Merge branch 'hans/ssh/kex_ecdh/OTP-12622' into maint

* hans/ssh/kex_ecdh/OTP-12622:
  ssh: Elliptic Curve Diffie-Hellman (ECDH)

8 files changed, 338 insertions, 81 deletions

diff --git a/lib/ssh/src/ssh_connection_handler.erl b/lib/ssh/src/ssh_connection_handler.erl
index 180698d741..fcd66b80c0 100644
--- a/lib/ssh/src/ssh_connection_handler.erl
+++ b/lib/ssh/src/ssh_connection_handler.erl
@@ -429,7 +429,21 @@ key_exchange(#ssh_msg_kex_dh_gex_group{} = Msg,
 	     #state{ssh_params = #ssh{role = client} = Ssh0} = State) ->
     {ok, KexGexInit, Ssh} = ssh_transport:handle_kex_dh_gex_group(Msg, Ssh0),
     send_msg(KexGexInit, State),
-    {next_state, key_exchange_dh_gex_reply, next_packet(State#state{ssh_params = Ssh})}.
+    {next_state, key_exchange_dh_gex_reply, next_packet(State#state{ssh_params = Ssh})};
+
+key_exchange(#ssh_msg_kex_ecdh_init{} = Msg, 
+	     #state{ssh_params = #ssh{role = server} = Ssh0} = State) ->
+    {ok, KexEcdhReply, Ssh1} = ssh_transport:handle_kex_ecdh_init(Msg, Ssh0),
+    send_msg(KexEcdhReply, State),
+    {ok, NewKeys, Ssh} = ssh_transport:new_keys_message(Ssh1),
+    send_msg(NewKeys, State),
+    {next_state, new_keys, next_packet(State#state{ssh_params = Ssh})};
+
+key_exchange(#ssh_msg_kex_ecdh_reply{} = Msg, 
+	     #state{ssh_params = #ssh{role = client} = Ssh0} = State) ->
+    {ok, NewKeys, Ssh} = ssh_transport:handle_kex_ecdh_reply(Msg, Ssh0),
+    send_msg(NewKeys, State),
+    {next_state, new_keys, next_packet(State#state{ssh_params = Ssh})}.
 
 %%--------------------------------------------------------------------
 -spec key_exchange_dh_gex_init(#ssh_msg_kex_dh_gex_init{}, #state{}) -> gen_fsm_state_return().
@@ -1307,7 +1321,7 @@ event(Event, StateName, State) ->
 	    handle_disconnect(DisconnectMsg, State);
 	throw:{ErrorToDisplay, #ssh_msg_disconnect{} = DisconnectMsg}  ->
 	    handle_disconnect(DisconnectMsg, State, ErrorToDisplay);
-	_:_ ->
+	_C:_Error ->
 	    handle_disconnect(#ssh_msg_disconnect{code = error_code(StateName),
 						  description = "Invalid state",
 						  language = "en"}, State)
@@ -1376,9 +1390,10 @@ generate_event(<<?BYTE(Byte), _/binary>> = Msg, StateName,
 	    {stop, {shutdown, Error}, State#state{connection_state = Connection}}
     end;
 
+
 generate_event(Msg, StateName, State0, EncData) ->
     try 
-	Event = ssh_message:decode(Msg),
+	Event = ssh_message:decode(set_prefix_if_trouble(Msg,State0)),
 	State = generate_event_new_state(State0, EncData),
 	case Event of
 	    #ssh_msg_kexinit{} ->
@@ -1388,7 +1403,7 @@ generate_event(Msg, StateName, State0, EncData) ->
 		event(Event, StateName, State)
 	end
     catch 
-	_:_  ->
+	_C:_E  ->
 	    DisconnectMsg =
 		#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR, 
 				    description = "Encountered unexpected input",
@@ -1397,6 +1412,26 @@ generate_event(Msg, StateName, State0, EncData) ->
     end.		
 	    
 
+set_prefix_if_trouble(Msg = <<?BYTE(Op),_/binary>>, #state{ssh_params=SshParams}) 
+  when Op == 30;
+       Op == 31
+       ->
+    case catch atom_to_list(kex(SshParams)) of
+	"ecdh-sha2-" ++ _ -> 
+	    <<"ecdh",Msg/binary>>;
+	"diffie-hellman-group-exchange-" ++ _ ->
+	    <<"dh_gex",Msg/binary>>;
+	"diffie-hellman-group" ++ _ ->
+	    <<"dh",Msg/binary>>;
+	_ -> 
+	    Msg
+    end;
+set_prefix_if_trouble(Msg, _) ->
+    Msg.
+
+kex(#ssh{algorithms=#alg{kex=Kex}}) -> Kex;
+kex(_) -> undefined.
+
 
 handle_request(ChannelPid, ChannelId, Type, Data, WantReply, From,
 	       #state{connection_state =
@@ -1491,6 +1526,7 @@ new_channel_id(#state{connection_state = #connection{channel_id_seed = Id} =
 	       = State) ->
     {Id, State#state{connection_state =
 		     Connection#connection{channel_id_seed = Id + 1}}}.
+
 generate_event_new_state(#state{ssh_params = 
 				#ssh{recv_sequence = SeqNum0} 
 				= Ssh} = State, EncData) ->
diff --git a/lib/ssh/src/ssh_message.erl b/lib/ssh/src/ssh_message.erl
index 7b786b8fff..cb1dcb67c5 100644
--- a/lib/ssh/src/ssh_message.erl
+++ b/lib/ssh/src/ssh_message.erl
@@ -259,6 +259,14 @@ encode(#ssh_msg_kex_dh_gex_reply{
     EncSign = encode_sign(Key, Signature),
     ssh_bits:encode([?SSH_MSG_KEX_DH_GEX_REPLY, EncKey, F, EncSign], [byte, binary, mpint, binary]);
 
+encode(#ssh_msg_kex_ecdh_init{q_c = Q_c}) ->
+    ssh_bits:encode([?SSH_MSG_KEX_ECDH_INIT, Q_c], [byte, mpint]);
+
+encode(#ssh_msg_kex_ecdh_reply{public_host_key = Key, q_s = Q_s, h_sig = Sign}) ->
+    EncKey = encode_host_key(Key),
+    EncSign = encode_sign(Key, Sign),
+    ssh_bits:encode([?SSH_MSG_KEX_ECDH_REPLY, EncKey, Q_s, EncSign], [byte, binary, mpint, binary]);
+
 encode(#ssh_msg_ignore{data = Data}) ->
     ssh_bits:encode([?SSH_MSG_IGNORE, Data], [byte, string]);
 
@@ -422,30 +430,45 @@ decode(<<?BYTE(?SSH_MSG_USERAUTH_INFO_RESPONSE), ?UINT32(Num), Data/binary>>) ->
 decode(<<?BYTE(?SSH_MSG_KEXINIT), Cookie:128, Data/binary>>) ->
     decode_kex_init(Data, [Cookie, ssh_msg_kexinit], 10);
 
-decode(<<?BYTE(?SSH_MSG_KEXDH_INIT), ?UINT32(Len), E:Len/big-signed-integer-unit:8>>) ->
+decode(<<"dh",?BYTE(?SSH_MSG_KEXDH_INIT), ?UINT32(Len), E:Len/big-signed-integer-unit:8>>) ->
     #ssh_msg_kexdh_init{e = E
 		       };
+
+decode(<<"dh", ?BYTE(?SSH_MSG_KEXDH_REPLY), 
+	 ?UINT32(Len0), Key:Len0/binary,
+	 ?UINT32(Len1), F:Len1/big-signed-integer-unit:8,
+	 ?UINT32(Len2), Hashsign:Len2/binary>>) ->
+    #ssh_msg_kexdh_reply{
+       public_host_key = decode_host_key(Key),
+       f = F,
+       h_sig = decode_sign(Hashsign)
+      };
+
 decode(<<?BYTE(?SSH_MSG_KEX_DH_GEX_REQUEST), ?UINT32(Min), ?UINT32(N), ?UINT32(Max)>>) ->
     #ssh_msg_kex_dh_gex_request{
        min = Min,
        n = N,
        max = Max
       };
-decode(<<?BYTE(?SSH_MSG_KEX_DH_GEX_REQUEST_OLD), ?UINT32(N)>>) ->
+
+decode(<<"dh_gex",?BYTE(?SSH_MSG_KEX_DH_GEX_REQUEST_OLD), ?UINT32(N)>>) ->
     #ssh_msg_kex_dh_gex_request_old{
        n = N
       };
-decode(<<?BYTE(?SSH_MSG_KEX_DH_GEX_GROUP),  
+
+decode(<<"dh_gex",?BYTE(?SSH_MSG_KEX_DH_GEX_GROUP),  
 	 ?UINT32(Len0), Prime:Len0/big-signed-integer-unit:8,
 	 ?UINT32(Len1), Generator:Len1/big-signed-integer-unit:8>>) ->
     #ssh_msg_kex_dh_gex_group{
        p = Prime,
        g = Generator
       };
+
 decode(<<?BYTE(?SSH_MSG_KEX_DH_GEX_INIT), ?UINT32(Len), E:Len/big-signed-integer-unit:8>>) ->
     #ssh_msg_kex_dh_gex_init{
        e = E
       };
+
 decode(<<?BYTE(?SSH_MSG_KEX_DH_GEX_REPLY), 
 	 ?UINT32(Len0), Key:Len0/binary,
 	 ?UINT32(Len1), F:Len1/big-signed-integer-unit:8,
@@ -455,13 +478,21 @@ decode(<<?BYTE(?SSH_MSG_KEX_DH_GEX_REPLY),
        f = F,
        h_sig = decode_sign(Hashsign)
       };
-decode(<<?BYTE(?SSH_MSG_KEXDH_REPLY), ?UINT32(Len0), Key:Len0/binary,
-	 ?UINT32(Len1), F:Len1/big-signed-integer-unit:8,
-	 ?UINT32(Len2), Hashsign:Len2/binary>>) ->
-    #ssh_msg_kexdh_reply{
+
+decode(<<"ecdh",?BYTE(?SSH_MSG_KEX_ECDH_INIT),
+	 ?UINT32(Len0), Q_c:Len0/big-signed-integer-unit:8>>) ->
+    #ssh_msg_kex_ecdh_init{
+       q_c = Q_c
+      };
+
+decode(<<"ecdh",?BYTE(?SSH_MSG_KEX_ECDH_REPLY),
+	 ?UINT32(Len1), Key:Len1/binary,
+	 ?UINT32(Len2), Q_s:Len2/big-signed-integer-unit:8,
+	 ?UINT32(Len3), Sig:Len3/binary>>) ->
+    #ssh_msg_kex_ecdh_reply{
        public_host_key = decode_host_key(Key),
-       f = F,
-       h_sig = decode_sign(Hashsign)
+       q_s = Q_s,
+       h_sig = decode_sign(Sig)
       };
 
 decode(<<?SSH_MSG_SERVICE_REQUEST, ?UINT32(Len0), Service:Len0/binary>>) ->
diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index 9ed6c85ff7..235d8918f3 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -42,6 +42,8 @@
 	 handle_kex_dh_gex_group/2, handle_kex_dh_gex_init/2, handle_kex_dh_gex_reply/2,
 	 handle_new_keys/2, handle_kex_dh_gex_request/2,
 	 handle_kexdh_reply/2, 
+	 handle_kex_ecdh_init/2,
+	 handle_kex_ecdh_reply/2,
 	 unpack/3, decompress/2, ssh_packet/2, pack/2, msg_data/1,
 	 sign/3, verify/4]).
 
@@ -53,7 +55,7 @@
 %%% user.
 %%%
 %%% A supported algorithm can be requested in the option 'preferred_algorithms',
-%%% but may give unexpected results because of being promoted to default.
+%%% but may give unexpected results before being promoted to default.
 %%%
 %%% This makes it possible to add experimental algorithms (in supported_algorithms)
 %%% and test them without letting the default users know about them.
@@ -66,8 +68,6 @@ algo_classes() -> [kex, public_key, cipher, mac, compression].
 default_algorithms(compression) ->
     %% Do not announce '[email protected]' because there seem to be problems
     supported_algorithms(compression, same(['[email protected]']));
-default_algorithms(kex) ->
-    supported_algorithms(kex, []);
 default_algorithms(Alg) ->
     supported_algorithms(Alg).
 
@@ -76,10 +76,14 @@ supported_algorithms() -> [{K,supported_algorithms(K)} || K <- algo_classes()].
 
 supported_algorithms(kex) ->
     select_crypto_supported(
-      [{'diffie-hellman-group14-sha1',          [{hashs,sha}]},
-       {'diffie-hellman-group1-sha1',           [{hashs,sha}]},
-       {'diffie-hellman-group-exchange-sha256', [{hashs,sha256}]},
-       {'diffie-hellman-group-exchange-sha1',   [{hashs,sha}]}
+      [
+       {'ecdh-sha2-nistp256',                   [{public_keys,ecdh}, {ec_curve,secp256r1}, {hashs,sha256}]},
+       {'ecdh-sha2-nistp384',                   [{public_keys,ecdh}, {ec_curve,secp384r1}, {hashs,sha384}]},
+       {'ecdh-sha2-nistp521',                   [{public_keys,ecdh}, {ec_curve,secp521r1}, {hashs,sha512}]},
+       {'diffie-hellman-group14-sha1',          [{public_keys,dh}, {hashs,sha}]},
+       {'diffie-hellman-group-exchange-sha256', [{public_keys,dh}, {hashs,sha256}]},
+       {'diffie-hellman-group-exchange-sha1',   [{public_keys,dh}, {hashs,sha}]},
+       {'diffie-hellman-group1-sha1',           [{public_keys,dh}, {hashs,sha}]}
       ]);
 supported_algorithms(public_key) ->
     ssh_auth:default_public_key_algorithms();
@@ -94,7 +98,8 @@ supported_algorithms(cipher) ->
 supported_algorithms(mac) ->
     same(
       select_crypto_supported(
-	[{'hmac-sha2-256', [{hashs,sha256}]},
+	[{'hmac-sha2-512', [{hashs,sha512}]},
+	 {'hmac-sha2-256', [{hashs,sha256}]},
 	 {'hmac-sha1',     [{hashs,sha}]}
 	]
        ));
@@ -109,14 +114,19 @@ supported_algorithms(Key, BlackList) ->
     supported_algorithms(Key) -- BlackList.
 
 select_crypto_supported(L) ->    
-    Sup = crypto:supports(),
+    Sup = [{ec_curve,crypto_supported_curves()} | crypto:supports()],
     [Name || {Name,CryptoRequires} <- L,
 	     crypto_supported(CryptoRequires, Sup)].
 
+crypto_supported_curves() ->
+    try crypto:ec_curves()
+    catch _:_ -> []
+    end.
+
 crypto_supported(Conditions, Supported) ->
-    lists:all(fun({Tag,CryptoName}) ->
-		      lists:member(CryptoName, proplists:get_value(Tag,Supported,[]))
-	      end, Conditions).
+    lists:all( fun({Tag,CryptoName}) ->
+		       lists:member(CryptoName, proplists:get_value(Tag,Supported,[]))
+	       end, Conditions).
 
 
 same(Algs) ->  [{client2server,Algs}, {server2client,Algs}].
@@ -294,10 +304,7 @@ verify_algorithm(#alg{decrypt = undefined}) -> false;
 verify_algorithm(#alg{compress = undefined}) -> false;
 verify_algorithm(#alg{decompress = undefined}) -> false;
 
-verify_algorithm(#alg{kex = 'diffie-hellman-group1-sha1'}) -> true;
-verify_algorithm(#alg{kex = 'diffie-hellman-group14-sha1'}) -> true;
-verify_algorithm(#alg{kex = 'diffie-hellman-group-exchange-sha1'}) -> true;
-verify_algorithm(#alg{kex = 'diffie-hellman-group-exchange-sha256'}) -> true;
+verify_algorithm(#alg{kex = Kex}) -> lists:member(Kex, supported_algorithms(kex));
 verify_algorithm(_) -> false.
 
 %%%----------------------------------------------------------------
@@ -307,8 +314,7 @@ verify_algorithm(_) -> false.
 key_exchange_first_msg(Kex, Ssh0) when Kex == 'diffie-hellman-group1-sha1' ;
 				       Kex == 'diffie-hellman-group14-sha1' ->
     {G, P} = dh_group(Kex),
-    {Private, Public} = dh_gen_key(G, P, 1024),
-    %% Public = G^Private mod P  (def)
+    {Public, Private} = generate_key(dh, [P,G]),
     {SshPacket, Ssh1} = ssh_packet(#ssh_msg_kexdh_init{e = Public}, Ssh0),
     {ok, SshPacket, 
      Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}}}};
@@ -324,7 +330,16 @@ key_exchange_first_msg(Kex, Ssh0) when Kex == 'diffie-hellman-group-exchange-sha
 					       max = Max}, 
 		   Ssh0),
     {ok, SshPacket, 
-     Ssh1#ssh{keyex_info = {Min, Max, NBits}}}. 
+     Ssh1#ssh{keyex_info = {Min, Max, NBits}}};
+
+key_exchange_first_msg(Kex, Ssh0) when Kex == 'ecdh-sha2-nistp256' ;
+				       Kex == 'ecdh-sha2-nistp384' ;
+				       Kex == 'ecdh-sha2-nistp521' ->
+    Curve = ecdh_curve(Kex),
+    {Public, Private} = generate_key(ecdh, Curve),
+    {SshPacket, Ssh1} = ssh_packet(#ssh_msg_kex_ecdh_init{q_c=Public},  Ssh0),
+    {ok, SshPacket, 
+     Ssh1#ssh{keyex_key = {{Public,Private},Curve}}}.
 
 %%%----------------------------------------------------------------
 %%%
@@ -337,8 +352,8 @@ handle_kexdh_init(#ssh_msg_kexdh_init{e = E},
     {G, P} = dh_group(Kex),
     if
 	1=<E, E=<(P-1) ->
-	    {Private, Public} = dh_gen_key(G, P, 1024),
-	    K = dh_compute_key(G, P, E, Private),
+	    {Public, Private} = generate_key(dh, [P,G]),
+	    K = compute_key(dh, E, Private, [P,G]),
 	    Key = get_host_key(Ssh0),
 	    H = kex_h(Ssh0, Key, E, Public, K),
 	    H_SIG = sign_host_key(Ssh0, Key, H),
@@ -367,7 +382,7 @@ handle_kexdh_reply(#ssh_msg_kexdh_reply{public_host_key = HostKey,
     %% client
     if 
 	1=<F, F=<(P-1)->
-	    K = dh_compute_key(G, P, F, Private),
+	    K = compute_key(dh, F, Private, [P,G]),
 	    H = kex_h(Ssh0, HostKey, Public, F, K),
 
 	    case verify_host_key(Ssh0, HostKey, H, H_SIG) of
@@ -405,7 +420,7 @@ handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request{min = Min,
 			  Ssh0=#ssh{opts=Opts}) when Min=<NBits, NBits=<Max ->
     %% server
     {G, P} = dh_gex_group(Min, NBits, Max, proplists:get_value(dh_gex_groups,Opts)),
-    {Private, Public} = dh_gen_key(G, P, 1024),
+    {Public, Private} = generate_key(dh, [P,G]),
     {SshPacket, Ssh} = 
 	ssh_packet(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0),
     {ok, SshPacket, 
@@ -422,7 +437,7 @@ handle_kex_dh_gex_request(_, _) ->
 
 handle_kex_dh_gex_group(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0) ->
     %% client
-    {Private, Public} = dh_gen_key(G, P, 1024),
+    {Public, Private} = generate_key(dh, [P,G]),
     {SshPacket, Ssh1} = 
 	ssh_packet(#ssh_msg_kex_dh_gex_init{e = Public}, Ssh0),	% Pub = G^Priv mod P (def)
 
@@ -436,7 +451,7 @@ handle_kex_dh_gex_init(#ssh_msg_kex_dh_gex_init{e = E},
     %% server
     if
 	1=<E, E=<(P-1) ->
-	    K = dh_compute_key(G, P, E, Private),
+	    K = compute_key(dh, E, Private, [P,G]),
 	    if
 		1<K, K<(P-1) ->
 		    HostKey = get_host_key(Ssh0),
@@ -476,7 +491,7 @@ handle_kex_dh_gex_reply(#ssh_msg_kex_dh_gex_reply{public_host_key = HostKey,
     %% client
     if 
 	1=<F, F=<(P-1)->
-	    K = dh_compute_key(G, P, F, Private),
+	    K = compute_key(dh, F, Private, [P,G]),
 	    if
 		1<K, K<(P-1) ->
 		    H = kex_h(Ssh0, HostKey, Min, NBits, Max, P, G, Public, F, K),
@@ -513,12 +528,83 @@ handle_kex_dh_gex_reply(#ssh_msg_kex_dh_gex_reply{public_host_key = HostKey,
     end.	       
 
 %%%----------------------------------------------------------------
+%%%
+%%% diffie-hellman-ecdh-sha2-*
+%%% 
+handle_kex_ecdh_init(#ssh_msg_kex_ecdh_init{q_c = PeerPublic},
+		     Ssh0 = #ssh{algorithms = #alg{kex=Kex}}) ->
+    %% at server
+    Curve = ecdh_curve(Kex),
+    case ecdh_validate_public_key(PeerPublic, Curve) of
+	true ->
+            {MyPublic, MyPrivate} = generate_key(ecdh, Curve),
+	    K = compute_key(ecdh, PeerPublic, MyPrivate, Curve),
+	    HostKey = get_host_key(Ssh0),
+	    H = kex_h(Ssh0, Curve, HostKey, PeerPublic, MyPublic, K),
+	    H_SIG = sign_host_key(Ssh0, HostKey, H),
+	    {SshPacket, Ssh1} = 
+		ssh_packet(#ssh_msg_kex_ecdh_reply{public_host_key = HostKey,
+						   q_s = MyPublic,
+						   h_sig = H_SIG},
+			   Ssh0),
+    	    {ok, SshPacket, Ssh1#ssh{keyex_key = {{MyPublic,MyPrivate},Curve},
+				     shared_secret = K,
+				     exchanged_hash = H,
+				     session_id = sid(Ssh1, H)}};
+
+	false ->
+	    throw({{error,invalid_peer_public_key},
+		   #ssh_msg_disconnect{
+		      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		      description = "Peer ECDH public key is invalid",
+		      language = ""}
+		  })
+    end.
+
+handle_kex_ecdh_reply(#ssh_msg_kex_ecdh_reply{public_host_key = HostKey,
+					      q_s = PeerPublic,
+					      h_sig = H_SIG},
+		      #ssh{keyex_key = {{MyPublic,MyPrivate}, Curve}} = Ssh0
+		     ) ->
+    %% at client
+    case ecdh_validate_public_key(PeerPublic, Curve) of
+	true ->
+	    K = compute_key(ecdh, PeerPublic, MyPrivate, Curve),
+	    H = kex_h(Ssh0, Curve, HostKey, MyPublic, PeerPublic, K), 
+	    case verify_host_key(Ssh0, HostKey, H, H_SIG) of
+		ok ->
+		    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
+		    {ok, SshPacket, Ssh#ssh{shared_secret  = K,
+					    exchanged_hash = H,
+					    session_id = sid(Ssh, H)}};
+		Error ->
+		    throw({Error,
+			   #ssh_msg_disconnect{
+			      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+			      description = "Key exchange failed",
+			      language = ""}
+			  })
+	    end;
+
+	false ->
+	    throw({{error,invalid_peer_public_key},
+		   #ssh_msg_disconnect{
+		      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		      description = "Peer ECDH public key is invalid",
+		      language = ""}
+		  })
+    end.
+
+
+ecdh_validate_public_key(_, _) -> true.		% FIXME: Far too many false positives :)
+
+%%%----------------------------------------------------------------
 handle_new_keys(#ssh_msg_newkeys{}, Ssh0) ->
     try install_alg(Ssh0) of
 	#ssh{} = Ssh ->
 	    {ok, Ssh}
     catch 
-	error:_Error -> %% TODO: Throw earlier ....
+	_C:_Error -> %% TODO: Throw earlier ....
 	    throw(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
 				      description = "Install alg failed", 
 				      language = "en"})
@@ -546,10 +632,10 @@ get_host_key(SSH) ->
     end.
 
 sign_host_key(_Ssh, #'RSAPrivateKey'{} = Private, H) ->
-    Hash = sha, %% Option ?!
+    Hash = sha,
     _Signature = sign(H, Hash, Private);
 sign_host_key(_Ssh, #'DSAPrivateKey'{} = Private, H) ->
-    Hash = sha, %% Option ?!
+    Hash = sha,
     _RawSignature = sign(H, Hash, Private).
 
 verify_host_key(SSH, PublicKey, Digest, Signature) ->
@@ -1134,7 +1220,9 @@ mac('hmac-md5', Key, SeqNum, Data) ->
 mac('hmac-md5-96', Key, SeqNum, Data) ->
     crypto:hmac(md5, Key, [<<?UINT32(SeqNum)>>, Data], mac_digest_size('hmac-md5-96'));
 mac('hmac-sha2-256', Key, SeqNum, Data) ->
-	crypto:hmac(sha256, Key, [<<?UINT32(SeqNum)>>, Data]).
+	crypto:hmac(sha256, Key, [<<?UINT32(SeqNum)>>, Data]);
+mac('hmac-sha2-512', Key, SeqNum, Data) ->
+	crypto:hmac(sha512, Key, [<<?UINT32(SeqNum)>>, Data]).
 
 %% return N hash bytes (HASH)
 hash(SSH, Char, Bits) ->
@@ -1144,10 +1232,18 @@ hash(SSH, Char, Bits) ->
 		fun(Data) -> crypto:hash(sha, Data) end;
 	    'diffie-hellman-group14-sha1' ->
 		fun(Data) -> crypto:hash(sha, Data) end;
+
 	    'diffie-hellman-group-exchange-sha1' ->
 		fun(Data) -> crypto:hash(sha, Data) end;
 	    'diffie-hellman-group-exchange-sha256' ->
 		fun(Data) -> crypto:hash(sha256, Data) end;
+
+	    'ecdh-sha2-nistp256' ->
+		fun(Data) -> crypto:hash(sha256,Data) end;
+	    'ecdh-sha2-nistp384' ->
+		fun(Data) -> crypto:hash(sha384,Data) end;
+	    'ecdh-sha2-nistp521' ->
+		fun(Data) -> crypto:hash(sha512,Data) end;
 	    _ ->
 		exit({bad_algorithm,SSH#ssh.kex})
 	end,
@@ -1176,8 +1272,16 @@ kex_h(SSH, Key, E, F, K) ->
 			 ssh_message:encode_host_key(Key), E,F,K],
 			[string,string,binary,binary,binary,
 			 mpint,mpint,mpint]),
-    crypto:hash(sha,L).
- 
+    crypto:hash(sha((SSH#ssh.algorithms)#alg.kex), L).
+%%  crypto:hash(sha,L).
+
+kex_h(SSH, Curve, Key, Q_c, Q_s, K) ->
+    L = ssh_bits:encode([SSH#ssh.c_version, SSH#ssh.s_version,
+			 SSH#ssh.c_keyinit, SSH#ssh.s_keyinit,
+			 ssh_message:encode_host_key(Key), Q_c, Q_s, K],
+			[string,string,binary,binary,binary,
+			 mpint,mpint,mpint]),
+    crypto:hash(sha(Curve), L).
 
 kex_h(SSH, Key, Min, NBits, Max, Prime, Gen, E, F, K) ->
     L = if Min==-1; Max==-1 ->
@@ -1199,6 +1303,14 @@ kex_h(SSH, Key, Min, NBits, Max, Prime, Gen, E, F, K) ->
 	end,
     crypto:hash(sha((SSH#ssh.algorithms)#alg.kex), L).
   
+sha('nistp256') -> sha256;
+sha('secp256r1')-> sha256;
+sha('nistp384') -> sha384;
+sha('secp384r1')-> sha384;
+sha('nistp521') -> sha512;
+sha('secp521r1')-> sha512;
+sha('diffie-hellman-group1-sha1') -> sha;
+sha('diffie-hellman-group14-sha1') -> sha;
 sha('diffie-hellman-group-exchange-sha1')   -> sha;
 sha('diffie-hellman-group-exchange-sha256') -> sha256.
 
@@ -1207,6 +1319,7 @@ mac_key_size('hmac-sha1-96') -> 20*8;
 mac_key_size('hmac-md5')     -> 16*8;
 mac_key_size('hmac-md5-96')  -> 16*8;
 mac_key_size('hmac-sha2-256')-> 32*8;
+mac_key_size('hmac-sha2-512')-> 512;
 mac_key_size(none) -> 0.
 
 mac_digest_size('hmac-sha1')    -> 20;
@@ -1214,6 +1327,7 @@ mac_digest_size('hmac-sha1-96') -> 12;
 mac_digest_size('hmac-md5')    -> 20;
 mac_digest_size('hmac-md5-96') -> 12;
 mac_digest_size('hmac-sha2-256') -> 32;
+mac_digest_size('hmac-sha2-512') -> 64;
 mac_digest_size(none) -> 0.
 
 peer_name({Host, _}) ->
@@ -1267,14 +1381,19 @@ dh_gex_group(Min, N, Max, Groups) ->
     end.
 
 
-dh_gen_key(G, P, _) ->
-    {Public, Private} = crypto:generate_key(dh, [P, G]),
-    {crypto:bytes_to_integer(Private), crypto:bytes_to_integer(Public)}.
+generate_key(Algorithm, Args) ->
+    {Public,Private} = crypto:generate_key(Algorithm, Args),
+    {crypto:bytes_to_integer(Public), crypto:bytes_to_integer(Private)}.
+
+      
+compute_key(Algorithm, OthersPublic, MyPrivate, Args) ->
+    Shared = crypto:compute_key(Algorithm, OthersPublic, MyPrivate, Args),
+    crypto:bytes_to_integer(Shared).
+
 
-dh_compute_key(G, P, OthersPublic, MyPrivate) ->
-    crypto:bytes_to_integer(
-      crypto:compute_key(dh, OthersPublic, MyPrivate, [P,G])
-     ).
+ecdh_curve('ecdh-sha2-nistp256') -> secp256r1;
+ecdh_curve('ecdh-sha2-nistp384') -> secp384r1;
+ecdh_curve('ecdh-sha2-nistp521') -> secp521r1.
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %%
diff --git a/lib/ssh/src/ssh_transport.hrl b/lib/ssh/src/ssh_transport.hrl
index 9e1de171c2..e6449e93c5 100644
--- a/lib/ssh/src/ssh_transport.hrl
+++ b/lib/ssh/src/ssh_transport.hrl
@@ -29,9 +29,6 @@
 
 -define(DEFAULT_CLIENT_VERSION, {2, 0}).
 -define(DEFAULT_SERVER_VERSION, {2, 0}).
--define(DEFAULT_DH_GROUP_MIN, 512).
--define(DEFAULT_DH_GROUP_NBITS, 1024).
--define(DEFAULT_DH_GROUP_MAX,  4096).
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %%
@@ -109,8 +106,8 @@
 %%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
-%% diffie-hellman-group1-sha1
--define(SSH_MSG_KEXDH_INIT,  30).
+%% diffie-hellman-group1-sha1 | diffie-hellman-group14-sha1
+-define(SSH_MSG_KEXDH_INIT,   30).
 -define(SSH_MSG_KEXDH_REPLY,  31).
 
 -record(ssh_msg_kexdh_init,
@@ -134,7 +131,11 @@
 %%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
-%% diffie-hellman-group-exchange-sha1
+%% diffie-hellman-group-exchange-sha1 | diffie-hellman-group-exchange-sha256
+-define(DEFAULT_DH_GROUP_MIN,    512).
+-define(DEFAULT_DH_GROUP_NBITS, 1024).
+-define(DEFAULT_DH_GROUP_MAX,   4096).
+
 -define(SSH_MSG_KEX_DH_GEX_REQUEST_OLD, 30).
 -define(SSH_MSG_KEX_DH_GEX_REQUEST,     34).
 -define(SSH_MSG_KEX_DH_GEX_GROUP,       31).
@@ -171,7 +172,36 @@
 	  h_sig
 	 }).
 
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%
+%% KEY ECDH messages
+%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%% ecdh-sha2-nistp256 | ecdh-sha2-nistp384 | ecdh-sha2-nistp521
+
+-define(SSH_MSG_KEX_ECDH_INIT,                30).
+-define(SSH_MSG_KEX_ECDH_REPLY,               31).
+
+-record(ssh_msg_kex_ecdh_init,
+	{
+	  q_c    % string (client's ephemeral public key octet string)
+	}).
+
+-record(ssh_msg_kex_ecdh_reply,
+	{
+	  public_host_key,   % string (server's public host key) (k_s)
+	  q_s,               % string (server's ephemeral public key octet string)
+	  h_sig              % string (the signature on the exchange hash)
+	}).
+
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%
 %% error codes
+%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
 -define(SSH_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT,   1).
 -define(SSH_DISCONNECT_PROTOCOL_ERROR,   2).
 -define(SSH_DISCONNECT_KEY_EXCHANGE_FAILED,   3).
@@ -188,7 +218,12 @@
 -define(SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,  14).
 -define(SSH_DISCONNECT_ILLEGAL_USER_NAME,  15).
 
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%
 %% groups
+%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
 %%% rfc 2489, ch 6.2
 -define(dh_group1,
diff --git a/lib/ssh/test/ssh_basic_SUITE.erl b/lib/ssh/test/ssh_basic_SUITE.erl
index 6dfff945ac..27b611780d 100644
--- a/lib/ssh/test/ssh_basic_SUITE.erl
+++ b/lib/ssh/test/ssh_basic_SUITE.erl
@@ -96,7 +96,10 @@ groups() ->
      {key_exchange, [], ['diffie-hellman-group-exchange-sha1',
 			 'diffie-hellman-group-exchange-sha256',
 			 'diffie-hellman-group1-sha1',
-			 'diffie-hellman-group14-sha1'
+			 'diffie-hellman-group14-sha1',
+			 'ecdh-sha2-nistp256',
+			 'ecdh-sha2-nistp384',
+			 'ecdh-sha2-nistp521'
 			]},
      {dir_options, [], [user_dir_option,
 			system_dir_option]}
@@ -845,6 +848,15 @@ ssh_msg_debug_fun_option_client(Config) ->
 'diffie-hellman-group14-sha1'(Config) ->
     kextest('diffie-hellman-group14-sha1',Config).
 
+'ecdh-sha2-nistp256'(Config) ->
+    kextest('ecdh-sha2-nistp256',Config).
+
+'ecdh-sha2-nistp384'(Config) ->
+    kextest('ecdh-sha2-nistp384',Config).
+
+'ecdh-sha2-nistp521'(Config) ->
+    kextest('ecdh-sha2-nistp521',Config).
+
 
 kextest(Kex, Config) ->
     case lists:member(Kex, ssh_transport:supported_algorithms(kex)) of
diff --git a/lib/ssh/test/ssh_protocol_SUITE.erl b/lib/ssh/test/ssh_protocol_SUITE.erl
index dc02b940d7..132be3beb2 100644
--- a/lib/ssh/test/ssh_protocol_SUITE.erl
+++ b/lib/ssh/test/ssh_protocol_SUITE.erl
@@ -115,7 +115,8 @@ lib_works_as_client(Config) ->
 	  [{set_options, [print_ops, print_seqnums, print_messages]},
 	   {connect,
 	    server_host(Config),server_port(Config),
-	    [{silently_accept_hosts, true},
+	    [{preferred_algorithms,[{kex,['diffie-hellman-group1-sha1']}]},
+	     {silently_accept_hosts, true},
 	     {user_dir, user_dir(Config)},
 	     {user_interaction, false}]},
 	   receive_hello,
@@ -207,7 +208,9 @@ lib_works_as_server(Config) ->
       end),
 
     %% and finally connect to it with a regular Erlang SSH client:
-    {ok,_} = std_connect(HostPort, Config).
+    {ok,_} = std_connect(HostPort, Config, 
+			 [{preferred_algorithms,[{kex,['diffie-hellman-group1-sha1']}]}]
+			).
 
 %%--------------------------------------------------------------------
 %%% Matching
@@ -449,24 +452,24 @@ server_user_password(N, Config) -> lists:nth(N, ?v(user_passwords,Config)).
     
 
 std_connect(Config) -> 
-    {User,Pwd} = server_user_password(Config),
-    std_connect(server_host(Config), server_port(Config),
-		Config,
-		[{user,User},{password,Pwd}]).
+    std_connect({server_host(Config), server_port(Config)}, Config).
     
 std_connect({Host,Port}, Config) ->
-    {User,Pwd} = server_user_password(Config),
-    std_connect(Host, Port, Config, [{user,User},{password,Pwd}]).
+    std_connect({Host,Port}, Config, []).
 
 std_connect({Host,Port}, Config, Opts) ->
     std_connect(Host, Port, Config, Opts).
 
 std_connect(Host, Port, Config, Opts) ->
+    {User,Pwd} = server_user_password(Config),
     ssh:connect(Host, Port, 
-		[{silently_accept_hosts, true},
-		 {user_dir, user_dir(Config)},
-		 {user_interaction, false} | Opts],
+		%% Prefere User's Opts to the default opts
+		[O || O = {Tag,_} <- [{user,User},{password,Pwd},
+				      {silently_accept_hosts, true},
+				      {user_dir, user_dir(Config)},
+				      {user_interaction, false}],
+		      not lists:keymember(Tag, 1, Opts)
+		] ++ Opts,
 		30000).
     
-
 %%%----------------------------------------------------------------	
diff --git a/lib/ssh/test/ssh_to_openssh_SUITE.erl b/lib/ssh/test/ssh_to_openssh_SUITE.erl
index 06bf264033..663168b169 100644
--- a/lib/ssh/test/ssh_to_openssh_SUITE.erl
+++ b/lib/ssh/test/ssh_to_openssh_SUITE.erl
@@ -204,6 +204,7 @@ erlang_client_openssh_server_kexs(Config) when is_list(Config) ->
     Success =
 	lists:foldl(
 	  fun(Kex, Acc) ->
+		  ct:log("============= ~p ============= ~p",[Kex,Acc]),
 		  ConnectionRef = 
 		      ssh_test_lib:connect(?SSH_DEFAULT_PORT, [{silently_accept_hosts, true},
 							       {user_interaction, false},
@@ -228,13 +229,14 @@ erlang_client_openssh_server_kexs(Config) when is_list(Config) ->
 			  Acc;
 		      Other ->
 			  ct:log("~p failed: ~p",[Kex,Other]),
-			  false
+			  [Kex|Acc]
 		  end
-	  end, true, ssh_transport:supported_algorithms(kex)),
+	  end, [], ssh_transport:supported_algorithms(kex)),
     case Success of
-	true ->
+	[] ->
 	    ok;
-	false ->
+	BadKex ->
+	    ct:log("Bad kex algos: ~p",[BadKex]),
 	    {fail, "Kex failed for one or more algos"}
     end.
 
@@ -412,7 +414,7 @@ erlang_server_openssh_client_kexs(Config) when is_list(Config) ->
 				  Acc
 			  after ?TIMEOUT ->
 				  ct:log("Did not receive answer for ~p",[Kex]),
-				  false
+				  [Kex|Acc]
 			  end;
 		      false ->
 			  receive
@@ -420,17 +422,18 @@ erlang_server_openssh_client_kexs(Config) when is_list(Config) ->
 				  Acc
 			  after ?TIMEOUT ->
 				  ct:log("Did not receive no matching kex message for ~p",[Kex]),
-				  false
+				  [Kex|Acc]
 			  end
 		  end
-	  end, true, Kexs),
+	  end, [], Kexs),
     
     ssh:stop_daemon(Pid),
 
     case Success of
-	true ->
+	[] ->
 	    ok;
-	false ->
+	BadKex ->
+	    ct:log("Bad kex algos: ~p",[BadKex]),
 	    {fail, "Kex failed for one or more algos"}
     end.
 	
diff --git a/lib/ssh/test/ssh_trpt_test_lib.erl b/lib/ssh/test/ssh_trpt_test_lib.erl
index 38b2789742..66df890f5c 100644
--- a/lib/ssh/test/ssh_trpt_test_lib.erl
+++ b/lib/ssh/test/ssh_trpt_test_lib.erl
@@ -533,7 +533,7 @@ receive_binary_msg(S0=#s{ssh=C0=#ssh{decrypt_block_size = BlockSize,
 	    <<Mac:MacSize/binary, Rest/binary>> = EncRest,
 
 	    case {ssh_transport:is_valid_mac(Mac, SshPacket, C2),
-		  catch ssh_message:decode(Payload)}
+		  catch ssh_message:decode(set_prefix_if_trouble(Payload,S1))}
 	    of
 		{false,         _} -> fail(bad_mac,S1);
 		{_,    {'EXIT',_}} -> fail(decode_failed,S1);
@@ -557,6 +557,24 @@ receive_binary_msg(S0=#s{ssh=C0=#ssh{decrypt_block_size = BlockSize,
     end.
 
 
+set_prefix_if_trouble(Msg = <<?BYTE(Op),_/binary>>, #s{alg=#alg{kex=Kex}})
+  when Op == 30;
+       Op == 31
+       ->
+    case catch atom_to_list(Kex) of
+	"ecdh-sha2-" ++ _ -> 
+	    <<"ecdh",Msg/binary>>;
+	"diffie-hellman-group-exchange-" ++ _ ->
+	    <<"dh_gex",Msg/binary>>;
+	"diffie-hellman-group" ++ _ ->
+	    <<"dh",Msg/binary>>;
+	_ -> 
+	    Msg
+    end;
+set_prefix_if_trouble(Msg, _) ->
+    Msg.
+
+
 receive_poll(S=#s{socket=Sock}) -> 
     inet:setopts(Sock, [{active,once}]),
     receive