Add Automatic-Module-Name to MANIFEST.MF

2025-12-06 15:20:54 +03:00 · 2021-08-27 15:35:06 +02:00
179 changed files with 6520 additions and 4923 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +1 @@
 *.bat text eol=crlf
-src/itest/docker-image/** eol=lf
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -6,37 +6,48 @@ name: Build SSHJ

 on:
  push:
+    branches: [ master ]
  pull_request:
    branches: [ master ]

 jobs:
  java12:
-    name: Build with Java 11
+    name: Build with Java 12
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
-    - name: Set up Java 11
-      uses: actions/setup-java@v3
+    - name: Set up JDK 12
+      uses: actions/setup-java@v1
      with:
-        distribution: 'temurin'
-        java-version: 11
+        java-version: 12
    - name: Grant execute permission for gradlew
      run: chmod +x gradlew
    - name: Build with Gradle
      run: ./gradlew check
-    - name: Codecov
-      uses: codecov/codecov-action@v2
+  # java10:
+  #   name: Build with Java 10
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #   - uses: actions/checkout@v2
+  #   - name: Set up JDK 10
+  #     uses: actions/setup-java@v1
+  #     with:
+  #       java-version: 10
+  #   - name: Grant execute permission for gradlew
+  #     run: chmod +x gradlew
+  #   - name: Build with Gradle
+  #     run: ./gradlew check -xanimalsnifferMain -xanimalsnifferTest

  integration:
    name: Integration test
-    runs-on: ubuntu-latest
+    needs: [java12]
+    runs-on: [ubuntu-latest]
    steps:
      - uses: actions/checkout@v2
      - run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@v1
        with:
-          distribution: 'temurin'
-          java-version: 11
+          java-version: 12
      - name: Grant execute permission for gradlew
        run: chmod +x gradlew
      - name: Build with Gradle
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,49 +0,0 @@
-name: SSHJ Release
-
-on:
-  push:
-    tags:
-      - '*'
-
-permissions:
-  contents: write
-
-jobs:
-  java12:
-    name: Build with Java 12
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - name: Set up JDK 12
-        uses: actions/setup-java@v2
-        with:
-          distribution: 'zulu'
-          java-version: 12
-      - name: Grant execute permission for gradlew
-        run: chmod +x gradlew
-      - name: Build with Gradle
-        run: ./gradlew check
-  release:
-    name: Release
-    needs: [java12]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-java@v2
-        with:
-          distribution: 'zulu'
-          java-version: 12
-      - name: Grant execute permission for gradlew
-        run: chmod +x gradlew
-      - name: Release
-        run: ./gradlew clean publishToSonatype closeAndReleaseSonatypeStagingRepository
-        env:
-          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.SIGNINGKEY }}
-          ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.SIGNINGKEYID }}
-          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.SIGNINGPASSWORD }}
-          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.OSSRH_USERNAME }}
-          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.OSSRH_PASSWORD }}
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -2,6 +2,5 @@
    "java.checkstyle.configuration": "${workspaceFolder}/gradle/config/checkstyle/checkstyle.xml",
    "files.watcherExclude": {
        "**/target": true
-    },
-    "java.configuration.updateBuildConfiguration": "automatic"
+    }
 }
--- a/README.adoc
+++ b/README.adoc
@@ -1,11 +1,12 @@
 = sshj - SSHv2 library for Java
 Jeroen van Erp
 :sshj_groupid: com.hierynomus
-:sshj_version: 0.36.0
+:sshj_version: 0.31.0
 :source-highlighter: pygments

-image:https://github.com/hierynomus/sshj/actions/workflows/gradle.yml/badge.svg[link="https://github.com/hierynomus/sshj/actions/workflows/gradle.yml"]
-image:https://app.codacy.com/project/badge/Grade/2c8a5a67c6a54ed89c9a699fd6b27305["Codacy Grade", link="https://app.codacy.com/gh/hierynomus/sshj"]
+image:https://api.bintray.com/packages/hierynomus/maven/sshj/images/download.svg[link="https://bintray.com/hierynomus/maven/sshj/_latestVersion"]
+image:https://travis-ci.org/hierynomus/sshj.svg?branch=master[link="https://travis-ci.org/hierynomus/sshj"]
+image:https://api.codacy.com/project/badge/Grade/14a0a316bb9149739b5ea26dbfa8da8a["Codacy code quality", link="https://www.codacy.com/app/jeroen_2/sshj?utm_source=github.com&utm_medium=referral&utm_content=hierynomus/sshj&utm_campaign=Badge_Grade"]
 image:https://codecov.io/gh/hierynomus/sshj/branch/master/graph/badge.svg["codecov", link="https://codecov.io/gh/hierynomus/sshj"]
 image:http://www.javadoc.io/badge/com.hierynomus/sshj.svg?color=blue["JavaDocs", link="http://www.javadoc.io/doc/com.hierynomus/sshj"]
 image:https://maven-badges.herokuapp.com/maven-central/com.hierynomus/sshj/badge.svg["Maven Central",link="https://maven-badges.herokuapp.com/maven-central/com.hierynomus/sshj"]
@@ -95,11 +96,7 @@ If you need something that is not included, it shouldn't be too hard to add (do
 http://ssh-comparison.quendi.de/comparison.html[SSH Implementation Comparison]

 == Dependencies
-
- Java 8 or higher
- https://www.slf4j.org/[SLF4J 2.0.0]
- https://www.bouncycastle.org[Bouncy Castle]
-
+Java 6+. http://www.slf4j.org/download.html[slf4j] is required. http://www.bouncycastle.org/java.html[bouncycastle] is highly recommended and required for using some of the crypto algorithms. http://www.jcraft.com/jzlib/[jzlib] is required for using zlib compression.

 == Reporting bugs
 Issue tracker: https://github.com/hierynomus/sshj/issues
@@ -108,61 +105,6 @@ Issue tracker: https://github.com/hierynomus/sshj/issues
 Fork away!

 == Release history
-SSHJ 0.36.0 (2023-09-04)::
-* Rewrote Integration tests to JUnit5
-* Merged https://github.com/hierynomus/sshj/pull/851[#851]: Fix race condition in key exchange causing intermittent SSH_MSG_UNIMPLEMENTED
-* Merged https://github.com/hierynomus/sshj/pull/861[#861]: Add DefaultSecurityProviderConfig with has BouncyCastle disabled
-* Merged https://github.com/hierynomus/sshj/pull/881[#881]: Rewrote test classes to JUnit Jupiter engine
-* Merged https://github.com/hierynomus/sshj/pull/880[#880]: Removed Java 7 backport Socket utilities
-* Merged https://github.com/hierynomus/sshj/pull/879[#879]: Replaced custom Base64 with java.util.Base64
-* Merged https://github.com/hierynomus/sshj/pull/852[#852]: Removed unused bcrypt password hashing methods
-* Merged https://github.com/hierynomus/sshj/pull/874[#874]: Java 8 minimum version + dependency upgrades
-* Merged https://github.com/hierynomus/sshj/pull/876[#876]: Change `newStatefulSFTPClient` to return `StatefulSFTPClient`
-* Merged https://github.com/hierynomus/sshj/pull/860[#860]: Upgrade to Gradle 7.6.1
-* Merged https://github.com/hierynomus/sshj/pull/838[#838]: Replaced Curve25519 class with X25519 Key agreement
-* Merged https://github.com/hierynomus/sshj/pull/772[#772]: Remove dependency on jzlib
-SSHJ 0.35.0 (2023-01-30)::
-* Merged https://github.com/hierynomus/sshj/pull/835[#835]: TimeoutException message improved
-* Merged https://github.com/hierynomus/sshj/pull/815[#815]: Support authPassword on FreeBSD
-* Merged https://github.com/hierynomus/sshj/pull/813[#813]: Prevent `CHANNEL_CLOSE` between isOpen and write call.
-* Merged https://github.com/hierynomus/sshj/pull/811[#811]: Add `Transport.isKeyExchangeREquired` to prevent unnecessary KEXINIT
-SSHJ 0.34.0 (2022-08-10)::
-* Merged https://github.com/hierynomus/sshj/pull/743[#743]: Use default client credentials for AuthGssApiWithMic
-* Merged https://github.com/hierynomus/sshj/pull/801[#801]: Restore thread interrupt status after catching InterruptedException
-* Merged https://github.com/hierynomus/sshj/pull/793[#793]: Merge PKCS5 and PKCS8 classes
-* Upgraded dependencies SLF4J (1.7.36) and Logback (1.2.11)
-* Merged https://github.com/hierynomus/sshj/pull/791[#791]: Update KeepAlive examples
-* Merged https://github.com/hierynomus/sshj/pull/775[#775]: Add SFTP resume support
-SSHJ 0.33.0 (2022-04-22)::
-* Upgraded dependencies BouncyCastle (1.70)
-* Merged https://github.com/hierynomus/sshj/pull/687[#687]: Correctly close connection when remote closes connection.
-* Merged https://github.com/hierynomus/sshj/pull/741[#741]: Add support for testcontainers in test setup to test more scenarios
-* Merged https://github.com/hierynomus/sshj/pull/733[#733]: Send correct key proposal if client knows CA key
-* Merged https://github.com/hierynomus/sshj/pull/746[#746]: Fix bug in reading Putty private key file with passphrase
-* Merged https://github.com/hierynomus/sshj/pull/742[#742]: Use Config.keyAlgorithms to determine rsa-sha2 support
-* Merged https://github.com/hierynomus/sshj/pull/754[#754]: Use SFTP protocol version to set FXP rename flags conditionally
-* Merged https://github.com/hierynomus/sshj/pull/752[#752]: Correctly start and terminate KeepAlive thread
-* Merged https://github.com/hierynomus/sshj/pull/753[#753]: Provide better thread names
-* Merged https://github.com/hierynomus/sshj/pull/724[#724]: Add parameter to limit read ahead length
-* Merged https://github.com/hierynomus/sshj/pull/763[#763]: Try all public key algorithms for a specific key type
-* Merged https://github.com/hierynomus/sshj/pull/756[#756]: Remove deprecated proxy connect methods
-* Merged https://github.com/hierynomus/sshj/pull/770[#770]: Add support for `ed25519` `aes-128-cbc` keys
-* Merged https://github.com/hierynomus/sshj/pull/773[#773]: Fix NPE when reading empty OpenSSHKeyV1KeyFile
-* Merged https://github.com/hierynomus/sshj/pull/777[#777]: Don't request too many read-ahead packets
-
-SSHJ 0.32.0 (2021-10-12)::
-* Send EOF on channel close (Fixes https://github.com/hierynomus/sshj/issues/143[#143], https://github.com/hierynomus/sshj/issues/496[#496], https://github.com/hierynomus/sshj/issues/553[#553], https://github.com/hierynomus/sshj/issues/554[#554])
-* Merged https://github.com/hierynomus/sshj/pull/726[#726]: Parse OpenSSH v1 keys with full CRT information present
-* Merged https://github.com/hierynomus/sshj/pull/721[#721]: Prefer known host key algorithm for host key verification
-* Merged https://github.com/hierynomus/sshj/pull/716[#716], https://github.com/hierynomus/sshj/pull/729[#729] and https://github.com/hierynomus/sshj/pull/730[#730]: Add full support for PuTTY v3 key files.
-* Merged https://github.com/hierynomus/sshj/pull/708[#708] and https://github.com/hierynomus/sshj/pull/713[#71]: Add support for PKCS#8 private keys
-* Merged https://github.com/hierynomus/sshj/pull/703[#703]: Support host certificate keys
-* Upgraded dependencies BouncyCastle (1.69), SLF4j (1.7.32), Logback (1.2.6), asn-one (0.6.0)
-* Merged https://github.com/hierynomus/sshj/pull/702[#702]: Support Public key authentication using certificates
-* Merged https://github.com/hierynomus/sshj/pull/691[#691]: Fix for writing negative unsigned integers to Buffer
-* Merged https://github.com/hierynomus/sshj/pull/682[#682]: Support for chacha20-poly1305@openssh.com cipher
-* Merged https://github.com/hierynomus/sshj/pull/680[#680]: Configurable preserve mtimes for SCP transfers
-
 SSHJ 0.31.0 (2021-02-08)::
 * Bump dependencies (asn-one 0.5.0, BouncyCastle 1.68, slf4j-api 1.7.30)
 * Merged https://github.com/hierynomus/sshj/pull/660[#660]: Support ED25519 and ECDSA keys in PuTTY format
--- a/build-publishing.gradle
+++ b/build-publishing.gradle
@@ -23,6 +23,7 @@ dependencies {
  compile "org.slf4j:slf4j-api:1.7.7"
  compile "org.bouncycastle:bcprov-jdk15on:$bouncycastleVersion"
  compile "org.bouncycastle:bcpkix-jdk15on:$bouncycastleVersion"
+  compile "com.jcraft:jzlib:1.1.3"

  testCompile "junit:junit:4.11"
  testCompile "org.mockito:mockito-core:1.9.5"
--- a/build.gradle
+++ b/build.gradle
@@ -1,27 +1,25 @@
+import java.text.SimpleDateFormat
+import com.bmuschko.gradle.docker.tasks.container.*
+import com.bmuschko.gradle.docker.tasks.image.*
+
 plugins {
  id "java"
-  id "jvm-test-suite"
  id "groovy"
  id "jacoco"
-  id "com.github.blindpirate.osgi" version '0.0.6'
+  id "com.github.blindpirate.osgi" version '0.0.3'
  id "maven-publish"
-  id "signing"
-  id 'pl.allegro.tech.build.axion-release' version '1.15.3'
-  id "com.github.hierynomus.license" version "0.16.1"
-  id "com.bmuschko.docker-remote-api" version "9.2.1"
-  id 'ru.vyarus.github-info' version '1.5.0'
-  id "io.github.gradle-nexus.publish-plugin" version "1.3.0"
+  id 'pl.allegro.tech.build.axion-release' version '1.11.0'
+  id "com.bmuschko.docker-remote-api" version "6.4.0"
+  id "com.github.hierynomus.license" version "0.12.1"
+  id "com.jfrog.bintray" version "1.8.5"
+  id 'ru.vyarus.java-lib' version '1.0.5'
+  // id 'ru.vyarus.pom' version '1.0.3'
+  id 'ru.vyarus.github-info' version '1.1.0'
 }

 group = "com.hierynomus"
 ext.moduleName = "${project.group}.${project.name}"

-defaultTasks "build"
-
-repositories {
-  mavenCentral()
-}
-
 scmVersion {
  tag {
    prefix = 'v'
@@ -35,21 +33,36 @@ scmVersion {

 project.version = scmVersion.version

-compileJava {
-  options.release = 8
+defaultTasks "build"
+
+repositories {
+  mavenCentral()
 }

-configurations.implementation.transitive = false
+configurations.compile.transitive = false

-def bouncycastleVersion = "1.75"
-def sshdVersion = "2.10.0"
+def bouncycastleVersion = "1.69"
+def sshdVersion = "2.1.0"

 dependencies {
-  implementation "org.slf4j:slf4j-api:2.0.7"
-  implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion"
-  implementation "org.bouncycastle:bcpkix-jdk18on:$bouncycastleVersion"
-  implementation "com.hierynomus:asn-one:0.6.0"
+  implementation "org.slf4j:slf4j-api:1.7.30"
+  implementation "org.bouncycastle:bcprov-jdk15on:$bouncycastleVersion"
+  implementation "org.bouncycastle:bcpkix-jdk15on:$bouncycastleVersion"
+  implementation "com.jcraft:jzlib:1.1.3"
+  implementation "com.hierynomus:asn-one:0.5.0"
+
  implementation "net.i2p.crypto:eddsa:0.3.0"
+
+  testImplementation "junit:junit:4.12"
+  testImplementation 'org.spockframework:spock-core:1.3-groovy-2.4'
+  testImplementation "org.mockito:mockito-core:2.28.2"
+  testImplementation "org.apache.sshd:sshd-core:$sshdVersion"
+  testImplementation "org.apache.sshd:sshd-sftp:$sshdVersion"
+  testImplementation "org.apache.sshd:sshd-scp:$sshdVersion"
+  testRuntimeOnly "ch.qos.logback:logback-classic:1.2.3"
+  testImplementation 'org.glassfish.grizzly:grizzly-http-server:2.4.4'
+  testImplementation 'org.apache.httpcomponents:httpclient:4.5.9'
+
 }

 license {
@@ -58,16 +71,7 @@ license {
  mapping {
    java = 'SLASHSTAR_STYLE'
  }
-  excludes([
-    '**/sshj/common/Base64.java',
-    '**/com/hierynomus/sshj/userauth/keyprovider/bcrypt/*.java',
-    '**/files/test_file_*.txt',
-  ])
-}
-
-java {
-	withJavadocJar()
-	withSourcesJar()
+  excludes(['**/djb/Curve25519.java', '**/sshj/common/Base64.java', '**/org/mindrot/jbcrypt/*.java'])
 }

 if (!JavaVersion.current().isJava9Compatible()) {
@@ -81,82 +85,11 @@ if (JavaVersion.current().isJava8Compatible()) {
  }
 }

-testing {
-  suites {
-    configureEach {
-      useJUnitJupiter()
-      dependencies {
-        implementation "org.slf4j:slf4j-api:2.0.7"
-        implementation 'org.spockframework:spock-core:2.3-groovy-3.0'
-        implementation "org.mockito:mockito-core:4.11.0"
-        implementation "org.assertj:assertj-core:3.24.2"
-        implementation "ru.vyarus:spock-junit5:1.2.0"
-        implementation "org.apache.sshd:sshd-core:$sshdVersion"
-        implementation "org.apache.sshd:sshd-sftp:$sshdVersion"
-        implementation "org.apache.sshd:sshd-scp:$sshdVersion"
-        implementation "ch.qos.logback:logback-classic:1.3.8"
-        implementation 'org.glassfish.grizzly:grizzly-http-server:3.0.1'
-      }

-      targets {
-        all {
-          testTask.configure {
-            testLogging {
-              showStandardStreams = false
-              exceptionFormat = 'full'
-            }
-            include "**/*Test.*"
-            include "**/*Spec.*"
-            afterSuite { descriptor, result ->
-              def indicator = "\u001B[32m✓\u001b[0m"
-              if (result.failedTestCount > 0) {
-                indicator = "\u001B[31m✘\u001b[0m"
-              }
-              logger.lifecycle("$indicator Test ${descriptor.name}; Executed: ${result.testCount}/\u001B[32m${result.successfulTestCount}\u001B[0m/\u001B[31m${result.failedTestCount}\u001B[0m")
-            }
-          }
-        }
-      }
-    }
-
-    test {
-      sources {
-        groovy {
-          srcDirs = ['src/test/groovy']
-        }
-      }
-    }
-
-    integrationTest(JvmTestSuite) {
-      dependencies {
-        implementation project()
-        implementation 'org.testcontainers:testcontainers:1.18.3'
-        implementation 'org.testcontainers:junit-jupiter:1.18.3'
-      }
-
-      sources {
-        java {
-          srcDirs = ['src/itest/java']
-        }
-
-        resources {
-          srcDirs = ['src/itest/resources']
-        }
-      }
-
-      targets {
-        all {
-          testTask.configure {
-            shouldRunAfter(test)
-          }
-        }
-      }
-    }
-  }
+compileJava {
+  options.compilerArgs.addAll(['--release', '7'])
 }

-project.tasks.compileGroovy.onlyIf { false }
-
 task writeSshjVersionProperties {
  doLast {
    project.file("${project.buildDir}/resources/main").mkdirs()
@@ -203,96 +136,175 @@ sourcesJar {
  }
 }

+configurations {
+  integrationTestImplementation.extendsFrom testImplementation
+  integrationTestRuntimeOnly.extendsFrom testRuntimeOnly
+}
+
+sourceSets {
+  integrationTest {
+    groovy {
+      compileClasspath += sourceSets.main.output + sourceSets.test.output
+      runtimeClasspath += sourceSets.main.output + sourceSets.test.output
+      srcDir file('src/itest/groovy')
+    }
+    resources.srcDir file('src/itest/resources')
+  }
+}
+
+task integrationTest(type: Test) {
+  testClassesDirs = sourceSets.integrationTest.output.classesDirs
+  classpath = sourceSets.integrationTest.runtimeClasspath
+}
+
+tasks.withType(Test) {
+  testLogging {
+    exceptionFormat = 'full'
+  }
+  include "**/*Test.*"
+  include "**/*Spec.*"
+  if (!project.hasProperty("allTests")) {
+    useJUnit {
+      excludeCategories 'com.hierynomus.sshj.test.SlowTests'
+      excludeCategories 'com.hierynomus.sshj.test.KnownFailingTests'
+    }
+  }
+
+  afterSuite { descriptor, result ->
+    if (descriptor.className != null) {
+      def indicator = "\u001B[32m✓\u001b[0m"
+      if (result.failedTestCount > 0) {
+        indicator = "\u001B[31m✘\u001b[0m"
+      }
+      logger.lifecycle("$indicator Test ${descriptor.name}; Executed: ${result.testCount}/\u001B[32m${result.successfulTestCount}\u001B[0m/\u001B[31m${result.failedTestCount}\u001B[0m")
+    }
+  }
+}
+
+project.tasks.compileGroovy.onlyIf { false }
+
 github {
  user 'hierynomus'
  license 'Apache'
 }

-publishing {
-	publications {
-		maven(MavenPublication) {
-			from(components.java)
-		}
-	}
-}
-
-project.signing {
-  required { project.gradle.taskGraph.hasTask("release") }
-	sign publishing.publications.maven
-
-  if (project.hasProperty("signingKeyId") || project.hasProperty("signingKey")) {
-		def signingKeyId = project.findProperty("signingKeyId")
-		def signingKey = project.findProperty("signingKey")
-		def signingPassword = project.findProperty("signingPassword")
-		if (signingKeyId) {
-			useInMemoryPgpKeys(signingKeyId, signingKey, signingPassword)
-		} else if (signingKey) {
-			useInMemoryPgpKeys(signingKey, signingPassword)
-		}
-	}
-}
-
-project.plugins.withType(MavenPublishPlugin).all {
-	PublishingExtension publishing = project.extensions.getByType(PublishingExtension)
-	publishing.publications.withType(MavenPublication).all { mavenPublication ->
-		mavenPublication.pom {
-			name = "${project.name}"
-      description = 'SSHv2 library for Java'
-      inceptionYear = '2009'
-      url = "https://github.com/hierynomus/${project.name}"
-			licenses {
-				license {
-					name = "The Apache License, Version 2.0"
-					url = "https://www.apache.org/licenses/LICENSE-2.0"
-				}
-			}
-			developers {
-				developer {
-					id = "hierynomus"
-					name = "Jeroen van Erp"
-					email = "jeroen@hierynomus.com"
-				}
-				developer {
-					id = "shikhar"
-					name = "Shikhar Bhushan"
-					email = "shikhar@schmizz.net"
-          url = "http://schmizz.net"
-          roles = ["Previous Lead developer"]
-				}
-        developer {
-          id = "iterate"
-          name = "David Kocher"
-          email = "dkocher@iterate.ch"
-          organization = "iterate GmbH"
-          organizationUrl = "https://iterate.ch"
-          roles = ["Developer"]
-        }
-			}
-      scm {
-        url = "https://github.com/hierynomus/${project.name}"
-        connection = "scm:git@github.com:hierynomus/${project.name}.git"
-        developerConnection = "scm:git@github.com:hierynomus/${project.name}.git"
+pom {
+  description "SSHv2 library for Java"
+  url "https://github.com/hierynomus/sshj"
+  inceptionYear "2009"
+  developers {
+    developer {
+      id "hierynomus"
+      name "Jeroen van Erp"
+      email "jeroen@javadude.nl"
+      roles {
+        role "Lead developer"
      }
-		}
-	}
+    }
+    developer {
+      id "shikhar"
+      name "Shikhar Bhushan"
+      email "shikhar@schmizz.net"
+      url "http://schmizz.net"
+      roles {
+        role "Previous lead developer"
+      }
+    }
+    developer {
+      id "iterate"
+      name "David Kocher"
+      email "dkocher@iterate.ch"
+      organization "iterage GmbH"
+      organizationUrl "https://iterate.ch"
+      roles {
+        role "Developer"
+      }
+    }
+  }
 }

-nexusPublishing {
-	repositories {
-		sonatype()    //sonatypeUsername and sonatypePassword properties are used automatically
-	}
-
-	connectTimeout = Duration.ofMinutes(3)
-	clientTimeout = Duration.ofMinutes(3)
+if (project.hasProperty("bintrayUsername") && project.hasProperty("bintrayApiKey")) {
+  bintray {
+    user = project.property("bintrayUsername")
+    key = project.property("bintrayApiKey")
+    publish = true
+    publications = ["maven"]
+    pkg {
+      repo = "maven"
+      name = "${project.name}"
+      licenses = ["Apache-2.0"]
+      vcsUrl = "https://github.com/hierynomus/sshj.git"
+      labels = ["ssh", "sftp", "secure-shell", "network", "file-transfer"]
+      githubRepo = "hierynomus/sshj"
+      version {
+        name = "${project.version}"
+        vcsTag = "v${project.version}"
+        released = new SimpleDateFormat('yyyy-MM-dd\'T\'HH:mm:ss.SSSZZ').format(new Date())
+        gpg {
+          sign = true
+          passphrase = project.property("signing.password")
+        }
+        mavenCentralSync {
+          sync = true
+          user = project.property("sonatypeUsername")
+          password = project.property("sonatypePassword")
+          close = 1
+        }
+      }
+    }
+  }
 }

 jacocoTestReport {
    reports {
-        xml.required = true
-        html.required = true
+        xml.enabled true
+        html.enabled true
    }
 }

+
+task buildItestImage(type: DockerBuildImage) {
+    inputDir = file('src/itest/docker-image')
+    images.add('sshj/sshd-itest:latest')
+}
+
+task createItestContainer(type: DockerCreateContainer) {
+    dependsOn buildItestImage
+    targetImageId buildItestImage.getImageId()
+    hostConfig.portBindings = ['2222:22']
+    hostConfig.autoRemove = true
+}
+
+task startItestContainer(type: DockerStartContainer) {
+    dependsOn createItestContainer
+    targetContainerId createItestContainer.getContainerId()
+}
+
+task logItestContainer(type: DockerLogsContainer) {
+    dependsOn createItestContainer
+    targetContainerId createItestContainer.getContainerId()
+    showTimestamps = true
+    stdErr = true
+    stdOut = true
+    tailAll = true
+}
+
+task stopItestContainer(type: DockerStopContainer) {
+    targetContainerId createItestContainer.getContainerId()
+}
+
+task forkedUploadRelease(type: GradleBuild) {
+  buildFile = project.buildFile
+  tasks = ["bintrayUpload"]
+}
+
+project.tasks.integrationTest.dependsOn(startItestContainer)
+project.tasks.integrationTest.finalizedBy(stopItestContainer)
+
+// Being enabled, it pollutes logs on CI. Uncomment when debugging some test to get sshd logs.
+// project.tasks.stopItestContainer.dependsOn(logItestContainer)
+
 project.tasks.release.dependsOn([project.tasks.integrationTest, project.tasks.build])
+project.tasks.release.finalizedBy(project.tasks.forkedUploadRelease)
 project.tasks.jacocoTestReport.dependsOn(project.tasks.test)
 project.tasks.check.dependsOn(project.tasks.jacocoTestReport)
--- a/examples/pom.xml
+++ b/examples/pom.xml
@@ -24,7 +24,7 @@
    <groupId>com.hierynomus</groupId>
    <artifactId>sshj-examples</artifactId>
    <packaging>jar</packaging>
-    <version>0.33.0</version>
+    <version>0.19.1</version>

    <name>sshj-examples</name>
    <description>Examples for SSHv2 library for Java</description>
@@ -55,7 +55,7 @@
        <dependency>
            <groupId>com.hierynomus</groupId>
            <artifactId>sshj</artifactId>
-            <version>0.33.0</version>
+            <version>0.31.0</version>
        </dependency>
    </dependencies>

--- a/examples/src/main/java/net/schmizz/sshj/examples/KeepAlive.java
+++ b/examples/src/main/java/net/schmizz/sshj/examples/KeepAlive.java
@@ -19,9 +19,8 @@ public class KeepAlive {
        final SSHClient ssh = new SSHClient(defaultConfig);
        try {
            ssh.addHostKeyVerifier(new PromiscuousVerifier());
-            // Set interval to enable keep-alive before connecting
-            ssh.getConnection().getKeepAlive().setKeepAliveInterval(5);
            ssh.connect(args[0]);
+            ssh.getConnection().getKeepAlive().setKeepAliveInterval(5); //every 60sec
            ssh.authPassword(args[1], args[2]);
            Session session = ssh.startSession();
            session.allocateDefaultPTY();
--- a/examples/src/main/java/net/schmizz/sshj/examples/RemotePF.java
+++ b/examples/src/main/java/net/schmizz/sshj/examples/RemotePF.java
@@ -19,7 +19,6 @@ public class RemotePF {
        client.loadKnownHosts();

        client.connect("localhost");
-        client.getConnection().getKeepAlive().setKeepAliveInterval(5);
        try {

            client.authPublickey(System.getProperty("user.name"));
@@ -34,6 +33,8 @@ public class RemotePF {
                    // what we do with incoming connections that are forwarded to us
                    new SocketForwardingConnectListener(new InetSocketAddress("google.com", 80)));

+            client.getTransport().setHeartbeatInterval(30);
+
            // Something to hang on to so that the forwarding stays
            client.getTransport().join();

--- a/gradle/wrapper/gradle-wrapper.jar
+++ b/gradle/wrapper/gradle-wrapper.jar
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-6.4-bin.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
--- a/259
+++ b/259
@@ -1,7 +1,7 @@
-#!/bin/sh
+#!/usr/bin/env sh

 #
-# Copyright © 2015-2021 the original authors.
+# Copyright 2015 the original author or authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -17,113 +17,78 @@
 #

 ##############################################################################
-#
-#   Gradle start up script for POSIX generated by Gradle.
-#
-#   Important for running:
-#
-#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
-#       noncompliant, but you have some other compliant shell such as ksh or
-#       bash, then to run this script, type that shell name before the whole
-#       command line, like:
-#
-#           ksh Gradle
-#
-#       Busybox and similar reduced shells will NOT work, because this script
-#       requires all of these POSIX shell features:
-#         * functions;
-#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
-#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
-#         * compound commands having a testable exit status, especially «case»;
-#         * various built-in commands including «command», «set», and «ulimit».
-#
-#   Important for patching:
-#
-#   (2) This script targets any POSIX shell, so it avoids extensions provided
-#       by Bash, Ksh, etc; in particular arrays are avoided.
-#
-#       The "traditional" practice of packing multiple parameters into a
-#       space-separated string is a well documented source of bugs and security
-#       problems, so this is (mostly) avoided, by progressively accumulating
-#       options in "$@", and eventually passing that to Java.
-#
-#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
-#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
-#       see the in-line comments for details.
-#
-#       There are tweaks for specific operating systems such as AIX, CygWin,
-#       Darwin, MinGW, and NonStop.
-#
-#   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
-#       within the Gradle project.
-#
-#       You can find Gradle at https://github.com/gradle/gradle/.
-#
+##
+##  Gradle start up script for UN*X
+##
 ##############################################################################

 # Attempt to set APP_HOME
-
 # Resolve links: $0 may be a link
-app_path=$0
-
-# Need this for daisy-chained symlinks.
-while
-    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
-    [ -h "$app_path" ]
-do
-    ls=$( ls -ld "$app_path" )
-    link=${ls#*' -> '}
-    case $link in             #(
-      /*)   app_path=$link ;; #(
-      *)    app_path=$APP_HOME$link ;;
-    esac
+PRG="$0"
+# Need this for relative symlinks.
+while [ -h "$PRG" ] ; do
+    ls=`ls -ld "$PRG"`
+    link=`expr "$ls" : '.*-> \(.*\)$'`
+    if expr "$link" : '/.*' > /dev/null; then
+        PRG="$link"
+    else
+        PRG=`dirname "$PRG"`"/$link"
+    fi
 done
-
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+SAVED="`pwd`"
+cd "`dirname \"$PRG\"`/" >/dev/null
+APP_HOME="`pwd -P`"
+cd "$SAVED" >/dev/null

 APP_NAME="Gradle"
-APP_BASE_NAME=${0##*/}
+APP_BASE_NAME=`basename "$0"`

 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'

 # Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD=maximum
+MAX_FD="maximum"

 warn () {
    echo "$*"
-} >&2
+}

 die () {
    echo
    echo "$*"
    echo
    exit 1
-} >&2
+}

 # OS specific support (must be 'true' or 'false').
 cygwin=false
 msys=false
 darwin=false
 nonstop=false
-case "$( uname )" in                #(
-  CYGWIN* )         cygwin=true  ;; #(
-  Darwin* )         darwin=true  ;; #(
-  MSYS* | MINGW* )  msys=true    ;; #(
-  NONSTOP* )        nonstop=true ;;
+case "`uname`" in
+  CYGWIN* )
+    cygwin=true
+    ;;
+  Darwin* )
+    darwin=true
+    ;;
+  MINGW* )
+    msys=true
+    ;;
+  NONSTOP* )
+    nonstop=true
+    ;;
 esac

 CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar

-
 # Determine the Java command to use to start the JVM.
 if [ -n "$JAVA_HOME" ] ; then
    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
        # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD=$JAVA_HOME/jre/sh/java
+        JAVACMD="$JAVA_HOME/jre/sh/java"
    else
-        JAVACMD=$JAVA_HOME/bin/java
+        JAVACMD="$JAVA_HOME/bin/java"
    fi
    if [ ! -x "$JAVACMD" ] ; then
        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
@@ -132,7 +97,7 @@ Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
    fi
 else
-    JAVACMD=java
+    JAVACMD="java"
    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.

 Please set the JAVA_HOME variable in your environment to match the
@@ -140,95 +105,79 @@ location of your Java installation."
 fi

 # Increase the maximum file descriptors if we can.
-if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
-    case $MAX_FD in #(
-      max*)
-        MAX_FD=$( ulimit -H -n ) ||
-            warn "Could not query maximum file descriptor limit"
-    esac
-    case $MAX_FD in  #(
-      '' | soft) :;; #(
-      *)
-        ulimit -n "$MAX_FD" ||
-            warn "Could not set maximum file descriptor limit to $MAX_FD"
-    esac
+if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
+    MAX_FD_LIMIT=`ulimit -H -n`
+    if [ $? -eq 0 ] ; then
+        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
+            MAX_FD="$MAX_FD_LIMIT"
+        fi
+        ulimit -n $MAX_FD
+        if [ $? -ne 0 ] ; then
+            warn "Could not set maximum file descriptor limit: $MAX_FD"
+        fi
+    else
+        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
+    fi
 fi

-# Collect all arguments for the java command, stacking in reverse order:
-#   * args from the command line
-#   * the main class name
-#   * -classpath
-#   * -D...appname settings
-#   * --module-path (only if needed)
-#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+# For Darwin, add options to specify how the application appears in the dock
+if $darwin; then
+    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
+fi

 # For Cygwin or MSYS, switch paths to Windows format before running java
-if "$cygwin" || "$msys" ; then
-    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
-    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
+    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
+    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
+    JAVACMD=`cygpath --unix "$JAVACMD"`

-    JAVACMD=$( cygpath --unix "$JAVACMD" )
-
-    # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    for arg do
-        if
-            case $arg in                                #(
-              -*)   false ;;                            # don't mess with options #(
-              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
-                    [ -e "$t" ] ;;                      #(
-              *)    false ;;
-            esac
-        then
-            arg=$( cygpath --path --ignore --mixed "$arg" )
-        fi
-        # Roll the args list around exactly as many times as the number of
-        # args, so each arg winds up back in the position where it started, but
-        # possibly modified.
-        #
-        # NB: a `for` loop captures its iteration list before it begins, so
-        # changing the positional parameters here affects neither the number of
-        # iterations, nor the values presented in `arg`.
-        shift                   # remove old arg
-        set -- "$@" "$arg"      # push replacement arg
+    # We build the pattern for arguments to be converted via cygpath
+    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
+    SEP=""
+    for dir in $ROOTDIRSRAW ; do
+        ROOTDIRS="$ROOTDIRS$SEP$dir"
+        SEP="|"
    done
+    OURCYGPATTERN="(^($ROOTDIRS))"
+    # Add a user-defined pattern to the cygpath arguments
+    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
+        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
+    fi
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    i=0
+    for arg in "$@" ; do
+        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
+        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
+
+        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
+            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
+        else
+            eval `echo args$i`="\"$arg\""
+        fi
+        i=`expr $i + 1`
+    done
+    case $i in
+        0) set -- ;;
+        1) set -- "$args0" ;;
+        2) set -- "$args0" "$args1" ;;
+        3) set -- "$args0" "$args1" "$args2" ;;
+        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
+        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
+        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
+        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
+        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
+        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+    esac
 fi

-# Collect all arguments for the java command;
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
-#     shell script including quotes and variable substitutions, so put them in
-#     double quotes to make sure that they get re-expanded; and
-#   * put everything else in single quotes, so that it's not re-expanded.
+# Escape application args
+save () {
+    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
+    echo " "
+}
+APP_ARGS=`save "$@"`

-set -- \
-        "-Dorg.gradle.appname=$APP_BASE_NAME" \
-        -classpath "$CLASSPATH" \
-        org.gradle.wrapper.GradleWrapperMain \
-        "$@"
-
-# Use "xargs" to parse quoted args.
-#
-# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
-#
-# In Bash we could simply go:
-#
-#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
-#   set -- "${ARGS[@]}" "$@"
-#
-# but POSIX shell has neither arrays nor command substitution, so instead we
-# post-process each arg (as a line of input to sed) to backslash-escape any
-# character that might be a shell metacharacter, then use eval to reverse
-# that process (while maintaining the separation between arguments), and wrap
-# the whole thing up as a single "set" statement.
-#
-# This will of course break if any of these variables contains a newline or
-# an unmatched quote.
-#
-
-eval "set -- $(
-        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
-        xargs -n1 |
-        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
-        tr '\n' ' '
-    )" '"$@"'
+# Collect all arguments for the java command, following the shell quoting and substitution rules
+eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"

 exec "$JAVACMD" "$@"
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -40,7 +40,7 @@ if defined JAVA_HOME goto findJavaFromJavaHome

 set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
-if "%ERRORLEVEL%" == "0" goto execute
+if "%ERRORLEVEL%" == "0" goto init

 echo.
 echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
@@ -54,7 +54,7 @@ goto fail
 set JAVA_HOME=%JAVA_HOME:"=%
 set JAVA_EXE=%JAVA_HOME%/bin/java.exe

-if exist "%JAVA_EXE%" goto execute
+if exist "%JAVA_EXE%" goto init

 echo.
 echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
@@ -64,14 +64,28 @@ echo location of your Java installation.

 goto fail

+:init
+@rem Get command-line arguments, handling Windows variants
+
+if not "%OS%" == "Windows_NT" goto win9xME_args
+
+:win9xME_args
+@rem Slurp the command line arguments.
+set CMD_LINE_ARGS=
+set _SKIP=2
+
+:win9xME_args_slurp
+if "x%~1" == "x" goto execute
+
+set CMD_LINE_ARGS=%*
+
 :execute
@rem Setup the command line

 set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar

-
@rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS%

 :end
@rem End local scope for the variables with windows NT shell
--- a/src/itest/docker-image/Dockerfile
+++ b/src/itest/docker-image/Dockerfile
@@ -0,0 +1,24 @@
+FROM sickp/alpine-sshd:7.5-r2
+
+ADD authorized_keys /home/sshj/.ssh/authorized_keys
+
+ADD test-container/ssh_host_ecdsa_key     /etc/ssh/ssh_host_ecdsa_key
+ADD test-container/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ecdsa_key.pub
+ADD test-container/ssh_host_ed25519_key   /etc/ssh/ssh_host_ed25519_key
+ADD test-container/ssh_host_ed25519_key.pub   /etc/ssh/ssh_host_ed25519_key.pub
+ADD test-container/sshd_config /etc/ssh/sshd_config
+COPY test-container/trusted_ca_keys /etc/ssh/trusted_ca_keys
+COPY test-container/host_keys/* /etc/ssh/
+
+RUN apk add --no-cache tini
+RUN \
+  echo "root:smile" | chpasswd && \
+  adduser -D -s /bin/ash sshj && \
+  passwd -u sshj && \
+  echo "sshj:ultrapassword" | chpasswd && \
+  chmod 600 /home/sshj/.ssh/authorized_keys && \
+  chmod 600 /etc/ssh/ssh_host_*_key && \
+  chmod 644 /etc/ssh/*.pub && \
+  chown -R sshj:sshj /home/sshj
+
+ENTRYPOINT ["/sbin/tini", "/entrypoint.sh", "-o", "LogLevel=DEBUG2"]
--- a/src/itest/docker-image/authorized_keys
+++ b/src/itest/docker-image/authorized_keys
@@ -3,7 +3,6 @@ ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHQiZm0w
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDAdJiRkkBM8yC8seTEoAn2PfwbLKrkcahZ0xxPoWICJ root@sshj
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ8ww4hJG/gHJYdkjTTBDF1GNz+228nuWprPV+NbQauA ajvanerp@Heimdall.local
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOaWrwt3drIOjeBq2LSHRavxAT7ja2f+5soOUJl/zKSI ajvanerp@Heimdall.xebialabs.com
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICYfPGSYFOHuSzTJ67H0ynvKJDfgDmwPOj7iJaLGbIBi sshjtest@TranceLove
 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoZ9l6Tkm2aL1tSBy2yw4xU5s8BE9MfqS/4J7DzvsYJxF6oQmTIjmStuhH/CT7UjuDtKXdXZUsIhKtafiizxGO8kHSzKDeitpth2RSr8ddMzZKyD6RNs7MfsgjA3UTtrrSrCXEY6O43S2cnuJrWzkPxtwxaQ3zOvDbS2tiulzyq0VzYmuhA/a4CyuQtJBuu+P2oqmu6pU/VB6IzONpvBvYbNPsH1WDmP7zko5wHPihXPCliztspKxS4DRtOZ7BGXyvg44UmIy0Kf4jOkaBV/eCCA4qH7ZHz71/5ceMOpszPcNOEmLGGYhwI+P3OuGMpkrSAv1f8IY6R8spZNncP6UaQ== no-passphrase
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDKRyZAtOJJfAhPU6xE6ZXY564vwErAI3n3Yn4lTHL9bxev9Ily6eCqPLcV0WbSV04pztngFn9MjT7yb8mcXheHpIaWEH569sMpmpOtyfn4p68SceuXBGyyPGMIcfOTknkASd1JYSD4EPkd9rZmCzcx3vEnLu8ChnA/G221xSVQ5VC/jD/c/CgNUayhQ+xbn57qHKKtZwfTa21QmwIabGYJNwlVjlKTCdddeVnZfKqKrG7cxHQApsxd21rhM9IT/C/f4Y/Tx3WUUVeam0iZ265oiPHoPALqJIWSQIUheRYAxYAQqJwSQ0Or9MM8XXun2Iy3RUSGk6eIvrCsFbNURsHNs7Pu0UnpYv6FZ3vCkFep/1pAT6fQvY7pDOOWDHKXArD4watc9gIWaQBH73wDW/KgBcnMRSoGWgQjsYqIamP4oV1+HqUI3lRAsXZaX+eiBGt3+3A5KebP27UJ1YUwhwlzs7wzTKaCu0OaL+hOsP1F2AxAa995bgFksMd23645ux3YCJKXG4sGpJ1Z/Hs49K72gv+QjLZVxXqY623c8+3OUhlixqoEFd4iG7UMc5a552ch/VA+jaspmLZoFhPz99aBRVb1oCSPxSwLw+Q/wxv6pZmT+14rqTzY2farjU53hM+CsUPh7dnWXhGG7RuA5wCdeOXOYjuksfzAoHIZhPqTgQ== ajvanerp@Heimdall.local
 ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBMvfRYSe44VQGwxexOMibcM3+fWeUP1jrBofOxFDRRrzRF8dK/vll2svqTPXMRnITnT1UoemEcB5OHtvH4hzfh/HFeDxJ5S7UncYxoClTSa8MeMFG2Zj9CoUZs1SHbwSGg== root@sshj
--- a/src/itest/docker-image/entrypoint.sh
+++ b/src/itest/docker-image/entrypoint.sh
@@ -1,7 +0,0 @@
-#!/bin/ash
-
-# generate host keys if not present
-ssh-keygen -A
-
-# do not detach (-D), log to stderr (-e), passthrough other arguments
-exec /usr/sbin/sshd -D -e "$@"
--- a/src/itest/docker-image/test-container/sshd_config
+++ b/src/itest/docker-image/test-container/sshd_config
@@ -0,0 +1,158 @@
+#	$OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_dsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin yes
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#PubkeyAuthentication yes
+
+# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
+# but this is overridden so installations will only check .ssh/authorized_keys
+AuthorizedKeysFile	.ssh/authorized_keys
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+#PasswordAuthentication yes
+#PermitEmptyPasswords no
+
+# Change to no to disable s/key passwords
+#ChallengeResponseAuthentication yes
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+#UsePAM no
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem	sftp	/usr/lib/ssh/sftp-server
+
+# the following are HPN related configuration options
+# tcp receive buffer polling. disable in non autotuning kernels
+#TcpRcvBufPoll yes
+
+# disable hpn performance boosts
+#HPNDisabled no
+
+# buffer size for hpn to non-hpn connections
+#HPNBufferSize 2048
+
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server
+
+KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1
+macs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com
+
+TrustedUserCAKeys /etc/ssh/trusted_ca_keys
+
+Ciphers 3des-cbc,blowfish-cbc,aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
+
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_dsa_key
+HostKey /etc/ssh/ssh_host_ecdsa_key
+HostKey /etc/ssh/ssh_host_ed25519_key
+
+HostKey /etc/ssh/ssh_host_ecdsa_256_key
+HostCertificate /etc/ssh/ssh_host_ecdsa_256_key-cert.pub
+
+HostKey /etc/ssh/ssh_host_ecdsa_384_key
+HostCertificate /etc/ssh/ssh_host_ecdsa_384_key-cert.pub
+
+HostKey /etc/ssh/ssh_host_ecdsa_521_key
+HostCertificate /etc/ssh/ssh_host_ecdsa_521_key-cert.pub
+
+HostKey /etc/ssh/ssh_host_ed25519_384_key
+HostCertificate /etc/ssh/ssh_host_ed25519_384_key-cert.pub
+
+HostKey /etc/ssh/ssh_host_rsa_2048_key
+HostCertificate /etc/ssh/ssh_host_rsa_2048_key-cert.pub
+
+LogLevel DEBUG2
--- a/src/itest/groovy/com/hierynomus/sshj/IntegrationBaseSpec.groovy
+++ b/src/itest/groovy/com/hierynomus/sshj/IntegrationBaseSpec.groovy
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj
+
+import net.schmizz.sshj.Config
+import net.schmizz.sshj.DefaultConfig
+import net.schmizz.sshj.SSHClient
+import net.schmizz.sshj.transport.verification.PromiscuousVerifier
+import spock.lang.Specification
+
+class IntegrationBaseSpec extends Specification {
+    protected static final int DOCKER_PORT = 2222
+    protected static final String USERNAME = "sshj"
+    protected static final String KEYFILE = "src/itest/resources/keyfiles/id_rsa"
+    protected final static String SERVER_IP = System.getProperty("serverIP", "127.0.0.1")
+
+    protected static SSHClient getConnectedClient(Config config) {
+        SSHClient sshClient = new SSHClient(config)
+        sshClient.addHostKeyVerifier(new PromiscuousVerifier())
+        sshClient.connect(SERVER_IP, DOCKER_PORT)
+
+        return sshClient
+    }
+
+    protected static SSHClient getConnectedClient() throws IOException {
+        return getConnectedClient(new DefaultConfig())
+    }
+
+}
--- a/src/itest/groovy/com/hierynomus/sshj/IntegrationSpec.groovy
+++ b/src/itest/groovy/com/hierynomus/sshj/IntegrationSpec.groovy
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj
+
+import com.hierynomus.sshj.key.KeyAlgorithms
+import net.schmizz.sshj.DefaultConfig
+import net.schmizz.sshj.SSHClient
+import net.schmizz.sshj.transport.TransportException
+import net.schmizz.sshj.userauth.UserAuthException
+import spock.lang.Unroll
+
+class IntegrationSpec extends IntegrationBaseSpec {
+
+    @Unroll
+    def "should accept correct key for #signatureName"() {
+        given:
+        def config = new DefaultConfig()
+        config.setKeyAlgorithms(Collections.singletonList(signatureFactory))
+        SSHClient sshClient = new SSHClient(config)
+        sshClient.addHostKeyVerifier(fingerprint) // test-containers/ssh_host_ecdsa_key's fingerprint
+
+        when:
+        sshClient.connect(SERVER_IP, DOCKER_PORT)
+
+        then:
+        sshClient.isConnected()
+
+        where:
+        signatureFactory << [KeyAlgorithms.ECDSASHANistp256(), KeyAlgorithms.EdDSA25519()]
+        fingerprint << ["d3:6a:a9:52:05:ab:b5:48:dd:73:60:18:0c:3a:f0:a3", "dc:68:38:ce:fc:6f:2c:d6:6d:6b:34:eb:5c:f0:41:6a"]
+        signatureName = signatureFactory.getName()
+    }
+
+    def "should decline wrong key"() throws IOException {
+        given:
+        SSHClient sshClient = new SSHClient(new DefaultConfig())
+        sshClient.addHostKeyVerifier("d4:6a:a9:52:05:ab:b5:48:dd:73:60:18:0c:3a:f0:a3")
+
+        when:
+        sshClient.connect(SERVER_IP, DOCKER_PORT)
+
+        then:
+        thrown(TransportException.class)
+    }
+
+    @Unroll
+    def "should authenticate with key #key"() {
+        given:
+        SSHClient client = getConnectedClient()
+
+        when:
+        def keyProvider = passphrase != null ? client.loadKeys("src/itest/resources/keyfiles/$key", passphrase) : client.loadKeys("src/itest/resources/keyfiles/$key")
+        client.authPublickey(USERNAME, keyProvider)
+
+        then:
+        client.isAuthenticated()
+
+        where:
+        key | passphrase
+//        "id_ecdsa_nistp256" | null // TODO: Need to improve PKCS8 key support.
+        "id_ecdsa_opensshv1" | null
+        "id_ed25519_opensshv1" | null
+        "id_ed25519_opensshv1_aes256cbc.pem" | "foobar"
+        "id_ed25519_opensshv1_protected" | "sshjtest"
+        "id_rsa" | null
+        "id_rsa_opensshv1" | null
+        "id_ecdsa_nistp384_opensshv1" | null
+        "id_ecdsa_nistp521_opensshv1" | null
+    }
+
+   def "should not authenticate with wrong key"() {
+        given:
+        SSHClient client = getConnectedClient()
+
+        when:
+        client.authPublickey("sshj", "src/itest/resources/keyfiles/id_unknown_key")
+
+        then:
+        thrown(UserAuthException.class)
+        !client.isAuthenticated()
+    }
+}
--- a/src/itest/groovy/com/hierynomus/sshj/sftp/FileWriteSpec.groovy
+++ b/src/itest/groovy/com/hierynomus/sshj/sftp/FileWriteSpec.groovy
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj.sftp
+
+import com.hierynomus.sshj.IntegrationBaseSpec
+import net.schmizz.sshj.SSHClient
+import net.schmizz.sshj.sftp.OpenMode
+import net.schmizz.sshj.sftp.RemoteFile
+import net.schmizz.sshj.sftp.SFTPClient
+
+import java.nio.charset.StandardCharsets
+
+import static org.codehaus.groovy.runtime.IOGroovyMethods.withCloseable
+
+class FileWriteSpec extends IntegrationBaseSpec {
+
+    def "should append to file (GH issue #390)"() {
+        given:
+        SSHClient client = getConnectedClient()
+        client.authPublickey("sshj", "src/test/resources/id_rsa")
+        SFTPClient sftp = client.newSFTPClient()
+        def file = "/home/sshj/test.txt"
+        def initialText = "This is the initial text.\n".getBytes(StandardCharsets.UTF_16)
+        def appendText = "And here's the appended text.\n".getBytes(StandardCharsets.UTF_16)
+
+        when:
+        withCloseable(sftp.open(file, EnumSet.of(OpenMode.WRITE, OpenMode.CREAT))) { RemoteFile initial ->
+            initial.write(0, initialText, 0, initialText.length)
+        }
+
+        then:
+        withCloseable(sftp.open(file, EnumSet.of(OpenMode.READ))) { RemoteFile read ->
+            def bytes = new byte[initialText.length]
+            read.read(0, bytes, 0, bytes.length)
+            bytes == initialText
+        }
+
+        when:
+        withCloseable(sftp.open(file, EnumSet.of(OpenMode.WRITE, OpenMode.APPEND))) { RemoteFile append ->
+            append.write(0, appendText, 0, appendText.length)
+        }
+
+        then:
+        withCloseable(sftp.open(file, EnumSet.of(OpenMode.READ))) { RemoteFile read ->
+            def bytes = new byte[initialText.length + appendText.length]
+            read.read(0, bytes, 0, bytes.length)
+            Arrays.copyOfRange(bytes, 0, initialText.length) == initialText
+            Arrays.copyOfRange(bytes, initialText.length, initialText.length + appendText.length) == appendText
+        }
+
+        cleanup:
+        sftp.close()
+        client.close()
+    }
+}
--- a/src/itest/groovy/com/hierynomus/sshj/signature/KeyWithCertificateSpec.groovy
+++ b/src/itest/groovy/com/hierynomus/sshj/signature/KeyWithCertificateSpec.groovy
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj.signature
+
+import com.hierynomus.sshj.IntegrationBaseSpec
+import net.schmizz.sshj.DefaultConfig
+import net.schmizz.sshj.SSHClient
+import net.schmizz.sshj.transport.verification.OpenSSHKnownHosts
+import spock.lang.Unroll
+
+import java.nio.file.Files
+import java.util.stream.Collectors
+
+/**
+ * This is a brief test for verifying connection to a server using keys with certificates.
+ *
+ * Also, take a look at the unit test {@link net.schmizz.sshj.transport.verification.KeyWithCertificateUnitSpec}.
+ */
+class KeyWithCertificateSpec extends IntegrationBaseSpec {
+
+    @Unroll
+    def "authorising with a signed public key #keyName"() {
+        given:
+        def client = getConnectedClient()
+
+        when:
+        client.authPublickey(USERNAME, "src/itest/resources/keyfiles/certificates/$keyName")
+
+        then:
+        client.authenticated
+
+        where:
+        keyName << [
+                "id_ecdsa_256_pem_signed_by_ecdsa",
+                "id_ecdsa_256_rfc4716_signed_by_ecdsa",
+                "id_ecdsa_256_pem_signed_by_ed25519",
+                "id_ecdsa_256_rfc4716_signed_by_ed25519",
+                "id_ecdsa_256_pem_signed_by_rsa",
+                "id_ecdsa_256_rfc4716_signed_by_rsa",
+                "id_ecdsa_384_pem_signed_by_ecdsa",
+                "id_ecdsa_384_rfc4716_signed_by_ecdsa",
+                "id_ecdsa_384_pem_signed_by_ed25519",
+                "id_ecdsa_384_rfc4716_signed_by_ed25519",
+                "id_ecdsa_384_pem_signed_by_rsa",
+                "id_ecdsa_384_rfc4716_signed_by_rsa",
+                "id_ecdsa_521_pem_signed_by_ecdsa",
+                "id_ecdsa_521_rfc4716_signed_by_ecdsa",
+                "id_ecdsa_521_pem_signed_by_ed25519",
+                "id_ecdsa_521_rfc4716_signed_by_ed25519",
+                "id_ecdsa_521_pem_signed_by_rsa",
+                "id_ecdsa_521_rfc4716_signed_by_rsa",
+                "id_rsa_2048_pem_signed_by_ecdsa",
+                "id_rsa_2048_rfc4716_signed_by_ecdsa",
+                "id_rsa_2048_pem_signed_by_ed25519",
+                "id_rsa_2048_rfc4716_signed_by_ed25519",
+                "id_rsa_2048_pem_signed_by_rsa",
+                "id_rsa_2048_rfc4716_signed_by_rsa",
+                "id_ed25519_384_rfc4716_signed_by_ecdsa",
+                "id_ed25519_384_rfc4716_signed_by_ed25519",
+                "id_ed25519_384_rfc4716_signed_by_rsa",
+        ]
+    }
+
+    @Unroll
+    def "accepting a signed host public key with type #hostKeyAlgo"() {
+        given:
+        File knownHosts = Files.createTempFile("known_hosts", "").toFile()
+        knownHosts.deleteOnExit()
+
+        and:
+        File caPubKey = new File("src/itest/resources/keyfiles/certificates/CA_rsa.pem.pub")
+        String knownHostsFileContents = "" +
+                "@cert-authority $SERVER_IP ${caPubKey.text}" +
+                "\n@cert-authority [$SERVER_IP]:$DOCKER_PORT ${caPubKey.text}"
+        knownHosts.write(knownHostsFileContents)
+
+        and:
+        def config = new DefaultConfig()
+        config.keyAlgorithms = config.keyAlgorithms.stream()
+                .filter { it.name == hostKeyAlgo }
+                .collect(Collectors.toList())
+        SSHClient sshClient = new SSHClient(config)
+        sshClient.addHostKeyVerifier(new OpenSSHKnownHosts(knownHosts))
+        sshClient.connect(SERVER_IP, DOCKER_PORT)
+
+        when:
+        sshClient.authPassword("sshj", "ultrapassword")
+
+        then:
+        sshClient.authenticated
+
+        and:
+        knownHosts.getText() == knownHostsFileContents
+
+        where:
+        hostKeyAlgo << [
+                "ecdsa-sha2-nistp256-cert-v01@openssh.com",
+                "ssh-ed25519-cert-v01@openssh.com",
+                "ssh-rsa-cert-v01@openssh.com",
+        ]
+    }
+}
--- a/src/itest/groovy/com/hierynomus/sshj/signature/RsaSignatureClientKeySpec.groovy
+++ b/src/itest/groovy/com/hierynomus/sshj/signature/RsaSignatureClientKeySpec.groovy
@@ -13,16 +13,22 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-package net.schmizz.sshj;
+package com.hierynomus.sshj.signature

-import net.schmizz.sshj.common.SecurityUtils;
+import com.hierynomus.sshj.IntegrationBaseSpec
+import net.schmizz.sshj.DefaultConfig
+import spock.lang.Unroll

-/**
- * SSHJ Configuration that uses the default Security Provider configuration from java.security and disables Bouncy Castle registration
- */
-public class DefaultSecurityProviderConfig extends DefaultConfig {
-    static {
-        // Disable Bouncy Castle Provider registration prior to invoking constructors
-        SecurityUtils.setRegisterBouncyCastle(false);
+class RsaSignatureClientKeySpec extends IntegrationBaseSpec {
+    @Unroll
+    def "should correctly connect using publickey auth with RSA key with signature"() {
+        given:
+        def client = getConnectedClient(new DefaultConfig())
+
+        when:
+        client.authPublickey(USERNAME, "src/itest/resources/keyfiles/id_rsa2")
+
+        then:
+        client.authenticated
    }
 }
--- a/src/itest/groovy/com/hierynomus/sshj/signature/SignatureSpec.groovy
+++ b/src/itest/groovy/com/hierynomus/sshj/signature/SignatureSpec.groovy
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj.signature
+
+import com.hierynomus.sshj.IntegrationBaseSpec
+import com.hierynomus.sshj.key.KeyAlgorithms
+import net.schmizz.sshj.DefaultConfig
+import spock.lang.Unroll
+
+class SignatureSpec extends IntegrationBaseSpec {
+
+    @Unroll
+    def "should correctly connect with #sig Signature"() {
+        given:
+        def cfg = new DefaultConfig()
+        cfg.setKeyAlgorithms(Collections.singletonList(sigFactory))
+        def client = getConnectedClient(cfg)
+
+        when:
+        client.authPublickey(USERNAME, KEYFILE)
+
+        then:
+        client.authenticated
+
+        where:
+        sigFactory << [KeyAlgorithms.SSHRSA(), KeyAlgorithms.RSASHA256(), KeyAlgorithms.RSASHA512()]
+        sig = sigFactory.name
+    }
+}
--- a/src/itest/groovy/com/hierynomus/sshj/transport/cipher/CipherSpec.groovy
+++ b/src/itest/groovy/com/hierynomus/sshj/transport/cipher/CipherSpec.groovy
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj.transport.cipher
+
+import com.hierynomus.sshj.IntegrationBaseSpec
+import net.schmizz.sshj.DefaultConfig
+import spock.lang.Unroll
+
+class CipherSpec extends IntegrationBaseSpec {
+
+    @Unroll
+    def "should correctly connect with #cipher Cipher"() {
+        given:
+        def cfg = new DefaultConfig()
+        cfg.setCipherFactories(cipherFactory)
+        def client = getConnectedClient(cfg)
+
+        when:
+        client.authPublickey(USERNAME, KEYFILE)
+
+        then:
+        client.authenticated
+
+        cleanup:
+        client.disconnect()
+
+        where:
+        cipherFactory << [BlockCiphers.TripleDESCBC(),
+                          BlockCiphers.BlowfishCBC(),
+                          BlockCiphers.AES128CBC(),
+                          BlockCiphers.AES128CTR(),
+                          BlockCiphers.AES192CBC(),
+                          BlockCiphers.AES192CTR(),
+                          BlockCiphers.AES256CBC(),
+                          BlockCiphers.AES256CTR(),
+                          GcmCiphers.AES128GCM(),
+                          GcmCiphers.AES256GCM(),
+                          ChachaPolyCiphers.CHACHA_POLY_OPENSSH()]
+        cipher = cipherFactory.name
+    }
+
+}
--- a/src/itest/groovy/com/hierynomus/sshj/transport/kex/KexSpec.groovy
+++ b/src/itest/groovy/com/hierynomus/sshj/transport/kex/KexSpec.groovy
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj.transport.kex
+
+import com.hierynomus.sshj.IntegrationBaseSpec
+import com.hierynomus.sshj.transport.mac.Macs
+import net.schmizz.sshj.DefaultConfig
+import net.schmizz.sshj.transport.kex.Curve25519DH
+import net.schmizz.sshj.transport.kex.Curve25519SHA256
+import net.schmizz.sshj.transport.kex.DH
+import net.schmizz.sshj.transport.kex.DHGexSHA1
+import net.schmizz.sshj.transport.kex.DHGexSHA256
+import net.schmizz.sshj.transport.kex.ECDH
+import net.schmizz.sshj.transport.kex.ECDHNistP
+import spock.lang.Unroll
+
+class KexSpec extends IntegrationBaseSpec {
+
+    @Unroll
+    def "should correctly connect with #kex Key Exchange"() {
+        given:
+        def cfg = new DefaultConfig()
+        cfg.setKeyExchangeFactories(kexFactory)
+        def client = getConnectedClient(cfg)
+
+        when:
+        client.authPublickey(USERNAME, KEYFILE)
+
+        then:
+        client.authenticated
+
+        where:
+        kexFactory << [DHGroups.Group1SHA1(),
+                       DHGroups.Group14SHA1(),
+                       DHGroups.Group14SHA256(),
+                       DHGroups.Group16SHA512(),
+                       DHGroups.Group18SHA512(),
+                       new DHGexSHA1.Factory(),
+                       new DHGexSHA256.Factory(),
+                       new Curve25519SHA256.Factory(),
+                       new Curve25519SHA256.FactoryLibSsh(),
+                       new ECDHNistP.Factory256(),
+                       new ECDHNistP.Factory384(),
+                       new ECDHNistP.Factory521()]
+        kex = kexFactory.name
+    }
+
+}
--- a/src/itest/groovy/com/hierynomus/sshj/transport/mac/MacSpec.groovy
+++ b/src/itest/groovy/com/hierynomus/sshj/transport/mac/MacSpec.groovy
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj.transport.mac
+
+import com.hierynomus.sshj.IntegrationBaseSpec
+import net.schmizz.sshj.DefaultConfig
+import spock.lang.Unroll
+
+class MacSpec extends IntegrationBaseSpec {
+
+    @Unroll
+    def "should correctly connect with #mac MAC"() {
+        given:
+        def cfg = new DefaultConfig()
+        cfg.setMACFactories(macFactory)
+        def client = getConnectedClient(cfg)
+
+        when:
+        client.authPublickey(USERNAME, KEYFILE)
+
+        then:
+        client.authenticated
+
+        cleanup:
+        client.disconnect()
+
+        where:
+        macFactory << [Macs.HMACRIPEMD160(), Macs.HMACRIPEMD160OpenSsh(), Macs.HMACSHA2256(), Macs.HMACSHA2512()]
+        mac = macFactory.name
+    }
+
+    @Unroll
+    def "should correctly connect with Encrypt-Then-Mac #mac MAC"() {
+        given:
+        def cfg = new DefaultConfig()
+        cfg.setMACFactories(macFactory)
+        def client = getConnectedClient(cfg)
+
+        when:
+        client.authPublickey(USERNAME, KEYFILE)
+
+        then:
+        client.authenticated
+
+        cleanup:
+        client.disconnect()
+
+        where:
+        macFactory << [Macs.HMACRIPEMD160Etm(), Macs.HMACSHA2256Etm(), Macs.HMACSHA2512Etm()]
+        mac = macFactory.name
+    }
+}
--- a/src/itest/java/com/hierynomus/sshj/HostKeyVerifierTest.java
+++ b/src/itest/java/com/hierynomus/sshj/HostKeyVerifierTest.java
@@ -1,72 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj;
-
-import static org.junit.Assert.assertThrows;
-import static org.junit.Assert.assertTrue;
-
-import java.util.List;
-import java.util.stream.Stream;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.Arguments;
-import org.junit.jupiter.params.provider.MethodSource;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
-
-import com.hierynomus.sshj.key.KeyAlgorithms;
-
-import net.schmizz.sshj.Config;
-import net.schmizz.sshj.DefaultConfig;
-import net.schmizz.sshj.SSHClient;
-import net.schmizz.sshj.transport.TransportException;
-
-@Testcontainers
-public class HostKeyVerifierTest {
-    @Container
-    private static final SshdContainer sshd = new SshdContainer();
-
-    public static Stream<Arguments> signatureAlgos() {
-        return Stream.of(
-            Arguments.of(KeyAlgorithms.ECDSASHANistp256(), "d3:6a:a9:52:05:ab:b5:48:dd:73:60:18:0c:3a:f0:a3"),
-            Arguments.of(KeyAlgorithms.EdDSA25519(), "dc:68:38:ce:fc:6f:2c:d6:6d:6b:34:eb:5c:f0:41:6a"));
-    }
-
-    @ParameterizedTest(name = "Should connect with signature verified for Key Algorithm {0}")
-    @MethodSource("signatureAlgos")
-    public void shouldConnectWithSignatureVerified(KeyAlgorithms.Factory alg, String fingerprint) throws Throwable {
-        Config config = new DefaultConfig();
-        config.setKeyAlgorithms(List.of(alg));
-
-        try (SSHClient client = new SSHClient(config)) {
-            client.addHostKeyVerifier(fingerprint);
-            client.connect(sshd.getHost(), sshd.getFirstMappedPort());
-
-            assertTrue(client.isConnected());
-        }
-    }
-
-    @Test
-    public void shouldDeclineWrongKey() throws Throwable {
-        try (SSHClient client = new SSHClient()) {
-            assertThrows(TransportException.class, () -> {
-                client.addHostKeyVerifier("d4:6a:a9:52:05:ab:b5:48:dd:73:60:18:0c:3a:f0:a3");
-                client.connect(sshd.getHost(), sshd.getFirstMappedPort());
-            });
-        }
-    }
-}
--- a/src/itest/java/com/hierynomus/sshj/ManyChannelsTest.java
+++ b/src/itest/java/com/hierynomus/sshj/ManyChannelsTest.java
@@ -1,74 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
-import java.util.concurrent.TimeUnit;
-
-import org.junit.jupiter.api.Test;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
-
-import com.hierynomus.sshj.SshdContainer.SshdConfigBuilder;
-
-import net.schmizz.sshj.SSHClient;
-import net.schmizz.sshj.common.IOUtils;
-import net.schmizz.sshj.connection.channel.direct.Session;
-
-import static org.assertj.core.api.Assertions.*;
-
-@Testcontainers
-public class ManyChannelsTest {
-    @Container
-    private static final SshdContainer sshd = new SshdContainer(SshdContainer.Builder.defaultBuilder()
-            .withSshdConfig(SshdConfigBuilder.defaultBuilder().with("MaxSessions", "200")).withAllKeys());
-
-    @Test
-    public void shouldWorkWithManyChannelsWithoutNoExistentChannelError_GH805() throws Throwable {
-        try (SSHClient client = sshd.getConnectedClient()) {
-            client.authPublickey("sshj", "src/test/resources/id_rsa");
-
-            List<Future<Exception>> futures = new ArrayList<>();
-            ExecutorService executorService = Executors.newCachedThreadPool();
-
-            for (int i = 0; i < 20; i++) {
-                futures.add(executorService.submit(() -> {
-                    try {
-                        for (int j = 0; j < 10; j++) {
-                            try (Session sshSession = client.startSession()) {
-                                try (Session.Command sshCommand = sshSession.exec("ls -la")) {
-                                    IOUtils.readFully(sshCommand.getInputStream()).toString();
-                                }
-                            }
-                        }
-                    } catch (Exception e) {
-                        return e;
-                    }
-                    return null;
-                }));
-            }
-
-            executorService.shutdown();
-            executorService.awaitTermination(1, TimeUnit.DAYS);
-
-            assertThat(futures).allSatisfy(future -> assertThat(future.get()).isNull());
-        }
-    }
-}
--- a/src/itest/java/com/hierynomus/sshj/PublicKeyAuthTest.java
+++ b/src/itest/java/com/hierynomus/sshj/PublicKeyAuthTest.java
@@ -1,86 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj;
-
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.util.stream.Stream;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.Arguments;
-import org.junit.jupiter.params.provider.MethodSource;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
-
-import com.hierynomus.sshj.SshdContainer.SshdConfigBuilder;
-
-import net.schmizz.sshj.SSHClient;
-import net.schmizz.sshj.userauth.UserAuthException;
-import net.schmizz.sshj.userauth.keyprovider.KeyProvider;
-
-@Testcontainers
-public class PublicKeyAuthTest {
-    @Container
-    private static final SshdContainer sshd = new SshdContainer(SshdContainer.Builder.defaultBuilder().withSshdConfig(
-            SshdConfigBuilder.defaultBuilder().with("PubkeyAcceptedAlgorithms", "+ssh-rsa-cert-v01@openssh.com"))
-            .withAllKeys());
-
-    public static Stream<Arguments> keys() {
-        return Stream.of(
-                Arguments.of("id_rsa2", null),
-                // "id_ecdsa_nistp256" | null // TODO: Need to improve PKCS8 key support.
-                Arguments.of("id_ecdsa_opensshv1", null),
-                Arguments.of("id_ed25519_opensshv1", null),
-                Arguments.of("id_ed25519_opensshv1_aes256cbc.pem", "foobar"),
-                Arguments.of("id_ed25519_opensshv1_aes128cbc.pem", "sshjtest"),
-                Arguments.of("id_ed25519_opensshv1_protected", "sshjtest"),
-                Arguments.of("id_rsa", null),
-                Arguments.of("id_rsa_opensshv1", null),
-                Arguments.of("id_ecdsa_nistp384_opensshv1", null),
-                Arguments.of("id_ecdsa_nistp521_opensshv1", null));
-    }
-
-    @ParameterizedTest(name = "should authenticate with signed public key {0}")
-    @MethodSource("keys")
-    public void shouldAuthenticateWithSignedRsaKey(String key, String passphrase) throws Throwable {
-        try (SSHClient client = sshd.getConnectedClient()) {
-            KeyProvider p = null;
-            if (passphrase != null) {
-                p = client.loadKeys("src/itest/resources/keyfiles/" + key, passphrase);
-            } else {
-                p = client.loadKeys("src/itest/resources/keyfiles/" + key);
-            }
-            client.authPublickey("sshj", p);
-
-            assertTrue(client.isAuthenticated());
-        }
-    }
-
-    @Test
-    public void shouldNotAuthenticateWithUnknownKey() throws Throwable {
-        try (SSHClient client = sshd.getConnectedClient()) {
-            assertThrows(UserAuthException.class, () -> {
-                client.authPublickey("sshj", "src/itest/resources/keyfiles/id_unknown_key");
-            });
-
-            assertFalse(client.isAuthenticated());
-        }
-    }
-
-}
--- a/src/itest/java/com/hierynomus/sshj/RsaShaKeySignatureTest.java
+++ b/src/itest/java/com/hierynomus/sshj/RsaShaKeySignatureTest.java
@@ -1,100 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj;
-
-import java.util.stream.Stream;
-
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.Arguments;
-import org.junit.jupiter.params.provider.MethodSource;
-
-import com.hierynomus.sshj.SshdContainer.SshdConfigBuilder;
-import com.hierynomus.sshj.key.KeyAlgorithms;
-
-import net.schmizz.sshj.Config;
-import net.schmizz.sshj.DefaultConfig;
-import net.schmizz.sshj.SSHClient;
-
-import java.util.List;
-
-import static org.junit.jupiter.api.Assertions.assertTrue;
-import static com.hierynomus.sshj.SshdContainer.withSshdContainer;
-
-public class RsaShaKeySignatureTest {
-
-    public static Stream<Arguments> hostKeysAndAlgorithms() {
-        return Stream.of(
-                Arguments.of("ssh_host_ecdsa_256_key", KeyAlgorithms.ECDSASHANistp256()),
-                Arguments.of("ssh_host_ecdsa_384_key", KeyAlgorithms.ECDSASHANistp384()),
-                Arguments.of("ssh_host_ecdsa_521_key", KeyAlgorithms.ECDSASHANistp521()),
-                Arguments.of("ssh_host_ed25519_384_key", KeyAlgorithms.EdDSA25519()),
-                Arguments.of("ssh_host_rsa_2048_key", KeyAlgorithms.RSASHA512()));
-    }
-
-    @ParameterizedTest(name = "Should connect to server that does not support ssh-rsa with host key {1}")
-    @MethodSource("hostKeysAndAlgorithms")
-    public void shouldConnectToServerThatDoesNotSupportSshRsaWithHostKey(String key, KeyAlgorithms.Factory algorithm)
-            throws Throwable {
-        SshdConfigBuilder configBuilder = SshdConfigBuilder
-                .defaultBuilder()
-                .with("PubkeyAcceptedAlgorithms", "rsa-sha2-512,rsa-sha2-256,ssh-ed25519");
-        withSshdContainer(SshdContainer.Builder.defaultBuilder()
-                .withSshdConfig(configBuilder).addHostKey("test-container/host_keys/" + key), sshd -> {
-                    Config c = new DefaultConfig();
-                    c.setKeyAlgorithms(List.of(KeyAlgorithms.RSASHA512(), KeyAlgorithms.RSASHA256(), algorithm));
-
-                    SSHClient client = sshd.getConnectedClient(c);
-                    client.authPublickey("sshj", "src/itest/resources/keyfiles/id_rsa_opensshv1");
-
-                    assertTrue(client.isAuthenticated());
-
-                    client.disconnect();
-                });
-    }
-
-    @ParameterizedTest(name = "Should connect to a default server with host key {1} with a default config")
-    @MethodSource("hostKeysAndAlgorithms")
-    public void shouldConnectToDefaultServer(String key, KeyAlgorithms.Factory algorithm) throws Throwable {
-        withSshdContainer(SshdContainer.Builder.defaultBuilder().addHostKey("test-container/host_keys/" + key),
-                sshd -> {
-                    SSHClient client = sshd.getConnectedClient();
-                    client.authPublickey("sshj", "src/itest/resources/keyfiles/id_rsa_opensshv1");
-
-                    assertTrue(client.isAuthenticated());
-
-                    client.disconnect();
-                });
-    }
-
-    @ParameterizedTest(name = "Should connect to a server that only supports ssh-rsa with host key {1}")
-    @MethodSource("hostKeysAndAlgorithms")
-    public void shouldConnectToSshRsaOnlyServer(String key, KeyAlgorithms.Factory algorithm) throws Throwable {
-        SshdConfigBuilder configBuilder = SshdConfigBuilder
-                .defaultBuilder()
-                .with("PubkeyAcceptedAlgorithms", "ssh-rsa,ssh-ed25519");
-
-        withSshdContainer(SshdContainer.Builder.defaultBuilder()
-                .withSshdConfig(configBuilder).addHostKey("test-container/host_keys/" + key), sshd -> {
-                    Config c = new DefaultConfig();
-                    c.setKeyAlgorithms(List.of(KeyAlgorithms.SSHRSA(), algorithm));
-                    SSHClient client = sshd.getConnectedClient(c);
-                    client.authPublickey("sshj", "src/itest/resources/keyfiles/id_rsa_opensshv1");
-
-                    assertTrue(client.isAuthenticated());
-                    client.disconnect();
-                });
-    }
-}
--- a/src/itest/java/com/hierynomus/sshj/SshServerWaitStrategy.java
+++ b/src/itest/java/com/hierynomus/sshj/SshServerWaitStrategy.java
@@ -1,77 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj;
-
-import org.testcontainers.containers.wait.strategy.WaitStrategy;
-import org.testcontainers.containers.wait.strategy.WaitStrategyTarget;
-
-import java.io.IOException;
-import java.net.InetSocketAddress;
-import java.net.Socket;
-import java.nio.charset.StandardCharsets;
-import java.time.Duration;
-import java.util.Arrays;
-
-/**
- * A wait strategy designed for {@link SshdContainer} to wait until the SSH server is ready, to avoid races when a test
- * tries to connect to a server before the server has started.
- */
-public class SshServerWaitStrategy implements WaitStrategy {
-    private Duration startupTimeout = Duration.ofMinutes(1);
-
-    @Override
-    public void waitUntilReady(WaitStrategyTarget waitStrategyTarget) {
-        long expectedEnd = System.nanoTime() + startupTimeout.toNanos();
-        while (waitStrategyTarget.isRunning()) {
-            long attemptStart = System.nanoTime();
-            IOException error = null;
-            byte[] buffer = new byte[7];
-            try (Socket socket = new Socket()) {
-                socket.setSoTimeout(500);
-                socket.connect(new InetSocketAddress(
-                        waitStrategyTarget.getHost(), waitStrategyTarget.getFirstMappedPort()));
-                // Haven't seen any SSH server that sends the version in two or more packets.
-                //noinspection ResultOfMethodCallIgnored
-                socket.getInputStream().read(buffer);
-                if (!Arrays.equals(buffer, "SSH-2.0".getBytes(StandardCharsets.UTF_8))) {
-                    error = new IOException("The version message doesn't look like an SSH server version");
-                }
-            } catch (IOException err) {
-                error = err;
-            }
-
-            if (error == null) {
-                break;
-            } else if (System.nanoTime() >= expectedEnd) {
-                throw new RuntimeException(error);
-            }
-
-            try {
-                //noinspection BusyWait
-                Thread.sleep(Math.max(0L, 500L - (System.nanoTime() - attemptStart) / 1_000_000));
-            } catch (InterruptedException e) {
-                Thread.currentThread().interrupt();
-                break;
-            }
-        }
-    }
-
-    @Override
-    public WaitStrategy withStartupTimeout(Duration startupTimeout) {
-        this.startupTimeout = startupTimeout;
-        return this;
-    }
-}
--- a/src/itest/java/com/hierynomus/sshj/SshdContainer.java
+++ b/src/itest/java/com/hierynomus/sshj/SshdContainer.java
@@ -1,242 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj;
-
-import ch.qos.logback.classic.Level;
-import ch.qos.logback.classic.Logger;
-import net.schmizz.sshj.Config;
-import net.schmizz.sshj.DefaultConfig;
-import net.schmizz.sshj.SSHClient;
-import net.schmizz.sshj.transport.verification.PromiscuousVerifier;
-
-import org.jetbrains.annotations.NotNull;
-import org.junit.jupiter.api.function.ThrowingConsumer;
-import org.slf4j.LoggerFactory;
-import org.testcontainers.containers.GenericContainer;
-import org.testcontainers.images.builder.ImageFromDockerfile;
-import org.testcontainers.images.builder.dockerfile.DockerfileBuilder;
-import org.testcontainers.utility.DockerLoggerFactory;
-
-import java.util.function.Consumer;
-
-import java.io.IOException;
-import java.nio.file.Paths;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.concurrent.Future;
-
-/**
- * A JUnit4 rule for launching a generic SSH server container.
- */
-public class SshdContainer extends GenericContainer<SshdContainer> {
-
-    /**
-     * A workaround for strange logger names of testcontainers. They contain no
-     * dots, but contain slashes,
-     * square brackets, and even emoji. It's uneasy to set the logging level via the
-     * XML file of logback, the
-     * result would be less readable than the code below.
-     */
-    public static class DebugLoggingImageFromDockerfile extends ImageFromDockerfile {
-        public DebugLoggingImageFromDockerfile() {
-            super();
-            Logger logger = (Logger) LoggerFactory.getILoggerFactory()
-                    .getLogger(DockerLoggerFactory.getLogger(getDockerImageName()).getName());
-            logger.setLevel(Level.DEBUG);
-        }
-    }
-
-    public static class SshdConfigBuilder {
-        public static final String DEFAULT_SSHD_CONFIG = "" +
-                "PermitRootLogin yes\n" +
-                "AuthorizedKeysFile .ssh/authorized_keys\n" +
-                "Subsystem sftp /usr/lib/ssh/sftp-server\n" +
-                "KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1\n"
-                +
-                "macs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512\n"
-                +
-                "TrustedUserCAKeys /etc/ssh/trusted_ca_keys\n" +
-                "Ciphers 3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com\n"
-                +
-                "LogLevel DEBUG2\n";
-        private String sshdConfig;
-
-        public SshdConfigBuilder(@NotNull String sshdConfig) {
-            this.sshdConfig = sshdConfig;
-        }
-
-        public static SshdConfigBuilder defaultBuilder() {
-            return new SshdConfigBuilder(DEFAULT_SSHD_CONFIG);
-        }
-
-        public @NotNull SshdConfigBuilder withHostKey(@NotNull String hostKey) {
-            sshdConfig += "HostKey /etc/ssh/" + Paths.get(hostKey).getFileName() + "\n";
-            return this;
-        }
-
-        public @NotNull SshdConfigBuilder withHostKeyCertificate(@NotNull String hostKeyCertificate) {
-            sshdConfig += "HostCertificate /etc/ssh/" + Paths.get(hostKeyCertificate).getFileName() + "\n";
-            return this;
-        }
-
-        public @NotNull SshdConfigBuilder with(String key, String value) {
-            sshdConfig += key + " " + value + "\n";
-            return this;
-        }
-
-        public @NotNull String build() {
-            return sshdConfig;
-        }
-    }
-
-    public static class Builder implements Consumer<DockerfileBuilder> {
-        private List<String> hostKeys = new ArrayList<>();
-        private List<String> certificates = new ArrayList<>();
-        private @NotNull SshdConfigBuilder sshdConfig = SshdConfigBuilder.defaultBuilder();
-
-        public static Builder defaultBuilder() {
-            Builder b = new Builder();
-
-            return b;
-        }
-
-
-        public @NotNull Builder withSshdConfig(@NotNull SshdConfigBuilder sshdConfig) {
-            this.sshdConfig = sshdConfig;
-            return this;
-        }
-
-        public @NotNull Builder withAllKeys() {
-            this.addHostKey("test-container/ssh_host_ecdsa_key");
-            this.addHostKey("test-container/ssh_host_ed25519_key");
-            this.addHostKey("test-container/host_keys/ssh_host_ecdsa_256_key");
-            this.addHostKey("test-container/host_keys/ssh_host_ecdsa_384_key");
-            this.addHostKey("test-container/host_keys/ssh_host_ecdsa_521_key");
-            this.addHostKey("test-container/host_keys/ssh_host_ed25519_384_key");
-            this.addHostKey("test-container/host_keys/ssh_host_rsa_2048_key");
-            this.addHostKeyCertificate("test-container/host_keys/ssh_host_ecdsa_256_key-cert.pub");
-            this.addHostKeyCertificate("test-container/host_keys/ssh_host_ecdsa_384_key-cert.pub");
-            this.addHostKeyCertificate("test-container/host_keys/ssh_host_ecdsa_521_key-cert.pub");
-            this.addHostKeyCertificate("test-container/host_keys/ssh_host_ed25519_384_key-cert.pub");
-            this.addHostKeyCertificate("test-container/host_keys/ssh_host_rsa_2048_key-cert.pub");
-            return this;
-        }
-
-        public @NotNull SshdContainer build() {
-            return new SshdContainer(buildInner());
-        }
-
-        @NotNull Future<String> buildInner() {
-            return new DebugLoggingImageFromDockerfile()
-                    .withDockerfileFromBuilder(this)
-                    .withFileFromPath(".", Paths.get("src/itest/docker-image"))
-                    .withFileFromString("sshd_config", sshdConfig.build());
-        }
-
-        public void accept(@NotNull DockerfileBuilder builder) {
-            builder.from("alpine:3.18.3");
-            builder.run("apk add --no-cache openssh");
-            builder.expose(22);
-            builder.copy("entrypoint.sh", "/entrypoint.sh");
-
-            builder.add("authorized_keys", "/home/sshj/.ssh/authorized_keys");
-            builder.copy("test-container/trusted_ca_keys", "/etc/ssh/trusted_ca_keys");
-
-            for (String hostKey : hostKeys) {
-                builder.copy(hostKey, "/etc/ssh/" + Paths.get(hostKey).getFileName());
-                builder.copy(hostKey + ".pub", "/etc/ssh/" + Paths.get(hostKey).getFileName() + ".pub");
-            }
-
-            for (String certificate : certificates) {
-                builder.copy(certificate, "/etc/ssh/" + Paths.get(certificate).getFileName());
-            }
-
-
-            builder.run("apk add --no-cache tini"
-                    + " && echo \"root:smile\" | chpasswd"
-                    + " && adduser -D -s /bin/ash sshj"
-                    + " && passwd -u sshj"
-                    + " && echo \"sshj:ultrapassword\" | chpasswd"
-                    + " && chmod 600 /home/sshj/.ssh/authorized_keys"
-                    + " && chmod 600 /etc/ssh/ssh_host_*_key"
-                    + " && chmod 644 /etc/ssh/*.pub"
-                    + " && chmod 755 /entrypoint.sh"
-                    + " && chown -R sshj:sshj /home/sshj");
-            builder.entryPoint("/sbin/tini", "/entrypoint.sh", "-o", "LogLevel=DEBUG2");
-
-            builder.add("sshd_config", "/etc/ssh/sshd_config");
-        }
-
-        public @NotNull Builder addHostKey(@NotNull String hostKey) {
-            hostKeys.add(hostKey);
-            sshdConfig.withHostKey(hostKey);
-            return this;
-        }
-
-        public @NotNull Builder addHostKeyCertificate(@NotNull String hostKeyCertificate) {
-            certificates.add(hostKeyCertificate);
-            sshdConfig.withHostKeyCertificate(hostKeyCertificate);
-            return this;
-        }
-    }
-
-    @SuppressWarnings("unused") // Used dynamically by Spock
-    public SshdContainer() {
-        this(new SshdContainer.Builder().withAllKeys().buildInner());
-    }
-
-    public SshdContainer(SshdContainer.Builder builder) {
-        this(builder.buildInner());
-    }
-
-    public SshdContainer(@NotNull Future<String> future) {
-        super(future);
-        withExposedPorts(22);
-        setWaitStrategy(new SshServerWaitStrategy());
-        withLogConsumer(outputFrame -> {
-            switch (outputFrame.getType()) {
-                case STDOUT:
-                    logger().info("sshd stdout: {}", outputFrame.getUtf8String().stripTrailing());
-                    break;
-                case STDERR:
-                    logger().info("sshd stderr: {}", outputFrame.getUtf8String().stripTrailing());
-                    break;
-            }
-        });
-    }
-
-    public SSHClient getConnectedClient(Config config) throws IOException {
-        SSHClient sshClient = new SSHClient(config);
-        sshClient.addHostKeyVerifier(new PromiscuousVerifier());
-        sshClient.connect("127.0.0.1", getFirstMappedPort());
-
-        return sshClient;
-    }
-
-    public SSHClient getConnectedClient() throws IOException {
-        return getConnectedClient(new DefaultConfig());
-    }
-
-    public static void withSshdContainer(SshdContainer.Builder builder, @NotNull ThrowingConsumer<SshdContainer> consumer) throws Throwable {
-        SshdContainer sshdContainer = new SshdContainer(builder.buildInner());
-        sshdContainer.start();
-        try {
-            consumer.accept(sshdContainer);
-        } finally {
-            sshdContainer.stop();
-        }
-    }
-}
--- a/src/itest/java/com/hierynomus/sshj/sftp/FileWriteTest.java
+++ b/src/itest/java/com/hierynomus/sshj/sftp/FileWriteTest.java
@@ -1,73 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj.sftp;
-
-import java.nio.charset.StandardCharsets;
-import java.util.EnumSet;
-
-import org.junit.jupiter.api.Test;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
-import org.testcontainers.shaded.org.bouncycastle.util.Arrays;
-
-import com.hierynomus.sshj.SshdContainer;
-
-import net.schmizz.sshj.SSHClient;
-import net.schmizz.sshj.sftp.OpenMode;
-import net.schmizz.sshj.sftp.RemoteFile;
-import net.schmizz.sshj.sftp.SFTPClient;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-@Testcontainers
-public class FileWriteTest {
-    @Container
-    private static SshdContainer sshd = new SshdContainer();
-
-    @Test
-    public void shouldAppendToFile_GH390() throws Throwable {
-        try (SSHClient client = sshd.getConnectedClient()) {
-            client.authPublickey("sshj", "src/test/resources/id_rsa");
-            try (SFTPClient sftp = client.newSFTPClient()) {
-                String file = "/home/sshj/test.txt";
-                byte[] initialText = "This is the initial text.\n".getBytes(StandardCharsets.UTF_16);
-                byte[] appendText = "And here's the appended text.\n".getBytes(StandardCharsets.UTF_16);
-
-                try (RemoteFile initial = sftp.open(file, EnumSet.of(OpenMode.WRITE, OpenMode.CREAT))) {
-                    initial.write(0, initialText, 0, initialText.length);
-                }
-
-                try (RemoteFile read = sftp.open(file, EnumSet.of(OpenMode.READ))) {
-                    byte[] readBytes = new byte[initialText.length];
-                    read.read(0, readBytes, 0, readBytes.length);
-                    assertThat(readBytes).isEqualTo(initialText);
-                }
-
-                try (RemoteFile initial = sftp.open(file, EnumSet.of(OpenMode.WRITE, OpenMode.APPEND))) {
-                    initial.write(0, appendText, 0, appendText.length);
-                }
-
-                try (RemoteFile read = sftp.open(file, EnumSet.of(OpenMode.READ))) {
-                    byte[] readBytes = new byte[initialText.length + appendText.length];
-                    read.read(0, readBytes, 0, readBytes.length);
-                    assertThat(Arrays.copyOfRange(readBytes, 0, initialText.length)).isEqualTo(initialText);
-                    assertThat(Arrays.copyOfRange(readBytes, initialText.length, initialText.length + appendText.length)).isEqualTo(appendText);
-                }
-            }
-
-        }
-    }
-}
--- a/src/itest/java/com/hierynomus/sshj/signature/HostKeyWithCertificateTest.java
+++ b/src/itest/java/com/hierynomus/sshj/signature/HostKeyWithCertificateTest.java
@@ -1,66 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj.signature;
-
-import java.io.File;
-import java.io.StringReader;
-import java.nio.file.Files;
-import java.util.List;
-
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.ValueSource;
-
-import com.hierynomus.sshj.SshdContainer;
-import com.hierynomus.sshj.SshdContainer.SshdConfigBuilder;
-
-import net.schmizz.sshj.Config;
-import net.schmizz.sshj.DefaultConfig;
-import net.schmizz.sshj.SSHClient;
-import net.schmizz.sshj.transport.verification.OpenSSHKnownHosts;
-
-import static com.hierynomus.sshj.SshdContainer.withSshdContainer;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-public class HostKeyWithCertificateTest {
-
-    @ParameterizedTest(name = "Should connect to server that has a signed host public key {0}")
-    @ValueSource(strings = { "ssh_host_ecdsa_256_key", "ssh_host_ecdsa_384_key", "ssh_host_ecdsa_521_key",
-            "ssh_host_ed25519_384_key" })
-    // TODO "ssh_host_rsa_2048_key" fails with "HOST_KEY_NOT_VERIFIABLE" after upgrade to new OpenSSH version
-    public void shouldConnectToServerWithSignedHostKey(String hostkey) throws Throwable {
-        File caPubKey = new File("src/itest/resources/keyfiles/certificates/CA_rsa.pem.pub");
-        String caPubKeyContents = Files.readString(caPubKey.toPath());
-        String address = "127.0.0.1";
-
-        SshdConfigBuilder b = SshdConfigBuilder.defaultBuilder().with("PasswordAuthentication", "yes");
-
-        withSshdContainer(SshdContainer.Builder.defaultBuilder().withSshdConfig(b).addHostKey("test-container/host_keys/" + hostkey).addHostKeyCertificate("test-container/host_keys/" + hostkey + "-cert.pub"), sshd -> {
-            String knownHosts = List.of("@cert-authority " + address + " " + caPubKeyContents,
-                    "@cert-authority [" + address + "]:" + sshd.getFirstMappedPort() + " " + caPubKeyContents).stream()
-                    .reduce("", (a, b1) -> a + "\n" + b1);
-            DefaultConfig cfg = new DefaultConfig();
-            try (SSHClient c = new SSHClient(cfg)) {
-                c.addHostKeyVerifier(new OpenSSHKnownHosts(new StringReader(knownHosts)));
-                c.connect(address, sshd.getFirstMappedPort());
-
-                c.authPassword("sshj", "ultrapassword");
-
-                assertTrue(c.isAuthenticated());
-            }
-        });
-
-    }
-}
--- a/src/itest/java/com/hierynomus/sshj/signature/PublicKeyAuthWithCertificateTest.java
+++ b/src/itest/java/com/hierynomus/sshj/signature/PublicKeyAuthWithCertificateTest.java
@@ -1,83 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj.signature;
-
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.util.stream.Stream;
-
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.MethodSource;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
-
-import com.hierynomus.sshj.SshdContainer;
-import com.hierynomus.sshj.SshdContainer.SshdConfigBuilder;
-
-import net.schmizz.sshj.Config;
-import net.schmizz.sshj.DefaultConfig;
-import net.schmizz.sshj.SSHClient;
-
-@Testcontainers
-public class PublicKeyAuthWithCertificateTest {
-    @Container
-    private static final SshdContainer sshd = new SshdContainer(SshdContainer.Builder.defaultBuilder().withSshdConfig(SshdConfigBuilder.defaultBuilder().with("PubkeyAcceptedAlgorithms", "+ssh-rsa-cert-v01@openssh.com")).withAllKeys());
-
-    public static Stream<String> keys() {
-        return Stream.of(
-        "id_ecdsa_256_pem_signed_by_ecdsa",
-        "id_ecdsa_256_rfc4716_signed_by_ecdsa",
-        "id_ecdsa_256_pem_signed_by_ed25519",
-        "id_ecdsa_256_rfc4716_signed_by_ed25519",
-        "id_ecdsa_256_pem_signed_by_rsa",
-        "id_ecdsa_256_rfc4716_signed_by_rsa",
-        "id_ecdsa_384_pem_signed_by_ecdsa",
-        "id_ecdsa_384_rfc4716_signed_by_ecdsa",
-        "id_ecdsa_384_pem_signed_by_ed25519",
-        "id_ecdsa_384_rfc4716_signed_by_ed25519",
-        "id_ecdsa_384_pem_signed_by_rsa",
-        "id_ecdsa_384_rfc4716_signed_by_rsa",
-        "id_ecdsa_521_pem_signed_by_ecdsa",
-        "id_ecdsa_521_rfc4716_signed_by_ecdsa",
-        "id_ecdsa_521_pem_signed_by_ed25519",
-        "id_ecdsa_521_rfc4716_signed_by_ed25519",
-        "id_ecdsa_521_pem_signed_by_rsa",
-        "id_ecdsa_521_rfc4716_signed_by_rsa",
-        "id_rsa_2048_pem_signed_by_ecdsa",
-        "id_rsa_2048_rfc4716_signed_by_ecdsa",
-        "id_rsa_2048_pem_signed_by_ed25519",
-        "id_rsa_2048_rfc4716_signed_by_ed25519",
-        "id_rsa_2048_pem_signed_by_rsa",
-        "id_rsa_2048_rfc4716_signed_by_rsa",
-        "id_ed25519_384_rfc4716_signed_by_ecdsa",
-        "id_ed25519_384_rfc4716_signed_by_ed25519",
-        "id_ed25519_384_rfc4716_signed_by_rsa");
-    }
-
-    @ParameterizedTest(name = "should authenticate with signed public key {0}")
-    @MethodSource("keys")
-    public void shouldAuthenticateWithSignedPublicKey(String key) throws Throwable {
-        Config c = new DefaultConfig();
-        SSHClient client = sshd.getConnectedClient(c);
-
-        client.authPublickey("sshj", "src/itest/resources/keyfiles/certificates/" + key);
-
-        assertTrue(client.isAuthenticated());
-
-        client.disconnect();
-    }
-
-}
--- a/src/itest/java/com/hierynomus/sshj/signature/SignatureTest.java
+++ b/src/itest/java/com/hierynomus/sshj/signature/SignatureTest.java
@@ -1,57 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj.signature;
-
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.util.List;
-import java.util.stream.Stream;
-
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.MethodSource;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
-
-import com.hierynomus.sshj.SshdContainer;
-import com.hierynomus.sshj.SshdContainer.SshdConfigBuilder;
-import com.hierynomus.sshj.key.KeyAlgorithms;
-
-import net.schmizz.sshj.Config;
-import net.schmizz.sshj.DefaultConfig;
-import net.schmizz.sshj.SSHClient;
-
-@Testcontainers
-public class SignatureTest {
-    @Container
-    private static final SshdContainer sshd = new SshdContainer(SshdContainer.Builder.defaultBuilder().withSshdConfig(SshdConfigBuilder.defaultBuilder().with("HostKeyAlgorithms", "+ssh-rsa").with("PubkeyAcceptedAlgorithms", "+ssh-rsa")).withAllKeys());
-
-    public static Stream<KeyAlgorithms.Factory> algs() {
-        return Stream.of(KeyAlgorithms.SSHRSA(), KeyAlgorithms.RSASHA256(), KeyAlgorithms.RSASHA512());
-    }
-
-    @ParameterizedTest(name = "should correctly connect with Signature {0}")
-    @MethodSource("algs")
-    public void shouldCorrectlyConnectWithMac(KeyAlgorithms.Factory alg) throws Throwable {
-        Config c = new DefaultConfig();
-        c.setKeyAlgorithms(List.of(alg));
-        try (SSHClient client = sshd.getConnectedClient(c)) {
-            client.authPublickey("sshj", "src/itest/resources/keyfiles/id_rsa");
-
-            assertTrue(client.isAuthenticated());
-        }
-    }
-
-}
--- a/src/itest/java/com/hierynomus/sshj/transport/cipher/CipherTest.java
+++ b/src/itest/java/com/hierynomus/sshj/transport/cipher/CipherTest.java
@@ -1,65 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj.transport.cipher;
-
-import static org.junit.Assert.assertTrue;
-
-import java.util.List;
-import java.util.stream.Stream;
-
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.MethodSource;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
-
-import com.hierynomus.sshj.SshdContainer;
-
-import net.schmizz.sshj.Config;
-import net.schmizz.sshj.DefaultConfig;
-import net.schmizz.sshj.SSHClient;
-import net.schmizz.sshj.common.Factory;
-import net.schmizz.sshj.transport.cipher.Cipher;
-
-@Testcontainers
-public class CipherTest {
-    @Container
-    private static final SshdContainer sshd = new SshdContainer();
-
-    public static Stream<Factory.Named<Cipher>> ciphers() {
-        return Stream.of(BlockCiphers.TripleDESCBC(),
-                          BlockCiphers.AES128CBC(),
-                          BlockCiphers.AES128CTR(),
-                          BlockCiphers.AES192CBC(),
-                          BlockCiphers.AES192CTR(),
-                          BlockCiphers.AES256CBC(),
-                          BlockCiphers.AES256CTR(),
-                          GcmCiphers.AES128GCM(),
-                          GcmCiphers.AES256GCM(),
-                          ChachaPolyCiphers.CHACHA_POLY_OPENSSH());
-    }
-
-    @ParameterizedTest(name = "should correctly connect with Cipher {0}")
-    @MethodSource("ciphers")
-    public void shouldCorrectlyConnectWithCipher(Factory.Named<Cipher> cipher) throws Throwable {
-        Config c = new DefaultConfig();
-        c.setCipherFactories(List.of(cipher));
-        try (SSHClient client = sshd.getConnectedClient(c)) {
-            client.authPublickey("sshj", "src/itest/resources/keyfiles/id_rsa_opensshv1");
-
-            assertTrue(client.isAuthenticated());
-        }
-    }
-}
--- a/src/itest/java/com/hierynomus/sshj/transport/kex/KexTest.java
+++ b/src/itest/java/com/hierynomus/sshj/transport/kex/KexTest.java
@@ -1,73 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj.transport.kex;
-
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.util.List;
-import java.util.stream.Stream;
-
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.MethodSource;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
-
-import com.hierynomus.sshj.SshdContainer;
-import com.hierynomus.sshj.transport.mac.Macs;
-
-import net.schmizz.sshj.Config;
-import net.schmizz.sshj.DefaultConfig;
-import net.schmizz.sshj.SSHClient;
-import net.schmizz.sshj.common.Factory;
-import net.schmizz.sshj.transport.kex.Curve25519SHA256;
-import net.schmizz.sshj.transport.kex.DHGexSHA1;
-import net.schmizz.sshj.transport.kex.DHGexSHA256;
-import net.schmizz.sshj.transport.kex.ECDHNistP;
-import net.schmizz.sshj.transport.kex.KeyExchange;
-
-@Testcontainers
-public class KexTest {
-    @Container
-    private static final SshdContainer sshd = new SshdContainer();
-
-    public static Stream<Factory.Named<KeyExchange>> kex() {
-        return Stream.of(
-                DHGroups.Group1SHA1(),
-                DHGroups.Group14SHA1(),
-                DHGroups.Group14SHA256(),
-                DHGroups.Group16SHA512(),
-                DHGroups.Group18SHA512(),
-                new DHGexSHA1.Factory(),
-                new DHGexSHA256.Factory(),
-                new Curve25519SHA256.Factory(),
-                new Curve25519SHA256.FactoryLibSsh(),
-                new ECDHNistP.Factory256(),
-                new ECDHNistP.Factory384(),
-                new ECDHNistP.Factory521());
-    }
-
-    @ParameterizedTest(name = "should correctly connect with Key Exchange {0}")
-    @MethodSource("kex")
-    public void shouldCorrectlyConnectWithMac(Factory.Named<KeyExchange> kex) throws Throwable {
-        Config c = new DefaultConfig();
-        c.setKeyExchangeFactories(List.of(kex));
-        try (SSHClient client = sshd.getConnectedClient(c)) {
-            client.authPublickey("sshj", "src/itest/resources/keyfiles/id_rsa_opensshv1");
-
-            assertTrue(client.isAuthenticated());
-        }
-    }
-}
--- a/src/itest/java/com/hierynomus/sshj/transport/mac/MacTest.java
+++ b/src/itest/java/com/hierynomus/sshj/transport/mac/MacTest.java
@@ -1,54 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj.transport.mac;
-
-import static org.junit.Assert.assertTrue;
-
-import java.util.List;
-import java.util.stream.Stream;
-
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.MethodSource;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
-
-import com.hierynomus.sshj.SshdContainer;
-
-import net.schmizz.sshj.Config;
-import net.schmizz.sshj.DefaultConfig;
-import net.schmizz.sshj.SSHClient;
-
-@Testcontainers
-public class MacTest {
-    @Container
-    private static final SshdContainer sshd = new SshdContainer();
-
-    public static Stream<Macs.Factory> macs() {
-        return Stream.of(Macs.HMACSHA2256(), Macs.HMACSHA2512(), Macs.HMACSHA2256Etm(), Macs.HMACSHA2512Etm());
-    }
-
-    @ParameterizedTest(name = "should correctly connect with MAC {0}")
-    @MethodSource("macs")
-    public void shouldCorrectlyConnectWithMac(Macs.Factory mac) throws Throwable {
-        Config c = new DefaultConfig();
-        c.setMACFactories(List.of(mac));
-        try (SSHClient client = sshd.getConnectedClient(c)) {
-            client.authPublickey("sshj", "src/itest/resources/keyfiles/id_rsa_opensshv1");
-
-            assertTrue(client.isAuthenticated());
-        }
-    }
-}
--- a/src/itest/resources/keyfiles/id_ed25519_opensshv1_aes128cbc.pem
+++ b/src/itest/resources/keyfiles/id_ed25519_opensshv1_aes128cbc.pem
@@ -1,3 +0,0 @@
-----BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAACmFlczEyOC1jYmMAAAAGYmNyeXB0AAAAGAAAABDfrL8SxDyrkNlsJdAmc7Z0AAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAICYfPGSYFOHuSzTJ67H0ynvKJDfgDmwPOj7iJaLGbIBiAAAAkLVqaDIfs+sPBNyy7ytdLnP/xH7Nt5FIXx3Upw6wKuMGdBzbFQLcvu60Le+SFP3uUfXE8TcHramXbH0n+UBMW6raCAKOkHUU1BtrKxPG1eKU/LBx3Bk5FxyKm7fo0XsCUmqSVK25EHOJfYq1QwIbWICkvQUNu+2Hg8/MQKoFJMentI+GqjdaG76f6Wf+aj9UwA==
-----END OPENSSH PRIVATE KEY-----
--- a/src/itest/resources/logback-test.xml
+++ b/src/itest/resources/logback-test.xml
@@ -1,34 +0,0 @@
-<!--
-
-    Copyright (C)2009 - SSHJ Contributors
-
-    Licensed under the Apache License, Version 2.0 (the "License");
-    you may not use this file except in compliance with the License.
-    You may obtain a copy of the License at
-
-        http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing, software
-    distributed under the License is distributed on an "AS IS" BASIS,
-    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-    See the License for the specific language governing permissions and
-    limitations under the License.
-
-->
-<configuration>
-
-    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
-        <encoder>
-            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%.-20thread] %-5level %logger{36} - %msg%n</pattern>
-        </encoder>
-    </appender>
-
-    <root level="info">
-        <appender-ref ref="STDOUT"/>
-    </root>
-
-    <logger name="org.apache.sshd.server" level="debug" />
-    <logger name="net.schmizz.sshj" level="debug"/>
-    <logger name="net.schmizz.sshj.transport" level="trace" />
-
-</configuration>
--- a/src/main/java/com/hierynomus/sshj/backport/JavaVersion.java
+++ b/src/main/java/com/hierynomus/sshj/backport/JavaVersion.java
@@ -13,20 +13,14 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-package net.schmizz.sshj.sftp;
+package com.hierynomus.sshj.backport;

-public enum RenameFlags {
-    OVERWRITE(1),
-    ATOMIC(2),
-    NATIVE(4);
+public class JavaVersion {
+    public static boolean isJava7OrEarlier() {
+        String property = System.getProperty("java.specification.version");
+        float diff = Float.parseFloat(property) - 1.7f;

-    private final long flag;
-
-    RenameFlags(long flag) {
-        this.flag = flag;
+        return diff < 0.01;
    }

-    public long longValue() {
-        return flag;
-    }
 }
--- a/src/main/java/com/hierynomus/sshj/backport/Jdk7HttpProxySocket.java
+++ b/src/main/java/com/hierynomus/sshj/backport/Jdk7HttpProxySocket.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj.backport;
+
+import net.schmizz.sshj.common.IOUtils;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.*;
+
+public class Jdk7HttpProxySocket extends Socket {
+
+    private Proxy httpProxy = null;
+
+    public Jdk7HttpProxySocket(Proxy proxy) {
+        super(proxy.type() == Proxy.Type.HTTP ? Proxy.NO_PROXY : proxy);
+        if (proxy.type() == Proxy.Type.HTTP) {
+            this.httpProxy = proxy;
+        }
+    }
+
+    @Override
+    public void connect(SocketAddress endpoint, int timeout) throws IOException {
+        if (httpProxy != null) {
+            connectHttpProxy(endpoint, timeout);
+        } else {
+            super.connect(endpoint, timeout);
+        }
+    }
+
+    private void connectHttpProxy(SocketAddress endpoint, int timeout) throws IOException {
+        super.connect(httpProxy.address(), timeout);
+
+        if (!(endpoint instanceof InetSocketAddress)) {
+            throw new SocketException("Expected an InetSocketAddress to connect to, got: " + endpoint);
+        }
+        InetSocketAddress isa = (InetSocketAddress) endpoint;
+        String httpConnect = "CONNECT " + isa.getHostName() + ":" + isa.getPort() + " HTTP/1.0\n\n";
+        getOutputStream().write(httpConnect.getBytes(IOUtils.UTF8));
+        checkAndFlushProxyResponse();
+    }
+
+    private void checkAndFlushProxyResponse()throws IOException {
+        InputStream socketInput = getInputStream();
+        byte[] tmpBuffer = new byte[512];
+        int len = socketInput.read(tmpBuffer, 0, tmpBuffer.length);
+
+        if (len == 0) {
+            throw new SocketException("Empty response from proxy");
+        }
+
+        String proxyResponse = new String(tmpBuffer, 0, len, IOUtils.UTF8);
+
+        // Expecting HTTP/1.x 200 OK
+        if (proxyResponse.contains("200")) {
+            // Flush any outstanding message in buffer
+            if (socketInput.available() > 0) {
+                socketInput.skip(socketInput.available());
+            }
+            // Proxy Connect Successful
+        } else {
+            throw new SocketException("Fail to create Socket\nResponse was:" + proxyResponse);
+        }
+    }
+}
--- a/src/main/java/com/hierynomus/sshj/backport/Sockets.java
+++ b/src/main/java/com/hierynomus/sshj/backport/Sockets.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.hierynomus.sshj.backport;
+
+import java.io.Closeable;
+import java.io.IOException;
+import java.net.Socket;
+
+public class Sockets {
+
+    /**
+     * Java 7 and up have Socket implemented as Closeable, whereas Java6 did not have this inheritance.
+     * @param socket The socket to wrap as Closeable
+     * @return The (potentially wrapped) Socket as a Closeable.
+     */
+    public static Closeable asCloseable(final Socket socket) {
+        if (Closeable.class.isAssignableFrom(socket.getClass())) {
+            return Closeable.class.cast(socket);
+        } else {
+            return new Closeable() {
+                @Override
+                public void close() throws IOException {
+                    socket.close();
+                }
+            };
+        }
+    }
+}
--- a/src/main/java/com/hierynomus/sshj/common/RemoteAddressProvider.java
+++ b/src/main/java/com/hierynomus/sshj/common/RemoteAddressProvider.java
@@ -1,27 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj.common;
-
-import java.net.InetSocketAddress;
-
-public interface RemoteAddressProvider {
-    /**
-     * Get Remote Socket Address associated with transport connection
-     *
-     * @return Remote Socket Address or null when not connected
-     */
-    InetSocketAddress getRemoteSocketAddress();
-}
--- a/src/main/java/com/hierynomus/sshj/common/ThreadNameProvider.java
+++ b/src/main/java/com/hierynomus/sshj/common/ThreadNameProvider.java
@@ -1,36 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.hierynomus.sshj.common;
-
-import java.net.InetSocketAddress;
-
-public class ThreadNameProvider {
-    private static final String DISCONNECTED = "DISCONNECTED";
-
-    /**
-     * Set Thread Name prefixed with sshj followed by class and remote address when connected
-     *
-     * @param thread Class of Thread being named
-     * @param remoteAddressProvider Remote Address Provider associated with Thread
-     */
-    public static void setThreadName(final Thread thread, final RemoteAddressProvider remoteAddressProvider) {
-        final InetSocketAddress remoteSocketAddress = remoteAddressProvider.getRemoteSocketAddress();
-        final String address = remoteSocketAddress == null ? DISCONNECTED : remoteSocketAddress.toString();
-        final long started = System.currentTimeMillis();
-        final String threadName = String.format("sshj-%s-%s-%d", thread.getClass().getSimpleName(), address, started);
-        thread.setName(threadName);
-    }
-}
--- a/src/main/java/com/hierynomus/sshj/key/KeyAlgorithms.java
+++ b/src/main/java/com/hierynomus/sshj/key/KeyAlgorithms.java
@@ -27,6 +27,8 @@ import java.util.List;

 public class KeyAlgorithms {

+    public static List<String> SSH_RSA_SHA2_ALGORITHMS = Arrays.asList("rsa-sha2-512", "rsa-sha2-256");
+
    public static Factory SSHRSA() { return new Factory("ssh-rsa", new SignatureRSA.FactorySSHRSA(), KeyType.RSA); }
    public static Factory SSHRSACertV01() { return new Factory("ssh-rsa-cert-v01@openssh.com", new SignatureRSA.FactoryCERT(), KeyType.RSA_CERT); }
    public static Factory RSASHA256() { return new Factory("rsa-sha2-256", new SignatureRSA.FactoryRSASHA256(), KeyType.RSA); }
@@ -59,18 +61,9 @@ public class KeyAlgorithms {
            return algorithmName;
        }

-        public KeyType getKeyType() {
-            return keyType;
-        }
-
        @Override
        public KeyAlgorithm create() {
            return new BaseKeyAlgorithm(algorithmName, signatureFactory, keyType);
        }
-
-        @Override
-        public String toString() {
-            return algorithmName;
-        }
    }
 }
--- a/src/main/java/com/hierynomus/sshj/transport/kex/DHGroups.java
+++ b/src/main/java/com/hierynomus/sshj/transport/kex/DHGroups.java
@@ -89,11 +89,6 @@ public class DHGroups {
        public String getName() {
            return name;
        }
-
-        @Override
-        public String toString() {
-            return name;
-        }
    }

 }
--- a/src/main/java/com/hierynomus/sshj/transport/verification/KnownHostMatchers.java
+++ b/src/main/java/com/hierynomus/sshj/transport/verification/KnownHostMatchers.java
@@ -15,13 +15,13 @@
 */
 package com.hierynomus.sshj.transport.verification;

+import net.schmizz.sshj.common.Base64;
 import net.schmizz.sshj.common.IOUtils;
 import net.schmizz.sshj.common.SSHException;
 import net.schmizz.sshj.transport.mac.MAC;

 import java.io.IOException;
 import java.util.ArrayList;
-import java.util.Base64;
 import java.util.List;
 import java.util.regex.Pattern;

@@ -85,12 +85,12 @@ public class KnownHostMatchers {

        private String hashHost(String host) throws IOException {
            sha1.init(getSaltyBytes());
-            return "|1|" + salt + "|" + Base64.getEncoder().encodeToString(sha1.doFinal(host.getBytes(IOUtils.UTF8)));
+            return "|1|" + salt + "|" + Base64.encodeBytes(sha1.doFinal(host.getBytes(IOUtils.UTF8)));
        }

-        private byte[] getSaltyBytes() {
+        private byte[] getSaltyBytes() throws IOException {
            if (saltyBytes == null) {
-                saltyBytes = Base64.getDecoder().decode(salt);
+                saltyBytes = Base64.decode(salt);
            }
            return saltyBytes;
        }
--- a/src/main/java/com/hierynomus/sshj/userauth/keyprovider/OpenSSHKeyFileUtil.java
+++ b/src/main/java/com/hierynomus/sshj/userauth/keyprovider/OpenSSHKeyFileUtil.java
@@ -15,6 +15,7 @@
 */
 package com.hierynomus.sshj.userauth.keyprovider;

+import net.schmizz.sshj.common.Base64;
 import net.schmizz.sshj.common.Buffer;
 import net.schmizz.sshj.common.KeyType;

@@ -23,7 +24,6 @@ import java.io.File;
 import java.io.IOException;
 import java.io.Reader;
 import java.security.PublicKey;
-import java.util.Base64;

 public class OpenSSHKeyFileUtil {
    private OpenSSHKeyFileUtil() {
@@ -56,7 +56,7 @@ public class OpenSSHKeyFileUtil {
                    if (parts.length >= 2) {
                        return new ParsedPubKey(
                                KeyType.fromString(parts[0]),
-                                new Buffer.PlainBuffer(Base64.getDecoder().decode(parts[1])).readPublicKey()
+                                new Buffer.PlainBuffer(Base64.decode(parts[1])).readPublicKey()
                        );
                    } else {
                        throw new IOException("Got line with only one column");
--- a/src/main/java/com/hierynomus/sshj/userauth/keyprovider/OpenSSHKeyV1KeyFile.java
+++ b/src/main/java/com/hierynomus/sshj/userauth/keyprovider/OpenSSHKeyV1KeyFile.java
@@ -21,13 +21,8 @@ import com.hierynomus.sshj.transport.cipher.BlockCiphers;
 import net.i2p.crypto.eddsa.EdDSAPrivateKey;
 import net.i2p.crypto.eddsa.spec.EdDSANamedCurveTable;
 import net.i2p.crypto.eddsa.spec.EdDSAPrivateKeySpec;
-import net.schmizz.sshj.common.Buffer;
+import net.schmizz.sshj.common.*;
 import net.schmizz.sshj.common.Buffer.PlainBuffer;
-import net.schmizz.sshj.common.ByteArrayUtils;
-import net.schmizz.sshj.common.IOUtils;
-import net.schmizz.sshj.common.KeyType;
-import net.schmizz.sshj.common.SSHRuntimeException;
-import net.schmizz.sshj.common.SecurityUtils;
 import net.schmizz.sshj.transport.cipher.Cipher;
 import net.schmizz.sshj.userauth.keyprovider.BaseFileKeyProvider;
 import net.schmizz.sshj.userauth.keyprovider.FileKeyProvider;
@@ -35,7 +30,7 @@ import net.schmizz.sshj.userauth.keyprovider.KeyFormat;
 import org.bouncycastle.asn1.nist.NISTNamedCurves;
 import org.bouncycastle.asn1.x9.X9ECParameters;
 import org.bouncycastle.jce.spec.ECNamedCurveSpec;
-import com.hierynomus.sshj.userauth.keyprovider.bcrypt.BCrypt;
+import org.mindrot.jbcrypt.BCrypt;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -50,9 +45,8 @@ import java.nio.CharBuffer;
 import java.nio.charset.Charset;
 import java.security.*;
 import java.security.spec.ECPrivateKeySpec;
-import java.security.spec.RSAPrivateCrtKeySpec;
+import java.security.spec.RSAPrivateKeySpec;
 import java.util.Arrays;
-import java.util.Base64;

 /**
 * Reads a key file in the new OpenSSH format.
@@ -105,7 +99,7 @@ public class OpenSSHKeyV1KeyFile extends BaseFileKeyProvider {
            }

            String keyFile = readKeyFile(reader);
-            byte[] decode = Base64.getDecoder().decode(keyFile);
+            byte[] decode = Base64.decode(keyFile);
            PlainBuffer keyBuffer = new PlainBuffer(decode);
            return readDecodedKeyPair(keyBuffer);

@@ -183,11 +177,11 @@ public class OpenSSHKeyV1KeyFile extends BaseFileKeyProvider {
                Arrays.fill(charBuffer.array(), '\u0000');
                Arrays.fill(byteBuffer.array(), (byte) 0);
            }
-            byte[] keyiv = new byte[cipher.getIVSize()+ cipher.getBlockSize()];
+            byte[] keyiv = new byte[48];
            new BCrypt().pbkdf(passphrase, opts.readBytes(), opts.readUInt32AsInt(), keyiv);
            Arrays.fill(passphrase, (byte) 0);
-            byte[] key = Arrays.copyOfRange(keyiv, 0, cipher.getBlockSize());
-            byte[] iv = Arrays.copyOfRange(keyiv, cipher.getBlockSize(), cipher.getIVSize() + cipher.getBlockSize());
+            byte[] key = Arrays.copyOfRange(keyiv, 0, 32);
+            byte[] iv = Arrays.copyOfRange(keyiv, 32, 48);
            cipher.init(Cipher.Mode.Decrypt, key, iv);
        } else {
            throw new IllegalStateException("No support for KDF '" + kdfName + "'.");
@@ -199,8 +193,6 @@ public class OpenSSHKeyV1KeyFile extends BaseFileKeyProvider {
            return BlockCiphers.AES256CTR().create();
        } else if (cipherName.equals(BlockCiphers.AES256CBC().getName())) {
            return BlockCiphers.AES256CBC().create();
-        } else if (cipherName.equals(BlockCiphers.AES128CBC().getName())) {
-            return BlockCiphers.AES128CBC().create();
        }
        throw new IllegalStateException("Cipher '" + cipherName + "' not currently implemented for openssh-key-v1 format");
    }
@@ -224,9 +216,6 @@ public class OpenSSHKeyV1KeyFile extends BaseFileKeyProvider {
        while (line != null && !line.startsWith(BEGIN)) {
            line = reader.readLine();
        }
-        if (line == null) {
-            return false;
-        }
        line = line.substring(BEGIN.length());
        return line.startsWith(OPENSSH_PRIVATE_KEY);
    }
@@ -256,9 +245,13 @@ public class OpenSSHKeyV1KeyFile extends BaseFileKeyProvider {
                kp = new KeyPair(publicKey, new EdDSAPrivateKey(new EdDSAPrivateKeySpec(privKey, EdDSANamedCurveTable.getByName("Ed25519"))));
                break;
            case RSA:
-                final RSAPrivateCrtKeySpec rsaPrivateCrtKeySpec = readRsaPrivateKeySpec(keyBuffer);
-                final PrivateKey privateKey = SecurityUtils.getKeyFactory(KeyAlgorithm.RSA).generatePrivate(rsaPrivateCrtKeySpec);
-                kp = new KeyPair(publicKey, privateKey);
+                BigInteger n = keyBuffer.readMPInt(); // Modulus
+                keyBuffer.readMPInt(); // Public Exponent
+                BigInteger d = keyBuffer.readMPInt(); // Private Exponent
+                keyBuffer.readMPInt(); // iqmp (q^-1 mod p)
+                keyBuffer.readMPInt(); // p (Prime 1)
+                keyBuffer.readMPInt(); // q (Prime 2)
+                kp = new KeyPair(publicKey, SecurityUtils.getKeyFactory(KeyAlgorithm.RSA).generatePrivate(new RSAPrivateKeySpec(n, d)));
                break;
            case ECDSA256:
                kp = new KeyPair(publicKey, createECDSAPrivateKey(kt, keyBuffer, "P-256"));
@@ -291,35 +284,6 @@ public class OpenSSHKeyV1KeyFile extends BaseFileKeyProvider {
        ECNamedCurveSpec ecCurveSpec = new ECNamedCurveSpec(name, ecParams.getCurve(), ecParams.getG(), ecParams.getN());
        ECPrivateKeySpec pks = new ECPrivateKeySpec(s, ecCurveSpec);
        return SecurityUtils.getKeyFactory(KeyAlgorithm.ECDSA).generatePrivate(pks);
-    }

-    /**
-     * Read RSA Private CRT Key Spec according to OpenSSH sshkey_private_deserialize in sshkey.c
-     *
-     * @param buffer Buffer
-     * @return RSA Private CRT Key Specification
-     * @throws Buffer.BufferException Thrown on failure to read from buffer
-     */
-    private RSAPrivateCrtKeySpec readRsaPrivateKeySpec(final PlainBuffer buffer) throws Buffer.BufferException {
-        final BigInteger modulus = buffer.readMPInt();
-        final BigInteger publicExponent = buffer.readMPInt();
-        final BigInteger privateExponent = buffer.readMPInt();
-        final BigInteger crtCoefficient = buffer.readMPInt(); // iqmp (q^-1 mod p)
-        final BigInteger primeP = buffer.readMPInt();
-        final BigInteger primeQ = buffer.readMPInt();
-
-        // Calculate Prime Exponent P and Prime Exponent Q according to RFC 8017 Section 3.2
-        final BigInteger primeExponentP = privateExponent.remainder(primeP.subtract(BigInteger.ONE));
-        final BigInteger primeExponentQ = privateExponent.remainder(primeQ.subtract(BigInteger.ONE));
-        return new RSAPrivateCrtKeySpec(
-                modulus,
-                publicExponent,
-                privateExponent,
-                primeP,
-                primeQ,
-                primeExponentP,
-                primeExponentQ,
-                crtCoefficient
-        );
    }
 }
--- a/src/main/java/djb/Curve25519.java
+++ b/src/main/java/djb/Curve25519.java
@@ -0,0 +1,918 @@
+/* Ported from C to Java by Dmitry Skiba [sahn0], 23/02/08.
+ * Original: http://cds.xs4all.nl:8081/ecdh/
+ */
+/* Generic 64-bit integer implementation of Curve25519 ECDH
+ * Written by Matthijs van Duin, 200608242056
+ * Public domain.
+ *
+ * Based on work by Daniel J Bernstein, http://cr.yp.to/ecdh.html
+ */
+package djb;
+
+public class Curve25519 {
+
+	/* key size */
+	public static final int KEY_SIZE = 32;
+	
+	/* 0 */
+	public static final byte[] ZERO = {
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+	};
+	
+	/* the prime 2^255-19 */
+	public static final byte[] PRIME = {
+		(byte)237, (byte)255, (byte)255, (byte)255,
+		(byte)255, (byte)255, (byte)255, (byte)255,
+		(byte)255, (byte)255, (byte)255, (byte)255,
+		(byte)255, (byte)255, (byte)255, (byte)255,
+		(byte)255, (byte)255, (byte)255, (byte)255,
+		(byte)255, (byte)255, (byte)255, (byte)255,
+	    (byte)255, (byte)255, (byte)255, (byte)255,
+	    (byte)255, (byte)255, (byte)255, (byte)127
+	};
+	
+	/* group order (a prime near 2^252+2^124) */
+	public static final byte[] ORDER = {
+		(byte)237, (byte)211, (byte)245, (byte)92,
+		(byte)26,  (byte)99,  (byte)18,  (byte)88,
+		(byte)214, (byte)156, (byte)247, (byte)162,
+		(byte)222, (byte)249, (byte)222, (byte)20,
+		(byte)0,   (byte)0,   (byte)0,   (byte)0, 
+		(byte)0,   (byte)0,   (byte)0,   (byte)0,
+		(byte)0,   (byte)0,   (byte)0,   (byte)0, 
+		(byte)0,   (byte)0,   (byte)0,   (byte)16
+	};
+	
+	/********* KEY AGREEMENT *********/
+	
+	/* Private key clamping
+	 *   k [out] your private key for key agreement
+	 *   k  [in]  32 random bytes
+	 */
+	public static final void clamp(byte[] k) {
+		k[31] &= 0x7F;
+		k[31] |= 0x40;
+		k[ 0] &= 0xF8;
+	}
+	
+	/* Key-pair generation
+	 *   P  [out] your public key
+	 *   s  [out] your private key for signing
+	 *   k  [out] your private key for key agreement
+	 *   k  [in]  32 random bytes
+	 * s may be NULL if you don't care
+	 *
+	 * WARNING: if s is not NULL, this function has data-dependent timing */
+	public static final void keygen(byte[] P, byte[] s, byte[] k) {
+		clamp(k);
+		core(P, s, k, null);
+	}
+
+	/* Key agreement
+	 *   Z  [out] shared secret (needs hashing before use)
+	 *   k  [in]  your private key for key agreement
+	 *   P  [in]  peer's public key
+	 */
+	public static final void curve(byte[] Z, byte[] k, byte[] P) {
+		core(Z, null, k, P);
+	}
+	
+	/********* DIGITAL SIGNATURES *********/
+
+	/* deterministic EC-KCDSA
+	 *
+	 *    s is the private key for signing
+	 *    P is the corresponding public key
+	 *    Z is the context data (signer public key or certificate, etc)
+	 *
+	 * signing:
+	 *
+	 *    m = hash(Z, message)
+	 *    x = hash(m, s)
+	 *    keygen25519(Y, NULL, x);
+	 *    r = hash(Y);
+	 *    h = m XOR r
+	 *    sign25519(v, h, x, s);
+	 *
+	 *    output (v,r) as the signature
+	 *
+	 * verification:
+	 *
+	 *    m = hash(Z, message);
+	 *    h = m XOR r
+	 *    verify25519(Y, v, h, P)
+	 *
+	 *    confirm  r == hash(Y)
+	 *
+	 * It would seem to me that it would be simpler to have the signer directly do 
+	 * h = hash(m, Y) and send that to the recipient instead of r, who can verify 
+	 * the signature by checking h == hash(m, Y).  If there are any problems with 
+	 * such a scheme, please let me know.
+	 *
+	 * Also, EC-KCDSA (like most DS algorithms) picks x random, which is a waste of 
+	 * perfectly good entropy, but does allow Y to be calculated in advance of (or 
+	 * parallel to) hashing the message.
+	 */
+	
+	/* Signature generation primitive, calculates (x-h)s mod q
+	 *   v  [out] signature value
+	 *   h  [in]  signature hash (of message, signature pub key, and context data)
+	 *   x  [in]  signature private key
+	 *   s  [in]  private key for signing
+	 * returns true on success, false on failure (use different x or h)
+	 */
+	public static final boolean sign(byte[] v, byte[] h, byte[] x, byte[] s) {
+		// v = (x - h) s  mod q
+		int w, i;
+		byte[] h1 = new byte[32], x1 = new byte[32];
+		byte[] tmp1 = new byte[64];
+		byte[] tmp2 = new byte[64];
+
+		// Don't clobber the arguments, be nice!
+		cpy32(h1, h);
+		cpy32(x1, x);
+
+		// Reduce modulo group order
+		byte[] tmp3=new byte[32];
+		divmod(tmp3, h1, 32, ORDER, 32);
+		divmod(tmp3, x1, 32, ORDER, 32);
+
+		// v = x1 - h1
+		// If v is negative, add the group order to it to become positive.
+		// If v was already positive we don't have to worry about overflow
+		// when adding the order because v < ORDER and 2*ORDER < 2^256
+		mula_small(v, x1, 0, h1, 32, -1);
+		mula_small(v, v , 0, ORDER, 32, 1);
+
+		// tmp1 = (x-h)*s mod q
+		mula32(tmp1, v, s, 32, 1);
+		divmod(tmp2, tmp1, 64, ORDER, 32);
+
+		for (w = 0, i = 0; i < 32; i++)
+			w |= v[i] = tmp1[i];
+		return w != 0;
+	}
+
+	/* Signature verification primitive, calculates Y = vP + hG
+	 *   Y  [out] signature public key
+	 *   v  [in]  signature value
+	 *   h  [in]  signature hash
+	 *   P  [in]  public key
+	 */
+	public static final void verify(byte[] Y, byte[] v, byte[] h, byte[] P) {
+		/* Y = v abs(P) + h G  */
+		byte[] d=new byte[32];
+	    long10[] 
+	        p=new long10[]{new long10(),new long10()},
+	    	s=new long10[]{new long10(),new long10()},
+		    yx=new long10[]{new long10(),new long10(),new long10()},
+		    yz=new long10[]{new long10(),new long10(),new long10()},
+		    t1=new long10[]{new long10(),new long10(),new long10()},
+		    t2=new long10[]{new long10(),new long10(),new long10()};
+		
+		int vi = 0, hi = 0, di = 0, nvh=0, i, j, k;
+
+		/* set p[0] to G and p[1] to P  */
+
+		set(p[0], 9);
+		unpack(p[1], P);
+
+		/* set s[0] to P+G and s[1] to P-G  */
+
+		/* s[0] = (Py^2 + Gy^2 - 2 Py Gy)/(Px - Gx)^2 - Px - Gx - 486662  */
+		/* s[1] = (Py^2 + Gy^2 + 2 Py Gy)/(Px - Gx)^2 - Px - Gx - 486662  */
+
+		x_to_y2(t1[0], t2[0], p[1]);	/* t2[0] = Py^2  */
+		sqrt(t1[0], t2[0]);	/* t1[0] = Py or -Py  */
+		j = is_negative(t1[0]);		/*      ... check which  */
+		t2[0]._0 += 39420360;		/* t2[0] = Py^2 + Gy^2  */
+		mul(t2[1], BASE_2Y, t1[0]);/* t2[1] = 2 Py Gy or -2 Py Gy  */
+		sub(t1[j], t2[0], t2[1]);	/* t1[0] = Py^2 + Gy^2 - 2 Py Gy  */
+		add(t1[1-j], t2[0], t2[1]);/* t1[1] = Py^2 + Gy^2 + 2 Py Gy  */
+		cpy(t2[0], p[1]);		/* t2[0] = Px  */
+		t2[0]._0 -= 9;			/* t2[0] = Px - Gx  */
+		sqr(t2[1], t2[0]);		/* t2[1] = (Px - Gx)^2  */
+		recip(t2[0], t2[1], 0);	/* t2[0] = 1/(Px - Gx)^2  */
+		mul(s[0], t1[0], t2[0]);	/* s[0] = t1[0]/(Px - Gx)^2  */
+		sub(s[0], s[0], p[1]);	/* s[0] = t1[0]/(Px - Gx)^2 - Px  */
+		s[0]._0 -= 9 + 486662;		/* s[0] = X(P+G)  */
+		mul(s[1], t1[1], t2[0]);	/* s[1] = t1[1]/(Px - Gx)^2  */
+		sub(s[1], s[1], p[1]);	/* s[1] = t1[1]/(Px - Gx)^2 - Px  */
+		s[1]._0 -= 9 + 486662;		/* s[1] = X(P-G)  */
+		mul_small(s[0], s[0], 1);	/* reduce s[0] */
+		mul_small(s[1], s[1], 1);	/* reduce s[1] */
+
+
+		/* prepare the chain  */
+		for (i = 0; i < 32; i++) {
+			vi = (vi >> 8) ^ (v[i] & 0xFF) ^ ((v[i] & 0xFF) << 1);
+			hi = (hi >> 8) ^ (h[i] & 0xFF) ^ ((h[i] & 0xFF) << 1);
+			nvh = ~(vi ^ hi);
+			di = (nvh & (di & 0x80) >> 7) ^ vi;
+			di ^= nvh & (di & 0x01) << 1;
+			di ^= nvh & (di & 0x02) << 1;
+			di ^= nvh & (di & 0x04) << 1;
+			di ^= nvh & (di & 0x08) << 1;
+			di ^= nvh & (di & 0x10) << 1;
+			di ^= nvh & (di & 0x20) << 1;
+			di ^= nvh & (di & 0x40) << 1;
+			d[i] = (byte)di;
+		}
+
+		di = ((nvh & (di & 0x80) << 1) ^ vi) >> 8;
+
+		/* initialize state */
+		set(yx[0], 1);
+		cpy(yx[1], p[di]);
+		cpy(yx[2], s[0]);
+		set(yz[0], 0);
+		set(yz[1], 1);
+		set(yz[2], 1);
+
+		/* y[0] is (even)P + (even)G
+		 * y[1] is (even)P + (odd)G  if current d-bit is 0
+		 * y[1] is (odd)P + (even)G  if current d-bit is 1
+		 * y[2] is (odd)P + (odd)G
+		 */
+
+		vi = 0;
+		hi = 0;
+
+		/* and go for it! */
+		for (i = 32; i--!=0; ) {
+			vi = (vi << 8) | (v[i] & 0xFF);
+			hi = (hi << 8) | (h[i] & 0xFF);
+			di = (di << 8) | (d[i] & 0xFF);
+
+			for (j = 8; j--!=0; ) {
+				mont_prep(t1[0], t2[0], yx[0], yz[0]);
+				mont_prep(t1[1], t2[1], yx[1], yz[1]);
+				mont_prep(t1[2], t2[2], yx[2], yz[2]);
+
+				k = ((vi ^ vi >> 1) >> j & 1)
+				  + ((hi ^ hi >> 1) >> j & 1);
+				mont_dbl(yx[2], yz[2], t1[k], t2[k], yx[0], yz[0]);
+
+				k = (di >> j & 2) ^ ((di >> j & 1) << 1);
+				mont_add(t1[1], t2[1], t1[k], t2[k], yx[1], yz[1],
+						p[di >> j & 1]);
+
+				mont_add(t1[2], t2[2], t1[0], t2[0], yx[2], yz[2],
+						s[((vi ^ hi) >> j & 2) >> 1]);
+			}
+		}
+
+		k = (vi & 1) + (hi & 1);
+		recip(t1[0], yz[k], 0);
+		mul(t1[1], yx[k], t1[0]);
+
+		pack(t1[1], Y);
+	}
+	
+	/////////////////////////////////////////////////////////////////////////// 
+	
+	/* sahn0:
+	 * Using this class instead of long[10] to avoid bounds checks. */
+	private static final class long10 {
+		public long10() {}
+		public long10(
+			long _0, long _1, long _2, long _3, long _4,
+			long _5, long _6, long _7, long _8, long _9)
+		{
+			this._0=_0; this._1=_1; this._2=_2;
+			this._3=_3; this._4=_4; this._5=_5;
+			this._6=_6; this._7=_7; this._8=_8;
+			this._9=_9;
+		}
+		public long _0,_1,_2,_3,_4,_5,_6,_7,_8,_9;
+	}
+	
+	/********************* radix 2^8 math *********************/
+	
+	private static final void cpy32(byte[] d, byte[] s) {
+		int i;
+		for (i = 0; i < 32; i++)
+			d[i] = s[i];
+	}
+	
+	/* p[m..n+m-1] = q[m..n+m-1] + z * x */
+	/* n is the size of x */
+	/* n+m is the size of p and q */
+	private static final int mula_small(byte[] p,byte[] q,int m,byte[] x,int n,int z) {
+		int v=0;
+		for (int i=0;i<n;++i) {
+			v+=(q[i+m] & 0xFF)+z*(x[i] & 0xFF);
+			p[i+m]=(byte)v;
+			v>>=8;
+		}
+		return v;		
+	}
+	
+	/* p += x * y * z  where z is a small integer
+	 * x is size 32, y is size t, p is size 32+t
+	 * y is allowed to overlap with p+32 if you don't care about the upper half  */
+	private static final int mula32(byte[] p, byte[] x, byte[] y, int t, int z) {
+		final int n = 31;
+		int w = 0;
+		int i = 0;
+		for (; i < t; i++) {
+			int zy = z * (y[i] & 0xFF);
+			w += mula_small(p, p, i, x, n, zy) +
+				(p[i+n] & 0xFF) + zy * (x[n] & 0xFF);
+			p[i+n] = (byte)w;
+			w >>= 8;
+		}
+		p[i+n] = (byte)(w + (p[i+n] & 0xFF));
+		return w >> 8;
+	}
+	
+	/* divide r (size n) by d (size t), returning quotient q and remainder r
+	 * quotient is size n-t+1, remainder is size t
+	 * requires t > 0 && d[t-1] != 0
+	 * requires that r[-1] and d[-1] are valid memory locations
+	 * q may overlap with r+t */
+	private static final void divmod(byte[] q, byte[] r, int n, byte[] d, int t) {
+		int rn = 0;
+		int dt = ((d[t-1] & 0xFF) << 8);
+		if (t>1) {
+			dt |= (d[t-2] & 0xFF);
+		}
+		while (n-- >= t) {
+			int z = (rn << 16) | ((r[n] & 0xFF) << 8);
+			if (n>0) {
+				z |= (r[n-1] & 0xFF);
+			}
+			z/=dt;
+			rn += mula_small(r,r, n-t+1, d, t, -z);
+			q[n-t+1] = (byte)((z + rn) & 0xFF); /* rn is 0 or -1 (underflow) */
+			mula_small(r,r, n-t+1, d, t, -rn);
+			rn = (r[n] & 0xFF);
+			r[n] = 0;
+		}
+		r[t-1] = (byte)rn;
+	}
+	
+	private static final int numsize(byte[] x,int n) {
+		while (n--!=0 && x[n]==0)
+			;
+		return n+1;
+	}
+	
+	/* Returns x if a contains the gcd, y if b.
+	 * Also, the returned buffer contains the inverse of a mod b,
+	 * as 32-byte signed.
+	 * x and y must have 64 bytes space for temporary use.
+	 * requires that a[-1] and b[-1] are valid memory locations  */
+	private static final byte[] egcd32(byte[] x,byte[] y,byte[] a,byte[] b) {
+		int an, bn = 32, qn, i;
+		for (i = 0; i < 32; i++)
+			x[i] = y[i] = 0;
+		x[0] = 1;
+		an = numsize(a, 32);
+		if (an==0)
+			return y;	/* division by zero */
+		byte[] temp=new byte[32];
+		while (true) {
+			qn = bn - an + 1;
+			divmod(temp, b, bn, a, an);
+			bn = numsize(b, bn);
+			if (bn==0)
+				return x;
+			mula32(y, x, temp, qn, -1);
+
+			qn = an - bn + 1;
+			divmod(temp, a, an, b, bn);
+			an = numsize(a, an);
+			if (an==0)
+				return y;
+			mula32(x, y, temp, qn, -1);
+		}
+	}
+	
+	/********************* radix 2^25.5 GF(2^255-19) math *********************/	
+	
+	private static final int P25=33554431;	/* (1 << 25) - 1 */
+	private static final int P26=67108863;	/* (1 << 26) - 1 */
+	
+	/* Convert to internal format from little-endian byte format */
+	private static final void unpack(long10 x,byte[] m) {
+		x._0 = ((m[0] & 0xFF))         | ((m[1] & 0xFF))<<8 |
+				(m[2] & 0xFF)<<16      | ((m[3] & 0xFF)& 3)<<24;
+		x._1 = ((m[3] & 0xFF)&~ 3)>>2  | (m[4] & 0xFF)<<6 |
+				(m[5] & 0xFF)<<14 | ((m[6] & 0xFF)& 7)<<22;
+		x._2 = ((m[6] & 0xFF)&~ 7)>>3  | (m[7] & 0xFF)<<5 |
+				(m[8] & 0xFF)<<13 | ((m[9] & 0xFF)&31)<<21;
+		x._3 = ((m[9] & 0xFF)&~31)>>5  | (m[10] & 0xFF)<<3 |
+				(m[11] & 0xFF)<<11 | ((m[12] & 0xFF)&63)<<19;
+		x._4 = ((m[12] & 0xFF)&~63)>>6 | (m[13] & 0xFF)<<2 |
+				(m[14] & 0xFF)<<10 |  (m[15] & 0xFF)    <<18;
+		x._5 =  (m[16] & 0xFF)         | (m[17] & 0xFF)<<8 |
+				(m[18] & 0xFF)<<16 | ((m[19] & 0xFF)& 1)<<24;
+		x._6 = ((m[19] & 0xFF)&~ 1)>>1 | (m[20] & 0xFF)<<7 |
+				(m[21] & 0xFF)<<15 | ((m[22] & 0xFF)& 7)<<23;
+		x._7 = ((m[22] & 0xFF)&~ 7)>>3 | (m[23] & 0xFF)<<5 |
+				(m[24] & 0xFF)<<13 | ((m[25] & 0xFF)&15)<<21;
+		x._8 = ((m[25] & 0xFF)&~15)>>4 | (m[26] & 0xFF)<<4 |
+				(m[27] & 0xFF)<<12 | ((m[28] & 0xFF)&63)<<20;
+		x._9 = ((m[28] & 0xFF)&~63)>>6 | (m[29] & 0xFF)<<2 |
+				(m[30] & 0xFF)<<10 |  (m[31] & 0xFF)    <<18;
+	}
+	
+	/* Check if reduced-form input >= 2^255-19 */
+	private static final boolean is_overflow(long10 x) {
+		return (
+			((x._0 > P26-19)) &&
+			((x._1 & x._3 & x._5 & x._7 & x._9) == P25) &&
+			((x._2 & x._4 & x._6 & x._8) == P26)
+			) || (x._9 > P25);
+	}
+	
+	/* Convert from internal format to little-endian byte format.  The 
+	 * number must be in a reduced form which is output by the following ops:
+	 *     unpack, mul, sqr
+	 *     set --  if input in range 0 .. P25
+	 * If you're unsure if the number is reduced, first multiply it by 1.  */
+	private static final void pack(long10 x,byte[] m) {
+		int ld = 0, ud = 0;
+		long t;
+		ld = (is_overflow(x)?1:0) - ((x._9 < 0)?1:0);
+		ud = ld * -(P25+1);
+		ld *= 19;
+		t = ld + x._0 + (x._1 << 26);
+		m[ 0] = (byte)t;
+		m[ 1] = (byte)(t >> 8);
+		m[ 2] = (byte)(t >> 16);
+		m[ 3] = (byte)(t >> 24);
+		t = (t >> 32) + (x._2 << 19);
+		m[ 4] = (byte)t;
+		m[ 5] = (byte)(t >> 8);
+		m[ 6] = (byte)(t >> 16);
+		m[ 7] = (byte)(t >> 24);
+		t = (t >> 32) + (x._3 << 13);
+		m[ 8] = (byte)t;
+		m[ 9] = (byte)(t >> 8);
+		m[10] = (byte)(t >> 16);
+		m[11] = (byte)(t >> 24);
+		t = (t >> 32) + (x._4 <<  6);
+		m[12] = (byte)t;
+		m[13] = (byte)(t >> 8);
+		m[14] = (byte)(t >> 16);
+		m[15] = (byte)(t >> 24);
+		t = (t >> 32) + x._5 + (x._6 << 25);
+		m[16] = (byte)t;
+		m[17] = (byte)(t >> 8);
+		m[18] = (byte)(t >> 16);
+		m[19] = (byte)(t >> 24);
+		t = (t >> 32) + (x._7 << 19);
+		m[20] = (byte)t;
+		m[21] = (byte)(t >> 8);
+		m[22] = (byte)(t >> 16);
+		m[23] = (byte)(t >> 24);
+		t = (t >> 32) + (x._8 << 12);
+		m[24] = (byte)t;
+		m[25] = (byte)(t >> 8);
+		m[26] = (byte)(t >> 16);
+		m[27] = (byte)(t >> 24);
+		t = (t >> 32) + ((x._9 + ud) << 6);
+		m[28] = (byte)t;
+		m[29] = (byte)(t >> 8);
+		m[30] = (byte)(t >> 16);
+		m[31] = (byte)(t >> 24);
+	}
+
+	/* Copy a number */
+	private static final void cpy(long10 out, long10 in) {
+		out._0=in._0;	out._1=in._1;
+		out._2=in._2;	out._3=in._3;
+		out._4=in._4;	out._5=in._5;
+		out._6=in._6;	out._7=in._7;
+		out._8=in._8;	out._9=in._9;		
+	}
+
+	/* Set a number to value, which must be in range -185861411 .. 185861411 */
+	private static final void set(long10 out, int in) {
+		out._0=in;	out._1=0;
+		out._2=0;	out._3=0;
+		out._4=0;	out._5=0;
+		out._6=0;	out._7=0;
+		out._8=0;	out._9=0;		
+	}
+	
+	/* Add/subtract two numbers.  The inputs must be in reduced form, and the 
+	 * output isn't, so to do another addition or subtraction on the output, 
+	 * first multiply it by one to reduce it. */
+	private static final void add(long10 xy, long10 x, long10 y) {
+		xy._0 = x._0 + y._0;	xy._1 = x._1 + y._1;
+		xy._2 = x._2 + y._2;	xy._3 = x._3 + y._3;
+		xy._4 = x._4 + y._4;	xy._5 = x._5 + y._5;
+		xy._6 = x._6 + y._6;	xy._7 = x._7 + y._7;
+		xy._8 = x._8 + y._8;	xy._9 = x._9 + y._9;
+	}
+	private static final void sub(long10 xy, long10 x, long10 y) {
+		xy._0 = x._0 - y._0;	xy._1 = x._1 - y._1;
+		xy._2 = x._2 - y._2;	xy._3 = x._3 - y._3;
+		xy._4 = x._4 - y._4;	xy._5 = x._5 - y._5;
+		xy._6 = x._6 - y._6;	xy._7 = x._7 - y._7;
+		xy._8 = x._8 - y._8;	xy._9 = x._9 - y._9;
+	}
+	
+	/* Multiply a number by a small integer in range -185861411 .. 185861411.
+	 * The output is in reduced form, the input x need not be.  x and xy may point
+	 * to the same buffer. */
+	private static final long10 mul_small(long10 xy, long10 x, long y) {
+		long t;
+		t = (x._8*y);
+		xy._8 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + (x._9*y);
+		xy._9 = (t & ((1 << 25) - 1));
+		t = 19 * (t >> 25) + (x._0*y);
+		xy._0 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + (x._1*y);
+		xy._1 = (t & ((1 << 25) - 1));
+		t = (t >> 25) + (x._2*y);
+		xy._2 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + (x._3*y);
+		xy._3 = (t & ((1 << 25) - 1));
+		t = (t >> 25) + (x._4*y);
+		xy._4 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + (x._5*y);
+		xy._5 = (t & ((1 << 25) - 1));
+		t = (t >> 25) + (x._6*y);
+		xy._6 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + (x._7*y);
+		xy._7 = (t & ((1 << 25) - 1));
+		t = (t >> 25) + xy._8;
+		xy._8 = (t & ((1 << 26) - 1));
+		xy._9 += (t >> 26);
+		return xy;
+	}
+
+	/* Multiply two numbers.  The output is in reduced form, the inputs need not 
+	 * be. */
+	private static final long10 mul(long10 xy, long10 x, long10 y) {
+		/* sahn0:
+		 * Using local variables to avoid class access.
+		 * This seem to improve performance a bit...
+		 */
+		long
+			x_0=x._0,x_1=x._1,x_2=x._2,x_3=x._3,x_4=x._4,
+			x_5=x._5,x_6=x._6,x_7=x._7,x_8=x._8,x_9=x._9;
+		long
+			y_0=y._0,y_1=y._1,y_2=y._2,y_3=y._3,y_4=y._4,
+			y_5=y._5,y_6=y._6,y_7=y._7,y_8=y._8,y_9=y._9;
+		long t;
+		t = (x_0*y_8) + (x_2*y_6) + (x_4*y_4) + (x_6*y_2) +
+			(x_8*y_0) + 2 * ((x_1*y_7) + (x_3*y_5) +
+					(x_5*y_3) + (x_7*y_1)) + 38 *
+			(x_9*y_9);
+		xy._8 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + (x_0*y_9) + (x_1*y_8) + (x_2*y_7) +
+			(x_3*y_6) + (x_4*y_5) + (x_5*y_4) +
+			(x_6*y_3) + (x_7*y_2) + (x_8*y_1) +
+			(x_9*y_0);
+		xy._9 = (t & ((1 << 25) - 1));
+		t = (x_0*y_0) + 19 * ((t >> 25) + (x_2*y_8) + (x_4*y_6)
+				+ (x_6*y_4) + (x_8*y_2)) + 38 *
+			((x_1*y_9) + (x_3*y_7) + (x_5*y_5) +
+			 (x_7*y_3) + (x_9*y_1));
+		xy._0 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + (x_0*y_1) + (x_1*y_0) + 19 * ((x_2*y_9)
+				+ (x_3*y_8) + (x_4*y_7) + (x_5*y_6) +
+				(x_6*y_5) + (x_7*y_4) + (x_8*y_3) +
+				(x_9*y_2));
+		xy._1 = (t & ((1 << 25) - 1));
+		t = (t >> 25) + (x_0*y_2) + (x_2*y_0) + 19 * ((x_4*y_8)
+				+ (x_6*y_6) + (x_8*y_4)) + 2 * (x_1*y_1)
+				+ 38 * ((x_3*y_9) + (x_5*y_7) +
+						(x_7*y_5) + (x_9*y_3));
+		xy._2 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + (x_0*y_3) + (x_1*y_2) + (x_2*y_1) +
+			(x_3*y_0) + 19 * ((x_4*y_9) + (x_5*y_8) +
+					(x_6*y_7) + (x_7*y_6) +
+					(x_8*y_5) + (x_9*y_4));
+		xy._3 = (t & ((1 << 25) - 1));
+		t = (t >> 25) + (x_0*y_4) + (x_2*y_2) + (x_4*y_0) + 19 *
+			((x_6*y_8) + (x_8*y_6)) + 2 * ((x_1*y_3) +
+								 (x_3*y_1)) + 38 *
+			((x_5*y_9) + (x_7*y_7) + (x_9*y_5));
+		xy._4 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + (x_0*y_5) + (x_1*y_4) + (x_2*y_3) +
+			(x_3*y_2) + (x_4*y_1) + (x_5*y_0) + 19 *
+			((x_6*y_9) + (x_7*y_8) + (x_8*y_7) +
+			 (x_9*y_6));
+		xy._5 = (t & ((1 << 25) - 1));
+		t = (t >> 25) + (x_0*y_6) + (x_2*y_4) + (x_4*y_2) +
+			(x_6*y_0) + 19 * (x_8*y_8) + 2 * ((x_1*y_5) +
+					(x_3*y_3) + (x_5*y_1)) + 38 *
+			((x_7*y_9) + (x_9*y_7));
+		xy._6 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + (x_0*y_7) + (x_1*y_6) + (x_2*y_5) +
+			(x_3*y_4) + (x_4*y_3) + (x_5*y_2) +
+			(x_6*y_1) + (x_7*y_0) + 19 * ((x_8*y_9) +
+					(x_9*y_8));
+		xy._7 = (t & ((1 << 25) - 1));
+		t = (t >> 25) + xy._8;
+		xy._8 = (t & ((1 << 26) - 1));
+		xy._9 += (t >> 26);
+		return xy;
+	}
+
+	/* Square a number.  Optimization of  mul25519(x2, x, x)  */
+	private static final long10 sqr(long10 x2, long10 x) {
+		long
+			x_0=x._0,x_1=x._1,x_2=x._2,x_3=x._3,x_4=x._4,
+			x_5=x._5,x_6=x._6,x_7=x._7,x_8=x._8,x_9=x._9;
+		long t;
+		t = (x_4*x_4) + 2 * ((x_0*x_8) + (x_2*x_6)) + 38 *
+			(x_9*x_9) + 4 * ((x_1*x_7) + (x_3*x_5));
+		x2._8 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + 2 * ((x_0*x_9) + (x_1*x_8) + (x_2*x_7) +
+				(x_3*x_6) + (x_4*x_5));
+		x2._9 = (t & ((1 << 25) - 1));
+		t = 19 * (t >> 25) + (x_0*x_0) + 38 * ((x_2*x_8) +
+				(x_4*x_6) + (x_5*x_5)) + 76 * ((x_1*x_9)
+				+ (x_3*x_7));
+		x2._0 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + 2 * (x_0*x_1) + 38 * ((x_2*x_9) +
+				(x_3*x_8) + (x_4*x_7) + (x_5*x_6));
+		x2._1 = (t & ((1 << 25) - 1));
+		t = (t >> 25) + 19 * (x_6*x_6) + 2 * ((x_0*x_2) +
+				(x_1*x_1)) + 38 * (x_4*x_8) + 76 *
+				((x_3*x_9) + (x_5*x_7));
+		x2._2 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + 2 * ((x_0*x_3) + (x_1*x_2)) + 38 *
+			((x_4*x_9) + (x_5*x_8) + (x_6*x_7));
+		x2._3 = (t & ((1 << 25) - 1));
+		t = (t >> 25) + (x_2*x_2) + 2 * (x_0*x_4) + 38 *
+			((x_6*x_8) + (x_7*x_7)) + 4 * (x_1*x_3) + 76 *
+			(x_5*x_9);
+		x2._4 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + 2 * ((x_0*x_5) + (x_1*x_4) + (x_2*x_3))
+			+ 38 * ((x_6*x_9) + (x_7*x_8));
+		x2._5 = (t & ((1 << 25) - 1));
+		t = (t >> 25) + 19 * (x_8*x_8) + 2 * ((x_0*x_6) +
+				(x_2*x_4) + (x_3*x_3)) + 4 * (x_1*x_5) +
+				76 * (x_7*x_9);
+		x2._6 = (t & ((1 << 26) - 1));
+		t = (t >> 26) + 2 * ((x_0*x_7) + (x_1*x_6) + (x_2*x_5) +
+				(x_3*x_4)) + 38 * (x_8*x_9);
+		x2._7 = (t & ((1 << 25) - 1));
+		t = (t >> 25) + x2._8;
+		x2._8 = (t & ((1 << 26) - 1));
+		x2._9 += (t >> 26);
+		return x2;
+	}
+	
+	/* Calculates a reciprocal.  The output is in reduced form, the inputs need not 
+	 * be.  Simply calculates  y = x^(p-2)  so it's not too fast. */
+	/* When sqrtassist is true, it instead calculates y = x^((p-5)/8) */
+	private static final void recip(long10 y, long10 x, int sqrtassist) {
+		long10
+		    t0=new long10(),
+			t1=new long10(),
+			t2=new long10(),
+			t3=new long10(),
+			t4=new long10();
+		int i;
+		/* the chain for x^(2^255-21) is straight from djb's implementation */
+		sqr(t1, x);	/*  2 == 2 * 1	*/
+		sqr(t2, t1);	/*  4 == 2 * 2	*/
+		sqr(t0, t2);	/*  8 == 2 * 4	*/
+		mul(t2, t0, x);	/*  9 == 8 + 1	*/
+		mul(t0, t2, t1);	/* 11 == 9 + 2	*/
+		sqr(t1, t0);	/* 22 == 2 * 11	*/
+		mul(t3, t1, t2);	/* 31 == 22 + 9
+					== 2^5   - 2^0	*/
+		sqr(t1, t3);	/* 2^6   - 2^1	*/
+		sqr(t2, t1);	/* 2^7   - 2^2	*/
+		sqr(t1, t2);	/* 2^8   - 2^3	*/
+		sqr(t2, t1);	/* 2^9   - 2^4	*/
+		sqr(t1, t2);	/* 2^10  - 2^5	*/
+		mul(t2, t1, t3);	/* 2^10  - 2^0	*/
+		sqr(t1, t2);	/* 2^11  - 2^1	*/
+		sqr(t3, t1);	/* 2^12  - 2^2	*/
+		for (i = 1; i < 5; i++) {
+			sqr(t1, t3);
+			sqr(t3, t1);
+		} /* t3 */		/* 2^20  - 2^10	*/
+		mul(t1, t3, t2);	/* 2^20  - 2^0	*/
+		sqr(t3, t1);	/* 2^21  - 2^1	*/
+		sqr(t4, t3);	/* 2^22  - 2^2	*/
+		for (i = 1; i < 10; i++) {
+			sqr(t3, t4);
+			sqr(t4, t3);
+		} /* t4 */		/* 2^40  - 2^20	*/
+		mul(t3, t4, t1);	/* 2^40  - 2^0	*/
+		for (i = 0; i < 5; i++) {
+			sqr(t1, t3);
+			sqr(t3, t1);
+		} /* t3 */		/* 2^50  - 2^10	*/
+		mul(t1, t3, t2);	/* 2^50  - 2^0	*/
+		sqr(t2, t1);	/* 2^51  - 2^1	*/
+		sqr(t3, t2);	/* 2^52  - 2^2	*/
+		for (i = 1; i < 25; i++) {
+			sqr(t2, t3);
+			sqr(t3, t2);
+		} /* t3 */		/* 2^100 - 2^50 */
+		mul(t2, t3, t1);	/* 2^100 - 2^0	*/
+		sqr(t3, t2);	/* 2^101 - 2^1	*/
+		sqr(t4, t3);	/* 2^102 - 2^2	*/
+		for (i = 1; i < 50; i++) {
+			sqr(t3, t4);
+			sqr(t4, t3);
+		} /* t4 */		/* 2^200 - 2^100 */
+		mul(t3, t4, t2);	/* 2^200 - 2^0	*/
+		for (i = 0; i < 25; i++) {
+			sqr(t4, t3);
+			sqr(t3, t4);
+		} /* t3 */		/* 2^250 - 2^50	*/
+		mul(t2, t3, t1);	/* 2^250 - 2^0	*/
+		sqr(t1, t2);	/* 2^251 - 2^1	*/
+		sqr(t2, t1);	/* 2^252 - 2^2	*/
+		if (sqrtassist!=0) {
+			mul(y, x, t2);	/* 2^252 - 3 */
+		} else {
+			sqr(t1, t2);	/* 2^253 - 2^3	*/
+			sqr(t2, t1);	/* 2^254 - 2^4	*/
+			sqr(t1, t2);	/* 2^255 - 2^5	*/
+			mul(y, t1, t0);	/* 2^255 - 21	*/
+		}
+	}
+	
+	/* checks if x is "negative", requires reduced input */
+	private static final int is_negative(long10 x) {
+		return (int)(((is_overflow(x) || (x._9 < 0))?1:0) ^ (x._0 & 1));
+	}
+	
+	/* a square root */
+	private static final void sqrt(long10 x, long10 u) {
+		long10 v=new long10(), t1=new long10(), t2=new long10();
+		add(t1, u, u);	/* t1 = 2u		*/
+		recip(v, t1, 1);	/* v = (2u)^((p-5)/8)	*/
+		sqr(x, v);		/* x = v^2		*/
+		mul(t2, t1, x);	/* t2 = 2uv^2		*/
+		t2._0--;		/* t2 = 2uv^2-1		*/
+		mul(t1, v, t2);	/* t1 = v(2uv^2-1)	*/
+		mul(x, u, t1);	/* x = uv(2uv^2-1)	*/
+	}
+	
+	/********************* Elliptic curve *********************/
+	
+	/* y^2 = x^3 + 486662 x^2 + x  over GF(2^255-19) */
+	
+	/* t1 = ax + az
+	 * t2 = ax - az  */
+	private static final void mont_prep(long10 t1, long10 t2, long10 ax, long10 az) {
+		add(t1, ax, az);
+		sub(t2, ax, az);
+	}
+	
+	/* A = P + Q   where
+	 *  X(A) = ax/az
+	 *  X(P) = (t1+t2)/(t1-t2)
+	 *  X(Q) = (t3+t4)/(t3-t4)
+	 *  X(P-Q) = dx
+	 * clobbers t1 and t2, preserves t3 and t4  */
+	private static final void mont_add(long10 t1, long10 t2, long10 t3, long10 t4,long10 ax, long10 az, long10 dx) {
+		mul(ax, t2, t3);
+		mul(az, t1, t4);
+		add(t1, ax, az);
+		sub(t2, ax, az);
+		sqr(ax, t1);
+		sqr(t1, t2);
+		mul(az, t1, dx);
+	}
+	
+	/* B = 2 * Q   where
+	 *  X(B) = bx/bz
+	 *  X(Q) = (t3+t4)/(t3-t4)
+	 * clobbers t1 and t2, preserves t3 and t4  */
+	private static final void mont_dbl(long10 t1, long10 t2, long10 t3, long10 t4,long10 bx, long10 bz) {
+		sqr(t1, t3);
+		sqr(t2, t4);
+		mul(bx, t1, t2);
+		sub(t2, t1, t2);
+		mul_small(bz, t2, 121665);
+		add(t1, t1, bz);
+		mul(bz, t1, t2);
+	}
+	
+	/* Y^2 = X^3 + 486662 X^2 + X
+	 * t is a temporary  */
+	private static final void x_to_y2(long10 t, long10 y2, long10 x) {
+		sqr(t, x);
+		mul_small(y2, x, 486662);
+		add(t, t, y2);
+		t._0++;
+		mul(y2, t, x);
+	}
+	
+	/* P = kG   and  s = sign(P)/k  */
+	private static final void core(byte[] Px, byte[] s, byte[] k, byte[] Gx) {
+		long10 
+		    dx=new long10(),
+		    t1=new long10(),
+		    t2=new long10(),
+		    t3=new long10(),
+		    t4=new long10();
+	    long10[] 
+	        x=new long10[]{new long10(),new long10()},
+	    	z=new long10[]{new long10(),new long10()};
+		int i, j;
+
+		/* unpack the base */
+		if (Gx!=null)
+			unpack(dx, Gx);
+		else
+			set(dx, 9);
+
+		/* 0G = point-at-infinity */
+		set(x[0], 1);
+		set(z[0], 0);
+
+		/* 1G = G */
+		cpy(x[1], dx);
+		set(z[1], 1);
+
+		for (i = 32; i--!=0; ) {
+			if (i==0) {
+				i=0;
+			}
+			for (j = 8; j--!=0; ) {
+				/* swap arguments depending on bit */
+				int bit1 = (k[i] & 0xFF) >> j & 1;
+				int bit0 = ~(k[i] & 0xFF) >> j & 1;
+				long10 ax = x[bit0];
+				long10 az = z[bit0];
+				long10 bx = x[bit1];
+				long10 bz = z[bit1];
+
+				/* a' = a + b	*/
+				/* b' = 2 b	*/
+				mont_prep(t1, t2, ax, az);
+				mont_prep(t3, t4, bx, bz);
+				mont_add(t1, t2, t3, t4, ax, az, dx);
+				mont_dbl(t1, t2, t3, t4, bx, bz);
+			}
+		}
+
+		recip(t1, z[0], 0);
+		mul(dx, x[0], t1);
+		pack(dx, Px);
+
+		/* calculate s such that s abs(P) = G  .. assumes G is std base point */
+		if (s!=null) {
+			x_to_y2(t2, t1, dx);	/* t1 = Py^2  */
+			recip(t3, z[1], 0);	/* where Q=P+G ... */
+			mul(t2, x[1], t3);	/* t2 = Qx  */
+			add(t2, t2, dx);	/* t2 = Qx + Px  */
+			t2._0 += 9 + 486662;	/* t2 = Qx + Px + Gx + 486662  */
+			dx._0 -= 9;		/* dx = Px - Gx  */
+			sqr(t3, dx);	/* t3 = (Px - Gx)^2  */
+			mul(dx, t2, t3);	/* dx = t2 (Px - Gx)^2  */
+			sub(dx, dx, t1);	/* dx = t2 (Px - Gx)^2 - Py^2  */
+			dx._0 -= 39420360;	/* dx = t2 (Px - Gx)^2 - Py^2 - Gy^2  */
+			mul(t1, dx, BASE_R2Y);	/* t1 = -Py  */
+			if (is_negative(t1)!=0)	/* sign is 1, so just copy  */
+				cpy32(s, k);
+			else			/* sign is -1, so negate  */
+				mula_small(s, ORDER_TIMES_8, 0, k, 32, -1);
+
+			/* reduce s mod q
+			 * (is this needed?  do it just in case, it's fast anyway) */
+			//divmod((dstptr) t1, s, 32, order25519, 32);
+
+			/* take reciprocal of s mod q */
+			byte[] temp1=new byte[32];
+			byte[] temp2=new byte[64];
+			byte[] temp3=new byte[64];
+			cpy32(temp1, ORDER);
+			cpy32(s, egcd32(temp2, temp3, s, temp1));
+			if ((s[31] & 0x80)!=0)
+				mula_small(s, s, 0, ORDER, 32, 1);
+		}
+	}
+
+	/* smallest multiple of the order that's >= 2^255 */
+	private static final byte[] ORDER_TIMES_8 = {
+		(byte)104, (byte)159, (byte)174, (byte)231,
+		(byte)210, (byte)24,  (byte)147, (byte)192,
+		(byte)178, (byte)230, (byte)188, (byte)23,
+		(byte)245, (byte)206, (byte)247, (byte)166,
+		(byte)0,   (byte)0,   (byte)0,   (byte)0,  
+		(byte)0,   (byte)0,   (byte)0,   (byte)0,
+		(byte)0,   (byte)0,   (byte)0,   (byte)0,  
+		(byte)0,   (byte)0,   (byte)0,   (byte)128
+	};
+	
+	/* constants 2Gy and 1/(2Gy) */
+	private static final long10 BASE_2Y = new long10(
+		39999547, 18689728, 59995525, 1648697, 57546132,
+		24010086, 19059592, 5425144, 63499247, 16420658
+	);
+	private static final long10 BASE_R2Y = new long10(
+		5744, 8160848, 4790893, 13779497, 35730846,
+		12541209, 49101323, 30047407, 40071253, 6226132
+	);
+}
--- a/src/main/java/net/schmizz/concurrent/Promise.java
+++ b/src/main/java/net/schmizz/concurrent/Promise.java
@@ -136,7 +136,7 @@ public class Promise<V, T extends Throwable> {
            throws T {
        final V value = tryRetrieve(timeout, unit);
        if (value == null)
-            throw chainer.chain(new TimeoutException("Timeout expired: " + timeout + " " + unit));
+            throw chainer.chain(new TimeoutException("Timeout expired"));
        else
            return value;
    }
@@ -176,7 +176,6 @@ public class Promise<V, T extends Throwable> {
            }
            return val;
        } catch (InterruptedException ie) {
-            Thread.currentThread().interrupt();
            throw chainer.chain(ie);
        } finally {
            lock.unlock();
--- a/src/main/java/net/schmizz/keepalive/Heartbeater.java
+++ b/src/main/java/net/schmizz/keepalive/Heartbeater.java
@@ -24,7 +24,7 @@ final class Heartbeater
        extends KeepAlive {

    Heartbeater(ConnectionImpl conn) {
-        super(conn, "sshj-Heartbeater");
+        super(conn, "heartbeater");
    }

    @Override
--- a/src/main/java/net/schmizz/keepalive/KeepAlive.java
+++ b/src/main/java/net/schmizz/keepalive/KeepAlive.java
@@ -20,8 +20,6 @@ import net.schmizz.sshj.connection.ConnectionImpl;
 import net.schmizz.sshj.transport.TransportException;
 import org.slf4j.Logger;

-import java.util.concurrent.TimeUnit;
-
 public abstract class KeepAlive extends Thread {
    protected final Logger log;
    protected final ConnectionImpl conn;
@@ -35,49 +33,40 @@ public abstract class KeepAlive extends Thread {
        setDaemon(true);
    }

-    /**
-     * KeepAlive enabled based on KeepAlive interval
-     *
-     * @return Enabled when KeepInterval is greater than 0
-     */
-    public boolean isEnabled() {
-        return keepAliveInterval > 0;
-    }
-
-    /**
-     * Get KeepAlive interval in seconds
-     *
-     * @return KeepAlive interval in seconds defaults to 0
-     */
    public synchronized int getKeepAliveInterval() {
        return keepAliveInterval;
    }

-    /**
-     * Set KeepAlive interval in seconds
-     *
-     * @param keepAliveInterval KeepAlive interval in seconds
-     */
    public synchronized void setKeepAliveInterval(int keepAliveInterval) {
        this.keepAliveInterval = keepAliveInterval;
+        if (keepAliveInterval > 0 && getState() == State.NEW) {
+            start();
+        }
+        notify();
+    }
+
+    synchronized protected int getPositiveInterval()
+            throws InterruptedException {
+        while (keepAliveInterval <= 0) {
+            wait();
+        }
+        return keepAliveInterval;
    }

    @Override
    public void run() {
-        log.debug("{} Started with interval [{} seconds]", getClass().getSimpleName(), keepAliveInterval);
+        log.debug("Starting {}, sending keep-alive every {} seconds", getClass().getSimpleName(), keepAliveInterval);
        try {
            while (!isInterrupted()) {
-                final int interval = getKeepAliveInterval();
+                final int hi = getPositiveInterval();
                if (conn.getTransport().isRunning()) {
-                    log.debug("{} Sending after interval [{} seconds]", getClass().getSimpleName(), interval);
+                    log.debug("Sending keep-alive since {} seconds elapsed", hi);
                    doKeepAlive();
                }
-                TimeUnit.SECONDS.sleep(interval);
+                Thread.sleep(hi * 1000);
            }
        } catch (InterruptedException e) {
-            // this is almost certainly a planned interruption, but even so, no harm in setting the interrupt flag
-            Thread.currentThread().interrupt();
-            log.trace("{} Interrupted while sleeping", getClass().getSimpleName());
+            // Interrupt signal may be catched when sleeping.      
        } catch (Exception e) {
            // If we weren't interrupted, kill the transport, then this exception was unexpected.
            // Else we're in shutdown-mode already, so don't forcibly kill the transport.
@@ -85,7 +74,9 @@ public abstract class KeepAlive extends Thread {
                conn.getTransport().die(e);
            }
        }
-        log.debug("{} Stopped", getClass().getSimpleName());
+
+        log.debug("Stopping {}", getClass().getSimpleName());
+
    }

    protected abstract void doKeepAlive() throws TransportException, ConnectionException;
--- a/src/main/java/net/schmizz/keepalive/KeepAliveRunner.java
+++ b/src/main/java/net/schmizz/keepalive/KeepAliveRunner.java
@@ -37,7 +37,7 @@ public class KeepAliveRunner extends KeepAlive {
            new LinkedList<Promise<SSHPacket, ConnectionException>>();

    KeepAliveRunner(ConnectionImpl conn) {
-        super(conn, "sshj-KeepAliveRunner");
+        super(conn, "keep-alive");
    }

    synchronized public int getMaxAliveCount() {
--- a/src/main/java/net/schmizz/sshj/AndroidConfig.java
+++ b/src/main/java/net/schmizz/sshj/AndroidConfig.java
@@ -19,6 +19,8 @@ import com.hierynomus.sshj.key.KeyAlgorithm;
 import com.hierynomus.sshj.key.KeyAlgorithms;
 import net.schmizz.sshj.common.Factory;
 import net.schmizz.sshj.common.SecurityUtils;
+import net.schmizz.sshj.transport.random.JCERandom;
+import net.schmizz.sshj.transport.random.SingletonRandomFactory;

 import java.util.Arrays;

@@ -32,6 +34,7 @@ public class AndroidConfig
        SecurityUtils.registerSecurityProvider("org.spongycastle.jce.provider.BouncyCastleProvider");
    }

+
    @Override
    protected void initKeyAlgorithms() {
        setKeyAlgorithms(Arrays.<Factory.Named<KeyAlgorithm>>asList(
@@ -40,4 +43,10 @@ public class AndroidConfig
                KeyAlgorithms.SSHDSA()
        ));
    }
+
+    @Override
+    protected void initRandomFactory(boolean ignored) {
+        setRandomFactory(new SingletonRandomFactory(new JCERandom.Factory()));
+    }
+
 }
--- a/src/main/java/net/schmizz/sshj/ConfigImpl.java
+++ b/src/main/java/net/schmizz/sshj/ConfigImpl.java
@@ -26,7 +26,6 @@ import net.schmizz.sshj.transport.mac.MAC;
 import net.schmizz.sshj.transport.random.Random;
 import net.schmizz.sshj.userauth.keyprovider.FileKeyProvider;

-import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;

@@ -189,30 +188,4 @@ public class ConfigImpl
    public void setVerifyHostKeyCertificates(boolean value) {
        verifyHostKeyCertificates = value;
    }
-
-    /**
-     * Modern servers neglect the key algorithm ssh-rsa. OpenSSH 8.8 even dropped its support by default in favour
-     * of rsa-sha2-*. However, there are legacy servers like Apache SSHD that don't support the newer replacements
-     * for ssh-rsa.
-     *
-     * If ssh-rsa factory is in {@link #getKeyAlgorithms()}, this methods makes ssh-rsa key algorithm more preferred
-     * than any of rsa-sha2-*. Otherwise, nothing happens.
-     */
-    public void prioritizeSshRsaKeyAlgorithm() {
-        List<Factory.Named<KeyAlgorithm>> keyAlgorithms = getKeyAlgorithms();
-        for (int sshRsaIndex = 0; sshRsaIndex < keyAlgorithms.size(); ++ sshRsaIndex) {
-            if ("ssh-rsa".equals(keyAlgorithms.get(sshRsaIndex).getName())) {
-                for (int i = 0; i < sshRsaIndex; ++i) {
-                    final String algo = keyAlgorithms.get(i).getName();
-                    if ("rsa-sha2-256".equals(algo) || "rsa-sha2-512".equals(algo)) {
-                        keyAlgorithms = new ArrayList<>(keyAlgorithms);
-                        keyAlgorithms.add(i, keyAlgorithms.remove(sshRsaIndex));
-                        setKeyAlgorithms(keyAlgorithms);
-                        break;
-                    }
-                }
-                break;
-            }
-        }
-    }
 }
--- a/src/main/java/net/schmizz/sshj/DefaultConfig.java
+++ b/src/main/java/net/schmizz/sshj/DefaultConfig.java
@@ -29,24 +29,23 @@ import com.hierynomus.sshj.userauth.keyprovider.OpenSSHKeyV1KeyFile;
 import net.schmizz.keepalive.KeepAliveProvider;
 import net.schmizz.sshj.common.Factory;
 import net.schmizz.sshj.common.LoggerFactory;
+import net.schmizz.sshj.common.SecurityUtils;
 import net.schmizz.sshj.transport.cipher.Cipher;
 import net.schmizz.sshj.transport.compression.NoneCompression;
 import net.schmizz.sshj.transport.kex.Curve25519SHA256;
 import net.schmizz.sshj.transport.kex.DHGexSHA1;
 import net.schmizz.sshj.transport.kex.DHGexSHA256;
 import net.schmizz.sshj.transport.kex.ECDHNistP;
+import net.schmizz.sshj.transport.random.BouncyCastleRandom;
 import net.schmizz.sshj.transport.random.JCERandom;
 import net.schmizz.sshj.transport.random.SingletonRandomFactory;
 import net.schmizz.sshj.userauth.keyprovider.OpenSSHKeyFile;
+import net.schmizz.sshj.userauth.keyprovider.PKCS5KeyFile;
 import net.schmizz.sshj.userauth.keyprovider.PKCS8KeyFile;
 import net.schmizz.sshj.userauth.keyprovider.PuTTYKeyFile;
 import org.slf4j.Logger;

-import java.util.Arrays;
-import java.util.List;
-import java.util.LinkedList;
-import java.util.ListIterator;
-import java.util.Properties;
+import java.util.*;

 /**
 * A {@link net.schmizz.sshj.Config} that is initialized as follows. Items marked with an asterisk are added to the config only if
@@ -65,6 +64,8 @@ import java.util.Properties;
 * <li>{@link net.schmizz.sshj.ConfigImpl#setVersion Client version}: {@code "NET_3_0"}</li>
 * </ul>
 * <p/>
+ * [1] It is worth noting that Sun's JRE does not have the unlimited cryptography extension enabled by default. This
+ * prevents using ciphers with strength greater than 128.
 */
 public class DefaultConfig
        extends ConfigImpl {
@@ -74,10 +75,11 @@ public class DefaultConfig
    public DefaultConfig() {
        setLoggerFactory(LoggerFactory.DEFAULT);
        setVersion(readVersionFromProperties());
-        initKeyExchangeFactories();
+        final boolean bouncyCastleRegistered = SecurityUtils.isBouncyCastleRegistered();
+        initKeyExchangeFactories(bouncyCastleRegistered);
        initKeyAlgorithms();
-        initRandomFactory();
-        initFileKeyProviderFactories();
+        initRandomFactory(bouncyCastleRegistered);
+        initFileKeyProviderFactories(bouncyCastleRegistered);
        initCipherFactories();
        initCompressionFactories();
        initMACFactories();
@@ -102,32 +104,35 @@ public class DefaultConfig
        log = loggerFactory.getLogger(getClass());
    }

-    protected void initKeyExchangeFactories() {
-        setKeyExchangeFactories(
-                new Curve25519SHA256.Factory(),
-                new Curve25519SHA256.FactoryLibSsh(),
-                new DHGexSHA256.Factory(),
-                new ECDHNistP.Factory521(),
-                new ECDHNistP.Factory384(),
-                new ECDHNistP.Factory256(),
-                new DHGexSHA1.Factory(),
-                DHGroups.Group1SHA1(),
-                DHGroups.Group14SHA1(),
-                DHGroups.Group14SHA256(),
-                DHGroups.Group15SHA512(),
-                DHGroups.Group16SHA512(),
-                DHGroups.Group17SHA512(),
-                DHGroups.Group18SHA512(),
-                ExtendedDHGroups.Group14SHA256AtSSH(),
-                ExtendedDHGroups.Group15SHA256(),
-                ExtendedDHGroups.Group15SHA256AtSSH(),
-                ExtendedDHGroups.Group15SHA384AtSSH(),
-                ExtendedDHGroups.Group16SHA256(),
-                ExtendedDHGroups.Group16SHA384AtSSH(),
-                ExtendedDHGroups.Group16SHA512AtSSH(),
-                ExtendedDHGroups.Group18SHA512AtSSH(),
-                new ExtInfoClientFactory()
-        );
+    protected void initKeyExchangeFactories(boolean bouncyCastleRegistered) {
+        if (bouncyCastleRegistered) {
+            setKeyExchangeFactories(
+                    new Curve25519SHA256.Factory(),
+                    new Curve25519SHA256.FactoryLibSsh(),
+                    new DHGexSHA256.Factory(),
+                    new ECDHNistP.Factory521(),
+                    new ECDHNistP.Factory384(),
+                    new ECDHNistP.Factory256(),
+                    new DHGexSHA1.Factory(),
+                    DHGroups.Group1SHA1(),
+                    DHGroups.Group14SHA1(),
+                    DHGroups.Group14SHA256(),
+                    DHGroups.Group15SHA512(),
+                    DHGroups.Group16SHA512(),
+                    DHGroups.Group17SHA512(),
+                    DHGroups.Group18SHA512(),
+                    ExtendedDHGroups.Group14SHA256AtSSH(),
+                    ExtendedDHGroups.Group15SHA256(),
+                    ExtendedDHGroups.Group15SHA256AtSSH(),
+                    ExtendedDHGroups.Group15SHA384AtSSH(),
+                    ExtendedDHGroups.Group16SHA256(),
+                    ExtendedDHGroups.Group16SHA384AtSSH(),
+                    ExtendedDHGroups.Group16SHA512AtSSH(),
+                    ExtendedDHGroups.Group18SHA512AtSSH(),
+                    new ExtInfoClientFactory());
+        } else {
+            setKeyExchangeFactories(DHGroups.Group1SHA1(), new DHGexSHA1.Factory());
+        }
    }

    protected void initKeyAlgorithms() {
@@ -148,19 +153,22 @@ public class DefaultConfig
                KeyAlgorithms.SSHDSA()));
    }

-    protected void initRandomFactory() {
+    protected void initRandomFactory(boolean bouncyCastleRegistered) {
        setRandomFactory(new SingletonRandomFactory(new JCERandom.Factory()));
    }

-    protected void initFileKeyProviderFactories() {
-        setFileKeyProviderFactories(
-                new OpenSSHKeyV1KeyFile.Factory(),
-                new PKCS8KeyFile.Factory(),
-                new OpenSSHKeyFile.Factory(),
-                new PuTTYKeyFile.Factory()
-        );
+    protected void initFileKeyProviderFactories(boolean bouncyCastleRegistered) {
+        if (bouncyCastleRegistered) {
+            setFileKeyProviderFactories(
+                    new OpenSSHKeyV1KeyFile.Factory(),
+                    new PKCS8KeyFile.Factory(),
+                    new PKCS5KeyFile.Factory(),
+                    new OpenSSHKeyFile.Factory(),
+                    new PuTTYKeyFile.Factory());
+        }
    }

+
    protected void initCipherFactories() {
        List<Factory.Named<Cipher>> avail = new LinkedList<Factory.Named<Cipher>>(Arrays.<Factory.Named<Cipher>>asList(
                ChachaPolyCiphers.CHACHA_POLY_OPENSSH(),
@@ -198,22 +206,27 @@ public class DefaultConfig
                StreamCiphers.Arcfour256())
        );

-        final ListIterator<Factory.Named<Cipher>> factories = avail.listIterator();
-        while (factories.hasNext()) {
-            final Factory.Named<Cipher> factory = factories.next();
+        boolean warn = false;
+        // Ref. https://issues.apache.org/jira/browse/SSHD-24
+        // "AES256 and AES192 requires unlimited cryptography extension"
+        for (Iterator<Factory.Named<Cipher>> i = avail.iterator(); i.hasNext(); ) {
+            final Factory.Named<Cipher> f = i.next();
            try {
-                final Cipher cipher = factory.create();
-                final byte[] key = new byte[cipher.getBlockSize()];
-                final byte[] iv = new byte[cipher.getIVSize()];
-                cipher.init(Cipher.Mode.Encrypt, key, iv);
+                final Cipher c = f.create();
+                final byte[] key = new byte[c.getBlockSize()];
+                final byte[] iv = new byte[c.getIVSize()];
+                c.init(Cipher.Mode.Encrypt, key, iv);
            } catch (Exception e) {
-                log.info("Cipher [{}] disabled: {}", factory.getName(), e.getCause().getMessage());
-                factories.remove();
+                warn = true;
+                log.warn(e.getCause().getMessage());
+                i.remove();
            }
        }
+        if (warn)
+            log.warn("Disabling high-strength ciphers: cipher strengths apparently limited by JCE policy");

        setCipherFactories(avail);
-        log.debug("Available Ciphers {}", avail);
+        log.debug("Available cipher factories: {}", avail);
    }

    protected void initMACFactories() {
--- a/src/main/java/net/schmizz/sshj/SSHClient.java
+++ b/src/main/java/net/schmizz/sshj/SSHClient.java
@@ -15,8 +15,6 @@
 */
 package net.schmizz.sshj;

-import net.schmizz.keepalive.KeepAlive;
-import com.hierynomus.sshj.common.ThreadNameProvider;
 import net.schmizz.sshj.common.*;
 import net.schmizz.sshj.connection.Connection;
 import net.schmizz.sshj.connection.ConnectionException;
@@ -57,7 +55,6 @@ import javax.security.auth.login.LoginContext;
 import java.io.Closeable;
 import java.io.File;
 import java.io.IOException;
-import java.net.InetSocketAddress;
 import java.net.ServerSocket;
 import java.nio.charset.Charset;
 import java.security.KeyPair;
@@ -143,7 +140,7 @@ public class SSHClient
        super(DEFAULT_PORT);
 	loggerFactory = config.getLoggerFactory();
 	log = loggerFactory.getLogger(getClass());
-        this.trans = new TransportImpl(config);
+        this.trans = new TransportImpl(config, this);
        this.auth = new UserAuthImpl(trans);
        this.conn = new ConnectionImpl(trans, config.getKeepAliveProvider());
    }
@@ -427,7 +424,6 @@ public class SSHClient
    @Override
    public void disconnect()
            throws IOException {
-        conn.getKeepAlive().interrupt();
        for (LocalPortForwarder forwarder : forwarders) {
            try {
                forwarder.close();
@@ -445,16 +441,6 @@ public class SSHClient
        return conn;
    }

-    /**
-     * Get Remote Socket Address from Transport
-     *
-     * @return Remote Socket Address or null when not connected
-     */
-    @Override
-    public InetSocketAddress getRemoteSocketAddress() {
-        return trans.getRemoteSocketAddress();
-    }
-
    /**
     * Returns the character set used to communicate with the remote machine for certain strings (like paths).
     *
@@ -551,7 +537,7 @@ public class SSHClient
     * Creates a {@link KeyProvider} instance from given location on the file system. Currently the following private key files are supported:
     * <ul>
     *     <li>PKCS8 (OpenSSH uses this format)</li>
-     *     <li>PEM-encoded PKCS1</li>
+     *     <li>PKCS5</li>
     *     <li>Putty keyfile</li>
     *     <li>openssh-key-v1 (New OpenSSH keyfile format)</li>
     * </ul>
@@ -742,7 +728,7 @@ public class SSHClient
     *
     * @throws IOException if there is an error starting the {@code sftp} subsystem
     */
-    public StatefulSFTPClient newStatefulSFTPClient()
+    public SFTPClient newStatefulSFTPClient()
            throws IOException {
        checkConnected();
        checkAuthenticated();
@@ -805,11 +791,6 @@ public class SSHClient
            throws IOException {
        super.onConnect();
        trans.init(getRemoteHostname(), getRemotePort(), getInputStream(), getOutputStream());
-        final KeepAlive keepAliveThread = conn.getKeepAlive();
-        if (keepAliveThread.isEnabled()) {
-            ThreadNameProvider.setThreadName(conn.getKeepAlive(), trans);
-            keepAliveThread.start();
-        }
        doKex();
    }

--- a/src/main/java/net/schmizz/sshj/SocketClient.java
+++ b/src/main/java/net/schmizz/sshj/SocketClient.java
@@ -15,6 +15,8 @@
 */
 package net.schmizz.sshj;

+import com.hierynomus.sshj.backport.JavaVersion;
+import com.hierynomus.sshj.backport.Jdk7HttpProxySocket;
 import net.schmizz.sshj.connection.channel.Channel;
 import net.schmizz.sshj.connection.channel.direct.DirectConnection;

@@ -24,6 +26,7 @@ import java.io.InputStream;
 import java.io.OutputStream;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
+import java.net.Proxy;
 import java.net.Socket;

 public abstract class SocketClient {
@@ -54,6 +57,73 @@ public abstract class SocketClient {
        return new InetSocketAddress(hostname, port);
    }

+    /**
+     * Connect to a host via a proxy.
+     * @param hostname The host name to connect to.
+     * @param proxy The proxy to connect via.
+     * @deprecated This method will be removed after v0.12.0. If you want to connect via a proxy, you can do this by injecting a {@link javax.net.SocketFactory}
+     *             into the SocketClient. The SocketFactory should create sockets using the {@link java.net.Socket#Socket(java.net.Proxy)} constructor.
+     */
+    @Deprecated
+    public void connect(String hostname, Proxy proxy) throws IOException {
+        connect(hostname, defaultPort, proxy);
+    }
+
+    /**
+     * Connect to a host via a proxy.
+     * @param hostname The host name to connect to.
+     * @param port The port to connect to.
+     * @param proxy The proxy to connect via.
+     * @deprecated This method will be removed after v0.12.0. If you want to connect via a proxy, you can do this by injecting a {@link javax.net.SocketFactory}
+     *             into the SocketClient. The SocketFactory should create sockets using the {@link java.net.Socket#Socket(java.net.Proxy)} constructor.
+     */
+    @Deprecated
+    public void connect(String hostname, int port, Proxy proxy) throws IOException {
+        this.hostname = hostname;
+        this.port = port;
+        if (JavaVersion.isJava7OrEarlier() && proxy.type() == Proxy.Type.HTTP) {
+            // Java7 and earlier have no support for HTTP Connect proxies, return our custom socket.
+            socket = new Jdk7HttpProxySocket(proxy);
+        } else {
+            socket = new Socket(proxy);
+        }
+        socket.connect(makeInetSocketAddress(hostname, port), connectTimeout);
+        onConnect();
+    }
+
+    /**
+     * Connect to a host via a proxy.
+     * @param host The host address to connect to.
+     * @param proxy The proxy to connect via.
+     * @deprecated This method will be removed after v0.12.0. If you want to connect via a proxy, you can do this by injecting a {@link javax.net.SocketFactory}
+     *             into the SocketClient. The SocketFactory should create sockets using the {@link java.net.Socket#Socket(java.net.Proxy)} constructor.
+     */
+    @Deprecated
+    public void connect(InetAddress host, Proxy proxy) throws IOException {
+        connect(host, defaultPort, proxy);
+    }
+
+    /**
+     * Connect to a host via a proxy.
+     * @param host The host address to connect to.
+     * @param port The port to connect to.
+     * @param proxy The proxy to connect via.
+     * @deprecated This method will be removed after v0.12.0. If you want to connect via a proxy, you can do this by injecting a {@link javax.net.SocketFactory}
+     *             into the SocketClient. The SocketFactory should create sockets using the {@link java.net.Socket#Socket(java.net.Proxy)} constructor.
+     */
+    @Deprecated
+    public void connect(InetAddress host, int port, Proxy proxy) throws IOException {
+        this.port = port;
+        if (JavaVersion.isJava7OrEarlier() && proxy.type() == Proxy.Type.HTTP) {
+            // Java7 and earlier have no support for HTTP Connect proxies, return our custom socket.
+            socket = new Jdk7HttpProxySocket(proxy);
+        } else {
+            socket = new Socket(proxy);
+        }
+        socket.connect(new InetSocketAddress(host, port), connectTimeout);
+        onConnect();
+    }
+
    public void connect(String hostname) throws IOException {
        connect(hostname, defaultPort);
    }
--- a/src/main/java/net/schmizz/sshj/common/Base64.java
+++ b/src/main/java/net/schmizz/sshj/common/Base64.java
--- a/src/main/java/net/schmizz/sshj/common/ECDSAVariationsAdapter.java
+++ b/src/main/java/net/schmizz/sshj/common/ECDSAVariationsAdapter.java
@@ -57,6 +57,9 @@ class ECDSAVariationsAdapter {

    static PublicKey readPubKeyFromBuffer(Buffer<?> buf, String variation) throws GeneralSecurityException {
        String algorithm = BASE_ALGORITHM_NAME + variation;
+        if (!SecurityUtils.isBouncyCastleRegistered()) {
+            throw new GeneralSecurityException("BouncyCastle is required to read a key of type " + algorithm);
+        }
        try {
            // final String algo = buf.readString(); it has been already read
            final String curveName = buf.readString();
--- a/src/main/java/net/schmizz/sshj/common/SecurityUtils.java
+++ b/src/main/java/net/schmizz/sshj/common/SecurityUtils.java
@@ -259,11 +259,6 @@ public class SecurityUtils {
        return false;
    }

-    /**
-     * Configure whether to register the Bouncy Castle Security Provider. Must be called prior to other methods
-     *
-     * @param registerBouncyCastle Enable or disable Bouncy Castle Provider registration on subsequent method invocation
-     */
    public static synchronized void setRegisterBouncyCastle(boolean registerBouncyCastle) {
        SecurityUtils.registerBouncyCastle = registerBouncyCastle;
        registrationDone = false;
--- a/src/main/java/net/schmizz/sshj/common/StreamCopier.java
+++ b/src/main/java/net/schmizz/sshj/common/StreamCopier.java
@@ -145,14 +145,8 @@ public class StreamCopier {
        final double sizeKiB = count / 1024.0;
        log.debug(String.format("%1$,.1f KiB transferred in %2$,.1f seconds (%3$,.2f KiB/s)", sizeKiB, timeSeconds, (sizeKiB / timeSeconds)));

-        // Did we encounter EOF?
-        if (read == -1) {
-            // If InputStream was closed we should also close OutputStream
-            out.close();
-
-            if (length != -1)
-                throw new IOException("Encountered EOF, could not transfer " + length + " bytes");
-        }
+        if (length != -1 && read == -1)
+            throw new IOException("Encountered EOF, could not transfer " + length + " bytes");

        return count;
    }
--- a/src/main/java/net/schmizz/sshj/connection/channel/AbstractChannel.java
+++ b/src/main/java/net/schmizz/sshj/connection/channel/AbstractChannel.java
@@ -304,25 +304,6 @@ public abstract class AbstractChannel
        }
    }

-    // Prevent CHANNEL_CLOSE to be sent between isOpen and a Transport.write call in the runnable, otherwise
-    // a disconnect with a "packet referred to nonexistent channel" message can occur.
-    //
-    // This particularly happens when the transport.Reader thread passes an eof from the server to the
-    // ChannelInputStream, the reading library-user thread returns, and closes the channel at the same time as the
-    // transport.Reader thread receives the subsequent CHANNEL_CLOSE from the server.
-    boolean whileOpen(TransportRunnable runnable) throws TransportException, ConnectionException {
-        openCloseLock.lock();
-        try {
-            if (isOpen()) {
-                runnable.run();
-                return true;
-            }
-        } finally {
-            openCloseLock.unlock();
-        }
-        return false;
-    }
-
    private void gotChannelRequest(SSHPacket buf)
            throws ConnectionException, TransportException {
        final String reqType;
@@ -446,8 +427,5 @@ public abstract class AbstractChannel
                + rwin + " >";
    }

-    public interface TransportRunnable {
-        void run() throws TransportException, ConnectionException;
-    }

 }
--- a/src/main/java/net/schmizz/sshj/connection/channel/ChannelInputStream.java
+++ b/src/main/java/net/schmizz/sshj/connection/channel/ChannelInputStream.java
@@ -105,7 +105,6 @@ public final class ChannelInputStream
                try {
                    buf.wait();
                } catch (InterruptedException e) {
-                    Thread.currentThread().interrupt();
                    throw (IOException) new InterruptedIOException().initCause(e);
                }
            }
--- a/src/main/java/net/schmizz/sshj/connection/channel/ChannelOutputStream.java
+++ b/src/main/java/net/schmizz/sshj/connection/channel/ChannelOutputStream.java
@@ -22,7 +22,6 @@ import net.schmizz.sshj.transport.TransportException;

 import java.io.IOException;
 import java.io.OutputStream;
-import java.util.concurrent.atomic.AtomicBoolean;

 /**
 * {@link OutputStream} for channels. Buffers data upto the remote window's maximum packet size. Data can also be
@@ -30,14 +29,14 @@ import java.util.concurrent.atomic.AtomicBoolean;
 */
 public final class ChannelOutputStream extends OutputStream implements ErrorNotifiable {

-    private final AbstractChannel chan;
+    private final Channel chan;
    private final Transport trans;
    private final Window.Remote win;

    private final DataBuffer buffer = new DataBuffer();
    private final byte[] b = new byte[1];

-    private AtomicBoolean closed;
+    private boolean closed;
    private SSHException error;

    private final class DataBuffer {
@@ -47,12 +46,6 @@ public final class ChannelOutputStream extends OutputStream implements ErrorNoti

        private final SSHPacket packet = new SSHPacket(Message.CHANNEL_DATA);
        private final Buffer.PlainBuffer leftOvers = new Buffer.PlainBuffer();
-        private final AbstractChannel.TransportRunnable packetWriteRunnable = new AbstractChannel.TransportRunnable() {
-            @Override
-            public void run() throws TransportException {
-                trans.write(packet);
-            }
-        };

        DataBuffer() {
            headerOffset = packet.rpos();
@@ -105,9 +98,8 @@ public final class ChannelOutputStream extends OutputStream implements ErrorNoti
                if (leftOverBytes > 0) {
                    leftOvers.putRawBytes(packet.array(), packet.wpos(), leftOverBytes);
                }
-                if (!chan.whileOpen(packetWriteRunnable)) {
-                    throwStreamClosed();
-                }
+
+                trans.write(packet);
                win.consume(writeNow);

                packet.rpos(headerOffset);
@@ -126,11 +118,10 @@ public final class ChannelOutputStream extends OutputStream implements ErrorNoti

    }

-    public ChannelOutputStream(AbstractChannel chan, Transport trans, Window.Remote win) {
+    public ChannelOutputStream(Channel chan, Transport trans, Window.Remote win) {
        this.chan = chan;
        this.trans = trans;
        this.win = win;
-        this.closed = new AtomicBoolean(false);
    }

    @Override
@@ -160,26 +151,24 @@ public final class ChannelOutputStream extends OutputStream implements ErrorNoti

    private void checkClose() throws SSHException {
        // Check whether either the Stream is closed, or the underlying channel is closed
-        if (closed.get() || !chan.isOpen()) {
-            if (error != null) {
+        if (closed || !chan.isOpen()) {
+            if (error != null)
                throw error;
-            } else {
-                throwStreamClosed();
-            }
+            else
+                throw new ConnectionException("Stream closed");
        }
    }

    @Override
    public synchronized void close() throws IOException {
        // Not closed yet, and underlying channel is open to flush the data to.
-        if (!closed.getAndSet(true)) {
-            chan.whileOpen(new AbstractChannel.TransportRunnable() {
-                @Override
-                public void run() throws TransportException, ConnectionException {
-                    buffer.flush(false);
-                    trans.write(new SSHPacket(Message.CHANNEL_EOF).putUInt32(chan.getRecipient()));
-                }
-            });
+        if (!closed && chan.isOpen()) {
+            try {
+                buffer.flush(false);
+//                trans.write(new SSHPacket(Message.CHANNEL_EOF).putUInt32(chan.getRecipient()));
+            } finally {
+                closed = true;
+            }
        }
    }

@@ -200,7 +189,4 @@ public final class ChannelOutputStream extends OutputStream implements ErrorNoti
        return "< ChannelOutputStream for Channel #" + chan.getID() + " >";
    }

-    private static void throwStreamClosed() throws ConnectionException {
-        throw new ConnectionException("Stream closed");
-    }
 }
--- a/src/main/java/net/schmizz/sshj/connection/channel/SocketStreamCopyMonitor.java
+++ b/src/main/java/net/schmizz/sshj/connection/channel/SocketStreamCopyMonitor.java
@@ -22,6 +22,8 @@ import java.io.IOException;
 import java.net.Socket;
 import java.util.concurrent.TimeUnit;

+import static com.hierynomus.sshj.backport.Sockets.asCloseable;
+
 public class SocketStreamCopyMonitor
        extends Thread {

@@ -41,7 +43,7 @@ public class SocketStreamCopyMonitor
                    await(y);
                } catch (IOException ignored) {
                } finally {
-                    IOUtils.closeQuietly(channel, socket);
+                    IOUtils.closeQuietly(channel, asCloseable(socket));
                }
            }

--- a/src/main/java/net/schmizz/sshj/connection/channel/Window.java
+++ b/src/main/java/net/schmizz/sshj/connection/channel/Window.java
@@ -93,7 +93,6 @@ public abstract class Window {
                            throw new ConnectionException("Timeout when trying to expand the window size");
                        }
                    } catch (InterruptedException ie) {
-                        Thread.currentThread().interrupt();
                        throw new ConnectionException(ie);
                    }
                }
--- a/src/main/java/net/schmizz/sshj/connection/channel/direct/LocalPortForwarder.java
+++ b/src/main/java/net/schmizz/sshj/connection/channel/direct/LocalPortForwarder.java
@@ -29,6 +29,8 @@ import java.net.Socket;
 import java.net.SocketException;
 import java.util.concurrent.TimeUnit;

+import static com.hierynomus.sshj.backport.Sockets.asCloseable;
+
 public class LocalPortForwarder {

    public static class ForwardedChannel
@@ -76,7 +78,7 @@ public class LocalPortForwarder {
            chan.open();
            chan.start();
        } catch (IOException e) {
-            IOUtils.closeQuietly(chan, socket);
+            IOUtils.closeQuietly(chan, asCloseable(socket));
            throw e;
        }
    }
--- a/src/main/java/net/schmizz/sshj/connection/channel/direct/SessionFactory.java
+++ b/src/main/java/net/schmizz/sshj/connection/channel/direct/SessionFactory.java
@@ -15,11 +15,10 @@
 */
 package net.schmizz.sshj.connection.channel.direct;

-import com.hierynomus.sshj.common.RemoteAddressProvider;
 import net.schmizz.sshj.common.SSHException;

 /** A factory interface for creating SSH {@link Session session channels}. */
-public interface SessionFactory extends RemoteAddressProvider {
+public interface SessionFactory {

    /**
     * Opens a {@code session} channel. The returned {@link Session} instance allows {@link Session#exec(String)
@@ -28,7 +27,7 @@ public interface SessionFactory extends RemoteAddressProvider {
     *
     * @return the opened {@code session} channel
     *
-     * @throws SSHException Thrown on session initialization failures
+     * @throws SSHException
     * @see Session
     */
    Session startSession()
--- a/src/main/java/net/schmizz/sshj/connection/channel/forwarded/RemotePortForwarder.java
+++ b/src/main/java/net/schmizz/sshj/connection/channel/forwarded/RemotePortForwarder.java
@@ -142,10 +142,6 @@ public class RemotePortForwarder
                // Listen on all IPv4
                return true;
            }
-            if ("0.0.0.0".equals(address) && "0:0:0:0:0:0:0:0".equals(channelForward.address)) {
-                // Handle IPv4 requests on IPv6 channel forward
-                return true;
-            }
            return false;
        }

--- a/src/main/java/net/schmizz/sshj/sftp/PacketReader.java
+++ b/src/main/java/net/schmizz/sshj/sftp/PacketReader.java
@@ -41,7 +41,7 @@ public class PacketReader extends Thread {
        this.engine = engine;
        log = engine.getLoggerFactory().getLogger(getClass());
        this.in = engine.getSubsystem().getInputStream();
-        setName("sshj-PacketReader");
+        setName("sftp reader");
        setDaemon(true);
    }

--- a/src/main/java/net/schmizz/sshj/sftp/RemoteFile.java
+++ b/src/main/java/net/schmizz/sshj/sftp/RemoteFile.java
@@ -23,8 +23,6 @@ import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
-import java.util.ArrayDeque;
-import java.util.Deque;
 import java.util.LinkedList;
 import java.util.Queue;
 import java.util.concurrent.TimeUnit;
@@ -222,104 +220,49 @@ public class RemoteFile

    public class ReadAheadRemoteFileInputStream
            extends InputStream {
-        private class UnconfirmedRead {
-            private final long offset;
-            private final Promise<Response, SFTPException> promise;
-            private final int length;
-
-            private UnconfirmedRead(long offset, int length, Promise<Response, SFTPException> promise) {
-                this.offset = offset;
-                this.length = length;
-                this.promise = promise;
-            }
-
-            UnconfirmedRead(long offset, int length) throws IOException {
-                this(offset, length, RemoteFile.this.asyncRead(offset, length));
-            }
-
-            public long getOffset() {
-                return offset;
-            }
-
-            public Promise<Response, SFTPException> getPromise() {
-                return promise;
-            }
-
-            public int getLength() {
-                return length;
-            }
-        }

        private final byte[] b = new byte[1];

        private final int maxUnconfirmedReads;
-        private final long readAheadLimit;
-        private final Deque<UnconfirmedRead> unconfirmedReads = new ArrayDeque<>();
+        private final Queue<Promise<Response, SFTPException>> unconfirmedReads = new LinkedList<Promise<Response, SFTPException>>();
+        private final Queue<Long> unconfirmedReadOffsets = new LinkedList<Long>();

-        private long currentOffset;
-        private int maxReadLength = Integer.MAX_VALUE;
+        private long requestOffset;
+        private long responseOffset;
        private boolean eof;

        public ReadAheadRemoteFileInputStream(int maxUnconfirmedReads) {
-            this(maxUnconfirmedReads, 0L);
-        }
-        
-        /**
-         *
-         * @param maxUnconfirmedReads Maximum number of unconfirmed requests to send
-         * @param fileOffset Initial offset in file to read from
-         */
-        public ReadAheadRemoteFileInputStream(int maxUnconfirmedReads, long fileOffset) {
-            this(maxUnconfirmedReads, fileOffset, -1L);
+            assert 0 <= maxUnconfirmedReads;
+
+            this.maxUnconfirmedReads = maxUnconfirmedReads;
        }

-        /**
-         *
-         * @param maxUnconfirmedReads Maximum number of unconfirmed requests to send
-         * @param fileOffset Initial offset in file to read from
-         * @param readAheadLimit Read ahead is disabled after this limit has been reached
-         */
-        public ReadAheadRemoteFileInputStream(int maxUnconfirmedReads, long fileOffset, long readAheadLimit) {
+        public ReadAheadRemoteFileInputStream(int maxUnconfirmedReads, long fileOffset) {
            assert 0 <= maxUnconfirmedReads;
            assert 0 <= fileOffset;

            this.maxUnconfirmedReads = maxUnconfirmedReads;
-            this.currentOffset = fileOffset;
-            this.readAheadLimit = readAheadLimit > 0 ? fileOffset + readAheadLimit : Long.MAX_VALUE;
+            this.requestOffset = this.responseOffset = fileOffset;
        }

        private ByteArrayInputStream pending = new ByteArrayInputStream(new byte[0]);

        private boolean retrieveUnconfirmedRead(boolean blocking) throws IOException {
-            final UnconfirmedRead unconfirmedRead = unconfirmedReads.peek();
-            if (unconfirmedRead == null || !blocking && !unconfirmedRead.getPromise().isDelivered()) {
+            if (unconfirmedReads.size() <= 0) {
                return false;
            }
-            unconfirmedReads.remove(unconfirmedRead);

-            final Response res = unconfirmedRead.promise.retrieve(requester.getTimeoutMs(), TimeUnit.MILLISECONDS);
+            if (!blocking && !unconfirmedReads.peek().isDelivered()) {
+                return false;
+            }
+
+            unconfirmedReadOffsets.remove();
+            final Response res = unconfirmedReads.remove().retrieve(requester.getTimeoutMs(), TimeUnit.MILLISECONDS);
            switch (res.getType()) {
                case DATA:
                    int recvLen = res.readUInt32AsInt();
-                    if (unconfirmedRead.offset == currentOffset) {
-                        currentOffset += recvLen;
-                        pending = new ByteArrayInputStream(res.array(), res.rpos(), recvLen);
-
-                        if (recvLen < unconfirmedRead.length) {
-                            // The server returned a packet smaller than the client had requested.
-                            // It can be caused by at least one of the following:
-                            // * The file has been read fully. Then, few futile read requests can be sent during
-                            //   the next read(), but the file will be downloaded correctly anyway.
-                            // * The server shapes the request length. Then, the read window will be adjusted,
-                            //   and all further read-ahead requests won't be shaped.
-                            // * The file on the server is not a regular file, it is something like fifo.
-                            //   Then, the window will shrink, and the client will start reading the file slower than it
-                            //   hypothetically can. It must be a rare case, and it is not worth implementing a sort of
-                            //   congestion control algorithm here.
-                            maxReadLength = recvLen;
-                            unconfirmedReads.clear();
-                        }
-                    }
+                    responseOffset += recvLen;
+                    pending = new ByteArrayInputStream(res.array(), res.rpos(), recvLen);
                    break;

                case STATUS:
@@ -347,31 +290,40 @@ public class RemoteFile
                // we also need to go here for len <= 0, because pending may be at
                // EOF in which case it would return -1 instead of 0

-                long requestOffset;
-                if (unconfirmedReads.isEmpty()) {
-                    requestOffset = currentOffset;
-                }
-                else {
-                    final UnconfirmedRead lastRequest = unconfirmedReads.getLast();
-                    requestOffset = lastRequest.offset + lastRequest.length;
-                }
                while (unconfirmedReads.size() <= maxUnconfirmedReads) {
                    // Send read requests as long as there is no EOF and we have not reached the maximum parallelism
-                    int reqLen = Math.min(Math.max(1024, len), maxReadLength);
-                    if (readAheadLimit > requestOffset) {
-                        long remaining = readAheadLimit - requestOffset;
-                        if (reqLen > remaining) {
-                            reqLen = (int) remaining;
-                        }
-                    }
-                    unconfirmedReads.add(new UnconfirmedRead(requestOffset, reqLen));
+                    int reqLen = Math.max(1024, len); // don't be shy!
+                    unconfirmedReads.add(RemoteFile.this.asyncRead(requestOffset, reqLen));
+                    unconfirmedReadOffsets.add(requestOffset);
                    requestOffset += reqLen;
-                    if (requestOffset >= readAheadLimit) {
-                        break;
-                    }
                }

-                if (!retrieveUnconfirmedRead(true /*blocking*/)) {
+                long nextOffset = unconfirmedReadOffsets.peek();
+                if (responseOffset != nextOffset) {
+
+                    // the server could not give us all the data we needed, so
+                    // we try to fill the gap synchronously
+
+                    assert responseOffset < nextOffset;
+                    assert 0 < (nextOffset - responseOffset);
+                    assert (nextOffset - responseOffset) <= Integer.MAX_VALUE;
+
+                    byte[] buf = new byte[(int) (nextOffset - responseOffset)];
+                    int recvLen = RemoteFile.this.read(responseOffset, buf, 0, buf.length);
+
+                    if (recvLen < 0) {
+                        eof = true;
+                        return -1;
+                    }
+
+                    if (0 == recvLen) {
+                        // avoid infinite loops
+                        throw new SFTPException("Unexpected response size (0), bailing out");
+                    }
+
+                    responseOffset += recvLen;
+                    pending = new ByteArrayInputStream(buf, 0, recvLen);
+                } else if (!retrieveUnconfirmedRead(true /*blocking*/)) {

                    // this may happen if we change prefetch strategy
                    // currently, we should never get here...
--- a/src/main/java/net/schmizz/sshj/sftp/SFTPClient.java
+++ b/src/main/java/net/schmizz/sshj/sftp/SFTPClient.java
@@ -115,13 +115,9 @@ public class SFTPClient
        }
    }

-    public void rename(String oldpath, String newpath) throws IOException {
-        rename(oldpath, newpath, EnumSet.noneOf(RenameFlags.class));
-    }
-
-    public void rename(String oldpath, String newpath, Set<RenameFlags> renameFlags)
+    public void rename(String oldpath, String newpath)
            throws IOException {
-        engine.rename(oldpath, newpath, renameFlags);
+        engine.rename(oldpath, newpath);
    }

    public void rm(String filename)
@@ -232,41 +228,21 @@ public class SFTPClient
            throws IOException {
        xfer.download(source, dest);
    }
-    
-    public void get(String source, String dest, long byteOffset)
-            throws IOException {
-        xfer.download(source, dest, byteOffset);
-    }

    public void put(String source, String dest)
            throws IOException {
        xfer.upload(source, dest);
    }

-    public void put(String source, String dest, long byteOffset)
-            throws IOException {
-        xfer.upload(source, dest, byteOffset);
-    }
-
    public void get(String source, LocalDestFile dest)
            throws IOException {
        xfer.download(source, dest);
    }
-    
-    public void get(String source, LocalDestFile dest, long byteOffset)
-            throws IOException {
-        xfer.download(source, dest, byteOffset);
-    }

    public void put(LocalSourceFile source, String dest)
            throws IOException {
        xfer.upload(source, dest);
    }
-    
-    public void put(LocalSourceFile source, String dest, long byteOffset)
-            throws IOException {
-        xfer.upload(source, dest, byteOffset);
-    }

    @Override
    public void close()
--- a/src/main/java/net/schmizz/sshj/sftp/SFTPEngine.java
+++ b/src/main/java/net/schmizz/sshj/sftp/SFTPEngine.java
@@ -15,7 +15,6 @@
 */
 package net.schmizz.sshj.sftp;

-import com.hierynomus.sshj.common.ThreadNameProvider;
 import net.schmizz.concurrent.Promise;
 import net.schmizz.sshj.common.IOUtils;
 import net.schmizz.sshj.common.LoggerFactory;
@@ -69,7 +68,6 @@ public class SFTPEngine
        sub = session.startSubsystem("sftp");
        out = sub.getOutputStream();
        reader = new PacketReader(this);
-        ThreadNameProvider.setThreadName(reader, ssh);
        pathHelper = new PathHelper(new PathHelper.Canonicalizer() {
            @Override
            public String canonicalize(String path)
@@ -232,22 +230,13 @@ public class SFTPEngine
        return stat(PacketType.LSTAT, path);
    }

-    public void rename(String oldPath, String newPath, Set<RenameFlags> flags)
+    public void rename(String oldPath, String newPath)
            throws IOException {
        if (operativeVersion < 1)
            throw new SFTPException("RENAME is not supported in SFTPv" + operativeVersion);
-
-        final Request request = newRequest(PacketType.RENAME).putString(oldPath, sub.getRemoteCharset()).putString(newPath, sub.getRemoteCharset());
-        // SFTP Version 5 introduced rename flags according to Section 6.5 of the specification
-        if (operativeVersion >= 5) {
-            long renameFlagMask = 0L;
-            for (RenameFlags flag : flags) {
-                renameFlagMask = renameFlagMask | flag.longValue();
-            }
-            request.putUInt32(renameFlagMask);
-        }
-
-        doRequest(request).ensureStatusPacketIsOK();
+        doRequest(
+                newRequest(PacketType.RENAME).putString(oldPath, sub.getRemoteCharset()).putString(newPath, sub.getRemoteCharset())
+        ).ensureStatusPacketIsOK();
    }

    public String canonicalize(String path)
--- a/src/main/java/net/schmizz/sshj/sftp/SFTPFileTransfer.java
+++ b/src/main/java/net/schmizz/sshj/sftp/SFTPFileTransfer.java
@@ -50,47 +50,25 @@ public class SFTPFileTransfer
    @Override
    public void upload(String source, String dest)
            throws IOException {
-        upload(source, dest, 0);
-    }
-    
-    @Override
-    public void upload(String source, String dest, long byteOffset)
-            throws IOException {
-        upload(new FileSystemFile(source), dest, byteOffset);
+        upload(new FileSystemFile(source), dest);
    }

    @Override
    public void download(String source, String dest)
            throws IOException {
-        download(source, dest, 0);
-    }
-    
-    @Override
-    public void download(String source, String dest, long byteOffset)
-            throws IOException {
-        download(source, new FileSystemFile(dest), byteOffset);
+        download(source, new FileSystemFile(dest));
    }

    @Override
    public void upload(LocalSourceFile localFile, String remotePath) throws IOException {
-        upload(localFile, remotePath, 0);
-    }
-    
-    @Override
-    public void upload(LocalSourceFile localFile, String remotePath, long byteOffset) throws IOException {
-        new Uploader(localFile, remotePath).upload(getTransferListener(), byteOffset);
+        new Uploader(localFile, remotePath).upload(getTransferListener());
    }

    @Override
    public void download(String source, LocalDestFile dest) throws IOException {
-        download(source, dest, 0);
-    }
-    
-    @Override
-    public void download(String source, LocalDestFile dest, long byteOffset) throws IOException {
        final PathComponents pathComponents = engine.getPathHelper().getComponents(source);
        final FileAttributes attributes = engine.stat(source);
-        new Downloader().download(getTransferListener(), new RemoteResourceInfo(pathComponents, attributes), dest, byteOffset);
+        new Downloader().download(getTransferListener(), new RemoteResourceInfo(pathComponents, attributes), dest);
    }

    public void setUploadFilter(LocalFileFilter uploadFilter) {
@@ -114,8 +92,7 @@ public class SFTPFileTransfer
        @SuppressWarnings("PMD.MissingBreakInSwitch")
        private void download(final TransferListener listener,
                              final RemoteResourceInfo remote,
-                              final LocalDestFile local,
-                              final long byteOffset) throws IOException {
+                              final LocalDestFile local) throws IOException {
            final LocalDestFile adjustedFile;
            switch (remote.getAttributes().getType()) {
                case DIRECTORY:
@@ -124,9 +101,8 @@ public class SFTPFileTransfer
                case UNKNOWN:
                    log.warn("Server did not supply information about the type of file at `{}` " +
                                     "-- assuming it is a regular file!", remote.getPath());
-                    // fall through
                case REGULAR:
-                    adjustedFile = downloadFile(listener.file(remote.getName(), remote.getAttributes().getSize()), remote, local, byteOffset);
+                    adjustedFile = downloadFile(listener.file(remote.getName(), remote.getAttributes().getSize()), remote, local);
                    break;
                default:
                    throw new IOException(remote + " is not a regular file or directory");
@@ -143,7 +119,7 @@ public class SFTPFileTransfer
            final RemoteDirectory rd = engine.openDir(remote.getPath());
            try {
                for (RemoteResourceInfo rri : rd.scan(getDownloadFilter()))
-                    download(listener, rri, adjusted.getChild(rri.getName()), 0); // not supporting individual byte offsets for these files
+                    download(listener, rri, adjusted.getChild(rri.getName()));
            } finally {
                rd.close();
            }
@@ -152,15 +128,13 @@ public class SFTPFileTransfer

        private LocalDestFile downloadFile(final StreamCopier.Listener listener,
                                           final RemoteResourceInfo remote,
-                                           final LocalDestFile local,
-                                           final long byteOffset)
+                                           final LocalDestFile local)
                throws IOException {
            final LocalDestFile adjusted = local.getTargetFile(remote.getName());
            final RemoteFile rf = engine.open(remote.getPath());
            try {
-                log.debug("Attempting to download {} with offset={}", remote.getPath(), byteOffset);
-                final RemoteFile.ReadAheadRemoteFileInputStream rfis = rf.new ReadAheadRemoteFileInputStream(16, byteOffset);
-                final OutputStream os = adjusted.getOutputStream(byteOffset != 0);
+                final RemoteFile.ReadAheadRemoteFileInputStream rfis = rf.new ReadAheadRemoteFileInputStream(16);
+                final OutputStream os = adjusted.getOutputStream();
                try {
                    new StreamCopier(rfis, os, engine.getLoggerFactory())
                            .bufSize(engine.getSubsystem().getLocalMaxPacketSize())
@@ -199,17 +173,17 @@ public class SFTPFileTransfer
            this.remote = remote;
        }

-        private void upload(final TransferListener listener, long byteOffset) throws IOException {
+        private void upload(final TransferListener listener) throws IOException {
            if (source.isDirectory()) {
                makeDirIfNotExists(remote); // Ensure that the directory exists
                uploadDir(listener.directory(source.getName()), source, remote);
                setAttributes(source, remote);
            } else if (source.isFile() && isDirectory(remote)) {
                String adjustedRemote = engine.getPathHelper().adjustForParent(this.remote, source.getName());
-                uploadFile(listener.file(source.getName(), source.getLength()), source, adjustedRemote, byteOffset);
+                uploadFile(listener.file(source.getName(), source.getLength()), source, adjustedRemote);
                setAttributes(source, adjustedRemote);
            } else if (source.isFile()) {
-                uploadFile(listener.file(source.getName(), source.getLength()), source, remote, byteOffset);
+                uploadFile(listener.file(source.getName(), source.getLength()), source, remote);
                setAttributes(source, remote);
            } else {
                throw new IOException(source + " is not a file or directory");
@@ -218,14 +192,13 @@ public class SFTPFileTransfer

        private void upload(final TransferListener listener,
                            final LocalSourceFile local,
-                            final String remote,
-                            final long byteOffset)
+                            final String remote)
                throws IOException {
            final String adjustedPath;
            if (local.isDirectory()) {
                adjustedPath = uploadDir(listener.directory(local.getName()), local, remote);
            } else if (local.isFile()) {
-                adjustedPath = uploadFile(listener.file(local.getName(), local.getLength()), local, remote, byteOffset);
+                adjustedPath = uploadFile(listener.file(local.getName(), local.getLength()), local, remote);
            } else {
                throw new IOException(local + " is not a file or directory");
            }
@@ -244,34 +217,22 @@ public class SFTPFileTransfer
                throws IOException {
            makeDirIfNotExists(remote);
            for (LocalSourceFile f : local.getChildren(getUploadFilter()))
-                upload(listener, f, engine.getPathHelper().adjustForParent(remote, f.getName()), 0); // not supporting individual byte offsets for these files
+                upload(listener, f, engine.getPathHelper().adjustForParent(remote, f.getName()));
            return remote;
        }

        private String uploadFile(final StreamCopier.Listener listener,
                                  final LocalSourceFile local,
-                                  final String remote,
-                                  final long byteOffset)
+                                  final String remote)
                throws IOException {
-            final String adjusted = prepareFile(local, remote, byteOffset);
+            final String adjusted = prepareFile(local, remote);
            RemoteFile rf = null;
            InputStream fis = null;
            RemoteFile.RemoteFileOutputStream rfos = null;
-            EnumSet<OpenMode> modes;
            try {
-                if (byteOffset == 0) {
-                    // Starting at the beginning, overwrite/create
-                    modes = EnumSet.of(OpenMode.WRITE, OpenMode.CREAT, OpenMode.TRUNC);
-                } else {
-                    // Starting at some offset, append
-                    modes = EnumSet.of(OpenMode.WRITE, OpenMode.APPEND);
-                }
-                
-                log.debug("Attempting to upload {} with offset={}", local.getName(), byteOffset);
-                rf = engine.open(adjusted, modes);
+                rf = engine.open(adjusted, EnumSet.of(OpenMode.WRITE, OpenMode.CREAT, OpenMode.TRUNC));
                fis = local.getInputStream();
-                fis.skip(byteOffset);
-                rfos = rf.new RemoteFileOutputStream(byteOffset, 16);
+                rfos = rf.new RemoteFileOutputStream(0, 16);
                new StreamCopier(fis, rfos, engine.getLoggerFactory())
                        .bufSize(engine.getSubsystem().getRemoteMaxPacketSize() - rf.getOutgoingPacketOverhead())
                        .keepFlushing(false)
@@ -333,7 +294,7 @@ public class SFTPFileTransfer
            }
        }

-        private String prepareFile(final LocalSourceFile local, final String remote, final long byteOffset)
+        private String prepareFile(final LocalSourceFile local, final String remote)
                throws IOException {
            final FileAttributes attrs;
            try {
@@ -348,7 +309,7 @@ public class SFTPFileTransfer
            if (attrs.getMode().getType() == FileMode.Type.DIRECTORY) {
                throw new IOException("Trying to upload file " + local.getName() + " to path " + remote + " but that is a directory");
            } else {
-                log.debug("probeFile: {} is a {} file that will be {}", remote, attrs.getMode().getType(), byteOffset > 0 ? "resumed" : "replaced");
+                log.debug("probeFile: {} is a {} file that will be replaced", remote, attrs.getMode().getType());
                return remote;
            }
        }
--- a/src/main/java/net/schmizz/sshj/sftp/StatefulSFTPClient.java
+++ b/src/main/java/net/schmizz/sshj/sftp/StatefulSFTPClient.java
@@ -117,9 +117,9 @@ public class StatefulSFTPClient
    }

    @Override
-    public void rename(String oldpath, String newpath, Set<RenameFlags> renameFlags)
+    public void rename(String oldpath, String newpath)
            throws IOException {
-        super.rename(cwdify(oldpath), cwdify(newpath), renameFlags);
+        super.rename(cwdify(oldpath), cwdify(newpath));
    }

    @Override
--- a/src/main/java/net/schmizz/sshj/signature/AbstractSignatureDSA.java
+++ b/src/main/java/net/schmizz/sshj/signature/AbstractSignatureDSA.java
@@ -1,63 +0,0 @@
-/*
- * Copyright (C)2009 - SSHJ Contributors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package net.schmizz.sshj.signature;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.math.BigInteger;
-import java.util.ArrayList;
-import java.util.List;
-
-import com.hierynomus.asn1.ASN1OutputStream;
-import com.hierynomus.asn1.encodingrules.der.DEREncoder;
-import com.hierynomus.asn1.types.ASN1Object;
-import com.hierynomus.asn1.types.constructed.ASN1Sequence;
-import com.hierynomus.asn1.types.primitive.ASN1Integer;
-
-import net.schmizz.sshj.common.IOUtils;
-
-public abstract class AbstractSignatureDSA extends AbstractSignature {
-    protected AbstractSignatureDSA(String algorithm, String signatureName) {
-        super(algorithm, signatureName);
-    }
-
-    /**
-     * Get ASN.1 Signature encoded using DER Sequence of integers
-     *
-     * @param r DSA Signature R
-     * @param s DSA Signature S
-     * @return ASN.1 Encoded Signature
-     * @throws IOException Thrown when failing to write signature integers
-     */
-    @SuppressWarnings("rawtypes")
-    protected byte[] encodeAsnSignature(final BigInteger r, final BigInteger s) throws IOException {
-        List<ASN1Object> vector = new ArrayList<ASN1Object>();
-        vector.add(new com.hierynomus.asn1.types.primitive.ASN1Integer(r));
-        vector.add(new ASN1Integer(s));
-
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        ASN1OutputStream asn1OutputStream = new ASN1OutputStream(new DEREncoder(), baos);
-        try {
-            asn1OutputStream.writeObject(new ASN1Sequence(vector));
-            asn1OutputStream.flush();
-        } finally {
-            IOUtils.closeQuietly(asn1OutputStream);
-        }
-
-        return baos.toByteArray();
-
-    }
-}
--- a/src/main/java/net/schmizz/sshj/signature/SignatureDSA.java
+++ b/src/main/java/net/schmizz/sshj/signature/SignatureDSA.java
@@ -15,19 +15,26 @@
 */
 package net.schmizz.sshj.signature;

+import com.hierynomus.asn1.encodingrules.der.DEREncoder;
+import com.hierynomus.asn1.types.ASN1Object;
+import com.hierynomus.asn1.types.constructed.ASN1Sequence;
+import com.hierynomus.asn1.types.primitive.ASN1Integer;
 import net.schmizz.sshj.common.KeyType;
 import net.schmizz.sshj.common.SSHRuntimeException;

+import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.math.BigInteger;
 import java.security.SignatureException;
+import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.List;

 /**
 * DSA {@link Signature}
 */
 public class SignatureDSA
-        extends AbstractSignatureDSA {
+        extends AbstractSignature {

    /**
     * A named factory for DSA signature
@@ -83,14 +90,32 @@ public class SignatureDSA
    public boolean verify(byte[] sig) {
        try {
            byte[] sigBlob = extractSig(sig, "ssh-dss");
-            BigInteger r = new BigInteger(1, Arrays.copyOfRange(sigBlob, 0, 20));
-            BigInteger s = new BigInteger(1, Arrays.copyOfRange(sigBlob, 20, 40));
-
-            return signature.verify(encodeAsnSignature(r, s));
+            return signature.verify(asnEncode(sigBlob));
        } catch (SignatureException e) {
            throw new SSHRuntimeException(e);
        } catch (IOException e) {
            throw new SSHRuntimeException(e);
        }
    }
+
+    /**
+     * Encodes the signature as a DER sequence (ASN.1 format).
+     */
+    private byte[] asnEncode(byte[] sigBlob) throws IOException {
+        BigInteger r = new BigInteger(1, Arrays.copyOfRange(sigBlob, 0, 20));
+        BigInteger s = new BigInteger(1, Arrays.copyOfRange(sigBlob, 20, 40));
+
+        List<ASN1Object> vector = new ArrayList<ASN1Object>();
+        vector.add(new com.hierynomus.asn1.types.primitive.ASN1Integer(r));
+        vector.add(new ASN1Integer(s));
+
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        com.hierynomus.asn1.ASN1OutputStream asn1OutputStream = new com.hierynomus.asn1.ASN1OutputStream(new DEREncoder(), baos);
+
+        asn1OutputStream.writeObject(new ASN1Sequence(vector));
+        asn1OutputStream.flush();
+
+
+        return baos.toByteArray();
+    }
 }
--- a/src/main/java/net/schmizz/sshj/signature/SignatureECDSA.java
+++ b/src/main/java/net/schmizz/sshj/signature/SignatureECDSA.java
@@ -15,8 +15,9 @@
 */
 package net.schmizz.sshj.signature;

-import com.hierynomus.asn1.ASN1InputStream;
 import com.hierynomus.asn1.encodingrules.der.DERDecoder;
+import com.hierynomus.asn1.encodingrules.der.DEREncoder;
+import com.hierynomus.asn1.types.ASN1Object;
 import com.hierynomus.asn1.types.constructed.ASN1Sequence;
 import com.hierynomus.asn1.types.primitive.ASN1Integer;
 import net.schmizz.sshj.common.Buffer;
@@ -25,12 +26,15 @@ import net.schmizz.sshj.common.KeyType;
 import net.schmizz.sshj.common.SSHRuntimeException;

 import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.math.BigInteger;
 import java.security.SignatureException;
+import java.util.ArrayList;
+import java.util.List;

 /** ECDSA {@link Signature} */
-public class SignatureECDSA extends AbstractSignatureDSA {
+public class SignatureECDSA extends AbstractSignature {

    /** A named factory for ECDSA-256 signature */
    public static class Factory256 implements net.schmizz.sshj.common.Factory.Named<Signature> {
@@ -87,7 +91,7 @@ public class SignatureECDSA extends AbstractSignatureDSA {
    @Override
    public byte[] encode(byte[] sig) {
        ByteArrayInputStream bais = new ByteArrayInputStream(sig);
-        ASN1InputStream asn1InputStream = new ASN1InputStream(new DERDecoder(), bais);
+        com.hierynomus.asn1.ASN1InputStream asn1InputStream = new com.hierynomus.asn1.ASN1InputStream(new DERDecoder(), bais);
        try {
            ASN1Sequence sequence = asn1InputStream.readObject();
            ASN1Integer r = (ASN1Integer) sequence.get(0);
@@ -106,14 +110,35 @@ public class SignatureECDSA extends AbstractSignatureDSA {
    public boolean verify(byte[] sig) {
        try {
            byte[] sigBlob = extractSig(sig, keyTypeName);
-            Buffer.PlainBuffer sigbuf = new Buffer.PlainBuffer(sigBlob);
-            BigInteger r = sigbuf.readMPInt();
-            BigInteger s = sigbuf.readMPInt();
-            return signature.verify(encodeAsnSignature(r, s));
+            return signature.verify(asnEncode(sigBlob));
        } catch (SignatureException e) {
            throw new SSHRuntimeException(e);
        } catch (IOException e) {
            throw new SSHRuntimeException(e);
        }
    }
+
+    /**
+     * Encodes the signature as a DER sequence (ASN.1 format).
+     */
+    private byte[] asnEncode(byte[] sigBlob) throws IOException {
+        Buffer.PlainBuffer sigbuf = new Buffer.PlainBuffer(sigBlob);
+        BigInteger r = sigbuf.readMPInt();
+        BigInteger s = sigbuf.readMPInt();
+
+
+        List<ASN1Object> vector = new ArrayList<ASN1Object>();
+        vector.add(new ASN1Integer(r));
+        vector.add(new ASN1Integer(s));
+
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        com.hierynomus.asn1.ASN1OutputStream asn1OutputStream = new com.hierynomus.asn1.ASN1OutputStream(new DEREncoder(), baos);
+        try {
+            asn1OutputStream.writeObject(new ASN1Sequence(vector));
+            asn1OutputStream.flush();
+        } finally {
+            IOUtils.closeQuietly(asn1OutputStream);
+        }
+        return baos.toByteArray();
+    }
 }
--- a/src/main/java/net/schmizz/sshj/transport/KeyExchanger.java
+++ b/src/main/java/net/schmizz/sshj/transport/KeyExchanger.java
@@ -136,25 +136,13 @@ final class KeyExchanger
    void startKex(boolean waitForDone)
            throws TransportException {
        if (!kexOngoing.getAndSet(true)) {
-            if (isKeyExchangeAllowed()) {
-                log.debug("Initiating key exchange");
-                done.clear();
-                sendKexInit();
-            } else {
-                kexOngoing.set(false);
-            }
+            done.clear();
+            sendKexInit();
        }
        if (waitForDone)
            waitForDone();
    }

-    /**
-     * Key exchange can be initiated exactly once while connecting or later after authentication when re-keying.
-     */
-    private boolean isKeyExchangeAllowed() {
-        return !isKexDone() || transport.isAuthenticated();
-    }
-
    void waitForDone()
            throws TransportException {
        done.await(transport.getTimeoutMs(), TimeUnit.MILLISECONDS);
@@ -182,22 +170,11 @@ final class KeyExchanger
    private void sendKexInit()
            throws TransportException {
        log.debug("Sending SSH_MSG_KEXINIT");
-        List<String> knownHostAlgs = findKnownHostAlgs(transport.getRemoteHost(), transport.getRemotePort());
-        clientProposal = new Proposal(transport.getConfig(), knownHostAlgs);
+        clientProposal = new Proposal(transport.getConfig());
        transport.write(clientProposal.getPacket());
        kexInitSent.set();
    }

-    private List<String> findKnownHostAlgs(String hostname, int port) {
-        for (HostKeyVerifier hkv : hostVerifiers) {
-            List<String> keyTypes = hkv.findExistingAlgorithms(hostname, port);
-            if (keyTypes != null && !keyTypes.isEmpty()) {
-                return keyTypes;
-            }
-        }
-        return Collections.emptyList();
-    }
-
    private void sendNewKeys()
            throws TransportException {
        log.debug("Sending SSH_MSG_NEWKEYS");
@@ -255,6 +232,7 @@ final class KeyExchanger
                                        negotiatedAlgs.getKeyExchangeAlgorithm());
        transport.setHostKeyAlgorithm(Factory.Named.Util.create(transport.getConfig().getKeyAlgorithms(),
                                      negotiatedAlgs.getSignatureAlgorithm()));
+        transport.setRSASHA2Support(negotiatedAlgs.getRSASHA2Support());

        try {
            kex.init(transport,
--- a/src/main/java/net/schmizz/sshj/transport/NegotiatedAlgorithms.java
+++ b/src/main/java/net/schmizz/sshj/transport/NegotiatedAlgorithms.java
@@ -26,8 +26,10 @@ public final class NegotiatedAlgorithms {
    private final String c2sComp;
    private final String s2cComp;

+    private final boolean rsaSHA2Support;
+
    NegotiatedAlgorithms(String kex, String sig, String c2sCipher, String s2cCipher, String c2sMAC, String s2cMAC,
-                         String c2sComp, String s2cComp) {
+                         String c2sComp, String s2cComp, boolean rsaSHA2Support) {
        this.kex = kex;
        this.sig = sig;
        this.c2sCipher = c2sCipher;
@@ -36,6 +38,7 @@ public final class NegotiatedAlgorithms {
        this.s2cMAC = s2cMAC;
        this.c2sComp = c2sComp;
        this.s2cComp = s2cComp;
+        this.rsaSHA2Support = rsaSHA2Support;
    }

    public String getKeyExchangeAlgorithm() {
@@ -70,6 +73,10 @@ public final class NegotiatedAlgorithms {
        return s2cComp;
    }

+    public boolean getRSASHA2Support() {
+        return rsaSHA2Support;
+    }
+
    @Override
    public String toString() {
        return ("[ " +
@@ -81,6 +88,7 @@ public final class NegotiatedAlgorithms {
                "s2cMAC=" + s2cMAC + "; " +
                "c2sComp=" + c2sComp + "; " +
                "s2cComp=" + s2cComp + "; " +
+                "rsaSHA2Support=" + rsaSHA2Support +
                " ]");
    }

--- a/src/main/java/net/schmizz/sshj/transport/Proposal.java
+++ b/src/main/java/net/schmizz/sshj/transport/Proposal.java
@@ -15,6 +15,7 @@
 */
 package net.schmizz.sshj.transport;

+import com.hierynomus.sshj.key.KeyAlgorithms;
 import net.schmizz.sshj.Config;
 import net.schmizz.sshj.common.Buffer;
 import net.schmizz.sshj.common.Factory;
@@ -37,9 +38,9 @@ class Proposal {
    private final List<String> s2cComp;
    private final SSHPacket packet;

-    public Proposal(Config config, List<String> knownHostAlgs) {
+    public Proposal(Config config) {
        kex = Factory.Named.Util.getNames(config.getKeyExchangeFactories());
-        sig = filterKnownHostKeyAlgorithms(Factory.Named.Util.getNames(config.getKeyAlgorithms()), knownHostAlgs);
+        sig = Factory.Named.Util.getNames(config.getKeyAlgorithms());
        c2sCipher = s2cCipher = Factory.Named.Util.getNames(config.getCipherFactories());
        c2sMAC = s2cMAC = Factory.Named.Util.getNames(config.getMACFactories());
        c2sComp = s2cComp = Factory.Named.Util.getNames(config.getCompressionFactories());
@@ -126,45 +127,34 @@ class Proposal {
    public NegotiatedAlgorithms negotiate(Proposal other)
            throws TransportException {
        return new NegotiatedAlgorithms(
-                firstMatch("KeyExchangeAlgorithms", this.getKeyExchangeAlgorithms(), other.getKeyExchangeAlgorithms()),
-                firstMatch("HostKeyAlgorithms", this.getHostKeyAlgorithms(), other.getHostKeyAlgorithms()),
-                firstMatch("Client2ServerCipherAlgorithms", this.getClient2ServerCipherAlgorithms(),
-                        other.getClient2ServerCipherAlgorithms()),
-                firstMatch("Server2ClientCipherAlgorithms", this.getServer2ClientCipherAlgorithms(),
-                        other.getServer2ClientCipherAlgorithms()),
-                firstMatch("Client2ServerMACAlgorithms", this.getClient2ServerMACAlgorithms(),
-                        other.getClient2ServerMACAlgorithms()),
-                firstMatch("Server2ClientMACAlgorithms", this.getServer2ClientMACAlgorithms(),
-                        other.getServer2ClientMACAlgorithms()),
-                firstMatch("Client2ServerCompressionAlgorithms", this.getClient2ServerCompressionAlgorithms(),
-                        other.getClient2ServerCompressionAlgorithms()),
-                firstMatch("Server2ClientCompressionAlgorithms", this.getServer2ClientCompressionAlgorithms(),
-                        other.getServer2ClientCompressionAlgorithms())
+                firstMatch("KeyExchangeAlgorithms",
+                           this.getKeyExchangeAlgorithms(),
+                           other.getKeyExchangeAlgorithms()),
+                firstMatch("HostKeyAlgorithms",
+                           this.getHostKeyAlgorithms(),
+                           other.getHostKeyAlgorithms()),
+                firstMatch("Client2ServerCipherAlgorithms",
+                           this.getClient2ServerCipherAlgorithms(),
+                           other.getClient2ServerCipherAlgorithms()),
+                firstMatch("Server2ClientCipherAlgorithms",
+                           this.getServer2ClientCipherAlgorithms(),
+                           other.getServer2ClientCipherAlgorithms()),
+                firstMatch("Client2ServerMACAlgorithms",
+                           this.getClient2ServerMACAlgorithms(),
+                           other.getClient2ServerMACAlgorithms()),
+                firstMatch("Server2ClientMACAlgorithms",
+                           this.getServer2ClientMACAlgorithms(),
+                           other.getServer2ClientMACAlgorithms()),
+                firstMatch("Client2ServerCompressionAlgorithms",
+                           this.getClient2ServerCompressionAlgorithms(),
+                           other.getClient2ServerCompressionAlgorithms()),
+                firstMatch("Server2ClientCompressionAlgorithms",
+                           this.getServer2ClientCompressionAlgorithms(),
+                           other.getServer2ClientCompressionAlgorithms()),
+                other.getHostKeyAlgorithms().containsAll(KeyAlgorithms.SSH_RSA_SHA2_ALGORITHMS)
        );
    }

-    private List<String> filterKnownHostKeyAlgorithms(List<String> configuredKeyAlgorithms, List<String> knownHostKeyAlgorithms) {
-        if (knownHostKeyAlgorithms != null && !knownHostKeyAlgorithms.isEmpty()) {
-            List<String> preferredAlgorithms = new ArrayList<String>();
-            List<String> otherAlgorithms = new ArrayList<String>();
-
-            for (String configuredKeyAlgorithm : configuredKeyAlgorithms) {
-                if (knownHostKeyAlgorithms.contains(configuredKeyAlgorithm)) {
-                    preferredAlgorithms.add(configuredKeyAlgorithm);
-                } else {
-                    otherAlgorithms.add(configuredKeyAlgorithm);
-                }
-            }
-
-            preferredAlgorithms.addAll(otherAlgorithms);
-
-            return preferredAlgorithms;
-        } else {
-            return configuredKeyAlgorithms;
-        }
-
-    }
-
    private static String firstMatch(String ofWhat, List<String> a, List<String> b)
            throws TransportException {
        for (String aa : a) {
--- a/src/main/java/net/schmizz/sshj/transport/Reader.java
+++ b/src/main/java/net/schmizz/sshj/transport/Reader.java
@@ -29,7 +29,7 @@ public final class Reader
    public Reader(TransportImpl trans) {
        this.trans = trans;
        log = trans.getConfig().getLoggerFactory().getLogger(getClass());
-        setName("sshj-Reader");
+        setName("reader");
        setDaemon(true);
    }

--- a/src/main/java/net/schmizz/sshj/transport/Transport.java
+++ b/src/main/java/net/schmizz/sshj/transport/Transport.java
@@ -15,7 +15,6 @@
 */
 package net.schmizz.sshj.transport;

-import com.hierynomus.sshj.common.RemoteAddressProvider;
 import com.hierynomus.sshj.key.KeyAlgorithm;
 import net.schmizz.sshj.Config;
 import net.schmizz.sshj.Service;
@@ -28,12 +27,11 @@ import net.schmizz.sshj.transport.verification.HostKeyVerifier;

 import java.io.InputStream;
 import java.io.OutputStream;
-import java.util.List;
 import java.util.concurrent.TimeUnit;

 /** Transport layer of the SSH protocol. */
 public interface Transport
-        extends SSHPacketHandler, RemoteAddressProvider {
+        extends SSHPacketHandler {

    /**
     * Sets the host information and the streams to be used by this transport. Identification information is exchanged
@@ -87,6 +85,22 @@ public interface Transport
     */
    void setTimeoutMs(int timeout);

+    /**
+     * @return the interval in seconds at which a heartbeat message is sent to the server
+     * @deprecated Moved to {@link net.schmizz.keepalive.KeepAlive#getKeepAliveInterval()}. This is accessible through the {@link net.schmizz.sshj.connection.Connection}.
+     *             Scheduled to be removed in 0.12.0
+     */
+    @Deprecated
+    int getHeartbeatInterval();
+
+    /**
+     * @param interval the interval in seconds, {@code 0} means no heartbeat
+     * @deprecated Moved to {@link net.schmizz.keepalive.KeepAlive#getKeepAliveInterval()}. This is accessible through the {@link net.schmizz.sshj.connection.Connection}.
+     *             Scheduled to be removed in 0.12.0
+     */
+    @Deprecated
+    void setHeartbeatInterval(int interval);
+
    /** @return the hostname to which this transport is connected. */
    String getRemoteHost();

@@ -210,7 +224,7 @@ public interface Transport
    /**
     * Specify a {@code listener} that will be notified upon disconnection.
     *
-     * @param listener Disconnect Listener to be configured
+     * @param listener
     */
    void setDisconnectListener(DisconnectListener listener);

@@ -225,5 +239,5 @@ public interface Transport
    void die(Exception e);

    KeyAlgorithm getHostKeyAlgorithm();
-    List<KeyAlgorithm> getClientKeyAlgorithms(KeyType keyType) throws TransportException;
+    KeyAlgorithm getClientKeyAlgorithm(KeyType keyType) throws TransportException;
 }
--- a/src/main/java/net/schmizz/sshj/transport/TransportImpl.java
+++ b/src/main/java/net/schmizz/sshj/transport/TransportImpl.java
@@ -15,7 +15,6 @@
 */
 package net.schmizz.sshj.transport;

-import com.hierynomus.sshj.common.ThreadNameProvider;
 import com.hierynomus.sshj.key.KeyAlgorithm;
 import com.hierynomus.sshj.key.KeyAlgorithms;
 import com.hierynomus.sshj.transport.IdentificationStringParser;
@@ -23,6 +22,7 @@ import net.schmizz.concurrent.ErrorDeliveryUtil;
 import net.schmizz.concurrent.Event;
 import net.schmizz.sshj.AbstractService;
 import net.schmizz.sshj.Config;
+import net.schmizz.sshj.SSHClient;
 import net.schmizz.sshj.Service;
 import net.schmizz.sshj.common.*;
 import net.schmizz.sshj.transport.verification.AlgorithmsVerifier;
@@ -32,8 +32,6 @@ import org.slf4j.Logger;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
-import java.net.InetSocketAddress;
-import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.locks.ReentrantLock;
@@ -82,12 +80,20 @@ public final class TransportImpl

    private final Reader reader;

+    /**
+     * @deprecated Moved to {@link net.schmizz.sshj.SSHClient}
+     */
+    @Deprecated
+    private final SSHClient sshClient;
+
    private final Encoder encoder;

    private final Decoder decoder;

    private KeyAlgorithm hostKeyAlgorithm;

+    private boolean rsaSHA2Support;
+
    private final Event<TransportException> serviceAccept;

    private final Event<TransportException> close;
@@ -130,8 +136,8 @@ public final class TransportImpl
    public TransportImpl(Config config) {
        this.config = config;
        this.loggerFactory = config.getLoggerFactory();
-        this.serviceAccept = new Event<>("service accept", TransportException.chainer, loggerFactory);
-        this.close = new Event<>("transport close", TransportException.chainer, loggerFactory);
+        this.serviceAccept = new Event<TransportException>("service accept", TransportException.chainer, loggerFactory);
+        this.close = new Event<TransportException>("transport close", TransportException.chainer, loggerFactory);
        this.nullService = new NullService(this);
        this.service = nullService;
        this.log = loggerFactory.getLogger(getClass());
@@ -141,6 +147,29 @@ public final class TransportImpl
        this.decoder = new Decoder(this);
        this.kexer = new KeyExchanger(this);
        this.clientID = String.format("SSH-2.0-%s", config.getVersion());
+        this.sshClient = null;
+    }
+
+    /*
+     * Temporary constructor until we remove support for the set/get Heartbeat interval from transport.
+     * @deprecated To be removed in 0.12.0
+     */
+    @Deprecated
+    public TransportImpl(Config config, SSHClient sshClient) {
+        this.config = config;
+        this.loggerFactory = config.getLoggerFactory();
+        this.serviceAccept = new Event<TransportException>("service accept", TransportException.chainer, loggerFactory);
+        this.close = new Event<TransportException>("transport close", TransportException.chainer, loggerFactory);
+        this.log = loggerFactory.getLogger(getClass());
+        this.nullService = new NullService(this);
+        this.service = nullService;
+        this.disconnectListener = this;
+        this.reader = new Reader(this);
+        this.encoder = new Encoder(config.getRandomFactory().create(), writeLock, loggerFactory);
+        this.decoder = new Decoder(this);
+        this.kexer = new KeyExchanger(this);
+        this.clientID = String.format("SSH-2.0-%s", config.getVersion());
+        this.sshClient = sshClient;
    }

    @Override
@@ -165,20 +194,9 @@ public final class TransportImpl
            throw new TransportException(e);
        }

-        ThreadNameProvider.setThreadName(reader, this);
        reader.start();
    }

-    /**
-     * Get Remote Socket Address using Connection Information
-     *
-     * @return Remote Socket Address or null when not connected
-     */
-    @Override
-    public InetSocketAddress getRemoteSocketAddress() {
-        return connInfo == null ? null : new InetSocketAddress(getRemoteHost(), getRemotePort());
-    }
-
    /**
     * TransportImpl implements its own default DisconnectListener.
     */
@@ -222,7 +240,7 @@ public final class TransportImpl
     *
     * @param buffer The buffer to read from.
     * @return empty string if full ident string has not yet been received
-     * @throws IOException Thrown when protocol version is not supported
+     * @throws IOException
     */
    private String readIdentification(Buffer.PlainBuffer buffer)
            throws IOException {
@@ -268,6 +286,20 @@ public final class TransportImpl
        this.timeoutMs = timeoutMs;
    }

+    @Override
+    @Deprecated
+    public int getHeartbeatInterval() {
+        log.warn("**Deprecated**: Please use: sshClient.getConnection().getKeepAlive().getKeepAliveInterval()");
+        return sshClient.getConnection().getKeepAlive().getKeepAliveInterval();
+    }
+
+    @Override
+    @Deprecated
+    public void setHeartbeatInterval(int interval) {
+        log.warn("**Deprecated**: Please use: sshClient.getConnection().getKeepAlive().setKeepAliveInterval()");
+        sshClient.getConnection().getKeepAlive().setKeepAliveInterval(interval);
+    }
+
    @Override
    public String getRemoteHost() {
        return connInfo.host;
@@ -555,7 +587,7 @@ public final class TransportImpl
     * Got an SSH_MSG_UNIMPLEMENTED, so lets see where we're at and act accordingly.
     *
     * @param packet The 'unimplemented' packet received
-     * @throws TransportException Thrown when key exchange is ongoing
+     * @throws TransportException
     */
    private void gotUnimplemented(SSHPacket packet)
            throws SSHException {
@@ -637,19 +669,21 @@ public final class TransportImpl
        return this.hostKeyAlgorithm;
    }

+    public void setRSASHA2Support(boolean rsaSHA2Support) {
+        this.rsaSHA2Support = rsaSHA2Support;
+    }
+
    @Override
-    public List<KeyAlgorithm> getClientKeyAlgorithms(KeyType keyType) throws TransportException {
+    public KeyAlgorithm getClientKeyAlgorithm(KeyType keyType) throws TransportException {
+        if (keyType != KeyType.RSA || !rsaSHA2Support) {
+            return Factory.Named.Util.create(getConfig().getKeyAlgorithms(), keyType.toString());
+        }
+
        List<Factory.Named<KeyAlgorithm>> factories = getConfig().getKeyAlgorithms();
-        List<KeyAlgorithm> available = new ArrayList<>();
        if (factories != null)
            for (Factory.Named<KeyAlgorithm> f : factories)
-                if (
-                        f instanceof KeyAlgorithms.Factory && ((KeyAlgorithms.Factory) f).getKeyType().equals(keyType)
-                                || !(f instanceof KeyAlgorithms.Factory) && f.getName().equals(keyType.toString())
-                )
-                    available.add(f.create());
-        if (available.isEmpty())
-            throw new TransportException("Cannot find an available KeyAlgorithm for type " + keyType);
-        return available;
+                if (f.getName().equals("ssh-rsa") || KeyAlgorithms.SSH_RSA_SHA2_ALGORITHMS.contains(f.getName()))
+                    return f.create();
+        throw new TransportException("Cannot find an available KeyAlgorithm for type " + keyType);
    }
 }
--- a/src/main/java/net/schmizz/sshj/transport/compression/ZlibCompression.java
+++ b/src/main/java/net/schmizz/sshj/transport/compression/ZlibCompression.java
@@ -15,16 +15,18 @@
 */
 package net.schmizz.sshj.transport.compression;

-import java.util.zip.DataFormatException;
-import java.util.zip.Deflater;
-import java.util.zip.Inflater;
-
+import com.jcraft.jzlib.Deflater;
+import com.jcraft.jzlib.GZIPException;
+import com.jcraft.jzlib.Inflater;
+import com.jcraft.jzlib.JZlib;
 import net.schmizz.sshj.common.Buffer;
 import net.schmizz.sshj.common.DisconnectReason;
+import net.schmizz.sshj.common.SSHRuntimeException;
 import net.schmizz.sshj.transport.TransportException;
-import net.schmizz.sshj.transport.compression.Compression;

-public class ZlibCompression implements Compression {
+/** ZLib based Compression. */
+public class ZlibCompression
+        implements Compression {

    /** Named factory for the ZLib Compression. */
    public static class Factory
@@ -50,15 +52,19 @@ public class ZlibCompression implements Compression {

    @Override
    public void init(Mode mode) {
-        switch (mode) {
-            case DEFLATE:
-                deflater = new Deflater(Deflater.DEFAULT_COMPRESSION);
-                break;
-            case INFLATE:
-                inflater = new Inflater();
-                break;
-            default:
-                assert false;
+        try {
+            switch (mode) {
+                case DEFLATE:
+                    deflater = new Deflater(JZlib.Z_DEFAULT_COMPRESSION);
+                    break;
+                case INFLATE:
+                    inflater = new Inflater();
+                    break;
+                default:
+                    assert false;
+            }
+        } catch (GZIPException gze) {
+
        }
    }

@@ -69,28 +75,43 @@ public class ZlibCompression implements Compression {

    @Override
    public void compress(Buffer buffer) {
-        deflater.setInput(buffer.array(), buffer.rpos(), buffer.available());
+        deflater.setNextIn(buffer.array());
+        deflater.setNextInIndex(buffer.rpos());
+        deflater.setAvailIn(buffer.available());
        buffer.wpos(buffer.rpos());
        do {
-            final int len = deflater.deflate(tempBuf, 0, BUF_SIZE, Deflater.SYNC_FLUSH);
-            buffer.putRawBytes(tempBuf, 0, len);
-        } while (!deflater.needsInput());
+            deflater.setNextOut(tempBuf);
+            deflater.setNextOutIndex(0);
+            deflater.setAvailOut(BUF_SIZE);
+            final int status = deflater.deflate(JZlib.Z_PARTIAL_FLUSH);
+            if (status == JZlib.Z_OK) {
+                buffer.putRawBytes(tempBuf, 0, BUF_SIZE - deflater.getAvailOut());
+            } else {
+                throw new SSHRuntimeException("compress: deflate returned " + status);
+            }
+        } while (deflater.getAvailOut() == 0);
    }

+
    @Override
    public void uncompress(Buffer from, Buffer to)
            throws TransportException {
-        inflater.setInput(from.array(), from.rpos(), from.available());
+        inflater.setNextIn(from.array());
+        inflater.setNextInIndex(from.rpos());
+        inflater.setAvailIn(from.available());
        while (true) {
-            try {
-                int len = inflater.inflate(tempBuf, 0, BUF_SIZE);
-                if(len > 0) {
-                    to.putRawBytes(tempBuf, 0, len);
-                } else {
+            inflater.setNextOut(tempBuf);
+            inflater.setNextOutIndex(0);
+            inflater.setAvailOut(BUF_SIZE);
+            final int status = inflater.inflate(JZlib.Z_PARTIAL_FLUSH);
+            switch (status) {
+                case JZlib.Z_OK:
+                    to.putRawBytes(tempBuf, 0, BUF_SIZE - inflater.getAvailOut());
+                    break;
+                case JZlib.Z_BUF_ERROR:
                    return;
-                }
-            } catch (DataFormatException e) {
-                throw new TransportException(DisconnectReason.COMPRESSION_ERROR, "uncompress: inflate returned " + e.getMessage());
+                default:
+                    throw new TransportException(DisconnectReason.COMPRESSION_ERROR, "uncompress: inflate returned " + status);
            }
        }
    }
--- a/src/main/java/net/schmizz/sshj/transport/kex/Curve25519DH.java
+++ b/src/main/java/net/schmizz/sshj/transport/kex/Curve25519DH.java
@@ -15,89 +15,50 @@
 */
 package net.schmizz.sshj.transport.kex;

+import com.hierynomus.sshj.common.KeyAlgorithm;
 import net.schmizz.sshj.common.Factory;
-import net.schmizz.sshj.common.SecurityUtils;
 import net.schmizz.sshj.transport.random.Random;
+import org.bouncycastle.asn1.x9.X9ECParameters;
+import org.bouncycastle.crypto.ec.CustomNamedCurves;
+import org.bouncycastle.jce.spec.ECParameterSpec;
+
 import java.math.BigInteger;
 import java.security.GeneralSecurityException;
-import java.security.KeyFactory;
-import java.security.KeyPair;
-import java.security.PublicKey;
 import java.security.spec.AlgorithmParameterSpec;
-import java.security.spec.KeySpec;
-import java.security.spec.X509EncodedKeySpec;
+import java.util.Arrays;

-/**
- * Key Exchange Method using Curve25519 as defined in RFC 8731
- */
 public class Curve25519DH extends DHBase {

-    private static final String ALGORITHM = "X25519";
-
-    private static final int ENCODED_ALGORITHM_ID_KEY_LENGTH = 44;
-
-    private static final int ALGORITHM_ID_LENGTH = 12;
-
-    private static final int KEY_LENGTH = 32;
-
-    private final byte[] algorithmId = new byte[ALGORITHM_ID_LENGTH];
+    private byte[] secretKey;

    public Curve25519DH() {
-        super(ALGORITHM, ALGORITHM);
+        super(KeyAlgorithm.ECDSA, "ECDH");
+    }
+
+    @Override
+    void computeK(byte[] f) throws GeneralSecurityException {
+        byte[] k = new byte[32];
+        djb.Curve25519.curve(k, secretKey, f);
+        setK(new BigInteger(1, k));
+    }
+
+    @Override
+    public void init(AlgorithmParameterSpec params, Factory<Random> randomFactory) throws GeneralSecurityException {
+        Random random = randomFactory.create();
+        byte[] secretBytes =  new byte[32];
+        random.fill(secretBytes);
+        byte[] publicBytes = new byte[32];
+        djb.Curve25519.keygen(publicBytes, null, secretBytes);
+        this.secretKey = Arrays.copyOf(secretBytes, secretBytes.length);
+        setE(publicBytes);
    }

    /**
-     * Compute Shared Secret Key using Diffie-Hellman Curve25519 known as X25519
-     *
-     * @param peerPublicKey Peer public key bytes
-     * @throws GeneralSecurityException Thrown on key agreement failures
+     * TODO want to figure out why BouncyCastle does not work.
+     * @return The initialized curve25519 parameter spec
     */
-    @Override
-    void computeK(final byte[] peerPublicKey) throws GeneralSecurityException {
-        final KeyFactory keyFactory = SecurityUtils.getKeyFactory(ALGORITHM);
-        final KeySpec peerPublicKeySpec = getPeerPublicKeySpec(peerPublicKey);
-        final PublicKey generatedPeerPublicKey = keyFactory.generatePublic(peerPublicKeySpec);
-
-        agreement.doPhase(generatedPeerPublicKey, true);
-        final byte[] sharedSecretKey = agreement.generateSecret();
-        final BigInteger sharedSecretNumber = new BigInteger(BigInteger.ONE.signum(), sharedSecretKey);
-        setK(sharedSecretNumber);
-    }
-
-    /**
-     * Initialize Key Agreement with generated Public and Private Key Pair
-     *
-     * @param params Parameters not used
-     * @param randomFactory Random Factory not used
-     * @throws GeneralSecurityException Thrown on key agreement initialization failures
-     */
-    @Override
-    public void init(final AlgorithmParameterSpec params, final Factory<Random> randomFactory) throws GeneralSecurityException {
-        final KeyPair keyPair = generator.generateKeyPair();
-        agreement.init(keyPair.getPrivate());
-        setPublicKey(keyPair.getPublic());
-    }
-
-    private void setPublicKey(final PublicKey publicKey) {
-        final byte[] encoded = publicKey.getEncoded();
-
-        // Encoded public key consists of the algorithm identifier and public key
-        if (encoded.length == ENCODED_ALGORITHM_ID_KEY_LENGTH) {
-            final byte[] publicKeyEncoded = new byte[KEY_LENGTH];
-            System.arraycopy(encoded, ALGORITHM_ID_LENGTH, publicKeyEncoded, 0, KEY_LENGTH);
-            setE(publicKeyEncoded);
-
-            // Save Algorithm Identifier byte array
-            System.arraycopy(encoded, 0, algorithmId, 0, ALGORITHM_ID_LENGTH);
-        } else {
-            throw new IllegalArgumentException(String.format("X25519 unsupported public key length [%d]", encoded.length));
-        }
-    }
-
-    private KeySpec getPeerPublicKeySpec(final byte[] peerPublicKey) {
-        final byte[] encodedKeySpec = new byte[ENCODED_ALGORITHM_ID_KEY_LENGTH];
-        System.arraycopy(algorithmId, 0, encodedKeySpec, 0, ALGORITHM_ID_LENGTH);
-        System.arraycopy(peerPublicKey, 0, encodedKeySpec, ALGORITHM_ID_LENGTH, KEY_LENGTH);
-        return new X509EncodedKeySpec(encodedKeySpec);
+    public static AlgorithmParameterSpec getCurve25519Params() {
+        X9ECParameters ecP = CustomNamedCurves.getByName("curve25519");
+        return new ECParameterSpec(ecP.getCurve(), ecP.getG(), ecP.getN(), ecP.getH(), ecP.getSeed());
    }
 }
--- a/src/main/java/net/schmizz/sshj/transport/kex/Curve25519SHA256.java
+++ b/src/main/java/net/schmizz/sshj/transport/kex/Curve25519SHA256.java
@@ -56,6 +56,6 @@ public class Curve25519SHA256 extends AbstractDHG {

    @Override
    protected void initDH(DHBase dh) throws GeneralSecurityException {
-        dh.init(null, trans.getConfig().getRandomFactory());
+        dh.init(Curve25519DH.getCurve25519Params(), trans.getConfig().getRandomFactory());
    }
 }
--- a/src/main/java/net/schmizz/sshj/transport/verification/FingerprintVerifier.java
+++ b/src/main/java/net/schmizz/sshj/transport/verification/FingerprintVerifier.java
@@ -15,15 +15,14 @@
 */
 package net.schmizz.sshj.transport.verification;

+import java.io.IOException;
 import java.security.GeneralSecurityException;
 import java.security.MessageDigest;
 import java.security.PublicKey;
 import java.util.Arrays;
-import java.util.Base64;
-import java.util.Collections;
-import java.util.List;
 import java.util.regex.Pattern;

+import net.schmizz.sshj.common.Base64;
 import net.schmizz.sshj.common.Buffer;
 import net.schmizz.sshj.common.SSHRuntimeException;
 import net.schmizz.sshj.common.SecurityUtils;
@@ -45,40 +44,43 @@ public class FingerprintVerifier implements HostKeyVerifier {
     *
     * @param fingerprint of an SSH fingerprint in MD5 (hex), SHA-1 (base64) or SHA-256(base64) format
     *
-     * @return Host Key Verifier
+     * @return
     */
    public static HostKeyVerifier getInstance(String fingerprint) {
-        if (fingerprint.startsWith("SHA1:")) {
-            return new FingerprintVerifier("SHA-1", fingerprint.substring(5));
-        }

-        if (fingerprint.startsWith("SHA256:")) {
-            return new FingerprintVerifier("SHA-256", fingerprint.substring(7));
-        }
-
-        final String md5;
-        if (fingerprint.startsWith("MD5:")) {
-            md5 = fingerprint.substring(4); // remove the MD5: prefix
-        } else {
-            md5 = fingerprint;
-        }
-
-        if (!MD5_FINGERPRINT_PATTERN.matcher(md5).matches()) {
-            throw new SSHRuntimeException("Invalid MD5 fingerprint: " + fingerprint);
-        }
-
-        // Use the old default fingerprint verifier for md5 fingerprints
-        return (new HostKeyVerifier() {
-            @Override
-            public boolean verify(String h, int p, PublicKey k) {
-                return SecurityUtils.getFingerprint(k).equals(md5);
+        try {
+            if (fingerprint.startsWith("SHA1:")) {
+                return new FingerprintVerifier("SHA-1", fingerprint.substring(5));
            }

-            @Override
-            public List<String> findExistingAlgorithms(String hostname, int port) {
-                return Collections.emptyList();
+            if (fingerprint.startsWith("SHA256:")) {
+                return new FingerprintVerifier("SHA-256", fingerprint.substring(7));
            }
-        });
+
+            final String md5;
+            if (fingerprint.startsWith("MD5:")) {
+                md5 = fingerprint.substring(4); // remove the MD5: prefix
+            } else {
+                md5 = fingerprint;
+            }
+
+            if (!MD5_FINGERPRINT_PATTERN.matcher(md5).matches()) {
+                throw new SSHRuntimeException("Invalid MD5 fingerprint: " + fingerprint);
+            }
+
+            // Use the old default fingerprint verifier for md5 fingerprints
+            return (new HostKeyVerifier() {
+                @Override
+                public boolean verify(String h, int p, PublicKey k) {
+                    return SecurityUtils.getFingerprint(k).equals(md5);
+                }
+            });
+        } catch (SSHRuntimeException e) {
+            throw e;
+        } catch (IOException e) {
+            throw new SSHRuntimeException(e);
+        }
+
    }

    private final String digestAlgorithm;
@@ -90,8 +92,10 @@ public class FingerprintVerifier implements HostKeyVerifier {
     *            the used digest algorithm
     * @param base64Fingerprint
     *            base64 encoded fingerprint data
+     *
+     * @throws IOException
     */
-    private FingerprintVerifier(String digestAlgorithm, String base64Fingerprint) {
+    private FingerprintVerifier(String digestAlgorithm, String base64Fingerprint) throws IOException {
        this.digestAlgorithm = digestAlgorithm;

        // if the length is not padded with "=" chars at the end so that it is divisible by 4 the SSHJ Base64 implementation does not work correctly
@@ -99,7 +103,7 @@ public class FingerprintVerifier implements HostKeyVerifier {
        while (base64FingerprintBuilder.length() % 4 != 0) {
            base64FingerprintBuilder.append("=");
        }
-        fingerprintData = Base64.getDecoder().decode(base64FingerprintBuilder.toString());
+        fingerprintData = Base64.decode(base64FingerprintBuilder.toString());
    }

    @Override
@@ -116,13 +120,8 @@ public class FingerprintVerifier implements HostKeyVerifier {
        return Arrays.equals(fingerprintData, digestData);
    }

-    @Override
-    public List<String> findExistingAlgorithms(String hostname, int port) {
-        return Collections.emptyList();
-    }
-
    @Override
    public String toString() {
        return "FingerprintVerifier{digestAlgorithm='" + digestAlgorithm + "'}";
    }
-}
+}
--- a/src/main/java/net/schmizz/sshj/transport/verification/HostKeyVerifier.java
+++ b/src/main/java/net/schmizz/sshj/transport/verification/HostKeyVerifier.java
@@ -16,7 +16,6 @@
 package net.schmizz.sshj.transport.verification;

 import java.security.PublicKey;
-import java.util.List;

 /** Host key verification interface. */
 public interface HostKeyVerifier {
@@ -36,12 +35,4 @@ public interface HostKeyVerifier {
     */
    boolean verify(String hostname, int port, PublicKey key);

-    /**
-     * It is necessary to connect with the type of algorithm that matches an existing know_host entry.
-     * This will allow a match when we later verify with the negotiated key {@code HostKeyVerifier.verify}
-     * @param hostname remote hostname
-     * @param port     remote port
-     * @return existing key types or empty list if no keys known for hostname
-     */
-    List<String> findExistingAlgorithms(String hostname, int port);
 }
--- a/src/main/java/net/schmizz/sshj/transport/verification/OpenSSHKnownHosts.java
+++ b/src/main/java/net/schmizz/sshj/transport/verification/OpenSSHKnownHosts.java
@@ -18,30 +18,15 @@ package net.schmizz.sshj.transport.verification;
 import com.hierynomus.sshj.common.KeyAlgorithm;
 import com.hierynomus.sshj.transport.verification.KnownHostMatchers;
 import com.hierynomus.sshj.userauth.certificate.Certificate;
-import net.schmizz.sshj.common.Buffer;
-import net.schmizz.sshj.common.IOUtils;
-import net.schmizz.sshj.common.KeyType;
-import net.schmizz.sshj.common.LoggerFactory;
-import net.schmizz.sshj.common.SSHException;
-import net.schmizz.sshj.common.SSHRuntimeException;
-import net.schmizz.sshj.common.SecurityUtils;
+import net.schmizz.sshj.common.*;
 import org.slf4j.Logger;

-import java.io.BufferedOutputStream;
-import java.io.BufferedReader;
-import java.io.BufferedWriter;
-import java.io.File;
-import java.io.FileOutputStream;
-import java.io.FileReader;
-import java.io.FileWriter;
-import java.io.IOException;
-import java.io.Reader;
+import java.io.*;
 import java.math.BigInteger;
 import java.security.KeyFactory;
 import java.security.PublicKey;
 import java.security.spec.RSAPublicKeySpec;
 import java.util.ArrayList;
-import java.util.Base64;
 import java.util.List;

 /**
@@ -105,10 +90,6 @@ public class OpenSSHKnownHosts
        }
    }

-    private String adjustHostname(final String hostname, final int port) {
-        String lowerHN = hostname.toLowerCase();
-        return (port != 22) ? "[" + lowerHN + "]:" + port : lowerHN;
-    }

    public File getFile() {
        return khFile;
@@ -122,7 +103,7 @@ public class OpenSSHKnownHosts
            return false;
        }

-        final String adjustedHostname = adjustHostname(hostname, port);
+        final String adjustedHostname = (port != 22) ? "[" + hostname + "]:" + port : hostname;

        boolean foundApplicableHostEntry = false;
        for (KnownHostEntry e : entries) {
@@ -146,34 +127,6 @@ public class OpenSSHKnownHosts
        return hostKeyUnverifiableAction(adjustedHostname, key);
    }

-    @Override
-    public List<String> findExistingAlgorithms(String hostname, int port) {
-        final String adjustedHostname = adjustHostname(hostname, port);
-        List<String> knownHostAlgorithms = new ArrayList<String>();
-        for (KnownHostEntry e : entries) {
-            try {
-                if (e.appliesTo(adjustedHostname)) {
-                    final KeyType type = e.getType();
-                    if (e instanceof HostEntry && ((HostEntry) e).marker == Marker.CA_CERT) {
-                        // Only the CA key type is known, but the type of the host key is not.
-                        // Adding all supported types for keys with certificates.
-                        for (final KeyType candidate : KeyType.values()) {
-                            if (candidate.getParent() != null) {
-                                knownHostAlgorithms.add(candidate.toString());
-                            }
-                        }
-                    }
-                    else {
-                        knownHostAlgorithms.add(type.toString());
-                    }
-                }
-            } catch (IOException ioe) {
-            }
-        }
-
-        return knownHostAlgorithms;
-    }
-
    protected boolean hostKeyUnverifiableAction(String hostname, PublicKey key) {
        return false;
    }
@@ -289,7 +242,7 @@ public class OpenSSHKnownHosts
            if (type != KeyType.UNKNOWN) {
                final String sKey = split[i++];
                try {
-                    byte[] keyBytes = Base64.getDecoder().decode(sKey);
+                    byte[] keyBytes = Base64.decode(sKey);
                    key = new Buffer.PlainBuffer(keyBytes).readPublicKey();
                } catch (IOException ioe) {
                    log.warn("Error decoding Base64 key bytes", ioe);
@@ -468,7 +421,8 @@ public class OpenSSHKnownHosts
        }

        private String getKeyString(PublicKey pk) {
-            return Base64.getEncoder().encodeToString(pk.getEncoded());
+            final Buffer.PlainBuffer buf = new Buffer.PlainBuffer().putPublicKey(pk);
+            return Base64.encodeBytes(buf.array(), buf.rpos(), buf.available());
        }

        protected String getHostPart() {
--- a/src/main/java/net/schmizz/sshj/transport/verification/PromiscuousVerifier.java
+++ b/src/main/java/net/schmizz/sshj/transport/verification/PromiscuousVerifier.java
@@ -16,8 +16,6 @@
 package net.schmizz.sshj.transport.verification;

 import java.security.PublicKey;
-import java.util.Collections;
-import java.util.List;

 public final class PromiscuousVerifier
        implements HostKeyVerifier {
@@ -27,9 +25,4 @@ public final class PromiscuousVerifier
        return true;
    }

-    @Override
-    public List<String> findExistingAlgorithms(String hostname, int port) {
-        return Collections.emptyList();
-    }
-
 }
--- a/src/main/java/net/schmizz/sshj/userauth/keyprovider/KeyFormat.java
+++ b/src/main/java/net/schmizz/sshj/userauth/keyprovider/KeyFormat.java
@@ -16,9 +16,10 @@
 package net.schmizz.sshj.userauth.keyprovider;

 /**
-* Key File Formats
+* @version $Id:$
 */
 public enum KeyFormat {
+    PKCS5,
    PKCS8,
    OpenSSH,
    OpenSSHv1,
--- a/src/main/java/net/schmizz/sshj/userauth/keyprovider/KeyProviderUtil.java
+++ b/src/main/java/net/schmizz/sshj/userauth/keyprovider/KeyProviderUtil.java
@@ -27,9 +27,9 @@ public class KeyProviderUtil {
     * <p/>
     * Return values are consistent with the {@code NamedFactory} implementations in the {@code keyprovider} package.
     *
-     * @param location File Path to key
+     * @param location
     * @return name of the key file format
-     * @throws java.io.IOException Thrown on file processing failures
+     * @throws java.io.IOException
     */
    public static KeyFormat detectKeyFileFormat(File location)
            throws IOException {
@@ -45,7 +45,7 @@ public class KeyProviderUtil {
     * @param privateKey     Private key stored in a string
     * @param separatePubKey Is the public key stored separately from the private key
     * @return name of the key file format
-     * @throws java.io.IOException Thrown on file processing failures
+     * @throws java.io.IOException
     */
    public static KeyFormat detectKeyFileFormat(String privateKey, boolean separatePubKey)
            throws IOException {
@@ -60,7 +60,7 @@ public class KeyProviderUtil {
     * @param privateKey     Private key accessible through a {@code Reader}
     * @param separatePubKey Is the public key stored separately from the private key
     * @return name of the key file format
-     * @throws java.io.IOException Thrown on file processing failures
+     * @throws java.io.IOException
     */
    public static KeyFormat detectKeyFileFormat(Reader privateKey, boolean separatePubKey)
            throws IOException {
@@ -94,8 +94,10 @@ public class KeyProviderUtil {
            } else if (separatePubKey) {
                // Can delay asking for password since have unencrypted pubkey
                return KeyFormat.OpenSSH;
-            } else {
+            } else if (header.contains("BEGIN PRIVATE KEY") || header.contains("BEGIN ENCRYPTED PRIVATE KEY")) {
                return KeyFormat.PKCS8;
+            } else {
+                return KeyFormat.PKCS5;
            }
        } else if (header.startsWith("PuTTY-User-Key-File-")) {
            return KeyFormat.PuTTY;
--- a/src/main/java/net/schmizz/sshj/userauth/keyprovider/PKCS5KeyFile.java
+++ b/src/main/java/net/schmizz/sshj/userauth/keyprovider/PKCS5KeyFile.java
@@ -0,0 +1,272 @@
+/*
+ * Copyright (C)2009 - SSHJ Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package net.schmizz.sshj.userauth.keyprovider;
+
+import com.hierynomus.sshj.common.KeyAlgorithm;
+import com.hierynomus.sshj.transport.cipher.BlockCiphers;
+import net.schmizz.sshj.common.Base64;
+import net.schmizz.sshj.common.ByteArrayUtils;
+import net.schmizz.sshj.common.IOUtils;
+import net.schmizz.sshj.common.KeyType;
+import net.schmizz.sshj.transport.cipher.*;
+import net.schmizz.sshj.transport.digest.Digest;
+import net.schmizz.sshj.transport.digest.MD5;
+
+import java.io.BufferedReader;
+import java.io.EOFException;
+import java.io.IOException;
+import java.math.BigInteger;
+import java.nio.ByteBuffer;
+import java.nio.CharBuffer;
+import java.security.*;
+import java.security.spec.*;
+import java.util.Arrays;
+
+/**
+ * Represents a PKCS5-encoded key file. This is the format typically used by OpenSSH, OpenSSL, Amazon, etc.
+ */
+public class PKCS5KeyFile extends BaseFileKeyProvider {
+
+    public static class Factory
+            implements net.schmizz.sshj.common.Factory.Named<FileKeyProvider> {
+
+        @Override
+        public FileKeyProvider create() {
+            return new PKCS5KeyFile();
+        }
+
+        @Override
+        public String getName() {
+            return "PKCS5";
+        }
+    }
+
+    /**
+     * Indicates a format issue with PKCS5 data
+     */
+    public static class FormatException
+            extends IOException {
+
+        FormatException(String msg) {
+            super(msg);
+        }
+    }
+
+    /**
+     * Indicates a problem decrypting the data
+     */
+    public static class DecryptException
+            extends IOException {
+
+        DecryptException(String msg) {
+            super(msg);
+        }
+    }
+
+    protected byte[] data;
+
+    protected KeyPair readKeyPair()
+            throws IOException {
+
+        BufferedReader reader = new BufferedReader(resource.getReader());
+        try {
+            String line = null;
+            Cipher cipher = new NoneCipher();
+            StringBuffer sb = new StringBuffer();
+            byte[] iv = new byte[0]; // salt
+            while ((line = reader.readLine()) != null) {
+                if (line.startsWith("-----BEGIN ") && line.endsWith(" PRIVATE KEY-----")) {
+                    int end = line.length() - 17;
+                    if (end > 11) {
+                        String s = line.substring(11, line.length() - 17);
+                        if ("RSA".equals(s)) {
+                            type = KeyType.RSA;
+                        } else if ("DSA".equals(s)) {
+                            type = KeyType.DSA;
+                        } else if ("DSS".equals(s)) {
+                            type = KeyType.DSA;
+                        } else {
+                            throw new FormatException("Unrecognized PKCS5 key type");
+                        }
+                    } else {
+                        throw new FormatException("Bad header; possibly PKCS8 format?");
+                    }
+                } else if (line.startsWith("-----END")) {
+                    break;
+                } else if (type != null) {
+                    if (line.startsWith("Proc-Type: ")) {
+                        if (!"4,ENCRYPTED".equals(line.substring(11))) {
+                            throw new FormatException("Unrecognized Proc-Type");
+                        }
+                    } else if (line.startsWith("DEK-Info: ")) {
+                        int ptr = line.indexOf(",");
+                        if (ptr == -1) {
+                            throw new FormatException("Unrecognized DEK-Info");
+                        } else {
+                            String algorithm = line.substring(10, ptr);
+                            if ("DES-EDE3-CBC".equals(algorithm)) {
+                                cipher = BlockCiphers.TripleDESCBC().create();
+                            } else if ("AES-128-CBC".equals(algorithm)) {
+                                cipher = BlockCiphers.AES128CBC().create();
+                            } else if ("AES-192-CBC".equals(algorithm)) {
+                                cipher = BlockCiphers.AES192CBC().create();
+                            } else if ("AES-256-CBC".equals(algorithm)) {
+                                cipher = BlockCiphers.AES256CBC().create();
+                            } else {
+                                throw new FormatException("Not a supported algorithm: " + algorithm);
+                            }
+                            iv = Arrays.copyOfRange(ByteArrayUtils.parseHex(line.substring(ptr + 1)), 0, cipher.getIVSize());
+                        }
+                    } else if (line.length() > 0) {
+                        sb.append(line);
+                    }
+                }
+            }
+            if (type == null) {
+                throw new FormatException("PKCS5 header not found");
+            }
+            ASN1Data asn = new ASN1Data(data = decrypt(Base64.decode(sb.toString()), cipher, iv));
+            switch (type) {
+                case RSA: {
+                    KeyFactory factory = KeyFactory.getInstance(KeyAlgorithm.RSA);
+                    asn.readNext();
+                    BigInteger modulus = asn.readNext();
+                    BigInteger pubExp = asn.readNext();
+                    BigInteger prvExp = asn.readNext();
+                    PublicKey pubKey = factory.generatePublic(new RSAPublicKeySpec(modulus, pubExp));
+                    PrivateKey prvKey = factory.generatePrivate(new RSAPrivateKeySpec(modulus, prvExp));
+                    return new KeyPair(pubKey, prvKey);
+                }
+                case DSA: {
+                    KeyFactory factory = KeyFactory.getInstance(KeyAlgorithm.DSA);
+                    asn.readNext();
+                    BigInteger p = asn.readNext();
+                    BigInteger q = asn.readNext();
+                    BigInteger g = asn.readNext();
+                    BigInteger pub = asn.readNext();
+                    BigInteger prv = asn.readNext();
+                    PublicKey pubKey = factory.generatePublic(new DSAPublicKeySpec(pub, p, q, g));
+                    PrivateKey prvKey = factory.generatePrivate(new DSAPrivateKeySpec(prv, p, q, g));
+                    return new KeyPair(pubKey, prvKey);
+                }
+                default:
+                    throw new IOException("Unrecognized PKCS5 key type: " + type);
+            }
+        } catch (NoSuchAlgorithmException e) {
+            throw new IOException(e);
+        } catch (InvalidKeySpecException e) {
+            throw new IOException(e);
+        } finally {
+            reader.close();
+        }
+    }
+
+    @Override
+    public String toString() {
+        return "PKCS5KeyFile{resource=" + resource + "}";
+    }
+
+    private byte[] getPassphraseBytes() {
+        CharBuffer cb = CharBuffer.wrap(pwdf.reqPassword(resource));
+        ByteBuffer bb = IOUtils.UTF8.encode(cb);
+        byte[] result = Arrays.copyOfRange(bb.array(), bb.position(), bb.limit());
+        Arrays.fill(cb.array(), '\u0000');
+        Arrays.fill(bb.array(), (byte) 0);
+        return result;
+    }
+
+    private byte[] decrypt(byte[] raw, Cipher cipher, byte[] iv) throws DecryptException {
+        if (pwdf == null) {
+            return raw;
+        }
+        Digest md5 = new MD5();
+        int bsize = cipher.getBlockSize();
+        int hsize = md5.getBlockSize();
+        int hnlen = bsize / hsize * hsize + (bsize % hsize == 0 ? 0 : hsize);
+        do {
+            md5.init();
+            byte[] hn = new byte[hnlen];
+            byte[] tmp = null;
+            byte[] passphrase = getPassphraseBytes();
+            for (int i = 0; i + hsize <= hn.length; ) {
+                if (tmp != null) {
+                    md5.update(tmp, 0, tmp.length);
+                }
+                md5.update(passphrase, 0, passphrase.length);
+                md5.update(iv, 0, iv.length > 8 ? 8 : iv.length);
+                tmp = md5.digest();
+                System.arraycopy(tmp, 0, hn, i, tmp.length);
+                i += tmp.length;
+            }
+            Arrays.fill(passphrase, (byte) 0);
+            byte[] key = Arrays.copyOfRange(hn, 0, bsize);
+            cipher.init(Cipher.Mode.Decrypt, key, iv);
+            Arrays.fill(key, (byte) 0);
+            byte[] decrypted = Arrays.copyOf(raw, raw.length);
+            cipher.update(decrypted, 0, decrypted.length);
+            if (ASN1Data.MAGIC == decrypted[0]) {
+                return decrypted;
+            }
+        } while (pwdf.shouldRetry(resource));
+        throw new DecryptException("Decryption failed");
+    }
+
+    class ASN1Data {
+        static final byte MAGIC = (byte) 0x30;
+
+        private byte[] buff;
+        private int index, length;
+
+        ASN1Data(byte[] buff) throws FormatException {
+            this.buff = buff;
+            index = 0;
+            if (buff[index++] != MAGIC) {
+                throw new FormatException("Not ASN.1 data");
+            }
+            length = buff[index++] & 0xff;
+            if ((length & 0x80) != 0) {
+                int counter = length & 0x7f;
+                length = 0;
+                while (counter-- > 0) {
+                    length = (length << 8) + (buff[index++] & 0xff);
+                }
+            }
+            if ((index + length) > buff.length) {
+                throw new FormatException("Length mismatch: " + buff.length + " != " + (index + length));
+            }
+        }
+
+        BigInteger readNext() throws IOException {
+            if (index >= length) {
+                throw new EOFException();
+            } else if (buff[index++] != 0x02) {
+                throw new IOException("Not an int code: " + Integer.toHexString(0xff & buff[index]));
+            }
+            int length = buff[index++] & 0xff;
+            if ((length & 0x80) != 0) {
+                int counter = length & 0x7f;
+                length = 0;
+                while (counter-- > 0) {
+                    length = (length << 8) + (buff[index++] & 0xff);
+                }
+            }
+            byte[] sequence = new byte[length];
+            System.arraycopy(buff, index, sequence, 0, length);
+            index += length;
+            return new BigInteger(sequence);
+        }
+    }
+}
--- a/src/main/java/net/schmizz/sshj/userauth/keyprovider/PKCS8KeyFile.java
+++ b/src/main/java/net/schmizz/sshj/userauth/keyprovider/PKCS8KeyFile.java
@@ -27,21 +27,14 @@ import org.bouncycastle.openssl.PEMEncryptedKeyPair;
 import org.bouncycastle.openssl.PEMKeyPair;
 import org.bouncycastle.openssl.PEMParser;
 import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
-import org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder;
 import org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder;
-import org.bouncycastle.operator.InputDecryptorProvider;
-import org.bouncycastle.operator.OperatorCreationException;
-import org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo;
-import org.bouncycastle.pkcs.PKCSException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import java.io.IOException;
 import java.security.KeyPair;

-/**
- * Key File implementation supporting PEM-encoded PKCS8 and PKCS1 formats with or without password-based encryption
- */
+/** Represents a PKCS8-encoded key file. This is the format used by (old-style) OpenSSH and OpenSSL. */
 public class PKCS8KeyFile extends BaseFileKeyProvider {

    public static class Factory
@@ -60,6 +53,8 @@ public class PKCS8KeyFile extends BaseFileKeyProvider {

    protected final Logger log = LoggerFactory.getLogger(getClass());

+    protected char[] passphrase; // for blanking out
+
    protected KeyPairConverter<PrivateKeyInfo> privateKeyInfoKeyPairConverter = new PrivateKeyInfoKeyPairConverter();

    protected KeyPair readKeyPair()
@@ -79,19 +74,22 @@ public class PKCS8KeyFile extends BaseFileKeyProvider {

                if (o instanceof PEMEncryptedKeyPair) {
                    final PEMEncryptedKeyPair encryptedKeyPair = (PEMEncryptedKeyPair) o;
-                    final PEMKeyPair pemKeyPair = readEncryptedKeyPair(encryptedKeyPair);
-                    kp = pemConverter.getKeyPair(pemKeyPair);
+                    JcePEMDecryptorProviderBuilder decryptorBuilder = new JcePEMDecryptorProviderBuilder();
+                    if (SecurityUtils.getSecurityProvider() != null) {
+                        decryptorBuilder.setProvider(SecurityUtils.getSecurityProvider());
+                    }
+                    try {
+                        passphrase = pwdf == null ? null : pwdf.reqPassword(resource);
+                        kp = pemConverter.getKeyPair(encryptedKeyPair.decryptKeyPair(decryptorBuilder.build(passphrase)));
+                    } finally {
+                        PasswordUtils.blankOut(passphrase);
+                    }
                } else if (o instanceof PEMKeyPair) {
                    kp = pemConverter.getKeyPair((PEMKeyPair) o);
                } else if (o instanceof PrivateKeyInfo) {
                    final PrivateKeyInfo privateKeyInfo = (PrivateKeyInfo) o;
                    final PEMKeyPair pemKeyPair = privateKeyInfoKeyPairConverter.getKeyPair(privateKeyInfo);
                    kp = pemConverter.getKeyPair(pemKeyPair);
-                } else if (o instanceof PKCS8EncryptedPrivateKeyInfo) {
-                    final PKCS8EncryptedPrivateKeyInfo encryptedPrivateKeyInfo = (PKCS8EncryptedPrivateKeyInfo) o;
-                    final PrivateKeyInfo privateKeyInfo = readEncryptedPrivateKeyInfo(encryptedPrivateKeyInfo);
-                    final PEMKeyPair pemKeyPair = privateKeyInfoKeyPairConverter.getKeyPair(privateKeyInfo);
-                    kp = pemConverter.getKeyPair(pemKeyPair);
                } else {
                    log.warn("Unexpected PKCS8 PEM Object [{}]", o);
                }
@@ -116,37 +114,4 @@ public class PKCS8KeyFile extends BaseFileKeyProvider {
    public String toString() {
        return "PKCS8KeyFile{resource=" + resource + "}";
    }
-
-    private PEMKeyPair readEncryptedKeyPair(final PEMEncryptedKeyPair encryptedKeyPair) throws IOException {
-        final JcePEMDecryptorProviderBuilder builder = new JcePEMDecryptorProviderBuilder();
-        if (SecurityUtils.getSecurityProvider() != null) {
-            builder.setProvider(SecurityUtils.getSecurityProvider());
-        }
-        char[] passphrase = null;
-        try {
-            passphrase = pwdf == null ? null : pwdf.reqPassword(resource);
-            return encryptedKeyPair.decryptKeyPair(builder.build(passphrase));
-        } finally {
-            PasswordUtils.blankOut(passphrase);
-        }
-    }
-
-    private PrivateKeyInfo readEncryptedPrivateKeyInfo(final PKCS8EncryptedPrivateKeyInfo encryptedPrivateKeyInfo) throws EncryptionException {
-        final JceOpenSSLPKCS8DecryptorProviderBuilder builder = new JceOpenSSLPKCS8DecryptorProviderBuilder();
-        if (SecurityUtils.getSecurityProvider() != null) {
-            builder.setProvider(SecurityUtils.getSecurityProvider());
-        }
-        char[] passphrase = null;
-        try {
-            passphrase = pwdf == null ? null : pwdf.reqPassword(resource);
-            final InputDecryptorProvider inputDecryptorProvider = builder.build(passphrase);
-            return encryptedPrivateKeyInfo.decryptPrivateKeyInfo(inputDecryptorProvider);
-        } catch (final OperatorCreationException e) {
-            throw new EncryptionException("Loading Password for Encrypted Private Key Failed", e);
-        } catch (final PKCSException e) {
-            throw new EncryptionException("Reading Encrypted Private Key Failed", e);
-        } finally {
-            PasswordUtils.blankOut(passphrase);
-        }
-    }
 }
--- a/Show More
+++ b/Show More