diff --git a/src/internal.c b/src/internal.c
index 9d314dff1..996f8f7a6 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -3649,22 +3649,20 @@ int GetSkip(const byte* buf, word32 len, word32* idx)
 
 
 /* Gets the size of the mpint, and puts the pointer to the start of
- * buf's number into *mpint. This function does not copy. */
+ * buf's number into *mpint. This function does not copy. Note that a
+ * zero-length mpint sets *mpint to NULL. */
 int GetMpint(word32* mpintSz, const byte** mpint,
         const byte* buf, word32 len, word32* idx)
 {
     int result;
 
-    result = GetUint32(mpintSz, buf, len, idx);
+    result = GetStringRef(mpintSz, mpint, buf, len, idx);
 
     if (result == WS_SUCCESS) {
-        result = WS_BUFFER_E;
-
-        if (*idx < len && *mpintSz <= len - *idx) {
-            *mpint = buf + *idx;
-            *idx += *mpintSz;
-            result = WS_SUCCESS;
-        }
+        /* All mpints used in SSH are positive. Reject values with
+         * the sign bit set as non-canonical. (RFC 4251 Section 5) */
+        if (*mpintSz > 0 && (**mpint & 0x80) != 0)
+            result = WS_PARSE_E;
     }
 
     return result;
@@ -5064,12 +5062,16 @@ static int ParseECCPubKey(WOLFSSH *ssh,
 {
     int ret;
 #ifndef WOLFSSH_NO_ECDSA
-    const byte* q;
-    word32 qSz, pubKeyIdx = 0;
+    word32 pubKeyIdx = 0;
     int primeId = 0;
 
     ret = wc_ecc_init_ex(&sigKeyBlock_ptr->sk.ecc.key, ssh->ctx->heap,
                                  INVALID_DEVID);
+    if (ret == 0) {
+        /* The key is initialized. Mark it so that FreePubKey() cleans
+         * it up on all paths, including the error paths below. */
+        sigKeyBlock_ptr->keyAllocated = 1;
+    }
 #ifdef HAVE_WC_ECC_SET_RNG
     if (ret == 0)
         ret = wc_ecc_set_rng(&sigKeyBlock_ptr->sk.ecc.key, ssh->rng);
@@ -5077,36 +5079,72 @@ static int ParseECCPubKey(WOLFSSH *ssh,
     if (ret != 0)
         ret = WS_ECC_E;
     else
-        ret = GetStringRef(&qSz, &q, pubKey, pubKeySz, &pubKeyIdx);
+        ret = WS_SUCCESS;
 
+    /* Get the algorithm name in the key block. It must match the
+     * negotiated host key algorithm. Do not trust the key blob to
+     * choose the curve. */
     if (ret == WS_SUCCESS) {
-        primeId = (int)NameToId((const char*)q, qSz);
-        if (primeId != ID_UNKNOWN) {
-            primeId = wcPrimeForId((byte)primeId);
-            if (primeId == ECC_CURVE_INVALID)
+        const char* algoName;
+        const byte* keyAlgoName;
+        word32 keyAlgoNameSz;
+
+        ret = GetStringRef(&keyAlgoNameSz, &keyAlgoName,
+                pubKey, pubKeySz, &pubKeyIdx);
+
+        if (ret == WS_SUCCESS) {
+            algoName = IdToName(ssh->handshake->pubKeyId);
+            if (keyAlgoNameSz != (word32)WSTRLEN(algoName)
+                    || WMEMCMP(keyAlgoName, algoName, keyAlgoNameSz) != 0) {
+                ret = WS_INVALID_ALGO_ID;
+            }
+        }
+    }
+
+    /* Derive the curve from the negotiated algorithm, not from the blob. */
+    if (ret == WS_SUCCESS) {
+        primeId = wcPrimeForId(ssh->handshake->pubKeyId);
+        if (primeId == ECC_CURVE_INVALID) {
+            ret = WS_INVALID_PRIME_CURVE;
+        }
+    }
+
+    /* The curve name (RFC 5656 section 3.1) in the blob must match the
+     * curve of the negotiated algorithm. */
+    if (ret == WS_SUCCESS) {
+        const char* curveName;
+        const byte* keyCurveName;
+        word32 keyCurveNameSz;
+
+        ret = GetStringRef(&keyCurveNameSz, &keyCurveName,
+                pubKey, pubKeySz, &pubKeyIdx);
+
+        if (ret == WS_SUCCESS) {
+            curveName = PrimeNameForId(ssh->handshake->pubKeyId);
+            if (keyCurveNameSz != (word32)WSTRLEN(curveName)
+                    || WMEMCMP(keyCurveName, curveName, keyCurveNameSz) != 0) {
                 ret = WS_INVALID_PRIME_CURVE;
+            }
         }
-        else
-            ret = WS_INVALID_ALGO_ID;
     }
 
-    /* Skip the curve name since we're getting it from the algo. */
-    if (ret == WS_SUCCESS)
-        ret = GetSkip(pubKey, pubKeySz, &pubKeyIdx);
+    if (ret == WS_SUCCESS) {
+        const byte* q;
+        word32 qSz;
 
-    if (ret == WS_SUCCESS)
         ret = GetStringRef(&qSz, &q, pubKey, pubKeySz, &pubKeyIdx);
 
-    if (ret == WS_SUCCESS) {
-        ret = wc_ecc_import_x963_ex(q, qSz,
-                &sigKeyBlock_ptr->sk.ecc.key, primeId);
-        if (ret == 0) {
-            sigKeyBlock_ptr->keySz =
-                (word32)sizeof(sigKeyBlock_ptr->sk.ecc.key);
-            sigKeyBlock_ptr->keyAllocated = 1;
+        if (ret == WS_SUCCESS) {
+            ret = wc_ecc_import_x963_ex(q, qSz,
+                    &sigKeyBlock_ptr->sk.ecc.key, primeId);
+            if (ret == 0) {
+                sigKeyBlock_ptr->keySz =
+                    (word32)sizeof(sigKeyBlock_ptr->sk.ecc.key);
+            }
+            else {
+                ret = WS_ECC_E;
+            }
         }
-        else
-            ret = WS_ECC_E;
     }
 #else
     WOLFSSH_UNUSED(ssh);
@@ -7429,7 +7467,9 @@ static int DoUserAuthRequestRsa(WOLFSSH* ssh, WS_UserAuthData_PublicKey* pk,
     }
 
     if (ret == WS_SUCCESS) {
-        ret = GetMpint(&sigSz, &sig, pk->signature, pk->signatureSz, &i);
+        /* RFC 4253 Section 6.6: the RSA signature blob is a string of
+         * raw signature bytes, not an mpint. */
+        ret = GetStringRef(&sigSz, &sig, pk->signature, pk->signatureSz, &i);
     }
 
     if (ret == WS_SUCCESS) {
@@ -7588,7 +7628,9 @@ static int DoUserAuthRequestRsaCert(WOLFSSH* ssh, WS_UserAuthData_PublicKey* pk,
     }
 
     if (ret == WS_SUCCESS) {
-        ret = GetMpint(&sigSz, &sig, pk->signature, pk->signatureSz, &i);
+        /* RFC 4253 Section 6.6: the RSA signature blob is a string of
+         * raw signature bytes, not an mpint. */
+        ret = GetStringRef(&sigSz, &sig, pk->signature, pk->signatureSz, &i);
     }
 
     if (ret == WS_SUCCESS) {
@@ -18295,8 +18337,45 @@ int wolfSSH_TestRsaVerify(const byte* sig, word32 sigSz,
             key, heap, "wolfSSH_TestRsaVerify");
 }
 
+int wolfSSH_TestDoUserAuthRequestRsa(WOLFSSH* ssh,
+        WS_UserAuthData_PublicKey* pk, int hashId, byte* digest,
+        word32 digestSz)
+{
+    return DoUserAuthRequestRsa(ssh, pk, (enum wc_HashType)hashId,
+            digest, digestSz);
+}
+
+#ifdef WOLFSSH_CERTS
+
+int wolfSSH_TestDoUserAuthRequestRsaCert(WOLFSSH* ssh,
+        WS_UserAuthData_PublicKey* pk, int hashId, byte* digest,
+        word32 digestSz)
+{
+    return DoUserAuthRequestRsaCert(ssh, pk, (enum wc_HashType)hashId,
+            digest, digestSz);
+}
+
+#endif /* WOLFSSH_CERTS */
+
 #endif /* !WOLFSSH_NO_RSA */
 
+#ifndef WOLFSSH_NO_ECDSA
+
+int wolfSSH_TestParseECCPubKey(WOLFSSH* ssh, byte* pubKey, word32 pubKeySz)
+{
+    struct wolfSSH_sigKeyBlock sigKeyBlock;
+    int ret;
+
+    WMEMSET(&sigKeyBlock, 0, sizeof(sigKeyBlock));
+    sigKeyBlock.useEcc = 1;
+    ret = ParseECCPubKey(ssh, &sigKeyBlock, pubKey, pubKeySz);
+    FreePubKey(&sigKeyBlock);
+
+    return ret;
+}
+
+#endif /* !WOLFSSH_NO_ECDSA */
+
 #ifndef WOLFSSH_NO_ED25519
 
 int wolfSSH_TestDoUserAuthRequestEd25519(WOLFSSH* ssh,
diff --git a/tests/unit.c b/tests/unit.c
index 5d1acdcd9..b557ce4cc 100644
--- a/tests/unit.c
+++ b/tests/unit.c
@@ -455,6 +455,77 @@ static int test_DoProtoId(void)
     return failures;
 }
 
+
+/* GetMpint() Unit Test */
+
+typedef struct {
+    const char* name;
+    const byte* input;
+    word32 inputSz;
+    int expected;       /* expected return value */
+    word32 expectedSz;  /* expected mpint size on success */
+} GetMpintTestVector;
+
+static const byte mpintPositive[] = { 0, 0, 0, 4, 0x12, 0x34, 0x56, 0x78 };
+static const byte mpintLeadZero[] = { 0, 0, 0, 3, 0x00, 0x80, 0x01 };
+static const byte mpintZeroLen[] = { 0, 0, 0, 0 };
+static const byte mpintNegative[] = { 0, 0, 0, 2, 0x80, 0x01 };
+static const byte mpintNegOne[] = { 0, 0, 0, 1, 0xFF };
+static const byte mpintShort[] = { 0, 0, 0, 5, 0x01, 0x02 };
+
+static const GetMpintTestVector getMpintTestVectors[] = {
+    { "positive", mpintPositive, sizeof(mpintPositive), WS_SUCCESS, 4 },
+    { "canonical leading zero", mpintLeadZero, sizeof(mpintLeadZero),
+        WS_SUCCESS, 3 },
+    { "zero length", mpintZeroLen, sizeof(mpintZeroLen), WS_SUCCESS, 0 },
+    { "negative", mpintNegative, sizeof(mpintNegative), WS_PARSE_E, 0 },
+    { "negative one", mpintNegOne, sizeof(mpintNegOne), WS_PARSE_E, 0 },
+    { "length past end of buffer", mpintShort, sizeof(mpintShort),
+        WS_BUFFER_E, 0 },
+};
+
+static int test_GetMpint(void)
+{
+    const GetMpintTestVector* tv;
+    int tc = (int)(sizeof(getMpintTestVectors)/sizeof(getMpintTestVectors[0]));
+    int i;
+    int ret;
+    int failures = 0;
+
+    for (i = 0, tv = getMpintTestVectors; i < tc; i++, tv++) {
+        const byte* mpint = NULL;
+        word32 mpintSz = 0;
+        word32 idx = 0;
+
+        ret = GetMpint(&mpintSz, &mpint, tv->input, tv->inputSz, &idx);
+        if (ret != tv->expected) {
+            fprintf(stderr, "\t[%d] \"%s\" FAIL: got %d, expected %d\n",
+                    i, tv->name, ret, tv->expected);
+            failures++;
+            continue;
+        }
+        if (ret == WS_SUCCESS) {
+            const byte* expectedPtr =
+                (tv->expectedSz > 0) ? tv->input + LENGTH_SZ : NULL;
+
+            if (mpintSz != tv->expectedSz) {
+                fprintf(stderr,
+                        "\t[%d] \"%s\" FAIL: size %u, expected %u\n",
+                        i, tv->name, mpintSz, tv->expectedSz);
+                failures++;
+            }
+            else if (mpint != expectedPtr || idx != LENGTH_SZ + mpintSz) {
+                fprintf(stderr,
+                        "\t[%d] \"%s\" FAIL: bad pointer or index\n",
+                        i, tv->name);
+                failures++;
+            }
+        }
+    }
+
+    return failures;
+}
+
 #endif /* WOLFSSH_TEST_INTERNAL */
 
 
@@ -3389,6 +3460,434 @@ static int test_ScpRecvCallback_NewDirChdirFail(void)
 
 #endif /* WOLFSSH_SCP recv callback depth guard test */
 
+
+/* ParseECCPubKey() Unit Test */
+
+#ifndef WOLFSSH_NO_ECDSA_SHA2_NISTP256
+
+/* The payload of keys/gretel-key-ecc.pub:
+ *   string "ecdsa-sha2-nistp256" | string "nistp256" | string Q
+ * ParseECCPubKey() must reject blobs whose algorithm name or curve name
+ * does not match the negotiated host key algorithm. A MitM must not be
+ * able to choose a different curve by lying in the blob. */
+static const byte eccPubKeyBlob[] = {
+    0x00, 0x00, 0x00, 0x13, 0x65, 0x63, 0x64, 0x73, 0x61, 0x2D, 0x73, 0x68,
+    0x61, 0x32, 0x2D, 0x6E, 0x69, 0x73, 0x74, 0x70, 0x32, 0x35, 0x36, 0x00,
+    0x00, 0x00, 0x08, 0x6E, 0x69, 0x73, 0x74, 0x70, 0x32, 0x35, 0x36, 0x00,
+    0x00, 0x00, 0x41, 0x04, 0xA0, 0x2D, 0x1F, 0xC7, 0x2A, 0x68, 0x36, 0xED,
+    0x24, 0x58, 0xED, 0xBE, 0x22, 0xE8, 0x6C, 0x70, 0x66, 0x8C, 0x2B, 0x46,
+    0xE7, 0xA0, 0xCC, 0x90, 0xFE, 0x80, 0xE0, 0xCD, 0x87, 0xF7, 0x35, 0xF6,
+    0xFD, 0x80, 0xA0, 0xD6, 0x1F, 0x5B, 0x61, 0x2E, 0xD6, 0x1D, 0xDF, 0x54,
+    0x40, 0x3C, 0x17, 0x3B, 0x51, 0xE1, 0x21, 0x9C, 0xD1, 0x61, 0xE7, 0x17,
+    0x87, 0xB4, 0x86, 0xF4, 0xFE, 0x06, 0x85, 0x16,
+};
+
+/* Offsets of interest in eccPubKeyBlob. */
+#define ECC_BLOB_ALGO_DIGITS  20 /* the "256" in "ecdsa-sha2-nistp256" */
+#define ECC_BLOB_CURVE_DIGITS 32 /* the "256" in "nistp256" */
+#define ECC_BLOB_POINT        39 /* leading byte (0x04) of Q */
+#define ECC_BLOB_TRUNC_SZ     30 /* cuts the blob mid curve name */
+
+static const byte eccBadPointFormat[] = { 0x05 };
+
+typedef struct {
+    const char* name;
+    word32 patchIdx;
+    const byte* patch;
+    word32 patchSz;     /* 0 = no patch */
+    word32 blobSz;
+    byte pubKeyId;      /* negotiated host key algorithm */
+    int expected;
+} ParseECCPubKeyTestVector;
+
+static const ParseECCPubKeyTestVector parseECCPubKeyTestVectors[] = {
+    { "valid nistp256 blob", 0, NULL, 0, sizeof(eccPubKeyBlob),
+        ID_ECDSA_SHA2_NISTP256, WS_SUCCESS },
+    { "algo name mismatch", ECC_BLOB_ALGO_DIGITS, (const byte*)"384", 3,
+        sizeof(eccPubKeyBlob), ID_ECDSA_SHA2_NISTP256, WS_INVALID_ALGO_ID },
+#ifndef WOLFSSH_NO_ECDSA_SHA2_NISTP384
+    { "blob downgrades negotiated nistp384", 0, NULL, 0,
+        sizeof(eccPubKeyBlob), ID_ECDSA_SHA2_NISTP384, WS_INVALID_ALGO_ID },
+#endif
+    { "curve name mismatch", ECC_BLOB_CURVE_DIGITS, (const byte*)"384", 3,
+        sizeof(eccPubKeyBlob), ID_ECDSA_SHA2_NISTP256,
+        WS_INVALID_PRIME_CURVE },
+    { "corrupt point format", ECC_BLOB_POINT, eccBadPointFormat, 1,
+        sizeof(eccPubKeyBlob), ID_ECDSA_SHA2_NISTP256, WS_ECC_E },
+    { "truncated blob", 0, NULL, 0, ECC_BLOB_TRUNC_SZ,
+        ID_ECDSA_SHA2_NISTP256, WS_BUFFER_E },
+};
+
+static int test_ParseECCPubKey(void)
+{
+    WOLFSSH_CTX* ctx = NULL;
+    WOLFSSH* ssh = NULL;
+    const ParseECCPubKeyTestVector* tv;
+    int tc = (int)(sizeof(parseECCPubKeyTestVectors)
+            / sizeof(parseECCPubKeyTestVectors[0]));
+    int i;
+    int ret;
+    int failures = 0;
+
+    ctx = wolfSSH_CTX_new(WOLFSSH_ENDPOINT_CLIENT, NULL);
+    if (ctx == NULL)
+        return 1;
+    ssh = wolfSSH_new(ctx);
+    if (ssh == NULL || ssh->handshake == NULL) {
+        wolfSSH_free(ssh);
+        wolfSSH_CTX_free(ctx);
+        return 1;
+    }
+
+    for (i = 0, tv = parseECCPubKeyTestVectors; i < tc; i++, tv++) {
+        byte blob[sizeof(eccPubKeyBlob)];
+
+        WMEMCPY(blob, eccPubKeyBlob, sizeof(eccPubKeyBlob));
+        if (tv->patchSz > 0)
+            WMEMCPY(blob + tv->patchIdx, tv->patch, tv->patchSz);
+        ssh->handshake->pubKeyId = tv->pubKeyId;
+
+        ret = wolfSSH_TestParseECCPubKey(ssh, blob, tv->blobSz);
+        if (ret != tv->expected) {
+            fprintf(stderr, "\t[%d] \"%s\" FAIL: got %d, expected %d\n",
+                    i, tv->name, ret, tv->expected);
+            failures++;
+        }
+    }
+
+    wolfSSH_free(ssh);
+    wolfSSH_CTX_free(ctx);
+
+    return failures;
+}
+
+#endif /* !WOLFSSH_NO_ECDSA_SHA2_NISTP256 */
+
+
+/* DoUserAuthRequestRsa() Unit Test */
+
+#if !defined(WOLFSSH_NO_RSA) && !defined(WOLFSSH_NO_SSH_RSA_SHA1)
+
+/* RFC 4253 Section 6.6: the RSA signature blob is a string of raw
+ * signature bytes, not an mpint. The fixed signature below was made
+ * with keys/hansel-key-rsa.pem over the message
+ * "wolfSSH unit test message 1" (SHA-1, PKCS#1 v1.5) and its first
+ * byte (0xB7) has the high bit set. An mpint parse would reject it
+ * as negative, so this pins the string parse. */
+
+/* string "ssh-rsa" | mpint e | mpint n, from keys/hansel-key-rsa.pem */
+static const byte userAuthRsaPubKeyBlob[] = {
+    0x00, 0x00, 0x00, 0x07, 0x73, 0x73, 0x68, 0x2D, 0x72, 0x73, 0x61, 0x00,
+    0x00, 0x00, 0x03, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0xBD,
+    0x3F, 0x76, 0x45, 0xA3, 0x03, 0xAC, 0x38, 0xD5, 0xC7, 0x0F, 0x93, 0x30,
+    0x5A, 0x20, 0x9C, 0x89, 0x7C, 0xAD, 0x05, 0x16, 0x46, 0x86, 0x83, 0x0D,
+    0x8A, 0x2B, 0x16, 0x4A, 0x05, 0x2C, 0xE4, 0x77, 0x47, 0x70, 0x00, 0xAE,
+    0x1D, 0x83, 0xE2, 0xD9, 0x6E, 0x99, 0xD4, 0xF0, 0x45, 0x98, 0x15, 0x93,
+    0xF6, 0x87, 0x4E, 0xAC, 0x64, 0x63, 0xA1, 0x95, 0xC9, 0x7C, 0x30, 0xE8,
+    0x3E, 0x2F, 0xA3, 0xF1, 0x24, 0x9F, 0x0C, 0x6B, 0x1C, 0xFE, 0x1B, 0x02,
+    0x99, 0xCD, 0xC6, 0xA7, 0x6C, 0x84, 0x85, 0x46, 0x54, 0x12, 0x40, 0xE1,
+    0xB4, 0xE5, 0xF2, 0xAA, 0x39, 0xEC, 0xD6, 0x27, 0x24, 0x0B, 0xD1, 0xA1,
+    0xE2, 0xEF, 0x34, 0x69, 0x25, 0x6D, 0xC0, 0x74, 0x67, 0x25, 0x98, 0x7D,
+    0xC4, 0xF8, 0x52, 0xAB, 0x9B, 0x4B, 0x3A, 0x12, 0x1D, 0xE1, 0xE3, 0xFA,
+    0xD6, 0xCF, 0x9A, 0xE6, 0x9C, 0x23, 0x4E, 0x39, 0xC4, 0x84, 0x16, 0x88,
+    0x3D, 0x42, 0x4E, 0xD8, 0x2F, 0xCC, 0xD2, 0x91, 0x67, 0x9D, 0xB6, 0x71,
+    0x2A, 0x02, 0x65, 0x5F, 0xBB, 0x75, 0x0E, 0x8C, 0xBB, 0x87, 0x97, 0x97,
+    0xC6, 0xF8, 0xB2, 0x98, 0xE2, 0x2F, 0x68, 0x26, 0x4A, 0x53, 0xEC, 0x79,
+    0x3A, 0x8A, 0x5F, 0xCC, 0xCF, 0xF0, 0x16, 0x47, 0xB2, 0xD0, 0x43, 0xD6,
+    0x36, 0x6C, 0xC8, 0xE7, 0x2F, 0xFE, 0xA7, 0x35, 0x39, 0x69, 0xFB, 0x1D,
+    0x78, 0x45, 0x9D, 0x89, 0x00, 0xC8, 0x41, 0xCF, 0x34, 0x1F, 0xA3, 0xF3,
+    0xF1, 0xFB, 0x28, 0x14, 0xFB, 0xD8, 0x48, 0x6F, 0xAC, 0xE3, 0xFC, 0x33,
+    0xD1, 0xDB, 0xAE, 0xEF, 0x27, 0x9E, 0x57, 0x56, 0x29, 0xA2, 0x1A, 0x3A,
+    0xE5, 0x9A, 0xFE, 0xA4, 0x49, 0xC8, 0x7F, 0xB7, 0x4E, 0xD0, 0x1F, 0x04,
+    0x6E, 0x58, 0x16, 0xB7, 0xEB, 0x9D, 0xF8, 0x92, 0x3C, 0xC2, 0xB0, 0x21,
+    0x7C, 0x4E, 0x31,
+};
+
+/* SHA-1 of "wolfSSH unit test message 1" */
+static const byte userAuthRsaDigest[] = {
+    0x2A, 0x43, 0xF5, 0x19, 0x09, 0xEE, 0x2D, 0x85, 0x89, 0xD3, 0xE0, 0xCE,
+    0xF8, 0xA6, 0x8A, 0xC4, 0xD3, 0x33, 0xB3, 0x30,
+};
+
+/* string "ssh-rsa" | string signature */
+static const byte userAuthRsaSigBlob[] = {
+    0x00, 0x00, 0x00, 0x07, 0x73, 0x73, 0x68, 0x2D, 0x72, 0x73, 0x61, 0x00,
+    0x00, 0x01, 0x00, 0xB7, 0xFD, 0xC3, 0x7B, 0x4A, 0xAD, 0x4B, 0x04, 0x28,
+    0xD0, 0xAA, 0x41, 0x59, 0x4D, 0xFB, 0x37, 0xBD, 0x2F, 0xA4, 0x93, 0x63,
+    0x4D, 0x10, 0xCF, 0x95, 0x59, 0x4C, 0x37, 0xBE, 0x71, 0xF1, 0x3D, 0xF5,
+    0x8A, 0x72, 0x92, 0x22, 0xE3, 0x0F, 0xE9, 0xAE, 0x12, 0xA9, 0xD3, 0xC8,
+    0x6A, 0x78, 0x66, 0x65, 0x4C, 0xDB, 0xA0, 0xB2, 0x8B, 0x19, 0x0F, 0x05,
+    0xC4, 0x05, 0x69, 0x54, 0x13, 0x34, 0x17, 0xB2, 0xEE, 0x77, 0x41, 0x9B,
+    0x17, 0xD6, 0x52, 0xA7, 0x1C, 0x81, 0x84, 0xED, 0x60, 0x3D, 0x52, 0xEF,
+    0x57, 0xCD, 0xE8, 0x9D, 0x51, 0xCB, 0x38, 0xC8, 0xB2, 0x8E, 0x74, 0x2F,
+    0xFD, 0x32, 0xCB, 0x0D, 0x8B, 0xFB, 0x7B, 0xCC, 0x35, 0xFF, 0x75, 0x10,
+    0x89, 0x0A, 0x1E, 0xA8, 0x37, 0xC9, 0x39, 0xED, 0x9F, 0xDA, 0x5D, 0xC5,
+    0x38, 0xEA, 0xC3, 0xBA, 0x58, 0x89, 0x5A, 0xA0, 0x84, 0x4D, 0x5F, 0x73,
+    0xF9, 0x5A, 0xC8, 0xD2, 0xEA, 0xB5, 0x6D, 0x3D, 0xC0, 0x12, 0xA7, 0x79,
+    0x30, 0x16, 0xE3, 0x2F, 0xBC, 0xAB, 0x12, 0xA8, 0xA1, 0xAB, 0x4B, 0xB3,
+    0x07, 0xF1, 0xDA, 0x1E, 0x3E, 0x5F, 0x02, 0x4B, 0x73, 0x22, 0x26, 0xC5,
+    0x51, 0xFB, 0xD1, 0x81, 0x53, 0x3B, 0xBA, 0x5E, 0x36, 0x2A, 0xBF, 0xC2,
+    0xB2, 0x9A, 0x0C, 0x8C, 0xB2, 0xCB, 0x6B, 0x9F, 0x30, 0xC8, 0x63, 0xA5,
+    0x72, 0xAF, 0x1D, 0x96, 0xE7, 0xB6, 0x17, 0xC4, 0xEB, 0x5F, 0xFD, 0xA4,
+    0xFB, 0xF8, 0xE4, 0x69, 0xE4, 0xA3, 0x47, 0x59, 0x2D, 0x8F, 0x4F, 0xB3,
+    0xD2, 0xAA, 0xD2, 0xF3, 0xCA, 0x42, 0xD5, 0xF7, 0x25, 0x5B, 0xCD, 0x60,
+    0x17, 0xA2, 0x0C, 0xE0, 0xF4, 0xEE, 0xE0, 0xF6, 0xED, 0x41, 0xC9, 0x00,
+    0x1B, 0x5A, 0x24, 0xD4, 0x18, 0xBA, 0xAC, 0x40, 0xBD, 0x7F, 0xFD, 0x46,
+    0x2F, 0xC5, 0x19, 0xF9, 0xE6, 0x2F, 0x16,
+};
+
+/* Offsets of interest in userAuthRsaSigBlob. */
+#define RSA_SIG_BLOB_ALGO 4   /* "ssh-rsa" */
+#define RSA_SIG_BLOB_LEN  11  /* length of the signature string */
+#define RSA_SIG_BLOB_SIG  15  /* first byte of the raw signature */
+
+/* 257: one past the actual signature size */
+static const byte userAuthRsaSigLenOverrun[] = { 0x00, 0x00, 0x01, 0x01 };
+
+typedef struct {
+    const char* name;
+    word32 patchIdx;
+    const byte* patch;
+    word32 patchSz;     /* 0 = no patch */
+    word32 flipIdx;     /* XOR 0x01 into this index; 0 = none */
+    int expected;
+} UserAuthRsaTestVector;
+
+static const UserAuthRsaTestVector userAuthRsaTestVectors[] = {
+    { "high bit signature accepted", 0, NULL, 0, 0, WS_SUCCESS },
+    { "corrupt signature rejected", 0, NULL, 0, RSA_SIG_BLOB_SIG + 128,
+        WS_RSA_E },
+    { "signature length overrun", RSA_SIG_BLOB_LEN, userAuthRsaSigLenOverrun,
+        4, 0, WS_BUFFER_E },
+    { "signature algo name mismatch", RSA_SIG_BLOB_ALGO,
+        (const byte*)"ssh-dss", 7, 0, WS_INVALID_ALGO_ID },
+};
+
+static int test_DoUserAuthRequestRsa(void)
+{
+    WOLFSSH_CTX* ctx = NULL;
+    WOLFSSH* ssh = NULL;
+    const UserAuthRsaTestVector* tv;
+    int tc = (int)(sizeof(userAuthRsaTestVectors)
+            / sizeof(userAuthRsaTestVectors[0]));
+    int i;
+    int ret;
+    int failures = 0;
+
+    /* The point of the test is a signature whose leading byte has the
+     * high bit set. Guard against the vector being regenerated without
+     * that property. */
+    if ((userAuthRsaSigBlob[RSA_SIG_BLOB_SIG] & 0x80) == 0) {
+        fprintf(stderr, "\tuserAuthRsaSigBlob needs its high bit set\n");
+        return 1;
+    }
+
+    ctx = wolfSSH_CTX_new(WOLFSSH_ENDPOINT_SERVER, NULL);
+    if (ctx == NULL)
+        return 1;
+    ssh = wolfSSH_new(ctx);
+    if (ssh == NULL) {
+        wolfSSH_CTX_free(ctx);
+        return 1;
+    }
+
+    for (i = 0, tv = userAuthRsaTestVectors; i < tc; i++, tv++) {
+        byte sigBlob[sizeof(userAuthRsaSigBlob)];
+        byte digest[sizeof(userAuthRsaDigest)];
+        WS_UserAuthData_PublicKey pk;
+
+        WMEMCPY(sigBlob, userAuthRsaSigBlob, sizeof(sigBlob));
+        WMEMCPY(digest, userAuthRsaDigest, sizeof(digest));
+        if (tv->patchSz > 0)
+            WMEMCPY(sigBlob + tv->patchIdx, tv->patch, tv->patchSz);
+        if (tv->flipIdx > 0)
+            sigBlob[tv->flipIdx] ^= 0x01;
+
+        WMEMSET(&pk, 0, sizeof(pk));
+        pk.publicKeyType = (const byte*)"ssh-rsa";
+        pk.publicKeyTypeSz = 7;
+        pk.publicKey = userAuthRsaPubKeyBlob;
+        pk.publicKeySz = (word32)sizeof(userAuthRsaPubKeyBlob);
+        pk.hasSignature = 1;
+        pk.signature = sigBlob;
+        pk.signatureSz = (word32)sizeof(sigBlob);
+
+        ret = wolfSSH_TestDoUserAuthRequestRsa(ssh, &pk, WC_HASH_TYPE_SHA,
+                digest, (word32)sizeof(digest));
+        if (ret != tv->expected) {
+            fprintf(stderr, "\t[%d] \"%s\" FAIL: got %d, expected %d\n",
+                    i, tv->name, ret, tv->expected);
+            failures++;
+        }
+    }
+
+    wolfSSH_free(ssh);
+    wolfSSH_CTX_free(ctx);
+
+    return failures;
+}
+
+#ifdef WOLFSSH_CERTS
+
+/* DoUserAuthRequestRsaCert() parses the signature blob the same way as
+ * DoUserAuthRequestRsa(), but takes the public key from an X.509
+ * certificate. This is a self-signed certificate made from
+ * keys/hansel-key-rsa.pem, the same key as the vectors above, so the
+ * digest and signature blob are reused. */
+static const byte userAuthRsaCertDer[] = {
+    0x30, 0x82, 0x03, 0xFB, 0x30, 0x82, 0x02, 0xE3, 0xA0, 0x03, 0x02, 0x01,
+    0x02, 0x02, 0x14, 0x1C, 0x71, 0x06, 0xEC, 0x89, 0xF3, 0x37, 0x6F, 0xE7,
+    0xBB, 0x3C, 0xE2, 0x74, 0x54, 0x43, 0x1F, 0x75, 0x0A, 0xED, 0xD5, 0x30,
+    0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B,
+    0x05, 0x00, 0x30, 0x81, 0x8C, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55,
+    0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03,
+    0x55, 0x04, 0x08, 0x0C, 0x02, 0x57, 0x41, 0x31, 0x10, 0x30, 0x0E, 0x06,
+    0x03, 0x55, 0x04, 0x07, 0x0C, 0x07, 0x53, 0x65, 0x61, 0x74, 0x74, 0x6C,
+    0x65, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x0A, 0x0C, 0x0B,
+    0x77, 0x6F, 0x6C, 0x66, 0x53, 0x53, 0x4C, 0x20, 0x49, 0x6E, 0x63, 0x31,
+    0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x0B, 0x0C, 0x0B, 0x44, 0x65,
+    0x76, 0x65, 0x6C, 0x6F, 0x70, 0x6D, 0x65, 0x6E, 0x74, 0x31, 0x0F, 0x30,
+    0x0D, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x06, 0x48, 0x61, 0x6E, 0x73,
+    0x65, 0x6C, 0x31, 0x21, 0x30, 0x1F, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86,
+    0xF7, 0x0D, 0x01, 0x09, 0x01, 0x16, 0x12, 0x68, 0x61, 0x6E, 0x73, 0x65,
+    0x6C, 0x40, 0x65, 0x78, 0x61, 0x6D, 0x70, 0x6C, 0x65, 0x2E, 0x63, 0x6F,
+    0x6D, 0x30, 0x1E, 0x17, 0x0D, 0x32, 0x36, 0x30, 0x36, 0x31, 0x32, 0x31,
+    0x37, 0x34, 0x35, 0x30, 0x39, 0x5A, 0x17, 0x0D, 0x34, 0x38, 0x30, 0x35,
+    0x30, 0x37, 0x31, 0x37, 0x34, 0x35, 0x30, 0x39, 0x5A, 0x30, 0x81, 0x8C,
+    0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55,
+    0x53, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0C, 0x02,
+    0x57, 0x41, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55, 0x04, 0x07, 0x0C,
+    0x07, 0x53, 0x65, 0x61, 0x74, 0x74, 0x6C, 0x65, 0x31, 0x14, 0x30, 0x12,
+    0x06, 0x03, 0x55, 0x04, 0x0A, 0x0C, 0x0B, 0x77, 0x6F, 0x6C, 0x66, 0x53,
+    0x53, 0x4C, 0x20, 0x49, 0x6E, 0x63, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03,
+    0x55, 0x04, 0x0B, 0x0C, 0x0B, 0x44, 0x65, 0x76, 0x65, 0x6C, 0x6F, 0x70,
+    0x6D, 0x65, 0x6E, 0x74, 0x31, 0x0F, 0x30, 0x0D, 0x06, 0x03, 0x55, 0x04,
+    0x03, 0x0C, 0x06, 0x48, 0x61, 0x6E, 0x73, 0x65, 0x6C, 0x31, 0x21, 0x30,
+    0x1F, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x01,
+    0x16, 0x12, 0x68, 0x61, 0x6E, 0x73, 0x65, 0x6C, 0x40, 0x65, 0x78, 0x61,
+    0x6D, 0x70, 0x6C, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x30, 0x82, 0x01, 0x22,
+    0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01,
+    0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0F, 0x00, 0x30, 0x82, 0x01, 0x0A,
+    0x02, 0x82, 0x01, 0x01, 0x00, 0xBD, 0x3F, 0x76, 0x45, 0xA3, 0x03, 0xAC,
+    0x38, 0xD5, 0xC7, 0x0F, 0x93, 0x30, 0x5A, 0x20, 0x9C, 0x89, 0x7C, 0xAD,
+    0x05, 0x16, 0x46, 0x86, 0x83, 0x0D, 0x8A, 0x2B, 0x16, 0x4A, 0x05, 0x2C,
+    0xE4, 0x77, 0x47, 0x70, 0x00, 0xAE, 0x1D, 0x83, 0xE2, 0xD9, 0x6E, 0x99,
+    0xD4, 0xF0, 0x45, 0x98, 0x15, 0x93, 0xF6, 0x87, 0x4E, 0xAC, 0x64, 0x63,
+    0xA1, 0x95, 0xC9, 0x7C, 0x30, 0xE8, 0x3E, 0x2F, 0xA3, 0xF1, 0x24, 0x9F,
+    0x0C, 0x6B, 0x1C, 0xFE, 0x1B, 0x02, 0x99, 0xCD, 0xC6, 0xA7, 0x6C, 0x84,
+    0x85, 0x46, 0x54, 0x12, 0x40, 0xE1, 0xB4, 0xE5, 0xF2, 0xAA, 0x39, 0xEC,
+    0xD6, 0x27, 0x24, 0x0B, 0xD1, 0xA1, 0xE2, 0xEF, 0x34, 0x69, 0x25, 0x6D,
+    0xC0, 0x74, 0x67, 0x25, 0x98, 0x7D, 0xC4, 0xF8, 0x52, 0xAB, 0x9B, 0x4B,
+    0x3A, 0x12, 0x1D, 0xE1, 0xE3, 0xFA, 0xD6, 0xCF, 0x9A, 0xE6, 0x9C, 0x23,
+    0x4E, 0x39, 0xC4, 0x84, 0x16, 0x88, 0x3D, 0x42, 0x4E, 0xD8, 0x2F, 0xCC,
+    0xD2, 0x91, 0x67, 0x9D, 0xB6, 0x71, 0x2A, 0x02, 0x65, 0x5F, 0xBB, 0x75,
+    0x0E, 0x8C, 0xBB, 0x87, 0x97, 0x97, 0xC6, 0xF8, 0xB2, 0x98, 0xE2, 0x2F,
+    0x68, 0x26, 0x4A, 0x53, 0xEC, 0x79, 0x3A, 0x8A, 0x5F, 0xCC, 0xCF, 0xF0,
+    0x16, 0x47, 0xB2, 0xD0, 0x43, 0xD6, 0x36, 0x6C, 0xC8, 0xE7, 0x2F, 0xFE,
+    0xA7, 0x35, 0x39, 0x69, 0xFB, 0x1D, 0x78, 0x45, 0x9D, 0x89, 0x00, 0xC8,
+    0x41, 0xCF, 0x34, 0x1F, 0xA3, 0xF3, 0xF1, 0xFB, 0x28, 0x14, 0xFB, 0xD8,
+    0x48, 0x6F, 0xAC, 0xE3, 0xFC, 0x33, 0xD1, 0xDB, 0xAE, 0xEF, 0x27, 0x9E,
+    0x57, 0x56, 0x29, 0xA2, 0x1A, 0x3A, 0xE5, 0x9A, 0xFE, 0xA4, 0x49, 0xC8,
+    0x7F, 0xB7, 0x4E, 0xD0, 0x1F, 0x04, 0x6E, 0x58, 0x16, 0xB7, 0xEB, 0x9D,
+    0xF8, 0x92, 0x3C, 0xC2, 0xB0, 0x21, 0x7C, 0x4E, 0x31, 0x02, 0x03, 0x01,
+    0x00, 0x01, 0xA3, 0x53, 0x30, 0x51, 0x30, 0x1D, 0x06, 0x03, 0x55, 0x1D,
+    0x0E, 0x04, 0x16, 0x04, 0x14, 0x67, 0x59, 0x9C, 0xD7, 0x16, 0x3F, 0xE6,
+    0x98, 0x47, 0x4F, 0xAE, 0x62, 0x4F, 0xAE, 0x27, 0x3A, 0xE8, 0xF6, 0x40,
+    0xAE, 0x30, 0x1F, 0x06, 0x03, 0x55, 0x1D, 0x23, 0x04, 0x18, 0x30, 0x16,
+    0x80, 0x14, 0x67, 0x59, 0x9C, 0xD7, 0x16, 0x3F, 0xE6, 0x98, 0x47, 0x4F,
+    0xAE, 0x62, 0x4F, 0xAE, 0x27, 0x3A, 0xE8, 0xF6, 0x40, 0xAE, 0x30, 0x0F,
+    0x06, 0x03, 0x55, 0x1D, 0x13, 0x01, 0x01, 0xFF, 0x04, 0x05, 0x30, 0x03,
+    0x01, 0x01, 0xFF, 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7,
+    0x0D, 0x01, 0x01, 0x0B, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x77,
+    0x70, 0xC5, 0x15, 0xFE, 0xF8, 0x2D, 0xCB, 0x5C, 0x18, 0x36, 0x87, 0xC9,
+    0x82, 0xFD, 0x6D, 0x3C, 0x78, 0xD8, 0xCF, 0xEB, 0x71, 0xFD, 0xEB, 0xD7,
+    0x05, 0x9A, 0xAE, 0xBE, 0xE1, 0x55, 0xCF, 0xE9, 0x04, 0xE3, 0xF1, 0xAE,
+    0x30, 0xDE, 0x19, 0xC3, 0x5E, 0x25, 0xDE, 0xB7, 0x39, 0x21, 0x57, 0x82,
+    0xD5, 0x98, 0xD6, 0x19, 0x49, 0x9D, 0x9F, 0xDE, 0x07, 0x9D, 0xEE, 0xB1,
+    0x24, 0xBD, 0x3E, 0xFD, 0xBA, 0x27, 0xA2, 0x9D, 0x0C, 0x08, 0x77, 0xA7,
+    0xB1, 0xFA, 0x6E, 0x36, 0xAA, 0xAE, 0x1F, 0xFA, 0xF6, 0xAE, 0x0A, 0x72,
+    0x48, 0x5C, 0x89, 0xD6, 0x4F, 0x10, 0x80, 0x3A, 0x2A, 0xA8, 0x6C, 0x00,
+    0x06, 0x41, 0x0B, 0xA6, 0xAA, 0x20, 0xE5, 0xEB, 0x38, 0xD4, 0xF7, 0x67,
+    0xCC, 0x40, 0x05, 0x61, 0xF9, 0x89, 0x8A, 0xF0, 0xCB, 0x03, 0xD9, 0x19,
+    0x8D, 0x63, 0x53, 0xB7, 0x2C, 0x53, 0x13, 0xA5, 0x3C, 0x5B, 0x5D, 0xDA,
+    0x20, 0x96, 0xDD, 0x7F, 0xF8, 0x63, 0x5A, 0x47, 0x59, 0x10, 0x48, 0xA7,
+    0x35, 0x84, 0xF2, 0x61, 0x4C, 0x3E, 0xAC, 0xE6, 0x06, 0x90, 0x96, 0x07,
+    0xA3, 0x7B, 0x2D, 0x36, 0xEF, 0x5D, 0xD0, 0x5C, 0x0A, 0x1C, 0x4D, 0xA2,
+    0x81, 0x18, 0xE3, 0x22, 0xFB, 0xBF, 0x9B, 0x12, 0x68, 0xAD, 0x6A, 0xCD,
+    0xF2, 0x72, 0xD3, 0xBA, 0x24, 0x63, 0xCC, 0x45, 0x47, 0xDE, 0x83, 0xD6,
+    0x8A, 0x94, 0xD2, 0xC1, 0xDC, 0xAB, 0xFD, 0x4E, 0xF0, 0x11, 0x21, 0xB9,
+    0x0F, 0xF3, 0xEE, 0x87, 0xF9, 0x03, 0x1A, 0xB4, 0x75, 0x21, 0x81, 0xDA,
+    0x2E, 0x1D, 0x82, 0x63, 0x26, 0x34, 0x56, 0x91, 0x2D, 0xDC, 0xFD, 0x0A,
+    0xF2, 0x3F, 0xBA, 0x44, 0xCD, 0x81, 0x53, 0x1F, 0x8B, 0xD3, 0x38, 0x22,
+    0x02, 0x05, 0x85, 0x35, 0x41, 0x50, 0xE8, 0x48, 0x6E, 0xE3, 0x7D, 0xA9,
+    0xFE, 0x5C, 0x39,
+};
+
+static int test_DoUserAuthRequestRsaCert(void)
+{
+    WOLFSSH_CTX* ctx = NULL;
+    WOLFSSH* ssh = NULL;
+    const UserAuthRsaTestVector* tv;
+    int tc = (int)(sizeof(userAuthRsaTestVectors)
+            / sizeof(userAuthRsaTestVectors[0]));
+    int i;
+    int ret;
+    int failures = 0;
+
+    if ((userAuthRsaSigBlob[RSA_SIG_BLOB_SIG] & 0x80) == 0) {
+        fprintf(stderr, "\tuserAuthRsaSigBlob needs its high bit set\n");
+        return 1;
+    }
+
+    ctx = wolfSSH_CTX_new(WOLFSSH_ENDPOINT_SERVER, NULL);
+    if (ctx == NULL)
+        return 1;
+    ssh = wolfSSH_new(ctx);
+    if (ssh == NULL) {
+        wolfSSH_CTX_free(ctx);
+        return 1;
+    }
+
+    for (i = 0, tv = userAuthRsaTestVectors; i < tc; i++, tv++) {
+        byte sigBlob[sizeof(userAuthRsaSigBlob)];
+        byte digest[sizeof(userAuthRsaDigest)];
+        WS_UserAuthData_PublicKey pk;
+
+        WMEMCPY(sigBlob, userAuthRsaSigBlob, sizeof(sigBlob));
+        WMEMCPY(digest, userAuthRsaDigest, sizeof(digest));
+        if (tv->patchSz > 0)
+            WMEMCPY(sigBlob + tv->patchIdx, tv->patch, tv->patchSz);
+        if (tv->flipIdx > 0)
+            sigBlob[tv->flipIdx] ^= 0x01;
+
+        WMEMSET(&pk, 0, sizeof(pk));
+        pk.publicKeyType = (const byte*)"x509v3-ssh-rsa";
+        pk.publicKeyTypeSz = 14;
+        pk.publicKey = userAuthRsaCertDer;
+        pk.publicKeySz = (word32)sizeof(userAuthRsaCertDer);
+        pk.hasSignature = 1;
+        pk.signature = sigBlob;
+        pk.signatureSz = (word32)sizeof(sigBlob);
+
+        ret = wolfSSH_TestDoUserAuthRequestRsaCert(ssh, &pk, WC_HASH_TYPE_SHA,
+                digest, (word32)sizeof(digest));
+        if (ret != tv->expected) {
+            fprintf(stderr, "\t[%d] \"%s\" FAIL: got %d, expected %d\n",
+                    i, tv->name, ret, tv->expected);
+            failures++;
+        }
+    }
+
+    wolfSSH_free(ssh);
+    wolfSSH_CTX_free(ctx);
+
+    return failures;
+}
+
+#endif /* WOLFSSH_CERTS */
+
+#endif /* !WOLFSSH_NO_RSA && !WOLFSSH_NO_SSH_RSA_SHA1 */
+
 #endif /* WOLFSSH_TEST_INTERNAL */
 
 /* Error Code And Message Test */
@@ -3465,6 +3964,10 @@ int wolfSSH_UnitTest(int argc, char** argv)
     unitResult = test_DoProtoId();
     printf("DoProtoId: %s\n", (unitResult == 0 ? "SUCCESS" : "FAILED"));
     testResult = testResult || unitResult;
+
+    unitResult = test_GetMpint();
+    printf("GetMpint: %s\n", (unitResult == 0 ? "SUCCESS" : "FAILED"));
+    testResult = testResult || unitResult;
 #endif
 
 #if defined(WOLFSSH_TEST_INTERNAL) && \
@@ -3520,6 +4023,24 @@ int wolfSSH_UnitTest(int argc, char** argv)
             (unitResult == 0 ? "SUCCESS" : "FAILED"));
     testResult = testResult || unitResult;
 #endif
+#if !defined(WOLFSSH_NO_RSA) && !defined(WOLFSSH_NO_SSH_RSA_SHA1)
+    unitResult = test_DoUserAuthRequestRsa();
+    printf("DoUserAuthRequestRsa: %s\n",
+            (unitResult == 0 ? "SUCCESS" : "FAILED"));
+    testResult = testResult || unitResult;
+#ifdef WOLFSSH_CERTS
+    unitResult = test_DoUserAuthRequestRsaCert();
+    printf("DoUserAuthRequestRsaCert: %s\n",
+            (unitResult == 0 ? "SUCCESS" : "FAILED"));
+    testResult = testResult || unitResult;
+#endif
+#endif
+#if !defined(WOLFSSH_NO_ECDSA_SHA2_NISTP256)
+    unitResult = test_ParseECCPubKey();
+    printf("ParseECCPubKey: %s\n",
+            (unitResult == 0 ? "SUCCESS" : "FAILED"));
+    testResult = testResult || unitResult;
+#endif
 #if !defined(WOLFSSH_NO_ED25519) && defined(HAVE_ED25519) && \
     defined(HAVE_ED25519_SIGN) && defined(HAVE_ED25519_VERIFY) && \
     defined(WOLFSSL_ED25519_STREAMING_VERIFY)
diff --git a/wolfssh/internal.h b/wolfssh/internal.h
index 4af8b7357..6733e092d 100644
--- a/wolfssh/internal.h
+++ b/wolfssh/internal.h
@@ -1424,7 +1424,19 @@ enum WS_MessageIdLimits {
     WOLFSSH_API int wolfSSH_TestRsaVerify(const byte* sig, word32 sigSz,
             const byte* encDigest, word32 encDigestSz,
             RsaKey* key, void* heap);
+    WOLFSSH_API int wolfSSH_TestDoUserAuthRequestRsa(WOLFSSH* ssh,
+            WS_UserAuthData_PublicKey* pk, int hashId, byte* digest,
+            word32 digestSz);
+#ifdef WOLFSSH_CERTS
+    WOLFSSH_API int wolfSSH_TestDoUserAuthRequestRsaCert(WOLFSSH* ssh,
+            WS_UserAuthData_PublicKey* pk, int hashId, byte* digest,
+            word32 digestSz);
+#endif /* WOLFSSH_CERTS */
 #endif /* !WOLFSSH_NO_RSA */
+#ifndef WOLFSSH_NO_ECDSA
+    WOLFSSH_API int wolfSSH_TestParseECCPubKey(WOLFSSH* ssh, byte* pubKey,
+            word32 pubKeySz);
+#endif /* !WOLFSSH_NO_ECDSA */
 #ifndef WOLFSSH_NO_ED25519
     WOLFSSH_API int wolfSSH_TestDoUserAuthRequestEd25519(WOLFSSH* ssh,
             WS_UserAuthData* authData);