Merge 6.7p1.

  * New upstream release (http://www.openssh.com/txt/release-6.7):
    - sshd(8): The default set of ciphers and MACs has been altered to
      remove unsafe algorithms.  In particular, CBC ciphers and arcfour* are
      disabled by default.  The full set of algorithms remains available if
      configured explicitly via the Ciphers and MACs sshd_config options.
    - ssh(1), sshd(8): Add support for Unix domain socket forwarding.  A
      remote TCP port may be forwarded to a local Unix domain socket and
      vice versa or both ends may be a Unix domain socket (closes: #236718).
    - ssh(1), ssh-keygen(1): Add support for SSHFP DNS records for ED25519
      key types.
    - sftp(1): Allow resumption of interrupted uploads.
    - ssh(1): When rekeying, skip file/DNS lookups of the hostkey if it is
      the same as the one sent during initial key exchange.
    - sshd(8): Allow explicit ::1 and 127.0.0.1 forwarding bind addresses
      when GatewayPorts=no; allows client to choose address family.
    - sshd(8): Add a sshd_config PermitUserRC option to control whether
      ~/.ssh/rc is executed, mirroring the no-user-rc authorized_keys
      option.
    - ssh(1): Add a %C escape sequence for LocalCommand and ControlPath that
      expands to a unique identifer based on a hash of the tuple of (local
      host, remote user, hostname, port).  Helps avoid exceeding miserly
      pathname limits for Unix domain sockets in multiplexing control paths.
    - sshd(8): Make the "Too many authentication failures" message include
      the user, source address, port and protocol in a format similar to the
      authentication success / failure messages.
    - Use CLOCK_BOOTTIME in preference to CLOCK_MONOTONIC when it is
      available. It considers time spent suspended, thereby ensuring
      timeouts (e.g. for expiring agent keys) fire correctly (closes:
      #734553).
    - Use prctl() to prevent sftp-server from accessing
      /proc/self/{mem,maps}.
  * Restore TCP wrappers support, removed upstream in 6.7.  It is true that
    dropping this reduces preauth attack surface in sshd.  On the other
    hand, this support seems to be quite widely used, and abruptly dropping
    it (from the perspective of users who don't read openssh-unix-dev) could
    easily cause more serious problems in practice.  It's not entirely clear
    what the right long-term answer for Debian is, but it at least probably
    doesn't involve dropping this feature shortly before a freeze.
  * Replace patch to disable OpenSSL version check with an updated version
    of Kurt Roeckx's patch from #732940 to just avoid checking the status
    field.

100 files changed, 4729 insertions, 0 deletions

diff --git a/regress/unittests/Makefile b/regress/unittests/Makefile
new file mode 100644
index 000000000..bdb4574e2
--- /dev/null
+++ b/regress/unittests/Makefile
@@ -0,0 +1,5 @@
+#       $OpenBSD: Makefile,v 1.1 2014/04/30 05:32:00 djm Exp $
+
+SUBDIR= test_helper sshbuf sshkey
+
+.include <bsd.subdir.mk>
diff --git a/regress/unittests/Makefile.inc b/regress/unittests/Makefile.inc
new file mode 100644
index 000000000..4c3363749
--- /dev/null
+++ b/regress/unittests/Makefile.inc
@@ -0,0 +1,59 @@
+#       $OpenBSD: Makefile.inc,v 1.1 2014/04/30 05:32:00 djm Exp $
+
+.include <bsd.own.mk>
+.include <bsd.obj.mk>
+
+# enable warnings
+WARNINGS=Yes
+
+DEBUG=-g
+CFLAGS+=        -fstack-protector-all
+CDIAGFLAGS=     -Wall
+CDIAGFLAGS+=    -Wextra
+CDIAGFLAGS+=    -Werror
+CDIAGFLAGS+=    -Wchar-subscripts
+CDIAGFLAGS+=    -Wcomment
+CDIAGFLAGS+=    -Wformat
+CDIAGFLAGS+=    -Wformat-security
+CDIAGFLAGS+=    -Wimplicit
+CDIAGFLAGS+=    -Winline
+CDIAGFLAGS+=    -Wmissing-declarations
+CDIAGFLAGS+=    -Wmissing-prototypes
+CDIAGFLAGS+=    -Wparentheses
+CDIAGFLAGS+=    -Wpointer-arith
+CDIAGFLAGS+=    -Wpointer-sign
+CDIAGFLAGS+=    -Wreturn-type
+CDIAGFLAGS+=    -Wshadow
+CDIAGFLAGS+=    -Wsign-compare
+CDIAGFLAGS+=    -Wstrict-aliasing
+CDIAGFLAGS+=    -Wstrict-prototypes
+CDIAGFLAGS+=    -Wswitch
+CDIAGFLAGS+=    -Wtrigraphs
+CDIAGFLAGS+=    -Wuninitialized
+CDIAGFLAGS+=    -Wunused
+.if ${COMPILER_VERSION} == "gcc4"
+CDIAGFLAGS+=    -Wold-style-definition
+.endif
+
+SSHREL=../../../../../usr.bin/ssh
+
+CFLAGS+=-I${.CURDIR}/../test_helper -I${.CURDIR}/${SSHREL}
+
+.if exists(${.CURDIR}/../test_helper/${__objdir})
+LDADD+=-L${.CURDIR}/../test_helper/${__objdir} -ltest_helper
+DPADD+=${.CURDIR}/../test_helper/${__objdir}/libtest_helper.a
+.else
+LDADD+=-L${.CURDIR}/../test_helper -ltest_helper
+DPADD+=${.CURDIR}/../test_helper/libtest_helper.a
+.endif
+
+.if exists(${.CURDIR}/${SSHREL}/lib/${__objdir})
+LDADD+=-L${.CURDIR}/${SSHREL}/lib/${__objdir} -lssh
+DPADD+=${.CURDIR}/${SSHREL}/lib/${__objdir}/libssh.a
+.else
+LDADD+=-L${.CURDIR}/${SSHREL}/lib -lssh
+DPADD+=${.CURDIR}/${SSHREL}/lib/libssh.a
+.endif
+
+LDADD+= -lcrypto
+DPADD+= ${LIBCRYPTO}
diff --git a/regress/unittests/sshbuf/Makefile b/regress/unittests/sshbuf/Makefile
new file mode 100644
index 000000000..85f99ac38
--- /dev/null
+++ b/regress/unittests/sshbuf/Makefile
@@ -0,0 +1,14 @@
+#       $OpenBSD: Makefile,v 1.1 2014/04/30 05:32:00 djm Exp $
+
+PROG=test_sshbuf
+SRCS=tests.c
+SRCS+=test_sshbuf.c
+SRCS+=test_sshbuf_getput_basic.c
+SRCS+=test_sshbuf_getput_crypto.c
+SRCS+=test_sshbuf_misc.c
+SRCS+=test_sshbuf_fuzz.c
+SRCS+=test_sshbuf_getput_fuzz.c
+SRCS+=test_sshbuf_fixed.c
+
+.include <bsd.regress.mk>
+
diff --git a/regress/unittests/sshbuf/test_sshbuf.c b/regress/unittests/sshbuf/test_sshbuf.c
new file mode 100644
index 000000000..ee77d6934
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf.c
@@ -0,0 +1,240 @@
+/*      $OpenBSD: test_sshbuf.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#define SSHBUF_INTERNAL 1       /* access internals for testing */
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include "../test_helper/test_helper.h"
+
+#include "ssherr.h"
+#include "sshbuf.h"
+
+void sshbuf_tests(void);
+
+void
+sshbuf_tests(void)
+{
+        struct sshbuf *p1;
+        const u_char *cdp;
+        u_char *dp;
+        size_t sz;
+        int r;
+
+        TEST_START("allocate sshbuf");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        TEST_DONE();
+
+        TEST_START("max size on fresh buffer");
+        ASSERT_SIZE_T_GT(sshbuf_max_size(p1), 0);
+        TEST_DONE();
+
+        TEST_START("available on fresh buffer");
+        ASSERT_SIZE_T_GT(sshbuf_avail(p1), 0);
+        TEST_DONE();
+
+        TEST_START("len = 0 on empty buffer");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        TEST_DONE();
+
+        TEST_START("set valid max size");
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 65536), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), 65536);
+        TEST_DONE();
+
+        TEST_START("available on limited buffer");
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 65536);
+        TEST_DONE();
+
+        TEST_START("free");
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("consume on empty buffer");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_consume(p1, 0), 0);
+        ASSERT_INT_EQ(sshbuf_consume(p1, 1), SSH_ERR_MESSAGE_INCOMPLETE);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("consume_end on empty buffer");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_consume_end(p1, 0), 0);
+        ASSERT_INT_EQ(sshbuf_consume_end(p1, 1), SSH_ERR_MESSAGE_INCOMPLETE);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("reserve space");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        r = sshbuf_reserve(p1, 1, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        *dp = 0x11;
+        r = sshbuf_reserve(p1, 3, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        *dp++ = 0x22;
+        *dp++ = 0x33;
+        *dp++ = 0x44;
+        TEST_DONE();
+
+        TEST_START("sshbuf_len on filled buffer");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        TEST_DONE();
+
+        TEST_START("sshbuf_ptr on filled buffer");
+        cdp = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(cdp, NULL);
+        ASSERT_U8_EQ(cdp[0], 0x11);
+        ASSERT_U8_EQ(cdp[1], 0x22);
+        ASSERT_U8_EQ(cdp[2], 0x33);
+        ASSERT_U8_EQ(cdp[3], 0x44);
+        TEST_DONE();
+
+        TEST_START("consume on filled buffer");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        ASSERT_INT_EQ(sshbuf_consume(p1, 0), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        r = sshbuf_consume(p1, 64);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        ASSERT_INT_EQ(sshbuf_consume(p1, 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 3);
+        cdp = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_U8_EQ(cdp[0], 0x22);
+        ASSERT_INT_EQ(sshbuf_consume(p1, 2), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        cdp = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_U8_EQ(cdp[0], 0x44);
+        r = sshbuf_consume(p1, 2);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        ASSERT_INT_EQ(sshbuf_consume(p1, 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        r = sshbuf_consume(p1, 1);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("consume_end on filled buffer");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        r = sshbuf_reserve(p1, 4, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        *dp++ = 0x11;
+        *dp++ = 0x22;
+        *dp++ = 0x33;
+        *dp++ = 0x44;
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        r = sshbuf_consume_end(p1, 5);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        ASSERT_INT_EQ(sshbuf_consume_end(p1, 3), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        cdp = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(cdp, NULL);
+        ASSERT_U8_EQ(*cdp, 0x11);
+        r = sshbuf_consume_end(p1, 2);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_consume_end(p1, 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("fill limited buffer");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 1223), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), 1223);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 1223);
+        r = sshbuf_reserve(p1, 1223, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        memset(dp, 0xd7, 1223);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1223);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 0);
+        r = sshbuf_reserve(p1, 1, &dp);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_PTR_EQ(dp, NULL);
+        TEST_DONE();
+
+        TEST_START("consume and force compaction");
+        ASSERT_INT_EQ(sshbuf_consume(p1, 223), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1000);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 223);
+        r = sshbuf_reserve(p1, 224, &dp);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_PTR_EQ(dp, NULL);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1000);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 223);
+        r = sshbuf_reserve(p1, 223, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        memset(dp, 0x7d, 223);
+        cdp = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(cdp, NULL);
+        ASSERT_MEM_FILLED_EQ(cdp, 0xd7, 1000);
+        ASSERT_MEM_FILLED_EQ(cdp + 1000, 0x7d, 223);
+        TEST_DONE();
+
+        TEST_START("resize full buffer");
+        r = sshbuf_set_max_size(p1, 1000);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        sz = roundup(1223 + SSHBUF_SIZE_INC * 3, SSHBUF_SIZE_INC);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sz), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), sz);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), sz - 1223);
+        ASSERT_INT_EQ(sshbuf_len(p1), 1223);
+        TEST_DONE();
+
+        /* NB. uses sshbuf internals */
+        TEST_START("alloc chunking");
+        r = sshbuf_reserve(p1, 1, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        *dp = 0xff;
+        cdp = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(cdp, NULL);
+        ASSERT_MEM_FILLED_EQ(cdp, 0xd7, 1000);
+        ASSERT_MEM_FILLED_EQ(cdp + 1000, 0x7d, 223);
+        ASSERT_MEM_FILLED_EQ(cdp + 1223, 0xff, 1);
+        ASSERT_SIZE_T_EQ(sshbuf_alloc(p1) % SSHBUF_SIZE_INC, 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("reset buffer");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 1223), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), 1223);
+        r = sshbuf_reserve(p1, 1223, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        memset(dp, 0xd7, 1223);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1223);
+        sshbuf_reset(p1);
+        ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), 1223);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 1223);
+        sshbuf_free(p1);
+        TEST_DONE();
+}
diff --git a/regress/unittests/sshbuf/test_sshbuf_fixed.c b/regress/unittests/sshbuf/test_sshbuf_fixed.c
new file mode 100644
index 000000000..df4925f7c
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf_fixed.c
@@ -0,0 +1,126 @@
+/*      $OpenBSD: test_sshbuf_fixed.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#define SSHBUF_INTERNAL 1  /* access internals for testing */
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include "../test_helper/test_helper.h"
+
+#include "sshbuf.h"
+#include "ssherr.h"
+
+void sshbuf_fixed(void);
+
+const u_char test_buf[] = "\x01\x12\x34\x56\x78\x00\x00\x00\x05hello";
+
+void
+sshbuf_fixed(void)
+{
+        struct sshbuf *p1, *p2, *p3;
+        u_char c;
+        char *s;
+        u_int i;
+        size_t l;
+
+        TEST_START("sshbuf_from");
+        p1 = sshbuf_from(test_buf, sizeof(test_buf));
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_PTR_EQ(sshbuf_mutable_ptr(p1), NULL);
+        ASSERT_INT_EQ(sshbuf_check_reserve(p1, 1), SSH_ERR_BUFFER_READ_ONLY);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 1, NULL), SSH_ERR_BUFFER_READ_ONLY);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 200), SSH_ERR_BUFFER_READ_ONLY);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0x12345678), SSH_ERR_BUFFER_READ_ONLY);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 0);
+        ASSERT_PTR_EQ(sshbuf_ptr(p1), test_buf);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_from data");
+        p1 = sshbuf_from(test_buf, sizeof(test_buf) - 1);
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_PTR_EQ(sshbuf_ptr(p1), test_buf);
+        ASSERT_INT_EQ(sshbuf_get_u8(p1, &c), 0);
+        ASSERT_PTR_EQ(sshbuf_ptr(p1), test_buf + 1);
+        ASSERT_U8_EQ(c, 1);
+        ASSERT_INT_EQ(sshbuf_get_u32(p1, &i), 0);
+        ASSERT_PTR_EQ(sshbuf_ptr(p1), test_buf + 5);
+        ASSERT_U32_EQ(i, 0x12345678);
+        ASSERT_INT_EQ(sshbuf_get_cstring(p1, &s, &l), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        ASSERT_STRING_EQ(s, "hello");
+        ASSERT_SIZE_T_EQ(l, 5);
+        sshbuf_free(p1);
+        free(s);
+        TEST_DONE();
+
+        TEST_START("sshbuf_fromb ");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_U_INT_EQ(sshbuf_refcount(p1), 1);
+        ASSERT_PTR_EQ(sshbuf_parent(p1), NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, test_buf, sizeof(test_buf) - 1), 0);
+        p2 = sshbuf_fromb(p1);
+        ASSERT_PTR_NE(p2, NULL);
+        ASSERT_U_INT_EQ(sshbuf_refcount(p1), 2);
+        ASSERT_PTR_EQ(sshbuf_parent(p1), NULL);
+        ASSERT_PTR_EQ(sshbuf_parent(p2), p1);
+        ASSERT_PTR_EQ(sshbuf_ptr(p2), sshbuf_ptr(p1));
+        ASSERT_PTR_NE(sshbuf_ptr(p1), NULL);
+        ASSERT_PTR_NE(sshbuf_ptr(p2), NULL);
+        ASSERT_PTR_EQ(sshbuf_mutable_ptr(p1), NULL);
+        ASSERT_PTR_EQ(sshbuf_mutable_ptr(p2), NULL);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sshbuf_len(p2));
+        ASSERT_INT_EQ(sshbuf_get_u8(p2, &c), 0);
+        ASSERT_PTR_EQ(sshbuf_ptr(p2), sshbuf_ptr(p1) + 1);
+        ASSERT_U8_EQ(c, 1);
+        ASSERT_INT_EQ(sshbuf_get_u32(p2, &i), 0);
+        ASSERT_PTR_EQ(sshbuf_ptr(p2), sshbuf_ptr(p1) + 5);
+        ASSERT_U32_EQ(i, 0x12345678);
+        ASSERT_INT_EQ(sshbuf_get_cstring(p2, &s, &l), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p2), 0);
+        ASSERT_STRING_EQ(s, "hello");
+        ASSERT_SIZE_T_EQ(l, 5);
+        sshbuf_free(p1);
+        ASSERT_U_INT_EQ(sshbuf_refcount(p1), 1);
+        sshbuf_free(p2);
+        free(s);
+        TEST_DONE();
+
+        TEST_START("sshbuf_froms");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x01), 0);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0x12345678), 0);
+        ASSERT_INT_EQ(sshbuf_put_cstring(p1, "hello"), 0);
+        p2 = sshbuf_new();
+        ASSERT_PTR_NE(p2, NULL);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(test_buf) - 1);
+        ASSERT_INT_EQ(sshbuf_put_stringb(p2, p1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p2), sizeof(test_buf) + 4 - 1);
+        ASSERT_INT_EQ(sshbuf_froms(p2, &p3), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p2), 0);
+        ASSERT_PTR_NE(p3, NULL);
+        ASSERT_PTR_NE(sshbuf_ptr(p3), NULL);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p3), sizeof(test_buf) - 1);
+        ASSERT_MEM_EQ(sshbuf_ptr(p3), test_buf, sizeof(test_buf) - 1);
+        sshbuf_free(p3);
+        ASSERT_INT_EQ(sshbuf_put_stringb(p2, p1), 0);
+        ASSERT_INT_EQ(sshbuf_consume_end(p2, 1), 0);
+        ASSERT_INT_EQ(sshbuf_froms(p2, &p3), SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_PTR_EQ(p3, NULL);
+        sshbuf_free(p2);
+        sshbuf_free(p1);
+}
diff --git a/regress/unittests/sshbuf/test_sshbuf_fuzz.c b/regress/unittests/sshbuf/test_sshbuf_fuzz.c
new file mode 100644
index 000000000..c52376b53
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf_fuzz.c
@@ -0,0 +1,127 @@
+/*      $OpenBSD: test_sshbuf_fuzz.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include "../test_helper/test_helper.h"
+
+#include "ssherr.h"
+#include "sshbuf.h"
+
+#define NUM_FUZZ_TESTS (1 << 18)
+
+void sshbuf_fuzz_tests(void);
+
+void
+sshbuf_fuzz_tests(void)
+{
+        struct sshbuf *p1;
+        u_char *dp;
+        size_t sz, sz2, i;
+        u_int32_t r;
+        int ret;
+
+        /* NB. uses sshbuf internals */
+        TEST_START("fuzz alloc/dealloc");
+        p1 = sshbuf_new();
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 16 * 1024), 0);
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_PTR_NE(sshbuf_ptr(p1), NULL);
+        ASSERT_MEM_ZERO_NE(sshbuf_ptr(p1), sshbuf_len(p1));
+        for (i = 0; i < NUM_FUZZ_TESTS; i++) {
+                r = arc4random_uniform(10);
+                if (r == 0) {
+                        /* 10% chance: small reserve */
+                        r = arc4random_uniform(10);
+ fuzz_reserve:
+                        sz = sshbuf_avail(p1);
+                        sz2 = sshbuf_len(p1);
+                        ret = sshbuf_reserve(p1, r, &dp);
+                        if (ret < 0) {
+                                ASSERT_PTR_EQ(dp, NULL);
+                                ASSERT_SIZE_T_LT(sz, r);
+                                ASSERT_SIZE_T_EQ(sshbuf_avail(p1), sz);
+                                ASSERT_SIZE_T_EQ(sshbuf_len(p1), sz2);
+                        } else {
+                                ASSERT_PTR_NE(dp, NULL);
+                                ASSERT_SIZE_T_GE(sz, r);
+                                ASSERT_SIZE_T_EQ(sshbuf_avail(p1), sz - r);
+                                ASSERT_SIZE_T_EQ(sshbuf_len(p1), sz2 + r);
+                                memset(dp, arc4random_uniform(255) + 1, r);
+                        }
+                } else if (r < 3) {
+                        /* 20% chance: big reserve */
+                        r = arc4random_uniform(8 * 1024);
+                        goto fuzz_reserve;
+                } else if (r == 3) {
+                        /* 10% chance: small consume */
+                        r = arc4random_uniform(10);
+ fuzz_consume:
+                        sz = sshbuf_avail(p1);
+                        sz2 = sshbuf_len(p1);
+                        /* 50% change consume from end, otherwise start */
+                        ret = ((arc4random() & 1) ?
+                            sshbuf_consume : sshbuf_consume_end)(p1, r);
+                        if (ret < 0) {
+                                ASSERT_SIZE_T_LT(sz2, r);
+                                ASSERT_SIZE_T_EQ(sshbuf_avail(p1), sz);
+                                ASSERT_SIZE_T_EQ(sshbuf_len(p1), sz2);
+                        } else {
+                                ASSERT_SIZE_T_GE(sz2, r);
+                                ASSERT_SIZE_T_EQ(sshbuf_avail(p1), sz + r);
+                                ASSERT_SIZE_T_EQ(sshbuf_len(p1), sz2 - r);
+                        }
+                } else if (r < 8) {
+                        /* 40% chance: big consume */
+                        r = arc4random_uniform(2 * 1024);
+                        goto fuzz_consume;
+                } else if (r == 8) {
+                        /* 10% chance: reset max size */
+                        r = arc4random_uniform(16 * 1024);
+                        sz = sshbuf_max_size(p1);
+                        if (sshbuf_set_max_size(p1, r) < 0)
+                                ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), sz);
+                        else
+                                ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), r);
+                } else {
+                        if (arc4random_uniform(8192) == 0) {
+                                /* tiny chance: new buffer */
+                                ASSERT_PTR_NE(sshbuf_ptr(p1), NULL);
+                                ASSERT_MEM_ZERO_NE(sshbuf_ptr(p1), sshbuf_len(p1));
+                                sshbuf_free(p1);
+                                p1 = sshbuf_new();
+                                ASSERT_PTR_NE(p1, NULL);
+                                ASSERT_INT_EQ(sshbuf_set_max_size(p1,
+                                    16 * 1024), 0);
+                        } else {
+                                /* Almost 10%: giant reserve */
+                                /* use arc4random_buf for r > 2^32 on 64 bit */
+                                arc4random_buf(&r, sizeof(r));
+                                while (r < SSHBUF_SIZE_MAX / 2) {
+                                        r <<= 1;
+                                        r |= arc4random() & 1;
+                                }
+                                goto fuzz_reserve;
+                        }
+                }
+                ASSERT_PTR_NE(sshbuf_ptr(p1), NULL);
+                ASSERT_SIZE_T_LE(sshbuf_max_size(p1), 16 * 1024);
+        }
+        ASSERT_PTR_NE(sshbuf_ptr(p1), NULL);
+        ASSERT_MEM_ZERO_NE(sshbuf_ptr(p1), sshbuf_len(p1));
+        sshbuf_free(p1);
+        TEST_DONE();
+}
diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_basic.c b/regress/unittests/sshbuf/test_sshbuf_getput_basic.c
new file mode 100644
index 000000000..966e8432b
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf_getput_basic.c
@@ -0,0 +1,484 @@
+/*      $OpenBSD: test_sshbuf_getput_basic.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include "../test_helper/test_helper.h"
+#include "ssherr.h"
+#include "sshbuf.h"
+
+void sshbuf_getput_basic_tests(void);
+
+void
+sshbuf_getput_basic_tests(void)
+{
+        struct sshbuf *p1, *p2;
+        const u_char *cd;
+        u_char *d, d2[32], x[] = {
+                0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x00, 0x99
+        };
+        u_int64_t v64;
+        u_int32_t v32;
+        u_int16_t v16;
+        u_char v8;
+        size_t s;
+        char *s2;
+        int r;
+        u_char bn1[] = { 0x00, 0x00, 0x00 };
+        u_char bn2[] = { 0x00, 0x00, 0x01, 0x02 };
+        u_char bn3[] = { 0x00, 0x80, 0x09 };
+        u_char bn_exp1[] = { 0x00, 0x00, 0x00, 0x00 };
+        u_char bn_exp2[] = { 0x00, 0x00, 0x00, 0x02, 0x01, 0x02 };
+        u_char bn_exp3[] = { 0x00, 0x00, 0x00, 0x03, 0x00, 0x80, 0x09 };
+
+        TEST_START("PEEK_U64");
+        ASSERT_U64_EQ(PEEK_U64(x), 0x1122334455667788ULL);
+        TEST_DONE();
+
+        TEST_START("PEEK_U32");
+        ASSERT_U32_EQ(PEEK_U32(x), 0x11223344);
+        TEST_DONE();
+
+        TEST_START("PEEK_U16");
+        ASSERT_U16_EQ(PEEK_U16(x), 0x1122);
+        TEST_DONE();
+
+        TEST_START("POKE_U64");
+        bzero(d2, sizeof(d2));
+        POKE_U64(d2, 0x1122334455667788ULL);
+        ASSERT_MEM_EQ(d2, x, 8);
+        TEST_DONE();
+        
+        TEST_START("POKE_U32");
+        bzero(d2, sizeof(d2));
+        POKE_U32(d2, 0x11223344);
+        ASSERT_MEM_EQ(d2, x, 4);
+        TEST_DONE();
+        
+        TEST_START("POKE_U16");
+        bzero(d2, sizeof(d2));
+        POKE_U16(d2, 0x1122);
+        ASSERT_MEM_EQ(d2, x, 2);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, 5), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 5);
+        cd = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(cd, NULL);
+        ASSERT_U8_EQ(cd[0], 0x11);
+        ASSERT_U8_EQ(cd[1], 0x22);
+        ASSERT_U8_EQ(cd[2], 0x33);
+        ASSERT_U8_EQ(cd[3], 0x44);
+        ASSERT_U8_EQ(cd[4], 0x55);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get");
+        ASSERT_INT_EQ(sshbuf_get(p1, d2, 4), 0);
+        ASSERT_MEM_EQ(d2, x, 4);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        ASSERT_U8_EQ(*(sshbuf_ptr(p1)), 0x55);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get truncated");
+        r = sshbuf_get(p1, d2, 4);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        ASSERT_U8_EQ(*(sshbuf_ptr(p1)), 0x55);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put truncated");
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 4), 0);
+        r = sshbuf_put(p1, x, 5);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u64");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, 10), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 10);
+        ASSERT_INT_EQ(sshbuf_get_u64(p1, &v64), 0);
+        ASSERT_U64_EQ(v64, 0x1122334455667788ULL);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u64 truncated");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        r = sshbuf_get_u64(p1, &v64);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u32");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, 10), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 10);
+        ASSERT_INT_EQ(sshbuf_get_u32(p1, &v32), 0);
+        ASSERT_U32_EQ(v32, 0x11223344);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 6);
+        ASSERT_INT_EQ(sshbuf_get_u32(p1, &v32), 0);
+        ASSERT_U32_EQ(v32, 0x55667788);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u32 truncated");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        r = sshbuf_get_u32(p1, &v32);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u16");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, 9), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 9);
+        ASSERT_INT_EQ(sshbuf_get_u16(p1, &v16), 0);
+        ASSERT_U16_EQ(v16, 0x1122);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 7);
+        ASSERT_INT_EQ(sshbuf_get_u16(p1, &v16), 0);
+        ASSERT_U16_EQ(v16, 0x3344);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 5);
+        ASSERT_INT_EQ(sshbuf_get_u16(p1, &v16), 0);
+        ASSERT_U16_EQ(v16, 0x5566);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 3);
+        ASSERT_INT_EQ(sshbuf_get_u16(p1, &v16), 0);
+        ASSERT_U16_EQ(v16, 0x7788);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u16 truncated");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        r = sshbuf_get_u16(p1, &v16);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u8");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, 2), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        ASSERT_INT_EQ(sshbuf_get_u8(p1, &v8), 0);
+        ASSERT_U8_EQ(v8, 0x11);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        ASSERT_INT_EQ(sshbuf_get_u8(p1, &v8), 0);
+        ASSERT_U8_EQ(v8, 0x22);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u8 truncated");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        r = sshbuf_get_u8(p1, &v8);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u64");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u64(p1, 0x1122334455667788ULL), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 8);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), x, 8);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u64 exact");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 8), 0);
+        ASSERT_INT_EQ(sshbuf_put_u64(p1, 0x1122334455667788ULL), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 8);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), x, 8);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u64 limited");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 7), 0);
+        r = sshbuf_put_u64(p1, 0x1122334455667788ULL);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+        
+        TEST_START("sshbuf_put_u32");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0x11223344), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), x, 4);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u32 exact");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 4), 0);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0x11223344), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), x, 4);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u32 limited");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 3), 0);
+        r = sshbuf_put_u32(p1, 0x11223344);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+        
+        TEST_START("sshbuf_put_u16");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0x1122), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), x, 2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u16");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 2), 0);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0x1122), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), x, 2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u16 limited");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 1), 0);
+        r = sshbuf_put_u16(p1, 0x1122);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_string");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4 + 4);
+        ASSERT_INT_EQ(sshbuf_get_string(p1, &d, &s), 0);
+        ASSERT_SIZE_T_EQ(s, sizeof(x));
+        ASSERT_MEM_EQ(d, x, sizeof(x));
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        free(d);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_string exact");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(x) + 4), 0);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        ASSERT_INT_EQ(sshbuf_get_string(p1, &d, &s), 0);
+        ASSERT_SIZE_T_EQ(s, sizeof(x));
+        ASSERT_MEM_EQ(d, x, sizeof(x));
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        free(d);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_string truncated");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        ASSERT_INT_EQ(sshbuf_consume_end(p1, 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 3);
+        r = sshbuf_get_string(p1, &d, &s);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 3);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_string giant");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0xffffffff), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        r = sshbuf_get_string(p1, &d, &s);
+        ASSERT_INT_EQ(r, SSH_ERR_STRING_TOO_LARGE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_cstring giant");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0xffffffff), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        r = sshbuf_get_cstring(p1, &s2, &s);
+        ASSERT_INT_EQ(r, SSH_ERR_STRING_TOO_LARGE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_cstring embedded \\0");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        r = sshbuf_get_cstring(p1, &s2, NULL);
+        ASSERT_INT_EQ(r, SSH_ERR_INVALID_FORMAT);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_cstring trailing \\0");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, sizeof(x) - 1), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x) - 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4 - 1);
+        ASSERT_INT_EQ(sshbuf_get_cstring(p1, &s2, &s), 0);
+        ASSERT_SIZE_T_EQ(s, sizeof(x) - 1);
+        ASSERT_MEM_EQ(s2, x, s);
+        free(s2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_string");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_string(p1, x, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        ASSERT_U32_EQ(PEEK_U32(sshbuf_ptr(p1)), sizeof(x));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1) + 4, x, sizeof(x));
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_string limited");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(x) + 4 - 1), 0);
+        r = sshbuf_put_string(p1, x, sizeof(x));
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_string giant");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        r = sshbuf_put_string(p1, (void *)0x01, 0xfffffffc);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_putf");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        r = sshbuf_putf(p1, "%s %d %x", "hello", 23, 0x5f);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 11);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), "hello 23 5f", 11);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_putb");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        p2 = sshbuf_new();
+        ASSERT_PTR_NE(p2, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, "blahblahblah", 12), 0);
+        ASSERT_INT_EQ(sshbuf_putb(p2, p1), 0);
+        sshbuf_free(p1);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p2), 12);
+        ASSERT_MEM_EQ(sshbuf_ptr(p2), "blahblahblah", 12);
+        sshbuf_free(p2);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2_bytes empty buf");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2_bytes(p1, NULL, 0), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(bn_exp1));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp1, sizeof(bn_exp1));
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2_bytes all zeroes");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2_bytes(p1, bn1, sizeof(bn1)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(bn_exp1));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp1, sizeof(bn_exp1));
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2_bytes simple");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2_bytes(p1, bn2+2, sizeof(bn2)-2), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(bn_exp2));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp2, sizeof(bn_exp2));
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2_bytes leading zero");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2_bytes(p1, bn2, sizeof(bn2)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(bn_exp2));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp2, sizeof(bn_exp2));
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2_bytes neg");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2_bytes(p1, bn3+1, sizeof(bn3)-1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(bn_exp3));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp3, sizeof(bn_exp3));
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2_bytes neg and leading zero");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2_bytes(p1, bn3, sizeof(bn3)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(bn_exp3));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp3, sizeof(bn_exp3));
+        sshbuf_free(p1);
+        TEST_DONE();
+}
diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c b/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c
new file mode 100644
index 000000000..0c4c71ecd
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c
@@ -0,0 +1,409 @@
+/*      $OpenBSD: test_sshbuf_getput_crypto.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/bn.h>
+#include <openssl/objects.h>
+#ifdef OPENSSL_HAS_NISTP256
+# include <openssl/ec.h>
+#endif
+
+#include "../test_helper/test_helper.h"
+#include "ssherr.h"
+#include "sshbuf.h"
+
+void sshbuf_getput_crypto_tests(void);
+
+void
+sshbuf_getput_crypto_tests(void)
+{
+        struct sshbuf *p1;
+        const u_char *d;
+        size_t s;
+        BIGNUM *bn, *bn2;
+        /* This one has num_bits != num_bytes * 8 to test bignum1 encoding */
+        const char *hexbn1 = "0102030405060708090a0b0c0d0e0f10";
+        /* This one has MSB set to test bignum2 encoding negative-avoidance */
+        const char *hexbn2 = "f0e0d0c0b0a0908070605040302010007fff11";
+        u_char expbn1[] = {
+                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+                0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
+        };
+        u_char expbn2[] = {
+                0xf0, 0xe0, 0xd0, 0xc0, 0xb0, 0xa0, 0x90, 0x80,
+                0x70, 0x60, 0x50, 0x40, 0x30, 0x20, 0x10, 0x00,
+                0x7f, 0xff, 0x11
+        };
+#ifdef OPENSSL_HAS_NISTP256
+        BIGNUM *bn_x, *bn_y;
+        int ec256_nid = NID_X9_62_prime256v1;
+        char *ec256_x = "0C828004839D0106AA59575216191357"
+                        "34B451459DADB586677EF9DF55784999";
+        char *ec256_y = "4D196B50F0B4E94B3C73E3A9D4CD9DF2"
+                        "C8F9A35E42BDD047550F69D80EC23CD4";
+        u_char expec256[] = {
+                0x04,
+                0x0c, 0x82, 0x80, 0x04, 0x83, 0x9d, 0x01, 0x06,
+                0xaa, 0x59, 0x57, 0x52, 0x16, 0x19, 0x13, 0x57,
+                0x34, 0xb4, 0x51, 0x45, 0x9d, 0xad, 0xb5, 0x86,
+                0x67, 0x7e, 0xf9, 0xdf, 0x55, 0x78, 0x49, 0x99,
+                0x4d, 0x19, 0x6b, 0x50, 0xf0, 0xb4, 0xe9, 0x4b,
+                0x3c, 0x73, 0xe3, 0xa9, 0xd4, 0xcd, 0x9d, 0xf2,
+                0xc8, 0xf9, 0xa3, 0x5e, 0x42, 0xbd, 0xd0, 0x47,
+                0x55, 0x0f, 0x69, 0xd8, 0x0e, 0xc2, 0x3c, 0xd4
+        };
+        EC_KEY *eck;
+        EC_POINT *ecp;
+#endif
+        int r;
+
+#define MKBN(b, bnn) \
+        do { \
+                bnn = NULL; \
+                ASSERT_INT_GT(BN_hex2bn(&bnn, b), 0); \
+        } while (0)
+
+        TEST_START("sshbuf_put_bignum1");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum1(p1, bn), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn1) + 2);
+        ASSERT_U16_EQ(PEEK_U16(sshbuf_ptr(p1)), (u_int16_t)BN_num_bits(bn));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1) + 2, expbn1, sizeof(expbn1));
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum1 limited");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(expbn1) + 1), 0);
+        r = sshbuf_put_bignum1(p1, bn);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum1 bn2");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum1(p1, bn), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 2);
+        ASSERT_U16_EQ(PEEK_U16(sshbuf_ptr(p1)), (u_int16_t)BN_num_bits(bn));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1) + 2, expbn2, sizeof(expbn2));
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum1 bn2 limited");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(expbn1) + 1), 0);
+        r = sshbuf_put_bignum1(p1, bn);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2(p1, bn), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn1) + 4);
+        ASSERT_U32_EQ(PEEK_U32(sshbuf_ptr(p1)), (u_int32_t)BN_num_bytes(bn));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1) + 4, expbn1, sizeof(expbn1));
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2 limited");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(expbn1) + 3), 0);
+        r = sshbuf_put_bignum2(p1, bn);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2 bn2");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2(p1, bn), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 4 + 1); /* MSB */
+        ASSERT_U32_EQ(PEEK_U32(sshbuf_ptr(p1)), (u_int32_t)BN_num_bytes(bn) + 1);
+        ASSERT_U8_EQ(*(sshbuf_ptr(p1) + 4), 0x00);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1) + 5, expbn2, sizeof(expbn2));
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2 bn2 limited");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(expbn2) + 3), 0);
+        r = sshbuf_put_bignum2(p1, bn);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum1");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn1));
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0);
+        bn2 = BN_new();
+        ASSERT_INT_EQ(sshbuf_get_bignum1(p1, bn2), 0);
+        ASSERT_BIGNUM_EQ(bn, bn2);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum1 truncated");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1) - 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn1) - 1);
+        bn2 = BN_new();
+        r = sshbuf_get_bignum1(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn1) - 1);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum1 giant");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xffff), 0);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, (0xffff + 7) / 8, NULL), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + ((0xffff + 7) / 8));
+        bn2 = BN_new();
+        r = sshbuf_get_bignum1(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_BIGNUM_TOO_LARGE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + ((0xffff + 7) / 8));
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum1 bn2");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn2));
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0);
+        bn2 = BN_new();
+        ASSERT_INT_EQ(sshbuf_get_bignum1(p1, bn2), 0);
+        ASSERT_BIGNUM_EQ(bn, bn2);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum1 bn2 truncated");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2) - 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn2) - 1);
+        bn2 = BN_new();
+        r = sshbuf_get_bignum1(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn2) - 1);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum2");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4 + sizeof(expbn1));
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0);
+        bn2 = BN_new();
+        ASSERT_INT_EQ(sshbuf_get_bignum2(p1, bn2), 0);
+        ASSERT_BIGNUM_EQ(bn, bn2);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum2 truncated");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1) - 1), 0);
+        bn2 = BN_new();
+        r = sshbuf_get_bignum2(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn1) + 3);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum2 giant");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 65536), 0);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 65536, NULL), 0);
+        bn2 = BN_new();
+        r = sshbuf_get_bignum2(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_BIGNUM_TOO_LARGE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 65536 + 4);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum2 bn2");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn) + 1), 0); /* MSB */
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x00), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4 + 1 + sizeof(expbn2));
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0);
+        bn2 = BN_new();
+        ASSERT_INT_EQ(sshbuf_get_bignum2(p1, bn2), 0);
+        ASSERT_BIGNUM_EQ(bn, bn2);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum2 bn2 truncated");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn) + 1), 0);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x00), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2) - 1), 0);
+        bn2 = BN_new();
+        r = sshbuf_get_bignum2(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 1 + 4 - 1);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum2 bn2 negative");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2)), 0);
+        bn2 = BN_new();
+        r = sshbuf_get_bignum2(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_BIGNUM_IS_NEGATIVE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 4);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+#ifdef OPENSSL_HAS_NISTP256
+        TEST_START("sshbuf_put_ec");
+        eck = EC_KEY_new_by_curve_name(ec256_nid);
+        ASSERT_PTR_NE(eck, NULL);
+        ecp = EC_POINT_new(EC_KEY_get0_group(eck));
+        ASSERT_PTR_NE(ecp, NULL);
+        MKBN(ec256_x, bn_x);
+        MKBN(ec256_y, bn_y);
+        ASSERT_INT_EQ(EC_POINT_set_affine_coordinates_GFp(
+            EC_KEY_get0_group(eck), ecp, bn_x, bn_y, NULL), 1);
+        ASSERT_INT_EQ(EC_KEY_set_public_key(eck, ecp), 1);
+        BN_free(bn_x);
+        BN_free(bn_y);
+        EC_POINT_free(ecp);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_eckey(p1, eck), 0);
+        ASSERT_INT_EQ(sshbuf_get_string_direct(p1, &d, &s), 0);
+        ASSERT_SIZE_T_EQ(s, sizeof(expec256));
+        ASSERT_MEM_EQ(d, expec256, sizeof(expec256));
+        sshbuf_free(p1);
+        EC_KEY_free(eck);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_ec");
+        eck = EC_KEY_new_by_curve_name(ec256_nid);
+        ASSERT_PTR_NE(eck, NULL);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_string(p1, expec256, sizeof(expec256)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expec256) + 4);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x00), 0);
+        ASSERT_INT_EQ(sshbuf_get_eckey(p1, eck), 0);
+        bn_x = BN_new();
+        bn_y = BN_new();
+        ASSERT_PTR_NE(bn_x, NULL);
+        ASSERT_PTR_NE(bn_y, NULL);
+        ASSERT_INT_EQ(EC_POINT_get_affine_coordinates_GFp(
+            EC_KEY_get0_group(eck), EC_KEY_get0_public_key(eck),
+            bn_x, bn_y, NULL), 1);
+        MKBN(ec256_x, bn);
+        MKBN(ec256_y, bn2);
+        ASSERT_INT_EQ(BN_cmp(bn_x, bn), 0);
+        ASSERT_INT_EQ(BN_cmp(bn_y, bn2), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        sshbuf_free(p1);
+        EC_KEY_free(eck);
+        BN_free(bn_x);
+        BN_free(bn_y);
+        BN_free(bn);
+        BN_free(bn2);
+        TEST_DONE();
+#endif
+}
+
diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c b/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c
new file mode 100644
index 000000000..8c3269b13
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c
@@ -0,0 +1,130 @@
+/*      $OpenBSD: test_sshbuf_getput_fuzz.c,v 1.2 2014/05/02 02:54:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/bn.h>
+#include <openssl/objects.h>
+#ifdef OPENSSL_HAS_NISTP256
+# include <openssl/ec.h>
+#endif
+
+#include "../test_helper/test_helper.h"
+#include "ssherr.h"
+#include "sshbuf.h"
+
+void sshbuf_getput_fuzz_tests(void);
+
+static void
+attempt_parse_blob(u_char *blob, size_t len)
+{
+        struct sshbuf *p1;
+        BIGNUM *bn;
+#ifdef OPENSSL_HAS_NISTP256
+        EC_KEY *eck;
+#endif
+        u_char *s;
+        size_t l;
+        u_int8_t u8;
+        u_int16_t u16;
+        u_int32_t u32;
+        u_int64_t u64;
+
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, blob, len), 0);
+        sshbuf_get_u8(p1, &u8);
+        sshbuf_get_u16(p1, &u16);
+        sshbuf_get_u32(p1, &u32);
+        sshbuf_get_u64(p1, &u64);
+        if (sshbuf_get_string(p1, &s, &l) == 0) {
+                bzero(s, l);
+                free(s);
+        }
+        bn = BN_new();
+        sshbuf_get_bignum1(p1, bn);
+        BN_clear_free(bn);
+        bn = BN_new();
+        sshbuf_get_bignum2(p1, bn);
+        BN_clear_free(bn);
+#ifdef OPENSSL_HAS_NISTP256
+        eck = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+        ASSERT_PTR_NE(eck, NULL);
+        sshbuf_get_eckey(p1, eck);
+        EC_KEY_free(eck);
+#endif
+        sshbuf_free(p1);
+}
+
+
+static void
+onerror(void *fuzz)
+{
+        fprintf(stderr, "Failed during fuzz:\n");
+        fuzz_dump((struct fuzz *)fuzz);
+}
+
+void
+sshbuf_getput_fuzz_tests(void)
+{
+        u_char blob[] = {
+                /* u8 */
+                0xd0,
+                /* u16 */
+                0xc0, 0xde,
+                /* u32 */
+                0xfa, 0xce, 0xde, 0xad,
+                /* u64 */
+                0xfe, 0xed, 0xac, 0x1d, 0x1f, 0x1c, 0xbe, 0xef,
+                /* string */
+                0x00, 0x00, 0x00, 0x09,
+                'O', ' ', 'G', 'o', 'r', 'g', 'o', 'n', '!',
+                /* bignum1 */
+                0x79,
+                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+                0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
+                /* bignum2 */
+                0x00, 0x00, 0x00, 0x14,
+                0x00,
+                0xf0, 0xe0, 0xd0, 0xc0, 0xb0, 0xa0, 0x90, 0x80,
+                0x70, 0x60, 0x50, 0x40, 0x30, 0x20, 0x10, 0x00,
+                0x7f, 0xff, 0x11,
+                /* EC point (NIST-256 curve) */
+                0x00, 0x00, 0x00, 0x41,
+                0x04,
+                0x0c, 0x82, 0x80, 0x04, 0x83, 0x9d, 0x01, 0x06,
+                0xaa, 0x59, 0x57, 0x52, 0x16, 0x19, 0x13, 0x57,
+                0x34, 0xb4, 0x51, 0x45, 0x9d, 0xad, 0xb5, 0x86,
+                0x67, 0x7e, 0xf9, 0xdf, 0x55, 0x78, 0x49, 0x99,
+                0x4d, 0x19, 0x6b, 0x50, 0xf0, 0xb4, 0xe9, 0x4b,
+                0x3c, 0x73, 0xe3, 0xa9, 0xd4, 0xcd, 0x9d, 0xf2,
+                0xc8, 0xf9, 0xa3, 0x5e, 0x42, 0xbd, 0xd0, 0x47,
+                0x55, 0x0f, 0x69, 0xd8, 0x0e, 0xc2, 0x3c, 0xd4,
+        };
+        struct fuzz *fuzz;
+
+        TEST_START("fuzz blob parsing");
+        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | FUZZ_2_BIT_FLIP |
+            FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP |
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END, blob, sizeof(blob));
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz))
+                attempt_parse_blob(blob, sizeof(blob));
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+        TEST_ONERROR(NULL, NULL);
+}
+
diff --git a/regress/unittests/sshbuf/test_sshbuf_misc.c b/regress/unittests/sshbuf/test_sshbuf_misc.c
new file mode 100644
index 000000000..f155491a0
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf_misc.c
@@ -0,0 +1,138 @@
+/*      $OpenBSD: test_sshbuf_misc.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include "../test_helper/test_helper.h"
+
+#include "sshbuf.h"
+
+void sshbuf_misc_tests(void);
+
+void
+sshbuf_misc_tests(void)
+{
+        struct sshbuf *p1;
+        char tmp[512], *p;
+        FILE *out;
+        size_t sz;
+
+        TEST_START("sshbuf_dump");
+        out = tmpfile();
+        ASSERT_PTR_NE(out, NULL);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0x12345678), 0);
+        sshbuf_dump(p1, out);
+        fflush(out);
+        rewind(out);
+        sz = fread(tmp, 1, sizeof(tmp), out);
+        ASSERT_INT_EQ(ferror(out), 0);
+        ASSERT_INT_NE(feof(out), 0);
+        ASSERT_SIZE_T_GT(sz, 0);
+        tmp[sz] = '\0';
+        ASSERT_PTR_NE(strstr(tmp, "12 34 56 78"), NULL);
+        fclose(out);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_dtob16");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0x12345678), 0);
+        p = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(p, NULL);
+        ASSERT_STRING_EQ(p, "12345678");
+        free(p);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_dtob64 len 1");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x11), 0);
+        p = sshbuf_dtob64(p1);
+        ASSERT_PTR_NE(p, NULL);
+        ASSERT_STRING_EQ(p, "EQ==");
+        free(p);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_dtob64 len 2");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x11), 0);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x22), 0);
+        p = sshbuf_dtob64(p1);
+        ASSERT_PTR_NE(p, NULL);
+        ASSERT_STRING_EQ(p, "ESI=");
+        free(p);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_dtob64 len 3");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x11), 0);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x22), 0);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x33), 0);
+        p = sshbuf_dtob64(p1);
+        ASSERT_PTR_NE(p, NULL);
+        ASSERT_STRING_EQ(p, "ESIz");
+        free(p);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_dtob64 len 8191");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 8192, NULL), 0);
+        bzero(sshbuf_mutable_ptr(p1), 8192);
+        p = sshbuf_dtob64(p1);
+        ASSERT_PTR_NE(p, NULL);
+        ASSERT_SIZE_T_EQ(strlen(p), ((8191 + 2) / 3) * 4);
+        free(p);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_b64tod len 1");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_b64tod(p1, "0A=="), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        ASSERT_U8_EQ(*sshbuf_ptr(p1), 0xd0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_b64tod len 2");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_b64tod(p1, "0A8="), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        ASSERT_U16_EQ(PEEK_U16(sshbuf_ptr(p1)), 0xd00f);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_b64tod len 4");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_b64tod(p1, "0A/QDw=="), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        ASSERT_U32_EQ(PEEK_U32(sshbuf_ptr(p1)), 0xd00fd00f);
+        sshbuf_free(p1);
+        TEST_DONE();
+}
+
diff --git a/regress/unittests/sshbuf/tests.c b/regress/unittests/sshbuf/tests.c
new file mode 100644
index 000000000..1557e4342
--- /dev/null
+++ b/regress/unittests/sshbuf/tests.c
@@ -0,0 +1,28 @@
+/*      $OpenBSD: tests.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "../test_helper/test_helper.h"
+
+void sshbuf_tests(void);
+void sshbuf_getput_basic_tests(void);
+void sshbuf_getput_crypto_tests(void);
+void sshbuf_misc_tests(void);
+void sshbuf_fuzz_tests(void);
+void sshbuf_getput_fuzz_tests(void);
+void sshbuf_fixed(void);
+
+void
+tests(void)
+{
+        sshbuf_tests();
+        sshbuf_getput_basic_tests();
+        sshbuf_getput_crypto_tests();
+        sshbuf_misc_tests();
+        sshbuf_fuzz_tests();
+        sshbuf_getput_fuzz_tests();
+        sshbuf_fixed();
+}
diff --git a/regress/unittests/sshkey/Makefile b/regress/unittests/sshkey/Makefile
new file mode 100644
index 000000000..1bcd26676
--- /dev/null
+++ b/regress/unittests/sshkey/Makefile
@@ -0,0 +1,13 @@
+#       $OpenBSD: Makefile,v 1.1 2014/06/24 01:14:18 djm Exp $
+
+TEST_ENV=      "MALLOC_OPTIONS=AFGJPRX"
+
+PROG=test_sshkey
+SRCS=tests.c test_sshkey.c test_file.c test_fuzz.c common.c
+REGRESS_TARGETS=run-regress-${PROG}
+
+run-regress-${PROG}: ${PROG}
+        env ${TEST_ENV} ./${PROG} -d ${.CURDIR}/testdata
+
+.include <bsd.regress.mk>
+
diff --git a/regress/unittests/sshkey/common.c b/regress/unittests/sshkey/common.c
new file mode 100644
index 000000000..0a4b3a90c
--- /dev/null
+++ b/regress/unittests/sshkey/common.c
@@ -0,0 +1,84 @@
+/*      $OpenBSD: common.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/*
+ * Helpers for key API tests
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/dsa.h>
+#include <openssl/objects.h>
+#ifdef OPENSSL_HAS_NISTP256
+# include <openssl/ec.h>
+#endif
+
+#include "../test_helper/test_helper.h"
+
+#include "ssherr.h"
+#include "authfile.h"
+#include "sshkey.h"
+#include "sshbuf.h"
+
+#include "common.h"
+
+struct sshbuf *
+load_file(const char *name)
+{
+        int fd;
+        struct sshbuf *ret;
+
+        ASSERT_PTR_NE(ret = sshbuf_new(), NULL);
+        ASSERT_INT_NE(fd = open(test_data_file(name), O_RDONLY), -1);
+        ASSERT_INT_EQ(sshkey_load_file(fd, name, ret), 0);
+        close(fd);
+        return ret;
+}
+
+struct sshbuf *
+load_text_file(const char *name)
+{
+        struct sshbuf *ret = load_file(name);
+        const u_char *p;
+
+        /* Trim whitespace at EOL */
+        for (p = sshbuf_ptr(ret); sshbuf_len(ret) > 0;) {
+                if (p[sshbuf_len(ret) - 1] == '\r' ||
+                    p[sshbuf_len(ret) - 1] == '\t' ||
+                    p[sshbuf_len(ret) - 1] == ' ' ||
+                    p[sshbuf_len(ret) - 1] == '\n')
+                        ASSERT_INT_EQ(sshbuf_consume_end(ret, 1), 0);
+                else
+                        break;
+        }
+        /* \0 terminate */
+        ASSERT_INT_EQ(sshbuf_put_u8(ret, 0), 0);
+        return ret;
+}
+
+BIGNUM *
+load_bignum(const char *name)
+{
+        BIGNUM *ret = NULL;
+        struct sshbuf *buf;
+
+        buf = load_text_file(name);
+        ASSERT_INT_NE(BN_hex2bn(&ret, (const char *)sshbuf_ptr(buf)), 0);
+        sshbuf_free(buf);
+        return ret;
+}
+
diff --git a/regress/unittests/sshkey/common.h b/regress/unittests/sshkey/common.h
new file mode 100644
index 000000000..bf7d19dce
--- /dev/null
+++ b/regress/unittests/sshkey/common.h
@@ -0,0 +1,16 @@
+/*      $OpenBSD: common.h,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/*
+ * Helpers for key API tests
+ *
+ * Placed in the public domain
+ */
+
+/* Load a binary file into a buffer */
+struct sshbuf *load_file(const char *name);
+
+/* Load a text file into a buffer */
+struct sshbuf *load_text_file(const char *name);
+
+/* Load a bignum from a file */
+BIGNUM *load_bignum(const char *name);
+
diff --git a/regress/unittests/sshkey/mktestdata.sh b/regress/unittests/sshkey/mktestdata.sh
new file mode 100755
index 000000000..ee1fe3962
--- /dev/null
+++ b/regress/unittests/sshkey/mktestdata.sh
@@ -0,0 +1,190 @@
+#!/bin/sh
+# $OpenBSD: mktestdata.sh,v 1.3 2014/07/22 23:57:40 dtucker Exp $
+
+PW=mekmitasdigoat
+
+rsa1_params() {
+        _in="$1"
+        _outbase="$2"
+        set -e
+        ssh-keygen -f $_in -e -m pkcs8 | \
+            openssl rsa -noout -text -pubin | \
+            awk '/^Modulus:$/,/^Exponent:/' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.n
+        # XXX need conversion support in ssh-keygen for the other params
+        for x in n ; do
+                echo "" >> ${_outbase}.$x
+                echo ============ ${_outbase}.$x
+                cat ${_outbase}.$x
+                echo ============
+        done
+}
+
+rsa_params() {
+        _in="$1"
+        _outbase="$2"
+        set -e
+        openssl rsa -noout -text -in $_in | \
+            awk '/^modulus:$/,/^publicExponent:/' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.n
+        openssl rsa -noout -text -in $_in | \
+            awk '/^prime1:$/,/^prime2:/' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.p
+        openssl rsa -noout -text -in $_in | \
+            awk '/^prime2:$/,/^exponent1:/' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.q
+        for x in n p q ; do
+                echo "" >> ${_outbase}.$x
+                echo ============ ${_outbase}.$x
+                cat ${_outbase}.$x
+                echo ============
+        done
+}
+
+dsa_params() {
+        _in="$1"
+        _outbase="$2"
+        set -e
+        openssl dsa -noout -text -in $_in | \
+            awk '/^priv:$/,/^pub:/' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.priv
+        openssl dsa -noout -text -in $_in | \
+            awk '/^pub:/,/^P:/' | #\
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.pub
+        openssl dsa -noout -text -in $_in | \
+            awk '/^G:/,0' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.g
+        for x in priv pub g ; do
+                echo "" >> ${_outbase}.$x
+                echo ============ ${_outbase}.$x
+                cat ${_outbase}.$x
+                echo ============
+        done
+}
+
+ecdsa_params() {
+        _in="$1"
+        _outbase="$2"
+        set -e
+        openssl ec -noout -text -in $_in | \
+            awk '/^priv:$/,/^pub:/' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.priv
+        openssl ec -noout -text -in $_in | \
+            awk '/^pub:/,/^ASN1 OID:/' | #\
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.pub
+        openssl ec -noout -text -in $_in | \
+            grep "ASN1 OID:" | tr -d '\n' | \
+            sed 's/.*: //;s/ *$//' > ${_outbase}.curve
+        for x in priv pub curve ; do
+                echo "" >> ${_outbase}.$x
+                echo ============ ${_outbase}.$x
+                cat ${_outbase}.$x
+                echo ============
+        done
+}
+
+set -ex
+
+cd testdata
+
+rm -f rsa1_1 rsa_1 dsa_1 ecdsa_1 ed25519_1
+rm -f rsa1_2 rsa_2 dsa_2 ecdsa_2 ed25519_2
+rm -f rsa_n dsa_n ecdsa_n # new-format keys
+rm -f rsa1_1_pw rsa_1_pw dsa_1_pw ecdsa_1_pw ed25519_1_pw
+rm -f rsa_n_pw dsa_n_pw ecdsa_n_pw
+rm -f pw *.pub *.bn.* *.param.* *.fp *.fp.bb
+
+ssh-keygen -t rsa1 -b 768 -C "RSA1 test key #1" -N "" -f rsa1_1
+ssh-keygen -t rsa -b 768 -C "RSA test key #1" -N "" -f rsa_1
+ssh-keygen -t dsa -b 1024 -C "DSA test key #1" -N "" -f dsa_1
+ssh-keygen -t ecdsa -b 256 -C "ECDSA test key #1" -N "" -f ecdsa_1
+ssh-keygen -t ed25519 -C "ED25519 test key #1" -N "" -f ed25519_1
+
+ssh-keygen -t rsa1 -b 2048 -C "RSA1 test key #2" -N "" -f rsa1_2
+ssh-keygen -t rsa -b 2048 -C "RSA test key #2" -N "" -f rsa_2
+ssh-keygen -t dsa -b 1024 -C "DSA test key #2" -N "" -f dsa_2
+ssh-keygen -t ecdsa -b 521 -C "ECDSA test key #2" -N "" -f ecdsa_2
+ssh-keygen -t ed25519 -C "ED25519 test key #1" -N "" -f ed25519_2
+
+cp rsa_1 rsa_n
+cp dsa_1 dsa_n
+cp ecdsa_1 ecdsa_n
+
+cp rsa1_1 rsa1_1_pw
+cp rsa_1 rsa_1_pw
+cp dsa_1 dsa_1_pw
+cp ecdsa_1 ecdsa_1_pw
+cp ed25519_1 ed25519_1_pw
+cp rsa_1 rsa_n_pw
+cp dsa_1 dsa_n_pw
+cp ecdsa_1 ecdsa_n_pw
+
+ssh-keygen -pf rsa1_1_pw -N "$PW"
+ssh-keygen -pf rsa_1_pw -N "$PW"
+ssh-keygen -pf dsa_1_pw -N "$PW"
+ssh-keygen -pf ecdsa_1_pw -N "$PW"
+ssh-keygen -pf ed25519_1_pw -N "$PW"
+ssh-keygen -opf rsa_n_pw -N "$PW"
+ssh-keygen -opf dsa_n_pw -N "$PW"
+ssh-keygen -opf ecdsa_n_pw -N "$PW"
+
+rsa1_params rsa1_1 rsa1_1.param
+rsa1_params rsa1_2 rsa1_2.param
+rsa_params rsa_1 rsa_1.param
+rsa_params rsa_2 rsa_2.param
+dsa_params dsa_1 dsa_1.param
+dsa_params dsa_1 dsa_1.param
+ecdsa_params ecdsa_1 ecdsa_1.param
+ecdsa_params ecdsa_2 ecdsa_2.param
+# XXX ed25519 params
+
+ssh-keygen -s rsa_2 -I hugo -n user1,user2 \
+    -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \
+    -V 19990101:20110101 -z 1 rsa_1.pub
+ssh-keygen -s rsa_2 -I hugo -n user1,user2 \
+    -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \
+    -V 19990101:20110101 -z 2 dsa_1.pub
+ssh-keygen -s rsa_2 -I hugo -n user1,user2 \
+    -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \
+    -V 19990101:20110101 -z 3 ecdsa_1.pub
+ssh-keygen -s rsa_2 -I hugo -n user1,user2 \
+    -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \
+    -V 19990101:20110101 -z 4 ed25519_1.pub
+
+ssh-keygen -s ed25519_1 -I julius -n host1,host2 -h \
+    -V 19990101:20110101 -z 5 rsa_1.pub
+ssh-keygen -s ed25519_1 -I julius -n host1,host2 -h \
+    -V 19990101:20110101 -z 6 dsa_1.pub
+ssh-keygen -s ecdsa_1 -I julius -n host1,host2 -h \
+    -V 19990101:20110101 -z 7 ecdsa_1.pub
+ssh-keygen -s ed25519_1 -I julius -n host1,host2 -h \
+    -V 19990101:20110101 -z 8 ed25519_1.pub
+
+ssh-keygen -lf rsa1_1 | awk '{print $2}' > rsa1_1.fp
+ssh-keygen -lf rsa_1 | awk '{print $2}' > rsa_1.fp
+ssh-keygen -lf dsa_1 | awk '{print $2}' > dsa_1.fp
+ssh-keygen -lf ecdsa_1 | awk '{print $2}' > ecdsa_1.fp
+ssh-keygen -lf ed25519_1 | awk '{print $2}' > ed25519_1.fp
+ssh-keygen -lf rsa1_2 | awk '{print $2}' > rsa1_2.fp
+ssh-keygen -lf rsa_2 | awk '{print $2}' > rsa_2.fp
+ssh-keygen -lf dsa_2 | awk '{print $2}' > dsa_2.fp
+ssh-keygen -lf ecdsa_2 | awk '{print $2}' > ecdsa_2.fp
+ssh-keygen -lf ed25519_2 | awk '{print $2}' > ed25519_2.fp
+
+ssh-keygen -lf dsa_1-cert.pub  | awk '{print $2}' > dsa_1-cert.fp
+ssh-keygen -lf ecdsa_1-cert.pub  | awk '{print $2}' > ecdsa_1-cert.fp
+ssh-keygen -lf ed25519_1-cert.pub  | awk '{print $2}' > ed25519_1-cert.fp
+ssh-keygen -lf rsa_1-cert.pub  | awk '{print $2}' > rsa_1-cert.fp
+
+ssh-keygen -Bf rsa1_1 | awk '{print $2}' > rsa1_1.fp.bb
+ssh-keygen -Bf rsa_1 | awk '{print $2}' > rsa_1.fp.bb
+ssh-keygen -Bf dsa_1 | awk '{print $2}' > dsa_1.fp.bb
+ssh-keygen -Bf ecdsa_1 | awk '{print $2}' > ecdsa_1.fp.bb
+ssh-keygen -Bf ed25519_1 | awk '{print $2}' > ed25519_1.fp.bb
+ssh-keygen -Bf rsa1_2 | awk '{print $2}' > rsa1_2.fp.bb
+ssh-keygen -Bf rsa_2 | awk '{print $2}' > rsa_2.fp.bb
+ssh-keygen -Bf dsa_2 | awk '{print $2}' > dsa_2.fp.bb
+ssh-keygen -Bf ecdsa_2 | awk '{print $2}' > ecdsa_2.fp.bb
+ssh-keygen -Bf ed25519_2 | awk '{print $2}' > ed25519_2.fp.bb
+
+echo "$PW" > pw
diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c
new file mode 100644
index 000000000..764f7fb76
--- /dev/null
+++ b/regress/unittests/sshkey/test_file.c
@@ -0,0 +1,457 @@
+/*      $OpenBSD: test_file.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/*
+ * Regress test for sshkey.h key management API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/dsa.h>
+#include <openssl/objects.h>
+#ifdef OPENSSL_HAS_NISTP256
+# include <openssl/ec.h>
+#endif
+
+#include "../test_helper/test_helper.h"
+
+#include "ssherr.h"
+#include "authfile.h"
+#include "sshkey.h"
+#include "sshbuf.h"
+
+#include "common.h"
+
+void sshkey_file_tests(void);
+
+void
+sshkey_file_tests(void)
+{
+        struct sshkey *k1, *k2;
+        struct sshbuf *buf, *pw;
+        BIGNUM *a, *b, *c;
+        char *cp;
+
+        TEST_START("load passphrase");
+        pw = load_text_file("pw");
+        TEST_DONE();
+
+        TEST_START("parse RSA1 from private");
+        buf = load_file("rsa1_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "rsa1_1",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k1, NULL);
+        a = load_bignum("rsa1_1.param.n");
+        ASSERT_BIGNUM_EQ(k1->rsa->n, a);
+        BN_free(a);
+        TEST_DONE();
+
+        TEST_START("parse RSA1 from private w/ passphrase");
+        buf = load_file("rsa1_1_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "rsa1_1_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load RSA1 from public");
+        ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa1_1.pub"), &k2,
+            NULL), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("RSA1 key hex fingerprint");
+        buf = load_text_file("rsa1_1.fp");
+        cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        TEST_START("RSA1 key bubblebabble fingerprint");
+        buf = load_text_file("rsa1_1.fp.bb");
+        cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        sshkey_free(k1);
+
+        TEST_START("parse RSA from private");
+        buf = load_file("rsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "rsa_1",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k1, NULL);
+        a = load_bignum("rsa_1.param.n");
+        b = load_bignum("rsa_1.param.p");
+        c = load_bignum("rsa_1.param.q");
+        ASSERT_BIGNUM_EQ(k1->rsa->n, a);
+        ASSERT_BIGNUM_EQ(k1->rsa->p, b);
+        ASSERT_BIGNUM_EQ(k1->rsa->q, c);
+        BN_free(a);
+        BN_free(b);
+        BN_free(c);
+        TEST_DONE();
+
+        TEST_START("parse RSA from private w/ passphrase");
+        buf = load_file("rsa_1_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "rsa_1_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("parse RSA from new-format");
+        buf = load_file("rsa_n");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            "", "rsa_n", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("parse RSA from new-format w/ passphrase");
+        buf = load_file("rsa_n_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "rsa_n_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load RSA from public");
+        ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_1.pub"), &k2,
+            NULL), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load RSA cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1"), &k2), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(k2->type, KEY_RSA_CERT);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 0);
+        ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1);
+        TEST_DONE();
+
+        TEST_START("RSA key hex fingerprint");
+        buf = load_text_file("rsa_1.fp");
+        cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        TEST_START("RSA cert hex fingerprint");
+        buf = load_text_file("rsa_1-cert.fp");
+        cp = sshkey_fingerprint(k2, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("RSA key bubblebabble fingerprint");
+        buf = load_text_file("rsa_1.fp.bb");
+        cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        sshkey_free(k1);
+
+        TEST_START("parse DSA from private");
+        buf = load_file("dsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "dsa_1",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k1, NULL);
+        a = load_bignum("dsa_1.param.g");
+        b = load_bignum("dsa_1.param.priv");
+        c = load_bignum("dsa_1.param.pub");
+        ASSERT_BIGNUM_EQ(k1->dsa->g, a);
+        ASSERT_BIGNUM_EQ(k1->dsa->priv_key, b);
+        ASSERT_BIGNUM_EQ(k1->dsa->pub_key, c);
+        BN_free(a);
+        BN_free(b);
+        BN_free(c);
+        TEST_DONE();
+
+        TEST_START("parse DSA from private w/ passphrase");
+        buf = load_file("dsa_1_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "dsa_1_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("parse DSA from new-format");
+        buf = load_file("dsa_n");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            "", "dsa_n", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("parse DSA from new-format w/ passphrase");
+        buf = load_file("dsa_n_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "dsa_n_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load DSA from public");
+        ASSERT_INT_EQ(sshkey_load_public(test_data_file("dsa_1.pub"), &k2,
+            NULL), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load DSA cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("dsa_1"), &k2), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(k2->type, KEY_DSA_CERT);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 0);
+        ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1);
+        TEST_DONE();
+
+        TEST_START("DSA key hex fingerprint");
+        buf = load_text_file("dsa_1.fp");
+        cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        TEST_START("DSA cert hex fingerprint");
+        buf = load_text_file("dsa_1-cert.fp");
+        cp = sshkey_fingerprint(k2, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("DSA key bubblebabble fingerprint");
+        buf = load_text_file("dsa_1.fp.bb");
+        cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        sshkey_free(k1);
+
+#ifdef OPENSSL_HAS_ECC
+        TEST_START("parse ECDSA from private");
+        buf = load_file("ecdsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "ecdsa_1",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k1, NULL);
+        buf = load_text_file("ecdsa_1.param.curve");
+        ASSERT_STRING_EQ((const char *)sshbuf_ptr(buf),
+            OBJ_nid2sn(k1->ecdsa_nid));
+        sshbuf_free(buf);
+        a = load_bignum("ecdsa_1.param.priv");
+        b = load_bignum("ecdsa_1.param.pub");
+        c = EC_POINT_point2bn(EC_KEY_get0_group(k1->ecdsa),
+            EC_KEY_get0_public_key(k1->ecdsa), POINT_CONVERSION_UNCOMPRESSED,
+            NULL, NULL);
+        ASSERT_PTR_NE(c, NULL);
+        ASSERT_BIGNUM_EQ(EC_KEY_get0_private_key(k1->ecdsa), a);
+        ASSERT_BIGNUM_EQ(b, c);
+        BN_free(a);
+        BN_free(b);
+        BN_free(c);
+        TEST_DONE();
+
+        TEST_START("parse ECDSA from private w/ passphrase");
+        buf = load_file("ecdsa_1_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "ecdsa_1_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("parse ECDSA from new-format");
+        buf = load_file("ecdsa_n");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            "", "ecdsa_n", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("parse ECDSA from new-format w/ passphrase");
+        buf = load_file("ecdsa_n_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "ecdsa_n_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load ECDSA from public");
+        ASSERT_INT_EQ(sshkey_load_public(test_data_file("ecdsa_1.pub"), &k2,
+            NULL), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load ECDSA cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("ecdsa_1"), &k2), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(k2->type, KEY_ECDSA_CERT);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 0);
+        ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1);
+        TEST_DONE();
+
+        TEST_START("ECDSA key hex fingerprint");
+        buf = load_text_file("ecdsa_1.fp");
+        cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        TEST_START("ECDSA cert hex fingerprint");
+        buf = load_text_file("ecdsa_1-cert.fp");
+        cp = sshkey_fingerprint(k2, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("ECDSA key bubblebabble fingerprint");
+        buf = load_text_file("ecdsa_1.fp.bb");
+        cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        sshkey_free(k1);
+#endif /* OPENSSL_HAS_ECC */
+
+        TEST_START("parse Ed25519 from private");
+        buf = load_file("ed25519_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "ed25519_1",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_INT_EQ(k1->type, KEY_ED25519);
+        /* XXX check key contents */
+        TEST_DONE();
+
+        TEST_START("parse Ed25519 from private w/ passphrase");
+        buf = load_file("ed25519_1_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "ed25519_1_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load Ed25519 from public");
+        ASSERT_INT_EQ(sshkey_load_public(test_data_file("ed25519_1.pub"), &k2,
+            NULL), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load Ed25519 cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("ed25519_1"), &k2), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(k2->type, KEY_ED25519_CERT);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 0);
+        ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1);
+        TEST_DONE();
+
+        TEST_START("Ed25519 key hex fingerprint");
+        buf = load_text_file("ed25519_1.fp");
+        cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        TEST_START("Ed25519 cert hex fingerprint");
+        buf = load_text_file("ed25519_1-cert.fp");
+        cp = sshkey_fingerprint(k2, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("Ed25519 key bubblebabble fingerprint");
+        buf = load_text_file("ed25519_1.fp.bb");
+        cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        sshkey_free(k1);
+
+        sshbuf_free(pw);
+
+}
diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c
new file mode 100644
index 000000000..a3f61a6df
--- /dev/null
+++ b/regress/unittests/sshkey/test_fuzz.c
@@ -0,0 +1,406 @@
+/*      $OpenBSD: test_fuzz.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/*
+ * Fuzz tests for key parsing
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/dsa.h>
+#include <openssl/objects.h>
+#ifdef OPENSSL_HAS_NISTP256
+# include <openssl/ec.h>
+#endif
+
+#include "../test_helper/test_helper.h"
+
+#include "ssherr.h"
+#include "authfile.h"
+#include "sshkey.h"
+#include "sshbuf.h"
+
+#include "common.h"
+
+void sshkey_fuzz_tests(void);
+
+static void
+onerror(void *fuzz)
+{
+        fprintf(stderr, "Failed during fuzz:\n");
+        fuzz_dump((struct fuzz *)fuzz);
+}
+
+static void
+public_fuzz(struct sshkey *k)
+{
+        struct sshkey *k1;
+        struct sshbuf *buf;
+        struct fuzz *fuzz;
+
+        ASSERT_PTR_NE(buf = sshbuf_new(), NULL);
+        ASSERT_INT_EQ(sshkey_to_blob_buf(k, buf), 0);
+        /* XXX need a way to run the tests in "slow, but complete" mode */
+        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | /* XXX too slow FUZZ_2_BIT_FLIP | */
+            FUZZ_1_BYTE_FLIP | /* XXX too slow FUZZ_2_BYTE_FLIP | */
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END,
+            sshbuf_mutable_ptr(buf), sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(buf), sshbuf_len(buf),
+            &k1), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                if (sshkey_from_blob(fuzz_ptr(fuzz), fuzz_len(fuzz), &k1) == 0)
+                        sshkey_free(k1);
+        }
+        fuzz_cleanup(fuzz);
+}
+
+static void
+sig_fuzz(struct sshkey *k)
+{
+        struct fuzz *fuzz;
+        u_char *sig, c[] = "some junk to be signed";
+        size_t l;
+
+        ASSERT_INT_EQ(sshkey_sign(k, &sig, &l, c, sizeof(c), 0), 0);
+        ASSERT_SIZE_T_GT(l, 0);
+        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | /* too slow FUZZ_2_BIT_FLIP | */
+            FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP |
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END, sig, l);
+        ASSERT_INT_EQ(sshkey_verify(k, sig, l, c, sizeof(c), 0), 0);
+        free(sig);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                sshkey_verify(k, fuzz_ptr(fuzz), fuzz_len(fuzz),
+                    c, sizeof(c), 0);
+        }
+        fuzz_cleanup(fuzz);
+}
+
+void
+sshkey_fuzz_tests(void)
+{
+        struct sshkey *k1;
+        struct sshbuf *buf, *fuzzed;
+        struct fuzz *fuzz;
+        int r;
+
+        TEST_START("fuzz RSA1 private");
+        buf = load_file("rsa1_1");
+        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | FUZZ_1_BYTE_FLIP |
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END,
+            sshbuf_mutable_ptr(buf), sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz RSA1 public");
+        buf = load_file("rsa1_1_pw");
+        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | FUZZ_1_BYTE_FLIP |
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END,
+            sshbuf_mutable_ptr(buf), sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_public_rsa1_fileblob(buf, &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_public_rsa1_fileblob(fuzzed, &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz RSA private");
+        buf = load_file("rsa_1");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz RSA new-format private");
+        buf = load_file("rsa_n");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz DSA private");
+        buf = load_file("dsa_1");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz DSA new-format private");
+        buf = load_file("dsa_n");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+#ifdef OPENSSL_HAS_ECC
+        TEST_START("fuzz ECDSA private");
+        buf = load_file("ecdsa_1");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz ECDSA new-format private");
+        buf = load_file("ecdsa_n");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+#endif
+
+        TEST_START("fuzz Ed25519 private");
+        buf = load_file("ed25519_1");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz RSA public");
+        buf = load_file("rsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz RSA cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1"), &k1), 0);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz DSA public");
+        buf = load_file("dsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz DSA cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("dsa_1"), &k1), 0);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+#ifdef OPENSSL_HAS_ECC
+        TEST_START("fuzz ECDSA public");
+        buf = load_file("ecdsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz ECDSA cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("ecdsa_1"), &k1), 0);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+#endif
+
+        TEST_START("fuzz Ed25519 public");
+        buf = load_file("ed25519_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz Ed25519 cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("ed25519_1"), &k1), 0);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz RSA sig");
+        buf = load_file("rsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        sig_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz DSA sig");
+        buf = load_file("dsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        sig_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+#ifdef OPENSSL_HAS_ECC
+        TEST_START("fuzz ECDSA sig");
+        buf = load_file("ecdsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        sig_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+#endif
+
+        TEST_START("fuzz Ed25519 sig");
+        buf = load_file("ed25519_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        sig_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+/* XXX fuzz decoded new-format blobs too */
+
+}
diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c
new file mode 100644
index 000000000..ef0c67956
--- /dev/null
+++ b/regress/unittests/sshkey/test_sshkey.c
@@ -0,0 +1,357 @@
+/*      $OpenBSD: test_sshkey.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/*
+ * Regress test for sshkey.h key management API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/dsa.h>
+#ifdef OPENSSL_HAS_NISTP256
+# include <openssl/ec.h>
+#endif
+
+#include "../test_helper/test_helper.h"
+
+#include "ssherr.h"
+#include "sshbuf.h"
+#define SSHBUF_INTERNAL 1       /* access internals for testing */
+#include "sshkey.h"
+
+#include "authfile.h"
+#include "common.h"
+#include "ssh2.h"
+
+void sshkey_tests(void);
+
+static void
+build_cert(struct sshbuf *b, const struct sshkey *k, const char *type,
+    const struct sshkey *sign_key, const struct sshkey *ca_key)
+{
+        struct sshbuf *ca_buf, *pk, *principals, *critopts, *exts;
+        u_char *sigblob;
+        size_t siglen;
+
+        ca_buf = sshbuf_new();
+        ASSERT_INT_EQ(sshkey_to_blob_buf(ca_key, ca_buf), 0);
+
+        /*
+         * Get the public key serialisation by rendering the key and skipping
+         * the type string. This is a bit of a hack :/
+         */
+        pk = sshbuf_new();
+        ASSERT_INT_EQ(sshkey_plain_to_blob_buf(k, pk), 0);
+        ASSERT_INT_EQ(sshbuf_skip_string(pk), 0);
+
+        principals = sshbuf_new();
+        ASSERT_INT_EQ(sshbuf_put_cstring(principals, "gsamsa"), 0);
+        ASSERT_INT_EQ(sshbuf_put_cstring(principals, "gregor"), 0);
+
+        critopts = sshbuf_new();
+        /* XXX fill this in */
+
+        exts = sshbuf_new();
+        /* XXX fill this in */
+
+        ASSERT_INT_EQ(sshbuf_put_cstring(b, type), 0);
+        ASSERT_INT_EQ(sshbuf_put_cstring(b, "noncenoncenonce!"), 0); /* nonce */
+        ASSERT_INT_EQ(sshbuf_putb(b, pk), 0); /* public key serialisation */
+        ASSERT_INT_EQ(sshbuf_put_u64(b, 1234), 0); /* serial */
+        ASSERT_INT_EQ(sshbuf_put_u32(b, SSH2_CERT_TYPE_USER), 0); /* type */
+        ASSERT_INT_EQ(sshbuf_put_cstring(b, "gregor"), 0); /* key ID */
+        ASSERT_INT_EQ(sshbuf_put_stringb(b, principals), 0); /* principals */
+        ASSERT_INT_EQ(sshbuf_put_u64(b, 0), 0); /* start */
+        ASSERT_INT_EQ(sshbuf_put_u64(b, 0xffffffffffffffffULL), 0); /* end */
+        ASSERT_INT_EQ(sshbuf_put_stringb(b, critopts), 0); /* options */
+        ASSERT_INT_EQ(sshbuf_put_stringb(b, exts), 0); /* extensions */
+        ASSERT_INT_EQ(sshbuf_put_string(b, NULL, 0), 0); /* reserved */
+        ASSERT_INT_EQ(sshbuf_put_stringb(b, ca_buf), 0); /* signature key */
+        ASSERT_INT_EQ(sshkey_sign(sign_key, &sigblob, &siglen,
+            sshbuf_ptr(b), sshbuf_len(b), 0), 0);
+        ASSERT_INT_EQ(sshbuf_put_string(b, sigblob, siglen), 0); /* signature */
+
+        free(sigblob);
+        sshbuf_free(ca_buf);
+        sshbuf_free(exts);
+        sshbuf_free(critopts);
+        sshbuf_free(principals);
+        sshbuf_free(pk);
+}
+
+void
+sshkey_tests(void)
+{
+        struct sshkey *k1, *k2, *k3, *k4, *kr, *kd, *ke, *kf;
+        struct sshbuf *b;
+
+        TEST_START("new invalid");
+        k1 = sshkey_new(-42);
+        ASSERT_PTR_EQ(k1, NULL);
+        TEST_DONE();
+
+        TEST_START("new/free KEY_UNSPEC");
+        k1 = sshkey_new(KEY_UNSPEC);
+        ASSERT_PTR_NE(k1, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new/free KEY_RSA1");
+        k1 = sshkey_new(KEY_RSA1);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(k1->rsa, NULL);
+        ASSERT_PTR_NE(k1->rsa->n, NULL);
+        ASSERT_PTR_NE(k1->rsa->e, NULL);
+        ASSERT_PTR_EQ(k1->rsa->p, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new/free KEY_RSA");
+        k1 = sshkey_new(KEY_RSA);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(k1->rsa, NULL);
+        ASSERT_PTR_NE(k1->rsa->n, NULL);
+        ASSERT_PTR_NE(k1->rsa->e, NULL);
+        ASSERT_PTR_EQ(k1->rsa->p, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new/free KEY_DSA");
+        k1 = sshkey_new(KEY_DSA);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(k1->dsa, NULL);
+        ASSERT_PTR_NE(k1->dsa->g, NULL);
+        ASSERT_PTR_EQ(k1->dsa->priv_key, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new/free KEY_ECDSA");
+        k1 = sshkey_new(KEY_ECDSA);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_EQ(k1->ecdsa, NULL);  /* Can't allocate without NID */
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new/free KEY_ED25519");
+        k1 = sshkey_new(KEY_ED25519);
+        ASSERT_PTR_NE(k1, NULL);
+        /* These should be blank until key loaded or generated */
+        ASSERT_PTR_EQ(k1->ed25519_sk, NULL);
+        ASSERT_PTR_EQ(k1->ed25519_pk, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new_private KEY_RSA");
+        k1 = sshkey_new_private(KEY_RSA);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(k1->rsa, NULL);
+        ASSERT_PTR_NE(k1->rsa->n, NULL);
+        ASSERT_PTR_NE(k1->rsa->e, NULL);
+        ASSERT_PTR_NE(k1->rsa->p, NULL);
+        ASSERT_INT_EQ(sshkey_add_private(k1), 0);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new_private KEY_DSA");
+        k1 = sshkey_new_private(KEY_DSA);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(k1->dsa, NULL);
+        ASSERT_PTR_NE(k1->dsa->g, NULL);
+        ASSERT_PTR_NE(k1->dsa->priv_key, NULL);
+        ASSERT_INT_EQ(sshkey_add_private(k1), 0);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("generate KEY_RSA too small modulus");
+        ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 128, &k1),
+            SSH_ERR_INVALID_ARGUMENT);
+        ASSERT_PTR_EQ(k1, NULL);
+        TEST_DONE();
+
+        TEST_START("generate KEY_RSA too large modulus");
+        ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 1 << 20, &k1),
+            SSH_ERR_INVALID_ARGUMENT);
+        ASSERT_PTR_EQ(k1, NULL);
+        TEST_DONE();
+
+        TEST_START("generate KEY_DSA wrong bits");
+        ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 2048, &k1),
+            SSH_ERR_INVALID_ARGUMENT);
+        ASSERT_PTR_EQ(k1, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("generate KEY_ECDSA wrong bits");
+        ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 42, &k1),
+            SSH_ERR_INVALID_ARGUMENT);
+        ASSERT_PTR_EQ(k1, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("generate KEY_RSA");
+        ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 768, &kr), 0);
+        ASSERT_PTR_NE(kr, NULL);
+        ASSERT_PTR_NE(kr->rsa, NULL);
+        ASSERT_PTR_NE(kr->rsa->n, NULL);
+        ASSERT_PTR_NE(kr->rsa->e, NULL);
+        ASSERT_PTR_NE(kr->rsa->p, NULL);
+        ASSERT_INT_EQ(BN_num_bits(kr->rsa->n), 768);
+        TEST_DONE();
+
+        TEST_START("generate KEY_DSA");
+        ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 1024, &kd), 0);
+        ASSERT_PTR_NE(kd, NULL);
+        ASSERT_PTR_NE(kd->dsa, NULL);
+        ASSERT_PTR_NE(kd->dsa->g, NULL);
+        ASSERT_PTR_NE(kd->dsa->priv_key, NULL);
+        TEST_DONE();
+
+#ifdef OPENSSL_HAS_ECC
+        TEST_START("generate KEY_ECDSA");
+        ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &ke), 0);
+        ASSERT_PTR_NE(ke, NULL);
+        ASSERT_PTR_NE(ke->ecdsa, NULL);
+        ASSERT_PTR_NE(EC_KEY_get0_public_key(ke->ecdsa), NULL);
+        ASSERT_PTR_NE(EC_KEY_get0_private_key(ke->ecdsa), NULL);
+        TEST_DONE();
+#endif
+
+        TEST_START("generate KEY_ED25519");
+        ASSERT_INT_EQ(sshkey_generate(KEY_ED25519, 256, &kf), 0);
+        ASSERT_PTR_NE(kf, NULL);
+        ASSERT_INT_EQ(kf->type, KEY_ED25519);
+        ASSERT_PTR_NE(kf->ed25519_pk, NULL);
+        ASSERT_PTR_NE(kf->ed25519_sk, NULL);
+        TEST_DONE();
+
+        TEST_START("demote KEY_RSA");
+        ASSERT_INT_EQ(sshkey_demote(kr, &k1), 0);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(kr, k1);
+        ASSERT_INT_EQ(k1->type, KEY_RSA);
+        ASSERT_PTR_NE(k1->rsa, NULL);
+        ASSERT_PTR_NE(k1->rsa->n, NULL);
+        ASSERT_PTR_NE(k1->rsa->e, NULL);
+        ASSERT_PTR_EQ(k1->rsa->p, NULL);
+        TEST_DONE();
+
+        TEST_START("equal KEY_RSA/demoted KEY_RSA");
+        ASSERT_INT_EQ(sshkey_equal(kr, k1), 1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("demote KEY_DSA");
+        ASSERT_INT_EQ(sshkey_demote(kd, &k1), 0);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(kd, k1);
+        ASSERT_INT_EQ(k1->type, KEY_DSA);
+        ASSERT_PTR_NE(k1->dsa, NULL);
+        ASSERT_PTR_NE(k1->dsa->g, NULL);
+        ASSERT_PTR_EQ(k1->dsa->priv_key, NULL);
+        TEST_DONE();
+
+        TEST_START("equal KEY_DSA/demoted KEY_DSA");
+        ASSERT_INT_EQ(sshkey_equal(kd, k1), 1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+#ifdef OPENSSL_HAS_ECC
+        TEST_START("demote KEY_ECDSA");
+        ASSERT_INT_EQ(sshkey_demote(ke, &k1), 0);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(ke, k1);
+        ASSERT_INT_EQ(k1->type, KEY_ECDSA);
+        ASSERT_PTR_NE(k1->ecdsa, NULL);
+        ASSERT_INT_EQ(k1->ecdsa_nid, ke->ecdsa_nid);
+        ASSERT_PTR_NE(EC_KEY_get0_public_key(ke->ecdsa), NULL);
+        ASSERT_PTR_EQ(EC_KEY_get0_private_key(k1->ecdsa), NULL);
+        TEST_DONE();
+
+        TEST_START("equal KEY_ECDSA/demoted KEY_ECDSA");
+        ASSERT_INT_EQ(sshkey_equal(ke, k1), 1);
+        sshkey_free(k1);
+        TEST_DONE();
+#endif
+
+        TEST_START("demote KEY_ED25519");
+        ASSERT_INT_EQ(sshkey_demote(kf, &k1), 0);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(kf, k1);
+        ASSERT_INT_EQ(k1->type, KEY_ED25519);
+        ASSERT_PTR_NE(k1->ed25519_pk, NULL);
+        ASSERT_PTR_EQ(k1->ed25519_sk, NULL);
+        TEST_DONE();
+
+        TEST_START("equal KEY_ED25519/demoted KEY_ED25519");
+        ASSERT_INT_EQ(sshkey_equal(kf, k1), 1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("equal mismatched key types");
+        ASSERT_INT_EQ(sshkey_equal(kd, kr), 0);
+#ifdef OPENSSL_HAS_ECC
+        ASSERT_INT_EQ(sshkey_equal(kd, ke), 0);
+        ASSERT_INT_EQ(sshkey_equal(kr, ke), 0);
+        ASSERT_INT_EQ(sshkey_equal(ke, kf), 0);
+#endif
+        ASSERT_INT_EQ(sshkey_equal(kd, kf), 0);
+        TEST_DONE();
+
+        TEST_START("equal different keys");
+        ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 768, &k1), 0);
+        ASSERT_INT_EQ(sshkey_equal(kr, k1), 0);
+        sshkey_free(k1);
+        ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 1024, &k1), 0);
+        ASSERT_INT_EQ(sshkey_equal(kd, k1), 0);
+        sshkey_free(k1);
+#ifdef OPENSSL_HAS_ECC
+        ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &k1), 0);
+        ASSERT_INT_EQ(sshkey_equal(ke, k1), 0);
+        sshkey_free(k1);
+#endif
+        ASSERT_INT_EQ(sshkey_generate(KEY_ED25519, 256, &k1), 0);
+        ASSERT_INT_EQ(sshkey_equal(kf, k1), 0);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        sshkey_free(kr);
+        sshkey_free(kd);
+#ifdef OPENSSL_HAS_ECC
+        sshkey_free(ke);
+#endif
+        sshkey_free(kf);
+
+/* XXX certify test */
+/* XXX sign test */
+/* XXX verify test */
+
+        TEST_START("nested certificate");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1"), &k1), 0);
+        ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_1.pub"), &k2,
+            NULL), 0);
+        b = load_file("rsa_2");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(b, "", "rsa_1",
+            &k3, NULL), 0);
+        sshbuf_reset(b);
+        build_cert(b, k2, "ssh-rsa-cert-v01@openssh.com", k3, k1);
+        ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(b), sshbuf_len(b), &k4),
+            SSH_ERR_KEY_CERT_INVALID_SIGN_KEY);
+        ASSERT_PTR_EQ(k4, NULL);
+        sshbuf_free(b);
+        sshkey_free(k1);
+        sshkey_free(k2);
+        sshkey_free(k3);
+        TEST_DONE();
+
+}
diff --git a/regress/unittests/sshkey/testdata/dsa_1 b/regress/unittests/sshkey/testdata/dsa_1
new file mode 100644
index 000000000..34346869f
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1
@@ -0,0 +1,12 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBuwIBAAKBgQCxBNwH8TmLXqiZa0b9pxC6W+zS4Voqp8S+QwecYpNPTmhjaUYI
+E/aJWAzFVtdbysLM89ukvw/z8qBkbMSefdypKmjUtgv51ZD4nfV4Wxb+G+1QExHr
+M+kowOOL3XbcsdbPLUt8vxDJbBlQRch4zyai7CWjQR3JFXpR8sevUFJxSQIVAIdE
+oncp2DEY2U/ZZnIyGCwApCzfAoGARW+eewZTv1Eosxv3ANKx372pf5+fQKwnWizI
+j5z/GY3w3xobRCP9FiL4K3Nip2FvHLTGpRrlfm19RWYAg77VsNgztC4V9C8QrKWc
+WJdkUkoQpZ3VoO25rO13hmIelkal3omKCF4ZE/edeF3d2B8DlzYs0aBcjTCMDrub
+/CJILcYCgYEAgJt9jefGQi4Sl5F8h3jYo52LygE8sNYyurElMKVmyhFSKJ1Ifi9j
+4hNp2jZzu7jpZWhYndUoPaG6gbRB7fL3p5knlRo3P2Dznd6u6NAdhrADWW+JX9n1
+/EMKUv0h8rRFI/3b9RY1HVVzBQH7V3sNJ6iekH8JqOy1liCMaMylw4gCFBl7Lc6V
+hmTiTuhLXjoRdCZS/p/m
+-----END DSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/dsa_1-cert.fp b/regress/unittests/sshkey/testdata/dsa_1-cert.fp
new file mode 100644
index 000000000..56ee1f89b
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1-cert.fp
@@ -0,0 +1 @@
+5a:4a:41:8c:4e:fa:4c:52:19:f9:39:49:31:fb:fd:74
diff --git a/regress/unittests/sshkey/testdata/dsa_1-cert.pub b/regress/unittests/sshkey/testdata/dsa_1-cert.pub
new file mode 100644
index 000000000..023edf136
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1-cert.pub
@@ -0,0 +1 @@
+ssh-dss-cert-v01@openssh.com AAAAHHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgj8zueN51MSQ7jW3fFwqyJWA3DycAAavQ8WgMHqcUG7YAAACBALEE3AfxOYteqJlrRv2nELpb7NLhWiqnxL5DB5xik09OaGNpRggT9olYDMVW11vKwszz26S/D/PyoGRsxJ593KkqaNS2C/nVkPid9XhbFv4b7VATEesz6SjA44vddtyx1s8tS3y/EMlsGVBFyHjPJqLsJaNBHckVelHyx69QUnFJAAAAFQCHRKJ3KdgxGNlP2WZyMhgsAKQs3wAAAIBFb557BlO/USizG/cA0rHfval/n59ArCdaLMiPnP8ZjfDfGhtEI/0WIvgrc2KnYW8ctMalGuV+bX1FZgCDvtWw2DO0LhX0LxCspZxYl2RSShClndWg7bms7XeGYh6WRqXeiYoIXhkT9514Xd3YHwOXNizRoFyNMIwOu5v8IkgtxgAAAIEAgJt9jefGQi4Sl5F8h3jYo52LygE8sNYyurElMKVmyhFSKJ1Ifi9j4hNp2jZzu7jpZWhYndUoPaG6gbRB7fL3p5knlRo3P2Dznd6u6NAdhrADWW+JX9n1/EMKUv0h8rRFI/3b9RY1HVVzBQH7V3sNJ6iekH8JqOy1liCMaMylw4gAAAAAAAAABgAAAAIAAAAGanVsaXVzAAAAEgAAAAVob3N0MQAAAAVob3N0MgAAAAA2i4NgAAAAAE0d4eAAAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAILk95V5J3LKVx8bcLSB4073R7d0aAvR8gJrPvnV0D3MQAAAAUwAAAAtzc2gtZWQyNTUxOQAAAEA6qftqozw0ah9PG9obAg8iOPwQv6AsT9t/1G69eArSd9Am85OKIhAvYguI1Xtr9rw78X/Xk+6HtyAOF3QemaQD dsa_1.pub
diff --git a/regress/unittests/sshkey/testdata/dsa_1.fp b/regress/unittests/sshkey/testdata/dsa_1.fp
new file mode 100644
index 000000000..56ee1f89b
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1.fp
@@ -0,0 +1 @@
+5a:4a:41:8c:4e:fa:4c:52:19:f9:39:49:31:fb:fd:74
diff --git a/regress/unittests/sshkey/testdata/dsa_1.fp.bb b/regress/unittests/sshkey/testdata/dsa_1.fp.bb
new file mode 100644
index 000000000..07dd9b418
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1.fp.bb
@@ -0,0 +1 @@
+xosat-baneh-gocad-relek-kepur-mibip-motog-bykyb-hisug-mysus-tuxix
diff --git a/regress/unittests/sshkey/testdata/dsa_1.param.g b/regress/unittests/sshkey/testdata/dsa_1.param.g
new file mode 100644
index 000000000..4b09f6d18
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1.param.g
@@ -0,0 +1 @@
+456f9e7b0653bf5128b31bf700d2b1dfbda97f9f9f40ac275a2cc88f9cff198df0df1a1b4423fd1622f82b7362a7616f1cb4c6a51ae57e6d7d45660083bed5b0d833b42e15f42f10aca59c589764524a10a59dd5a0edb9aced7786621e9646a5de898a085e1913f79d785dddd81f0397362cd1a05c8d308c0ebb9bfc22482dc6
diff --git a/regress/unittests/sshkey/testdata/dsa_1.param.priv b/regress/unittests/sshkey/testdata/dsa_1.param.priv
new file mode 100644
index 000000000..2dd737cbe
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1.param.priv
@@ -0,0 +1 @@
+197b2dce958664e24ee84b5e3a11742652fe9fe6
diff --git a/regress/unittests/sshkey/testdata/dsa_1.param.pub b/regress/unittests/sshkey/testdata/dsa_1.param.pub
new file mode 100644
index 000000000..b23d7207f
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1.param.pub
@@ -0,0 +1 @@
+00809b7d8de7c6422e1297917c8778d8a39d8bca013cb0d632bab12530a566ca1152289d487e2f63e21369da3673bbb8e96568589dd5283da1ba81b441edf2f7a79927951a373f60f39ddeaee8d01d86b003596f895fd9f5fc430a52fd21f2b44523fddbf516351d55730501fb577b0d27a89e907f09a8ecb596208c68cca5c388
diff --git a/regress/unittests/sshkey/testdata/dsa_1.pub b/regress/unittests/sshkey/testdata/dsa_1.pub
new file mode 100644
index 000000000..89681970c
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1.pub
@@ -0,0 +1 @@
+ssh-dss AAAAB3NzaC1kc3MAAACBALEE3AfxOYteqJlrRv2nELpb7NLhWiqnxL5DB5xik09OaGNpRggT9olYDMVW11vKwszz26S/D/PyoGRsxJ593KkqaNS2C/nVkPid9XhbFv4b7VATEesz6SjA44vddtyx1s8tS3y/EMlsGVBFyHjPJqLsJaNBHckVelHyx69QUnFJAAAAFQCHRKJ3KdgxGNlP2WZyMhgsAKQs3wAAAIBFb557BlO/USizG/cA0rHfval/n59ArCdaLMiPnP8ZjfDfGhtEI/0WIvgrc2KnYW8ctMalGuV+bX1FZgCDvtWw2DO0LhX0LxCspZxYl2RSShClndWg7bms7XeGYh6WRqXeiYoIXhkT9514Xd3YHwOXNizRoFyNMIwOu5v8IkgtxgAAAIEAgJt9jefGQi4Sl5F8h3jYo52LygE8sNYyurElMKVmyhFSKJ1Ifi9j4hNp2jZzu7jpZWhYndUoPaG6gbRB7fL3p5knlRo3P2Dznd6u6NAdhrADWW+JX9n1/EMKUv0h8rRFI/3b9RY1HVVzBQH7V3sNJ6iekH8JqOy1liCMaMylw4g= DSA test key #1
diff --git a/regress/unittests/sshkey/testdata/dsa_1_pw b/regress/unittests/sshkey/testdata/dsa_1_pw
new file mode 100644
index 000000000..1402153a0
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1_pw
@@ -0,0 +1,15 @@
+-----BEGIN DSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,9E668E24E7B9D658E3E7D0446B32B376
+
+hDjDLbfCAQutblxLuyNzSLxISSgXTgyzq8St9GE0lUtEc7i0xGNWwoWpFSbtD9y1
+yTG5UkhATQt56SY1ABfXZ21wieYuEEQeSJi0gwUQNNt2SwwITx4EdzDedWiHjikt
+jbzH3v33agp/odw2X9wY6zu75y9CeW9o7SszRl286DliWIHJmhMlbb8r7jRqu62H
+s5YYxD0xS1ipWauxklmIXMWNZHcARo8ZiJOuNdLshrSrl8DUW9P6F89FvxclQzKr
+44u3OBm7KbgPvPURDFLgNP6uCGBjzHvhHTpzVBxmQzCl3aGgsTKXiwJ1eupNjntB
+ji0EnbznvoxR6qhXxw/WQ+MnWlWqTXka/2qaB6m3oJv+Zn7cPCJ5kvHnhr2JmNMl
+igTh4Ov4LZLyNgO0Lbec4KyxW9QInRV5CY4Pu5lhqHteiPmOIGMWFtuh8Bb8Kg2q
+VvXnPo5I3FjqV7UhDduO1Wn558sBZWQPqRbHVPN6wXJuM3HGkBl+aNjn0qddv9tr
+VFJd/xdly2Ne81g3CB8jysE+3WEOrV9kdybocp/EhSOzP4i6pjWlyWdR5+CgbvRm
+TUIeIaQbmPIB5251o5YK+Q==
+-----END DSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/dsa_2 b/regress/unittests/sshkey/testdata/dsa_2
new file mode 100644
index 000000000..b189dc821
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_2
@@ -0,0 +1,12 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBuwIBAAKBgQDoMxCTyBnLPSO7CRU3RyfJLANLKBZ3/LdcsyNaARctaRA5gzRb
+XdTFFU+rWKfxv+otm0KyCOepLtWy8tjKRYb7Ni46USlGwtM0Adx/3vR4iWNfipDP
+K2V4O97JyMe3wsbF7siC01U4b8Ki+J44iFG9nuRnOTHqUWI615mraQRwlQIVAMsX
+nsPGH8QrU11F1ScAIfZC165dAoGACCXyOHFkxABpJDtJs6AE7Hl3XjI4dnlim/XH
+Y60W6gcO7gHSE2r2ljCubJqoUXmxd5mLKgnu91jIG/4URwDM4V7pb2k99sXpAi8I
+L52eQl88C0bRD9+lEJfR4PMT39EccDRPB4+E055RoYQZ/McIyad8sF3Qwt084Eq+
+IkUt2coCgYEAxZRpCY82sM9Mu4B0EcH6O8seRqIRScmelljhUtKxuvf2PChwIWkR
+HK9lORHBE3iKyurC5Muf3abuHKwMFjrOjHKOTqXBRrDZ7RgLQA0aUAQD3lWc9OTP
+NShjphpq5xr0HZB31eJg3/Mo6KxYlRpzMXbTyenZP0XLICSSAywvTDoCFG5whl2k
+Y2FLGfi9V6ylUVH6jKgE
+-----END DSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/dsa_2.fp b/regress/unittests/sshkey/testdata/dsa_2.fp
new file mode 100644
index 000000000..ba9de82a8
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_2.fp
@@ -0,0 +1 @@
+72:5f:50:6b:e5:64:c5:62:21:92:3f:8b:10:9b:9f:1a
diff --git a/regress/unittests/sshkey/testdata/dsa_2.fp.bb b/regress/unittests/sshkey/testdata/dsa_2.fp.bb
new file mode 100644
index 000000000..37a5221a7
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_2.fp.bb
@@ -0,0 +1 @@
+xesoh-mebaf-feced-lenuz-sicam-pevok-bosak-nogaz-ligen-fekef-fixex
diff --git a/regress/unittests/sshkey/testdata/dsa_2.pub b/regress/unittests/sshkey/testdata/dsa_2.pub
new file mode 100644
index 000000000..6ed2736b1
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_2.pub
@@ -0,0 +1 @@
+ssh-dss AAAAB3NzaC1kc3MAAACBAOgzEJPIGcs9I7sJFTdHJ8ksA0soFnf8t1yzI1oBFy1pEDmDNFtd1MUVT6tYp/G/6i2bQrII56ku1bLy2MpFhvs2LjpRKUbC0zQB3H/e9HiJY1+KkM8rZXg73snIx7fCxsXuyILTVThvwqL4njiIUb2e5Gc5MepRYjrXmatpBHCVAAAAFQDLF57Dxh/EK1NdRdUnACH2QteuXQAAAIAIJfI4cWTEAGkkO0mzoATseXdeMjh2eWKb9cdjrRbqBw7uAdITavaWMK5smqhRebF3mYsqCe73WMgb/hRHAMzhXulvaT32xekCLwgvnZ5CXzwLRtEP36UQl9Hg8xPf0RxwNE8Hj4TTnlGhhBn8xwjJp3ywXdDC3TzgSr4iRS3ZygAAAIEAxZRpCY82sM9Mu4B0EcH6O8seRqIRScmelljhUtKxuvf2PChwIWkRHK9lORHBE3iKyurC5Muf3abuHKwMFjrOjHKOTqXBRrDZ7RgLQA0aUAQD3lWc9OTPNShjphpq5xr0HZB31eJg3/Mo6KxYlRpzMXbTyenZP0XLICSSAywvTDo= DSA test key #2
diff --git a/regress/unittests/sshkey/testdata/dsa_n b/regress/unittests/sshkey/testdata/dsa_n
new file mode 100644
index 000000000..34346869f
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_n
@@ -0,0 +1,12 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBuwIBAAKBgQCxBNwH8TmLXqiZa0b9pxC6W+zS4Voqp8S+QwecYpNPTmhjaUYI
+E/aJWAzFVtdbysLM89ukvw/z8qBkbMSefdypKmjUtgv51ZD4nfV4Wxb+G+1QExHr
+M+kowOOL3XbcsdbPLUt8vxDJbBlQRch4zyai7CWjQR3JFXpR8sevUFJxSQIVAIdE
+oncp2DEY2U/ZZnIyGCwApCzfAoGARW+eewZTv1Eosxv3ANKx372pf5+fQKwnWizI
+j5z/GY3w3xobRCP9FiL4K3Nip2FvHLTGpRrlfm19RWYAg77VsNgztC4V9C8QrKWc
+WJdkUkoQpZ3VoO25rO13hmIelkal3omKCF4ZE/edeF3d2B8DlzYs0aBcjTCMDrub
+/CJILcYCgYEAgJt9jefGQi4Sl5F8h3jYo52LygE8sNYyurElMKVmyhFSKJ1Ifi9j
+4hNp2jZzu7jpZWhYndUoPaG6gbRB7fL3p5knlRo3P2Dznd6u6NAdhrADWW+JX9n1
+/EMKUv0h8rRFI/3b9RY1HVVzBQH7V3sNJ6iekH8JqOy1liCMaMylw4gCFBl7Lc6V
+hmTiTuhLXjoRdCZS/p/m
+-----END DSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/dsa_n_pw b/regress/unittests/sshkey/testdata/dsa_n_pw
new file mode 100644
index 000000000..42f70dd23
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_n_pw
@@ -0,0 +1,22 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABD5nB+Nkw
+LNoPtAG7C3IdXmAAAAEAAAAAEAAAGyAAAAB3NzaC1kc3MAAACBALEE3AfxOYteqJlrRv2n
+ELpb7NLhWiqnxL5DB5xik09OaGNpRggT9olYDMVW11vKwszz26S/D/PyoGRsxJ593KkqaN
+S2C/nVkPid9XhbFv4b7VATEesz6SjA44vddtyx1s8tS3y/EMlsGVBFyHjPJqLsJaNBHckV
+elHyx69QUnFJAAAAFQCHRKJ3KdgxGNlP2WZyMhgsAKQs3wAAAIBFb557BlO/USizG/cA0r
+Hfval/n59ArCdaLMiPnP8ZjfDfGhtEI/0WIvgrc2KnYW8ctMalGuV+bX1FZgCDvtWw2DO0
+LhX0LxCspZxYl2RSShClndWg7bms7XeGYh6WRqXeiYoIXhkT9514Xd3YHwOXNizRoFyNMI
+wOu5v8IkgtxgAAAIEAgJt9jefGQi4Sl5F8h3jYo52LygE8sNYyurElMKVmyhFSKJ1Ifi9j
+4hNp2jZzu7jpZWhYndUoPaG6gbRB7fL3p5knlRo3P2Dznd6u6NAdhrADWW+JX9n1/EMKUv
+0h8rRFI/3b9RY1HVVzBQH7V3sNJ6iekH8JqOy1liCMaMylw4gAAAHw8P1DtkBulOGv85qf
+P+md2+LL+NKufVzHl9k2UKQFjeqY6uqs4HSDqvhXe7oiXd5mz6I7orxjtKU9hGjNF4ABUD
+OawVGe/GCRUQ4WgpAgDnqQLeFcdIwtMSIrRZU6xjs314EI7TM7IIiG26JEuXDfZI1e7C3y
+Cc38ZsP3zmg/UjgcCQar5c4n++vhOmeO36+fcUyZ1QlR05SaEtFYJA+otP3RmKTiDwob8Q
+zRMr8Y57i2NTTtFjkmnnnQCibP62yz7N22Dve7RTOH8jiaW7p02Vn/6WmCarevN1rxtLLR
+lkuWtPoKY8z/Ktcev8YE9f2+9H2TfXDRKYqIEfxgZLCJ4yP2gxDe6zurabS0hAO1CP+ej5
+htdJM3/rTqHAIevXX5uhIDmMvRHnLGldaIX1xux8TIJvSfMkYNIwscIP4kx7BGMk04vXtW
+5DLm6IZhzw9T3hjr8R0kBugmT6/h9vD5iN1D+wiHIhHYzQKMU9nOeFNsMBFWgJjU0l8VlF
+gEjEMgAEfwynnmIoKB1iA/0em1tdU3naS59DBK+buE0trxUpTAAB5z8yPhAm6DdqrPE8cA
+N3HlMoWrbCuak2A0uyOlEJjPg4UJUnv12ve2c9pAMsAu/4CAszCEM0prR+qd/RA4nn4M5u
+Xrny2wNtt/DybCkA==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1 b/regress/unittests/sshkey/testdata/ecdsa_1
new file mode 100644
index 000000000..aec73dd61
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIFghsFR1K95tz8qOl3+tX6fv8a/O6AfNbxOSFZX3ihxooAoGCCqGSM49
+AwEHoUQDQgAEalpgP0BOePHtTw0Pus4tdhTb8P9yWUZluvLf1D8vrHImT+G4vr/W
+xo5iXGKQVEifuUVyLkAW2kDrq8J/szeRiQ==
+-----END EC PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1-cert.fp b/regress/unittests/sshkey/testdata/ecdsa_1-cert.fp
new file mode 100644
index 000000000..a56dbc8d0
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1-cert.fp
@@ -0,0 +1 @@
+f7:be:4c:02:65:ed:4c:11:af:ab:a8:dd:0a:92:e7:44
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1-cert.pub b/regress/unittests/sshkey/testdata/ecdsa_1-cert.pub
new file mode 100644
index 000000000..29b06a4dd
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1-cert.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgjpoHehzmM54xz776HOiTOLPhkOwSWyXOMYeqDhDEcLgAAAAIbmlzdHAyNTYAAABBBGpaYD9ATnjx7U8ND7rOLXYU2/D/cllGZbry39Q/L6xyJk/huL6/1saOYlxikFRIn7lFci5AFtpA66vCf7M3kYkAAAAAAAAABwAAAAIAAAAGanVsaXVzAAAAEgAAAAVob3N0MQAAAAVob3N0MgAAAAA2i4NgAAAAAE0d4eAAAAAAAAAAAAAAAAAAAABoAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGpaYD9ATnjx7U8ND7rOLXYU2/D/cllGZbry39Q/L6xyJk/huL6/1saOYlxikFRIn7lFci5AFtpA66vCf7M3kYkAAABjAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAABIAAAAIFZM1PXlXf0a3VuGs7MVdWSealDXprT1nN5hQTg+m+EYAAAAIGN1yNXWEY5V315NhOD3mBuh/xCpfDn5rZjF4YntA7du ecdsa_1.pub
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.fp b/regress/unittests/sshkey/testdata/ecdsa_1.fp
new file mode 100644
index 000000000..a56dbc8d0
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1.fp
@@ -0,0 +1 @@
+f7:be:4c:02:65:ed:4c:11:af:ab:a8:dd:0a:92:e7:44
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.fp.bb b/regress/unittests/sshkey/testdata/ecdsa_1.fp.bb
new file mode 100644
index 000000000..f01a5dd44
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1.fp.bb
@@ -0,0 +1 @@
+xotah-hecal-zibyb-nadug-romuc-hator-venum-hobip-ruluh-ripus-naxix
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.param.curve b/regress/unittests/sshkey/testdata/ecdsa_1.param.curve
new file mode 100644
index 000000000..fa0400467
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1.param.curve
@@ -0,0 +1 @@
+prime256v1
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.param.priv b/regress/unittests/sshkey/testdata/ecdsa_1.param.priv
new file mode 100644
index 000000000..3475f1fe9
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1.param.priv
@@ -0,0 +1 @@
+5821b054752bde6dcfca8e977fad5fa7eff1afcee807cd6f13921595f78a1c68
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.param.pub b/regress/unittests/sshkey/testdata/ecdsa_1.param.pub
new file mode 100644
index 000000000..11847a394
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1.param.pub
@@ -0,0 +1 @@
+046a5a603f404e78f1ed4f0d0fbace2d7614dbf0ff72594665baf2dfd43f2fac72264fe1b8bebfd6c68e625c629054489fb945722e4016da40ebabc27fb3379189
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.pub b/regress/unittests/sshkey/testdata/ecdsa_1.pub
new file mode 100644
index 000000000..eca1620bc
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGpaYD9ATnjx7U8ND7rOLXYU2/D/cllGZbry39Q/L6xyJk/huL6/1saOYlxikFRIn7lFci5AFtpA66vCf7M3kYk= ECDSA test key #1
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1_pw b/regress/unittests/sshkey/testdata/ecdsa_1_pw
new file mode 100644
index 000000000..071154ab2
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1_pw
@@ -0,0 +1,8 @@
+-----BEGIN EC PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,74C8AEA5BFAFCC2B1C8B13DE671F5610
+
+vUsgOvCqezxPmcZcFqrSy9Y1MMlVguY0h9cfSPFC7gUrRr+45uCOYX5bOwEXecKn
+/9uCXZtlBwwqDS9iK5IPoUrjEHvzI5rVbHWUxDrEOVbsfiDuCxrQM19It6QIqC1v
+OSQEdXuBWR5WmhKNc3dqLbWsU8u2s60YwKQmZrj9nM4=
+-----END EC PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2 b/regress/unittests/sshkey/testdata/ecdsa_2
new file mode 100644
index 000000000..76ae07ad4
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2
@@ -0,0 +1,7 @@
+-----BEGIN EC PRIVATE KEY-----
+MIHcAgEBBEIBg4kVxUfoo/RE/78/QBRqG6PZuHZ82eLnhmZVzBa7XREUiYI/Jw7r
+Qwp4FTBVfXL76Pt5AyBMf+52aVeOUlLRERSgBwYFK4EEACOhgYkDgYYABACNTJ5O
+uNo5dNgIQRLHzKU91m7immKFiutJ6BlDbkRkKr+Envj13J6HOgYvOTm0n7SPlKHS
+STZ4/T36d/rzQOAbIwEnbbwD9HMj6IzE4WH9lJzH7Zy7Tcyu6dOM8L7nOxCp3DUk
+F3aAnPSFJhD7NN0jBWOFsD6uy1OmaTklPfRAnCt1MQ==
+-----END EC PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.fp b/regress/unittests/sshkey/testdata/ecdsa_2.fp
new file mode 100644
index 000000000..eb4bbdf03
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2.fp
@@ -0,0 +1 @@
+51:bd:ff:2b:6d:26:9b:90:f9:e1:4a:ca:a0:29:8e:70
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.fp.bb b/regress/unittests/sshkey/testdata/ecdsa_2.fp.bb
new file mode 100644
index 000000000..267bc63fd
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2.fp.bb
@@ -0,0 +1 @@
+xuzaz-zuzuk-virop-vypah-zumel-gylak-selih-fevad-varag-zynif-haxox
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.param.curve b/regress/unittests/sshkey/testdata/ecdsa_2.param.curve
new file mode 100644
index 000000000..617ea2fb8
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2.param.curve
@@ -0,0 +1 @@
+secp521r1
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.param.priv b/regress/unittests/sshkey/testdata/ecdsa_2.param.priv
new file mode 100644
index 000000000..537cdaac3
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2.param.priv
@@ -0,0 +1 @@
+01838915c547e8a3f444ffbf3f40146a1ba3d9b8767cd9e2e7866655cc16bb5d111489823f270eeb430a781530557d72fbe8fb7903204c7fee7669578e5252d11114
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.param.pub b/regress/unittests/sshkey/testdata/ecdsa_2.param.pub
new file mode 100644
index 000000000..3352ac769
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2.param.pub
@@ -0,0 +1 @@
+04008d4c9e4eb8da3974d8084112c7cca53dd66ee29a62858aeb49e819436e44642abf849ef8f5dc9e873a062f3939b49fb48f94a1d2493678fd3dfa77faf340e01b2301276dbc03f47323e88cc4e161fd949cc7ed9cbb4dccaee9d38cf0bee73b10a9dc35241776809cf4852610fb34dd23056385b03eaecb53a66939253df4409c2b7531
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.pub b/regress/unittests/sshkey/testdata/ecdsa_2.pub
new file mode 100644
index 000000000..34e1881dd
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBACNTJ5OuNo5dNgIQRLHzKU91m7immKFiutJ6BlDbkRkKr+Envj13J6HOgYvOTm0n7SPlKHSSTZ4/T36d/rzQOAbIwEnbbwD9HMj6IzE4WH9lJzH7Zy7Tcyu6dOM8L7nOxCp3DUkF3aAnPSFJhD7NN0jBWOFsD6uy1OmaTklPfRAnCt1MQ== ECDSA test key #2
diff --git a/regress/unittests/sshkey/testdata/ecdsa_n b/regress/unittests/sshkey/testdata/ecdsa_n
new file mode 100644
index 000000000..aec73dd61
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_n
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIFghsFR1K95tz8qOl3+tX6fv8a/O6AfNbxOSFZX3ihxooAoGCCqGSM49
+AwEHoUQDQgAEalpgP0BOePHtTw0Pus4tdhTb8P9yWUZluvLf1D8vrHImT+G4vr/W
+xo5iXGKQVEifuUVyLkAW2kDrq8J/szeRiQ==
+-----END EC PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ecdsa_n_pw b/regress/unittests/sshkey/testdata/ecdsa_n_pw
new file mode 100644
index 000000000..75d585908
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_n_pw
@@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABBXqI6Z6o
+uRM+jAwdhnDoIMAAAAEAAAAAEAAABoAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlz
+dHAyNTYAAABBBGpaYD9ATnjx7U8ND7rOLXYU2/D/cllGZbry39Q/L6xyJk/huL6/1saOYl
+xikFRIn7lFci5AFtpA66vCf7M3kYkAAACwYMnoCTqvUTG0ktSSMNsOZLCdal5J4avEpM1L
+sV9SL/RVcwo3ChprhwsnQsaAtMiJCRcHerKgD9qy1MNNaE5VNfVJ0Ih/7ut04cbFKed8p6
+0V+w8WP7WvFffBPoHn+GGbQd1FDGzHhXUB61pH8Qzd1bI/sld/XEtMk7iYjNGQe9Rt0RaK
+Wi8trwaA0Fb2w/EFnrdsFFxrIhQEqYBdEQJo782IqAsMG9OwUaM0vy+8bcI=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ed25519_1 b/regress/unittests/sshkey/testdata/ed25519_1
new file mode 100644
index 000000000..a537ae13d
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACC5PeVeSdyylcfG3C0geNO90e3dGgL0fICaz751dA9zEAAAAJglsAcYJbAH
+GAAAAAtzc2gtZWQyNTUxOQAAACC5PeVeSdyylcfG3C0geNO90e3dGgL0fICaz751dA9zEA
+AAAED6HJ8Bh8tdQvhMd5o8IxtIwBv8/FV48FpBFWAbYdsIsLk95V5J3LKVx8bcLSB4073R
+7d0aAvR8gJrPvnV0D3MQAAAAE0VEMjU1MTkgdGVzdCBrZXkgIzEBAg==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ed25519_1-cert.fp b/regress/unittests/sshkey/testdata/ed25519_1-cert.fp
new file mode 100644
index 000000000..e6d23d0b8
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1-cert.fp
@@ -0,0 +1 @@
+19:08:8e:7e:4d:e5:de:86:2a:09:47:65:eb:0a:51:2f
diff --git a/regress/unittests/sshkey/testdata/ed25519_1-cert.pub b/regress/unittests/sshkey/testdata/ed25519_1-cert.pub
new file mode 100644
index 000000000..ad0b9a888
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1-cert.pub
@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIHmdL66MkkOvncpc0W4MdvlJZMfQthHiOUv+XKm7gvzOAAAAILk95V5J3LKVx8bcLSB4073R7d0aAvR8gJrPvnV0D3MQAAAAAAAAAAgAAAACAAAABmp1bGl1cwAAABIAAAAFaG9zdDEAAAAFaG9zdDIAAAAANouDYAAAAABNHeHgAAAAAAAAAAAAAAAAAAAAMwAAAAtzc2gtZWQyNTUxOQAAACC5PeVeSdyylcfG3C0geNO90e3dGgL0fICaz751dA9zEAAAAFMAAAALc3NoLWVkMjU1MTkAAABAsUStKm1z3Rtvwy3eXE1DrgVp6kix2iEQXfB66IHX2UpAj5yl0eQGXWTSEDIxHDIb0SJvUH43OWX0PrEeAs0mAA== ed25519_1.pub
diff --git a/regress/unittests/sshkey/testdata/ed25519_1.fp b/regress/unittests/sshkey/testdata/ed25519_1.fp
new file mode 100644
index 000000000..e6d23d0b8
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1.fp
@@ -0,0 +1 @@
+19:08:8e:7e:4d:e5:de:86:2a:09:47:65:eb:0a:51:2f
diff --git a/regress/unittests/sshkey/testdata/ed25519_1.fp.bb b/regress/unittests/sshkey/testdata/ed25519_1.fp.bb
new file mode 100644
index 000000000..591a711b4
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1.fp.bb
@@ -0,0 +1 @@
+xofip-nuhoh-botam-cypeg-panig-tunef-bimav-numeb-nikic-gocyf-paxax
diff --git a/regress/unittests/sshkey/testdata/ed25519_1.pub b/regress/unittests/sshkey/testdata/ed25519_1.pub
new file mode 100644
index 000000000..633e05077
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILk95V5J3LKVx8bcLSB4073R7d0aAvR8gJrPvnV0D3MQ ED25519 test key #1
diff --git a/regress/unittests/sshkey/testdata/ed25519_1_pw b/regress/unittests/sshkey/testdata/ed25519_1_pw
new file mode 100644
index 000000000..9fc635208
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1_pw
@@ -0,0 +1,8 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABAlT1eewp
+9gl0gue+sSrBWKAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAILk95V5J3LKVx8bc
+LSB4073R7d0aAvR8gJrPvnV0D3MQAAAAoMrL9ixIQHoJ86DcKMGt26+bCeaoyGjW5hha2Y
+IxAZ+rRvNjUuv3MGvbUxtUpPZkTP/vk2fVSCuCD9St5Lbt/LKdIk2MfWIFbjZ6iEfdzxz0
+DHmsSDMps8dbePqqIPULR8av447jEzQEkUc8GSR6WqFSJOjJ8OvrJat1KcEK7V2tjZnLS1
+GoLMqVAtCVhuXwUkeJiRQE/JRl172hxB+LAVw=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ed25519_2 b/regress/unittests/sshkey/testdata/ed25519_2
new file mode 100644
index 000000000..a6e5f0040
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_2
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBXUfO5Kid+jhRnyVt+1r9wj2FN/mZ6RfgGdySeYoq4WAAAAJjGeKsZxnir
+GQAAAAtzc2gtZWQyNTUxOQAAACBXUfO5Kid+jhRnyVt+1r9wj2FN/mZ6RfgGdySeYoq4WA
+AAAEB+gn4gGClQl2WMeOkikY+w0A0kSw1KH4Oyami7hlypsFdR87kqJ36OFGfJW37Wv3CP
+YU3+ZnpF+AZ3JJ5iirhYAAAAE0VEMjU1MTkgdGVzdCBrZXkgIzEBAg==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ed25519_2.fp b/regress/unittests/sshkey/testdata/ed25519_2.fp
new file mode 100644
index 000000000..02c684f36
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_2.fp
@@ -0,0 +1 @@
+5c:c9:ae:a3:0c:aa:28:29:b8:fc:7c:64:ba:6e:e9:c9
diff --git a/regress/unittests/sshkey/testdata/ed25519_2.fp.bb b/regress/unittests/sshkey/testdata/ed25519_2.fp.bb
new file mode 100644
index 000000000..ebe782e2c
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_2.fp.bb
@@ -0,0 +1 @@
+xenoz-tovup-zecyt-hohar-motam-sugid-fecyz-tutyk-gosom-ginar-kixux
diff --git a/regress/unittests/sshkey/testdata/ed25519_2.pub b/regress/unittests/sshkey/testdata/ed25519_2.pub
new file mode 100644
index 000000000..37b93352a
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_2.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdR87kqJ36OFGfJW37Wv3CPYU3+ZnpF+AZ3JJ5iirhY ED25519 test key #1
diff --git a/regress/unittests/sshkey/testdata/pw b/regress/unittests/sshkey/testdata/pw
new file mode 100644
index 000000000..8a1dff98a
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/pw
@@ -0,0 +1 @@
+mekmitasdigoat
diff --git a/regress/unittests/sshkey/testdata/rsa1_1 b/regress/unittests/sshkey/testdata/rsa1_1
new file mode 100644
index 000000000..d22014e88
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_1
diff --git a/regress/unittests/sshkey/testdata/rsa1_1.fp b/regress/unittests/sshkey/testdata/rsa1_1.fp
new file mode 100644
index 000000000..782ece0db
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_1.fp
@@ -0,0 +1 @@
+a8:82:9b:98:c5:e6:19:d6:83:39:9f:4d:3a:8f:7c:80
diff --git a/regress/unittests/sshkey/testdata/rsa1_1.fp.bb b/regress/unittests/sshkey/testdata/rsa1_1.fp.bb
new file mode 100644
index 000000000..caaf9511a
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_1.fp.bb
@@ -0,0 +1 @@
+xukib-cymuf-mylib-kecih-rogyb-sorid-belys-kytem-dinin-cicil-kyxex
diff --git a/regress/unittests/sshkey/testdata/rsa1_1.param.n b/regress/unittests/sshkey/testdata/rsa1_1.param.n
new file mode 100644
index 000000000..4ceb37362
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_1.param.n
@@ -0,0 +1 @@
+00cf68059e5c7743318d740d3ebb55eb577891c9c3098817703f4c3157285055c2daa50102509ebdcade324e541c965e2931fd3459052fe65d013722da805d7ec8ef5b97cc006789d0566c5578b23e7aaa5be2b055d85798030cdead2eb2cc4eb3
diff --git a/regress/unittests/sshkey/testdata/rsa1_1.pub b/regress/unittests/sshkey/testdata/rsa1_1.pub
new file mode 100644
index 000000000..56cf30d30
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_1.pub
@@ -0,0 +1 @@
+768 65537 1257820658919101781627826212425999371251377782154008557690434337796299274692579921603319269571889066123773172648045269780061837011867522525764583065919572648969392756890567918758763032103894830246827894023662422727333291801518558899 RSA1 test key #1
diff --git a/regress/unittests/sshkey/testdata/rsa1_1_pw b/regress/unittests/sshkey/testdata/rsa1_1_pw
new file mode 100644
index 000000000..3113dbc0f
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_1_pw
diff --git a/regress/unittests/sshkey/testdata/rsa1_2 b/regress/unittests/sshkey/testdata/rsa1_2
new file mode 100644
index 000000000..e75e665ff
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_2
diff --git a/regress/unittests/sshkey/testdata/rsa1_2.fp b/regress/unittests/sshkey/testdata/rsa1_2.fp
new file mode 100644
index 000000000..c3325371d
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_2.fp
@@ -0,0 +1 @@
+c0:83:1c:97:5f:32:77:7e:e4:e3:e9:29:b9:eb:76:9c
diff --git a/regress/unittests/sshkey/testdata/rsa1_2.fp.bb b/regress/unittests/sshkey/testdata/rsa1_2.fp.bb
new file mode 100644
index 000000000..cd8037140
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_2.fp.bb
@@ -0,0 +1 @@
+xifad-vevot-sozyl-fapeb-meryf-kylut-cydiv-firik-gavyb-lanad-kaxox
diff --git a/regress/unittests/sshkey/testdata/rsa1_2.param.n b/regress/unittests/sshkey/testdata/rsa1_2.param.n
new file mode 100644
index 000000000..f8143a4b9
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_2.param.n
@@ -0,0 +1 @@
+00b08a9fa386aceaab2ec3e9cdc7e6cb4eac9e98620279eed6762e1f513739a417ac8a86231fad3b8727a9de994973a7aae674a132547341984ade91aa1c22f01d2f0204ea7fa121969c367a5d04bda384066cf94e0b56d1efc47f50ca28e90603547df41c0676550d82d369f699b457d4f0f077999d9e76ab679fbf4206d418dbabed1823f14e4ddf3aac987686e6b006f8a23ea6af13b4c0e5b1fb5b1eb4db2f47b229422c450574cae9c64db5dcfce050836b6bdfa8fb541b4d426444a5ea20ad51a25d3048414ced2e199da2997968273e8beb10f3a351e98a57b00dadfa8f00a39bb55be94dae898fda6021d728f32b2ec93edd16e51073be3ac7511e5085
diff --git a/regress/unittests/sshkey/testdata/rsa1_2.pub b/regress/unittests/sshkey/testdata/rsa1_2.pub
new file mode 100644
index 000000000..de1afbb8b
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_2.pub
@@ -0,0 +1 @@
+2048 65537 22286299513474010485021611215236051675183880694440075228245854420062562171290421803318459093678819161498086077099067169041536315773126601869537036602014639497662916952995546870691495931205282427606841521014293638607226118353743812583642616889028731910222603216563207637006843580936568089467160095319593442255227365472917576488012409542775346105980501967996562422764758836868135158147777193940857952623773420292946843206784104932927528915610322518810753953608862466374219925252817405397507396462117715293725218947744085154122395590957537510003558169729949140038634486299736757269280065662263306737701939154762092925061 RSA1 test key #2
diff --git a/regress/unittests/sshkey/testdata/rsa_1 b/regress/unittests/sshkey/testdata/rsa_1
new file mode 100644
index 000000000..09e79a72e
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1
@@ -0,0 +1,12 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIBywIBAAJhAM/6MDmVVm/uNQmZpOcthoAAgMDUg7G4H6ZLLyPEhboKaBBHvIdw
+ZdDmB+0LDf3D1aWXyUd2/pCkCysiBzqd/523zAzjY7HayqL6A940AxKBBbWLn+X6
+i2yJR7dTOYkk6QIDAQABAmAgKanBjfWzE5yCIo+c7K5rJyjCKVtAZaAHYIMmveKM
+VcWoFt/x9hDY0GoTX21HfDxLX8oDxnsmhsOrnvSmgUChFwkm45eSETqeVDWwIVFA
+FGL1s38xQsciWZWBFNppAIECMQD7nslReAxwz/Ad++ACXswfJg1l2wUQ1gJA3zh3
+jln6a4s3aV1zxbKlIn8iqBv0BZkCMQDTmO4WqyNnin73XCZs0DWu7GsfcuaH8QnD
+wqPjJgrclTZXedxHkeqO2oyZW4mLC9ECMBb/blsZ49kzyDiVWuYcj/+Q1MyodhAR
+32bagCi9RBAVYEYSRU5dlXRucLxULSnikQIxAJ5teY5Vcru6kZfJUifUuO0QrKAu
+WnbcPVBqMmUHfchsm/RhFFIt6W4uKmlEhTYrkQIxAMAStb7QCU3yU6ZkN7uL22Zs
+498i4jY6y+VEXv+L9O09VdlEnXhbUisOhy1bhyS3yg==
+-----END RSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/rsa_1-cert.fp b/regress/unittests/sshkey/testdata/rsa_1-cert.fp
new file mode 100644
index 000000000..bf9c2e362
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1-cert.fp
@@ -0,0 +1 @@
+be:27:4c:16:27:f5:04:03:62:a8:b7:91:df:a5:b1:3b
diff --git a/regress/unittests/sshkey/testdata/rsa_1-cert.pub b/regress/unittests/sshkey/testdata/rsa_1-cert.pub
new file mode 100644
index 000000000..51b1ce0dd
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1-cert.pub
@@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg1i9Ueveqg9sFSGsEYmsQqlI+dpC3nqhucPfwBVo3DtcAAAADAQABAAAAYQDP+jA5lVZv7jUJmaTnLYaAAIDA1IOxuB+mSy8jxIW6CmgQR7yHcGXQ5gftCw39w9Wll8lHdv6QpAsrIgc6nf+dt8wM42Ox2sqi+gPeNAMSgQW1i5/l+otsiUe3UzmJJOkAAAAAAAAABQAAAAIAAAAGanVsaXVzAAAAEgAAAAVob3N0MQAAAAVob3N0MgAAAAA2i4NgAAAAAE0d4eAAAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAILk95V5J3LKVx8bcLSB4073R7d0aAvR8gJrPvnV0D3MQAAAAUwAAAAtzc2gtZWQyNTUxOQAAAED0TLf2Mv2F9TBt1Skf/1vviUgt7bt9xvL5HqugnVDfKaEg+RNKgfa5Rtpteb39EODkH8v4FJPWlmNG0F9w0cYF rsa_1.pub
diff --git a/regress/unittests/sshkey/testdata/rsa_1.fp b/regress/unittests/sshkey/testdata/rsa_1.fp
new file mode 100644
index 000000000..bf9c2e362
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1.fp
@@ -0,0 +1 @@
+be:27:4c:16:27:f5:04:03:62:a8:b7:91:df:a5:b1:3b
diff --git a/regress/unittests/sshkey/testdata/rsa_1.fp.bb b/regress/unittests/sshkey/testdata/rsa_1.fp.bb
new file mode 100644
index 000000000..448133bad
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1.fp.bb
@@ -0,0 +1 @@
+xetif-zuvul-nylyc-vykor-lumac-gyhyv-bacih-cimyk-sycen-gikym-pixax
diff --git a/regress/unittests/sshkey/testdata/rsa_1.param.n b/regress/unittests/sshkey/testdata/rsa_1.param.n
new file mode 100644
index 000000000..2ffc2ba7e
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1.param.n
@@ -0,0 +1 @@
+00cffa303995566fee350999a4e72d86800080c0d483b1b81fa64b2f23c485ba0a681047bc877065d0e607ed0b0dfdc3d5a597c94776fe90a40b2b22073a9dff9db7cc0ce363b1dacaa2fa03de3403128105b58b9fe5fa8b6c8947b753398924e9
diff --git a/regress/unittests/sshkey/testdata/rsa_1.param.p b/regress/unittests/sshkey/testdata/rsa_1.param.p
new file mode 100644
index 000000000..4fcf148c3
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1.param.p
@@ -0,0 +1 @@
+00fb9ec951780c70cff01dfbe0025ecc1f260d65db0510d60240df38778e59fa6b8b37695d73c5b2a5227f22a81bf40599
diff --git a/regress/unittests/sshkey/testdata/rsa_1.param.q b/regress/unittests/sshkey/testdata/rsa_1.param.q
new file mode 100644
index 000000000..3473f5144
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1.param.q
@@ -0,0 +1 @@
+00d398ee16ab23678a7ef75c266cd035aeec6b1f72e687f109c3c2a3e3260adc95365779dc4791ea8eda8c995b898b0bd1
diff --git a/regress/unittests/sshkey/testdata/rsa_1.pub b/regress/unittests/sshkey/testdata/rsa_1.pub
new file mode 100644
index 000000000..889fdae86
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAYQDP+jA5lVZv7jUJmaTnLYaAAIDA1IOxuB+mSy8jxIW6CmgQR7yHcGXQ5gftCw39w9Wll8lHdv6QpAsrIgc6nf+dt8wM42Ox2sqi+gPeNAMSgQW1i5/l+otsiUe3UzmJJOk= RSA test key #1
diff --git a/regress/unittests/sshkey/testdata/rsa_1_pw b/regress/unittests/sshkey/testdata/rsa_1_pw
new file mode 100644
index 000000000..71637a59b
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1_pw
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,1E851A01F12A49FDC256E7A665C61D4B
+
++sfWU7kg3idmHL6vShby5LXnfF4bZDPhJjv89uldae7qPEgEW8qS8o0Ssokxf7Au
+/vTQnbSB+gy/qZaUOykOzqiV1YL7UfkbOkM2QYnzzrVeGzI5RZ0G9iH8HBn2owQ+
+Ejf1UKDUVZEea5X0IwQRfE0zaZqFS4tyEex0iKz8dI4FvyabKLZsCs1DBGO7A3ml
+LgP947mh10yKWTP2fbq8LOhDUEWCXrh2NzuH6Rl5nNyC4MNQEkLzK1wL7J/WCNaL
+sciYmuqEQRDikDDQQFZw2wjBD638fhK+IhuN3VGegiXFnu5C+p9kzUvqVk4X9g2r
+BMmlP0pceFv/fEwtNNaeI2Tt7mIsWsZTmCqdzOUAYqGIiNjzykWw64nMO3TpVpbA
+i4854RhblbeiyjENbMVPU6BAk4fx7OJvDElLxwN43CS3U0MldbI7A4uG3B3RTSCj
+1rGxRNAHWC3q3zzrn6gLwrUVje4iTedaKItLIHQeo1A091Tr8AqQdZi/Ck2Ju0Hl
+4Qdwzjw1Y5n1Akm+EWh31ydxtUQ0YBOz/W6DKwTNA1D8oH9bZBG4f0pnvVhtttAO
+WKj+DUqMa+f3OOmQ9UXlitk2pEgjeMngTgfQnhZiCts=
+-----END RSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/rsa_2 b/regress/unittests/sshkey/testdata/rsa_2
new file mode 100644
index 000000000..058cf777a
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAlDS/ygeFfsR/mhZK/XMHU/gzRogPuMQIYUd17WDjMprA6dQb
+ckTDrNm/mrf09I6YAhjgooEL16oWM1z6cesDE0KwaJsy6uTmXFMLO+Ha4mtFHhmu
+tiyJcQ9MKKr0vC64384WQZygZk0OlVz7x9WSPiGXzal5MzsX4TYq5B05o2Cb+epA
+FxK0c8cdYZD0Sy57gWRpRA3yJq4zh/hks98jzn0XA3HAJA39MKhUG5tf5e6z5BeP
+Yi5FvdnDQ9WcasRiEvkmHbg59pbgg/Lbsl6OgZQruS8hKiJ3YBARt2euCCeg7qAF
+KbXRR9TMwfphH3Ai4Oi/w6HPRAhdrwooA/gKkQIDAQABAoIBAH22OLB/rMaYmrvz
+COzvM1oQgD3lj6Bj98+8M9WEh3MXPWeaGSXWGjx1/0aXn1oJ0fqFa5Wr7IWkqmwr
+A+y5McSWntg8PPZt7tCFSFQlAetonhooIsA4CuUx2qHsUOeGoh6EyvAgkRX1atdb
+Jd6d1AyLph43EK1aBKltrvgLqiZfs7mcuwyvKtN9ktdKY2FDhn6DHpm9pE9MEHJV
+Xv1isNc6a0qNoRlKqxrSZHNEN4fbjLw31wBySzmmnIog5wVEwaHeASwLJT6TmuIZ
+eZxnd7/jMwRZWH8ZIGKvkTMp4fYzK9QkehO7A2HFD3FPDBVrkSJjqRdkujF8vu1C
+0RwrD1kCgYEAxFXUoE1ero6vp9akvR/mw94kYjXE/YOz1yi0KTkZUs6gURc8Kzsm
+MzlEZ31rnngE4jQHYAvuPEfiqcnUgylW3QuevMgo2hCLYO7aG5C0fk8TeOiuvnrF
+YPO8rSJWk/BgdrPtzu45P7jmWsjkHn+y+t8cKvq1sZY40sn2YgIhYK8CgYEAwT6j
+5tReI6sxpHltPUbvOdpD04eL6ggBAKwzb5aBoa/Dj+sU1zg5uyY8diggQEEznlBW
+iWTQmmmfy1ef9i6YAwNuZveKOrVwNMcdubQJ2X26XoFrmA59PjsbLtr1bdUb02gz
+6P5x6pcw5qzEq0mddgvHiU3RhL24xdc1LW8nmL8CgYEAmgaT1macPuklmNBlURGz
+4jll5b41GoW2EreWDzkCStpbHwLRa0DuCQWGSoI0aY/SlPsoRgtWDOiAQ59ZHsTR
+pnw1PfjxQ5HzJkp7xWBSmTzEE/jHDhwWuKa+gD0OGuVbaARkLhDpzLnrzZEIlXyt
+Fu7tlDI3VGh7j7Jtnhn5wXUCgYBKmPbGfcaVeFmih2lfFUn2CEbUmmetgUd5zf/R
+HMWP9/zDStlxt3e5winm5tiEVWcqvxKY2T0Zzppr8biDXTs7NpDg2MAYp7/X7+GO
+tWxz8/AE2WsCeN1qL4Dv1oCV1IV4V6pqUAcDqzeqZJlLEhDh5+wwGcU+u8pfPRN/
+JYCgmwKBgDa+kXPqzcc6vzD9cwEEk4ftn9/Vk2yBx0XOu8RdEkRhXj1QXGJckCqh
+FkXzVbuurFhsBt+H0B4arw+51T9fVCZqfcaU34u+Qa/FQvTod4OJUSRxYUaDqygs
+VTyuP+zGZlIw7JWktxjVazENsM/ef5wBH0Nf839OZbPVDLfn7K0j
+-----END RSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/rsa_2.fp b/regress/unittests/sshkey/testdata/rsa_2.fp
new file mode 100644
index 000000000..53939f413
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2.fp
@@ -0,0 +1 @@
+fb:8f:7b:26:3d:42:40:ef:ed:f1:ed:ee:66:9e:ba:b0
diff --git a/regress/unittests/sshkey/testdata/rsa_2.fp.bb b/regress/unittests/sshkey/testdata/rsa_2.fp.bb
new file mode 100644
index 000000000..e90a3571a
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2.fp.bb
@@ -0,0 +1 @@
+xepev-gupub-vuvyg-femiv-gonat-defiv-hirak-betub-pahut-veryd-hexix
diff --git a/regress/unittests/sshkey/testdata/rsa_2.param.n b/regress/unittests/sshkey/testdata/rsa_2.param.n
new file mode 100644
index 000000000..389de4226
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2.param.n
@@ -0,0 +1 @@
+009434bfca07857ec47f9a164afd730753f83346880fb8c408614775ed60e3329ac0e9d41b7244c3acd9bf9ab7f4f48e980218e0a2810bd7aa16335cfa71eb031342b0689b32eae4e65c530b3be1dae26b451e19aeb62c89710f4c28aaf4bc2eb8dfce16419ca0664d0e955cfbc7d5923e2197cda979333b17e1362ae41d39a3609bf9ea401712b473c71d6190f44b2e7b816469440df226ae3387f864b3df23ce7d170371c0240dfd30a8541b9b5fe5eeb3e4178f622e45bdd9c343d59c6ac46212f9261db839f696e083f2dbb25e8e81942bb92f212a2277601011b767ae0827a0eea00529b5d147d4ccc1fa611f7022e0e8bfc3a1cf44085daf0a2803f80a91
diff --git a/regress/unittests/sshkey/testdata/rsa_2.param.p b/regress/unittests/sshkey/testdata/rsa_2.param.p
new file mode 100644
index 000000000..c3c9a130a
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2.param.p
@@ -0,0 +1 @@
+00c455d4a04d5eae8eafa7d6a4bd1fe6c3de246235c4fd83b3d728b429391952cea051173c2b3b26333944677d6b9e7804e23407600bee3c47e2a9c9d4832956dd0b9ebcc828da108b60eeda1b90b47e4f1378e8aebe7ac560f3bcad225693f06076b3edceee393fb8e65ac8e41e7fb2fadf1c2afab5b19638d2c9f662022160af
diff --git a/regress/unittests/sshkey/testdata/rsa_2.param.q b/regress/unittests/sshkey/testdata/rsa_2.param.q
new file mode 100644
index 000000000..728c474b0
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2.param.q
@@ -0,0 +1 @@
+00c13ea3e6d45e23ab31a4796d3d46ef39da43d3878bea080100ac336f9681a1afc38feb14d73839bb263c7628204041339e50568964d09a699fcb579ff62e9803036e66f78a3ab57034c71db9b409d97dba5e816b980e7d3e3b1b2edaf56dd51bd36833e8fe71ea9730e6acc4ab499d760bc7894dd184bdb8c5d7352d6f2798bf
diff --git a/regress/unittests/sshkey/testdata/rsa_2.pub b/regress/unittests/sshkey/testdata/rsa_2.pub
new file mode 100644
index 000000000..ed9f78cad
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUNL/KB4V+xH+aFkr9cwdT+DNGiA+4xAhhR3XtYOMymsDp1BtyRMOs2b+at/T0jpgCGOCigQvXqhYzXPpx6wMTQrBomzLq5OZcUws74dria0UeGa62LIlxD0woqvS8LrjfzhZBnKBmTQ6VXPvH1ZI+IZfNqXkzOxfhNirkHTmjYJv56kAXErRzxx1hkPRLLnuBZGlEDfImrjOH+GSz3yPOfRcDccAkDf0wqFQbm1/l7rPkF49iLkW92cND1ZxqxGIS+SYduDn2luCD8tuyXo6BlCu5LyEqIndgEBG3Z64IJ6DuoAUptdFH1MzB+mEfcCLg6L/Doc9ECF2vCigD+AqR RSA test key #2
diff --git a/regress/unittests/sshkey/testdata/rsa_n b/regress/unittests/sshkey/testdata/rsa_n
new file mode 100644
index 000000000..09e79a72e
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_n
@@ -0,0 +1,12 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIBywIBAAJhAM/6MDmVVm/uNQmZpOcthoAAgMDUg7G4H6ZLLyPEhboKaBBHvIdw
+ZdDmB+0LDf3D1aWXyUd2/pCkCysiBzqd/523zAzjY7HayqL6A940AxKBBbWLn+X6
+i2yJR7dTOYkk6QIDAQABAmAgKanBjfWzE5yCIo+c7K5rJyjCKVtAZaAHYIMmveKM
+VcWoFt/x9hDY0GoTX21HfDxLX8oDxnsmhsOrnvSmgUChFwkm45eSETqeVDWwIVFA
+FGL1s38xQsciWZWBFNppAIECMQD7nslReAxwz/Ad++ACXswfJg1l2wUQ1gJA3zh3
+jln6a4s3aV1zxbKlIn8iqBv0BZkCMQDTmO4WqyNnin73XCZs0DWu7GsfcuaH8QnD
+wqPjJgrclTZXedxHkeqO2oyZW4mLC9ECMBb/blsZ49kzyDiVWuYcj/+Q1MyodhAR
+32bagCi9RBAVYEYSRU5dlXRucLxULSnikQIxAJ5teY5Vcru6kZfJUifUuO0QrKAu
+WnbcPVBqMmUHfchsm/RhFFIt6W4uKmlEhTYrkQIxAMAStb7QCU3yU6ZkN7uL22Zs
+498i4jY6y+VEXv+L9O09VdlEnXhbUisOhy1bhyS3yg==
+-----END RSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/rsa_n_pw b/regress/unittests/sshkey/testdata/rsa_n_pw
new file mode 100644
index 000000000..0166fd5f1
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_n_pw
@@ -0,0 +1,14 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABClELgtaZ
+qAmMwESpqXDN0uAAAAEAAAAAEAAAB3AAAAB3NzaC1yc2EAAAADAQABAAAAYQDP+jA5lVZv
+7jUJmaTnLYaAAIDA1IOxuB+mSy8jxIW6CmgQR7yHcGXQ5gftCw39w9Wll8lHdv6QpAsrIg
+c6nf+dt8wM42Ox2sqi+gPeNAMSgQW1i5/l+otsiUe3UzmJJOkAAAGgwJpHy/nshQa9+Jbw
+yomvgNMYvuuoD7Ll7iCY/RFFGXivTkki27C9q0qx3afauSLQQWFanGhjeJn7JPy98lMcVl
+qnn5XOE5+xxZqA8ONOBD8eH0KBcTH17DH1A1z94p5zZ1VJKIWsBZ0krxgHIXcdv9ucAckj
+N0vAEBm+0wsfy2TTOtuqXvcj65wFwknpyy/SSvU0QTr99FiYe9PIhIslBHO6wlqxfKj+Tm
+E/nCb75dAVu6gTtS2P0pdOqV/V7VHX5C0z3BROqpKDJJcVeoc7vRkEl+MWfvvQrG66IPEW
+luohFXPDPDrxu1zDduyRsmNwpBHChi2rFhxtsjxNK0svMwESeCCKAWmPxnzLJfvMbTCv00
+SpaCr7WhtzsGt73axqSkeOdynp5NNrN7MEdwruMZFirF4BcI2z2H9ugpS+qbLPuE2H5vln
+h7NSwBUNwmZ+4TC8MXFH9KIpRg8dNhf66OU610LYiN4+ZfOYCmfQfgQuBGhMTYFMY6O4SB
+NCdIavvWY6rDSBq7QC1f4rHpwiXxpkiE43Rd8fM32TaPlBPtA=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/tests.c b/regress/unittests/sshkey/tests.c
new file mode 100644
index 000000000..13f265cdb
--- /dev/null
+++ b/regress/unittests/sshkey/tests.c
@@ -0,0 +1,27 @@
+/*      $OpenBSD: tests.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <openssl/evp.h>
+
+#include "../test_helper/test_helper.h"
+
+void sshkey_tests(void);
+void sshkey_file_tests(void);
+void sshkey_fuzz_tests(void);
+
+void
+tests(void)
+{
+        OpenSSL_add_all_algorithms();
+        ERR_load_CRYPTO_strings();
+
+        sshkey_tests();
+        sshkey_file_tests();
+        sshkey_fuzz_tests();
+}
diff --git a/regress/unittests/test_helper/Makefile b/regress/unittests/test_helper/Makefile
new file mode 100644
index 000000000..3e90903ef
--- /dev/null
+++ b/regress/unittests/test_helper/Makefile
@@ -0,0 +1,13 @@
+#       $OpenBSD: Makefile,v 1.1 2014/04/30 05:32:00 djm Exp $
+
+LIB=    test_helper
+SRCS=   test_helper.c fuzz.c
+
+DEBUGLIBS= no
+NOPROFILE= yes
+NOPIC=  yes
+
+install:
+        @echo -n
+
+.include <bsd.lib.mk>
diff --git a/regress/unittests/test_helper/fuzz.c b/regress/unittests/test_helper/fuzz.c
new file mode 100644
index 000000000..77c6e7cad
--- /dev/null
+++ b/regress/unittests/test_helper/fuzz.c
@@ -0,0 +1,378 @@
+/*      $OpenBSD: fuzz.c,v 1.3 2014/05/02 09:41:32 andre Exp $  */
+/*
+ * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* Utility functions/framework for fuzz tests */
+
+#include "includes.h"
+
+#include <sys/types.h>
+
+#include <assert.h>
+#include <ctype.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+
+#include "test_helper.h"
+
+/* #define FUZZ_DEBUG */
+
+#ifdef FUZZ_DEBUG
+# define FUZZ_DBG(x) do { \
+                printf("%s:%d %s: ", __FILE__, __LINE__, __func__); \
+                printf x; \
+                printf("\n"); \
+                fflush(stdout); \
+        } while (0)
+#else
+# define FUZZ_DBG(x)
+#endif
+
+/* For brevity later */
+typedef unsigned long long fuzz_ullong;
+
+/* For base-64 fuzzing */
+static const char fuzz_b64chars[] =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+struct fuzz {
+        /* Fuzz method currently in use */
+        int strategy;
+
+        /* Fuzz methods remaining */
+        int strategies;
+
+        /* Original seed data blob */
+        void *seed;
+        size_t slen;
+
+        /* Current working copy of seed with fuzz mutations applied */
+        u_char *fuzzed;
+
+        /* Used by fuzz methods */
+        size_t o1, o2;
+};
+
+static const char *
+fuzz_ntop(u_int n)
+{
+        switch (n) {
+        case 0:
+                return "NONE";
+        case FUZZ_1_BIT_FLIP:
+                return "FUZZ_1_BIT_FLIP";
+        case FUZZ_2_BIT_FLIP:
+                return "FUZZ_2_BIT_FLIP";
+        case FUZZ_1_BYTE_FLIP:
+                return "FUZZ_1_BYTE_FLIP";
+        case FUZZ_2_BYTE_FLIP:
+                return "FUZZ_2_BYTE_FLIP";
+        case FUZZ_TRUNCATE_START:
+                return "FUZZ_TRUNCATE_START";
+        case FUZZ_TRUNCATE_END:
+                return "FUZZ_TRUNCATE_END";
+        case FUZZ_BASE64:
+                return "FUZZ_BASE64";
+        default:
+                abort();
+        }
+}
+
+void
+fuzz_dump(struct fuzz *fuzz)
+{
+        u_char *p = fuzz_ptr(fuzz);
+        size_t i, j, len = fuzz_len(fuzz);
+
+        switch (fuzz->strategy) {
+        case FUZZ_1_BIT_FLIP:
+                fprintf(stderr, "%s case %zu of %zu (bit: %zu)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    fuzz->o1, fuzz->slen * 8, fuzz->o1);
+                break;
+        case FUZZ_2_BIT_FLIP:
+                fprintf(stderr, "%s case %llu of %llu (bits: %zu, %zu)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    (((fuzz_ullong)fuzz->o2) * fuzz->slen * 8) + fuzz->o1,
+                    ((fuzz_ullong)fuzz->slen * 8) * fuzz->slen * 8,
+                    fuzz->o1, fuzz->o2);
+                break;
+        case FUZZ_1_BYTE_FLIP:
+                fprintf(stderr, "%s case %zu of %zu (byte: %zu)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    fuzz->o1, fuzz->slen, fuzz->o1);
+                break;
+        case FUZZ_2_BYTE_FLIP:
+                fprintf(stderr, "%s case %llu of %llu (bytes: %zu, %zu)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    (((fuzz_ullong)fuzz->o2) * fuzz->slen) + fuzz->o1,
+                    ((fuzz_ullong)fuzz->slen) * fuzz->slen,
+                    fuzz->o1, fuzz->o2);
+                break;
+        case FUZZ_TRUNCATE_START:
+                fprintf(stderr, "%s case %zu of %zu (offset: %zu)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    fuzz->o1, fuzz->slen, fuzz->o1);
+                break;
+        case FUZZ_TRUNCATE_END:
+                fprintf(stderr, "%s case %zu of %zu (offset: %zu)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    fuzz->o1, fuzz->slen, fuzz->o1);
+                break;
+        case FUZZ_BASE64:
+                assert(fuzz->o2 < sizeof(fuzz_b64chars) - 1);
+                fprintf(stderr, "%s case %llu of %llu (offset: %zu char: %c)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    (fuzz->o1 * (fuzz_ullong)64) + fuzz->o2,
+                    fuzz->slen * (fuzz_ullong)64, fuzz->o1,
+                    fuzz_b64chars[fuzz->o2]);
+                break;
+        default:
+                abort();
+        }
+
+        fprintf(stderr, "fuzz context %p len = %zu\n", fuzz, len);
+        for (i = 0; i < len; i += 16) {
+                fprintf(stderr, "%.4zd: ", i);
+                for (j = i; j < i + 16; j++) {
+                        if (j < len)
+                                fprintf(stderr, "%02x ", p[j]);
+                        else
+                                fprintf(stderr, "   ");
+                }
+                fprintf(stderr, " ");
+                for (j = i; j < i + 16; j++) {
+                        if (j < len) {
+                                if  (isascii(p[j]) && isprint(p[j]))
+                                        fprintf(stderr, "%c", p[j]);
+                                else
+                                        fprintf(stderr, ".");
+                        }
+                }
+                fprintf(stderr, "\n");
+        }
+}
+
+struct fuzz *
+fuzz_begin(u_int strategies, const void *p, size_t l)
+{
+        struct fuzz *ret = calloc(sizeof(*ret), 1);
+
+        assert(p != NULL);
+        assert(ret != NULL);
+        ret->seed = malloc(l);
+        assert(ret->seed != NULL);
+        memcpy(ret->seed, p, l);
+        ret->slen = l;
+        ret->strategies = strategies;
+
+        assert(ret->slen < SIZE_MAX / 8);
+        assert(ret->strategies <= (FUZZ_MAX|(FUZZ_MAX-1)));
+
+        FUZZ_DBG(("begin, ret = %p", ret));
+
+        fuzz_next(ret);
+        return ret;
+}
+
+void
+fuzz_cleanup(struct fuzz *fuzz)
+{
+        FUZZ_DBG(("cleanup, fuzz = %p", fuzz));
+        assert(fuzz != NULL);
+        assert(fuzz->seed != NULL);
+        assert(fuzz->fuzzed != NULL);
+        free(fuzz->seed);
+        free(fuzz->fuzzed);
+        free(fuzz);
+}
+
+static int
+fuzz_strategy_done(struct fuzz *fuzz)
+{
+        FUZZ_DBG(("fuzz = %p, strategy = %s, o1 = %zu, o2 = %zu, slen = %zu",
+            fuzz, fuzz_ntop(fuzz->strategy), fuzz->o1, fuzz->o2, fuzz->slen));
+
+        switch (fuzz->strategy) {
+        case FUZZ_1_BIT_FLIP:
+                return fuzz->o1 >= fuzz->slen * 8;
+        case FUZZ_2_BIT_FLIP:
+                return fuzz->o2 >= fuzz->slen * 8;
+        case FUZZ_2_BYTE_FLIP:
+                return fuzz->o2 >= fuzz->slen;
+        case FUZZ_1_BYTE_FLIP:
+        case FUZZ_TRUNCATE_START:
+        case FUZZ_TRUNCATE_END:
+        case FUZZ_BASE64:
+                return fuzz->o1 >= fuzz->slen;
+        default:
+                abort();
+        }
+}
+
+void
+fuzz_next(struct fuzz *fuzz)
+{
+        u_int i;
+
+        FUZZ_DBG(("start, fuzz = %p, strategy = %s, strategies = 0x%lx, "
+            "o1 = %zu, o2 = %zu, slen = %zu", fuzz, fuzz_ntop(fuzz->strategy),
+            (u_long)fuzz->strategies, fuzz->o1, fuzz->o2, fuzz->slen));
+
+        if (fuzz->strategy == 0 || fuzz_strategy_done(fuzz)) {
+                /* If we are just starting out, we need to allocate too */
+                if (fuzz->fuzzed == NULL) {
+                        FUZZ_DBG(("alloc"));
+                        fuzz->fuzzed = calloc(fuzz->slen, 1);
+                }
+                /* Pick next strategy */
+                FUZZ_DBG(("advance"));
+                for (i = 1; i <= FUZZ_MAX; i <<= 1) {
+                        if ((fuzz->strategies & i) != 0) {
+                                fuzz->strategy = i;
+                                break;
+                        }
+                }
+                FUZZ_DBG(("selected = %u", fuzz->strategy));
+                if (fuzz->strategy == 0) {
+                        FUZZ_DBG(("done, no more strategies"));
+                        return;
+                }
+                fuzz->strategies &= ~(fuzz->strategy);
+                fuzz->o1 = fuzz->o2 = 0;
+        }
+
+        assert(fuzz->fuzzed != NULL);
+
+        switch (fuzz->strategy) {
+        case FUZZ_1_BIT_FLIP:
+                assert(fuzz->o1 / 8 < fuzz->slen);
+                memcpy(fuzz->fuzzed, fuzz->seed, fuzz->slen);
+                fuzz->fuzzed[fuzz->o1 / 8] ^= 1 << (fuzz->o1 % 8);
+                fuzz->o1++;
+                break;
+        case FUZZ_2_BIT_FLIP:
+                assert(fuzz->o1 / 8 < fuzz->slen);
+                assert(fuzz->o2 / 8 < fuzz->slen);
+                memcpy(fuzz->fuzzed, fuzz->seed, fuzz->slen);
+                fuzz->fuzzed[fuzz->o1 / 8] ^= 1 << (fuzz->o1 % 8);
+                fuzz->fuzzed[fuzz->o2 / 8] ^= 1 << (fuzz->o2 % 8);
+                fuzz->o1++;
+                if (fuzz->o1 >= fuzz->slen * 8) {
+                        fuzz->o1 = 0;
+                        fuzz->o2++;
+                }
+                break;
+        case FUZZ_1_BYTE_FLIP:
+                assert(fuzz->o1 < fuzz->slen);
+                memcpy(fuzz->fuzzed, fuzz->seed, fuzz->slen);
+                fuzz->fuzzed[fuzz->o1] ^= 0xff;
+                fuzz->o1++;
+                break;
+        case FUZZ_2_BYTE_FLIP:
+                assert(fuzz->o1 < fuzz->slen);
+                assert(fuzz->o2 < fuzz->slen);
+                memcpy(fuzz->fuzzed, fuzz->seed, fuzz->slen);
+                fuzz->fuzzed[fuzz->o1] ^= 0xff;
+                fuzz->fuzzed[fuzz->o2] ^= 0xff;
+                fuzz->o1++;
+                if (fuzz->o1 >= fuzz->slen) {
+                        fuzz->o1 = 0;
+                        fuzz->o2++;
+                }
+                break;
+        case FUZZ_TRUNCATE_START:
+        case FUZZ_TRUNCATE_END:
+                assert(fuzz->o1 < fuzz->slen);
+                memcpy(fuzz->fuzzed, fuzz->seed, fuzz->slen);
+                fuzz->o1++;
+                break;
+        case FUZZ_BASE64:
+                assert(fuzz->o1 < fuzz->slen);
+                assert(fuzz->o2 < sizeof(fuzz_b64chars) - 1);
+                memcpy(fuzz->fuzzed, fuzz->seed, fuzz->slen);
+                fuzz->fuzzed[fuzz->o1] = fuzz_b64chars[fuzz->o2];
+                fuzz->o2++;
+                if (fuzz->o2 >= sizeof(fuzz_b64chars) - 1) {
+                        fuzz->o2 = 0;
+                        fuzz->o1++;
+                }
+                break;
+        default:
+                abort();
+        }
+
+        FUZZ_DBG(("done, fuzz = %p, strategy = %s, strategies = 0x%lx, "
+            "o1 = %zu, o2 = %zu, slen = %zu", fuzz, fuzz_ntop(fuzz->strategy),
+            (u_long)fuzz->strategies, fuzz->o1, fuzz->o2, fuzz->slen));
+}
+
+int
+fuzz_done(struct fuzz *fuzz)
+{
+        FUZZ_DBG(("fuzz = %p, strategies = 0x%lx", fuzz,
+            (u_long)fuzz->strategies));
+
+        return fuzz_strategy_done(fuzz) && fuzz->strategies == 0;
+}
+
+size_t
+fuzz_len(struct fuzz *fuzz)
+{
+        assert(fuzz->fuzzed != NULL);
+        switch (fuzz->strategy) {
+        case FUZZ_1_BIT_FLIP:
+        case FUZZ_2_BIT_FLIP:
+        case FUZZ_1_BYTE_FLIP:
+        case FUZZ_2_BYTE_FLIP:
+        case FUZZ_BASE64:
+                return fuzz->slen;
+        case FUZZ_TRUNCATE_START:
+        case FUZZ_TRUNCATE_END:
+                assert(fuzz->o1 <= fuzz->slen);
+                return fuzz->slen - fuzz->o1;
+        default:
+                abort();
+        }
+}
+
+u_char *
+fuzz_ptr(struct fuzz *fuzz)
+{
+        assert(fuzz->fuzzed != NULL);
+        switch (fuzz->strategy) {
+        case FUZZ_1_BIT_FLIP:
+        case FUZZ_2_BIT_FLIP:
+        case FUZZ_1_BYTE_FLIP:
+        case FUZZ_2_BYTE_FLIP:
+        case FUZZ_BASE64:
+                return fuzz->fuzzed;
+        case FUZZ_TRUNCATE_START:
+                assert(fuzz->o1 <= fuzz->slen);
+                return fuzz->fuzzed + fuzz->o1;
+        case FUZZ_TRUNCATE_END:
+                assert(fuzz->o1 <= fuzz->slen);
+                return fuzz->fuzzed;
+        default:
+                abort();
+        }
+}
+
diff --git a/regress/unittests/test_helper/test_helper.c b/regress/unittests/test_helper/test_helper.c
new file mode 100644
index 000000000..d0bc67833
--- /dev/null
+++ b/regress/unittests/test_helper/test_helper.c
@@ -0,0 +1,471 @@
+/*      $OpenBSD: test_helper.c,v 1.2 2014/05/02 09:41:32 andre Exp $   */
+/*
+ * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* Utility functions/framework for regress tests */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+
+#include <fcntl.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+#include <unistd.h>
+
+#include <openssl/bn.h>
+
+#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
+# include <vis.h>
+#endif
+
+#include "test_helper.h"
+
+#define TEST_CHECK_INT(r, pred) do {            \
+                switch (pred) {                 \
+                case TEST_EQ:                   \
+                        if (r == 0)             \
+                                return;         \
+                        break;                  \
+                case TEST_NE:                   \
+                        if (r != 0)             \
+                                return;         \
+                        break;                  \
+                case TEST_LT:                   \
+                        if (r < 0)              \
+                                return;         \
+                        break;                  \
+                case TEST_LE:                   \
+                        if (r <= 0)             \
+                                return;         \
+                        break;                  \
+                case TEST_GT:                   \
+                        if (r > 0)              \
+                                return;         \
+                        break;                  \
+                case TEST_GE:                   \
+                        if (r >= 0)             \
+                                return;         \
+                        break;                  \
+                default:                        \
+                        abort();                \
+                }                               \
+        } while (0)
+
+#define TEST_CHECK(x1, x2, pred) do {           \
+                switch (pred) {                 \
+                case TEST_EQ:                   \
+                        if (x1 == x2)           \
+                                return;         \
+                        break;                  \
+                case TEST_NE:                   \
+                        if (x1 != x2)           \
+                                return;         \
+                        break;                  \
+                case TEST_LT:                   \
+                        if (x1 < x2)            \
+                                return;         \
+                        break;                  \
+                case TEST_LE:                   \
+                        if (x1 <= x2)           \
+                                return;         \
+                        break;                  \
+                case TEST_GT:                   \
+                        if (x1 > x2)            \
+                                return;         \
+                        break;                  \
+                case TEST_GE:                   \
+                        if (x1 >= x2)           \
+                                return;         \
+                        break;                  \
+                default:                        \
+                        abort();                \
+                }                               \
+        } while (0)
+
+extern char *__progname;
+
+static int verbose_mode = 0;
+static int quiet_mode = 0;
+static char *active_test_name = NULL;
+static u_int test_number = 0;
+static test_onerror_func_t *test_onerror = NULL;
+static void *onerror_ctx = NULL;
+static const char *data_dir = NULL;
+
+int
+main(int argc, char **argv)
+{
+        int ch;
+
+        /* Handle systems without __progname */
+        if (__progname == NULL) {
+                __progname = strrchr(argv[0], '/');
+                if (__progname == NULL || __progname[1] == '\0')
+                        __progname = argv[0];   
+                else
+                        __progname++;
+                if ((__progname = strdup(__progname)) == NULL) {
+                        fprintf(stderr, "strdup failed\n");
+                        exit(1);
+                }
+        }
+
+        while ((ch = getopt(argc, argv, "vqd:")) != -1) {
+                switch (ch) {
+                case 'd':
+                        data_dir = optarg;
+                        break;
+                case 'q':
+                        verbose_mode = 0;
+                        quiet_mode = 1;
+                        break;
+                case 'v':
+                        verbose_mode = 1;
+                        quiet_mode = 0;
+                        break;
+                default:
+                        fprintf(stderr, "Unrecognised command line option\n");
+                        fprintf(stderr, "Usage: %s [-v]\n", __progname);
+                        exit(1);
+                }
+        }
+        setvbuf(stdout, NULL, _IONBF, 0);
+        if (!quiet_mode)
+                printf("%s: ", __progname);
+        if (verbose_mode)
+                printf("\n");
+
+        tests();
+
+        if (!quiet_mode)
+                printf(" %u tests ok\n", test_number);
+        return 0;
+}
+
+const char *
+test_data_file(const char *name)
+{
+        static char ret[PATH_MAX];
+
+        if (data_dir != NULL)
+                snprintf(ret, sizeof(ret), "%s/%s", data_dir, name);
+        else
+                strlcpy(ret, name, sizeof(ret));
+        if (access(ret, F_OK) != 0) {
+                fprintf(stderr, "Cannot access data file %s: %s\n",
+                    ret, strerror(errno));
+                exit(1);
+        }
+        return ret;
+}
+
+void
+test_start(const char *n)
+{
+        assert(active_test_name == NULL);
+        assert((active_test_name = strdup(n)) != NULL);
+        if (verbose_mode)
+                printf("test %u - \"%s\": ", test_number, active_test_name);
+        test_number++;
+}
+
+void
+set_onerror_func(test_onerror_func_t *f, void *ctx)
+{
+        test_onerror = f;
+        onerror_ctx = ctx;
+}
+
+void
+test_done(void)
+{
+        assert(active_test_name != NULL);
+        free(active_test_name);
+        active_test_name = NULL;
+        if (verbose_mode)
+                printf("OK\n");
+        else if (!quiet_mode) {
+                printf(".");
+                fflush(stdout);
+        }
+}
+
+void
+ssl_err_check(const char *file, int line)
+{
+        long openssl_error = ERR_get_error();
+
+        if (openssl_error == 0)
+                return;
+
+        fprintf(stderr, "\n%s:%d: uncaught OpenSSL error: %s",
+            file, line, ERR_error_string(openssl_error, NULL));
+        abort();
+}
+
+static const char *
+pred_name(enum test_predicate p)
+{
+        switch (p) {
+        case TEST_EQ:
+                return "EQ";
+        case TEST_NE:
+                return "NE";
+        case TEST_LT:
+                return "LT";
+        case TEST_LE:
+                return "LE";
+        case TEST_GT:
+                return "GT";
+        case TEST_GE:
+                return "GE";
+        default:
+                return "UNKNOWN";
+        }
+}
+
+static void
+test_die(void)
+{
+        if (test_onerror != NULL)
+                test_onerror(onerror_ctx);
+        abort();
+}
+
+static void
+test_header(const char *file, int line, const char *a1, const char *a2,
+    const char *name, enum test_predicate pred)
+{
+        fprintf(stderr, "\n%s:%d test #%u \"%s\"\n", 
+            file, line, test_number, active_test_name);
+        fprintf(stderr, "ASSERT_%s_%s(%s%s%s) failed:\n",
+            name, pred_name(pred), a1,
+            a2 != NULL ? ", " : "", a2 != NULL ? a2 : "");
+}
+
+void
+assert_bignum(const char *file, int line, const char *a1, const char *a2,
+    const BIGNUM *aa1, const BIGNUM *aa2, enum test_predicate pred)
+{
+        int r = BN_cmp(aa1, aa2);
+
+        TEST_CHECK_INT(r, pred);
+        test_header(file, line, a1, a2, "BIGNUM", pred);
+        fprintf(stderr, "%12s = 0x%s\n", a1, BN_bn2hex(aa1));
+        fprintf(stderr, "%12s = 0x%s\n", a2, BN_bn2hex(aa2));
+        test_die();
+}
+
+void
+assert_string(const char *file, int line, const char *a1, const char *a2,
+    const char *aa1, const char *aa2, enum test_predicate pred)
+{
+        int r = strcmp(aa1, aa2);
+
+        TEST_CHECK_INT(r, pred);
+        test_header(file, line, a1, a2, "STRING", pred);
+        fprintf(stderr, "%12s = %s (len %zu)\n", a1, aa1, strlen(aa1));
+        fprintf(stderr, "%12s = %s (len %zu)\n", a2, aa2, strlen(aa2));
+        test_die();
+}
+
+static char *
+tohex(const void *_s, size_t l)
+{
+        u_int8_t *s = (u_int8_t *)_s;
+        size_t i, j;
+        const char *hex = "0123456789abcdef";
+        char *r = malloc((l * 2) + 1);
+
+        assert(r != NULL);
+        for (i = j = 0; i < l; i++) {
+                r[j++] = hex[(s[i] >> 4) & 0xf];
+                r[j++] = hex[s[i] & 0xf];
+        }
+        r[j] = '\0';
+        return r;
+}
+
+void
+assert_mem(const char *file, int line, const char *a1, const char *a2,
+    const void *aa1, const void *aa2, size_t l, enum test_predicate pred)
+{
+        int r = memcmp(aa1, aa2, l);
+
+        TEST_CHECK_INT(r, pred);
+        test_header(file, line, a1, a2, "STRING", pred);
+        fprintf(stderr, "%12s = %s (len %zu)\n", a1, tohex(aa1, MIN(l, 256)), l);
+        fprintf(stderr, "%12s = %s (len %zu)\n", a2, tohex(aa2, MIN(l, 256)), l);
+        test_die();
+}
+
+static int
+memvalcmp(const u_int8_t *s, u_char v, size_t l, size_t *where)
+{
+        size_t i;
+
+        for (i = 0; i < l; i++) {
+                if (s[i] != v) {
+                        *where = i;
+                        return 1;
+                }
+        }
+        return 0;
+}
+
+void
+assert_mem_filled(const char *file, int line, const char *a1,
+    const void *aa1, u_char v, size_t l, enum test_predicate pred)
+{
+        size_t where = -1;
+        int r = memvalcmp(aa1, v, l, &where);
+        char tmp[64];
+
+        if (l == 0)
+                return;
+        TEST_CHECK_INT(r, pred);
+        test_header(file, line, a1, NULL, "MEM_ZERO", pred);
+        fprintf(stderr, "%20s = %s%s (len %zu)\n", a1,
+            tohex(aa1, MIN(l, 20)), l > 20 ? "..." : "", l);
+        snprintf(tmp, sizeof(tmp), "(%s)[%zu]", a1, where);
+        fprintf(stderr, "%20s = 0x%02x (expected 0x%02x)\n", tmp,
+            ((u_char *)aa1)[where], v);
+        test_die();
+}
+
+void
+assert_int(const char *file, int line, const char *a1, const char *a2,
+    int aa1, int aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "INT", pred);
+        fprintf(stderr, "%12s = %d\n", a1, aa1);
+        fprintf(stderr, "%12s = %d\n", a2, aa2);
+        test_die();
+}
+
+void
+assert_size_t(const char *file, int line, const char *a1, const char *a2,
+    size_t aa1, size_t aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "SIZE_T", pred);
+        fprintf(stderr, "%12s = %zu\n", a1, aa1);
+        fprintf(stderr, "%12s = %zu\n", a2, aa2);
+        test_die();
+}
+
+void
+assert_u_int(const char *file, int line, const char *a1, const char *a2,
+    u_int aa1, u_int aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "U_INT", pred);
+        fprintf(stderr, "%12s = %u / 0x%x\n", a1, aa1, aa1);
+        fprintf(stderr, "%12s = %u / 0x%x\n", a2, aa2, aa2);
+        test_die();
+}
+
+void
+assert_long_long(const char *file, int line, const char *a1, const char *a2,
+    long long aa1, long long aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "LONG LONG", pred);
+        fprintf(stderr, "%12s = %lld / 0x%llx\n", a1, aa1, aa1);
+        fprintf(stderr, "%12s = %lld / 0x%llx\n", a2, aa2, aa2);
+        test_die();
+}
+
+void
+assert_char(const char *file, int line, const char *a1, const char *a2,
+    char aa1, char aa2, enum test_predicate pred)
+{
+        char buf[8];
+
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "CHAR", pred);
+        fprintf(stderr, "%12s = '%s' / 0x02%x\n", a1,
+            vis(buf, aa1, VIS_SAFE|VIS_NL|VIS_TAB|VIS_OCTAL, 0), aa1);
+        fprintf(stderr, "%12s = '%s' / 0x02%x\n", a1,
+            vis(buf, aa2, VIS_SAFE|VIS_NL|VIS_TAB|VIS_OCTAL, 0), aa2);
+        test_die();
+}
+
+void
+assert_u8(const char *file, int line, const char *a1, const char *a2,
+    u_int8_t aa1, u_int8_t aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "U8", pred);
+        fprintf(stderr, "%12s = 0x%02x %u\n", a1, aa1, aa1);
+        fprintf(stderr, "%12s = 0x%02x %u\n", a2, aa2, aa2);
+        test_die();
+}
+
+void
+assert_u16(const char *file, int line, const char *a1, const char *a2,
+    u_int16_t aa1, u_int16_t aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "U16", pred);
+        fprintf(stderr, "%12s = 0x%04x %u\n", a1, aa1, aa1);
+        fprintf(stderr, "%12s = 0x%04x %u\n", a2, aa2, aa2);
+        test_die();
+}
+
+void
+assert_u32(const char *file, int line, const char *a1, const char *a2,
+    u_int32_t aa1, u_int32_t aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "U32", pred);
+        fprintf(stderr, "%12s = 0x%08x %u\n", a1, aa1, aa1);
+        fprintf(stderr, "%12s = 0x%08x %u\n", a2, aa2, aa2);
+        test_die();
+}
+
+void
+assert_u64(const char *file, int line, const char *a1, const char *a2,
+    u_int64_t aa1, u_int64_t aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "U64", pred);
+        fprintf(stderr, "%12s = 0x%016llx %llu\n", a1,
+            (unsigned long long)aa1, (unsigned long long)aa1);
+        fprintf(stderr, "%12s = 0x%016llx %llu\n", a2,
+            (unsigned long long)aa2, (unsigned long long)aa2);
+        test_die();
+}
+
+void
+assert_ptr(const char *file, int line, const char *a1, const char *a2,
+    const void *aa1, const void *aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "PTR", pred);
+        fprintf(stderr, "%12s = %p\n", a1, aa1);
+        fprintf(stderr, "%12s = %p\n", a2, aa2);
+        test_die();
+}
+
diff --git a/regress/unittests/test_helper/test_helper.h b/regress/unittests/test_helper/test_helper.h
new file mode 100644
index 000000000..a398c615f
--- /dev/null
+++ b/regress/unittests/test_helper/test_helper.h
@@ -0,0 +1,292 @@
+/*      $OpenBSD: test_helper.h,v 1.3 2014/05/02 09:41:32 andre Exp $   */
+/*
+ * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* Utility functions/framework for regress tests */
+
+#ifndef _TEST_HELPER_H
+#define _TEST_HELPER_H
+
+#include "includes.h"
+
+#include <sys/types.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+
+#include <openssl/bn.h>
+#include <openssl/err.h>
+
+enum test_predicate {
+        TEST_EQ, TEST_NE, TEST_LT, TEST_LE, TEST_GT, TEST_GE
+};
+typedef void (test_onerror_func_t)(void *);
+
+/* Supplied by test suite */
+void tests(void);
+
+const char *test_data_file(const char *name);
+void test_start(const char *n);
+void set_onerror_func(test_onerror_func_t *f, void *ctx);
+void test_done(void);
+void ssl_err_check(const char *file, int line);
+void assert_bignum(const char *file, int line,
+    const char *a1, const char *a2,
+    const BIGNUM *aa1, const BIGNUM *aa2, enum test_predicate pred);
+void assert_string(const char *file, int line,
+    const char *a1, const char *a2,
+    const char *aa1, const char *aa2, enum test_predicate pred);
+void assert_mem(const char *file, int line,
+    const char *a1, const char *a2,
+    const void *aa1, const void *aa2, size_t l, enum test_predicate pred);
+void assert_mem_filled(const char *file, int line,
+    const char *a1,
+    const void *aa1, u_char v, size_t l, enum test_predicate pred);
+void assert_int(const char *file, int line,
+    const char *a1, const char *a2,
+    int aa1, int aa2, enum test_predicate pred);
+void assert_size_t(const char *file, int line,
+    const char *a1, const char *a2,
+    size_t aa1, size_t aa2, enum test_predicate pred);
+void assert_u_int(const char *file, int line,
+    const char *a1, const char *a2,
+    u_int aa1, u_int aa2, enum test_predicate pred);
+void assert_long_long(const char *file, int line,
+    const char *a1, const char *a2,
+    long long aa1, long long aa2, enum test_predicate pred);
+void assert_char(const char *file, int line,
+    const char *a1, const char *a2,
+    char aa1, char aa2, enum test_predicate pred);
+void assert_ptr(const char *file, int line,
+    const char *a1, const char *a2,
+    const void *aa1, const void *aa2, enum test_predicate pred);
+void assert_u8(const char *file, int line,
+    const char *a1, const char *a2,
+    u_int8_t aa1, u_int8_t aa2, enum test_predicate pred);
+void assert_u16(const char *file, int line,
+    const char *a1, const char *a2,
+    u_int16_t aa1, u_int16_t aa2, enum test_predicate pred);
+void assert_u32(const char *file, int line,
+    const char *a1, const char *a2,
+    u_int32_t aa1, u_int32_t aa2, enum test_predicate pred);
+void assert_u64(const char *file, int line,
+    const char *a1, const char *a2,
+    u_int64_t aa1, u_int64_t aa2, enum test_predicate pred);
+
+#define TEST_START(n)                   test_start(n)
+#define TEST_DONE()                     test_done()
+#define TEST_ONERROR(f, c)              set_onerror_func(f, c)
+#define SSL_ERR_CHECK()                 ssl_err_check(__FILE__, __LINE__)
+
+#define ASSERT_BIGNUM_EQ(a1, a2) \
+        assert_bignum(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_STRING_EQ(a1, a2) \
+        assert_string(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_MEM_EQ(a1, a2, l) \
+        assert_mem(__FILE__, __LINE__, #a1, #a2, a1, a2, l, TEST_EQ)
+#define ASSERT_MEM_FILLED_EQ(a1, c, l) \
+        assert_mem_filled(__FILE__, __LINE__, #a1, a1, c, l, TEST_EQ)
+#define ASSERT_MEM_ZERO_EQ(a1, l) \
+        assert_mem_filled(__FILE__, __LINE__, #a1, a1, '\0', l, TEST_EQ)
+#define ASSERT_INT_EQ(a1, a2) \
+        assert_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_SIZE_T_EQ(a1, a2) \
+        assert_size_t(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_U_INT_EQ(a1, a2) \
+        assert_u_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_LONG_LONG_EQ(a1, a2) \
+        assert_long_long(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_CHAR_EQ(a1, a2) \
+        assert_char(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_PTR_EQ(a1, a2) \
+        assert_ptr(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_U8_EQ(a1, a2) \
+        assert_u8(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_U16_EQ(a1, a2) \
+        assert_u16(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_U32_EQ(a1, a2) \
+        assert_u32(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_U64_EQ(a1, a2) \
+        assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+
+#define ASSERT_BIGNUM_NE(a1, a2) \
+        assert_bignum(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_STRING_NE(a1, a2) \
+        assert_string(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_MEM_NE(a1, a2, l) \
+        assert_mem(__FILE__, __LINE__, #a1, #a2, a1, a2, l, TEST_NE)
+#define ASSERT_MEM_ZERO_NE(a1, l) \
+        assert_mem_filled(__FILE__, __LINE__, #a1, a1, '\0', l, TEST_NE)
+#define ASSERT_INT_NE(a1, a2) \
+        assert_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_SIZE_T_NE(a1, a2) \
+        assert_size_t(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_U_INT_NE(a1, a2) \
+        assert_u_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_LONG_LONG_NE(a1, a2) \
+        assert_long_long(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_CHAR_NE(a1, a2) \
+        assert_char(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_PTR_NE(a1, a2) \
+        assert_ptr(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_U8_NE(a1, a2) \
+        assert_u8(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_U16_NE(a1, a2) \
+        assert_u16(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_U32_NE(a1, a2) \
+        assert_u32(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_U64_NE(a1, a2) \
+        assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+
+#define ASSERT_BIGNUM_LT(a1, a2) \
+        assert_bignum(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_STRING_LT(a1, a2) \
+        assert_string(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_MEM_LT(a1, a2, l) \
+        assert_mem(__FILE__, __LINE__, #a1, #a2, a1, a2, l, TEST_LT)
+#define ASSERT_INT_LT(a1, a2) \
+        assert_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_SIZE_T_LT(a1, a2) \
+        assert_size_t(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_U_INT_LT(a1, a2) \
+        assert_u_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_LONG_LONG_LT(a1, a2) \
+        assert_long_long(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_CHAR_LT(a1, a2) \
+        assert_char(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_PTR_LT(a1, a2) \
+        assert_ptr(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_U8_LT(a1, a2) \
+        assert_u8(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_U16_LT(a1, a2) \
+        assert_u16(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_U32_LT(a1, a2) \
+        assert_u32(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_U64_LT(a1, a2) \
+        assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+
+#define ASSERT_BIGNUM_LE(a1, a2) \
+        assert_bignum(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_STRING_LE(a1, a2) \
+        assert_string(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_MEM_LE(a1, a2, l) \
+        assert_mem(__FILE__, __LINE__, #a1, #a2, a1, a2, l, TEST_LE)
+#define ASSERT_INT_LE(a1, a2) \
+        assert_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_SIZE_T_LE(a1, a2) \
+        assert_size_t(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_U_INT_LE(a1, a2) \
+        assert_u_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_LONG_LONG_LE(a1, a2) \
+        assert_long_long(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_CHAR_LE(a1, a2) \
+        assert_char(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_PTR_LE(a1, a2) \
+        assert_ptr(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_U8_LE(a1, a2) \
+        assert_u8(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_U16_LE(a1, a2) \
+        assert_u16(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_U32_LE(a1, a2) \
+        assert_u32(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_U64_LE(a1, a2) \
+        assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+
+#define ASSERT_BIGNUM_GT(a1, a2) \
+        assert_bignum(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_STRING_GT(a1, a2) \
+        assert_string(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_MEM_GT(a1, a2, l) \
+        assert_mem(__FILE__, __LINE__, #a1, #a2, a1, a2, l, TEST_GT)
+#define ASSERT_INT_GT(a1, a2) \
+        assert_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_SIZE_T_GT(a1, a2) \
+        assert_size_t(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_U_INT_GT(a1, a2) \
+        assert_u_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_LONG_LONG_GT(a1, a2) \
+        assert_long_long(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_CHAR_GT(a1, a2) \
+        assert_char(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_PTR_GT(a1, a2) \
+        assert_ptr(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_U8_GT(a1, a2) \
+        assert_u8(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_U16_GT(a1, a2) \
+        assert_u16(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_U32_GT(a1, a2) \
+        assert_u32(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_U64_GT(a1, a2) \
+        assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+
+#define ASSERT_BIGNUM_GE(a1, a2) \
+        assert_bignum(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_STRING_GE(a1, a2) \
+        assert_string(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_MEM_GE(a1, a2, l) \
+        assert_mem(__FILE__, __LINE__, #a1, #a2, a1, a2, l, TEST_GE)
+#define ASSERT_INT_GE(a1, a2) \
+        assert_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_SIZE_T_GE(a1, a2) \
+        assert_size_t(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_U_INT_GE(a1, a2) \
+        assert_u_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_LONG_LONG_GE(a1, a2) \
+        assert_long_long(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_CHAR_GE(a1, a2) \
+        assert_char(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_PTR_GE(a1, a2) \
+        assert_ptr(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_U8_GE(a1, a2) \
+        assert_u8(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_U16_GE(a1, a2) \
+        assert_u16(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_U32_GE(a1, a2) \
+        assert_u32(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_U64_GE(a1, a2) \
+        assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+
+/* Fuzzing support */
+
+struct fuzz;
+#define FUZZ_1_BIT_FLIP         0x00000001      /* Flip one bit at a time */
+#define FUZZ_2_BIT_FLIP         0x00000002      /* Flip two bits at a time */
+#define FUZZ_1_BYTE_FLIP        0x00000004      /* Flip one byte at a time */
+#define FUZZ_2_BYTE_FLIP        0x00000008      /* Flip two bytes at a time */
+#define FUZZ_TRUNCATE_START     0x00000010      /* Truncate from beginning */
+#define FUZZ_TRUNCATE_END       0x00000020      /* Truncate from end */
+#define FUZZ_BASE64             0x00000040      /* Try all base64 chars */
+#define FUZZ_MAX                FUZZ_BASE64
+
+/* Start fuzzing a blob of data with selected strategies (bitmask) */
+struct fuzz *fuzz_begin(u_int strategies, const void *p, size_t l);
+
+/* Free a fuzz context */
+void fuzz_cleanup(struct fuzz *fuzz);
+
+/* Prepare the next fuzz case in the series */
+void fuzz_next(struct fuzz *fuzz);
+
+/* Determine whether the current fuzz sequence is exhausted (nonzero = yes) */
+int fuzz_done(struct fuzz *fuzz);
+
+/* Return the length and a pointer to the current fuzzed case */
+size_t fuzz_len(struct fuzz *fuzz);
+u_char *fuzz_ptr(struct fuzz *fuzz);
+
+/* Dump the current fuzz case to stderr */
+void fuzz_dump(struct fuzz *fuzz);
+#endif /* _TEST_HELPER_H */