm(signer Signer, extensions map[string][]byte) (MultiA
 	// Filter algorithms based on those supported by MultiAlgorithmSigner.
 	var keyAlgos []string
 	for _, algo := range algorithmsForKeyFormat(keyFormat) {
-		if contains(as.Algorithms(), underlyingAlgo(algo)) {
+		if slices.Contains(as.Algorithms(), underlyingAlgo(algo)) {
 			keyAlgos = append(keyAlgos, algo)
 		}
 	}
 
-	algo, err := findCommon("public key signature algorithm", keyAlgos, serverAlgos)
+	algo, err := findCommon("public key signature algorithm", keyAlgos, serverAlgos, true)
 	if err != nil {
 		// If there is no overlap, return the fallback algorithm to support
 		// servers that fail to list all supported algorithms.
@@ -334,7 +326,7 @@ func (cb publicKeyCallback) auth(session []byte, user string, c packetConn, rand
 		// the key try to use the obtained algorithm as if "server-sig-algs" had
 		// not been implemented if supported from the algorithm signer.
 		if !ok && idx < origSignersLen && isRSACert(algo) && algo != CertAlgoRSAv01 {
-			if contains(as.Algorithms(), KeyAlgoRSA) {
+			if slices.Contains(as.Algorithms(), KeyAlgoRSA) {
 				// We retry using the compat algorithm after all signers have
 				// been tried normally.
 				signers = append(signers, &multiAlgorithmSigner{
@@ -385,7 +377,7 @@ func (cb publicKeyCallback) auth(session []byte, user string, c packetConn, rand
 		// contain the "publickey" method, do not attempt to authenticate with any
 		// other keys.  According to RFC 4252 Section 7, the latter can occur when
 		// additional authentication methods are required.
-		if success == authSuccess || !contains(methods, cb.method()) {
+		if success == authSuccess || !slices.Contains(methods, cb.method()) {
 			return success, methods, err
 		}
 	}
@@ -434,7 +426,7 @@ func confirmKeyAck(key PublicKey, c packetConn) (bool, error) {
 			// servers send the key type instead. OpenSSH allows any algorithm
 			// that matches the public key, so we do the same.
 			// https://github.com/openssh/openssh-portable/blob/86bdd385/sshconnect2.c#L709
-			if !contains(algorithmsForKeyFormat(key.Type()), msg.Algo) {
+			if !slices.Contains(algorithmsForKeyFormat(key.Type()), msg.Algo) {
 				return false, nil
 			}
 			if !bytes.Equal(msg.PubKey, pubKey) {

ssh/client_auth_test.go

@@ -14,6 +14,7 @@ import (
 	"net"
 	"os"
 	"runtime"
+	"slices"
 	"strings"
 	"testing"
 )
@@ -324,6 +325,9 @@ func TestMethodInvalidAlgorithm(t *testing.T) {
 }
 
 func TestClientHMAC(t *testing.T) {
+	supportedAlgos := SupportedAlgorithms()
+	insecureAlgos := InsecureAlgorithms()
+	supportedMACs := append(supportedAlgos.MACs, insecureAlgos.MACs...)
 	for _, mac := range supportedMACs {
 		config := &ClientConfig{
 			User: "testuser",
@@ -349,7 +353,7 @@ func TestClientUnsupportedCipher(t *testing.T) {
 			PublicKeys(),
 		},
 		Config: Config{
-			Ciphers: []string{"aes128-cbc"}, // not currently supported
+			Ciphers: []string{"unsupported-cipher"}, // not currently supported
 		},
 	}
 	if err := tryAuth(t, config); err == nil {
@@ -1132,7 +1136,7 @@ func TestPickSignatureAlgorithm(t *testing.T) {
 				t.Fatalf("error generating cert signer: %v", err)
 			}
 			// The signer supports the public key algorithm and the
-			// public key format is a certificate type so the cerificate
+			// public key format is a certificate type so the certificate
 			// algorithm matching the key format must be returned
 			_, algo, err = pickSignatureAlgorithm(certSigner, c.extensions)
 			if err != nil {
@@ -1211,7 +1215,7 @@ func (cb configurablePublicKeyCallback) auth(session []byte, user string, c pack
 	if err != nil {
 		return authFailure, nil, err
 	}
-	if success == authSuccess || !contains(methods, cb.method()) {
+	if success == authSuccess || !slices.Contains(methods, cb.method()) {
 		return success, methods, err
 	}
 

ssh/client_test.go

@@ -292,7 +292,7 @@ func TestUnsupportedAlgorithm(t *testing.T) {
 		{
 			"unsupported and supported KEXs",
 			Config{
-				KeyExchanges: []string{"unsupported", kexAlgoCurve25519SHA256},
+				KeyExchanges: []string{"unsupported", KeyExchangeCurve25519},
 			},
 			"",
 		},
@@ -306,7 +306,7 @@ func TestUnsupportedAlgorithm(t *testing.T) {
 		{
 			"unsupported and supported ciphers",
 			Config{
-				Ciphers: []string{"unsupported", chacha20Poly1305ID},
+				Ciphers: []string{"unsupported", CipherChaCha20Poly1305},
 			},
 			"",
 		},
@@ -315,16 +315,16 @@ func TestUnsupportedAlgorithm(t *testing.T) {
 			Config{
 				MACs: []string{"unsupported"},
 				// MAC is used for non AAED ciphers.
-				Ciphers: []string{"aes256-ctr"},
+				Ciphers: []string{CipherAES256CTR},
 			},
 			"no common algorithm",
 		},
 		{
 			"unsupported and supported MACs",
 			Config{
-				MACs: []string{"unsupported", "hmac-sha2-256-etm@openssh.com"},
+				MACs: []string{"unsupported", HMACSHA256ETM},
 				// MAC is used for non AAED ciphers.
-				Ciphers: []string{"aes256-ctr"},
+				Ciphers: []string{CipherAES256CTR},
 			},
 			"",
 		},

ssh/common.go

@@ -6,10 +6,12 @@ package ssh
 
 import (
 	"crypto"
+	"crypto/fips140"
 	"crypto/rand"
 	"fmt"
 	"io"
 	"math"
+	"slices"
 	"sync"
 
 	_ "crypto/sha1"
@@ -24,88 +26,298 @@ const (
 	serviceSSH      = "ssh-connection"
 )
 
-// supportedCiphers lists ciphers we support but might not recommend.
-var supportedCiphers = []string{
-	"aes128-ctr", "aes192-ctr", "aes256-ctr",
-	"aes128-gcm@openssh.com", gcm256CipherID,
-	chacha20Poly1305ID,
-	"arcfour256", "arcfour128", "arcfour",
-	aes128cbcID,
-	tripledescbcID,
+// The ciphers currently or previously implemented by this library, to use in
+// [Config.Ciphers]. For a list, see the [Algorithms.Ciphers] returned by
+// [SupportedAlgorithms] or [InsecureAlgorithms].
+const (
+	CipherAES128GCM            = "aes128-gcm@openssh.com"
+	CipherAES256GCM            = "aes256-gcm@openssh.com"
+	CipherChaCha20Poly1305     = "chacha20-poly1305@openssh.com"
+	CipherAES128CTR            = "aes128-ctr"
+	CipherAES192CTR            = "aes192-ctr"
+	CipherAES256CTR            = "aes256-ctr"
+	InsecureCipherAES128CBC    = "aes128-cbc"
+	InsecureCipherTripleDESCBC = "3des-cbc"
+	InsecureCipherRC4          = "arcfour"
+	InsecureCipherRC4128       = "arcfour128"
+	InsecureCipherRC4256       = "arcfour256"
+)
+
+// The key exchanges currently or previously implemented by this library, to use
+// in [Config.KeyExchanges]. For a list, see the
+// [Algorithms.KeyExchanges] returned by [SupportedAlgorithms] or
+// [InsecureAlgorithms].
+const (
+	InsecureKeyExchangeDH1SHA1   = "diffie-hellman-group1-sha1"
+	InsecureKeyExchangeDH14SHA1  = "diffie-hellman-group14-sha1"
+	KeyExchangeDH14SHA256        = "diffie-hellman-group14-sha256"
+	KeyExchangeDH16SHA512        = "diffie-hellman-group16-sha512"
+	KeyExchangeECDHP256          = "ecdh-sha2-nistp256"
+	KeyExchangeECDHP384          = "ecdh-sha2-nistp384"
+	KeyExchangeECDHP521          = "ecdh-sha2-nistp521"
+	KeyExchangeCurve25519        = "curve25519-sha256"
+	InsecureKeyExchangeDHGEXSHA1 = "diffie-hellman-group-exchange-sha1"
+	KeyExchangeDHGEXSHA256       = "diffie-hellman-group-exchange-sha256"
+	// KeyExchangeMLKEM768X25519 is supported from Go 1.24.
+	KeyExchangeMLKEM768X25519 = "mlkem768x25519-sha256"
+
+	// An alias for KeyExchangeCurve25519SHA256. This kex ID will be added if
+	// KeyExchangeCurve25519SHA256 is requested for backward compatibility with
+	// OpenSSH versions up to 7.2.
+	keyExchangeCurve25519LibSSH = "curve25519-sha256@libssh.org"
+)
+
+// The message authentication code (MAC) currently or previously implemented by
+// this library, to use in [Config.MACs]. For a list, see the
+// [Algorithms.MACs] returned by [SupportedAlgorithms] or
+// [InsecureAlgorithms].
+const (
+	HMACSHA256ETM      = "hmac-sha2-256-etm@openssh.com"
+	HMACSHA512ETM      = "hmac-sha2-512-etm@openssh.com"
+	HMACSHA256         = "hmac-sha2-256"
+	HMACSHA512         = "hmac-sha2-512"
+	HMACSHA1           = "hmac-sha1"
+	InsecureHMACSHA196 = "hmac-sha1-96"
+)
+
+var (
+	// supportedKexAlgos specifies key-exchange algorithms implemented by this
+	// package in preference order, excluding those with security issues.
+	supportedKexAlgos = []string{
+		KeyExchangeMLKEM768X25519,
+		KeyExchangeCurve25519,
+		KeyExchangeECDHP256,
+		KeyExchangeECDHP384,
+		KeyExchangeECDHP521,
+		KeyExchangeDH14SHA256,
+		KeyExchangeDH16SHA512,
+		KeyExchangeDHGEXSHA256,
+	}
+	// defaultKexAlgos specifies the default preference for key-exchange
+	// algorithms in preference order.
+	defaultKexAlgos = []string{
+		KeyExchangeMLKEM768X25519,
+		KeyExchangeCurve25519,
+		KeyExchangeECDHP256,
+		KeyExchangeECDHP384,
+		KeyExchangeECDHP521,
+		KeyExchangeDH14SHA256,
+		InsecureKeyExchangeDH14SHA1,
+	}
+	// insecureKexAlgos specifies key-exchange algorithms implemented by this
+	// package and which have security issues.
+	insecureKexAlgos = []string{
+		InsecureKeyExchangeDH14SHA1,
+		InsecureKeyExchangeDH1SHA1,
+		InsecureKeyExchangeDHGEXSHA1,
+	}
+	// supportedCiphers specifies cipher algorithms implemented by this package
+	// in preference order, excluding those with security issues.
+	supportedCiphers = []string{
+		CipherAES128GCM,
+		CipherAES256GCM,
+		CipherChaCha20Poly1305,
+		CipherAES128CTR,
+		CipherAES192CTR,
+		CipherAES256CTR,
+	}
+	// defaultCiphers specifies the default preference for ciphers algorithms
+	// in preference order.
+	defaultCiphers = supportedCiphers
+	// insecureCiphers specifies cipher algorithms implemented by this
+	// package and which have security issues.
+	insecureCiphers = []string{
+		InsecureCipherAES128CBC,
+		InsecureCipherTripleDESCBC,
+		InsecureCipherRC4256,
+		InsecureCipherRC4128,
+		InsecureCipherRC4,
+	}
+	// supportedMACs specifies MAC algorithms implemented by this package in
+	// preference order, excluding those with security issues.
+	supportedMACs = []string{
+		HMACSHA256ETM,
+		HMACSHA512ETM,
+		HMACSHA256,
+		HMACSHA512,
+		HMACSHA1,
+	}
+	// defaultMACs specifies the default preference for MAC algorithms in
+	// preference order.
+	defaultMACs = []string{
+		HMACSHA256ETM,
+		HMACSHA512ETM,
+		HMACSHA256,
+		HMACSHA512,
+		HMACSHA1,
+		InsecureHMACSHA196,
+	}
+	// insecureMACs specifies MAC algorithms implemented by this
+	// package and which have security issues.
+	insecureMACs = []string{
+		InsecureHMACSHA196,
+	}
+	// supportedHostKeyAlgos specifies the supported host-key algorithms (i.e.
+	// methods of authenticating servers) implemented by this package in
+	// preference order, excluding those with security issues.
+	supportedHostKeyAlgos = []string{
+		CertAlgoRSASHA256v01,
+		CertAlgoRSASHA512v01,
+		CertAlgoECDSA256v01,
+		CertAlgoECDSA384v01,
+		CertAlgoECDSA521v01,
+		CertAlgoED25519v01,
+		KeyAlgoRSASHA256,
+		KeyAlgoRSASHA512,
+		KeyAlgoECDSA256,
+		KeyAlgoECDSA384,
+		KeyAlgoECDSA521,
+		KeyAlgoED25519,
+	}
+	// defaultHostKeyAlgos specifies the default preference for host-key
+	// algorithms in preference order.
+	defaultHostKeyAlgos = []string{
+		CertAlgoRSASHA256v01,
+		CertAlgoRSASHA512v01,
+		CertAlgoRSAv01,
+		InsecureCertAlgoDSAv01,
+		CertAlgoECDSA256v01,
+		CertAlgoECDSA384v01,
+		CertAlgoECDSA521v01,
+		CertAlgoED25519v01,
+		KeyAlgoECDSA256,
+		KeyAlgoECDSA384,
+		KeyAlgoECDSA521,
+		KeyAlgoRSASHA256,
+		KeyAlgoRSASHA512,
+		KeyAlgoRSA,
+		InsecureKeyAlgoDSA,
+		KeyAlgoED25519,
+	}
+	// insecureHostKeyAlgos specifies host-key algorithms implemented by this
+	// package and which have security issues.
+	insecureHostKeyAlgos = []string{
+		KeyAlgoRSA,
+		InsecureKeyAlgoDSA,
+		CertAlgoRSAv01,
+		InsecureCertAlgoDSAv01,
+	}
+	// supportedPubKeyAuthAlgos specifies the supported client public key
+	// authentication algorithms. Note that this doesn't include certificate
+	// types since those use the underlying algorithm. Order is irrelevant.
+	supportedPubKeyAuthAlgos = []string{
+		KeyAlgoED25519,
+		KeyAlgoSKED25519,
+		KeyAlgoSKECDSA256,
+		KeyAlgoECDSA256,
+		KeyAlgoECDSA384,
+		KeyAlgoECDSA521,
+		KeyAlgoRSASHA256,
+		KeyAlgoRSASHA512,
+	}
+
+	// defaultPubKeyAuthAlgos specifies the preferred client public key
+	// authentication algorithms. This list is sent to the client if it supports
+	// the server-sig-algs extension. Order is irrelevant.
+	defaultPubKeyAuthAlgos = []string{
+		KeyAlgoED25519,
+		KeyAlgoSKED25519,
+		KeyAlgoSKECDSA256,
+		KeyAlgoECDSA256,
+		KeyAlgoECDSA384,
+		KeyAlgoECDSA521,
+		KeyAlgoRSASHA256,
+		KeyAlgoRSASHA512,
+		KeyAlgoRSA,
+		InsecureKeyAlgoDSA,
+	}
+	// insecurePubKeyAuthAlgos specifies client public key authentication
+	// algorithms implemented by this package and which have security issues.
+	insecurePubKeyAuthAlgos = []string{
+		KeyAlgoRSA,
+		InsecureKeyAlgoDSA,
+	}
+)
+
+// NegotiatedAlgorithms defines algorithms negotiated between client and server.
+type NegotiatedAlgorithms struct {
+	KeyExchange string
+	HostKey     string
+	Read        DirectionAlgorithms
+	Write       DirectionAlgorithms
 }
 
-// preferredCiphers specifies the default preference for ciphers.
-var preferredCiphers = []string{
-	"aes128-gcm@openssh.com", gcm256CipherID,
-	chacha20Poly1305ID,
-	"aes128-ctr", "aes192-ctr", "aes256-ctr",
+// Algorithms defines a set of algorithms that can be configured in the client
+// or server config for negotiation during a handshake.
+type Algorithms struct {
+	KeyExchanges   []string
+	Ciphers        []string
+	MACs           []string
+	HostKeys       []string
+	PublicKeyAuths []string
 }
 
-// supportedKexAlgos specifies the supported key-exchange algorithms in
-// preference order.
-var supportedKexAlgos = []string{
-	kexAlgoCurve25519SHA256, kexAlgoCurve25519SHA256LibSSH,
-	// P384 and P521 are not constant-time yet, but since we don't
-	// reuse ephemeral keys, using them for ECDH should be OK.
-	kexAlgoECDH256, kexAlgoECDH384, kexAlgoECDH521,
-	kexAlgoDH14SHA256, kexAlgoDH16SHA512, kexAlgoDH14SHA1,
-	kexAlgoDH1SHA1,
+func init() {
+	if fips140.Enabled() {
+		defaultHostKeyAlgos = slices.DeleteFunc(defaultHostKeyAlgos, func(algo string) bool {
+			_, err := hashFunc(underlyingAlgo(algo))
+			return err != nil
+		})
+		defaultPubKeyAuthAlgos = slices.DeleteFunc(defaultPubKeyAuthAlgos, func(algo string) bool {
+			_, err := hashFunc(underlyingAlgo(algo))
+			return err != nil
+		})
+	}
 }
 
-// serverForbiddenKexAlgos contains key exchange algorithms, that are forbidden
-// for the server half.
-var serverForbiddenKexAlgos = map[string]struct{}{
-	kexAlgoDHGEXSHA1:   {}, // server half implementation is only minimal to satisfy the automated tests
-	kexAlgoDHGEXSHA256: {}, // server half implementation is only minimal to satisfy the automated tests
+func hashFunc(format string) (crypto.Hash, error) {
+	switch format {
+	case KeyAlgoRSASHA256, KeyAlgoECDSA256, KeyAlgoSKED25519, KeyAlgoSKECDSA256:
+		return crypto.SHA256, nil
+	case KeyAlgoECDSA384:
+		return crypto.SHA384, nil
+	case KeyAlgoRSASHA512, KeyAlgoECDSA521:
+		return crypto.SHA512, nil
+	case KeyAlgoED25519:
+		// KeyAlgoED25519 doesn't pre-hash.
+		return 0, nil
+	case KeyAlgoRSA, InsecureKeyAlgoDSA:
+		if fips140.Enabled() {
+			return 0, fmt.Errorf("ssh: hash algorithm for format %q not allowed in FIPS 140 mode", format)
+		}
+		return crypto.SHA1, nil
+	default:
+		return 0, fmt.Errorf("ssh: hash algorithm for format %q not mapped", format)
+	}
 }
 
-// preferredKexAlgos specifies the default preference for key-exchange
-// algorithms in preference order. The diffie-hellman-group16-sha512 algorithm
-// is disabled by default because it is a bit slower than the others.
-var preferredKexAlgos = []string{
-	kexAlgoCurve25519SHA256, kexAlgoCurve25519SHA256LibSSH,
-	kexAlgoECDH256, kexAlgoECDH384, kexAlgoECDH521,
-	kexAlgoDH14SHA256, kexAlgoDH14SHA1,
+// SupportedAlgorithms returns algorithms currently implemented by this package,
+// excluding those with security issues, which are returned by
+// InsecureAlgorithms. The algorithms listed here are in preference order.
+func SupportedAlgorithms() Algorithms {
+	return Algorithms{
+		Ciphers:        slices.Clone(supportedCiphers),
+		MACs:           slices.Clone(supportedMACs),
+		KeyExchanges:   slices.Clone(supportedKexAlgos),
+		HostKeys:       slices.Clone(supportedHostKeyAlgos),
+		PublicKeyAuths: slices.Clone(supportedPubKeyAuthAlgos),
+	}
 }
 
-// supportedHostKeyAlgos specifies the supported host-key algorithms (i.e. methods
-// of authenticating servers) in preference order.
-var supportedHostKeyAlgos = []string{
-	CertAlgoRSASHA256v01, CertAlgoRSASHA512v01,
-	CertAlgoRSAv01, CertAlgoDSAv01, CertAlgoECDSA256v01,
-	CertAlgoECDSA384v01, CertAlgoECDSA521v01, CertAlgoED25519v01,
-
-	KeyAlgoECDSA256, KeyAlgoECDSA384, KeyAlgoECDSA521,
-	KeyAlgoRSASHA256, KeyAlgoRSASHA512,
-	KeyAlgoRSA, KeyAlgoDSA,
-
-	KeyAlgoED25519,
-}
-
-// supportedMACs specifies a default set of MAC algorithms in preference order.
-// This is based on RFC 4253, section 6.4, but with hmac-md5 variants removed
-// because they have reached the end of their useful life.
-var supportedMACs = []string{
-	"hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", "hmac-sha1-96",
+// InsecureAlgorithms returns algorithms currently implemented by this package
+// and which have security issues.
+func InsecureAlgorithms() Algorithms {
+	return Algorithms{
+		KeyExchanges:   slices.Clone(insecureKexAlgos),
+		Ciphers:        slices.Clone(insecureCiphers),
+		MACs:           slices.Clone(insecureMACs),
+		HostKeys:       slices.Clone(insecureHostKeyAlgos),
+		PublicKeyAuths: slices.Clone(insecurePubKeyAuthAlgos),
+	}
 }
 
 var supportedCompressions = []string{compressionNone}
 
-// hashFuncs keeps the mapping of supported signature algorithms to their
-// respective hashes needed for signing and verification.
-var hashFuncs = map[string]crypto.Hash{
-	KeyAlgoRSA:       crypto.SHA1,
-	KeyAlgoRSASHA256: crypto.SHA256,
-	KeyAlgoRSASHA512: crypto.SHA512,
-	KeyAlgoDSA:       crypto.SHA1,
-	KeyAlgoECDSA256:  crypto.SHA256,
-	KeyAlgoECDSA384:  crypto.SHA384,
-	KeyAlgoECDSA521:  crypto.SHA512,
-	// KeyAlgoED25519 doesn't pre-hash.
-	KeyAlgoSKECDSA256: crypto.SHA256,
-	KeyAlgoSKED25519:  crypto.SHA256,
-}
-
 // algorithmsForKeyFormat returns the supported signature algorithms for a given
 // public key format (PublicKey.Type), in order of preference. See RFC 8332,
 // Section 2. See also the note in sendKexInit on backwards compatibility.
@@ -120,11 +332,40 @@ func algorithmsForKeyFormat(keyFormat string) []string {
 	}
 }
 
+// keyFormatForAlgorithm returns the key format corresponding to the given
+// signature algorithm. It returns an empty string if the signature algorithm is
+// invalid or unsupported.
+func keyFormatForAlgorithm(sigAlgo string) string {
+	switch sigAlgo {
+	case KeyAlgoRSA, KeyAlgoRSASHA256, KeyAlgoRSASHA512:
+		return KeyAlgoRSA
+	case CertAlgoRSAv01, CertAlgoRSASHA256v01, CertAlgoRSASHA512v01:
+		return CertAlgoRSAv01
+	case KeyAlgoED25519,
+		KeyAlgoSKED25519,
+		KeyAlgoSKECDSA256,
+		KeyAlgoECDSA256,
+		KeyAlgoECDSA384,
+		KeyAlgoECDSA521,
+		InsecureKeyAlgoDSA,
+		InsecureCertAlgoDSAv01,
+		CertAlgoECDSA256v01,
+		CertAlgoECDSA384v01,
+		CertAlgoECDSA521v01,
+		CertAlgoSKECDSA256v01,
+		CertAlgoED25519v01,
+		CertAlgoSKED25519v01:
+		return sigAlgo
+	default:
+		return ""
+	}
+}
+
 // isRSA returns whether algo is a supported RSA algorithm, including certificate
 // algorithms.
 func isRSA(algo string) bool {
 	algos := algorithmsForKeyFormat(KeyAlgoRSA)
-	return contains(algos, underlyingAlgo(algo))
+	return slices.Contains(algos, underlyingAlgo(algo))
 }
 
 func isRSACert(algo string) bool {
@@ -135,18 +376,6 @@ func isRSACert(algo string) bool {
 	return isRSA(algo)
 }
 
-// supportedPubKeyAuthAlgos specifies the supported client public key
-// authentication algorithms. Note that this doesn't include certificate types
-// since those use the underlying algorithm. This list is sent to the client if
-// it supports the server-sig-algs extension. Order is irrelevant.
-var supportedPubKeyAuthAlgos = []string{
-	KeyAlgoED25519,
-	KeyAlgoSKED25519, KeyAlgoSKECDSA256,
-	KeyAlgoECDSA256, KeyAlgoECDSA384, KeyAlgoECDSA521,
-	KeyAlgoRSASHA256, KeyAlgoRSASHA512, KeyAlgoRSA,
-	KeyAlgoDSA,
-}
-
 // unexpectedMessageError results when the SSH message that we received didn't
 // match what we wanted.
 func unexpectedMessageError(expected, got uint8) error {
@@ -158,7 +387,7 @@ func parseError(tag uint8) error {
 	return fmt.Errorf("ssh: parse error in message type %d", tag)
 }
 
-func findCommon(what string, client []string, server []string) (common string, err error) {
+func findCommon(what string, client []string, server []string, isClient bool) (string, error) {
 	for _, c := range client {
 		for _, s := range server {
 			if c == s {
@@ -166,23 +395,49 @@ func findCommon(what string, client []string, server []string) (common string, e
 			}
 		}
 	}
-	return "", fmt.Errorf("ssh: no common algorithm for %s; client offered: %v, server offered: %v", what, client, server)
+	err := &AlgorithmNegotiationError{
+		What: what,
+	}
+	if isClient {
+		err.SupportedAlgorithms = client
+		err.RequestedAlgorithms = server
+	} else {
+		err.SupportedAlgorithms = server
+		err.RequestedAlgorithms = client
+	}
+	return "", err
 }
 
-// directionAlgorithms records algorithm choices in one direction (either read or write)
-type directionAlgorithms struct {
+// AlgorithmNegotiationError defines the error returned if the client and the
+// server cannot agree on an algorithm for key exchange, host key, cipher, MAC.
+type AlgorithmNegotiationError struct {
+	What string
+	// RequestedAlgorithms lists the algorithms supported by the peer.
+	RequestedAlgorithms []string
+	// SupportedAlgorithms lists the algorithms supported on our side.
+	SupportedAlgorithms []string
+}
+
+func (a *AlgorithmNegotiationError) Error() string {
+	return fmt.Sprintf("ssh: no common algorithm for %s; we offered: %v, peer offered: %v",
+		a.What, a.SupportedAlgorithms, a.RequestedAlgorithms)
+}
+
+// DirectionAlgorithms defines the algorithms negotiated in one direction
+// (either read or write).
+type DirectionAlgorithms struct {
 	Cipher      string
 	MAC         string
-	Compression string
+	compression string
 }
 
 // rekeyBytes returns a rekeying intervals in bytes.
-func (a *directionAlgorithms) rekeyBytes() int64 {
+func (a *DirectionAlgorithms) rekeyBytes() int64 {
 	// According to RFC 4344 block ciphers should rekey after
 	// 2^(BLOCKSIZE/4) blocks. For all AES flavors BLOCKSIZE is
 	// 128.
 	switch a.Cipher {
-	case "aes128-ctr", "aes192-ctr", "aes256-ctr", gcm128CipherID, gcm256CipherID, aes128cbcID:
+	case CipherAES128CTR, CipherAES192CTR, CipherAES256CTR, CipherAES128GCM, CipherAES256GCM, InsecureCipherAES128CBC:
 		return 16 * (1 << 32)
 
 	}
@@ -192,66 +447,59 @@ func (a *directionAlgorithms) rekeyBytes() int64 {
 }
 
 var aeadCiphers = map[string]bool{
-	gcm128CipherID:     true,
-	gcm256CipherID:     true,
-	chacha20Poly1305ID: true,
+	CipherAES128GCM:        true,
+	CipherAES256GCM:        true,
+	CipherChaCha20Poly1305: true,
 }
 
-type algorithms struct {
-	kex     string
-	hostKey string
-	w       directionAlgorithms
-	r       directionAlgorithms
-}
+func findAgreedAlgorithms(isClient bool, clientKexInit, serverKexInit *kexInitMsg) (algs *NegotiatedAlgorithms, err error) {
+	result := &NegotiatedAlgorithms{}
 
-func findAgreedAlgorithms(isClient bool, clientKexInit, serverKexInit *kexInitMsg) (algs *algorithms, err error) {
-	result := &algorithms{}
-
-	result.kex, err = findCommon("key exchange", clientKexInit.KexAlgos, serverKexInit.KexAlgos)
+	result.KeyExchange, err = findCommon("key exchange", clientKexInit.KexAlgos, serverKexInit.KexAlgos, isClient)
 	if err != nil {
 		return
 	}
 
-	result.hostKey, err = findCommon("host key", clientKexInit.ServerHostKeyAlgos, serverKexInit.ServerHostKeyAlgos)
+	result.HostKey, err = findCommon("host key", clientKexInit.ServerHostKeyAlgos, serverKexInit.ServerHostKeyAlgos, isClient)
 	if err != nil {
 		return
 	}
 
-	stoc, ctos := &result.w, &result.r
+	stoc, ctos := &result.Write, &result.Read
 	if isClient {
 		ctos, stoc = stoc, ctos
 	}
 
-	ctos.Cipher, err = findCommon("client to server cipher", clientKexInit.CiphersClientServer, serverKexInit.CiphersClientServer)
+	ctos.Cipher, err = findCommon("client to server cipher", clientKexInit.CiphersClientServer, serverKexInit.CiphersClientServer, isClient)
 	if err != nil {
 		return
 	}
 
-	stoc.Cipher, err = findCommon("server to client cipher", clientKexInit.CiphersServerClient, serverKexInit.CiphersServerClient)
+	stoc.Cipher, err = findCommon("server to client cipher", clientKexInit.CiphersServerClient, serverKexInit.CiphersServerClient, isClient)
 	if err != nil {
 		return
 	}
 
 	if !aeadCiphers[ctos.Cipher] {
-		ctos.MAC, err = findCommon("client to server MAC", clientKexInit.MACsClientServer, serverKexInit.MACsClientServer)
+		ctos.MAC, err = findCommon("client to server MAC", clientKexInit.MACsClientServer, serverKexInit.MACsClientServer, isClient)
 		if err != nil {
 			return
 		}
 	}
 
 	if !aeadCiphers[stoc.Cipher] {
-		stoc.MAC, err = findCommon("server to client MAC", clientKexInit.MACsServerClient, serverKexInit.MACsServerClient)
+		stoc.MAC, err = findCommon("server to client MAC", clientKexInit.MACsServerClient, serverKexInit.MACsServerClient, isClient)
 		if err != nil {
 			return
 		}
 	}
 
-	ctos.Compression, err = findCommon("client to server compression", clientKexInit.CompressionClientServer, serverKexInit.CompressionClientServer)
+	ctos.compression, err = findCommon("client to server compression", clientKexInit.CompressionClientServer, serverKexInit.CompressionClientServer, isClient)
 	if err != nil {
 		return
 	}
 
-	stoc.Compression, err = findCommon("server to client compression", clientKexInit.CompressionServerClient, serverKexInit.CompressionServerClient)
+	stoc.compression, err = findCommon("server to client compression", clientKexInit.CompressionServerClient, serverKexInit.CompressionServerClient, isClient)
 	if err != nil {
 		return
 	}
@@ -297,7 +545,7 @@ func (c *Config) SetDefaults() {
 		c.Rand = rand.Reader
 	}
 	if c.Ciphers == nil {
-		c.Ciphers = preferredCiphers
+		c.Ciphers = defaultCiphers
 	}
 	var ciphers []string
 	for _, c := range c.Ciphers {
@@ -309,19 +557,22 @@ func (c *Config) SetDefaults() {
 	c.Ciphers = ciphers
 
 	if c.KeyExchanges == nil {
-		c.KeyExchanges = preferredKexAlgos
+		c.KeyExchanges = defaultKexAlgos
 	}
 	var kexs []string
 	for _, k := range c.KeyExchanges {
 		if kexAlgoMap[k] != nil {
 			// Ignore the KEX if we have no kexAlgoMap definition.
 			kexs = append(kexs, k)
+			if k == KeyExchangeCurve25519 && !slices.Contains(c.KeyExchanges, keyExchangeCurve25519LibSSH) {
+				kexs = append(kexs, keyExchangeCurve25519LibSSH)
+			}
 		}
 	}
 	c.KeyExchanges = kexs
 
 	if c.MACs == nil {
-		c.MACs = supportedMACs
+		c.MACs = defaultMACs
 	}
 	var macs []string
 	for _, m := range c.MACs {

ssh/common_test.go

@@ -5,7 +5,9 @@
 package ssh
 
 import (
+	"maps"
 	"reflect"
+	"slices"
 	"testing"
 )
 
@@ -51,33 +53,33 @@ func TestFindAgreedAlgorithms(t *testing.T) {
 		}
 	}
 
-	initDirAlgs := func(a *directionAlgorithms) {
+	initDirAlgs := func(a *DirectionAlgorithms) {
 		if a.Cipher == "" {
 			a.Cipher = "cipher1"
 		}
 		if a.MAC == "" {
 			a.MAC = "mac1"
 		}
-		if a.Compression == "" {
-			a.Compression = "compression1"
+		if a.compression == "" {
+			a.compression = "compression1"
 		}
 	}
 
-	initAlgs := func(a *algorithms) {
-		if a.kex == "" {
-			a.kex = "kex1"
+	initAlgs := func(a *NegotiatedAlgorithms) {
+		if a.KeyExchange == "" {
+			a.KeyExchange = "kex1"
 		}
-		if a.hostKey == "" {
-			a.hostKey = "hostkey1"
+		if a.HostKey == "" {
+			a.HostKey = "hostkey1"
 		}
-		initDirAlgs(&a.r)
-		initDirAlgs(&a.w)
+		initDirAlgs(&a.Read)
+		initDirAlgs(&a.Write)
 	}
 
 	type testcase struct {
 		name                   string
 		clientIn, serverIn     kexInitMsg
-		wantClient, wantServer algorithms
+		wantClient, wantServer NegotiatedAlgorithms
 		wantErr                bool
 	}
 
@@ -120,19 +122,19 @@ func TestFindAgreedAlgorithms(t *testing.T) {
 				CiphersClientServer: []string{"cipher2", "cipher1"},
 				CiphersServerClient: []string{"cipher3", "cipher2"},
 			},
-			wantClient: algorithms{
-				r: directionAlgorithms{
+			wantClient: NegotiatedAlgorithms{
+				Read: DirectionAlgorithms{
 					Cipher: "cipher3",
 				},
-				w: directionAlgorithms{
+				Write: DirectionAlgorithms{
 					Cipher: "cipher2",
 				},
 			},
-			wantServer: algorithms{
-				w: directionAlgorithms{
+			wantServer: NegotiatedAlgorithms{
+				Write: DirectionAlgorithms{
 					Cipher: "cipher3",
 				},
-				r: directionAlgorithms{
+				Read: DirectionAlgorithms{
 					Cipher: "cipher2",
 				},
 			},
@@ -174,3 +176,21 @@ func TestFindAgreedAlgorithms(t *testing.T) {
 		})
 	}
 }
+
+func TestKeyFormatAlgorithms(t *testing.T) {
+	supportedAlgos := SupportedAlgorithms()
+	insecureAlgos := InsecureAlgorithms()
+	algoritms := append(supportedAlgos.PublicKeyAuths, insecureAlgos.PublicKeyAuths...)
+	algoritms = append(algoritms, slices.Collect(maps.Keys(certKeyAlgoNames))...)
+
+	for _, algo := range algoritms {
+		keyFormat := keyFormatForAlgorithm(algo)
+		if keyFormat == "" {
+			t.Errorf("got empty key format for algorithm %q", algo)
+		}
+		if !slices.Contains(algorithmsForKeyFormat(keyFormat), algo) {
+			t.Errorf("algorithms for key format %q, does not contain %q", keyFormat, algo)
+		}
+
+	}
+}

ssh/connection.go

@@ -74,6 +74,13 @@ type Conn interface {
 	//   Disconnect
 }
 
+// AlgorithmsConnMetadata is a ConnMetadata that can return the algorithms
+// negotiated between client and server.
+type AlgorithmsConnMetadata interface {
+	ConnMetadata
+	Algorithms() NegotiatedAlgorithms
+}
+
 // DiscardRequests consumes and rejects all requests from the
 // passed-in channel.
 func DiscardRequests(in <-chan *Request) {
@@ -106,6 +113,7 @@ type sshConn struct {
 	sessionID     []byte
 	clientVersion []byte
 	serverVersion []byte
+	algorithms    NegotiatedAlgorithms
 }
 
 func dup(src []byte) []byte {
@@ -141,3 +149,7 @@ func (c *sshConn) ClientVersion() []byte {
 func (c *sshConn) ServerVersion() []byte {
 	return dup(c.serverVersion)
 }
+
+func (c *sshConn) Algorithms() NegotiatedAlgorithms {
+	return c.algorithms
+}

ssh/doc.go

@@ -16,8 +16,19 @@ References:
 	[PROTOCOL]: https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL?rev=HEAD
 	[PROTOCOL.certkeys]: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.certkeys?rev=HEAD
 	[SSH-PARAMETERS]:    http://www.iana.org/assignments/ssh-parameters/ssh-parameters.xml#ssh-parameters-1
+	[SSH-CERTS]:	https://datatracker.ietf.org/doc/html/draft-miller-ssh-cert-01
+	[FIPS 140-3 mode]: https://go.dev/doc/security/fips140
 
 This package does not fall under the stability promise of the Go language itself,
 so its API may be changed when pressing needs arise.
+
+# FIPS 140-3 mode
+
+When the program is in [FIPS 140-3 mode], this package behaves as if only SP
+800-140C and SP 800-140D approved cipher suites, signature algorithms,
+certificate public key types and sizes, and key exchange and derivation
+algorithms were implemented. Others are silently ignored and not negotiated, or
+rejected. This set may depend on the algorithms supported by the FIPS 140-3 Go
+Cryptographic Module selected with GOFIPS140, and may change across Go versions.
 */
 package ssh

ssh/example_test.go

@@ -154,6 +154,75 @@ func ExampleNewServerConn() {
 	}
 }
 
+func ExampleServerConfig() {
+	// Minimal ServerConfig with SHA-1 algorithms disabled and supporting only
+	// public key authentication.
+
+	// The algorithms returned by ssh.SupportedAlgorithms() are different from
+	// the default ones and do not include algorithms that are considered
+	// insecure, such as those using SHA-1, returned by
+	// ssh.InsecureAlgorithms().
+	algorithms := ssh.SupportedAlgorithms()
+
+	// Public key authentication is done by comparing
+	// the public key of a received connection
+	// with the entries in the authorized_keys file.
+	authorizedKeysBytes, err := os.ReadFile("authorized_keys")
+	if err != nil {
+		log.Fatalf("Failed to load authorized_keys, err: %v", err)
+	}
+
+	authorizedKeysMap := map[string]bool{}
+	for len(authorizedKeysBytes) > 0 {
+		pubKey, _, _, rest, err := ssh.ParseAuthorizedKey(authorizedKeysBytes)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		authorizedKeysMap[string(pubKey.Marshal())] = true
+		authorizedKeysBytes = rest
+	}
+
+	config := &ssh.ServerConfig{
+		Config: ssh.Config{
+			KeyExchanges: algorithms.KeyExchanges,
+			Ciphers:      algorithms.Ciphers,
+			MACs:         algorithms.MACs,
+		},
+		// The configured PublicKeyAuthAlgorithms do not contain SHA-1 based
+		// signature formats, so if the client attempts to use them the
+		// authentication will fail before calling the defined callback.
+		PublicKeyAuthAlgorithms: algorithms.PublicKeyAuths,
+		PublicKeyCallback: func(c ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
+			if authorizedKeysMap[string(pubKey.Marshal())] {
+				return &ssh.Permissions{
+					// Record the public key used for authentication.
+					Extensions: map[string]string{
+						"pubkey-fp": ssh.FingerprintSHA256(pubKey),
+					},
+				}, nil
+			}
+			return nil, fmt.Errorf("unknown public key for %q", c.User())
+		},
+	}
+
+	privateBytes, err := os.ReadFile("id_rsa")
+	if err != nil {
+		log.Fatal("Failed to load private key: ", err)
+	}
+
+	private, err := ssh.ParsePrivateKey(privateBytes)
+	if err != nil {
+		log.Fatal("Failed to parse private key: ", err)
+	}
+	// Restrict host key algorithms to disable ssh-rsa.
+	signer, err := ssh.NewSignerWithAlgorithms(private.(ssh.AlgorithmSigner), []string{ssh.KeyAlgoRSASHA256, ssh.KeyAlgoRSASHA512})
+	if err != nil {
+		log.Fatal("Failed to create private key with restricted algorithms: ", err)
+	}
+	config.AddHostKey(signer)
+}
+
 func ExampleServerConfig_AddHostKey() {
 	// Minimal ServerConfig supporting only password authentication.
 	config := &ssh.ServerConfig{
@@ -262,6 +331,47 @@ func ExampleDial() {
 	fmt.Println(b.String())
 }
 
+func ExampleClientConfig() {
+	var hostKey ssh.PublicKey
+	key, err := os.ReadFile("/home/user/.ssh/id_rsa")
+	if err != nil {
+		log.Fatalf("unable to read private key: %v", err)
+	}
+
+	// Create the Signer for this private key.
+	signer, err := ssh.ParsePrivateKey(key)
+	if err != nil {
+		log.Fatalf("unable to parse private key: %v", err)
+	}
+
+	// Minimal ClientConfig with SHA-1 algorithms disabled.
+	// The algorithms returned by ssh.SupportedAlgorithms() are different from
+	// the default ones and do not include algorithms that are considered
+	// insecure, such as those using SHA-1, returned by
+	// ssh.InsecureAlgorithms().
+	algorithms := ssh.SupportedAlgorithms()
+	config := &ssh.ClientConfig{
+		Config: ssh.Config{
+			KeyExchanges: algorithms.KeyExchanges,
+			Ciphers:      algorithms.Ciphers,
+			MACs:         algorithms.MACs,
+		},
+		User: "username",
+		Auth: []ssh.AuthMethod{
+			ssh.PublicKeys(signer),
+		},
+		HostKeyCallback: ssh.FixedHostKey(hostKey),
+		// We should check that hostKey algorithm is included in
+		// algorithms.HostKeys.
+		HostKeyAlgorithms: algorithms.HostKeys,
+	}
+	client, err := ssh.Dial("tcp", "yourserver.com:22", config)
+	if err != nil {
+		log.Fatal("Failed to dial: ", err)
+	}
+	defer client.Close()
+}
+
 func ExamplePublicKeys() {
 	var hostKey ssh.PublicKey
 	// A public key may be used to authenticate against the remote

ssh/handshake.go

@@ -5,12 +5,12 @@
 package ssh
 
 import (
-	"crypto/rand"
 	"errors"
 	"fmt"
 	"io"
 	"log"
 	"net"
+	"slices"
 	"strings"
 	"sync"
 )
@@ -39,7 +39,7 @@ type keyingTransport interface {
 	// prepareKeyChange sets up a key change. The key change for a
 	// direction will be effected if a msgNewKeys message is sent
 	// or received.
-	prepareKeyChange(*algorithms, *kexResult) error
+	prepareKeyChange(*NegotiatedAlgorithms, *kexResult) error
 
 	// setStrictMode sets the strict KEX mode, notably triggering
 	// sequence number resets on sending or receiving msgNewKeys.
@@ -116,7 +116,7 @@ type handshakeTransport struct {
 	bannerCallback BannerCallback
 
 	// Algorithms agreed in the last key exchange.
-	algorithms *algorithms
+	algorithms *NegotiatedAlgorithms
 
 	// Counters exclusively owned by readLoop.
 	readPacketsLeft uint32
@@ -165,7 +165,7 @@ func newClientTransport(conn keyingTransport, clientVersion, serverVersion []byt
 	if config.HostKeyAlgorithms != nil {
 		t.hostKeyAlgorithms = config.HostKeyAlgorithms
 	} else {
-		t.hostKeyAlgorithms = supportedHostKeyAlgos
+		t.hostKeyAlgorithms = defaultHostKeyAlgos
 	}
 	go t.readLoop()
 	go t.kexLoop()
@@ -185,6 +185,10 @@ func (t *handshakeTransport) getSessionID() []byte {
 	return t.sessionID
 }
 
+func (t *handshakeTransport) getAlgorithms() NegotiatedAlgorithms {
+	return *t.algorithms
+}
+
 // waitSession waits for the session to be established. This should be
 // the first thing to call after instantiating handshakeTransport.
 func (t *handshakeTransport) waitSession() error {
@@ -291,7 +295,7 @@ func (t *handshakeTransport) resetWriteThresholds() {
 	if t.config.RekeyThreshold > 0 {
 		t.writeBytesLeft = int64(t.config.RekeyThreshold)
 	} else if t.algorithms != nil {
-		t.writeBytesLeft = t.algorithms.w.rekeyBytes()
+		t.writeBytesLeft = t.algorithms.Write.rekeyBytes()
 	} else {
 		t.writeBytesLeft = 1 << 30
 	}
@@ -408,7 +412,7 @@ func (t *handshakeTransport) resetReadThresholds() {
 	if t.config.RekeyThreshold > 0 {
 		t.readBytesLeft = int64(t.config.RekeyThreshold)
 	} else if t.algorithms != nil {
-		t.readBytesLeft = t.algorithms.r.rekeyBytes()
+		t.readBytesLeft = t.algorithms.Read.rekeyBytes()
 	} else {
 		t.readBytesLeft = 1 << 30
 	}
@@ -501,7 +505,7 @@ func (t *handshakeTransport) sendKexInit() error {
 		CompressionClientServer: supportedCompressions,
 		CompressionServerClient: supportedCompressions,
 	}
-	io.ReadFull(rand.Reader, msg.Cookie[:])
+	io.ReadFull(t.config.Rand, msg.Cookie[:])
 
 	// We mutate the KexAlgos slice, in order to add the kex-strict extension algorithm,
 	// and possibly to add the ext-info extension algorithm. Since the slice may be the
@@ -524,7 +528,7 @@ func (t *handshakeTransport) sendKexInit() error {
 			switch s := k.(type) {
 			case MultiAlgorithmSigner:
 				for _, algo := range algorithmsForKeyFormat(keyFormat) {
-					if contains(s.Algorithms(), underlyingAlgo(algo)) {
+					if slices.Contains(s.Algorithms(), underlyingAlgo(algo)) {
 						msg.ServerHostKeyAlgos = append(msg.ServerHostKeyAlgos, algo)
 					}
 				}
@@ -676,7 +680,7 @@ func (t *handshakeTransport) enterKeyExchange(otherInitPacket []byte) error {
 		return err
 	}
 
-	if t.sessionID == nil && ((isClient && contains(serverInit.KexAlgos, kexStrictServer)) || (!isClient && contains(clientInit.KexAlgos, kexStrictClient))) {
+	if t.sessionID == nil && ((isClient && slices.Contains(serverInit.KexAlgos, kexStrictServer)) || (!isClient && slices.Contains(clientInit.KexAlgos, kexStrictClient))) {
 		t.strictMode = true
 		if err := t.conn.setStrictMode(); err != nil {
 			return err
@@ -701,9 +705,9 @@ func (t *handshakeTransport) enterKeyExchange(otherInitPacket []byte) error {
 		}
 	}
 
-	kex, ok := kexAlgoMap[t.algorithms.kex]
+	kex, ok := kexAlgoMap[t.algorithms.KeyExchange]
 	if !ok {
-		return fmt.Errorf("ssh: unexpected key exchange algorithm %v", t.algorithms.kex)
+		return fmt.Errorf("ssh: unexpected key exchange algorithm %v", t.algorithms.KeyExchange)
 	}
 
 	var result *kexResult
@@ -733,7 +737,7 @@ func (t *handshakeTransport) enterKeyExchange(otherInitPacket []byte) error {
 	// On the server side, after the first SSH_MSG_NEWKEYS, send a SSH_MSG_EXT_INFO
 	// message with the server-sig-algs extension if the client supports it. See
 	// RFC 8308, Sections 2.4 and 3.1, and [PROTOCOL], Section 1.9.
-	if !isClient && firstKeyExchange && contains(clientInit.KexAlgos, "ext-info-c") {
+	if !isClient && firstKeyExchange && slices.Contains(clientInit.KexAlgos, "ext-info-c") {
 		supportedPubKeyAuthAlgosList := strings.Join(t.publicKeyAuthAlgorithms, ",")
 		extInfo := &extInfoMsg{
 			NumExtensions: 2,
@@ -787,7 +791,7 @@ func (a algorithmSignerWrapper) SignWithAlgorithm(rand io.Reader, data []byte, a
 func pickHostKey(hostKeys []Signer, algo string) AlgorithmSigner {
 	for _, k := range hostKeys {
 		if s, ok := k.(MultiAlgorithmSigner); ok {
-			if !contains(s.Algorithms(), underlyingAlgo(algo)) {
+			if !slices.Contains(s.Algorithms(), underlyingAlgo(algo)) {
 				continue
 			}
 		}
@@ -810,12 +814,12 @@ func pickHostKey(hostKeys []Signer, algo string) AlgorithmSigner {
 }
 
 func (t *handshakeTransport) server(kex kexAlgorithm, magics *handshakeMagics) (*kexResult, error) {
-	hostKey := pickHostKey(t.hostKeys, t.algorithms.hostKey)
+	hostKey := pickHostKey(t.hostKeys, t.algorithms.HostKey)
 	if hostKey == nil {
 		return nil, errors.New("ssh: internal error: negotiated unsupported signature type")
 	}
 
-	r, err := kex.Server(t.conn, t.config.Rand, magics, hostKey, t.algorithms.hostKey)
+	r, err := kex.Server(t.conn, t.config.Rand, magics, hostKey, t.algorithms.HostKey)
 	return r, err
 }
 
@@ -830,7 +834,7 @@ func (t *handshakeTransport) client(kex kexAlgorithm, magics *handshakeMagics) (
 		return nil, err
 	}
 
-	if err := verifyHostKeySignature(hostKey, t.algorithms.hostKey, result); err != nil {
+	if err := verifyHostKeySignature(hostKey, t.algorithms.HostKey, result); err != nil {
 		return nil, err
 	}
 

ssh/handshake_test.go

@@ -367,7 +367,7 @@ type errorKeyingTransport struct {
 	readLeft, writeLeft int
 }
 
-func (n *errorKeyingTransport) prepareKeyChange(*algorithms, *kexResult) error {
+func (n *errorKeyingTransport) prepareKeyChange(*NegotiatedAlgorithms, *kexResult) error {
 	return nil
 }
 
@@ -545,7 +545,7 @@ type mockKeyingTransport struct {
 	kexInitSent    chan struct{}
 }
 
-func (n *mockKeyingTransport) prepareKeyChange(*algorithms, *kexResult) error {
+func (n *mockKeyingTransport) prepareKeyChange(*NegotiatedAlgorithms, *kexResult) error {
 	return nil
 }
 
@@ -762,7 +762,7 @@ func TestHandshakePendingPacketsError(t *testing.T) {
 func TestHandshakeRekeyDefault(t *testing.T) {
 	clientConf := &ClientConfig{
 		Config: Config{
-			Ciphers: []string{"aes128-ctr"},
+			Ciphers: []string{CipherAES128CTR},
 		},
 		HostKeyCallback: InsecureIgnoreHostKey(),
 	}
@@ -788,7 +788,7 @@ func TestHandshakeRekeyDefault(t *testing.T) {
 }
 
 func TestHandshakeAEADCipherNoMAC(t *testing.T) {
-	for _, cipher := range []string{chacha20Poly1305ID, gcm128CipherID} {
+	for _, cipher := range []string{CipherChaCha20Poly1305, CipherAES128GCM} {
 		checker := &syncChecker{
 			called: make(chan int, 1),
 		}
@@ -1239,3 +1239,128 @@ func TestStrictKEXMixed(t *testing.T) {
 		t.Fatalf("client.waitSession: %v", err)
 	}
 }
+
+func TestNegotiatedAlgorithms(t *testing.T) {
+	c1, c2, err := netPipe()
+	if err != nil {
+		t.Fatalf("netPipe: %v", err)
+	}
+	defer c1.Close()
+	defer c2.Close()
+
+	var serverAlgorithms NegotiatedAlgorithms
+
+	serverConf := &ServerConfig{
+		PasswordCallback: func(conn ConnMetadata, password []byte) (*Permissions, error) {
+			if algorithmConn, ok := conn.(AlgorithmsConnMetadata); ok {
+				serverAlgorithms = algorithmConn.Algorithms()
+				return &Permissions{}, nil
+			}
+			return nil, errors.New("server conn does not implement AlgorithmsConnMetadata")
+		},
+	}
+	serverConf.AddHostKey(testSigners["rsa"])
+	go NewServerConn(c1, serverConf)
+
+	clientConf := &ClientConfig{
+		User:            "test",
+		Auth:            []AuthMethod{Password("testpw")},
+		HostKeyCallback: FixedHostKey(testSigners["rsa"].PublicKey()),
+	}
+
+	if conn, _, _, err := NewClientConn(c2, "", clientConf); err != nil {
+		t.Fatal(err)
+	} else {
+		if algorithmConn, ok := conn.(AlgorithmsConnMetadata); ok {
+			clientAlgorithms := algorithmConn.Algorithms()
+			if clientAlgorithms.HostKey == "" {
+				t.Fatal("negotiated client host key is empty")
+			}
+			if clientAlgorithms.KeyExchange == "" {
+				t.Fatal("negotiated client KEX is empty")
+			}
+			if clientAlgorithms.Read.Cipher == "" {
+				t.Fatal("negotiated client read cipher is empty")
+			}
+			if clientAlgorithms.Write.Cipher == "" {
+				t.Fatal("negotiated client write cipher is empty")
+			}
+			if !reflect.DeepEqual(clientAlgorithms, serverAlgorithms) {
+				t.Fatalf("negotiated client algorithms: %+v differs from negotiated server algorithms: %+v",
+					clientAlgorithms, serverAlgorithms)
+			}
+		} else {
+			t.Fatal("client conn does not implement AlgorithmsConnMetadata")
+		}
+	}
+}
+
+func TestAlgorithmNegotiationError(t *testing.T) {
+	c1, c2, err := netPipe()
+	if err != nil {
+		t.Fatalf("netPipe: %v", err)
+	}
+	defer c1.Close()
+	defer c2.Close()
+
+	serverConf := &ServerConfig{
+		Config: Config{
+			Ciphers: []string{CipherAES128CTR, CipherAES256CTR},
+		},
+		PasswordCallback: func(conn ConnMetadata, password []byte) (*Permissions, error) {
+			return &Permissions{}, nil
+		},
+	}
+	serverConf.AddHostKey(testSigners["rsa"])
+
+	srvErrCh := make(chan error, 1)
+	go func() {
+		_, _, _, err := NewServerConn(c1, serverConf)
+		srvErrCh <- err
+	}()
+
+	clientConf := &ClientConfig{
+		Config: Config{
+			Ciphers: []string{CipherAES128GCM, CipherAES256GCM},
+		},
+		User:            "test",
+		Auth:            []AuthMethod{Password("testpw")},
+		HostKeyCallback: FixedHostKey(testSigners["rsa"].PublicKey()),
+	}
+
+	_, _, _, err = NewClientConn(c2, "", clientConf)
+	if err == nil {
+		t.Fatal("client connection succeeded expected algorithm negotiation error")
+	}
+	var negotiationError *AlgorithmNegotiationError
+	if !errors.As(err, &negotiationError) {
+		t.Fatalf("expected algorithm negotiation error, got %v", err)
+	}
+	expectedErrorString := fmt.Sprintf("ssh: handshake failed: ssh: no common algorithm for client to server cipher; we offered: %v, peer offered: %v",
+		clientConf.Ciphers, serverConf.Ciphers)
+	if err.Error() != expectedErrorString {
+		t.Fatalf("expected error string %q, got %q", expectedErrorString, err.Error())
+	}
+	if !reflect.DeepEqual(negotiationError.RequestedAlgorithms, serverConf.Ciphers) {
+		t.Fatalf("expected requested algorithms %v, got %v", serverConf.Ciphers, negotiationError.RequestedAlgorithms)
+	}
+	if !reflect.DeepEqual(negotiationError.SupportedAlgorithms, clientConf.Ciphers) {
+		t.Fatalf("expected supported algorithms %v, got %v", clientConf.Ciphers, negotiationError.SupportedAlgorithms)
+	}
+	err = <-srvErrCh
+	negotiationError = nil
+	if !errors.As(err, &negotiationError) {
+		t.Fatalf("expected algorithm negotiation error, got %v", err)
+	}
+	expectedErrorString = fmt.Sprintf("ssh: no common algorithm for client to server cipher; we offered: %v, peer offered: %v",
+		serverConf.Ciphers, clientConf.Ciphers)
+	if err.Error() != expectedErrorString {
+		t.Fatalf("expected error string %q, got %q", expectedErrorString, err.Error())
+	}
+	if !reflect.DeepEqual(negotiationError.RequestedAlgorithms, clientConf.Ciphers) {
+		t.Fatalf("expected requested algorithms %v, got %v", clientConf.Ciphers, negotiationError.RequestedAlgorithms)
+	}
+	if !reflect.DeepEqual(negotiationError.SupportedAlgorithms, serverConf.Ciphers) {
+		t.Fatalf("expected supported algorithms %v, got %v", serverConf.Ciphers, negotiationError.SupportedAlgorithms)
+	}
+}

ssh/kex.go

@@ -8,33 +8,31 @@ import (
 	"crypto"
 	"crypto/ecdsa"
 	"crypto/elliptic"
+	"crypto/fips140"
 	"crypto/rand"
-	"crypto/subtle"
 	"encoding/binary"
 	"errors"
 	"fmt"
 	"io"
 	"math/big"
+	"slices"
 
 	"golang.org/x/crypto/curve25519"
 )
 
 const (
-	kexAlgoDH1SHA1                = "diffie-hellman-group1-sha1"
-	kexAlgoDH14SHA1               = "diffie-hellman-group14-sha1"
-	kexAlgoDH14SHA256             = "diffie-hellman-group14-sha256"
-	kexAlgoDH16SHA512             = "diffie-hellman-group16-sha512"
-	kexAlgoECDH256                = "ecdh-sha2-nistp256"
-	kexAlgoECDH384                = "ecdh-sha2-nistp384"
-	kexAlgoECDH521                = "ecdh-sha2-nistp521"
-	kexAlgoCurve25519SHA256LibSSH = "curve25519-sha256@libssh.org"
-	kexAlgoCurve25519SHA256       = "curve25519-sha256"
-
-	// For the following kex only the client half contains a production
-	// ready implementation. The server half only consists of a minimal
-	// implementation to satisfy the automated tests.
-	kexAlgoDHGEXSHA1   = "diffie-hellman-group-exchange-sha1"
-	kexAlgoDHGEXSHA256 = "diffie-hellman-group-exchange-sha256"
+	// This is the group called diffie-hellman-group1-sha1 in RFC 4253 and
+	// Oakley Group 2 in RFC 2409.
+	oakleyGroup2 = "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF"
+	// This is the group called diffie-hellman-group14-sha1 in RFC 4253 and
+	// Oakley Group 14 in RFC 3526.
+	oakleyGroup14 = "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF"
+	// This is the group called diffie-hellman-group15-sha512 in RFC 8268 and
+	// Oakley Group 15 in RFC 3526.
+	oakleyGroup15 = "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF"
+	// This is the group called diffie-hellman-group16-sha512 in RFC 8268 and
+	// Oakley Group 16 in RFC 3526.
+	oakleyGroup16 = "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D788719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA993B4EA988D8FDDC186FFB7DC90A6C08F4DF435C934063199FFFFFFFFFFFFFFFF"
 )
 
 // kexResult captures the outcome of a key exchange.
@@ -399,56 +397,64 @@ func ecHash(curve elliptic.Curve) crypto.Hash {
 	return crypto.SHA512
 }
 
+// kexAlgoMap defines the supported KEXs. KEXs not included are not supported
+// and will not be negotiated, even if explicitly configured. When FIPS mode is
+// enabled, only FIPS-approved algorithms are included.
 var kexAlgoMap = map[string]kexAlgorithm{}
 
 func init() {
-	// This is the group called diffie-hellman-group1-sha1 in
-	// RFC 4253 and Oakley Group 2 in RFC 2409.
-	p, _ := new(big.Int).SetString("FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF", 16)
-	kexAlgoMap[kexAlgoDH1SHA1] = &dhGroup{
+	// mlkem768x25519-sha256 we'll work with fips140=on but not fips140=only
+	// until Go 1.26.
+	kexAlgoMap[KeyExchangeMLKEM768X25519] = &mlkem768WithCurve25519sha256{}
+	kexAlgoMap[KeyExchangeECDHP521] = &ecdh{elliptic.P521()}
+	kexAlgoMap[KeyExchangeECDHP384] = &ecdh{elliptic.P384()}
+	kexAlgoMap[KeyExchangeECDHP256] = &ecdh{elliptic.P256()}
+
+	if fips140.Enabled() {
+		defaultKexAlgos = slices.DeleteFunc(defaultKexAlgos, func(algo string) bool {
+			_, ok := kexAlgoMap[algo]
+			return !ok
+		})
+		return
+	}
+
+	p, _ := new(big.Int).SetString(oakleyGroup2, 16)
+	kexAlgoMap[InsecureKeyExchangeDH1SHA1] = &dhGroup{
 		g:        new(big.Int).SetInt64(2),
 		p:        p,
 		pMinus1:  new(big.Int).Sub(p, bigOne),
 		hashFunc: crypto.SHA1,
 	}
 
-	// This are the groups called diffie-hellman-group14-sha1 and
-	// diffie-hellman-group14-sha256 in RFC 4253 and RFC 8268,
-	// and Oakley Group 14 in RFC 3526.
-	p, _ = new(big.Int).SetString("FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF", 16)
+	p, _ = new(big.Int).SetString(oakleyGroup14, 16)
 	group14 := &dhGroup{
 		g:       new(big.Int).SetInt64(2),
 		p:       p,
 		pMinus1: new(big.Int).Sub(p, bigOne),
 	}
 
-	kexAlgoMap[kexAlgoDH14SHA1] = &dhGroup{
+	kexAlgoMap[InsecureKeyExchangeDH14SHA1] = &dhGroup{
 		g: group14.g, p: group14.p, pMinus1: group14.pMinus1,
 		hashFunc: crypto.SHA1,
 	}
-	kexAlgoMap[kexAlgoDH14SHA256] = &dhGroup{
+	kexAlgoMap[KeyExchangeDH14SHA256] = &dhGroup{
 		g: group14.g, p: group14.p, pMinus1: group14.pMinus1,
 		hashFunc: crypto.SHA256,
 	}
 
-	// This is the group called diffie-hellman-group16-sha512 in RFC
-	// 8268 and Oakley Group 16 in RFC 3526.
-	p, _ = new(big.Int).SetString("FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D788719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA993B4EA988D8FDDC186FFB7DC90A6C08F4DF435C934063199FFFFFFFFFFFFFFFF", 16)
+	p, _ = new(big.Int).SetString(oakleyGroup16, 16)
 
-	kexAlgoMap[kexAlgoDH16SHA512] = &dhGroup{
+	kexAlgoMap[KeyExchangeDH16SHA512] = &dhGroup{
 		g:        new(big.Int).SetInt64(2),
 		p:        p,
 		pMinus1:  new(big.Int).Sub(p, bigOne),
 		hashFunc: crypto.SHA512,
 	}
 
-	kexAlgoMap[kexAlgoECDH521] = &ecdh{elliptic.P521()}
-	kexAlgoMap[kexAlgoECDH384] = &ecdh{elliptic.P384()}
-	kexAlgoMap[kexAlgoECDH256] = &ecdh{elliptic.P256()}
-	kexAlgoMap[kexAlgoCurve25519SHA256] = &curve25519sha256{}
-	kexAlgoMap[kexAlgoCurve25519SHA256LibSSH] = &curve25519sha256{}
-	kexAlgoMap[kexAlgoDHGEXSHA1] = &dhGEXSHA{hashFunc: crypto.SHA1}
-	kexAlgoMap[kexAlgoDHGEXSHA256] = &dhGEXSHA{hashFunc: crypto.SHA256}
+	kexAlgoMap[KeyExchangeCurve25519] = &curve25519sha256{}
+	kexAlgoMap[keyExchangeCurve25519LibSSH] = &curve25519sha256{}
+	kexAlgoMap[InsecureKeyExchangeDHGEXSHA1] = &dhGEXSHA{hashFunc: crypto.SHA1}
+	kexAlgoMap[KeyExchangeDHGEXSHA256] = &dhGEXSHA{hashFunc: crypto.SHA256}
 }
 
 // curve25519sha256 implements the curve25519-sha256 (formerly known as
@@ -464,15 +470,17 @@ func (kp *curve25519KeyPair) generate(rand io.Reader) error {
 	if _, err := io.ReadFull(rand, kp.priv[:]); err != nil {
 		return err
 	}
-	curve25519.ScalarBaseMult(&kp.pub, &kp.priv)
+	p, err := curve25519.X25519(kp.priv[:], curve25519.Basepoint)
+	if err != nil {
+		return fmt.Errorf("curve25519: %w", err)
+	}
+	if len(p) != 32 {
+		return fmt.Errorf("curve25519: internal error: X25519 returned %d bytes, expected 32", len(p))
+	}
+	copy(kp.pub[:], p)
 	return nil
 }
 
-// curve25519Zeros is just an array of 32 zero bytes so that we have something
-// convenient to compare against in order to reject curve25519 points with the
-// wrong order.
-var curve25519Zeros [32]byte
-
 func (kex *curve25519sha256) Client(c packetConn, rand io.Reader, magics *handshakeMagics) (*kexResult, error) {
 	var kp curve25519KeyPair
 	if err := kp.generate(rand); err != nil {
@@ -495,11 +503,9 @@ func (kex *curve25519sha256) Client(c packetConn, rand io.Reader, magics *handsh
 		return nil, errors.New("ssh: peer's curve25519 public value has wrong length")
 	}
 
-	var servPub, secret [32]byte
-	copy(servPub[:], reply.EphemeralPubKey)
-	curve25519.ScalarMult(&secret, &kp.priv, &servPub)
-	if subtle.ConstantTimeCompare(secret[:], curve25519Zeros[:]) == 1 {
-		return nil, errors.New("ssh: peer's curve25519 public value has wrong order")
+	secret, err := curve25519.X25519(kp.priv[:], reply.EphemeralPubKey)
+	if err != nil {
+		return nil, fmt.Errorf("ssh: peer's curve25519 public value is not valid: %w", err)
 	}
 
 	h := crypto.SHA256.New()
@@ -541,11 +547,9 @@ func (kex *curve25519sha256) Server(c packetConn, rand io.Reader, magics *handsh
 		return nil, err
 	}
 
-	var clientPub, secret [32]byte
-	copy(clientPub[:], kexInit.ClientPubKey)
-	curve25519.ScalarMult(&secret, &kp.priv, &clientPub)
-	if subtle.ConstantTimeCompare(secret[:], curve25519Zeros[:]) == 1 {
-		return nil, errors.New("ssh: peer's curve25519 public value has wrong order")
+	secret, err := curve25519.X25519(kp.priv[:], kexInit.ClientPubKey)
+	if err != nil {
+		return nil, fmt.Errorf("ssh: peer's curve25519 public value is not valid: %w", err)
 	}
 
 	hostKeyBytes := priv.PublicKey().Marshal()
@@ -601,9 +605,9 @@ const (
 func (gex *dhGEXSHA) Client(c packetConn, randSource io.Reader, magics *handshakeMagics) (*kexResult, error) {
 	// Send GexRequest
 	kexDHGexRequest := kexDHGexRequestMsg{
-		MinBits:      dhGroupExchangeMinimumBits,
-		PreferedBits: dhGroupExchangePreferredBits,
-		MaxBits:      dhGroupExchangeMaximumBits,
+		MinBits:       dhGroupExchangeMinimumBits,
+		PreferredBits: dhGroupExchangePreferredBits,
+		MaxBits:       dhGroupExchangeMaximumBits,
 	}
 	if err := c.writePacket(Marshal(&kexDHGexRequest)); err != nil {
 		return nil, err
@@ -690,9 +694,7 @@ func (gex *dhGEXSHA) Client(c packetConn, randSource io.Reader, magics *handshak
 }
 
 // Server half implementation of the Diffie Hellman Key Exchange with SHA1 and SHA256.
-//
-// This is a minimal implementation to satisfy the automated tests.
-func (gex dhGEXSHA) Server(c packetConn, randSource io.Reader, magics *handshakeMagics, priv AlgorithmSigner, algo string) (result *kexResult, err error) {
+func (gex *dhGEXSHA) Server(c packetConn, randSource io.Reader, magics *handshakeMagics, priv AlgorithmSigner, algo string) (result *kexResult, err error) {
 	// Receive GexRequest
 	packet, err := c.readPacket()
 	if err != nil {
@@ -702,13 +704,32 @@ func (gex dhGEXSHA) Server(c packetConn, randSource io.Reader, magics *handshake
 	if err = Unmarshal(packet, &kexDHGexRequest); err != nil {
 		return
 	}
+	// We check that the request received is valid and that the MaxBits
+	// requested are at least equal to our supported minimum. This is the same
+	// check done in OpenSSH:
+	// https://github.com/openssh/openssh-portable/blob/80a2f64b/kexgexs.c#L94
+	//
+	// Furthermore, we also check that the required MinBits are less than or
+	// equal to 4096 because we can use up to Oakley Group 16.
+	if kexDHGexRequest.MaxBits < kexDHGexRequest.MinBits || kexDHGexRequest.PreferredBits < kexDHGexRequest.MinBits ||
+		kexDHGexRequest.MaxBits < kexDHGexRequest.PreferredBits || kexDHGexRequest.MaxBits < dhGroupExchangeMinimumBits ||
+		kexDHGexRequest.MinBits > 4096 {
+		return nil, fmt.Errorf("ssh: DH GEX request out of range, min: %d, max: %d, preferred: %d", kexDHGexRequest.MinBits,
+			kexDHGexRequest.MaxBits, kexDHGexRequest.PreferredBits)
+	}
+
+	var p *big.Int
+	// We hardcode sending Oakley Group 14 (2048 bits), Oakley Group 15 (3072
+	// bits) or Oakley Group 16 (4096 bits), based on the requested max size.
+	if kexDHGexRequest.MaxBits < 3072 {
+		p, _ = new(big.Int).SetString(oakleyGroup14, 16)
+	} else if kexDHGexRequest.MaxBits < 4096 {
+		p, _ = new(big.Int).SetString(oakleyGroup15, 16)
+	} else {
+		p, _ = new(big.Int).SetString(oakleyGroup16, 16)
+	}
 
-	// Send GexGroup
-	// This is the group called diffie-hellman-group14-sha1 in RFC
-	// 4253 and Oakley Group 14 in RFC 3526.
-	p, _ := new(big.Int).SetString("FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF", 16)
 	g := big.NewInt(2)
-
 	msg := &kexDHGexGroupMsg{
 		P: p,
 		G: g,
@@ -746,9 +767,9 @@ func (gex dhGEXSHA) Server(c packetConn, randSource io.Reader, magics *handshake
 	h := gex.hashFunc.New()
 	magics.write(h)
 	writeString(h, hostKeyBytes)
-	binary.Write(h, binary.BigEndian, uint32(dhGroupExchangeMinimumBits))
-	binary.Write(h, binary.BigEndian, uint32(dhGroupExchangePreferredBits))
-	binary.Write(h, binary.BigEndian, uint32(dhGroupExchangeMaximumBits))
+	binary.Write(h, binary.BigEndian, kexDHGexRequest.MinBits)
+	binary.Write(h, binary.BigEndian, kexDHGexRequest.PreferredBits)
+	binary.Write(h, binary.BigEndian, kexDHGexRequest.MaxBits)
 	writeInt(h, p)
 	writeInt(h, g)
 	writeInt(h, kexDHGexInit.X)

ssh/keys.go

@@ -27,6 +27,7 @@ import (
 	"fmt"
 	"io"
 	"math/big"
+	"slices"
 	"strings"
 
 	"golang.org/x/crypto/ssh/internal/bcrypt_pbkdf"
@@ -36,14 +37,19 @@ import (
 // ClientConfig.HostKeyAlgorithms, Signature.Format, or as AlgorithmSigner
 // arguments.
 const (
-	KeyAlgoRSA        = "ssh-rsa"
-	KeyAlgoDSA        = "ssh-dss"
-	KeyAlgoECDSA256   = "ecdsa-sha2-nistp256"
-	KeyAlgoSKECDSA256 = "sk-ecdsa-sha2-nistp256@openssh.com"
-	KeyAlgoECDSA384   = "ecdsa-sha2-nistp384"
-	KeyAlgoECDSA521   = "ecdsa-sha2-nistp521"
-	KeyAlgoED25519    = "ssh-ed25519"
-	KeyAlgoSKED25519  = "sk-ssh-ed25519@openssh.com"
+	KeyAlgoRSA = "ssh-rsa"
+	// Deprecated: DSA is only supported at insecure key sizes, and was removed
+	// from major implementations.
+	KeyAlgoDSA = InsecureKeyAlgoDSA
+	// Deprecated: DSA is only supported at insecure key sizes, and was removed
+	// from major implementations.
+	InsecureKeyAlgoDSA = "ssh-dss"
+	KeyAlgoECDSA256    = "ecdsa-sha2-nistp256"
+	KeyAlgoSKECDSA256  = "sk-ecdsa-sha2-nistp256@openssh.com"
+	KeyAlgoECDSA384    = "ecdsa-sha2-nistp384"
+	KeyAlgoECDSA521    = "ecdsa-sha2-nistp521"
+	KeyAlgoED25519     = "ssh-ed25519"
+	KeyAlgoSKED25519   = "sk-ssh-ed25519@openssh.com"
 
 	// KeyAlgoRSASHA256 and KeyAlgoRSASHA512 are only public key algorithms, not
 	// public key formats, so they can't appear as a PublicKey.Type. The
@@ -67,7 +73,7 @@ func parsePubKey(in []byte, algo string) (pubKey PublicKey, rest []byte, err err
 	switch algo {
 	case KeyAlgoRSA:
 		return parseRSA(in)
-	case KeyAlgoDSA:
+	case InsecureKeyAlgoDSA:
 		return parseDSA(in)
 	case KeyAlgoECDSA256, KeyAlgoECDSA384, KeyAlgoECDSA521:
 		return parseECDSA(in)
@@ -77,13 +83,18 @@ func parsePubKey(in []byte, algo string) (pubKey PublicKey, rest []byte, err err
 		return parseED25519(in)
 	case KeyAlgoSKED25519:
 		return parseSKEd25519(in)
-	case CertAlgoRSAv01, CertAlgoDSAv01, CertAlgoECDSA256v01, CertAlgoECDSA384v01, CertAlgoECDSA521v01, CertAlgoSKECDSA256v01, CertAlgoED25519v01, CertAlgoSKED25519v01:
+	case CertAlgoRSAv01, InsecureCertAlgoDSAv01, CertAlgoECDSA256v01, CertAlgoECDSA384v01, CertAlgoECDSA521v01, CertAlgoSKECDSA256v01, CertAlgoED25519v01, CertAlgoSKED25519v01:
 		cert, err := parseCert(in, certKeyAlgoNames[algo])
 		if err != nil {
 			return nil, nil, err
 		}
 		return cert, nil, nil
 	}
+	if keyFormat := keyFormatForAlgorithm(algo); keyFormat != "" {
+		return nil, nil, fmt.Errorf("ssh: signature algorithm %q isn't a key format; key is malformed and should be re-encoded with type %q",
+			algo, keyFormat)
+	}
+
 	return nil, nil, fmt.Errorf("ssh: unknown key algorithm: %v", algo)
 }
 
@@ -186,9 +197,10 @@ func ParseKnownHosts(in []byte) (marker string, hosts []string, pubKey PublicKey
 	return "", nil, nil, "", nil, io.EOF
 }
 
-// ParseAuthorizedKey parses a public key from an authorized_keys
-// file used in OpenSSH according to the sshd(8) manual page.
+// ParseAuthorizedKey parses a public key from an authorized_keys file used in
+// OpenSSH according to the sshd(8) manual page. Invalid lines are ignored.
 func ParseAuthorizedKey(in []byte) (out PublicKey, comment string, options []string, rest []byte, err error) {
+	var lastErr error
 	for len(in) > 0 {
 		end := bytes.IndexByte(in, '\n')
 		if end != -1 {
@@ -217,6 +229,8 @@ func ParseAuthorizedKey(in []byte) (out PublicKey, comment string, options []str
 
 		if out, comment, err = parseAuthorizedKey(in[i:]); err == nil {
 			return out, comment, options, rest, nil
+		} else {
+			lastErr = err
 		}
 
 		// No key type recognised. Maybe there's an options field at
@@ -259,16 +273,22 @@ func ParseAuthorizedKey(in []byte) (out PublicKey, comment string, options []str
 		if out, comment, err = parseAuthorizedKey(in[i:]); err == nil {
 			options = candidateOptions
 			return out, comment, options, rest, nil
+		} else {
+			lastErr = err
 		}
 
 		in = rest
 		continue
 	}
 
+	if lastErr != nil {
+		return nil, "", nil, nil, fmt.Errorf("ssh: no key found; last parsing error for ignored line: %w", lastErr)
+	}
+
 	return nil, "", nil, nil, errors.New("ssh: no key found")
 }
 
-// ParsePublicKey parses an SSH public key formatted for use in
+// ParsePublicKey parses an SSH public key or certificate formatted for use in
 // the SSH wire protocol according to RFC 4253, section 6.6.
 func ParsePublicKey(in []byte) (out PublicKey, err error) {
 	algo, in, ok := parseString(in)
@@ -390,11 +410,11 @@ func NewSignerWithAlgorithms(signer AlgorithmSigner, algorithms []string) (Multi
 	}
 
 	for _, algo := range algorithms {
-		if !contains(supportedAlgos, algo) {
+		if !slices.Contains(supportedAlgos, algo) {
 			return nil, fmt.Errorf("ssh: algorithm %q is not supported for key type %q",
 				algo, signer.PublicKey().Type())
 		}
-		if !contains(signerAlgos, algo) {
+		if !slices.Contains(signerAlgos, algo) {
 			return nil, fmt.Errorf("ssh: algorithm %q is restricted for the provided signer", algo)
 		}
 	}
@@ -481,10 +501,13 @@ func (r *rsaPublicKey) Marshal() []byte {
 
 func (r *rsaPublicKey) Verify(data []byte, sig *Signature) error {
 	supportedAlgos := algorithmsForKeyFormat(r.Type())
-	if !contains(supportedAlgos, sig.Format) {
+	if !slices.Contains(supportedAlgos, sig.Format) {
 		return fmt.Errorf("ssh: signature type %s for key type %s", sig.Format, r.Type())
 	}
-	hash := hashFuncs[sig.Format]
+	hash, err := hashFunc(sig.Format)
+	if err != nil {
+		return err
+	}
 	h := hash.New()
 	h.Write(data)
 	digest := h.Sum(nil)
@@ -601,7 +624,11 @@ func (k *dsaPublicKey) Verify(data []byte, sig *Signature) error {
 	if sig.Format != k.Type() {
 		return fmt.Errorf("ssh: signature type %s for key type %s", sig.Format, k.Type())
 	}
-	h := hashFuncs[sig.Format].New()
+	hash, err := hashFunc(sig.Format)
+	if err != nil {
+		return err
+	}
+	h := hash.New()
 	h.Write(data)
 	digest := h.Sum(nil)
 
@@ -646,7 +673,11 @@ func (k *dsaPrivateKey) SignWithAlgorithm(rand io.Reader, data []byte, algorithm
 		return nil, fmt.Errorf("ssh: unsupported signature algorithm %s", algorithm)
 	}
 
-	h := hashFuncs[k.PublicKey().Type()].New()
+	hash, err := hashFunc(k.PublicKey().Type())
+	if err != nil {
+		return nil, err
+	}
+	h := hash.New()
 	h.Write(data)
 	digest := h.Sum(nil)
 	r, s, err := dsa.Sign(rand, k.PrivateKey, digest)
@@ -796,8 +827,11 @@ func (k *ecdsaPublicKey) Verify(data []byte, sig *Signature) error {
 	if sig.Format != k.Type() {
 		return fmt.Errorf("ssh: signature type %s for key type %s", sig.Format, k.Type())
 	}
-
-	h := hashFuncs[sig.Format].New()
+	hash, err := hashFunc(sig.Format)
+	if err != nil {
+		return err
+	}
+	h := hash.New()
 	h.Write(data)
 	digest := h.Sum(nil)
 
@@ -900,8 +934,11 @@ func (k *skECDSAPublicKey) Verify(data []byte, sig *Signature) error {
 	if sig.Format != k.Type() {
 		return fmt.Errorf("ssh: signature type %s for key type %s", sig.Format, k.Type())
 	}
-
-	h := hashFuncs[sig.Format].New()
+	hash, err := hashFunc(sig.Format)
+	if err != nil {
+		return err
+	}
+	h := hash.New()
 	h.Write([]byte(k.application))
 	appDigest := h.Sum(nil)
 
@@ -1004,7 +1041,11 @@ func (k *skEd25519PublicKey) Verify(data []byte, sig *Signature) error {
 		return fmt.Errorf("invalid size %d for Ed25519 public key", l)
 	}
 
-	h := hashFuncs[sig.Format].New()
+	hash, err := hashFunc(sig.Format)
+	if err != nil {
+		return err
+	}
+	h := hash.New()
 	h.Write([]byte(k.application))
 	appDigest := h.Sum(nil)
 
@@ -1107,11 +1148,14 @@ func (s *wrappedSigner) SignWithAlgorithm(rand io.Reader, data []byte, algorithm
 		algorithm = s.pubKey.Type()
 	}
 
-	if !contains(s.Algorithms(), algorithm) {
+	if !slices.Contains(s.Algorithms(), algorithm) {
 		return nil, fmt.Errorf("ssh: unsupported signature algorithm %q for key format %q", algorithm, s.pubKey.Type())
 	}
 
-	hashFunc := hashFuncs[algorithm]
+	hashFunc, err := hashFunc(algorithm)
+	if err != nil {
+		return nil, err
+	}
 	var digest []byte
 	if hashFunc != 0 {
 		h := hashFunc.New()

ssh/keys_test.go

@@ -59,6 +59,17 @@ func TestKeyMarshalParse(t *testing.T) {
 	}
 }
 
+func TestParsePublicKeyWithSigningAlgoAsKeyFormat(t *testing.T) {
+	key := []byte(`rsa-sha2-256 AAAADHJzYS1zaGEyLTI1NgAAAAMBAAEAAAEBAJ7qMyjLXEJCCJmRknuCLo0uPi5GrPY5pQYr84lhlN8Gor5KVL2LKYCW4e70r5xzj7SrHHSCft1FMlYg1KDO9xrprJh733kQqAPWETmSuH0EfRtGtcH6EarKyVxk6As076/yNiiMKVBtG0RPa1L7FviTfcYK4vnCCVrbv3RmA5CCzuG5BSMbRLxzVb4Ri3p8jhxYT8N4QGe/2yqvJLys5vQ9szpZR3tcFp3DJIVZhBRfR6LnoY23XZniAAMQaUVBX86dXQ++dNwAwZSXSt9Og+AniOCiBYqhNVa5n3DID/H7YtEtG+CbZr3r2KD3fv8AfSLRar4XOp8rsRdD31h/kr8=`)
+	_, _, _, _, err := ParseAuthorizedKey(key)
+	if err == nil {
+		t.Fatal("parsing a public key using a signature algorithm as the key format succeeded unexpectedly")
+	}
+	if !strings.Contains(err.Error(), `signature algorithm "rsa-sha2-256" isn't a key format`) {
+		t.Errorf(`got %v, expected 'signature algorithm "rsa-sha2-256" isn't a key format'`, err)
+	}
+}
+
 func TestUnsupportedCurves(t *testing.T) {
 	raw, err := ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
 	if err != nil {
@@ -810,3 +821,30 @@ func TestCryptoPublicKey(t *testing.T) {
 		}
 	}
 }
+
+func TestParseCertWithCertSignatureKey(t *testing.T) {
+	certBytes := []byte(`-----BEGIN SSH CERTIFICATE-----
+AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIPSp27hvNSB0
+IotJnVhjC4zxNgNS8BHlUCxD0VJi4D/eAAAAIIJMi1e5qfx+IFuKD/p/Ssqcb3os
+CpOw/4wBs1pQ53zwAAAAAAAAAAEAAAACAAAAAAAAABMAAAAPZm9vLmV4YW1wbGUu
+Y29tAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAT0AAAAgc3NoLWVkMjU1
+MTktY2VydC12MDFAb3BlbnNzaC5jb20AAAAg+sNYhCO35mQT1UBMpmMk8ey+culd
+IU8vBlPEl4B07swAAAAggiv+RLnboS4znGCVl/n1jDg2uD0h15tW4s/04eS2mLQA
+AAAAAAAAAQAAAAIAAAAAAAAAEwAAAA9mb28uZXhhbXBsZS5jb20AAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAMwAAAAtzc2gtZWQyNTUxOQAAACCV2wETgLKL
+Kt0bRl3YUnd/ZYSlq0xJMbn4Jj3cdPWykQAAAFMAAAALc3NoLWVkMjU1MTkAAABA
+WOdbRGEzyRAhiIK227CLUQD5caXYMV8FvSIB7toEE2M/8HnWdG9H3Rsg/v3unruQ
+JrQldnuPJNe7KOP2+zvUDgAAAFMAAAALc3NoLWVkMjU1MTkAAABAm3bIPp85ZpIe
+D+izJcUqlcAOri7HO8bULFNHT6LVegvB06xQ5TLwMlrxWUF4cafl1tSe8JQck4a6
+cLYUOHfQDw==
+-----END SSH CERTIFICATE-----
+	`)
+	block, _ := pem.Decode(certBytes)
+	if block == nil {
+		t.Fatal("invalid test certificate")
+	}
+
+	if _, err := ParsePublicKey(block.Bytes); err == nil {
+		t.Fatal("parsing an SSH certificate using another certificate as signature key succeeded; expected failure")
+	}
+}

ssh/knownhosts/knownhosts.go

@@ -302,8 +302,8 @@ func (k *KnownKey) String() string {
 // applications can offer an interactive prompt to the user.
 type KeyError struct {
 	// Want holds the accepted host keys. For each key algorithm,
-	// there can be one hostkey.  If Want is empty, the host is
-	// unknown. If Want is non-empty, there was a mismatch, which
+	// there can be multiple hostkeys.  If Want is empty, the host
+	// is unknown. If Want is non-empty, there was a mismatch, which
 	// can signify a MITM attack.
 	Want []KnownKey
 }
@@ -358,34 +358,20 @@ func (db *hostKeyDB) checkAddr(a addr, remoteKey ssh.PublicKey) error {
 	// is just a key for the IP address, but not for the
 	// hostname?
 
-	// Algorithm => key.
-	knownKeys := map[string]KnownKey{}
+	keyErr := &KeyError{}
+
 	for _, l := range db.lines {
-		if l.match(a) {
-			typ := l.knownKey.Key.Type()
-			if _, ok := knownKeys[typ]; !ok {
-				knownKeys[typ] = l.knownKey
-			}
+		if !l.match(a) {
+			continue
+		}
+
+		keyErr.Want = append(keyErr.Want, l.knownKey)
+		if keyEq(l.knownKey.Key, remoteKey) {
+			return nil
 		}
 	}
 
-	keyErr := &KeyError{}
-	for _, v := range knownKeys {
-		keyErr.Want = append(keyErr.Want, v)
-	}
-
-	// Unknown remote host.
-	if len(knownKeys) == 0 {
-		return keyErr
-	}
-
-	// If the remote host starts using a different, unknown key type, we
-	// also interpret that as a mismatch.
-	if known, ok := knownKeys[remoteKey.Type()]; !ok || !keyEq(known.Key, remoteKey) {
-		return keyErr
-	}
-
-	return nil
+	return keyErr
 }
 
 // The Read function parses file contents.
@@ -435,20 +421,26 @@ func New(files ...string) (ssh.HostKeyCallback, error) {
 	return certChecker.CheckHostKey, nil
 }
 
-// Normalize normalizes an address into the form used in known_hosts
+// Normalize normalizes an address into the form used in known_hosts. Supports
+// IPv4, hostnames, bracketed IPv6. Any other non-standard formats are returned
+// with minimal transformation.
 func Normalize(address string) string {
+	const defaultSSHPort = "22"
+
 	host, port, err := net.SplitHostPort(address)
 	if err != nil {
 		host = address
-		port = "22"
+		port = defaultSSHPort
 	}
-	entry := host
-	if port != "22" {
-		entry = "[" + entry + "]:" + port
-	} else if strings.Contains(host, ":") && !strings.HasPrefix(host, "[") {
-		entry = "[" + entry + "]"
+
+	if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") {
+		host = host[1 : len(host)-1]
 	}
-	return entry
+
+	if port == defaultSSHPort {
+		return host
+	}
+	return "[" + host + "]:" + port
 }
 
 // Line returns a line to add append to the known_hosts files.

ssh/knownhosts/knownhosts_test.go

@@ -201,17 +201,6 @@ func TestHostNamePrecedence(t *testing.T) {
 	}
 }
 
-func TestDBOrderingPrecedenceKeyType(t *testing.T) {
-	str := fmt.Sprintf("server.org,%s %s\nserver.org,%s %s", testAddr, edKeyStr, testAddr, alternateEdKeyStr)
-	db := testDB(t, str)
-
-	if err := db.check("server.org:22", testAddr, alternateEdKey); err == nil {
-		t.Errorf("check succeeded")
-	} else if _, ok := err.(*KeyError); !ok {
-		t.Errorf("got %T, want *KeyError", err)
-	}
-}
-
 func TestNegate(t *testing.T) {
 	str := fmt.Sprintf("%s,!server.org %s", testAddr, edKeyStr)
 	db := testDB(t, str)
@@ -247,7 +236,7 @@ func TestLine(t *testing.T) {
 		"server.org":                             "server.org " + edKeyStr,
 		"server.org:22":                          "server.org " + edKeyStr,
 		"server.org:23":                          "[server.org]:23 " + edKeyStr,
-		"[c629:1ec4:102:304:102:304:102:304]:22": "[c629:1ec4:102:304:102:304:102:304] " + edKeyStr,
+		"[c629:1ec4:102:304:102:304:102:304]:22": "c629:1ec4:102:304:102:304:102:304 " + edKeyStr,
 		"[c629:1ec4:102:304:102:304:102:304]:23": "[c629:1ec4:102:304:102:304:102:304]:23 " + edKeyStr,
 	} {
 		if got := Line([]string{in}, edKey); got != want {
@@ -321,14 +310,25 @@ func testHostHash(t *testing.T, hostname, encoded string) {
 
 func TestNormalize(t *testing.T) {
 	for in, want := range map[string]string{
-		"127.0.0.1:22":             "127.0.0.1",
-		"[127.0.0.1]:22":           "127.0.0.1",
-		"[127.0.0.1]:23":           "[127.0.0.1]:23",
-		"127.0.0.1:23":             "[127.0.0.1]:23",
-		"[a.b.c]:22":               "a.b.c",
-		"[abcd:abcd:abcd:abcd]":    "[abcd:abcd:abcd:abcd]",
-		"[abcd:abcd:abcd:abcd]:22": "[abcd:abcd:abcd:abcd]",
-		"[abcd:abcd:abcd:abcd]:23": "[abcd:abcd:abcd:abcd]:23",
+		"127.0.0.1":                 "127.0.0.1",
+		"127.0.0.1:22":              "127.0.0.1",
+		"[127.0.0.1]:22":            "127.0.0.1",
+		"[127.0.0.1]:23":            "[127.0.0.1]:23",
+		"127.0.0.1:23":              "[127.0.0.1]:23",
+		"[a.b.c]:22":                "a.b.c",
+		"[a.b.c]:23":                "[a.b.c]:23",
+		"abcd::abcd:abcd:abcd":      "abcd::abcd:abcd:abcd",
+		"[abcd::abcd:abcd:abcd]":    "abcd::abcd:abcd:abcd",
+		"[abcd::abcd:abcd:abcd]:22": "abcd::abcd:abcd:abcd",
+		"[abcd::abcd:abcd:abcd]:23": "[abcd::abcd:abcd:abcd]:23",
+		"2001:db8::1":               "2001:db8::1",
+		"2001:db8::1:22":            "2001:db8::1:22",
+		"[2001:db8::1]:22":          "2001:db8::1",
+		"2001:db8::1:2200":          "2001:db8::1:2200",
+		"a.b.c.d.com:2200":          "[a.b.c.d.com]:2200",
+		"2001::db8:1":               "2001::db8:1",
+		"2001::db8:1:22":            "2001::db8:1:22",
+		"2001::db8:1:2200":          "2001::db8:1:2200",
 	} {
 		got := Normalize(in)
 		if got != want {
@@ -354,3 +354,16 @@ func TestHashedHostkeyCheck(t *testing.T) {
 		t.Errorf("got error %v, want %v", got, want)
 	}
 }
+
+func TestIssue36126(t *testing.T) {
+	str := fmt.Sprintf("server.org,%s %s\nserver.org,%s %s", testAddr, edKeyStr, testAddr, alternateEdKeyStr)
+	db := testDB(t, str)
+
+	if err := db.check("server.org:22", testAddr, edKey); err != nil {
+		t.Errorf("should have passed the check, got %v", err)
+	}
+
+	if err := db.check("server.org:22", testAddr, alternateEdKey); err != nil {
+		t.Errorf("should have passed the check, got %v", err)
+	}
+}

ssh/mac.go

@@ -7,11 +7,13 @@ package ssh
 // Message authentication support
 
 import (
+	"crypto/fips140"
 	"crypto/hmac"
 	"crypto/sha1"
 	"crypto/sha256"
 	"crypto/sha512"
 	"hash"
+	"slices"
 )
 
 type macMode struct {
@@ -46,23 +48,37 @@ func (t truncatingMAC) Size() int {
 
 func (t truncatingMAC) BlockSize() int { return t.hmac.BlockSize() }
 
-var macModes = map[string]*macMode{
-	"hmac-sha2-512-etm@openssh.com": {64, true, func(key []byte) hash.Hash {
+// macModes defines the supported MACs. MACs not included are not supported
+// and will not be negotiated, even if explicitly configured. When FIPS mode is
+// enabled, only FIPS-approved algorithms are included.
+var macModes = map[string]*macMode{}
+
+func init() {
+	macModes[HMACSHA512ETM] = &macMode{64, true, func(key []byte) hash.Hash {
 		return hmac.New(sha512.New, key)
-	}},
-	"hmac-sha2-256-etm@openssh.com": {32, true, func(key []byte) hash.Hash {
+	}}
+	macModes[HMACSHA256ETM] = &macMode{32, true, func(key []byte) hash.Hash {
 		return hmac.New(sha256.New, key)
-	}},
-	"hmac-sha2-512": {64, false, func(key []byte) hash.Hash {
+	}}
+	macModes[HMACSHA512] = &macMode{64, false, func(key []byte) hash.Hash {
 		return hmac.New(sha512.New, key)
-	}},
-	"hmac-sha2-256": {32, false, func(key []byte) hash.Hash {
+	}}
+	macModes[HMACSHA256] = &macMode{32, false, func(key []byte) hash.Hash {
 		return hmac.New(sha256.New, key)
-	}},
-	"hmac-sha1": {20, false, func(key []byte) hash.Hash {
+	}}
+
+	if fips140.Enabled() {
+		defaultMACs = slices.DeleteFunc(defaultMACs, func(algo string) bool {
+			_, ok := macModes[algo]
+			return !ok
+		})
+		return
+	}
+
+	macModes[HMACSHA1] = &macMode{20, false, func(key []byte) hash.Hash {
 		return hmac.New(sha1.New, key)
-	}},
-	"hmac-sha1-96": {20, false, func(key []byte) hash.Hash {
+	}}
+	macModes[InsecureHMACSHA196] = &macMode{20, false, func(key []byte) hash.Hash {
 		return truncatingMAC{12, hmac.New(sha1.New, key)}
-	}},
+	}}
 }

ssh/messages.go

@@ -122,9 +122,9 @@ type kexDHGexReplyMsg struct {
 const msgKexDHGexRequest = 34
 
 type kexDHGexRequestMsg struct {
-	MinBits      uint32 `sshtype:"34"`
-	PreferedBits uint32
-	MaxBits      uint32
+	MinBits       uint32 `sshtype:"34"`
+	PreferredBits uint32
+	MaxBits       uint32
 }
 
 // See RFC 4253, section 10.
@@ -792,7 +792,7 @@ func marshalString(to []byte, s []byte) []byte {
 	return to[len(s):]
 }
 
-var bigIntType = reflect.TypeOf((*big.Int)(nil))
+var bigIntType = reflect.TypeFor[*big.Int]()
 
 // Decode a packet into its corresponding message.
 func decode(packet []byte) (interface{}, error) {
@@ -818,6 +818,8 @@ func decode(packet []byte) (interface{}, error) {
 		return new(userAuthSuccessMsg), nil
 	case msgUserAuthFailure:
 		msg = new(userAuthFailureMsg)
+	case msgUserAuthBanner:
+		msg = new(userAuthBannerMsg)
 	case msgUserAuthPubKeyOk:
 		msg = new(userAuthPubKeyOkMsg)
 	case msgGlobalRequest:

ssh/messages_test.go

@@ -206,6 +206,62 @@ func TestMarshalMultiTag(t *testing.T) {
 	}
 }
 
+func TestDecode(t *testing.T) {
+	rnd := rand.New(rand.NewSource(0))
+	kexInit := new(kexInitMsg).Generate(rnd, 10).Interface()
+	kexDHInit := new(kexDHInitMsg).Generate(rnd, 10).Interface()
+	kexDHReply := new(kexDHReplyMsg)
+	kexDHReply.Y = randomInt(rnd)
+	// Note: userAuthSuccessMsg can't be tested directly since it
+	// doesn't have a field for sshtype. So it's tested separately
+	// at the end.
+	decodeMessageTypes := []interface{}{
+		new(disconnectMsg),
+		new(serviceRequestMsg),
+		new(serviceAcceptMsg),
+		new(extInfoMsg),
+		kexInit,
+		kexDHInit,
+		kexDHReply,
+		new(userAuthRequestMsg),
+		new(userAuthFailureMsg),
+		new(userAuthBannerMsg),
+		new(userAuthPubKeyOkMsg),
+		new(globalRequestMsg),
+		new(globalRequestSuccessMsg),
+		new(globalRequestFailureMsg),
+		new(channelOpenMsg),
+		new(channelDataMsg),
+		new(channelOpenConfirmMsg),
+		new(channelOpenFailureMsg),
+		new(windowAdjustMsg),
+		new(channelEOFMsg),
+		new(channelCloseMsg),
+		new(channelRequestMsg),
+		new(channelRequestSuccessMsg),
+		new(channelRequestFailureMsg),
+		new(userAuthGSSAPIToken),
+		new(userAuthGSSAPIMIC),
+		new(userAuthGSSAPIErrTok),
+		new(userAuthGSSAPIError),
+	}
+	for _, msg := range decodeMessageTypes {
+		decoded, err := decode(Marshal(msg))
+		if err != nil {
+			t.Errorf("error decoding %T", msg)
+		} else if reflect.TypeOf(msg) != reflect.TypeOf(decoded) {
+			t.Errorf("error decoding %T, unexpected %T", msg, decoded)
+		}
+	}
+
+	userAuthSuccess, err := decode([]byte{msgUserAuthSuccess})
+	if err != nil {
+		t.Errorf("error decoding userAuthSuccessMsg")
+	} else if _, ok := userAuthSuccess.(*userAuthSuccessMsg); !ok {
+		t.Errorf("error decoding userAuthSuccessMsg, unexpected %T", userAuthSuccess)
+	}
+}
+
 func randomBytes(out []byte, rand *rand.Rand) {
 	for i := 0; i < len(out); i++ {
 		out[i] = byte(rand.Int31())

ssh/mlkem.go

@@ -0,0 +1,168 @@
+// Copyright 2024 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package ssh
+
+import (
+	"crypto"
+	"crypto/mlkem"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"io"
+
+	"golang.org/x/crypto/curve25519"
+)
+
+// mlkem768WithCurve25519sha256 implements the hybrid ML-KEM768 with
+// curve25519-sha256 key exchange method, as described by
+// draft-kampanakis-curdle-ssh-pq-ke-05 section 2.3.3.
+type mlkem768WithCurve25519sha256 struct{}
+
+func (kex *mlkem768WithCurve25519sha256) Client(c packetConn, rand io.Reader, magics *handshakeMagics) (*kexResult, error) {
+	var c25519kp curve25519KeyPair
+	if err := c25519kp.generate(rand); err != nil {
+		return nil, err
+	}
+
+	seed := make([]byte, mlkem.SeedSize)
+	if _, err := io.ReadFull(rand, seed); err != nil {
+		return nil, err
+	}
+
+	mlkemDk, err := mlkem.NewDecapsulationKey768(seed)
+	if err != nil {
+		return nil, err
+	}
+
+	hybridKey := append(mlkemDk.EncapsulationKey().Bytes(), c25519kp.pub[:]...)
+	if err := c.writePacket(Marshal(&kexECDHInitMsg{hybridKey})); err != nil {
+		return nil, err
+	}
+
+	packet, err := c.readPacket()
+	if err != nil {
+		return nil, err
+	}
+
+	var reply kexECDHReplyMsg
+	if err = Unmarshal(packet, &reply); err != nil {
+		return nil, err
+	}
+
+	if len(reply.EphemeralPubKey) != mlkem.CiphertextSize768+32 {
+		return nil, errors.New("ssh: peer's mlkem768x25519 public value has wrong length")
+	}
+
+	// Perform KEM decapsulate operation to obtain shared key from ML-KEM.
+	mlkem768Secret, err := mlkemDk.Decapsulate(reply.EphemeralPubKey[:mlkem.CiphertextSize768])
+	if err != nil {
+		return nil, err
+	}
+
+	// Complete Curve25519 ECDH to obtain its shared key.
+	c25519Secret, err := curve25519.X25519(c25519kp.priv[:], reply.EphemeralPubKey[mlkem.CiphertextSize768:])
+	if err != nil {
+		return nil, fmt.Errorf("ssh: peer's mlkem768x25519 public value is not valid: %w", err)
+	}
+	// Compute actual shared key.
+	h := sha256.New()
+	h.Write(mlkem768Secret)
+	h.Write(c25519Secret)
+	secret := h.Sum(nil)
+
+	h.Reset()
+	magics.write(h)
+	writeString(h, reply.HostKey)
+	writeString(h, hybridKey)
+	writeString(h, reply.EphemeralPubKey)
+
+	K := make([]byte, stringLength(len(secret)))
+	marshalString(K, secret)
+	h.Write(K)
+
+	return &kexResult{
+		H:         h.Sum(nil),
+		K:         K,
+		HostKey:   reply.HostKey,
+		Signature: reply.Signature,
+		Hash:      crypto.SHA256,
+	}, nil
+}
+
+func (kex *mlkem768WithCurve25519sha256) Server(c packetConn, rand io.Reader, magics *handshakeMagics, priv AlgorithmSigner, algo string) (*kexResult, error) {
+	packet, err := c.readPacket()
+	if err != nil {
+		return nil, err
+	}
+
+	var kexInit kexECDHInitMsg
+	if err = Unmarshal(packet, &kexInit); err != nil {
+		return nil, err
+	}
+
+	if len(kexInit.ClientPubKey) != mlkem.EncapsulationKeySize768+32 {
+		return nil, errors.New("ssh: peer's ML-KEM768/curve25519 public value has wrong length")
+	}
+
+	encapsulationKey, err := mlkem.NewEncapsulationKey768(kexInit.ClientPubKey[:mlkem.EncapsulationKeySize768])
+	if err != nil {
+		return nil, fmt.Errorf("ssh: peer's ML-KEM768 encapsulation key is not valid: %w", err)
+	}
+	// Perform KEM encapsulate operation to obtain ciphertext and shared key.
+	mlkem768Secret, mlkem768Ciphertext := encapsulationKey.Encapsulate()
+
+	// Perform server side of Curve25519 ECDH to obtain server public value and
+	// shared key.
+	var c25519kp curve25519KeyPair
+	if err := c25519kp.generate(rand); err != nil {
+		return nil, err
+	}
+	c25519Secret, err := curve25519.X25519(c25519kp.priv[:], kexInit.ClientPubKey[mlkem.EncapsulationKeySize768:])
+	if err != nil {
+		return nil, fmt.Errorf("ssh: peer's ML-KEM768/curve25519 public value is not valid: %w", err)
+	}
+	hybridKey := append(mlkem768Ciphertext, c25519kp.pub[:]...)
+
+	// Compute actual shared key.
+	h := sha256.New()
+	h.Write(mlkem768Secret)
+	h.Write(c25519Secret)
+	secret := h.Sum(nil)
+
+	hostKeyBytes := priv.PublicKey().Marshal()
+
+	h.Reset()
+	magics.write(h)
+	writeString(h, hostKeyBytes)
+	writeString(h, kexInit.ClientPubKey)
+	writeString(h, hybridKey)
+
+	K := make([]byte, stringLength(len(secret)))
+	marshalString(K, secret)
+	h.Write(K)
+
+	H := h.Sum(nil)
+
+	sig, err := signAndMarshal(priv, rand, H, algo)
+	if err != nil {
+		return nil, err
+	}
+
+	reply := kexECDHReplyMsg{
+		EphemeralPubKey: hybridKey,
+		HostKey:         hostKeyBytes,
+		Signature:       sig,
+	}
+	if err := c.writePacket(Marshal(&reply)); err != nil {
+		return nil, err
+	}
+	return &kexResult{
+		H:         H,
+		K:         K,
+		HostKey:   hostKeyBytes,
+		Signature: sig,
+		Hash:      crypto.SHA256,
+	}, nil
+}

ssh/server.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"slices"
 	"strings"
 )
 
@@ -43,6 +44,9 @@ type Permissions struct {
 	// pass data from the authentication callbacks to the server
 	// application layer.
 	Extensions map[string]string
+
+	// ExtraData allows to store user defined data.
+	ExtraData map[any]any
 }
 
 type GSSAPIWithMICConfig struct {
@@ -126,6 +130,21 @@ type ServerConfig struct {
 	// Permissions.Extensions entry.
 	PublicKeyCallback func(conn ConnMetadata, key PublicKey) (*Permissions, error)
 
+	// VerifiedPublicKeyCallback, if non-nil, is called after a client
+	// successfully confirms having control over a key that was previously
+	// approved by PublicKeyCallback. The permissions object passed to the
+	// callback is the one returned by PublicKeyCallback for the given public
+	// key and its ownership is transferred to the callback. The returned
+	// Permissions object can be the same object, optionally modified, or a
+	// completely new object. If VerifiedPublicKeyCallback is non-nil,
+	// PublicKeyCallback is not allowed to return a PartialSuccessError, which
+	// can instead be returned by VerifiedPublicKeyCallback.
+	//
+	// VerifiedPublicKeyCallback does not affect which authentication methods
+	// are included in the list of methods that can be attempted by the client.
+	VerifiedPublicKeyCallback func(conn ConnMetadata, key PublicKey, permissions *Permissions,
+		signatureAlgorithm string) (*Permissions, error)
+
 	// KeyboardInteractiveCallback, if non-nil, is called when
 	// keyboard-interactive authentication is selected (RFC
 	// 4256). The client object's Challenge function should be
@@ -243,22 +262,15 @@ func NewServerConn(c net.Conn, config *ServerConfig) (*ServerConn, <-chan NewCha
 		fullConf.MaxAuthTries = 6
 	}
 	if len(fullConf.PublicKeyAuthAlgorithms) == 0 {
-		fullConf.PublicKeyAuthAlgorithms = supportedPubKeyAuthAlgos
+		fullConf.PublicKeyAuthAlgorithms = defaultPubKeyAuthAlgos
 	} else {
 		for _, algo := range fullConf.PublicKeyAuthAlgorithms {
-			if !contains(supportedPubKeyAuthAlgos, algo) {
+			if !slices.Contains(SupportedAlgorithms().PublicKeyAuths, algo) && !slices.Contains(InsecureAlgorithms().PublicKeyAuths, algo) {
 				c.Close()
 				return nil, nil, nil, fmt.Errorf("ssh: unsupported public key authentication algorithm %s", algo)
 			}
 		}
 	}
-	// Check if the config contains any unsupported key exchanges
-	for _, kex := range fullConf.KeyExchanges {
-		if _, ok := serverForbiddenKexAlgos[kex]; ok {
-			c.Close()
-			return nil, nil, nil, fmt.Errorf("ssh: unsupported key exchange %s for server", kex)
-		}
-	}
 
 	s := &connection{
 		sshConn: sshConn{conn: c},
@@ -315,6 +327,7 @@ func (s *connection) serverHandshake(config *ServerConfig) (*Permissions, error)
 
 	// We just did the key change, so the session ID is established.
 	s.sessionID = s.transport.getSessionID()
+	s.algorithms = s.transport.getAlgorithms()
 
 	var packet []byte
 	if packet, err = s.transport.readPacket(); err != nil {
@@ -637,7 +650,7 @@ userAuthLoop:
 				return nil, parseError(msgUserAuthRequest)
 			}
 			algo := string(algoBytes)
-			if !contains(config.PublicKeyAuthAlgorithms, underlyingAlgo(algo)) {
+			if !slices.Contains(config.PublicKeyAuthAlgorithms, underlyingAlgo(algo)) {
 				authErr = fmt.Errorf("ssh: algorithm %q not accepted", algo)
 				break
 			}
@@ -658,6 +671,9 @@ userAuthLoop:
 				candidate.pubKeyData = pubKeyData
 				candidate.perms, candidate.result = authConfig.PublicKeyCallback(s, pubKey)
 				_, isPartialSuccessError := candidate.result.(*PartialSuccessError)
+				if isPartialSuccessError && config.VerifiedPublicKeyCallback != nil {
+					return nil, errors.New("ssh: invalid library usage: PublicKeyCallback must not return partial success when VerifiedPublicKeyCallback is defined")
+				}
 
 				if (candidate.result == nil || isPartialSuccessError) &&
 					candidate.perms != nil &&
@@ -701,7 +717,7 @@ userAuthLoop:
 				// ssh-rsa-cert-v01@openssh.com algorithm with ssh-rsa public
 				// key type. The algorithm and public key type must be
 				// consistent: both must be certificate algorithms, or neither.
-				if !contains(algorithmsForKeyFormat(pubKey.Type()), algo) {
+				if !slices.Contains(algorithmsForKeyFormat(pubKey.Type()), algo) {
 					authErr = fmt.Errorf("ssh: public key type %q not compatible with selected algorithm %q",
 						pubKey.Type(), algo)
 					break
@@ -711,7 +727,7 @@ userAuthLoop:
 				// algorithm name that corresponds to algo with
 				// sig.Format.  This is usually the same, but
 				// for certs, the names differ.
-				if !contains(config.PublicKeyAuthAlgorithms, sig.Format) {
+				if !slices.Contains(config.PublicKeyAuthAlgorithms, sig.Format) {
 					authErr = fmt.Errorf("ssh: algorithm %q not accepted", sig.Format)
 					break
 				}
@@ -728,6 +744,12 @@ userAuthLoop:
 
 				authErr = candidate.result
 				perms = candidate.perms
+				if authErr == nil && config.VerifiedPublicKeyCallback != nil {
+					// Only call VerifiedPublicKeyCallback after the key has been accepted
+					// and successfully verified. If authErr is non-nil, the key is not
+					// considered verified and the callback must not run.
+					perms, authErr = config.VerifiedPublicKeyCallback(s, pubKey, perms, algo)
+				}
 			}
 		case "gssapi-with-mic":
 			if authConfig.GSSAPIWithMICConfig == nil {

ssh/server_test.go

@@ -212,7 +212,7 @@ func TestNewServerConnValidationErrors(t *testing.T) {
 
 	serverConf = &ServerConfig{
 		Config: Config{
-			KeyExchanges: []string{kexAlgoDHGEXSHA256},
+			KeyExchanges: []string{KeyExchangeDHGEXSHA256},
 		},
 	}
 	c = &markerConn{}
@@ -434,6 +434,380 @@ func TestPreAuthConnAndBanners(t *testing.T) {
 	}
 }
 
+func TestVerifiedPublicKeyCallback(t *testing.T) {
+	c1, c2, err := netPipe()
+	if err != nil {
+		t.Fatalf("netPipe: %v", err)
+	}
+	defer c1.Close()
+	defer c2.Close()
+
+	extraKey := "extra"
+	extraDataString := "just a string"
+
+	serverConf := &ServerConfig{
+		VerifiedPublicKeyCallback: func(conn ConnMetadata, key PublicKey, permissions *Permissions, signatureAlgorithm string) (*Permissions, error) {
+			if permissions != nil && permissions.ExtraData != nil {
+				if !reflect.DeepEqual(map[any]any{extraKey: extraDataString}, permissions.ExtraData) {
+					t.Errorf("expected extra data: %v; got: %v", extraDataString, permissions.ExtraData)
+				}
+			} else {
+				t.Error("expected extra data is missing")
+			}
+			if signatureAlgorithm != KeyAlgoRSASHA256 {
+				t.Errorf("expected signature algorithm: %q; got: %q", KeyAlgoRSASHA256, signatureAlgorithm)
+			}
+			return permissions, nil
+		},
+		PublicKeyCallback: func(conn ConnMetadata, key PublicKey) (*Permissions, error) {
+			return &Permissions{ExtraData: map[any]any{extraKey: extraDataString}}, nil
+		},
+	}
+	serverConf.AddHostKey(testSigners["rsa"])
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		conn, _, _, err := NewServerConn(c1, serverConf)
+		if err != nil {
+			t.Errorf("unexpected server error: %v", err)
+		}
+		if !reflect.DeepEqual(map[any]any{extraKey: extraDataString}, conn.Permissions.ExtraData) {
+			t.Errorf("expected extra data: %v; got: %v", extraDataString, conn.Permissions.ExtraData)
+		}
+	}()
+
+	clientConf := ClientConfig{
+		User: "user",
+		Auth: []AuthMethod{
+			PublicKeys(testSigners["rsa"]),
+		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
+	}
+
+	_, _, _, err = NewClientConn(c2, "", &clientConf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	<-done
+}
+
+func TestVerifiedPublicCallbackPartialSuccess(t *testing.T) {
+	c1, c2, err := netPipe()
+	if err != nil {
+		t.Fatalf("netPipe: %v", err)
+	}
+	defer c1.Close()
+	defer c2.Close()
+
+	serverConf := &ServerConfig{
+		PublicKeyCallback: func(conn ConnMetadata, key PublicKey) (*Permissions, error) {
+			if bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) {
+				return nil, nil
+			}
+			return nil, errors.New("invalid credentials")
+		},
+		VerifiedPublicKeyCallback: func(conn ConnMetadata, key PublicKey, permissions *Permissions, signatureAlgorithm string) (*Permissions, error) {
+			if bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) {
+				return nil, &PartialSuccessError{
+					Next: ServerAuthCallbacks{
+						PasswordCallback: func(conn ConnMetadata, password []byte) (*Permissions, error) {
+							if string(password) == clientPassword {
+								return nil, nil
+							}
+							return nil, nil
+						},
+					},
+				}
+			}
+			return nil, errors.New("invalid credentials")
+		},
+	}
+	serverConf.AddHostKey(testSigners["rsa"])
+
+	clientConf := ClientConfig{
+		User: "user",
+		Auth: []AuthMethod{
+			PublicKeys(testSigners["rsa"]),
+			Password(clientPassword),
+		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
+	}
+
+	go NewServerConn(c1, serverConf)
+
+	_, _, _, err = NewClientConn(c2, "", &clientConf)
+	if err != nil {
+		t.Fatalf("client login error: %s", err)
+	}
+}
+
+func TestVerifiedPublicKeyCallbackPwdAndKey(t *testing.T) {
+	c1, c2, err := netPipe()
+	if err != nil {
+		t.Fatalf("netPipe: %v", err)
+	}
+	defer c1.Close()
+	defer c2.Close()
+
+	serverConf := &ServerConfig{
+		PasswordCallback: func(conn ConnMetadata, password []byte) (*Permissions, error) {
+			if string(password) == clientPassword {
+				return nil, &PartialSuccessError{
+					Next: ServerAuthCallbacks{
+						PublicKeyCallback: func(conn ConnMetadata, key PublicKey) (*Permissions, error) {
+							if bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) {
+								return nil, nil
+							}
+							return nil, errors.New("invalid credentials")
+						},
+					},
+				}
+			}
+			return nil, errors.New("invalid credentials")
+
+		},
+		VerifiedPublicKeyCallback: func(conn ConnMetadata, key PublicKey, permissions *Permissions, signatureAlgorithm string) (*Permissions, error) {
+			if bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) {
+				return nil, nil
+			}
+			return nil, errors.New("invalid credentials")
+		},
+	}
+	serverConf.AddHostKey(testSigners["rsa"])
+
+	clientConf := ClientConfig{
+		User: "user",
+		Auth: []AuthMethod{
+			Password(clientPassword),
+			PublicKeys(testSigners["rsa"]),
+		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
+	}
+
+	go NewServerConn(c1, serverConf)
+
+	_, _, _, err = NewClientConn(c2, "", &clientConf)
+	if err != nil {
+		t.Fatalf("client login error: %s", err)
+	}
+}
+
+func TestVerifiedPubKeyCallbackAuthMethods(t *testing.T) {
+	c1, c2, err := netPipe()
+	if err != nil {
+		t.Fatalf("netPipe: %v", err)
+	}
+	defer c1.Close()
+	defer c2.Close()
+
+	serverConf := &ServerConfig{
+		PasswordCallback: func(conn ConnMetadata, password []byte) (*Permissions, error) {
+			return nil, nil
+		},
+		VerifiedPublicKeyCallback: func(conn ConnMetadata, key PublicKey, permissions *Permissions, signatureAlgorithm string) (*Permissions, error) {
+			if bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) {
+				return nil, nil
+			}
+			return nil, errors.New("invalid credentials")
+		},
+	}
+	serverConf.AddHostKey(testSigners["rsa"])
+
+	clientConf := ClientConfig{
+		User: "user",
+		Auth: []AuthMethod{
+			PublicKeys(testSigners["rsa"]),
+		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
+	}
+
+	go NewServerConn(c1, serverConf)
+
+	_, _, _, err = NewClientConn(c2, "", &clientConf)
+	if err == nil {
+		t.Fatal("client login succeed with only VerifiedPublicKeyCallback defined")
+	}
+}
+
+func TestVerifiedPubKeyCallbackError(t *testing.T) {
+	c1, c2, err := netPipe()
+	if err != nil {
+		t.Fatalf("netPipe: %v", err)
+	}
+	defer c1.Close()
+	defer c2.Close()
+
+	serverConf := &ServerConfig{
+		PublicKeyCallback: func(conn ConnMetadata, key PublicKey) (*Permissions, error) {
+			return nil, nil
+		},
+		VerifiedPublicKeyCallback: func(conn ConnMetadata, key PublicKey, permissions *Permissions, signatureAlgorithm string) (*Permissions, error) {
+			return nil, errors.New("invalid credentials")
+		},
+	}
+	serverConf.AddHostKey(testSigners["rsa"])
+
+	clientConf := ClientConfig{
+		User: "user",
+		Auth: []AuthMethod{
+			PublicKeys(testSigners["rsa"]),
+		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
+	}
+
+	go NewServerConn(c1, serverConf)
+
+	_, _, _, err = NewClientConn(c2, "", &clientConf)
+	if err == nil {
+		t.Fatal("client login succeed with VerifiedPublicKeyCallback returning an error")
+	}
+}
+
+func TestVerifiedPublicCallbackPartialSuccessBadUsage(t *testing.T) {
+	c1, c2, err := netPipe()
+	if err != nil {
+		t.Fatalf("netPipe: %v", err)
+	}
+	defer c1.Close()
+	defer c2.Close()
+
+	serverConf := &ServerConfig{
+		PublicKeyCallback: func(conn ConnMetadata, key PublicKey) (*Permissions, error) {
+			if bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) {
+				// Returning PartialSuccessError is not permitted when
+				// VerifiedPublicKeyCallback is defined. This callback is
+				// invoked for both query requests and real authentications,
+				// while VerifiedPublicKeyCallback is only triggered if the
+				// client has proven control of the key.
+				return nil, &PartialSuccessError{
+					Next: ServerAuthCallbacks{
+						PasswordCallback: func(conn ConnMetadata, password []byte) (*Permissions, error) {
+							if string(password) == clientPassword {
+								return nil, nil
+							}
+							return nil, nil
+						},
+					},
+				}
+			}
+			return nil, errors.New("invalid credentials")
+		},
+		VerifiedPublicKeyCallback: func(conn ConnMetadata, key PublicKey, permissions *Permissions, signatureAlgorithm string) (*Permissions, error) {
+			if bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) {
+				return nil, &PartialSuccessError{
+					Next: ServerAuthCallbacks{
+						PasswordCallback: func(conn ConnMetadata, password []byte) (*Permissions, error) {
+							if string(password) == clientPassword {
+								return nil, nil
+							}
+							return nil, nil
+						},
+					},
+				}
+			}
+			return nil, errors.New("invalid credentials")
+		},
+	}
+	serverConf.AddHostKey(testSigners["rsa"])
+
+	clientConf := ClientConfig{
+		User: "user",
+		Auth: []AuthMethod{
+			PublicKeys(testSigners["rsa"]),
+			Password(clientPassword),
+		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
+	}
+
+	go NewServerConn(c1, serverConf)
+
+	_, _, _, err = NewClientConn(c2, "", &clientConf)
+	if err == nil {
+		t.Fatal("authentication succeeded with PartialSuccess returned from PublicKeyCallback and  VerifiedPublicKeyCallback defined")
+	}
+}
+
+func TestVerifiedPublicKeyCallbackOnError(t *testing.T) {
+	c1, c2, err := netPipe()
+	if err != nil {
+		t.Fatalf("netPipe: %v", err)
+	}
+	defer c1.Close()
+	defer c2.Close()
+
+	var verifiedCallbackCalled bool
+
+	serverConf := &ServerConfig{
+		VerifiedPublicKeyCallback: func(conn ConnMetadata, key PublicKey, permissions *Permissions, signatureAlgorithm string) (*Permissions, error) {
+			verifiedCallbackCalled = true
+			return nil, nil
+		},
+		PublicKeyCallback: func(conn ConnMetadata, key PublicKey) (*Permissions, error) {
+			return nil, errors.New("invalid key")
+		},
+	}
+	serverConf.AddHostKey(testSigners["rsa"])
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		NewServerConn(c1, serverConf)
+	}()
+
+	clientConf := ClientConfig{
+		User: "user",
+		Auth: []AuthMethod{
+			PublicKeys(testSigners["rsa"]),
+		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
+	}
+
+	_, _, _, err = NewClientConn(c2, "", &clientConf)
+	if err == nil {
+		t.Fatal("authentication should fail")
+	}
+	<-done
+	if verifiedCallbackCalled {
+		t.Error("VerifiedPublicKeyCallback called after PublicKeyCallback returned an error")
+	}
+}
+
+func TestVerifiedPublicKeyCallbackOnly(t *testing.T) {
+	c1, c2, err := netPipe()
+	if err != nil {
+		t.Fatalf("netPipe: %v", err)
+	}
+	defer c1.Close()
+	defer c2.Close()
+
+	serverConf := &ServerConfig{
+		VerifiedPublicKeyCallback: func(conn ConnMetadata, key PublicKey, permissions *Permissions, signatureAlgorithm string) (*Permissions, error) {
+			return nil, nil
+		},
+	}
+	serverConf.AddHostKey(testSigners["rsa"])
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		NewServerConn(c1, serverConf)
+	}()
+
+	clientConf := ClientConfig{
+		User: "user",
+		Auth: []AuthMethod{
+			PublicKeys(testSigners["rsa"]),
+		},
+		HostKeyCallback: InsecureIgnoreHostKey(),
+	}
+
+	_, _, _, err = NewClientConn(c2, "", &clientConf)
+	if err == nil {
+		t.Fatal("authentication succeeded with only VerifiedPublicKeyCallback defined")
+	}
+	<-done
+}
+
 type markerConn struct {
 	closed uint32
 	used   uint32

ssh/tcpip.go

@@ -459,7 +459,7 @@ func (c *Client) dial(laddr string, lport int, raddr string, rport int) (Channel
 		return nil, err
 	}
 	go DiscardRequests(in)
-	return ch, err
+	return ch, nil
 }
 
 type tcpChan struct {

ssh/test/banner_test.go

@@ -1,31 +0,0 @@
-// Copyright 2014 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
-
-package test
-
-import (
-	"testing"
-)
-
-func TestBannerCallbackAgainstOpenSSH(t *testing.T) {
-	server := newServer(t)
-
-	clientConf := clientConfig()
-
-	var receivedBanner string
-	clientConf.BannerCallback = func(message string) error {
-		receivedBanner = message
-		return nil
-	}
-
-	conn := server.Dial(clientConf)
-	defer conn.Close()
-
-	expected := "Server Banner"
-	if receivedBanner != expected {
-		t.Fatalf("got %v; want %v", receivedBanner, expected)
-	}
-}

ssh/test/doc.go

@@ -4,4 +4,6 @@
 
 // Package test contains integration tests for the
 // golang.org/x/crypto/ssh package.
+//
+// Deprecated: this package is for internal use only.
 package test

ssh/test/forward_unix_test.go

@@ -94,7 +94,7 @@ func testPortForward(t *testing.T, n, listenAddr string) {
 	if len(sent) != len(read) {
 		t.Fatalf("got %d bytes, want %d", len(read), len(sent))
 	}
-	if bytes.Compare(sent, read) != 0 {
+	if !bytes.Equal(sent, read) {
 		t.Fatalf("read back data does not match")
 	}
 

ssh/test/recording_client_test.go

@@ -0,0 +1,504 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package test
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/internal/testenv"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/testdata"
+)
+
+// serverPort contains the port that OpenSSH will listen on. OpenSSH can't take
+// "0" as an argument here so we have to pick a number and hope that it's not in
+// use on the machine. Since this only occurs when -update is given and thus
+// when there's a human watching the test, this isn't too bad.
+const serverPort = 24222
+
+var (
+	storeUsernameOnce sync.Once
+)
+
+type clientTest struct {
+	// name is a freeform string identifying the test and the file in which
+	// the expected results will be stored.
+	name string
+	// config contains the client configuration to use for this test.
+	config *ssh.ClientConfig
+	// expectError defines the error string to check if the connection is
+	// expected to fail.
+	expectError string
+	// successCallback defines a callback to execute after the client connection
+	// is established.
+	successCallback func(t *testing.T, client *ssh.Client)
+}
+
+// connFromCommand starts the reference server process, connects to it and
+// returns a recordingConn for the connection. It must be closed before Waiting
+// for child.
+func (test *clientTest) connFromCommand(t *testing.T, config string) *recordingConn {
+	sshd, err := exec.LookPath("sshd")
+	if err != nil {
+		t.Skipf("sshd not found, skipping test: %v", err)
+	}
+	dir, err := os.MkdirTemp("", "sshtest")
+	if err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Create(filepath.Join(dir, "sshd_config"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := configTmpl[config]; ok == false {
+		t.Fatal(fmt.Errorf("Invalid server config '%s'", config))
+	}
+	configVars := map[string]string{
+		"Dir": dir,
+	}
+	err = configTmpl[config].Execute(f, configVars)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.Close()
+
+	writeFile(filepath.Join(dir, "banner"), []byte("Server Banner"))
+
+	for k, v := range testdata.PEMBytes {
+		filename := "id_" + k
+		writeFile(filepath.Join(dir, filename), v)
+		writeFile(filepath.Join(dir, filename+".pub"), ssh.MarshalAuthorizedKey(testPublicKeys[k]))
+	}
+
+	var authkeys bytes.Buffer
+	for k := range testdata.PEMBytes {
+		authkeys.Write(ssh.MarshalAuthorizedKey(testPublicKeys[k]))
+	}
+	writeFile(filepath.Join(dir, "authorized_keys"), authkeys.Bytes())
+	cmd := testenv.Command(t, sshd, "-D", "-e", "-f", f.Name(), "-p", strconv.Itoa(serverPort))
+	cmd.Stdin = nil
+	var output bytes.Buffer
+	cmd.Stdout = &output
+	cmd.Stderr = &output
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := os.RemoveAll(dir); err != nil {
+			t.Error(err)
+		}
+		// Don't check for errors; if it fails it's most
+		// likely "os: process already finished", and we don't
+		// care about that. Use os.Interrupt, so child
+		// processes are killed too.
+		cmd.Process.Signal(os.Interrupt)
+		cmd.Wait()
+		if t.Failed() {
+			t.Logf("OpenSSH output:\n\n%s", cmd.Stdout)
+		}
+	})
+	var tcpConn net.Conn
+	for i := uint(0); i < 5; i++ {
+		tcpConn, err = net.DialTCP("tcp", nil, &net.TCPAddr{
+			IP:   net.IPv4(127, 0, 0, 1),
+			Port: serverPort,
+		})
+		if err == nil {
+			break
+		}
+		time.Sleep((1 << i) * 5 * time.Millisecond)
+	}
+	if err != nil {
+		t.Fatalf("error connecting to the OpenSSH server: %v (%v)\n\n%s", err, cmd.Wait(), output.Bytes())
+	}
+
+	record := &recordingConn{
+		Conn:           tcpConn,
+		clientToServer: true,
+	}
+
+	return record
+}
+
+func (test *clientTest) dataPath() string {
+	return filepath.Join("..", "testdata", "Client-"+test.name)
+}
+
+func (test *clientTest) usernameDataPath() string {
+	return filepath.Join("..", "testdata", "Client-username")
+}
+
+func (test *clientTest) loadData() (flows [][]byte, err error) {
+	in, err := os.Open(test.dataPath())
+	if err != nil {
+		return nil, err
+	}
+	defer in.Close()
+	return parseTestData(in)
+}
+
+func (test *clientTest) storeUsername() (err error) {
+	storeUsernameOnce.Do(func() {
+		err = os.WriteFile(test.usernameDataPath(), []byte(username()), 0666)
+	})
+	return err
+}
+
+func (test *clientTest) loadUsername() (string, error) {
+	data, err := os.ReadFile(test.usernameDataPath())
+	return string(data), err
+}
+
+func (test *clientTest) run(t *testing.T, write bool) {
+	var clientConn net.Conn
+	var recordingConn *recordingConn
+
+	setDeterministicRandomSource(&test.config.Config)
+
+	if write {
+		// We store the username used when we record the connection so we can
+		// reuse the same username when running tests.
+		if err := test.storeUsername(); err != nil {
+			t.Fatalf("failed to store username to %q: %v", test.usernameDataPath(), err)
+		}
+		recordingConn = test.connFromCommand(t, "default")
+		clientConn = recordingConn
+	} else {
+		username, err := test.loadUsername()
+		if err != nil {
+			t.Fatalf("failed to load username from %q: %v", test.usernameDataPath(), err)
+		}
+		test.config.User = username
+		timer := time.AfterFunc(10*time.Second, func() {
+			fmt.Println("This test may be stuck, try running using -timeout 10s")
+		})
+		t.Cleanup(func() {
+			timer.Stop()
+		})
+		flows, err := test.loadData()
+		if err != nil {
+			t.Fatalf("failed to load data from %s: %v", test.dataPath(), err)
+		}
+		clientConn = newReplayingConn(t, flows)
+	}
+	c, chans, reqs, err := ssh.NewClientConn(clientConn, "", test.config)
+	if err != nil {
+		if test.expectError == "" {
+			t.Fatal(err)
+		} else {
+			if !strings.Contains(err.Error(), test.expectError) {
+				t.Fatalf("%q not found in %v", test.expectError, err)
+			}
+		}
+	} else {
+		if test.expectError != "" {
+			t.Error("dial should have failed.")
+		}
+		client := ssh.NewClient(c, chans, reqs)
+		if test.successCallback != nil {
+			test.successCallback(t, client)
+		}
+		if err := client.Close(); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	if write {
+		path := test.dataPath()
+		out, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+		if err != nil {
+			t.Fatalf("Failed to create output file: %v", err)
+		}
+		defer out.Close()
+		recordingConn.Close()
+
+		recordingConn.WriteTo(out)
+		t.Logf("Wrote %s\n", path)
+	}
+}
+
+func recordingsClientConfig() *ssh.ClientConfig {
+	config := clientConfig()
+	config.SetDefaults()
+	// Remove ML-KEM since it only works with Go 1.24.
+	if config.KeyExchanges[0] == ssh.KeyExchangeMLKEM768X25519 {
+		config.KeyExchanges = config.KeyExchanges[1:]
+	}
+	config.Auth = []ssh.AuthMethod{
+		ssh.PublicKeys(testSigners["rsa"]),
+	}
+	return config
+}
+
+func TestClientKeyExchanges(t *testing.T) {
+	config := ssh.ClientConfig{}
+	config.SetDefaults()
+
+	var keyExchanges []string
+	for _, kex := range config.KeyExchanges {
+		// Exclude ecdh for now, to make them deterministic we should use see a
+		// stream of fixed bytes as the random source.
+		if !strings.HasPrefix(kex, "ecdh-") {
+			keyExchanges = append(keyExchanges, kex)
+		}
+	}
+	// Add diffie-hellman-group-exchange-sha256 and
+	// diffie-hellman-group16-sha512 as they are not enabled by default.
+	keyExchanges = append(keyExchanges, "diffie-hellman-group-exchange-sha256", "diffie-hellman-group16-sha512")
+
+	for _, kex := range keyExchanges {
+		c := recordingsClientConfig()
+		c.KeyExchanges = []string{kex}
+		test := clientTest{
+			name:   "KEX-" + kex,
+			config: c,
+		}
+		runTestAndUpdateIfNeeded(t, test.name, test.run)
+	}
+}
+
+func TestClientCiphers(t *testing.T) {
+	config := ssh.ClientConfig{}
+	config.SetDefaults()
+
+	for _, ciph := range config.Ciphers {
+		c := recordingsClientConfig()
+		c.Ciphers = []string{ciph}
+		test := clientTest{
+			name:   "Cipher-" + ciph,
+			config: c,
+		}
+		runTestAndUpdateIfNeeded(t, test.name, test.run)
+	}
+}
+
+func TestClientMACs(t *testing.T) {
+	config := ssh.ClientConfig{}
+	config.SetDefaults()
+
+	for _, mac := range config.MACs {
+		c := recordingsClientConfig()
+		c.MACs = []string{mac}
+		test := clientTest{
+			name:   "MAC-" + mac,
+			config: c,
+		}
+		runTestAndUpdateIfNeeded(t, test.name, test.run)
+	}
+}
+
+func TestBannerCallback(t *testing.T) {
+	var receivedBanner string
+	config := recordingsClientConfig()
+	config.BannerCallback = func(message string) error {
+		receivedBanner = message
+		return nil
+	}
+	test := clientTest{
+		name:   "BannerCallback",
+		config: config,
+		successCallback: func(t *testing.T, client *ssh.Client) {
+			expected := "Server Banner"
+			if receivedBanner != expected {
+				t.Fatalf("got %v; want %v", receivedBanner, expected)
+			}
+		},
+	}
+	runTestAndUpdateIfNeeded(t, test.name, test.run)
+}
+
+func TestRunCommandSuccess(t *testing.T) {
+	if runtime.GOARCH == "wasm" {
+		t.Skip("skipping test, executing a command, session.Run(), is not supported on wasm")
+	}
+	test := clientTest{
+		name:   "RunCommandSuccess",
+		config: recordingsClientConfig(),
+		successCallback: func(t *testing.T, client *ssh.Client) {
+			session, err := client.NewSession()
+			if err != nil {
+				t.Fatalf("session failed: %v", err)
+			}
+			defer session.Close()
+			err = session.Run("true")
+			if err != nil {
+				t.Fatalf("session failed: %v", err)
+			}
+		},
+	}
+
+	runTestAndUpdateIfNeeded(t, test.name, test.run)
+}
+
+func TestHostKeyCheck(t *testing.T) {
+	config := recordingsClientConfig()
+	hostDB := hostKeyDB()
+	config.HostKeyCallback = hostDB.Check
+
+	// change the keys.
+	hostDB.keys[ssh.KeyAlgoRSA][25]++
+	hostDB.keys[ssh.InsecureKeyAlgoDSA][25]++
+	hostDB.keys[ssh.KeyAlgoECDSA256][25]++
+
+	test := clientTest{
+		name:        "HostKeyCheck",
+		config:      config,
+		expectError: "host key mismatch",
+	}
+
+	runTestAndUpdateIfNeeded(t, test.name, test.run)
+}
+
+func TestRunCommandStdin(t *testing.T) {
+	if runtime.GOARCH == "wasm" {
+		t.Skip("skipping test, executing a command, session.Run(), is not supported on wasm")
+	}
+	test := clientTest{
+		name:   "RunCommandStdin",
+		config: recordingsClientConfig(),
+		successCallback: func(t *testing.T, client *ssh.Client) {
+			session, err := client.NewSession()
+			if err != nil {
+				t.Fatalf("session failed: %v", err)
+			}
+			defer session.Close()
+
+			r, w := io.Pipe()
+			defer r.Close()
+			defer w.Close()
+			session.Stdin = r
+
+			err = session.Run("true")
+			if err != nil {
+				t.Fatalf("session failed: %v", err)
+			}
+		},
+	}
+
+	runTestAndUpdateIfNeeded(t, test.name, test.run)
+}
+
+func TestRunCommandStdinError(t *testing.T) {
+	if runtime.GOARCH == "wasm" {
+		t.Skip("skipping test, executing a command, session.Run(), is not supported on wasm")
+	}
+	test := clientTest{
+		name:   "RunCommandStdinError",
+		config: recordingsClientConfig(),
+		successCallback: func(t *testing.T, client *ssh.Client) {
+			session, err := client.NewSession()
+			if err != nil {
+				t.Fatalf("session failed: %v", err)
+			}
+			defer session.Close()
+
+			r, w := io.Pipe()
+			defer r.Close()
+			session.Stdin = r
+			pipeErr := errors.New("closing write end of pipe")
+			w.CloseWithError(pipeErr)
+
+			err = session.Run("true")
+			if err != pipeErr {
+				t.Fatalf("expected %v, found %v", pipeErr, err)
+			}
+		},
+	}
+
+	runTestAndUpdateIfNeeded(t, test.name, test.run)
+}
+
+func TestRunCommandFailed(t *testing.T) {
+	if runtime.GOARCH == "wasm" {
+		t.Skip("skipping test, executing a command, session.Run(), is not supported on wasm")
+	}
+	test := clientTest{
+		name:   "RunCommandFailed",
+		config: recordingsClientConfig(),
+		successCallback: func(t *testing.T, client *ssh.Client) {
+			session, err := client.NewSession()
+			if err != nil {
+				t.Fatalf("session failed: %v", err)
+			}
+			defer session.Close()
+
+			// Trigger a failure by attempting to execute a non-existent
+			// command.
+			err = session.Run(`non-existent command`)
+			if err == nil {
+				t.Fatalf("session succeeded: %v", err)
+			}
+		},
+	}
+
+	runTestAndUpdateIfNeeded(t, test.name, test.run)
+}
+
+func TestWindowChange(t *testing.T) {
+	if runtime.GOARCH == "wasm" {
+		t.Skip("skipping test, stdin/out are not supported on wasm")
+	}
+	test := clientTest{
+		name:   "WindowChange",
+		config: recordingsClientConfig(),
+		successCallback: func(t *testing.T, client *ssh.Client) {
+			session, err := client.NewSession()
+			if err != nil {
+				t.Fatalf("session failed: %v", err)
+			}
+			defer session.Close()
+
+			stdout, err := session.StdoutPipe()
+			if err != nil {
+				t.Fatalf("unable to acquire stdout pipe: %s", err)
+			}
+
+			stdin, err := session.StdinPipe()
+			if err != nil {
+				t.Fatalf("unable to acquire stdin pipe: %s", err)
+			}
+
+			tm := ssh.TerminalModes{ssh.ECHO: 0}
+			if err = session.RequestPty("xterm", 80, 40, tm); err != nil {
+				t.Fatalf("req-pty failed: %s", err)
+			}
+
+			if err := session.WindowChange(100, 100); err != nil {
+				t.Fatalf("window-change failed: %s", err)
+			}
+
+			err = session.Shell()
+			if err != nil {
+				t.Fatalf("session failed: %s", err)
+			}
+
+			stdin.Write([]byte("stty size && exit\n"))
+
+			var buf bytes.Buffer
+			if _, err := io.Copy(&buf, stdout); err != nil {
+				t.Fatalf("reading failed: %s", err)
+			}
+
+			if sttyOutput := buf.String(); !strings.Contains(sttyOutput, "100 100") {
+				t.Fatalf("terminal WindowChange failure: expected \"100 100\" stty output, got %s", sttyOutput)
+			}
+		},
+	}
+
+	runTestAndUpdateIfNeeded(t, test.name, test.run)
+}

ssh/test/recording_server_test.go

@@ -0,0 +1,284 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package test
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/internal/testenv"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/testdata"
+)
+
+type serverTest struct {
+	// name is a freeform string identifying the test and the file in which
+	// the expected results will be stored.
+	name string
+	// config contains the server configuration to use for this test.
+	config *ssh.ServerConfig
+}
+
+// connFromCommand starts opens a listening socket and starts the reference
+// client to connect to it. It returns a recordingConn that wraps the resulting
+// connection.
+func (test *serverTest) connFromCommand(t *testing.T) (conn *recordingConn, err error) {
+	sshCLI, err := exec.LookPath("ssh")
+	if err != nil {
+		t.Skipf("skipping test: %v", err)
+	}
+	l, err := net.ListenTCP("tcp", &net.TCPAddr{
+		IP:   net.IPv4(127, 0, 0, 1),
+		Port: 0,
+	})
+	if err != nil {
+		return nil, err
+	}
+	defer l.Close()
+
+	port := l.Addr().(*net.TCPAddr).Port
+	dir, err := os.MkdirTemp("", "sshtest")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	filename := "id_ed25519"
+	writeFile(filepath.Join(dir, filename), testdata.PEMBytes["ed25519"])
+	writeFile(filepath.Join(dir, filename+".pub"), ssh.MarshalAuthorizedKey(testPublicKeys["ed25519"]))
+	var args []string
+	args = append(args, "-v", "-i", filepath.Join(dir, filename), "-o", "StrictHostKeyChecking=no")
+	args = append(args, "-oKexAlgorithms=+diffie-hellman-group14-sha1")
+	args = append(args, "-p", strconv.Itoa(port))
+	args = append(args, "testuser@127.0.0.1")
+	args = append(args, "true")
+	cmd := testenv.Command(t, sshCLI, args...)
+	cmd.Stdin = nil
+	var output bytes.Buffer
+	cmd.Stdout = &output
+	cmd.Stderr = &output
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+
+	t.Cleanup(func() {
+		if err := os.RemoveAll(dir); err != nil {
+			t.Error(err)
+		}
+		// Don't check for errors; if it fails it's most
+		// likely "os: process already finished", and we don't
+		// care about that.
+		cmd.Process.Kill()
+		cmd.Wait()
+		if t.Failed() {
+			t.Logf("OpenSSH output:\n\n%s", cmd.Stdout)
+		}
+	})
+
+	connChan := make(chan any, 1)
+	go func() {
+		tcpConn, err := l.Accept()
+		if err != nil {
+			connChan <- err
+			return
+		}
+		connChan <- tcpConn
+	}()
+
+	var tcpConn net.Conn
+	select {
+	case connOrError := <-connChan:
+		if err, ok := connOrError.(error); ok {
+			return nil, err
+		}
+		tcpConn = connOrError.(net.Conn)
+	case <-time.After(2 * time.Second):
+		return nil, errors.New("timed out waiting for connection from child process")
+	}
+
+	record := &recordingConn{
+		Conn:           tcpConn,
+		clientToServer: false,
+	}
+
+	return record, nil
+}
+
+func (test *serverTest) dataPath() string {
+	return filepath.Join("..", "testdata", "Server-"+test.name)
+}
+
+func (test *serverTest) loadData() (flows [][]byte, err error) {
+	in, err := os.Open(test.dataPath())
+	if err != nil {
+		return nil, err
+	}
+	defer in.Close()
+	return parseTestData(in)
+}
+
+func (test *serverTest) run(t *testing.T, write bool) {
+	var serverConn net.Conn
+	var recordingConn *recordingConn
+
+	setDeterministicRandomSource(&test.config.Config)
+
+	if write {
+		var err error
+		recordingConn, err = test.connFromCommand(t)
+		if err != nil {
+			t.Fatalf("Failed to start subcommand: %v", err)
+		}
+		serverConn = recordingConn
+	} else {
+		timer := time.AfterFunc(10*time.Second, func() {
+			fmt.Println("This test may be stuck, try running using -timeout 10s")
+		})
+		t.Cleanup(func() {
+			timer.Stop()
+		})
+		flows, err := test.loadData()
+		if err != nil {
+			t.Fatalf("Failed to load data from %s", test.dataPath())
+		}
+		serverConn = newReplayingConn(t, flows)
+	}
+
+	server, chans, reqs, err := ssh.NewServerConn(serverConn, test.config)
+	if err != nil {
+		t.Fatalf("Failed to create server conn: %v", err)
+	}
+	defer server.Close()
+
+	go ssh.DiscardRequests(reqs)
+
+	done := make(chan bool)
+
+	for newChannel := range chans {
+		if newChannel.ChannelType() != "session" {
+			newChannel.Reject(ssh.UnknownChannelType, "unknown channel type")
+			continue
+		}
+
+		channel, requests, err := newChannel.Accept()
+		if err != nil {
+			continue
+		}
+
+		go func(in <-chan *ssh.Request) {
+			for req := range in {
+				switch req.Type {
+				case "exec":
+					if req.WantReply {
+						req.Reply(true, nil)
+					}
+					channel.SendRequest("exit-status", false, ssh.Marshal(&exitStatusMsg{Status: 0}))
+					channel.Close()
+					done <- true
+				default:
+					if req.WantReply {
+						req.Reply(false, nil)
+					}
+				}
+			}
+		}(requests)
+	}
+
+	<-done
+
+	if write {
+		path := test.dataPath()
+		out, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+		if err != nil {
+			t.Fatalf("Failed to create output file: %v", err)
+		}
+		defer out.Close()
+		recordingConn.Close()
+
+		recordingConn.WriteTo(out)
+		t.Logf("Wrote %s\n", path)
+	}
+}
+
+func recordingsServerConfig() *ssh.ServerConfig {
+	config := &ssh.ServerConfig{
+		PublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+			return nil, nil
+		},
+	}
+	config.SetDefaults()
+	// Remove ML-KEM since it only works with Go 1.24.
+	config.SetDefaults()
+	if config.KeyExchanges[0] == ssh.KeyExchangeMLKEM768X25519 {
+		config.KeyExchanges = config.KeyExchanges[1:]
+	}
+	config.AddHostKey(testSigners["rsa"])
+	return config
+}
+
+func TestServerKeyExchanges(t *testing.T) {
+	config := ssh.ClientConfig{}
+	config.SetDefaults()
+
+	var keyExchanges []string
+	for _, kex := range config.KeyExchanges {
+		// Exclude ecdh for now, to make them deterministic we should use see a
+		// stream of fixed bytes as the random source.
+		// Exclude ML-KEM because server side is not deterministic.
+		if !strings.HasPrefix(kex, "ecdh-") && !strings.HasPrefix(kex, "mlkem") {
+			keyExchanges = append(keyExchanges, kex)
+		}
+	}
+	// Add diffie-hellman-group16-sha512 as it is not enabled by default.
+	keyExchanges = append(keyExchanges, "diffie-hellman-group16-sha512")
+
+	for _, kex := range keyExchanges {
+		c := recordingsServerConfig()
+		c.KeyExchanges = []string{kex}
+		test := serverTest{
+			name:   "KEX-" + kex,
+			config: c,
+		}
+		runTestAndUpdateIfNeeded(t, test.name, test.run)
+	}
+}
+
+func TestServerCiphers(t *testing.T) {
+	config := ssh.ClientConfig{}
+	config.SetDefaults()
+
+	for _, ciph := range config.Ciphers {
+		c := recordingsServerConfig()
+		c.Ciphers = []string{ciph}
+		test := serverTest{
+			name:   "Cipher-" + ciph,
+			config: c,
+		}
+		runTestAndUpdateIfNeeded(t, test.name, test.run)
+	}
+}
+
+func TestServerMACs(t *testing.T) {
+	config := ssh.ClientConfig{}
+	config.SetDefaults()
+
+	for _, mac := range config.MACs {
+		c := recordingsServerConfig()
+		c.MACs = []string{mac}
+		test := serverTest{
+			name:   "MAC-" + mac,
+			config: c,
+		}
+		runTestAndUpdateIfNeeded(t, test.name, test.run)
+	}
+}

ssh/test/recording_test.go

@@ -0,0 +1,433 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package test
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/hex"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"os"
+	"os/user"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"text/template"
+	"time"
+
+	"golang.org/x/crypto/sha3"
+	"golang.org/x/crypto/ssh"
+)
+
+const (
+	defaultSSHDConfig = `
+Protocol 2
+Banner {{.Dir}}/banner
+HostKey {{.Dir}}/id_rsa
+HostKey {{.Dir}}/id_dsa
+HostKey {{.Dir}}/id_ecdsa
+HostCertificate {{.Dir}}/id_rsa-sha2-512-cert.pub
+Pidfile {{.Dir}}/sshd.pid
+KeyRegenerationInterval 3600
+ServerKeyBits 768
+SyslogFacility AUTH
+LogLevel DEBUG2
+LoginGraceTime 120
+PermitRootLogin no
+StrictModes no
+RSAAuthentication yes
+PubkeyAuthentication yes
+AuthorizedKeysFile	{{.Dir}}/authorized_keys
+TrustedUserCAKeys {{.Dir}}/id_ecdsa.pub
+IgnoreRhosts yes
+RhostsRSAAuthentication no
+HostbasedAuthentication no
+PubkeyAcceptedKeyTypes=*
+# In recent versions of OpenSSH, Diffie-Hellman key exchange algorithms
+# are disabled by default. However, they are still included in our default
+# Key Exchange (KEX) configuration. We explicitly enable them here to
+# maintain compatibility for our test cases.
+KexAlgorithms +diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256
+`
+	multiAuthSshdConfigTail = `
+UsePAM yes
+PasswordAuthentication yes
+ChallengeResponseAuthentication yes
+AuthenticationMethods {{.AuthMethods}}
+`
+	maxAuthTriesSshdConfigTail = `
+PasswordAuthentication yes
+MaxAuthTries 1
+`
+)
+
+var configTmpl = map[string]*template.Template{
+	"default":      template.Must(template.New("").Parse(defaultSSHDConfig)),
+	"MultiAuth":    template.Must(template.New("").Parse(defaultSSHDConfig + multiAuthSshdConfigTail)),
+	"MaxAuthTries": template.Must(template.New("").Parse(defaultSSHDConfig + maxAuthTriesSshdConfigTail))}
+
+type server struct {
+	t          *testing.T
+	configfile string
+
+	testUser     string // test username for sshd
+	testPasswd   string // test password for sshd
+	sshdTestPwSo string // dynamic library to inject a custom password into sshd
+
+	lastDialConn net.Conn
+}
+
+type storedHostKey struct {
+	// keys map from an algorithm string to binary key data.
+	keys map[string][]byte
+
+	// checkCount counts the Check calls. Used for testing
+	// rekeying.
+	checkCount int
+}
+
+func (k *storedHostKey) Add(key ssh.PublicKey) {
+	if k.keys == nil {
+		k.keys = map[string][]byte{}
+	}
+	k.keys[key.Type()] = key.Marshal()
+}
+
+func (k *storedHostKey) Check(addr string, remote net.Addr, key ssh.PublicKey) error {
+	k.checkCount++
+	algo := key.Type()
+
+	if k.keys == nil || !bytes.Equal(key.Marshal(), k.keys[algo]) {
+		return fmt.Errorf("host key mismatch. Got %q, want %q", key, k.keys[algo])
+	}
+	return nil
+}
+
+func hostKeyDB() *storedHostKey {
+	keyChecker := &storedHostKey{}
+	keyChecker.Add(testPublicKeys["ecdsa"])
+	keyChecker.Add(testPublicKeys["rsa"])
+	keyChecker.Add(testPublicKeys["dsa"])
+	return keyChecker
+}
+
+func clientConfig() *ssh.ClientConfig {
+	config := &ssh.ClientConfig{
+		User: username(),
+		Auth: []ssh.AuthMethod{
+			ssh.PublicKeys(testSigners["user"]),
+		},
+		HostKeyCallback: hostKeyDB().Check,
+		HostKeyAlgorithms: []string{ // by default, don't allow certs as this affects the hostKeyDB checker
+			ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521,
+			ssh.KeyAlgoRSA, ssh.InsecureKeyAlgoDSA,
+			ssh.KeyAlgoED25519,
+		},
+	}
+	return config
+}
+
+// SSH reference tests run a connection against a reference implementation
+// (OpenSSH) of SSH and record the bytes of the resulting connection. The Go
+// code, during a test, is configured with deterministic randomness and so the
+// reference test can be reproduced exactly in the future.
+//
+// In order to save everyone who wishes to run the tests from needing the
+// reference implementation installed, the reference connections are saved in
+// files in the testdata directory. Thus running the tests involves nothing
+// external, but creating and updating them requires the reference
+// implementation.
+//
+// Tests can be updated by running them with the -update flag. This will cause
+// the test files for failing tests to be regenerated. Since the reference
+// implementation will always generate fresh random numbers, large parts of the
+// reference connection will always change.
+
+var (
+	update = flag.Bool("update", false, "update golden files on failure")
+)
+
+func runTestAndUpdateIfNeeded(t *testing.T, name string, run func(t *testing.T, update bool)) {
+	success := t.Run(name, func(t *testing.T) {
+		if !*update {
+			t.Parallel()
+		}
+		run(t, false)
+	})
+
+	if !success && *update {
+		t.Run(name+"#update", func(t *testing.T) {
+			run(t, true)
+		})
+	}
+}
+
+// recordingConn is a net.Conn that records the traffic that passes through it.
+// WriteTo can be used to produce output that can be later be loaded with
+// ParseTestData.
+type recordingConn struct {
+	net.Conn
+	clientToServer bool
+	sync.Mutex
+	flows   [][]byte
+	reading bool
+}
+
+func (r *recordingConn) Read(b []byte) (n int, err error) {
+	if n, err = r.Conn.Read(b); n == 0 {
+		return
+	}
+	b = b[:n]
+
+	r.Lock()
+	defer r.Unlock()
+
+	if l := len(r.flows); l == 0 || !r.reading {
+		buf := make([]byte, len(b))
+		copy(buf, b)
+		r.flows = append(r.flows, buf)
+	} else {
+		r.flows[l-1] = append(r.flows[l-1], b[:n]...)
+	}
+	r.reading = true
+	return
+}
+
+func (r *recordingConn) Write(b []byte) (n int, err error) {
+	if n, err = r.Conn.Write(b); n == 0 {
+		return
+	}
+	b = b[:n]
+
+	r.Lock()
+	defer r.Unlock()
+
+	if l := len(r.flows); l == 0 || r.reading {
+		buf := make([]byte, len(b))
+		copy(buf, b)
+		r.flows = append(r.flows, buf)
+	} else {
+		r.flows[l-1] = append(r.flows[l-1], b[:n]...)
+	}
+	r.reading = false
+	return
+}
+
+// WriteTo writes Go source code to w that contains the recorded traffic.
+func (r *recordingConn) WriteTo(w io.Writer) (int64, error) {
+	var written int64
+	for i, flow := range r.flows {
+		source, dest := "client", "server"
+		if !r.clientToServer {
+			source, dest = dest, source
+		}
+		n, err := fmt.Fprintf(w, ">>> Flow %d (%s to %s)\n", i+1, source, dest)
+		written += int64(n)
+		if err != nil {
+			return written, err
+		}
+		dumper := hex.Dumper(w)
+		n, err = dumper.Write(flow)
+		written += int64(n)
+		if err != nil {
+			return written, err
+		}
+		err = dumper.Close()
+		if err != nil {
+			return written, err
+		}
+		r.clientToServer = !r.clientToServer
+	}
+	return written, nil
+}
+
+func parseTestData(r io.Reader) (flows [][]byte, err error) {
+	var currentFlow []byte
+
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		line := scanner.Text()
+		// If the line starts with ">>> " then it marks the beginning
+		// of a new flow.
+		if strings.HasPrefix(line, ">>> ") {
+			if len(currentFlow) > 0 || len(flows) > 0 {
+				flows = append(flows, currentFlow)
+				currentFlow = nil
+			}
+			continue
+		}
+
+		// Otherwise the line is a line of hex dump that looks like:
+		// 00000170  fc f5 06 bf (...)  |.....X{&?......!|
+		// (Some bytes have been omitted from the middle section.)
+		_, after, ok := strings.Cut(line, " ")
+		if !ok {
+			return nil, errors.New("invalid test data")
+		}
+		line = after
+
+		before, _, ok := strings.Cut(line, "|")
+		if !ok {
+			return nil, errors.New("invalid test data")
+		}
+		line = before
+
+		hexBytes := strings.Fields(line)
+		for _, hexByte := range hexBytes {
+			val, err := strconv.ParseUint(hexByte, 16, 8)
+			if err != nil {
+				return nil, errors.New("invalid hex byte in test data: " + err.Error())
+			}
+			currentFlow = append(currentFlow, byte(val))
+		}
+	}
+
+	if len(currentFlow) > 0 {
+		flows = append(flows, currentFlow)
+	}
+
+	return flows, nil
+}
+
+func newReplayingConn(t testing.TB, flows [][]byte) net.Conn {
+	r := &replayingConn{
+		t:       t,
+		flows:   flows,
+		reading: false,
+	}
+	r.readCond = sync.NewCond(&r.Mutex)
+	return r
+}
+
+// replayingConn is a net.Conn that replays flows recorded by recordingConn.
+type replayingConn struct {
+	t testing.TB
+	sync.Mutex
+	flows   [][]byte
+	reading bool
+	// SSH channels use a read loop goroutine, we use this condition to wait
+	// until we are ready to read/write.
+	readCond *sync.Cond
+}
+
+var _ net.Conn = (*replayingConn)(nil)
+
+func (r *replayingConn) Read(b []byte) (n int, err error) {
+	r.Lock()
+	defer r.Unlock()
+
+	for !r.reading {
+		r.readCond.Wait()
+	}
+
+	// Some tests run commands that return no output.
+	if len(r.flows) == 0 {
+		return 0, nil
+	}
+
+	n = copy(b, r.flows[0])
+	r.flows[0] = r.flows[0][n:]
+	if len(r.flows[0]) == 0 {
+		r.flows = r.flows[1:]
+		r.reading = false
+		r.readCond.Broadcast()
+		if len(r.flows) == 0 {
+			return n, io.EOF
+		}
+	}
+	return n, nil
+}
+
+func (r *replayingConn) Write(b []byte) (n int, err error) {
+	r.Lock()
+	defer r.Unlock()
+
+	for r.reading {
+		r.readCond.Wait()
+	}
+
+	if !bytes.HasPrefix(r.flows[0], b) {
+		r.t.Errorf("write mismatch: expected %x, got %x", r.flows[0], b)
+		r.reading = true
+		r.readCond.Broadcast()
+		return 0, fmt.Errorf("write mismatch")
+	}
+	r.flows[0] = r.flows[0][len(b):]
+	if len(r.flows[0]) == 0 {
+		r.flows = r.flows[1:]
+		r.reading = true
+		r.readCond.Broadcast()
+	}
+	return len(b), nil
+}
+
+func (r *replayingConn) Close() error {
+	r.Lock()
+	defer r.Unlock()
+
+	if len(r.flows) > 0 {
+		r.t.Errorf("closed with unfinished flows: %d", len(r.flows))
+		return fmt.Errorf("unexpected close")
+	}
+	return nil
+}
+
+func (r *replayingConn) LocalAddr() net.Addr                { return nil }
+func (r *replayingConn) RemoteAddr() net.Addr               { return nil }
+func (r *replayingConn) SetDeadline(_ time.Time) error      { return nil }
+func (r *replayingConn) SetReadDeadline(_ time.Time) error  { return nil }
+func (r *replayingConn) SetWriteDeadline(_ time.Time) error { return nil }
+
+func username() string {
+	var username string
+	if user, err := user.Current(); err == nil {
+		username = user.Username
+	} else {
+		// user.Current() currently requires cgo. If an error is
+		// returned attempt to get the username from the environment.
+		log.Printf("user.Current: %v; falling back on $USER", err)
+		username = os.Getenv("USER")
+	}
+	if username == "" {
+		panic("Unable to get username")
+	}
+	return username
+}
+
+func writeFile(path string, contents []byte) {
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0600)
+	if err != nil {
+		panic(err)
+	}
+	defer f.Close()
+	if _, err := f.Write(contents); err != nil {
+		panic(err)
+	}
+}
+
+// setDeterministicRandomSource sets a deterministic random source for the
+// provided ssh.Config. It is intended solely for use in test cases, as
+// deterministic randomness is insecure and should never be used in production
+// environments. A deterministic random source is required to enable consistent
+// testing against recorded session files.
+func setDeterministicRandomSource(config *ssh.Config) {
+	config.Rand = sha3.NewShake128()
+}
+
+func TestMain(m *testing.M) {
+	flag.Usage = func() {
+		fmt.Fprintf(flag.CommandLine.Output(), "Usage of %s:\n", os.Args)
+		flag.PrintDefaults()
+	}
+
+	flag.Parse()
+	os.Exit(m.Run())
+}

ssh/test/session_test.go

@@ -10,7 +10,6 @@ package test
 
 import (
 	"bytes"
-	"errors"
 	"fmt"
 	"io"
 	"path/filepath"
@@ -29,108 +28,6 @@ func skipIfIssue64959(t *testing.T, err error) {
 	}
 }
 
-func TestRunCommandSuccess(t *testing.T) {
-	server := newServer(t)
-	conn := server.Dial(clientConfig())
-	defer conn.Close()
-
-	session, err := conn.NewSession()
-	if err != nil {
-		skipIfIssue64959(t, err)
-		t.Fatalf("session failed: %v", err)
-	}
-	defer session.Close()
-	err = session.Run("true")
-	if err != nil {
-		t.Fatalf("session failed: %v", err)
-	}
-}
-
-func TestHostKeyCheck(t *testing.T) {
-	server := newServer(t)
-
-	conf := clientConfig()
-	hostDB := hostKeyDB()
-	conf.HostKeyCallback = hostDB.Check
-
-	// change the keys.
-	hostDB.keys[ssh.KeyAlgoRSA][25]++
-	hostDB.keys[ssh.KeyAlgoDSA][25]++
-	hostDB.keys[ssh.KeyAlgoECDSA256][25]++
-
-	conn, err := server.TryDial(conf)
-	if err == nil {
-		conn.Close()
-		t.Fatalf("dial should have failed.")
-	} else if !strings.Contains(err.Error(), "host key mismatch") {
-		t.Fatalf("'host key mismatch' not found in %v", err)
-	}
-}
-
-func TestRunCommandStdin(t *testing.T) {
-	server := newServer(t)
-	conn := server.Dial(clientConfig())
-	defer conn.Close()
-
-	session, err := conn.NewSession()
-	if err != nil {
-		skipIfIssue64959(t, err)
-		t.Fatalf("session failed: %v", err)
-	}
-	defer session.Close()
-
-	r, w := io.Pipe()
-	defer r.Close()
-	defer w.Close()
-	session.Stdin = r
-
-	err = session.Run("true")
-	if err != nil {
-		t.Fatalf("session failed: %v", err)
-	}
-}
-
-func TestRunCommandStdinError(t *testing.T) {
-	server := newServer(t)
-	conn := server.Dial(clientConfig())
-	defer conn.Close()
-
-	session, err := conn.NewSession()
-	if err != nil {
-		skipIfIssue64959(t, err)
-		t.Fatalf("session failed: %v", err)
-	}
-	defer session.Close()
-
-	r, w := io.Pipe()
-	defer r.Close()
-	session.Stdin = r
-	pipeErr := errors.New("closing write end of pipe")
-	w.CloseWithError(pipeErr)
-
-	err = session.Run("true")
-	if err != pipeErr {
-		t.Fatalf("expected %v, found %v", pipeErr, err)
-	}
-}
-
-func TestRunCommandFailed(t *testing.T) {
-	server := newServer(t)
-	conn := server.Dial(clientConfig())
-	defer conn.Close()
-
-	session, err := conn.NewSession()
-	if err != nil {
-		skipIfIssue64959(t, err)
-		t.Fatalf("session failed: %v", err)
-	}
-	defer session.Close()
-	err = session.Run(`bash -c "kill -9 $$"`)
-	if err == nil {
-		t.Fatalf("session succeeded: %v", err)
-	}
-}
-
 func TestRunCommandWeClosed(t *testing.T) {
 	server := newServer(t)
 	conn := server.Dial(clientConfig())
@@ -290,59 +187,6 @@ func TestValidTerminalMode(t *testing.T) {
 	}
 }
 
-func TestWindowChange(t *testing.T) {
-	if runtime.GOOS == "aix" {
-		// On AIX, sshd cannot acquire /dev/pts/* if launched as
-		// a non-root user.
-		t.Skipf("skipping on %s", runtime.GOOS)
-	}
-	server := newServer(t)
-	conn := server.Dial(clientConfig())
-	defer conn.Close()
-
-	session, err := conn.NewSession()
-	if err != nil {
-		skipIfIssue64959(t, err)
-		t.Fatalf("session failed: %v", err)
-	}
-	defer session.Close()
-
-	stdout, err := session.StdoutPipe()
-	if err != nil {
-		t.Fatalf("unable to acquire stdout pipe: %s", err)
-	}
-
-	stdin, err := session.StdinPipe()
-	if err != nil {
-		t.Fatalf("unable to acquire stdin pipe: %s", err)
-	}
-
-	tm := ssh.TerminalModes{ssh.ECHO: 0}
-	if err = session.RequestPty("xterm", 80, 40, tm); err != nil {
-		t.Fatalf("req-pty failed: %s", err)
-	}
-
-	if err := session.WindowChange(100, 100); err != nil {
-		t.Fatalf("window-change failed: %s", err)
-	}
-
-	err = session.Shell()
-	if err != nil {
-		t.Fatalf("session failed: %s", err)
-	}
-
-	stdin.Write([]byte("stty size && exit\n"))
-
-	var buf bytes.Buffer
-	if _, err := io.Copy(&buf, stdout); err != nil {
-		t.Fatalf("reading failed: %s", err)
-	}
-
-	if sttyOutput := buf.String(); !strings.Contains(sttyOutput, "100 100") {
-		t.Fatalf("terminal WindowChange failure: expected \"100 100\" stty output, got %s", sttyOutput)
-	}
-}
-
 func testOneCipher(t *testing.T, cipher string, cipherOrder []string) {
 	server := newServer(t)
 	conf := clientConfig()
@@ -380,8 +224,8 @@ func testOneCipher(t *testing.T, cipher string, cipherOrder []string) {
 }
 
 var deprecatedCiphers = []string{
-	"aes128-cbc", "3des-cbc",
-	"arcfour128", "arcfour256",
+	ssh.InsecureCipherAES128CBC, ssh.InsecureCipherTripleDESCBC,
+	ssh.InsecureCipherRC4128, ssh.InsecureCipherRC4256,
 }
 
 func TestCiphers(t *testing.T) {
@@ -396,55 +240,6 @@ func TestCiphers(t *testing.T) {
 	}
 }
 
-func TestMACs(t *testing.T) {
-	var config ssh.Config
-	config.SetDefaults()
-	macOrder := config.MACs
-
-	for _, mac := range macOrder {
-		t.Run(mac, func(t *testing.T) {
-			server := newServer(t)
-			conf := clientConfig()
-			conf.MACs = []string{mac}
-			// Don't fail if sshd doesn't have the MAC.
-			conf.MACs = append(conf.MACs, macOrder...)
-			if conn, err := server.TryDial(conf); err == nil {
-				conn.Close()
-			} else {
-				t.Fatalf("failed for MAC %q", mac)
-			}
-		})
-	}
-}
-
-func TestKeyExchanges(t *testing.T) {
-	var config ssh.Config
-	config.SetDefaults()
-	kexOrder := config.KeyExchanges
-	// Based on the discussion in #17230, the key exchange algorithms
-	// diffie-hellman-group-exchange-sha1 and diffie-hellman-group-exchange-sha256
-	// are not included in the default list of supported kex so we have to add them
-	// here manually.
-	kexOrder = append(kexOrder, "diffie-hellman-group-exchange-sha1", "diffie-hellman-group-exchange-sha256")
-	// The key exchange algorithms diffie-hellman-group16-sha512 is disabled by
-	// default so we add it here manually.
-	kexOrder = append(kexOrder, "diffie-hellman-group16-sha512")
-	for _, kex := range kexOrder {
-		t.Run(kex, func(t *testing.T) {
-			server := newServer(t)
-			conf := clientConfig()
-			// Don't fail if sshd doesn't have the kex.
-			conf.KeyExchanges = append([]string{kex}, kexOrder...)
-			conn, err := server.TryDial(conf)
-			if err == nil {
-				conn.Close()
-			} else {
-				t.Errorf("failed for kex %q", kex)
-			}
-		})
-	}
-}
-
 func TestClientAuthAlgorithms(t *testing.T) {
 	for _, key := range []string{
 		"rsa",

ssh/test/sshcli_test.go

@@ -34,23 +34,29 @@ func sshClient(t *testing.T) string {
 	return sshCLI
 }
 
+// setupSSHCLIKeys writes the provided key files to a temporary directory and
+// returns the path to the private key.
+func setupSSHCLIKeys(t *testing.T, keyFiles map[string][]byte, privKeyName string) string {
+	tmpDir := t.TempDir()
+	for fn, content := range keyFiles {
+		if err := os.WriteFile(filepath.Join(tmpDir, fn), content, 0600); err != nil {
+			t.Fatalf("WriteFile(%q): %v", fn, err)
+		}
+	}
+	return filepath.Join(tmpDir, privKeyName)
+}
+
 func TestSSHCLIAuth(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skipf("always fails on Windows, see #64403")
 	}
 	sshCLI := sshClient(t)
-	dir := t.TempDir()
-	keyPrivPath := filepath.Join(dir, "rsa")
-
-	for fn, content := range map[string][]byte{
-		keyPrivPath:                        testdata.PEMBytes["rsa"],
-		keyPrivPath + ".pub":               ssh.MarshalAuthorizedKey(testPublicKeys["rsa"]),
-		filepath.Join(dir, "rsa-cert.pub"): testdata.SSHCertificates["rsa-user-testcertificate"],
-	} {
-		if err := os.WriteFile(fn, content, 0600); err != nil {
-			t.Fatalf("WriteFile(%q): %v", fn, err)
-		}
+	keyFiles := map[string][]byte{
+		"rsa":          testdata.PEMBytes["rsa"],
+		"rsa.pub":      ssh.MarshalAuthorizedKey(testPublicKeys["rsa"]),
+		"rsa-cert.pub": testdata.SSHCertificates["rsa-user-testcertificate"],
 	}
+	keyPrivPath := setupSSHCLIKeys(t, keyFiles, "rsa")
 
 	certChecker := ssh.CertChecker{
 		IsUserAuthority: func(k ssh.PublicKey) bool {
@@ -98,3 +104,60 @@ func TestSSHCLIAuth(t *testing.T) {
 		t.Fatalf("user certificate authentication failed, error: %v, command output %q", err, string(out))
 	}
 }
+
+func TestSSHCLIKeyExchanges(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skipf("always fails on Windows, see #64403")
+	}
+	sshCLI := sshClient(t)
+	keyFiles := map[string][]byte{
+		"rsa":     testdata.PEMBytes["rsa"],
+		"rsa.pub": ssh.MarshalAuthorizedKey(testPublicKeys["rsa"]),
+	}
+	keyPrivPath := setupSSHCLIKeys(t, keyFiles, "rsa")
+
+	keyExchanges := append(ssh.SupportedAlgorithms().KeyExchanges, ssh.InsecureAlgorithms().KeyExchanges...)
+	for _, kex := range keyExchanges {
+		t.Run(kex, func(t *testing.T) {
+			cmd := testenv.Command(t, sshCLI, "-Q", "kex")
+			out, err := cmd.CombinedOutput()
+			if err != nil {
+				t.Fatalf("%s failed to check if the KEX is supported, error: %v, command output %q", kex, err, string(out))
+			}
+			if !bytes.Contains(out, []byte(kex)) {
+				t.Skipf("KEX %q is not supported in the installed ssh CLI", kex)
+			}
+			config := &ssh.ServerConfig{
+				Config: ssh.Config{
+					KeyExchanges: []string{kex},
+				},
+				PublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+					if conn.User() == "testpubkey" && bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) {
+						return nil, nil
+					}
+
+					return nil, fmt.Errorf("pubkey for %q not acceptable", conn.User())
+				},
+			}
+			config.AddHostKey(testSigners["rsa"])
+
+			server, err := newTestServer(config)
+			if err != nil {
+				t.Fatalf("unable to start test server: %v", err)
+			}
+			defer server.Close()
+
+			port, err := server.port()
+			if err != nil {
+				t.Fatalf("unable to get server port: %v", err)
+			}
+
+			cmd = testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no",
+				"-o", fmt.Sprintf("KexAlgorithms=%s", kex), "-p", port, "testpubkey@127.0.0.1", "true")
+			out, err = cmd.CombinedOutput()
+			if err != nil {
+				t.Fatalf("%s failed, error: %v, command output %q", kex, err, string(out))
+			}
+		})
+	}
+}

ssh/test/test_unix_test.go

@@ -13,140 +13,18 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"fmt"
-	"log"
 	"net"
 	"os"
 	"os/exec"
 	"os/user"
 	"path/filepath"
 	"testing"
-	"text/template"
 
 	"golang.org/x/crypto/internal/testenv"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/testdata"
 )
 
-const (
-	defaultSshdConfig = `
-Protocol 2
-Banner {{.Dir}}/banner
-HostKey {{.Dir}}/id_rsa
-HostKey {{.Dir}}/id_dsa
-HostKey {{.Dir}}/id_ecdsa
-HostCertificate {{.Dir}}/id_rsa-sha2-512-cert.pub
-Pidfile {{.Dir}}/sshd.pid
-#UsePrivilegeSeparation no
-KeyRegenerationInterval 3600
-ServerKeyBits 768
-SyslogFacility AUTH
-LogLevel DEBUG2
-LoginGraceTime 120
-PermitRootLogin no
-StrictModes no
-RSAAuthentication yes
-PubkeyAuthentication yes
-AuthorizedKeysFile	{{.Dir}}/authorized_keys
-TrustedUserCAKeys {{.Dir}}/id_ecdsa.pub
-IgnoreRhosts yes
-RhostsRSAAuthentication no
-HostbasedAuthentication no
-PubkeyAcceptedKeyTypes=*
-`
-	multiAuthSshdConfigTail = `
-UsePAM yes
-PasswordAuthentication yes
-ChallengeResponseAuthentication yes
-AuthenticationMethods {{.AuthMethods}}
-`
-	maxAuthTriesSshdConfigTail = `
-PasswordAuthentication yes
-MaxAuthTries 1
-`
-)
-
-var configTmpl = map[string]*template.Template{
-	"default":      template.Must(template.New("").Parse(defaultSshdConfig)),
-	"MultiAuth":    template.Must(template.New("").Parse(defaultSshdConfig + multiAuthSshdConfigTail)),
-	"MaxAuthTries": template.Must(template.New("").Parse(defaultSshdConfig + maxAuthTriesSshdConfigTail))}
-
-type server struct {
-	t          *testing.T
-	configfile string
-
-	testUser     string // test username for sshd
-	testPasswd   string // test password for sshd
-	sshdTestPwSo string // dynamic library to inject a custom password into sshd
-
-	lastDialConn net.Conn
-}
-
-func username() string {
-	var username string
-	if user, err := user.Current(); err == nil {
-		username = user.Username
-	} else {
-		// user.Current() currently requires cgo. If an error is
-		// returned attempt to get the username from the environment.
-		log.Printf("user.Current: %v; falling back on $USER", err)
-		username = os.Getenv("USER")
-	}
-	if username == "" {
-		panic("Unable to get username")
-	}
-	return username
-}
-
-type storedHostKey struct {
-	// keys map from an algorithm string to binary key data.
-	keys map[string][]byte
-
-	// checkCount counts the Check calls. Used for testing
-	// rekeying.
-	checkCount int
-}
-
-func (k *storedHostKey) Add(key ssh.PublicKey) {
-	if k.keys == nil {
-		k.keys = map[string][]byte{}
-	}
-	k.keys[key.Type()] = key.Marshal()
-}
-
-func (k *storedHostKey) Check(addr string, remote net.Addr, key ssh.PublicKey) error {
-	k.checkCount++
-	algo := key.Type()
-
-	if k.keys == nil || bytes.Compare(key.Marshal(), k.keys[algo]) != 0 {
-		return fmt.Errorf("host key mismatch. Got %q, want %q", key, k.keys[algo])
-	}
-	return nil
-}
-
-func hostKeyDB() *storedHostKey {
-	keyChecker := &storedHostKey{}
-	keyChecker.Add(testPublicKeys["ecdsa"])
-	keyChecker.Add(testPublicKeys["rsa"])
-	keyChecker.Add(testPublicKeys["dsa"])
-	return keyChecker
-}
-
-func clientConfig() *ssh.ClientConfig {
-	config := &ssh.ClientConfig{
-		User: username(),
-		Auth: []ssh.AuthMethod{
-			ssh.PublicKeys(testSigners["user"]),
-		},
-		HostKeyCallback: hostKeyDB().Check,
-		HostKeyAlgorithms: []string{ // by default, don't allow certs as this affects the hostKeyDB checker
-			ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521,
-			ssh.KeyAlgoRSA, ssh.KeyAlgoDSA,
-			ssh.KeyAlgoED25519,
-		},
-	}
-	return config
-}
-
 // unixConnection creates two halves of a connected net.UnixConn.  It
 // is used for connecting the Go SSH client with sshd without opening
 // ports.
@@ -262,17 +140,6 @@ func (s *server) Dial(config *ssh.ClientConfig) *ssh.Client {
 	return conn
 }
 
-func writeFile(path string, contents []byte) {
-	f, err := os.OpenFile(path, os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0600)
-	if err != nil {
-		panic(err)
-	}
-	defer f.Close()
-	if _, err := f.Write(contents); err != nil {
-		panic(err)
-	}
-}
-
 // generate random password
 func randomPassword() (string, error) {
 	b := make([]byte, 12)

ssh/testdata/Client-BannerCallback

@@ -0,0 +1,298 @@
+>>> Flow 1 (client to server)
+00000000  53 53 48 2d 32 2e 30 2d  47 6f 0d 0a              |SSH-2.0-Go..|
+>>> Flow 2 (server to client)
+00000000  53 53 48 2d 32 2e 30 2d  4f 70 65 6e 53 53 48 5f  |SSH-2.0-OpenSSH_|
+00000010  39 2e 39 0d 0a                                    |9.9..|
+>>> Flow 3 (client to server)
+00000000  00 00 03 2c 11 14 7f 9c  2b a4 e8 8f 82 7d 61 60  |...,....+....}a`|
+00000010  45 50 76 05 85 3e 00 00  00 c9 63 75 72 76 65 32  |EPv..>....curve2|
+00000020  35 35 31 39 2d 73 68 61  32 35 36 2c 63 75 72 76  |5519-sha256,curv|
+00000030  65 32 35 35 31 39 2d 73  68 61 32 35 36 40 6c 69  |e25519-sha256@li|
+00000040  62 73 73 68 2e 6f 72 67  2c 65 63 64 68 2d 73 68  |bssh.org,ecdh-sh|
+00000050  61 32 2d 6e 69 73 74 70  32 35 36 2c 65 63 64 68  |a2-nistp256,ecdh|
+00000060  2d 73 68 61 32 2d 6e 69  73 74 70 33 38 34 2c 65  |-sha2-nistp384,e|
+00000070  63 64 68 2d 73 68 61 32  2d 6e 69 73 74 70 35 32  |cdh-sha2-nistp52|
+00000080  31 2c 64 69 66 66 69 65  2d 68 65 6c 6c 6d 61 6e  |1,diffie-hellman|
+00000090  2d 67 72 6f 75 70 31 34  2d 73 68 61 32 35 36 2c  |-group14-sha256,|
+000000a0  64 69 66 66 69 65 2d 68  65 6c 6c 6d 61 6e 2d 67  |diffie-hellman-g|
+000000b0  72 6f 75 70 31 34 2d 73  68 61 31 2c 65 78 74 2d  |roup14-sha1,ext-|
+000000c0  69 6e 66 6f 2d 63 2c 6b  65 78 2d 73 74 72 69 63  |info-c,kex-stric|
+000000d0  74 2d 63 2d 76 30 30 40  6f 70 65 6e 73 73 68 2e  |t-c-v00@openssh.|
+000000e0  63 6f 6d 00 00 00 57 65  63 64 73 61 2d 73 68 61  |com...Wecdsa-sha|
+000000f0  32 2d 6e 69 73 74 70 32  35 36 2c 65 63 64 73 61  |2-nistp256,ecdsa|
+00000100  2d 73 68 61 32 2d 6e 69  73 74 70 33 38 34 2c 65  |-sha2-nistp384,e|
+00000110  63 64 73 61 2d 73 68 61  32 2d 6e 69 73 74 70 35  |cdsa-sha2-nistp5|
+00000120  32 31 2c 73 73 68 2d 72  73 61 2c 73 73 68 2d 64  |21,ssh-rsa,ssh-d|
+00000130  73 73 2c 73 73 68 2d 65  64 32 35 35 31 39 00 00  |ss,ssh-ed25519..|
+00000140  00 6c 61 65 73 31 32 38  2d 67 63 6d 40 6f 70 65  |.laes128-gcm@ope|
+00000150  6e 73 73 68 2e 63 6f 6d  2c 61 65 73 32 35 36 2d  |nssh.com,aes256-|
+00000160  67 63 6d 40 6f 70 65 6e  73 73 68 2e 63 6f 6d 2c  |gcm@openssh.com,|
+00000170  63 68 61 63 68 61 32 30  2d 70 6f 6c 79 31 33 30  |chacha20-poly130|
+00000180  35 40 6f 70 65 6e 73 73  68 2e 63 6f 6d 2c 61 65  |5@openssh.com,ae|
+00000190  73 31 32 38 2d 63 74 72  2c 61 65 73 31 39 32 2d  |s128-ctr,aes192-|
+000001a0  63 74 72 2c 61 65 73 32  35 36 2d 63 74 72 00 00  |ctr,aes256-ctr..|
+000001b0  00 6c 61 65 73 31 32 38  2d 67 63 6d 40 6f 70 65  |.laes128-gcm@ope|
+000001c0  6e 73 73 68 2e 63 6f 6d  2c 61 65 73 32 35 36 2d  |nssh.com,aes256-|
+000001d0  67 63 6d 40 6f 70 65 6e  73 73 68 2e 63 6f 6d 2c  |gcm@openssh.com,|
+000001e0  63 68 61 63 68 61 32 30  2d 70 6f 6c 79 31 33 30  |chacha20-poly130|
+000001f0  35 40 6f 70 65 6e 73 73  68 2e 63 6f 6d 2c 61 65  |5@openssh.com,ae|
+00000200  73 31 32 38 2d 63 74 72  2c 61 65 73 31 39 32 2d  |s128-ctr,aes192-|
+00000210  63 74 72 2c 61 65 73 32  35 36 2d 63 74 72 00 00  |ctr,aes256-ctr..|
+00000220  00 6e 68 6d 61 63 2d 73  68 61 32 2d 32 35 36 2d  |.nhmac-sha2-256-|
+00000230  65 74 6d 40 6f 70 65 6e  73 73 68 2e 63 6f 6d 2c  |etm@openssh.com,|
+00000240  68 6d 61 63 2d 73 68 61  32 2d 35 31 32 2d 65 74  |hmac-sha2-512-et|
+00000250  6d 40 6f 70 65 6e 73 73  68 2e 63 6f 6d 2c 68 6d  |m@openssh.com,hm|
+00000260  61 63 2d 73 68 61 32 2d  32 35 36 2c 68 6d 61 63  |ac-sha2-256,hmac|
+00000270  2d 73 68 61 32 2d 35 31  32 2c 68 6d 61 63 2d 73  |-sha2-512,hmac-s|
+00000280  68 61 31 2c 68 6d 61 63  2d 73 68 61 31 2d 39 36  |ha1,hmac-sha1-96|
+00000290  00 00 00 6e 68 6d 61 63  2d 73 68 61 32 2d 32 35  |...nhmac-sha2-25|
+000002a0  36 2d 65 74 6d 40 6f 70  65 6e 73 73 68 2e 63 6f  |6-etm@openssh.co|
+000002b0  6d 2c 68 6d 61 63 2d 73  68 61 32 2d 35 31 32 2d  |m,hmac-sha2-512-|
+000002c0  65 74 6d 40 6f 70 65 6e  73 73 68 2e 63 6f 6d 2c  |etm@openssh.com,|
+000002d0  68 6d 61 63 2d 73 68 61  32 2d 32 35 36 2c 68 6d  |hmac-sha2-256,hm|
+000002e0  61 63 2d 73 68 61 32 2d  35 31 32 2c 68 6d 61 63  |ac-sha2-512,hmac|
+000002f0  2d 73 68 61 31 2c 68 6d  61 63 2d 73 68 61 31 2d  |-sha1,hmac-sha1-|
+00000300  39 36 00 00 00 04 6e 6f  6e 65 00 00 00 04 6e 6f  |96....none....no|
+00000310  6e 65 00 00 00 00 00 00  00 00 00 00 00 00 00 d7  |ne..............|
+00000320  3b 80 93 f6 ef bc 88 eb  1a 6e ac fa 66 ef 26 3c  |;........n..f.&<|
+>>> Flow 4 (server to client)
+00000000  00 00 04 9c 0a 14 c8 9f  47 8f 1d b3 6c e4 86 d8  |........G...l...|
+00000010  29 d2 db 83 c7 ee 00 00  01 7a 73 6e 74 72 75 70  |)........zsntrup|
+00000020  37 36 31 78 32 35 35 31  39 2d 73 68 61 35 31 32  |761x25519-sha512|
+00000030  2c 73 6e 74 72 75 70 37  36 31 78 32 35 35 31 39  |,sntrup761x25519|
+00000040  2d 73 68 61 35 31 32 40  6f 70 65 6e 73 73 68 2e  |-sha512@openssh.|
+00000050  63 6f 6d 2c 6d 6c 6b 65  6d 37 36 38 78 32 35 35  |com,mlkem768x255|
+00000060  31 39 2d 73 68 61 32 35  36 2c 63 75 72 76 65 32  |19-sha256,curve2|
+00000070  35 35 31 39 2d 73 68 61  32 35 36 2c 63 75 72 76  |5519-sha256,curv|
+00000080  65 32 35 35 31 39 2d 73  68 61 32 35 36 40 6c 69  |e25519-sha256@li|
+00000090  62 73 73 68 2e 6f 72 67  2c 65 63 64 68 2d 73 68  |bssh.org,ecdh-sh|
+000000a0  61 32 2d 6e 69 73 74 70  32 35 36 2c 65 63 64 68  |a2-nistp256,ecdh|
+000000b0  2d 73 68 61 32 2d 6e 69  73 74 70 33 38 34 2c 65  |-sha2-nistp384,e|
+000000c0  63 64 68 2d 73 68 61 32  2d 6e 69 73 74 70 35 32  |cdh-sha2-nistp52|
+000000d0  31 2c 64 69 66 66 69 65  2d 68 65 6c 6c 6d 61 6e  |1,diffie-hellman|
+000000e0  2d 67 72 6f 75 70 2d 65  78 63 68 61 6e 67 65 2d  |-group-exchange-|
+000000f0  73 68 61 32 35 36 2c 64  69 66 66 69 65 2d 68 65  |sha256,diffie-he|
+00000100  6c 6c 6d 61 6e 2d 67 72  6f 75 70 31 36 2d 73 68  |llman-group16-sh|
+00000110  61 35 31 32 2c 64 69 66  66 69 65 2d 68 65 6c 6c  |a512,diffie-hell|
+00000120  6d 61 6e 2d 67 72 6f 75  70 31 38 2d 73 68 61 35  |man-group18-sha5|
+00000130  31 32 2c 64 69 66 66 69  65 2d 68 65 6c 6c 6d 61  |12,diffie-hellma|
+00000140  6e 2d 67 72 6f 75 70 31  34 2d 73 68 61 32 35 36  |n-group14-sha256|
+00000150  2c 64 69 66 66 69 65 2d  68 65 6c 6c 6d 61 6e 2d  |,diffie-hellman-|
+00000160  67 72 6f 75 70 31 34 2d  73 68 61 31 2c 65 78 74  |group14-sha1,ext|
+00000170  2d 69 6e 66 6f 2d 73 2c  6b 65 78 2d 73 74 72 69  |-info-s,kex-stri|
+00000180  63 74 2d 73 2d 76 30 30  40 6f 70 65 6e 73 73 68  |ct-s-v00@openssh|
+00000190  2e 63 6f 6d 00 00 00 2d  72 73 61 2d 73 68 61 32  |.com...-rsa-sha2|
+000001a0  2d 35 31 32 2c 72 73 61  2d 73 68 61 32 2d 32 35  |-512,rsa-sha2-25|
+000001b0  36 2c 65 63 64 73 61 2d  73 68 61 32 2d 6e 69 73  |6,ecdsa-sha2-nis|
+000001c0  74 70 32 35 36 00 00 00  6c 63 68 61 63 68 61 32  |tp256...lchacha2|
+000001d0  30 2d 70 6f 6c 79 31 33  30 35 40 6f 70 65 6e 73  |0-poly1305@opens|
+000001e0  73 68 2e 63 6f 6d 2c 61  65 73 31 32 38 2d 63 74  |sh.com,aes128-ct|
+000001f0  72 2c 61 65 73 31 39 32  2d 63 74 72 2c 61 65 73  |r,aes192-ctr,aes|
+00000200  32 35 36 2d 63 74 72 2c  61 65 73 31 32 38 2d 67  |256-ctr,aes128-g|
+00000210  63 6d 40 6f 70 65 6e 73  73 68 2e 63 6f 6d 2c 61  |cm@openssh.com,a|
+00000220  65 73 32 35 36 2d 67 63  6d 40 6f 70 65 6e 73 73  |es256-gcm@openss|
+00000230  68 2e 63 6f 6d 00 00 00  6c 63 68 61 63 68 61 32  |h.com...lchacha2|
+00000240  30 2d 70 6f 6c 79 31 33  30 35 40 6f 70 65 6e 73  |0-poly1305@opens|
+00000250  73 68 2e 63 6f 6d 2c 61  65 73 31 32 38 2d 63 74  |sh.com,aes128-ct|
+00000260  72 2c 61 65 73 31 39 32  2d 63 74 72 2c 61 65 73  |r,aes192-ctr,aes|
+00000270  32 35 36 2d 63 74 72 2c  61 65 73 31 32 38 2d 67  |256-ctr,aes128-g|
+00000280  63 6d 40 6f 70 65 6e 73  73 68 2e 63 6f 6d 2c 61  |cm@openssh.com,a|
+00000290  65 73 32 35 36 2d 67 63  6d 40 6f 70 65 6e 73 73  |es256-gcm@openss|
+000002a0  68 2e 63 6f 6d 00 00 00  d5 75 6d 61 63 2d 36 34  |h.com....umac-64|
+000002b0  2d 65 74 6d 40 6f 70 65  6e 73 73 68 2e 63 6f 6d  |-etm@openssh.com|
+000002c0  2c 75 6d 61 63 2d 31 32  38 2d 65 74 6d 40 6f 70  |,umac-128-etm@op|
+000002d0  65 6e 73 73 68 2e 63 6f  6d 2c 68 6d 61 63 2d 73  |enssh.com,hmac-s|
+000002e0  68 61 32 2d 32 35 36 2d  65 74 6d 40 6f 70 65 6e  |ha2-256-etm@open|
+000002f0  73 73 68 2e 63 6f 6d 2c  68 6d 61 63 2d 73 68 61  |ssh.com,hmac-sha|
+00000300  32 2d 35 31 32 2d 65 74  6d 40 6f 70 65 6e 73 73  |2-512-etm@openss|
+00000310  68 2e 63 6f 6d 2c 68 6d  61 63 2d 73 68 61 31 2d  |h.com,hmac-sha1-|
+00000320  65 74 6d 40 6f 70 65 6e  73 73 68 2e 63 6f 6d 2c  |etm@openssh.com,|
+00000330  75 6d 61 63 2d 36 34 40  6f 70 65 6e 73 73 68 2e  |umac-64@openssh.|
+00000340  63 6f 6d 2c 75 6d 61 63  2d 31 32 38 40 6f 70 65  |com,umac-128@ope|
+00000350  6e 73 73 68 2e 63 6f 6d  2c 68 6d 61 63 2d 73 68  |nssh.com,hmac-sh|
+00000360  61 32 2d 32 35 36 2c 68  6d 61 63 2d 73 68 61 32  |a2-256,hmac-sha2|
+00000370  2d 35 31 32 2c 68 6d 61  63 2d 73 68 61 31 00 00  |-512,hmac-sha1..|
+00000380  00 d5 75 6d 61 63 2d 36  34 2d 65 74 6d 40 6f 70  |..umac-64-etm@op|
+00000390  65 6e 73 73 68 2e 63 6f  6d 2c 75 6d 61 63 2d 31  |enssh.com,umac-1|
+000003a0  32 38 2d 65 74 6d 40 6f  70 65 6e 73 73 68 2e 63  |28-etm@openssh.c|
+000003b0  6f 6d 2c 68 6d 61 63 2d  73 68 61 32 2d 32 35 36  |om,hmac-sha2-256|
+000003c0  2d 65 74 6d 40 6f 70 65  6e 73 73 68 2e 63 6f 6d  |-etm@openssh.com|
+000003d0  2c 68 6d 61 63 2d 73 68  61 32 2d 35 31 32 2d 65  |,hmac-sha2-512-e|
+000003e0  74 6d 40 6f 70 65 6e 73  73 68 2e 63 6f 6d 2c 68  |tm@openssh.com,h|
+000003f0  6d 61 63 2d 73 68 61 31  2d 65 74 6d 40 6f 70 65  |mac-sha1-etm@ope|
+00000400  6e 73 73 68 2e 63 6f 6d  2c 75 6d 61 63 2d 36 34  |nssh.com,umac-64|
+00000410  40 6f 70 65 6e 73 73 68  2e 63 6f 6d 2c 75 6d 61  |@openssh.com,uma|
+00000420  63 2d 31 32 38 40 6f 70  65 6e 73 73 68 2e 63 6f  |c-128@openssh.co|
+00000430  6d 2c 68 6d 61 63 2d 73  68 61 32 2d 32 35 36 2c  |m,hmac-sha2-256,|
+00000440  68 6d 61 63 2d 73 68 61  32 2d 35 31 32 2c 68 6d  |hmac-sha2-512,hm|
+00000450  61 63 2d 73 68 61 31 00  00 00 15 6e 6f 6e 65 2c  |ac-sha1....none,|
+00000460  7a 6c 69 62 40 6f 70 65  6e 73 73 68 2e 63 6f 6d  |zlib@openssh.com|
+00000470  00 00 00 15 6e 6f 6e 65  2c 7a 6c 69 62 40 6f 70  |....none,zlib@op|
+00000480  65 6e 73 73 68 2e 63 6f  6d 00 00 00 00 00 00 00  |enssh.com.......|
+00000490  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+>>> Flow 5 (client to server)
+00000000  00 00 00 2c 06 1e 00 00  00 20 aa 80 4b 53 a8 4b  |...,..... ..KS.K|
+00000010  4c 0f fa ac a3 b8 5f 64  7d 36 42 e7 1d 56 45 7e  |L....._d}6B..VE~|
+00000020  2b ac e0 f9 e7 60 f5 d7  55 37 b8 cc 87 3c 23 dc  |+....`..U7...<#.|
+>>> Flow 6 (server to client)
+00000000  00 00 01 04 0a 1f 00 00  00 68 00 00 00 13 65 63  |.........h....ec|
+00000010  64 73 61 2d 73 68 61 32  2d 6e 69 73 74 70 32 35  |dsa-sha2-nistp25|
+00000020  36 00 00 00 08 6e 69 73  74 70 32 35 36 00 00 00  |6....nistp256...|
+00000030  41 04 8b d1 dd c3 a2 af  65 c5 b1 7e 0d 88 0e 10  |A.......e..~....|
+00000040  3b 52 4a 43 b7 3c ed e9  9a 89 5d 2b 05 74 b7 7e  |;RJC.<....]+.t.~|
+00000050  2b 1e 12 dd 2c 78 71 53  be eb f6 4e 5d 19 cf 98  |+...,xqS...N]...|
+00000060  d0 25 2d 4a a3 4a 15 2c  50 10 67 80 6d 2e d9 fa  |.%-J.J.,P.g.m...|
+00000070  84 a8 00 00 00 20 37 00  93 5e 60 8c 9f e2 e0 4b  |..... 7..^`....K|
+00000080  59 97 5c 6f d4 5a 3e 25  f8 fb 08 72 92 05 4d 6c  |Y.\o.Z>%...r..Ml|
+00000090  80 c4 27 0e ec 26 00 00  00 64 00 00 00 13 65 63  |..'..&...d....ec|
+000000a0  64 73 61 2d 73 68 61 32  2d 6e 69 73 74 70 32 35  |dsa-sha2-nistp25|
+000000b0  36 00 00 00 49 00 00 00  21 00 ec c1 21 3e be 3c  |6...I...!...!>.<|
+000000c0  7a 50 7b 47 eb c2 92 bf  0b 93 cf 59 b5 84 2c f5  |zP{G.......Y..,.|
+000000d0  bf 9b 2d 01 cc 2e 42 15  b0 04 00 00 00 20 61 99  |..-...B...... a.|
+000000e0  9e 54 45 c1 54 a4 da d6  0b 3a d1 09 24 0f a0 b1  |.TE.T....:..$...|
+000000f0  66 b9 6f 06 a4 f4 09 7e  51 3f 5a e2 98 6c 00 00  |f.o....~Q?Z..l..|
+00000100  00 00 00 00 00 00 00 00  00 00 00 0c 0a 15 00 00  |................|
+00000110  00 00 00 00 00 00 00 00  00 00 01 40 57 9a 3e 61  |...........@W.>a|
+00000120  04 0a 62 05 83 8d 82 84  8a e6 91 0b 2c 28 d5 ce  |..b.........,(..|
+00000130  b8 06 56 59 54 af 80 60  6c 9b 8c a5 1c 8a 5a 30  |..VYT..`l.....Z0|
+00000140  e3 70 23 61 86 ed a3 6a  b6 fc 8d b8 d0 c3 72 25  |.p#a...j......r%|
+00000150  1c 4c 5c 84 a5 77 59 83  31 52 1b f4 09 8c 9f a7  |.L\..wY.1R......|
+00000160  b5 b2 ca f2 2c 8d ca 8f  2f 49 b9 83 65 af 97 5d  |....,.../I..e..]|
+00000170  a3 a9 02 97 8f ee 42 30  9a 6c 8a 38 2c 23 33 1b  |......B0.l.8,#3.|
+00000180  16 08 cd 7e 5e 2a 9b b4  34 26 9e 3b cb ec 37 0b  |...~^*..4&.;..7.|
+00000190  39 8e 39 62 80 57 a2 95  d7 0d b6 ce 02 d8 66 b0  |9.9b.W........f.|
+000001a0  15 c4 cf 77 01 80 7b 42  41 96 4d 92 d6 5d b3 03  |...w..{BA.M..]..|
+000001b0  f3 83 22 c8 fe a7 7a c3  a4 aa 6a 75 23 de 4a 30  |.."...z...ju#.J0|
+000001c0  76 e6 8d 2a c7 3a c8 1a  60 f3 db ce 8a 53 44 2f  |v..*.:..`....SD/|
+000001d0  ff 02 38 3e 23 28 cf 45  08 ae b8 a8 24 db 6f 1e  |..8>#(.E....$.o.|
+000001e0  77 7a 33 19 e8 d0 13 11  63 19 b6 71 8b 19 3b 5b  |wz3.....c..q..;[|
+000001f0  ad b5 3d cc 08 6f bd 89  cb fa c9 d7 e6 af e0 82  |..=..o..........|
+00000200  25 8b 60 bb 08 64 d3 71  d0 71 05 f1 94 1e 9b 7b  |%.`..d.q.q.....{|
+00000210  07 35 64 fa 05 c3 23 4d  95 d0 4d 49 7d 93 61 72  |.5d...#M..MI}.ar|
+00000220  11 14 07 94 fb 3e a4 0f  7c ce 24 e3 a5 24 3e ae  |.....>..|.$..$>.|
+00000230  e5 11 f5 29 f1 aa 2d 6c  a8 8d 47 fb cb 0c 62 e2  |...)..-l..G...b.|
+00000240  cc 80 89 bc a6 76 e6 60  5c bf 86 78 58 ea e3 b2  |.....v.`\..xX...|
+00000250  b3 61 35 c4 80 23 f5 c6  ac 45 fd 5f 5b 41 8d 59  |.a5..#...E._[A.Y|
+00000260  eb 4c b2 3c fa df 0a 78  c4 af 59 42              |.L.<...x..YB|
+>>> Flow 7 (client to server)
+00000000  00 00 00 0c 0a 15 62 b8  d2 60 16 9a fa 2f 75 ab  |......b..`.../u.|
+00000010  00 00 00 20 ad 6d e9 f4  a6 ee b0 dc 51 d0 16 a8  |... .m......Q...|
+00000020  48 f5 0b cf 15 42 51 3a  8a 0a 3d 4b cd 20 82 ce  |H....BQ:..=K. ..|
+00000030  3f ac d4 33 0d ff 29 ea  f8 28 2c dc e2 c4 bc 46  |?..3..)..(,....F|
+00000040  c2 5e 8a ce                                       |.^..|
+>>> Flow 8 (server to client)
+00000000  00 00 00 20 25 d5 f5 9e  c7 e4 76 15 a5 03 f4 30  |... %.....v....0|
+00000010  02 2e 64 e7 b7 a8 33 12  d1 d1 e0 62 3d b5 23 12  |..d...3....b=.#.|
+00000020  eb 61 31 21 5c 07 bb 54  bc 4f 29 5d 80 1e 7c 88  |.a1!\..T.O)]..|.|
+00000030  b9 46 b0 56                                       |.F.V|
+>>> Flow 9 (client to server)
+00000000  00 00 00 30 dc 6c b3 a7  e2 60 9c a8 41 3c 12 4b  |...0.l...`..A<.K|
+00000010  f0 90 69 20 65 08 60 50  b0 52 22 ed 50 cf 5f 5c  |..i e.`P.R".P._\|
+00000020  d3 ed 35 13 88 32 2c 7c  d5 5b 6c f3 09 1b 50 0e  |..5..2,|.[l...P.|
+00000030  9b bb ac 21 73 94 51 93  73 de 71 6c 0a fd 11 a4  |...!s.Q.s.ql....|
+00000040  77 70 55 ef                                       |wpU.|
+>>> Flow 10 (server to client)
+00000000  00 00 00 20 32 b6 e9 e4  79 15 00 f8 5a 72 08 38  |... 2...y...Zr.8|
+00000010  55 af 59 21 6e 7f f4 6f  f2 0e e8 d8 a5 61 bb a4  |U.Y!n..o.....a..|
+00000020  ce 26 3b 94 a8 e7 d9 5d  69 d7 6d d7 70 5f b8 a9  |.&;....]i.m.p_..|
+00000030  e9 ee 02 e8 00 00 00 40  21 fe 1d 4e 06 ce c3 51  |.......@!..N...Q|
+00000040  34 9d ad 04 60 1b 5e b7  89 c9 8d f5 24 d7 ff 69  |4...`.^.....$..i|
+00000050  a0 89 fe 95 58 66 7f af  63 1b b2 f5 b0 ad 26 b8  |....Xf..c.....&.|
+00000060  b4 25 33 9d 47 02 69 98  a1 a2 5c 30 5b 1c da 9d  |.%3.G.i...\0[...|
+00000070  7d 75 8c f3 be 05 dd b2  0f 65 5c 1e 17 08 d7 00  |}u.......e\.....|
+00000080  03 97 99 ca a4 ca a3 c2                           |........|
+>>> Flow 11 (client to server)
+00000000  00 00 01 60 4d a5 d0 b6  1a b3 dc c9 f2 da 8e 8a  |...`M...........|
+00000010  03 a4 d3 61 0b 95 e5 7e  db cc 31 49 21 c7 fa 95  |...a...~..1I!...|
+00000020  43 d0 ee 93 d6 45 29 85  3c 9a 82 e4 6b 65 5d 7c  |C....E).<...ke]||
+00000030  cc 52 e8 83 b2 5a 65 ad  2f 83 1f b0 e7 a4 aa c7  |.R...Ze./.......|
+00000040  49 40 98 10 d8 af c2 c0  0f a2 54 d0 30 37 13 06  |I@........T.07..|
+00000050  12 63 a6 3b 73 30 74 d3  47 56 51 ba 23 32 c8 6f  |.c.;s0t.GVQ.#2.o|
+00000060  e7 8a b1 27 fa f6 21 6c  26 2a f7 00 cb 14 d6 9a  |...'..!l&*......|
+00000070  c2 f7 45 51 c8 20 6c 96  24 b2 64 57 06 23 31 ed  |..EQ. l.$.dW.#1.|
+00000080  3a b2 10 7f 1d 8e 48 25  db 95 6c 0e 30 90 aa 69  |:.....H%..l.0..i|
+00000090  92 ae a5 1b 36 40 43 62  95 b0 d8 f6 bf 5c c1 8e  |....6@Cb.....\..|
+000000a0  48 ab 38 f9 75 52 e1 8e  b2 4b 75 6e f4 ac 03 24  |H.8.uR...Kun...$|
+000000b0  73 f4 01 51 98 0c 6f ed  4f 19 29 88 d7 08 13 d2  |s..Q..o.O.).....|
+000000c0  84 d9 54 63 b3 e3 8a 0d  42 6c f0 67 ac dc 4b 93  |..Tc....Bl.g..K.|
+000000d0  79 f2 70 ff 53 1f 27 f3  70 7c bf 75 33 79 64 3c  |y.p.S.'.p|.u3yd<|
+000000e0  eb 30 1b dc c4 ff 11 f9  6f 74 f3 d1 1a c0 6b 4e  |.0......ot....kN|
+000000f0  f2 56 32 5f 0d 82 eb 49  10 a1 0a df 47 af 18 c6  |.V2_...I....G...|
+00000100  21 c3 77 b4 39 7a 62 c3  aa f4 fb 19 95 bc 2d d2  |!.w.9zb.......-.|
+00000110  36 ca 6b d6 bf 91 00 3d  73 e8 41 65 60 44 89 48  |6.k....=s.Ae`D.H|
+00000120  57 89 9b 69 a4 c8 5e c2  df b8 bb e8 da e4 09 f9  |W..i..^.........|
+00000130  29 17 39 c6 35 88 7f 26  9b c8 94 02 03 c4 03 e8  |).9.5..&........|
+00000140  f6 df 68 52 e2 6e 84 91  10 7b 06 23 b0 4b f5 75  |..hR.n...{.#.K.u|
+00000150  4f b6 b8 b4 f2 b3 72 8a  bf 91 92 1f 73 0a de e4  |O.....r.....s...|
+00000160  20 62 3d 30 50 c3 b9 7b  cd 59 d1 83 fd e7 f0 cd  | b=0P..{.Y......|
+00000170  c6 a0 11 12                                       |....|
+>>> Flow 12 (server to client)
+00000000  00 00 01 40 57 32 56 54  ba 8e a5 73 bc 12 1e 11  |...@W2VT...s....|
+00000010  02 03 72 e9 23 4f b2 70  a5 23 ea de f6 1e 25 e3  |..r.#O.p.#....%.|
+00000020  6c d0 8d c5 db da 81 e5  04 71 7e 9b 75 99 1b 70  |l........q~.u..p|
+00000030  ef 04 fc 64 ef 83 2b a9  4b 87 32 ed 28 98 17 ec  |...d..+.K.2.(...|
+00000040  c6 e9 bf 8f 85 8e 93 ac  91 a2 fe a0 78 bc e3 88  |............x...|
+00000050  97 a4 3a 2e 3e 11 f5 04  0e 6f 38 6d 33 7f b7 10  |..:.>....o8m3...|
+00000060  9f 1d 84 45 02 11 da 63  37 f7 86 c7 1b b3 36 ec  |...E...c7.....6.|
+00000070  ea b7 1a 2d 38 39 0a a1  0d 44 84 6b ad d7 22 28  |...-89...D.k.."(|
+00000080  27 ab 24 b5 c3 85 77 31  b3 97 0c 12 35 7f 3e c7  |'.$...w1....5.>.|
+00000090  d4 0e 3f 16 07 70 e8 fc  b1 f7 29 94 28 2c ae 1b  |..?..p....).(,..|
+000000a0  b3 1a 25 8a 2e e7 5f 52  5b 17 dd e5 ec e9 db 93  |..%..._R[.......|
+000000b0  12 29 3d ba bf ac 90 d4  37 42 36 53 ae 3e 8c db  |.)=.....7B6S.>..|
+000000c0  d7 7c 48 c5 43 a1 ee d3  b6 74 ac 01 27 c9 06 0c  |.|H.C....t..'...|
+000000d0  ae 31 68 a7 a9 ff 40 9e  d1 f3 c9 ee ca 3b 98 13  |.1h...@......;..|
+000000e0  aa 5d 00 67 a0 fb 68 32  64 07 ff 4c f3 e1 4c be  |.].g..h2d..L..L.|
+000000f0  38 3e 26 10 5c 9d 4b fc  7f 3f 22 0f ee 12 af f9  |8>&.\.K..?".....|
+00000100  3d 51 83 b1 5c 65 63 f1  fa 92 0e 1d 76 b9 27 a4  |=Q..\ec.....v.'.|
+00000110  a4 a3 ec ba e9 43 b1 77  e1 c7 db 9e 25 bc 93 4d  |.....C.w....%..M|
+00000120  0c 9c bd 64 a0 db f4 a1  2b 9a 24 99 a9 0d be 17  |...d....+.$.....|
+00000130  cd 99 31 da 3f 83 66 c0  4e 6f a5 1a 1e ec 4d 07  |..1.?.f.No....M.|
+00000140  a4 04 d7 23 03 f7 ec 2c  8a 12 96 85 c1 d0 cb 59  |...#...,.......Y|
+00000150  e8 6b 4a 6d                                       |.kJm|
+>>> Flow 13 (client to server)
+00000000  00 00 02 80 5e 7e 95 09  c2 ec 6e cd 14 10 2c 4f  |....^~....n...,O|
+00000010  d3 f5 0a 89 6c 4a 3a b0  26 e4 c4 bc 51 26 ec a2  |....lJ:.&...Q&..|
+00000020  1a c9 35 8e b6 7a a7 88  1d fe 04 04 73 f1 e7 e1  |..5..z......s...|
+00000030  86 4c 3d 85 61 02 cc 5d  24 bb 87 a2 3e b2 5d bd  |.L=.a..]$...>.].|
+00000040  19 5f ce 47 5a 6c 6c ab  45 84 2d 3e 51 82 90 e7  |._.GZll.E.->Q...|
+00000050  76 41 b7 37 0a b8 57 d9  3c 43 3e 3b 3d ba 39 41  |vA.7..W.<C>;=.9A|
+00000060  01 84 1b 3f 80 e0 f4 9b  32 32 12 02 c5 f5 23 4e  |...?....22....#N|
+00000070  36 75 37 2b ce 24 5e f7  9b 5b 3c 6e f8 2c aa d5  |6u7+.$^..[<n.,..|
+00000080  77 03 b0 ff fe ad 75 2f  73 b5 94 0b aa f4 08 31  |w.....u/s......1|
+00000090  46 a3 f3 f6 7e 1e bf eb  fe c3 2c 20 e7 c5 02 41  |F...~....., ...A|
+000000a0  2b 91 dd eb 8d f4 ec a9  61 0c b8 c3 67 12 0d 1f  |+.......a...g...|
+000000b0  4f a8 40 b0 64 68 f0 90  65 d8 06 f6 b0 7d 9f 5c  |O.@.dh..e....}.\|
+000000c0  2c 54 5e c4 db bc 44 b2  8a 65 9b 70 e4 5f dd 73  |,T^...D..e.p._.s|
+000000d0  1b 4e 91 9a 3a 87 ba da  1e d9 0e 7c 68 b3 b1 c3  |.N..:......|h...|
+000000e0  8e ce 32 a5 0d 09 22 8d  62 79 80 75 54 59 1f f8  |..2...".by.uTY..|
+000000f0  9c 80 4a 4a 17 a6 1d 74  1f bd b8 76 32 24 d7 4c  |..JJ...t...v2$.L|
+00000100  64 0d 58 a4 f1 2e 4b 7a  82 31 33 8b 53 b2 e0 84  |d.X...Kz.13.S...|
+00000110  72 88 2d 97 2b e8 27 77  4f ed 0c ad 04 5a 7a 7d  |r.-.+.'wO....Zz}|
+00000120  f2 10 7c db 08 b6 cd 00  22 32 19 21 4c c3 c0 71  |..|....."2.!L..q|
+00000130  1a 95 4c 97 74 54 9d 2d  81 73 47 45 9b bb 72 16  |..L.tT.-.sGE..r.|
+00000140  b5 10 d0 11 6a 2d 90 fa  5b 17 27 62 75 a9 40 91  |....j-..[.'bu.@.|
+00000150  f6 a4 0b 3a 36 27 2c 48  e3 74 07 7d a9 35 58 7b  |...:6',H.t.}.5X{|
+00000160  b8 0e 05 48 6c 30 96 dc  d0 b0 e2 a4 9b 82 71 04  |...Hl0........q.|
+00000170  bd cd 66 54 ee 8c 1e 82  cd 5e 08 67 d3 92 d3 ad  |..fT.....^.g....|
+00000180  6f 68 20 ac 2e 07 16 39  6c 05 3f 1f 72 89 0b 5d  |oh ....9l.?.r..]|
+00000190  00 d1 a8 ce f7 93 7c b0  fe d5 01 8a dc be 1f 2b  |......|........+|
+000001a0  cf 94 9b 2e bc 2d c5 cc  9f 1a 88 44 73 f2 82 20  |.....-.....Ds.. |
+000001b0  30 ba 04 da 91 46 22 30  1a a5 bf ee 73 80 69 9d  |0....F"0....s.i.|
+000001c0  66 0d 61 02 b2 9a ff 39  87 35 89 3e 53 f8 1a d2  |f.a....9.5.>S...|
+000001d0  c0 31 f3 d0 19 4d 51 a5  05 da 8d d3 9b a7 58 29  |.1...MQ.......X)|
+000001e0  1e 25 c1 2e f8 27 ad 05  3f 11 b6 1f 9c 6d a5 d0  |.%...'..?....m..|
+000001f0  28 db ba 57 8a 12 9f c5  f3 73 93 48 05 ba d2 0a  |(..W.....s.H....|
+00000200  a8 6d a4 a8 96 02 de a8  77 fd 01 e4 fe 14 87 46  |.m......w......F|
+00000210  d4 df f4 fc a7 e7 40 c2  3a 64 52 98 b8 5e 0f 00  |......@.:dR..^..|
+00000220  06 bf 70 d9 5b 2d 14 22  3e 6a a8 e2 c5 9b 91 76  |..p.[-.">j.....v|
+00000230  50 c9 92 b5 c0 31 32 a8  77 c9 be 02 00 68 08 c4  |P....12.w....h..|
+00000240  1e 08 d1 fa d8 e8 32 97  5a 0a 56 a8 9b 78 94 20  |......2.Z.V..x. |
+00000250  84 dd 56 18 2e eb 5d d2  e3 fd 28 05 b7 15 32 87  |..V...]...(...2.|
+00000260  c4 78 71 f6 11 41 22 da  3b b5 4c 60 71 df 6c eb  |.xq..A".;.L`q.l.|
+00000270  c3 7c 4a 9c b3 e3 c9 12  2b a3 79 c9 e2 99 2a 4d  |.|J.....+.y...*M|
+00000280  6b 88 2b 42 48 79 c7 52  33 f5 09 2e 60 1f 96 b1  |k.+BHy.R3...`...|
+00000290  b5 35 94 5a                                       |.5.Z|
+>>> Flow 14 (server to client)
+00000000  00 00 00 10 60 4c c8 0d  e2 72 d3 60 e0 94 a4 06  |....`L...r.`....|
+00000010  79 85 52 74 0f 2d 35 96  99 61 f6 8d d4 01 6e e3  |y.Rt.-5..a....n.|
+00000020  b2 54 8a 0f                                       |.T..|

ssh/testdata/Client-Cipher-aes128-ctr

@@ -0,0 +1,295 @@
+>>> Flow 1 (client to server)
+00000000  53 53 48 2d 32 2e 30 2d  47 6f 0d 0a              |SSH-2.0-Go..|
+>>> Flow 2 (server to client)
+00000000  53 53 48 2d 32 2e 30 2d  4f 70 65 6e 53 53 48 5f  |SSH-2.0-OpenSSH_|
+00000010  39 2e 39 0d 0a                                    |9.9..|
+>>> Flow 3 (client to server)
+00000000  00 00 02 5c 05 14 7f 9c  2b a4 e8 8f 82 7d 61 60  |...\....+....}a`|
+00000010  45 50 76 05 85 3e 00 00  00 c9 63 75 72 76 65 32  |EPv..>....curve2|
+00000020  35 35 31 39 2d 73 68 61  32 35 36 2c 63 75 72 76  |5519-sha256,curv|
+00000030  65 32 35 35 31 39 2d 73  68 61 32 35 36 40 6c 69  |e25519-sha256@li|
+00000040  62 73 73 68 2e 6f 72 67  2c 65 63 64 68 2d 73 68  |bssh.org,ecdh-sh|
+00000050  61 32 2d 6e 69 73 74 70  32 35 36 2c 65 63 64 68  |a2-nistp256,ecdh|
+00000060  2d 73 68 61 32 2d 6e 69  73 74 70 33 38 34 2c 65  |-sha2-nistp384,e|
+00000070  63 64 68 2d 73 68 61 32  2d 6e 69 73 74 70 35 32  |cdh-sha2-nistp52|
+00000080  31 2c 64 69 66 66 69 65  2d 68 65 6c 6c 6d 61 6e  |1,diffie-hellman|
+00000090  2d 67 72 6f 75 70 31 34  2d 73 68 61 32 35 36 2c  |-group14-sha256,|
+000000a0  64 69 66 66 69 65 2d 68  65 6c 6c 6d 61 6e 2d 67  |diffie-hellman-g|
+000000b0  72 6f 75 70 31 34 2d 73  68 61 31 2c 65 78 74 2d  |roup14-sha1,ext-|
+000000c0  69 6e 66 6f 2d 63 2c 6b  65 78 2d 73 74 72 69 63  |info-c,kex-stric|
+000000d0  74 2d 63 2d 76 30 30 40  6f 70 65 6e 73 73 68 2e  |t-c-v00@openssh.|
+000000e0  63 6f 6d 00 00 00 57 65  63 64 73 61 2d 73 68 61  |com...Wecdsa-sha|
+000000f0  32 2d 6e 69 73 74 70 32  35 36 2c 65 63 64 73 61  |2-nistp256,ecdsa|
+00000100  2d 73 68 61 32 2d 6e 69  73 74 70 33 38 34 2c 65  |-sha2-nistp384,e|
+00000110  63 64 73 61 2d 73 68 61  32 2d 6e 69 73 74 70 35  |cdsa-sha2-nistp5|
+00000120  32 31 2c 73 73 68 2d 72  73 61 2c 73 73 68 2d 64  |21,ssh-rsa,ssh-d|
+00000130  73 73 2c 73 73 68 2d 65  64 32 35 35 31 39 00 00  |ss,ssh-ed25519..|
+00000140  00 0a 61 65 73 31 32 38  2d 63 74 72 00 00 00 0a  |..aes128-ctr....|
+00000150  61 65 73 31 32 38 2d 63  74 72 00 00 00 6e 68 6d  |aes128-ctr...nhm|
+00000160  61 63 2d 73 68 61 32 2d  32 35 36 2d 65 74 6d 40  |ac-sha2-256-etm@|
+00000170  6f 70 65 6e 73 73 68 2e  63 6f 6d 2c 68 6d 61 63  |openssh.com,hmac|
+00000180  2d 73 68 61 32 2d 35 31  32 2d 65 74 6d 40 6f 70  |-sha2-512-etm@op|
+00000190  65 6e 73 73 68 2e 63 6f  6d 2c 68 6d 61 63 2d 73  |enssh.com,hmac-s|
+000001a0  68 61 32 2d 32 35 36 2c  68 6d 61 63 2d 73 68 61  |ha2-256,hmac-sha|
+000001b0  32 2d 35 31 32 2c 68 6d  61 63 2d 73 68 61 31 2c  |2-512,hmac-sha1,|
+000001c0  68 6d 61 63 2d 73 68 61  31 2d 39 36 00 00 00 6e  |hmac-sha1-96...n|
+000001d0  68 6d 61 63 2d 73 68 61  32 2d 32 35 36 2d 65 74  |hmac-sha2-256-et|
+000001e0  6d 40 6f 70 65 6e 73 73  68 2e 63 6f 6d 2c 68 6d  |m@openssh.com,hm|
+000001f0  61 63 2d 73 68 61 32 2d  35 31 32 2d 65 74 6d 40  |ac-sha2-512-etm@|
+00000200  6f 70 65 6e 73 73 68 2e  63 6f 6d 2c 68 6d 61 63  |openssh.com,hmac|
+00000210  2d 73 68 61 32 2d 32 35  36 2c 68 6d 61 63 2d 73  |-sha2-256,hmac-s|
+00000220  68 61 32 2d 35 31 32 2c  68 6d 61 63 2d 73 68 61  |ha2-512,hmac-sha|
+00000230  31 2c 68 6d 61 63 2d 73  68 61 31 2d 39 36 00 00  |1,hmac-sha1-96..|
+00000240  00 04 6e 6f 6e 65 00 00  00 04 6e 6f 6e 65 00 00  |..none....none..|
+00000250  00 00 00 00 00 00 00 00  00 00 00 d7 3b 80 93 f6  |............;...|
+>>> Flow 4 (server to client)
+00000000  00 00 04 9c 0a 14 3c 7e  44 d5 52 42 76 d2 6a fa  |......<~D.RBv.j.|
+00000010  8b b0 ea cc ef 95 00 00  01 7a 73 6e 74 72 75 70  |.........zsntrup|
+00000020  37 36 31 78 32 35 35 31  39 2d 73 68 61 35 31 32  |761x25519-sha512|
+00000030  2c 73 6e 74 72 75 70 37  36 31 78 32 35 35 31 39  |,sntrup761x25519|
+00000040  2d 73 68 61 35 31 32 40  6f 70 65 6e 73 73 68 2e  |-sha512@openssh.|
+00000050  63 6f 6d 2c 6d 6c 6b 65  6d 37 36 38 78 32 35 35  |com,mlkem768x255|
+00000060  31 39 2d 73 68 61 32 35  36 2c 63 75 72 76 65 32  |19-sha256,curve2|
+00000070  35 35 31 39 2d 73 68 61  32 35 36 2c 63 75 72 76  |5519-sha256,curv|
+00000080  65 32 35 35 31 39 2d 73  68 61 32 35 36 40 6c 69  |e25519-sha256@li|
+00000090  62 73 73 68 2e 6f 72 67  2c 65 63 64 68 2d 73 68  |bssh.org,ecdh-sh|
+000000a0  61 32 2d 6e 69 73 74 70  32 35 36 2c 65 63 64 68  |a2-nistp256,ecdh|
+000000b0  2d 73 68 61 32 2d 6e 69  73 74 70 33 38 34 2c 65  |-sha2-nistp384,e|
+000000c0  63 64 68 2d 73 68 61 32  2d 6e 69 73 74 70 35 32  |cdh-sha2-nistp52|
+000000d0  31 2c 64 69 66 66 69 65  2d 68 65 6c 6c 6d 61 6e  |1,diffie-hellman|
+000000e0  2d 67 72 6f 75 70 2d 65  78 63 68 61 6e 67 65 2d  |-group-exchange-|
+000000f0  73 68 61 32 35 36 2c 64  69 66 66 69 65 2d 68 65  |sha256,diffie-he|
+00000100  6c 6c 6d 61 6e 2d 67 72  6f 75 70 31 36 2d 73 68  |llman-group16-sh|
+00000110  61 35 31 32 2c 64 69 66  66 69 65 2d 68 65 6c 6c  |a512,diffie-hell|
+00000120  6d 61 6e 2d 67 72 6f 75  70 31 38 2d 73 68 61 35  |man-group18-sha5|
+00000130  31 32 2c 64 69 66 66 69  65 2d 68 65 6c 6c 6d 61  |12,diffie-hellma|
+00000140  6e 2d 67 72 6f 75 70 31  34 2d 73 68 61 32 35 36  |n-group14-sha256|
+00000150  2c 64 69 66 66 69 65 2d  68 65 6c 6c 6d 61 6e 2d  |,diffie-hellman-|
+00000160  67 72 6f 75 70 31 34 2d  73 68 61 31 2c 65 78 74  |group14-sha1,ext|
+00000170  2d 69 6e 66 6f 2d 73 2c  6b 65 78 2d 73 74 72 69  |-info-s,kex-stri|
+00000180  63 74 2d 73 2d 76 30 30  40 6f 70 65 6e 73 73 68  |ct-s-v00@openssh|
+00000190  2e 63 6f 6d 00 00 00 2d  72 73 61 2d 73 68 61 32  |.com...-rsa-sha2|
+000001a0  2d 35 31 32 2c 72 73 61  2d 73 68 61 32 2d 32 35  |-512,rsa-sha2-25|
+000001b0  36 2c 65 63 64 73 61 2d  73 68 61 32 2d 6e 69 73  |6,ecdsa-sha2-nis|
+000001c0  74 70 32 35 36 00 00 00  6c 63 68 61 63 68 61 32  |tp256...lchacha2|
+000001d0  30 2d 70 6f 6c 79 31 33  30 35 40 6f 70 65 6e 73  |0-poly1305@opens|
+000001e0  73 68 2e 63 6f 6d 2c 61  65 73 31 32 38 2d 63 74  |sh.com,aes128-ct|
+000001f0  72 2c 61 65 73 31 39 32  2d 63 74 72 2c 61 65 73  |r,aes192-ctr,aes|
+00000200  32 35 36 2d 63 74 72 2c  61 65 73 31 32 38 2d 67  |256-ctr,aes128-g|
+00000210  63 6d 40 6f 70 65 6e 73  73 68 2e 63 6f 6d 2c 61  |cm@openssh.com,a|
+00000220  65 73 32 35 36 2d 67 63  6d 40 6f 70 65 6e 73 73  |es256-gcm@openss|
+00000230  68 2e 63 6f 6d 00 00 00  6c 63 68 61 63 68 61 32  |h.com...lchacha2|
+00000240  30 2d 70 6f 6c 79 31 33  30 35 40 6f 70 65 6e 73  |0-poly1305@opens|
+00000250  73 68 2e 63 6f 6d 2c 61  65 73 31 32 38 2d 63 74  |sh.com,aes128-ct|
+00000260  72 2c 61 65 73 31 39 32  2d 63 74 72 2c 61 65 73  |r,aes192-ctr,aes|
+00000270  32 35 36 2d 63 74 72 2c  61 65 73 31 32 38 2d 67  |256-ctr,aes128-g|
+00000280  63 6d 40 6f 70 65 6e 73  73 68 2e 63 6f 6d 2c 61  |cm@openssh.com,a|
+00000290  65 73 32 35 36 2d 67 63  6d 40 6f 70 65 6e 73 73  |es256-gcm@openss|
+000002a0  68 2e 63 6f 6d 00 00 00  d5 75 6d 61 63 2d 36 34  |h.com....umac-64|
+000002b0  2d 65 74 6d 40 6f 70 65  6e 73 73 68 2e 63 6f 6d  |-etm@openssh.com|
+000002c0  2c 75 6d 61 63 2d 31 32  38 2d 65 74 6d 40 6f 70  |,umac-128-etm@op|
+000002d0  65 6e 73 73 68 2e 63 6f  6d 2c 68 6d 61 63 2d 73  |enssh.com,hmac-s|
+000002e0  68 61 32 2d 32 35 36 2d  65 74 6d 40 6f 70 65 6e  |ha2-256-etm@open|
+000002f0  73 73 68 2e 63 6f 6d 2c  68 6d 61 63 2d 73 68 61  |ssh.com,hmac-sha|
+00000300  32 2d 35 31 32 2d 65 74  6d 40 6f 70 65 6e 73 73  |2-512-etm@openss|
+00000310  68 2e 63 6f 6d 2c 68 6d  61 63 2d 73 68 61 31 2d  |h.com,hmac-sha1-|
+00000320  65 74 6d 40 6f 70 65 6e  73 73 68 2e 63 6f 6d 2c  |etm@openssh.com,|
+00000330  75 6d 61 63 2d 36 34 40  6f 70 65 6e 73 73 68 2e  |umac-64@openssh.|
+00000340  63 6f 6d 2c 75 6d 61 63  2d 31 32 38 40 6f 70 65  |com,umac-128@ope|
+00000350  6e 73 73 68 2e 63 6f 6d  2c 68 6d 61 63 2d 73 68  |nssh.com,hmac-sh|
+00000360  61 32 2d 32 35 36 2c 68  6d 61 63 2d 73 68 61 32  |a2-256,hmac-sha2|
+00000370  2d 35 31 32 2c 68 6d 61  63 2d 73 68 61 31 00 00  |-512,hmac-sha1..|
+00000380  00 d5 75 6d 61 63 2d 36  34 2d 65 74 6d 40 6f 70  |..umac-64-etm@op|
+00000390  65 6e 73 73 68 2e 63 6f  6d 2c 75 6d 61 63 2d 31  |enssh.com,umac-1|
+000003a0  32 38 2d 65 74 6d 40 6f  70 65 6e 73 73 68 2e 63  |28-etm@openssh.c|
+000003b0  6f 6d 2c 68 6d 61 63 2d  73 68 61 32 2d 32 35 36  |om,hmac-sha2-256|
+000003c0  2d 65 74 6d 40 6f 70 65  6e 73 73 68 2e 63 6f 6d  |-etm@openssh.com|
+000003d0  2c 68 6d 61 63 2d 73 68  61 32 2d 35 31 32 2d 65  |,hmac-sha2-512-e|
+000003e0  74 6d 40 6f 70 65 6e 73  73 68 2e 63 6f 6d 2c 68  |tm@openssh.com,h|
+000003f0  6d 61 63 2d 73 68 61 31  2d 65 74 6d 40 6f 70 65  |mac-sha1-etm@ope|
+00000400  6e 73 73 68 2e 63 6f 6d  2c 75 6d 61 63 2d 36 34  |nssh.com,umac-64|
+00000410  40 6f 70 65 6e 73 73 68  2e 63 6f 6d 2c 75 6d 61  |@openssh.com,uma|
+00000420  63 2d 31 32 38 40 6f 70  65 6e 73 73 68 2e 63 6f  |c-128@openssh.co|
+00000430  6d 2c 68 6d 61 63 2d 73  68 61 32 2d 32 35 36 2c  |m,hmac-sha2-256,|
+00000440  68 6d 61 63 2d 73 68 61  32 2d 35 31 32 2c 68 6d  |hmac-sha2-512,hm|
+00000450  61 63 2d 73 68 61 31 00  00 00 15 6e 6f 6e 65 2c  |ac-sha1....none,|
+00000460  7a 6c 69 62 40 6f 70 65  6e 73 73 68 2e 63 6f 6d  |zlib@openssh.com|
+00000470  00 00 00 15 6e 6f 6e 65  2c 7a 6c 69 62 40 6f 70  |....none,zlib@op|
+00000480  65 6e 73 73 68 2e 63 6f  6d 00 00 00 00 00 00 00  |enssh.com.......|
+00000490  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+>>> Flow 5 (client to server)
+00000000  00 00 00 2c 06 1e 00 00  00 20 13 cf b6 0f c2 c9  |...,..... ......|
+00000010  08 d9 7b f6 60 d4 53 7f  4b b1 29 37 59 98 3c dd  |..{.`.S.K.)7Y.<.|
+00000020  ab b1 51 12 94 92 eb 56  4c 6f e8 a3 63 9c a8 a1  |..Q....VLo..c...|
+>>> Flow 6 (server to client)
+00000000  00 00 01 04 09 1f 00 00  00 68 00 00 00 13 65 63  |.........h....ec|
+00000010  64 73 61 2d 73 68 61 32  2d 6e 69 73 74 70 32 35  |dsa-sha2-nistp25|
+00000020  36 00 00 00 08 6e 69 73  74 70 32 35 36 00 00 00  |6....nistp256...|
+00000030  41 04 8b d1 dd c3 a2 af  65 c5 b1 7e 0d 88 0e 10  |A.......e..~....|
+00000040  3b 52 4a 43 b7 3c ed e9  9a 89 5d 2b 05 74 b7 7e  |;RJC.<....]+.t.~|
+00000050  2b 1e 12 dd 2c 78 71 53  be eb f6 4e 5d 19 cf 98  |+...,xqS...N]...|
+00000060  d0 25 2d 4a a3 4a 15 2c  50 10 67 80 6d 2e d9 fa  |.%-J.J.,P.g.m...|
+00000070  84 a8 00 00 00 20 e9 56  86 74 34 11 d7 d3 48 a0  |..... .V.t4...H.|
+00000080  a8 6d bd 3f 00 ae da 7d  63 fb 6f b2 2d 90 c8 53  |.m.?...}c.o.-..S|
+00000090  3f 14 42 43 88 12 00 00  00 65 00 00 00 13 65 63  |?.BC.....e....ec|
+000000a0  64 73 61 2d 73 68 61 32  2d 6e 69 73 74 70 32 35  |dsa-sha2-nistp25|
+000000b0  36 00 00 00 4a 00 00 00  21 00 ed ac 80 ff 90 17  |6...J...!.......|
+000000c0  05 2b 9b 55 14 f1 04 45  f5 8e 59 7b 0f a9 69 51  |.+.U...E..Y{..iQ|
+000000d0  39 04 ef ab 75 03 27 8d  b2 a6 00 00 00 21 00 fb  |9...u.'......!..|
+000000e0  5c 9b 84 8f 26 00 81 c4  7a 58 c8 c1 e7 3c 15 b7  |\...&...zX...<..|
+000000f0  a3 06 27 f8 e2 a1 b5 02  5d 7f 73 29 8a e5 98 00  |..'.....].s)....|
+00000100  00 00 00 00 00 00 00 00  00 00 00 0c 0a 15 00 00  |................|
+00000110  00 00 00 00 00 00 00 00  00 00 01 40 fc d3 1f 73  |...........@...s|
+00000120  95 a6 4b 07 99 e0 76 21  16 09 1e 47 bb 69 67 42  |..K...v!...G.igB|
+00000130  5c f2 e4 d2 24 8c a4 92  56 65 11 8a 8e 58 64 fd  |\...$...Ve...Xd.|
+00000140  20 69 4d fd a3 61 44 1d  d6 b8 40 3e 9a 07 05 d5  | iM..aD...@>....|
+00000150  be 5d 02 bf a0 6e 9c 1b  5d 3f b1 10 21 88 6b 78  |.]...n..]?..!.kx|
+00000160  5b 36 a4 ba 01 a4 62 50  e7 e2 d1 d2 7a 47 a3 fc  |[6....bP....zG..|
+00000170  27 38 15 89 10 13 ee d4  bc 72 d2 16 95 d5 3a 52  |'8.......r....:R|
+00000180  df 54 1e 9c 6e dd 01 2a  30 3e 5c 0a 5e 08 19 ef  |.T..n..*0>\.^...|
+00000190  d4 60 a6 f0 85 34 da 53  f6 c0 51 8b 5a 6b 3e 28  |.`...4.S..Q.Zk>(|
+000001a0  4a 7b 41 72 89 73 c3 16  1e d4 62 fe 21 3a 0f 74  |J{Ar.s....b.!:.t|
+000001b0  45 6d 61 01 3c b1 95 a0  37 6e b5 5d 38 a8 54 be  |Ema.<...7n.]8.T.|
+000001c0  f2 67 0d 99 cc 61 4d 11  4a 64 93 93 05 47 0f 08  |.g...aM.Jd...G..|
+000001d0  75 fc 41 25 24 ce a6 b4  e7 71 c8 f4 eb 77 00 82  |u.A%$....q...w..|
+000001e0  a9 8d 5d 7a f5 b9 d1 01  cb 3f d1 30 41 c4 35 56  |..]z.....?.0A.5V|
+000001f0  d6 7c 13 e5 1a d2 ae 59  3a a1 35 bc 0f ca 67 73  |.|.....Y:.5...gs|
+00000200  39 da 3f 33 d0 d4 ad 16  37 0d 23 52 45 c5 48 a1  |9.?3....7.#RE.H.|
+00000210  0a 07 44 34 f2 a4 f1 59  91 2f ec 46 2b 47 fd 7a  |..D4...Y./.F+G.z|
+00000220  80 82 60 7b 22 e0 aa e2  be 9f ca 5f d0 da 58 23  |..`{"......_..X#|
+00000230  b3 f9 30 e0 f6 48 a6 97  99 55 76 79 fd cc c3 fd  |..0..H...Uvy....|
+00000240  1b c3 91 51 f3 a2 17 c4  50 ad 34 c9 66 47 5d f2  |...Q....P.4.fG].|
+00000250  0a 77 81 a2 74 35 3e e0  e1 ce 7b 10 22 9c 4a 10  |.w..t5>...{.".J.|
+00000260  6b b8 5e 21 49 dc cb 02  85 7a 96 4f d6 39 b5 e5  |k.^!I....z.O.9..|
+00000270  a1 40 7a 1d d6 b3 c5 3e  08 65 31 ad              |.@z....>.e1.|
+>>> Flow 7 (client to server)
+00000000  00 00 00 0c 0a 15 e3 f9  ae 57 e2 35 b8 cc 87 3c  |.........W.5...<|
+00000010  00 00 00 20 33 e5 12 ab  62 1c 2c 69 88 93 54 76  |... 3...b.,i..Tv|
+00000020  f7 f8 fd dc 60 17 93 77  87 cd 82 b1 07 a3 b1 ab  |....`..w........|
+00000030  3c 1a 85 46 bb 6d 43 54  d5 63 49 d9 1d 51 55 89  |<..F.mCT.cI..QU.|
+00000040  e9 5c 5f 7c 62 b8 76 b4  0b c6 c4 e9 be d2 b2 9b  |.\_|b.v.........|
+00000050  d3 dc 15 b8                                       |....|
+>>> Flow 8 (server to client)
+00000000  00 00 00 20 93 ba c4 77  30 8a 7f d5 56 ed 0b b8  |... ...w0...V...|
+00000010  85 c8 49 71 3a a1 8b 8b  94 d4 b1 e2 2b 0f 54 12  |..Iq:.......+.T.|
+00000020  74 89 06 dc a5 92 37 aa  5e 3a 24 4d 82 df a6 40  |t.....7.^:$M...@|
+00000030  74 48 79 db 42 bf 49 49  67 61 a3 e5 96 c2 f8 11  |tHy.B.IIga......|
+00000040  a6 74 2c 1b                                       |.t,.|
+>>> Flow 9 (client to server)
+00000000  00 00 00 30 78 7e e0 d6  9f ee 3f ac 47 ee a1 ab  |...0x~....?.G...|
+00000010  1f 7a d5 00 e0 b8 0a 00  69 61 db 12 f2 d4 b2 c5  |.z......ia......|
+00000020  a0 09 12 08 c2 fa c1 2a  3b 21 18 03 4f be 96 0a  |.......*;!..O...|
+00000030  fc b4 36 8f c6 4d 8d 13  c7 ca 48 80 65 db 25 da  |..6..M....H.e.%.|
+00000040  4e 36 29 44 fb 19 b4 96  53 b9 2f 74 56 c9 8c 66  |N6)D....S./tV..f|
+00000050  85 03 eb 98                                       |....|
+>>> Flow 10 (server to client)
+00000000  00 00 00 20 36 ba 73 95  01 22 06 8d e9 7c c1 41  |... 6.s.."...|.A|
+00000010  92 85 b9 b8 f4 37 52 b0  b4 99 8f 47 f7 ef 38 10  |.....7R....G..8.|
+00000020  a6 b0 35 c4 44 f1 72 89  0a 67 75 09 de 70 68 d5  |..5.D.r..gu..ph.|
+00000030  4e 81 af 5b e4 5b 61 02  aa ed bb 31 fe 70 59 f5  |N..[.[a....1.pY.|
+00000040  fc bf 7a 44 00 00 00 40  e3 5b ae 48 03 59 c7 d0  |..zD...@.[.H.Y..|
+00000050  22 f6 34 db c7 f4 2a 09  7e 0d ad c0 e4 b6 52 c2  |".4...*.~.....R.|
+00000060  7d de 8e 63 04 a0 06 d6  74 76 51 57 a6 16 7b 39  |}..c....tvQW..{9|
+00000070  90 8c af 32 c3 c1 84 3f  65 39 15 d7 0e 8e b9 8e  |...2...?e9......|
+00000080  8f 13 97 9a ff f8 9b aa  5f 09 11 4c 46 e4 3d f6  |........_..LF.=.|
+00000090  d1 e3 ac b7 d5 3e ae 68  6e ca 52 c6 f9 78 c4 ba  |.....>.hn.R..x..|
+000000a0  f7 37 0c 28 a5 7e 2d 45                           |.7.(.~-E|
+>>> Flow 11 (client to server)
+00000000  00 00 01 60 90 e3 71 e0  56 c9 9e 55 b4 59 3c 28  |...`..q.V..U.Y<(|
+00000010  9e 51 1c 69 16 61 e8 39  fd 0c 67 80 eb f4 c7 70  |.Q.i.a.9..g....p|
+00000020  1a f9 6a b4 f3 b7 65 25  28 f5 a5 1a 56 b7 3c dc  |..j...e%(...V.<.|
+00000030  5b 6c 77 df 08 a2 31 e1  7f 77 17 24 fd 5a a3 e6  |[lw...1..w.$.Z..|
+00000040  42 cf 4b da 75 e0 8b bf  f3 e5 59 cb 11 95 d7 87  |B.K.u.....Y.....|
+00000050  21 69 64 91 91 dc d8 b3  11 48 df 36 72 b1 05 43  |!id......H.6r..C|
+00000060  d5 09 95 92 90 b9 d8 e4  0f 84 dd 3b c7 55 3b 93  |...........;.U;.|
+00000070  d6 d0 3c 08 04 84 5a 25  55 76 ad 70 da 4d 17 6c  |..<...Z%Uv.p.M.l|
+00000080  5b 5e 56 0f 96 3b 4a 89  0f 23 7a a5 69 e3 b1 61  |[^V..;J..#z.i..a|
+00000090  0d 19 a9 88 e9 79 bc 70  43 15 48 5e 7e 7f 76 75  |.....y.pC.H^~.vu|
+000000a0  5f 8f d4 dc f7 90 af 67  e0 0a 62 56 0c 46 69 5c  |_......g..bV.Fi\|
+000000b0  92 bd 1d 3e bb 96 9e e9  a5 77 8a a4 70 ab df 5e  |...>.....w..p..^|
+000000c0  cb 09 7c 84 43 c4 d1 0e  86 0f ad e2 b7 fe d1 24  |..|.C..........$|
+000000d0  e3 59 5c 22 00 07 77 a6  05 d0 53 90 47 ae c7 72  |.Y\"..w...S.G..r|
+000000e0  f2 6a 56 98 f9 1e 6e 4c  b1 a6 b8 3f 9f 04 c0 60  |.jV...nL...?...`|
+000000f0  9a 79 14 75 4d 5f e4 c4  70 da f9 3e 88 71 94 04  |.y.uM_..p..>.q..|
+00000100  5e 07 67 a9 d8 4c 4d e2  af 51 13 d1 e5 65 15 fe  |^.g..LM..Q...e..|
+00000110  b7 cd 7d 79 3c ba 3f 99  f3 4a 1f 2b f5 7f ff d6  |..}y<.?..J.+....|
+00000120  77 48 34 96 33 1d 87 c6  41 f8 cf f8 b5 94 e8 47  |wH4.3...A......G|
+00000130  d2 12 4d 21 9c 4a d8 ea  02 27 d5 dd 69 87 9a c6  |..M!.J...'..i...|
+00000140  86 71 9f 97 14 d1 a3 03  35 d3 02 ed dd 5d 51 5d  |.q......5....]Q]|
+00000150  f5 12 47 b9 c5 39 eb fb  2d dc 56 99 da 6e e9 0a  |..G..9..-.V..n..|
+00000160  e6 50 94 7d f3 2e c0 64  e8 32 89 dc 43 3f ed f2  |.P.}...d.2..C?..|
+00000170  99 21 c6 81 6b a6 05 90  9d 88 1e 28 d7 15 8e b8  |.!..k......(....|
+00000180  6e e1 4a de                                       |n.J.|
+>>> Flow 12 (server to client)
+00000000  00 00 01 40 c2 47 39 65  3f a2 7e 94 17 b3 10 86  |...@.G9e?.~.....|
+00000010  f9 73 32 6e f3 ec ab e3  ac d0 8a fb 82 d3 b1 e5  |.s2n............|
+00000020  45 f9 cb 72 41 f8 23 ad  f8 ce b6 7d 94 f6 2b 56  |E..rA.#....}..+V|
+00000030  4e 99 b0 0d d5 11 2f 55  c3 67 44 bf 0f 72 5c 5a  |N...../U.gD..r\Z|
+00000040  6f 41 16 b2 46 f2 f5 1d  fe d7 3b cc 47 3f d7 97  |oA..F.....;.G?..|
+00000050  4e 9b 2c 84 de 31 10 2a  98 91 5e 55 15 fb df 61  |N.,..1.*..^U...a|
+00000060  6d 6d 0e 59 dd 9c f4 f3  bf bc 8a 6b 37 ce 78 c6  |mm.Y.......k7.x.|
+00000070  cc 21 c9 56 42 11 04 65  01 6c 94 29 e3 0c 12 31  |.!.VB..e.l.)...1|
+00000080  7e cc f7 3c e3 9d 74 d4  2a 5a 35 ba 85 33 86 e1  |~..<..t.*Z5..3..|
+00000090  99 2f 79 1e 7e 42 ca c4  b4 fa e7 60 2f f4 6f 80  |./y.~B.....`/.o.|
+000000a0  28 f1 9c f8 94 89 90 7f  ad ce fd d4 be cd af 66  |(..............f|
+000000b0  93 4e 53 29 2c 15 4d 5d  d4 36 73 97 0e 9c 53 95  |.NS),.M].6s...S.|
+000000c0  42 69 1a 80 34 ab 46 2b  97 7f 42 ca d9 33 94 e2  |Bi..4.F+..B..3..|
+000000d0  35 b9 c8 ec 98 34 87 4f  fe 14 ce cd 47 c4 77 22  |5....4.O....G.w"|
+000000e0  74 8b f6 c6 4a dd 95 b2  57 b1 ba cd 3e bd a2 cb  |t...J...W...>...|
+000000f0  c7 0f e2 75 24 48 a8 75  83 35 45 8f 11 16 a8 6c  |...u$H.u.5E....l|
+00000100  05 3d d3 bb 2c 81 4c 67  ae 33 32 ae 28 d9 dd dd  |.=..,.Lg.32.(...|
+00000110  ea 73 b7 7c 88 7e ac 72  fa b9 e4 ed 37 2e 0c 0a  |.s.|.~.r....7...|
+00000120  8f 24 f7 80 15 af b3 61  4b 1e 83 73 34 7f bd d7  |.$.....aK..s4...|
+00000130  8f 24 25 93 43 75 3c a7  e1 dc ff e1 f7 e7 9a b5  |.$%.Cu<.........|
+00000140  18 1c bd 8d 81 12 a3 1a  16 1d fa e5 72 9c c7 9d  |............r...|
+00000150  f3 d2 1b 76 ca a6 76 50  c5 83 56 1b 20 e5 c9 99  |...v..vP..V. ...|
+00000160  c0 68 fb 99                                       |.h..|
+>>> Flow 13 (client to server)
+00000000  00 00 02 80 93 38 6e 30  08 53 2e 06 7f 0b 15 9f  |.....8n0.S......|
+00000010  f0 12 11 34 be b5 e6 77  ef 32 d1 e5 ab b7 25 5a  |...4...w.2....%Z|
+00000020  2a 97 6b 83 f2 08 35 d0  ae 3b 45 ec 47 72 60 b0  |*.k...5..;E.Gr`.|
+00000030  2c c1 2c 5e 66 23 a0 b0  b5 c4 77 04 97 fc 89 14  |,.,^f#....w.....|
+00000040  e6 d2 60 a6 40 d0 78 22  da c9 6a a4 72 8b 63 ad  |..`.@.x"..j.r.c.|
+00000050  60 57 b4 27 15 8f 66 0b  a0 0c c2 c0 31 a2 74 4b  |`W.'..f.....1.tK|
+00000060  89 4c 8f d1 cd 45 a2 3d  bf f9 8d 72 95 4f fa c8  |.L...E.=...r.O..|
+00000070  46 09 ec 4c cc b0 7b 69  dd 20 3e e7 b0 ac 2d a4  |F..L..{i. >...-.|
+00000080  f0 34 88 02 24 e1 5b 53  c7 aa 06 96 fe 35 ab d0  |.4..$.[S.....5..|
+00000090  47 95 be 42 2f 75 22 d4  14 1f c4 cb 40 89 6f a0  |G..B/u".....@.o.|
+000000a0  ff 73 01 dc 40 9d c7 3d  8b 96 f1 f9 89 f6 b1 fe  |.s..@..=........|
+000000b0  00 35 53 9c f7 09 25 a6  90 90 bb c8 a7 a2 88 e0  |.5S...%.........|
+000000c0  ee 78 97 a8 d2 26 b7 b4  8c c6 3d 10 16 29 4b 6c  |.x...&....=..)Kl|
+000000d0  ee 30 90 73 09 57 f2 e1  c3 90 5f bc a2 48 aa 7b  |.0.s.W...._..H.{|
+000000e0  34 a3 95 1c 33 29 04 e4  97 f9 5f 62 5b 70 a0 c7  |4...3)...._b[p..|
+000000f0  35 0f 28 ea 66 f8 42 61  a5 09 c3 c3 f1 81 26 66  |5.(.f.Ba......&f|
+00000100  c3 c7 b9 b8 8e eb fa 22  30 a7 61 39 35 04 ba dc  |......."0.a95...|
+00000110  ff ab 5c 4e f6 0a 1d dc  da 1d 37 88 fb 13 83 9b  |..\N......7.....|
+00000120  64 7c 5a 80 dc 05 df 3c  5a 36 16 67 6f 3f eb d1  |d|Z....<Z6.go?..|
+00000130  f9 b8 4c 43 c3 39 97 e8  d9 2a e6 2b df 61 45 b1  |..LC.9...*.+.aE.|
+00000140  9b d6 42 c0 d0 04 e9 d4  8b d5 fc db bc 09 ab 6d  |..B............m|
+00000150  fe e1 8c a9 95 29 d0 f6  e8 d0 f7 f5 f2 b8 39 f1  |.....)........9.|
+00000160  2b 72 a7 ec 65 e9 7a 95  18 c2 2c 02 57 fa f8 b6  |+r..e.z...,.W...|
+00000170  81 a8 10 99 cb ea a6 df  d8 fe fd bf 20 32 82 97  |............ 2..|
+00000180  78 31 a4 17 96 0c 50 05  bc c9 51 51 a9 fe da 2f  |x1....P...QQ.../|
+00000190  f1 bf df 91 1a 68 76 0f  bc d9 22 9e bc 5e 65 64  |.....hv..."..^ed|
+000001a0  7d 9f 19 c9 b6 09 77 0d  8d 7b cc 95 b5 70 cb c4  |}.....w..{...p..|
+000001b0  d8 b6 85 4d f9 df 90 ce  91 2b 65 90 0d 2f f2 0a  |...M.....+e../..|
+000001c0  87 3e af c5 55 bd 37 05  4a 5d a6 ae d7 ce ec 65  |.>..U.7.J].....e|
+000001d0  94 66 7e 4e e2 94 b4 f0  5a 83 08 f6 e1 ce 62 e5  |.f~N....Z.....b.|
+000001e0  24 d6 98 6e a7 10 23 03  57 e8 03 b1 b0 84 53 0b  |$..n..#.W.....S.|
+000001f0  74 85 df fd b2 e1 0d 52  af 51 e3 64 5b 9d ed 42  |t......R.Q.d[..B|
+00000200  88 a6 bd f1 e5 61 05 a7  40 f6 0b c2 97 26 ad 3c  |.....a..@....&.<|
+00000210  60 4f 75 d9 fb 20 b1 4d  96 a0 e8 80 c1 fe 1c 2c  |`Ou.. .M.......,|
+00000220  d5 b2 17 d5 8a 63 50 16  ae 67 3c dc 56 28 68 6d  |.....cP..g<.V(hm|
+00000230  3d ec ca 11 58 f4 98 30  dc 92 f4 38 6b 7c ff 4d  |=...X..0...8k|.M|
+00000240  e4 f0 63 66 b4 e6 20 56  3a d0 b7 e8 10 d0 13 44  |..cf.. V:......D|
+00000250  a7 ac 20 2a ca 8c 4f 73  12 36 8d 29 66 92 0c 5a  |.. *..Os.6.)f..Z|
+00000260  db 11 49 8b c2 2a e4 7c  2d 4c 26 5c d7 a5 37 2f  |..I..*.|-L&\..7/|
+00000270  4b 4e 95 90 1b de 4c 7d  78 6a 62 ac b0 a0 e8 93  |KN....L}xjb.....|
+00000280  46 65 ce c9 39 19 36 14  d4 22 28 75 23 3b 33 97  |Fe..9.6.."(u#;3.|
+00000290  95 46 f1 7a 87 ae d4 4b  dd 2d 3b 7e 5b 3a e1 d2  |.F.z...K.-;~[:..|
+000002a0  17 85 9c 7e                                       |...~|
+>>> Flow 14 (server to client)
+00000000  00 00 00 10 f5 bc 41 31  d1 0d d3 47 ed 2b 87 a0  |......A1...G.+..|
+00000010  53 67 74 1d 19 c6 af f6  59 6a 8c d2 0d 29 0a 63  |Sgt.....Yj...).c|
+00000020  b1 0d cc db d3 b4 d3 1b  d3 d0 73 a6 f8 ec 16 06  |..........s.....|
+00000030  de e2 0e b8                                       |....|

ssh/testdata/Client-Cipher-aes128-gcm@openssh.com

@@ -0,0 +1,287 @@
+>>> Flow 1 (client to server)
+00000000  53 53 48 2d 32 2e 30 2d  47 6f 0d 0a              |SSH-2.0-Go..|
+>>> Flow 2 (server to client)
+00000000  53 53 48 2d 32 2e 30 2d  4f 70 65 6e 53 53 48 5f  |SSH-2.0-OpenSSH_|
+00000010  39 2e 39 0d 0a                                    |9.9..|
+>>> Flow 3 (client to server)
+00000000  00 00 02 7c 0d 14 7f 9c  2b a4 e8 8f 82 7d 61 60  |...|....+....}a`|
+00000010  45 50 76 05 85 3e 00 00  00 c9 63 75 72 76 65 32  |EPv..>....curve2|
+00000020  35 35 31 39 2d 73 68 61  32 35 36 2c 63 75 72 76  |5519-sha256,curv|
+00000030  65 32 35 35 31 39 2d 73  68 61 32 35 36 40 6c 69  |e25519-sha256@li|
+00000040  62 73 73 68 2e 6f 72 67  2c 65 63 64 68 2d 73 68  |bssh.org,ecdh-sh|
+00000050  61 32 2d 6e 69 73 74 70  32 35 36 2c 65 63 64 68  |a2-nistp256,ecdh|
+00000060  2d 73 68 61 32 2d 6e 69  73 74 70 33 38 34 2c 65  |-sha2-nistp384,e|
+00000070  63 64 68 2d 73 68 61 32  2d 6e 69 73 74 70 35 32  |cdh-sha2-nistp52|
+00000080  31 2c 64 69 66 66 69 65  2d 68 65 6c 6c 6d 61 6e  |1,diffie-hellman|
+00000090  2d 67 72 6f 75 70 31 34  2d 73 68 61 32 35 36 2c  |-group14-sha256,|
+000000a0  64 69 66 66 69 65 2d 68  65 6c 6c 6d 61 6e 2d 67  |diffie-hellman-g|
+000000b0  72 6f 75 70 31 34 2d 73  68 61 31 2c 65 78 74 2d  |roup14-sha1,ext-|
+000000c0  69 6e 66 6f 2d 63 2c 6b  65 78 2d 73 74 72 69 63  |info-c,kex-stric|
+000000d0  74 2d 63 2d 76 30 30 40  6f 70 65 6e 73 73 68 2e  |t-c-v00@openssh.|
+000000e0  63 6f 6d 00 00 00 57 65  63 64 73 61 2d 73 68 61  |com...Wecdsa-sha|
+000000f0  32 2d 6e 69 73 74 70 32  35 36 2c 65 63 64 73 61  |2-nistp256,ecdsa|
+00000100  2d 73 68 61 32 2d 6e 69  73 74 70 33 38 34 2c 65  |-sha2-nistp384,e|
+00000110  63 64 73 61 2d 73 68 61  32 2d 6e 69 73 74 70 35  |cdsa-sha2-nistp5|
+00000120  32 31 2c 73 73 68 2d 72  73 61 2c 73 73 68 2d 64  |21,ssh-rsa,ssh-d|
+00000130  73 73 2c 73 73 68 2d 65  64 32 35 35 31 39 00 00  |ss,ssh-ed25519..|
+00000140  00 16 61 65 73 31 32 38  2d 67 63 6d 40 6f 70 65  |..aes128-gcm@ope|
+00000150  6e 73 73 68 2e 63 6f 6d  00 00 00 16 61 65 73 31  |nssh.com....aes1|
+00000160  32 38 2d 67 63 6d 40 6f  70 65 6e 73 73 68 2e 63  |28-gcm@openssh.c|
+00000170  6f 6d 00 00 00 6e 68 6d  61 63 2d 73 68 61 32 2d  |om...nhmac-sha2-|
+00000180  32 35 36 2d 65 74 6d 40  6f 70 65 6e 73 73 68 2e  |256-etm@openssh.|
+00000190  63 6f 6d 2c 68 6d 61 63  2d 73 68 61 32 2d 35 31  |com,hmac-sha2-51|
+000001a0  32 2d 65 74 6d 40 6f 70  65 6e 73 73 68 2e 63 6f  |2-etm@openssh.co|
+000001b0  6d 2c 68 6d 61 63 2d 73  68 61 32 2d 32 35 36 2c  |m,hmac-sha2-256,|
+000001c0  68 6d 61 63 2d 73 68 61  32 2d 35 31 32 2c 68 6d  |hmac-sha2-512,hm|
+000001d0  61 63 2d 73 68 61 31 2c  68 6d 61 63 2d 73 68 61  |ac-sha1,hmac-sha|
+000001e0  31 2d 39 36 00 00 00 6e  68 6d 61 63 2d 73 68 61  |1-96...nhmac-sha|
+000001f0  32 2d 32 35 36 2d 65 74  6d 40 6f 70 65 6e 73 73  |2-256-etm@openss|
+00000200  68 2e 63 6f 6d 2c 68 6d  61 63 2d 73 68 61 32 2d  |h.com,hmac-sha2-|
+00000210  35 31 32 2d 65 74 6d 40  6f 70 65 6e 73 73 68 2e  |512-etm@openssh.|
+00000220  63 6f 6d 2c 68 6d 61 63  2d 73 68 61 32 2d 32 35  |com,hmac-sha2-25|
+00000230  36 2c 68 6d 61 63 2d 73  68 61 32 2d 35 31 32 2c  |6,hmac-sha2-512,|
+00000240  68 6d 61 63 2d 73 68 61  31 2c 68 6d 61 63 2d 73  |hmac-sha1,hmac-s|
+00000250  68 61 31 2d 39 36 00 00  00 04 6e 6f 6e 65 00 00  |ha1-96....none..|
+00000260  00 04 6e 6f 6e 65 00 00  00 00 00 00 00 00 00 00  |..none..........|
+00000270  00 00 00 d7 3b 80 93 f6  ef bc 88 eb 1a 6e ac fa  |....;........n..|
+>>> Flow 4 (server to client)
+00000000  00 00 04 9c 0a 14 5b f0  eb 4c e5 38 1d df 00 dc  |......[..L.8....|
+00000010  d7 5e f9 2f 04 3b 00 00  01 7a 73 6e 74 72 75 70  |.^./.;...zsntrup|
+00000020  37 36 31 78 32 35 35 31  39 2d 73 68 61 35 31 32  |761x25519-sha512|
+00000030  2c 73 6e 74 72 75 70 37  36 31 78 32 35 35 31 39  |,sntrup761x25519|
+00000040  2d 73 68 61 35 31 32 40  6f 70 65 6e 73 73 68 2e  |-sha512@openssh.|
+00000050  63 6f 6d 2c 6d 6c 6b 65  6d 37 36 38 78 32 35 35  |com,mlkem768x255|
+00000060  31 39 2d 73 68 61 32 35  36 2c 63 75 72 76 65 32  |19-sha256,curve2|
+00000070  35 35 31 39 2d 73 68 61  32 35 36 2c 63 75 72 76  |5519-sha256,curv|
+00000080  65 32 35 35 31 39 2d 73  68 61 32 35 36 40 6c 69  |e25519-sha256@li|
+00000090  62 73 73 68 2e 6f 72 67  2c 65 63 64 68 2d 73 68  |bssh.org,ecdh-sh|
+000000a0  61 32 2d 6e 69 73 74 70  32 35 36 2c 65 63 64 68  |a2-nistp256,ecdh|
+000000b0  2d 73 68 61 32 2d 6e 69  73 74 70 33 38 34 2c 65  |-sha2-nistp384,e|
+000000c0  63 64 68 2d 73 68 61 32  2d 6e 69 73 74 70 35 32  |cdh-sha2-nistp52|
+000000d0  31 2c 64 69 66 66 69 65  2d 68 65 6c 6c 6d 61 6e  |1,diffie-hellman|
+000000e0  2d 67 72 6f 75 70 2d 65  78 63 68 61 6e 67 65 2d  |-group-exchange-|
+000000f0  73 68 61 32 35 36 2c 64  69 66 66 69 65 2d 68 65  |sha256,diffie-he|
+00000100  6c 6c 6d 61 6e 2d 67 72  6f 75 70 31 36 2d 73 68  |llman-group16-sh|
+00000110  61 35 31 32 2c 64 69 66  66 69 65 2d 68 65 6c 6c  |a512,diffie-hell|
+00000120  6d 61 6e 2d 67 72 6f 75  70 31 38 2d 73 68 61 35  |man-group18-sha5|
+00000130  31 32 2c 64 69 66 66 69  65 2d 68 65 6c 6c 6d 61  |12,diffie-hellma|
+00000140  6e 2d 67 72 6f 75 70 31  34 2d 73 68 61 32 35 36  |n-group14-sha256|
+00000150  2c 64 69 66 66 69 65 2d  68 65 6c 6c 6d 61 6e 2d  |,diffie-hellman-|
+00000160  67 72 6f 75 70 31 34 2d  73 68 61 31 2c 65 78 74  |group14-sha1,ext|
+00000170  2d 69 6e 66 6f 2d 73 2c  6b 65 78 2d 73 74 72 69  |-info-s,kex-stri|
+00000180  63 74 2d 73 2d 76 30 30  40 6f 70 65 6e 73 73 68  |ct-s-v00@openssh|
+00000190  2e 63 6f 6d 00 00 00 2d  72 73 61 2d 73 68 61 32  |.com...-rsa-sha2|
+000001a0  2d 35 31 32 2c 72 73 61  2d 73 68 61 32 2d 32 35  |-512,rsa-sha2-25|
+000001b0  36 2c 65 63 64 73 61 2d  73 68 61 32 2d 6e 69 73  |6,ecdsa-sha2-nis|
+000001c0  74 70 32 35 36 00 00 00  6c 63 68 61 63 68 61 32  |tp256...lchacha2|
+000001d0  30 2d 70 6f 6c 79 31 33  30 35 40 6f 70 65 6e 73  |0-poly1305@opens|
+000001e0  73 68 2e 63 6f 6d 2c 61  65 73 31 32 38 2d 63 74  |sh.com,aes128-ct|
+000001f0  72 2c 61 65 73 31 39 32  2d 63 74 72 2c 61 65 73  |r,aes192-ctr,aes|
+00000200  32 35 36 2d 63 74 72 2c  61 65 73 31 32 38 2d 67  |256-ctr,aes128-g|
+00000210  63 6d 40 6f 70 65 6e 73  73 68 2e 63 6f 6d 2c 61  |cm@openssh.com,a|
+00000220  65 73 32 35 36 2d 67 63  6d 40 6f 70 65 6e 73 73  |es256-gcm@openss|
+00000230  68 2e 63 6f 6d 00 00 00  6c 63 68 61 63 68 61 32  |h.com...lchacha2|
+00000240  30 2d 70 6f 6c 79 31 33  30 35 40 6f 70 65 6e 73  |0-poly1305@opens|
+00000250  73 68 2e 63 6f 6d 2c 61  65 73 31 32 38 2d 63 74  |sh.com,aes128-ct|
+00000260  72 2c 61 65 73 31 39 32  2d 63 74 72 2c 61 65 73  |r,aes192-ctr,aes|
+00000270  32 35 36 2d 63 74 72 2c  61 65 73 31 32 38 2d 67  |256-ctr,aes128-g|
+00000280  63 6d 40 6f 70 65 6e 73  73 68 2e 63 6f 6d 2c 61  |cm@openssh.com,a|
+00000290  65 73 32 35 36 2d 67 63  6d 40 6f 70 65 6e 73 73  |es256-gcm@openss|
+000002a0  68 2e 63 6f 6d 00 00 00  d5 75 6d 61 63 2d 36 34  |h.com....umac-64|
+000002b0  2d 65 74 6d 40 6f 70 65  6e 73 73 68 2e 63 6f 6d  |-etm@openssh.com|
+000002c0  2c 75 6d 61 63 2d 31 32  38 2d 65 74 6d 40 6f 70  |,umac-128-etm@op|
+000002d0  65 6e 73 73 68 2e 63 6f  6d 2c 68 6d 61 63 2d 73  |enssh.com,hmac-s|
+000002e0  68 61 32 2d 32 35 36 2d  65 74 6d 40 6f 70 65 6e  |ha2-256-etm@open|
+000002f0  73 73 68 2e 63 6f 6d 2c  68 6d 61 63 2d 73 68 61  |ssh.com,hmac-sha|
+00000300  32 2d 35 31 32 2d 65 74  6d 40 6f 70 65 6e 73 73  |2-512-etm@openss|
+00000310  68 2e 63 6f 6d 2c 68 6d  61 63 2d 73 68 61 31 2d  |h.com,hmac-sha1-|
+00000320  65 74 6d 40 6f 70 65 6e  73 73 68 2e 63 6f 6d 2c  |etm@openssh.com,|
+00000330  75 6d 61 63 2d 36 34 40  6f 70 65 6e 73 73 68 2e  |umac-64@openssh.|
+00000340  63 6f 6d 2c 75 6d 61 63  2d 31 32 38 40 6f 70 65  |com,umac-128@ope|
+00000350  6e 73 73 68 2e 63 6f 6d  2c 68 6d 61 63 2d 73 68  |nssh.com,hmac-sh|
+00000360  61 32 2d 32 35 36 2c 68  6d 61 63 2d 73 68 61 32  |a2-256,hmac-sha2|
+00000370  2d 35 31 32 2c 68 6d 61  63 2d 73 68 61 31 00 00  |-512,hmac-sha1..|
+00000380  00 d5 75 6d 61 63 2d 36  34 2d 65 74 6d 40 6f 70  |..umac-64-etm@op|
+00000390  65 6e 73 73 68 2e 63 6f  6d 2c 75 6d 61 63 2d 31  |enssh.com,umac-1|
+000003a0  32 38 2d 65 74 6d 40 6f  70 65 6e 73 73 68 2e 63  |28-etm@openssh.c|
+000003b0  6f 6d 2c 68 6d 61 63 2d  73 68 61 32 2d 32 35 36  |om,hmac-sha2-256|
+000003c0  2d 65 74 6d 40 6f 70 65  6e 73 73 68 2e 63 6f 6d  |-etm@openssh.com|
+000003d0  2c 68 6d 61 63 2d 73 68  61 32 2d 35 31 32 2d 65  |,hmac-sha2-512-e|
+000003e0  74 6d 40 6f 70 65 6e 73  73 68 2e 63 6f 6d 2c 68  |tm@openssh.com,h|
+000003f0  6d 61 63 2d 73 68 61 31  2d 65 74 6d 40 6f 70 65  |mac-sha1-etm@ope|
+00000400  6e 73 73 68 2e 63 6f 6d  2c 75 6d 61 63 2d 36 34  |nssh.com,umac-64|
+00000410  40 6f 70 65 6e 73 73 68  2e 63 6f 6d 2c 75 6d 61  |@openssh.com,uma|
+00000420  63 2d 31 32 38 40 6f 70  65 6e 73 73 68 2e 63 6f  |c-128@openssh.co|
+00000430  6d 2c 68 6d 61 63 2d 73  68 61 32 2d 32 35 36 2c  |m,hmac-sha2-256,|
+00000440  68 6d 61 63 2d 73 68 61  32 2d 35 31 32 2c 68 6d  |hmac-sha2-512,hm|
+00000450  61 63 2d 73 68 61 31 00  00 00 15 6e 6f 6e 65 2c  |ac-sha1....none,|
+00000460  7a 6c 69 62 40 6f 70 65  6e 73 73 68 2e 63 6f 6d  |zlib@openssh.com|
+00000470  00 00 00 15 6e 6f 6e 65  2c 7a 6c 69 62 40 6f 70  |....none,zlib@op|
+00000480  65 6e 73 73 68 2e 63 6f  6d 00 00 00 00 00 00 00  |enssh.com.......|
+00000490  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+>>> Flow 5 (client to server)
+00000000  00 00 00 2c 06 1e 00 00  00 20 7e 4a 3b cc bf 9a  |...,..... ~J;...|
+00000010  2e 84 5f cb bb 32 fa b6  67 2f 28 60 b3 d3 48 e8  |.._..2..g/(`..H.|
+00000020  f9 c9 38 6f ae b4 a3 c4  5b 73 ae 57 e2 35 b8 cc  |..8o....[s.W.5..|
+>>> Flow 6 (server to client)
+00000000  00 00 01 04 09 1f 00 00  00 68 00 00 00 13 65 63  |.........h....ec|
+00000010  64 73 61 2d 73 68 61 32  2d 6e 69 73 74 70 32 35  |dsa-sha2-nistp25|
+00000020  36 00 00 00 08 6e 69 73  74 70 32 35 36 00 00 00  |6....nistp256...|
+00000030  41 04 8b d1 dd c3 a2 af  65 c5 b1 7e 0d 88 0e 10  |A.......e..~....|
+00000040  3b 52 4a 43 b7 3c ed e9  9a 89 5d 2b 05 74 b7 7e  |;RJC.<....]+.t.~|
+00000050  2b 1e 12 dd 2c 78 71 53  be eb f6 4e 5d 19 cf 98  |+...,xqS...N]...|
+00000060  d0 25 2d 4a a3 4a 15 2c  50 10 67 80 6d 2e d9 fa  |.%-J.J.,P.g.m...|
+00000070  84 a8 00 00 00 20 24 91  84 75 c5 47 0e f0 65 f7  |..... $..u.G..e.|
+00000080  b4 24 f9 69 a6 ba b0 3c  fa c7 6b 47 67 93 ed 68  |.$.i...<..kGg..h|
+00000090  c7 24 9f 85 d1 20 00 00  00 65 00 00 00 13 65 63  |.$... ...e....ec|
+000000a0  64 73 61 2d 73 68 61 32  2d 6e 69 73 74 70 32 35  |dsa-sha2-nistp25|
+000000b0  36 00 00 00 4a 00 00 00  21 00 be d5 c3 20 93 2a  |6...J...!.... .*|
+000000c0  6f 26 6e ff 6e 3b fc 85  55 ff 33 8a a9 ce 0a 46  |o&n.n;..U.3....F|
+000000d0  33 6f b8 b6 8c ee 3d dd  0c 81 00 00 00 21 00 c7  |3o....=......!..|
+000000e0  f1 e0 5b 89 be 5f c2 55  77 8a 0b 08 e8 d0 f3 e6  |..[.._.Uw.......|
+000000f0  ce d0 fe 20 4e 64 8e 8e  76 1d 2c 86 06 48 0a 00  |... Nd..v.,..H..|
+00000100  00 00 00 00 00 00 00 00  00 00 00 0c 0a 15 00 00  |................|
+00000110  00 00 00 00 00 00 00 00  00 00 01 40 7a e3 f5 9b  |...........@z...|
+00000120  b1 a1 ce 3c 76 3c 19 bd  fd 43 ae a0 cd 49 a6 2e  |...<v<...C...I..|
+00000130  b9 3b f6 25 4d 9d 0e 20  e3 29 30 f6 d5 ce 22 c8  |.;.%M.. .)0...".|
+00000140  29 f3 10 f2 99 99 e7 5b  7c eb a8 4b 5c 6e 35 57  |)......[|..K\n5W|
+00000150  30 9e 6d 9d 41 fe be a2  cf 55 7a 8a 45 08 95 5e  |0.m.A....Uz.E..^|
+00000160  58 89 c6 24 27 ea 14 a1  a5 d9 9b 06 80 40 94 84  |X..$'........@..|
+00000170  10 14 88 71 71 06 a0 b6  53 d1 4b 07 77 e4 12 6e  |...qq...S.K.w..n|
+00000180  cc 4a 0a 89 87 3c d2 f3  2e 70 02 71 f3 3c 96 fb  |.J...<...p.q.<..|
+00000190  29 7d b6 85 93 7e 73 e0  83 d7 5f 9e 36 67 7f 82  |)}...~s..._.6g..|
+000001a0  b3 d5 cb bb 93 fd d8 fd  29 9a 9a 55 07 b1 8a 05  |........)..U....|
+000001b0  92 cc 40 eb 2e f1 cc fe  82 13 58 8b e5 6e f2 8a  |..@.......X..n..|
+000001c0  b9 ae 3a e1 07 29 ed f7  5a 52 57 c6 58 92 fa f3  |..:..)..ZRW.X...|
+000001d0  43 dd 4a fc 7c 67 54 55  eb fc dd 5b 86 26 2f 6e  |C.J.|gTU...[.&/n|
+000001e0  78 d5 2a 48 7f f6 2f 44  89 35 a7 71 8d 41 fe dd  |x.*H../D.5.q.A..|
+000001f0  6b 59 45 08 99 e8 02 f9  27 80 a2 0a 1a 4e 51 e1  |kYE.....'....NQ.|
+00000200  c7 db 0d 45 54 9e 6e 61  7f 01 a4 1d 4a 43 98 05  |...ET.na....JC..|
+00000210  15 b4 4a 29 73 56 6f ad  3d c7 ac d1 d3 6e ca 65  |..J)sVo.=....n.e|
+00000220  36 31 d3 82 a6 67 4c b2  dd e8 24 9f 39 33 4d 0e  |61...gL...$.93M.|
+00000230  81 ef 20 b6 a0 ca 5a 06  b1 75 4b 4d 0d 5f 3e 8f  |.. ...Z..uKM._>.|
+00000240  bb 65 12 af 72 f7 3d 26  cd 29 7e 12 ee 90 e4 f8  |.e..r.=&.)~.....|
+00000250  f9 b5 93 11 1f 96 a9 82  5f d0 c3 d3 8a 5c ba cc  |........_....\..|
+00000260  6b 6f ae 87 92 4e ba 86  a8 dc 68 6f              |ko...N....ho|
+>>> Flow 7 (client to server)
+00000000  00 00 00 0c 0a 15 87 3c  23 dc 62 b8 d2 60 16 9a  |.......<#.b..`..|
+00000010  00 00 00 20 79 7f 77 85  3c a1 cd 5b 68 fb 0d 92  |... y.w.<..[h...|
+00000020  3c d9 58 4c a3 88 ff 1c  94 e5 50 cb 1d ab 83 ab  |<.XL......P.....|
+00000030  7e b2 ff 51 e4 3a d2 c6  65 c8 42 f5 de 8c 90 71  |~..Q.:..e.B....q|
+00000040  1c 99 e1 09                                       |....|
+>>> Flow 8 (server to client)
+00000000  00 00 00 20 9e 31 c9 bd  a5 a4 95 f8 67 2b 5e 5a  |... .1......g+^Z|
+00000010  63 53 db 9d a9 ae ef 08  43 f9 2b 0a 15 b7 38 71  |cS......C.+...8q|
+00000020  7e d0 68 16 d6 03 c4 0c  66 b9 e8 0e 4b 0f e8 53  |~.h.....f...K..S|
+00000030  e4 bc c2 60                                       |...`|
+>>> Flow 9 (client to server)
+00000000  00 00 00 30 9f 76 ec e4  9c a3 55 3e 8a 83 03 54  |...0.v....U>...T|
+00000010  c9 d1 e4 20 91 6b d9 2c  28 28 a5 7f 82 92 3a 89  |... .k.,((....:.|
+00000020  d0 cd 98 e7 a4 85 d7 31  a8 3e be a3 b3 c0 65 65  |.......1.>....ee|
+00000030  e6 6c 74 e5 38 13 42 51  12 e2 d0 1b 53 39 f6 b3  |.lt.8.BQ....S9..|
+00000040  e8 b2 73 3f                                       |..s?|
+>>> Flow 10 (server to client)
+00000000  00 00 00 20 e4 45 97 15  a1 64 3b ff 65 37 c4 2e  |... .E...d;.e7..|
+00000010  03 d6 8e e7 91 ca 58 65  55 f5 b9 fa ef 3b 7d cc  |......XeU....;}.|
+00000020  ad 11 3b 54 c8 e3 2c f8  de 42 55 b2 97 b4 a7 ec  |..;T..,..BU.....|
+00000030  d8 a0 90 98 00 00 00 40  5c bc 96 d5 fe 09 4a e9  |.......@\.....J.|
+00000040  d1 a5 f9 2e 9f 4c 0f 28  0c 66 79 aa 53 bb 78 d5  |.....L.(.fy.S.x.|
+00000050  41 a5 8f 7d 53 09 98 fb  be 3d 26 35 f3 8a 76 88  |A..}S....=&5..v.|
+00000060  3f e1 66 b3 93 9e c9 00  b6 33 0e 12 ac 37 50 8f  |?.f......3...7P.|
+00000070  f7 b3 25 51 71 9f f7 e1  f9 b3 7b c8 4d 0f ca 92  |..%Qq.....{.M...|
+00000080  21 32 5c f4 22 c1 63 90                           |!2\.".c.|
+>>> Flow 11 (client to server)
+00000000  00 00 01 60 98 3f bc 85  ef 21 41 c0 61 b1 ad d1  |...`.?...!A.a...|
+00000010  d9 73 3d 13 54 fe d7 c1  d3 d8 65 02 e4 3f 32 eb  |.s=.T.....e..?2.|
+00000020  78 2f fc fe 5f fc 48 ea  7f d9 53 51 59 a8 ad c0  |x/.._.H...SQY...|
+00000030  a4 65 c8 e6 6b 11 44 e7  ab 9a 1a 84 4e 83 1c a9  |.e..k.D.....N...|
+00000040  48 95 0a d1 f2 4c 64 c8  43 c4 0c 15 5b 5b af e0  |H....Ld.C...[[..|
+00000050  3c 21 0d ff f2 a8 7c 91  a1 d9 cc 7a f1 ff 53 56  |<!....|....z..SV|
+00000060  b2 09 f1 8b bb bf 42 5e  c0 1d 03 6b ba 15 6f 68  |......B^...k..oh|
+00000070  5a 69 5c d5 33 11 c6 52  d2 12 23 dc 57 f8 06 7a  |Zi\.3..R..#.W..z|
+00000080  55 d9 ee 8e cb 5f 49 32  c1 6a 84 57 73 b1 c5 70  |U...._I2.j.Ws..p|
+00000090  78 83 bc 4a 45 72 ec 07  0a 5a cb 5d c2 06 d2 d7  |x..JEr...Z.]....|
+000000a0  fd 0a 4c 0f 8a 47 e0 58  7e ec f8 35 ba 9a 4c 0e  |..L..G.X~..5..L.|
+000000b0  3f 0b 21 b2 b8 17 a0 c8  a1 c6 98 38 9c 7b 15 d0  |?.!........8.{..|
+000000c0  8e 12 49 5a d9 5e ae ce  64 7d be 67 22 48 53 c7  |..IZ.^..d}.g"HS.|
+000000d0  2a 19 37 8e 4e c8 2b 12  33 70 68 8a 18 8e 2b 5c  |*.7.N.+.3ph...+\|
+000000e0  1d 8a d2 b3 3b 0e 8b 55  58 12 2d 9c 67 5e bd 77  |....;..UX.-.g^.w|
+000000f0  48 85 c3 88 59 4c c6 6f  64 3b 0c 24 96 81 d2 e1  |H...YL.od;.$....|
+00000100  39 24 0e 9d 72 7a 0b 29  66 cc 7e fe 6d 88 1f d0  |9$..rz.)f.~.m...|
+00000110  1b ac 9d 00 8d 21 98 58  36 c0 64 e7 83 f8 77 87  |.....!.X6.d...w.|
+00000120  d7 8e 06 a9 57 b3 01 2b  61 4f 7d 31 d4 6c 5d 78  |....W..+aO}1.l]x|
+00000130  ee c7 06 f8 92 92 36 d3  6e 98 8f 0d 5b 68 1a 1d  |......6.n...[h..|
+00000140  fb d8 90 a0 3c db c1 40  4a bc 18 6a b7 f6 45 d0  |....<..@J..j..E.|
+00000150  42 49 7e 8f b8 4f 27 93  8c d7 3b 57 46 79 a7 20  |BI~..O'...;WFy. |
+00000160  25 57 0f ca a8 70 83 3a  21 5f 63 b5 fa d8 9d 4b  |%W...p.:!_c....K|
+00000170  f0 8a 88 b7                                       |....|
+>>> Flow 12 (server to client)
+00000000  00 00 01 40 ef 68 cf f5  46 8a f8 c9 2f 84 67 34  |...@.h..F.../.g4|
+00000010  bf 28 5f 6c b4 f5 87 1c  93 4a 87 30 5c cf 3c f1  |.(_l.....J.0\.<.|
+00000020  2b 86 d7 28 26 00 ae e5  8b 68 e7 66 ed 14 e7 95  |+..(&....h.f....|
+00000030  c1 33 d1 34 e0 d2 d8 f7  eb 7d 94 0c e4 22 c9 69  |.3.4.....}...".i|
+00000040  c8 68 b6 e3 01 fc f0 32  a8 2f 82 56 2d 04 fd 55  |.h.....2./.V-..U|
+00000050  fd 7a 89 d9 b6 19 e0 32  34 27 82 c5 61 ff 20 95  |.z.....24'..a. .|
+00000060  44 c6 fd fd 8c 62 3c 39  16 9e 62 6d 5d 30 3c b4  |D....b<9..bm]0<.|
+00000070  43 47 72 6e b7 2a 61 5f  95 9b 4f 9b b3 0b 76 e3  |CGrn.*a_..O...v.|
+00000080  c3 5f d0 61 8d a1 7d c7  6d 5b f3 54 57 8a 43 aa  |._.a..}.m[.TW.C.|
+00000090  03 19 06 06 1e cd d9 b1  52 1d 59 c8 38 60 da 12  |........R.Y.8`..|
+000000a0  52 35 52 41 b0 45 73 b3  c3 f2 d8 e8 cc a5 c4 84  |R5RA.Es.........|
+000000b0  88 cd 78 4b 92 ec 02 02  25 fd e9 ea 2f 1d 62 ec  |..xK....%.../.b.|
+000000c0  17 af 3e 2e bd d2 d5 d5  94 f8 30 ad 75 9d 36 31  |..>.......0.u.61|
+000000d0  51 37 e7 d7 1d 06 fe 4b  06 f6 6a 90 0e 53 0b 2e  |Q7.....K..j..S..|
+000000e0  5b d2 7d d3 b3 28 f7 22  31 29 47 b3 f5 8a 40 d4  |[.}..(."1)G...@.|
+000000f0  bd 90 fa cc 0e 43 66 fb  3b cb 12 9a e6 4c 84 84  |.....Cf.;....L..|
+00000100  55 0d 84 cc 71 10 55 79  a4 51 1a b5 f4 61 d0 bf  |U...q.Uy.Q...a..|
+00000110  07 34 b0 a1 d8 96 81 fe  51 b1 63 fa a5 90 82 87  |.4......Q.c.....|
+00000120  0d bc 15 63 d8 7f 8e 5f  4d c3 be 7d 54 36 3c f4  |...c..._M..}T6<.|
+00000130  4c 88 5e 8d 41 6f f3 74  25 b3 3b f1 3d 4d 8c 14  |L.^.Ao.t%.;.=M..|
+00000140  83 5e 5e b7 78 e5 8a 8f  73 28 30 7d 64 0f 5c bd  |.^^.x...s(0}d.\.|
+00000150  31 e4 9a c4                                       |1...|
+>>> Flow 13 (client to server)
+00000000  00 00 02 80 00 cb 00 7f  f2 7f 90 a4 6b 52 c0 6c  |............kR.l|
+00000010  7b 1b 0a a0 0e 61 e9 93  be a0 96 da 8b 25 10 2d  |{....a.......%.-|
+00000020  1f 12 3b 87 cf 98 45 5c  59 91 c0 5c 37 a5 0c 5b  |..;...E\Y..\7..[|
+00000030  df 23 6b b6 b4 8a c4 f0  c7 b5 28 2f e3 21 b7 10  |.#k.......(/.!..|
+00000040  fc 8d 32 04 1d e9 11 7d  68 1c 68 eb 8c a3 38 45  |..2....}h.h...8E|
+00000050  a7 a2 01 37 97 ac b2 fd  90 29 15 0e c6 13 ce 66  |...7.....).....f|
+00000060  85 ff a7 4e 48 4c ba d9  fc 15 ec e3 64 98 36 9d  |...NHL......d.6.|
+00000070  0b dd fe 21 8b 1f ba 81  39 ac 79 f0 b9 01 aa 09  |...!....9.y.....|
+00000080  64 a0 8e da 7b d4 e1 13  28 57 fe 1c 05 ec ad ed  |d...{...(W......|
+00000090  38 de 3e 79 a0 74 d5 01  4e fe 4b e6 e8 53 d3 d6  |8.>y.t..N.K..S..|
+000000a0  03 a6 79 46 77 c1 5f ee  a7 c3 c5 9e 97 f6 57 1d  |..yFw._.......W.|
+000000b0  5e 35 3e 8a a7 fc 91 f3  f1 91 dd 6c ea ae d8 04  |^5>........l....|
+000000c0  5a 03 69 b4 1e fb 40 be  b9 39 56 08 7c 32 ca a2  |Z.i...@..9V.|2..|
+000000d0  c5 e0 ec 0a 66 61 25 49  5c 78 ce 08 8c b6 39 3a  |....fa%I\x....9:|
+000000e0  5e 29 da f3 a1 9b 0b 0b  70 8f 54 fd 1e c7 36 26  |^)......p.T...6&|
+000000f0  9d ae 82 79 0e fb 18 27  ce 45 6d 04 ce 0e a7 c2  |...y...'.Em.....|
+00000100  81 27 e8 53 8e 03 a7 55  c4 ca c4 48 26 c5 8d 2b  |.'.S...U...H&..+|
+00000110  3b dc 66 ca 98 35 bb b7  ab 22 e3 93 64 6d e7 10  |;.f..5..."..dm..|
+00000120  8a 9b fb e7 af 24 b1 ff  58 e4 01 90 18 d6 2c 38  |.....$..X.....,8|
+00000130  4c aa b1 44 15 cd 9d 76  9f 8f a4 1d 11 36 96 41  |L..D...v.....6.A|
+00000140  1b 33 a3 ee 1f 4a e5 23  8c bc 82 a5 10 6a 3c 27  |.3...J.#.....j<'|
+00000150  68 7f 8f 8a b8 cc 22 1b  0f 1c b5 ea 51 05 5c 43  |h.....".....Q.\C|
+00000160  2d 85 c3 4e 2d d9 6c b3  4c 2c 5d 45 c0 77 85 20  |-..N-.l.L,]E.w. |
+00000170  df 40 38 0a e7 ab 33 f0  60 66 fa 2a 94 46 3b 73  |.@8...3.`f.*.F;s|
+00000180  9a 80 2b 5a 8b ec eb 0a  c6 93 e0 85 e2 78 99 9e  |..+Z.........x..|
+00000190  5d 03 3a ea 9c 43 e4 a2  05 5f 6d 3b bb e2 8a 70  |].:..C..._m;...p|
+000001a0  f8 ce bc 36 f2 9f 58 b6  42 30 83 2c 45 3e 5b 6d  |...6..X.B0.,E>[m|
+000001b0  23 f1 8c 86 4a 42 cf c9  50 88 9c 4c 28 18 64 4b  |#...JB..P..L(.dK|
+000001c0  14 48 82 b3 35 42 82 c7  3b 4a bf cb 7e c1 4a e2  |.H..5B..;J..~.J.|
+000001d0  e8 de a3 55 19 94 3e 38  80 2d a9 60 16 73 7e 85  |...U..>8.-.`.s~.|
+000001e0  50 47 4f 0a 26 d8 e9 b8  14 ab 1a 8f 67 9a a1 a5  |PGO.&.......g...|
+000001f0  0e fe 67 59 4f f6 2c 57  01 98 c5 65 b3 7c f0 57  |..gYO.,W...e.|.W|
+00000200  42 c4 30 41 8b cc f0 c7  05 32 a3 e0 ef 97 bf 23  |B.0A.....2.....#|
+00000210  f0 d8 fc 87 fc 13 9f 3d  33 6d 80 a2 e1 75 df 93  |.......=3m...u..|
+00000220  34 1b 9a 7f 36 c6 80 f5  75 c5 4c 0b 43 75 5a 97  |4...6...u.L.CuZ.|
+00000230  f6 c0 bf 67 86 8e 2e 8a  15 ef 30 cc a8 d6 43 3f  |...g......0...C?|
+00000240  aa 1a 7a 39 bf 9d 45 8d  60 97 02 2d 7d 2b c3 b7  |..z9..E.`..-}+..|
+00000250  fb ea d0 9e 99 69 26 05  f7 bb 79 5d 9a fa 86 fb  |.....i&...y]....|
+00000260  96 fe 42 58 32 7a 7c d1  05 0b 1b 7a 12 35 ea be  |..BX2z|....z.5..|
+00000270  dc 56 19 8f 32 4c 92 17  53 d9 33 00 04 e8 6f ba  |.V..2L..S.3...o.|
+00000280  4f bb 52 83 ff ba e6 f9  87 3c aa 6f c1 58 93 23  |O.R......<.o.X.#|
+00000290  b0 5e 26 42                                       |.^&B|
+>>> Flow 14 (server to client)
+00000000  00 00 00 10 79 b4 da e8  8c a4 14 53 a6 e7 37 65  |....y......S..7e|
+00000010  37 76 0e 7d ef a8 d9 91  1d 99 2a 57 95 fc 2a 97  |7v.}......*W..*.|
+00000020  37 12 13 73                                       |7..s|