Merge branch 'maint'

* maint:
  ssh: Doc updates
  ssh: some benchmarking of [email protected]
  ssh: -spec
  ssh: Add [email protected] cipher
  crypto: doc poly1305
  crypto: doc chacha20
  crypto: Error in test case
  crypto: chacha20 test case
  crypto: poly1305 test case
  crypto: -spec
  crypto: chacha20 cipher
  crypto: Mac POLY1305 if >=OpenSSL 1.1.1-pre8

9 files changed, 530 insertions, 75 deletions

diff --git a/lib/crypto/c_src/crypto.c b/lib/crypto/c_src/crypto.c
index 72aa44e7db..d409ea7dcf 100644
--- a/lib/crypto/c_src/crypto.c
+++ b/lib/crypto/c_src/crypto.c
@@ -178,11 +178,19 @@
 
 #if OPENSSL_VERSION_NUMBER >= PACKED_OPENSSL_VERSION_PLAIN(1,1,0)
 # ifndef HAS_LIBRESSL
+#  define HAVE_CHACHA20
 #  define HAVE_CHACHA20_POLY1305
 #  define HAVE_RSA_OAEP_MD
 # endif
 #endif
 
+// OPENSSL_VERSION_NUMBER >= 1.1.1-pre8
+#if OPENSSL_VERSION_NUMBER >= (PACKED_OPENSSL_VERSION_PLAIN(1,1,1)-7)
+# ifndef HAS_LIBRESSL
+#  define HAVE_POLY1305
+# endif
+#endif
+
 #if OPENSSL_VERSION_NUMBER <= PACKED_OPENSSL_VERSION(0,9,8,'l')
 # define HAVE_ECB_IVEC_BUG
 #endif
@@ -524,6 +532,11 @@ static ERL_NIF_TERM aes_gcm_decrypt_NO_EVP(ErlNifEnv* env, int argc, const ERL_N
 static ERL_NIF_TERM chacha20_poly1305_encrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM chacha20_poly1305_decrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 
+static ERL_NIF_TERM chacha20_stream_init(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM chacha20_stream_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+
+static ERL_NIF_TERM poly1305_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+
 static ERL_NIF_TERM engine_by_id_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM engine_init_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM engine_finish_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
@@ -614,6 +627,12 @@ static ErlNifFunc nif_funcs[] = {
     {"chacha20_poly1305_encrypt", 4, chacha20_poly1305_encrypt},
     {"chacha20_poly1305_decrypt", 5, chacha20_poly1305_decrypt},
 
+    {"chacha20_stream_init",    2, chacha20_stream_init},
+    {"chacha20_stream_encrypt", 2, chacha20_stream_crypt},
+    {"chacha20_stream_decrypt", 2, chacha20_stream_crypt},
+
+    {"poly1305_nif", 2, poly1305_nif},
+
     {"engine_by_id_nif", 1, engine_by_id_nif},
     {"engine_init_nif", 1, engine_init_nif},
     {"engine_finish_nif", 1, engine_finish_nif},
@@ -1246,7 +1265,7 @@ static ERL_NIF_TERM algo_pubkey[11]; /* increase when extending the list */
 static int algo_cipher_cnt, algo_cipher_fips_cnt;
 static ERL_NIF_TERM algo_cipher[24]; /* increase when extending the list */
 static int algo_mac_cnt, algo_mac_fips_cnt;
-static ERL_NIF_TERM algo_mac[2]; /* increase when extending the list */
+static ERL_NIF_TERM algo_mac[3]; /* increase when extending the list */
 static int algo_curve_cnt, algo_curve_fips_cnt;
 static ERL_NIF_TERM algo_curve[87]; /* increase when extending the list */
 
@@ -1334,13 +1353,19 @@ static void init_algorithms_types(ErlNifEnv* env)
 #if defined(HAVE_CHACHA20_POLY1305)
     algo_cipher[algo_cipher_cnt++] = enif_make_atom(env,"chacha20_poly1305");
 #endif
-
+#if defined(HAVE_CHACHA20)
+    algo_cipher[algo_cipher_cnt++] = enif_make_atom(env,"chacha20");
+#endif
+ 
     // Validated algorithms first
     algo_mac_cnt = 0;
     algo_mac[algo_mac_cnt++] = enif_make_atom(env,"hmac");
 #ifdef HAVE_CMAC
     algo_mac[algo_mac_cnt++] = enif_make_atom(env,"cmac");
 #endif
+#ifdef HAVE_POLY1305
+    algo_mac[algo_mac_cnt++] = enif_make_atom(env,"poly1305");
+#endif
     // Non-validated algorithms follow
     algo_mac_fips_cnt = algo_mac_cnt;
 
@@ -2082,6 +2107,62 @@ static ERL_NIF_TERM cmac_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]
 #endif
 }
 
+/* For OpenSSL >= 1.1.1 the hmac_nif and cmac_nif could be integrated into poly1305 (with 'type' as parameter) */
+static ERL_NIF_TERM poly1305_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Key, Text) */
+#ifdef HAVE_POLY1305
+    ErlNifBinary key_bin, text, ret_bin;
+    ERL_NIF_TERM ret = atom_error;
+    EVP_PKEY *key = NULL;
+    EVP_MD_CTX *mctx = NULL;
+    EVP_PKEY_CTX *pctx = NULL;
+    const EVP_MD *md = NULL;
+    size_t size;
+    int type;
+
+    type = EVP_PKEY_POLY1305;
+
+    if (!enif_inspect_binary(env, argv[0], &key_bin) ||
+        !(key_bin.size == 32) ) {
+        return enif_make_badarg(env);
+    }
+    
+    if (!enif_inspect_binary(env, argv[1], &text) ) {
+        return enif_make_badarg(env);
+    }
+
+    key = EVP_PKEY_new_raw_private_key(type, /*engine*/ NULL, key_bin.data,  key_bin.size);
+
+    if (!key ||
+        !(mctx = EVP_MD_CTX_new()) ||
+        !EVP_DigestSignInit(mctx, &pctx, md, /*engine*/ NULL, key) ||
+        !EVP_DigestSignUpdate(mctx, text.data, text.size)) {
+        goto err;
+    }
+    
+    if (!EVP_DigestSignFinal(mctx, NULL, &size) ||
+        !enif_alloc_binary(size, &ret_bin) ||
+        !EVP_DigestSignFinal(mctx, ret_bin.data, &size)) {
+        goto err;
+    }
+
+    if ((size != ret_bin.size) &&
+        !enif_realloc_binary(&ret_bin, size)) {
+        goto err;
+    }
+
+    ret = enif_make_binary(env, &ret_bin);
+
+ err:
+    EVP_MD_CTX_free(mctx);
+    EVP_PKEY_free(key);
+    return ret;
+
+#else
+    return atom_notsup;
+#endif
+}
+
 static ERL_NIF_TERM block_crypt_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {/* (Type, Key, Ivec, Text, IsEncrypt) or (Type, Key, Text, IsEncrypt) */
     struct cipher_type_t *cipherp = NULL;
@@ -2666,6 +2747,69 @@ out_err:
 #endif
 }
 
+
+static ERL_NIF_TERM chacha20_stream_init(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Key, IV) */
+#if defined(HAVE_CHACHA20)
+    ErlNifBinary     key_bin, ivec_bin;
+    struct evp_cipher_ctx *ctx;
+    const EVP_CIPHER *cipher;
+    ERL_NIF_TERM     ret;
+
+    if (!enif_inspect_iolist_as_binary(env, argv[0], &key_bin)
+        || !enif_inspect_binary(env, argv[1], &ivec_bin)
+        || key_bin.size != 32
+        || ivec_bin.size != 16) {
+        return enif_make_badarg(env);
+    }
+
+    cipher = EVP_chacha20();
+
+    ctx = enif_alloc_resource(evp_cipher_ctx_rtype, sizeof(struct evp_cipher_ctx));
+    ctx->ctx = EVP_CIPHER_CTX_new();
+
+
+    EVP_CipherInit_ex(ctx->ctx, cipher, NULL,
+                      key_bin.data, ivec_bin.data, 1);
+    EVP_CIPHER_CTX_set_padding(ctx->ctx, 0);
+    ret = enif_make_resource(env, ctx);
+    enif_release_resource(ctx);
+    return ret;
+#else
+    return enif_raise_exception(env, atom_notsup);
+#endif
+};
+
+static ERL_NIF_TERM chacha20_stream_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (State, Data) */
+#if defined(HAVE_CHACHA20)
+    struct evp_cipher_ctx *ctx, *new_ctx;
+    ErlNifBinary   data_bin;
+    ERL_NIF_TERM   ret, cipher_term;
+    unsigned char  *out;
+    int            outl = 0;
+
+    if (!enif_get_resource(env, argv[0], evp_cipher_ctx_rtype, (void**)&ctx)
+        || !enif_inspect_iolist_as_binary(env, argv[1], &data_bin)) {
+        return enif_make_badarg(env);
+    }
+    new_ctx = enif_alloc_resource(evp_cipher_ctx_rtype, sizeof(struct evp_cipher_ctx));
+    new_ctx->ctx = EVP_CIPHER_CTX_new();
+    EVP_CIPHER_CTX_copy(new_ctx->ctx, ctx->ctx);
+    out = enif_make_new_binary(env, data_bin.size, &cipher_term);
+    EVP_CipherUpdate(new_ctx->ctx, out, &outl, data_bin.data, data_bin.size);
+    ASSERT(outl == data_bin.size);
+
+    ret = enif_make_tuple2(env, enif_make_resource(env, new_ctx), cipher_term);
+    enif_release_resource(new_ctx);
+    CONSUME_REDS(env,data_bin);
+    return ret;
+#else
+    return enif_raise_exception(env, atom_notsup);
+#endif
+};
+
+
 static ERL_NIF_TERM strong_rand_bytes_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {/* (Bytes) */
     unsigned bytes;
diff --git a/lib/crypto/doc/src/crypto.xml b/lib/crypto/doc/src/crypto.xml
index 58da89f0a9..38cc93a476 100644
--- a/lib/crypto/doc/src/crypto.xml
+++ b/lib/crypto/doc/src/crypto.xml
@@ -155,7 +155,7 @@
     <p>The key's password
     </p>
 
-     <code>stream_cipher() = rc4 | aes_ctr </code>
+     <code>stream_cipher() = rc4 | aes_ctr | chacha20 </code>
 
      <code>block_cipher() = aes_cbc | aes_cfb8 | aes_cfb128 | aes_ige256 | blowfish_cbc |
      blowfish_cfb64 | des_cbc | des_cfb | des3_cbc | des3_cfb | des_ede3 | rc2_cbc </code>
@@ -193,9 +193,9 @@
      Note that both md4 and md5 are recommended only for compatibility with existing applications.
      </p>
      <code> cipher_algorithms() = aes_cbc | aes_cfb8 | aes_cfb128 | aes_ctr | aes_gcm |
-     aes_ige256 | blowfish_cbc | blowfish_cfb64 | chacha20_poly1305 | des_cbc |
+     aes_ige256 | blowfish_cbc | blowfish_cfb64 | chacha20 | chacha20_poly1305 | des_cbc |
      des_cfb | des3_cbc | des3_cfb | des_ede3 | rc2_cbc | rc4 </code>
-     <code> mac_algorithms() = hmac | cmac</code>
+     <code> mac_algorithms() = hmac | cmac | poly1305</code>
      <code> public_key_algorithms() = rsa |dss | ecdsa | dh | ecdh | ec_gf2m</code>
      <p>Note that ec_gf2m is not strictly a public key algorithm, but a restriction on what curves are supported
      with ecdsa and ecdh.
@@ -598,6 +598,20 @@
     </func>
 
     <func>
+      <name>poly1305(Key, Data) -> Mac</name>
+      <fsummary></fsummary>
+      <type>
+        <v>Key = iodata()</v>
+	<v>Data = iodata()</v>
+	<v>Mac = binary()</v>
+      </type>
+      <desc>
+        <p>Computes a POLY1305 message authentication code (<c>Mac</c>) from <c>Data</c> using
+        <c>Key</c> as the authentication key.</p>
+      </desc>
+    </func>
+
+    <func>
       <name>private_decrypt(Type, CipherText, PrivateKey, Padding) -> PlainText</name>
       <fsummary>Decrypts CipherText using the private Key.</fsummary>
       <type>
@@ -958,7 +972,7 @@ _FloatValue = rand:uniform().     % [0.0; 1.0[</pre>
       <name>stream_init(Type, Key, IVec) -> State</name>
       <fsummary></fsummary>
       <type>
-	<v>Type = aes_ctr </v>
+	<v>Type = aes_ctr | chacha20</v>
         <v>State = opaque() </v>
         <v>Key = iodata()</v>
         <v>IVec = binary()</v>
diff --git a/lib/crypto/src/crypto.erl b/lib/crypto/src/crypto.erl
index 81ab4e5ea1..f6a785303b 100644
--- a/lib/crypto/src/crypto.erl
+++ b/lib/crypto/src/crypto.erl
@@ -29,6 +29,7 @@
 -export([generate_key/2, generate_key/3, compute_key/4]).
 -export([hmac/3, hmac/4, hmac_init/2, hmac_update/2, hmac_final/1, hmac_final_n/2]).
 -export([cmac/3, cmac/4]).
+-export([poly1305/2]).
 -export([exor/2, strong_rand_bytes/1, mod_pow/3]).
 -export([rand_seed/0, rand_seed_alg/1]).
 -export([rand_seed_s/0, rand_seed_alg_s/1]).
@@ -194,6 +195,11 @@ cmac(Type, Key, Data) ->
 cmac(Type, Key, Data, MacSize) ->
     erlang:binary_part(cmac(Type, Key, Data), 0, MacSize).
 
+-spec poly1305(iodata(), iodata()) -> binary().
+
+poly1305(Key, Data) ->
+    poly1305_nif(Key, Data).
+
 %% Ecrypt/decrypt %%%
 
 -spec block_encrypt(des_cbc | des_cfb |
@@ -309,7 +315,10 @@ next_iv(Type, Data, _Ivec) ->
     next_iv(Type, Data).
 
 stream_init(aes_ctr, Key, Ivec) ->
-    {aes_ctr, aes_ctr_stream_init(Key, Ivec)}.
+    {aes_ctr, aes_ctr_stream_init(Key, Ivec)};
+stream_init(chacha20, Key, Ivec) ->
+    {chacha20, chacha20_stream_init(Key,Ivec)}.
+
 stream_init(rc4, Key) ->
     {rc4, notsup_to_error(rc4_set_key(Key))}.
 
@@ -1060,9 +1069,12 @@ hmac_final_nif(_Context) -> ?nif_stub.
 hmac_final_nif(_Context, _MacSize) -> ?nif_stub.
 
 %% CMAC
-
 cmac_nif(_Type, _Key, _Data) -> ?nif_stub.
 
+%% POLY1305
+poly1305_nif(_Key, _Data) -> ?nif_stub.
+
+
 %% CIPHERS --------------------------------------------------------------------
 
 block_crypt_nif(_Type, _Key, _Ivec, _Text, _IsEncrypt) -> ?nif_stub.
@@ -1117,14 +1129,20 @@ do_stream_encrypt({aes_ctr, State0}, Data) ->
     {{aes_ctr, State}, Cipher};
 do_stream_encrypt({rc4, State0}, Data) ->
     {State, Cipher} = rc4_encrypt_with_state(State0, Data),
-    {{rc4, State}, Cipher}.
+    {{rc4, State}, Cipher};
+do_stream_encrypt({chacha20, State0}, Data) ->
+    {State, Cipher} = chacha20_stream_encrypt(State0, Data),
+    {{chacha20, State}, Cipher}.
 
 do_stream_decrypt({aes_ctr, State0}, Data) ->
     {State, Text} = aes_ctr_stream_decrypt(State0, Data),
     {{aes_ctr, State}, Text};
 do_stream_decrypt({rc4, State0}, Data) ->
     {State, Text} = rc4_encrypt_with_state(State0, Data),
-    {{rc4, State}, Text}.
+    {{rc4, State}, Text};
+do_stream_decrypt({chacha20, State0}, Data) ->
+    {State, Cipher} = chacha20_stream_decrypt(State0, Data),
+    {{chacha20, State}, Cipher}.
 
 
 %%
@@ -1148,6 +1166,18 @@ aes_ctr_stream_decrypt(_State, _Cipher) -> ?nif_stub.
 rc4_set_key(_Key) -> ?nif_stub.
 rc4_encrypt_with_state(_State, _Data) -> ?nif_stub.
 
+%%
+%% CHACHA20 - stream cipher
+%%
+-type chacha20_state() :: term().
+-spec chacha20_stream_init(iodata(), binary()) -> chacha20_state().
+-spec chacha20_stream_encrypt(chacha20_state(), binary()) -> {chacha20_state(), binary()}.
+-spec chacha20_stream_decrypt(chacha20_state(), binary()) -> {chacha20_state(), binary()}.
+
+chacha20_stream_init(_Key, _IVec) -> ?nif_stub.
+chacha20_stream_encrypt(_State, _Data) -> ?nif_stub.
+chacha20_stream_decrypt(_State, _Data) -> ?nif_stub.
+
 %% Secure remote password  -------------------------------------------------------------------
 
 user_srp_gen_key(Private, Generator, Prime) ->
diff --git a/lib/crypto/test/crypto_SUITE.erl b/lib/crypto/test/crypto_SUITE.erl
index 1027a8d945..3257dfd373 100644
--- a/lib/crypto/test/crypto_SUITE.erl
+++ b/lib/crypto/test/crypto_SUITE.erl
@@ -77,6 +77,8 @@ groups() ->
                      {group, aes_ctr},
 		     {group, aes_gcm},
 		     {group, chacha20_poly1305},
+		     {group, chacha20},
+                     {group, poly1305},
 		     {group, aes_cbc}]},
      {fips, [], [{group, no_md4},
                  {group, no_md5},
@@ -112,6 +114,7 @@ groups() ->
                  {group, aes_ctr},
 		 {group, aes_gcm},
 		 {group, no_chacha20_poly1305},
+		 {group, no_chacha20},
 		 {group, aes_cbc}]},
      {md4, [], [hash]},
      {md5, [], [hash, hmac]},
@@ -157,6 +160,8 @@ groups() ->
      {aes_ctr, [], [stream]},
      {aes_gcm, [], [aead]},
      {chacha20_poly1305, [], [aead]},
+     {chacha20, [], [stream]},
+     {poly1305, [], [poly1305]},
      {aes_cbc, [], [block]},
      {no_md4, [], [no_support, no_hash]},
      {no_md5, [], [no_support, no_hash, no_hmac]},
@@ -170,6 +175,7 @@ groups() ->
      {no_blowfish_ofb64, [], [no_support, no_block]},
      {no_aes_ige256, [], [no_support, no_block]},
      {no_chacha20_poly1305, [], [no_support, no_aead]},
+     {no_chacha20, [], [no_support, no_stream_ivec]},
      {no_rc2_cbc, [], [no_support, no_block]},
      {no_rc4, [], [no_support, no_stream]},
      {api_errors, [], [api_errors_ecdh]}
@@ -356,6 +362,20 @@ cmac(Config) when is_list(Config) ->
     lists:foreach(fun cmac_check/1, Pairs),
     lists:foreach(fun cmac_check/1, cmac_iolistify(Pairs)).
 %%--------------------------------------------------------------------
+poly1305() ->
+    [{doc, "Test poly1305 function"}].
+poly1305(Config) ->
+    lists:foreach(
+      fun({Key, Txt, Expect}) ->
+              case crypto:poly1305(Key,Txt) of
+                  Expect ->
+                      ok;
+                  Other ->
+                      ct:fail({{crypto, poly1305, [Key, Txt]}, {expected, Expect}, {got, Other}})
+              end
+      end, proplists:get_value(poly1305, Config)).
+
+%%--------------------------------------------------------------------
 block() ->
      [{doc, "Test block ciphers"}].
 block(Config) when is_list(Config) ->
@@ -420,6 +440,13 @@ no_stream(Config) when is_list(Config) ->
     notsup(fun crypto:stream_init/2, [Type, <<"Key">>]).
 
 %%--------------------------------------------------------------------
+no_stream_ivec() ->
+      [{doc, "Test disabled stream ciphers that uses ivec"}].
+no_stream_ivec(Config) when is_list(Config) ->
+    Type = ?config(type, Config),
+    notsup(fun crypto:stream_init/3, [Type, <<"Key">>, <<"Ivec">>]).
+
+%%--------------------------------------------------------------------
 aead() ->
       [{doc, "Test AEAD ciphers"}].
 aead(Config) when is_list(Config) ->
@@ -757,16 +784,33 @@ stream_cipher({Type, Key, IV, PlainText}) ->
 	    ok;
 	Other ->
 	    ct:fail({{crypto, stream_decrypt, [State, CipherText]}, {expected, PlainText}, {got, Other}})
+    end;
+stream_cipher({Type, Key, IV, PlainText, CipherText}) ->
+    Plain = iolist_to_binary(PlainText),
+    State = crypto:stream_init(Type, Key, IV),
+    case crypto:stream_encrypt(State, PlainText) of
+        {_, CipherText} ->
+            ok;
+        {_, Other0} ->
+            ct:fail({{crypto, stream_encrypt, [State, Type, Key, IV, Plain]}, {expected, CipherText}, {got, Other0}})
+    end,
+    case crypto:stream_decrypt(State, CipherText) of
+        {_, Plain} ->
+            ok;
+        Other1 ->
+            ct:fail({{crypto, stream_decrypt, [State, CipherText]}, {expected, PlainText}, {got, Other1}})
     end.
 
 stream_cipher_incment({Type, Key, PlainTexts}) ->
     State = crypto:stream_init(Type, Key),
-    stream_cipher_incment(State, State, PlainTexts, [], iolist_to_binary(PlainTexts));
+    stream_cipher_incment_loop(State, State, PlainTexts, [], iolist_to_binary(PlainTexts));
 stream_cipher_incment({Type, Key, IV, PlainTexts}) ->
     State = crypto:stream_init(Type, Key, IV),
-    stream_cipher_incment(State, State, PlainTexts, [], iolist_to_binary(PlainTexts)).
+    stream_cipher_incment_loop(State, State, PlainTexts, [], iolist_to_binary(PlainTexts));
+stream_cipher_incment({Type, Key, IV, PlainTexts, _CipherText}) ->
+    stream_cipher_incment({Type, Key, IV, PlainTexts}).
 
-stream_cipher_incment(_State, OrigState, [], Acc, Plain) ->
+stream_cipher_incment_loop(_State, OrigState, [], Acc, Plain) ->
     CipherText = iolist_to_binary(lists:reverse(Acc)),
     case crypto:stream_decrypt(OrigState, CipherText) of
 	{_, Plain} ->
@@ -774,9 +818,9 @@ stream_cipher_incment(_State, OrigState, [], Acc, Plain) ->
 	Other ->
 	    ct:fail({{crypto, stream_decrypt, [OrigState, CipherText]}, {expected, Plain}, {got, Other}})
     end;
-stream_cipher_incment(State0, OrigState, [PlainText | PlainTexts], Acc, Plain) ->
+stream_cipher_incment_loop(State0, OrigState, [PlainText | PlainTexts], Acc, Plain) ->
     {State, CipherText} = crypto:stream_encrypt(State0, PlainText),
-    stream_cipher_incment(State, OrigState, PlainTexts, [CipherText | Acc], Plain).
+    stream_cipher_incment_loop(State, OrigState, PlainTexts, [CipherText | Acc], Plain).
 
 aead_cipher({Type, Key, PlainText, IV, AAD, CipherText, CipherTag}) ->
     Plain = iolist_to_binary(PlainText),
@@ -1027,7 +1071,9 @@ do_cmac_iolistify({Type, Key, Text, Size, CMac}) ->
 do_stream_iolistify({Type, Key, PlainText}) ->
     {Type, iolistify(Key), iolistify(PlainText)};
 do_stream_iolistify({Type, Key, IV, PlainText}) ->
-    {Type, iolistify(Key), IV, iolistify(PlainText)}.
+    {Type, iolistify(Key), IV, iolistify(PlainText)};
+do_stream_iolistify({Type, Key, IV, PlainText, CipherText}) ->
+    {Type, iolistify(Key), IV, iolistify(PlainText), CipherText}.
 
 do_block_iolistify({des_cbc = Type, Key, IV, PlainText}) ->
     {Type, Key, IV, des_iolistify(PlainText)};
@@ -1432,6 +1478,18 @@ group_config(aes_gcm, Config) ->
 group_config(chacha20_poly1305, Config) ->
     AEAD = chacha20_poly1305(),
     [{aead, AEAD} | Config];
+group_config(chacha20, Config) ->
+    Stream = chacha20(),
+    [{stream, Stream} | Config];
+group_config(poly1305, Config) ->
+    V = [%% {Key, Txt, Expect}
+         {%% RFC7539 2.5.2
+           crypto_SUITE:hexstr2bin("85d6be7857556d337f4452fe42d506a80103808afb0db2fd4abff6af4149f51b"),
+           <<"Cryptographic Forum Research Group">>,
+           crypto_SUITE:hexstr2bin("a8061dc1305136c6c22b8baf0c0127a9")
+         }
+        ],
+    [{poly1305,V} | Config];
 group_config(aes_cbc, Config) ->
     Block = aes_cbc(Config),
     [{block, Block} | Config];
@@ -2069,6 +2127,7 @@ aes_gcm(Config) ->
              "gcmEncryptExtIV192.rsp",
              "gcmEncryptExtIV256.rsp"]).
 
+
 %% https://tools.ietf.org/html/rfc7539#appendix-A.5
 chacha20_poly1305() ->
     [
@@ -2114,6 +2173,103 @@ chacha20_poly1305() ->
       hexstr2bin("eead9d67890cbb22392336fea1851f38")}                    %% CipherTag
     ].
 
+
+chacha20() ->
+%%% chacha20 (no mode) test vectors from RFC 7539 A.2
+    [
+     %% Test Vector #1:
+     {chacha20,
+      hexstr2bin("00000000000000000000000000000000"
+                 "00000000000000000000000000000000"),                    %% Key
+      hexstr2bin("00000000" % Initial counter = 0, little-endian
+                 "000000000000000000000000"),                            %% IV
+      hexstr2bin("00000000000000000000000000000000"                      %% PlainText
+                 "00000000000000000000000000000000"
+                 "00000000000000000000000000000000"
+                 "00000000000000000000000000000000"),
+      hexstr2bin("76b8e0ada0f13d90405d6ae55386bd28"                      %% CipherText
+                 "bdd219b8a08ded1aa836efcc8b770dc7"
+                 "da41597c5157488d7724e03fb8d84a37"
+                 "6a43b8f41518a11cc387b669b2ee6586")},
+     %% Test Vector #2:
+     {chacha20,
+      hexstr2bin("00000000000000000000000000000000"
+                 "00000000000000000000000000000001"),                    %% Key
+      hexstr2bin("01000000" % Initial counter = 1, little-endian
+                 "000000000000000000000002"),                            %% IV
+      hexstr2bin("416e79207375626d697373696f6e2074"                      %% PlainText
+                 "6f20746865204945544620696e74656e"
+                 "6465642062792074686520436f6e7472"
+                 "696275746f7220666f72207075626c69"
+                 "636174696f6e20617320616c6c206f72"
+                 "2070617274206f6620616e2049455446"
+                 "20496e7465726e65742d447261667420"
+                 "6f722052464320616e6420616e792073"
+                 "746174656d656e74206d616465207769"
+                 "7468696e2074686520636f6e74657874"
+                 "206f6620616e20494554462061637469"
+                 "7669747920697320636f6e7369646572"
+                 "656420616e20224945544620436f6e74"
+                 "7269627574696f6e222e205375636820"
+                 "73746174656d656e747320696e636c75"
+                 "6465206f72616c2073746174656d656e"
+                 "747320696e2049455446207365737369"
+                 "6f6e732c2061732077656c6c20617320"
+                 "7772697474656e20616e6420656c6563"
+                 "74726f6e696320636f6d6d756e696361"
+                 "74696f6e73206d61646520617420616e"
+                 "792074696d65206f7220706c6163652c"
+                 "20776869636820617265206164647265"
+                 "7373656420746f"),
+      hexstr2bin("a3fbf07df3fa2fde4f376ca23e827370"                      %% CipherText
+                 "41605d9f4f4f57bd8cff2c1d4b7955ec"
+                 "2a97948bd3722915c8f3d337f7d37005"
+                 "0e9e96d647b7c39f56e031ca5eb6250d"
+                 "4042e02785ececfa4b4bb5e8ead0440e"
+                 "20b6e8db09d881a7c6132f420e527950"
+                 "42bdfa7773d8a9051447b3291ce1411c"
+                 "680465552aa6c405b7764d5e87bea85a"
+                 "d00f8449ed8f72d0d662ab052691ca66"
+                 "424bc86d2df80ea41f43abf937d3259d"
+                 "c4b2d0dfb48a6c9139ddd7f76966e928"
+                 "e635553ba76c5c879d7b35d49eb2e62b"
+                 "0871cdac638939e25e8a1e0ef9d5280f"
+                 "a8ca328b351c3c765989cbcf3daa8b6c"
+                 "cc3aaf9f3979c92b3720fc88dc95ed84"
+                 "a1be059c6499b9fda236e7e818b04b0b"
+                 "c39c1e876b193bfe5569753f88128cc0"
+                 "8aaa9b63d1a16f80ef2554d7189c411f"
+                 "5869ca52c5b83fa36ff216b9c1d30062"
+                 "bebcfd2dc5bce0911934fda79a86f6e6"
+                 "98ced759c3ff9b6477338f3da4f9cd85"
+                 "14ea9982ccafb341b2384dd902f3d1ab"
+                 "7ac61dd29c6f21ba5b862f3730e37cfd"
+                 "c4fd806c22f221")},
+     %%Test Vector #3:
+     {chacha20,
+      hexstr2bin("1c9240a5eb55d38af333888604f6b5f0"
+                 "473917c1402b80099dca5cbc207075c0"),                    %% Key
+      hexstr2bin("2a000000" % Initial counter = 42 (decimal), little-endian
+                 "000000000000000000000002"),                            %% IV
+      hexstr2bin("2754776173206272696c6c69672c2061"                      %% PlainText
+                 "6e642074686520736c6974687920746f"
+                 "7665730a446964206779726520616e64"
+                 "2067696d626c6520696e207468652077"
+                 "6162653a0a416c6c206d696d73792077"
+                 "6572652074686520626f726f676f7665"
+                 "732c0a416e6420746865206d6f6d6520"
+                 "7261746873206f757467726162652e"),
+      hexstr2bin("62e6347f95ed87a45ffae7426f27a1df"                      %% CipherText
+                 "5fb69110044c0d73118effa95b01e5cf"
+                 "166d3df2d721caf9b21e5fb14c616871"
+                 "fd84c54f9d65b283196c7fe4f60553eb"
+                 "f39c6402c42234e32a356b3e764312a6"
+                 "1a5532055716ead6962568f87d3f3f77"
+                 "04c6a8d1bcd1bf4d50d6154b6da731b1"
+                 "87b58dfd728afa36757a797ac188d1")}
+    ].
+
+
 rsa_plain() ->
     <<"7896345786348756234 Hejsan Svejsan, erlang crypto debugger"
       "09812312908312378623487263487623412039812 huagasd">>.
diff --git a/lib/ssh/doc/src/ssh_app.xml b/lib/ssh/doc/src/ssh_app.xml
index 9ec909d733..4f0896d613 100644
--- a/lib/ssh/doc/src/ssh_app.xml
+++ b/lib/ssh/doc/src/ssh_app.xml
@@ -186,6 +186,7 @@
       <tag>Encryption algorithms (ciphers)</tag>
       <item>
 	<list type="bulleted">
+	  <item>[email protected]</item>
           <item>[email protected]</item>
 	  <item>aes256-ctr</item>
 	  <item>aes192-ctr</item>
diff --git a/lib/ssh/src/ssh.hrl b/lib/ssh/src/ssh.hrl
index 01c44cb371..4ac5b7a2c1 100644
--- a/lib/ssh/src/ssh.hrl
+++ b/lib/ssh/src/ssh.hrl
@@ -140,7 +140,8 @@
                             '[email protected]' |
                             'aes192-ctr' |
                             'aes256-ctr' |
-                            '[email protected]'
+                            '[email protected]' |
+                            '[email protected]'
                             .
 
 -type mac_alg()          :: 'AEAD_AES_128_GCM' |
diff --git a/lib/ssh/src/ssh_connection_handler.erl b/lib/ssh/src/ssh_connection_handler.erl
index 8e4831a601..4b41c10cbb 100644
--- a/lib/ssh/src/ssh_connection_handler.erl
+++ b/lib/ssh/src/ssh_connection_handler.erl
@@ -356,6 +356,8 @@ alg(ConnectionHandler) ->
                                                  | undefined,
 	  encrypted_data_buffer     = <<>>      :: binary()
                                                  | undefined,
+	  aead_data                 = <<>>      :: binary()
+                                                 | undefined,
 	  undecrypted_packet_length             :: undefined | non_neg_integer(),
 	  key_exchange_init_msg                 :: #ssh_msg_kexinit{}
 						 | undefined,
@@ -1308,14 +1310,16 @@ handle_event(info, {Proto, Sock, NewData}, StateName, D0 = #data{socket = Sock,
     try ssh_transport:handle_packet_part(
 	  D0#data.decrypted_data_buffer,
 	  <<(D0#data.encrypted_data_buffer)/binary, NewData/binary>>,
-	  D0#data.undecrypted_packet_length,
+          D0#data.aead_data,
+          D0#data.undecrypted_packet_length,
 	  D0#data.ssh_params)
     of
 	{packet_decrypted, DecryptedBytes, EncryptedDataRest, Ssh1} ->
 	    D1 = D0#data{ssh_params =
 			    Ssh1#ssh{recv_sequence = ssh_transport:next_seqnum(Ssh1#ssh.recv_sequence)},
 			decrypted_data_buffer = <<>>,
-			undecrypted_packet_length = undefined,
+                        undecrypted_packet_length = undefined,
+                        aead_data = <<>>,
 			encrypted_data_buffer = EncryptedDataRest},
 	    try
 		ssh_message:decode(set_kex_overload_prefix(DecryptedBytes,D1))
@@ -1353,14 +1357,15 @@ handle_event(info, {Proto, Sock, NewData}, StateName, D0 = #data{socket = Sock,
                                          StateName, D1),
                     {stop, Shutdown, D}
 	    end;
-        
-	{get_more, DecryptedBytes, EncryptedDataRest, RemainingSshPacketLen, Ssh1} ->
+
+	{get_more, DecryptedBytes, EncryptedDataRest, AeadData, RemainingSshPacketLen, Ssh1} ->
 	    %% Here we know that there are not enough bytes in
 	    %% EncryptedDataRest to use. We must wait for more.
 	    inet:setopts(Sock, [{active, once}]),
 	    {keep_state, D0#data{encrypted_data_buffer = EncryptedDataRest,
 				 decrypted_data_buffer = DecryptedBytes,
-				 undecrypted_packet_length = RemainingSshPacketLen,
+                                 undecrypted_packet_length = RemainingSshPacketLen,
+                                 aead_data = AeadData,
 				 ssh_params = Ssh1}};
 
 	{bad_mac, Ssh1} ->
diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index b6d7aa0b1b..d6b9142529 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -36,7 +36,7 @@
 	 default_algorithms/0, default_algorithms/1,
          algo_classes/0, algo_class/1,
          algo_two_spec_classes/0, algo_two_spec_class/1,
-	 handle_packet_part/4,
+	 handle_packet_part/5,
 	 handle_hello_version/1,
 	 key_exchange_init_msg/1,
 	 key_init/3, new_keys_message/1,
@@ -114,7 +114,8 @@ default_algorithms(kex) ->
 
 default_algorithms(cipher) ->
     supported_algorithms(cipher, same(['AEAD_AES_128_GCM',
-				       'AEAD_AES_256_GCM']));
+				       'AEAD_AES_256_GCM'
+                                      ]));
 default_algorithms(mac) ->
     supported_algorithms(mac, same(['AEAD_AES_128_GCM',
 				    'AEAD_AES_256_GCM']));
@@ -160,6 +161,7 @@ supported_algorithms(cipher) ->
     same(
       select_crypto_supported(
 	[
+         {'[email protected]', [{ciphers,chacha20}, {macs,poly1305}]},
          {'[email protected]', [{ciphers,{aes_gcm,256}}]},
          {'aes256-ctr',       [{ciphers,{aes_ctr,256}}]},
          {'aes192-ctr',       [{ciphers,{aes_ctr,192}}]},
@@ -982,13 +984,14 @@ select_algorithm(Role, Client, Server, Opts) ->
 %%% the exchanged MAC algorithms are ignored and there doesn't have to be
 %%% a matching MAC.
 
-aead_gcm_simultan('[email protected]', _) -> {'AEAD_AES_128_GCM', 'AEAD_AES_128_GCM'};
-aead_gcm_simultan('[email protected]', _) -> {'AEAD_AES_256_GCM', 'AEAD_AES_256_GCM'};
-aead_gcm_simultan('AEAD_AES_128_GCM', _) -> {'AEAD_AES_128_GCM', 'AEAD_AES_128_GCM'};
-aead_gcm_simultan('AEAD_AES_256_GCM', _) -> {'AEAD_AES_256_GCM', 'AEAD_AES_256_GCM'};
-aead_gcm_simultan(_, 'AEAD_AES_128_GCM') -> {'AEAD_AES_128_GCM', 'AEAD_AES_128_GCM'};
-aead_gcm_simultan(_, 'AEAD_AES_256_GCM') -> {'AEAD_AES_256_GCM', 'AEAD_AES_256_GCM'};
-aead_gcm_simultan(Cipher, Mac) -> {Cipher,Mac}.
+aead_gcm_simultan('[email protected]', _)         -> {'AEAD_AES_128_GCM', 'AEAD_AES_128_GCM'};
+aead_gcm_simultan('[email protected]', _)         -> {'AEAD_AES_256_GCM', 'AEAD_AES_256_GCM'};
+aead_gcm_simultan('AEAD_AES_128_GCM'=C, _)             -> {C, C};
+aead_gcm_simultan('AEAD_AES_256_GCM'=C, _)             -> {C, C};
+aead_gcm_simultan(_, 'AEAD_AES_128_GCM'=C)             -> {C, C};
+aead_gcm_simultan(_, 'AEAD_AES_256_GCM'=C)             -> {C, C};
+aead_gcm_simultan('[email protected]'=C, _)-> {C, C};
+aead_gcm_simultan(Cipher, Mac)                         -> {Cipher,Mac}.
 
 
 select_encrypt_decrypt(client, Client, Server) ->
@@ -1136,7 +1139,7 @@ pack(PlainText,
 	  encrypt = CryptoAlg} = Ssh0,  PacketLenDeviationForTests) when is_binary(PlainText) ->
 
     {Ssh1, CompressedPlainText} = compress(Ssh0, PlainText),
-    {EcryptedPacket, MAC, Ssh3} =
+    {FinalPacket, Ssh3} =
 	case pkt_type(CryptoAlg) of
 	    common ->
 		PaddingLen = padding_length(4+1+size(CompressedPlainText), Ssh0),
@@ -1145,16 +1148,15 @@ pack(PlainText,
 		PlainPacketData = <<?UINT32(PlainPacketLen),?BYTE(PaddingLen), CompressedPlainText/binary, Padding/binary>>,
 		{Ssh2, EcryptedPacket0} = encrypt(Ssh1, PlainPacketData),
 		MAC0 = mac(MacAlg, MacKey, SeqNum, PlainPacketData),
-		{EcryptedPacket0, MAC0, Ssh2};
+                {<<EcryptedPacket0/binary,MAC0/binary>>, Ssh2};
 	    aead ->
 		PaddingLen = padding_length(1+size(CompressedPlainText), Ssh0),
 		Padding =  ssh_bits:random(PaddingLen),
 		PlainPacketLen = 1 + PaddingLen + size(CompressedPlainText) + PacketLenDeviationForTests,
 		PlainPacketData = <<?BYTE(PaddingLen), CompressedPlainText/binary, Padding/binary>>,
-		{Ssh2, {EcryptedPacket0,MAC0}} = encrypt(Ssh1, {<<?UINT32(PlainPacketLen)>>,PlainPacketData}),
-		{<<?UINT32(PlainPacketLen),EcryptedPacket0/binary>>, MAC0, Ssh2}
+                {Ssh2, {EcryptedPacket0,MAC0}} = encrypt(Ssh1, <<?UINT32(PlainPacketLen),PlainPacketData/binary>>),
+                {<<EcryptedPacket0/binary,MAC0/binary>>, Ssh2}
 	end,
-    FinalPacket = [EcryptedPacket, MAC],
     Ssh = Ssh3#ssh{send_sequence = (SeqNum+1) band 16#ffffffff},
     {FinalPacket, Ssh}.
 
@@ -1174,31 +1176,31 @@ padding_length(Size, #ssh{encrypt_block_size = BlockSize,
 
 
 
-handle_packet_part(<<>>, Encrypted0, undefined, #ssh{decrypt = CryptoAlg} = Ssh0) ->
+handle_packet_part(<<>>, Encrypted0, AEAD0, undefined, #ssh{decrypt = CryptoAlg} = Ssh0) ->
     %% New ssh packet
     case get_length(pkt_type(CryptoAlg), Encrypted0, Ssh0) of
 	get_more ->
 	    %% too short to get the length
-	    {get_more, <<>>, Encrypted0, undefined, Ssh0};
+	    {get_more, <<>>, Encrypted0, AEAD0, undefined, Ssh0};
 
-	{ok, PacketLen, _, _, _} when PacketLen > ?SSH_MAX_PACKET_SIZE ->
+	{ok, PacketLen, _, _, _, _} when PacketLen > ?SSH_MAX_PACKET_SIZE ->
 	    %% far too long message than expected
 	    {error, {exceeds_max_size,PacketLen}};
 	
-	{ok, PacketLen, Decrypted, Encrypted1,
+	{ok, PacketLen, Decrypted, Encrypted1, AEAD,
 	 #ssh{recv_mac_size = MacSize} = Ssh1} ->
 	    %% enough bytes so we got the length and can calculate how many
 	    %% more bytes to expect for a full packet
 	    TotalNeeded = (4 + PacketLen + MacSize),
-	    handle_packet_part(Decrypted, Encrypted1, TotalNeeded, Ssh1)
+	    handle_packet_part(Decrypted, Encrypted1, AEAD, TotalNeeded, Ssh1)
     end;
 
-handle_packet_part(DecryptedPfx, EncryptedBuffer, TotalNeeded, Ssh0) 
+handle_packet_part(DecryptedPfx, EncryptedBuffer, AEAD, TotalNeeded, Ssh0) 
   when (size(DecryptedPfx)+size(EncryptedBuffer)) < TotalNeeded ->
     %% need more bytes to finalize the packet
-    {get_more, DecryptedPfx, EncryptedBuffer, TotalNeeded, Ssh0};
+    {get_more, DecryptedPfx, EncryptedBuffer, AEAD, TotalNeeded, Ssh0};
 
-handle_packet_part(DecryptedPfx, EncryptedBuffer, TotalNeeded, 
+handle_packet_part(DecryptedPfx, EncryptedBuffer, AEAD, TotalNeeded, 
 		   #ssh{recv_mac_size = MacSize,
 			decrypt = CryptoAlg} = Ssh0) ->
     %% enough bytes to decode the packet.
@@ -1216,8 +1218,7 @@ handle_packet_part(DecryptedPfx, EncryptedBuffer, TotalNeeded,
 		    {packet_decrypted, DecompressedPayload, NextPacketBytes, Ssh}
 	    end;
 	aead ->
-	    PacketLenBin = DecryptedPfx,
-	    case decrypt(Ssh0, {PacketLenBin,EncryptedSfx,Mac}) of
+            case decrypt(Ssh0, {AEAD,EncryptedSfx,Mac}) of
 		{Ssh1, error} ->
 		    {bad_mac, Ssh1};
 		{Ssh1, DecryptedSfx} ->
@@ -1234,21 +1235,29 @@ get_length(common, EncryptedBuffer, #ssh{decrypt_block_size = BlockSize} = Ssh0)
 	    <<EncBlock:BlockSize/binary, EncryptedRest/binary>> = EncryptedBuffer,
 	    {Ssh, 
 	     <<?UINT32(PacketLen),_/binary>> = Decrypted} = decrypt(Ssh0, EncBlock),
-	    {ok, PacketLen, Decrypted, EncryptedRest, Ssh};
+	    {ok, PacketLen, Decrypted, EncryptedRest, <<>>, Ssh};
 	false ->
 	    get_more
     end;
+
 get_length(aead, EncryptedBuffer, Ssh) ->
-    case size(EncryptedBuffer) >= 4 of
-	true ->
+    case {size(EncryptedBuffer) >= 4, Ssh#ssh.decrypt} of
+       {true, '[email protected]'} ->
+            <<EncryptedLen:4/binary, EncryptedRest/binary>> = EncryptedBuffer,
+            {Ssh1,  PacketLenBin} = decrypt(Ssh, {length,EncryptedLen}),
+            <<?UINT32(PacketLen)>> = PacketLenBin,
+            {ok, PacketLen, PacketLenBin, EncryptedRest, EncryptedLen, Ssh1};
+        {true, _} ->
 	    <<?UINT32(PacketLen), EncryptedRest/binary>> = EncryptedBuffer,
-	    {ok, PacketLen, <<?UINT32(PacketLen)>>, EncryptedRest, Ssh};
-	false ->
+            {ok, PacketLen, <<?UINT32(PacketLen)>>, EncryptedRest, <<?UINT32(PacketLen)>>, Ssh};
+        {false, _} ->
 	    get_more
     end.
 
+
 pkt_type('AEAD_AES_128_GCM') -> aead;
 pkt_type('AEAD_AES_256_GCM') -> aead;
+pkt_type('[email protected]') -> aead;
 pkt_type(_) -> common.
 
 payload(<<PacketLen:32, PaddingLen:8, PayloadAndPadding/binary>>) ->
@@ -1353,11 +1362,32 @@ cipher('aes192-ctr') ->
 cipher('aes256-ctr') ->
     #cipher_data{key_bytes = 32,
                  iv_bytes = 16,
-                 block_bytes = 16}.
+                 block_bytes = 16};
+
+cipher('[email protected]') -> % FIXME: Verify!!
+    #cipher_data{key_bytes = 32,
+                 iv_bytes = 12,
+                 block_bytes = 8}.
+    
 
 
 encrypt_init(#ssh{encrypt = none} = Ssh) ->
     {ok, Ssh};
+encrypt_init(#ssh{encrypt = '[email protected]', role = client} = Ssh) ->
+    %% [email protected] uses two independent crypto streams, one (chacha20)
+    %% for the length used in stream mode, and the other (chacha20-poly1305) as AEAD for
+    %% the payload and to MAC the length||payload.
+    %% See draft-josefsson-ssh-chacha20-poly1305-openssh-00
+    <<K2:32/binary,K1:32/binary>> = hash(Ssh, "C", 512),
+    {ok, Ssh#ssh{encrypt_keys = {K1,K2}
+                % encrypt_block_size = 16, %default = 8.  What to set it to? 64 (openssl chacha.h)
+                 % ctx and iv is setup for each packet
+                }};
+encrypt_init(#ssh{encrypt = '[email protected]', role = server} = Ssh) ->
+    <<K2:32/binary,K1:32/binary>> = hash(Ssh, "D", 512),
+    {ok, Ssh#ssh{encrypt_keys = {K1,K2}
+                % encrypt_block_size = 16, %default = 8.  What to set it to?
+                }};
 encrypt_init(#ssh{encrypt = 'AEAD_AES_128_GCM', role = client} = Ssh) ->
     IV = hash(Ssh, "A", 12*8),
     <<K:16/binary>> = hash(Ssh, "C", 128),
@@ -1458,18 +1488,40 @@ encrypt_final(Ssh) ->
 
 encrypt(#ssh{encrypt = none} = Ssh, Data) ->
     {Ssh, Data};
+encrypt(#ssh{encrypt = '[email protected]',
+             encrypt_keys = {K1,K2},
+             send_sequence = Seq} = Ssh,
+        <<LenData:4/binary, PayloadData/binary>>) ->
+    %% Encrypt length
+    IV1 = <<0:8/unit:8, Seq:8/unit:8>>,
+    {_,EncLen} = crypto:stream_encrypt(crypto:stream_init(chacha20, K1, IV1),
+                                            LenData),
+    %% Encrypt payload
+    IV2 = <<1:8/little-unit:8, Seq:8/unit:8>>,
+     {_,EncPayloadData} = crypto:stream_encrypt(crypto:stream_init(chacha20, K2, IV2),
+                                                PayloadData),
+
+    %% MAC tag
+    {_,PolyKey} = crypto:stream_encrypt(crypto:stream_init(chacha20, K2, <<0:8/unit:8,Seq:8/unit:8>>),
+                                        <<0:32/unit:8>>),
+    EncBytes = <<EncLen/binary,EncPayloadData/binary>>,
+    Ctag = crypto:poly1305(PolyKey, EncBytes),
+    %% Result
+    {Ssh, {EncBytes,Ctag}};
 encrypt(#ssh{encrypt = 'AEAD_AES_128_GCM',
             encrypt_keys = K,
-            encrypt_ctx = IV0} = Ssh, Data={_AAD,_Ptext}) ->
-    Enc = {_Ctext,_Ctag} = crypto:block_encrypt(aes_gcm, K, IV0, Data),
+             encrypt_ctx = IV0} = Ssh,
+        <<LenData:4/binary, PayloadData/binary>>) ->
+    {Ctext,Ctag} = crypto:block_encrypt(aes_gcm, K, IV0, {LenData,PayloadData}),
     IV = next_gcm_iv(IV0),
-    {Ssh#ssh{encrypt_ctx = IV}, Enc};
+    {Ssh#ssh{encrypt_ctx = IV}, {<<LenData/binary,Ctext/binary>>,Ctag}};
 encrypt(#ssh{encrypt = 'AEAD_AES_256_GCM',
             encrypt_keys = K,
-            encrypt_ctx = IV0} = Ssh, Data={_AAD,_Ptext}) ->
-    Enc = {_Ctext,_Ctag} = crypto:block_encrypt(aes_gcm, K, IV0, Data),
+             encrypt_ctx = IV0} = Ssh, 
+        <<LenData:4/binary, PayloadData/binary>>) ->
+    {Ctext,Ctag} = crypto:block_encrypt(aes_gcm, K, IV0, {LenData,PayloadData}),
     IV = next_gcm_iv(IV0),
-    {Ssh#ssh{encrypt_ctx = IV}, Enc};
+    {Ssh#ssh{encrypt_ctx = IV}, {<<LenData/binary,Ctext/binary>>,Ctag}};
 encrypt(#ssh{encrypt = '3des-cbc',
 	     encrypt_keys = {K1,K2,K3},
 	     encrypt_ctx = IV0} = Ssh, Data) ->
@@ -1502,6 +1554,14 @@ encrypt(#ssh{encrypt = 'aes256-ctr',
 
 decrypt_init(#ssh{decrypt = none} = Ssh) ->
     {ok, Ssh};
+decrypt_init(#ssh{decrypt = '[email protected]', role = client} = Ssh) ->
+    <<K2:32/binary,K1:32/binary>> = hash(Ssh, "D", 512),
+    {ok, Ssh#ssh{decrypt_keys = {K1,K2}
+                }};
+decrypt_init(#ssh{decrypt = '[email protected]', role = server} = Ssh) ->
+    <<K2:32/binary,K1:32/binary>> = hash(Ssh, "C", 512),
+    {ok, Ssh#ssh{decrypt_keys = {K1,K2}
+                }};
 decrypt_init(#ssh{decrypt = 'AEAD_AES_128_GCM', role = client} = Ssh) ->
     IV = hash(Ssh, "B", 12*8),
     <<K:16/binary>> = hash(Ssh, "D", 128),
@@ -1602,6 +1662,31 @@ decrypt_final(Ssh) ->
 
 decrypt(Ssh, <<>>) ->
     {Ssh, <<>>};
+decrypt(#ssh{decrypt = '[email protected]',
+             decrypt_keys = {K1,_K2},
+             recv_sequence = Seq} = Ssh, {length,EncryptedLen}) ->
+    {_State,PacketLenBin} =
+        crypto:stream_decrypt(crypto:stream_init(chacha20, K1, <<0:8/unit:8, Seq:8/unit:8>>),
+                              EncryptedLen),
+    {Ssh, PacketLenBin};
+decrypt(#ssh{decrypt = '[email protected]',
+             decrypt_keys = {_K1,K2},
+             recv_sequence = Seq} = Ssh, {AAD,Ctext,Ctag}) ->
+    %% The length is already decoded and used to divide the input
+    %% Check the mac (important that it is timing-safe):
+    {_,PolyKey} =
+        crypto:stream_encrypt(crypto:stream_init(chacha20, K2, <<0:8/unit:8,Seq:8/unit:8>>),
+                              <<0:32/unit:8>>),
+    case equal_const_time(Ctag, crypto:poly1305(PolyKey, <<AAD/binary,Ctext/binary>>)) of
+        true ->
+            %% MAC is ok, decode
+            IV2 = <<1:8/little-unit:8, Seq:8/unit:8>>,
+            {_,PlainText} =
+                crypto:stream_decrypt(crypto:stream_init(chacha20,K2,IV2), Ctext),
+            {Ssh, PlainText};
+        false ->
+           {Ssh,error}
+    end;
 decrypt(#ssh{decrypt = none} = Ssh, Data) ->
     {Ssh, Data};
 decrypt(#ssh{decrypt = 'AEAD_AES_128_GCM',
@@ -1744,7 +1829,7 @@ send_mac_init(SSH) ->
 		    Key = hash(SSH, "F", KeySize),
 		    {ok, SSH#ssh { send_mac_key = Key }}
 	    end;
-	aead ->
+	_ ->
 	    %% Not applicable
 	    {ok, SSH}
     end.
@@ -1765,7 +1850,7 @@ recv_mac_init(SSH) ->
 		    Key = hash(SSH, "E", 8*mac_key_bytes(SSH#ssh.recv_mac)),
 		    {ok, SSH#ssh { recv_mac_key = Key }}
 	    end;
-	aead ->
+	_ ->
 	    %% Not applicable
 	    {ok, SSH}
     end.
@@ -1905,6 +1990,7 @@ mac_key_bytes('hmac-sha2-256')-> 32;
 mac_key_bytes('hmac-sha2-512')-> 64;
 mac_key_bytes('AEAD_AES_128_GCM') -> 0;
 mac_key_bytes('AEAD_AES_256_GCM') -> 0;
+mac_key_bytes('[email protected]') -> 0;
 mac_key_bytes(none) -> 0.
 
 mac_digest_size('hmac-sha1')    -> 20;
@@ -1915,6 +2001,7 @@ mac_digest_size('hmac-sha2-256') -> 32;
 mac_digest_size('hmac-sha2-512') -> 64;
 mac_digest_size('AEAD_AES_128_GCM') -> 16;
 mac_digest_size('AEAD_AES_256_GCM') -> 16;
+mac_digest_size('[email protected]') -> 16;
 mac_digest_size(none) -> 0.
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -2026,6 +2113,20 @@ same(Algs) ->  [{client2server,Algs}, {server2client,Algs}].
 %%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
+%%% Compare two binaries in a timing safe maner.
+%%% The time spent in comparing should not be different depending on where in the binaries they differ.
+%%% This is to avoid a certain side-channel attac.
+equal_const_time(X1, X2) -> equal_const_time(X1, X2, true).
+
+equal_const_time(<<B1,R1/binary>>, <<B2,R2/binary>>, Truth) ->
+    equal_const_time(R1, R2, Truth and (B1 == B2));
+equal_const_time(<<>>, <<>>, Truth) ->
+    Truth;
+equal_const_time(_, _, _) ->
+    false.
+
+%%%-------- Remove CR, LF and following characters from a line
+
 trim_tail(Str) ->
     lists:takewhile(fun(C) -> 
 			    C=/=$\r andalso C=/=$\n
diff --git a/lib/ssh/test/ssh_bench_SUITE.erl b/lib/ssh/test/ssh_bench_SUITE.erl
index b6c6147646..441cf97234 100644
--- a/lib/ssh/test/ssh_bench_SUITE.erl
+++ b/lib/ssh/test/ssh_bench_SUITE.erl
@@ -65,10 +65,10 @@ init_per_suite(Config) ->
                                      {preferred_algorithms, Algs},
                                      {modify_algorithms,[{prepend,[{cipher,[none]},
                                                                    {mac,[none]}
-                                                                  ]},
-                                                         {rm, [{cipher,['[email protected]',
-                                                                        '[email protected]']}
-                                                              ]}
+                                                                  ]}
+                                                         %% ,{rm, [{cipher,['[email protected]',
+                                                         %%                '[email protected]']}
+                                                         %%      ]}
                                                         ]},
                                      {max_random_length_padding, 0},
                                      {subsystems, [{"/dev/null", {ssh_bench_dev_null,[DataSize]}}]}
@@ -152,7 +152,8 @@ transfer_text(Config) ->
      || {Crypto,Mac} <- [{        none,                    none},
                          {'aes128-ctr',             'hmac-sha1'},
                          {'aes256-ctr',             'hmac-sha1'},
-%%                         {'[email protected]', 'hmac-sha1'},
+{'[email protected]', 'hmac-sha1'},
+{'[email protected]', 'hmac-sha1'},
                          {'aes128-cbc',             'hmac-sha1'},
                          {'3des-cbc',               'hmac-sha1'},
                          {'aes128-ctr',             'hmac-sha2-256'},
@@ -182,29 +183,31 @@ gen_data(DataSz) ->
 %%              {suite, ?MODULE},
 %%              {name, mk_name(["Transfer 1M bytes ",Cipher,"/",Mac," [µs]"])}]);
 connect_measure(Port, Cipher, Mac, Data, Options) ->
-    AES_GCM = {cipher,['[email protected]',
-                       '[email protected]']},
+    AES_GCM = {cipher,
+               []},
+               %% ['[email protected]',
+               %%  '[email protected]']},
 
     AlgOpt = case {Cipher,Mac} of
                  {none,none} ->
                      [{modify_algorithms,[{prepend, [{cipher,[Cipher]},
-                                                     {mac,[Mac]}]},
-                                          {rm,[AES_GCM]}
+                                                     {mac,[Mac]}]}
+%%%                                          ,{rm,[AES_GCM]}
                                          ]}];
                  {none,_} ->
-                     [{modify_algorithms,[{prepend, [{cipher,[Cipher]}]},
-                                          {rm,[AES_GCM]}
+                     [{modify_algorithms,[{prepend, [{cipher,[Cipher]}]}
+%%%                                          ,{rm,[AES_GCM]}
                                          ]},
                       {preferred_algorithms, [{mac,[Mac]}]}];
                  {_,none} ->
-                     [{modify_algorithms,[{prepend, [{mac,[Mac]}]},
-                                          {rm,[AES_GCM]}
+                     [{modify_algorithms,[{prepend, [{mac,[Mac]}]}
+%%%                                          ,{rm,[AES_GCM]}
                                          ]},
                       {preferred_algorithms, [{cipher,[Cipher]}]}];
                  _ ->
                      [{preferred_algorithms, [{cipher,[Cipher]},
-                                              {mac,[Mac]}]},
-                      {modify_algorithms, [{rm,[AES_GCM]}]}
+                                              {mac,[Mac]}]}
+%%%                      ,{modify_algorithms, [{rm,[AES_GCM]}]}
                      ]
              end,
     Times =