Import openssh_6.7p1.orig.tar.gz

113 files changed, 4900 insertions, 44 deletions

diff --git a/regress/Makefile b/regress/Makefile
index 6e3b8d634..3feb7a997 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -1,6 +1,6 @@
-#       $OpenBSD: Makefile,v 1.68 2014/01/25 04:35:32 dtucker Exp $
+#       $OpenBSD: Makefile,v 1.70 2014/06/24 01:14:17 djm Exp $
 
-REGRESS_TARGETS=        t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t-exec
+REGRESS_TARGETS=        unit t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t-exec
 tests:          $(REGRESS_TARGETS)
 
 # Interop tests are not run by default
@@ -180,3 +180,11 @@ t-exec-interop:	${INTEROP_TESTS:=.sh}
 
 # Not run by default
 interop: ${INTEROP_TARGETS}
+
+# Unit tests, built by top-level Makefile
+unit:
+        set -e ; if test -z "${SKIP_UNIT}" ; then \
+                ${.OBJDIR}/unittests/sshbuf/test_sshbuf ; \
+                ${.OBJDIR}/unittests/sshkey/test_sshkey \
+                        -d  ${.CURDIR}//unittests/sshkey/testdata ; \
+        fi
diff --git a/regress/connect-privsep.sh b/regress/connect-privsep.sh
index 94cc64acf..41cb7af69 100644
--- a/regress/connect-privsep.sh
+++ b/regress/connect-privsep.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: connect-privsep.sh,v 1.4 2012/07/02 14:37:06 dtucker Exp $
+#       $OpenBSD: connect-privsep.sh,v 1.5 2014/05/04 10:40:59 logan Exp $
 #       Placed in the Public Domain.
 
 tid="proxy connect with privsep"
@@ -26,7 +26,7 @@ done
 
 # Because sandbox is sensitive to changes in libc, especially malloc, retest
 # with every malloc.conf option (and none).
-for m in '' A F G H J P R S X Z '<' '>'; do
+for m in '' A F G H J P R S X '<' '>'; do
     for p in 1 2; do
         env MALLOC_OPTIONS="$m" ${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
         if [ $? -ne 0 ]; then
diff --git a/regress/dhgex.sh b/regress/dhgex.sh
index 4c1a3d83c..57fca4a32 100644
--- a/regress/dhgex.sh
+++ b/regress/dhgex.sh
@@ -1,10 +1,11 @@
-#       $OpenBSD: dhgex.sh,v 1.1 2014/01/25 04:35:32 dtucker Exp $
+#       $OpenBSD: dhgex.sh,v 1.2 2014/04/21 22:15:37 djm Exp $
 #       Placed in the Public Domain.
 
 tid="dhgex"
 
 LOG=${TEST_SSH_LOGFILE}
 rm -f ${LOG}
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
 
 kexs=`${SSH} -Q kex | grep diffie-hellman-group-exchange`
 
@@ -14,6 +15,9 @@ ssh_test_dhgex()
         cipher="$1"; shift
         kex="$1"; shift
 
+        cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
+        echo "KexAlgorithms=$kex" >> $OBJ/sshd_proxy
+        echo "Ciphers=$cipher" >> $OBJ/sshd_proxy
         rm -f ${LOG}
         opts="-oKexAlgorithms=$kex -oCiphers=$cipher"
         groupsz="1024<$bits<8192"
diff --git a/regress/forwarding.sh b/regress/forwarding.sh
index 94873f22c..f799d4951 100644
--- a/regress/forwarding.sh
+++ b/regress/forwarding.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: forwarding.sh,v 1.11 2013/06/10 21:56:43 dtucker Exp $
+#       $OpenBSD: forwarding.sh,v 1.12 2014/07/15 15:54:15 millert Exp $
 #       Placed in the Public Domain.
 
 tid="local and remote forwarding"
@@ -28,7 +28,7 @@ for p in 1 2; do
         trace "transfer over forwarded channels and check result"
         ${SSH} -$q -F $OBJ/ssh_config -p$last -o 'ConnectionAttempts=4' \
                 somehost cat ${DATA} > ${COPY}
-        test -f ${COPY}         || fail "failed copy of ${DATA}"
+        test -s ${COPY}         || fail "failed copy of ${DATA}"
         cmp ${DATA} ${COPY}     || fail "corrupted copy of ${DATA}"
 
         sleep 10
@@ -114,8 +114,24 @@ for p in 1 2; do
         trace "config file: transfer over forwarded channels and check result"
         ${SSH} -F $OBJ/ssh_config -p${base}02 -o 'ConnectionAttempts=4' \
                 somehost cat ${DATA} > ${COPY}
-        test -f ${COPY}         || fail "failed copy of ${DATA}"
+        test -s ${COPY}         || fail "failed copy of ${DATA}"
         cmp ${DATA} ${COPY}     || fail "corrupted copy of ${DATA}"
 
         wait
 done
+
+for p in 2; do
+        trace "transfer over chained unix domain socket forwards and check result"
+        rm -f $OBJ/unix-[123].fwd
+        ${SSH} -f -F $OBJ/ssh_config -R${base}01:[$OBJ/unix-1.fwd] somehost sleep 10
+        ${SSH} -f -F $OBJ/ssh_config -L[$OBJ/unix-1.fwd]:[$OBJ/unix-2.fwd] somehost sleep 10
+        ${SSH} -f -F $OBJ/ssh_config -R[$OBJ/unix-2.fwd]:[$OBJ/unix-3.fwd] somehost sleep 10
+        ${SSH} -f -F $OBJ/ssh_config -L[$OBJ/unix-3.fwd]:127.0.0.1:$PORT somehost sleep 10
+        ${SSH} -F $OBJ/ssh_config -p${base}01 -o 'ConnectionAttempts=4' \
+                somehost cat ${DATA} > ${COPY}
+        test -s ${COPY}                 || fail "failed copy ${DATA}"
+        cmp ${DATA} ${COPY}             || fail "corrupted copy of ${DATA}"
+
+        #wait
+        sleep 10
+done
diff --git a/regress/integrity.sh b/regress/integrity.sh
index 852d82690..d3a489ff7 100644
--- a/regress/integrity.sh
+++ b/regress/integrity.sh
@@ -1,7 +1,8 @@
-#       $OpenBSD: integrity.sh,v 1.12 2013/11/21 03:18:51 djm Exp $
+#       $OpenBSD: integrity.sh,v 1.14 2014/05/21 07:04:21 djm Exp $
 #       Placed in the Public Domain.
 
 tid="integrity"
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
 
 # start at byte 2900 (i.e. after kex) and corrupt at different offsets
 # XXX the test hangs if we modify the low bytes of the packet length
@@ -34,11 +35,15 @@ for m in $macs; do
                         # avoid modifying the high bytes of the length
                         continue
                 fi
+                cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
                 # modify output from sshd at offset $off
                 pxy="proxycommand=$cmd | $OBJ/modpipe -wm xor:$off:1"
                 if ssh -Q cipher-auth | grep "^${m}\$" >/dev/null 2>&1 ; then
+                        echo "Ciphers=$m" >> $OBJ/sshd_proxy
                         macopt="-c $m"
                 else
+                        echo "Ciphers=aes128-ctr" >> $OBJ/sshd_proxy
+                        echo "MACs=$m" >> $OBJ/sshd_proxy
                         macopt="-m $m -c aes128-ctr"
                 fi
                 verbose "test $tid: $m @$off"
@@ -49,14 +54,14 @@ for m in $macs; do
                         fail "ssh -m $m succeeds with bit-flip at $off"
                 fi
                 ecnt=`expr $ecnt + 1`
-                output=$(tail -2 $TEST_SSH_LOGFILE | egrep -v "^debug" | \
+                out=$(tail -2 $TEST_SSH_LOGFILE | egrep -v "^debug" | \
                      tr -s '\r\n' '.')
-                case "$output" in
+                case "$out" in
                 Bad?packet*)    elen=`expr $elen + 1`; skip=3;;
                 Corrupted?MAC* | Decryption?integrity?check?failed*)
                                 emac=`expr $emac + 1`; skip=0;;
                 padding*)       epad=`expr $epad + 1`; skip=0;;
-                *)              fail "unexpected error mac $m at $off";;
+                *)              fail "unexpected error mac $m at $off: $out";;
                 esac
         done
         verbose "test $tid: $ecnt errors: mac $emac padding $epad length $elen"
diff --git a/regress/kextype.sh b/regress/kextype.sh
index 8c2ac09d6..6f952f4e4 100644
--- a/regress/kextype.sh
+++ b/regress/kextype.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: kextype.sh,v 1.4 2013/11/07 04:26:56 dtucker Exp $
+#       $OpenBSD: kextype.sh,v 1.5 2014/04/21 22:15:37 djm Exp $
 #       Placed in the Public Domain.
 
 tid="login with different key exchange algorithms"
@@ -7,6 +7,11 @@ TIME=/usr/bin/time
 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
 cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
 
+# Make server accept all key exchanges.
+ALLKEX=`ssh -Q kex`
+KEXOPT=`echo $ALLKEX | tr ' ' ,`
+echo "KexAlgorithms=$KEXOPT" >> $OBJ/sshd_proxy
+
 tries="1 2 3 4"
 for k in `${SSH} -Q kex`; do
         verbose "kex $k"
diff --git a/regress/krl.sh b/regress/krl.sh
index 09246371c..287384b4a 100644
--- a/regress/krl.sh
+++ b/regress/krl.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: krl.sh,v 1.2 2013/11/21 03:15:46 djm Exp $
+#       $OpenBSD: krl.sh,v 1.3 2014/06/24 01:04:43 djm Exp $
 #       Placed in the Public Domain.
 
 tid="key revocation lists"
@@ -37,6 +37,9 @@ serial: 700-797
 serial: 798
 serial: 799
 serial: 599-701
+# Some multiple consecutive serial number ranges
+serial: 10000-20000
+serial: 30000-40000
 EOF
 
 # A specification that revokes some certificated by key ID.
diff --git a/regress/login-timeout.sh b/regress/login-timeout.sh
index d9b48f391..eb76f554b 100644
--- a/regress/login-timeout.sh
+++ b/regress/login-timeout.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: login-timeout.sh,v 1.6 2014/02/27 20:04:16 djm Exp $
+#       $OpenBSD: login-timeout.sh,v 1.7 2014/03/13 20:44:49 djm Exp $
 #       Placed in the Public Domain.
 
 tid="connect after login grace timeout"
@@ -22,6 +22,7 @@ $SUDO kill `$SUDO cat $PIDFILE`
 trace "test login grace without privsep"
 echo "UsePrivilegeSeparation no" >> $OBJ/sshd_config
 start_sshd
+sleep 1
 
 (echo SSH-2.0-fake; sleep 60) | telnet 127.0.0.1 ${PORT} >/dev/null 2>&1 & 
 sleep 15
diff --git a/regress/multiplex.sh b/regress/multiplex.sh
index 3e697e691..8ee140be6 100644
--- a/regress/multiplex.sh
+++ b/regress/multiplex.sh
@@ -1,10 +1,26 @@
-#       $OpenBSD: multiplex.sh,v 1.21 2013/05/17 04:29:14 dtucker Exp $
+#       $OpenBSD: multiplex.sh,v 1.25 2014/07/22 01:32:12 djm Exp $
 #       Placed in the Public Domain.
 
 CTL=/tmp/openssh.regress.ctl-sock.$$
 
 tid="connection multiplexing"
 
+if have_prog nc ; then
+        if nc -h 2>&1 | grep -- -N >/dev/null; then
+                NC="nc -N";
+        elif nc -h 2>&1 | grep -- "-U.*Use UNIX" >/dev/null ; then
+                NC="nc"
+        else
+                echo "nc is incompatible"
+        fi
+fi
+
+if test -z "$NC" ; then
+        echo "skipped (no compatible nc found)"
+        exit 0
+fi
+
+trace "will use ProxyCommand $proxycmd"
 if config_defined DISABLE_FD_PASSING ; then
         echo "skipped (not supported on this platform)"
         exit 0
@@ -29,7 +45,8 @@ start_mux_master()
         trace "start master, fork to background"
         ${SSH} -Nn2 -MS$CTL -F $OBJ/ssh_config -oSendEnv="_XXX_TEST" somehost \
             -E $TEST_REGRESS_LOGFILE 2>&1 &
-        MASTER_PID=$!
+        # NB. $SSH_PID will be killed by test-exec.sh:cleanup on fatal errors.
+        SSH_PID=$!
         wait_for_mux_master_ready
 }
 
@@ -71,6 +88,25 @@ test -f ${COPY}			|| fail "scp: failed copy ${DATA}"
 cmp ${DATA} ${COPY}             || fail "scp: corrupted copy of ${DATA}"
 
 rm -f ${COPY}
+verbose "test $tid: forward"
+trace "forward over TCP/IP and check result"
+$NC -l 127.0.0.1 $((${PORT} + 1)) < ${DATA} &
+netcat_pid=$!
+${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -L127.0.0.1:$((${PORT} + 2)):127.0.0.1:$((${PORT} + 1)) otherhost >>$TEST_SSH_LOGFILE 2>&1
+$NC -d 127.0.0.1 $((${PORT} + 2)) > ${COPY} < /dev/null
+cmp ${DATA} ${COPY}             || fail "ssh: corrupted copy of ${DATA}"
+kill $netcat_pid 2>/dev/null
+rm -f ${COPY} $OBJ/unix-[123].fwd
+
+trace "forward over UNIX and check result"
+$NC -Ul $OBJ/unix-1.fwd < ${DATA} &
+netcat_pid=$!
+${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -L$OBJ/unix-2.fwd:$OBJ/unix-1.fwd otherhost >>$TEST_SSH_LOGFILE 2>&1
+${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -R$OBJ/unix-3.fwd:$OBJ/unix-2.fwd otherhost >>$TEST_SSH_LOGFILE 2>&1
+$NC -d -U $OBJ/unix-3.fwd > ${COPY} </dev/null
+cmp ${DATA} ${COPY}             || fail "ssh: corrupted copy of ${DATA}"
+kill $netcat_pid 2>/dev/null
+rm -f ${COPY} $OBJ/unix-[123].fwd
 
 for s in 0 1 4 5 44; do
         trace "exit status $s over multiplexed connection"
@@ -95,7 +131,7 @@ verbose "test $tid: cmd check"
 ${SSH} -F $OBJ/ssh_config -S $CTL -Ocheck otherhost >>$TEST_REGRESS_LOGFILE 2>&1 \
     || fail "check command failed" 
 
-verbose "test $tid: cmd forward local"
+verbose "test $tid: cmd forward local (TCP)"
 ${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -L $P:localhost:$PORT otherhost \
      || fail "request local forward failed"
 ${SSH} -F $OBJ/ssh_config -p$P otherhost true \
@@ -105,7 +141,7 @@ ${SSH} -F $OBJ/ssh_config -S $CTL -Ocancel -L $P:localhost:$PORT otherhost \
 ${SSH} -F $OBJ/ssh_config -p$P otherhost true \
      && fail "local forward port still listening"
 
-verbose "test $tid: cmd forward remote"
+verbose "test $tid: cmd forward remote (TCP)"
 ${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -R $P:localhost:$PORT otherhost \
      || fail "request remote forward failed"
 ${SSH} -F $OBJ/ssh_config -p$P otherhost true \
@@ -115,13 +151,35 @@ ${SSH} -F $OBJ/ssh_config -S $CTL -Ocancel -R $P:localhost:$PORT otherhost \
 ${SSH} -F $OBJ/ssh_config -p$P otherhost true \
      && fail "remote forward port still listening"
 
+verbose "test $tid: cmd forward local (UNIX)"
+${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -L $OBJ/unix-1.fwd:localhost:$PORT otherhost \
+     || fail "request local forward failed"
+echo "" | $NC -U $OBJ/unix-1.fwd | grep "Protocol mismatch" >/dev/null 2>&1 \
+     || fail "connect to local forward path failed"
+${SSH} -F $OBJ/ssh_config -S $CTL -Ocancel -L $OBJ/unix-1.fwd:localhost:$PORT otherhost \
+     || fail "cancel local forward failed"
+N=$(echo "xyzzy" | $NC -U $OBJ/unix-1.fwd 2>&1 | grep "xyzzy" | wc -l)
+test ${N} -eq 0 || fail "local forward path still listening"
+rm -f $OBJ/unix-1.fwd
+
+verbose "test $tid: cmd forward remote (UNIX)"
+${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -R $OBJ/unix-1.fwd:localhost:$PORT otherhost \
+     || fail "request remote forward failed"
+echo "" | $NC -U $OBJ/unix-1.fwd | grep "Protocol mismatch" >/dev/null 2>&1 \
+     || fail "connect to remote forwarded path failed"
+${SSH} -F $OBJ/ssh_config -S $CTL -Ocancel -R $OBJ/unix-1.fwd:localhost:$PORT otherhost \
+     || fail "cancel remote forward failed"
+N=$(echo "xyzzy" | $NC -U $OBJ/unix-1.fwd 2>&1 | grep "xyzzy" | wc -l)
+test ${N} -eq 0 || fail "remote forward path still listening"
+rm -f $OBJ/unix-1.fwd
+
 verbose "test $tid: cmd exit"
 ${SSH} -F $OBJ/ssh_config -S $CTL -Oexit otherhost >>$TEST_REGRESS_LOGFILE 2>&1 \
     || fail "send exit command failed" 
 
 # Wait for master to exit
-wait $MASTER_PID
-kill -0 $MASTER_PID >/dev/null 2>&1 && fail "exit command failed"
+wait $SSH_PID
+kill -0 $SSH_PID >/dev/null 2>&1 && fail "exit command failed"
 
 # Restart master and test -O stop command with master using -N
 verbose "test $tid: cmd stop"
@@ -138,6 +196,8 @@ ${SSH} -F $OBJ/ssh_config -S $CTL -Ostop otherhost >>$TEST_REGRESS_LOGFILE 2>&1
 # wait until both long-running command and master have exited.
 wait $SLEEP_PID
 [ $! != 0 ] || fail "waiting for concurrent command"
-wait $MASTER_PID
+wait $SSH_PID
 [ $! != 0 ] || fail "waiting for master stop"
-kill -0 $MASTER_PID >/dev/null 2>&1 && fail "stop command failed"
+kill -0 $SSH_PID >/dev/null 2>&1 && fatal "stop command failed"
+SSH_PID="" # Already gone, so don't kill in cleanup
+
diff --git a/regress/proxy-connect.sh b/regress/proxy-connect.sh
index 76e602dd6..023ba7367 100644
--- a/regress/proxy-connect.sh
+++ b/regress/proxy-connect.sh
@@ -1,26 +1,31 @@
-#       $OpenBSD: proxy-connect.sh,v 1.6 2013/03/07 00:20:34 djm Exp $
+#       $OpenBSD: proxy-connect.sh,v 1.7 2014/05/03 18:46:14 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="proxy connect"
 
-verbose "plain username"
-for p in 1 2; do
-        ${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
-        if [ $? -ne 0 ]; then
-                fail "ssh proxyconnect protocol $p failed"
-        fi
-        SSH_CONNECTION=`${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 'echo $SSH_CONNECTION'`
+mv $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
+
+for ps in no yes; do
+  cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
+  echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
+
+  for p in 1 2; do
+    for c in no yes; do
+        verbose "plain username protocol $p privsep=$ps comp=$c"
+        opts="-$p -oCompression=$c -F $OBJ/ssh_proxy"
+        SSH_CONNECTION=`${SSH} $opts 999.999.999.999 'echo $SSH_CONNECTION'`
         if [ $? -ne 0 ]; then
-                fail "ssh proxyconnect protocol $p failed"
+                fail "ssh proxyconnect protocol $p privsep=$ps comp=$c failed"
         fi
         if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
-                fail "bad SSH_CONNECTION"
+                fail "bad SSH_CONNECTION protocol $p privsep=$ps comp=$c"
         fi
+    done
+  done
 done
 
-verbose "username with style"
 for p in 1 2; do
+        verbose "username with style protocol $p"
         ${SSH} -$p -F $OBJ/ssh_proxy ${USER}:style@999.999.999.999 true || \
                 fail "ssh proxyconnect protocol $p failed"
 done
-
diff --git a/regress/rekey.sh b/regress/rekey.sh
index cf9401ea0..fd452b034 100644
--- a/regress/rekey.sh
+++ b/regress/rekey.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: rekey.sh,v 1.14 2013/11/21 03:18:51 djm Exp $
+#       $OpenBSD: rekey.sh,v 1.15 2014/04/21 22:15:37 djm Exp $
 #       Placed in the Public Domain.
 
 tid="rekey"
@@ -6,14 +6,22 @@ tid="rekey"
 LOG=${TEST_SSH_LOGFILE}
 
 rm -f ${LOG}
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
 
 # Test rekeying based on data volume only.
 # Arguments will be passed to ssh.
 ssh_data_rekeying()
 {
+        _kexopt=$1 ; shift
+        _opts="$@"
+        if ! test -z "$_kexopts" ; then
+                cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
+                echo "$_kexopt" >> $OBJ/sshd_proxy
+                _opts="$_opts -o$_kexopt"
+        fi
         rm -f ${COPY} ${LOG}
-        ${SSH} <${DATA} -oCompression=no $@ -v -F $OBJ/ssh_proxy somehost \
-                "cat > ${COPY}"
+        _opts="$_opts -oCompression=no"
+        ${SSH} <${DATA} $_opts -v -F $OBJ/ssh_proxy somehost "cat > ${COPY}"
         if [ $? -ne 0 ]; then
                 fail "ssh failed ($@)"
         fi
@@ -41,7 +49,7 @@ done
 
 for opt in $opts; do
         verbose "client rekey $opt"
-        ssh_data_rekeying -oRekeyLimit=256k -o$opt
+        ssh_data_rekeying "$opt" -oRekeyLimit=256k
 done
 
 # AEAD ciphers are magical so test with all KexAlgorithms
@@ -49,14 +57,14 @@ if ${SSH} -Q cipher-auth | grep '^.*$' >/dev/null 2>&1 ; then
   for c in `${SSH} -Q cipher-auth`; do
     for kex in `${SSH} -Q kex`; do
         verbose "client rekey $c $kex"
-        ssh_data_rekeying -oRekeyLimit=256k -oCiphers=$c -oKexAlgorithms=$kex
+        ssh_data_rekeying "KexAlgorithms=$kex" -oRekeyLimit=256k -oCiphers=$c
     done
   done
 fi
 
 for s in 16 1k 128k 256k; do
         verbose "client rekeylimit ${s}"
-        ssh_data_rekeying -oCompression=no -oRekeyLimit=$s
+        ssh_data_rekeying "" -oCompression=no -oRekeyLimit=$s
 done
 
 for s in 5 10; do
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index aac8aa5c2..a1bab832f 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: test-exec.sh,v 1.47 2013/11/09 05:41:34 dtucker Exp $
+#       $OpenBSD: test-exec.sh,v 1.48 2014/07/06 07:42:03 djm Exp $
 #       Placed in the Public Domain.
 
 #SUDO=sudo
@@ -240,13 +240,20 @@ md5 () {
 # helper
 cleanup ()
 {
+        if [ "x$SSH_PID" != "x" ]; then
+                if [ $SSH_PID -lt 2 ]; then
+                        echo bad pid for ssh: $SSH_PID
+                else
+                        kill $SSH_PID
+                fi
+        fi
         if [ -f $PIDFILE ]; then
                 pid=`$SUDO cat $PIDFILE`
                 if [ "X$pid" = "X" ]; then
                         echo no sshd running
                 else
                         if [ $pid -lt 2 ]; then
-                                echo bad pid for ssh: $pid
+                                echo bad pid for sshd: $pid
                         else
                                 $SUDO kill $pid
                                 trace "wait for sshd to exit"
diff --git a/regress/try-ciphers.sh b/regress/try-ciphers.sh
index ac34cedbf..2881ce16c 100644
--- a/regress/try-ciphers.sh
+++ b/regress/try-ciphers.sh
@@ -1,13 +1,18 @@
-#       $OpenBSD: try-ciphers.sh,v 1.22 2013/11/21 03:18:51 djm Exp $
+#       $OpenBSD: try-ciphers.sh,v 1.23 2014/04/21 22:15:37 djm Exp $
 #       Placed in the Public Domain.
 
 tid="try ciphers"
 
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
+
 for c in `${SSH} -Q cipher`; do
         n=0
         for m in `${SSH} -Q mac`; do
                 trace "proto 2 cipher $c mac $m"
                 verbose "test $tid: proto 2 cipher $c mac $m"
+                cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
+                echo "Ciphers=$c" >> $OBJ/sshd_proxy
+                echo "MACs=$m" >> $OBJ/sshd_proxy
                 ${SSH} -F $OBJ/ssh_proxy -2 -m $m -c $c somehost true
                 if [ $? -ne 0 ]; then
                         fail "ssh -2 failed with mac $m cipher $c"
diff --git a/regress/unittests/Makefile b/regress/unittests/Makefile
new file mode 100644
index 000000000..bdb4574e2
--- /dev/null
+++ b/regress/unittests/Makefile
@@ -0,0 +1,5 @@
+#       $OpenBSD: Makefile,v 1.1 2014/04/30 05:32:00 djm Exp $
+
+SUBDIR= test_helper sshbuf sshkey
+
+.include <bsd.subdir.mk>
diff --git a/regress/unittests/Makefile.inc b/regress/unittests/Makefile.inc
new file mode 100644
index 000000000..4c3363749
--- /dev/null
+++ b/regress/unittests/Makefile.inc
@@ -0,0 +1,59 @@
+#       $OpenBSD: Makefile.inc,v 1.1 2014/04/30 05:32:00 djm Exp $
+
+.include <bsd.own.mk>
+.include <bsd.obj.mk>
+
+# enable warnings
+WARNINGS=Yes
+
+DEBUG=-g
+CFLAGS+=        -fstack-protector-all
+CDIAGFLAGS=     -Wall
+CDIAGFLAGS+=    -Wextra
+CDIAGFLAGS+=    -Werror
+CDIAGFLAGS+=    -Wchar-subscripts
+CDIAGFLAGS+=    -Wcomment
+CDIAGFLAGS+=    -Wformat
+CDIAGFLAGS+=    -Wformat-security
+CDIAGFLAGS+=    -Wimplicit
+CDIAGFLAGS+=    -Winline
+CDIAGFLAGS+=    -Wmissing-declarations
+CDIAGFLAGS+=    -Wmissing-prototypes
+CDIAGFLAGS+=    -Wparentheses
+CDIAGFLAGS+=    -Wpointer-arith
+CDIAGFLAGS+=    -Wpointer-sign
+CDIAGFLAGS+=    -Wreturn-type
+CDIAGFLAGS+=    -Wshadow
+CDIAGFLAGS+=    -Wsign-compare
+CDIAGFLAGS+=    -Wstrict-aliasing
+CDIAGFLAGS+=    -Wstrict-prototypes
+CDIAGFLAGS+=    -Wswitch
+CDIAGFLAGS+=    -Wtrigraphs
+CDIAGFLAGS+=    -Wuninitialized
+CDIAGFLAGS+=    -Wunused
+.if ${COMPILER_VERSION} == "gcc4"
+CDIAGFLAGS+=    -Wold-style-definition
+.endif
+
+SSHREL=../../../../../usr.bin/ssh
+
+CFLAGS+=-I${.CURDIR}/../test_helper -I${.CURDIR}/${SSHREL}
+
+.if exists(${.CURDIR}/../test_helper/${__objdir})
+LDADD+=-L${.CURDIR}/../test_helper/${__objdir} -ltest_helper
+DPADD+=${.CURDIR}/../test_helper/${__objdir}/libtest_helper.a
+.else
+LDADD+=-L${.CURDIR}/../test_helper -ltest_helper
+DPADD+=${.CURDIR}/../test_helper/libtest_helper.a
+.endif
+
+.if exists(${.CURDIR}/${SSHREL}/lib/${__objdir})
+LDADD+=-L${.CURDIR}/${SSHREL}/lib/${__objdir} -lssh
+DPADD+=${.CURDIR}/${SSHREL}/lib/${__objdir}/libssh.a
+.else
+LDADD+=-L${.CURDIR}/${SSHREL}/lib -lssh
+DPADD+=${.CURDIR}/${SSHREL}/lib/libssh.a
+.endif
+
+LDADD+= -lcrypto
+DPADD+= ${LIBCRYPTO}
diff --git a/regress/unittests/sshbuf/Makefile b/regress/unittests/sshbuf/Makefile
new file mode 100644
index 000000000..85f99ac38
--- /dev/null
+++ b/regress/unittests/sshbuf/Makefile
@@ -0,0 +1,14 @@
+#       $OpenBSD: Makefile,v 1.1 2014/04/30 05:32:00 djm Exp $
+
+PROG=test_sshbuf
+SRCS=tests.c
+SRCS+=test_sshbuf.c
+SRCS+=test_sshbuf_getput_basic.c
+SRCS+=test_sshbuf_getput_crypto.c
+SRCS+=test_sshbuf_misc.c
+SRCS+=test_sshbuf_fuzz.c
+SRCS+=test_sshbuf_getput_fuzz.c
+SRCS+=test_sshbuf_fixed.c
+
+.include <bsd.regress.mk>
+
diff --git a/regress/unittests/sshbuf/test_sshbuf.c b/regress/unittests/sshbuf/test_sshbuf.c
new file mode 100644
index 000000000..ee77d6934
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf.c
@@ -0,0 +1,240 @@
+/*      $OpenBSD: test_sshbuf.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#define SSHBUF_INTERNAL 1       /* access internals for testing */
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include "../test_helper/test_helper.h"
+
+#include "ssherr.h"
+#include "sshbuf.h"
+
+void sshbuf_tests(void);
+
+void
+sshbuf_tests(void)
+{
+        struct sshbuf *p1;
+        const u_char *cdp;
+        u_char *dp;
+        size_t sz;
+        int r;
+
+        TEST_START("allocate sshbuf");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        TEST_DONE();
+
+        TEST_START("max size on fresh buffer");
+        ASSERT_SIZE_T_GT(sshbuf_max_size(p1), 0);
+        TEST_DONE();
+
+        TEST_START("available on fresh buffer");
+        ASSERT_SIZE_T_GT(sshbuf_avail(p1), 0);
+        TEST_DONE();
+
+        TEST_START("len = 0 on empty buffer");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        TEST_DONE();
+
+        TEST_START("set valid max size");
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 65536), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), 65536);
+        TEST_DONE();
+
+        TEST_START("available on limited buffer");
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 65536);
+        TEST_DONE();
+
+        TEST_START("free");
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("consume on empty buffer");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_consume(p1, 0), 0);
+        ASSERT_INT_EQ(sshbuf_consume(p1, 1), SSH_ERR_MESSAGE_INCOMPLETE);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("consume_end on empty buffer");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_consume_end(p1, 0), 0);
+        ASSERT_INT_EQ(sshbuf_consume_end(p1, 1), SSH_ERR_MESSAGE_INCOMPLETE);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("reserve space");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        r = sshbuf_reserve(p1, 1, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        *dp = 0x11;
+        r = sshbuf_reserve(p1, 3, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        *dp++ = 0x22;
+        *dp++ = 0x33;
+        *dp++ = 0x44;
+        TEST_DONE();
+
+        TEST_START("sshbuf_len on filled buffer");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        TEST_DONE();
+
+        TEST_START("sshbuf_ptr on filled buffer");
+        cdp = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(cdp, NULL);
+        ASSERT_U8_EQ(cdp[0], 0x11);
+        ASSERT_U8_EQ(cdp[1], 0x22);
+        ASSERT_U8_EQ(cdp[2], 0x33);
+        ASSERT_U8_EQ(cdp[3], 0x44);
+        TEST_DONE();
+
+        TEST_START("consume on filled buffer");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        ASSERT_INT_EQ(sshbuf_consume(p1, 0), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        r = sshbuf_consume(p1, 64);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        ASSERT_INT_EQ(sshbuf_consume(p1, 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 3);
+        cdp = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_U8_EQ(cdp[0], 0x22);
+        ASSERT_INT_EQ(sshbuf_consume(p1, 2), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        cdp = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_U8_EQ(cdp[0], 0x44);
+        r = sshbuf_consume(p1, 2);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        ASSERT_INT_EQ(sshbuf_consume(p1, 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        r = sshbuf_consume(p1, 1);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("consume_end on filled buffer");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        r = sshbuf_reserve(p1, 4, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        *dp++ = 0x11;
+        *dp++ = 0x22;
+        *dp++ = 0x33;
+        *dp++ = 0x44;
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        r = sshbuf_consume_end(p1, 5);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        ASSERT_INT_EQ(sshbuf_consume_end(p1, 3), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        cdp = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(cdp, NULL);
+        ASSERT_U8_EQ(*cdp, 0x11);
+        r = sshbuf_consume_end(p1, 2);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_consume_end(p1, 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("fill limited buffer");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 1223), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), 1223);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 1223);
+        r = sshbuf_reserve(p1, 1223, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        memset(dp, 0xd7, 1223);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1223);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 0);
+        r = sshbuf_reserve(p1, 1, &dp);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_PTR_EQ(dp, NULL);
+        TEST_DONE();
+
+        TEST_START("consume and force compaction");
+        ASSERT_INT_EQ(sshbuf_consume(p1, 223), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1000);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 223);
+        r = sshbuf_reserve(p1, 224, &dp);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_PTR_EQ(dp, NULL);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1000);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 223);
+        r = sshbuf_reserve(p1, 223, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        memset(dp, 0x7d, 223);
+        cdp = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(cdp, NULL);
+        ASSERT_MEM_FILLED_EQ(cdp, 0xd7, 1000);
+        ASSERT_MEM_FILLED_EQ(cdp + 1000, 0x7d, 223);
+        TEST_DONE();
+
+        TEST_START("resize full buffer");
+        r = sshbuf_set_max_size(p1, 1000);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        sz = roundup(1223 + SSHBUF_SIZE_INC * 3, SSHBUF_SIZE_INC);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sz), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), sz);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), sz - 1223);
+        ASSERT_INT_EQ(sshbuf_len(p1), 1223);
+        TEST_DONE();
+
+        /* NB. uses sshbuf internals */
+        TEST_START("alloc chunking");
+        r = sshbuf_reserve(p1, 1, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        *dp = 0xff;
+        cdp = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(cdp, NULL);
+        ASSERT_MEM_FILLED_EQ(cdp, 0xd7, 1000);
+        ASSERT_MEM_FILLED_EQ(cdp + 1000, 0x7d, 223);
+        ASSERT_MEM_FILLED_EQ(cdp + 1223, 0xff, 1);
+        ASSERT_SIZE_T_EQ(sshbuf_alloc(p1) % SSHBUF_SIZE_INC, 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("reset buffer");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 1223), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), 1223);
+        r = sshbuf_reserve(p1, 1223, &dp);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_PTR_NE(dp, NULL);
+        memset(dp, 0xd7, 1223);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1223);
+        sshbuf_reset(p1);
+        ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), 1223);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 1223);
+        sshbuf_free(p1);
+        TEST_DONE();
+}
diff --git a/regress/unittests/sshbuf/test_sshbuf_fixed.c b/regress/unittests/sshbuf/test_sshbuf_fixed.c
new file mode 100644
index 000000000..df4925f7c
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf_fixed.c
@@ -0,0 +1,126 @@
+/*      $OpenBSD: test_sshbuf_fixed.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#define SSHBUF_INTERNAL 1  /* access internals for testing */
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include "../test_helper/test_helper.h"
+
+#include "sshbuf.h"
+#include "ssherr.h"
+
+void sshbuf_fixed(void);
+
+const u_char test_buf[] = "\x01\x12\x34\x56\x78\x00\x00\x00\x05hello";
+
+void
+sshbuf_fixed(void)
+{
+        struct sshbuf *p1, *p2, *p3;
+        u_char c;
+        char *s;
+        u_int i;
+        size_t l;
+
+        TEST_START("sshbuf_from");
+        p1 = sshbuf_from(test_buf, sizeof(test_buf));
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_PTR_EQ(sshbuf_mutable_ptr(p1), NULL);
+        ASSERT_INT_EQ(sshbuf_check_reserve(p1, 1), SSH_ERR_BUFFER_READ_ONLY);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 1, NULL), SSH_ERR_BUFFER_READ_ONLY);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 200), SSH_ERR_BUFFER_READ_ONLY);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0x12345678), SSH_ERR_BUFFER_READ_ONLY);
+        ASSERT_SIZE_T_EQ(sshbuf_avail(p1), 0);
+        ASSERT_PTR_EQ(sshbuf_ptr(p1), test_buf);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_from data");
+        p1 = sshbuf_from(test_buf, sizeof(test_buf) - 1);
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_PTR_EQ(sshbuf_ptr(p1), test_buf);
+        ASSERT_INT_EQ(sshbuf_get_u8(p1, &c), 0);
+        ASSERT_PTR_EQ(sshbuf_ptr(p1), test_buf + 1);
+        ASSERT_U8_EQ(c, 1);
+        ASSERT_INT_EQ(sshbuf_get_u32(p1, &i), 0);
+        ASSERT_PTR_EQ(sshbuf_ptr(p1), test_buf + 5);
+        ASSERT_U32_EQ(i, 0x12345678);
+        ASSERT_INT_EQ(sshbuf_get_cstring(p1, &s, &l), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        ASSERT_STRING_EQ(s, "hello");
+        ASSERT_SIZE_T_EQ(l, 5);
+        sshbuf_free(p1);
+        free(s);
+        TEST_DONE();
+
+        TEST_START("sshbuf_fromb ");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_U_INT_EQ(sshbuf_refcount(p1), 1);
+        ASSERT_PTR_EQ(sshbuf_parent(p1), NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, test_buf, sizeof(test_buf) - 1), 0);
+        p2 = sshbuf_fromb(p1);
+        ASSERT_PTR_NE(p2, NULL);
+        ASSERT_U_INT_EQ(sshbuf_refcount(p1), 2);
+        ASSERT_PTR_EQ(sshbuf_parent(p1), NULL);
+        ASSERT_PTR_EQ(sshbuf_parent(p2), p1);
+        ASSERT_PTR_EQ(sshbuf_ptr(p2), sshbuf_ptr(p1));
+        ASSERT_PTR_NE(sshbuf_ptr(p1), NULL);
+        ASSERT_PTR_NE(sshbuf_ptr(p2), NULL);
+        ASSERT_PTR_EQ(sshbuf_mutable_ptr(p1), NULL);
+        ASSERT_PTR_EQ(sshbuf_mutable_ptr(p2), NULL);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sshbuf_len(p2));
+        ASSERT_INT_EQ(sshbuf_get_u8(p2, &c), 0);
+        ASSERT_PTR_EQ(sshbuf_ptr(p2), sshbuf_ptr(p1) + 1);
+        ASSERT_U8_EQ(c, 1);
+        ASSERT_INT_EQ(sshbuf_get_u32(p2, &i), 0);
+        ASSERT_PTR_EQ(sshbuf_ptr(p2), sshbuf_ptr(p1) + 5);
+        ASSERT_U32_EQ(i, 0x12345678);
+        ASSERT_INT_EQ(sshbuf_get_cstring(p2, &s, &l), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p2), 0);
+        ASSERT_STRING_EQ(s, "hello");
+        ASSERT_SIZE_T_EQ(l, 5);
+        sshbuf_free(p1);
+        ASSERT_U_INT_EQ(sshbuf_refcount(p1), 1);
+        sshbuf_free(p2);
+        free(s);
+        TEST_DONE();
+
+        TEST_START("sshbuf_froms");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x01), 0);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0x12345678), 0);
+        ASSERT_INT_EQ(sshbuf_put_cstring(p1, "hello"), 0);
+        p2 = sshbuf_new();
+        ASSERT_PTR_NE(p2, NULL);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(test_buf) - 1);
+        ASSERT_INT_EQ(sshbuf_put_stringb(p2, p1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p2), sizeof(test_buf) + 4 - 1);
+        ASSERT_INT_EQ(sshbuf_froms(p2, &p3), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p2), 0);
+        ASSERT_PTR_NE(p3, NULL);
+        ASSERT_PTR_NE(sshbuf_ptr(p3), NULL);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p3), sizeof(test_buf) - 1);
+        ASSERT_MEM_EQ(sshbuf_ptr(p3), test_buf, sizeof(test_buf) - 1);
+        sshbuf_free(p3);
+        ASSERT_INT_EQ(sshbuf_put_stringb(p2, p1), 0);
+        ASSERT_INT_EQ(sshbuf_consume_end(p2, 1), 0);
+        ASSERT_INT_EQ(sshbuf_froms(p2, &p3), SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_PTR_EQ(p3, NULL);
+        sshbuf_free(p2);
+        sshbuf_free(p1);
+}
diff --git a/regress/unittests/sshbuf/test_sshbuf_fuzz.c b/regress/unittests/sshbuf/test_sshbuf_fuzz.c
new file mode 100644
index 000000000..c52376b53
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf_fuzz.c
@@ -0,0 +1,127 @@
+/*      $OpenBSD: test_sshbuf_fuzz.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include "../test_helper/test_helper.h"
+
+#include "ssherr.h"
+#include "sshbuf.h"
+
+#define NUM_FUZZ_TESTS (1 << 18)
+
+void sshbuf_fuzz_tests(void);
+
+void
+sshbuf_fuzz_tests(void)
+{
+        struct sshbuf *p1;
+        u_char *dp;
+        size_t sz, sz2, i;
+        u_int32_t r;
+        int ret;
+
+        /* NB. uses sshbuf internals */
+        TEST_START("fuzz alloc/dealloc");
+        p1 = sshbuf_new();
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 16 * 1024), 0);
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_PTR_NE(sshbuf_ptr(p1), NULL);
+        ASSERT_MEM_ZERO_NE(sshbuf_ptr(p1), sshbuf_len(p1));
+        for (i = 0; i < NUM_FUZZ_TESTS; i++) {
+                r = arc4random_uniform(10);
+                if (r == 0) {
+                        /* 10% chance: small reserve */
+                        r = arc4random_uniform(10);
+ fuzz_reserve:
+                        sz = sshbuf_avail(p1);
+                        sz2 = sshbuf_len(p1);
+                        ret = sshbuf_reserve(p1, r, &dp);
+                        if (ret < 0) {
+                                ASSERT_PTR_EQ(dp, NULL);
+                                ASSERT_SIZE_T_LT(sz, r);
+                                ASSERT_SIZE_T_EQ(sshbuf_avail(p1), sz);
+                                ASSERT_SIZE_T_EQ(sshbuf_len(p1), sz2);
+                        } else {
+                                ASSERT_PTR_NE(dp, NULL);
+                                ASSERT_SIZE_T_GE(sz, r);
+                                ASSERT_SIZE_T_EQ(sshbuf_avail(p1), sz - r);
+                                ASSERT_SIZE_T_EQ(sshbuf_len(p1), sz2 + r);
+                                memset(dp, arc4random_uniform(255) + 1, r);
+                        }
+                } else if (r < 3) {
+                        /* 20% chance: big reserve */
+                        r = arc4random_uniform(8 * 1024);
+                        goto fuzz_reserve;
+                } else if (r == 3) {
+                        /* 10% chance: small consume */
+                        r = arc4random_uniform(10);
+ fuzz_consume:
+                        sz = sshbuf_avail(p1);
+                        sz2 = sshbuf_len(p1);
+                        /* 50% change consume from end, otherwise start */
+                        ret = ((arc4random() & 1) ?
+                            sshbuf_consume : sshbuf_consume_end)(p1, r);
+                        if (ret < 0) {
+                                ASSERT_SIZE_T_LT(sz2, r);
+                                ASSERT_SIZE_T_EQ(sshbuf_avail(p1), sz);
+                                ASSERT_SIZE_T_EQ(sshbuf_len(p1), sz2);
+                        } else {
+                                ASSERT_SIZE_T_GE(sz2, r);
+                                ASSERT_SIZE_T_EQ(sshbuf_avail(p1), sz + r);
+                                ASSERT_SIZE_T_EQ(sshbuf_len(p1), sz2 - r);
+                        }
+                } else if (r < 8) {
+                        /* 40% chance: big consume */
+                        r = arc4random_uniform(2 * 1024);
+                        goto fuzz_consume;
+                } else if (r == 8) {
+                        /* 10% chance: reset max size */
+                        r = arc4random_uniform(16 * 1024);
+                        sz = sshbuf_max_size(p1);
+                        if (sshbuf_set_max_size(p1, r) < 0)
+                                ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), sz);
+                        else
+                                ASSERT_SIZE_T_EQ(sshbuf_max_size(p1), r);
+                } else {
+                        if (arc4random_uniform(8192) == 0) {
+                                /* tiny chance: new buffer */
+                                ASSERT_PTR_NE(sshbuf_ptr(p1), NULL);
+                                ASSERT_MEM_ZERO_NE(sshbuf_ptr(p1), sshbuf_len(p1));
+                                sshbuf_free(p1);
+                                p1 = sshbuf_new();
+                                ASSERT_PTR_NE(p1, NULL);
+                                ASSERT_INT_EQ(sshbuf_set_max_size(p1,
+                                    16 * 1024), 0);
+                        } else {
+                                /* Almost 10%: giant reserve */
+                                /* use arc4random_buf for r > 2^32 on 64 bit */
+                                arc4random_buf(&r, sizeof(r));
+                                while (r < SSHBUF_SIZE_MAX / 2) {
+                                        r <<= 1;
+                                        r |= arc4random() & 1;
+                                }
+                                goto fuzz_reserve;
+                        }
+                }
+                ASSERT_PTR_NE(sshbuf_ptr(p1), NULL);
+                ASSERT_SIZE_T_LE(sshbuf_max_size(p1), 16 * 1024);
+        }
+        ASSERT_PTR_NE(sshbuf_ptr(p1), NULL);
+        ASSERT_MEM_ZERO_NE(sshbuf_ptr(p1), sshbuf_len(p1));
+        sshbuf_free(p1);
+        TEST_DONE();
+}
diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_basic.c b/regress/unittests/sshbuf/test_sshbuf_getput_basic.c
new file mode 100644
index 000000000..966e8432b
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf_getput_basic.c
@@ -0,0 +1,484 @@
+/*      $OpenBSD: test_sshbuf_getput_basic.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include "../test_helper/test_helper.h"
+#include "ssherr.h"
+#include "sshbuf.h"
+
+void sshbuf_getput_basic_tests(void);
+
+void
+sshbuf_getput_basic_tests(void)
+{
+        struct sshbuf *p1, *p2;
+        const u_char *cd;
+        u_char *d, d2[32], x[] = {
+                0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x00, 0x99
+        };
+        u_int64_t v64;
+        u_int32_t v32;
+        u_int16_t v16;
+        u_char v8;
+        size_t s;
+        char *s2;
+        int r;
+        u_char bn1[] = { 0x00, 0x00, 0x00 };
+        u_char bn2[] = { 0x00, 0x00, 0x01, 0x02 };
+        u_char bn3[] = { 0x00, 0x80, 0x09 };
+        u_char bn_exp1[] = { 0x00, 0x00, 0x00, 0x00 };
+        u_char bn_exp2[] = { 0x00, 0x00, 0x00, 0x02, 0x01, 0x02 };
+        u_char bn_exp3[] = { 0x00, 0x00, 0x00, 0x03, 0x00, 0x80, 0x09 };
+
+        TEST_START("PEEK_U64");
+        ASSERT_U64_EQ(PEEK_U64(x), 0x1122334455667788ULL);
+        TEST_DONE();
+
+        TEST_START("PEEK_U32");
+        ASSERT_U32_EQ(PEEK_U32(x), 0x11223344);
+        TEST_DONE();
+
+        TEST_START("PEEK_U16");
+        ASSERT_U16_EQ(PEEK_U16(x), 0x1122);
+        TEST_DONE();
+
+        TEST_START("POKE_U64");
+        bzero(d2, sizeof(d2));
+        POKE_U64(d2, 0x1122334455667788ULL);
+        ASSERT_MEM_EQ(d2, x, 8);
+        TEST_DONE();
+        
+        TEST_START("POKE_U32");
+        bzero(d2, sizeof(d2));
+        POKE_U32(d2, 0x11223344);
+        ASSERT_MEM_EQ(d2, x, 4);
+        TEST_DONE();
+        
+        TEST_START("POKE_U16");
+        bzero(d2, sizeof(d2));
+        POKE_U16(d2, 0x1122);
+        ASSERT_MEM_EQ(d2, x, 2);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, 5), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 5);
+        cd = sshbuf_ptr(p1);
+        ASSERT_PTR_NE(cd, NULL);
+        ASSERT_U8_EQ(cd[0], 0x11);
+        ASSERT_U8_EQ(cd[1], 0x22);
+        ASSERT_U8_EQ(cd[2], 0x33);
+        ASSERT_U8_EQ(cd[3], 0x44);
+        ASSERT_U8_EQ(cd[4], 0x55);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get");
+        ASSERT_INT_EQ(sshbuf_get(p1, d2, 4), 0);
+        ASSERT_MEM_EQ(d2, x, 4);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        ASSERT_U8_EQ(*(sshbuf_ptr(p1)), 0x55);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get truncated");
+        r = sshbuf_get(p1, d2, 4);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        ASSERT_U8_EQ(*(sshbuf_ptr(p1)), 0x55);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put truncated");
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 4), 0);
+        r = sshbuf_put(p1, x, 5);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u64");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, 10), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 10);
+        ASSERT_INT_EQ(sshbuf_get_u64(p1, &v64), 0);
+        ASSERT_U64_EQ(v64, 0x1122334455667788ULL);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u64 truncated");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        r = sshbuf_get_u64(p1, &v64);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u32");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, 10), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 10);
+        ASSERT_INT_EQ(sshbuf_get_u32(p1, &v32), 0);
+        ASSERT_U32_EQ(v32, 0x11223344);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 6);
+        ASSERT_INT_EQ(sshbuf_get_u32(p1, &v32), 0);
+        ASSERT_U32_EQ(v32, 0x55667788);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u32 truncated");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        r = sshbuf_get_u32(p1, &v32);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u16");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, 9), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 9);
+        ASSERT_INT_EQ(sshbuf_get_u16(p1, &v16), 0);
+        ASSERT_U16_EQ(v16, 0x1122);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 7);
+        ASSERT_INT_EQ(sshbuf_get_u16(p1, &v16), 0);
+        ASSERT_U16_EQ(v16, 0x3344);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 5);
+        ASSERT_INT_EQ(sshbuf_get_u16(p1, &v16), 0);
+        ASSERT_U16_EQ(v16, 0x5566);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 3);
+        ASSERT_INT_EQ(sshbuf_get_u16(p1, &v16), 0);
+        ASSERT_U16_EQ(v16, 0x7788);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u16 truncated");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        r = sshbuf_get_u16(p1, &v16);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u8");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, 2), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        ASSERT_INT_EQ(sshbuf_get_u8(p1, &v8), 0);
+        ASSERT_U8_EQ(v8, 0x11);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        ASSERT_INT_EQ(sshbuf_get_u8(p1, &v8), 0);
+        ASSERT_U8_EQ(v8, 0x22);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_u8 truncated");
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        r = sshbuf_get_u8(p1, &v8);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u64");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u64(p1, 0x1122334455667788ULL), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 8);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), x, 8);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u64 exact");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 8), 0);
+        ASSERT_INT_EQ(sshbuf_put_u64(p1, 0x1122334455667788ULL), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 8);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), x, 8);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u64 limited");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 7), 0);
+        r = sshbuf_put_u64(p1, 0x1122334455667788ULL);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+        
+        TEST_START("sshbuf_put_u32");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0x11223344), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), x, 4);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u32 exact");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 4), 0);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0x11223344), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), x, 4);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u32 limited");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 3), 0);
+        r = sshbuf_put_u32(p1, 0x11223344);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+        
+        TEST_START("sshbuf_put_u16");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0x1122), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), x, 2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u16");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 2), 0);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0x1122), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), x, 2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_u16 limited");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, 1), 0);
+        r = sshbuf_put_u16(p1, 0x1122);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_string");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4 + 4);
+        ASSERT_INT_EQ(sshbuf_get_string(p1, &d, &s), 0);
+        ASSERT_SIZE_T_EQ(s, sizeof(x));
+        ASSERT_MEM_EQ(d, x, sizeof(x));
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        free(d);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_string exact");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(x) + 4), 0);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        ASSERT_INT_EQ(sshbuf_get_string(p1, &d, &s), 0);
+        ASSERT_SIZE_T_EQ(s, sizeof(x));
+        ASSERT_MEM_EQ(d, x, sizeof(x));
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        free(d);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_string truncated");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        ASSERT_INT_EQ(sshbuf_consume_end(p1, 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 3);
+        r = sshbuf_get_string(p1, &d, &s);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 3);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_string giant");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0xffffffff), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        r = sshbuf_get_string(p1, &d, &s);
+        ASSERT_INT_EQ(r, SSH_ERR_STRING_TOO_LARGE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_cstring giant");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0xffffffff), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        r = sshbuf_get_cstring(p1, &s2, &s);
+        ASSERT_INT_EQ(r, SSH_ERR_STRING_TOO_LARGE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_cstring embedded \\0");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        r = sshbuf_get_cstring(p1, &s2, NULL);
+        ASSERT_INT_EQ(r, SSH_ERR_INVALID_FORMAT);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_cstring trailing \\0");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, sizeof(x) - 1), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x) - 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4 - 1);
+        ASSERT_INT_EQ(sshbuf_get_cstring(p1, &s2, &s), 0);
+        ASSERT_SIZE_T_EQ(s, sizeof(x) - 1);
+        ASSERT_MEM_EQ(s2, x, s);
+        free(s2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_string");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_string(p1, x, sizeof(x)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(x) + 4);
+        ASSERT_U32_EQ(PEEK_U32(sshbuf_ptr(p1)), sizeof(x));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1) + 4, x, sizeof(x));
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_string limited");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(x) + 4 - 1), 0);
+        r = sshbuf_put_string(p1, x, sizeof(x));
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_string giant");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        r = sshbuf_put_string(p1, (void *)0x01, 0xfffffffc);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_putf");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        r = sshbuf_putf(p1, "%s %d %x", "hello", 23, 0x5f);
+        ASSERT_INT_EQ(r, 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 11);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), "hello 23 5f", 11);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_putb");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        p2 = sshbuf_new();
+        ASSERT_PTR_NE(p2, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, "blahblahblah", 12), 0);
+        ASSERT_INT_EQ(sshbuf_putb(p2, p1), 0);
+        sshbuf_free(p1);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p2), 12);
+        ASSERT_MEM_EQ(sshbuf_ptr(p2), "blahblahblah", 12);
+        sshbuf_free(p2);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2_bytes empty buf");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2_bytes(p1, NULL, 0), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(bn_exp1));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp1, sizeof(bn_exp1));
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2_bytes all zeroes");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2_bytes(p1, bn1, sizeof(bn1)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(bn_exp1));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp1, sizeof(bn_exp1));
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2_bytes simple");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2_bytes(p1, bn2+2, sizeof(bn2)-2), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(bn_exp2));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp2, sizeof(bn_exp2));
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2_bytes leading zero");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2_bytes(p1, bn2, sizeof(bn2)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(bn_exp2));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp2, sizeof(bn_exp2));
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2_bytes neg");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2_bytes(p1, bn3+1, sizeof(bn3)-1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(bn_exp3));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp3, sizeof(bn_exp3));
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2_bytes neg and leading zero");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2_bytes(p1, bn3, sizeof(bn3)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(bn_exp3));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp3, sizeof(bn_exp3));
+        sshbuf_free(p1);
+        TEST_DONE();
+}
diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c b/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c
new file mode 100644
index 000000000..0c4c71ecd
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c
@@ -0,0 +1,409 @@
+/*      $OpenBSD: test_sshbuf_getput_crypto.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/bn.h>
+#include <openssl/objects.h>
+#ifdef OPENSSL_HAS_NISTP256
+# include <openssl/ec.h>
+#endif
+
+#include "../test_helper/test_helper.h"
+#include "ssherr.h"
+#include "sshbuf.h"
+
+void sshbuf_getput_crypto_tests(void);
+
+void
+sshbuf_getput_crypto_tests(void)
+{
+        struct sshbuf *p1;
+        const u_char *d;
+        size_t s;
+        BIGNUM *bn, *bn2;
+        /* This one has num_bits != num_bytes * 8 to test bignum1 encoding */
+        const char *hexbn1 = "0102030405060708090a0b0c0d0e0f10";
+        /* This one has MSB set to test bignum2 encoding negative-avoidance */
+        const char *hexbn2 = "f0e0d0c0b0a0908070605040302010007fff11";
+        u_char expbn1[] = {
+                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+                0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
+        };
+        u_char expbn2[] = {
+                0xf0, 0xe0, 0xd0, 0xc0, 0xb0, 0xa0, 0x90, 0x80,
+                0x70, 0x60, 0x50, 0x40, 0x30, 0x20, 0x10, 0x00,
+                0x7f, 0xff, 0x11
+        };
+#ifdef OPENSSL_HAS_NISTP256
+        BIGNUM *bn_x, *bn_y;
+        int ec256_nid = NID_X9_62_prime256v1;
+        char *ec256_x = "0C828004839D0106AA59575216191357"
+                        "34B451459DADB586677EF9DF55784999";
+        char *ec256_y = "4D196B50F0B4E94B3C73E3A9D4CD9DF2"
+                        "C8F9A35E42BDD047550F69D80EC23CD4";
+        u_char expec256[] = {
+                0x04,
+                0x0c, 0x82, 0x80, 0x04, 0x83, 0x9d, 0x01, 0x06,
+                0xaa, 0x59, 0x57, 0x52, 0x16, 0x19, 0x13, 0x57,
+                0x34, 0xb4, 0x51, 0x45, 0x9d, 0xad, 0xb5, 0x86,
+                0x67, 0x7e, 0xf9, 0xdf, 0x55, 0x78, 0x49, 0x99,
+                0x4d, 0x19, 0x6b, 0x50, 0xf0, 0xb4, 0xe9, 0x4b,
+                0x3c, 0x73, 0xe3, 0xa9, 0xd4, 0xcd, 0x9d, 0xf2,
+                0xc8, 0xf9, 0xa3, 0x5e, 0x42, 0xbd, 0xd0, 0x47,
+                0x55, 0x0f, 0x69, 0xd8, 0x0e, 0xc2, 0x3c, 0xd4
+        };
+        EC_KEY *eck;
+        EC_POINT *ecp;
+#endif
+        int r;
+
+#define MKBN(b, bnn) \
+        do { \
+                bnn = NULL; \
+                ASSERT_INT_GT(BN_hex2bn(&bnn, b), 0); \
+        } while (0)
+
+        TEST_START("sshbuf_put_bignum1");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum1(p1, bn), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn1) + 2);
+        ASSERT_U16_EQ(PEEK_U16(sshbuf_ptr(p1)), (u_int16_t)BN_num_bits(bn));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1) + 2, expbn1, sizeof(expbn1));
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum1 limited");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(expbn1) + 1), 0);
+        r = sshbuf_put_bignum1(p1, bn);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum1 bn2");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum1(p1, bn), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 2);
+        ASSERT_U16_EQ(PEEK_U16(sshbuf_ptr(p1)), (u_int16_t)BN_num_bits(bn));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1) + 2, expbn2, sizeof(expbn2));
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum1 bn2 limited");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(expbn1) + 1), 0);
+        r = sshbuf_put_bignum1(p1, bn);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2(p1, bn), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn1) + 4);
+        ASSERT_U32_EQ(PEEK_U32(sshbuf_ptr(p1)), (u_int32_t)BN_num_bytes(bn));
+        ASSERT_MEM_EQ(sshbuf_ptr(p1) + 4, expbn1, sizeof(expbn1));
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2 limited");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(expbn1) + 3), 0);
+        r = sshbuf_put_bignum2(p1, bn);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2 bn2");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_bignum2(p1, bn), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 4 + 1); /* MSB */
+        ASSERT_U32_EQ(PEEK_U32(sshbuf_ptr(p1)), (u_int32_t)BN_num_bytes(bn) + 1);
+        ASSERT_U8_EQ(*(sshbuf_ptr(p1) + 4), 0x00);
+        ASSERT_MEM_EQ(sshbuf_ptr(p1) + 5, expbn2, sizeof(expbn2));
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_put_bignum2 bn2 limited");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(expbn2) + 3), 0);
+        r = sshbuf_put_bignum2(p1, bn);
+        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
+        BN_free(bn);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum1");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn1));
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0);
+        bn2 = BN_new();
+        ASSERT_INT_EQ(sshbuf_get_bignum1(p1, bn2), 0);
+        ASSERT_BIGNUM_EQ(bn, bn2);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum1 truncated");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1) - 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn1) - 1);
+        bn2 = BN_new();
+        r = sshbuf_get_bignum1(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn1) - 1);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum1 giant");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xffff), 0);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, (0xffff + 7) / 8, NULL), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + ((0xffff + 7) / 8));
+        bn2 = BN_new();
+        r = sshbuf_get_bignum1(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_BIGNUM_TOO_LARGE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + ((0xffff + 7) / 8));
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum1 bn2");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn2));
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0);
+        bn2 = BN_new();
+        ASSERT_INT_EQ(sshbuf_get_bignum1(p1, bn2), 0);
+        ASSERT_BIGNUM_EQ(bn, bn2);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum1 bn2 truncated");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2) - 1), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn2) - 1);
+        bn2 = BN_new();
+        r = sshbuf_get_bignum1(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn2) - 1);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum2");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4 + sizeof(expbn1));
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0);
+        bn2 = BN_new();
+        ASSERT_INT_EQ(sshbuf_get_bignum2(p1, bn2), 0);
+        ASSERT_BIGNUM_EQ(bn, bn2);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum2 truncated");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1) - 1), 0);
+        bn2 = BN_new();
+        r = sshbuf_get_bignum2(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn1) + 3);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum2 giant");
+        MKBN(hexbn1, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 65536), 0);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 65536, NULL), 0);
+        bn2 = BN_new();
+        r = sshbuf_get_bignum2(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_BIGNUM_TOO_LARGE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 65536 + 4);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum2 bn2");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn) + 1), 0); /* MSB */
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x00), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4 + 1 + sizeof(expbn2));
+        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0);
+        bn2 = BN_new();
+        ASSERT_INT_EQ(sshbuf_get_bignum2(p1, bn2), 0);
+        ASSERT_BIGNUM_EQ(bn, bn2);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum2 bn2 truncated");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn) + 1), 0);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x00), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2) - 1), 0);
+        bn2 = BN_new();
+        r = sshbuf_get_bignum2(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 1 + 4 - 1);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_bignum2 bn2 negative");
+        MKBN(hexbn2, bn);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn)), 0);
+        ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2)), 0);
+        bn2 = BN_new();
+        r = sshbuf_get_bignum2(p1, bn2);
+        ASSERT_INT_EQ(r, SSH_ERR_BIGNUM_IS_NEGATIVE);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 4);
+        BN_free(bn);
+        BN_free(bn2);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+#ifdef OPENSSL_HAS_NISTP256
+        TEST_START("sshbuf_put_ec");
+        eck = EC_KEY_new_by_curve_name(ec256_nid);
+        ASSERT_PTR_NE(eck, NULL);
+        ecp = EC_POINT_new(EC_KEY_get0_group(eck));
+        ASSERT_PTR_NE(ecp, NULL);
+        MKBN(ec256_x, bn_x);
+        MKBN(ec256_y, bn_y);
+        ASSERT_INT_EQ(EC_POINT_set_affine_coordinates_GFp(
+            EC_KEY_get0_group(eck), ecp, bn_x, bn_y, NULL), 1);
+        ASSERT_INT_EQ(EC_KEY_set_public_key(eck, ecp), 1);
+        BN_free(bn_x);
+        BN_free(bn_y);
+        EC_POINT_free(ecp);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_eckey(p1, eck), 0);
+        ASSERT_INT_EQ(sshbuf_get_string_direct(p1, &d, &s), 0);
+        ASSERT_SIZE_T_EQ(s, sizeof(expec256));
+        ASSERT_MEM_EQ(d, expec256, sizeof(expec256));
+        sshbuf_free(p1);
+        EC_KEY_free(eck);
+        TEST_DONE();
+
+        TEST_START("sshbuf_get_ec");
+        eck = EC_KEY_new_by_curve_name(ec256_nid);
+        ASSERT_PTR_NE(eck, NULL);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_string(p1, expec256, sizeof(expec256)), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expec256) + 4);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x00), 0);
+        ASSERT_INT_EQ(sshbuf_get_eckey(p1, eck), 0);
+        bn_x = BN_new();
+        bn_y = BN_new();
+        ASSERT_PTR_NE(bn_x, NULL);
+        ASSERT_PTR_NE(bn_y, NULL);
+        ASSERT_INT_EQ(EC_POINT_get_affine_coordinates_GFp(
+            EC_KEY_get0_group(eck), EC_KEY_get0_public_key(eck),
+            bn_x, bn_y, NULL), 1);
+        MKBN(ec256_x, bn);
+        MKBN(ec256_y, bn2);
+        ASSERT_INT_EQ(BN_cmp(bn_x, bn), 0);
+        ASSERT_INT_EQ(BN_cmp(bn_y, bn2), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        sshbuf_free(p1);
+        EC_KEY_free(eck);
+        BN_free(bn_x);
+        BN_free(bn_y);
+        BN_free(bn);
+        BN_free(bn2);
+        TEST_DONE();
+#endif
+}
+
diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c b/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c
new file mode 100644
index 000000000..8c3269b13
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c
@@ -0,0 +1,130 @@
+/*      $OpenBSD: test_sshbuf_getput_fuzz.c,v 1.2 2014/05/02 02:54:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/bn.h>
+#include <openssl/objects.h>
+#ifdef OPENSSL_HAS_NISTP256
+# include <openssl/ec.h>
+#endif
+
+#include "../test_helper/test_helper.h"
+#include "ssherr.h"
+#include "sshbuf.h"
+
+void sshbuf_getput_fuzz_tests(void);
+
+static void
+attempt_parse_blob(u_char *blob, size_t len)
+{
+        struct sshbuf *p1;
+        BIGNUM *bn;
+#ifdef OPENSSL_HAS_NISTP256
+        EC_KEY *eck;
+#endif
+        u_char *s;
+        size_t l;
+        u_int8_t u8;
+        u_int16_t u16;
+        u_int32_t u32;
+        u_int64_t u64;
+
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, blob, len), 0);
+        sshbuf_get_u8(p1, &u8);
+        sshbuf_get_u16(p1, &u16);
+        sshbuf_get_u32(p1, &u32);
+        sshbuf_get_u64(p1, &u64);
+        if (sshbuf_get_string(p1, &s, &l) == 0) {
+                bzero(s, l);
+                free(s);
+        }
+        bn = BN_new();
+        sshbuf_get_bignum1(p1, bn);
+        BN_clear_free(bn);
+        bn = BN_new();
+        sshbuf_get_bignum2(p1, bn);
+        BN_clear_free(bn);
+#ifdef OPENSSL_HAS_NISTP256
+        eck = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+        ASSERT_PTR_NE(eck, NULL);
+        sshbuf_get_eckey(p1, eck);
+        EC_KEY_free(eck);
+#endif
+        sshbuf_free(p1);
+}
+
+
+static void
+onerror(void *fuzz)
+{
+        fprintf(stderr, "Failed during fuzz:\n");
+        fuzz_dump((struct fuzz *)fuzz);
+}
+
+void
+sshbuf_getput_fuzz_tests(void)
+{
+        u_char blob[] = {
+                /* u8 */
+                0xd0,
+                /* u16 */
+                0xc0, 0xde,
+                /* u32 */
+                0xfa, 0xce, 0xde, 0xad,
+                /* u64 */
+                0xfe, 0xed, 0xac, 0x1d, 0x1f, 0x1c, 0xbe, 0xef,
+                /* string */
+                0x00, 0x00, 0x00, 0x09,
+                'O', ' ', 'G', 'o', 'r', 'g', 'o', 'n', '!',
+                /* bignum1 */
+                0x79,
+                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+                0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
+                /* bignum2 */
+                0x00, 0x00, 0x00, 0x14,
+                0x00,
+                0xf0, 0xe0, 0xd0, 0xc0, 0xb0, 0xa0, 0x90, 0x80,
+                0x70, 0x60, 0x50, 0x40, 0x30, 0x20, 0x10, 0x00,
+                0x7f, 0xff, 0x11,
+                /* EC point (NIST-256 curve) */
+                0x00, 0x00, 0x00, 0x41,
+                0x04,
+                0x0c, 0x82, 0x80, 0x04, 0x83, 0x9d, 0x01, 0x06,
+                0xaa, 0x59, 0x57, 0x52, 0x16, 0x19, 0x13, 0x57,
+                0x34, 0xb4, 0x51, 0x45, 0x9d, 0xad, 0xb5, 0x86,
+                0x67, 0x7e, 0xf9, 0xdf, 0x55, 0x78, 0x49, 0x99,
+                0x4d, 0x19, 0x6b, 0x50, 0xf0, 0xb4, 0xe9, 0x4b,
+                0x3c, 0x73, 0xe3, 0xa9, 0xd4, 0xcd, 0x9d, 0xf2,
+                0xc8, 0xf9, 0xa3, 0x5e, 0x42, 0xbd, 0xd0, 0x47,
+                0x55, 0x0f, 0x69, 0xd8, 0x0e, 0xc2, 0x3c, 0xd4,
+        };
+        struct fuzz *fuzz;
+
+        TEST_START("fuzz blob parsing");
+        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | FUZZ_2_BIT_FLIP |
+            FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP |
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END, blob, sizeof(blob));
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz))
+                attempt_parse_blob(blob, sizeof(blob));
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+        TEST_ONERROR(NULL, NULL);
+}
+
diff --git a/regress/unittests/sshbuf/test_sshbuf_misc.c b/regress/unittests/sshbuf/test_sshbuf_misc.c
new file mode 100644
index 000000000..f155491a0
--- /dev/null
+++ b/regress/unittests/sshbuf/test_sshbuf_misc.c
@@ -0,0 +1,138 @@
+/*      $OpenBSD: test_sshbuf_misc.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include "../test_helper/test_helper.h"
+
+#include "sshbuf.h"
+
+void sshbuf_misc_tests(void);
+
+void
+sshbuf_misc_tests(void)
+{
+        struct sshbuf *p1;
+        char tmp[512], *p;
+        FILE *out;
+        size_t sz;
+
+        TEST_START("sshbuf_dump");
+        out = tmpfile();
+        ASSERT_PTR_NE(out, NULL);
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0x12345678), 0);
+        sshbuf_dump(p1, out);
+        fflush(out);
+        rewind(out);
+        sz = fread(tmp, 1, sizeof(tmp), out);
+        ASSERT_INT_EQ(ferror(out), 0);
+        ASSERT_INT_NE(feof(out), 0);
+        ASSERT_SIZE_T_GT(sz, 0);
+        tmp[sz] = '\0';
+        ASSERT_PTR_NE(strstr(tmp, "12 34 56 78"), NULL);
+        fclose(out);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_dtob16");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u32(p1, 0x12345678), 0);
+        p = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(p, NULL);
+        ASSERT_STRING_EQ(p, "12345678");
+        free(p);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_dtob64 len 1");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x11), 0);
+        p = sshbuf_dtob64(p1);
+        ASSERT_PTR_NE(p, NULL);
+        ASSERT_STRING_EQ(p, "EQ==");
+        free(p);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_dtob64 len 2");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x11), 0);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x22), 0);
+        p = sshbuf_dtob64(p1);
+        ASSERT_PTR_NE(p, NULL);
+        ASSERT_STRING_EQ(p, "ESI=");
+        free(p);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_dtob64 len 3");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x11), 0);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x22), 0);
+        ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x33), 0);
+        p = sshbuf_dtob64(p1);
+        ASSERT_PTR_NE(p, NULL);
+        ASSERT_STRING_EQ(p, "ESIz");
+        free(p);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_dtob64 len 8191");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 8192, NULL), 0);
+        bzero(sshbuf_mutable_ptr(p1), 8192);
+        p = sshbuf_dtob64(p1);
+        ASSERT_PTR_NE(p, NULL);
+        ASSERT_SIZE_T_EQ(strlen(p), ((8191 + 2) / 3) * 4);
+        free(p);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_b64tod len 1");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_b64tod(p1, "0A=="), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 1);
+        ASSERT_U8_EQ(*sshbuf_ptr(p1), 0xd0);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_b64tod len 2");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_b64tod(p1, "0A8="), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
+        ASSERT_U16_EQ(PEEK_U16(sshbuf_ptr(p1)), 0xd00f);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_b64tod len 4");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_b64tod(p1, "0A/QDw=="), 0);
+        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4);
+        ASSERT_U32_EQ(PEEK_U32(sshbuf_ptr(p1)), 0xd00fd00f);
+        sshbuf_free(p1);
+        TEST_DONE();
+}
+
diff --git a/regress/unittests/sshbuf/tests.c b/regress/unittests/sshbuf/tests.c
new file mode 100644
index 000000000..1557e4342
--- /dev/null
+++ b/regress/unittests/sshbuf/tests.c
@@ -0,0 +1,28 @@
+/*      $OpenBSD: tests.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "../test_helper/test_helper.h"
+
+void sshbuf_tests(void);
+void sshbuf_getput_basic_tests(void);
+void sshbuf_getput_crypto_tests(void);
+void sshbuf_misc_tests(void);
+void sshbuf_fuzz_tests(void);
+void sshbuf_getput_fuzz_tests(void);
+void sshbuf_fixed(void);
+
+void
+tests(void)
+{
+        sshbuf_tests();
+        sshbuf_getput_basic_tests();
+        sshbuf_getput_crypto_tests();
+        sshbuf_misc_tests();
+        sshbuf_fuzz_tests();
+        sshbuf_getput_fuzz_tests();
+        sshbuf_fixed();
+}
diff --git a/regress/unittests/sshkey/Makefile b/regress/unittests/sshkey/Makefile
new file mode 100644
index 000000000..1bcd26676
--- /dev/null
+++ b/regress/unittests/sshkey/Makefile
@@ -0,0 +1,13 @@
+#       $OpenBSD: Makefile,v 1.1 2014/06/24 01:14:18 djm Exp $
+
+TEST_ENV=      "MALLOC_OPTIONS=AFGJPRX"
+
+PROG=test_sshkey
+SRCS=tests.c test_sshkey.c test_file.c test_fuzz.c common.c
+REGRESS_TARGETS=run-regress-${PROG}
+
+run-regress-${PROG}: ${PROG}
+        env ${TEST_ENV} ./${PROG} -d ${.CURDIR}/testdata
+
+.include <bsd.regress.mk>
+
diff --git a/regress/unittests/sshkey/common.c b/regress/unittests/sshkey/common.c
new file mode 100644
index 000000000..0a4b3a90c
--- /dev/null
+++ b/regress/unittests/sshkey/common.c
@@ -0,0 +1,84 @@
+/*      $OpenBSD: common.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/*
+ * Helpers for key API tests
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/dsa.h>
+#include <openssl/objects.h>
+#ifdef OPENSSL_HAS_NISTP256
+# include <openssl/ec.h>
+#endif
+
+#include "../test_helper/test_helper.h"
+
+#include "ssherr.h"
+#include "authfile.h"
+#include "sshkey.h"
+#include "sshbuf.h"
+
+#include "common.h"
+
+struct sshbuf *
+load_file(const char *name)
+{
+        int fd;
+        struct sshbuf *ret;
+
+        ASSERT_PTR_NE(ret = sshbuf_new(), NULL);
+        ASSERT_INT_NE(fd = open(test_data_file(name), O_RDONLY), -1);
+        ASSERT_INT_EQ(sshkey_load_file(fd, name, ret), 0);
+        close(fd);
+        return ret;
+}
+
+struct sshbuf *
+load_text_file(const char *name)
+{
+        struct sshbuf *ret = load_file(name);
+        const u_char *p;
+
+        /* Trim whitespace at EOL */
+        for (p = sshbuf_ptr(ret); sshbuf_len(ret) > 0;) {
+                if (p[sshbuf_len(ret) - 1] == '\r' ||
+                    p[sshbuf_len(ret) - 1] == '\t' ||
+                    p[sshbuf_len(ret) - 1] == ' ' ||
+                    p[sshbuf_len(ret) - 1] == '\n')
+                        ASSERT_INT_EQ(sshbuf_consume_end(ret, 1), 0);
+                else
+                        break;
+        }
+        /* \0 terminate */
+        ASSERT_INT_EQ(sshbuf_put_u8(ret, 0), 0);
+        return ret;
+}
+
+BIGNUM *
+load_bignum(const char *name)
+{
+        BIGNUM *ret = NULL;
+        struct sshbuf *buf;
+
+        buf = load_text_file(name);
+        ASSERT_INT_NE(BN_hex2bn(&ret, (const char *)sshbuf_ptr(buf)), 0);
+        sshbuf_free(buf);
+        return ret;
+}
+
diff --git a/regress/unittests/sshkey/common.h b/regress/unittests/sshkey/common.h
new file mode 100644
index 000000000..bf7d19dce
--- /dev/null
+++ b/regress/unittests/sshkey/common.h
@@ -0,0 +1,16 @@
+/*      $OpenBSD: common.h,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/*
+ * Helpers for key API tests
+ *
+ * Placed in the public domain
+ */
+
+/* Load a binary file into a buffer */
+struct sshbuf *load_file(const char *name);
+
+/* Load a text file into a buffer */
+struct sshbuf *load_text_file(const char *name);
+
+/* Load a bignum from a file */
+BIGNUM *load_bignum(const char *name);
+
diff --git a/regress/unittests/sshkey/mktestdata.sh b/regress/unittests/sshkey/mktestdata.sh
new file mode 100755
index 000000000..ee1fe3962
--- /dev/null
+++ b/regress/unittests/sshkey/mktestdata.sh
@@ -0,0 +1,190 @@
+#!/bin/sh
+# $OpenBSD: mktestdata.sh,v 1.3 2014/07/22 23:57:40 dtucker Exp $
+
+PW=mekmitasdigoat
+
+rsa1_params() {
+        _in="$1"
+        _outbase="$2"
+        set -e
+        ssh-keygen -f $_in -e -m pkcs8 | \
+            openssl rsa -noout -text -pubin | \
+            awk '/^Modulus:$/,/^Exponent:/' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.n
+        # XXX need conversion support in ssh-keygen for the other params
+        for x in n ; do
+                echo "" >> ${_outbase}.$x
+                echo ============ ${_outbase}.$x
+                cat ${_outbase}.$x
+                echo ============
+        done
+}
+
+rsa_params() {
+        _in="$1"
+        _outbase="$2"
+        set -e
+        openssl rsa -noout -text -in $_in | \
+            awk '/^modulus:$/,/^publicExponent:/' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.n
+        openssl rsa -noout -text -in $_in | \
+            awk '/^prime1:$/,/^prime2:/' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.p
+        openssl rsa -noout -text -in $_in | \
+            awk '/^prime2:$/,/^exponent1:/' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.q
+        for x in n p q ; do
+                echo "" >> ${_outbase}.$x
+                echo ============ ${_outbase}.$x
+                cat ${_outbase}.$x
+                echo ============
+        done
+}
+
+dsa_params() {
+        _in="$1"
+        _outbase="$2"
+        set -e
+        openssl dsa -noout -text -in $_in | \
+            awk '/^priv:$/,/^pub:/' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.priv
+        openssl dsa -noout -text -in $_in | \
+            awk '/^pub:/,/^P:/' | #\
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.pub
+        openssl dsa -noout -text -in $_in | \
+            awk '/^G:/,0' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.g
+        for x in priv pub g ; do
+                echo "" >> ${_outbase}.$x
+                echo ============ ${_outbase}.$x
+                cat ${_outbase}.$x
+                echo ============
+        done
+}
+
+ecdsa_params() {
+        _in="$1"
+        _outbase="$2"
+        set -e
+        openssl ec -noout -text -in $_in | \
+            awk '/^priv:$/,/^pub:/' | \
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.priv
+        openssl ec -noout -text -in $_in | \
+            awk '/^pub:/,/^ASN1 OID:/' | #\
+            grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.pub
+        openssl ec -noout -text -in $_in | \
+            grep "ASN1 OID:" | tr -d '\n' | \
+            sed 's/.*: //;s/ *$//' > ${_outbase}.curve
+        for x in priv pub curve ; do
+                echo "" >> ${_outbase}.$x
+                echo ============ ${_outbase}.$x
+                cat ${_outbase}.$x
+                echo ============
+        done
+}
+
+set -ex
+
+cd testdata
+
+rm -f rsa1_1 rsa_1 dsa_1 ecdsa_1 ed25519_1
+rm -f rsa1_2 rsa_2 dsa_2 ecdsa_2 ed25519_2
+rm -f rsa_n dsa_n ecdsa_n # new-format keys
+rm -f rsa1_1_pw rsa_1_pw dsa_1_pw ecdsa_1_pw ed25519_1_pw
+rm -f rsa_n_pw dsa_n_pw ecdsa_n_pw
+rm -f pw *.pub *.bn.* *.param.* *.fp *.fp.bb
+
+ssh-keygen -t rsa1 -b 768 -C "RSA1 test key #1" -N "" -f rsa1_1
+ssh-keygen -t rsa -b 768 -C "RSA test key #1" -N "" -f rsa_1
+ssh-keygen -t dsa -b 1024 -C "DSA test key #1" -N "" -f dsa_1
+ssh-keygen -t ecdsa -b 256 -C "ECDSA test key #1" -N "" -f ecdsa_1
+ssh-keygen -t ed25519 -C "ED25519 test key #1" -N "" -f ed25519_1
+
+ssh-keygen -t rsa1 -b 2048 -C "RSA1 test key #2" -N "" -f rsa1_2
+ssh-keygen -t rsa -b 2048 -C "RSA test key #2" -N "" -f rsa_2
+ssh-keygen -t dsa -b 1024 -C "DSA test key #2" -N "" -f dsa_2
+ssh-keygen -t ecdsa -b 521 -C "ECDSA test key #2" -N "" -f ecdsa_2
+ssh-keygen -t ed25519 -C "ED25519 test key #1" -N "" -f ed25519_2
+
+cp rsa_1 rsa_n
+cp dsa_1 dsa_n
+cp ecdsa_1 ecdsa_n
+
+cp rsa1_1 rsa1_1_pw
+cp rsa_1 rsa_1_pw
+cp dsa_1 dsa_1_pw
+cp ecdsa_1 ecdsa_1_pw
+cp ed25519_1 ed25519_1_pw
+cp rsa_1 rsa_n_pw
+cp dsa_1 dsa_n_pw
+cp ecdsa_1 ecdsa_n_pw
+
+ssh-keygen -pf rsa1_1_pw -N "$PW"
+ssh-keygen -pf rsa_1_pw -N "$PW"
+ssh-keygen -pf dsa_1_pw -N "$PW"
+ssh-keygen -pf ecdsa_1_pw -N "$PW"
+ssh-keygen -pf ed25519_1_pw -N "$PW"
+ssh-keygen -opf rsa_n_pw -N "$PW"
+ssh-keygen -opf dsa_n_pw -N "$PW"
+ssh-keygen -opf ecdsa_n_pw -N "$PW"
+
+rsa1_params rsa1_1 rsa1_1.param
+rsa1_params rsa1_2 rsa1_2.param
+rsa_params rsa_1 rsa_1.param
+rsa_params rsa_2 rsa_2.param
+dsa_params dsa_1 dsa_1.param
+dsa_params dsa_1 dsa_1.param
+ecdsa_params ecdsa_1 ecdsa_1.param
+ecdsa_params ecdsa_2 ecdsa_2.param
+# XXX ed25519 params
+
+ssh-keygen -s rsa_2 -I hugo -n user1,user2 \
+    -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \
+    -V 19990101:20110101 -z 1 rsa_1.pub
+ssh-keygen -s rsa_2 -I hugo -n user1,user2 \
+    -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \
+    -V 19990101:20110101 -z 2 dsa_1.pub
+ssh-keygen -s rsa_2 -I hugo -n user1,user2 \
+    -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \
+    -V 19990101:20110101 -z 3 ecdsa_1.pub
+ssh-keygen -s rsa_2 -I hugo -n user1,user2 \
+    -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \
+    -V 19990101:20110101 -z 4 ed25519_1.pub
+
+ssh-keygen -s ed25519_1 -I julius -n host1,host2 -h \
+    -V 19990101:20110101 -z 5 rsa_1.pub
+ssh-keygen -s ed25519_1 -I julius -n host1,host2 -h \
+    -V 19990101:20110101 -z 6 dsa_1.pub
+ssh-keygen -s ecdsa_1 -I julius -n host1,host2 -h \
+    -V 19990101:20110101 -z 7 ecdsa_1.pub
+ssh-keygen -s ed25519_1 -I julius -n host1,host2 -h \
+    -V 19990101:20110101 -z 8 ed25519_1.pub
+
+ssh-keygen -lf rsa1_1 | awk '{print $2}' > rsa1_1.fp
+ssh-keygen -lf rsa_1 | awk '{print $2}' > rsa_1.fp
+ssh-keygen -lf dsa_1 | awk '{print $2}' > dsa_1.fp
+ssh-keygen -lf ecdsa_1 | awk '{print $2}' > ecdsa_1.fp
+ssh-keygen -lf ed25519_1 | awk '{print $2}' > ed25519_1.fp
+ssh-keygen -lf rsa1_2 | awk '{print $2}' > rsa1_2.fp
+ssh-keygen -lf rsa_2 | awk '{print $2}' > rsa_2.fp
+ssh-keygen -lf dsa_2 | awk '{print $2}' > dsa_2.fp
+ssh-keygen -lf ecdsa_2 | awk '{print $2}' > ecdsa_2.fp
+ssh-keygen -lf ed25519_2 | awk '{print $2}' > ed25519_2.fp
+
+ssh-keygen -lf dsa_1-cert.pub  | awk '{print $2}' > dsa_1-cert.fp
+ssh-keygen -lf ecdsa_1-cert.pub  | awk '{print $2}' > ecdsa_1-cert.fp
+ssh-keygen -lf ed25519_1-cert.pub  | awk '{print $2}' > ed25519_1-cert.fp
+ssh-keygen -lf rsa_1-cert.pub  | awk '{print $2}' > rsa_1-cert.fp
+
+ssh-keygen -Bf rsa1_1 | awk '{print $2}' > rsa1_1.fp.bb
+ssh-keygen -Bf rsa_1 | awk '{print $2}' > rsa_1.fp.bb
+ssh-keygen -Bf dsa_1 | awk '{print $2}' > dsa_1.fp.bb
+ssh-keygen -Bf ecdsa_1 | awk '{print $2}' > ecdsa_1.fp.bb
+ssh-keygen -Bf ed25519_1 | awk '{print $2}' > ed25519_1.fp.bb
+ssh-keygen -Bf rsa1_2 | awk '{print $2}' > rsa1_2.fp.bb
+ssh-keygen -Bf rsa_2 | awk '{print $2}' > rsa_2.fp.bb
+ssh-keygen -Bf dsa_2 | awk '{print $2}' > dsa_2.fp.bb
+ssh-keygen -Bf ecdsa_2 | awk '{print $2}' > ecdsa_2.fp.bb
+ssh-keygen -Bf ed25519_2 | awk '{print $2}' > ed25519_2.fp.bb
+
+echo "$PW" > pw
diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c
new file mode 100644
index 000000000..764f7fb76
--- /dev/null
+++ b/regress/unittests/sshkey/test_file.c
@@ -0,0 +1,457 @@
+/*      $OpenBSD: test_file.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/*
+ * Regress test for sshkey.h key management API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/dsa.h>
+#include <openssl/objects.h>
+#ifdef OPENSSL_HAS_NISTP256
+# include <openssl/ec.h>
+#endif
+
+#include "../test_helper/test_helper.h"
+
+#include "ssherr.h"
+#include "authfile.h"
+#include "sshkey.h"
+#include "sshbuf.h"
+
+#include "common.h"
+
+void sshkey_file_tests(void);
+
+void
+sshkey_file_tests(void)
+{
+        struct sshkey *k1, *k2;
+        struct sshbuf *buf, *pw;
+        BIGNUM *a, *b, *c;
+        char *cp;
+
+        TEST_START("load passphrase");
+        pw = load_text_file("pw");
+        TEST_DONE();
+
+        TEST_START("parse RSA1 from private");
+        buf = load_file("rsa1_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "rsa1_1",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k1, NULL);
+        a = load_bignum("rsa1_1.param.n");
+        ASSERT_BIGNUM_EQ(k1->rsa->n, a);
+        BN_free(a);
+        TEST_DONE();
+
+        TEST_START("parse RSA1 from private w/ passphrase");
+        buf = load_file("rsa1_1_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "rsa1_1_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load RSA1 from public");
+        ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa1_1.pub"), &k2,
+            NULL), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("RSA1 key hex fingerprint");
+        buf = load_text_file("rsa1_1.fp");
+        cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        TEST_START("RSA1 key bubblebabble fingerprint");
+        buf = load_text_file("rsa1_1.fp.bb");
+        cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        sshkey_free(k1);
+
+        TEST_START("parse RSA from private");
+        buf = load_file("rsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "rsa_1",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k1, NULL);
+        a = load_bignum("rsa_1.param.n");
+        b = load_bignum("rsa_1.param.p");
+        c = load_bignum("rsa_1.param.q");
+        ASSERT_BIGNUM_EQ(k1->rsa->n, a);
+        ASSERT_BIGNUM_EQ(k1->rsa->p, b);
+        ASSERT_BIGNUM_EQ(k1->rsa->q, c);
+        BN_free(a);
+        BN_free(b);
+        BN_free(c);
+        TEST_DONE();
+
+        TEST_START("parse RSA from private w/ passphrase");
+        buf = load_file("rsa_1_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "rsa_1_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("parse RSA from new-format");
+        buf = load_file("rsa_n");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            "", "rsa_n", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("parse RSA from new-format w/ passphrase");
+        buf = load_file("rsa_n_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "rsa_n_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load RSA from public");
+        ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_1.pub"), &k2,
+            NULL), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load RSA cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1"), &k2), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(k2->type, KEY_RSA_CERT);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 0);
+        ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1);
+        TEST_DONE();
+
+        TEST_START("RSA key hex fingerprint");
+        buf = load_text_file("rsa_1.fp");
+        cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        TEST_START("RSA cert hex fingerprint");
+        buf = load_text_file("rsa_1-cert.fp");
+        cp = sshkey_fingerprint(k2, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("RSA key bubblebabble fingerprint");
+        buf = load_text_file("rsa_1.fp.bb");
+        cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        sshkey_free(k1);
+
+        TEST_START("parse DSA from private");
+        buf = load_file("dsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "dsa_1",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k1, NULL);
+        a = load_bignum("dsa_1.param.g");
+        b = load_bignum("dsa_1.param.priv");
+        c = load_bignum("dsa_1.param.pub");
+        ASSERT_BIGNUM_EQ(k1->dsa->g, a);
+        ASSERT_BIGNUM_EQ(k1->dsa->priv_key, b);
+        ASSERT_BIGNUM_EQ(k1->dsa->pub_key, c);
+        BN_free(a);
+        BN_free(b);
+        BN_free(c);
+        TEST_DONE();
+
+        TEST_START("parse DSA from private w/ passphrase");
+        buf = load_file("dsa_1_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "dsa_1_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("parse DSA from new-format");
+        buf = load_file("dsa_n");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            "", "dsa_n", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("parse DSA from new-format w/ passphrase");
+        buf = load_file("dsa_n_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "dsa_n_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load DSA from public");
+        ASSERT_INT_EQ(sshkey_load_public(test_data_file("dsa_1.pub"), &k2,
+            NULL), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load DSA cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("dsa_1"), &k2), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(k2->type, KEY_DSA_CERT);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 0);
+        ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1);
+        TEST_DONE();
+
+        TEST_START("DSA key hex fingerprint");
+        buf = load_text_file("dsa_1.fp");
+        cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        TEST_START("DSA cert hex fingerprint");
+        buf = load_text_file("dsa_1-cert.fp");
+        cp = sshkey_fingerprint(k2, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("DSA key bubblebabble fingerprint");
+        buf = load_text_file("dsa_1.fp.bb");
+        cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        sshkey_free(k1);
+
+#ifdef OPENSSL_HAS_ECC
+        TEST_START("parse ECDSA from private");
+        buf = load_file("ecdsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "ecdsa_1",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k1, NULL);
+        buf = load_text_file("ecdsa_1.param.curve");
+        ASSERT_STRING_EQ((const char *)sshbuf_ptr(buf),
+            OBJ_nid2sn(k1->ecdsa_nid));
+        sshbuf_free(buf);
+        a = load_bignum("ecdsa_1.param.priv");
+        b = load_bignum("ecdsa_1.param.pub");
+        c = EC_POINT_point2bn(EC_KEY_get0_group(k1->ecdsa),
+            EC_KEY_get0_public_key(k1->ecdsa), POINT_CONVERSION_UNCOMPRESSED,
+            NULL, NULL);
+        ASSERT_PTR_NE(c, NULL);
+        ASSERT_BIGNUM_EQ(EC_KEY_get0_private_key(k1->ecdsa), a);
+        ASSERT_BIGNUM_EQ(b, c);
+        BN_free(a);
+        BN_free(b);
+        BN_free(c);
+        TEST_DONE();
+
+        TEST_START("parse ECDSA from private w/ passphrase");
+        buf = load_file("ecdsa_1_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "ecdsa_1_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("parse ECDSA from new-format");
+        buf = load_file("ecdsa_n");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            "", "ecdsa_n", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("parse ECDSA from new-format w/ passphrase");
+        buf = load_file("ecdsa_n_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "ecdsa_n_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load ECDSA from public");
+        ASSERT_INT_EQ(sshkey_load_public(test_data_file("ecdsa_1.pub"), &k2,
+            NULL), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load ECDSA cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("ecdsa_1"), &k2), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(k2->type, KEY_ECDSA_CERT);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 0);
+        ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1);
+        TEST_DONE();
+
+        TEST_START("ECDSA key hex fingerprint");
+        buf = load_text_file("ecdsa_1.fp");
+        cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        TEST_START("ECDSA cert hex fingerprint");
+        buf = load_text_file("ecdsa_1-cert.fp");
+        cp = sshkey_fingerprint(k2, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("ECDSA key bubblebabble fingerprint");
+        buf = load_text_file("ecdsa_1.fp.bb");
+        cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        sshkey_free(k1);
+#endif /* OPENSSL_HAS_ECC */
+
+        TEST_START("parse Ed25519 from private");
+        buf = load_file("ed25519_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "ed25519_1",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_INT_EQ(k1->type, KEY_ED25519);
+        /* XXX check key contents */
+        TEST_DONE();
+
+        TEST_START("parse Ed25519 from private w/ passphrase");
+        buf = load_file("ed25519_1_pw");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
+            (const char *)sshbuf_ptr(pw), "ed25519_1_pw", &k2, NULL), 0);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load Ed25519 from public");
+        ASSERT_INT_EQ(sshkey_load_public(test_data_file("ed25519_1.pub"), &k2,
+            NULL), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("load Ed25519 cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("ed25519_1"), &k2), 0);
+        ASSERT_PTR_NE(k2, NULL);
+        ASSERT_INT_EQ(k2->type, KEY_ED25519_CERT);
+        ASSERT_INT_EQ(sshkey_equal(k1, k2), 0);
+        ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1);
+        TEST_DONE();
+
+        TEST_START("Ed25519 key hex fingerprint");
+        buf = load_text_file("ed25519_1.fp");
+        cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        TEST_START("Ed25519 cert hex fingerprint");
+        buf = load_text_file("ed25519_1-cert.fp");
+        cp = sshkey_fingerprint(k2, SSH_FP_MD5, SSH_FP_HEX);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        sshkey_free(k2);
+        TEST_DONE();
+
+        TEST_START("Ed25519 key bubblebabble fingerprint");
+        buf = load_text_file("ed25519_1.fp.bb");
+        cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);
+        ASSERT_PTR_NE(cp, NULL);
+        ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));
+        sshbuf_free(buf);
+        free(cp);
+        TEST_DONE();
+
+        sshkey_free(k1);
+
+        sshbuf_free(pw);
+
+}
diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c
new file mode 100644
index 000000000..a3f61a6df
--- /dev/null
+++ b/regress/unittests/sshkey/test_fuzz.c
@@ -0,0 +1,406 @@
+/*      $OpenBSD: test_fuzz.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/*
+ * Fuzz tests for key parsing
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/dsa.h>
+#include <openssl/objects.h>
+#ifdef OPENSSL_HAS_NISTP256
+# include <openssl/ec.h>
+#endif
+
+#include "../test_helper/test_helper.h"
+
+#include "ssherr.h"
+#include "authfile.h"
+#include "sshkey.h"
+#include "sshbuf.h"
+
+#include "common.h"
+
+void sshkey_fuzz_tests(void);
+
+static void
+onerror(void *fuzz)
+{
+        fprintf(stderr, "Failed during fuzz:\n");
+        fuzz_dump((struct fuzz *)fuzz);
+}
+
+static void
+public_fuzz(struct sshkey *k)
+{
+        struct sshkey *k1;
+        struct sshbuf *buf;
+        struct fuzz *fuzz;
+
+        ASSERT_PTR_NE(buf = sshbuf_new(), NULL);
+        ASSERT_INT_EQ(sshkey_to_blob_buf(k, buf), 0);
+        /* XXX need a way to run the tests in "slow, but complete" mode */
+        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | /* XXX too slow FUZZ_2_BIT_FLIP | */
+            FUZZ_1_BYTE_FLIP | /* XXX too slow FUZZ_2_BYTE_FLIP | */
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END,
+            sshbuf_mutable_ptr(buf), sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(buf), sshbuf_len(buf),
+            &k1), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                if (sshkey_from_blob(fuzz_ptr(fuzz), fuzz_len(fuzz), &k1) == 0)
+                        sshkey_free(k1);
+        }
+        fuzz_cleanup(fuzz);
+}
+
+static void
+sig_fuzz(struct sshkey *k)
+{
+        struct fuzz *fuzz;
+        u_char *sig, c[] = "some junk to be signed";
+        size_t l;
+
+        ASSERT_INT_EQ(sshkey_sign(k, &sig, &l, c, sizeof(c), 0), 0);
+        ASSERT_SIZE_T_GT(l, 0);
+        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | /* too slow FUZZ_2_BIT_FLIP | */
+            FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP |
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END, sig, l);
+        ASSERT_INT_EQ(sshkey_verify(k, sig, l, c, sizeof(c), 0), 0);
+        free(sig);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                sshkey_verify(k, fuzz_ptr(fuzz), fuzz_len(fuzz),
+                    c, sizeof(c), 0);
+        }
+        fuzz_cleanup(fuzz);
+}
+
+void
+sshkey_fuzz_tests(void)
+{
+        struct sshkey *k1;
+        struct sshbuf *buf, *fuzzed;
+        struct fuzz *fuzz;
+        int r;
+
+        TEST_START("fuzz RSA1 private");
+        buf = load_file("rsa1_1");
+        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | FUZZ_1_BYTE_FLIP |
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END,
+            sshbuf_mutable_ptr(buf), sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz RSA1 public");
+        buf = load_file("rsa1_1_pw");
+        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | FUZZ_1_BYTE_FLIP |
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END,
+            sshbuf_mutable_ptr(buf), sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_public_rsa1_fileblob(buf, &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_public_rsa1_fileblob(fuzzed, &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz RSA private");
+        buf = load_file("rsa_1");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz RSA new-format private");
+        buf = load_file("rsa_n");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz DSA private");
+        buf = load_file("dsa_1");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz DSA new-format private");
+        buf = load_file("dsa_n");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+#ifdef OPENSSL_HAS_ECC
+        TEST_START("fuzz ECDSA private");
+        buf = load_file("ecdsa_1");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz ECDSA new-format private");
+        buf = load_file("ecdsa_n");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+#endif
+
+        TEST_START("fuzz Ed25519 private");
+        buf = load_file("ed25519_1");
+        fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
+            sshbuf_len(buf));
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshkey_free(k1);
+        sshbuf_free(buf);
+        ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
+        TEST_ONERROR(onerror, fuzz);
+        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+                r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
+                ASSERT_INT_EQ(r, 0);
+                if (sshkey_parse_private_fileblob(fuzzed, "", "key",
+                    &k1, NULL) == 0)
+                        sshkey_free(k1);
+                sshbuf_reset(fuzzed);
+        }
+        sshbuf_free(fuzzed);
+        fuzz_cleanup(fuzz);
+        TEST_DONE();
+
+        TEST_START("fuzz RSA public");
+        buf = load_file("rsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz RSA cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1"), &k1), 0);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz DSA public");
+        buf = load_file("dsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz DSA cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("dsa_1"), &k1), 0);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+#ifdef OPENSSL_HAS_ECC
+        TEST_START("fuzz ECDSA public");
+        buf = load_file("ecdsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz ECDSA cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("ecdsa_1"), &k1), 0);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+#endif
+
+        TEST_START("fuzz Ed25519 public");
+        buf = load_file("ed25519_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz Ed25519 cert");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("ed25519_1"), &k1), 0);
+        public_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz RSA sig");
+        buf = load_file("rsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        sig_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("fuzz DSA sig");
+        buf = load_file("dsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        sig_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+#ifdef OPENSSL_HAS_ECC
+        TEST_START("fuzz ECDSA sig");
+        buf = load_file("ecdsa_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        sig_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+#endif
+
+        TEST_START("fuzz Ed25519 sig");
+        buf = load_file("ed25519_1");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
+            &k1, NULL), 0);
+        sshbuf_free(buf);
+        sig_fuzz(k1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+/* XXX fuzz decoded new-format blobs too */
+
+}
diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c
new file mode 100644
index 000000000..ef0c67956
--- /dev/null
+++ b/regress/unittests/sshkey/test_sshkey.c
@@ -0,0 +1,357 @@
+/*      $OpenBSD: test_sshkey.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/*
+ * Regress test for sshkey.h key management API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/dsa.h>
+#ifdef OPENSSL_HAS_NISTP256
+# include <openssl/ec.h>
+#endif
+
+#include "../test_helper/test_helper.h"
+
+#include "ssherr.h"
+#include "sshbuf.h"
+#define SSHBUF_INTERNAL 1       /* access internals for testing */
+#include "sshkey.h"
+
+#include "authfile.h"
+#include "common.h"
+#include "ssh2.h"
+
+void sshkey_tests(void);
+
+static void
+build_cert(struct sshbuf *b, const struct sshkey *k, const char *type,
+    const struct sshkey *sign_key, const struct sshkey *ca_key)
+{
+        struct sshbuf *ca_buf, *pk, *principals, *critopts, *exts;
+        u_char *sigblob;
+        size_t siglen;
+
+        ca_buf = sshbuf_new();
+        ASSERT_INT_EQ(sshkey_to_blob_buf(ca_key, ca_buf), 0);
+
+        /*
+         * Get the public key serialisation by rendering the key and skipping
+         * the type string. This is a bit of a hack :/
+         */
+        pk = sshbuf_new();
+        ASSERT_INT_EQ(sshkey_plain_to_blob_buf(k, pk), 0);
+        ASSERT_INT_EQ(sshbuf_skip_string(pk), 0);
+
+        principals = sshbuf_new();
+        ASSERT_INT_EQ(sshbuf_put_cstring(principals, "gsamsa"), 0);
+        ASSERT_INT_EQ(sshbuf_put_cstring(principals, "gregor"), 0);
+
+        critopts = sshbuf_new();
+        /* XXX fill this in */
+
+        exts = sshbuf_new();
+        /* XXX fill this in */
+
+        ASSERT_INT_EQ(sshbuf_put_cstring(b, type), 0);
+        ASSERT_INT_EQ(sshbuf_put_cstring(b, "noncenoncenonce!"), 0); /* nonce */
+        ASSERT_INT_EQ(sshbuf_putb(b, pk), 0); /* public key serialisation */
+        ASSERT_INT_EQ(sshbuf_put_u64(b, 1234), 0); /* serial */
+        ASSERT_INT_EQ(sshbuf_put_u32(b, SSH2_CERT_TYPE_USER), 0); /* type */
+        ASSERT_INT_EQ(sshbuf_put_cstring(b, "gregor"), 0); /* key ID */
+        ASSERT_INT_EQ(sshbuf_put_stringb(b, principals), 0); /* principals */
+        ASSERT_INT_EQ(sshbuf_put_u64(b, 0), 0); /* start */
+        ASSERT_INT_EQ(sshbuf_put_u64(b, 0xffffffffffffffffULL), 0); /* end */
+        ASSERT_INT_EQ(sshbuf_put_stringb(b, critopts), 0); /* options */
+        ASSERT_INT_EQ(sshbuf_put_stringb(b, exts), 0); /* extensions */
+        ASSERT_INT_EQ(sshbuf_put_string(b, NULL, 0), 0); /* reserved */
+        ASSERT_INT_EQ(sshbuf_put_stringb(b, ca_buf), 0); /* signature key */
+        ASSERT_INT_EQ(sshkey_sign(sign_key, &sigblob, &siglen,
+            sshbuf_ptr(b), sshbuf_len(b), 0), 0);
+        ASSERT_INT_EQ(sshbuf_put_string(b, sigblob, siglen), 0); /* signature */
+
+        free(sigblob);
+        sshbuf_free(ca_buf);
+        sshbuf_free(exts);
+        sshbuf_free(critopts);
+        sshbuf_free(principals);
+        sshbuf_free(pk);
+}
+
+void
+sshkey_tests(void)
+{
+        struct sshkey *k1, *k2, *k3, *k4, *kr, *kd, *ke, *kf;
+        struct sshbuf *b;
+
+        TEST_START("new invalid");
+        k1 = sshkey_new(-42);
+        ASSERT_PTR_EQ(k1, NULL);
+        TEST_DONE();
+
+        TEST_START("new/free KEY_UNSPEC");
+        k1 = sshkey_new(KEY_UNSPEC);
+        ASSERT_PTR_NE(k1, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new/free KEY_RSA1");
+        k1 = sshkey_new(KEY_RSA1);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(k1->rsa, NULL);
+        ASSERT_PTR_NE(k1->rsa->n, NULL);
+        ASSERT_PTR_NE(k1->rsa->e, NULL);
+        ASSERT_PTR_EQ(k1->rsa->p, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new/free KEY_RSA");
+        k1 = sshkey_new(KEY_RSA);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(k1->rsa, NULL);
+        ASSERT_PTR_NE(k1->rsa->n, NULL);
+        ASSERT_PTR_NE(k1->rsa->e, NULL);
+        ASSERT_PTR_EQ(k1->rsa->p, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new/free KEY_DSA");
+        k1 = sshkey_new(KEY_DSA);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(k1->dsa, NULL);
+        ASSERT_PTR_NE(k1->dsa->g, NULL);
+        ASSERT_PTR_EQ(k1->dsa->priv_key, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new/free KEY_ECDSA");
+        k1 = sshkey_new(KEY_ECDSA);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_EQ(k1->ecdsa, NULL);  /* Can't allocate without NID */
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new/free KEY_ED25519");
+        k1 = sshkey_new(KEY_ED25519);
+        ASSERT_PTR_NE(k1, NULL);
+        /* These should be blank until key loaded or generated */
+        ASSERT_PTR_EQ(k1->ed25519_sk, NULL);
+        ASSERT_PTR_EQ(k1->ed25519_pk, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new_private KEY_RSA");
+        k1 = sshkey_new_private(KEY_RSA);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(k1->rsa, NULL);
+        ASSERT_PTR_NE(k1->rsa->n, NULL);
+        ASSERT_PTR_NE(k1->rsa->e, NULL);
+        ASSERT_PTR_NE(k1->rsa->p, NULL);
+        ASSERT_INT_EQ(sshkey_add_private(k1), 0);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("new_private KEY_DSA");
+        k1 = sshkey_new_private(KEY_DSA);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(k1->dsa, NULL);
+        ASSERT_PTR_NE(k1->dsa->g, NULL);
+        ASSERT_PTR_NE(k1->dsa->priv_key, NULL);
+        ASSERT_INT_EQ(sshkey_add_private(k1), 0);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("generate KEY_RSA too small modulus");
+        ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 128, &k1),
+            SSH_ERR_INVALID_ARGUMENT);
+        ASSERT_PTR_EQ(k1, NULL);
+        TEST_DONE();
+
+        TEST_START("generate KEY_RSA too large modulus");
+        ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 1 << 20, &k1),
+            SSH_ERR_INVALID_ARGUMENT);
+        ASSERT_PTR_EQ(k1, NULL);
+        TEST_DONE();
+
+        TEST_START("generate KEY_DSA wrong bits");
+        ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 2048, &k1),
+            SSH_ERR_INVALID_ARGUMENT);
+        ASSERT_PTR_EQ(k1, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("generate KEY_ECDSA wrong bits");
+        ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 42, &k1),
+            SSH_ERR_INVALID_ARGUMENT);
+        ASSERT_PTR_EQ(k1, NULL);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("generate KEY_RSA");
+        ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 768, &kr), 0);
+        ASSERT_PTR_NE(kr, NULL);
+        ASSERT_PTR_NE(kr->rsa, NULL);
+        ASSERT_PTR_NE(kr->rsa->n, NULL);
+        ASSERT_PTR_NE(kr->rsa->e, NULL);
+        ASSERT_PTR_NE(kr->rsa->p, NULL);
+        ASSERT_INT_EQ(BN_num_bits(kr->rsa->n), 768);
+        TEST_DONE();
+
+        TEST_START("generate KEY_DSA");
+        ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 1024, &kd), 0);
+        ASSERT_PTR_NE(kd, NULL);
+        ASSERT_PTR_NE(kd->dsa, NULL);
+        ASSERT_PTR_NE(kd->dsa->g, NULL);
+        ASSERT_PTR_NE(kd->dsa->priv_key, NULL);
+        TEST_DONE();
+
+#ifdef OPENSSL_HAS_ECC
+        TEST_START("generate KEY_ECDSA");
+        ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &ke), 0);
+        ASSERT_PTR_NE(ke, NULL);
+        ASSERT_PTR_NE(ke->ecdsa, NULL);
+        ASSERT_PTR_NE(EC_KEY_get0_public_key(ke->ecdsa), NULL);
+        ASSERT_PTR_NE(EC_KEY_get0_private_key(ke->ecdsa), NULL);
+        TEST_DONE();
+#endif
+
+        TEST_START("generate KEY_ED25519");
+        ASSERT_INT_EQ(sshkey_generate(KEY_ED25519, 256, &kf), 0);
+        ASSERT_PTR_NE(kf, NULL);
+        ASSERT_INT_EQ(kf->type, KEY_ED25519);
+        ASSERT_PTR_NE(kf->ed25519_pk, NULL);
+        ASSERT_PTR_NE(kf->ed25519_sk, NULL);
+        TEST_DONE();
+
+        TEST_START("demote KEY_RSA");
+        ASSERT_INT_EQ(sshkey_demote(kr, &k1), 0);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(kr, k1);
+        ASSERT_INT_EQ(k1->type, KEY_RSA);
+        ASSERT_PTR_NE(k1->rsa, NULL);
+        ASSERT_PTR_NE(k1->rsa->n, NULL);
+        ASSERT_PTR_NE(k1->rsa->e, NULL);
+        ASSERT_PTR_EQ(k1->rsa->p, NULL);
+        TEST_DONE();
+
+        TEST_START("equal KEY_RSA/demoted KEY_RSA");
+        ASSERT_INT_EQ(sshkey_equal(kr, k1), 1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("demote KEY_DSA");
+        ASSERT_INT_EQ(sshkey_demote(kd, &k1), 0);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(kd, k1);
+        ASSERT_INT_EQ(k1->type, KEY_DSA);
+        ASSERT_PTR_NE(k1->dsa, NULL);
+        ASSERT_PTR_NE(k1->dsa->g, NULL);
+        ASSERT_PTR_EQ(k1->dsa->priv_key, NULL);
+        TEST_DONE();
+
+        TEST_START("equal KEY_DSA/demoted KEY_DSA");
+        ASSERT_INT_EQ(sshkey_equal(kd, k1), 1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+#ifdef OPENSSL_HAS_ECC
+        TEST_START("demote KEY_ECDSA");
+        ASSERT_INT_EQ(sshkey_demote(ke, &k1), 0);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(ke, k1);
+        ASSERT_INT_EQ(k1->type, KEY_ECDSA);
+        ASSERT_PTR_NE(k1->ecdsa, NULL);
+        ASSERT_INT_EQ(k1->ecdsa_nid, ke->ecdsa_nid);
+        ASSERT_PTR_NE(EC_KEY_get0_public_key(ke->ecdsa), NULL);
+        ASSERT_PTR_EQ(EC_KEY_get0_private_key(k1->ecdsa), NULL);
+        TEST_DONE();
+
+        TEST_START("equal KEY_ECDSA/demoted KEY_ECDSA");
+        ASSERT_INT_EQ(sshkey_equal(ke, k1), 1);
+        sshkey_free(k1);
+        TEST_DONE();
+#endif
+
+        TEST_START("demote KEY_ED25519");
+        ASSERT_INT_EQ(sshkey_demote(kf, &k1), 0);
+        ASSERT_PTR_NE(k1, NULL);
+        ASSERT_PTR_NE(kf, k1);
+        ASSERT_INT_EQ(k1->type, KEY_ED25519);
+        ASSERT_PTR_NE(k1->ed25519_pk, NULL);
+        ASSERT_PTR_EQ(k1->ed25519_sk, NULL);
+        TEST_DONE();
+
+        TEST_START("equal KEY_ED25519/demoted KEY_ED25519");
+        ASSERT_INT_EQ(sshkey_equal(kf, k1), 1);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        TEST_START("equal mismatched key types");
+        ASSERT_INT_EQ(sshkey_equal(kd, kr), 0);
+#ifdef OPENSSL_HAS_ECC
+        ASSERT_INT_EQ(sshkey_equal(kd, ke), 0);
+        ASSERT_INT_EQ(sshkey_equal(kr, ke), 0);
+        ASSERT_INT_EQ(sshkey_equal(ke, kf), 0);
+#endif
+        ASSERT_INT_EQ(sshkey_equal(kd, kf), 0);
+        TEST_DONE();
+
+        TEST_START("equal different keys");
+        ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 768, &k1), 0);
+        ASSERT_INT_EQ(sshkey_equal(kr, k1), 0);
+        sshkey_free(k1);
+        ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 1024, &k1), 0);
+        ASSERT_INT_EQ(sshkey_equal(kd, k1), 0);
+        sshkey_free(k1);
+#ifdef OPENSSL_HAS_ECC
+        ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &k1), 0);
+        ASSERT_INT_EQ(sshkey_equal(ke, k1), 0);
+        sshkey_free(k1);
+#endif
+        ASSERT_INT_EQ(sshkey_generate(KEY_ED25519, 256, &k1), 0);
+        ASSERT_INT_EQ(sshkey_equal(kf, k1), 0);
+        sshkey_free(k1);
+        TEST_DONE();
+
+        sshkey_free(kr);
+        sshkey_free(kd);
+#ifdef OPENSSL_HAS_ECC
+        sshkey_free(ke);
+#endif
+        sshkey_free(kf);
+
+/* XXX certify test */
+/* XXX sign test */
+/* XXX verify test */
+
+        TEST_START("nested certificate");
+        ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1"), &k1), 0);
+        ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_1.pub"), &k2,
+            NULL), 0);
+        b = load_file("rsa_2");
+        ASSERT_INT_EQ(sshkey_parse_private_fileblob(b, "", "rsa_1",
+            &k3, NULL), 0);
+        sshbuf_reset(b);
+        build_cert(b, k2, "ssh-rsa-cert-v01@openssh.com", k3, k1);
+        ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(b), sshbuf_len(b), &k4),
+            SSH_ERR_KEY_CERT_INVALID_SIGN_KEY);
+        ASSERT_PTR_EQ(k4, NULL);
+        sshbuf_free(b);
+        sshkey_free(k1);
+        sshkey_free(k2);
+        sshkey_free(k3);
+        TEST_DONE();
+
+}
diff --git a/regress/unittests/sshkey/testdata/dsa_1 b/regress/unittests/sshkey/testdata/dsa_1
new file mode 100644
index 000000000..34346869f
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1
@@ -0,0 +1,12 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBuwIBAAKBgQCxBNwH8TmLXqiZa0b9pxC6W+zS4Voqp8S+QwecYpNPTmhjaUYI
+E/aJWAzFVtdbysLM89ukvw/z8qBkbMSefdypKmjUtgv51ZD4nfV4Wxb+G+1QExHr
+M+kowOOL3XbcsdbPLUt8vxDJbBlQRch4zyai7CWjQR3JFXpR8sevUFJxSQIVAIdE
+oncp2DEY2U/ZZnIyGCwApCzfAoGARW+eewZTv1Eosxv3ANKx372pf5+fQKwnWizI
+j5z/GY3w3xobRCP9FiL4K3Nip2FvHLTGpRrlfm19RWYAg77VsNgztC4V9C8QrKWc
+WJdkUkoQpZ3VoO25rO13hmIelkal3omKCF4ZE/edeF3d2B8DlzYs0aBcjTCMDrub
+/CJILcYCgYEAgJt9jefGQi4Sl5F8h3jYo52LygE8sNYyurElMKVmyhFSKJ1Ifi9j
+4hNp2jZzu7jpZWhYndUoPaG6gbRB7fL3p5knlRo3P2Dznd6u6NAdhrADWW+JX9n1
+/EMKUv0h8rRFI/3b9RY1HVVzBQH7V3sNJ6iekH8JqOy1liCMaMylw4gCFBl7Lc6V
+hmTiTuhLXjoRdCZS/p/m
+-----END DSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/dsa_1-cert.fp b/regress/unittests/sshkey/testdata/dsa_1-cert.fp
new file mode 100644
index 000000000..56ee1f89b
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1-cert.fp
@@ -0,0 +1 @@
+5a:4a:41:8c:4e:fa:4c:52:19:f9:39:49:31:fb:fd:74
diff --git a/regress/unittests/sshkey/testdata/dsa_1-cert.pub b/regress/unittests/sshkey/testdata/dsa_1-cert.pub
new file mode 100644
index 000000000..023edf136
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1-cert.pub
@@ -0,0 +1 @@
+ssh-dss-cert-v01@openssh.com AAAAHHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgj8zueN51MSQ7jW3fFwqyJWA3DycAAavQ8WgMHqcUG7YAAACBALEE3AfxOYteqJlrRv2nELpb7NLhWiqnxL5DB5xik09OaGNpRggT9olYDMVW11vKwszz26S/D/PyoGRsxJ593KkqaNS2C/nVkPid9XhbFv4b7VATEesz6SjA44vddtyx1s8tS3y/EMlsGVBFyHjPJqLsJaNBHckVelHyx69QUnFJAAAAFQCHRKJ3KdgxGNlP2WZyMhgsAKQs3wAAAIBFb557BlO/USizG/cA0rHfval/n59ArCdaLMiPnP8ZjfDfGhtEI/0WIvgrc2KnYW8ctMalGuV+bX1FZgCDvtWw2DO0LhX0LxCspZxYl2RSShClndWg7bms7XeGYh6WRqXeiYoIXhkT9514Xd3YHwOXNizRoFyNMIwOu5v8IkgtxgAAAIEAgJt9jefGQi4Sl5F8h3jYo52LygE8sNYyurElMKVmyhFSKJ1Ifi9j4hNp2jZzu7jpZWhYndUoPaG6gbRB7fL3p5knlRo3P2Dznd6u6NAdhrADWW+JX9n1/EMKUv0h8rRFI/3b9RY1HVVzBQH7V3sNJ6iekH8JqOy1liCMaMylw4gAAAAAAAAABgAAAAIAAAAGanVsaXVzAAAAEgAAAAVob3N0MQAAAAVob3N0MgAAAAA2i4NgAAAAAE0d4eAAAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAILk95V5J3LKVx8bcLSB4073R7d0aAvR8gJrPvnV0D3MQAAAAUwAAAAtzc2gtZWQyNTUxOQAAAEA6qftqozw0ah9PG9obAg8iOPwQv6AsT9t/1G69eArSd9Am85OKIhAvYguI1Xtr9rw78X/Xk+6HtyAOF3QemaQD dsa_1.pub
diff --git a/regress/unittests/sshkey/testdata/dsa_1.fp b/regress/unittests/sshkey/testdata/dsa_1.fp
new file mode 100644
index 000000000..56ee1f89b
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1.fp
@@ -0,0 +1 @@
+5a:4a:41:8c:4e:fa:4c:52:19:f9:39:49:31:fb:fd:74
diff --git a/regress/unittests/sshkey/testdata/dsa_1.fp.bb b/regress/unittests/sshkey/testdata/dsa_1.fp.bb
new file mode 100644
index 000000000..07dd9b418
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1.fp.bb
@@ -0,0 +1 @@
+xosat-baneh-gocad-relek-kepur-mibip-motog-bykyb-hisug-mysus-tuxix
diff --git a/regress/unittests/sshkey/testdata/dsa_1.param.g b/regress/unittests/sshkey/testdata/dsa_1.param.g
new file mode 100644
index 000000000..4b09f6d18
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1.param.g
@@ -0,0 +1 @@
+456f9e7b0653bf5128b31bf700d2b1dfbda97f9f9f40ac275a2cc88f9cff198df0df1a1b4423fd1622f82b7362a7616f1cb4c6a51ae57e6d7d45660083bed5b0d833b42e15f42f10aca59c589764524a10a59dd5a0edb9aced7786621e9646a5de898a085e1913f79d785dddd81f0397362cd1a05c8d308c0ebb9bfc22482dc6
diff --git a/regress/unittests/sshkey/testdata/dsa_1.param.priv b/regress/unittests/sshkey/testdata/dsa_1.param.priv
new file mode 100644
index 000000000..2dd737cbe
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1.param.priv
@@ -0,0 +1 @@
+197b2dce958664e24ee84b5e3a11742652fe9fe6
diff --git a/regress/unittests/sshkey/testdata/dsa_1.param.pub b/regress/unittests/sshkey/testdata/dsa_1.param.pub
new file mode 100644
index 000000000..b23d7207f
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1.param.pub
@@ -0,0 +1 @@
+00809b7d8de7c6422e1297917c8778d8a39d8bca013cb0d632bab12530a566ca1152289d487e2f63e21369da3673bbb8e96568589dd5283da1ba81b441edf2f7a79927951a373f60f39ddeaee8d01d86b003596f895fd9f5fc430a52fd21f2b44523fddbf516351d55730501fb577b0d27a89e907f09a8ecb596208c68cca5c388
diff --git a/regress/unittests/sshkey/testdata/dsa_1.pub b/regress/unittests/sshkey/testdata/dsa_1.pub
new file mode 100644
index 000000000..89681970c
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1.pub
@@ -0,0 +1 @@
+ssh-dss AAAAB3NzaC1kc3MAAACBALEE3AfxOYteqJlrRv2nELpb7NLhWiqnxL5DB5xik09OaGNpRggT9olYDMVW11vKwszz26S/D/PyoGRsxJ593KkqaNS2C/nVkPid9XhbFv4b7VATEesz6SjA44vddtyx1s8tS3y/EMlsGVBFyHjPJqLsJaNBHckVelHyx69QUnFJAAAAFQCHRKJ3KdgxGNlP2WZyMhgsAKQs3wAAAIBFb557BlO/USizG/cA0rHfval/n59ArCdaLMiPnP8ZjfDfGhtEI/0WIvgrc2KnYW8ctMalGuV+bX1FZgCDvtWw2DO0LhX0LxCspZxYl2RSShClndWg7bms7XeGYh6WRqXeiYoIXhkT9514Xd3YHwOXNizRoFyNMIwOu5v8IkgtxgAAAIEAgJt9jefGQi4Sl5F8h3jYo52LygE8sNYyurElMKVmyhFSKJ1Ifi9j4hNp2jZzu7jpZWhYndUoPaG6gbRB7fL3p5knlRo3P2Dznd6u6NAdhrADWW+JX9n1/EMKUv0h8rRFI/3b9RY1HVVzBQH7V3sNJ6iekH8JqOy1liCMaMylw4g= DSA test key #1
diff --git a/regress/unittests/sshkey/testdata/dsa_1_pw b/regress/unittests/sshkey/testdata/dsa_1_pw
new file mode 100644
index 000000000..1402153a0
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_1_pw
@@ -0,0 +1,15 @@
+-----BEGIN DSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,9E668E24E7B9D658E3E7D0446B32B376
+
+hDjDLbfCAQutblxLuyNzSLxISSgXTgyzq8St9GE0lUtEc7i0xGNWwoWpFSbtD9y1
+yTG5UkhATQt56SY1ABfXZ21wieYuEEQeSJi0gwUQNNt2SwwITx4EdzDedWiHjikt
+jbzH3v33agp/odw2X9wY6zu75y9CeW9o7SszRl286DliWIHJmhMlbb8r7jRqu62H
+s5YYxD0xS1ipWauxklmIXMWNZHcARo8ZiJOuNdLshrSrl8DUW9P6F89FvxclQzKr
+44u3OBm7KbgPvPURDFLgNP6uCGBjzHvhHTpzVBxmQzCl3aGgsTKXiwJ1eupNjntB
+ji0EnbznvoxR6qhXxw/WQ+MnWlWqTXka/2qaB6m3oJv+Zn7cPCJ5kvHnhr2JmNMl
+igTh4Ov4LZLyNgO0Lbec4KyxW9QInRV5CY4Pu5lhqHteiPmOIGMWFtuh8Bb8Kg2q
+VvXnPo5I3FjqV7UhDduO1Wn558sBZWQPqRbHVPN6wXJuM3HGkBl+aNjn0qddv9tr
+VFJd/xdly2Ne81g3CB8jysE+3WEOrV9kdybocp/EhSOzP4i6pjWlyWdR5+CgbvRm
+TUIeIaQbmPIB5251o5YK+Q==
+-----END DSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/dsa_2 b/regress/unittests/sshkey/testdata/dsa_2
new file mode 100644
index 000000000..b189dc821
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_2
@@ -0,0 +1,12 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBuwIBAAKBgQDoMxCTyBnLPSO7CRU3RyfJLANLKBZ3/LdcsyNaARctaRA5gzRb
+XdTFFU+rWKfxv+otm0KyCOepLtWy8tjKRYb7Ni46USlGwtM0Adx/3vR4iWNfipDP
+K2V4O97JyMe3wsbF7siC01U4b8Ki+J44iFG9nuRnOTHqUWI615mraQRwlQIVAMsX
+nsPGH8QrU11F1ScAIfZC165dAoGACCXyOHFkxABpJDtJs6AE7Hl3XjI4dnlim/XH
+Y60W6gcO7gHSE2r2ljCubJqoUXmxd5mLKgnu91jIG/4URwDM4V7pb2k99sXpAi8I
+L52eQl88C0bRD9+lEJfR4PMT39EccDRPB4+E055RoYQZ/McIyad8sF3Qwt084Eq+
+IkUt2coCgYEAxZRpCY82sM9Mu4B0EcH6O8seRqIRScmelljhUtKxuvf2PChwIWkR
+HK9lORHBE3iKyurC5Muf3abuHKwMFjrOjHKOTqXBRrDZ7RgLQA0aUAQD3lWc9OTP
+NShjphpq5xr0HZB31eJg3/Mo6KxYlRpzMXbTyenZP0XLICSSAywvTDoCFG5whl2k
+Y2FLGfi9V6ylUVH6jKgE
+-----END DSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/dsa_2.fp b/regress/unittests/sshkey/testdata/dsa_2.fp
new file mode 100644
index 000000000..ba9de82a8
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_2.fp
@@ -0,0 +1 @@
+72:5f:50:6b:e5:64:c5:62:21:92:3f:8b:10:9b:9f:1a
diff --git a/regress/unittests/sshkey/testdata/dsa_2.fp.bb b/regress/unittests/sshkey/testdata/dsa_2.fp.bb
new file mode 100644
index 000000000..37a5221a7
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_2.fp.bb
@@ -0,0 +1 @@
+xesoh-mebaf-feced-lenuz-sicam-pevok-bosak-nogaz-ligen-fekef-fixex
diff --git a/regress/unittests/sshkey/testdata/dsa_2.pub b/regress/unittests/sshkey/testdata/dsa_2.pub
new file mode 100644
index 000000000..6ed2736b1
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_2.pub
@@ -0,0 +1 @@
+ssh-dss AAAAB3NzaC1kc3MAAACBAOgzEJPIGcs9I7sJFTdHJ8ksA0soFnf8t1yzI1oBFy1pEDmDNFtd1MUVT6tYp/G/6i2bQrII56ku1bLy2MpFhvs2LjpRKUbC0zQB3H/e9HiJY1+KkM8rZXg73snIx7fCxsXuyILTVThvwqL4njiIUb2e5Gc5MepRYjrXmatpBHCVAAAAFQDLF57Dxh/EK1NdRdUnACH2QteuXQAAAIAIJfI4cWTEAGkkO0mzoATseXdeMjh2eWKb9cdjrRbqBw7uAdITavaWMK5smqhRebF3mYsqCe73WMgb/hRHAMzhXulvaT32xekCLwgvnZ5CXzwLRtEP36UQl9Hg8xPf0RxwNE8Hj4TTnlGhhBn8xwjJp3ywXdDC3TzgSr4iRS3ZygAAAIEAxZRpCY82sM9Mu4B0EcH6O8seRqIRScmelljhUtKxuvf2PChwIWkRHK9lORHBE3iKyurC5Muf3abuHKwMFjrOjHKOTqXBRrDZ7RgLQA0aUAQD3lWc9OTPNShjphpq5xr0HZB31eJg3/Mo6KxYlRpzMXbTyenZP0XLICSSAywvTDo= DSA test key #2
diff --git a/regress/unittests/sshkey/testdata/dsa_n b/regress/unittests/sshkey/testdata/dsa_n
new file mode 100644
index 000000000..34346869f
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_n
@@ -0,0 +1,12 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBuwIBAAKBgQCxBNwH8TmLXqiZa0b9pxC6W+zS4Voqp8S+QwecYpNPTmhjaUYI
+E/aJWAzFVtdbysLM89ukvw/z8qBkbMSefdypKmjUtgv51ZD4nfV4Wxb+G+1QExHr
+M+kowOOL3XbcsdbPLUt8vxDJbBlQRch4zyai7CWjQR3JFXpR8sevUFJxSQIVAIdE
+oncp2DEY2U/ZZnIyGCwApCzfAoGARW+eewZTv1Eosxv3ANKx372pf5+fQKwnWizI
+j5z/GY3w3xobRCP9FiL4K3Nip2FvHLTGpRrlfm19RWYAg77VsNgztC4V9C8QrKWc
+WJdkUkoQpZ3VoO25rO13hmIelkal3omKCF4ZE/edeF3d2B8DlzYs0aBcjTCMDrub
+/CJILcYCgYEAgJt9jefGQi4Sl5F8h3jYo52LygE8sNYyurElMKVmyhFSKJ1Ifi9j
+4hNp2jZzu7jpZWhYndUoPaG6gbRB7fL3p5knlRo3P2Dznd6u6NAdhrADWW+JX9n1
+/EMKUv0h8rRFI/3b9RY1HVVzBQH7V3sNJ6iekH8JqOy1liCMaMylw4gCFBl7Lc6V
+hmTiTuhLXjoRdCZS/p/m
+-----END DSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/dsa_n_pw b/regress/unittests/sshkey/testdata/dsa_n_pw
new file mode 100644
index 000000000..42f70dd23
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/dsa_n_pw
@@ -0,0 +1,22 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABD5nB+Nkw
+LNoPtAG7C3IdXmAAAAEAAAAAEAAAGyAAAAB3NzaC1kc3MAAACBALEE3AfxOYteqJlrRv2n
+ELpb7NLhWiqnxL5DB5xik09OaGNpRggT9olYDMVW11vKwszz26S/D/PyoGRsxJ593KkqaN
+S2C/nVkPid9XhbFv4b7VATEesz6SjA44vddtyx1s8tS3y/EMlsGVBFyHjPJqLsJaNBHckV
+elHyx69QUnFJAAAAFQCHRKJ3KdgxGNlP2WZyMhgsAKQs3wAAAIBFb557BlO/USizG/cA0r
+Hfval/n59ArCdaLMiPnP8ZjfDfGhtEI/0WIvgrc2KnYW8ctMalGuV+bX1FZgCDvtWw2DO0
+LhX0LxCspZxYl2RSShClndWg7bms7XeGYh6WRqXeiYoIXhkT9514Xd3YHwOXNizRoFyNMI
+wOu5v8IkgtxgAAAIEAgJt9jefGQi4Sl5F8h3jYo52LygE8sNYyurElMKVmyhFSKJ1Ifi9j
+4hNp2jZzu7jpZWhYndUoPaG6gbRB7fL3p5knlRo3P2Dznd6u6NAdhrADWW+JX9n1/EMKUv
+0h8rRFI/3b9RY1HVVzBQH7V3sNJ6iekH8JqOy1liCMaMylw4gAAAHw8P1DtkBulOGv85qf
+P+md2+LL+NKufVzHl9k2UKQFjeqY6uqs4HSDqvhXe7oiXd5mz6I7orxjtKU9hGjNF4ABUD
+OawVGe/GCRUQ4WgpAgDnqQLeFcdIwtMSIrRZU6xjs314EI7TM7IIiG26JEuXDfZI1e7C3y
+Cc38ZsP3zmg/UjgcCQar5c4n++vhOmeO36+fcUyZ1QlR05SaEtFYJA+otP3RmKTiDwob8Q
+zRMr8Y57i2NTTtFjkmnnnQCibP62yz7N22Dve7RTOH8jiaW7p02Vn/6WmCarevN1rxtLLR
+lkuWtPoKY8z/Ktcev8YE9f2+9H2TfXDRKYqIEfxgZLCJ4yP2gxDe6zurabS0hAO1CP+ej5
+htdJM3/rTqHAIevXX5uhIDmMvRHnLGldaIX1xux8TIJvSfMkYNIwscIP4kx7BGMk04vXtW
+5DLm6IZhzw9T3hjr8R0kBugmT6/h9vD5iN1D+wiHIhHYzQKMU9nOeFNsMBFWgJjU0l8VlF
+gEjEMgAEfwynnmIoKB1iA/0em1tdU3naS59DBK+buE0trxUpTAAB5z8yPhAm6DdqrPE8cA
+N3HlMoWrbCuak2A0uyOlEJjPg4UJUnv12ve2c9pAMsAu/4CAszCEM0prR+qd/RA4nn4M5u
+Xrny2wNtt/DybCkA==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1 b/regress/unittests/sshkey/testdata/ecdsa_1
new file mode 100644
index 000000000..aec73dd61
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIFghsFR1K95tz8qOl3+tX6fv8a/O6AfNbxOSFZX3ihxooAoGCCqGSM49
+AwEHoUQDQgAEalpgP0BOePHtTw0Pus4tdhTb8P9yWUZluvLf1D8vrHImT+G4vr/W
+xo5iXGKQVEifuUVyLkAW2kDrq8J/szeRiQ==
+-----END EC PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1-cert.fp b/regress/unittests/sshkey/testdata/ecdsa_1-cert.fp
new file mode 100644
index 000000000..a56dbc8d0
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1-cert.fp
@@ -0,0 +1 @@
+f7:be:4c:02:65:ed:4c:11:af:ab:a8:dd:0a:92:e7:44
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1-cert.pub b/regress/unittests/sshkey/testdata/ecdsa_1-cert.pub
new file mode 100644
index 000000000..29b06a4dd
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1-cert.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgjpoHehzmM54xz776HOiTOLPhkOwSWyXOMYeqDhDEcLgAAAAIbmlzdHAyNTYAAABBBGpaYD9ATnjx7U8ND7rOLXYU2/D/cllGZbry39Q/L6xyJk/huL6/1saOYlxikFRIn7lFci5AFtpA66vCf7M3kYkAAAAAAAAABwAAAAIAAAAGanVsaXVzAAAAEgAAAAVob3N0MQAAAAVob3N0MgAAAAA2i4NgAAAAAE0d4eAAAAAAAAAAAAAAAAAAAABoAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGpaYD9ATnjx7U8ND7rOLXYU2/D/cllGZbry39Q/L6xyJk/huL6/1saOYlxikFRIn7lFci5AFtpA66vCf7M3kYkAAABjAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAABIAAAAIFZM1PXlXf0a3VuGs7MVdWSealDXprT1nN5hQTg+m+EYAAAAIGN1yNXWEY5V315NhOD3mBuh/xCpfDn5rZjF4YntA7du ecdsa_1.pub
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.fp b/regress/unittests/sshkey/testdata/ecdsa_1.fp
new file mode 100644
index 000000000..a56dbc8d0
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1.fp
@@ -0,0 +1 @@
+f7:be:4c:02:65:ed:4c:11:af:ab:a8:dd:0a:92:e7:44
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.fp.bb b/regress/unittests/sshkey/testdata/ecdsa_1.fp.bb
new file mode 100644
index 000000000..f01a5dd44
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1.fp.bb
@@ -0,0 +1 @@
+xotah-hecal-zibyb-nadug-romuc-hator-venum-hobip-ruluh-ripus-naxix
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.param.curve b/regress/unittests/sshkey/testdata/ecdsa_1.param.curve
new file mode 100644
index 000000000..fa0400467
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1.param.curve
@@ -0,0 +1 @@
+prime256v1
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.param.priv b/regress/unittests/sshkey/testdata/ecdsa_1.param.priv
new file mode 100644
index 000000000..3475f1fe9
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1.param.priv
@@ -0,0 +1 @@
+5821b054752bde6dcfca8e977fad5fa7eff1afcee807cd6f13921595f78a1c68
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.param.pub b/regress/unittests/sshkey/testdata/ecdsa_1.param.pub
new file mode 100644
index 000000000..11847a394
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1.param.pub
@@ -0,0 +1 @@
+046a5a603f404e78f1ed4f0d0fbace2d7614dbf0ff72594665baf2dfd43f2fac72264fe1b8bebfd6c68e625c629054489fb945722e4016da40ebabc27fb3379189
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.pub b/regress/unittests/sshkey/testdata/ecdsa_1.pub
new file mode 100644
index 000000000..eca1620bc
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGpaYD9ATnjx7U8ND7rOLXYU2/D/cllGZbry39Q/L6xyJk/huL6/1saOYlxikFRIn7lFci5AFtpA66vCf7M3kYk= ECDSA test key #1
diff --git a/regress/unittests/sshkey/testdata/ecdsa_1_pw b/regress/unittests/sshkey/testdata/ecdsa_1_pw
new file mode 100644
index 000000000..071154ab2
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_1_pw
@@ -0,0 +1,8 @@
+-----BEGIN EC PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,74C8AEA5BFAFCC2B1C8B13DE671F5610
+
+vUsgOvCqezxPmcZcFqrSy9Y1MMlVguY0h9cfSPFC7gUrRr+45uCOYX5bOwEXecKn
+/9uCXZtlBwwqDS9iK5IPoUrjEHvzI5rVbHWUxDrEOVbsfiDuCxrQM19It6QIqC1v
+OSQEdXuBWR5WmhKNc3dqLbWsU8u2s60YwKQmZrj9nM4=
+-----END EC PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2 b/regress/unittests/sshkey/testdata/ecdsa_2
new file mode 100644
index 000000000..76ae07ad4
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2
@@ -0,0 +1,7 @@
+-----BEGIN EC PRIVATE KEY-----
+MIHcAgEBBEIBg4kVxUfoo/RE/78/QBRqG6PZuHZ82eLnhmZVzBa7XREUiYI/Jw7r
+Qwp4FTBVfXL76Pt5AyBMf+52aVeOUlLRERSgBwYFK4EEACOhgYkDgYYABACNTJ5O
+uNo5dNgIQRLHzKU91m7immKFiutJ6BlDbkRkKr+Envj13J6HOgYvOTm0n7SPlKHS
+STZ4/T36d/rzQOAbIwEnbbwD9HMj6IzE4WH9lJzH7Zy7Tcyu6dOM8L7nOxCp3DUk
+F3aAnPSFJhD7NN0jBWOFsD6uy1OmaTklPfRAnCt1MQ==
+-----END EC PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.fp b/regress/unittests/sshkey/testdata/ecdsa_2.fp
new file mode 100644
index 000000000..eb4bbdf03
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2.fp
@@ -0,0 +1 @@
+51:bd:ff:2b:6d:26:9b:90:f9:e1:4a:ca:a0:29:8e:70
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.fp.bb b/regress/unittests/sshkey/testdata/ecdsa_2.fp.bb
new file mode 100644
index 000000000..267bc63fd
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2.fp.bb
@@ -0,0 +1 @@
+xuzaz-zuzuk-virop-vypah-zumel-gylak-selih-fevad-varag-zynif-haxox
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.param.curve b/regress/unittests/sshkey/testdata/ecdsa_2.param.curve
new file mode 100644
index 000000000..617ea2fb8
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2.param.curve
@@ -0,0 +1 @@
+secp521r1
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.param.priv b/regress/unittests/sshkey/testdata/ecdsa_2.param.priv
new file mode 100644
index 000000000..537cdaac3
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2.param.priv
@@ -0,0 +1 @@
+01838915c547e8a3f444ffbf3f40146a1ba3d9b8767cd9e2e7866655cc16bb5d111489823f270eeb430a781530557d72fbe8fb7903204c7fee7669578e5252d11114
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.param.pub b/regress/unittests/sshkey/testdata/ecdsa_2.param.pub
new file mode 100644
index 000000000..3352ac769
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2.param.pub
@@ -0,0 +1 @@
+04008d4c9e4eb8da3974d8084112c7cca53dd66ee29a62858aeb49e819436e44642abf849ef8f5dc9e873a062f3939b49fb48f94a1d2493678fd3dfa77faf340e01b2301276dbc03f47323e88cc4e161fd949cc7ed9cbb4dccaee9d38cf0bee73b10a9dc35241776809cf4852610fb34dd23056385b03eaecb53a66939253df4409c2b7531
diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.pub b/regress/unittests/sshkey/testdata/ecdsa_2.pub
new file mode 100644
index 000000000..34e1881dd
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_2.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBACNTJ5OuNo5dNgIQRLHzKU91m7immKFiutJ6BlDbkRkKr+Envj13J6HOgYvOTm0n7SPlKHSSTZ4/T36d/rzQOAbIwEnbbwD9HMj6IzE4WH9lJzH7Zy7Tcyu6dOM8L7nOxCp3DUkF3aAnPSFJhD7NN0jBWOFsD6uy1OmaTklPfRAnCt1MQ== ECDSA test key #2
diff --git a/regress/unittests/sshkey/testdata/ecdsa_n b/regress/unittests/sshkey/testdata/ecdsa_n
new file mode 100644
index 000000000..aec73dd61
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_n
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIFghsFR1K95tz8qOl3+tX6fv8a/O6AfNbxOSFZX3ihxooAoGCCqGSM49
+AwEHoUQDQgAEalpgP0BOePHtTw0Pus4tdhTb8P9yWUZluvLf1D8vrHImT+G4vr/W
+xo5iXGKQVEifuUVyLkAW2kDrq8J/szeRiQ==
+-----END EC PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ecdsa_n_pw b/regress/unittests/sshkey/testdata/ecdsa_n_pw
new file mode 100644
index 000000000..75d585908
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ecdsa_n_pw
@@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABBXqI6Z6o
+uRM+jAwdhnDoIMAAAAEAAAAAEAAABoAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlz
+dHAyNTYAAABBBGpaYD9ATnjx7U8ND7rOLXYU2/D/cllGZbry39Q/L6xyJk/huL6/1saOYl
+xikFRIn7lFci5AFtpA66vCf7M3kYkAAACwYMnoCTqvUTG0ktSSMNsOZLCdal5J4avEpM1L
+sV9SL/RVcwo3ChprhwsnQsaAtMiJCRcHerKgD9qy1MNNaE5VNfVJ0Ih/7ut04cbFKed8p6
+0V+w8WP7WvFffBPoHn+GGbQd1FDGzHhXUB61pH8Qzd1bI/sld/XEtMk7iYjNGQe9Rt0RaK
+Wi8trwaA0Fb2w/EFnrdsFFxrIhQEqYBdEQJo782IqAsMG9OwUaM0vy+8bcI=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ed25519_1 b/regress/unittests/sshkey/testdata/ed25519_1
new file mode 100644
index 000000000..a537ae13d
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACC5PeVeSdyylcfG3C0geNO90e3dGgL0fICaz751dA9zEAAAAJglsAcYJbAH
+GAAAAAtzc2gtZWQyNTUxOQAAACC5PeVeSdyylcfG3C0geNO90e3dGgL0fICaz751dA9zEA
+AAAED6HJ8Bh8tdQvhMd5o8IxtIwBv8/FV48FpBFWAbYdsIsLk95V5J3LKVx8bcLSB4073R
+7d0aAvR8gJrPvnV0D3MQAAAAE0VEMjU1MTkgdGVzdCBrZXkgIzEBAg==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ed25519_1-cert.fp b/regress/unittests/sshkey/testdata/ed25519_1-cert.fp
new file mode 100644
index 000000000..e6d23d0b8
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1-cert.fp
@@ -0,0 +1 @@
+19:08:8e:7e:4d:e5:de:86:2a:09:47:65:eb:0a:51:2f
diff --git a/regress/unittests/sshkey/testdata/ed25519_1-cert.pub b/regress/unittests/sshkey/testdata/ed25519_1-cert.pub
new file mode 100644
index 000000000..ad0b9a888
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1-cert.pub
@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIHmdL66MkkOvncpc0W4MdvlJZMfQthHiOUv+XKm7gvzOAAAAILk95V5J3LKVx8bcLSB4073R7d0aAvR8gJrPvnV0D3MQAAAAAAAAAAgAAAACAAAABmp1bGl1cwAAABIAAAAFaG9zdDEAAAAFaG9zdDIAAAAANouDYAAAAABNHeHgAAAAAAAAAAAAAAAAAAAAMwAAAAtzc2gtZWQyNTUxOQAAACC5PeVeSdyylcfG3C0geNO90e3dGgL0fICaz751dA9zEAAAAFMAAAALc3NoLWVkMjU1MTkAAABAsUStKm1z3Rtvwy3eXE1DrgVp6kix2iEQXfB66IHX2UpAj5yl0eQGXWTSEDIxHDIb0SJvUH43OWX0PrEeAs0mAA== ed25519_1.pub
diff --git a/regress/unittests/sshkey/testdata/ed25519_1.fp b/regress/unittests/sshkey/testdata/ed25519_1.fp
new file mode 100644
index 000000000..e6d23d0b8
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1.fp
@@ -0,0 +1 @@
+19:08:8e:7e:4d:e5:de:86:2a:09:47:65:eb:0a:51:2f
diff --git a/regress/unittests/sshkey/testdata/ed25519_1.fp.bb b/regress/unittests/sshkey/testdata/ed25519_1.fp.bb
new file mode 100644
index 000000000..591a711b4
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1.fp.bb
@@ -0,0 +1 @@
+xofip-nuhoh-botam-cypeg-panig-tunef-bimav-numeb-nikic-gocyf-paxax
diff --git a/regress/unittests/sshkey/testdata/ed25519_1.pub b/regress/unittests/sshkey/testdata/ed25519_1.pub
new file mode 100644
index 000000000..633e05077
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILk95V5J3LKVx8bcLSB4073R7d0aAvR8gJrPvnV0D3MQ ED25519 test key #1
diff --git a/regress/unittests/sshkey/testdata/ed25519_1_pw b/regress/unittests/sshkey/testdata/ed25519_1_pw
new file mode 100644
index 000000000..9fc635208
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_1_pw
@@ -0,0 +1,8 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABAlT1eewp
+9gl0gue+sSrBWKAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAILk95V5J3LKVx8bc
+LSB4073R7d0aAvR8gJrPvnV0D3MQAAAAoMrL9ixIQHoJ86DcKMGt26+bCeaoyGjW5hha2Y
+IxAZ+rRvNjUuv3MGvbUxtUpPZkTP/vk2fVSCuCD9St5Lbt/LKdIk2MfWIFbjZ6iEfdzxz0
+DHmsSDMps8dbePqqIPULR8av447jEzQEkUc8GSR6WqFSJOjJ8OvrJat1KcEK7V2tjZnLS1
+GoLMqVAtCVhuXwUkeJiRQE/JRl172hxB+LAVw=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ed25519_2 b/regress/unittests/sshkey/testdata/ed25519_2
new file mode 100644
index 000000000..a6e5f0040
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_2
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBXUfO5Kid+jhRnyVt+1r9wj2FN/mZ6RfgGdySeYoq4WAAAAJjGeKsZxnir
+GQAAAAtzc2gtZWQyNTUxOQAAACBXUfO5Kid+jhRnyVt+1r9wj2FN/mZ6RfgGdySeYoq4WA
+AAAEB+gn4gGClQl2WMeOkikY+w0A0kSw1KH4Oyami7hlypsFdR87kqJ36OFGfJW37Wv3CP
+YU3+ZnpF+AZ3JJ5iirhYAAAAE0VEMjU1MTkgdGVzdCBrZXkgIzEBAg==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/ed25519_2.fp b/regress/unittests/sshkey/testdata/ed25519_2.fp
new file mode 100644
index 000000000..02c684f36
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_2.fp
@@ -0,0 +1 @@
+5c:c9:ae:a3:0c:aa:28:29:b8:fc:7c:64:ba:6e:e9:c9
diff --git a/regress/unittests/sshkey/testdata/ed25519_2.fp.bb b/regress/unittests/sshkey/testdata/ed25519_2.fp.bb
new file mode 100644
index 000000000..ebe782e2c
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_2.fp.bb
@@ -0,0 +1 @@
+xenoz-tovup-zecyt-hohar-motam-sugid-fecyz-tutyk-gosom-ginar-kixux
diff --git a/regress/unittests/sshkey/testdata/ed25519_2.pub b/regress/unittests/sshkey/testdata/ed25519_2.pub
new file mode 100644
index 000000000..37b93352a
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/ed25519_2.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdR87kqJ36OFGfJW37Wv3CPYU3+ZnpF+AZ3JJ5iirhY ED25519 test key #1
diff --git a/regress/unittests/sshkey/testdata/pw b/regress/unittests/sshkey/testdata/pw
new file mode 100644
index 000000000..8a1dff98a
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/pw
@@ -0,0 +1 @@
+mekmitasdigoat
diff --git a/regress/unittests/sshkey/testdata/rsa1_1 b/regress/unittests/sshkey/testdata/rsa1_1
new file mode 100644
index 000000000..d22014e88
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_1
diff --git a/regress/unittests/sshkey/testdata/rsa1_1.fp b/regress/unittests/sshkey/testdata/rsa1_1.fp
new file mode 100644
index 000000000..782ece0db
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_1.fp
@@ -0,0 +1 @@
+a8:82:9b:98:c5:e6:19:d6:83:39:9f:4d:3a:8f:7c:80
diff --git a/regress/unittests/sshkey/testdata/rsa1_1.fp.bb b/regress/unittests/sshkey/testdata/rsa1_1.fp.bb
new file mode 100644
index 000000000..caaf9511a
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_1.fp.bb
@@ -0,0 +1 @@
+xukib-cymuf-mylib-kecih-rogyb-sorid-belys-kytem-dinin-cicil-kyxex
diff --git a/regress/unittests/sshkey/testdata/rsa1_1.param.n b/regress/unittests/sshkey/testdata/rsa1_1.param.n
new file mode 100644
index 000000000..4ceb37362
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_1.param.n
@@ -0,0 +1 @@
+00cf68059e5c7743318d740d3ebb55eb577891c9c3098817703f4c3157285055c2daa50102509ebdcade324e541c965e2931fd3459052fe65d013722da805d7ec8ef5b97cc006789d0566c5578b23e7aaa5be2b055d85798030cdead2eb2cc4eb3
diff --git a/regress/unittests/sshkey/testdata/rsa1_1.pub b/regress/unittests/sshkey/testdata/rsa1_1.pub
new file mode 100644
index 000000000..56cf30d30
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_1.pub
@@ -0,0 +1 @@
+768 65537 1257820658919101781627826212425999371251377782154008557690434337796299274692579921603319269571889066123773172648045269780061837011867522525764583065919572648969392756890567918758763032103894830246827894023662422727333291801518558899 RSA1 test key #1
diff --git a/regress/unittests/sshkey/testdata/rsa1_1_pw b/regress/unittests/sshkey/testdata/rsa1_1_pw
new file mode 100644
index 000000000..3113dbc0f
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_1_pw
diff --git a/regress/unittests/sshkey/testdata/rsa1_2 b/regress/unittests/sshkey/testdata/rsa1_2
new file mode 100644
index 000000000..e75e665ff
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_2
diff --git a/regress/unittests/sshkey/testdata/rsa1_2.fp b/regress/unittests/sshkey/testdata/rsa1_2.fp
new file mode 100644
index 000000000..c3325371d
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_2.fp
@@ -0,0 +1 @@
+c0:83:1c:97:5f:32:77:7e:e4:e3:e9:29:b9:eb:76:9c
diff --git a/regress/unittests/sshkey/testdata/rsa1_2.fp.bb b/regress/unittests/sshkey/testdata/rsa1_2.fp.bb
new file mode 100644
index 000000000..cd8037140
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_2.fp.bb
@@ -0,0 +1 @@
+xifad-vevot-sozyl-fapeb-meryf-kylut-cydiv-firik-gavyb-lanad-kaxox
diff --git a/regress/unittests/sshkey/testdata/rsa1_2.param.n b/regress/unittests/sshkey/testdata/rsa1_2.param.n
new file mode 100644
index 000000000..f8143a4b9
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_2.param.n
@@ -0,0 +1 @@
+00b08a9fa386aceaab2ec3e9cdc7e6cb4eac9e98620279eed6762e1f513739a417ac8a86231fad3b8727a9de994973a7aae674a132547341984ade91aa1c22f01d2f0204ea7fa121969c367a5d04bda384066cf94e0b56d1efc47f50ca28e90603547df41c0676550d82d369f699b457d4f0f077999d9e76ab679fbf4206d418dbabed1823f14e4ddf3aac987686e6b006f8a23ea6af13b4c0e5b1fb5b1eb4db2f47b229422c450574cae9c64db5dcfce050836b6bdfa8fb541b4d426444a5ea20ad51a25d3048414ced2e199da2997968273e8beb10f3a351e98a57b00dadfa8f00a39bb55be94dae898fda6021d728f32b2ec93edd16e51073be3ac7511e5085
diff --git a/regress/unittests/sshkey/testdata/rsa1_2.pub b/regress/unittests/sshkey/testdata/rsa1_2.pub
new file mode 100644
index 000000000..de1afbb8b
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa1_2.pub
@@ -0,0 +1 @@
+2048 65537 22286299513474010485021611215236051675183880694440075228245854420062562171290421803318459093678819161498086077099067169041536315773126601869537036602014639497662916952995546870691495931205282427606841521014293638607226118353743812583642616889028731910222603216563207637006843580936568089467160095319593442255227365472917576488012409542775346105980501967996562422764758836868135158147777193940857952623773420292946843206784104932927528915610322518810753953608862466374219925252817405397507396462117715293725218947744085154122395590957537510003558169729949140038634486299736757269280065662263306737701939154762092925061 RSA1 test key #2
diff --git a/regress/unittests/sshkey/testdata/rsa_1 b/regress/unittests/sshkey/testdata/rsa_1
new file mode 100644
index 000000000..09e79a72e
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1
@@ -0,0 +1,12 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIBywIBAAJhAM/6MDmVVm/uNQmZpOcthoAAgMDUg7G4H6ZLLyPEhboKaBBHvIdw
+ZdDmB+0LDf3D1aWXyUd2/pCkCysiBzqd/523zAzjY7HayqL6A940AxKBBbWLn+X6
+i2yJR7dTOYkk6QIDAQABAmAgKanBjfWzE5yCIo+c7K5rJyjCKVtAZaAHYIMmveKM
+VcWoFt/x9hDY0GoTX21HfDxLX8oDxnsmhsOrnvSmgUChFwkm45eSETqeVDWwIVFA
+FGL1s38xQsciWZWBFNppAIECMQD7nslReAxwz/Ad++ACXswfJg1l2wUQ1gJA3zh3
+jln6a4s3aV1zxbKlIn8iqBv0BZkCMQDTmO4WqyNnin73XCZs0DWu7GsfcuaH8QnD
+wqPjJgrclTZXedxHkeqO2oyZW4mLC9ECMBb/blsZ49kzyDiVWuYcj/+Q1MyodhAR
+32bagCi9RBAVYEYSRU5dlXRucLxULSnikQIxAJ5teY5Vcru6kZfJUifUuO0QrKAu
+WnbcPVBqMmUHfchsm/RhFFIt6W4uKmlEhTYrkQIxAMAStb7QCU3yU6ZkN7uL22Zs
+498i4jY6y+VEXv+L9O09VdlEnXhbUisOhy1bhyS3yg==
+-----END RSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/rsa_1-cert.fp b/regress/unittests/sshkey/testdata/rsa_1-cert.fp
new file mode 100644
index 000000000..bf9c2e362
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1-cert.fp
@@ -0,0 +1 @@
+be:27:4c:16:27:f5:04:03:62:a8:b7:91:df:a5:b1:3b
diff --git a/regress/unittests/sshkey/testdata/rsa_1-cert.pub b/regress/unittests/sshkey/testdata/rsa_1-cert.pub
new file mode 100644
index 000000000..51b1ce0dd
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1-cert.pub
@@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg1i9Ueveqg9sFSGsEYmsQqlI+dpC3nqhucPfwBVo3DtcAAAADAQABAAAAYQDP+jA5lVZv7jUJmaTnLYaAAIDA1IOxuB+mSy8jxIW6CmgQR7yHcGXQ5gftCw39w9Wll8lHdv6QpAsrIgc6nf+dt8wM42Ox2sqi+gPeNAMSgQW1i5/l+otsiUe3UzmJJOkAAAAAAAAABQAAAAIAAAAGanVsaXVzAAAAEgAAAAVob3N0MQAAAAVob3N0MgAAAAA2i4NgAAAAAE0d4eAAAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAILk95V5J3LKVx8bcLSB4073R7d0aAvR8gJrPvnV0D3MQAAAAUwAAAAtzc2gtZWQyNTUxOQAAAED0TLf2Mv2F9TBt1Skf/1vviUgt7bt9xvL5HqugnVDfKaEg+RNKgfa5Rtpteb39EODkH8v4FJPWlmNG0F9w0cYF rsa_1.pub
diff --git a/regress/unittests/sshkey/testdata/rsa_1.fp b/regress/unittests/sshkey/testdata/rsa_1.fp
new file mode 100644
index 000000000..bf9c2e362
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1.fp
@@ -0,0 +1 @@
+be:27:4c:16:27:f5:04:03:62:a8:b7:91:df:a5:b1:3b
diff --git a/regress/unittests/sshkey/testdata/rsa_1.fp.bb b/regress/unittests/sshkey/testdata/rsa_1.fp.bb
new file mode 100644
index 000000000..448133bad
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1.fp.bb
@@ -0,0 +1 @@
+xetif-zuvul-nylyc-vykor-lumac-gyhyv-bacih-cimyk-sycen-gikym-pixax
diff --git a/regress/unittests/sshkey/testdata/rsa_1.param.n b/regress/unittests/sshkey/testdata/rsa_1.param.n
new file mode 100644
index 000000000..2ffc2ba7e
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1.param.n
@@ -0,0 +1 @@
+00cffa303995566fee350999a4e72d86800080c0d483b1b81fa64b2f23c485ba0a681047bc877065d0e607ed0b0dfdc3d5a597c94776fe90a40b2b22073a9dff9db7cc0ce363b1dacaa2fa03de3403128105b58b9fe5fa8b6c8947b753398924e9
diff --git a/regress/unittests/sshkey/testdata/rsa_1.param.p b/regress/unittests/sshkey/testdata/rsa_1.param.p
new file mode 100644
index 000000000..4fcf148c3
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1.param.p
@@ -0,0 +1 @@
+00fb9ec951780c70cff01dfbe0025ecc1f260d65db0510d60240df38778e59fa6b8b37695d73c5b2a5227f22a81bf40599
diff --git a/regress/unittests/sshkey/testdata/rsa_1.param.q b/regress/unittests/sshkey/testdata/rsa_1.param.q
new file mode 100644
index 000000000..3473f5144
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1.param.q
@@ -0,0 +1 @@
+00d398ee16ab23678a7ef75c266cd035aeec6b1f72e687f109c3c2a3e3260adc95365779dc4791ea8eda8c995b898b0bd1
diff --git a/regress/unittests/sshkey/testdata/rsa_1.pub b/regress/unittests/sshkey/testdata/rsa_1.pub
new file mode 100644
index 000000000..889fdae86
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAYQDP+jA5lVZv7jUJmaTnLYaAAIDA1IOxuB+mSy8jxIW6CmgQR7yHcGXQ5gftCw39w9Wll8lHdv6QpAsrIgc6nf+dt8wM42Ox2sqi+gPeNAMSgQW1i5/l+otsiUe3UzmJJOk= RSA test key #1
diff --git a/regress/unittests/sshkey/testdata/rsa_1_pw b/regress/unittests/sshkey/testdata/rsa_1_pw
new file mode 100644
index 000000000..71637a59b
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_1_pw
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,1E851A01F12A49FDC256E7A665C61D4B
+
++sfWU7kg3idmHL6vShby5LXnfF4bZDPhJjv89uldae7qPEgEW8qS8o0Ssokxf7Au
+/vTQnbSB+gy/qZaUOykOzqiV1YL7UfkbOkM2QYnzzrVeGzI5RZ0G9iH8HBn2owQ+
+Ejf1UKDUVZEea5X0IwQRfE0zaZqFS4tyEex0iKz8dI4FvyabKLZsCs1DBGO7A3ml
+LgP947mh10yKWTP2fbq8LOhDUEWCXrh2NzuH6Rl5nNyC4MNQEkLzK1wL7J/WCNaL
+sciYmuqEQRDikDDQQFZw2wjBD638fhK+IhuN3VGegiXFnu5C+p9kzUvqVk4X9g2r
+BMmlP0pceFv/fEwtNNaeI2Tt7mIsWsZTmCqdzOUAYqGIiNjzykWw64nMO3TpVpbA
+i4854RhblbeiyjENbMVPU6BAk4fx7OJvDElLxwN43CS3U0MldbI7A4uG3B3RTSCj
+1rGxRNAHWC3q3zzrn6gLwrUVje4iTedaKItLIHQeo1A091Tr8AqQdZi/Ck2Ju0Hl
+4Qdwzjw1Y5n1Akm+EWh31ydxtUQ0YBOz/W6DKwTNA1D8oH9bZBG4f0pnvVhtttAO
+WKj+DUqMa+f3OOmQ9UXlitk2pEgjeMngTgfQnhZiCts=
+-----END RSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/rsa_2 b/regress/unittests/sshkey/testdata/rsa_2
new file mode 100644
index 000000000..058cf777a
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAlDS/ygeFfsR/mhZK/XMHU/gzRogPuMQIYUd17WDjMprA6dQb
+ckTDrNm/mrf09I6YAhjgooEL16oWM1z6cesDE0KwaJsy6uTmXFMLO+Ha4mtFHhmu
+tiyJcQ9MKKr0vC64384WQZygZk0OlVz7x9WSPiGXzal5MzsX4TYq5B05o2Cb+epA
+FxK0c8cdYZD0Sy57gWRpRA3yJq4zh/hks98jzn0XA3HAJA39MKhUG5tf5e6z5BeP
+Yi5FvdnDQ9WcasRiEvkmHbg59pbgg/Lbsl6OgZQruS8hKiJ3YBARt2euCCeg7qAF
+KbXRR9TMwfphH3Ai4Oi/w6HPRAhdrwooA/gKkQIDAQABAoIBAH22OLB/rMaYmrvz
+COzvM1oQgD3lj6Bj98+8M9WEh3MXPWeaGSXWGjx1/0aXn1oJ0fqFa5Wr7IWkqmwr
+A+y5McSWntg8PPZt7tCFSFQlAetonhooIsA4CuUx2qHsUOeGoh6EyvAgkRX1atdb
+Jd6d1AyLph43EK1aBKltrvgLqiZfs7mcuwyvKtN9ktdKY2FDhn6DHpm9pE9MEHJV
+Xv1isNc6a0qNoRlKqxrSZHNEN4fbjLw31wBySzmmnIog5wVEwaHeASwLJT6TmuIZ
+eZxnd7/jMwRZWH8ZIGKvkTMp4fYzK9QkehO7A2HFD3FPDBVrkSJjqRdkujF8vu1C
+0RwrD1kCgYEAxFXUoE1ero6vp9akvR/mw94kYjXE/YOz1yi0KTkZUs6gURc8Kzsm
+MzlEZ31rnngE4jQHYAvuPEfiqcnUgylW3QuevMgo2hCLYO7aG5C0fk8TeOiuvnrF
+YPO8rSJWk/BgdrPtzu45P7jmWsjkHn+y+t8cKvq1sZY40sn2YgIhYK8CgYEAwT6j
+5tReI6sxpHltPUbvOdpD04eL6ggBAKwzb5aBoa/Dj+sU1zg5uyY8diggQEEznlBW
+iWTQmmmfy1ef9i6YAwNuZveKOrVwNMcdubQJ2X26XoFrmA59PjsbLtr1bdUb02gz
+6P5x6pcw5qzEq0mddgvHiU3RhL24xdc1LW8nmL8CgYEAmgaT1macPuklmNBlURGz
+4jll5b41GoW2EreWDzkCStpbHwLRa0DuCQWGSoI0aY/SlPsoRgtWDOiAQ59ZHsTR
+pnw1PfjxQ5HzJkp7xWBSmTzEE/jHDhwWuKa+gD0OGuVbaARkLhDpzLnrzZEIlXyt
+Fu7tlDI3VGh7j7Jtnhn5wXUCgYBKmPbGfcaVeFmih2lfFUn2CEbUmmetgUd5zf/R
+HMWP9/zDStlxt3e5winm5tiEVWcqvxKY2T0Zzppr8biDXTs7NpDg2MAYp7/X7+GO
+tWxz8/AE2WsCeN1qL4Dv1oCV1IV4V6pqUAcDqzeqZJlLEhDh5+wwGcU+u8pfPRN/
+JYCgmwKBgDa+kXPqzcc6vzD9cwEEk4ftn9/Vk2yBx0XOu8RdEkRhXj1QXGJckCqh
+FkXzVbuurFhsBt+H0B4arw+51T9fVCZqfcaU34u+Qa/FQvTod4OJUSRxYUaDqygs
+VTyuP+zGZlIw7JWktxjVazENsM/ef5wBH0Nf839OZbPVDLfn7K0j
+-----END RSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/rsa_2.fp b/regress/unittests/sshkey/testdata/rsa_2.fp
new file mode 100644
index 000000000..53939f413
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2.fp
@@ -0,0 +1 @@
+fb:8f:7b:26:3d:42:40:ef:ed:f1:ed:ee:66:9e:ba:b0
diff --git a/regress/unittests/sshkey/testdata/rsa_2.fp.bb b/regress/unittests/sshkey/testdata/rsa_2.fp.bb
new file mode 100644
index 000000000..e90a3571a
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2.fp.bb
@@ -0,0 +1 @@
+xepev-gupub-vuvyg-femiv-gonat-defiv-hirak-betub-pahut-veryd-hexix
diff --git a/regress/unittests/sshkey/testdata/rsa_2.param.n b/regress/unittests/sshkey/testdata/rsa_2.param.n
new file mode 100644
index 000000000..389de4226
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2.param.n
@@ -0,0 +1 @@
+009434bfca07857ec47f9a164afd730753f83346880fb8c408614775ed60e3329ac0e9d41b7244c3acd9bf9ab7f4f48e980218e0a2810bd7aa16335cfa71eb031342b0689b32eae4e65c530b3be1dae26b451e19aeb62c89710f4c28aaf4bc2eb8dfce16419ca0664d0e955cfbc7d5923e2197cda979333b17e1362ae41d39a3609bf9ea401712b473c71d6190f44b2e7b816469440df226ae3387f864b3df23ce7d170371c0240dfd30a8541b9b5fe5eeb3e4178f622e45bdd9c343d59c6ac46212f9261db839f696e083f2dbb25e8e81942bb92f212a2277601011b767ae0827a0eea00529b5d147d4ccc1fa611f7022e0e8bfc3a1cf44085daf0a2803f80a91
diff --git a/regress/unittests/sshkey/testdata/rsa_2.param.p b/regress/unittests/sshkey/testdata/rsa_2.param.p
new file mode 100644
index 000000000..c3c9a130a
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2.param.p
@@ -0,0 +1 @@
+00c455d4a04d5eae8eafa7d6a4bd1fe6c3de246235c4fd83b3d728b429391952cea051173c2b3b26333944677d6b9e7804e23407600bee3c47e2a9c9d4832956dd0b9ebcc828da108b60eeda1b90b47e4f1378e8aebe7ac560f3bcad225693f06076b3edceee393fb8e65ac8e41e7fb2fadf1c2afab5b19638d2c9f662022160af
diff --git a/regress/unittests/sshkey/testdata/rsa_2.param.q b/regress/unittests/sshkey/testdata/rsa_2.param.q
new file mode 100644
index 000000000..728c474b0
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2.param.q
@@ -0,0 +1 @@
+00c13ea3e6d45e23ab31a4796d3d46ef39da43d3878bea080100ac336f9681a1afc38feb14d73839bb263c7628204041339e50568964d09a699fcb579ff62e9803036e66f78a3ab57034c71db9b409d97dba5e816b980e7d3e3b1b2edaf56dd51bd36833e8fe71ea9730e6acc4ab499d760bc7894dd184bdb8c5d7352d6f2798bf
diff --git a/regress/unittests/sshkey/testdata/rsa_2.pub b/regress/unittests/sshkey/testdata/rsa_2.pub
new file mode 100644
index 000000000..ed9f78cad
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_2.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUNL/KB4V+xH+aFkr9cwdT+DNGiA+4xAhhR3XtYOMymsDp1BtyRMOs2b+at/T0jpgCGOCigQvXqhYzXPpx6wMTQrBomzLq5OZcUws74dria0UeGa62LIlxD0woqvS8LrjfzhZBnKBmTQ6VXPvH1ZI+IZfNqXkzOxfhNirkHTmjYJv56kAXErRzxx1hkPRLLnuBZGlEDfImrjOH+GSz3yPOfRcDccAkDf0wqFQbm1/l7rPkF49iLkW92cND1ZxqxGIS+SYduDn2luCD8tuyXo6BlCu5LyEqIndgEBG3Z64IJ6DuoAUptdFH1MzB+mEfcCLg6L/Doc9ECF2vCigD+AqR RSA test key #2
diff --git a/regress/unittests/sshkey/testdata/rsa_n b/regress/unittests/sshkey/testdata/rsa_n
new file mode 100644
index 000000000..09e79a72e
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_n
@@ -0,0 +1,12 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIBywIBAAJhAM/6MDmVVm/uNQmZpOcthoAAgMDUg7G4H6ZLLyPEhboKaBBHvIdw
+ZdDmB+0LDf3D1aWXyUd2/pCkCysiBzqd/523zAzjY7HayqL6A940AxKBBbWLn+X6
+i2yJR7dTOYkk6QIDAQABAmAgKanBjfWzE5yCIo+c7K5rJyjCKVtAZaAHYIMmveKM
+VcWoFt/x9hDY0GoTX21HfDxLX8oDxnsmhsOrnvSmgUChFwkm45eSETqeVDWwIVFA
+FGL1s38xQsciWZWBFNppAIECMQD7nslReAxwz/Ad++ACXswfJg1l2wUQ1gJA3zh3
+jln6a4s3aV1zxbKlIn8iqBv0BZkCMQDTmO4WqyNnin73XCZs0DWu7GsfcuaH8QnD
+wqPjJgrclTZXedxHkeqO2oyZW4mLC9ECMBb/blsZ49kzyDiVWuYcj/+Q1MyodhAR
+32bagCi9RBAVYEYSRU5dlXRucLxULSnikQIxAJ5teY5Vcru6kZfJUifUuO0QrKAu
+WnbcPVBqMmUHfchsm/RhFFIt6W4uKmlEhTYrkQIxAMAStb7QCU3yU6ZkN7uL22Zs
+498i4jY6y+VEXv+L9O09VdlEnXhbUisOhy1bhyS3yg==
+-----END RSA PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/testdata/rsa_n_pw b/regress/unittests/sshkey/testdata/rsa_n_pw
new file mode 100644
index 000000000..0166fd5f1
--- /dev/null
+++ b/regress/unittests/sshkey/testdata/rsa_n_pw
@@ -0,0 +1,14 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABClELgtaZ
+qAmMwESpqXDN0uAAAAEAAAAAEAAAB3AAAAB3NzaC1yc2EAAAADAQABAAAAYQDP+jA5lVZv
+7jUJmaTnLYaAAIDA1IOxuB+mSy8jxIW6CmgQR7yHcGXQ5gftCw39w9Wll8lHdv6QpAsrIg
+c6nf+dt8wM42Ox2sqi+gPeNAMSgQW1i5/l+otsiUe3UzmJJOkAAAGgwJpHy/nshQa9+Jbw
+yomvgNMYvuuoD7Ll7iCY/RFFGXivTkki27C9q0qx3afauSLQQWFanGhjeJn7JPy98lMcVl
+qnn5XOE5+xxZqA8ONOBD8eH0KBcTH17DH1A1z94p5zZ1VJKIWsBZ0krxgHIXcdv9ucAckj
+N0vAEBm+0wsfy2TTOtuqXvcj65wFwknpyy/SSvU0QTr99FiYe9PIhIslBHO6wlqxfKj+Tm
+E/nCb75dAVu6gTtS2P0pdOqV/V7VHX5C0z3BROqpKDJJcVeoc7vRkEl+MWfvvQrG66IPEW
+luohFXPDPDrxu1zDduyRsmNwpBHChi2rFhxtsjxNK0svMwESeCCKAWmPxnzLJfvMbTCv00
+SpaCr7WhtzsGt73axqSkeOdynp5NNrN7MEdwruMZFirF4BcI2z2H9ugpS+qbLPuE2H5vln
+h7NSwBUNwmZ+4TC8MXFH9KIpRg8dNhf66OU610LYiN4+ZfOYCmfQfgQuBGhMTYFMY6O4SB
+NCdIavvWY6rDSBq7QC1f4rHpwiXxpkiE43Rd8fM32TaPlBPtA=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/sshkey/tests.c b/regress/unittests/sshkey/tests.c
new file mode 100644
index 000000000..13f265cdb
--- /dev/null
+++ b/regress/unittests/sshkey/tests.c
@@ -0,0 +1,27 @@
+/*      $OpenBSD: tests.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/*
+ * Regress test for sshbuf.h buffer API
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <openssl/evp.h>
+
+#include "../test_helper/test_helper.h"
+
+void sshkey_tests(void);
+void sshkey_file_tests(void);
+void sshkey_fuzz_tests(void);
+
+void
+tests(void)
+{
+        OpenSSL_add_all_algorithms();
+        ERR_load_CRYPTO_strings();
+
+        sshkey_tests();
+        sshkey_file_tests();
+        sshkey_fuzz_tests();
+}
diff --git a/regress/unittests/test_helper/Makefile b/regress/unittests/test_helper/Makefile
new file mode 100644
index 000000000..3e90903ef
--- /dev/null
+++ b/regress/unittests/test_helper/Makefile
@@ -0,0 +1,13 @@
+#       $OpenBSD: Makefile,v 1.1 2014/04/30 05:32:00 djm Exp $
+
+LIB=    test_helper
+SRCS=   test_helper.c fuzz.c
+
+DEBUGLIBS= no
+NOPROFILE= yes
+NOPIC=  yes
+
+install:
+        @echo -n
+
+.include <bsd.lib.mk>
diff --git a/regress/unittests/test_helper/fuzz.c b/regress/unittests/test_helper/fuzz.c
new file mode 100644
index 000000000..77c6e7cad
--- /dev/null
+++ b/regress/unittests/test_helper/fuzz.c
@@ -0,0 +1,378 @@
+/*      $OpenBSD: fuzz.c,v 1.3 2014/05/02 09:41:32 andre Exp $  */
+/*
+ * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* Utility functions/framework for fuzz tests */
+
+#include "includes.h"
+
+#include <sys/types.h>
+
+#include <assert.h>
+#include <ctype.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+
+#include "test_helper.h"
+
+/* #define FUZZ_DEBUG */
+
+#ifdef FUZZ_DEBUG
+# define FUZZ_DBG(x) do { \
+                printf("%s:%d %s: ", __FILE__, __LINE__, __func__); \
+                printf x; \
+                printf("\n"); \
+                fflush(stdout); \
+        } while (0)
+#else
+# define FUZZ_DBG(x)
+#endif
+
+/* For brevity later */
+typedef unsigned long long fuzz_ullong;
+
+/* For base-64 fuzzing */
+static const char fuzz_b64chars[] =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+struct fuzz {
+        /* Fuzz method currently in use */
+        int strategy;
+
+        /* Fuzz methods remaining */
+        int strategies;
+
+        /* Original seed data blob */
+        void *seed;
+        size_t slen;
+
+        /* Current working copy of seed with fuzz mutations applied */
+        u_char *fuzzed;
+
+        /* Used by fuzz methods */
+        size_t o1, o2;
+};
+
+static const char *
+fuzz_ntop(u_int n)
+{
+        switch (n) {
+        case 0:
+                return "NONE";
+        case FUZZ_1_BIT_FLIP:
+                return "FUZZ_1_BIT_FLIP";
+        case FUZZ_2_BIT_FLIP:
+                return "FUZZ_2_BIT_FLIP";
+        case FUZZ_1_BYTE_FLIP:
+                return "FUZZ_1_BYTE_FLIP";
+        case FUZZ_2_BYTE_FLIP:
+                return "FUZZ_2_BYTE_FLIP";
+        case FUZZ_TRUNCATE_START:
+                return "FUZZ_TRUNCATE_START";
+        case FUZZ_TRUNCATE_END:
+                return "FUZZ_TRUNCATE_END";
+        case FUZZ_BASE64:
+                return "FUZZ_BASE64";
+        default:
+                abort();
+        }
+}
+
+void
+fuzz_dump(struct fuzz *fuzz)
+{
+        u_char *p = fuzz_ptr(fuzz);
+        size_t i, j, len = fuzz_len(fuzz);
+
+        switch (fuzz->strategy) {
+        case FUZZ_1_BIT_FLIP:
+                fprintf(stderr, "%s case %zu of %zu (bit: %zu)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    fuzz->o1, fuzz->slen * 8, fuzz->o1);
+                break;
+        case FUZZ_2_BIT_FLIP:
+                fprintf(stderr, "%s case %llu of %llu (bits: %zu, %zu)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    (((fuzz_ullong)fuzz->o2) * fuzz->slen * 8) + fuzz->o1,
+                    ((fuzz_ullong)fuzz->slen * 8) * fuzz->slen * 8,
+                    fuzz->o1, fuzz->o2);
+                break;
+        case FUZZ_1_BYTE_FLIP:
+                fprintf(stderr, "%s case %zu of %zu (byte: %zu)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    fuzz->o1, fuzz->slen, fuzz->o1);
+                break;
+        case FUZZ_2_BYTE_FLIP:
+                fprintf(stderr, "%s case %llu of %llu (bytes: %zu, %zu)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    (((fuzz_ullong)fuzz->o2) * fuzz->slen) + fuzz->o1,
+                    ((fuzz_ullong)fuzz->slen) * fuzz->slen,
+                    fuzz->o1, fuzz->o2);
+                break;
+        case FUZZ_TRUNCATE_START:
+                fprintf(stderr, "%s case %zu of %zu (offset: %zu)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    fuzz->o1, fuzz->slen, fuzz->o1);
+                break;
+        case FUZZ_TRUNCATE_END:
+                fprintf(stderr, "%s case %zu of %zu (offset: %zu)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    fuzz->o1, fuzz->slen, fuzz->o1);
+                break;
+        case FUZZ_BASE64:
+                assert(fuzz->o2 < sizeof(fuzz_b64chars) - 1);
+                fprintf(stderr, "%s case %llu of %llu (offset: %zu char: %c)\n",
+                    fuzz_ntop(fuzz->strategy),
+                    (fuzz->o1 * (fuzz_ullong)64) + fuzz->o2,
+                    fuzz->slen * (fuzz_ullong)64, fuzz->o1,
+                    fuzz_b64chars[fuzz->o2]);
+                break;
+        default:
+                abort();
+        }
+
+        fprintf(stderr, "fuzz context %p len = %zu\n", fuzz, len);
+        for (i = 0; i < len; i += 16) {
+                fprintf(stderr, "%.4zd: ", i);
+                for (j = i; j < i + 16; j++) {
+                        if (j < len)
+                                fprintf(stderr, "%02x ", p[j]);
+                        else
+                                fprintf(stderr, "   ");
+                }
+                fprintf(stderr, " ");
+                for (j = i; j < i + 16; j++) {
+                        if (j < len) {
+                                if  (isascii(p[j]) && isprint(p[j]))
+                                        fprintf(stderr, "%c", p[j]);
+                                else
+                                        fprintf(stderr, ".");
+                        }
+                }
+                fprintf(stderr, "\n");
+        }
+}
+
+struct fuzz *
+fuzz_begin(u_int strategies, const void *p, size_t l)
+{
+        struct fuzz *ret = calloc(sizeof(*ret), 1);
+
+        assert(p != NULL);
+        assert(ret != NULL);
+        ret->seed = malloc(l);
+        assert(ret->seed != NULL);
+        memcpy(ret->seed, p, l);
+        ret->slen = l;
+        ret->strategies = strategies;
+
+        assert(ret->slen < SIZE_MAX / 8);
+        assert(ret->strategies <= (FUZZ_MAX|(FUZZ_MAX-1)));
+
+        FUZZ_DBG(("begin, ret = %p", ret));
+
+        fuzz_next(ret);
+        return ret;
+}
+
+void
+fuzz_cleanup(struct fuzz *fuzz)
+{
+        FUZZ_DBG(("cleanup, fuzz = %p", fuzz));
+        assert(fuzz != NULL);
+        assert(fuzz->seed != NULL);
+        assert(fuzz->fuzzed != NULL);
+        free(fuzz->seed);
+        free(fuzz->fuzzed);
+        free(fuzz);
+}
+
+static int
+fuzz_strategy_done(struct fuzz *fuzz)
+{
+        FUZZ_DBG(("fuzz = %p, strategy = %s, o1 = %zu, o2 = %zu, slen = %zu",
+            fuzz, fuzz_ntop(fuzz->strategy), fuzz->o1, fuzz->o2, fuzz->slen));
+
+        switch (fuzz->strategy) {
+        case FUZZ_1_BIT_FLIP:
+                return fuzz->o1 >= fuzz->slen * 8;
+        case FUZZ_2_BIT_FLIP:
+                return fuzz->o2 >= fuzz->slen * 8;
+        case FUZZ_2_BYTE_FLIP:
+                return fuzz->o2 >= fuzz->slen;
+        case FUZZ_1_BYTE_FLIP:
+        case FUZZ_TRUNCATE_START:
+        case FUZZ_TRUNCATE_END:
+        case FUZZ_BASE64:
+                return fuzz->o1 >= fuzz->slen;
+        default:
+                abort();
+        }
+}
+
+void
+fuzz_next(struct fuzz *fuzz)
+{
+        u_int i;
+
+        FUZZ_DBG(("start, fuzz = %p, strategy = %s, strategies = 0x%lx, "
+            "o1 = %zu, o2 = %zu, slen = %zu", fuzz, fuzz_ntop(fuzz->strategy),
+            (u_long)fuzz->strategies, fuzz->o1, fuzz->o2, fuzz->slen));
+
+        if (fuzz->strategy == 0 || fuzz_strategy_done(fuzz)) {
+                /* If we are just starting out, we need to allocate too */
+                if (fuzz->fuzzed == NULL) {
+                        FUZZ_DBG(("alloc"));
+                        fuzz->fuzzed = calloc(fuzz->slen, 1);
+                }
+                /* Pick next strategy */
+                FUZZ_DBG(("advance"));
+                for (i = 1; i <= FUZZ_MAX; i <<= 1) {
+                        if ((fuzz->strategies & i) != 0) {
+                                fuzz->strategy = i;
+                                break;
+                        }
+                }
+                FUZZ_DBG(("selected = %u", fuzz->strategy));
+                if (fuzz->strategy == 0) {
+                        FUZZ_DBG(("done, no more strategies"));
+                        return;
+                }
+                fuzz->strategies &= ~(fuzz->strategy);
+                fuzz->o1 = fuzz->o2 = 0;
+        }
+
+        assert(fuzz->fuzzed != NULL);
+
+        switch (fuzz->strategy) {
+        case FUZZ_1_BIT_FLIP:
+                assert(fuzz->o1 / 8 < fuzz->slen);
+                memcpy(fuzz->fuzzed, fuzz->seed, fuzz->slen);
+                fuzz->fuzzed[fuzz->o1 / 8] ^= 1 << (fuzz->o1 % 8);
+                fuzz->o1++;
+                break;
+        case FUZZ_2_BIT_FLIP:
+                assert(fuzz->o1 / 8 < fuzz->slen);
+                assert(fuzz->o2 / 8 < fuzz->slen);
+                memcpy(fuzz->fuzzed, fuzz->seed, fuzz->slen);
+                fuzz->fuzzed[fuzz->o1 / 8] ^= 1 << (fuzz->o1 % 8);
+                fuzz->fuzzed[fuzz->o2 / 8] ^= 1 << (fuzz->o2 % 8);
+                fuzz->o1++;
+                if (fuzz->o1 >= fuzz->slen * 8) {
+                        fuzz->o1 = 0;
+                        fuzz->o2++;
+                }
+                break;
+        case FUZZ_1_BYTE_FLIP:
+                assert(fuzz->o1 < fuzz->slen);
+                memcpy(fuzz->fuzzed, fuzz->seed, fuzz->slen);
+                fuzz->fuzzed[fuzz->o1] ^= 0xff;
+                fuzz->o1++;
+                break;
+        case FUZZ_2_BYTE_FLIP:
+                assert(fuzz->o1 < fuzz->slen);
+                assert(fuzz->o2 < fuzz->slen);
+                memcpy(fuzz->fuzzed, fuzz->seed, fuzz->slen);
+                fuzz->fuzzed[fuzz->o1] ^= 0xff;
+                fuzz->fuzzed[fuzz->o2] ^= 0xff;
+                fuzz->o1++;
+                if (fuzz->o1 >= fuzz->slen) {
+                        fuzz->o1 = 0;
+                        fuzz->o2++;
+                }
+                break;
+        case FUZZ_TRUNCATE_START:
+        case FUZZ_TRUNCATE_END:
+                assert(fuzz->o1 < fuzz->slen);
+                memcpy(fuzz->fuzzed, fuzz->seed, fuzz->slen);
+                fuzz->o1++;
+                break;
+        case FUZZ_BASE64:
+                assert(fuzz->o1 < fuzz->slen);
+                assert(fuzz->o2 < sizeof(fuzz_b64chars) - 1);
+                memcpy(fuzz->fuzzed, fuzz->seed, fuzz->slen);
+                fuzz->fuzzed[fuzz->o1] = fuzz_b64chars[fuzz->o2];
+                fuzz->o2++;
+                if (fuzz->o2 >= sizeof(fuzz_b64chars) - 1) {
+                        fuzz->o2 = 0;
+                        fuzz->o1++;
+                }
+                break;
+        default:
+                abort();
+        }
+
+        FUZZ_DBG(("done, fuzz = %p, strategy = %s, strategies = 0x%lx, "
+            "o1 = %zu, o2 = %zu, slen = %zu", fuzz, fuzz_ntop(fuzz->strategy),
+            (u_long)fuzz->strategies, fuzz->o1, fuzz->o2, fuzz->slen));
+}
+
+int
+fuzz_done(struct fuzz *fuzz)
+{
+        FUZZ_DBG(("fuzz = %p, strategies = 0x%lx", fuzz,
+            (u_long)fuzz->strategies));
+
+        return fuzz_strategy_done(fuzz) && fuzz->strategies == 0;
+}
+
+size_t
+fuzz_len(struct fuzz *fuzz)
+{
+        assert(fuzz->fuzzed != NULL);
+        switch (fuzz->strategy) {
+        case FUZZ_1_BIT_FLIP:
+        case FUZZ_2_BIT_FLIP:
+        case FUZZ_1_BYTE_FLIP:
+        case FUZZ_2_BYTE_FLIP:
+        case FUZZ_BASE64:
+                return fuzz->slen;
+        case FUZZ_TRUNCATE_START:
+        case FUZZ_TRUNCATE_END:
+                assert(fuzz->o1 <= fuzz->slen);
+                return fuzz->slen - fuzz->o1;
+        default:
+                abort();
+        }
+}
+
+u_char *
+fuzz_ptr(struct fuzz *fuzz)
+{
+        assert(fuzz->fuzzed != NULL);
+        switch (fuzz->strategy) {
+        case FUZZ_1_BIT_FLIP:
+        case FUZZ_2_BIT_FLIP:
+        case FUZZ_1_BYTE_FLIP:
+        case FUZZ_2_BYTE_FLIP:
+        case FUZZ_BASE64:
+                return fuzz->fuzzed;
+        case FUZZ_TRUNCATE_START:
+                assert(fuzz->o1 <= fuzz->slen);
+                return fuzz->fuzzed + fuzz->o1;
+        case FUZZ_TRUNCATE_END:
+                assert(fuzz->o1 <= fuzz->slen);
+                return fuzz->fuzzed;
+        default:
+                abort();
+        }
+}
+
diff --git a/regress/unittests/test_helper/test_helper.c b/regress/unittests/test_helper/test_helper.c
new file mode 100644
index 000000000..d0bc67833
--- /dev/null
+++ b/regress/unittests/test_helper/test_helper.c
@@ -0,0 +1,471 @@
+/*      $OpenBSD: test_helper.c,v 1.2 2014/05/02 09:41:32 andre Exp $   */
+/*
+ * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* Utility functions/framework for regress tests */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+
+#include <fcntl.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+#include <unistd.h>
+
+#include <openssl/bn.h>
+
+#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
+# include <vis.h>
+#endif
+
+#include "test_helper.h"
+
+#define TEST_CHECK_INT(r, pred) do {            \
+                switch (pred) {                 \
+                case TEST_EQ:                   \
+                        if (r == 0)             \
+                                return;         \
+                        break;                  \
+                case TEST_NE:                   \
+                        if (r != 0)             \
+                                return;         \
+                        break;                  \
+                case TEST_LT:                   \
+                        if (r < 0)              \
+                                return;         \
+                        break;                  \
+                case TEST_LE:                   \
+                        if (r <= 0)             \
+                                return;         \
+                        break;                  \
+                case TEST_GT:                   \
+                        if (r > 0)              \
+                                return;         \
+                        break;                  \
+                case TEST_GE:                   \
+                        if (r >= 0)             \
+                                return;         \
+                        break;                  \
+                default:                        \
+                        abort();                \
+                }                               \
+        } while (0)
+
+#define TEST_CHECK(x1, x2, pred) do {           \
+                switch (pred) {                 \
+                case TEST_EQ:                   \
+                        if (x1 == x2)           \
+                                return;         \
+                        break;                  \
+                case TEST_NE:                   \
+                        if (x1 != x2)           \
+                                return;         \
+                        break;                  \
+                case TEST_LT:                   \
+                        if (x1 < x2)            \
+                                return;         \
+                        break;                  \
+                case TEST_LE:                   \
+                        if (x1 <= x2)           \
+                                return;         \
+                        break;                  \
+                case TEST_GT:                   \
+                        if (x1 > x2)            \
+                                return;         \
+                        break;                  \
+                case TEST_GE:                   \
+                        if (x1 >= x2)           \
+                                return;         \
+                        break;                  \
+                default:                        \
+                        abort();                \
+                }                               \
+        } while (0)
+
+extern char *__progname;
+
+static int verbose_mode = 0;
+static int quiet_mode = 0;
+static char *active_test_name = NULL;
+static u_int test_number = 0;
+static test_onerror_func_t *test_onerror = NULL;
+static void *onerror_ctx = NULL;
+static const char *data_dir = NULL;
+
+int
+main(int argc, char **argv)
+{
+        int ch;
+
+        /* Handle systems without __progname */
+        if (__progname == NULL) {
+                __progname = strrchr(argv[0], '/');
+                if (__progname == NULL || __progname[1] == '\0')
+                        __progname = argv[0];   
+                else
+                        __progname++;
+                if ((__progname = strdup(__progname)) == NULL) {
+                        fprintf(stderr, "strdup failed\n");
+                        exit(1);
+                }
+        }
+
+        while ((ch = getopt(argc, argv, "vqd:")) != -1) {
+                switch (ch) {
+                case 'd':
+                        data_dir = optarg;
+                        break;
+                case 'q':
+                        verbose_mode = 0;
+                        quiet_mode = 1;
+                        break;
+                case 'v':
+                        verbose_mode = 1;
+                        quiet_mode = 0;
+                        break;
+                default:
+                        fprintf(stderr, "Unrecognised command line option\n");
+                        fprintf(stderr, "Usage: %s [-v]\n", __progname);
+                        exit(1);
+                }
+        }
+        setvbuf(stdout, NULL, _IONBF, 0);
+        if (!quiet_mode)
+                printf("%s: ", __progname);
+        if (verbose_mode)
+                printf("\n");
+
+        tests();
+
+        if (!quiet_mode)
+                printf(" %u tests ok\n", test_number);
+        return 0;
+}
+
+const char *
+test_data_file(const char *name)
+{
+        static char ret[PATH_MAX];
+
+        if (data_dir != NULL)
+                snprintf(ret, sizeof(ret), "%s/%s", data_dir, name);
+        else
+                strlcpy(ret, name, sizeof(ret));
+        if (access(ret, F_OK) != 0) {
+                fprintf(stderr, "Cannot access data file %s: %s\n",
+                    ret, strerror(errno));
+                exit(1);
+        }
+        return ret;
+}
+
+void
+test_start(const char *n)
+{
+        assert(active_test_name == NULL);
+        assert((active_test_name = strdup(n)) != NULL);
+        if (verbose_mode)
+                printf("test %u - \"%s\": ", test_number, active_test_name);
+        test_number++;
+}
+
+void
+set_onerror_func(test_onerror_func_t *f, void *ctx)
+{
+        test_onerror = f;
+        onerror_ctx = ctx;
+}
+
+void
+test_done(void)
+{
+        assert(active_test_name != NULL);
+        free(active_test_name);
+        active_test_name = NULL;
+        if (verbose_mode)
+                printf("OK\n");
+        else if (!quiet_mode) {
+                printf(".");
+                fflush(stdout);
+        }
+}
+
+void
+ssl_err_check(const char *file, int line)
+{
+        long openssl_error = ERR_get_error();
+
+        if (openssl_error == 0)
+                return;
+
+        fprintf(stderr, "\n%s:%d: uncaught OpenSSL error: %s",
+            file, line, ERR_error_string(openssl_error, NULL));
+        abort();
+}
+
+static const char *
+pred_name(enum test_predicate p)
+{
+        switch (p) {
+        case TEST_EQ:
+                return "EQ";
+        case TEST_NE:
+                return "NE";
+        case TEST_LT:
+                return "LT";
+        case TEST_LE:
+                return "LE";
+        case TEST_GT:
+                return "GT";
+        case TEST_GE:
+                return "GE";
+        default:
+                return "UNKNOWN";
+        }
+}
+
+static void
+test_die(void)
+{
+        if (test_onerror != NULL)
+                test_onerror(onerror_ctx);
+        abort();
+}
+
+static void
+test_header(const char *file, int line, const char *a1, const char *a2,
+    const char *name, enum test_predicate pred)
+{
+        fprintf(stderr, "\n%s:%d test #%u \"%s\"\n", 
+            file, line, test_number, active_test_name);
+        fprintf(stderr, "ASSERT_%s_%s(%s%s%s) failed:\n",
+            name, pred_name(pred), a1,
+            a2 != NULL ? ", " : "", a2 != NULL ? a2 : "");
+}
+
+void
+assert_bignum(const char *file, int line, const char *a1, const char *a2,
+    const BIGNUM *aa1, const BIGNUM *aa2, enum test_predicate pred)
+{
+        int r = BN_cmp(aa1, aa2);
+
+        TEST_CHECK_INT(r, pred);
+        test_header(file, line, a1, a2, "BIGNUM", pred);
+        fprintf(stderr, "%12s = 0x%s\n", a1, BN_bn2hex(aa1));
+        fprintf(stderr, "%12s = 0x%s\n", a2, BN_bn2hex(aa2));
+        test_die();
+}
+
+void
+assert_string(const char *file, int line, const char *a1, const char *a2,
+    const char *aa1, const char *aa2, enum test_predicate pred)
+{
+        int r = strcmp(aa1, aa2);
+
+        TEST_CHECK_INT(r, pred);
+        test_header(file, line, a1, a2, "STRING", pred);
+        fprintf(stderr, "%12s = %s (len %zu)\n", a1, aa1, strlen(aa1));
+        fprintf(stderr, "%12s = %s (len %zu)\n", a2, aa2, strlen(aa2));
+        test_die();
+}
+
+static char *
+tohex(const void *_s, size_t l)
+{
+        u_int8_t *s = (u_int8_t *)_s;
+        size_t i, j;
+        const char *hex = "0123456789abcdef";
+        char *r = malloc((l * 2) + 1);
+
+        assert(r != NULL);
+        for (i = j = 0; i < l; i++) {
+                r[j++] = hex[(s[i] >> 4) & 0xf];
+                r[j++] = hex[s[i] & 0xf];
+        }
+        r[j] = '\0';
+        return r;
+}
+
+void
+assert_mem(const char *file, int line, const char *a1, const char *a2,
+    const void *aa1, const void *aa2, size_t l, enum test_predicate pred)
+{
+        int r = memcmp(aa1, aa2, l);
+
+        TEST_CHECK_INT(r, pred);
+        test_header(file, line, a1, a2, "STRING", pred);
+        fprintf(stderr, "%12s = %s (len %zu)\n", a1, tohex(aa1, MIN(l, 256)), l);
+        fprintf(stderr, "%12s = %s (len %zu)\n", a2, tohex(aa2, MIN(l, 256)), l);
+        test_die();
+}
+
+static int
+memvalcmp(const u_int8_t *s, u_char v, size_t l, size_t *where)
+{
+        size_t i;
+
+        for (i = 0; i < l; i++) {
+                if (s[i] != v) {
+                        *where = i;
+                        return 1;
+                }
+        }
+        return 0;
+}
+
+void
+assert_mem_filled(const char *file, int line, const char *a1,
+    const void *aa1, u_char v, size_t l, enum test_predicate pred)
+{
+        size_t where = -1;
+        int r = memvalcmp(aa1, v, l, &where);
+        char tmp[64];
+
+        if (l == 0)
+                return;
+        TEST_CHECK_INT(r, pred);
+        test_header(file, line, a1, NULL, "MEM_ZERO", pred);
+        fprintf(stderr, "%20s = %s%s (len %zu)\n", a1,
+            tohex(aa1, MIN(l, 20)), l > 20 ? "..." : "", l);
+        snprintf(tmp, sizeof(tmp), "(%s)[%zu]", a1, where);
+        fprintf(stderr, "%20s = 0x%02x (expected 0x%02x)\n", tmp,
+            ((u_char *)aa1)[where], v);
+        test_die();
+}
+
+void
+assert_int(const char *file, int line, const char *a1, const char *a2,
+    int aa1, int aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "INT", pred);
+        fprintf(stderr, "%12s = %d\n", a1, aa1);
+        fprintf(stderr, "%12s = %d\n", a2, aa2);
+        test_die();
+}
+
+void
+assert_size_t(const char *file, int line, const char *a1, const char *a2,
+    size_t aa1, size_t aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "SIZE_T", pred);
+        fprintf(stderr, "%12s = %zu\n", a1, aa1);
+        fprintf(stderr, "%12s = %zu\n", a2, aa2);
+        test_die();
+}
+
+void
+assert_u_int(const char *file, int line, const char *a1, const char *a2,
+    u_int aa1, u_int aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "U_INT", pred);
+        fprintf(stderr, "%12s = %u / 0x%x\n", a1, aa1, aa1);
+        fprintf(stderr, "%12s = %u / 0x%x\n", a2, aa2, aa2);
+        test_die();
+}
+
+void
+assert_long_long(const char *file, int line, const char *a1, const char *a2,
+    long long aa1, long long aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "LONG LONG", pred);
+        fprintf(stderr, "%12s = %lld / 0x%llx\n", a1, aa1, aa1);
+        fprintf(stderr, "%12s = %lld / 0x%llx\n", a2, aa2, aa2);
+        test_die();
+}
+
+void
+assert_char(const char *file, int line, const char *a1, const char *a2,
+    char aa1, char aa2, enum test_predicate pred)
+{
+        char buf[8];
+
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "CHAR", pred);
+        fprintf(stderr, "%12s = '%s' / 0x02%x\n", a1,
+            vis(buf, aa1, VIS_SAFE|VIS_NL|VIS_TAB|VIS_OCTAL, 0), aa1);
+        fprintf(stderr, "%12s = '%s' / 0x02%x\n", a1,
+            vis(buf, aa2, VIS_SAFE|VIS_NL|VIS_TAB|VIS_OCTAL, 0), aa2);
+        test_die();
+}
+
+void
+assert_u8(const char *file, int line, const char *a1, const char *a2,
+    u_int8_t aa1, u_int8_t aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "U8", pred);
+        fprintf(stderr, "%12s = 0x%02x %u\n", a1, aa1, aa1);
+        fprintf(stderr, "%12s = 0x%02x %u\n", a2, aa2, aa2);
+        test_die();
+}
+
+void
+assert_u16(const char *file, int line, const char *a1, const char *a2,
+    u_int16_t aa1, u_int16_t aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "U16", pred);
+        fprintf(stderr, "%12s = 0x%04x %u\n", a1, aa1, aa1);
+        fprintf(stderr, "%12s = 0x%04x %u\n", a2, aa2, aa2);
+        test_die();
+}
+
+void
+assert_u32(const char *file, int line, const char *a1, const char *a2,
+    u_int32_t aa1, u_int32_t aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "U32", pred);
+        fprintf(stderr, "%12s = 0x%08x %u\n", a1, aa1, aa1);
+        fprintf(stderr, "%12s = 0x%08x %u\n", a2, aa2, aa2);
+        test_die();
+}
+
+void
+assert_u64(const char *file, int line, const char *a1, const char *a2,
+    u_int64_t aa1, u_int64_t aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "U64", pred);
+        fprintf(stderr, "%12s = 0x%016llx %llu\n", a1,
+            (unsigned long long)aa1, (unsigned long long)aa1);
+        fprintf(stderr, "%12s = 0x%016llx %llu\n", a2,
+            (unsigned long long)aa2, (unsigned long long)aa2);
+        test_die();
+}
+
+void
+assert_ptr(const char *file, int line, const char *a1, const char *a2,
+    const void *aa1, const void *aa2, enum test_predicate pred)
+{
+        TEST_CHECK(aa1, aa2, pred);
+        test_header(file, line, a1, a2, "PTR", pred);
+        fprintf(stderr, "%12s = %p\n", a1, aa1);
+        fprintf(stderr, "%12s = %p\n", a2, aa2);
+        test_die();
+}
+
diff --git a/regress/unittests/test_helper/test_helper.h b/regress/unittests/test_helper/test_helper.h
new file mode 100644
index 000000000..a398c615f
--- /dev/null
+++ b/regress/unittests/test_helper/test_helper.h
@@ -0,0 +1,292 @@
+/*      $OpenBSD: test_helper.h,v 1.3 2014/05/02 09:41:32 andre Exp $   */
+/*
+ * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* Utility functions/framework for regress tests */
+
+#ifndef _TEST_HELPER_H
+#define _TEST_HELPER_H
+
+#include "includes.h"
+
+#include <sys/types.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+
+#include <openssl/bn.h>
+#include <openssl/err.h>
+
+enum test_predicate {
+        TEST_EQ, TEST_NE, TEST_LT, TEST_LE, TEST_GT, TEST_GE
+};
+typedef void (test_onerror_func_t)(void *);
+
+/* Supplied by test suite */
+void tests(void);
+
+const char *test_data_file(const char *name);
+void test_start(const char *n);
+void set_onerror_func(test_onerror_func_t *f, void *ctx);
+void test_done(void);
+void ssl_err_check(const char *file, int line);
+void assert_bignum(const char *file, int line,
+    const char *a1, const char *a2,
+    const BIGNUM *aa1, const BIGNUM *aa2, enum test_predicate pred);
+void assert_string(const char *file, int line,
+    const char *a1, const char *a2,
+    const char *aa1, const char *aa2, enum test_predicate pred);
+void assert_mem(const char *file, int line,
+    const char *a1, const char *a2,
+    const void *aa1, const void *aa2, size_t l, enum test_predicate pred);
+void assert_mem_filled(const char *file, int line,
+    const char *a1,
+    const void *aa1, u_char v, size_t l, enum test_predicate pred);
+void assert_int(const char *file, int line,
+    const char *a1, const char *a2,
+    int aa1, int aa2, enum test_predicate pred);
+void assert_size_t(const char *file, int line,
+    const char *a1, const char *a2,
+    size_t aa1, size_t aa2, enum test_predicate pred);
+void assert_u_int(const char *file, int line,
+    const char *a1, const char *a2,
+    u_int aa1, u_int aa2, enum test_predicate pred);
+void assert_long_long(const char *file, int line,
+    const char *a1, const char *a2,
+    long long aa1, long long aa2, enum test_predicate pred);
+void assert_char(const char *file, int line,
+    const char *a1, const char *a2,
+    char aa1, char aa2, enum test_predicate pred);
+void assert_ptr(const char *file, int line,
+    const char *a1, const char *a2,
+    const void *aa1, const void *aa2, enum test_predicate pred);
+void assert_u8(const char *file, int line,
+    const char *a1, const char *a2,
+    u_int8_t aa1, u_int8_t aa2, enum test_predicate pred);
+void assert_u16(const char *file, int line,
+    const char *a1, const char *a2,
+    u_int16_t aa1, u_int16_t aa2, enum test_predicate pred);
+void assert_u32(const char *file, int line,
+    const char *a1, const char *a2,
+    u_int32_t aa1, u_int32_t aa2, enum test_predicate pred);
+void assert_u64(const char *file, int line,
+    const char *a1, const char *a2,
+    u_int64_t aa1, u_int64_t aa2, enum test_predicate pred);
+
+#define TEST_START(n)                   test_start(n)
+#define TEST_DONE()                     test_done()
+#define TEST_ONERROR(f, c)              set_onerror_func(f, c)
+#define SSL_ERR_CHECK()                 ssl_err_check(__FILE__, __LINE__)
+
+#define ASSERT_BIGNUM_EQ(a1, a2) \
+        assert_bignum(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_STRING_EQ(a1, a2) \
+        assert_string(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_MEM_EQ(a1, a2, l) \
+        assert_mem(__FILE__, __LINE__, #a1, #a2, a1, a2, l, TEST_EQ)
+#define ASSERT_MEM_FILLED_EQ(a1, c, l) \
+        assert_mem_filled(__FILE__, __LINE__, #a1, a1, c, l, TEST_EQ)
+#define ASSERT_MEM_ZERO_EQ(a1, l) \
+        assert_mem_filled(__FILE__, __LINE__, #a1, a1, '\0', l, TEST_EQ)
+#define ASSERT_INT_EQ(a1, a2) \
+        assert_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_SIZE_T_EQ(a1, a2) \
+        assert_size_t(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_U_INT_EQ(a1, a2) \
+        assert_u_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_LONG_LONG_EQ(a1, a2) \
+        assert_long_long(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_CHAR_EQ(a1, a2) \
+        assert_char(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_PTR_EQ(a1, a2) \
+        assert_ptr(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_U8_EQ(a1, a2) \
+        assert_u8(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_U16_EQ(a1, a2) \
+        assert_u16(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_U32_EQ(a1, a2) \
+        assert_u32(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+#define ASSERT_U64_EQ(a1, a2) \
+        assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_EQ)
+
+#define ASSERT_BIGNUM_NE(a1, a2) \
+        assert_bignum(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_STRING_NE(a1, a2) \
+        assert_string(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_MEM_NE(a1, a2, l) \
+        assert_mem(__FILE__, __LINE__, #a1, #a2, a1, a2, l, TEST_NE)
+#define ASSERT_MEM_ZERO_NE(a1, l) \
+        assert_mem_filled(__FILE__, __LINE__, #a1, a1, '\0', l, TEST_NE)
+#define ASSERT_INT_NE(a1, a2) \
+        assert_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_SIZE_T_NE(a1, a2) \
+        assert_size_t(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_U_INT_NE(a1, a2) \
+        assert_u_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_LONG_LONG_NE(a1, a2) \
+        assert_long_long(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_CHAR_NE(a1, a2) \
+        assert_char(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_PTR_NE(a1, a2) \
+        assert_ptr(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_U8_NE(a1, a2) \
+        assert_u8(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_U16_NE(a1, a2) \
+        assert_u16(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_U32_NE(a1, a2) \
+        assert_u32(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+#define ASSERT_U64_NE(a1, a2) \
+        assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_NE)
+
+#define ASSERT_BIGNUM_LT(a1, a2) \
+        assert_bignum(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_STRING_LT(a1, a2) \
+        assert_string(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_MEM_LT(a1, a2, l) \
+        assert_mem(__FILE__, __LINE__, #a1, #a2, a1, a2, l, TEST_LT)
+#define ASSERT_INT_LT(a1, a2) \
+        assert_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_SIZE_T_LT(a1, a2) \
+        assert_size_t(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_U_INT_LT(a1, a2) \
+        assert_u_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_LONG_LONG_LT(a1, a2) \
+        assert_long_long(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_CHAR_LT(a1, a2) \
+        assert_char(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_PTR_LT(a1, a2) \
+        assert_ptr(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_U8_LT(a1, a2) \
+        assert_u8(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_U16_LT(a1, a2) \
+        assert_u16(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_U32_LT(a1, a2) \
+        assert_u32(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+#define ASSERT_U64_LT(a1, a2) \
+        assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LT)
+
+#define ASSERT_BIGNUM_LE(a1, a2) \
+        assert_bignum(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_STRING_LE(a1, a2) \
+        assert_string(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_MEM_LE(a1, a2, l) \
+        assert_mem(__FILE__, __LINE__, #a1, #a2, a1, a2, l, TEST_LE)
+#define ASSERT_INT_LE(a1, a2) \
+        assert_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_SIZE_T_LE(a1, a2) \
+        assert_size_t(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_U_INT_LE(a1, a2) \
+        assert_u_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_LONG_LONG_LE(a1, a2) \
+        assert_long_long(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_CHAR_LE(a1, a2) \
+        assert_char(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_PTR_LE(a1, a2) \
+        assert_ptr(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_U8_LE(a1, a2) \
+        assert_u8(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_U16_LE(a1, a2) \
+        assert_u16(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_U32_LE(a1, a2) \
+        assert_u32(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+#define ASSERT_U64_LE(a1, a2) \
+        assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_LE)
+
+#define ASSERT_BIGNUM_GT(a1, a2) \
+        assert_bignum(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_STRING_GT(a1, a2) \
+        assert_string(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_MEM_GT(a1, a2, l) \
+        assert_mem(__FILE__, __LINE__, #a1, #a2, a1, a2, l, TEST_GT)
+#define ASSERT_INT_GT(a1, a2) \
+        assert_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_SIZE_T_GT(a1, a2) \
+        assert_size_t(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_U_INT_GT(a1, a2) \
+        assert_u_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_LONG_LONG_GT(a1, a2) \
+        assert_long_long(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_CHAR_GT(a1, a2) \
+        assert_char(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_PTR_GT(a1, a2) \
+        assert_ptr(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_U8_GT(a1, a2) \
+        assert_u8(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_U16_GT(a1, a2) \
+        assert_u16(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_U32_GT(a1, a2) \
+        assert_u32(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+#define ASSERT_U64_GT(a1, a2) \
+        assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GT)
+
+#define ASSERT_BIGNUM_GE(a1, a2) \
+        assert_bignum(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_STRING_GE(a1, a2) \
+        assert_string(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_MEM_GE(a1, a2, l) \
+        assert_mem(__FILE__, __LINE__, #a1, #a2, a1, a2, l, TEST_GE)
+#define ASSERT_INT_GE(a1, a2) \
+        assert_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_SIZE_T_GE(a1, a2) \
+        assert_size_t(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_U_INT_GE(a1, a2) \
+        assert_u_int(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_LONG_LONG_GE(a1, a2) \
+        assert_long_long(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_CHAR_GE(a1, a2) \
+        assert_char(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_PTR_GE(a1, a2) \
+        assert_ptr(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_U8_GE(a1, a2) \
+        assert_u8(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_U16_GE(a1, a2) \
+        assert_u16(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_U32_GE(a1, a2) \
+        assert_u32(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+#define ASSERT_U64_GE(a1, a2) \
+        assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE)
+
+/* Fuzzing support */
+
+struct fuzz;
+#define FUZZ_1_BIT_FLIP         0x00000001      /* Flip one bit at a time */
+#define FUZZ_2_BIT_FLIP         0x00000002      /* Flip two bits at a time */
+#define FUZZ_1_BYTE_FLIP        0x00000004      /* Flip one byte at a time */
+#define FUZZ_2_BYTE_FLIP        0x00000008      /* Flip two bytes at a time */
+#define FUZZ_TRUNCATE_START     0x00000010      /* Truncate from beginning */
+#define FUZZ_TRUNCATE_END       0x00000020      /* Truncate from end */
+#define FUZZ_BASE64             0x00000040      /* Try all base64 chars */
+#define FUZZ_MAX                FUZZ_BASE64
+
+/* Start fuzzing a blob of data with selected strategies (bitmask) */
+struct fuzz *fuzz_begin(u_int strategies, const void *p, size_t l);
+
+/* Free a fuzz context */
+void fuzz_cleanup(struct fuzz *fuzz);
+
+/* Prepare the next fuzz case in the series */
+void fuzz_next(struct fuzz *fuzz);
+
+/* Determine whether the current fuzz sequence is exhausted (nonzero = yes) */
+int fuzz_done(struct fuzz *fuzz);
+
+/* Return the length and a pointer to the current fuzzed case */
+size_t fuzz_len(struct fuzz *fuzz);
+u_char *fuzz_ptr(struct fuzz *fuzz);
+
+/* Dump the current fuzz case to stderr */
+void fuzz_dump(struct fuzz *fuzz);
+#endif /* _TEST_HELPER_H */