Bump src/golang.org/x/crypto
Bump src/golang.org/x/crypto

* wow

Bump
  Jason Baker:
     acme/autocert: fix TLS-ALPN identifier in tests
     acme: update TLS-ALPN identifier to the latest IANA assignment
  Alex Brainman:
     ssh/terminal: adjust ReadConsole rules on windows
     ssh/terminal: fix line endings handling in ReadPassword
  Mariano Cano:
     ssh: support ECDSA private keys in OpenSSH format
  Katie Hockman:
     internal/wycheproof: add test for hkdf key extraction
     openpgp/armor: allow armored PGP signature without a CRC
     internal/wycheproof: skip failing test on 32-bit arm
     internal/wycheproof: add Wycheproof tests for verifying signatures
     openpgp/elgamal: prevent bad key from causing panic in Decrypt
  Filippo Valsorda:
     ssh: support encrypted OpenSSH private keys
     cryptobyte: fix panic due to malformed ASN.1 inputs on 32-bit archs
     poly1305: drop broken arm assembly
     ssh: reject unencrypted keys from ParsePrivateKeyWithPassphrase
     ssh/agent: fix example
     chacha20: implement XChaCha20
     chacha20: expose internal/chacha20 package
     internal/chacha20: cache first round across XORKeyStream invocations
     internal/chacha20: refactor for readability and consistency
     poly1305: rewrite the Go implementation with 64-bit limbs
     curve25519: implement new X25519 API and deprecate ScalarMult
     curve25519: update package structure per golang.org/wiki/TargetSpecific
     acme: send User-Agent and add Client.UserAgent
     ed25519: turn into a wrapper for crypto/ed25519 beginning with Go 1.13
     openpgp/clearsign: reject potentially misleading headers and messages
     salsa20/salsa: fix keystream loop in amd64 assembly when overflowing 32-bit counter
     all: deprecate broken and legacy packages
     pkcs12: add a note suggesting ToPEM for multiple certificates/keys
     pkcs12: note that this package is frozen and point to an alternative
     Revert "pkcs12: add a DecodeAll method"
     cryptobyte: don't ignore bytes added to BuilderContinuations of fixed-size Builders
     cryptobyte: add (*Builder).Unwrite and (*Builder).SetError
     hkdf: add Extract and Expand
     hkdf: improve example
     chacha20poly1305: add example for NewX
     chacha20poly1305: add XChaCha20-Poly1305
     acme/autocert: expand tls-alpn-01 docs
     openpgp: restore signing in SerializePrivate
     acme/autocert: surface details of acme.AuthorizationError
     internal/subtle: add Any/InexactOverlap (new package) and apply them across packages
     acme/autocert: fix build in Go 1.9
     acme/autocert: update Manager.Client and Cache docs
     acme/autocert: support both RSA and ECDSA clients on the fly
     salsa20: panic when len(out) < len(in) following cipher.Stream
     openpgp: fix vet issue in tests
     bn256: explicitly fix MakeAffine for ∞
     openpgp/packet: improve handling of short MPIs for RSA values
     all: make overlap rules wording consistent
     acme: set correct KeyUsage and ExtKeyUsage
  Yasuhiro Matsumoto:
     ssh/terminal: stop using ENABLE_LINE_INPUT
     ssh/terminal: use duplicate handle in ReadPassword
     ssh/terminal: handle non-ASCII characters when reading passwords
     ssh: signal incorrect private key passwords with x509.IncorrectPasswordError
     ssh: add ParsePrivateKeysWithPassphrase
  Michael Munday:
     sha3: fix SHA-3 on s390x when using KIMD instruction
     internal/chacha20: use x/sys/cpu for s390x feature detection
     poly1305: use x/sys/cpu for s390x feature detection
     sha3: use x/sys/cpu for s390x feature detection
     chacha20poly1305: delete unused assembly functions
     poly1305: add additional test cases
     chacha20poly1305: add test for empty plaintext and additional data
     ssh: fix copy and paste error
     internal/chacha20: add s390x SIMD implementation
     chacha20poly1305: update to use new ChaCha20 API
     ssh: update to use new ChaCha20 API
     internal/chacha20: implement the cipher.Stream interface and optimize
     sha3: add optimized implementation for s390x
     sha3: delete unused field
     poly1305: add test vectors for edge cases
     crypto/chacha20poly1305: rename test vectors file
     crypto/chacha20poly1305/internal/chacha20: add missing copyright header
  Ben Toews:
     nacl/box: support anonymous seal/open
  edef:
     acme: expect standard ASN.1 signatures from ECDSA Client.Key
  Sebastian Kinne:
     ssh: add sk-ecdsa-sha2-nistp256 and sk-ed25519
  Fazlul Shahriar:
     ssh/agent: fix TestServerResponseTooLarge on Plan 9
  Bryan C. Mills:
     ssh/agent: clear the environment when starting ssh-agent in client_test
     sha3: align (*state).storage
     go.mod: set go version
  Lars Lehtonen:
     ssh/test: fix test goroutine error handling
     pkcs12: fix dropped error
     ssh: fix dropped error
     acme/internal/acmeprobe: fix dropped error variable
     openpgp/packet: fix swallowed errors in (*EncryptedKey).parse
  Lynn Boger:
     internal/chacha20: fix minor naming issue
     internal/chacha20: improve chacha20 performance on ppc64le
     poly1305: improve performance with asm for ppc64le
  Dmitri Shuralyov:
     acme/autocert: always pass AuthzURLs from AuthorizeOrder to deactivatePendingAuthz
  Alex Vaghin:
     acme/autocert: give tokensMu a better name
     acme/autocert: support ACME RFC 8555
     acme: update Directory URL to Let's Encrypt v2
     acme: prevent discovery network roundtrips in tests
     acme/internal: add a prober program
     acme: update existing methods for RFC 8555
     acme: implement new order-based issuance methods
     acme: support RFC 8555 account management
     acme: add KID variant to jwsEncodeJSON
     acme: fetch fresh nonces from newNonce resource
     acme/autocert: remove tls-sni-xx challenge support
     acme: try to fetch nonce from directory first
     acme: support IP address authorization type
     acme: support custom crypto.Signer implementations
     acme/autocert: add support for tls-alpn-01
     acme: expect 202 Accepted from Let's Encrypt
     acme: consistently return original errors from retries
     internal/subtle: add Google App Engine support
     acme: clarify retries and backoff algorithm
     acme/autocert: improve authorizations cleanup
     acme/autocert: support configurable CSR extensions
     acme: stop polling authz on 4xx client errors
     argon2: add missing amd64 tags
     acme/autocert: support http-01 challenge type
     acme: fill Subject CN field in the tls-sni challenge certs
     acme/autocert: remove failed state entries
     acme: add missing err assignment check
     acme: add function to check rate limits
     acme: replace ErrAuthorizationFailed with a type
     acme/autocert: treat invalid cert as a cache miss
     acme: generate correct ES512 signatures
     acme/autocert: extend default value of RenewBefore
     acme: reduce the number of network round trips
     acme/autocert: add an option for RSA-based certs
     chacha20poly1305: fix build constraints
     acme: add v3 implementation to RevokeAuthorization
     acme: add WithTemplate option for tls-sni certs
     acme/autocert: make tests more well-behaved
     acme: implement authorization revocation
     acme/autocert: support earlier versions of Go
     acme/autocert: correct acme package import
     acme: expose internal/acme as acme package
     acme/autocert: implement certificates renewal
     acme: take a user provided key in TLSSNIxChallengeCert
     acme: add client.DNS01ChallengeRecord
     acme: add Client.WaitAuthorization for polling
     acme: add StatusValid to expected values for Authorize
     acme: use EC keys where possible
     acme: add support for ECDSA-based signatures
     acme/autocert: replace DNSNames with HostPolicy
     acme: add Client.RevokeCert for certificate revocation
     acme/autocert: improve test speed on 386
     acme: improve http-01 challenge API
     acme/autocert: new high-level package for automatic cert management
     acme: context-aware Client methods
     acme: build up full chain certs when requested
     acme: format Client and errors
     acme: preserve account URI on get and update
     acme: improve TLSSNI{01,02}ChallengeCert methods
     acme: simplify TLS-SNI challenge cert
     acme: TLS-SNI challenges implementation
     acme: specify which version exactly is implemented
     acme: prompt for terms agreement
     acme: default values and discovery
  Scott Ragan:
     openpgp/packet: support crypto.Decrypter in EncryptedKey.Decrypt
  Brad Fitzpatrick:
     Revert "ssh/terminal: account for win32 api changes"
     ssh/test: skip test to fix build on solaris and aix
     crypto: update go.mod for s390x x/sys/cpu changes
     acme/autocert: change a var to a const
     ssh: also start forward listeners on ListenUnix
     ssh: don't start goroutines handling forwarded connections until needed
     ssh: fix error variable naming convention, add docs
     md4: move the example to the right directory
     acme/autocert: validate SNI value even more
     autocert: validate SNI values more, add tests
     crypto/ssh: fix tests on Go 1.7 on OpenBSD and Windows
     acme/autocert: fix context usage
     acme: stop using ctxhttp
     acme/autocert: add Listener
     acme, acme/autocert: switch to Go 1.7+ context package
     acme/autocert: context propagation and doc tweaks
     ssh: fix typo in unexported comment
     acme/autocert: remove trailing dot from domain before requesting cert
     poly1305, chacha20poly1305: fix build for Go 1.6
     poly1305: fix build
     acme/autocert: fix data race in tests
     ssh: disable known-flaky test from the Go build dashboard
  x1ddos:
     acme: add support for RFC8555 compliant discovery
  Jason A. Donenfeld:
     ssh/terminal: account for win32 api changes
  Eric Brown:
     ssh: drop dh-group1-sha1 from default key exchanges
  Tobias Klauser:
     sha3: add a space before +build in build tag comments
     ssh/test: skip test on js/wasm
     ssh/terminal: enable tests for aix
     ssh/terminal: use "reports whether" in IsTerminal doc
     ssh/terminal: fix TestMakeRawState on iOS
     blake2b: use internal/cpu to determine AVX and SSE 4 support
     ssh/terminal: store termios copy in terminal state on Solaris
     ssh/terminal: simplify defer
     ssh: remove unused parameter of newGCMCipher
     terminal/ssh: use ioctl wrappers from x/sys/unix
     ocsp: fix vet format string issues
     blake2s: fix vet format string issue
     blake2b: fix typo in error message
     ssh: remove unused buffer.eof return value
     ssh/terminal: set termios VMIN and VTIME in MakeRaw
     ssh/terminal: use console functions, types and consts from x/sys/windows
     ssh/terminal: use termios ioctl read/write constants from x/sys/unix
  Michael Hudson-Doyle:
     ssh/test: delete TestInvalidTerminalMode
  yuanhh:
     acme/autocert: remove tempfile after dircache write failed
  Agniva De Sarker:
     ssh: skip testHandshakeErrorHandlingN on js/wasm
     ssh/test: skip tests if run as root
     ssh/agent: update documentation link
  Lucas Bremgartner:
     ssh: add diffie-hellman-group-exchange-sha256
  Carlos Eduardo Seo:
     internal/chacha20: fix variable naming
     internal/chacha20: improve performance for ppc64le
  Conrado P. L. Gouvea:
     sha3: fix bug in cSHAKE Clone()
  yanweizhi:
     ssh/gss: support kerberos authentication for ssh server and client
  Matthew Dempsky:
     openpgp: replace "currentTime" with "creationTime" as appropriate
  Udalov Max:
     scrypt: use math.bits rotate functions instead of ad-hoc implementation
     blake2s: use math.bits rotate functions instead of ad-hoc implementation
     blake2b: use math.bits rotate functions instead of ad-hoc implementations
  chigotc:
     ssh/test: add port for aix/ppc64
     ssh/terminal: add AIX operating system
  Aofei Sheng:
     acme/autocert: make host of TLS certificate to be obtained always Punycode
  Han-Wen Nienhuys:
     ssh: invert algorithm choices on the server
     ssh/test: use t.Run for MAC/kex/pubkey tests
     ssh: print server exit reason in tests
     ssh: add packetTypeNames map for better debug info
     ssh: rename ExampleHostKeyCheck to ExampleClientConfig_HostKeyCallback
     ssh: remove testing.T from ExampleRetryableAuthMethod
     ssh: rename methods in packetCipher interface
     ssh: return specific error for invalid signature algorithm
     ssh/knownhosts: disregard IP address if the hostname is available
     ssh: drop extra connection Close call in TestMuxReadWrite
     ssh: document how to unmarshal public keys
     ssh: use a variable rather than type for NoAuthError
     ssh: clarify how to parse out Certificates
     ssh: compile multi_auth_test.go on linux only
     ssh: return correct error on read failure
     ssh: use io.ReadFull() for reading chacha20-poly1305 packets.
     ssh: remove chacha20-poly1305 from preferredCipher list
     ssh: cleanup cipher creation logic
     ssh: remove redundant code
     ssh: remove arcfour ciphers from the default preference list
     ssh: support chacha20-poly1305 cipher
     ssh: use t.Run for testing multiple ciphers/macs
     internal/chacha20: move up from chacha20poly1305/internal/chacha20
     ssh: specify InsecureIgnoreHostKey in the benchmarks
     Revert "ssh: add support for banners"
     ssh: reject unsupported DSA key sizes
     ssh: allow up to 255 bytes of padding in AES-GCM
     ssh: clarify intended use of Permissions.
     chacha20poly1305: fix style nits in variable names
     ssh/knownhosts: add file + linenumber for parse errors
     ssh/knownhosts: support hashed hostnames
     ssh/knownhosts: a parser for the OpenSSH known_hosts file format
     ssh: fix reset{Read,Write}Thresholds for initial setup
     ssh: set rekeying thresholds on construction
     ssh: fix format string in client_test.go
     ssh: reject RekeyThresholds over MaxInt64
     ssh: handle error from prepareKeyChange.
     ssh: require host key checking in the ClientConfig
     ssh: prevent double kex at connection start, 2nd try
     ssh: reset buffered packets after sending
     ssh: add debug print at the lowest level
     ssh: rationalize rekeying decisions.
     ssh: make sure we execute the initial key exchange only once
     ssh: soft code internal channel size for testing purposes
     ssh: rewrite (re)keying logic.
     ssh: make client auth tests less chatty.
     x/ssh: filter debug and ignore messages in transport.readPacket.
     ssh: clarify error type if a SendRequest goes unanswered
     x/crypto/ssh: handle missing exit status more gracefully.
     x/crypto/ssh: use BigEndian.Uint32 for decoding exit status.
     x/crypto/ssh: return msgNewKeys for a short-circuited first kex.
  Kris Kwiatkowski:
     sha3: add cSHAKE support
     sha3: enable TestUnalignedWrites
  Neven Sajko:
     all: change the old assembly style AX:CX to CX, AX
  Andrey Petrov:
     ssh/terminal: Use move-N sequences for >1 cursor moves
  Michael McLoughlin:
     curve25519: add test vectors from BoringSSL
     curve25519: mask high bit when loading group point
  Andreas Auernhammer:
     poly1305: implement a subset of the hash.Hash interface
     crypto/{blake2b,blake2s,argon2,chacha20poly1305}: replace CPU feature detection
     blake2b: Revert "blake2b: use internal/cpu to determine AVX and SSE 4 support"
     argon2: add Argon2id and update parameter recommendations
     argon2: fix incorrect key derivation if parallelism > 1
     argon2: add new package implementing the Argon2 PBKDF family
     blake2b: implement BLAKE2X
     blake2s: implement BLAKE2X
     xts: fix incorrect length check
     bcrypt: fix C compatibility code
     blake2b: fix self-assignment in test
     curve25519: improve cswap
     x/crypto/*: add import comment
     blake2s: register BLAKE2s
     blake2b: register BLAKE2b
     poly1305: simplify reference implementation
     blake2b: fix AVX performance problems on amd64
     blake2b: add AVX assembly
     blake2b: fix constant size
     blake2s,blake2b: fix typo in package doc
     blake2b: new package
     blake2s: new package
     chacha20poly1305: fix amd64 assembly - replace PINSRB and PEXTRQ
     poly1305: fix bug in amd64 assembly
     x/crypto/poly1305: optimize amd64 assembly performance
  Max Semenik:
     ssh/terminal: fix GetSize on Windows
  Michael Matloob:
     all: add a go.mod file
  Ian Haken:
     ssh/agent: add checking for empty SSH requests
     ssh/agent: Fix error returned from agent responses that are too big.
     ssh: support SSH agent signature flags and custom extensions
  lukechampine:
     xts: reduce tweak allocations
  Sad Pencil:
     bn256: fix String methods when g.p == nil
  Meng Zhuo:
     internal/chacha20: add SIMD implementation on arm64
  Michael Cook:
     all: fix ineffectual assignments
  Julien Kauffmann:
     pkcs12: add a DecodeAll method
  Michal Bohuslávek:
     ssh/terminal: support ^N and ^P
  Jay Taylor:
     crypto/ssh/knownhosts: fix out-of-date documentation for checkAddr
  Ross Smith II:
     blake2b: fix comments in grammar
  Péter Szilágyi:
     sha3: add support for Keccak-512
     crypto/ssh: use net.IP.Equal instead of bytes.Equal
     crypto/sha3: use the assembly optimized KeccakF on amd64
  kc1212:
     bn256: fix gfp12 MulScalar
  Axel Wagner:
     openpgp: support SHA384
     openpgp: pass hash to Signer.Sign for ECDSA
     openpgp: don't generate PubKeyAlgoRSASignOnly keys
     openpgp: allow RSA/ECDSA signers to return a pointer
  Philipp:
     cryptobyte: fix typo in test
  Kevin Burke:
     bcrypt: benchmark defaults
     all: run gofmt -s on source code
     all: fix errors reported by vet, golint
     acme, acme/autocert: add missing articles
     scrypt: add missing license header
     scrypt: update recommended parameters for 2017
     nacl/auth: add crypto_auth primitive
     README: add improvements
     all: use HTTPS for links that support it
     nacl/box: Add examples
     nacl/secretbox: add license header and package prefix
     nacl: use HTTPS for nacl.cr.yp.to links
     nacl/secretbox: add Seal, Open example
  Igor Zhilianin:
     all: fix typos
  David Jones:
     acme/autocert: include rejected hostname in TLS handshake error when host not configured
  Andres Lowrie:
     ssh/testdata: correct typo
  mkishere:
     ssh: fix typo in error message
  aviau:
     openpgp: split up tests and keys
     openpgp: test subkeys with sub-optimal signature packet ordering
     openpgp: move addUserID outside of ReadEntity
     openpgp: don't treat extra subkey selfsigs as uid sigs
     openpgp: fix bad error message
     openpgp: read keys with revoked user ids
  Paul M Furley:
     openpgp: use latest subkey binding signature
  Adam Langley:
     ssh: don't panic if a key is too short.
     chacha20poly1305: add some more XChaCha20-Poly1305 test vectors.
     acme/autocert: fix race in test.
     ed25519: require canonical signatures
     bn256: don't claim a 128-bit security level.
     nacl/auth: use KeySize constant consistently.
     cryptobyte: include changes from review of 57810
     cryptobyte: various API and documentation updates.
     nacl/[secret]box: clarify message size comment.
     ed25519: don't use constant-time functions in Verify.
     poly1305: add burn-in test.
     ocsp: fix test flakiness
     otr: add missing return on error path
     otr: reject private keys with parameters <= 0.
     ssh/terminal: consume data before checking for an error.
     x/crypto/ssh/terminal: replace \n with \r\n.
     x/crypto/blake2b: SSE4.1 is bit 19, not 15.
     blake2s: fix build constraints
     poly1305: don't move R13 in sum_arm.s.
     poly1305: enable assembly for ARM in Go 1.6.
     poly1305: fix stack handling in sum_arm.s
     chacha20poly1305: scope assembly constants
     poly1305: fix NaCl build.
     chacha20poly1305: clarify the correct attribution for the AMD64 assembly.
     chacha20poly1305: clarify the correct attribution for the AMD64 assembly.
     chacha20poly1305: new package.
     poly1305: rename files to sum_𝑥.s
     poly1305: minor updates.
     ssh: bound DH public values to [2, p-2].
     poly1305: add test for carry edge-case.
  David Ndungu:
     acme/autocert: clarify that multiple names are allowed
  Martin Möhrmann:
     chacha20poly1305: use x/sys/cpu feature variables directly
     chacha20poly1305: add runtime internal independent cpu feature detection
  Thomas Bushnell, BSG:
     openpgp/clearsign: add ability to sign with more than one key.
  Noel Georgi:
     ssh: RFC5208 support PKCS#8 key
  Wilfried Teiken:
     openpgp: support creating signatures compatible with 'gpg --sign'.
  ia:
     all: gofmt
  Roland Shoemaker:
     acme: fix encoding of the TLS-ALPN challenge extension
     x/crypto/ocsp: Don't hard-code OCSP response hash function
     ocsp: add Request.Marshal method
  Maciej Dębski:
     acme: add support for TLS-ALPN
  David Benjamin:
     ed25519: actually be compatible with RFC 8032
  Leo Antunes:
     acme/autocert: revoke dangling pending authzs
  Ryan Canty:
     openpgp: sign Entity during instantiation in NewEntity
  bill_ofarrell:
     poly1305: add optimized s390x SIMD implementation with VMSL
  Hana (Hyang-Ah) Kim:
     ssh/terminal: run tests only on supported platforms
  Leon Klingele:
     sha3: add NewLegacyKeccak256
  Filip Haglund:
     scrypt: update example to match recommendation two lines below
  Tom Thorogood:
     chacha20poly1305: correct AVX2 feature detection
  Joe Shaw:
     ocsp: remove error for > 1 certificate in response
  Alberto Donizetti:
     ssh/agent: remove len check in Unlock
  Andrey Mirtchovski:
     x/crypto: cryptobyte: manage integers with implicit tags
     cryptobyte: minor documentation fix
  ValarDragon:
     blake2b,blake2s: implement BinaryMarshaler, BinaryUnmarshaler
  Mark Rushakoff:
     xtea: comment cleanup
     argon2: fix typo and code formatting in comments
  Florian Uekermann:
     nacl/sign: add package
  Brad Morgan:
     acme/autocert: use valid certificates from the cache during renewal
  Mike Tsao:
     openpgp: serialize correct bitlength for generated ECC keys
  Andrew Bonventre:
     CONTRIBUTING.md: remove note about not accepting Pull Requests
  Kyle Spiers:
     sha3: fix typo in Shake256 docs
  Ilya Tocar:
     ripemd160: use bits.Rotate for rotates
  Jake Burkhead:
     acme/autocert: return error from cachePut
  Spencer Tung:
     Adding a unique error when no authentication method has been passed in yet.
     ssh: fix a formatting bug in a test
     ssh: fix if/else returns to adhere to Go style guidelines
     ssh: return authErr array if all authentication attempts fail
     ssh: fixing a small typo in connection.go
  Damien Tournoud:
     openpgp: allow NewEntity to specify the default cipher
  Yaron de Leeuw:
     openpgp: correct NewEntity name creation
  Ingo Gottwald:
     acme/autocert: Remove unused retryAfter func
  Sami Pönkänen:
     ssh: fix support for partial success authentication responses in client
  Sergey Lukjanov:
     ssh/knownhosts: remove godoc about non-supported hashed hosts
  Justin Gracenin:
     ssh: fix protocol version exchange (for multi-line)
  Mansour Rahimi:
     crypto/ssh: fix typo in error message in certs.go
  Andrew Ekstedt:
     pbkdf2: add benchmarks
  Peter Moody:
     ssh: accept ed25519 certs
     ssh/knownhosts: test coverage for IsHostAuthority
     ssh/knownhosts: add IsHostAuthority.
     x/crypto/ssh/agent: honor constraints on keys in the keyring.
     x/crypto/ssh: add ed25519 certs to supportedHostKeyAlgos
     x/crypto/ssh/agent: ecdsa key/cert typo
     agent: add agent server support for ed25519 keys.
  Sam Whited:
     crypto/ssh: only show banner once
     scrypt: fix broken example in documentation
  Tugdual Saunier:
     ssh: add support for banners
     ssh: add support for banners
  Joe Kyo:
     ed25519: update document to mention RFC 8032
     acme: clarify the purpose of CertOption interface
     acme, acme/autocert: use canonical http header keys
     acme: fix mismatched format arguments in acme_test.go
     acme/autocert: clean up temporary directories in TestDirCache()
  Anmol Sethi:
     ocsp: remove incorrect iota and update docs on CreateRequest
     acme: support for ECDSA keys
  Russ Cox:
     acme/autocert: add Cache to Manager example
     openpgp: check errors from ReadKeyRing during test
     curve25519: avoid loss of R15 in -dynlink mode
  namusyaka:
     acme: reword the godoc to be more human readable
     all: fix article typos
  Gh0u1L5:
     ssh/agent: use right message to unlock agent, with related integration tests
     ssh/agent: parse constraints when adding keys
  Artyom Pervukhin:
     ssh: fix documentation on ServerConfig.PublicKeyCallback
  mdp:
     openpgp/packet: fix AES-192 encrypted session keys
  Wei Congrui:
     salsa20/salsa: fix out of bounds write
  Tobias Assarsson:
     ssh: add Session.WindowChange to send window change events
  sukrithanda:
     md4: add example for New
  sbuss:
     sha3: added example output
  Martin Kreichgauer:
     ocsp: remove a redundant conditional expression from an if statement
     ocsp: enhance errors for responses without a matching SingleResponse
     cryptobyte: new package.
     ocsp: Expose ResponderID in parsed Response.
  Dave Cheney:
     all: gofmt ./...
  Jeff Hodges:
     nacl/secretbox: add benchmarks
  Johan Brandhorst:
     acme/autocert: enable HTTP/2 on listener
  Mathias Hall-Andersen:
     blake2s: add 128-bit digest support.
  Adam Eijdenberg:
     x/crypto/ssh: fix host certificate principal evaluation to check for hostname only
  Catalin Nicutar:
     ssh: change the local copy of the ServerConfig passed to NewServerConn
  Ross Light:
     acme/autocert: return error if Prompt not set
     acme/autocert: extract Manager example from comments
  Rick Sayre:
     ssh/terminal: implement missing functions for Solaris/OmniOS
  Joe Tsai:
     ssh/knownhosts: fix variable reuse bug in checkAddrs
     all: fix some vet warnings
  James Hartig:
     acme: automatically retry on badNonce errors
  James Myers:
     ssh: support MaxAuthTries on ServerConfig
     ssh: improve client public key authentication
  Akihiro Suda:
     ssh: support forwarding of Unix domain socket connections
  Paul Querna:
     ssh: Add support for RSA keys stored in OpenSSH's new format
     crypto/ssh: fix parsing order for ssh.ParseDSAPrivateKey
  Fredrik Forsmo:
     pkcs12: fix ToPEM to not ignore non-nil error from getSafeContents
  MiLk:
     ssh: Add the hmac-sha2-256-etm@openssh.com algorithm
  Heschi Kreinick:
     acme/autocert: fix racy tests
     ssh/agent: fix another test to not require IPv4.
     ssh: Support multiple source-addresses, don't require IPv4 in tests.
  Shenghou Ma:
     poly1305: make data declared in assembly files private
     chacha20poly1305: make polyHashADInternal private
  Andrew Gerrand:
     acme/autocert: fix typo in Cache doc comment
  Peter Morjan:
     ssh/terminal: consistent return value for Restore
  Lion Yang:
     chacha20poly1305: fix detection of BMI on amd64
  Mikio Hara:
     blake2b: fix build on non-amd64 platforms
     chacha20poly1305: fix typos
     ssh/terminal: fix a typo
     chacha20poly1305: fix typos
  David Lazar:
     bn256: fix equations in comments
  Ryuzo Yamamoto:
     x/crypto/ssh: Add FingerprintLegacyMD5 and FingerprintSHA256 methods
  Austin Clements:
     blake2b: test all three hashing implementations
     blake2s: test all four hashing implementations
     blake2s: fix frame size of hashBlocksSSE4
     blake2s: remove NOSPLIT from asm functions
     sha3: fix SP adjustment
     salsa20/salsa: eliminate unnecessary "callee save" prologue/epilogue
     salsa20/salsa: hide SP alignment from spadj
     blake2b: use proper Go frame sizes
     blake2s: use proper Go frame sizes
     curve25519: eliminate unnecessary "callee save" prologues
     curve25519: fix confusing SP adjustments
  Dmitry Savintsev:
     crypto/ssh: fix comment for ssh.NewPublicKey
     crypto/ssh: minor comment change (trivial)
  Paul van Brouwershaven:
     x/crypto/ocsp: Accept status for multiple certificates in response
  Samuele Pedroni:
     x/crypto/openpgp: support crypto.Signer private keys
  Martin Garton:
     ssh: add CryptoPublicKey interface, expose underlying crypto.PublicKey
     x/crypto/ssh: add support for ed25519 keys
  Henrik Hodne:
     ssh: fix height/width order in RequestPty example
  Emmanuel Odeke:
     x/crypto/ssh: public key authentication example
     x/crypto/ssh: ParsePrivateKey errors out with encrypted private keys
  Mike Houston:
     ssh: Consistent error handling in examples
  Fazal Majid:
     ssh/terminal: implement ReadPassword and IsTerminal
  Alok Menghrajani:
     openpgp: fix a typo in a comment
  Kaleb Elwert:
     ssh: properly handle wrong guess for FirstKexFollows in server
  Jonathan Rudenberg:
     acme/autocert: cache ACME account key
     acme/autocert: use ECDSA P-256 for account key and issued certs
  Jessica Frazelle:
     opengpg: set SelfSignature.PreferredHash in NewEntity
  Reinaldo de Souza Jr:
     crypto/openpgp: return error from userIdSignatureHash
  Sven Blumenstein:
     crypto/ssh: keep user in ConnMetadata if NoClientAuth is used
  Faiyaz Ahmed:
     x/crypto/ssh/terminal: have MakeRaw mirror cfmakeraw.
  Fedor Indutny:
     ocsp: fix default value of Version in ResponseData
  Martin Hamrle:
     x/crypto: fix typos
  Jamie Beverly:
     x/crypto/ssh: Add support for retryable authentication
  Joe Farrell:
     go.crypto/blowfish: fix typo in docstring in cipher.go
  Niall Sheridan:
     x/crypto/ssh: set constraints when adding certs to the agent
     ssh: allow adding ed25519 keys to the agent
  Sam Hug:
     x/crypto/ssh: add 3des-cbc as a non-default cipher

[#170761760]

Signed-off-by: Clay Kauzlaric <b161dd152ba17987305414195d30c2af856d229f@pivotal.io>
Co-authored-by: Clay Kauzlaric <b161dd152ba17987305414195d30c2af856d229f@pivotal.io>

cloudfoundry-incubator/cf-routing-release,cloudfoundry-incubator/cf-routing-release,cloudfoundry-incubator/cf-routing-release