diff -ur '--exclude=.*.un~' a/openssh-8_5_P1-hpn-AES-CTR-15.2.diff b/openssh-8_5_P1-hpn-AES-CTR-15.2.diff
--- a/openssh-8_5_P1-hpn-AES-CTR-15.2.diff	2021-08-20 11:49:32.351767063 -0700
+++ b/openssh-8_5_P1-hpn-AES-CTR-15.2.diff	2021-08-20 11:58:08.746214945 -0700
@@ -1026,9 +1026,9 @@
 +	}
 +#endif
 +
- 	debug("Authentication succeeded (%s).", authctxt.method->name);
- }
- 
+ 	if (ssh_packet_connection_is_on_socket(ssh)) {
+ 		verbose("Authenticated to %s ([%s]:%d) using \"%s\".", host,
+ 		    ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
 diff --git a/sshd.c b/sshd.c
 index 6277e6d6..bf3d6e4a 100644
 --- a/sshd.c
diff -ur '--exclude=.*.un~' a/openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff b/openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff
--- a/openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff	2021-08-20 11:49:32.351767063 -0700
+++ b/openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff	2021-08-20 12:04:45.008038085 -0700
@@ -536,18 +536,10 @@
  	if (state->rekey_limit)
  		*max_blocks = MINIMUM(*max_blocks,
  		    state->rekey_limit / enc->block_size);
-@@ -954,6 +963,24 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
+@@ -954,6 +963,16 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
  	return 0;
  }
  
-+/* this supports the forced rekeying required for the NONE cipher */
-+int rekey_requested = 0;
-+void
-+packet_request_rekeying(void)
-+{
-+	rekey_requested = 1;
-+}
-+
 +/* used to determine if pre or post auth when rekeying for aes-ctr
 + * and none cipher switch */
 +int
@@ -561,20 +553,6 @@
  #define MAX_PACKETS	(1U<<31)
  static int
  ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
-@@ -980,6 +1007,13 @@ ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
- 	if (state->p_send.packets == 0 && state->p_read.packets == 0)
- 		return 0;
- 
-+	/* used to force rekeying when called for by the none
-+         * cipher switch methods -cjr */
-+        if (rekey_requested == 1) {
-+                rekey_requested = 0;
-+                return 1;
-+        }
-+
- 	/* Time-based rekeying */
- 	if (state->rekey_interval != 0 &&
- 	    (int64_t)state->rekey_time + state->rekey_interval <= monotime())
 @@ -1317,7 +1351,7 @@ ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
  	struct session_state *state = ssh->state;
  	int len, r, ms_remain;
@@ -598,12 +576,11 @@
  };
  
  typedef int (ssh_packet_hook_fn)(struct ssh *, struct sshbuf *,
-@@ -155,6 +158,10 @@ int	 ssh_packet_inc_alive_timeouts(struct ssh *);
+@@ -155,6 +158,9 @@ int	 ssh_packet_inc_alive_timeouts(struct ssh *);
  int	 ssh_packet_set_maxsize(struct ssh *, u_int);
  u_int	 ssh_packet_get_maxsize(struct ssh *);
  
 +/* for forced packet rekeying post auth */
-+void	 packet_request_rekeying(void);
 +int	 packet_authentication_state(const struct ssh *);
 +
  int	 ssh_packet_get_state(struct ssh *, struct sshbuf *);
@@ -627,9 +604,9 @@
  	oLocalCommand, oPermitLocalCommand, oRemoteCommand,
 +	oTcpRcvBufPoll, oTcpRcvBuf, oHPNDisabled, oHPNBufferSize,
 +	oNoneEnabled, oNoneMacEnabled, oNoneSwitch,
+ 	oDisableMTAES,
  	oVisualHostKey,
  	oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass,
- 	oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
 @@ -297,6 +300,9 @@ static struct {
  	{ "kexalgorithms", oKexAlgorithms },
  	{ "ipqos", oIPQoS },
@@ -637,9 +614,9 @@
 +	{ "noneenabled", oNoneEnabled },
 +	{ "nonemacenabled", oNoneMacEnabled },
 +	{ "noneswitch", oNoneSwitch },
- 	{ "proxyusefdpass", oProxyUseFdpass },
- 	{ "canonicaldomains", oCanonicalDomains },
- 	{ "canonicalizefallbacklocal", oCanonicalizeFallbackLocal },
+ 	{ "sessiontype", oSessionType },
+ 	{ "stdinnull", oStdinNull },
+ 	{ "forkafterauthentication", oForkAfterAuthentication },
 @@ -317,6 +323,11 @@ static struct {
  	{ "securitykeyprovider", oSecurityKeyProvider },
  	{ "knownhostscommand", oKnownHostsCommand },
@@ -717,9 +694,9 @@
 +	options->hpn_buffer_size = -1;
 +	options->tcp_rcv_buf_poll = -1;
 +	options->tcp_rcv_buf = -1;
- 	options->proxy_use_fdpass = -1;
- 	options->ignored_unknown = NULL;
- 	options->num_canonical_domains = 0;
+ 	options->session_type = -1;
+ 	options->stdin_null = -1;
+ 	options->fork_after_authentication = -1;
 @@ -2426,6 +2484,41 @@ fill_default_options(Options * options)
  		options->server_alive_interval = 0;
  	if (options->server_alive_count_max == -1)
@@ -778,9 +755,9 @@
  	int	ip_qos_bulk;		/* IP ToS/DSCP/class for bulk traffic */
  	SyslogFacility log_facility;	/* Facility for system logging. */
 @@ -120,7 +124,11 @@ typedef struct {
- 
  	int	enable_ssh_keysign;
  	int64_t rekey_limit;
+ 	int     disable_multithreaded; /*disable multithreaded aes-ctr*/
 +	int     none_switch;    /* Use none cipher */
 +	int     none_enabled;   /* Allow none cipher to be used */
 +  	int     nonemac_enabled;   /* Allow none MAC to be used */
@@ -842,9 +819,9 @@
  	/* Portable-specific options */
  	if (options->use_pam == -1)
 @@ -424,6 +434,49 @@ fill_default_server_options(ServerOptions *options)
- 	}
- 	if (options->permit_tun == -1)
  		options->permit_tun = SSH_TUNMODE_NO;
+ 	if (options->disable_multithreaded == -1)
+ 		options->disable_multithreaded = 0;
 +	if (options->none_enabled == -1)
 +		options->none_enabled = 0;
 +	if (options->nonemac_enabled == -1)
@@ -1047,17 +1024,17 @@
  Note that
 diff --git a/sftp.c b/sftp.c
 index fb3c08d1..89bebbb2 100644
---- a/sftp.c
-+++ b/sftp.c
-@@ -71,7 +71,7 @@ typedef void EditLine;
- #include "sftp-client.h"
- 
- #define DEFAULT_COPY_BUFLEN	32768	/* Size of buffer for up/download */
--#define DEFAULT_NUM_REQUESTS	64	/* # concurrent outstanding requests */
-+#define DEFAULT_NUM_REQUESTS	256	/* # concurrent outstanding requests */
+--- a/sftp-client.c
++++ b/sftp-client.c
+@@ -65,7 +65,7 @@ typedef void EditLine;
+ #define DEFAULT_COPY_BUFLEN	32768
+ 
+ /* Default number of concurrent outstanding requests */
+-#define DEFAULT_NUM_REQUESTS	64
++#define DEFAULT_NUM_REQUESTS	256
  
- /* File to read commands from */
- FILE* infile;
+ /* Minimum amount of data to read at a time */
+ #define MIN_READ_SIZE	512
 diff --git a/ssh-keygen.c b/ssh-keygen.c
 index cfb5f115..36a6e519 100644
 --- a/ssh-keygen.c
@@ -1330,9 +1307,9 @@
 +		}
 +	}
 +
- 	debug("Authentication succeeded (%s).", authctxt.method->name);
- }
  
+ #ifdef WITH_OPENSSL
+ 	if (options.disable_multithreaded == 0) {
 diff --git a/sshd.c b/sshd.c
 index 6277e6d6..d66fa41a 100644
 --- a/sshd.c
@@ -1359,8 +1336,8 @@
  		if (bind(listen_sock, ai->ai_addr, ai->ai_addrlen) == -1) {
  			error("Bind to port %s on %s failed: %.200s.",
 @@ -1727,6 +1734,19 @@ main(int ac, char **av)
- 	/* Fill in default values for those options not explicitly set. */
- 	fill_default_server_options(&options);
+ 		fatal("AuthorizedPrincipalsCommand set without "
+ 		    "AuthorizedPrincipalsCommandUser");
  
 +	if (options.none_enabled == 1) {
 +		char *old_ciphers = options.ciphers;
@@ -1375,9 +1352,9 @@
 +		}
 +	}
 +
- 	/* challenge-response is implemented via keyboard interactive */
- 	if (options.challenge_response_authentication)
- 		options.kbd_interactive_authentication = 1;
+ 	/*
+ 	 * Check whether there is any path through configured auth methods.
+ 	 * Unfortunately it is not possible to verify this generally before
 @@ -2166,6 +2186,9 @@ main(int ac, char **av)
  	    rdomain == NULL ? "" : "\"");
  	free(laddr);