Merge branch 'hans/ssh/cuddle_tests'

13 files changed, 194 insertions, 71 deletions

diff --git a/lib/ssh/src/ssh_auth.erl b/lib/ssh/src/ssh_auth.erl
index 6cf659f830..ac64a7bf14 100644
--- a/lib/ssh/src/ssh_auth.erl
+++ b/lib/ssh/src/ssh_auth.erl
@@ -28,7 +28,8 @@
 -include("ssh_auth.hrl").
 -include("ssh_transport.hrl").
 
--export([publickey_msg/1, password_msg/1, keyboard_interactive_msg/1,
+-export([get_public_key/2,
+         publickey_msg/1, password_msg/1, keyboard_interactive_msg/1,
 	 service_request_msg/1, init_userauth_request_msg/1,
 	 userauth_request_msg/1, handle_userauth_request/3,
 	 handle_userauth_info_request/2, handle_userauth_info_response/2
@@ -136,41 +137,49 @@ keyboard_interactive_msg([#ssh{user = User,
 	      Ssh)
     end.
 
-publickey_msg([SigAlg, #ssh{user = User,
-		       session_id = SessionId,
-		       service = Service,
-		       opts = Opts} = Ssh]) ->
-    Hash = ssh_transport:sha(SigAlg),
+
+get_public_key(SigAlg, #ssh{opts = Opts}) ->
     KeyAlg = key_alg(SigAlg),
     {KeyCb,KeyCbOpts} = ?GET_OPT(key_cb, Opts),
     UserOpts = ?GET_OPT(user_options, Opts),
     case KeyCb:user_key(KeyAlg, [{key_cb_private,KeyCbOpts}|UserOpts]) of
-	{ok, PrivKey} ->
-	    SigAlgStr = atom_to_list(SigAlg),
+        {ok, PrivKey} ->
             try
                 Key = ssh_transport:extract_public_key(PrivKey),
                 public_key:ssh_encode(Key, ssh2_pubkey)
             of
-		PubKeyBlob ->
-		    SigData = build_sig_data(SessionId, User, Service,
-                                             PubKeyBlob, SigAlgStr),
-		    Sig = ssh_transport:sign(SigData, Hash, PrivKey),
-		    SigBlob = list_to_binary([?string(SigAlgStr),
-                                              ?binary(Sig)]),
-		    ssh_transport:ssh_packet(
-		      #ssh_msg_userauth_request{user = User,
-						service = Service,
-						method = "publickey",
-						data = [?TRUE,
-							?string(SigAlgStr),
-							?binary(PubKeyBlob),
-							?binary(SigBlob)]},
-		      Ssh)
+                PubKeyBlob -> {ok,{PrivKey,PubKeyBlob}}
             catch
                 _:_ -> 
-		    {not_ok, Ssh}
+		    not_ok
             end;
-     	_Error ->
+	_Error ->
+	    not_ok
+    end.
+
+
+publickey_msg([SigAlg, #ssh{user = User,
+		       session_id = SessionId,
+		       service = Service} = Ssh]) ->
+    case get_public_key(SigAlg, Ssh) of
+	{ok, {PrivKey,PubKeyBlob}} ->
+            SigAlgStr = atom_to_list(SigAlg),
+            SigData = build_sig_data(SessionId, User, Service,
+                                     PubKeyBlob, SigAlgStr),
+            Hash = ssh_transport:sha(SigAlg),
+            Sig = ssh_transport:sign(SigData, Hash, PrivKey),
+            SigBlob = list_to_binary([?string(SigAlgStr),
+                                      ?binary(Sig)]),
+            ssh_transport:ssh_packet(
+              #ssh_msg_userauth_request{user = User,
+                                        service = Service,
+                                        method = "publickey",
+                                        data = [?TRUE,
+                                                ?string(SigAlgStr),
+                                                ?binary(PubKeyBlob),
+                                                ?binary(SigBlob)]},
+              Ssh);
+     	_ ->
 	    {not_ok, Ssh}
     end.
 
diff --git a/lib/ssh/src/ssh_connection_handler.erl b/lib/ssh/src/ssh_connection_handler.erl
index f1ce337947..4c6aff5c24 100644
--- a/lib/ssh/src/ssh_connection_handler.erl
+++ b/lib/ssh/src/ssh_connection_handler.erl
@@ -453,16 +453,20 @@ init_ssh_record(Role, _Socket, PeerAddr, Opts) ->
                            PeerName0 when is_list(PeerName0) ->
                                PeerName0
                        end,
-	    S0#ssh{c_vsn = Vsn,
-		   c_version = Version,
-		   io_cb = case ?GET_OPT(user_interaction, Opts) of
-			       true ->  ssh_io;
-			       false -> ssh_no_io
-			   end,
-                   userauth_pubkeys = ?GET_OPT(pref_public_key_algs, Opts),
-		   userauth_quiet_mode = ?GET_OPT(quiet_mode, Opts),
-		   peer = {PeerName, PeerAddr}
-		  };
+            S1 =
+                S0#ssh{c_vsn = Vsn,
+                       c_version = Version,
+                       io_cb = case ?GET_OPT(user_interaction, Opts) of
+                                   true ->  ssh_io;
+                                   false -> ssh_no_io
+                               end,
+                       userauth_quiet_mode = ?GET_OPT(quiet_mode, Opts),
+                       peer = {PeerName, PeerAddr}
+                      },
+            S1#ssh{userauth_pubkeys = [K || K <- ?GET_OPT(pref_public_key_algs, Opts),
+                                            is_usable_user_pubkey(K, S1)
+                                      ]
+                  };
 
 	server ->
 	    S0#ssh{s_vsn = Vsn,
@@ -1700,29 +1704,59 @@ handle_ssh_msg_ext_info(#ssh_msg_ext_info{data=Data}, D0) ->
     lists:foldl(fun ext_info/2, D0, Data).
 
 
-ext_info({"server-sig-algs",SigAlgs}, D0 = #data{ssh_params=#ssh{role=client,
-                                                                 userauth_pubkeys=ClientSigAlgs}=Ssh0}) ->
-    %% Make strings to eliminate risk of beeing bombed with odd strings that fills the atom table:
-    SupportedAlgs = lists:map(fun erlang:atom_to_list/1, ssh_transport:supported_algorithms(public_key)),
-    ServerSigAlgs = [list_to_atom(SigAlg) || SigAlg <- string:tokens(SigAlgs,","),
-                                             %% length of SigAlg is implicitly checked by the comparison
-                                             %% in member/2:
-                                             lists:member(SigAlg, SupportedAlgs)
-                    ],
-    CommonAlgs = [Alg || Alg <- ServerSigAlgs,
-                         lists:member(Alg, ClientSigAlgs)],
-    SelectedAlgs =
-        case CommonAlgs of
-            [] -> ClientSigAlgs; % server-sig-algs value is just an advice
-            _ -> CommonAlgs
-        end,
-    D0#data{ssh_params = Ssh0#ssh{userauth_pubkeys = SelectedAlgs} };
+ext_info({"server-sig-algs",SigAlgsStr},
+         D0 = #data{ssh_params=#ssh{role=client,
+                                    userauth_pubkeys=ClientSigAlgs}=Ssh0}) ->
+    %% ClientSigAlgs are the pub_key algortithms that:
+    %%  1) is usable, that is, the user has such a public key and
+    %%  2) is either the default list or set by the caller
+    %%     with the client option 'pref_public_key_algs'
+    %%
+    %% The list is already checked for duplicates.
+
+    SigAlgs = [A || Astr <- string:tokens(SigAlgsStr, ","),
+                    A <- try [list_to_existing_atom(Astr)]
+                              %% list_to_existing_atom will fail for unknown algorithms
+                         catch _:_ -> []
+                         end],
+
+    CommonAlgs = [A || A <- SigAlgs,
+                       lists:member(A, ClientSigAlgs)],
+
+    %% Re-arrange the client supported public-key algorithms so that the server
+    %% preferred ones are tried first.
+    %% Trying algorithms not mentioned by the server is ok, since the server can't know
+    %% if the client supports 'server-sig-algs' or not.
+
+    D0#data{
+      ssh_params =
+          Ssh0#ssh{
+            userauth_pubkeys =
+                CommonAlgs ++ (ClientSigAlgs -- CommonAlgs)
+           }};
+
+    %% If there are algorithms common to the client and the server, use them.
+    %% Otherwise try with ones that the client supports.  The server-sig-alg
+    %% list is a suggestion, not an order.
+    %% case CommonAlgs of
+    %%     [_|_] ->
+    %%         D0#data{ssh_params = Ssh0#ssh{userauth_pubkeys = CommonAlgs}};
+    %%     [] ->
+    %%         D0
+    %% end;
 
 ext_info(_, D0) ->
     %% Not implemented
     D0.
 
 %%%----------------------------------------------------------------
+is_usable_user_pubkey(A, Ssh) ->
+    case ssh_auth:get_public_key(A, Ssh) of
+        {ok,_} -> true;
+        _ -> false
+    end.
+
+%%%----------------------------------------------------------------
 handle_request(ChannelPid, ChannelId, Type, Data, WantReply, From, D) ->
     case ssh_channel:cache_lookup(cache(D), ChannelId) of
 	#channel{remote_id = Id} = Channel ->
diff --git a/lib/ssh/src/ssh_dbg.erl b/lib/ssh/src/ssh_dbg.erl
index 003b3856e6..d5d4ab04c3 100644
--- a/lib/ssh/src/ssh_dbg.erl
+++ b/lib/ssh/src/ssh_dbg.erl
@@ -136,12 +136,13 @@ msg_formater(_, {trace_ts,Pid,call,{ssh_transport,handle_hello_version,[Hello]},
 msg_formater(_, {trace_ts,_Pid,return_from,{ssh_transport,handle_hello_version,1},_,_TS}, D) -> 
     D;
 
-msg_formater(_, {trace_ts,Pid,call,{ssh_connection_handler,ext_info,[{"server-sig-algs",_SigAlgs},State]},TS}, D) ->
+msg_formater(_, {trace_ts,Pid,call,{ssh_connection_handler,ext_info,[{"server-sig-algs",SigAlgs},State]},TS}, D) ->
     try lists:keyfind(ssh, 1, tuple_to_list(State)) of
         false ->
             D;
         #ssh{userauth_pubkeys = PKs} ->
-            fmt("~n~s ~p Client got suggestion to use user public key sig-algs~n  ~p~n", [ts(TS),Pid,PKs], D)
+            fmt("~n~s ~p Client got suggestion to use user public key sig-algs~n    ~p~n  and can use~n    ~p~n",
+                [ts(TS),Pid,string:tokens(SigAlgs,","),PKs], D)
     catch
         _:_ ->
             D
diff --git a/lib/ssh/src/ssh_options.erl b/lib/ssh/src/ssh_options.erl
index aebb5a7062..7eeed70739 100644
--- a/lib/ssh/src/ssh_options.erl
+++ b/lib/ssh/src/ssh_options.erl
@@ -674,7 +674,11 @@ check_pref_public_key_algs(V) ->
     PKs = ssh_transport:supported_algorithms(public_key),
     CHK = fun(A, Ack) ->
                   case lists:member(A, PKs) of
-                      true ->  [A|Ack];
+                      true -> 
+                          case lists:member(A,Ack) of
+                              false -> [A|Ack];
+                              true -> Ack       % Remove duplicates
+                          end;
                       false -> error_in_check(A, "Not supported public key")
                   end
           end,
diff --git a/lib/ssh/test/ssh_algorithms_SUITE.erl b/lib/ssh/test/ssh_algorithms_SUITE.erl
index 0f69910e40..98964a2c8a 100644
--- a/lib/ssh/test/ssh_algorithms_SUITE.erl
+++ b/lib/ssh/test/ssh_algorithms_SUITE.erl
@@ -131,9 +131,14 @@ init_per_group(public_key=Tag, Alg, Config) ->
     ct:log("Init tests for public_key ~p",[Alg]),
     PrefAlgs = {preferred_algorithms,[{Tag,[Alg]}]},
     %% Daemon started later in init_per_testcase
-    [{pref_algs,PrefAlgs},
-     {tag_alg,{Tag,Alg}}
-     | Config];
+    try
+        setup_pubkey(Alg,
+                 [{pref_algs,PrefAlgs},
+                  {tag_alg,{Tag,Alg}}
+                  | Config])
+    catch
+        _:_ -> {skip, io_lib:format("Unsupported: ~p",[Alg])}
+    end;
 
 init_per_group(Tag, Alg, Config) ->
     PA =
@@ -167,18 +172,24 @@ init_per_testcase(TC, Config) ->
     init_per_testcase(TC, proplists:get_value(tag_alg,Config), Config).
 
 
-init_per_testcase(_, {public_key,Alg}, Config) ->
-    Opts = pubkey_opts(Config),
+init_per_testcase(TC, {public_key,Alg}, Config) ->
+    ExtraOpts = case TC of
+                    simple_connect ->
+                        [{user_dir, proplists:get_value(priv_dir,Config)}];
+                    _ ->
+                        []
+                end,
+    Opts = pubkey_opts(Config) ++ ExtraOpts,
     case {ssh_file:user_key(Alg,Opts), ssh_file:host_key(Alg,Opts)} of
         {{ok,_}, {ok,_}} ->
-            ssh_dbg:ct_auth(),
-            start_pubkey_daemon([proplists:get_value(pref_algs,Config)],
+            start_pubkey_daemon([proplists:get_value(pref_algs,Config)
+                                | ExtraOpts],
                                 [{extra_daemon,true}|Config]);
-        {{ok,_}, _} ->
-            {skip, "No host key"};
+        {{ok,_}, {error,Err}} ->
+            {skip, io_lib:format("No host key: ~p",[Err])};
         
-        {_, {ok,_}} ->
-            {skip, "No user key"};
+        {{error,Err}, {ok,_}} ->
+            {skip, io_lib:format("No user key: ~p",[Err])};
         
         _ ->
             {skip, "Neither host nor user key"}
@@ -193,7 +204,6 @@ init_per_testcase(_, _, Config) ->
 
 
 end_per_testcase(_TC, Config) ->
-    catch ssh_dbg:stop(),
     case proplists:get_value(extra_daemon, Config, false) of
         true ->
             case proplists:get_value(srvr_pid,Config) of
@@ -223,6 +233,19 @@ simple_exec(Config) ->
     ssh_test_lib:std_simple_exec(Host, Port, Config).
 
 %%--------------------------------------------------------------------
+%% A simple exec call
+simple_connect(Config) ->
+    {Host,Port} = proplists:get_value(srvr_addr, Config),
+    Opts =
+        case proplists:get_value(tag_alg, Config) of
+            {public_key,Alg} -> [{pref_public_key_algs,[Alg]}];
+            _ -> []
+        end,
+    ConnectionRef = ssh_test_lib:std_connect(Config, Host, Port, Opts),
+    ct:log("~p:~p connected! ~p",[?MODULE,?LINE,ConnectionRef]),
+    ssh:close(ConnectionRef).
+
+%%--------------------------------------------------------------------
 %% Testing if no group matches
 simple_exec_groups_no_match_too_small(Config) ->
     try_exec_simple_group({400,500,600}, Config).
@@ -304,9 +327,15 @@ sshc_simple_exec_os_cmd(Config) ->
 %%--------------------------------------------------------------------
 %% Connect to the ssh server of the OS
 sshd_simple_exec(Config) ->
+    ClientPubKeyOpts =
+        case proplists:get_value(tag_alg,Config) of
+            {public_key,Alg} -> [{pref_public_key_algs,[Alg]}];
+            _ -> []
+        end,
     ConnectionRef = ssh_test_lib:connect(22, [{silently_accept_hosts, true},
                                               proplists:get_value(pref_algs,Config),
-					      {user_interaction, false}]),
+					      {user_interaction, false}
+                                              | ClientPubKeyOpts]),
     {ok, ChannelId0} = ssh_connection:session_channel(ConnectionRef, infinity),
     success = ssh_connection:exec(ConnectionRef, ChannelId0,
 				  "echo testing", infinity),
@@ -363,8 +392,8 @@ split(Alg) -> ssh_test_lib:to_atoms(string:tokens(atom_to_list(Alg), " + ")).
 
 specific_test_cases(Tag, Alg, SshcAlgos, SshdAlgos, TypeSSH) -> 
     case Tag of
-        public_key -> [];
-        _ -> [simple_exec, simple_sftp]
+        public_key -> [simple_connect];
+        _ -> [simple_connect, simple_exec, simple_sftp]
     end 
     ++ case supports(Tag, Alg, SshcAlgos) of
            true when TypeSSH == openSSH ->
@@ -439,10 +468,26 @@ setup_pubkey(Config) ->
     Keys =
         [ssh_test_lib:setup_dsa(DataDir, UserDir),
          ssh_test_lib:setup_rsa(DataDir, UserDir),
-         ssh_test_lib:setup_ecdsa("256", DataDir, UserDir)],
+         ssh_test_lib:setup_ecdsa("256", DataDir, UserDir)
+        ],
     ssh_test_lib:write_auth_keys(Keys, UserDir), % 'authorized_keys' shall contain ALL pub keys
     Config.
 
+setup_pubkey(Alg, Config) ->
+    DataDir = proplists:get_value(data_dir, Config),
+    UserDir = proplists:get_value(priv_dir, Config),
+    ct:log("Setup keys for ~p",[Alg]),
+    case Alg of
+        'ssh-dss' -> ssh_test_lib:setup_dsa(DataDir, UserDir);
+        'ssh-rsa' -> ssh_test_lib:setup_rsa(DataDir, UserDir);
+        'rsa-sha2-256' -> ssh_test_lib:setup_rsa(DataDir, UserDir);
+        'rsa-sha2-512' -> ssh_test_lib:setup_rsa(DataDir, UserDir);
+        'ecdsa-sha2-nistp256' -> ssh_test_lib:setup_ecdsa("256", DataDir, UserDir);
+        'ecdsa-sha2-nistp384' -> ssh_test_lib:setup_ecdsa("384", DataDir, UserDir);
+        'ecdsa-sha2-nistp521' -> ssh_test_lib:setup_ecdsa("521", DataDir, UserDir)
+    end,
+    Config.
+
 
 simple_exec_group(I, Config) when is_integer(I) ->
     simple_exec_group({I,I,I}, Config);
diff --git a/lib/ssh/test/ssh_algorithms_SUITE_data/id_ecdsa384 b/lib/ssh/test/ssh_algorithms_SUITE_data/id_ecdsa384
new file mode 100644
index 0000000000..4c39e916e9
--- /dev/null
+++ b/lib/ssh/test/ssh_algorithms_SUITE_data/id_ecdsa384
@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDAughXu55DNyhxe6x+MNjv4oZKWUDh7bhi4CqjvxhCp9KMpsybltcq+
+lsuKTarzTdKgBwYFK4EEACKhZANiAASu1vvDL0SQoXGtzlltaPHPyDfEVMG/sKLA
+pqv8vfRN5Wcs7+yaRKw92nYEKGXfZLbhVX8ArFPMtXPWHcRHCntvL1Acn2kJQ8Gc
+7iL4NAr8JhTIUBv4YMhHDa9Pv/CH2zk=
+-----END EC PRIVATE KEY-----
diff --git a/lib/ssh/test/ssh_algorithms_SUITE_data/id_ecdsa384.pub b/lib/ssh/test/ssh_algorithms_SUITE_data/id_ecdsa384.pub
new file mode 100644
index 0000000000..caa9604c84
--- /dev/null
+++ b/lib/ssh/test/ssh_algorithms_SUITE_data/id_ecdsa384.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBK7W+8MvRJChca3OWW1o8c/IN8RUwb+wosCmq/y99E3lZyzv7JpErD3adgQoZd9ktuFVfwCsU8y1c9YdxEcKe28vUByfaQlDwZzuIvg0CvwmFMhQG/hgyEcNr0+/8IfbOQ== uabhnil@elxadlj3q32
diff --git a/lib/ssh/test/ssh_algorithms_SUITE_data/id_ecdsa521 b/lib/ssh/test/ssh_algorithms_SUITE_data/id_ecdsa521
new file mode 100644
index 0000000000..1e16fcbd57
--- /dev/null
+++ b/lib/ssh/test/ssh_algorithms_SUITE_data/id_ecdsa521
@@ -0,0 +1,7 @@
+-----BEGIN EC PRIVATE KEY-----
+MIHbAgEBBEEWXGoVLiNwQVUwAGZWxOu6uxtU8ntxyZNlcWU4Z8pze9kq3eK7a9XH
+l/wxL75Vk1QdOiR/rE3s/L/zOuChp44o1aAHBgUrgQQAI6GBiQOBhgAEAfCrtwjO
+kQYKr4/F3uanS7Eby1+SYDdRl1ABuDFhNC3CivVBFt4CnRneV+Mf0viDAxD+HEpd
+/GaE2CdsFoVpglN5AVG+fEePY2PiCLHmjc4/pBuR+tWhErzcWAd0KLBCBuc4OAvl
+aLLYV1NAJI6COnnfGTCVvYYE5nKMG4LLX0zaWtWl
+-----END EC PRIVATE KEY-----
diff --git a/lib/ssh/test/ssh_algorithms_SUITE_data/id_ecdsa521.pub b/lib/ssh/test/ssh_algorithms_SUITE_data/id_ecdsa521.pub
new file mode 100644
index 0000000000..069683eba7
--- /dev/null
+++ b/lib/ssh/test/ssh_algorithms_SUITE_data/id_ecdsa521.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHwq7cIzpEGCq+Pxd7mp0uxG8tfkmA3UZdQAbgxYTQtwor1QRbeAp0Z3lfjH9L4gwMQ/hxKXfxmhNgnbBaFaYJTeQFRvnxHj2Nj4gix5o3OP6QbkfrVoRK83FgHdCiwQgbnODgL5Wiy2FdTQCSOgjp53xkwlb2GBOZyjBuCy19M2lrVpQ== uabhnil@elxadlj3q32
diff --git a/lib/ssh/test/ssh_algorithms_SUITE_data/ssh_host_ecdsa_key384 b/lib/ssh/test/ssh_algorithms_SUITE_data/ssh_host_ecdsa_key384
new file mode 100644
index 0000000000..5835bcd74c
--- /dev/null
+++ b/lib/ssh/test/ssh_algorithms_SUITE_data/ssh_host_ecdsa_key384
@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDB+l0+SMLYgQ3ZRzg2Pn5u+1ZwKbEnJzXsTKTJM9QSJbKkbA7uCnjdS
+CvEW+66CoHqgBwYFK4EEACKhZANiAAT6awCCIrcCr9H4wq0bJ/rQou3tpLHyyf33
+c8D6FPn48/hNqinpx7b0le/0D+Rrhdl9edIplAf6oki7yoFFGl4yuzWtv7rag9jB
+vv6w1508ChOmyQ094rFt/xj4KVBhEHI=
+-----END EC PRIVATE KEY-----
diff --git a/lib/ssh/test/ssh_algorithms_SUITE_data/ssh_host_ecdsa_key384.pub b/lib/ssh/test/ssh_algorithms_SUITE_data/ssh_host_ecdsa_key384.pub
new file mode 100644
index 0000000000..714fc4eb89
--- /dev/null
+++ b/lib/ssh/test/ssh_algorithms_SUITE_data/ssh_host_ecdsa_key384.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBPprAIIitwKv0fjCrRsn+tCi7e2ksfLJ/fdzwPoU+fjz+E2qKenHtvSV7/QP5GuF2X150imUB/qiSLvKgUUaXjK7Na2/utqD2MG+/rDXnTwKE6bJDT3isW3/GPgpUGEQcg== uabhnil@elxadlj3q32
diff --git a/lib/ssh/test/ssh_algorithms_SUITE_data/ssh_host_ecdsa_key521 b/lib/ssh/test/ssh_algorithms_SUITE_data/ssh_host_ecdsa_key521
new file mode 100644
index 0000000000..81aa8df39f
--- /dev/null
+++ b/lib/ssh/test/ssh_algorithms_SUITE_data/ssh_host_ecdsa_key521
@@ -0,0 +1,7 @@
+-----BEGIN EC PRIVATE KEY-----
+MIHbAgEBBEHHxgYEfDclsu5bW+pZfg+bkaqWpgEpXtuzLVm++FFPjhAPhMkurSRj
+WQ+CuI2TxgYkBbYFNjn9JqgdMF7FzaiojKAHBgUrgQQAI6GBiQOBhgAEAFTM8TKG
+xexxmfAGuyl/Tpk4wytB/OyuVfkF+Q3H1v17HLcpMacA5xUFr80+D5XnjxGttBsS
++X0uexR7QbPbhhPqADgQzFqvTsB1mUNAZnJBD6QNCZkfWwRRwFYQWSmisb43H6G3
+iUTKqiCXMXO8drKLA+Wi+L7VyfoI1CvatBBlDHbV
+-----END EC PRIVATE KEY-----
diff --git a/lib/ssh/test/ssh_algorithms_SUITE_data/ssh_host_ecdsa_key521.pub b/lib/ssh/test/ssh_algorithms_SUITE_data/ssh_host_ecdsa_key521.pub
new file mode 100644
index 0000000000..17b9a1d834
--- /dev/null
+++ b/lib/ssh/test/ssh_algorithms_SUITE_data/ssh_host_ecdsa_key521.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBABUzPEyhsXscZnwBrspf06ZOMMrQfzsrlX5BfkNx9b9exy3KTGnAOcVBa/NPg+V548RrbQbEvl9LnsUe0Gz24YT6gA4EMxar07AdZlDQGZyQQ+kDQmZH1sEUcBWEFkporG+Nx+ht4lEyqoglzFzvHayiwPlovi+1cn6CNQr2rQQZQx21Q== uabhnil@elxadlj3q32