Moved host verification tests to JUnit5

* adds fallback to posix-rename@openssh.com extension if possible and communicates possible problems with flags to the developer

* Adds '{}' around if/else statements

* adds basic tests for file rename

* fix comments

* fixes indentation

* adds helper methods to make existing sftp rename tests more concise

* adds basic test for atomic rewrite

* adds possibility to request a specific client version (e.g. for testing purposes)

* adds testcases for SFTP rename flags fallback behaviour

* refactoring to make SFTPEngine.init(int requestedVersion) protected

---------

Co-authored-by: Florian Klemenz <florian.klemenz@fau.de>
Co-authored-by: Jeroen van Erp <jeroen@hierynomus.com>

README.adoc

@@ -1,7 +1,7 @@
 = sshj - SSHv2 library for Java
 Jeroen van Erp
 :sshj_groupid: com.hierynomus
-:sshj_version: 0.36.0
+:sshj_version: 0.37.0
 :source-highlighter: pygments
 
 image:https://github.com/hierynomus/sshj/actions/workflows/gradle.yml/badge.svg[link="https://github.com/hierynomus/sshj/actions/workflows/gradle.yml"]
@@ -108,6 +108,10 @@ Issue tracker: https://github.com/hierynomus/sshj/issues
 Fork away!
 
 == Release history
+SSHJ 0.37.0 (2023-10-11)::
+* Merged https://github.com/hierynomus/sshj/pull/899[#899]: Add support for AES-GCM OpenSSH private keys
+* Merged https://github.com/hierynomus/sshj/pull/901[#901]: Fix ZLib compression bug
+* Merged https://github.com/hierynomus/sshj/pull/898[#898]: Improved malformed file handling for OpenSSH private keys
 SSHJ 0.36.0 (2023-09-04)::
 * Rewrote Integration tests to JUnit5
 * Merged https://github.com/hierynomus/sshj/pull/851[#851]: Fix race condition in key exchange causing intermittent SSH_MSG_UNIMPLEMENTED

examples/pom.xml

@@ -24,7 +24,7 @@
     <groupId>com.hierynomus</groupId>
     <artifactId>sshj-examples</artifactId>
     <packaging>jar</packaging>
-    <version>0.33.0</version>
+    <version>0.37.0</version>
 
     <name>sshj-examples</name>
     <description>Examples for SSHv2 library for Java</description>

src/itest/java/com/hierynomus/sshj/SshdContainer.java

@@ -214,6 +214,9 @@ public class SshdContainer extends GenericContainer<SshdContainer> {
                 case STDERR:
                     logger().info("sshd stderr: {}", outputFrame.getUtf8String().stripTrailing());
                     break;
+                case END:
+                    break;
+
             }
         });
     }

src/itest/java/com/hierynomus/sshj/sftp/PutFileCompressedTest.java

@@ -0,0 +1,81 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj.sftp;
+
+import com.hierynomus.sshj.SshdContainer;
+import net.schmizz.sshj.SSHClient;
+import net.schmizz.sshj.sftp.SFTPClient;
+import net.schmizz.sshj.xfer.InMemorySourceFile;
+import org.junit.jupiter.api.Test;
+import org.testcontainers.junit.jupiter.Container;
+import org.testcontainers.junit.jupiter.Testcontainers;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Random;
+
+@Testcontainers
+public class PutFileCompressedTest {
+
+    private static class TestInMemorySourceFile extends InMemorySourceFile {
+
+        private final String name;
+        private final byte[] data;
+
+        public TestInMemorySourceFile(String name, byte[] data) {
+            this.name = name;
+            this.data = data;
+        }
+
+        @Override
+        public String getName() {
+            return name;
+        }
+
+        @Override
+        public long getLength() {
+            return data.length;
+        }
+
+        @Override
+        public InputStream getInputStream() throws IOException {
+            return new ByteArrayInputStream(data);
+        }
+
+    }
+
+    @Container
+    private static SshdContainer sshd = new SshdContainer();
+
+    @Test
+    public void shouldPutCompressedFile_GH893() throws Throwable {
+        try (SSHClient client = sshd.getConnectedClient()) {
+            client.authPublickey("sshj", "src/test/resources/id_rsa");
+            client.useCompression();
+            try (SFTPClient sftp = client.newSFTPClient()) {
+                String filename = "test.txt";
+                // needs to be a larger file for bug taking effect
+                byte[] content = new byte[5000];
+                Random r = new Random(1);
+                r.nextBytes(content);
+
+                sftp.put(new TestInMemorySourceFile(filename,content), "/home/sshj/");
+            }
+
+        }
+    }
+}

src/itest/java/com/hierynomus/sshj/signature/HostKeyWithCertificateTest.java

@@ -26,7 +26,6 @@ import org.junit.jupiter.params.provider.ValueSource;
 import com.hierynomus.sshj.SshdContainer;
 import com.hierynomus.sshj.SshdContainer.SshdConfigBuilder;
 
-import net.schmizz.sshj.Config;
 import net.schmizz.sshj.DefaultConfig;
 import net.schmizz.sshj.SSHClient;
 import net.schmizz.sshj.transport.verification.OpenSSHKnownHosts;

src/itest/java/com/hierynomus/sshj/transport/kex/KexTest.java

@@ -26,7 +26,6 @@ import org.testcontainers.junit.jupiter.Container;
 import org.testcontainers.junit.jupiter.Testcontainers;
 
 import com.hierynomus.sshj.SshdContainer;
-import com.hierynomus.sshj.transport.mac.Macs;
 
 import net.schmizz.sshj.Config;
 import net.schmizz.sshj.DefaultConfig;

src/main/java/com/hierynomus/sshj/key/KeyAlgorithms.java

@@ -22,9 +22,6 @@ import net.schmizz.sshj.signature.SignatureDSA;
 import net.schmizz.sshj.signature.SignatureECDSA;
 import net.schmizz.sshj.signature.SignatureRSA;
 
-import java.util.Arrays;
-import java.util.List;
-
 public class KeyAlgorithms {
 
     public static Factory SSHRSA() { return new Factory("ssh-rsa", new SignatureRSA.FactorySSHRSA(), KeyType.RSA); }

src/main/java/com/hierynomus/sshj/transport/cipher/ChachaPolyCipher.java

@@ -16,9 +16,8 @@
 package com.hierynomus.sshj.transport.cipher;
 
 import java.security.GeneralSecurityException;
-import java.security.InvalidAlgorithmParameterException;
-import java.security.InvalidKeyException;
 
+import java.security.MessageDigest;
 import java.security.spec.AlgorithmParameterSpec;
 import java.util.Arrays;
 import javax.crypto.spec.IvParameterSpec;
@@ -82,8 +81,7 @@ public class ChachaPolyCipher extends BaseCipher {
     }
 
     @Override
-    protected void initCipher(javax.crypto.Cipher cipher, Mode mode, byte[] key, byte[] iv)
-            throws InvalidKeyException, InvalidAlgorithmParameterException {
+    protected void initCipher(javax.crypto.Cipher cipher, Mode mode, byte[] key, byte[] iv) {
         this.mode = mode;
 
         cipherKey = getKeySpec(Arrays.copyOfRange(key, 0, CHACHA_KEY_SIZE));
@@ -127,28 +125,34 @@ public class ChachaPolyCipher extends BaseCipher {
 
     @Override
     public void update(byte[] input, int inputOffset, int inputLen) {
-        if (inputOffset != AAD_LENGTH) {
+        if (inputOffset != 0 && inputOffset != AAD_LENGTH) {
             throw new IllegalArgumentException("updateAAD called with inputOffset " + inputOffset);
         }
 
-        final int macInputLength = AAD_LENGTH + inputLen;
-
+        final int macInputLength = inputOffset + inputLen;
         if (mode == Mode.Decrypt) {
-            byte[] macInput = new byte[macInputLength];
-            System.arraycopy(encryptedAad, 0, macInput, 0, AAD_LENGTH);
-            System.arraycopy(input, AAD_LENGTH, macInput, AAD_LENGTH, inputLen);
+            final byte[] macInput = new byte[macInputLength];
 
-            byte[] expectedPolyTag = mac.doFinal(macInput);
-            byte[] actualPolyTag = Arrays.copyOfRange(input, macInputLength, macInputLength + POLY_TAG_LENGTH);
-            if (!Arrays.equals(actualPolyTag, expectedPolyTag)) {
+            if (inputOffset == 0) {
+                // Handle decryption without AAD
+                System.arraycopy(input, 0, macInput, 0, inputLen);
+            } else {
+                // Handle decryption with previous AAD from updateAAD()
+                System.arraycopy(encryptedAad, 0, macInput, 0, AAD_LENGTH);
+                System.arraycopy(input, AAD_LENGTH, macInput, AAD_LENGTH, inputLen);
+            }
+
+            final byte[] expectedPolyTag = mac.doFinal(macInput);
+            final byte[] actualPolyTag = Arrays.copyOfRange(input, macInputLength, macInputLength + POLY_TAG_LENGTH);
+            if (!MessageDigest.isEqual(actualPolyTag, expectedPolyTag)) {
                 throw new SSHRuntimeException("MAC Error");
             }
         }
 
         try {
-            cipher.update(input, AAD_LENGTH, inputLen, input, AAD_LENGTH);
+            cipher.update(input, inputOffset, inputLen, input, inputOffset);
         } catch (GeneralSecurityException e) {
-            throw new SSHRuntimeException("Error updating data through cipher", e);
+            throw new SSHRuntimeException("ChaCha20 cipher processing failed", e);
         }
 
         if (mode == Mode.Encrypt) {

src/main/java/com/hierynomus/sshj/userauth/keyprovider/OpenSSHKeyV1KeyFile.java

@@ -18,6 +18,8 @@ package com.hierynomus.sshj.userauth.keyprovider;
 import com.hierynomus.sshj.common.KeyAlgorithm;
 import com.hierynomus.sshj.common.KeyDecryptionFailedException;
 import com.hierynomus.sshj.transport.cipher.BlockCiphers;
+import com.hierynomus.sshj.transport.cipher.ChachaPolyCiphers;
+import com.hierynomus.sshj.transport.cipher.GcmCiphers;
 import net.i2p.crypto.eddsa.EdDSAPrivateKey;
 import net.i2p.crypto.eddsa.spec.EdDSANamedCurveTable;
 import net.i2p.crypto.eddsa.spec.EdDSAPrivateKeySpec;
@@ -36,6 +38,7 @@ import org.bouncycastle.asn1.nist.NISTNamedCurves;
 import org.bouncycastle.asn1.x9.X9ECParameters;
 import org.bouncycastle.jce.spec.ECNamedCurveSpec;
 import com.hierynomus.sshj.userauth.keyprovider.bcrypt.BCrypt;
+import org.bouncycastle.openssl.EncryptionException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -47,24 +50,43 @@ import java.io.Reader;
 import java.math.BigInteger;
 import java.nio.ByteBuffer;
 import java.nio.CharBuffer;
-import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
 import java.security.*;
 import java.security.spec.ECPrivateKeySpec;
 import java.security.spec.RSAPrivateCrtKeySpec;
 import java.util.Arrays;
 import java.util.Base64;
+import java.util.HashMap;
+import java.util.Map;
 
 /**
  * Reads a key file in the new OpenSSH format.
  * The format is described in the following document: https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.key
  */
 public class OpenSSHKeyV1KeyFile extends BaseFileKeyProvider {
-    private static final Logger logger = LoggerFactory.getLogger(OpenSSHKeyV1KeyFile.class);
     private static final String BEGIN = "-----BEGIN ";
     private static final String END = "-----END ";
     private static final byte[] AUTH_MAGIC = "openssh-key-v1\0".getBytes();
     public static final String OPENSSH_PRIVATE_KEY = "OPENSSH PRIVATE KEY-----";
     public static final String BCRYPT = "bcrypt";
+
+    private static final String NONE_CIPHER = "none";
+
+    private static final Map<String, Factory.Named<Cipher>> SUPPORTED_CIPHERS = new HashMap<>();
+
+    static {
+        SUPPORTED_CIPHERS.put(BlockCiphers.TripleDESCBC().getName(), BlockCiphers.TripleDESCBC());
+        SUPPORTED_CIPHERS.put(BlockCiphers.AES128CBC().getName(), BlockCiphers.AES128CBC());
+        SUPPORTED_CIPHERS.put(BlockCiphers.AES192CBC().getName(), BlockCiphers.AES192CBC());
+        SUPPORTED_CIPHERS.put(BlockCiphers.AES256CBC().getName(), BlockCiphers.AES256CBC());
+        SUPPORTED_CIPHERS.put(BlockCiphers.AES128CTR().getName(), BlockCiphers.AES128CTR());
+        SUPPORTED_CIPHERS.put(BlockCiphers.AES192CTR().getName(), BlockCiphers.AES192CTR());
+        SUPPORTED_CIPHERS.put(BlockCiphers.AES256CTR().getName(), BlockCiphers.AES256CTR());
+        SUPPORTED_CIPHERS.put(GcmCiphers.AES256GCM().getName(), GcmCiphers.AES256GCM());
+        SUPPORTED_CIPHERS.put(GcmCiphers.AES128GCM().getName(), GcmCiphers.AES128GCM());
+        SUPPORTED_CIPHERS.put(ChachaPolyCiphers.CHACHA_POLY_OPENSSH().getName(), ChachaPolyCiphers.CHACHA_POLY_OPENSSH());
+    }
+
     private PublicKey pubKey;
 
     public static class Factory
@@ -98,19 +120,19 @@ public class OpenSSHKeyV1KeyFile extends BaseFileKeyProvider {
 
     @Override
     protected KeyPair readKeyPair() throws IOException {
-        BufferedReader reader = new BufferedReader(resource.getReader());
+        final BufferedReader reader = new BufferedReader(resource.getReader());
         try {
-            if (!checkHeader(reader)) {
-                throw new IOException("This key is not in 'openssh-key-v1' format");
+            if (checkHeader(reader)) {
+                final String encodedPrivateKey = readEncodedKey(reader);
+                byte[] decodedPrivateKey = Base64.getDecoder().decode(encodedPrivateKey);
+                final PlainBuffer bufferedPrivateKey = new PlainBuffer(decodedPrivateKey);
+                return readDecodedKeyPair(bufferedPrivateKey);
+            } else {
+                final String message = String.format("File header not found [%s%s]", BEGIN, OPENSSH_PRIVATE_KEY);
+                throw new IOException(message);
             }
-
-            String keyFile = readKeyFile(reader);
-            byte[] decode = Base64.getDecoder().decode(keyFile);
-            PlainBuffer keyBuffer = new PlainBuffer(decode);
-            return readDecodedKeyPair(keyBuffer);
-
-        } catch (GeneralSecurityException e) {
-            throw new SSHRuntimeException(e);
+        } catch (final GeneralSecurityException e) {
+            throw new SSHRuntimeException("Read OpenSSH Version 1 Key failed", e);
         } finally {
             IOUtils.closeQuietly(reader);
         }
@@ -135,88 +157,143 @@ public class OpenSSHKeyV1KeyFile extends BaseFileKeyProvider {
 
         int nrKeys = keyBuffer.readUInt32AsInt(); // int number of keys N; Should be 1
         if (nrKeys != 1) {
-            throw new IOException("We don't support having more than 1 key in the file (yet).");
+            final String message = String.format("OpenSSH Private Key number of keys not supported [%d]", nrKeys);
+            throw new IOException(message);
         }
         PublicKey publicKey = pubKey;
         if (publicKey == null) {
             publicKey = readPublicKey(new PlainBuffer(keyBuffer.readBytes()));
-        }
-        else {
+        } else {
             keyBuffer.readBytes();
         }
-        PlainBuffer privateKeyBuffer = new PlainBuffer(keyBuffer.readBytes()); // string (possibly) encrypted, padded list of private keys
-        if ("none".equals(cipherName)) {
-            logger.debug("Reading unencrypted keypair");
+
+        final byte[] privateKeyEncoded = keyBuffer.readBytes();
+        final PlainBuffer privateKeyBuffer = new PlainBuffer(privateKeyEncoded);
+
+        if (NONE_CIPHER.equals(cipherName)) {
             return readUnencrypted(privateKeyBuffer, publicKey);
         } else {
-            logger.info("Keypair is encrypted with: " + cipherName + ", " + kdfName + ", " + Arrays.toString(kdfOptions));
+            final byte[] encryptedPrivateKey = readEncryptedPrivateKey(privateKeyEncoded, keyBuffer);
             while (true) {
-                PlainBuffer decryptionBuffer = new PlainBuffer(privateKeyBuffer);
-                PlainBuffer decrypted = decryptBuffer(decryptionBuffer, cipherName, kdfName, kdfOptions);
+                final byte[] encrypted = encryptedPrivateKey.clone();
                 try {
+                    final PlainBuffer decrypted = decryptPrivateKey(encrypted, privateKeyEncoded.length, cipherName, kdfName, kdfOptions);
                     return readUnencrypted(decrypted, publicKey);
                 } catch (KeyDecryptionFailedException e) {
                     if (pwdf == null || !pwdf.shouldRetry(resource))
                         throw e;
                 }
             }
-//            throw new IOException("Cannot read encrypted keypair with " + cipherName + " yet.");
         }
     }
 
-    private PlainBuffer decryptBuffer(PlainBuffer privateKeyBuffer, String cipherName, String kdfName, byte[] kdfOptions) throws IOException {
-        Cipher cipher = createCipher(cipherName);
-        initializeCipher(kdfName, kdfOptions, cipher);
-        byte[] array = privateKeyBuffer.array();
-        cipher.update(array, 0, privateKeyBuffer.available());
-        return new PlainBuffer(array);
+    private byte[] readEncryptedPrivateKey(final byte[] privateKeyEncoded, final PlainBuffer inputBuffer) throws Buffer.BufferException {
+        final byte[] encryptedPrivateKey;
+
+        final int bufferRemaining = inputBuffer.available();
+        if (bufferRemaining == 0) {
+            encryptedPrivateKey = privateKeyEncoded;
+        } else {
+            // Read Authentication Tag for AES-GCM or ChaCha20-Poly1305
+            final byte[] authenticationTag = new byte[bufferRemaining];
+            inputBuffer.readRawBytes(authenticationTag);
+
+            final int encryptedBufferLength = privateKeyEncoded.length + authenticationTag.length;
+            final PlainBuffer encryptedBuffer = new PlainBuffer(encryptedBufferLength);
+            encryptedBuffer.putRawBytes(privateKeyEncoded);
+            encryptedBuffer.putRawBytes(authenticationTag);
+
+            encryptedPrivateKey = new byte[encryptedBufferLength];
+            encryptedBuffer.readRawBytes(encryptedPrivateKey);
+        }
+
+        return encryptedPrivateKey;
     }
 
-    private void initializeCipher(String kdfName, byte[] kdfOptions, Cipher cipher) throws Buffer.BufferException {
+    private PlainBuffer decryptPrivateKey(final byte[] privateKey, final int privateKeyLength, final String cipherName, final String kdfName, final byte[] kdfOptions) throws IOException {
+        try {
+            final Cipher cipher = createCipher(cipherName);
+            initializeCipher(kdfName, kdfOptions, cipher);
+            cipher.update(privateKey, 0, privateKeyLength);
+        } catch (final SSHRuntimeException e) {
+            final String message = String.format("OpenSSH Private Key decryption failed with cipher [%s]", cipherName);
+            throw new KeyDecryptionFailedException(new EncryptionException(message, e));
+        }
+        final PlainBuffer decryptedPrivateKey = new PlainBuffer(privateKeyLength);
+        decryptedPrivateKey.putRawBytes(privateKey, 0, privateKeyLength);
+        return decryptedPrivateKey;
+    }
+
+    private void initializeCipher(final String kdfName, final byte[] kdfOptions, final Cipher cipher) throws Buffer.BufferException {
         if (kdfName.equals(BCRYPT)) {
-            PlainBuffer opts = new PlainBuffer(kdfOptions);
+            final PlainBuffer bufferedOptions = new PlainBuffer(kdfOptions);
             byte[] passphrase = new byte[0];
             if (pwdf != null) {
-                CharBuffer charBuffer = CharBuffer.wrap(pwdf.reqPassword(null));
-                ByteBuffer byteBuffer = Charset.forName("UTF-8").encode(charBuffer);
+                final CharBuffer charBuffer = CharBuffer.wrap(pwdf.reqPassword(null));
+                final ByteBuffer byteBuffer = StandardCharsets.UTF_8.encode(charBuffer);
                 passphrase = Arrays.copyOfRange(byteBuffer.array(), byteBuffer.position(), byteBuffer.limit());
                 Arrays.fill(charBuffer.array(), '\u0000');
                 Arrays.fill(byteBuffer.array(), (byte) 0);
             }
-            byte[] keyiv = new byte[cipher.getIVSize()+ cipher.getBlockSize()];
-            new BCrypt().pbkdf(passphrase, opts.readBytes(), opts.readUInt32AsInt(), keyiv);
+
+            final int ivSize = cipher.getIVSize();
+            final int blockSize = cipher.getBlockSize();
+            final int parameterSize = ivSize + blockSize;
+            final byte[] keyIvParameters = new byte[parameterSize];
+
+            final byte[] salt = bufferedOptions.readBytes();
+            final int iterations = bufferedOptions.readUInt32AsInt();
+            new BCrypt().pbkdf(passphrase, salt, iterations, keyIvParameters);
             Arrays.fill(passphrase, (byte) 0);
-            byte[] key = Arrays.copyOfRange(keyiv, 0, cipher.getBlockSize());
-            byte[] iv = Arrays.copyOfRange(keyiv, cipher.getBlockSize(), cipher.getIVSize() + cipher.getBlockSize());
+
+            final byte[] key = Arrays.copyOfRange(keyIvParameters, 0, blockSize);
+            final byte[] iv = Arrays.copyOfRange(keyIvParameters, blockSize, parameterSize);
+
             cipher.init(Cipher.Mode.Decrypt, key, iv);
         } else {
-            throw new IllegalStateException("No support for KDF '" + kdfName + "'.");
+            final String message = String.format("OpenSSH Private Key encryption KDF not supported [%s]", kdfName);
+            throw new IllegalStateException(message);
         }
     }
 
-    private Cipher createCipher(String cipherName) {
-        if (cipherName.equals(BlockCiphers.AES256CTR().getName())) {
-            return BlockCiphers.AES256CTR().create();
-        } else if (cipherName.equals(BlockCiphers.AES256CBC().getName())) {
-            return BlockCiphers.AES256CBC().create();
-        } else if (cipherName.equals(BlockCiphers.AES128CBC().getName())) {
-            return BlockCiphers.AES128CBC().create();
+    private Cipher createCipher(final String cipherName) {
+        final Cipher cipher;
+
+        if (SUPPORTED_CIPHERS.containsKey(cipherName)) {
+            final Factory.Named<Cipher> cipherFactory = SUPPORTED_CIPHERS.get(cipherName);
+            cipher = cipherFactory.create();
+        } else {
+            final String message = String.format("OpenSSH Key encryption cipher not supported [%s]", cipherName);
+            throw new IllegalStateException(message);
         }
-        throw new IllegalStateException("Cipher '" + cipherName + "' not currently implemented for openssh-key-v1 format");
+
+        return cipher;
     }
 
     private PublicKey readPublicKey(final PlainBuffer plainBuffer) throws Buffer.BufferException, GeneralSecurityException {
         return KeyType.fromString(plainBuffer.readString()).readPubKeyFromBuffer(plainBuffer);
     }
 
-    private String readKeyFile(final BufferedReader reader) throws IOException {
-        StringBuilder sb = new StringBuilder();
+    private String readEncodedKey(final BufferedReader reader) throws IOException {
+        final StringBuilder builder = new StringBuilder();
+
+        boolean footerFound = false;
         String line = reader.readLine();
-        while (!line.startsWith(END)) {
-            sb.append(line);
+        while (line != null) {
+            if (line.startsWith(END)) {
+                footerFound = true;
+                break;
+            }
+            builder.append(line);
             line = reader.readLine();
         }
-        return sb.toString();
+
+        if (footerFound) {
+            return builder.toString();
+        } else {
+            final String message = String.format("File footer not found [%s%s]", END, OPENSSH_PRIVATE_KEY);
+            throw new IOException(message);
+        }
     }
 
     private boolean checkHeader(final BufferedReader reader) throws IOException {
@@ -239,12 +316,12 @@ public class OpenSSHKeyV1KeyFile extends BaseFileKeyProvider {
         int checkInt1 = keyBuffer.readUInt32AsInt(); // uint32 checkint1
         int checkInt2 = keyBuffer.readUInt32AsInt(); // uint32 checkint2
         if (checkInt1 != checkInt2) {
-            throw new KeyDecryptionFailedException();
+            throw new KeyDecryptionFailedException(new EncryptionException("OpenSSH Private Key integer comparison failed"));
         }
         // The private key section contains both the public key and the private key
         String keyType = keyBuffer.readString(); // string keytype
         KeyType kt = KeyType.fromString(keyType);
-        logger.info("Read key type: {}", keyType, kt);
+
         KeyPair kp;
         switch (kt) {
             case ED25519:

src/main/java/net/schmizz/sshj/SSHClient.java

@@ -28,7 +28,6 @@ import net.schmizz.sshj.connection.channel.forwarded.RemotePortForwarder.Forward
 import net.schmizz.sshj.connection.channel.forwarded.X11Forwarder;
 import net.schmizz.sshj.connection.channel.forwarded.X11Forwarder.X11Channel;
 import net.schmizz.sshj.sftp.SFTPClient;
-import net.schmizz.sshj.sftp.SFTPEngine;
 import net.schmizz.sshj.sftp.StatefulSFTPClient;
 import net.schmizz.sshj.transport.Transport;
 import net.schmizz.sshj.transport.TransportException;
@@ -733,7 +732,7 @@ public class SSHClient
             throws IOException {
         checkConnected();
         checkAuthenticated();
-        return new SFTPClient(new SFTPEngine(this).init());
+        return new SFTPClient(this);
     }
 
     /**
@@ -746,7 +745,7 @@ public class SSHClient
             throws IOException {
         checkConnected();
         checkAuthenticated();
-        return new StatefulSFTPClient(new SFTPEngine(this).init());
+        return new StatefulSFTPClient(this);
     }
 
     /**

src/main/java/net/schmizz/sshj/sftp/SFTPClient.java

@@ -15,6 +15,7 @@
  */
 package net.schmizz.sshj.sftp;
 
+import net.schmizz.sshj.connection.channel.direct.SessionFactory;
 import net.schmizz.sshj.xfer.FilePermission;
 import net.schmizz.sshj.xfer.LocalDestFile;
 import net.schmizz.sshj.xfer.LocalSourceFile;
@@ -39,6 +40,13 @@ public class SFTPClient
         this.xfer = new SFTPFileTransfer(engine);
     }
 
+    public SFTPClient(SessionFactory sessionFactory) throws IOException {
+        this.engine = new SFTPEngine(sessionFactory);
+        this.engine.init();
+        log = engine.getLoggerFactory().getLogger(getClass());
+        this.xfer = new SFTPFileTransfer(engine);
+    }
+
     public SFTPEngine getSFTPEngine() {
         return engine;
     }
@@ -232,7 +240,7 @@ public class SFTPClient
             throws IOException {
         xfer.download(source, dest);
     }
-    
+
     public void get(String source, String dest, long byteOffset)
             throws IOException {
         xfer.download(source, dest, byteOffset);
@@ -252,7 +260,7 @@ public class SFTPClient
             throws IOException {
         xfer.download(source, dest);
     }
-    
+
     public void get(String source, LocalDestFile dest, long byteOffset)
             throws IOException {
         xfer.download(source, dest, byteOffset);
@@ -262,7 +270,7 @@ public class SFTPClient
             throws IOException {
         xfer.upload(source, dest);
     }
-    
+
     public void put(LocalSourceFile source, String dest, long byteOffset)
             throws IOException {
         xfer.upload(source, dest, byteOffset);

src/main/java/net/schmizz/sshj/sftp/SFTPEngine.java

@@ -81,7 +81,23 @@ public class SFTPEngine
 
     public SFTPEngine init()
             throws IOException {
-        transmit(new SFTPPacket<Request>(PacketType.INIT).putUInt32(MAX_SUPPORTED_VERSION));
+        return init(MAX_SUPPORTED_VERSION);
+    }
+
+    /**
+     * Introduced for internal use by testcases.
+     * @param requestedVersion
+     * @throws IOException
+     */
+    protected SFTPEngine init(int requestedVersion)
+            throws IOException {
+        if (requestedVersion > MAX_SUPPORTED_VERSION)
+            throw new SFTPException("You requested an unsupported protocol version: " + requestedVersion + " (requested) > " + MAX_SUPPORTED_VERSION + " (supported)");
+
+        if (requestedVersion < MAX_SUPPORTED_VERSION)
+            log.debug("Client version {} is smaller than MAX_SUPPORTED_VERSION {}", requestedVersion, MAX_SUPPORTED_VERSION);
+
+        transmit(new SFTPPacket<Request>(PacketType.INIT).putUInt32(requestedVersion));
 
         final SFTPPacket<Response> response = reader.readPacket();
 
@@ -91,7 +107,7 @@ public class SFTPEngine
 
         operativeVersion = response.readUInt32AsInt();
         log.debug("Server version {}", operativeVersion);
-        if (MAX_SUPPORTED_VERSION < operativeVersion)
+        if (requestedVersion < operativeVersion)
             throw new SFTPException("Server reported incompatible protocol version: " + operativeVersion);
 
         while (response.available() > 0)
@@ -234,16 +250,75 @@ public class SFTPEngine
 
     public void rename(String oldPath, String newPath, Set<RenameFlags> flags)
             throws IOException {
-        if (operativeVersion < 1)
+        if (operativeVersion < 1) {
             throw new SFTPException("RENAME is not supported in SFTPv" + operativeVersion);
+        }
 
-        final Request request = newRequest(PacketType.RENAME).putString(oldPath, sub.getRemoteCharset()).putString(newPath, sub.getRemoteCharset());
-        // SFTP Version 5 introduced rename flags according to Section 6.5 of the specification
-        if (operativeVersion >= 5) {
-            long renameFlagMask = 0L;
-            for (RenameFlags flag : flags) {
-                renameFlagMask = renameFlagMask | flag.longValue();
+        // request variables to be determined
+        PacketType type = PacketType.RENAME; // Default
+        long renameFlagMask = 0L;
+        String serverExtension = null;
+
+        if (!flags.isEmpty()) {
+            // SFTP Version 5 introduced rename flags according to Section 6.5 of the specification
+            if (operativeVersion >= 5) {
+                for (RenameFlags flag : flags) {
+                    renameFlagMask = renameFlagMask | flag.longValue();
+                }
             }
+            // Try to find a fallback solution if flags are not supported by the server.
+
+            // "posix-rename@openssh.com" provides ATOMIC and OVERWRITE behaviour.
+            //  From the SFTP-spec, Section 6.5:
+            // "If SSH_FXP_RENAME_OVERWRITE is specified, the server MAY perform an atomic rename even if it is
+            // not requested."
+            // So, if overwrite is allowed we can always use the posix-rename as a fallback.
+            else if (flags.contains(RenameFlags.OVERWRITE) &&
+                    supportsServerExtension("posix-rename","openssh.com")) {
+
+                type = PacketType.EXTENDED;
+                serverExtension = "posix-rename@openssh.com";
+            }
+
+            // Because the OVERWRITE flag changes the behaviour in a possibly unintended way, it has to be
+            // explicitly requested for the above fallback to be applicable.
+            // Tell this to the developer if ATOMIC is requested without OVERWRITE.
+            else if (flags.contains(RenameFlags.ATOMIC) &&
+                    !flags.contains(RenameFlags.OVERWRITE) &&
+                    !flags.contains(RenameFlags.NATIVE) && // see next case below
+                    supportsServerExtension("posix-rename","openssh.com")) {
+                throw new SFTPException("RENAME-FLAGS are not supported in SFTPv" + operativeVersion + " but " +
+                            "the \"posix-rename@openssh.com\" extension could be used as fallback if OVERWRITE " +
+                            "behaviour is acceptable (needs to be activated via RenameFlags.OVERWRITE).");
+            }
+
+            // From the SFTP-spec, Section 6.5:
+            // "If flags includes SSH_FXP_RENAME_NATIVE, the server is free to do the rename operation in whatever
+            // fashion it deems appropriate. Other flag values are considered hints as to desired behavior, but not
+            // requirements."
+            else if (flags.contains(RenameFlags.NATIVE)) {
+                log.debug("Flags are not supported but NATIVE-flag allows to ignore other requested flags: " +
+                        flags.toString());
+            }
+
+            // finally: let the user know that the server does not support what was asked
+            else {
+                throw new SFTPException("RENAME-FLAGS are not supported in SFTPv" + operativeVersion + " and no " +
+                        "supported server extension could be found to achieve a similar result.");
+            }
+        }
+
+        // build and send request
+        final Request request = newRequest(type);
+
+        if (serverExtension != null) {
+            request.putString(serverExtension);
+        }
+
+        request.putString(oldPath, sub.getRemoteCharset())
+                .putString(newPath, sub.getRemoteCharset());
+
+        if (renameFlagMask != 0L) {
             request.putUInt32(renameFlagMask);
         }
 

src/main/java/net/schmizz/sshj/sftp/StatefulSFTPClient.java

@@ -15,6 +15,7 @@
  */
 package net.schmizz.sshj.sftp;
 
+import net.schmizz.sshj.connection.channel.direct.SessionFactory;
 import net.schmizz.sshj.xfer.LocalDestFile;
 import net.schmizz.sshj.xfer.LocalSourceFile;
 
@@ -34,6 +35,12 @@ public class StatefulSFTPClient
         log.debug("Start dir = {}", cwd);
     }
 
+    public StatefulSFTPClient(SessionFactory sessionFactory) throws IOException {
+        super(sessionFactory);
+        this.cwd = getSFTPEngine().canonicalize(".");
+        log.debug("Start dir = {}", cwd);
+    }
+
     private synchronized String cwdify(String path) {
         return engine.getPathHelper().adjustForParent(cwd, path);
     }

src/main/java/net/schmizz/sshj/transport/compression/ZlibCompression.java

@@ -22,7 +22,6 @@ import java.util.zip.Inflater;
 import net.schmizz.sshj.common.Buffer;
 import net.schmizz.sshj.common.DisconnectReason;
 import net.schmizz.sshj.transport.TransportException;
-import net.schmizz.sshj.transport.compression.Compression;
 
 public class ZlibCompression implements Compression {
 
@@ -71,10 +70,14 @@ public class ZlibCompression implements Compression {
     public void compress(Buffer buffer) {
         deflater.setInput(buffer.array(), buffer.rpos(), buffer.available());
         buffer.wpos(buffer.rpos());
-        do {
+        while (true) {
             final int len = deflater.deflate(tempBuf, 0, BUF_SIZE, Deflater.SYNC_FLUSH);
-            buffer.putRawBytes(tempBuf, 0, len);
-        } while (!deflater.needsInput());
+            if(len > 0) {
+                buffer.putRawBytes(tempBuf, 0, len);
+            } else {
+                return;
+            }
+        }
     }
 
     @Override

src/test/groovy/com/hierynomus/sshj/transport/verification/KnownHostMatchersSpec.groovy

@@ -1,59 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj.transport.verification
-
-import spock.lang.Specification
-import spock.lang.Unroll
-
-class KnownHostMatchersSpec extends Specification {
-
-    @Unroll
-    def "should #yesno match host #host with pattern #pattern"() {
-        given:
-        def matcher = KnownHostMatchers.createMatcher(pattern)
-
-        expect:
-        match == matcher.match(host)
-
-        where:
-        pattern       | host          | match
-        "aaa.bbb.com" | "aaa.bbb.com" | true
-        "aaa.bbb.com" | "aaa.ccc.com" | false
-        "*.bbb.com"   | "aaa.bbb.com" | true
-        "*.bbb.com"   | "aaa.ccc.com" | false
-        "aaa.*.com"   | "aaa.bbb.com" | true
-        "aaa.*.com"   | "aaa.ccc.com" | true
-        "aaa.bbb.*" | "aaa.bbb.com" | true
-        "aaa.bbb.*" | "aaa.ccc.com" | false
-        "!*.bbb.com" | "aaa.bbb.com" | false
-        "!*.bbb.com" | "aaa.ccc.com" | true
-        "aaa.bbb.com,!*.ccc.com" | "xxx.yyy.com" | true
-        "aaa.bbb.com,!*.ccc.com" | "aaa.bbb.com" | true
-        "aaa.bbb.com,!*.ccc.com" | "aaa.ccc.com" | false
-        "aaa.b??.com" | "aaa.bbb.com" | true
-        "aaa.b??.com" | "aaa.bcd.com" | true
-        "aaa.b??.com" | "aaa.ccd.com" | false
-        "aaa.b??.com" | "aaa.bccd.com" | false
-        "|1|F1E1KeoE/eEWhi10WpGv4OdiO6Y=|3988QV0VE8wmZL7suNrYQLITLCg=" | "192.168.1.61" | true
-        "|1|F1E1KeoE/eEWhi10WpGv4OdiO6Y=|3988QV0VE8wmZL7suNrYQLITLCg=" | "192.168.2.61" | false
-        "[aaa.bbb.com]:2222" | "aaa.bbb.com" | false
-        "[aaa.bbb.com]:2222" | "[aaa.bbb.com]:2222" | true
-        "[aaa.?bb.com]:2222" | "[aaa.dbb.com]:2222" | true
-        "[aaa.?xb.com]:2222" | "[aaa.dbb.com]:2222" | false
-        "[*.bbb.com]:2222" | "[aaa.bbb.com]:2222" | true
-        yesno = match ? "" : "no"
-    }
-}

src/test/groovy/com/hierynomus/sshj/transport/verification/OpenSSHKnownHostsSpec.groovy

@@ -1,221 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj.transport.verification
-
-import net.schmizz.sshj.common.Buffer
-import net.schmizz.sshj.transport.verification.OpenSSHKnownHosts
-import net.schmizz.sshj.util.KeyUtil
-import spock.lang.Specification
-import spock.lang.TempDir
-import spock.lang.Unroll
-
-import java.nio.file.Files
-import java.security.PublicKey
-
-class OpenSSHKnownHostsSpec extends Specification {
-
-    @TempDir def temp
-
-    def "should parse and verify hashed host entry"() {
-        given:
-        def f = knownHosts("|1|F1E1KeoE/eEWhi10WpGv4OdiO6Y=|3988QV0VE8wmZL7suNrYQLITLCg= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ==");
-        final PublicKey key = KeyUtil
-                .newRSAPublicKey(
-                "e8ff4797075a861db9d2319960a836b2746ada3da514955d2921f2c6a6c9895cbd557f604e43772b6303e3cab2ad82d83b21acdef4edb72524f9c2bef893335115acacfe2989bcbb2e978e4fedc8abc090363e205d975c1fdc35e55ba4daa4b5d5ab7a22c40f547a4a0fd1c683dfff10551c708ff8c34ea4e175cb9bf2313865308fa23601e5a610e2f76838be7ded3b4d3a2c49d2d40fa20db51d1cc8ab20d330bb0dadb88b1a12853f0ecb7c7632947b098dcf435a54566bcf92befd55e03ee2a57d17524cd3d59d6e800c66059067e5eb6edb81946b3286950748240ec9afa4389f9b62bc92f94ec0fba9e64d6dc2f455f816016a4c5f3d507382ed5d3365",
-                "23");
-
-        when:
-        OpenSSHKnownHosts openSSHKnownHosts = new OpenSSHKnownHosts(f)
-
-        then:
-        openSSHKnownHosts.verify("192.168.1.61", 22, key)
-        !openSSHKnownHosts.verify("192.168.1.2", 22, key)
-    }
-
-    def "should parse and verify v1 host entry"() {
-        given:
-        def f = knownHosts("test.com,1.1.1.1 2048 35 22017496617994656680820635966392838863613340434802393112245951008866692373218840197754553998457793202561151141246686162285550121243768846314646395880632789308110750881198697743542374668273149584280424505890648953477691795864456749782348425425954366277600319096366690719901119774784695056100331902394094537054256611668966698242432417382422091372756244612839068092471592121759862971414741954991375710930168229171638843329213652899594987626853020377726482288618521941129157643483558764875338089684351824791983007780922947554898825663693324944982594850256042689880090306493029526546183035567296830604572253312294059766327")
-        def key = KeyUtil.newRSAPublicKey("ae6983ed63a33afc69fe0b88b4ba14393120a0b66e1460916a8390ff109139cd14f4e1701ab5c5feeb479441fe2091d04c0ba7d3fa1756b80ed103657ab53b5d7daa38af22f59f9cbfc16892d4ef1f8fd3ae49663c295be1f568a160d54328fbc2c0598f48d32296b1b9942336234952c440cda1bfac904e3391db98e52f9b1de229adc18fc34a9a569717aa9a5b1145e73b8a8394354028d02054ca760243fb8fc1575490607dd098e698e02b5d8bdf22d55ec958245222ef4c65b8836b9f13674a2d2895a587bfd4423b4eeb6d3ef98451640e3d63d2fc6a761ffd34446abab028494caf36d67ffd65298d69f19f2d90bae4c207b671db563a08f1bb9bf237",
-                    "23")
-        when:
-        OpenSSHKnownHosts knownHosts = new OpenSSHKnownHosts(f)
-
-        then:
-        knownHosts.verify("test.com", 22, key)
-    }
-
-    def "should check all host entries for key"() {
-        given:
-        def f = knownHosts("""
-host1 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCiYp2IDgzDFhl8T4TRLIhEljvEixz1YN0XWh4dYh0REGK9T4QKiyb28EztPMdcOtz1uyX5rUGYXX9hj99S4SiU=
-host1 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLTjA7hduYGmvV9smEEsIdGLdghSPD7kL8QarIIOkeXmBh+LTtT/T1K+Ot/rmXCZsP8hoUXxbvN+Tks440Ci0ck=
-""")
-        def pk = new Buffer.PlainBuffer(Base64.getDecoder().decode("AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLTjA7hduYGmvV9smEEsIdGLdghSPD7kL8QarIIOkeXmBh+LTtT/T1K+Ot/rmXCZsP8hoUXxbvN+Tks440Ci0ck=")).readPublicKey()
-        when:
-        def knownhosts = new OpenSSHKnownHosts(f)
-
-        then:
-        knownhosts.verify("host1", 22, pk)
-    }
-
-    def "should not fail on bad base64 entry"() {
-        given:
-        def f = knownHosts("""
-host1 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTIDgzDFhl8T4TRLIhEljvEixz1YN0XWh4dYh0REGK9T4QKiyb28EztPMdcOtz1uyX5rUGYXX9hj99S4SiU=
-host1 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLTjA7hduYGmvV9smEEsIdGLdghSPD7kL8QarIIOkeXmBh+LTtT/T1K+Ot/rmXCZsP8hoUXxbvN+Tks440Ci0ck=
-""")
-        def pk = new Buffer.PlainBuffer(Base64.getDecoder().decode("AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLTjA7hduYGmvV9smEEsIdGLdghSPD7kL8QarIIOkeXmBh+LTtT/T1K+Ot/rmXCZsP8hoUXxbvN+Tks440Ci0ck=")).readPublicKey()
-        when:
-        def knownhosts = new OpenSSHKnownHosts(f)
-
-        then:
-        knownhosts.verify("host1", 22, pk)
-    }
-
-    def "should mark bad line and not fail"() {
-        given:
-        def f = knownHosts("M36Lo+Ik5ukNugvvoNFlpnyiHMmtKxt3FpyEfYuryXjNqMNWHn/ARVnpUIl5jRLTB7WBzyLYMG7X5nuoFL9zYqKGtHxChbDunxMVbspw5WXI9VN+qxcLwmITmpEvI9ApyS/Ox2ZyN7zw==\n")
-
-        when:
-        def knownhosts = new OpenSSHKnownHosts(f)
-
-        then:
-        knownhosts.entries().size() == 1
-        knownhosts.entries().get(0) instanceof OpenSSHKnownHosts.BadHostEntry
-    }
-
-    @Unroll
-    def "should add comment for #type line"() {
-        given:
-        def f = knownHosts(s)
-
-        when:
-        def knownHosts = new OpenSSHKnownHosts(f)
-
-        then:
-        knownHosts.entries().size() == 1
-        knownHosts.entries().get(0) instanceof OpenSSHKnownHosts.CommentEntry
-
-        where:
-        type << ["newline", "comment"]
-        s << ["\n", "#comment\n"]
-    }
-
-    @Unroll
-    def "should contain comment at end of line"() {
-        given:
-        def f = knownHosts(host)
-        when:
-        OpenSSHKnownHosts knownHosts = new OpenSSHKnownHosts(f)
-
-        then:
-        knownHosts.entries().size() == 1
-        def entry = knownHosts.entries().get(0)
-        entry instanceof OpenSSHKnownHosts.HostEntry
-        entry.comment == comment
-
-        where:
-        host << [
-"|1|F1E1KeoE/eEWhi10WpGv4OdiO6Y=|3988QV0VE8wmZL7suNrYQLITLCg= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ== this is a comment",
-"test.com,1.1.1.1 2048 35 22017496617994656680820635966392838863613340434802393112245951008866692373218840197754553998457793202561151141246686162285550121243768846314646395880632789308110750881198697743542374668273149584280424505890648953477691795864456749782348425425954366277600319096366690719901119774784695056100331902394094537054256611668966698242432417382422091372756244612839068092471592121759862971414741954991375710930168229171638843329213652899594987626853020377726482288618521941129157643483558764875338089684351824791983007780922947554898825663693324944982594850256042689880090306493029526546183035567296830604572253312294059766327 single",
-"schmizz.net,69.163.155.180 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ==",
-"schmizz.net,69.163.155.180 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ== ",
-"schmizz.net,69.163.155.180 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ== extra   space"
-        ]
-        comment << [
-            "this is a comment",
-            "single",
-            null,
-            null,
-            "extra   space"
-        ]
-    }
-
-    @Unroll
-    def "should match any host name from multi-host line"() {
-        given:
-        def f = knownHosts("schmizz.net,69.163.155.180 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ==")
-        def pk = new Buffer.PlainBuffer(Base64.getDecoder().decode("AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ==")).readPublicKey()
-
-        when:
-        def knownHosts = new OpenSSHKnownHosts(f)
-
-        then:
-        knownHosts.verify(h, 22, pk)
-
-        where:
-        h << ["schmizz.net", "69.163.155.180"]
-    }
-
-    def "should produce meaningful toString()"() {
-        given:
-        def f = knownHosts("schmizz.net,69.163.155.180 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ==")
-
-        when:
-        def knownhosts = new OpenSSHKnownHosts(f)
-
-        def toStringValue = knownhosts.toString()
-        then:
-        toStringValue == "OpenSSHKnownHosts{khFile='" + f + "'}"
-    }
-
-    def "should forgive redundant spaces like OpenSSH does"() {
-        given:
-        def key = "AAAAC3NzaC1lZDI1NTE5AAAAIIRsJi92NJJTQwXHZiRiARoEy4n1jYsNTQePHFTSl7tG"
-        def f = knownHosts("""
-          |host1 ssh-ed25519 $key
-          |
-          | host2   ssh-ed25519   $key  ,./gargage\\.,
-          |\t\t\t\t\t
-          |\t@revoked   host3\tssh-ed25519\t \t$key\t
-          """.stripMargin())
-        def pk = new Buffer.PlainBuffer(Base64.getDecoder().decode(key)).readPublicKey()
-
-        when:
-        def knownhosts = new OpenSSHKnownHosts(f)
-
-        then:
-        ["host1", "host2", "host3"].forEach {
-            knownhosts.verify(it, 22, pk)
-        }
-    }
-
-    def "should not throw errors while parsing corrupted records"() {
-        given:
-        def key = "AAAAC3NzaC1lZDI1NTE5AAAAIIRsJi92NJJTQwXHZiRiARoEy4n1jYsNTQePHFTSl7tG"
-        def f = knownHosts(
-                "\n"  // empty line
-                + "    \n"  // blank line
-                + "bad-host1\n"  // absent key type and key contents
-                + "bad-host2 ssh-ed25519\n"  // absent key contents
-                + "  bad-host3 ssh-ed25519\n"  // absent key contents, with leading spaces
-                + "@revoked  bad-host5 ssh-ed25519\n"  // absent key contents, with marker
-                + "good-host ssh-ed25519 $key"  // the only good host at the end
-        )
-
-        when:
-        def knownhosts = new OpenSSHKnownHosts(f)
-
-        then:
-        knownhosts.verify("good-host", 22, new Buffer.PlainBuffer(Base64.getDecoder().decode(key)).readPublicKey())
-    }
-
-    def knownHosts(String s) {
-        def f = Files.createFile(temp.resolve("known_hosts")).toFile()
-        f.write(s)
-        return f
-    }
-}

src/test/java/com/hierynomus/sshj/transport/ChachaPolyCipherTest.java

@@ -70,6 +70,28 @@ public class ChachaPolyCipherTest {
         }
     }
 
+    @Test
+    public void testEncryptDecryptWithoutAAD() {
+        final Cipher encryptionCipher = FACTORY.create();
+        final byte[] key = new byte[encryptionCipher.getBlockSize()];
+        Arrays.fill(key, (byte) 1);
+        encryptionCipher.init(Cipher.Mode.Encrypt, key, new byte[0]);
+
+        final byte[] plaintextBytes = PLAINTEXT.getBytes(StandardCharsets.UTF_8);
+        final byte[] message = new byte[plaintextBytes.length + POLY_TAG_LENGTH];
+        System.arraycopy(plaintextBytes, 0, message, 0, plaintextBytes.length);
+
+        encryptionCipher.update(message, 0, plaintextBytes.length);
+
+        final Cipher decryptionCipher = FACTORY.create();
+        decryptionCipher.init(Cipher.Mode.Decrypt, key, new byte[0]);
+        decryptionCipher.update(message, 0, plaintextBytes.length);
+
+        final byte[] decrypted = Arrays.copyOfRange(message, 0, plaintextBytes.length);
+        final String decoded = new String(decrypted, StandardCharsets.UTF_8);
+        assertEquals(PLAINTEXT, decoded);
+    }
+
     @Test
     public void testCheckOnUpdateParameters() {
         Cipher cipher = FACTORY.create();

src/test/java/com/hierynomus/sshj/transport/verification/KnownHostMatchersTest.java

@@ -0,0 +1,62 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj.transport.verification;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.util.stream.Stream;
+
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+
+public class KnownHostMatchersTest {
+    @MethodSource("com.hierynomus.sshj.transport.verification.KnownHostMatchersTest#patterns")
+    @ParameterizedTest
+    public void shouldMatchHostnameToPattern(String pattern, String hostname, boolean match) throws Exception {
+        KnownHostMatchers.HostMatcher matcher = KnownHostMatchers.createMatcher(pattern);
+        assertEquals(match, matcher.match(hostname));
+    }
+
+    public static Stream<Arguments> patterns() {
+        return Stream.of(
+            Arguments.of("aaa.bbb.com", "aaa.bbb.com", true),
+            Arguments.of("aaa.bbb.com", "aaa.ccc.com", false),
+            Arguments.of("*.bbb.com"  , "aaa.bbb.com", true),
+            Arguments.of("*.bbb.com"  , "aaa.ccc.com", false),
+            Arguments.of("aaa.*.com"  , "aaa.bbb.com", true),
+            Arguments.of("aaa.*.com"  , "aaa.ccc.com", true),
+            Arguments.of("aaa.bbb.*", "aaa.bbb.com", true),
+            Arguments.of("aaa.bbb.*", "aaa.ccc.com", false),
+            Arguments.of("!*.bbb.com", "aaa.bbb.com", false),
+            Arguments.of("!*.bbb.com", "aaa.ccc.com", true),
+            Arguments.of("aaa.bbb.com,!*.ccc.com", "xxx.yyy.com", true),
+            Arguments.of("aaa.bbb.com,!*.ccc.com", "aaa.bbb.com", true),
+            Arguments.of("aaa.bbb.com,!*.ccc.com", "aaa.ccc.com", false),
+            Arguments.of("aaa.b??.com", "aaa.bbb.com", true),
+            Arguments.of("aaa.b??.com", "aaa.bcd.com", true),
+            Arguments.of("aaa.b??.com", "aaa.ccd.com", false),
+            Arguments.of("aaa.b??.com", "aaa.bccd.com", false),
+            Arguments.of("|1|F1E1KeoE/eEWhi10WpGv4OdiO6Y=|3988QV0VE8wmZL7suNrYQLITLCg=", "192.168.1.61", true),
+            Arguments.of("|1|F1E1KeoE/eEWhi10WpGv4OdiO6Y=|3988QV0VE8wmZL7suNrYQLITLCg=", "192.168.2.61", false),
+            Arguments.of("[aaa.bbb.com]:2222", "aaa.bbb.com", false),
+            Arguments.of("[aaa.bbb.com]:2222", "[aaa.bbb.com]:2222", true),
+            Arguments.of("[aaa.?bb.com]:2222", "[aaa.dbb.com]:2222", true),
+            Arguments.of("[aaa.?xb.com]:2222", "[aaa.dbb.com]:2222", false),
+            Arguments.of("[*.bbb.com]:2222", "[aaa.bbb.com]:2222", true)
+        );
+    }
+}

src/test/java/com/hierynomus/sshj/transport/verification/OpenSSHKnownHostsTest.java

@@ -0,0 +1,216 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj.transport.verification;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.assertj.core.api.Assertions.*;
+
+import java.io.File;
+import java.io.IOException;
+import java.lang.module.ModuleDescriptor.Opens;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.security.PublicKey;
+import java.security.Security;
+import java.util.Base64;
+import java.util.stream.Stream;
+
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+
+import net.schmizz.sshj.common.Buffer;
+import net.schmizz.sshj.common.SecurityUtils;
+import net.schmizz.sshj.transport.verification.OpenSSHKnownHosts;
+import net.schmizz.sshj.util.KeyUtil;
+
+public class OpenSSHKnownHostsTest {
+    @TempDir
+    public File tempDir;
+
+    @BeforeAll
+    public static void setup() {
+        SecurityUtils.registerSecurityProvider("org.bouncycastle.jce.provider.BouncyCastleProvider");
+    }
+
+    @Test
+    public void shouldParseAndVerifyHashedHostEntry() throws Exception {
+        File knownHosts = knownHosts(
+                "|1|F1E1KeoE/eEWhi10WpGv4OdiO6Y=|3988QV0VE8wmZL7suNrYQLITLCg= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ==");
+        PublicKey k = KeyUtil.newRSAPublicKey(
+                "e8ff4797075a861db9d2319960a836b2746ada3da514955d2921f2c6a6c9895cbd557f604e43772b6303e3cab2ad82d83b21acdef4edb72524f9c2bef893335115acacfe2989bcbb2e978e4fedc8abc090363e205d975c1fdc35e55ba4daa4b5d5ab7a22c40f547a4a0fd1c683dfff10551c708ff8c34ea4e175cb9bf2313865308fa23601e5a610e2f76838be7ded3b4d3a2c49d2d40fa20db51d1cc8ab20d330bb0dadb88b1a12853f0ecb7c7632947b098dcf435a54566bcf92befd55e03ee2a57d17524cd3d59d6e800c66059067e5eb6edb81946b3286950748240ec9afa4389f9b62bc92f94ec0fba9e64d6dc2f455f816016a4c5f3d507382ed5d3365",
+                "23");
+
+        OpenSSHKnownHosts ohk = new OpenSSHKnownHosts(knownHosts);
+        assertTrue(ohk.verify("192.168.1.61", 22, k));
+        assertFalse(ohk.verify("192.168.1.2", 22, k));
+    }
+
+    @Test
+    public void shouldParseAndVerifyV1HostEntry() throws Exception {
+        File knownHosts = knownHosts(
+                "test.com,1.1.1.1 2048 35 22017496617994656680820635966392838863613340434802393112245951008866692373218840197754553998457793202561151141246686162285550121243768846314646395880632789308110750881198697743542374668273149584280424505890648953477691795864456749782348425425954366277600319096366690719901119774784695056100331902394094537054256611668966698242432417382422091372756244612839068092471592121759862971414741954991375710930168229171638843329213652899594987626853020377726482288618521941129157643483558764875338089684351824791983007780922947554898825663693324944982594850256042689880090306493029526546183035567296830604572253312294059766327");
+        PublicKey k = KeyUtil.newRSAPublicKey(
+                "ae6983ed63a33afc69fe0b88b4ba14393120a0b66e1460916a8390ff109139cd14f4e1701ab5c5feeb479441fe2091d04c0ba7d3fa1756b80ed103657ab53b5d7daa38af22f59f9cbfc16892d4ef1f8fd3ae49663c295be1f568a160d54328fbc2c0598f48d32296b1b9942336234952c440cda1bfac904e3391db98e52f9b1de229adc18fc34a9a569717aa9a5b1145e73b8a8394354028d02054ca760243fb8fc1575490607dd098e698e02b5d8bdf22d55ec958245222ef4c65b8836b9f13674a2d2895a587bfd4423b4eeb6d3ef98451640e3d63d2fc6a761ffd34446abab028494caf36d67ffd65298d69f19f2d90bae4c207b671db563a08f1bb9bf237",
+                "23");
+
+        OpenSSHKnownHosts ohk = new OpenSSHKnownHosts(knownHosts);
+        assertTrue(ohk.verify("test.com", 22, k));
+    }
+
+    @Test
+    public void shouldTestAllHostEntriesForKey() throws Exception {
+        File knownHosts = knownHosts(
+                "host1 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCiYp2IDgzDFhl8T4TRLIhEljvEixz1YN0XWh4dYh0REGK9T4QKiyb28EztPMdcOtz1uyX5rUGYXX9hj99S4SiU=\n"
+                        +
+                        "host1 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLTjA7hduYGmvV9smEEsIdGLdghSPD7kL8QarIIOkeXmBh+LTtT/T1K+Ot/rmXCZsP8hoUXxbvN+Tks440Ci0ck=\n");
+        PublicKey k = new Buffer.PlainBuffer(Base64.getDecoder().decode(
+                "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLTjA7hduYGmvV9smEEsIdGLdghSPD7kL8QarIIOkeXmBh+LTtT/T1K+Ot/rmXCZsP8hoUXxbvN+Tks440Ci0ck="))
+                .readPublicKey();
+
+        OpenSSHKnownHosts ohk = new OpenSSHKnownHosts(knownHosts);
+        assertTrue(ohk.verify("host1", 22, k));
+    }
+
+    @Test
+    public void shouldNotFailOnBadBase64Entry() throws Exception {
+        File knownHosts = knownHosts(
+                "host1 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTIDgzDFhl8T4TRLIhEljvEixz1YN0XWh4dYh0REGK9T4QKiyb28EztPMdcOtz1uyX5rUGYXX9hj99S4SiU=\n"
+                        +
+                        "host1 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLTjA7hduYGmvV9smEEsIdGLdghSPD7kL8QarIIOkeXmBh+LTtT/T1K+Ot/rmXCZsP8hoUXxbvN+Tks440Ci0ck=\n");
+        PublicKey k = new Buffer.PlainBuffer(Base64.getDecoder().decode(
+                "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLTjA7hduYGmvV9smEEsIdGLdghSPD7kL8QarIIOkeXmBh+LTtT/T1K+Ot/rmXCZsP8hoUXxbvN+Tks440Ci0ck="))
+                .readPublicKey();
+        OpenSSHKnownHosts ohk = new OpenSSHKnownHosts(knownHosts);
+
+        assertTrue(ohk.verify("host1", 22, k));
+    }
+
+    @Test
+    public void shouldMarkBadLineAndNotFail() throws Exception {
+        File knownHosts = knownHosts(
+                "M36Lo+Ik5ukNugvvoNFlpnyiHMmtKxt3FpyEfYuryXjNqMNWHn/ARVnpUIl5jRLTB7WBzyLYMG7X5nuoFL9zYqKGtHxChbDunxMVbspw5WXI9VN+qxcLwmITmpEvI9ApyS/Ox2ZyN7zw==\n");
+        OpenSSHKnownHosts ohk = new OpenSSHKnownHosts(knownHosts);
+        assertEquals(1, ohk.entries().size());
+        assertInstanceOf(OpenSSHKnownHosts.BadHostEntry.class, ohk.entries().get(0));
+    }
+
+    @Test
+    public void shouldAddCommentForSpecificLines() throws Exception {
+        File knownHosts = knownHosts("#comment\n\n");
+        OpenSSHKnownHosts ohk = new OpenSSHKnownHosts(knownHosts);
+        assertEquals(2, ohk.entries().size());
+        assertInstanceOf(OpenSSHKnownHosts.CommentEntry.class, ohk.entries().get(0));
+        assertInstanceOf(OpenSSHKnownHosts.CommentEntry.class, ohk.entries().get(1));
+    }
+
+    @Test
+    public void shouldNotVerifyRevokedEntries() throws Exception {
+        File knownHosts = knownHosts("host1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRsJi92NJJTQwXHZiRiARoEy4n1jYsNTQePHFTSl7tG\n" +
+                "@revoked revoked-host ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRsJi92NJJTQwXHZiRiARoEy4n1jYsNTQePHFTSl7tG\n");
+
+        OpenSSHKnownHosts ohk = new OpenSSHKnownHosts(knownHosts);
+        PublicKey k = new Buffer.PlainBuffer(Base64.getDecoder().decode(
+                "AAAAC3NzaC1lZDI1NTE5AAAAIIRsJi92NJJTQwXHZiRiARoEy4n1jYsNTQePHFTSl7tG"))
+                .readPublicKey();
+
+        assertTrue(ohk.verify("host1", 22, k));
+        assertFalse(ohk.verify("revoked-host", 22, k));
+    }
+
+    @Test
+    public void shouldForgiveRedundantSpacesLikeOpenSSH() throws Exception {
+        File knownHosts = knownHosts(
+                "host1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRsJi92NJJTQwXHZiRiARoEy4n1jYsNTQePHFTSl7tG\n" +
+                "\n" +
+                " host2   ssh-ed25519  AAAAC3NzaC1lZDI1NTE5AAAAIIRsJi92NJJTQwXHZiRiARoEy4n1jYsNTQePHFTSl7tG   ,./gargage\\.,\n" +
+                "\t\t\t\t\t\t\n" +
+                        "\t  host3\tssh-ed25519\t \tAAAAC3NzaC1lZDI1NTE5AAAAIIRsJi92NJJTQwXHZiRiARoEy4n1jYsNTQePHFTSl7tG\t\n");
+        OpenSSHKnownHosts ohk = new OpenSSHKnownHosts(knownHosts);
+
+        PublicKey pk = new Buffer.PlainBuffer(
+                Base64.getDecoder().decode("AAAAC3NzaC1lZDI1NTE5AAAAIIRsJi92NJJTQwXHZiRiARoEy4n1jYsNTQePHFTSl7tG"))
+                .readPublicKey();
+
+        assertTrue(ohk.verify("host1", 22, pk));
+        assertTrue(ohk.verify("host2", 22, pk));
+        assertTrue(ohk.verify("host3", 22, pk));
+    }
+
+    @Test
+    public void shouldNotThrowErrorsWhileParsingCorruptRecords() throws Exception {
+        File knownHosts = knownHosts(
+                "\n" // empty line
+                        + "    \n" // blank line
+                        + "bad-host1\n" // absent key type and key contents
+                        + "bad-host2 ssh-ed25519\n" // absent key contents
+                        + "  bad-host3 ssh-ed25519\n" // absent key contents, with leading spaces
+                        + "@revoked  bad-host5 ssh-ed25519\n" // absent key contents, with marker
+                        + "good-host ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRsJi92NJJTQwXHZiRiARoEy4n1jYsNTQePHFTSl7tG" // the only good host at the end
+        );
+        OpenSSHKnownHosts ohk = new OpenSSHKnownHosts(knownHosts);
+
+        assertTrue(ohk.verify("good-host", 22,
+                new Buffer.PlainBuffer(Base64.getDecoder()
+                        .decode("AAAAC3NzaC1lZDI1NTE5AAAAIIRsJi92NJJTQwXHZiRiARoEy4n1jYsNTQePHFTSl7tG"))
+                        .readPublicKey()));
+    }
+
+    @Test
+    public void shouldMatchAnyHostFromMultiHostLine() throws Exception {
+        File knownHosts = knownHosts(
+                "schmizz.net,69.163.155.180 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ==");
+        PublicKey k = new Buffer.PlainBuffer(Base64.getDecoder().decode(
+                "AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ=="))
+                .readPublicKey();
+        OpenSSHKnownHosts ohk = new OpenSSHKnownHosts(knownHosts);
+
+        assertTrue(ohk.verify("schmizz.net", 22, k));
+        assertTrue(ohk.verify("69.163.155.180", 22, k));
+    }
+
+    @ParameterizedTest
+    @MethodSource("com.hierynomus.sshj.transport.verification.OpenSSHKnownHostsTest#commentedHostEntries")
+    public void shouldRetainCommentAtEndOfLine(String entry, String comment) throws Exception {
+        File knownHosts = knownHosts(entry);
+        OpenSSHKnownHosts ohk = new OpenSSHKnownHosts(knownHosts);
+        assertEquals(1, ohk.entries().size());
+        assertThat(ohk.entries().get(0)).extracting("comment").isEqualTo(comment);
+    }
+
+    public static Stream<Arguments> commentedHostEntries() {
+        return Stream.of(
+            Arguments.of("|1|F1E1KeoE/eEWhi10WpGv4OdiO6Y=|3988QV0VE8wmZL7suNrYQLITLCg= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ== this is a comment", "this is a comment"),
+            Arguments.of("test.com,1.1.1.1 2048 35 22017496617994656680820635966392838863613340434802393112245951008866692373218840197754553998457793202561151141246686162285550121243768846314646395880632789308110750881198697743542374668273149584280424505890648953477691795864456749782348425425954366277600319096366690719901119774784695056100331902394094537054256611668966698242432417382422091372756244612839068092471592121759862971414741954991375710930168229171638843329213652899594987626853020377726482288618521941129157643483558764875338089684351824791983007780922947554898825663693324944982594850256042689880090306493029526546183035567296830604572253312294059766327 single",
+                "single"),
+            Arguments.of("schmizz.net,69.163.155.180 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ==", null),
+            Arguments.of("schmizz.net,69.163.155.180 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ== ", null),
+            Arguments.of("schmizz.net,69.163.155.180 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6P9Hlwdahh250jGZYKg2snRq2j2lFJVdKSHyxqbJiVy9VX9gTkN3K2MD48qyrYLYOyGs3vTttyUk+cK++JMzURWsrP4piby7LpeOT+3Iq8CQNj4gXZdcH9w15Vuk2qS11at6IsQPVHpKD9HGg9//EFUccI/4w06k4XXLm/IxOGUwj6I2AeWmEOL3aDi+fe07TTosSdLUD6INtR0cyKsg0zC7Da24ixoShT8Oy3x2MpR7CY3PQ1pUVmvPkr79VeA+4qV9F1JM09WdboAMZgWQZ+XrbtuBlGsyhpUHSCQOya+kOJ+bYryS+U7A+6nmTW3C9FX4FgFqTF89UHOC7V0zZQ== extra   space", "extra   space")
+        );
+    }
+
+    private File knownHosts(String contents) throws IOException {
+        File knownHosts = new File(tempDir, "known_hosts");
+        Files.write(knownHosts.toPath(), contents.getBytes(StandardCharsets.UTF_8));
+        return knownHosts;
+    }
+}

src/test/java/net/schmizz/sshj/keyprovider/OpenSSHKeyFileTest.java

@@ -25,7 +25,6 @@ import net.schmizz.sshj.userauth.password.PasswordFinder;
 import net.schmizz.sshj.userauth.password.PasswordUtils;
 import net.schmizz.sshj.userauth.password.Resource;
 import net.schmizz.sshj.util.KeyUtil;
-import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
@@ -226,6 +225,22 @@ public class OpenSSHKeyFileTest {
         assertThat(aPrivate.getAlgorithm(), equalTo("EdDSA"));
     }
 
+    @Test
+    public void shouldHandlePrivateKeyMissingHeader() {
+        OpenSSHKeyV1KeyFile keyFile = new OpenSSHKeyV1KeyFile();
+        keyFile.init(new File("src/test/resources/keyformats/pkcs8"));
+        final IOException exception = assertThrows(IOException.class, keyFile::getPrivate);
+        assertTrue(exception.getMessage().contains("header not found"));
+    }
+
+    @Test
+    public void shouldHandlePrivateKeyMissingFooter() {
+        final OpenSSHKeyV1KeyFile keyFile = new OpenSSHKeyV1KeyFile();
+        keyFile.init(new File("src/test/resources/keytypes/test_ed25519_missing_footer"));
+        final IOException exception = assertThrows(IOException.class, keyFile::getPrivate);
+        assertTrue(exception.getMessage().contains("footer not found"));
+    }
+
     @Test
     public void shouldLoadProtectedED25519PrivateKeyAes256CTR() throws IOException {
         checkOpenSSHKeyV1("src/test/resources/keytypes/ed25519_protected", "sshjtest", false);
@@ -245,7 +260,18 @@ public class OpenSSHKeyFileTest {
     }
 
     @Test
-    public void shouldFailOnIncorrectPassphraseAfterRetries() throws IOException {
+    public void shouldLoadProtectedEd25519PrivateKeyAES256GCM() throws IOException {
+        checkOpenSSHKeyV1("src/test/resources/keytypes/ed25519_aes256-gcm", "sshjtest", false);
+        checkOpenSSHKeyV1("src/test/resources/keytypes/ed25519_aes256-gcm", "sshjtest", true);
+    }
+
+    @Test
+    public void shouldLoadProtectedEd25519PrivateKeyChaCha20Poly1305() throws IOException {
+        checkOpenSSHKeyV1("src/test/resources/keytypes/ed25519_chacha20-poly1305", "sshjtest", false);
+    }
+
+    @Test
+    public void shouldFailOnIncorrectPassphraseAfterRetries() {
         assertThrows(KeyDecryptionFailedException.class, () -> {
         OpenSSHKeyV1KeyFile keyFile = new OpenSSHKeyV1KeyFile();
         keyFile.init(new File("src/test/resources/keytypes/ed25519_aes256cbc.pem"), new PasswordFinder() {

src/test/java/net/schmizz/sshj/sftp/RemoteFileRenameTest.java

@@ -0,0 +1,237 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package net.schmizz.sshj.sftp;
+
+import com.hierynomus.sshj.test.SshServerExtension;
+import net.schmizz.sshj.SSHClient;
+import net.schmizz.sshj.common.ByteArrayUtils;
+import org.apache.sshd.common.util.io.IoUtils;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.*;
+import java.util.EnumSet;
+import java.util.HashSet;
+import java.util.Random;
+import java.util.Set;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
+
+/**
+ * Testing of remote file rename using different combinations of net.schmizz.sshj.sftp.RenameFlags with
+ * possible workarounds for SFTP protocol versions lower than 5 that do not natively support these flags.
+ */
+public class RemoteFileRenameTest {
+    @RegisterExtension
+    public SshServerExtension fixture = new SshServerExtension();
+
+    @TempDir
+    public File temp;
+
+    @Test
+    public void shouldOverwriteFileWhenRequested() throws IOException {
+        // create source file
+        final byte[] sourceBytes = generateBytes(32);
+        File sourceFile = newTempFile("shouldOverwriteFileWhenRequested-source.bin", sourceBytes);
+
+        // create target file
+        final byte[] targetBytes = generateBytes(32);
+        File targetFile = newTempFile("shouldOverwriteFileWhenRequested-target.bin", targetBytes);
+
+        // rename with overwrite
+        Set<RenameFlags> flags = EnumSet.of(RenameFlags.OVERWRITE);
+        SFTPEngine sftp = sftpInit();
+        sftp.rename(sourceFile.getPath(), targetFile.getPath(), flags);
+
+        // check if rename was successful
+        assertThat("The source file should not exist anymore", !sourceFile.exists());
+        assertThat("The contents of the target file should be equal to the contents previously written " +
+                        "to the source file", fileContentEquals(targetFile, sourceBytes));
+    }
+
+    @Test
+    public void shouldNotOverwriteFileWhenNotRequested() throws IOException {
+        // create source file
+        final byte[] sourceBytes = generateBytes(32);
+        File sourceFile = newTempFile("shouldNotOverwriteFileWhenNotRequested-source.bin", sourceBytes);
+
+        // create target file
+        final byte[] targetBytes = generateBytes(32);
+        File targetFile = newTempFile("shouldNotOverwriteFileWhenNotRequested-target.bin", targetBytes);
+
+        // rename without overwrite -> should fail
+        Boolean exceptionThrown = false;
+        Set<RenameFlags> flags = new HashSet<>();
+        SFTPEngine sftp = sftpInit();
+        try {
+            sftp.rename(sourceFile.getPath(), targetFile.getPath(), flags);
+        }
+        catch (SFTPException e) {
+            exceptionThrown = true;
+        }
+
+        // check if rename failed as it should
+        assertThat("The source file should still exist", sourceFile.exists());
+        assertThat("The contents of the target file should be equal to the contents previously written to it",
+                fileContentEquals(targetFile, targetBytes));
+        assertThat("An appropriate exception should have been thrown", exceptionThrown);
+    }
+
+    @Test
+    public void shouldUseAtomicRenameWhenRequestedWithOverwriteOnInsufficientProtocolVersion() throws IOException {
+        // create source file
+        final byte[] sourceBytes = generateBytes(32);
+        File sourceFile = newTempFile("shouldUseAtomicRenameWhenRequestedWithOverwriteOnInsufficientProtocolVersion-source.bin", sourceBytes);
+
+        // create target file
+        final byte[] targetBytes = generateBytes(32);
+        File targetFile = newTempFile("shouldUseAtomicRenameWhenRequestedWithOverwriteOnInsufficientProtocolVersion-target.bin", targetBytes);
+
+        // atomic rename with overwrite -> should work
+        Set<RenameFlags> flags = EnumSet.of(RenameFlags.OVERWRITE, RenameFlags.ATOMIC);
+        int version = Math.min(SFTPEngine.MAX_SUPPORTED_VERSION, 4); // choose a supported version smaller than 5
+        SFTPEngine sftp = sftpInit(version);
+        sftp.rename(sourceFile.getPath(), targetFile.getPath(), flags);
+
+        assertThat("The connection should use the requested protocol version", sftp.getOperativeProtocolVersion() == version);
+        assertThat("The source file should not exist anymore", !sourceFile.exists());
+        assertThat("The contents of the target file should be equal to the contents previously written " +
+                        "to the source file", fileContentEquals(targetFile, sourceBytes));
+    }
+
+
+    @Test
+    public void shouldIgnoreAtomicFlagWhenRequestedWithNativeOnInsufficientProtocolVersion() throws IOException {
+        // create source file
+        final byte[] sourceBytes = generateBytes(32);
+        File sourceFile = newTempFile("shouldIgnoreAtomicFlagWhenRequestedWithNativeOnInsufficientProtocolVersion-source.bin", sourceBytes);
+
+        // create target file
+        final byte[] targetBytes = generateBytes(32);
+        File targetFile = newTempFile("shouldIgnoreAtomicFlagWhenRequestedWithNativeOnInsufficientProtocolVersion-target.bin", targetBytes);
+
+        // atomic flag should be ignored with native
+        // -> should fail because target exists and overwrite behaviour is not requested
+        Boolean exceptionThrown = false;
+        Set<RenameFlags> flags = EnumSet.of(RenameFlags.NATIVE, RenameFlags.ATOMIC);
+        int version = Math.min(SFTPEngine.MAX_SUPPORTED_VERSION, 4); // choose a supported version smaller than 5
+        SFTPEngine sftp = sftpInit(version);
+        try {
+            sftp.rename(sourceFile.getPath(), targetFile.getPath(), flags);
+        }
+        catch (SFTPException e) {
+            exceptionThrown = true;
+        }
+
+        assertThat("The connection should use the requested protocol version", sftp.getOperativeProtocolVersion() == version);
+        assertThat("The source file should still exist", sourceFile.exists());
+        assertThat("The contents of the target file should be equal to the contents previously written to it",
+                fileContentEquals(targetFile, targetBytes));
+        assertThat("An appropriate exception should have been thrown", exceptionThrown);
+
+    }
+
+
+    @Test
+    public void shouldFailAtomicRenameWithoutOverwriteOnInsufficientProtocolVersion() throws IOException {
+        // create source file
+        final byte[] sourceBytes = generateBytes(32);
+        File sourceFile = newTempFile("shouldFailAtomicRenameWithoutOverwriteOnInsufficientProtocolVersion-source.bin", sourceBytes);
+
+        // create target file
+        File targetFile = new File(temp, "shouldFailAtomicRenameWithoutOverwriteOnInsufficientProtocolVersion-target.bin");
+
+        // atomic rename without overwrite -> should fail
+        Boolean exceptionThrown = false;
+        Set<RenameFlags> flags = EnumSet.of(RenameFlags.ATOMIC);
+        int version = Math.min(SFTPEngine.MAX_SUPPORTED_VERSION, 4); // choose a supported version smaller than 5
+        SFTPEngine sftp = sftpInit(version);
+        try {
+            sftp.rename(sourceFile.getPath(), targetFile.getPath(), flags);
+        }
+        catch (SFTPException e) {
+            exceptionThrown = true;
+        }
+
+        // check if rename failed as it should (for version < 5)
+        assertThat("The connection should use the requested protocol version", sftp.getOperativeProtocolVersion() == version);
+        assertThat("The source file should still exist", sourceFile.exists());
+        assertThat("The target file should not exist", !targetFile.exists());
+        assertThat("An appropriate exception should have been thrown", exceptionThrown);
+    }
+
+    @Test
+    public void shouldDoAtomicRenameOnSufficientProtocolVersion() throws IOException {
+        // This test will be relevant as soon as sshj supports SFTP protocol version >= 5
+        if (SFTPEngine.MAX_SUPPORTED_VERSION >= 5) {
+            // create source file
+            final byte[] sourceBytes = generateBytes(32);
+            File sourceFile = newTempFile("shouldDoAtomicRenameOnSufficientProtocolVersion-source.bin", sourceBytes);
+
+            // create target file
+            File targetFile = new File(temp, "shouldDoAtomicRenameOnSufficientProtocolVersion-target.bin");
+
+            // atomic rename without overwrite -> should work on version >= 5
+            Set<RenameFlags> flags = EnumSet.of(RenameFlags.ATOMIC);
+            SFTPEngine sftp = sftpInit();
+            sftp.rename(sourceFile.getPath(), targetFile.getPath(), flags);
+
+            // check if rename worked as it should (for version >= 5)
+            assertThat("The connection should use the requested protocol version", sftp.getOperativeProtocolVersion() >= 5);
+            assertThat("The source file should not exist anymore", !sourceFile.exists());
+            assertThat("The target file should exist", targetFile.exists());
+        }
+        else {
+            // Ignored - cannot test because client does not support protocol version >= 5
+        }
+    }
+
+    private byte[] generateBytes(Integer size) {
+        byte[] randomBytes = new byte[size];
+        Random rnd = new Random();
+        rnd.nextBytes(randomBytes);
+        return randomBytes;
+    }
+
+    private File newTempFile(String name, byte[] content) throws IOException {
+        File tmpFile = new File(temp, name);
+        try (OutputStream fStream = new FileOutputStream(tmpFile)) {
+            IoUtils.copy(new ByteArrayInputStream(content), fStream);
+        }
+        return tmpFile;
+    }
+
+    private boolean fileContentEquals(File testFile, byte[] testBytes) throws IOException {
+        return ByteArrayUtils.equals(
+                IoUtils.toByteArray(new FileInputStream(testFile)), 0,
+                testBytes, 0,
+                testBytes.length);
+    }
+
+    private SFTPEngine sftpInit() throws IOException {
+        return sftpInit(SFTPEngine.MAX_SUPPORTED_VERSION);
+    }
+
+    private SFTPEngine sftpInit(int version) throws IOException {
+        SSHClient ssh = fixture.setupConnectedDefaultClient();
+        ssh.authPassword("test", "test");
+        SFTPEngine sftp = new SFTPEngine(ssh).init(version);
+        return sftp;
+    }
+}

src/test/resources/keytypes/ed25519_aes256-gcm

@@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAAFmFlczI1Ni1nY21Ab3BlbnNzaC5jb20AAAAGYmNyeXB0AA
+AAGAAAABDpxH70vULcphyZoyd8Roc8AAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAA
+ID3cbY1HvyY8fXNrcESSpXm/3nGKpjxNjrlD+U5oMVmxAAAAoGXyMyKfXmGAVGLI3jbwk5
+gqrHAEFI5HHuYfW1DAAjSlj41paovl9tk7jZLIGslLUrUkN8Ac6ACNYuCWQZPgPr5mXHDx
+x+8GpdYPrgamB74lVwEPwk1BVjJRYUDRJ0SWyHagybITJhutq7yH+hZS+S05q2EeVee4Cn
+ZqESfmPZwdHg41IkdVTrZcLzadjPrcqrGzg1P7T9zl9hLD2QfBmO+XN2FPM+ufOGxpHHyJ
+SY/c
+-----END OPENSSH PRIVATE KEY-----

src/test/resources/keytypes/ed25519_aes256-gcm.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID3cbY1HvyY8fXNrcESSpXm/3nGKpjxNjrlD+U5oMVmx

src/test/resources/keytypes/ed25519_chacha20-poly1305

@@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAAHWNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tAAAABm
+JjcnlwdAAAABgAAAAQilqbRL4q3X9kEqWdTsD5/gAAABAAAAABAAAAMwAAAAtzc2gtZWQy
+NTUxOQAAACCpvtXUZPONb1XDjLkHmP5mQrGryGaQsA68Nb+OAjaaEgAAAJh+Repmt76g31
+jlD1ITaJU298ZU3rFWgA/Hs3xnOTNPjhMMu9nzfoZAu0fraE1MBVaEgNKRpw7SG+2eDBOo
+3fvN3lF15i7Q8YHZd9alfcUg3FrvBzjd0Edx4AQxbSueibPFaqnwmVk/YzDiQHwlyWfA1x
+HbqxrbJf1S0i8Bt5OjLK6woGk0/lfWJmy82xIa1sa3ONkPVjaJncm/f2SKV7t2k1UP9/jx
+dLA=
+-----END OPENSSH PRIVATE KEY-----

src/test/resources/keytypes/ed25519_chacha20-poly1305.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKm+1dRk841vVcOMuQeY/mZCsavIZpCwDrw1v44CNpoS

src/test/resources/keytypes/test_ed25519_missing_footer

@@ -0,0 +1,6 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACAwHSYkZJATPMgvLHkxKAJ9j38Gyyq5HGoWdMcT6FiAiQAAAJDimgR84poE
+fAAAAAtzc2gtZWQyNTUxOQAAACAwHSYkZJATPMgvLHkxKAJ9j38Gyyq5HGoWdMcT6FiAiQ
+AAAECmsckQycWnfGQK6XtQpaMGODbAkMQOdJNK6XJSipB7dDAdJiRkkBM8yC8seTEoAn2P
+fwbLKrkcahZ0xxPoWICJAAAACXJvb3RAc3NoagECAwQ=