Use the public_key application for all public key handling

Also improved test suites to avoid copying of users keys to
test server directories as this is a security liability

20 files changed, 620 insertions, 948 deletions

diff --git a/lib/ssh/src/Makefile b/lib/ssh/src/Makefile
index da31d87369..a49f207564 100644
--- a/lib/ssh/src/Makefile
+++ b/lib/ssh/src/Makefile
@@ -1,7 +1,7 @@
 #
 # %CopyrightBegin%
 #
-# Copyright Ericsson AB 2004-2011. All Rights Reserved.
+# Copyright Ericsson AB 2004-2012. All Rights Reserved.
 #
 # The contents of this file are subject to the Erlang Public License,
 # Version 1.1, (the "License"); you may not use this file except in
@@ -101,8 +101,8 @@ INTERNAL_HRL_FILES = $(ASN_HRLS) ssh_auth.hrl ssh_connect.hrl ssh_transport.hrl
 # ----------------------------------------------------
 # FLAGS
 # ----------------------------------------------------
-ERL_COMPILE_FLAGS += -pa$(EBIN) 
-
+ERL_COMPILE_FLAGS += -pa$(EBIN)\
+	-pz $(ERL_TOP)/lib/public_key/ebin
 # ----------------------------------------------------
 # Targets
 # ----------------------------------------------------
diff --git a/lib/ssh/src/ssh_auth.erl b/lib/ssh/src/ssh_auth.erl
index 9dbd95886e..a39c664c45 100644
--- a/lib/ssh/src/ssh_auth.erl
+++ b/lib/ssh/src/ssh_auth.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2012. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -21,11 +21,13 @@
 
 -module(ssh_auth).
 
--include("ssh.hrl").
+-include_lib("public_key/include/public_key.hrl").
 
+-include("ssh.hrl").
 -include("ssh_auth.hrl").
 -include("ssh_transport.hrl").
 
+
 -export([publickey_msg/1, password_msg/1, keyboard_interactive_msg/1,
 	 service_request_msg/1, init_userauth_request_msg/1,
 	 userauth_request_msg/1, handle_userauth_request/3,
@@ -40,26 +42,29 @@ publickey_msg([Cb, #ssh{user = User,
 		       session_id = SessionId,
 		       service = Service,
 		       opts = Opts} = Ssh]) ->
+    
+    Alg = algorithm(Cb),
+    Hash = sha, %% Maybe option?!
     ssh_bits:install_messages(userauth_pk_messages()),
-    Alg = Cb:alg_name(),
+    
     case ssh_file:private_identity_key(Alg, Opts) of
-	{ok, PrivKey} ->
-	    PubKeyBlob = ssh_file:encode_public_key(PrivKey),
+	{ok, Key} ->
+	    PubKeyBlob = ssh_file:encode_public_key(Key),
 	    SigData = build_sig_data(SessionId, 
-				     User, Service, Alg, PubKeyBlob),
-	    Sig = Cb:sign(PrivKey, SigData),
-	    SigBlob = list_to_binary([?string(Alg), ?binary(Sig)]),
+     				     User, Service, Key, PubKeyBlob),
+	    Sig = sign(SigData, Hash, Key),
+	    SigBlob = list_to_binary([?string(algorithm(Key)), ?binary(Sig)]),
 	    ssh_transport:ssh_packet(
 	      #ssh_msg_userauth_request{user = User,
 					service = Service,
 					method = "publickey",
 					data = [?TRUE,
-						?string(Alg),
+						?string(algorithm(Key)),
 						?binary(PubKeyBlob),
 						?binary(SigBlob)]},
 	      Ssh);
-	_Error ->
-	  not_ok
+     	_Error ->
+	    not_ok
     end.
 
 password_msg([#ssh{opts = Opts, io_cb = IoCb,
@@ -192,12 +197,12 @@ handle_userauth_request(#ssh_msg_userauth_request{user = User,
 	?TRUE ->
 	    case verify_sig(SessionId, User, "ssh-connection", Alg,
 			    KeyBlob, SigWLen, Opts) of
-		ok ->
+		true ->
 		    {authorized, User, 
 		     ssh_transport:ssh_packet(
 		       #ssh_msg_userauth_success{}, Ssh)};
-		{error, Reason} ->
-		    {not_authorized, {User, {error, Reason}}, 
+		false ->
+		    {not_authorized, {User, {error, "Invalid signature"}}, 
 		     ssh_transport:ssh_packet(#ssh_msg_userauth_failure{
 			     authentications="publickey,password",
 			     partial_success = false}, Ssh)}
@@ -312,35 +317,65 @@ get_password_option(Opts, User) ->
     end.
 	    
 verify_sig(SessionId, User, Service, Alg, KeyBlob, SigWLen, Opts) ->
-    case ssh_file:lookup_user_key(User, Alg, Opts) of
+    {ok, Key} = ssh_file:decode_public_key_v2(KeyBlob, Alg),
+    case ssh_file:lookup_user_key(Key, User, Alg, Opts) of
 	{ok, OurKey} ->
-	    {ok, Key} = ssh_file:decode_public_key_v2(KeyBlob, Alg),
 	    case OurKey of
 		Key ->
-		    NewSig = build_sig_data(SessionId, 
-					    User, Service, Alg, KeyBlob),
+		    PlainText = build_sig_data(SessionId, 
+					    User, Service, Key, KeyBlob),
 		    <<?UINT32(AlgSigLen), AlgSig:AlgSigLen/binary>> = SigWLen,
 		    <<?UINT32(AlgLen), _Alg:AlgLen/binary,
-		     ?UINT32(SigLen), Sig:SigLen/binary>> = AlgSig,
-		    M = alg_to_module(Alg),
-		    M:verify(OurKey, NewSig, Sig);
+		      ?UINT32(SigLen), Sig:SigLen/binary>> = AlgSig,
+		    verify(PlainText, sha, Sig, Key);
 		_ ->
 		    {error, key_unacceptable}
 	    end;
 	Error -> Error
     end.
 
-build_sig_data(SessionId, User, Service, Alg, KeyBlob) ->
+build_sig_data(SessionId, User, Service, Key, KeyBlob) ->
     Sig = [?binary(SessionId),
 	   ?SSH_MSG_USERAUTH_REQUEST,
 	   ?string(User),
 	   ?string(Service),
 	   ?binary(<<"publickey">>),
 	   ?TRUE,
-	   ?string(Alg),
+	   ?string(algorithm(Key)),
 	   ?binary(KeyBlob)],
     list_to_binary(Sig).
 
+algorithm(ssh_rsa) ->
+    "ssh-rsa";
+algorithm(ssh_dsa) ->
+     "ssh-dss";
+algorithm(#'RSAPrivateKey'{}) ->
+    "ssh-rsa";
+algorithm(#'DSAPrivateKey'{}) ->
+    "ssh-dss";
+algorithm({_, #'Dss-Parms'{}}) ->
+    "ssh-dss";
+algorithm(#'RSAPublicKey'{}) ->
+    "ssh-rsa".
+
+sign(SigData, Hash,  #'DSAPrivateKey'{} = Key) ->
+    DerSignature = public_key:sign(SigData, Hash, Key),
+    #'Dss-Sig-Value'{r = R, s = S} = public_key:der_decode('Dss-Sig-Value', DerSignature),
+    <<R:160/big-unsigned-integer, S:160/big-unsigned-integer>>;
+sign(SigData, Hash, Key) ->
+    public_key:sign(SigData, Hash, Key).
+%% sign(SigData, _, #'DSAPrivateKey'{} = Key) ->
+%%     ssh_dsa:sign(Key, SigData).
+
+verify(PlainText, Hash, Sig, {_,  #'Dss-Parms'{}} = Key) ->
+    <<R:160/big-unsigned-integer, S:160/big-unsigned-integer>> = Sig,
+    Signature = public_key:der_encode('Dss-Sig-Value', #'Dss-Sig-Value'{r = R, s = S}),
+    public_key:verify(PlainText, Hash, Signature, Key);
+verify(PlainText, Hash, Sig, Key) ->
+    public_key:verify(PlainText, sha, Sig, Key).
+%% verify(PlainText, _Hash, Sig, {_, #'Dss-Parms'{}} = Key) ->
+%%     ssh_dsa:verify(Key, PlainText, Sig).
+
 decode_keyboard_interactive_prompts(NumPrompts, Data) ->
     Types = lists:append(lists:duplicate(NumPrompts, [string, boolean])),
     pairwise_tuplify(ssh_bits:decode(Data, Types)).
@@ -412,12 +447,8 @@ userauth_pk_messages() ->
 	binary]} % key blob
      ].
 
-alg_to_module("ssh-dss") ->
-    ssh_dsa;
-alg_to_module("ssh-rsa") ->
-    ssh_rsa.
-
 other_cb(ssh_rsa) -> 
     ssh_dsa;
 other_cb(ssh_dsa) -> 
     ssh_rsa.
+
diff --git a/lib/ssh/src/ssh_dsa.erl b/lib/ssh/src/ssh_dsa.erl
index cb2632beac..6650b8b99b 100644
--- a/lib/ssh/src/ssh_dsa.erl
+++ b/lib/ssh/src/ssh_dsa.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2012. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -23,28 +23,14 @@
 
 -module(ssh_dsa).
 
--export([verify/3]).
+-export([verify/3, verify/4]).
 -export([sign/2]).
 -export([alg_name/0]).
 
 -include("ssh.hrl").
+-include_lib("public_key/include/public_key.hrl").
 
-%% start() ->
-%%     crypto:start().
-
-%% sign_file(File, Opts) ->
-%%     start(),
-%%     {ok,Bin} = file:read_file(File),
-%%     {ok,Key} = ssh_file:private_host_dsa_key(user, Opts),
-%%     sign(Key, Bin).
-
-%% verify_file(File, Sig) ->
-%%     start(),
-%%     {ok,Bin} = file:read_file(File),
-%%     {ok,Key} = ssh_file:public_host_key(user, dsa),
-%%     verify(Key, Bin, Sig).
-
-sign(_Private=#ssh_key { private={P,Q,G,X} },Mb) ->
+sign(_Private= #'DSAPrivateKey'{p = P, q = Q, g = G, x = X},Mb) ->
     K = ssh_bits:irandom(160) rem Q,
     R = ssh_math:ipow(G, K, P) rem Q,
     Ki = ssh_math:invert(K, Q),
@@ -52,28 +38,18 @@ sign(_Private=#ssh_key { private={P,Q,G,X} },Mb) ->
     S = (Ki * (M + X*R)) rem Q,
     <<R:160/big-unsigned-integer, S:160/big-unsigned-integer>>.
 
-
-%% the paramiko client sends a bad sig sometimes, 
-%% instead of crashing, we nicely return error, the
-%% typcally manifests itself as Sb being 39 bytes
-%% instead of 40.
+verify(PlainText, sha, Sig, {Y,  {_, P, Q, G}}) ->
+    verify(#ssh_key{type = dsa,
+		    public = {P,Q,G,Y}}, PlainText, Sig).
 
 verify(Public, Mb, Sb) ->
     case catch xverify(Public, Mb, Sb) of
 	{'EXIT', _Reason} ->
-            %store({Public, Mb, Sb, _Reason}),
-	    {error, inconsistent_key};
+	    false;
 	ok ->
-  	    %store({Public, Mb, Sb, ok})
-	    ok
+	    true
     end.
 
-%% store(Term) ->
-%%     {ok, Fd} = file:open("/tmp/dsa", [append]),
-%%     io:format(Fd, "~p~n~n~n", [Term]),
-%%     file:close(Fd).
-
-
 xverify(_Public=#ssh_key { public={P,Q,G,Y} },Mb,Sb) ->
     <<R0:160/big-unsigned-integer, S0:160/big-unsigned-integer>> = Sb,
     ?ssh_assert(R0 >= 0 andalso R0 < Q andalso
diff --git a/lib/ssh/src/ssh_file.erl b/lib/ssh/src/ssh_file.erl
index 12180f56bb..64dc286b92 100644
--- a/lib/ssh/src/ssh_file.erl
+++ b/lib/ssh/src/ssh_file.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2012. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -23,21 +23,19 @@
 
 -module(ssh_file).
 
--include("ssh.hrl").
--include("PKCS-1.hrl").
--include("DSS.hrl").
-
+-include_lib("public_key/include/public_key.hrl").
 -include_lib("kernel/include/file.hrl").
 
+-include("ssh.hrl").
+
 -export([public_host_dsa_key/2,private_host_dsa_key/2,
 	 public_host_rsa_key/2,private_host_rsa_key/2,
 	 public_host_key/2,private_host_key/2,
-	 lookup_host_key/3, add_host_key/3, % del_host_key/2,
-	 lookup_user_key/3, ssh_dir/2, file_name/3]).
+	 lookup_host_key/3, add_host_key/3,
+	 lookup_user_key/4, ssh_dir/2, file_name/3]).
 
 -export([private_identity_key/2, 
 	 public_identity_key/2]).
-%% 	 identity_keys/2]).
 
 -export([encode_public_key/1, decode_public_key_v2/2]).
 
@@ -48,38 +46,149 @@
 -define(PERM_700, 8#700).
 -define(PERM_644, 8#644).
 
+
 %% API
 public_host_dsa_key(Type, Opts) ->
     File = file_name(Type, "ssh_host_dsa_key.pub", Opts),
-    read_public_key_v2(File, "ssh-dss").
+    decode(File, public_key).
 
 private_host_dsa_key(Type, Opts) ->
     File = file_name(Type, "ssh_host_dsa_key", Opts),
-    read_private_key_v2(File, "ssh-dss").
+    Password = proplists:get_value(password, Opts, ignore),
+    decode(File, Password).
 
 public_host_rsa_key(Type, Opts) ->
     File = file_name(Type, "ssh_host_rsa_key.pub", Opts),
-    read_public_key_v2(File, "ssh-rsa").
+    decode(File, public_key).
 
 private_host_rsa_key(Type, Opts) ->
     File = file_name(Type, "ssh_host_rsa_key", Opts),
-    read_private_key_v2(File, "ssh-rsa").
+    Password = proplists:get_value(password, Opts, ignore),
+    decode(File, Password).
 
 public_host_key(Type, Opts) ->
     File = file_name(Type, "ssh_host_key", Opts),
-    case read_private_key_v1(File,public) of
-	{error, enoent} ->	
-	    read_public_key_v1(File++".pub");
-	Result ->
-	    Result
+    decode(File, public_key).
+ 
+private_host_key(Type, Opts) ->
+    File = file_name(Type, "ssh_host_key", Opts),
+    Password = proplists:get_value(password, Opts, ignore),
+    decode(File, Password).
+
+private_identity_key(Alg, Opts) ->
+    File = file_name(user, identity_key_filename(Alg), Opts),
+    Password = proplists:get_value(password, Opts, ignore),
+    decode(File, Password).
+
+public_identity_key(Alg, Opts) ->
+    File = file_name(user, identity_key_filename(Alg) ++ ".pub", Opts),
+    decode(File, public_key).
+
+encode_public_key(#'RSAPrivateKey'{publicExponent = E, modulus = N}) ->
+    ssh_bits:encode(["ssh-rsa",E,N], [string,mpint,mpint]);
+encode_public_key(#'DSAPrivateKey'{p = P, q = Q, g = G, y = Y}) ->
+    ssh_bits:encode(["ssh-dss",P,Q,G,Y], [string,mpint,mpint,mpint,mpint]).
+
+decode(File, Password) ->
+    try 
+	{ok, decode_ssh_file(read_ssh_file(File), Password)}
+    catch 
+	throw:Reason ->
+	    {error, Reason};
+	error:Reason ->
+	    {error, Reason}
+    end.      
+
+read_ssh_file(File) ->
+    {ok, Bin} = file:read_file(File),
+    Bin.
+
+%% Public key
+decode_ssh_file(SshBin, public_key) ->
+    public_key:ssh_decode(SshBin, public_key);
+
+%% Private Key
+decode_ssh_file(Pem, Password) ->
+    case public_key:pem_decode(Pem) of
+	[{_, _, not_encrypted} = Entry]  -> 
+	    public_key:pem_entry_decode(Entry);
+	[Entry] when Password =/= ignore ->
+	    public_key:pem_entry_decode(Entry, Password);
+	 _ ->
+	    throw("No pass phrase provided for private key file")
     end.
+    
+
+%% lookup_host_key
+%% return {ok, Key(s)} or {error, not_found}
+%%
+
+lookup_host_key(Host, Alg, Opts) ->
+    Host1 = replace_localhost(Host),
+    do_lookup_host_key(Host1, Alg, Opts).
 	    
 
-private_host_key(Type, Opts) ->
-    File = file_name(Type, "ssh_host_key", Opts),
-    read_private_key_v1(File,private).
+add_host_key(Host, Key, Opts) ->
+    Host1 = add_ip(replace_localhost(Host)),
+    KnownHosts = file_name(user, "known_hosts", Opts),
+    case file:open(KnownHosts, [write,append]) of
+   	{ok, Fd} ->
+	    ok = file:change_mode(KnownHosts, ?PERM_644),
+   	    Res = add_key_fd(Fd, Host1, Key),
+   	    file:close(Fd),
+   	    Res;
+   	Error ->
+   	    Error
+    end.
+
+lookup_user_key(Key, User, Alg, Opts) ->
+    SshDir = ssh_dir({remoteuser,User}, Opts),
+    case lookup_user_key_f(Key, User, SshDir, Alg, "authorized_keys", Opts) of
+	{ok, Key} ->
+	    {ok, Key};
+	_ ->
+	    lookup_user_key_f(Key, User, SshDir, Alg,  "authorized_keys2", Opts)
+    end.
+
+
+%%
+%% Utils
+%%
 
+%% server use this to find individual keys for
+%% an individual user when user tries to login
+%% with publickey
+ssh_dir({remoteuser, User}, Opts) ->
+    case proplists:get_value(user_dir_fun, Opts) of
+	undefined ->
+	    case proplists:get_value(user_dir, Opts) of
+		undefined ->
+		    default_user_dir();
+		Dir ->
+		    Dir
+	    end;
+	FUN ->
+	    FUN(User)
+    end;
 
+%% client use this to find client ssh keys
+ssh_dir(user, Opts) ->
+    case proplists:get_value(user_dir, Opts, false) of
+	false -> default_user_dir();
+	D -> D
+    end;
+
+%% server use this to find server host keys
+ssh_dir(system, Opts) ->
+    proplists:get_value(system_dir, Opts, "/etc/ssh").
+
+
+file_name(Type, Name, Opts) ->
+    FN = filename:join(ssh_dir(Type, Opts), Name),
+    %%?dbg(?DBG_PATHS, "file_name: ~p\n", [FN]),
+    FN.
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
 %% in: "host" out: "host,1.2.3.4.
 add_ip(Host)                                                             ->
@@ -98,449 +207,112 @@ replace_localhost("localhost") ->
 replace_localhost(Host) ->
     Host.
 
-%% lookup_host_key
-%% return {ok, Key(s)} or {error, not_found}
-%%
-
-lookup_host_key(Host, Alg, Opts) ->
-    Host1 = replace_localhost(Host),
-    do_lookup_host_key(Host1, Alg, Opts).
-	    
 do_lookup_host_key(Host, Alg, Opts) ->
-    case file:open(file_name(user, "known_hosts", Opts), [read]) of
+    case file:open(file_name(user, "known_hosts", Opts), [read, binary]) of
 	{ok, Fd} ->
 	    Res = lookup_host_key_fd(Fd, Host, Alg),
 	    file:close(Fd),
-	    Res;
+	    {ok, Res};
 	{error, enoent} -> {error, not_found};
 	Error -> Error
     end.
 
-add_host_key(Host, Key, Opts) ->
-    Host1 = add_ip(replace_localhost(Host)),
-    KnownHosts = file_name(user, "known_hosts", Opts),
-    case file:open(KnownHosts, [write,append]) of
-   	{ok, Fd} ->
-	    ok = file:change_mode(KnownHosts, ?PERM_644),
-   	    Res = add_key_fd(Fd, Host1, Key),
-   	    file:close(Fd),
-   	    Res;
-   	Error ->
-   	    Error
-    end.
-
-%% del_host_key(Host, Opts) ->
-%%     Host1 = replace_localhost(Host),
-%%     case file:open(file_name(user, "known_hosts", Opts),[write,read]) of
-%% 	{ok, Fd} ->
-%% 	    Res = del_key_fd(Fd, Host1),
-%% 	    file:close(Fd),
-%% 	    Res;
-%% 	Error ->
-%% 	    Error
-%%     end.
-
 identity_key_filename("ssh-dss") -> "id_dsa";
 identity_key_filename("ssh-rsa") -> "id_rsa".
 
-private_identity_key(Alg, Opts) ->
-    Path = file_name(user, identity_key_filename(Alg), Opts),
-    read_private_key_v2(Path, Alg).
-
-public_identity_key(Alg, Opts) ->
-    Path = file_name(user, identity_key_filename(Alg) ++ ".pub", Opts),
-    read_public_key_v2(Path, Alg).
-
-
-read_public_key_v2(File, Type) ->
-    case file:read_file(File) of
-	{ok,Bin} ->
-	    List = binary_to_list(Bin),
-	    case lists:prefix(Type, List) of
-		true ->
-		    List1 = lists:nthtail(length(Type), List),
-		    K_S = ssh_bits:b64_decode(List1),
-		    decode_public_key_v2(K_S, Type);
-		false ->
-		    {error, bad_format}
-	    end;
-	Error ->
-	    Error
-    end.
-
 decode_public_key_v2(K_S, "ssh-rsa") ->
     case ssh_bits:decode(K_S,[string,mpint,mpint]) of
 	["ssh-rsa", E, N] ->
-	    {ok, #ssh_key { type = rsa,
-			    public = {N,E},
-			    comment=""}};
+	    {ok, #'RSAPublicKey'{publicExponent = E, modulus = N}};
 	_ ->
 	    {error, bad_format}
     end;
-decode_public_key_v2(K_S, "ssh-dss") ->
-    case ssh_bits:decode(K_S,[string,mpint,mpint,mpint,mpint]) of
-	["ssh-dss",P,Q,G,Y] ->
-	    {ok,#ssh_key { type = dsa,
-			   public = {P,Q,G,Y}
-			  }};
-	_A ->
-	    {error, bad_format}
-    end;
+decode_public_key_v2(K_S, "ssh-dss") ->  
+     case ssh_bits:decode(K_S,[string,mpint,mpint,mpint,mpint]) of
+     	["ssh-dss",P,Q,G,Y] ->
+     	    {ok, {Y, #'Dss-Parms'{p = P, q = Q, g = G}}};
+     	_A ->
+     	    {error, bad_format}
+     end;
 decode_public_key_v2(_, _) ->
     {error, bad_format}.
     
-
-read_public_key_v1(File) ->
-    case file:read_file(File) of
-	{ok,Bin} ->
-	    List = binary_to_list(Bin),
-	    case io_lib:fread("~d ~d ~d ~s", List) of
-		{ok,[_Sz,E,N,Comment],_} ->
-		    {ok,#ssh_key { type = rsa,
-				   public ={N,E},
-				   comment = Comment }};
-		_Error ->
-		    {error, bad_format}
-	    end;
-	Error ->
-	    Error
-    end.
-
-%% pem_type("ssh-dss") -> "DSA";
-%% pem_type("ssh-rsa") -> "RSA".
-
-read_private_key_v2(File, Type) ->
-    case file:read_file(File) of
-        {ok, PemBin} ->
-            case catch (public_key:pem_decode(PemBin)) of
-                [{_, Bin, not_encrypted}] ->
-                    decode_private_key_v2(Bin, Type);
-                Error -> %% Note we do not handle password encrypted keys at the moment
-                    {error, Error}
-            end;
-        {error, Reason} ->
-            {error, Reason}
-    end.
-%%  case file:read_file(File) of
-%% 	{ok,Bin} ->
-%% 	    case read_pem(binary_to_list(Bin), pem_type(Type)) of
-%% 		{ok,Bin1} ->
-%% 		    decode_private_key_v2(Bin1, Type);
-%% 		Error ->
-%% 		    Error
-%% 	    end;
-%% 	Error ->
-%% 	    Error
-%%     end.
-
-decode_private_key_v2(Private,"ssh-rsa") ->
-    case 'PKCS-1':decode( 'RSAPrivateKey', Private) of
-	{ok,RSA} -> %% FIXME Check for two-prime version
-	    {ok, #ssh_key { type = rsa,
-			    public = {RSA#'RSAPrivateKey'.modulus,
-				      RSA#'RSAPrivateKey'.publicExponent},
-			    private = {RSA#'RSAPrivateKey'.modulus,
-				       RSA#'RSAPrivateKey'.privateExponent}
-			    }};
-	Error ->
-	    Error
-    end;
-decode_private_key_v2(Private, "ssh-dss") ->
-    case 'DSS':decode('DSAPrivateKey', Private) of
-	{ok,DSA} -> %% FIXME Check for two-prime version
-	    {ok, #ssh_key { type = dsa,
-			    public = {DSA#'DSAPrivateKey'.p,
-				      DSA#'DSAPrivateKey'.q,
-				      DSA#'DSAPrivateKey'.g,
-				      DSA#'DSAPrivateKey'.y},
-			    private= {DSA#'DSAPrivateKey'.p,
-				      DSA#'DSAPrivateKey'.q,
-				      DSA#'DSAPrivateKey'.g,
-				      DSA#'DSAPrivateKey'.x}
-			   }};
-	_ ->
-	    {error,bad_format}
-    end.
-
-%% SSH1 private key format
-%%  <<"SSH PRIVATE KEY FILE FORMATE 1.1\n" 0:8 
-%%    CipherNum:8, Reserved:32,
-%%    NSz/uint32, N/bignum, E/bignum, Comment/string,
-%%
-%% [ R0:8 R1:8 R0:8 R1:8, D/bignum, IQMP/bignum, Q/bignum, P/bignum, Pad(8)]>>
-%%
-%% where [ ] is encrypted using des3 (ssh1 version) and
-%% a posssibly empty pass phrase using md5(passphase) as key
-%% 
-
-read_private_key_v1(File, Type) ->
-    case file:read_file(File) of
-	{ok,<<"SSH PRIVATE KEY FILE FORMAT 1.1\n",0,
-	     CipherNum,_Resereved:32,Bin/binary>>} ->
-	    decode_private_key_v1(Bin, CipherNum,Type);
-	{ok,_} ->
-	    {error, bad_format};
-	Error ->
-	    Error
-    end.
-
-decode_private_key_v1(Bin, CipherNum, Type) ->
-    case ssh_bits:decode(Bin,0,[uint32, bignum, bignum, string]) of
-	{Offset,[_NSz,N,E,Comment]} ->
-	    if Type == public ->
-		    {ok,#ssh_key { type=rsa,
-				   public={N,E},
-				   comment=Comment}};
-	       Type == private ->
-		    <<_:Offset/binary, Encrypted/binary>> = Bin,
-		    case ssh_bits:decode(decrypt1(Encrypted, CipherNum),0,
-					 [uint32, bignum, bignum, 
-					  bignum, bignum,{pad,8}]) of
-			{_,[_,D,IQMP,Q,P]} ->
-			    {ok,#ssh_key { type=rsa,
-					   public={N,E},
-					   private={D,IQMP,Q,P},
-					   comment=Comment}};
-			_ ->
-			    {error,bad_format}
-		    end
-	    end;
-	_ ->
-	    {error,bad_format}
-    end.
-
-
-decrypt1(Bin, CipherNum) ->
-    decrypt1(Bin, CipherNum,"").
-
-decrypt1(Bin, CipherNum, Phrase) ->
-    if CipherNum == ?SSH_CIPHER_NONE; Phrase == "" ->
-	    Bin;
-       CipherNum == ?SSH_CIPHER_3DES ->
-	    <<K1:8/binary, K2:8/binary>> = erlang:md5(Phrase),
-	    K3 = K1,
-	    IV = <<0,0,0,0,0,0,0,0>>,
-	    Bin1 = crypto:des_cbc_decrypt(K3,IV,Bin),
-	    Bin2 = crypto:des_cbc_encrypt(K2,IV,Bin1),
-	    crypto:des_cbc_decrypt(K1,IV,Bin2)
-    end.
-
-%% encrypt1(Bin, CipherNum) ->
-%%     encrypt1(Bin, CipherNum,"").
-
-%% encrypt1(Bin, CipherNum, Phrase) ->
-%%     if CipherNum == ?SSH_CIPHER_NONE; Phrase == "" ->
-%% 	    Bin;
-%%        CipherNum == ?SSH_CIPHER_3DES ->
-%% 	    <<K1:8/binary, K2:8/binary>> = erlang:md5(Phrase),
-%% 	    K3 = K1,
-%% 	    IV = <<0,0,0,0,0,0,0,0>>,
-%% 	    Bin1 = crypto:des_cbc_encrypt(K1,IV,Bin),
-%% 	    Bin2 = crypto:des_cbc_decrypt(K2,IV,Bin1),
-%% 	    crypto:des_cbc_encrypt(K3,IV,Bin2)
-%%     end.
-
-lookup_host_key_fd(Fd, Host, Alg) ->
+lookup_host_key_fd(Fd, Host, KeyType) ->
     case io:get_line(Fd, '') of
 	eof ->
 	    {error, not_found};
 	Line ->
-	    case string:tokens(Line, " ") of
-		[HostList, Alg, KeyData] ->
-%% 		    io:format(" ~p lookup_host_key_fd: HostList ~p Alg ~p KeyData ~p\n",
-%%			      [Host, HostList, Alg, KeyData]),
-		    case lists:member(Host, string:tokens(HostList, ",")) of
-			true ->
-			    decode_public_key_v2(ssh_bits:b64_decode(KeyData), Alg);
-			false ->
-			    lookup_host_key_fd(Fd, Host, Alg)
-		    end;
-		_ ->
-		    lookup_host_key_fd(Fd, Host, Alg)
+	    case public_key:ssh_decode(Line, known_hosts) of
+		[{Key, Attributes}] ->
+		    handle_host(Fd, Host, proplists:get_value(hostnames, Attributes), Key, KeyType);
+		[] ->
+		    lookup_host_key_fd(Fd, Host, KeyType)
 	    end
     end.
 
-
-
-%% del_key_fd(Fd, Host) ->
-%%     del_key_fd(Fd, Host, 0, 0).
-
-%% del_key_fd(Fd, Host, ReadPos0, WritePos0) ->
-%%     case io:get_line(Fd, '') of
-%% 	eof ->
-%% 	    if ReadPos0 == WritePos0 ->
-%% 		    ok;
-%% 	       true ->
-%% 		    file:truncate(Fd)
-%% 	    end;
-%% 	Line ->
-%% 	    {ok,ReadPos1} = file:position(Fd, cur),
-%% 	    case string:tokens(Line, " ") of
-%% 		[HostList, _Type, _KeyData] ->
-%% 		    case lists:member(Host, string:tokens(HostList, ",")) of
-%% 			true ->
-%% 			    del_key_fd(Fd, Host, ReadPos1, WritePos0);
-%% 			false ->
-%% 			    if ReadPos0 == WritePos0 ->
-%% 				    del_key_fd(Fd, Host, ReadPos1, ReadPos1);
-%% 			       true ->
-%% 				    file:position(Fd, WritePos0),
-%% 				    file:write(Fd, Line),
-%% 				    {ok,WritePos1} = file:position(Fd,cur),
-%% 				    del_key_fd(Fd, Host, ReadPos1, WritePos1)
-%% 			    end
-%% 		    end;
-%% 		_ ->
-%% 		    if ReadPos0 == WritePos0 ->
-%% 			    del_key_fd(Fd, Host, ReadPos1, ReadPos1);
-%% 		       true ->
-%% 			    file:position(Fd, WritePos0),
-%% 			    file:write(Fd, Line),
-%% 			    {ok,WritePos1} = file:position(Fd,cur),
-%% 			    del_key_fd(Fd, Host, ReadPos1, WritePos1)
-%% 		    end		    
-%% 	    end
-%%     end.
-
-
-add_key_fd(Fd, Host, Key) ->
-    case Key#ssh_key.type of
-	rsa ->
-	    {N,E} = Key#ssh_key.public,
-	    DK = ssh_bits:b64_encode(
-		   ssh_bits:encode(["ssh-rsa",E,N],
-				   [string,mpint,mpint])),
-	    file:write(Fd, [Host, " ssh-rsa ", DK, "\n"]);
-	dsa ->
-	    {P,Q,G,Y} = Key#ssh_key.public,
-	    DK = ssh_bits:b64_encode(
-		   ssh_bits:encode(["ssh-dss",P,Q,G,Y],
-				   [string,mpint,mpint,mpint,mpint])),
-	    file:write(Fd, [Host, " ssh-dss ", DK, "\n"])
+handle_host(Fd, Host, HostList, Key, KeyType) ->
+    Host1 = host_name(Host),
+    case lists:member(Host1, HostList) and key_match(Key, KeyType) of
+	true ->
+	    Key;
+	false ->
+	    lookup_host_key_fd(Fd, Host, KeyType)
     end.
 
+host_name(Atom) when is_atom(Atom) ->
+    atom_to_list(Atom);
+host_name(List) ->
+    List.
 
-%% read_pem(Cs, Type) ->
-%%     case read_line(Cs) of
-%% 	{"-----BEGIN "++Rest,Cs1} ->
-%% 	    case string:tokens(Rest, " ") of
-%% 		[Type, "PRIVATE", "KEY-----"] ->
-%% 		    read_pem64(Cs1, [], Type);
-%% 		_ ->
-%% 		    {error, bad_format}
-%% 	    end;
-%% 	{"",Cs1} when Cs1 =/= "" ->
-%% 	    read_pem(Cs1,Type);
-%% 	{_,""} ->
-%% 	    {error, bad_format}
-%%     end.
-
-%% read_pem64(Cs, Acc, Type) ->
-%%     case read_line(Cs) of
-%% 	{"-----END "++Rest,_Cs1} ->
-%% 	    case string:tokens(Rest, " ") of
-%% 		[Type, "PRIVATE", "KEY-----"] ->
-%% 		    {ok,ssh_bits:b64_decode(append(reverse(Acc)))};
-%% 		Toks ->
-%% 		    error_logger:format("ssh: TOKENS=~p\n", [Toks]),
-%% 		    {error, bad_format}
-%% 	    end;
-%% 	{B64, Cs1} when Cs1 =/= "" ->
-%% 	    read_pem64(Cs1, [B64|Acc], Type);
-%% 	_What ->
-%% 	    {error, bad_format}
-%%     end.
-
-
-%% read_line(Cs) -> read_line(Cs,[]).
-%% read_line([$\r,$\n|T], Acc) -> {reverse(Acc), T};
-%% read_line([$\n|T], Acc) -> {reverse(Acc), T};
-%% read_line([C|T], Acc) -> read_line(T,[C|Acc]);
-%% read_line([], Acc) -> {reverse(Acc),[]}.
-
-lookup_user_key(User, Alg, Opts) ->
-    SshDir = ssh_dir({remoteuser,User}, Opts),
-    case lookup_user_key_f(User, SshDir, Alg, "authorized_keys", Opts) of
-	{ok, Key} ->
-	    {ok, Key};
-	_ ->
-	    lookup_user_key_f(User, SshDir, Alg,  "authorized_keys2", Opts)
-    end.
+key_match(#'RSAPublicKey'{}, "ssh-rsa") ->
+    true;
+key_match({_, #'Dss-Parms'{}}, "ssh-dss") ->
+    true;
+key_match(_, _) ->
+    false.
+
+add_key_fd(Fd, Host,Key) ->
+    SshBin = public_key:ssh_encode([{Key, [{hostnames, [Host]}]}], known_hosts),
+    file:write(Fd, SshBin).
 
-lookup_user_key_f(_User, [], _Alg, _F, _Opts) ->
+lookup_user_key_f(_, _User, [], _Alg, _F, _Opts) ->
     {error, nouserdir};
-lookup_user_key_f(_User, nouserdir, _Alg, _F, _Opts) ->
+lookup_user_key_f(_, _User, nouserdir, _Alg, _F, _Opts) ->
     {error, nouserdir};
-lookup_user_key_f(_User, Dir, Alg, F, _Opts) ->
+lookup_user_key_f(Key, _User, Dir, _Alg, F, _Opts) ->
     FileName = filename:join(Dir, F),
-    case file:open(FileName, [read]) of
+    case file:open(FileName, [read, binary]) of
 	{ok, Fd} ->
-	    Res = lookup_user_key_fd(Fd, Alg),
+	    Res = lookup_user_key_fd(Fd, Key),
 	    file:close(Fd),
 	    Res;
 	{error, Reason} ->
 	    {error, {{openerr, Reason}, {file, FileName}}}
     end.
 
-lookup_user_key_fd(Fd, Alg) ->
+lookup_user_key_fd(Fd, Key) ->
     case io:get_line(Fd, '') of
 	eof ->
 	    {error, not_found};
 	Line ->
-	    case string:tokens(Line, " ") of
-		[Alg, KeyData, _] ->
-		    %% 		    io:format("lookup_user_key_fd: HostList ~p Alg ~p KeyData ~p\n",
-		    %% 			      [HostList, Alg, KeyData]),
-		    decode_public_key_v2(ssh_bits:b64_decode(KeyData), Alg);
-		_Other ->
-		    %%?dbg(false, "key_fd Other: ~w ~w\n", [Alg, _Other]),
-		    lookup_user_key_fd(Fd, Alg)
+	    case public_key:ssh_decode(Line, auth_keys) of
+		[{AuthKey, _}] ->
+		    case is_auth_key(Key, AuthKey) of
+			true ->
+			    {ok, Key};
+			false ->
+			    lookup_user_key_fd(Fd, Key)
+		    end;
+		[] ->
+		    lookup_user_key_fd(Fd, Key)
 	    end
     end.
 
+is_auth_key(Key, Key) -> 
+    true;
+is_auth_key(_,_) -> 
+    false.
 
-encode_public_key(#ssh_key{type = rsa, public = {N, E}}) ->
-    ssh_bits:encode(["ssh-rsa",E,N],
-		    [string,mpint,mpint]);
-encode_public_key(#ssh_key{type = dsa, public = {P,Q,G,Y}}) ->
-    ssh_bits:encode(["ssh-dss",P,Q,G,Y],
-		    [string,mpint,mpint,mpint,mpint]).
-
-%%
-%% Utils
-%%
-
-%% server use this to find individual keys for
-%% an individual user when user tries to login
-%% with publickey
-ssh_dir({remoteuser, User}, Opts) ->
-    case proplists:get_value(user_dir_fun, Opts) of
-	undefined ->
-	    case proplists:get_value(user_dir, Opts) of
-		undefined ->
-		    default_user_dir();
-		Dir ->
-		    Dir
-	    end;
-	FUN ->
-	    FUN(User)
-    end;
-
-%% client use this to find client ssh keys
-ssh_dir(user, Opts) ->
-    case proplists:get_value(user_dir, Opts, false) of
-	false -> default_user_dir();
-	D -> D
-    end;
-
-%% server use this to find server host keys
-ssh_dir(system, Opts) ->
-    proplists:get_value(system_dir, Opts, "/etc/ssh").
-
-file_name(Type, Name, Opts) ->
-    FN = filename:join(ssh_dir(Type, Opts), Name),
-    %%?dbg(?DBG_PATHS, "file_name: ~p\n", [FN]),
-    FN.
 
 default_user_dir()->
     {ok,[[Home|_]]} = init:get_argument(home),
diff --git a/lib/ssh/src/ssh_rsa.erl b/lib/ssh/src/ssh_rsa.erl
index 77c411b09f..03c55319b7 100644
--- a/lib/ssh/src/ssh_rsa.erl
+++ b/lib/ssh/src/ssh_rsa.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2012. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -23,40 +23,23 @@
 
 -module(ssh_rsa).
 
+-include_lib("public_key/include/public_key.hrl").
+
 -export([verify/3, sign/2]).
 -export([alg_name/0]).
 
 -include("ssh.hrl").
--include("PKCS-1.hrl").
-
 
 -define(MGF(Seed,Len), mgf1((Seed),(Len))).
 -define(HASH(X), crypto:sha((X))).
 -define(HLen, 20).
 
-%% start() ->
-%%     crypto:start().
-
-%% sign_file(File) ->
-%%     start(),
-%%     {ok,Bin} = file:read_file(File),
-%%     {ok,Key} = ssh_file:private_host_rsa_key(user),
-%%     sign(Key, Bin).
-
-%% verify_file(File, Sig) ->
-%%     start(),
-%%     {ok,Bin} = file:read_file(File),
-%%     {ok,Key} = ssh_file:public_host_rsa_key(user),
-%%     verify(Key, Bin, Sig).
-
 sign(Private,Mb) ->
     rsassa_pkcs1_v1_5_sign(Private,Mb).
 
 verify(Public,Mb,Sb) ->
     rsassa_pkcs1_v1_5_verify(Public,Mb,Sb).
 
-
-
 %% Integer to octet string
 i2osp(X, XLen) ->
     ssh_bits:i2bin(X, XLen).
@@ -65,125 +48,23 @@ i2osp(X, XLen) ->
 os2ip(X) ->
     ssh_bits:bin2i(X).
 
-%% decrypt1, M = message representative
-%% rsaep(#ssh_key { public={N,E}}, M) ->
-%%     ?ssh_assert(M >= 0 andalso M =< N-1, out_of_range),
-%%     ssh_math:ipow(M, E, N).
-
-%% encrypt1, C = cipher representative
-%% rsadp(#ssh_key { public={N,_}, private={_,D}}, C) ->
-%%     ?ssh_assert(C >= 0 andalso C =< N-1, out_of_range),
-%%     ssh_math:ipow(C, D, N).
-
 %% sign1, M = message representative
-rsasp1(#ssh_key { public={N,_}, private={_,D}}, M) ->
+rsasp1(#'RSAPrivateKey'{modulus = N, privateExponent = D}, M) ->
     ?ssh_assert((M >= 0 andalso M =< N-1), out_of_range),
     ssh_math:ipow(M, D, N).
 
 %% verify1,  S =signature representative
-rsavp1(#ssh_key { public={N,E}}, S)  ->
+rsavp1(#'RSAPublicKey'{publicExponent = E, modulus = N}, S)  ->
     ?ssh_assert(S >= 0 andalso S =< N-1, out_of_range),
     ssh_math:ipow(S, E, N).
 
 
-%% M messaage
-%% rsaes_oaep_encrypt(Public, M) ->
-%%     rsaes_oaep_encrypt(Public, M, <<>>).
-
-%% rsaes_oaep_encrypt(Public=#ssh_key { public={N,_E}}, M, L) ->
-%%     ?ssh_assert(size(L) =< 16#ffffffffffffffff, label_to_long),
-%%     K = (ssh_bits:isize(N)+7) div 8,
-%%     MLen = size(M),
-%%     %% LLen  = size(L),
-%%     ?ssh_assert(MLen =< K - 2*?HLen - 2, message_to_long),
-%%     LHash = ?HASH(L),
-%%     PS = ssh_bits:fill_bits(K - MLen - 2*?HLen - 2, 0),
-%%     DB = <<LHash/binary, PS/binary, 16#01, M/binary>>,
-%%     Seed = ssh_bits:random(?HLen),
-%%     DbMask = ?MGF(Seed, K - ?HLen - 1),
-%%     MaskedDB = ssh_bits:xor_bits(DB, DbMask),
-%%     SeedMask = ?MGF(MaskedDB, ?HLen),
-%%     MaskedSeed = ssh_bits:xor_bits(Seed, SeedMask),
-%%     EM = <<16#00, MaskedSeed/binary, MaskedDB/binary>>,
-%%     Mc = os2ip(EM),
-%%     C = rsaep(Public, Mc),
-%%     i2osp(C, K).
-
-%% rsaes_oaep_decrypt(Key, C) ->
-%%     rsaes_oaep_decrypt(Key, C, <<>>).
-
-%% rsaes_oaep_decrypt(Private=#ssh_key { public={N,_},private={_,_}},Cb,L) ->
-%%     ?ssh_assert(size(L) =< 16#ffffffffffffffff, label_to_long),
-%%     K = (ssh_bits:isize(N)+7) div 8,
-%%     ?ssh_assert(K == 2*?HLen + 2, decryption_error),
-%%     C = os2ip(Cb),
-%%     M = rsadp(Private, C),
-%%     EM = i2osp(M, K),
-%%     LHash = ?HASH(L),
-%%     MLen = K - ?HLen -1,
-%%     case EM of
-%% 	<<16#00, MaskedSeed:?HLen/binary, MaskedDB:MLen>> ->
-%% 	    SeedMask = ?MGF(MaskedDB, ?HLen),
-%% 	    Seed = ssh_bits:xor_bits(MaskedSeed, SeedMask),
-%% 	    DbMask = ?MGF(Seed, K - ?HLen - 1),
-%% 	    DB = ssh_bits:xor_bits(MaskedDB, DbMask),
-%% 	    PSLen = K - MLen - 2*?HLen - 2,
-%% 	    case DB of
-%% 		<<LHash:?HLen, _PS:PSLen/binary, 16#01, M/binary>> ->
-%% 		    M;
-%% 		_ ->
-%% 		    exit(decryption_error)
-%% 	    end;
-%% 	_ ->
-%% 	    exit(decryption_error)
-%%     end.
-
-
-%% rsaes_pkcs1_v1_5_encrypt(Public=#ssh_key { public={N,_}}, M) ->    
-%%     K = (ssh_bits:isize(N)+7) div 8,
-%%     MLen = size(M),
-%%     ?ssh_assert(MLen =< K - 11, message_to_long),
-%%     PS = ssh_bits:random(K - MLen - 3),
-%%     EM = <<16#00,16#02,PS/binary,16#00,M/binary>>,
-%%     Mc = os2ip(EM),
-%%     C = rsaep(Public, Mc),
-%%     i2osp(C, K).
-
-
-%% rsaes_pkcs1_v1_5_decrypt(Private=#ssh_key { public={N,_},private={_,_}},
-%% 			 Cb) ->
-%%     K = (ssh_bits:isize(N)+7) div 8,
-%%     CLen = size(Cb),
-%%     ?ssh_assert(CLen == K andalso K >= 11, decryption_error),
-%%     C = os2ip(Cb),
-%%     M = rsadp(Private, C),
-%%     EM = i2osp(M, K),
-%%     PSLen = K - CLen - 3,
-%%     case EM of
-%% 	<<16#00, 16#02, _PS:PSLen/binary, 16#00, M>> ->
-%% 	    M;
-%% 	_ ->
-%% 	    exit(decryption_error)
-%%     end.
-
-%% rsassa_pss_sign(Private=#ssh_key { public={N,_},private={_,_}},Mb) ->
-%%     ModBits = ssh_bits:isize(N),
-%%     K = (ModBits+7) div 8,
-%%     EM = emsa_pss_encode(Mb, ModBits - 1),
-%%     M = os2ip(EM),
-%%     S = rsasp1(Private, M),
-%%     i2osp(S, K).
-
-%% rsassa_pss_verify(Public=#ssh_key { public={N,_E}},Mb,Sb) ->
-%%     ModBits = ssh_bits:isize(N),
-%%     K = (ModBits+7) div 8,
-%%     ?ssh_assert(size(Sb) == K, invalid_signature),
-%%     S = os2ip(Sb),
-%%     M = rsavp1(Public,S),
-%%     EMLen = (ModBits-1+7) div 8,
-%%     EM = i2osp(M, EMLen),
-%%     emsa_pss_verify(Mb, EM, ModBits-1).
-
+rsassa_pkcs1_v1_5_sign(#'RSAPrivateKey'{modulus = N} = Private, Mb) ->
+    K = (ssh_bits:isize(N)+7) div 8,    
+    EM = emsa_pkcs1_v1_5_encode(Mb, K),
+    M = os2ip(EM),
+    S = rsasp1(Private, M),
+    i2osp(S, K);
 
 rsassa_pkcs1_v1_5_sign(Private=#ssh_key { public={N,_},private={_,_D}},Mb) ->
     K = (ssh_bits:isize(N)+7) div 8,    
@@ -192,7 +73,7 @@ rsassa_pkcs1_v1_5_sign(Private=#ssh_key { public={N,_},private={_,_D}},Mb) ->
     S = rsasp1(Private, M),
     i2osp(S, K).
 
-rsassa_pkcs1_v1_5_verify(Public=#ssh_key { public={N,_E}}, Mb, Sb) ->
+rsassa_pkcs1_v1_5_verify(#'RSAPublicKey'{modulus = N} = Public, Mb, Sb) ->
     K = (ssh_bits:isize(N)+7) div 8,
     ?ssh_assert(size(Sb) == K, invalid_signature),
     S = os2ip(Sb),
@@ -200,9 +81,9 @@ rsassa_pkcs1_v1_5_verify(Public=#ssh_key { public={N,_E}}, Mb, Sb) ->
     EM = i2osp(M, K),
     %?dbg(true, "verify K=~p S=~w ~n#M=~w~n#EM=~w~n", [K, S, M, EM]),
     case emsa_pkcs1_v1_5_encode(Mb, K) of
-	EM -> ok;
-	_S ->
-	    {error, invalid_signature}
+	EM -> true;
+	_S -> false
+	    %%{error, invalid_signature}
     end.
 
 
@@ -211,87 +92,13 @@ emsa_pkcs1_v1_5_encode(M, EMLen) ->
     %% Must use speical xxNull types here!
     Alg = #'AlgorithmNull' { algorithm = ?'id-sha1',
 			     parameters = <<>> },
-    {ok,TCode} = 'PKCS-1':encode('DigestInfoNull',
-				#'DigestInfoNull'{ digestAlgorithm = Alg,
-						   digest = H }),
-    T = list_to_binary(TCode),
-    TLen = size(T),
+    TCode = public_key:der_encode('DigestInfoNull',
+				  #'DigestInfoNull'{ digestAlgorithm = Alg,
+						     digest = H }),
+    TLen = size(TCode),
     ?ssh_assert(EMLen >= TLen + 11, message_to_short),
     PS = ssh_bits:fill_bits(EMLen - TLen - 3, 16#ff),
-    <<16#00, 16#01, PS/binary, 16#00, T/binary>>.
-
-
-%% emsa_pss_encode(M, EMBits) ->
-%%     emsa_pss_encode(M, EMBits, 0).
-
-%% emsa_pss_encode(M, EMBits, SLen) ->
-%%     ?ssh_assert(size(M) =< 16#ffffffffffffffff, message_to_long),
-%%     EMLen = (EMBits + 7) div 8,
-%%     MHash = ?HASH(M),
-%%     ?ssh_assert(EMLen >= ?HLen + SLen + 2, encoding_error),
-%%     Salt = ssh_bits:random(SLen),
-%%     M1 = [16#00,16#00,16#00,16#00,16#00,16#00,16#00,16#00,
-%% 	  MHash, Salt],
-%%     H = ?HASH(M1),
-%%     PS = ssh_bits:fill_bits(EMLen-SLen-?HLen-2, 0),
-%%     DB = <<PS/binary, 16#01, Salt/binary>>,
-%%     DbMask = ?MGF(H, EMLen - ?HLen -1),
-%%     MaskedDB = ssh_bits:xor_bits(DB, DbMask),
-%%     ZLen = 8*EMLen - EMBits,
-%%     NZLen = (8 - (ZLen rem 8)) rem 8,
-%%     <<_:ZLen, NZ:NZLen, MaskedDB1/binary>> = MaskedDB,
-%%     MaskedDB2 = <<0:ZLen, NZ:NZLen, MaskedDB1/binary>>,
-%%     <<MaskedDB2/binary, H/binary, 16#BC>>.
-
-
-%% emsa_pss_verify(M, EM, EMBits) ->
-%%     emsa_pss_verify(M, EM, EMBits, 0).
-
-%% emsa_pss_verify(M, EM, EMBits, SLen) ->
-%%     ?ssh_assert(size(M) =< 16#ffffffffffffffff, message_to_long),
-%%     EMLen = (EMBits + 7) div 8,
-%%     MHash = ?HASH(M),
-%%     ?ssh_assert(EMLen >= ?HLen + SLen + 2, inconsistent),
-%%     MaskLen = (EMLen - ?HLen - 1)-1,
-%%     ZLen = 8*EMLen - EMBits,
-%%     NZLen = (8 - (ZLen rem 8)) rem 8,
-%%     case EM of
-%% 	<<0:ZLen,Nz:NZLen,MaskedDB1:MaskLen/binary, H:?HLen/binary, 16#BC>> ->
-%% 	    MaskedDB = <<0:ZLen,Nz:NZLen,MaskedDB1/binary>>,
-%% 	    DbMask = ?MGF(H, EMLen - ?HLen - 1),
-%% 	    DB = ssh_bits:xor_bits(MaskedDB, DbMask),
-%% 	    PSLen1 = (EMLen - SLen - ?HLen - 2) - 1,
-%% 	    PS = ssh_bits:fill_bits(PSLen1, 0),
-%% 	    case DB of
-%% 		<<_:ZLen,0:NZLen,PS:PSLen1/binary,16#01,Salt:SLen/binary>> ->
-%% 		    M1 = [16#00,16#00,16#00,16#00,16#00,16#00,16#00,16#00,
-%% 			  MHash, Salt],
-%% 		    case ?HASH(M1) of
-%% 			H -> ok;
-%% 			_ -> exit(inconsistent)
-%% 		    end;
-%% 		_ ->
-%% 		    exit(inconsistent)
-%% 	    end;
-%% 	_ ->
-%% 	    exit(inconsistent)
-%%     end.
-
-    
-
-%% Mask generating function MGF1
-%% mgf1(MGFSeed, MaskLen) ->
-%%     T = mgf1_loop(0, ((MaskLen + ?HLen -1) div ?HLen) - 1, MGFSeed, ""),
-%%     <<R:MaskLen/binary, _/binary>> = T,
-%%     R.
-
-%% mgf1_loop(Counter, N, _, T) when Counter > N ->
-%%     list_to_binary(T);
-%% mgf1_loop(Counter, N, MGFSeed, T) ->
-%%     C = i2osp(Counter, 4),
-%%     mgf1_loop(Counter+1, N, MGFSeed, [T, ?HASH([MGFSeed, C])]).
-
-
+    <<16#00, 16#01, PS/binary, 16#00, TCode/binary>>.
 
 
 alg_name() ->
diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index de3e29e2f1..f610c71efa 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2004-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2004-2012. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -23,10 +23,11 @@
 
 -module(ssh_transport).
 
--include("ssh_transport.hrl").
+-include_lib("public_key/include/public_key.hrl").
+-include_lib("kernel/include/inet.hrl").
 
+-include("ssh_transport.hrl").
 -include("ssh.hrl").
--include_lib("kernel/include/inet.hrl").
 
 -export([connect/5, accept/4]). 
 -export([versions/2, hello_version_msg/1]).
@@ -331,6 +332,7 @@ handle_kexdh_init(#ssh_msg_kexdh_init{e = E}, Ssh0) ->
 						       }, Ssh0),
     %%?dbg(?DBG_KEX, "shared_secret: ~s ~n", [fmt_binary(K, 16, 4)]),
     %%?dbg(?DBG_KEX, "hash: ~s ~n", [fmt_binary(H, 16, 4)]),
+    %%Hash = crypto:sha(PlainText),
     {ok, SshPacket, Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}},
 			     shared_secret = K,
 			     exchanged_hash = H,
@@ -364,6 +366,7 @@ handle_kexdh_reply(#ssh_msg_kexdh_reply{public_host_key = HostKey, f = F,
     H = kex_h(Ssh0, HostKey, Public, F, K),
     %%?dbg(?DBG_KEX, "shared_secret: ~s ~n", [fmt_binary(K, 16, 4)]),
     %%?dbg(?DBG_KEX, "hash: ~s ~n", [fmt_binary(H, 16, 4)]),
+    %%Hash = crypto:sha(PlainText),
     case verify_host_key(Ssh0, HostKey, H, H_SIG) of
 	ok ->
 	    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
@@ -427,8 +430,8 @@ get_host_key(SSH) ->
     case ALG#alg.hkey of
 	'ssh-rsa' ->
 	    case Mod:private_host_rsa_key(Scope, Opts) of
-		{ok,Key=#ssh_key { public={N,E}} } ->
-		    %%?dbg(true, "x~n", []),
+		{ok, #'RSAPrivateKey'{modulus = N, publicExponent = E} = Key} ->
+		    %%?dbg(true, "x~n", []),		    
 		    {Key,
 		     ssh_bits:encode(["ssh-rsa",E,N],[string,mpint,mpint])};
 		Error ->
@@ -437,7 +440,7 @@ get_host_key(SSH) ->
 	    end;
 	'ssh-dss' ->
 	    case Mod:private_host_dsa_key(Scope, Opts) of
-		{ok,Key=#ssh_key { public={P,Q,G,Y}}} ->
+		{ok, #'DSAPrivateKey'{y = Y, p = P, q = Q, g = G} = Key} ->
 		    {Key, ssh_bits:encode(["ssh-dss",P,Q,G,Y],
 					  [string,mpint,mpint,mpint,mpint])};
 		Error ->
@@ -447,59 +450,60 @@ get_host_key(SSH) ->
 	    exit({error, bad_key_type})
     end.
 
-sign_host_key(Ssh, Private, H) ->
-    ALG = Ssh#ssh.algorithms,
-    Module = case ALG#alg.hkey of
-		 'ssh-rsa' -> 
-		     ssh_rsa;
-		 'ssh-dss' -> 
-		     ssh_dsa
-	     end,
-    case catch Module:sign(Private, H) of
-	{'EXIT', Reason} ->
-	    error_logger:format("SIGN FAILED: ~p\n", [Reason]),
-	    {error, Reason};
-	SIG ->
-	    ssh_bits:encode([Module:alg_name() ,SIG],[string,binary])
-    end.    
+sign_host_key(_Ssh, #'RSAPrivateKey'{} = Private, H) ->
+    Hash = sha, %% Option ?!
+    Signature = public_key:sign(H, Hash, Private),
+    ssh_bits:encode(["ssh-rsa", Signature],[string, binary]);
+sign_host_key(_Ssh, #'DSAPrivateKey'{} = Private, H) ->
+    Hash = sha, %% Option ?!
+    DerSignature = public_key:sign(H, Hash, Private),
+    #'Dss-Sig-Value'{r = R, s = S} = public_key:der_decode('Dss-Sig-Value', DerSignature),
+    RawSignature = <<R:160/big-unsigned-integer, S:160/big-unsigned-integer>>,
+    ssh_bits:encode(["ssh-dss", RawSignature],[string, binary]).
 
 verify_host_key(SSH, K_S, H, H_SIG) ->
     ALG = SSH#ssh.algorithms,
     case ALG#alg.hkey of
 	'ssh-rsa' ->
-	    case ssh_bits:decode(K_S,[string,mpint,mpint]) of
-		["ssh-rsa", E, N] ->
-		    ["ssh-rsa",SIG] = ssh_bits:decode(H_SIG,[string,binary]),
-		    Public = #ssh_key { type=rsa, public={N,E} },
-		    case catch ssh_rsa:verify(Public, H, SIG) of
-			{'EXIT', Reason} ->
-			    error_logger:format("VERIFY FAILED: ~p\n", [Reason]),
-			    {error, bad_signature};
-			ok ->
-			    known_host_key(SSH, Public, "ssh-rsa")
-		    end;
-		_ ->
-		    {error, bad_format}
-	    end;
+	    verify_host_key_rsa(SSH, K_S, H, H_SIG);
 	'ssh-dss' ->
-	    case ssh_bits:decode(K_S,[string,mpint,mpint,mpint,mpint]) of
-		["ssh-dss",P,Q,G,Y] ->
-		    ["ssh-dss",SIG] = ssh_bits:decode(H_SIG,[string,binary]),
-		    Public = #ssh_key { type=dsa, public={P,Q,G,Y} },
-		    case catch ssh_dsa:verify(Public, H, SIG) of
-			{'EXIT', Reason} ->
-			    error_logger:format("VERIFY FAILED: ~p\n", [Reason]),
-			    {error, bad_signature};
-			ok ->
-			    known_host_key(SSH, Public, "ssh-dss")
-		    end;
-		_ ->
-		    {error, bad_host_key_format}
-	    end;
+	    verify_host_key_dss(SSH, K_S, H, H_SIG);
 	_ ->
 	    {error, bad_host_key_algorithm}
     end.
 
+verify_host_key_rsa(SSH, K_S, H, H_SIG) ->
+    case ssh_bits:decode(K_S,[string,mpint,mpint]) of
+	["ssh-rsa", E, N] ->
+	    ["ssh-rsa",SIG] = ssh_bits:decode(H_SIG,[string,binary]),
+	    Public = #'RSAPublicKey'{publicExponent = E, modulus = N},
+	    case public_key:verify(H, sha, SIG, Public) of
+		false ->
+		    {error, bad_signature};
+		true ->
+		    known_host_key(SSH, Public, "ssh-rsa")
+	    end;
+	_ ->
+	    {error, bad_format}
+    end.
+
+verify_host_key_dss(SSH, K_S, H, H_SIG) ->
+    case ssh_bits:decode(K_S,[string,mpint,mpint,mpint,mpint]) of
+	["ssh-dss",P,Q,G,Y] ->
+	    ["ssh-dss",SIG] = ssh_bits:decode(H_SIG,[string,binary]),
+	    Public = {Y,  #'Dss-Parms'{p = P, q = Q, g = G}},
+	    <<R:160/big-unsigned-integer, S:160/big-unsigned-integer>> = SIG,
+	     Signature = public_key:der_encode('Dss-Sig-Value', #'Dss-Sig-Value'{r = R, s = S}),
+	    case public_key:verify(H, sha, Signature, Public) of
+		false ->
+		    {error, bad_signature};
+		true ->
+		    known_host_key(SSH, Public, "ssh-dss")
+	    end;
+	_ ->
+	    {error, bad_host_key_format}
+    end.
+
 accepted_host(Ssh, PeerName, Opts) ->
     case proplists:get_value(silently_accept_hosts, Opts, false) of
 	true ->
@@ -1055,6 +1059,7 @@ kex_h(SSH, K_S, E, F, K) ->
 			[string,string,binary,binary,binary,
 			 mpint,mpint,mpint]),
     crypto:sha(L).
+ 
 
 kex_h(SSH, K_S, Min, NBits, Max, Prime, Gen, E, F, K) ->
     L = if Min==-1; Max==-1 ->
@@ -1075,7 +1080,7 @@ kex_h(SSH, K_S, Min, NBits, Max, Prime, Gen, E, F, K) ->
 				 Prime, Gen, E,F,K], Ts)
 	end,
     crypto:sha(L).
-    
+  
 mac_key_size('hmac-sha1')    -> 20*8;
 mac_key_size('hmac-sha1-96') -> 20*8;
 mac_key_size('hmac-md5')     -> 16*8;
diff --git a/lib/ssh/test/ssh_basic_SUITE.erl b/lib/ssh/test/ssh_basic_SUITE.erl
index 73b60057cc..b44afe79c7 100644
--- a/lib/ssh/test/ssh_basic_SUITE.erl
+++ b/lib/ssh/test/ssh_basic_SUITE.erl
@@ -39,22 +39,12 @@
 %% variable, but should NOT alter/remove any existing entries.
 %%--------------------------------------------------------------------
 init_per_suite(Config) ->
+    test_server:format("Init per suite", []),
     case catch crypto:start() of
 	ok ->
-	    DataDir = ?config(data_dir, Config),
-	    UserDir = ?config(priv_dir, Config),
-	    ssh_test_lib:copyfile(DataDir, UserDir, "id_rsa"), 
-	    ssh_test_lib:copyfile(DataDir, UserDir, "id_dsa"),
-	    RSAFile = filename:join(DataDir, "id_rsa.pub"),
-	    DSAFile = filename:join(DataDir, "id_dsa.pub"),
-	    {ok, Ssh1} = file:read_file(RSAFile),
-	    {ok, Ssh2} = file:read_file(DSAFile),
-	    [{RSA, _}] = public_key:ssh_decode(Ssh1,public_key), 
-	    [{DSA, _}] = public_key:ssh_decode(Ssh2,public_key), 
-	    AuthKeys = public_key:ssh_encode([{RSA, [{comment, "Test"}]}, 
-					      {DSA,[{comment, "Test"}]}], auth_keys),
-	    AuthKeysFile = filename:join(UserDir, "authorized_keys"),
-	    file:write_file(AuthKeysFile, AuthKeys),
+	    DataDir = ?config(data_dir, Config),	    
+	    PrivDir = ?config(priv_dir, Config), 
+	    ssh_test_lib:setup_dsa(DataDir, PrivDir),
 	    Config;
 	_Else ->
 	    {skip, "Crypto could not be started!"}
@@ -67,6 +57,10 @@ init_per_suite(Config) ->
 %% Description: Cleanup after the whole suite
 %%--------------------------------------------------------------------
 end_per_suite(Config) ->
+    test_server:format("End per suite", []),
+    PrivDir = ?config(priv_dir, Config),
+    ssh_test_lib:clean_dsa(PrivDir),
+    ssh:stop(),
     crypto:stop(),
     ok.
 
@@ -103,7 +97,7 @@ end_per_testcase(TestCase, Config) when TestCase == server_password_option;
     end_per_testcase(Config);
 end_per_testcase(_TestCase, Config) ->
     end_per_testcase(Config).
-end_per_testcase(Config) ->    
+end_per_testcase(_Config) ->    
     ssh:stop(),
     ok.
 
@@ -117,7 +111,8 @@ end_per_testcase(Config) ->
 %%--------------------------------------------------------------------
 all() -> 
     [exec, exec_compressed, shell, daemon_already_started, 
-     server_password_option, server_userpassword_option, known_hosts].
+     server_password_option, server_userpassword_option,
+     known_hosts].
 
 groups() -> 
     [].
@@ -130,17 +125,6 @@ end_per_group(_GroupName, Config) ->
 
 %% Test cases starts here.
 %%--------------------------------------------------------------------
-sign_and_verify_rsa(doc) ->
-    ["Test api function ssh:sign_data and ssh:verify_data"];
-
-sign_and_verify_rsa(suite) ->
-    [];
-sign_and_verify_rsa(Config) when is_list(Config) ->
-    Data = ssh:sign_data(<<"correct data">>, "ssh-rsa"),
-    ok = ssh:verify_data(<<"correct data">>, Data, "ssh-rsa"),
-    {error,invalid_signature} = ssh:verify_data(<<"incorrect data">>, Data,"ssh-rsa").
-
-
 exec(doc) ->
     ["Test api function ssh_connection:exec"];
 
@@ -196,7 +180,7 @@ exec_compressed(suite) ->
 exec_compressed(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     SystemDir = ?config(data_dir, Config),
-    UserDir = ?config(priv_dir, Config),
+    UserDir = ?config(priv_dir, Config), 
 
     {Pid, Host, Port} = ssh_test_lib:daemon([{system_dir, SystemDir},{user_dir, UserDir},
 					     {compression, zlib},
@@ -231,7 +215,7 @@ shell(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     SystemDir = ?config(data_dir, Config),
     UserDir = ?config(priv_dir, Config),
-
+   
     {_Pid, _Host, Port} = ssh_test_lib:daemon([{system_dir, SystemDir},{user_dir, UserDir},
 					       {failfun, fun ssh_test_lib:failfun/2}]),
     test_server:sleep(500),
@@ -301,9 +285,13 @@ daemon_already_started(suite) ->
 
 daemon_already_started(Config) when is_list(Config) ->
     SystemDir = ?config(data_dir, Config),
+    UserDir = ?config(priv_dir, Config),
+
     {Pid, _Host, Port} = ssh_test_lib:daemon([{system_dir, SystemDir},
+					      {user_dir, UserDir},
 					      {failfun, fun ssh_test_lib:failfun/2}]),
     {error, eaddrinuse} = ssh_test_lib:daemon(Port, [{system_dir, SystemDir},
+						     {user_dir, UserDir},
 						     {failfun,
 						      fun ssh_test_lib:failfun/2}]),
     ssh:stop_daemon(Pid).
@@ -314,10 +302,12 @@ server_password_option(doc) ->
 server_password_option(suite) ->
     [];
 server_password_option(Config) when is_list(Config) ->
-    UserDir = filename:join(?config(priv_dir, Config), nopubkey), % to make sure we don't use public-key-auth
+    PrivDir = ?config(priv_dir, Config),
+    UserDir = filename:join(PrivDir, nopubkey), % to make sure we don't use public-key-auth
     file:make_dir(UserDir),
-    SysDir = ?config(data_dir, Config),	 
+    SysDir = ?config(data_dir, Config),
     {Pid, Host, Port} = ssh_test_lib:daemon([{system_dir, SysDir},
+					     {user_dir, UserDir},
 					     {password, "morot"}]),
 
     ConnectionRef =
@@ -345,10 +335,12 @@ server_userpassword_option(doc) ->
 server_userpassword_option(suite) ->
     [];
 server_userpassword_option(Config) when is_list(Config) ->
-    UserDir = filename:join(?config(priv_dir, Config), nopubkey), % to make sure we don't use public-key-auth
+    PrivDir = ?config(priv_dir, Config),
+    UserDir = filename:join(PrivDir, nopubkey), % to make sure we don't use public-key-auth
     file:make_dir(UserDir),
     SysDir = ?config(data_dir, Config),	  
     {Pid, Host, Port} = ssh_test_lib:daemon([{system_dir, SysDir},
+					     {user_dir, PrivDir},
 					     {user_passwords, [{"vego", "morot"}]}]),
 
     ConnectionRef =
@@ -386,17 +378,17 @@ known_hosts(doc) ->
 known_hosts(suite) ->
     [];
 known_hosts(Config) when is_list(Config) ->
-    DataDir = ?config(data_dir, Config),
-    UserDir = ?config(priv_dir, Config),
+    DataDir = ?config(data_dir, Config), 
+    PrivDir = ?config(priv_dir, Config), 
     
-    {Pid, Host, Port} = ssh_test_lib:daemon([{user_dir, UserDir},{system_dir, DataDir},
+    {Pid, Host, Port} = ssh_test_lib:daemon([{user_dir, PrivDir},{system_dir, DataDir},
 					     {failfun, fun ssh_test_lib:failfun/2}]),
 
-    KnownHosts = filename:join(UserDir, "known_hosts"),
+    KnownHosts = filename:join(PrivDir, "known_hosts"),
     file:delete(KnownHosts),
     {error, enoent} = file:read_file(KnownHosts),
     ConnectionRef =
-	ssh_test_lib:connect(Host, Port, [{user_dir, UserDir},
+	ssh_test_lib:connect(Host, Port, [{user_dir, PrivDir},
 					  {user_interaction, false},
 					  silently_accept_hosts]),
     {ok, _Channel} = ssh_connection:session_channel(ConnectionRef, infinity),
@@ -407,7 +399,7 @@ known_hosts(Config) when is_list(Config) ->
     [HostAndIp, Alg, _KeyData] = string:tokens(Line, " "),
     [Host, _Ip] = string:tokens(HostAndIp, ","),
     "ssh-" ++ _ = Alg,
-     ssh:stop_daemon(Pid).
+    ssh:stop_daemon(Pid).
 
 %%--------------------------------------------------------------------
 %% Internal functions
diff --git a/lib/ssh/test/ssh_basic_SUITE_data/ssh_host_dsa_key b/lib/ssh/test/ssh_basic_SUITE_data/ssh_host_dsa_key
index d306f8b26e..51ab6fbd88 100644
--- a/lib/ssh/test/ssh_basic_SUITE_data/ssh_host_dsa_key
+++ b/lib/ssh/test/ssh_basic_SUITE_data/ssh_host_dsa_key
@@ -1,13 +1,13 @@
 -----BEGIN DSA PRIVATE KEY-----
-MIIBvAIBAAKBgQDfi2flSTZZofwT4yQT0NikX/LGNT7UPeB/XEWe/xovEYCElfaQ
-APFixXvEgXwoojmZ5kiQRKzLM39wBP0jPERLbnZXfOOD0PDnw0haMh7dD7XKVMod
-/EigVgHf/qBdM2M8yz1s/rRF7n1UpLSypziKjkzCm7JoSQ2zbWIPdmBIXwIVAMgP
-kpr7Sq3O7sHdb8D601DRjoExAoGAMOQxDfB2Fd8ouz6G96f/UOzRMI/Kdv8kYYKW
-JIGY+pRYrLPyYzUeJznwZreOJgrczAX+luHnKFWJ2Dnk5CyeXk67Wsr7pJ/4MBMD
-OKeIS0S8qoSBN8+Krp79fgA+yS3IfqbkJLtLu4EBaCX4mKQIX4++k44d4U5lc8pt
-+9hlEI8CgYEAznKxx9kyC6bVo7LUYKaGhofRFt0SYFc5PVmT2VUGRs1R6+6DPD+e
-uEO6IhFct7JFSRbP9p0JD4Uk+3zlZF+XX6b2PsZkeV8f/02xlNGUSmEzCSiNg1AX
-Cy/WusYhul0MncWCHMcOZB5rIvU/aP5EJJtn3xrRaz6u0SThF6AnT34CFQC63czE
-ZU8w8Q+H7z0j+a+70x2iAw==
+MIIBuwIBAAKBgQCClaHzE2ul0gKSUxah5W0W8UiJLy4hXngKEqpaUq9SSdVdY2LK
+wVfKH1gt5iuaf1FfzOhsIC9G/GLnjYttXZc92cv/Gfe3gR+s0ni2++MX+T++mE/Q
+diltXv/Hp27PybS67SmiFW7I+RWnT2OKlMPtw2oUuKeztCe5UWjaj/y5FQIVAPLA
+l9RpiU30Z87NRAHY3NTRaqtrAoGANMRxw8UfdtNVR0CrQj3AgPaXOGE4d+G4Gp4X
+skvnCHycSVAjtYxebUkzUzt5Q6f/IabuLUdge3gXrc8BetvrcKbp+XZgM0/Vj2CF
+Ymmy3in6kzGZq7Fw1sZaku6AOU8vLa5woBT2vAcHLLT1bLAzj7viL048T6MfjrOP
+ef8nHvACgYBhDWFQJ1mf99sg92LalVq1dHLmVXb3PTJDfCO/Gz5NFmj9EZbAtdah
+/XcF3DeRF+eEoz48wQF/ExVxSMIhLdL+o+ElpVhlM7Yii+T7dPhkQfEul6zZXu+U
+ykSTXYUbtsfTNRFQGBW2/GfnEc0mnIxfn9v10NEWMzlq5z9wT9P0CgIVAN4wtL5W
+Lv62jKcdskxNyz2NQoBx
 -----END DSA PRIVATE KEY-----
 
diff --git a/lib/ssh/test/ssh_basic_SUITE_data/ssh_host_dsa_key.pub b/lib/ssh/test/ssh_basic_SUITE_data/ssh_host_dsa_key.pub
new file mode 100644
index 0000000000..4dbb1305b0
--- /dev/null
+++ b/lib/ssh/test/ssh_basic_SUITE_data/ssh_host_dsa_key.pub
@@ -0,0 +1,11 @@
+---- BEGIN SSH2 PUBLIC KEY ----
+AAAAB3NzaC1kc3MAAACBAIKVofMTa6XSApJTFqHlbRbxSIkvLiFeeAoSqlpSr1JJ1V1j
+YsrBV8ofWC3mK5p/UV/M6GwgL0b8YueNi21dlz3Zy/8Z97eBH6zSeLb74xf5P76YT9B2
+KW1e/8enbs/JtLrtKaIVbsj5FadPY4qUw+3DahS4p7O0J7lRaNqP/LkVAAAAFQDywJfU
+aYlN9GfOzUQB2NzU0WqrawAAAIA0xHHDxR9201VHQKtCPcCA9pc4YTh34bganheyS+cI
+fJxJUCO1jF5tSTNTO3lDp/8hpu4tR2B7eBetzwF62+twpun5dmAzT9WPYIViabLeKfqT
+MZmrsXDWxlqS7oA5Ty8trnCgFPa8BwcstPVssDOPu+IvTjxPox+Os495/yce8AAAAIBh
+DWFQJ1mf99sg92LalVq1dHLmVXb3PTJDfCO/Gz5NFmj9EZbAtdah/XcF3DeRF+eEoz48
+wQF/ExVxSMIhLdL+o+ElpVhlM7Yii+T7dPhkQfEul6zZXu+UykSTXYUbtsfTNRFQGBW2
+/GfnEc0mnIxfn9v10NEWMzlq5z9wT9P0Cg==
+---- END SSH2 PUBLIC KEY ----
diff --git a/lib/ssh/test/ssh_sftp_SUITE.erl b/lib/ssh/test/ssh_sftp_SUITE.erl
index a9a568ced6..a1c6673ce7 100644
--- a/lib/ssh/test/ssh_sftp_SUITE.erl
+++ b/lib/ssh/test/ssh_sftp_SUITE.erl
@@ -24,14 +24,12 @@
 -compile(export_all).
 
 -include_lib("common_test/include/ct.hrl").
--include("test_server_line.hrl").
 
 -include_lib("kernel/include/file.hrl").
 
 % Default timetrap timeout
 -define(default_timeout, ?t:minutes(1)).
 
--define(SFPD_PORT, 9999).
 -define(USER, "Alladin").
 -define(PASSWD, "Sesame").
 
@@ -46,17 +44,12 @@
 %% variable, but should NOT alter/remove any existing entries.
 %%--------------------------------------------------------------------
 init_per_suite(Config) ->
-    case {catch crypto:start(),catch ssh:start()} of
-	{ok,ok} ->
-	    Dir = ?config(priv_dir, Config),
-	    {ok, _} = ssh_test_lib:get_id_keys(Dir),
+    case crypto:start() of
+	ok ->
+	    ssh:start(),
 	    Config;
-	{ok,_} ->
-	    {skip,"Could not start ssh!"};
-	{_,ok} ->
-	    {skip,"Could not start crypto!"};
-	{_,_} ->
-	    {skip,"Could not start crypto and ssh!"}
+	_ ->
+	    {skip,"Could not start crypto!"}
     end.
 
 %%--------------------------------------------------------------------
@@ -66,9 +59,8 @@ init_per_suite(Config) ->
 %% Description: Cleanup after the whole suite
 %%--------------------------------------------------------------------
 end_per_suite(Config) ->
+    ssh:stop(),
     crypto:stop(),
-    Dir = ?config(priv_dir, Config),
-    ssh_test_lib:remove_id_keys(Dir),
     Config.
 
 %%--------------------------------------------------------------------
@@ -89,28 +81,30 @@ init_per_testcase(_Case, Config) ->
     TmpConfig0 = lists:keydelete(watchdog, 1, Config),
     TmpConfig = lists:keydelete(sftp, 1, TmpConfig0),
     Dog = test_server:timetrap(?default_timeout),
-    Dir = ?config(priv_dir, Config),
+    PrivDir = ?config(priv_dir, Config),
     SysDir =  ?config(data_dir, Config),
     Host = ssh_test_lib:hostname(),
 
     %% Run test against openssh server if available
-    Sftp = case (catch ssh_sftp:start_channel(Host,
-					      [{user_dir, Dir},
-					       {user_interaction, false},
+    Sftp = case (catch ssh_sftp:start_channel(Host,					      
+					      [{user_interaction, false},
 					       {silently_accept_hosts, true}])) of
 	       {ok, ChannelPid, Connection} ->
+		   test_server:format("Running against openssh"),
 		   {ChannelPid, Connection};
-	       _Error -> %% Start own sftp server
-		   {_Sftpd, _Host, _Port} = 
-		       ssh_test_lib:daemon(Host, ?SFPD_PORT,
-					   [{system_dir, SysDir},
+	       _Error -> %% Start own sftp
+		   test_server:format("Running against erlang ssh"),
+		   {_Sftpd, Host1, Port} = 		       
+		       ssh_test_lib:daemon([{system_dir, SysDir},
+					    {user_dir, PrivDir},
 					    {user_passwords,
 					     [{?USER, ?PASSWD}]},
 					    {failfun,
 					     fun ssh_test_lib:failfun/2}]),
-		   Result = (catch ssh_sftp:start_channel(Host, ?SFPD_PORT,
+		   Result = (catch ssh_sftp:start_channel(Host1, Port,
 							  [{user, ?USER},
 							   {password, ?PASSWD},
+							   {user_dir, PrivDir},
 							   {user_interaction, false},
 							   {silently_accept_hosts, true}])),
 		   {ok, ChannelPid, Connection} = Result,
diff --git a/lib/ssh/test/ssh_sftp_SUITE_data/ssh_host_dsa_key b/lib/ssh/test/ssh_sftp_SUITE_data/ssh_host_dsa_key
new file mode 100644
index 0000000000..51ab6fbd88
--- /dev/null
+++ b/lib/ssh/test/ssh_sftp_SUITE_data/ssh_host_dsa_key
@@ -0,0 +1,13 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBuwIBAAKBgQCClaHzE2ul0gKSUxah5W0W8UiJLy4hXngKEqpaUq9SSdVdY2LK
+wVfKH1gt5iuaf1FfzOhsIC9G/GLnjYttXZc92cv/Gfe3gR+s0ni2++MX+T++mE/Q
+diltXv/Hp27PybS67SmiFW7I+RWnT2OKlMPtw2oUuKeztCe5UWjaj/y5FQIVAPLA
+l9RpiU30Z87NRAHY3NTRaqtrAoGANMRxw8UfdtNVR0CrQj3AgPaXOGE4d+G4Gp4X
+skvnCHycSVAjtYxebUkzUzt5Q6f/IabuLUdge3gXrc8BetvrcKbp+XZgM0/Vj2CF
+Ymmy3in6kzGZq7Fw1sZaku6AOU8vLa5woBT2vAcHLLT1bLAzj7viL048T6MfjrOP
+ef8nHvACgYBhDWFQJ1mf99sg92LalVq1dHLmVXb3PTJDfCO/Gz5NFmj9EZbAtdah
+/XcF3DeRF+eEoz48wQF/ExVxSMIhLdL+o+ElpVhlM7Yii+T7dPhkQfEul6zZXu+U
+ykSTXYUbtsfTNRFQGBW2/GfnEc0mnIxfn9v10NEWMzlq5z9wT9P0CgIVAN4wtL5W
+Lv62jKcdskxNyz2NQoBx
+-----END DSA PRIVATE KEY-----
+
diff --git a/lib/ssh/test/ssh_sftp_SUITE_data/ssh_host_dsa_key.pub b/lib/ssh/test/ssh_sftp_SUITE_data/ssh_host_dsa_key.pub
new file mode 100644
index 0000000000..4dbb1305b0
--- /dev/null
+++ b/lib/ssh/test/ssh_sftp_SUITE_data/ssh_host_dsa_key.pub
@@ -0,0 +1,11 @@
+---- BEGIN SSH2 PUBLIC KEY ----
+AAAAB3NzaC1kc3MAAACBAIKVofMTa6XSApJTFqHlbRbxSIkvLiFeeAoSqlpSr1JJ1V1j
+YsrBV8ofWC3mK5p/UV/M6GwgL0b8YueNi21dlz3Zy/8Z97eBH6zSeLb74xf5P76YT9B2
+KW1e/8enbs/JtLrtKaIVbsj5FadPY4qUw+3DahS4p7O0J7lRaNqP/LkVAAAAFQDywJfU
+aYlN9GfOzUQB2NzU0WqrawAAAIA0xHHDxR9201VHQKtCPcCA9pc4YTh34bganheyS+cI
+fJxJUCO1jF5tSTNTO3lDp/8hpu4tR2B7eBetzwF62+twpun5dmAzT9WPYIViabLeKfqT
+MZmrsXDWxlqS7oA5Ty8trnCgFPa8BwcstPVssDOPu+IvTjxPox+Os495/yce8AAAAIBh
+DWFQJ1mf99sg92LalVq1dHLmVXb3PTJDfCO/Gz5NFmj9EZbAtdah/XcF3DeRF+eEoz48
+wQF/ExVxSMIhLdL+o+ElpVhlM7Yii+T7dPhkQfEul6zZXu+UykSTXYUbtsfTNRFQGBW2
+/GfnEc0mnIxfn9v10NEWMzlq5z9wT9P0Cg==
+---- END SSH2 PUBLIC KEY ----
diff --git a/lib/ssh/test/ssh_sftpd_SUITE.erl b/lib/ssh/test/ssh_sftpd_SUITE.erl
index 0873348be0..37a1c63b6e 100644
--- a/lib/ssh/test/ssh_sftpd_SUITE.erl
+++ b/lib/ssh/test/ssh_sftpd_SUITE.erl
@@ -55,13 +55,16 @@
 init_per_suite(Config) ->
     case (catch crypto:start()) of
 	ok ->
-	    ssh:start(),
-	    DataDir = ?config(data_dir, Config),
-	    UserDir = ?config(priv_dir, Config),
-	    ssh_test_lib:setup_dsa(UserDir, DataDir),
+	    DataDir = ?config(data_dir, Config),	    
+	    PrivDir = ?config(priv_dir, Config),
+	    ssh_test_lib:setup_dsa(DataDir, PrivDir),
+	    %% to make sure we don't use public-key-auth
+	    %% this should be tested by other test suites
+	    UserDir = filename:join(?config(priv_dir, Config), nopubkey), 
+	    file:make_dir(UserDir),  
 	    Config;
 	_ ->
-	    {skip,"Could not start ssh!"}
+	    {skip,"Could not start crypto!"}
     end.
 
 %%--------------------------------------------------------------------
@@ -71,8 +74,10 @@ init_per_suite(Config) ->
 %% Description: Cleanup after the whole suite
 %%--------------------------------------------------------------------
 end_per_suite(Config) ->
-    UserDir = ?config(priv_dir, Config),
-    ssh_test_lib:clean_dsa(UserDir),
+    SysDir = ?config(priv_dir, Config),
+    ssh_test_lib:clean_dsa(SysDir),
+    UserDir = filename:join(?config(priv_dir, Config), nopubkey),
+    file:del_dir(UserDir),
     ssh:stop(),
     crypto:stop(),
     ok.
@@ -93,15 +98,17 @@ end_per_suite(Config) ->
 init_per_testcase(TestCase, Config) ->
     ssh:start(),
     prep(Config),
+    PrivDir = ?config(priv_dir, Config),
+    ClientUserDir = filename:join(PrivDir, nopubkey),
     SysDir = ?config(data_dir, Config),
     {ok, Sftpd} =
 	ssh_sftpd:listen(?SFPD_PORT, [{system_dir, SysDir},
+				      {user_dir, PrivDir},
 				      {user_passwords,[{?USER, ?PASSWD}]},
 				      {pwdfun, fun(_,_) -> true end}]),
     
     Cm = ssh_test_lib:connect(?SFPD_PORT,
-			      [{system_dir, SysDir},
-			       {user_dir, SysDir},
+			      [{user_dir, ClientUserDir},
 			       {user, ?USER}, {password, ?PASSWD},
 			       {user_interaction, false},
 			       {silently_accept_hosts, true},
diff --git a/lib/ssh/test/ssh_sftpd_SUITE_data/id_dsa b/lib/ssh/test/ssh_sftpd_SUITE_data/id_dsa
new file mode 100644
index 0000000000..d306f8b26e
--- /dev/null
+++ b/lib/ssh/test/ssh_sftpd_SUITE_data/id_dsa
@@ -0,0 +1,13 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBvAIBAAKBgQDfi2flSTZZofwT4yQT0NikX/LGNT7UPeB/XEWe/xovEYCElfaQ
+APFixXvEgXwoojmZ5kiQRKzLM39wBP0jPERLbnZXfOOD0PDnw0haMh7dD7XKVMod
+/EigVgHf/qBdM2M8yz1s/rRF7n1UpLSypziKjkzCm7JoSQ2zbWIPdmBIXwIVAMgP
+kpr7Sq3O7sHdb8D601DRjoExAoGAMOQxDfB2Fd8ouz6G96f/UOzRMI/Kdv8kYYKW
+JIGY+pRYrLPyYzUeJznwZreOJgrczAX+luHnKFWJ2Dnk5CyeXk67Wsr7pJ/4MBMD
+OKeIS0S8qoSBN8+Krp79fgA+yS3IfqbkJLtLu4EBaCX4mKQIX4++k44d4U5lc8pt
++9hlEI8CgYEAznKxx9kyC6bVo7LUYKaGhofRFt0SYFc5PVmT2VUGRs1R6+6DPD+e
+uEO6IhFct7JFSRbP9p0JD4Uk+3zlZF+XX6b2PsZkeV8f/02xlNGUSmEzCSiNg1AX
+Cy/WusYhul0MncWCHMcOZB5rIvU/aP5EJJtn3xrRaz6u0SThF6AnT34CFQC63czE
+ZU8w8Q+H7z0j+a+70x2iAw==
+-----END DSA PRIVATE KEY-----
+
diff --git a/lib/ssh/test/ssh_sftpd_erlclient_SUITE.erl b/lib/ssh/test/ssh_sftpd_erlclient_SUITE.erl
index c63ad7de73..ca189d4b02 100644
--- a/lib/ssh/test/ssh_sftpd_erlclient_SUITE.erl
+++ b/lib/ssh/test/ssh_sftpd_erlclient_SUITE.erl
@@ -28,7 +28,6 @@
 
 -include_lib("kernel/include/file.hrl").
 
--define(SSHD_PORT, 9999).
 -define(USER, "Alladin").
 -define(PASSWD, "Sesame").
 -define(SSH_MAX_PACKET_SIZE, 32768).
@@ -48,14 +47,14 @@ init_per_suite(Config) ->
     case catch crypto:start() of
 	ok ->
 	    DataDir = ?config(data_dir, Config),
-	    UserDir = ?config(priv_dir, Config),
+	    PrivDir = ?config(priv_dir, Config),
 	    FileAlt = filename:join(DataDir, "ssh_sftpd_file_alt.erl"),
 	    c:c(FileAlt),
 	    FileName = filename:join(DataDir, "test.txt"),
 	    {ok, FileInfo} = file:read_file_info(FileName),
 	    ok = file:write_file_info(FileName,
 				      FileInfo#file_info{mode = 8#400}),
-	    ssh_test_lib:setup_dsa(DataDir, UserDir),
+	    ssh_test_lib:setup_dsa(DataDir, PrivDir),
 	    Config;
 	_Else ->
 	    {skip,"Could not start ssh!"}
@@ -67,9 +66,11 @@ init_per_suite(Config) ->
 %%   A list of key/value pairs, holding the test case configuration.
 %% Description: Cleanup after the whole suite
 %%--------------------------------------------------------------------
-end_per_suite(Config) ->
-    UserDir = ?config(priv_dir, Config),
-    ssh_test_lib:clean_dsa(UserDir),
+end_per_suite(Config) -> 
+    UserDir = filename:join(?config(priv_dir, Config), nopubkey),
+    file:del_dir(UserDir),
+    SysDir = ?config(priv_dir, Config),
+    ssh_test_lib:clean_dsa(SysDir),
     crypto:stop(),
     ok.
 
@@ -89,6 +90,7 @@ end_per_suite(Config) ->
 init_per_testcase(TestCase, Config) ->
     ssh:start(),
     PrivDir = ?config(priv_dir, Config),
+    DataDir = ?config(data_dir, Config),
 
     Options =
 	case atom_to_list(TestCase) of
@@ -96,45 +98,39 @@ init_per_testcase(TestCase, Config) ->
 		Spec =
 		    ssh_sftpd:subsystem_spec([{file_handler,
 					       ssh_sftpd_file_alt}]),
-		[{user_passwords,[{?USER, ?PASSWD}]},
-		 {pwdfun, fun(_,_) -> true end},
-		 {system_dir, PrivDir},
+		[{system_dir, DataDir},
+		 {user_dir, PrivDir},
 		 {subsystems, [Spec]}];
 	    "root_dir" ->
 		Privdir = ?config(priv_dir, Config),
 		Root = filename:join(Privdir, root),
 		file:make_dir(Root),
 		Spec = ssh_sftpd:subsystem_spec([{root,Root}]),
-		[{user_passwords,[{?USER, ?PASSWD}]},
-		 {pwdfun, fun(_,_) -> true end},
-		 {system_dir, PrivDir},
+		[{system_dir, DataDir},
+		 {user_dir, PrivDir},
 		 {subsystems, [Spec]}];
 	    "list_dir_limited" ->
 		Spec =
 		    ssh_sftpd:subsystem_spec([{max_files,1}]),
-		[{user_passwords,[{?USER, ?PASSWD}]},
-		 {pwdfun, fun(_,_) -> true end},
-		 {system_dir, PrivDir},
+		[{system_dir, DataDir},
+		 {user_dir, PrivDir},
 		 {subsystems, [Spec]}];
 
 	    _ ->
-		[{user_passwords,[{?USER, ?PASSWD}]},
-		 {pwdfun, fun(_,_) -> true end},
-		 {system_dir, PrivDir}]
+		[{user_dir, PrivDir},
+		 {system_dir, DataDir}]
 	end,
 
-    {Sftpd, Host, _Port} = ssh_test_lib:daemon(any, ?SSHD_PORT, Options),
+    {Sftpd, Host, Port} = ssh_test_lib:daemon(Options),
 
     {ok, ChannelPid, Connection} =
-	ssh_sftp:start_channel(Host, ?SSHD_PORT,
+	ssh_sftp:start_channel(Host, Port,
 			       [{silently_accept_hosts, true},
-				{user, ?USER}, {password, ?PASSWD}, 
-				{pwdfun, fun(_,_) -> true end},
 				{user_dir, PrivDir},
 				{timeout, 30000}]),
     TmpConfig = lists:keydelete(sftp, 1, Config),
     NewConfig = lists:keydelete(sftpd, 1, TmpConfig),
-    [{sftp, {ChannelPid, Connection}}, {sftpd, Sftpd} | NewConfig].
+    [{port, Port}, {sftp, {ChannelPid, Connection}}, {sftpd, Sftpd} | NewConfig].
 
 %%--------------------------------------------------------------------
 %% Function: end_per_testcase(TestCase, Config) -> _
@@ -214,6 +210,8 @@ quit_OTP_6349(suite) ->
 quit_OTP_6349(Config) when is_list(Config) ->
     DataDir = ?config(data_dir, Config),
     FileName = filename:join(DataDir, "test.txt"),
+    UserDir = ?config(priv_dir, Config), 
+    Port = ?config(port, Config),
 
     {Sftp, _} = ?config(sftp, Config),
 
@@ -224,11 +222,10 @@ quit_OTP_6349(Config) when is_list(Config) ->
     Host = ssh_test_lib:hostname(),
 
     timer:sleep(5000),
-    {ok, NewSftp, _Conn} = ssh_sftp:start_channel(Host, ?SSHD_PORT,
+    {ok, NewSftp, _Conn} = ssh_sftp:start_channel(Host, Port,
 						 [{silently_accept_hosts, true},
 						  {pwdfun, fun(_,_) -> true end},
-						  {system_dir, DataDir},
-						  {user_dir, DataDir},
+						  {user_dir, UserDir},
 						  {user, ?USER}, {password, ?PASSWD}]),
 
     {ok, <<_/binary>>} = ssh_sftp:read_file(NewSftp, FileName),
diff --git a/lib/ssh/test/ssh_sftpd_erlclient_SUITE_data/id_dsa b/lib/ssh/test/ssh_sftpd_erlclient_SUITE_data/id_dsa
new file mode 100644
index 0000000000..d306f8b26e
--- /dev/null
+++ b/lib/ssh/test/ssh_sftpd_erlclient_SUITE_data/id_dsa
@@ -0,0 +1,13 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBvAIBAAKBgQDfi2flSTZZofwT4yQT0NikX/LGNT7UPeB/XEWe/xovEYCElfaQ
+APFixXvEgXwoojmZ5kiQRKzLM39wBP0jPERLbnZXfOOD0PDnw0haMh7dD7XKVMod
+/EigVgHf/qBdM2M8yz1s/rRF7n1UpLSypziKjkzCm7JoSQ2zbWIPdmBIXwIVAMgP
+kpr7Sq3O7sHdb8D601DRjoExAoGAMOQxDfB2Fd8ouz6G96f/UOzRMI/Kdv8kYYKW
+JIGY+pRYrLPyYzUeJznwZreOJgrczAX+luHnKFWJ2Dnk5CyeXk67Wsr7pJ/4MBMD
+OKeIS0S8qoSBN8+Krp79fgA+yS3IfqbkJLtLu4EBaCX4mKQIX4++k44d4U5lc8pt
++9hlEI8CgYEAznKxx9kyC6bVo7LUYKaGhofRFt0SYFc5PVmT2VUGRs1R6+6DPD+e
+uEO6IhFct7JFSRbP9p0JD4Uk+3zlZF+XX6b2PsZkeV8f/02xlNGUSmEzCSiNg1AX
+Cy/WusYhul0MncWCHMcOZB5rIvU/aP5EJJtn3xrRaz6u0SThF6AnT34CFQC63czE
+ZU8w8Q+H7z0j+a+70x2iAw==
+-----END DSA PRIVATE KEY-----
+
diff --git a/lib/ssh/test/ssh_test_lib.erl b/lib/ssh/test/ssh_test_lib.erl
index f4e95f9bfb..abe65700c5 100644
--- a/lib/ssh/test/ssh_test_lib.erl
+++ b/lib/ssh/test/ssh_test_lib.erl
@@ -71,6 +71,9 @@ daemon(Host, Port, Options) ->
 start_shell(Port, IOServer, UserDir) ->
     spawn_link(?MODULE, init_shell, [Port, IOServer, [{user_dir, UserDir}]]).
 
+start_shell(Port, IOServer) ->
+    spawn_link(?MODULE, init_shell, [Port, IOServer, []]).
+
 init_shell(Port, IOServer, UserDir) ->
     Host = hostname(),
     Options = [{user_interaction, false}, {silently_accept_hosts,
@@ -91,13 +94,10 @@ init_io_server(TestCase) ->
 loop_io_server(TestCase, Buff0) ->
      receive
 	 {input, TestCase, Line} ->
-	     %io:format("~p~n",[{input, TestCase, Line}]),
 	     loop_io_server(TestCase, Buff0 ++ [Line]);
 	 {io_request, From, ReplyAs, Request} ->
-	     %io:format("request -> ~p~n",[Request]),
 	     {ok, Reply, Buff} = io_request(Request, TestCase, From,
 					    ReplyAs, Buff0),
-	     %io:format("reply -> ~p~n",[Reply]),
 	     io_reply(From, ReplyAs, Reply),
 	     loop_io_server(TestCase, Buff);
 	 {'EXIT',_, _} ->
@@ -183,34 +183,21 @@ inet_port()->
     gen_tcp:close(Socket),
     Port.
 
-
-%% copy private keys to given dir from ~/.ssh
-get_id_keys(DstDir) ->
-    SrcDir = filename:join(os:getenv("HOME"), ".ssh"),
-    RsaOk = copyfile(SrcDir, DstDir, "id_rsa"),
-    DsaOk = copyfile(SrcDir, DstDir, "id_dsa"),
-    case {RsaOk, DsaOk} of
-	{{ok, _}, {ok, _}} -> {ok, both};
-	{{ok, _}, _} -> {ok, rsa};
-	{_, {ok, _}} -> {ok, dsa};
-	{Error, _} -> Error
-    end.
-
-remove_id_keys(Dir) ->
-    file:delete(filename:join(Dir, "id_rsa")),
-    file:delete(filename:join(Dir, "id_dsa")).
-
-copyfile(SrcDir, DstDir, FileName) ->
-    Dest = filename:join(DstDir, FileName),
-    Result = file:copy(filename:join(SrcDir, FileName), Dest),
-    {ok, Pem} = file:read_file(Dest),
-    case public_key:pem_decode(Pem) of
-	[{_,_, not_encrypted}] ->
-	    Result;
+setup_ssh_auth_keys(RSAFile, DSAFile, Dir) ->
+    Entries = ssh_file_entry(RSAFile) ++ ssh_file_entry(DSAFile),
+    AuthKeys = public_key:ssh_encode(Entries , auth_keys),
+    AuthKeysFile = filename:join(Dir, "authorized_keys"),
+    file:write_file(AuthKeysFile, AuthKeys).
+
+ssh_file_entry(PubFile) ->
+    case file:read_file(PubFile) of
+	{ok, Ssh} ->
+	    [{Key, _}] = public_key:ssh_decode(Ssh, public_key), 
+	    [{Key, [{comment, "Test"}]}];
 	_ ->
-	   {error, "Has pass phrase can not be used by automated test case"} 
-    end.
-
+	    []
+    end. 
+	    
 failfun(_User, {authmethod,none}) ->
     ok;
 failfun(User, Reason) ->
@@ -232,25 +219,41 @@ known_hosts(BR) ->
     end.
 
 setup_dsa(DataDir, UserDir) ->
-    ssh_test_lib:copyfile(DataDir, UserDir, "ssh_host_dsa_key"),
-    ssh_test_lib:copyfile(DataDir, UserDir, "ssh_host_dsa_key.pub"),
-    {ok, Pem} = file:read_file(filename:join(UserDir, "ssh_host_dsa_key")),
-    DSA = public_key:pem_entry_decode(hd(public_key:pem_decode(Pem))),
-    PKey = DSA#'DSAPrivateKey'.y,
-    P = DSA#'DSAPrivateKey'.p,
-    Q = DSA#'DSAPrivateKey'.q,
-    G = DSA#'DSAPrivateKey'.g,
-    Dss = #'Dss-Parms'{p=P, q=Q, g=G},
+    file:copy(filename:join(DataDir, "id_dsa"), filename:join(UserDir, "id_dsa")),
+    setup_dsa_known_host(DataDir, UserDir),
+    setup_dsa_auth_keys(DataDir, UserDir).
+    
+clean_dsa(UserDir) ->
+    file:delete(filename:join(UserDir,"id_dsa")),
+    file:delete(filename:join(UserDir,"known_hosts")),
+    file:delete(filename:join(UserDir,"authorized_keys")).
+
+setup_dsa_known_host(SystemDir, UserDir) ->
+    {ok, SshBin} = file:read_file(filename:join(SystemDir, "ssh_host_dsa_key.pub")),
+    [{Key, _}] = public_key:ssh_decode(SshBin, public_key),
+    setup_known_hosts(Key, UserDir).
+
+setup_known_hosts(Key, UserDir) ->
     {ok, Hostname} = inet:gethostname(),
     {ok, {A, B, C, D}} = inet:getaddr(Hostname, inet),
     IP = lists:concat([A, ".", B, ".", C, ".", D]),
-    HostNames = [{hostnames,[IP, IP]}],
-    KnownHosts = [{{PKey, Dss}, HostNames}],
+    HostNames = [{hostnames,[Hostname, IP]}],
+    KnownHosts = [{Key, HostNames}],
     KnownHostsEnc = public_key:ssh_encode(KnownHosts, known_hosts),
     KHFile = filename:join(UserDir, "known_hosts"),
     file:write_file(KHFile, KnownHostsEnc).
 
-clean_dsa(UserDir) ->
-    file:delete(filename:join(UserDir,  "ssh_host_dsa_key")),
-    file:delete(filename:join(UserDir,  "ssh_host_dsa_key.pub")),
-    file:delete(filename:join(UserDir,  "known_hosts")).
+setup_dsa_auth_keys(Dir, UserDir) ->
+    {ok, Pem} = file:read_file(filename:join(Dir, "id_dsa")),
+    DSA = public_key:pem_entry_decode(hd(public_key:pem_decode(Pem))),
+    PKey = DSA#'DSAPrivateKey'.y,
+    P = DSA#'DSAPrivateKey'.p,
+    Q = DSA#'DSAPrivateKey'.q,
+    G = DSA#'DSAPrivateKey'.g,
+    Dss = #'Dss-Parms'{p=P, q=Q, g=G},
+    setup_auth_keys([{{PKey, Dss}, [{comment, "Test"}]}], UserDir).
+
+setup_auth_keys(Keys, Dir) ->
+    AuthKeys = public_key:ssh_encode(Keys, auth_keys),
+    AuthKeysFile = filename:join(Dir, "authorized_keys"),
+    file:write_file(AuthKeysFile, AuthKeys).
diff --git a/lib/ssh/test/ssh_to_openssh_SUITE.erl b/lib/ssh/test/ssh_to_openssh_SUITE.erl
index 53d04620c5..9fb24ba3f3 100644
--- a/lib/ssh/test/ssh_to_openssh_SUITE.erl
+++ b/lib/ssh/test/ssh_to_openssh_SUITE.erl
@@ -76,6 +76,7 @@ end_per_suite(_Config) ->
 %% Description: Initialization before each test case
 %%--------------------------------------------------------------------
 init_per_testcase(_TestCase, Config) ->
+    test_server:format("Init per test case~n", []),
     ssh:start(),
     Config.
 
@@ -119,18 +120,15 @@ groups() ->
 			  erlang_client_openssh_server_password]},
      {erlang_server, [], [erlang_server_openssh_client_exec,
 			  erlang_server_openssh_client_exec_compressed,
-			  erlang_server_openssh_client_pulic_key_dsa,
-			  erlang_client_openssh_server_password]}
+			  erlang_server_openssh_client_pulic_key_dsa]}
     ].
 
 init_per_group(erlang_server, Config) ->
     DataDir = ?config(data_dir, Config),
     UserDir = ?config(priv_dir, Config),
-    ssh_test_lib:setup_dsa(DataDir, UserDir),
+    ssh_test_lib:setup_dsa_known_host(DataDir, UserDir),
     Config;
 init_per_group(_, Config) ->
-    Dir = ?config(priv_dir, Config),
-    {ok, _} = ssh_test_lib:get_id_keys(Dir),
     Config.
 
 end_per_group(erlang_server, Config) ->
@@ -138,8 +136,6 @@ end_per_group(erlang_server, Config) ->
     ssh_test_lib:clean_dsa(UserDir),
     Config;
 end_per_group(_, Config) ->
-    Dir = ?config(priv_dir, Config),
-    ssh_test_lib:remove_id_keys(Dir),
     Config.
 
 %% TEST cases starts here.
@@ -152,9 +148,8 @@ erlang_shell_client_openssh_server(suite) ->
 
 erlang_shell_client_openssh_server(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    UserDir = ?config(priv_dir, Config),
     IO = ssh_test_lib:start_io_server(),
-    Shell = ssh_test_lib:start_shell(?SSH_DEFAULT_PORT, IO, UserDir),
+    Shell = ssh_test_lib:start_shell(?SSH_DEFAULT_PORT, IO),
     IO ! {input, self(), "echo Hej\n"},
     receive_hej(),
     IO ! {input, self(), "exit\n"},
@@ -250,8 +245,10 @@ erlang_server_openssh_client_exec(suite) ->
     [];
 
 erlang_server_openssh_client_exec(Config) when is_list(Config) ->
-    SystemDir = ?config(priv_dir, Config),
-    
+    SystemDir = ?config(data_dir, Config),
+    PrivDir = ?config(priv_dir, Config),
+    KnownHosts = filename:join(PrivDir, "known_hosts"),
+
     {Pid, Host, Port} = ssh_test_lib:daemon([{system_dir, SystemDir},
 					     {failfun, fun ssh_test_lib:failfun/2}]),
     
@@ -259,7 +256,10 @@ erlang_server_openssh_client_exec(Config) when is_list(Config) ->
     test_server:sleep(500),
 
     Cmd = "ssh -p " ++ integer_to_list(Port) ++
-	" -o StrictHostKeyChecking=no "++ Host ++ " 1+1.",
+	" -o UserKnownHostsFile=" ++ KnownHosts ++ " " ++ Host ++ " 1+1.",
+
+    test_server:format("Cmd: ~p~n", [Cmd]),
+
     SshPort = open_port({spawn, Cmd}, [binary]),
 
     receive
@@ -279,7 +279,10 @@ erlang_server_openssh_client_exec_compressed(suite) ->
     [];
 
 erlang_server_openssh_client_exec_compressed(Config) when is_list(Config) ->
-    SystemDir = ?config(priv_dir, Config),
+    SystemDir = ?config(data_dir, Config),
+    PrivDir = ?config(priv_dir, Config),
+    KnownHosts = filename:join(PrivDir, "known_hosts"),
+
     {Pid, Host, Port} = ssh_test_lib:daemon([{system_dir, SystemDir},
 					     {compression, zlib},
 					     {failfun, fun ssh_test_lib:failfun/2}]),
@@ -287,7 +290,7 @@ erlang_server_openssh_client_exec_compressed(Config) when is_list(Config) ->
     test_server:sleep(500),
 
     Cmd = "ssh -p " ++ integer_to_list(Port) ++
-	" -o StrictHostKeyChecking=no -C "++ Host ++ " 1+1.",
+	" -o UserKnownHostsFile=" ++ KnownHosts ++ " -C "++ Host ++ " 1+1.",
     SshPort = open_port({spawn, Cmd}, [binary]),
 
     receive
@@ -352,26 +355,27 @@ erlang_client_openssh_server_publickey_rsa(suite) ->
     [];
 erlang_client_openssh_server_publickey_rsa(Config) when is_list(Config) ->
     {ok,[[Home]]} = init:get_argument(home),
-    SrcDir =  filename:join(Home, ".ssh"),
-    UserDir = ?config(priv_dir, Config),
-    case ssh_test_lib:copyfile(SrcDir, UserDir, "id_rsa") of
-	{ok, _} ->
-	    ConnectionRef =
-		ssh_test_lib:connect(?SSH_DEFAULT_PORT,
-				     [{user_dir, UserDir},
-				      {public_key_alg, ssh_rsa},
-				      {user_interaction, false},
-				      silently_accept_hosts]),
-	    {ok, Channel} =
-		ssh_connection:session_channel(ConnectionRef, infinity),
-	    ok = ssh_connection:close(ConnectionRef, Channel),
-	    ok = ssh:close(ConnectionRef),
-	    ok = file:delete(filename:join(UserDir, "id_rsa"));
-	{error, enoent} ->
-	    {skip, "no ~/.ssh/id_rsa"};
-       	{error, Reason} ->
-	    {skip, Reason}
+    KeyFile =  filename:join(Home, ".ssh/id_rsa"),
+    case file:read_file(KeyFile) of
+	{ok, Pem} ->
+	    case public_key:pem_decode(Pem) of
+		[{_,_, not_encrypted}] ->
+		    ConnectionRef =
+			ssh_test_lib:connect(?SSH_DEFAULT_PORT,
+					     [{public_key_alg, ssh_rsa},
+					      {user_interaction, false},
+					      silently_accept_hosts]),
+		    {ok, Channel} =
+			ssh_connection:session_channel(ConnectionRef, infinity),
+		    ok = ssh_connection:close(ConnectionRef, Channel),
+		    ok = ssh:close(ConnectionRef);
+		_ ->
+		    {skip, {error, "Has pass phrase can not be used by automated test case"}} 
+	    end;
+	_ ->
+	    {skip, "no ~/.ssh/id_rsa"}  
     end.
+	
 
 %%--------------------------------------------------------------------
 erlang_client_openssh_server_publickey_dsa(doc) ->
@@ -380,27 +384,26 @@ erlang_client_openssh_server_publickey_dsa(suite) ->
     [];
 erlang_client_openssh_server_publickey_dsa(Config) when is_list(Config) ->
     {ok,[[Home]]} = init:get_argument(home),
-    SrcDir =  filename:join(Home, ".ssh"),
-    UserDir = ?config(priv_dir, Config),
-    case ssh_test_lib:copyfile(SrcDir, UserDir, "id_dsa") of
-	{ok, _} ->
-	    ConnectionRef =
-		ssh_test_lib:connect(?SSH_DEFAULT_PORT,
-				     [{user_dir, UserDir},
-				      {public_key_alg, ssh_dsa},
-				      {user_interaction, false},
-				      silently_accept_hosts]),
-	    {ok, Channel} =
-		ssh_connection:session_channel(ConnectionRef, infinity),
-	    ok = ssh_connection:close(ConnectionRef, Channel),
-	    ok = ssh:close(ConnectionRef),
-	    ok = file:delete(filename:join(UserDir, "id_dsa"));
-	{error, enoent} ->
-	    {skip, "no ~/.ssh/id_dsa"};
-	{error, Reason} ->
-	    {skip, Reason}
+    KeyFile =  filename:join(Home, ".ssh/id_dsa"),
+    case file:read_file(KeyFile) of
+	{ok, Pem} ->
+	    case public_key:pem_decode(Pem) of
+		[{_,_, not_encrypted}] ->
+		    ConnectionRef =
+			ssh_test_lib:connect(?SSH_DEFAULT_PORT,
+					     [{public_key_alg, ssh_dsa},
+					      {user_interaction, false},
+					      silently_accept_hosts]),
+		    {ok, Channel} =
+			ssh_connection:session_channel(ConnectionRef, infinity),
+		    ok = ssh_connection:close(ConnectionRef, Channel),
+		    ok = ssh:close(ConnectionRef);
+		_ ->
+		    {skip, {error, "Has pass phrase can not be used by automated test case"}} 
+	    end;
+	_ ->
+	    {skip, "no ~/.ssh/id_dsa"}  
     end.
-
 %%--------------------------------------------------------------------
 erlang_server_openssh_client_pulic_key_dsa(doc) ->
     ["Validate using dsa publickey."];
@@ -409,7 +412,10 @@ erlang_server_openssh_client_pulic_key_dsa(suite) ->
     [];
 
 erlang_server_openssh_client_pulic_key_dsa(Config) when is_list(Config) ->
-    SystemDir = ?config(priv_dir, Config),
+    SystemDir = ?config(data_dir, Config),
+    PrivDir = ?config(priv_dir, Config),
+    KnownHosts = filename:join(PrivDir, "known_hosts"),
+
     {Pid, Host, Port} = ssh_test_lib:daemon([{system_dir, SystemDir},
 					     {public_key_alg, ssh_dsa},
 					     {failfun, fun ssh_test_lib:failfun/2}]),
@@ -417,7 +423,8 @@ erlang_server_openssh_client_pulic_key_dsa(Config) when is_list(Config) ->
     test_server:sleep(500),
 
     Cmd = "ssh -p " ++ integer_to_list(Port) ++
-	" -o StrictHostKeyChecking=no "++ Host ++ " 1+1.",
+	" -o UserKnownHostsFile=" ++ KnownHosts ++
+	" " ++ Host ++ " 1+1.",
     SshPort = open_port({spawn, Cmd}, [binary]),
 
     receive
@@ -425,7 +432,6 @@ erlang_server_openssh_client_pulic_key_dsa(Config) when is_list(Config) ->
 	    ok
     after ?TIMEOUT ->
 	    test_server:fail("Did not receive answer")
-
     end,
      ssh:stop_daemon(Pid).
 
diff --git a/lib/ssh/test/ssh_to_openssh_SUITE_data/ssh_host_rsa_key b/lib/ssh/test/ssh_to_openssh_SUITE_data/ssh_host_rsa_key
new file mode 100644
index 0000000000..79968bdd7d
--- /dev/null
+++ b/lib/ssh/test/ssh_to_openssh_SUITE_data/ssh_host_rsa_key
@@ -0,0 +1,16 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQDCZX+4FBDwZIh9y/Uxee1VJnEXlowpz2yDKwj8semM4q843337
+zbNfxHmladB1lpz2NqyxI175xMIJuDxogyZdsOxGnFAzAnthR4dqL/RWRWzjaxSB
+6IAO9SPYVVlrpZ+1hsjLW79fwXK/yc8VdhRuWTeQiRgYY2ek8+OKbOqz4QIDAQAB
+AoGANmvJzJO5hkLuvyDZHKfAnGTtpifcR1wtSa9DjdKUyn8vhKF0mIimnbnYQEmW
+NUUb3gXCZLi9PvkpRSVRrASDOZwcjoU/Kvww163vBUVb2cOZfFhyn6o2Sk88Tt++
+udH3hdjpf9i7jTtUkUe+QYPsia+wgvvrmn4QrahLAH86+kECQQDx5gFeXTME3cnW
+WMpFz3PPumduzjqgqMMWEccX4FtQkMX/gyGa5UC7OHFyh0N/gSWvPbRHa8A6YgIt
+n8DO+fh5AkEAzbqX4DOn8NY6xJIi42q7l/2jIA0RkB6P7YugW5NblhqBZ0XDnpA5
+sMt+rz+K07u9XZtxgh1xi7mNfwY6lEAMqQJBAJBEauCKmRj35Z6OyeQku59SPsnY
++SJEREVvSNw2lH9SOKQQ4wPsYlTGbvKtNVZgAcen91L5MmYfeckYE/fdIZECQQCt
+64zxsTnM1I8iFxj/gP/OYlJBikrKt8udWmjaghzvLMEw+T2DExJyb9ZNeT53+UMB
+m6O+B/4xzU/djvp+0hbhAkAemIt+rA5kTmYlFndhpvzkSSM8a2EXsO4XIPgGWCTT
+tQKS/tTly0ADMjN/TVy11+9d6zcqadNVuHXHGtR4W0GR
+-----END RSA PRIVATE KEY-----
+
diff --git a/lib/ssh/test/ssh_to_openssh_SUITE_data/ssh_host_rsa_key.pub b/lib/ssh/test/ssh_to_openssh_SUITE_data/ssh_host_rsa_key.pub
new file mode 100644
index 0000000000..75d2025c71
--- /dev/null
+++ b/lib/ssh/test/ssh_to_openssh_SUITE_data/ssh_host_rsa_key.pub
@@ -0,0 +1,5 @@
+---- BEGIN SSH2 PUBLIC KEY ----
+AAAAB3NzaC1yc2EAAAADAQABAAAAgQDCZX+4FBDwZIh9y/Uxee1VJnEXlowpz2yDKwj8
+semM4q843337zbNfxHmladB1lpz2NqyxI175xMIJuDxogyZdsOxGnFAzAnthR4dqL/RW
+RWzjaxSB6IAO9SPYVVlrpZ+1hsjLW79fwXK/yc8VdhRuWTeQiRgYY2ek8+OKbOqz4Q==
+---- END SSH2 PUBLIC KEY ----