58 files changed, 8859 insertions, 10856 deletions

diff --git a/src/lib/libcrypto/engine/Makefile b/src/lib/libcrypto/engine/Makefile
index d29bdd09a0..9c214824eb 100644
--- a/src/lib/libcrypto/engine/Makefile
+++ b/src/lib/libcrypto/engine/Makefile
@@ -21,14 +21,12 @@ LIBSRC= eng_err.c eng_lib.c eng_list.c eng_init.c eng_ctrl.c \
         eng_table.c eng_pkey.c eng_fat.c eng_all.c \
         tb_rsa.c tb_dsa.c tb_ecdsa.c tb_dh.c tb_ecdh.c tb_rand.c tb_store.c \
         tb_cipher.c tb_digest.c tb_pkmeth.c tb_asnmth.c \
-        eng_openssl.c eng_cnf.c eng_dyn.c eng_cryptodev.c \
-        eng_rsax.c eng_rdrand.c
+        eng_openssl.c eng_cnf.c eng_dyn.c eng_cryptodev.c
 LIBOBJ= eng_err.o eng_lib.o eng_list.o eng_init.o eng_ctrl.o \
         eng_table.o eng_pkey.o eng_fat.o eng_all.o \
         tb_rsa.o tb_dsa.o tb_ecdsa.o tb_dh.o tb_ecdh.o tb_rand.o tb_store.o \
         tb_cipher.o tb_digest.o tb_pkmeth.o tb_asnmth.o \
-        eng_openssl.o eng_cnf.o eng_dyn.o eng_cryptodev.o \
-        eng_rsax.o eng_rdrand.o
+        eng_openssl.o eng_cnf.o eng_dyn.o eng_cryptodev.o
 
 SRC= $(LIBSRC)
 
@@ -251,34 +249,6 @@ eng_pkey.o: ../../include/openssl/pkcs7.h ../../include/openssl/safestack.h
 eng_pkey.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 eng_pkey.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
 eng_pkey.o: ../../include/openssl/x509_vfy.h ../cryptlib.h eng_int.h eng_pkey.c
-eng_rdrand.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
-eng_rdrand.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
-eng_rdrand.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
-eng_rdrand.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
-eng_rdrand.o: ../../include/openssl/engine.h ../../include/openssl/err.h
-eng_rdrand.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
-eng_rdrand.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
-eng_rdrand.o: ../../include/openssl/opensslconf.h
-eng_rdrand.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
-eng_rdrand.o: ../../include/openssl/pkcs7.h ../../include/openssl/rand.h
-eng_rdrand.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-eng_rdrand.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
-eng_rdrand.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-eng_rdrand.o: eng_rdrand.c
-eng_rsax.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
-eng_rsax.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
-eng_rsax.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
-eng_rsax.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
-eng_rsax.o: ../../include/openssl/ecdsa.h ../../include/openssl/engine.h
-eng_rsax.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-eng_rsax.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
-eng_rsax.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-eng_rsax.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
-eng_rsax.o: ../../include/openssl/pkcs7.h ../../include/openssl/rsa.h
-eng_rsax.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-eng_rsax.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
-eng_rsax.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-eng_rsax.o: eng_rsax.c
 eng_table.o: ../../e_os.h ../../include/openssl/asn1.h
 eng_table.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 eng_table.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
diff --git a/src/lib/libcrypto/engine/README b/src/lib/libcrypto/engine/README
new file mode 100644
index 0000000000..6b69b70f57
--- /dev/null
+++ b/src/lib/libcrypto/engine/README
@@ -0,0 +1,211 @@
+Notes: 2001-09-24
+-----------------
+
+This "description" (if one chooses to call it that) needed some major updating
+so here goes. This update addresses a change being made at the same time to
+OpenSSL, and it pretty much completely restructures the underlying mechanics of
+the "ENGINE" code. So it serves a double purpose of being a "ENGINE internals
+for masochists" document *and* a rather extensive commit log message. (I'd get
+lynched for sticking all this in CHANGES or the commit mails :-).
+
+ENGINE_TABLE underlies this restructuring, as described in the internal header
+"eng_int.h", implemented in eng_table.c, and used in each of the "class" files;
+tb_rsa.c, tb_dsa.c, etc.
+
+However, "EVP_CIPHER" underlies the motivation and design of ENGINE_TABLE so
+I'll mention a bit about that first. EVP_CIPHER (and most of this applies
+equally to EVP_MD for digests) is both a "method" and a algorithm/mode
+identifier that, in the current API, "lingers". These cipher description +
+implementation structures can be defined or obtained directly by applications,
+or can be loaded "en masse" into EVP storage so that they can be catalogued and
+searched in various ways, ie. two ways of encrypting with the "des_cbc"
+algorithm/mode pair are;
+
+(i) directly;
+     const EVP_CIPHER *cipher = EVP_des_cbc();
+     EVP_EncryptInit(&ctx, cipher, key, iv);
+     [ ... use EVP_EncryptUpdate() and EVP_EncryptFinal() ...]
+
+(ii) indirectly; 
+     OpenSSL_add_all_ciphers();
+     cipher = EVP_get_cipherbyname("des_cbc");
+     EVP_EncryptInit(&ctx, cipher, key, iv);
+     [ ... etc ... ]
+
+The latter is more generally used because it also allows ciphers/digests to be
+looked up based on other identifiers which can be useful for automatic cipher
+selection, eg. in SSL/TLS, or by user-controllable configuration.
+
+The important point about this is that EVP_CIPHER definitions and structures are
+passed around with impunity and there is no safe way, without requiring massive
+rewrites of many applications, to assume that EVP_CIPHERs can be reference
+counted. One an EVP_CIPHER is exposed to the caller, neither it nor anything it
+comes from can "safely" be destroyed. Unless of course the way of getting to
+such ciphers is via entirely distinct API calls that didn't exist before.
+However existing API usage cannot be made to understand when an EVP_CIPHER
+pointer, that has been passed to the caller, is no longer being used.
+
+The other problem with the existing API w.r.t. to hooking EVP_CIPHER support
+into ENGINE is storage - the OBJ_NAME-based storage used by EVP to register
+ciphers simultaneously registers cipher *types* and cipher *implementations* -
+they are effectively the same thing, an "EVP_CIPHER" pointer. The problem with
+hooking in ENGINEs is that multiple ENGINEs may implement the same ciphers. The
+solution is necessarily that ENGINE-provided ciphers simply are not registered,
+stored, or exposed to the caller in the same manner as existing ciphers. This is
+especially necessary considering the fact ENGINE uses reference counts to allow
+for cleanup, modularity, and DSO support - yet EVP_CIPHERs, as exposed to
+callers in the current API, support no such controls.
+
+Another sticking point for integrating cipher support into ENGINE is linkage.
+Already there is a problem with the way ENGINE supports RSA, DSA, etc whereby
+they are available *because* they're part of a giant ENGINE called "openssl".
+Ie. all implementations *have* to come from an ENGINE, but we get round that by
+having a giant ENGINE with all the software support encapsulated. This creates
+linker hassles if nothing else - linking a 1-line application that calls 2 basic
+RSA functions (eg. "RSA_free(RSA_new());") will result in large quantities of
+ENGINE code being linked in *and* because of that DSA, DH, and RAND also. If we
+continue with this approach for EVP_CIPHER support (even if it *was* possible)
+we would lose our ability to link selectively by selectively loading certain
+implementations of certain functionality. Touching any part of any kind of
+crypto would result in massive static linkage of everything else. So the
+solution is to change the way ENGINE feeds existing "classes", ie. how the
+hooking to ENGINE works from RSA, DSA, DH, RAND, as well as adding new hooking
+for EVP_CIPHER, and EVP_MD.
+
+The way this is now being done is by mostly reverting back to how things used to
+work prior to ENGINE :-). Ie. RSA now has a "RSA_METHOD" pointer again - this
+was previously replaced by an "ENGINE" pointer and all RSA code that required
+the RSA_METHOD would call ENGINE_get_RSA() each time on its ENGINE handle to
+temporarily get and use the ENGINE's RSA implementation. Apart from being more
+efficient, switching back to each RSA having an RSA_METHOD pointer also allows
+us to conceivably operate with *no* ENGINE. As we'll see, this removes any need
+for a fallback ENGINE that encapsulates default implementations - we can simply
+have our RSA structure pointing its RSA_METHOD pointer to the software
+implementation and have its ENGINE pointer set to NULL.
+
+A look at the EVP_CIPHER hooking is most explanatory, the RSA, DSA (etc) cases
+turn out to be degenerate forms of the same thing. The EVP storage of ciphers,
+and the existing EVP API functions that return "software" implementations and
+descriptions remain untouched. However, the storage takes more meaning in terms
+of "cipher description" and less meaning in terms of "implementation". When an
+EVP_CIPHER_CTX is actually initialised with an EVP_CIPHER method and is about to
+begin en/decryption, the hooking to ENGINE comes into play. What happens is that
+cipher-specific ENGINE code is asked for an ENGINE pointer (a functional
+reference) for any ENGINE that is registered to perform the algo/mode that the
+provided EVP_CIPHER structure represents. Under normal circumstances, that
+ENGINE code will return NULL because no ENGINEs will have had any cipher
+implementations *registered*. As such, a NULL ENGINE pointer is stored in the
+EVP_CIPHER_CTX context, and the EVP_CIPHER structure is left hooked into the
+context and so is used as the implementation. Pretty much how things work now
+except we'd have a redundant ENGINE pointer set to NULL and doing nothing.
+
+Conversely, if an ENGINE *has* been registered to perform the algorithm/mode
+combination represented by the provided EVP_CIPHER, then a functional reference
+to that ENGINE will be returned to the EVP_CIPHER_CTX during initialisation.
+That functional reference will be stored in the context (and released on
+cleanup) - and having that reference provides a *safe* way to use an EVP_CIPHER
+definition that is private to the ENGINE. Ie. the EVP_CIPHER provided by the
+application will actually be replaced by an EVP_CIPHER from the registered
+ENGINE - it will support the same algorithm/mode as the original but will be a
+completely different implementation. Because this EVP_CIPHER isn't stored in the
+EVP storage, nor is it returned to applications from traditional API functions,
+there is no associated problem with it not having reference counts. And of
+course, when one of these "private" cipher implementations is hooked into
+EVP_CIPHER_CTX, it is done whilst the EVP_CIPHER_CTX holds a functional
+reference to the ENGINE that owns it, thus the use of the ENGINE's EVP_CIPHER is
+safe.
+
+The "cipher-specific ENGINE code" I mentioned is implemented in tb_cipher.c but
+in essence it is simply an instantiation of "ENGINE_TABLE" code for use by
+EVP_CIPHER code. tb_digest.c is virtually identical but, of course, it is for
+use by EVP_MD code. Ditto for tb_rsa.c, tb_dsa.c, etc. These instantiations of
+ENGINE_TABLE essentially provide linker-separation of the classes so that even
+if ENGINEs implement *all* possible algorithms, an application using only
+EVP_CIPHER code will link at most code relating to EVP_CIPHER, tb_cipher.c, core
+ENGINE code that is independant of class, and of course the ENGINE
+implementation that the application loaded. It will *not* however link any
+class-specific ENGINE code for digests, RSA, etc nor will it bleed over into
+other APIs, such as the RSA/DSA/etc library code.
+
+ENGINE_TABLE is a little more complicated than may seem necessary but this is
+mostly to avoid a lot of "init()"-thrashing on ENGINEs (that may have to load
+DSOs, and other expensive setup that shouldn't be thrashed unnecessarily) *and*
+to duplicate "default" behaviour. Basically an ENGINE_TABLE instantiation, for
+example tb_cipher.c, implements a hash-table keyed by integer "nid" values.
+These nids provide the uniquenness of an algorithm/mode - and each nid will hash
+to a potentially NULL "ENGINE_PILE". An ENGINE_PILE is essentially a list of
+pointers to ENGINEs that implement that particular 'nid'. Each "pile" uses some
+caching tricks such that requests on that 'nid' will be cached and all future
+requests will return immediately (well, at least with minimal operation) unless
+a change is made to the pile, eg. perhaps an ENGINE was unloaded. The reason is
+that an application could have support for 10 ENGINEs statically linked
+in, and the machine in question may not have any of the hardware those 10
+ENGINEs support. If each of those ENGINEs has a "des_cbc" implementation, we
+want to avoid every EVP_CIPHER_CTX setup from trying (and failing) to initialise
+each of those 10 ENGINEs. Instead, the first such request will try to do that
+and will either return (and cache) a NULL ENGINE pointer or will return a
+functional reference to the first that successfully initialised. In the latter
+case it will also cache an extra functional reference to the ENGINE as a
+"default" for that 'nid'. The caching is acknowledged by a 'uptodate' variable
+that is unset only if un/registration takes place on that pile. Ie. if
+implementations of "des_cbc" are added or removed. This behaviour can be
+tweaked; the ENGINE_TABLE_FLAG_NOINIT value can be passed to
+ENGINE_set_table_flags(), in which case the only ENGINEs that tb_cipher.c will
+try to initialise from the "pile" will be those that are already initialised
+(ie. it's simply an increment of the functional reference count, and no real
+"initialisation" will take place).
+
+RSA, DSA, DH, and RAND all have their own ENGINE_TABLE code as well, and the
+difference is that they all use an implicit 'nid' of 1. Whereas EVP_CIPHERs are
+actually qualitatively different depending on 'nid' (the "des_cbc" EVP_CIPHER is
+not an interoperable implementation of "aes_256_cbc"), RSA_METHODs are
+necessarily interoperable and don't have different flavours, only different
+implementations. In other words, the ENGINE_TABLE for RSA will either be empty,
+or will have a single ENGING_PILE hashed to by the 'nid' 1 and that pile
+represents ENGINEs that implement the single "type" of RSA there is.
+
+Cleanup - the registration and unregistration may pose questions about how
+cleanup works with the ENGINE_PILE doing all this caching nonsense (ie. when the
+application or EVP_CIPHER code releases its last reference to an ENGINE, the
+ENGINE_PILE code may still have references and thus those ENGINEs will stay
+hooked in forever). The way this is handled is via "unregistration". With these
+new ENGINE changes, an abstract ENGINE can be loaded and initialised, but that
+is an algorithm-agnostic process. Even if initialised, it will not have
+registered any of its implementations (to do so would link all class "table"
+code despite the fact the application may use only ciphers, for example). This
+is deliberately a distinct step. Moreover, registration and unregistration has
+nothing to do with whether an ENGINE is *functional* or not (ie. you can even
+register an ENGINE and its implementations without it being operational, you may
+not even have the drivers to make it operate). What actually happens with
+respect to cleanup is managed inside eng_lib.c with the "engine_cleanup_***"
+functions. These functions are internal-only and each part of ENGINE code that
+could require cleanup will, upon performing its first allocation, register a
+callback with the "engine_cleanup" code. The other part of this that makes it
+tick is that the ENGINE_TABLE instantiations (tb_***.c) use NULL as their
+initialised state. So if RSA code asks for an ENGINE and no ENGINE has
+registered an implementation, the code will simply return NULL and the tb_rsa.c
+state will be unchanged. Thus, no cleanup is required unless registration takes
+place. ENGINE_cleanup() will simply iterate across a list of registered cleanup
+callbacks calling each in turn, and will then internally delete its own storage
+(a STACK). When a cleanup callback is next registered (eg. if the cleanup() is
+part of a gracefull restart and the application wants to cleanup all state then
+start again), the internal STACK storage will be freshly allocated. This is much
+the same as the situation in the ENGINE_TABLE instantiations ... NULL is the
+initialised state, so only modification operations (not queries) will cause that
+code to have to register a cleanup.
+
+What else? The bignum callbacks and associated ENGINE functions have been
+removed for two obvious reasons; (i) there was no way to generalise them to the
+mechanism now used by RSA/DSA/..., because there's no such thing as a BIGNUM
+method, and (ii) because of (i), there was no meaningful way for library or
+application code to automatically hook and use ENGINE supplied bignum functions
+anyway. Also, ENGINE_cpy() has been removed (although an internal-only version
+exists) - the idea of providing an ENGINE_cpy() function probably wasn't a good
+one and now certainly doesn't make sense in any generalised way. Some of the
+RSA, DSA, DH, and RAND functions that were fiddled during the original ENGINE
+changes have now, as a consequence, been reverted back. This is because the
+hooking of ENGINE is now automatic (and passive, it can interally use a NULL
+ENGINE pointer to simply ignore ENGINE from then on).
+
+Hell, that should be enough for now ... comments welcome: geoff@openssl.org
+
diff --git a/src/lib/libcrypto/engine/eng_aesni.c b/src/lib/libcrypto/engine/eng_aesni.c
new file mode 100644
index 0000000000..5fdb33bfde
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_aesni.c
@@ -0,0 +1,570 @@
+/*
+ * Support for Intel AES-NI intruction set
+ *   Author: Huang Ying <ying.huang@intel.com>
+ *
+ * Intel AES-NI is a new set of Single Instruction Multiple Data
+ * (SIMD) instructions that are going to be introduced in the next
+ * generation of Intel processor, as of 2009. These instructions
+ * enable fast and secure data encryption and decryption, using the
+ * Advanced Encryption Standard (AES), defined by FIPS Publication
+ * number 197.  The architecture introduces six instructions that
+ * offer full hardware support for AES. Four of them support high
+ * performance data encryption and decryption, and the other two
+ * instructions support the AES key expansion procedure.
+ *
+ * The white paper can be downloaded from:
+ *   http://softwarecommunity.intel.com/isn/downloads/intelavx/AES-Instructions-Set_WP.pdf
+ *
+ * This file is based on engines/e_padlock.c
+ */
+
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+#include <openssl/opensslconf.h>
+
+#if !defined(OPENSSL_NO_HW) && !defined(OPENSSL_NO_HW_AES_NI) && !defined(OPENSSL_NO_AES)
+
+#include <stdio.h>
+#include <assert.h>
+#include "cryptlib.h"
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+#include <openssl/evp.h>
+#include <openssl/aes.h>
+#include <openssl/err.h>
+
+/* AES-NI is available *ONLY* on some x86 CPUs.  Not only that it
+   doesn't exist elsewhere, but it even can't be compiled on other
+   platforms! */
+#undef COMPILE_HW_AESNI
+#if (defined(__x86_64) || defined(__x86_64__) || \
+     defined(_M_AMD64) || defined(_M_X64) || \
+     defined(OPENSSL_IA32_SSE2)) && !defined(OPENSSL_NO_ASM) && !defined(__i386__)
+#define COMPILE_HW_AESNI
+#endif
+static ENGINE *ENGINE_aesni (void);
+
+void ENGINE_load_aesni (void)
+{
+/* On non-x86 CPUs it just returns. */
+#ifdef COMPILE_HW_AESNI
+        ENGINE *toadd = ENGINE_aesni();
+        if (!toadd) return;
+        ENGINE_add (toadd);
+        ENGINE_register_complete (toadd);
+        ENGINE_free (toadd);
+        ERR_clear_error ();
+#endif
+}
+
+#ifdef COMPILE_HW_AESNI
+int aesni_set_encrypt_key(const unsigned char *userKey, int bits,
+                              AES_KEY *key);
+int aesni_set_decrypt_key(const unsigned char *userKey, int bits,
+                              AES_KEY *key);
+
+void aesni_encrypt(const unsigned char *in, unsigned char *out,
+                       const AES_KEY *key);
+void aesni_decrypt(const unsigned char *in, unsigned char *out,
+                       const AES_KEY *key);
+
+void aesni_ecb_encrypt(const unsigned char *in,
+                           unsigned char *out,
+                           size_t length,
+                           const AES_KEY *key,
+                           int enc);
+void aesni_cbc_encrypt(const unsigned char *in,
+                           unsigned char *out,
+                           size_t length,
+                           const AES_KEY *key,
+                           unsigned char *ivec, int enc);
+
+/* Function for ENGINE detection and control */
+static int aesni_init(ENGINE *e);
+
+/* Cipher Stuff */
+static int aesni_ciphers(ENGINE *e, const EVP_CIPHER **cipher,
+                                const int **nids, int nid);
+
+#define AESNI_MIN_ALIGN 16
+#define AESNI_ALIGN(x) \
+        ((void *)(((unsigned long)(x)+AESNI_MIN_ALIGN-1)&~(AESNI_MIN_ALIGN-1)))
+
+/* Engine names */
+static const char   aesni_id[] = "aesni",
+                    aesni_name[] = "Intel AES-NI engine",
+                    no_aesni_name[] = "Intel AES-NI engine (no-aesni)";
+
+
+/* The input and output encrypted as though 128bit cfb mode is being
+ * used.  The extra state information to record how much of the
+ * 128bit block we have used is contained in *num;
+ */
+static void aesni_cfb128_encrypt(const unsigned char *in, unsigned char *out,
+                                 unsigned int len, const void *key,
+                                 unsigned char ivec[16], int *num,
+                                 int enc)
+{
+    unsigned int n;
+    size_t l = 0;
+
+    assert(in && out && key && ivec && num);
+
+    n = *num;
+
+    if (enc) {
+#if !defined(OPENSSL_SMALL_FOOTPRINT)
+        if (16%sizeof(size_t) == 0) do {        /* always true actually */
+                while (n && len) {
+                        *(out++) = ivec[n] ^= *(in++);
+                        --len;
+                        n = (n+1) % 16;
+                }
+                while (len>=16) {
+                        aesni_encrypt(ivec, ivec, key);
+                        for (n=0; n<16; n+=sizeof(size_t)) {
+                                *(size_t*)(out+n) =
+                                *(size_t*)(ivec+n) ^= *(size_t*)(in+n);
+                        }
+                        len -= 16;
+                        out += 16;
+                        in  += 16;
+                }
+                n = 0;
+                if (len) {
+                        aesni_encrypt(ivec, ivec, key);
+                        while (len--) {
+                                out[n] = ivec[n] ^= in[n];
+                                ++n;
+                        }
+                }
+                *num = n;
+                return;
+        } while (0);
+        /* the rest would be commonly eliminated by x86* compiler */
+#endif
+        while (l<len) {
+                if (n == 0) {
+                        aesni_encrypt(ivec, ivec, key);
+                }
+                out[l] = ivec[n] ^= in[l];
+                ++l;
+                n = (n+1) % 16;
+        }
+        *num = n;
+    } else {
+#if !defined(OPENSSL_SMALL_FOOTPRINT)
+        if (16%sizeof(size_t) == 0) do {        /* always true actually */
+                while (n && len) {
+                        unsigned char c;
+                        *(out++) = ivec[n] ^ (c = *(in++)); ivec[n] = c;
+                        --len;
+                        n = (n+1) % 16;
+                }
+                while (len>=16) {
+                        aesni_encrypt(ivec, ivec, key);
+                        for (n=0; n<16; n+=sizeof(size_t)) {
+                                size_t t = *(size_t*)(in+n);
+                                *(size_t*)(out+n) = *(size_t*)(ivec+n) ^ t;
+                                *(size_t*)(ivec+n) = t;
+                        }
+                        len -= 16;
+                        out += 16;
+                        in  += 16;
+                }
+                n = 0;
+                if (len) {
+                        aesni_encrypt(ivec, ivec, key);
+                        while (len--) {
+                                unsigned char c;
+                                out[n] = ivec[n] ^ (c = in[n]); ivec[n] = c;
+                                ++n;
+                        }
+                }
+                *num = n;
+                return;
+        } while (0);
+        /* the rest would be commonly eliminated by x86* compiler */
+#endif
+        while (l<len) {
+                unsigned char c;
+                if (n == 0) {
+                        aesni_encrypt(ivec, ivec, key);
+                }
+                out[l] = ivec[n] ^ (c = in[l]); ivec[n] = c;
+                ++l;
+                n = (n+1) % 16;
+        }
+        *num=n;
+    }
+}
+
+/* The input and output encrypted as though 128bit ofb mode is being
+ * used.  The extra state information to record how much of the
+ * 128bit block we have used is contained in *num;
+ */
+static void aesni_ofb128_encrypt(const unsigned char *in, unsigned char *out,
+                                 unsigned int len, const void *key,
+                                 unsigned char ivec[16], int *num)
+{
+        unsigned int n;
+        size_t l=0;
+
+        assert(in && out && key && ivec && num);
+
+        n = *num;
+
+#if !defined(OPENSSL_SMALL_FOOTPRINT)
+        if (16%sizeof(size_t) == 0) do { /* always true actually */
+                while (n && len) {
+                        *(out++) = *(in++) ^ ivec[n];
+                        --len;
+                        n = (n+1) % 16;
+                }
+                while (len>=16) {
+                        aesni_encrypt(ivec, ivec, key);
+                        for (n=0; n<16; n+=sizeof(size_t))
+                                *(size_t*)(out+n) =
+                                *(size_t*)(in+n) ^ *(size_t*)(ivec+n);
+                        len -= 16;
+                        out += 16;
+                        in  += 16;
+                }
+                n = 0;
+                if (len) {
+                        aesni_encrypt(ivec, ivec, key);
+                        while (len--) {
+                                out[n] = in[n] ^ ivec[n];
+                                ++n;
+                        }
+                }
+                *num = n;
+                return;
+        } while(0);
+        /* the rest would be commonly eliminated by x86* compiler */
+#endif
+        while (l<len) {
+                if (n==0) {
+                        aesni_encrypt(ivec, ivec, key);
+                }
+                out[l] = in[l] ^ ivec[n];
+                ++l;
+                n = (n+1) % 16;
+        }
+
+        *num=n;
+}
+/* ===== Engine "management" functions ===== */
+
+#if defined(_WIN32)
+typedef unsigned __int64 IA32CAP;
+#else
+typedef unsigned long long IA32CAP;
+#endif
+
+/* Prepare the ENGINE structure for registration */
+static int
+aesni_bind_helper(ENGINE *e)
+{
+        int engage;
+        if (sizeof(OPENSSL_ia32cap_P) > 4) {
+                engage = ((IA32CAP)OPENSSL_ia32cap_P >> 57) & 1;
+        } else {
+                IA32CAP OPENSSL_ia32_cpuid(void);
+                engage = (OPENSSL_ia32_cpuid() >> 57) & 1;
+        }
+
+        /* Register everything or return with an error */
+        if (!ENGINE_set_id(e, aesni_id) ||
+            !ENGINE_set_name(e, engage ? aesni_name : no_aesni_name) ||
+
+            !ENGINE_set_init_function(e, aesni_init) ||
+            (engage && !ENGINE_set_ciphers (e, aesni_ciphers))
+            )
+                return 0;
+
+        /* Everything looks good */
+        return 1;
+}
+
+/* Constructor */
+static ENGINE *
+ENGINE_aesni(void)
+{
+        ENGINE *eng = ENGINE_new();
+
+        if (!eng) {
+                return NULL;
+        }
+
+        if (!aesni_bind_helper(eng)) {
+                ENGINE_free(eng);
+                return NULL;
+        }
+
+        return eng;
+}
+
+/* Check availability of the engine */
+static int
+aesni_init(ENGINE *e)
+{
+        return 1;
+}
+
+#if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb)
+#define NID_aes_128_cfb NID_aes_128_cfb128
+#endif
+
+#if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb)
+#define NID_aes_128_ofb NID_aes_128_ofb128
+#endif
+
+#if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb)
+#define NID_aes_192_cfb NID_aes_192_cfb128
+#endif
+
+#if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb)
+#define NID_aes_192_ofb NID_aes_192_ofb128
+#endif
+
+#if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb)
+#define NID_aes_256_cfb NID_aes_256_cfb128
+#endif
+
+#if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb)
+#define NID_aes_256_ofb NID_aes_256_ofb128
+#endif
+
+/* List of supported ciphers. */
+static int aesni_cipher_nids[] = {
+        NID_aes_128_ecb,
+        NID_aes_128_cbc,
+        NID_aes_128_cfb,
+        NID_aes_128_ofb,
+
+        NID_aes_192_ecb,
+        NID_aes_192_cbc,
+        NID_aes_192_cfb,
+        NID_aes_192_ofb,
+
+        NID_aes_256_ecb,
+        NID_aes_256_cbc,
+        NID_aes_256_cfb,
+        NID_aes_256_ofb,
+};
+static int aesni_cipher_nids_num =
+        (sizeof(aesni_cipher_nids)/sizeof(aesni_cipher_nids[0]));
+
+typedef struct
+{
+        AES_KEY ks;
+        unsigned int _pad1[3];
+} AESNI_KEY;
+
+static int
+aesni_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *user_key,
+                    const unsigned char *iv, int enc)
+{
+        int ret;
+        AES_KEY *key = AESNI_ALIGN(ctx->cipher_data);
+
+        if ((ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_CFB_MODE
+            || (ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_OFB_MODE
+            || enc)
+                ret=aesni_set_encrypt_key(user_key, ctx->key_len * 8, key);
+        else
+                ret=aesni_set_decrypt_key(user_key, ctx->key_len * 8, key);
+
+        if(ret < 0) {
+                EVPerr(EVP_F_AESNI_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED);
+                return 0;
+        }
+
+        return 1;
+}
+
+static int aesni_cipher_ecb(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                 const unsigned char *in, size_t inl)
+{       AES_KEY *key = AESNI_ALIGN(ctx->cipher_data);
+        aesni_ecb_encrypt(in, out, inl, key, ctx->encrypt);
+        return 1;
+}
+static int aesni_cipher_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                 const unsigned char *in, size_t inl)
+{       AES_KEY *key = AESNI_ALIGN(ctx->cipher_data);
+        aesni_cbc_encrypt(in, out, inl, key,
+                              ctx->iv, ctx->encrypt);
+        return 1;
+}
+static int aesni_cipher_cfb(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                 const unsigned char *in, size_t inl)
+{       AES_KEY *key = AESNI_ALIGN(ctx->cipher_data);
+
+        aesni_cfb128_encrypt(in, out, inl, key, ctx->iv,
+                             &ctx->num, ctx->encrypt);
+        return 1;
+}
+static int aesni_cipher_ofb(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                 const unsigned char *in, size_t inl)
+{       AES_KEY *key = AESNI_ALIGN(ctx->cipher_data);
+        aesni_ofb128_encrypt(in, out, inl, key, ctx->iv, &ctx->num);
+        return 1;
+}
+
+#define AES_BLOCK_SIZE          16
+
+#define EVP_CIPHER_block_size_ECB       AES_BLOCK_SIZE
+#define EVP_CIPHER_block_size_CBC       AES_BLOCK_SIZE
+#define EVP_CIPHER_block_size_OFB       1
+#define EVP_CIPHER_block_size_CFB       1
+
+/* Declaring so many ciphers by hand would be a pain.
+   Instead introduce a bit of preprocessor magic :-) */
+#define DECLARE_AES_EVP(ksize,lmode,umode)      \
+static const EVP_CIPHER aesni_##ksize##_##lmode = {     \
+        NID_aes_##ksize##_##lmode,                      \
+        EVP_CIPHER_block_size_##umode,                  \
+        ksize / 8,                                      \
+        AES_BLOCK_SIZE,                                 \
+        0 | EVP_CIPH_##umode##_MODE,                    \
+        aesni_init_key,                         \
+        aesni_cipher_##lmode,                           \
+        NULL,                                           \
+        sizeof(AESNI_KEY),                              \
+        EVP_CIPHER_set_asn1_iv,                         \
+        EVP_CIPHER_get_asn1_iv,                         \
+        NULL,                                           \
+        NULL                                            \
+}
+
+DECLARE_AES_EVP(128,ecb,ECB);
+DECLARE_AES_EVP(128,cbc,CBC);
+DECLARE_AES_EVP(128,cfb,CFB);
+DECLARE_AES_EVP(128,ofb,OFB);
+
+DECLARE_AES_EVP(192,ecb,ECB);
+DECLARE_AES_EVP(192,cbc,CBC);
+DECLARE_AES_EVP(192,cfb,CFB);
+DECLARE_AES_EVP(192,ofb,OFB);
+
+DECLARE_AES_EVP(256,ecb,ECB);
+DECLARE_AES_EVP(256,cbc,CBC);
+DECLARE_AES_EVP(256,cfb,CFB);
+DECLARE_AES_EVP(256,ofb,OFB);
+
+static int
+aesni_ciphers (ENGINE *e, const EVP_CIPHER **cipher,
+                      const int **nids, int nid)
+{
+        /* No specific cipher => return a list of supported nids ... */
+        if (!cipher) {
+                *nids = aesni_cipher_nids;
+                return aesni_cipher_nids_num;
+        }
+
+        /* ... or the requested "cipher" otherwise */
+        switch (nid) {
+        case NID_aes_128_ecb:
+                *cipher = &aesni_128_ecb;
+                break;
+        case NID_aes_128_cbc:
+                *cipher = &aesni_128_cbc;
+                break;
+        case NID_aes_128_cfb:
+                *cipher = &aesni_128_cfb;
+                break;
+        case NID_aes_128_ofb:
+                *cipher = &aesni_128_ofb;
+                break;
+
+        case NID_aes_192_ecb:
+                *cipher = &aesni_192_ecb;
+                break;
+        case NID_aes_192_cbc:
+                *cipher = &aesni_192_cbc;
+                break;
+        case NID_aes_192_cfb:
+                *cipher = &aesni_192_cfb;
+                break;
+        case NID_aes_192_ofb:
+                *cipher = &aesni_192_ofb;
+                break;
+
+        case NID_aes_256_ecb:
+                *cipher = &aesni_256_ecb;
+                break;
+        case NID_aes_256_cbc:
+                *cipher = &aesni_256_cbc;
+                break;
+        case NID_aes_256_cfb:
+                *cipher = &aesni_256_cfb;
+                break;
+        case NID_aes_256_ofb:
+                *cipher = &aesni_256_ofb;
+                break;
+
+        default:
+                /* Sorry, we don't support this NID */
+                *cipher = NULL;
+                return 0;
+        }
+        return 1;
+}
+
+#endif /* COMPILE_HW_AESNI */
+#endif /* !defined(OPENSSL_NO_HW) && !defined(OPENSSL_NO_HW_AESNI) && !defined(OPENSSL_NO_AES) */
+
diff --git a/src/lib/libcrypto/engine/hw_cswift_err.h b/src/lib/libcrypto/engine/eng_all.c
index 7120c3216f..79d1f2beff 100644
--- a/src/lib/libcrypto/engine/hw_cswift_err.h
+++ b/src/lib/libcrypto/engine/eng_all.c
@@ -1,5 +1,9 @@
+/* crypto/engine/eng_all.c -*- mode: C; c-file-style: "eay" -*- */
+/* Written by Richard Levitte <richard@levitte.org> for the OpenSSL
+ * project 2000.
+ */
 /* ====================================================================
- * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000-2001 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -16,12 +20,12 @@
  * 3. All advertising materials mentioning features or use of this
  *    software must display the following acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  *
  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  *    endorse or promote products derived from this software without
  *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
+ *    licensing@OpenSSL.org.
  *
  * 5. Products derived from this software may not be called "OpenSSL"
  *    nor may "OpenSSL" appear in their names without prior written
@@ -30,7 +34,7 @@
  * 6. Redistributions of any form whatsoever must retain the following
  *    acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  *
  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
@@ -52,42 +56,76 @@
  *
  */
 
-#ifndef HEADER_CSWIFT_ERR_H
-#define HEADER_CSWIFT_ERR_H
-
-/* BEGIN ERROR CODES */
-/* The following lines are auto generated by the script mkerr.pl. Any changes
- * made after this point may be overwritten when the script is next run.
- */
-static void ERR_load_CSWIFT_strings(void);
-static void ERR_unload_CSWIFT_strings(void);
-static void ERR_CSWIFT_error(int function, int reason, char *file, int line);
-#define CSWIFTerr(f,r) ERR_CSWIFT_error((f),(r),__FILE__,__LINE__)
+#include "cryptlib.h"
+#include "eng_int.h"
 
-/* Error codes for the CSWIFT functions. */
+void ENGINE_load_builtin_engines(void)
+        {
+#if 0
+        /* There's no longer any need for an "openssl" ENGINE unless, one day,
+         * it is the *only* way for standard builtin implementations to be be
+         * accessed (ie. it would be possible to statically link binaries with
+         * *no* builtin implementations). */
+        ENGINE_load_openssl();
+#endif
+#if !defined(OPENSSL_NO_HW) && (defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV))
+        ENGINE_load_cryptodev();
+#endif
 
-/* Function codes. */
-#define CSWIFT_F_CSWIFT_CTRL                             100
-#define CSWIFT_F_CSWIFT_DSA_SIGN                         101
-#define CSWIFT_F_CSWIFT_DSA_VERIFY                       102
-#define CSWIFT_F_CSWIFT_FINISH                           103
-#define CSWIFT_F_CSWIFT_INIT                             104
-#define CSWIFT_F_CSWIFT_MOD_EXP                          105
-#define CSWIFT_F_CSWIFT_MOD_EXP_CRT                      106
-#define CSWIFT_F_CSWIFT_RSA_MOD_EXP                      107
+#if !defined(OPENSSL_NO_HW) && !defined(OPENSSL_NO_HW_AESNI)
+        ENGINE_load_aesni();
+#endif
 
-/* Reason codes. */
-#define CSWIFT_R_ALREADY_LOADED                          100
-#define CSWIFT_R_BAD_KEY_SIZE                            101
-#define CSWIFT_R_BN_CTX_FULL                             102
-#define CSWIFT_R_BN_EXPAND_FAIL                          103
-#define CSWIFT_R_CTRL_COMMAND_NOT_IMPLEMENTED            104
-#define CSWIFT_R_MISSING_KEY_COMPONENTS                  105
-#define CSWIFT_R_NOT_LOADED                              106
-#define CSWIFT_R_REQUEST_FAILED                          107
-#define CSWIFT_R_UNIT_FAILURE                            108
+        ENGINE_load_dynamic();
+#ifndef OPENSSL_NO_STATIC_ENGINE
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_4758_CCA
+        ENGINE_load_4758cca();
+#endif
+#ifndef OPENSSL_NO_HW_AEP
+        ENGINE_load_aep();
+#endif
+#ifndef OPENSSL_NO_HW_ATALLA
+        ENGINE_load_atalla();
+#endif
+#ifndef OPENSSL_NO_HW_CSWIFT
+        ENGINE_load_cswift();
+#endif
+#ifndef OPENSSL_NO_HW_NCIPHER
+        ENGINE_load_chil();
+#endif
+#ifndef OPENSSL_NO_HW_NURON
+        ENGINE_load_nuron();
+#endif
+#ifndef OPENSSL_NO_HW_SUREWARE
+        ENGINE_load_sureware();
+#endif
+#ifndef OPENSSL_NO_HW_UBSEC
+        ENGINE_load_ubsec();
+#endif
+#ifndef OPENSSL_NO_HW_PADLOCK
+        ENGINE_load_padlock();
+#endif
+#endif
+#ifndef OPENSSL_NO_GOST
+        ENGINE_load_gost();
+#endif
+#ifndef OPENSSL_NO_GMP
+        ENGINE_load_gmp();
+#endif
+#if defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_NO_CAPIENG)
+        ENGINE_load_capi();
+#endif
+#endif
+        }
 
-#ifdef  __cplusplus
+#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
+void ENGINE_setup_bsd_cryptodev(void) {
+        static int bsd_cryptodev_default_loaded = 0;
+        if (!bsd_cryptodev_default_loaded) {
+                ENGINE_load_cryptodev();
+                ENGINE_register_all_complete();
+        }
+        bsd_cryptodev_default_loaded=1;
 }
 #endif
-#endif
diff --git a/src/lib/libcrypto/engine/eng_cnf.c b/src/lib/libcrypto/engine/eng_cnf.c
new file mode 100644
index 0000000000..95c4070015
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_cnf.c
@@ -0,0 +1,259 @@
+/* eng_cnf.c */
+/* Written by Stephen Henson (steve@openssl.org) for the OpenSSL
+ * project 2001.
+ */
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+#include <openssl/conf.h>
+
+/* #define ENGINE_CONF_DEBUG */
+
+/* ENGINE config module */
+
+static char *skip_dot(char *name)
+        {
+        char *p;
+        p = strchr(name, '.');
+        if (p)
+                return p + 1;
+        return name;
+        }
+
+static STACK_OF(ENGINE) *initialized_engines = NULL;
+
+static int int_engine_init(ENGINE *e)
+        {
+        if (!ENGINE_init(e))
+                return 0;
+        if (!initialized_engines)
+                initialized_engines = sk_ENGINE_new_null();
+        if (!initialized_engines || !sk_ENGINE_push(initialized_engines, e))
+                {
+                ENGINE_finish(e);
+                return 0;
+                }
+        return 1;
+        }
+        
+
+static int int_engine_configure(char *name, char *value, const CONF *cnf)
+        {
+        int i;
+        int ret = 0;
+        long do_init = -1;
+        STACK_OF(CONF_VALUE) *ecmds;
+        CONF_VALUE *ecmd = NULL;
+        char *ctrlname, *ctrlvalue;
+        ENGINE *e = NULL;
+        int soft = 0;
+
+        name = skip_dot(name);
+#ifdef ENGINE_CONF_DEBUG
+        fprintf(stderr, "Configuring engine %s\n", name);
+#endif
+        /* Value is a section containing ENGINE commands */
+        ecmds = NCONF_get_section(cnf, value);
+
+        if (!ecmds)
+                {
+                ENGINEerr(ENGINE_F_INT_ENGINE_CONFIGURE, ENGINE_R_ENGINE_SECTION_ERROR);
+                return 0;
+                }
+
+        for (i = 0; i < sk_CONF_VALUE_num(ecmds); i++)
+                {
+                ecmd = sk_CONF_VALUE_value(ecmds, i);
+                ctrlname = skip_dot(ecmd->name);
+                ctrlvalue = ecmd->value;
+#ifdef ENGINE_CONF_DEBUG
+        fprintf(stderr, "ENGINE conf: doing ctrl(%s,%s)\n", ctrlname, ctrlvalue);
+#endif
+
+                /* First handle some special pseudo ctrls */
+
+                /* Override engine name to use */
+                if (!strcmp(ctrlname, "engine_id"))
+                        name = ctrlvalue;
+                else if (!strcmp(ctrlname, "soft_load"))
+                        soft = 1;
+                /* Load a dynamic ENGINE */
+                else if (!strcmp(ctrlname, "dynamic_path"))
+                        {
+                        e = ENGINE_by_id("dynamic");
+                        if (!e)
+                                goto err;
+                        if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", ctrlvalue, 0))
+                                goto err;
+                        if (!ENGINE_ctrl_cmd_string(e, "LIST_ADD", "2", 0))
+                                goto err;
+                        if (!ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0))
+                                goto err;
+                        }
+                /* ... add other pseudos here ... */
+                else
+                        {
+                        /* At this point we need an ENGINE structural reference
+                         * if we don't already have one.
+                         */
+                        if (!e)
+                                {
+                                e = ENGINE_by_id(name);
+                                if (!e && soft)
+                                        {
+                                        ERR_clear_error();
+                                        return 1;
+                                        }
+                                if (!e)
+                                        goto err;
+                                }
+                        /* Allow "EMPTY" to mean no value: this allows a valid
+                         * "value" to be passed to ctrls of type NO_INPUT
+                         */
+                        if (!strcmp(ctrlvalue, "EMPTY"))
+                                ctrlvalue = NULL;
+                        if (!strcmp(ctrlname, "init"))
+                                {
+                                if (!NCONF_get_number_e(cnf, value, "init", &do_init))
+                                        goto err;
+                                if (do_init == 1)
+                                        {
+                                        if (!int_engine_init(e))
+                                                goto err;
+                                        }
+                                else if (do_init != 0)
+                                        {
+                                        ENGINEerr(ENGINE_F_INT_ENGINE_CONFIGURE, ENGINE_R_INVALID_INIT_VALUE);
+                                        goto err;
+                                        }
+                                }
+                        else if (!strcmp(ctrlname, "default_algorithms"))
+                                {
+                                if (!ENGINE_set_default_string(e, ctrlvalue))
+                                        goto err;
+                                }
+                        else if (!ENGINE_ctrl_cmd_string(e,
+                                        ctrlname, ctrlvalue, 0))
+                                goto err;
+                        }
+
+
+
+                }
+        if (e && (do_init == -1) && !int_engine_init(e))
+                {
+                ecmd = NULL;
+                goto err;
+                }
+        ret = 1;
+        err:
+        if (ret != 1)
+                {
+                ENGINEerr(ENGINE_F_INT_ENGINE_CONFIGURE, ENGINE_R_ENGINE_CONFIGURATION_ERROR);
+                if (ecmd)
+                        ERR_add_error_data(6, "section=", ecmd->section, 
+                                                ", name=", ecmd->name,
+                                                ", value=", ecmd->value);
+                }
+        if (e)
+                ENGINE_free(e);
+        return ret;
+        }
+
+
+static int int_engine_module_init(CONF_IMODULE *md, const CONF *cnf)
+        {
+        STACK_OF(CONF_VALUE) *elist;
+        CONF_VALUE *cval;
+        int i;
+#ifdef ENGINE_CONF_DEBUG
+        fprintf(stderr, "Called engine module: name %s, value %s\n",
+                        CONF_imodule_get_name(md), CONF_imodule_get_value(md));
+#endif
+        /* Value is a section containing ENGINEs to configure */
+        elist = NCONF_get_section(cnf, CONF_imodule_get_value(md));
+
+        if (!elist)
+                {
+                ENGINEerr(ENGINE_F_INT_ENGINE_MODULE_INIT, ENGINE_R_ENGINES_SECTION_ERROR);
+                return 0;
+                }
+
+        for (i = 0; i < sk_CONF_VALUE_num(elist); i++)
+                {
+                cval = sk_CONF_VALUE_value(elist, i);
+                if (!int_engine_configure(cval->name, cval->value, cnf))
+                        return 0;
+                }
+
+        return 1;
+        }
+
+static void int_engine_module_finish(CONF_IMODULE *md)
+        {
+        ENGINE *e;
+        while ((e = sk_ENGINE_pop(initialized_engines)))
+                ENGINE_finish(e);
+        sk_ENGINE_free(initialized_engines);
+        initialized_engines = NULL;
+        }
+        
+
+void ENGINE_add_conf_module(void)
+        {
+        CONF_module_add("engines",
+                        int_engine_module_init,
+                        int_engine_module_finish);
+        }
diff --git a/src/lib/libcrypto/engine/eng_cryptodev.c b/src/lib/libcrypto/engine/eng_cryptodev.c
index 5a715aca4f..10b3856b4e 100644
--- a/src/lib/libcrypto/engine/eng_cryptodev.c
+++ b/src/lib/libcrypto/engine/eng_cryptodev.c
@@ -32,7 +32,7 @@
 #include <openssl/bn.h>
 
 #if (defined(__unix__) || defined(unix)) && !defined(USG) && \
-        (defined(OpenBSD) || defined(__FreeBSD__))
+        (defined(__OpenBSD__) || defined(__FreeBSD__))
 #include <sys/param.h>
 # if (OpenBSD >= 200112) || ((__FreeBSD_version >= 470101 && __FreeBSD_version < 500000) || __FreeBSD_version >= 500041)
 #  define HAVE_CRYPTODEV
@@ -79,6 +79,8 @@ struct dev_crypto_state {
         unsigned char digest_res[HASH_MAX_LEN];
         char *mac_data;
         int mac_len;
+
+        int copy;
 #endif
 };
 
@@ -149,7 +151,6 @@ static struct {
         { CRYPTO_AES_CBC,               NID_aes_256_cbc,        16,     32, },
         { CRYPTO_BLF_CBC,               NID_bf_cbc,             8,      16, },
         { CRYPTO_CAST_CBC,              NID_cast5_cbc,          8,      16, },
-        { CRYPTO_SKIPJACK_CBC,          NID_undef,              0,       0, },
         { 0,                            NID_undef,              0,       0, },
 };
 
@@ -198,7 +199,6 @@ get_dev_crypto(void)
 
         if ((fd = open_dev_crypto()) == -1)
                 return (-1);
-#ifndef CRIOGET_NOT_NEEDED
         if (ioctl(fd, CRIOGET, &retfd) == -1)
                 return (-1);
 
@@ -207,19 +207,9 @@ get_dev_crypto(void)
                 close(retfd);
                 return (-1);
         }
-#else
-        retfd = fd;
-#endif
         return (retfd);
 }
 
-static void put_dev_crypto(int fd)
-{
-#ifndef CRIOGET_NOT_NEEDED
-        close(fd);
-#endif
-}
-
 /* Caching version for asym operations */
 static int
 get_asym_dev_crypto(void)
@@ -261,7 +251,7 @@ get_cryptodev_ciphers(const int **cnids)
                     ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
                         nids[count++] = ciphers[i].nid;
         }
-        put_dev_crypto(fd);
+        close(fd);
 
         if (count > 0)
                 *cnids = nids;
@@ -300,7 +290,7 @@ get_cryptodev_digests(const int **cnids)
                     ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
                         nids[count++] = digests[i].nid;
         }
-        put_dev_crypto(fd);
+        close(fd);
 
         if (count > 0)
                 *cnids = nids;
@@ -445,7 +435,7 @@ cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
         sess->cipher = cipher;
 
         if (ioctl(state->d_fd, CIOCGSESSION, sess) == -1) {
-                put_dev_crypto(state->d_fd);
+                close(state->d_fd);
                 state->d_fd = -1;
                 return (0);
         }
@@ -482,7 +472,7 @@ cryptodev_cleanup(EVP_CIPHER_CTX *ctx)
         } else {
                 ret = 1;
         }
-        put_dev_crypto(state->d_fd);
+        close(state->d_fd);
         state->d_fd = -1;
 
         return (ret);
@@ -695,7 +685,7 @@ static int cryptodev_digest_init(EVP_MD_CTX *ctx)
         sess->mac = digest;
 
         if (ioctl(state->d_fd, CIOCGSESSION, sess) < 0) {
-                put_dev_crypto(state->d_fd);
+                close(state->d_fd);
                 state->d_fd = -1;
                 printf("cryptodev_digest_init: Open session failed\n");
                 return (0);
@@ -767,12 +757,14 @@ static int cryptodev_digest_final(EVP_MD_CTX *ctx, unsigned char *md)
         if (! (ctx->flags & EVP_MD_CTX_FLAG_ONESHOT) ) {
                 /* if application doesn't support one buffer */
                 memset(&cryp, 0, sizeof(cryp));
+
                 cryp.ses = sess->ses;
                 cryp.flags = 0;
                 cryp.len = state->mac_len;
                 cryp.src = state->mac_data;
                 cryp.dst = NULL;
                 cryp.mac = (caddr_t)md;
+
                 if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
                         printf("cryptodev_digest_final: digest failed\n");
                         return (0);
@@ -793,9 +785,6 @@ static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx)
         struct dev_crypto_state *state = ctx->md_data;
         struct session_op *sess = &state->d_sess;
 
-        if (state == NULL)
-          return 0;
-
         if (state->d_fd < 0) {
                 printf("cryptodev_digest_cleanup: illegal input\n");
                 return (0);
@@ -807,13 +796,16 @@ static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx)
                 state->mac_len = 0;
         }
 
+        if (state->copy)
+                return 1;
+
         if (ioctl(state->d_fd, CIOCFSESSION, &sess->ses) < 0) {
                 printf("cryptodev_digest_cleanup: failed to close session\n");
                 ret = 0;
         } else {
                 ret = 1;
         }
-        put_dev_crypto(state->d_fd);    
+        close(state->d_fd);     
         state->d_fd = -1;
 
         return (ret);
@@ -823,40 +815,16 @@ static int cryptodev_digest_copy(EVP_MD_CTX *to,const EVP_MD_CTX *from)
 {
         struct dev_crypto_state *fstate = from->md_data;
         struct dev_crypto_state *dstate = to->md_data;
-        struct session_op *sess;
-        int digest;
-
-        if (dstate == NULL || fstate == NULL)
-          return 1;
-
-        memcpy(dstate, fstate, sizeof(struct dev_crypto_state));
-
-        sess = &dstate->d_sess;
-
-        digest = digest_nid_to_cryptodev(to->digest->type);
-
-        sess->mackey = dstate->dummy_mac_key;
-        sess->mackeylen = digest_key_length(to->digest->type);
-        sess->mac = digest;
 
-        dstate->d_fd = get_dev_crypto();
-
-        if (ioctl(dstate->d_fd, CIOCGSESSION, sess) < 0) {
-                put_dev_crypto(dstate->d_fd);
-                dstate->d_fd = -1;
-                printf("cryptodev_digest_init: Open session failed\n");
-                return (0);
-        }
+        memcpy(dstate, fstate, sizeof(struct dev_crypto_state));
 
         if (fstate->mac_len != 0) {
-                if (fstate->mac_data != NULL)
-                        {
-                        dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
-                        memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len);
-                        dstate->mac_len = fstate->mac_len;
-                        }
+                dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
+                memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len);
         }
 
+        dstate->copy = 1;
+
         return 1;
 }
 
@@ -1378,11 +1346,11 @@ ENGINE_load_cryptodev(void)
          * find out what asymmetric crypto algorithms we support
          */
         if (ioctl(fd, CIOCASYMFEAT, &cryptodev_asymfeat) == -1) {
-                put_dev_crypto(fd);
+                close(fd);
                 ENGINE_free(engine);
                 return;
         }
-        put_dev_crypto(fd);
+        close(fd);
 
         if (!ENGINE_set_id(engine, "cryptodev") ||
             !ENGINE_set_name(engine, "BSD cryptodev engine") ||
diff --git a/src/lib/libcrypto/engine/eng_ctrl.c b/src/lib/libcrypto/engine/eng_ctrl.c
new file mode 100644
index 0000000000..5ce25d92ec
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_ctrl.c
@@ -0,0 +1,389 @@
+/* crypto/engine/eng_ctrl.c */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+
+/* When querying a ENGINE-specific control command's 'description', this string
+ * is used if the ENGINE_CMD_DEFN has cmd_desc set to NULL. */
+static const char *int_no_description = "";
+
+/* These internal functions handle 'CMD'-related control commands when the
+ * ENGINE in question has asked us to take care of it (ie. the ENGINE did not
+ * set the ENGINE_FLAGS_MANUAL_CMD_CTRL flag. */
+
+static int int_ctrl_cmd_is_null(const ENGINE_CMD_DEFN *defn)
+        {
+        if((defn->cmd_num == 0) || (defn->cmd_name == NULL))
+                return 1;
+        return 0;
+        }
+
+static int int_ctrl_cmd_by_name(const ENGINE_CMD_DEFN *defn, const char *s)
+        {
+        int idx = 0;
+        while(!int_ctrl_cmd_is_null(defn) && (strcmp(defn->cmd_name, s) != 0))
+                {
+                idx++;
+                defn++;
+                }
+        if(int_ctrl_cmd_is_null(defn))
+                /* The given name wasn't found */
+                return -1;
+        return idx;
+        }
+
+static int int_ctrl_cmd_by_num(const ENGINE_CMD_DEFN *defn, unsigned int num)
+        {
+        int idx = 0;
+        /* NB: It is stipulated that 'cmd_defn' lists are ordered by cmd_num. So
+         * our searches don't need to take any longer than necessary. */
+        while(!int_ctrl_cmd_is_null(defn) && (defn->cmd_num < num))
+                {
+                idx++;
+                defn++;
+                }
+        if(defn->cmd_num == num)
+                return idx;
+        /* The given cmd_num wasn't found */
+        return -1;
+        }
+
+static int int_ctrl_helper(ENGINE *e, int cmd, long i, void *p,
+                           void (*f)(void))
+        {
+        int idx;
+        char *s = (char *)p;
+        /* Take care of the easy one first (eg. it requires no searches) */
+        if(cmd == ENGINE_CTRL_GET_FIRST_CMD_TYPE)
+                {
+                if((e->cmd_defns == NULL) || int_ctrl_cmd_is_null(e->cmd_defns))
+                        return 0;
+                return e->cmd_defns->cmd_num;
+                }
+        /* One or two commands require that "p" be a valid string buffer */
+        if((cmd == ENGINE_CTRL_GET_CMD_FROM_NAME) ||
+                        (cmd == ENGINE_CTRL_GET_NAME_FROM_CMD) ||
+                        (cmd == ENGINE_CTRL_GET_DESC_FROM_CMD))
+                {
+                if(s == NULL)
+                        {
+                        ENGINEerr(ENGINE_F_INT_CTRL_HELPER,
+                                ERR_R_PASSED_NULL_PARAMETER);
+                        return -1;
+                        }
+                }
+        /* Now handle cmd_name -> cmd_num conversion */
+        if(cmd == ENGINE_CTRL_GET_CMD_FROM_NAME)
+                {
+                if((e->cmd_defns == NULL) || ((idx = int_ctrl_cmd_by_name(
+                                                e->cmd_defns, s)) < 0))
+                        {
+                        ENGINEerr(ENGINE_F_INT_CTRL_HELPER,
+                                ENGINE_R_INVALID_CMD_NAME);
+                        return -1;
+                        }
+                return e->cmd_defns[idx].cmd_num;
+                }
+        /* For the rest of the commands, the 'long' argument must specify a
+         * valie command number - so we need to conduct a search. */
+        if((e->cmd_defns == NULL) || ((idx = int_ctrl_cmd_by_num(e->cmd_defns,
+                                        (unsigned int)i)) < 0))
+                {
+                ENGINEerr(ENGINE_F_INT_CTRL_HELPER,
+                        ENGINE_R_INVALID_CMD_NUMBER);
+                return -1;
+                }
+        /* Now the logic splits depending on command type */
+        switch(cmd)
+                {
+        case ENGINE_CTRL_GET_NEXT_CMD_TYPE:
+                idx++;
+                if(int_ctrl_cmd_is_null(e->cmd_defns + idx))
+                        /* end-of-list */
+                        return 0;
+                else
+                        return e->cmd_defns[idx].cmd_num;
+        case ENGINE_CTRL_GET_NAME_LEN_FROM_CMD:
+                return strlen(e->cmd_defns[idx].cmd_name);
+        case ENGINE_CTRL_GET_NAME_FROM_CMD:
+                return BIO_snprintf(s,strlen(e->cmd_defns[idx].cmd_name) + 1,
+                                    "%s", e->cmd_defns[idx].cmd_name);
+        case ENGINE_CTRL_GET_DESC_LEN_FROM_CMD:
+                if(e->cmd_defns[idx].cmd_desc)
+                        return strlen(e->cmd_defns[idx].cmd_desc);
+                return strlen(int_no_description);
+        case ENGINE_CTRL_GET_DESC_FROM_CMD:
+                if(e->cmd_defns[idx].cmd_desc)
+                        return BIO_snprintf(s,
+                                            strlen(e->cmd_defns[idx].cmd_desc) + 1,
+                                            "%s", e->cmd_defns[idx].cmd_desc);
+                return BIO_snprintf(s, strlen(int_no_description) + 1,"%s",
+                                    int_no_description);
+        case ENGINE_CTRL_GET_CMD_FLAGS:
+                return e->cmd_defns[idx].cmd_flags;
+                }
+        /* Shouldn't really be here ... */
+        ENGINEerr(ENGINE_F_INT_CTRL_HELPER,ENGINE_R_INTERNAL_LIST_ERROR);
+        return -1;
+        }
+
+int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+        {
+        int ctrl_exists, ref_exists;
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_CTRL,ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        ref_exists = ((e->struct_ref > 0) ? 1 : 0);
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        ctrl_exists = ((e->ctrl == NULL) ? 0 : 1);
+        if(!ref_exists)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_CTRL,ENGINE_R_NO_REFERENCE);
+                return 0;
+                }
+        /* Intercept any "root-level" commands before trying to hand them on to
+         * ctrl() handlers. */
+        switch(cmd)
+                {
+        case ENGINE_CTRL_HAS_CTRL_FUNCTION:
+                return ctrl_exists;
+        case ENGINE_CTRL_GET_FIRST_CMD_TYPE:
+        case ENGINE_CTRL_GET_NEXT_CMD_TYPE:
+        case ENGINE_CTRL_GET_CMD_FROM_NAME:
+        case ENGINE_CTRL_GET_NAME_LEN_FROM_CMD:
+        case ENGINE_CTRL_GET_NAME_FROM_CMD:
+        case ENGINE_CTRL_GET_DESC_LEN_FROM_CMD:
+        case ENGINE_CTRL_GET_DESC_FROM_CMD:
+        case ENGINE_CTRL_GET_CMD_FLAGS:
+                if(ctrl_exists && !(e->flags & ENGINE_FLAGS_MANUAL_CMD_CTRL))
+                        return int_ctrl_helper(e,cmd,i,p,f);
+                if(!ctrl_exists)
+                        {
+                        ENGINEerr(ENGINE_F_ENGINE_CTRL,ENGINE_R_NO_CONTROL_FUNCTION);
+                        /* For these cmd-related functions, failure is indicated
+                         * by a -1 return value (because 0 is used as a valid
+                         * return in some places). */
+                        return -1;
+                        }
+        default:
+                break;
+                }
+        /* Anything else requires a ctrl() handler to exist. */
+        if(!ctrl_exists)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_CTRL,ENGINE_R_NO_CONTROL_FUNCTION);
+                return 0;
+                }
+        return e->ctrl(e, cmd, i, p, f);
+        }
+
+int ENGINE_cmd_is_executable(ENGINE *e, int cmd)
+        {
+        int flags;
+        if((flags = ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FLAGS, cmd, NULL, NULL)) < 0)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_CMD_IS_EXECUTABLE,
+                        ENGINE_R_INVALID_CMD_NUMBER);
+                return 0;
+                }
+        if(!(flags & ENGINE_CMD_FLAG_NO_INPUT) &&
+                        !(flags & ENGINE_CMD_FLAG_NUMERIC) &&
+                        !(flags & ENGINE_CMD_FLAG_STRING))
+                return 0;
+        return 1;
+        }
+
+int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name,
+        long i, void *p, void (*f)(void), int cmd_optional)
+        {
+        int num;
+
+        if((e == NULL) || (cmd_name == NULL))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_CTRL_CMD,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if((e->ctrl == NULL) || ((num = ENGINE_ctrl(e,
+                                        ENGINE_CTRL_GET_CMD_FROM_NAME,
+                                        0, (void *)cmd_name, NULL)) <= 0))
+                {
+                /* If the command didn't *have* to be supported, we fake
+                 * success. This allows certain settings to be specified for
+                 * multiple ENGINEs and only require a change of ENGINE id
+                 * (without having to selectively apply settings). Eg. changing
+                 * from a hardware device back to the regular software ENGINE
+                 * without editing the config file, etc. */
+                if(cmd_optional)
+                        {
+                        ERR_clear_error();
+                        return 1;
+                        }
+                ENGINEerr(ENGINE_F_ENGINE_CTRL_CMD,
+                        ENGINE_R_INVALID_CMD_NAME);
+                return 0;
+                }
+        /* Force the result of the control command to 0 or 1, for the reasons
+         * mentioned before. */
+        if (ENGINE_ctrl(e, num, i, p, f) > 0)
+                return 1;
+        return 0;
+        }
+
+int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char *arg,
+                                int cmd_optional)
+        {
+        int num, flags;
+        long l;
+        char *ptr;
+        if((e == NULL) || (cmd_name == NULL))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_CTRL_CMD_STRING,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if((e->ctrl == NULL) || ((num = ENGINE_ctrl(e,
+                                        ENGINE_CTRL_GET_CMD_FROM_NAME,
+                                        0, (void *)cmd_name, NULL)) <= 0))
+                {
+                /* If the command didn't *have* to be supported, we fake
+                 * success. This allows certain settings to be specified for
+                 * multiple ENGINEs and only require a change of ENGINE id
+                 * (without having to selectively apply settings). Eg. changing
+                 * from a hardware device back to the regular software ENGINE
+                 * without editing the config file, etc. */
+                if(cmd_optional)
+                        {
+                        ERR_clear_error();
+                        return 1;
+                        }
+                ENGINEerr(ENGINE_F_ENGINE_CTRL_CMD_STRING,
+                        ENGINE_R_INVALID_CMD_NAME);
+                return 0;
+                }
+        if(!ENGINE_cmd_is_executable(e, num))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_CTRL_CMD_STRING,
+                        ENGINE_R_CMD_NOT_EXECUTABLE);
+                return 0;
+                }
+        if((flags = ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FLAGS, num, NULL, NULL)) < 0)
+                {
+                /* Shouldn't happen, given that ENGINE_cmd_is_executable()
+                 * returned success. */
+                ENGINEerr(ENGINE_F_ENGINE_CTRL_CMD_STRING,
+                        ENGINE_R_INTERNAL_LIST_ERROR);
+                return 0;
+                }
+        /* If the command takes no input, there must be no input. And vice
+         * versa. */
+        if(flags & ENGINE_CMD_FLAG_NO_INPUT)
+                {
+                if(arg != NULL)
+                        {
+                        ENGINEerr(ENGINE_F_ENGINE_CTRL_CMD_STRING,
+                                ENGINE_R_COMMAND_TAKES_NO_INPUT);
+                        return 0;
+                        }
+                /* We deliberately force the result of ENGINE_ctrl() to 0 or 1
+                 * rather than returning it as "return data". This is to ensure
+                 * usage of these commands is consistent across applications and
+                 * that certain applications don't understand it one way, and
+                 * others another. */
+                if(ENGINE_ctrl(e, num, 0, (void *)arg, NULL) > 0)
+                        return 1;
+                return 0;
+                }
+        /* So, we require input */
+        if(arg == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_CTRL_CMD_STRING,
+                        ENGINE_R_COMMAND_TAKES_INPUT);
+                return 0;
+                }
+        /* If it takes string input, that's easy */
+        if(flags & ENGINE_CMD_FLAG_STRING)
+                {
+                /* Same explanation as above */
+                if(ENGINE_ctrl(e, num, 0, (void *)arg, NULL) > 0)
+                        return 1;
+                return 0;
+                }
+        /* If it doesn't take numeric either, then it is unsupported for use in
+         * a config-setting situation, which is what this function is for. This
+         * should never happen though, because ENGINE_cmd_is_executable() was
+         * used. */
+        if(!(flags & ENGINE_CMD_FLAG_NUMERIC))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_CTRL_CMD_STRING,
+                        ENGINE_R_INTERNAL_LIST_ERROR);
+                return 0;
+                }
+        l = strtol(arg, &ptr, 10);
+        if((arg == ptr) || (*ptr != '\0'))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_CTRL_CMD_STRING,
+                        ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER);
+                return 0;
+                }
+        /* Force the result of the control command to 0 or 1, for the reasons
+         * mentioned before. */
+        if(ENGINE_ctrl(e, num, l, NULL, NULL) > 0)
+                return 1;
+        return 0;
+        }
diff --git a/src/lib/libcrypto/engine/eng_dyn.c b/src/lib/libcrypto/engine/eng_dyn.c
new file mode 100644
index 0000000000..807da7a5eb
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_dyn.c
@@ -0,0 +1,548 @@
+/* crypto/engine/eng_dyn.c */
+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
+ * project 2001.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+#include "eng_int.h"
+#include <openssl/dso.h>
+
+/* Shared libraries implementing ENGINEs for use by the "dynamic" ENGINE loader
+ * should implement the hook-up functions with the following prototypes. */
+
+/* Our ENGINE handlers */
+static int dynamic_init(ENGINE *e);
+static int dynamic_finish(ENGINE *e);
+static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void));
+/* Predeclare our context type */
+typedef struct st_dynamic_data_ctx dynamic_data_ctx;
+/* The implementation for the important control command */
+static int dynamic_load(ENGINE *e, dynamic_data_ctx *ctx);
+
+#define DYNAMIC_CMD_SO_PATH             ENGINE_CMD_BASE
+#define DYNAMIC_CMD_NO_VCHECK           (ENGINE_CMD_BASE + 1)
+#define DYNAMIC_CMD_ID                  (ENGINE_CMD_BASE + 2)
+#define DYNAMIC_CMD_LIST_ADD            (ENGINE_CMD_BASE + 3)
+#define DYNAMIC_CMD_DIR_LOAD            (ENGINE_CMD_BASE + 4)
+#define DYNAMIC_CMD_DIR_ADD             (ENGINE_CMD_BASE + 5)
+#define DYNAMIC_CMD_LOAD                (ENGINE_CMD_BASE + 6)
+
+/* The constants used when creating the ENGINE */
+static const char *engine_dynamic_id = "dynamic";
+static const char *engine_dynamic_name = "Dynamic engine loading support";
+static const ENGINE_CMD_DEFN dynamic_cmd_defns[] = {
+        {DYNAMIC_CMD_SO_PATH,
+                "SO_PATH",
+                "Specifies the path to the new ENGINE shared library",
+                ENGINE_CMD_FLAG_STRING},
+        {DYNAMIC_CMD_NO_VCHECK,
+                "NO_VCHECK",
+                "Specifies to continue even if version checking fails (boolean)",
+                ENGINE_CMD_FLAG_NUMERIC},
+        {DYNAMIC_CMD_ID,
+                "ID",
+                "Specifies an ENGINE id name for loading",
+                ENGINE_CMD_FLAG_STRING},
+        {DYNAMIC_CMD_LIST_ADD,
+                "LIST_ADD",
+                "Whether to add a loaded ENGINE to the internal list (0=no,1=yes,2=mandatory)",
+                ENGINE_CMD_FLAG_NUMERIC},
+        {DYNAMIC_CMD_DIR_LOAD,
+                "DIR_LOAD",
+                "Specifies whether to load from 'DIR_ADD' directories (0=no,1=yes,2=mandatory)",
+                ENGINE_CMD_FLAG_NUMERIC},
+        {DYNAMIC_CMD_DIR_ADD,
+                "DIR_ADD",
+                "Adds a directory from which ENGINEs can be loaded",
+                ENGINE_CMD_FLAG_STRING},
+        {DYNAMIC_CMD_LOAD,
+                "LOAD",
+                "Load up the ENGINE specified by other settings",
+                ENGINE_CMD_FLAG_NO_INPUT},
+        {0, NULL, NULL, 0}
+        };
+static const ENGINE_CMD_DEFN dynamic_cmd_defns_empty[] = {
+        {0, NULL, NULL, 0}
+        };
+
+/* Loading code stores state inside the ENGINE structure via the "ex_data"
+ * element. We load all our state into a single structure and use that as a
+ * single context in the "ex_data" stack. */
+struct st_dynamic_data_ctx
+        {
+        /* The DSO object we load that supplies the ENGINE code */
+        DSO *dynamic_dso;
+        /* The function pointer to the version checking shared library function */
+        dynamic_v_check_fn v_check;
+        /* The function pointer to the engine-binding shared library function */
+        dynamic_bind_engine bind_engine;
+        /* The default name/path for loading the shared library */
+        const char *DYNAMIC_LIBNAME;
+        /* Whether to continue loading on a version check failure */
+        int no_vcheck;
+        /* If non-NULL, stipulates the 'id' of the ENGINE to be loaded */
+        const char *engine_id;
+        /* If non-zero, a successfully loaded ENGINE should be added to the internal
+         * ENGINE list. If 2, the add must succeed or the entire load should fail. */
+        int list_add_value;
+        /* The symbol name for the version checking function */
+        const char *DYNAMIC_F1;
+        /* The symbol name for the "initialise ENGINE structure" function */
+        const char *DYNAMIC_F2;
+        /* Whether to never use 'dirs', use 'dirs' as a fallback, or only use
+         * 'dirs' for loading. Default is to use 'dirs' as a fallback. */
+        int dir_load;
+        /* A stack of directories from which ENGINEs could be loaded */
+        STACK_OF(OPENSSL_STRING) *dirs;
+        };
+
+/* This is the "ex_data" index we obtain and reserve for use with our context
+ * structure. */
+static int dynamic_ex_data_idx = -1;
+
+static void int_free_str(char *s) { OPENSSL_free(s); }
+/* Because our ex_data element may or may not get allocated depending on whether
+ * a "first-use" occurs before the ENGINE is freed, we have a memory leak
+ * problem to solve. We can't declare a "new" handler for the ex_data as we
+ * don't want a dynamic_data_ctx in *all* ENGINE structures of all types (this
+ * is a bug in the design of CRYPTO_EX_DATA). As such, we just declare a "free"
+ * handler and that will get called if an ENGINE is being destroyed and there
+ * was an ex_data element corresponding to our context type. */
+static void dynamic_data_ctx_free_func(void *parent, void *ptr,
+                        CRYPTO_EX_DATA *ad, int idx, long argl, void *argp)
+        {
+        if(ptr)
+                {
+                dynamic_data_ctx *ctx = (dynamic_data_ctx *)ptr;
+                if(ctx->dynamic_dso)
+                        DSO_free(ctx->dynamic_dso);
+                if(ctx->DYNAMIC_LIBNAME)
+                        OPENSSL_free((void*)ctx->DYNAMIC_LIBNAME);
+                if(ctx->engine_id)
+                        OPENSSL_free((void*)ctx->engine_id);
+                if(ctx->dirs)
+                        sk_OPENSSL_STRING_pop_free(ctx->dirs, int_free_str);
+                OPENSSL_free(ctx);
+                }
+        }
+
+/* Construct the per-ENGINE context. We create it blindly and then use a lock to
+ * check for a race - if so, all but one of the threads "racing" will have
+ * wasted their time. The alternative involves creating everything inside the
+ * lock which is far worse. */
+static int dynamic_set_data_ctx(ENGINE *e, dynamic_data_ctx **ctx)
+        {
+        dynamic_data_ctx *c;
+        c = OPENSSL_malloc(sizeof(dynamic_data_ctx));
+        if(!c)
+                {
+                ENGINEerr(ENGINE_F_DYNAMIC_SET_DATA_CTX,ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        memset(c, 0, sizeof(dynamic_data_ctx));
+        c->dynamic_dso = NULL;
+        c->v_check = NULL;
+        c->bind_engine = NULL;
+        c->DYNAMIC_LIBNAME = NULL;
+        c->no_vcheck = 0;
+        c->engine_id = NULL;
+        c->list_add_value = 0;
+        c->DYNAMIC_F1 = "v_check";
+        c->DYNAMIC_F2 = "bind_engine";
+        c->dir_load = 1;
+        c->dirs = sk_OPENSSL_STRING_new_null();
+        if(!c->dirs)
+                {
+                ENGINEerr(ENGINE_F_DYNAMIC_SET_DATA_CTX,ERR_R_MALLOC_FAILURE);
+                OPENSSL_free(c);
+                return 0;
+                }
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        if((*ctx = (dynamic_data_ctx *)ENGINE_get_ex_data(e,
+                                dynamic_ex_data_idx)) == NULL)
+                {
+                /* Good, we're the first */
+                ENGINE_set_ex_data(e, dynamic_ex_data_idx, c);
+                *ctx = c;
+                c = NULL;
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        /* If we lost the race to set the context, c is non-NULL and *ctx is the
+         * context of the thread that won. */
+        if(c)
+                OPENSSL_free(c);
+        return 1;
+        }
+
+/* This function retrieves the context structure from an ENGINE's "ex_data", or
+ * if it doesn't exist yet, sets it up. */
+static dynamic_data_ctx *dynamic_get_data_ctx(ENGINE *e)
+        {
+        dynamic_data_ctx *ctx;
+        if(dynamic_ex_data_idx < 0)
+                {
+                /* Create and register the ENGINE ex_data, and associate our
+                 * "free" function with it to ensure any allocated contexts get
+                 * freed when an ENGINE goes underground. */
+                int new_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL,
+                                        dynamic_data_ctx_free_func);
+                if(new_idx == -1)
+                        {
+                        ENGINEerr(ENGINE_F_DYNAMIC_GET_DATA_CTX,ENGINE_R_NO_INDEX);
+                        return NULL;
+                        }
+                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+                /* Avoid a race by checking again inside this lock */
+                if(dynamic_ex_data_idx < 0)
+                        {
+                        /* Good, someone didn't beat us to it */
+                        dynamic_ex_data_idx = new_idx;
+                        new_idx = -1;
+                        }
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                /* In theory we could "give back" the index here if
+                 * (new_idx>-1), but it's not possible and wouldn't gain us much
+                 * if it were. */
+                }
+        ctx = (dynamic_data_ctx *)ENGINE_get_ex_data(e, dynamic_ex_data_idx);
+        /* Check if the context needs to be created */
+        if((ctx == NULL) && !dynamic_set_data_ctx(e, &ctx))
+                /* "set_data" will set errors if necessary */
+                return NULL;
+        return ctx;
+        }
+
+static ENGINE *engine_dynamic(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!ENGINE_set_id(ret, engine_dynamic_id) ||
+                        !ENGINE_set_name(ret, engine_dynamic_name) ||
+                        !ENGINE_set_init_function(ret, dynamic_init) ||
+                        !ENGINE_set_finish_function(ret, dynamic_finish) ||
+                        !ENGINE_set_ctrl_function(ret, dynamic_ctrl) ||
+                        !ENGINE_set_flags(ret, ENGINE_FLAGS_BY_ID_COPY) ||
+                        !ENGINE_set_cmd_defns(ret, dynamic_cmd_defns))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_dynamic(void)
+        {
+        ENGINE *toadd = engine_dynamic();
+        if(!toadd) return;
+        ENGINE_add(toadd);
+        /* If the "add" worked, it gets a structural reference. So either way,
+         * we release our just-created reference. */
+        ENGINE_free(toadd);
+        /* If the "add" didn't work, it was probably a conflict because it was
+         * already added (eg. someone calling ENGINE_load_blah then calling
+         * ENGINE_load_builtin_engines() perhaps). */
+        ERR_clear_error();
+        }
+
+static int dynamic_init(ENGINE *e)
+        {
+        /* We always return failure - the "dyanamic" engine itself can't be used
+         * for anything. */
+        return 0;
+        }
+
+static int dynamic_finish(ENGINE *e)
+        {
+        /* This should never be called on account of "dynamic_init" always
+         * failing. */
+        return 0;
+        }
+
+static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+        {
+        dynamic_data_ctx *ctx = dynamic_get_data_ctx(e);
+        int initialised;
+        
+        if(!ctx)
+                {
+                ENGINEerr(ENGINE_F_DYNAMIC_CTRL,ENGINE_R_NOT_LOADED);
+                return 0;
+                }
+        initialised = ((ctx->dynamic_dso == NULL) ? 0 : 1);
+        /* All our control commands require the ENGINE to be uninitialised */
+        if(initialised)
+                {
+                ENGINEerr(ENGINE_F_DYNAMIC_CTRL,
+                        ENGINE_R_ALREADY_LOADED);
+                return 0;
+                }
+        switch(cmd)
+                {
+        case DYNAMIC_CMD_SO_PATH:
+                /* a NULL 'p' or a string of zero-length is the same thing */
+                if(p && (strlen((const char *)p) < 1))
+                        p = NULL;
+                if(ctx->DYNAMIC_LIBNAME)
+                        OPENSSL_free((void*)ctx->DYNAMIC_LIBNAME);
+                if(p)
+                        ctx->DYNAMIC_LIBNAME = BUF_strdup(p);
+                else
+                        ctx->DYNAMIC_LIBNAME = NULL;
+                return (ctx->DYNAMIC_LIBNAME ? 1 : 0);
+        case DYNAMIC_CMD_NO_VCHECK:
+                ctx->no_vcheck = ((i == 0) ? 0 : 1);
+                return 1;
+        case DYNAMIC_CMD_ID:
+                /* a NULL 'p' or a string of zero-length is the same thing */
+                if(p && (strlen((const char *)p) < 1))
+                        p = NULL;
+                if(ctx->engine_id)
+                        OPENSSL_free((void*)ctx->engine_id);
+                if(p)
+                        ctx->engine_id = BUF_strdup(p);
+                else
+                        ctx->engine_id = NULL;
+                return (ctx->engine_id ? 1 : 0);
+        case DYNAMIC_CMD_LIST_ADD:
+                if((i < 0) || (i > 2))
+                        {
+                        ENGINEerr(ENGINE_F_DYNAMIC_CTRL,
+                                ENGINE_R_INVALID_ARGUMENT);
+                        return 0;
+                        }
+                ctx->list_add_value = (int)i;
+                return 1;
+        case DYNAMIC_CMD_LOAD:
+                return dynamic_load(e, ctx);
+        case DYNAMIC_CMD_DIR_LOAD:
+                if((i < 0) || (i > 2))
+                        {
+                        ENGINEerr(ENGINE_F_DYNAMIC_CTRL,
+                                ENGINE_R_INVALID_ARGUMENT);
+                        return 0;
+                        }
+                ctx->dir_load = (int)i;
+                return 1;
+        case DYNAMIC_CMD_DIR_ADD:
+                /* a NULL 'p' or a string of zero-length is the same thing */
+                if(!p || (strlen((const char *)p) < 1))
+                        {
+                        ENGINEerr(ENGINE_F_DYNAMIC_CTRL,
+                                ENGINE_R_INVALID_ARGUMENT);
+                        return 0;
+                        }
+                {
+                char *tmp_str = BUF_strdup(p);
+                if(!tmp_str)
+                        {
+                        ENGINEerr(ENGINE_F_DYNAMIC_CTRL,
+                                ERR_R_MALLOC_FAILURE);
+                        return 0;
+                        }
+                sk_OPENSSL_STRING_insert(ctx->dirs, tmp_str, -1);
+                }
+                return 1;
+        default:
+                break;
+                }
+        ENGINEerr(ENGINE_F_DYNAMIC_CTRL,ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+        return 0;
+        }
+
+static int int_load(dynamic_data_ctx *ctx)
+        {
+        int num, loop;
+        /* Unless told not to, try a direct load */
+        if((ctx->dir_load != 2) && (DSO_load(ctx->dynamic_dso,
+                                ctx->DYNAMIC_LIBNAME, NULL, 0)) != NULL)
+                return 1;
+        /* If we're not allowed to use 'dirs' or we have none, fail */
+        if(!ctx->dir_load || (num = sk_OPENSSL_STRING_num(ctx->dirs)) < 1)
+                return 0;
+        for(loop = 0; loop < num; loop++)
+                {
+                const char *s = sk_OPENSSL_STRING_value(ctx->dirs, loop);
+                char *merge = DSO_merge(ctx->dynamic_dso, ctx->DYNAMIC_LIBNAME, s);
+                if(!merge)
+                        return 0;
+                if(DSO_load(ctx->dynamic_dso, merge, NULL, 0))
+                        {
+                        /* Found what we're looking for */
+                        OPENSSL_free(merge);
+                        return 1;
+                        }
+                OPENSSL_free(merge);
+                }
+        return 0;
+        }
+
+static int dynamic_load(ENGINE *e, dynamic_data_ctx *ctx)
+        {
+        ENGINE cpy;
+        dynamic_fns fns;
+
+        if(!ctx->dynamic_dso)
+                ctx->dynamic_dso = DSO_new();
+        if(!ctx->DYNAMIC_LIBNAME)
+                {
+                if(!ctx->engine_id)
+                        return 0;
+                ctx->DYNAMIC_LIBNAME =
+                        DSO_convert_filename(ctx->dynamic_dso, ctx->engine_id);
+                }
+        if(!int_load(ctx))
+                {
+                ENGINEerr(ENGINE_F_DYNAMIC_LOAD,
+                        ENGINE_R_DSO_NOT_FOUND);
+                DSO_free(ctx->dynamic_dso);
+                ctx->dynamic_dso = NULL;
+                return 0;
+                }
+        /* We have to find a bind function otherwise it'll always end badly */
+        if(!(ctx->bind_engine = (dynamic_bind_engine)DSO_bind_func(
+                                        ctx->dynamic_dso, ctx->DYNAMIC_F2)))
+                {
+                ctx->bind_engine = NULL;
+                DSO_free(ctx->dynamic_dso);
+                ctx->dynamic_dso = NULL;
+                ENGINEerr(ENGINE_F_DYNAMIC_LOAD,
+                        ENGINE_R_DSO_FAILURE);
+                return 0;
+                }
+        /* Do we perform version checking? */
+        if(!ctx->no_vcheck)
+                {
+                unsigned long vcheck_res = 0;
+                /* Now we try to find a version checking function and decide how
+                 * to cope with failure if/when it fails. */
+                ctx->v_check = (dynamic_v_check_fn)DSO_bind_func(
+                                ctx->dynamic_dso, ctx->DYNAMIC_F1);
+                if(ctx->v_check)
+                        vcheck_res = ctx->v_check(OSSL_DYNAMIC_VERSION);
+                /* We fail if the version checker veto'd the load *or* if it is
+                 * deferring to us (by returning its version) and we think it is
+                 * too old. */
+                if(vcheck_res < OSSL_DYNAMIC_OLDEST)
+                        {
+                        /* Fail */
+                        ctx->bind_engine = NULL;
+                        ctx->v_check = NULL;
+                        DSO_free(ctx->dynamic_dso);
+                        ctx->dynamic_dso = NULL;
+                        ENGINEerr(ENGINE_F_DYNAMIC_LOAD,
+                                ENGINE_R_VERSION_INCOMPATIBILITY);
+                        return 0;
+                        }
+                }
+        /* First binary copy the ENGINE structure so that we can roll back if
+         * the hand-over fails */
+        memcpy(&cpy, e, sizeof(ENGINE));
+        /* Provide the ERR, "ex_data", memory, and locking callbacks so the
+         * loaded library uses our state rather than its own. FIXME: As noted in
+         * engine.h, much of this would be simplified if each area of code
+         * provided its own "summary" structure of all related callbacks. It
+         * would also increase opaqueness. */
+        fns.static_state = ENGINE_get_static_state();
+        fns.err_fns = ERR_get_implementation();
+        fns.ex_data_fns = CRYPTO_get_ex_data_implementation();
+        CRYPTO_get_mem_functions(&fns.mem_fns.malloc_cb,
+                                &fns.mem_fns.realloc_cb,
+                                &fns.mem_fns.free_cb);
+        fns.lock_fns.lock_locking_cb = CRYPTO_get_locking_callback();
+        fns.lock_fns.lock_add_lock_cb = CRYPTO_get_add_lock_callback();
+        fns.lock_fns.dynlock_create_cb = CRYPTO_get_dynlock_create_callback();
+        fns.lock_fns.dynlock_lock_cb = CRYPTO_get_dynlock_lock_callback();
+        fns.lock_fns.dynlock_destroy_cb = CRYPTO_get_dynlock_destroy_callback();
+        /* Now that we've loaded the dynamic engine, make sure no "dynamic"
+         * ENGINE elements will show through. */
+        engine_set_all_null(e);
+
+        /* Try to bind the ENGINE onto our own ENGINE structure */
+        if(!ctx->bind_engine(e, ctx->engine_id, &fns))
+                {
+                ctx->bind_engine = NULL;
+                ctx->v_check = NULL;
+                DSO_free(ctx->dynamic_dso);
+                ctx->dynamic_dso = NULL;
+                ENGINEerr(ENGINE_F_DYNAMIC_LOAD,ENGINE_R_INIT_FAILED);
+                /* Copy the original ENGINE structure back */
+                memcpy(e, &cpy, sizeof(ENGINE));
+                return 0;
+                }
+        /* Do we try to add this ENGINE to the internal list too? */
+        if(ctx->list_add_value > 0)
+                {
+                if(!ENGINE_add(e))
+                        {
+                        /* Do we tolerate this or fail? */
+                        if(ctx->list_add_value > 1)
+                                {
+                                /* Fail - NB: By this time, it's too late to
+                                 * rollback, and trying to do so allows the
+                                 * bind_engine() code to have created leaks. We
+                                 * just have to fail where we are, after the
+                                 * ENGINE has changed. */
+                                ENGINEerr(ENGINE_F_DYNAMIC_LOAD,
+                                        ENGINE_R_CONFLICTING_ENGINE_ID);
+                                return 0;
+                                }
+                        /* Tolerate */
+                        ERR_clear_error();
+                        }
+                }
+        return 1;
+        }
diff --git a/src/lib/libcrypto/engine/eng_err.c b/src/lib/libcrypto/engine/eng_err.c
new file mode 100644
index 0000000000..81c70acfa8
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_err.c
@@ -0,0 +1,173 @@
+/* crypto/engine/eng_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2010 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include <openssl/engine.h>
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(ERR_LIB_ENGINE,func,0)
+#define ERR_REASON(reason) ERR_PACK(ERR_LIB_ENGINE,0,reason)
+
+static ERR_STRING_DATA ENGINE_str_functs[]=
+        {
+{ERR_FUNC(ENGINE_F_DYNAMIC_CTRL),       "DYNAMIC_CTRL"},
+{ERR_FUNC(ENGINE_F_DYNAMIC_GET_DATA_CTX),       "DYNAMIC_GET_DATA_CTX"},
+{ERR_FUNC(ENGINE_F_DYNAMIC_LOAD),       "DYNAMIC_LOAD"},
+{ERR_FUNC(ENGINE_F_DYNAMIC_SET_DATA_CTX),       "DYNAMIC_SET_DATA_CTX"},
+{ERR_FUNC(ENGINE_F_ENGINE_ADD), "ENGINE_add"},
+{ERR_FUNC(ENGINE_F_ENGINE_BY_ID),       "ENGINE_by_id"},
+{ERR_FUNC(ENGINE_F_ENGINE_CMD_IS_EXECUTABLE),   "ENGINE_cmd_is_executable"},
+{ERR_FUNC(ENGINE_F_ENGINE_CTRL),        "ENGINE_ctrl"},
+{ERR_FUNC(ENGINE_F_ENGINE_CTRL_CMD),    "ENGINE_ctrl_cmd"},
+{ERR_FUNC(ENGINE_F_ENGINE_CTRL_CMD_STRING),     "ENGINE_ctrl_cmd_string"},
+{ERR_FUNC(ENGINE_F_ENGINE_FINISH),      "ENGINE_finish"},
+{ERR_FUNC(ENGINE_F_ENGINE_FREE_UTIL),   "ENGINE_FREE_UTIL"},
+{ERR_FUNC(ENGINE_F_ENGINE_GET_CIPHER),  "ENGINE_get_cipher"},
+{ERR_FUNC(ENGINE_F_ENGINE_GET_DEFAULT_TYPE),    "ENGINE_GET_DEFAULT_TYPE"},
+{ERR_FUNC(ENGINE_F_ENGINE_GET_DIGEST),  "ENGINE_get_digest"},
+{ERR_FUNC(ENGINE_F_ENGINE_GET_NEXT),    "ENGINE_get_next"},
+{ERR_FUNC(ENGINE_F_ENGINE_GET_PKEY_ASN1_METH),  "ENGINE_get_pkey_asn1_meth"},
+{ERR_FUNC(ENGINE_F_ENGINE_GET_PKEY_METH),       "ENGINE_get_pkey_meth"},
+{ERR_FUNC(ENGINE_F_ENGINE_GET_PREV),    "ENGINE_get_prev"},
+{ERR_FUNC(ENGINE_F_ENGINE_INIT),        "ENGINE_init"},
+{ERR_FUNC(ENGINE_F_ENGINE_LIST_ADD),    "ENGINE_LIST_ADD"},
+{ERR_FUNC(ENGINE_F_ENGINE_LIST_REMOVE), "ENGINE_LIST_REMOVE"},
+{ERR_FUNC(ENGINE_F_ENGINE_LOAD_PRIVATE_KEY),    "ENGINE_load_private_key"},
+{ERR_FUNC(ENGINE_F_ENGINE_LOAD_PUBLIC_KEY),     "ENGINE_load_public_key"},
+{ERR_FUNC(ENGINE_F_ENGINE_LOAD_SSL_CLIENT_CERT),        "ENGINE_load_ssl_client_cert"},
+{ERR_FUNC(ENGINE_F_ENGINE_NEW), "ENGINE_new"},
+{ERR_FUNC(ENGINE_F_ENGINE_REMOVE),      "ENGINE_remove"},
+{ERR_FUNC(ENGINE_F_ENGINE_SET_DEFAULT_STRING),  "ENGINE_set_default_string"},
+{ERR_FUNC(ENGINE_F_ENGINE_SET_DEFAULT_TYPE),    "ENGINE_SET_DEFAULT_TYPE"},
+{ERR_FUNC(ENGINE_F_ENGINE_SET_ID),      "ENGINE_set_id"},
+{ERR_FUNC(ENGINE_F_ENGINE_SET_NAME),    "ENGINE_set_name"},
+{ERR_FUNC(ENGINE_F_ENGINE_TABLE_REGISTER),      "ENGINE_TABLE_REGISTER"},
+{ERR_FUNC(ENGINE_F_ENGINE_UNLOAD_KEY),  "ENGINE_UNLOAD_KEY"},
+{ERR_FUNC(ENGINE_F_ENGINE_UNLOCKED_FINISH),     "ENGINE_UNLOCKED_FINISH"},
+{ERR_FUNC(ENGINE_F_ENGINE_UP_REF),      "ENGINE_up_ref"},
+{ERR_FUNC(ENGINE_F_INT_CTRL_HELPER),    "INT_CTRL_HELPER"},
+{ERR_FUNC(ENGINE_F_INT_ENGINE_CONFIGURE),       "INT_ENGINE_CONFIGURE"},
+{ERR_FUNC(ENGINE_F_INT_ENGINE_MODULE_INIT),     "INT_ENGINE_MODULE_INIT"},
+{ERR_FUNC(ENGINE_F_LOG_MESSAGE),        "LOG_MESSAGE"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA ENGINE_str_reasons[]=
+        {
+{ERR_REASON(ENGINE_R_ALREADY_LOADED)     ,"already loaded"},
+{ERR_REASON(ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER),"argument is not a number"},
+{ERR_REASON(ENGINE_R_CMD_NOT_EXECUTABLE) ,"cmd not executable"},
+{ERR_REASON(ENGINE_R_COMMAND_TAKES_INPUT),"command takes input"},
+{ERR_REASON(ENGINE_R_COMMAND_TAKES_NO_INPUT),"command takes no input"},
+{ERR_REASON(ENGINE_R_CONFLICTING_ENGINE_ID),"conflicting engine id"},
+{ERR_REASON(ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED),"ctrl command not implemented"},
+{ERR_REASON(ENGINE_R_DH_NOT_IMPLEMENTED) ,"dh not implemented"},
+{ERR_REASON(ENGINE_R_DSA_NOT_IMPLEMENTED),"dsa not implemented"},
+{ERR_REASON(ENGINE_R_DSO_FAILURE)        ,"DSO failure"},
+{ERR_REASON(ENGINE_R_DSO_NOT_FOUND)      ,"dso not found"},
+{ERR_REASON(ENGINE_R_ENGINES_SECTION_ERROR),"engines section error"},
+{ERR_REASON(ENGINE_R_ENGINE_CONFIGURATION_ERROR),"engine configuration error"},
+{ERR_REASON(ENGINE_R_ENGINE_IS_NOT_IN_LIST),"engine is not in the list"},
+{ERR_REASON(ENGINE_R_ENGINE_SECTION_ERROR),"engine section error"},
+{ERR_REASON(ENGINE_R_FAILED_LOADING_PRIVATE_KEY),"failed loading private key"},
+{ERR_REASON(ENGINE_R_FAILED_LOADING_PUBLIC_KEY),"failed loading public key"},
+{ERR_REASON(ENGINE_R_FINISH_FAILED)      ,"finish failed"},
+{ERR_REASON(ENGINE_R_GET_HANDLE_FAILED)  ,"could not obtain hardware handle"},
+{ERR_REASON(ENGINE_R_ID_OR_NAME_MISSING) ,"'id' or 'name' missing"},
+{ERR_REASON(ENGINE_R_INIT_FAILED)        ,"init failed"},
+{ERR_REASON(ENGINE_R_INTERNAL_LIST_ERROR),"internal list error"},
+{ERR_REASON(ENGINE_R_INVALID_ARGUMENT)   ,"invalid argument"},
+{ERR_REASON(ENGINE_R_INVALID_CMD_NAME)   ,"invalid cmd name"},
+{ERR_REASON(ENGINE_R_INVALID_CMD_NUMBER) ,"invalid cmd number"},
+{ERR_REASON(ENGINE_R_INVALID_INIT_VALUE) ,"invalid init value"},
+{ERR_REASON(ENGINE_R_INVALID_STRING)     ,"invalid string"},
+{ERR_REASON(ENGINE_R_NOT_INITIALISED)    ,"not initialised"},
+{ERR_REASON(ENGINE_R_NOT_LOADED)         ,"not loaded"},
+{ERR_REASON(ENGINE_R_NO_CONTROL_FUNCTION),"no control function"},
+{ERR_REASON(ENGINE_R_NO_INDEX)           ,"no index"},
+{ERR_REASON(ENGINE_R_NO_LOAD_FUNCTION)   ,"no load function"},
+{ERR_REASON(ENGINE_R_NO_REFERENCE)       ,"no reference"},
+{ERR_REASON(ENGINE_R_NO_SUCH_ENGINE)     ,"no such engine"},
+{ERR_REASON(ENGINE_R_NO_UNLOAD_FUNCTION) ,"no unload function"},
+{ERR_REASON(ENGINE_R_PROVIDE_PARAMETERS) ,"provide parameters"},
+{ERR_REASON(ENGINE_R_RSA_NOT_IMPLEMENTED),"rsa not implemented"},
+{ERR_REASON(ENGINE_R_UNIMPLEMENTED_CIPHER),"unimplemented cipher"},
+{ERR_REASON(ENGINE_R_UNIMPLEMENTED_DIGEST),"unimplemented digest"},
+{ERR_REASON(ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD),"unimplemented public key method"},
+{ERR_REASON(ENGINE_R_VERSION_INCOMPATIBILITY),"version incompatibility"},
+{0,NULL}
+        };
+
+#endif
+
+void ERR_load_ENGINE_strings(void)
+        {
+#ifndef OPENSSL_NO_ERR
+
+        if (ERR_func_error_string(ENGINE_str_functs[0].error) == NULL)
+                {
+                ERR_load_strings(0,ENGINE_str_functs);
+                ERR_load_strings(0,ENGINE_str_reasons);
+                }
+#endif
+        }
diff --git a/src/lib/libcrypto/engine/eng_fat.c b/src/lib/libcrypto/engine/eng_fat.c
new file mode 100644
index 0000000000..db66e62350
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_fat.c
@@ -0,0 +1,181 @@
+/* crypto/engine/eng_fat.c */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
+
+#include "eng_int.h"
+#include <openssl/conf.h>
+
+int ENGINE_set_default(ENGINE *e, unsigned int flags)
+        {
+        if((flags & ENGINE_METHOD_CIPHERS) && !ENGINE_set_default_ciphers(e))
+                return 0;
+        if((flags & ENGINE_METHOD_DIGESTS) && !ENGINE_set_default_digests(e))
+                return 0;
+#ifndef OPENSSL_NO_RSA
+        if((flags & ENGINE_METHOD_RSA) && !ENGINE_set_default_RSA(e))
+                return 0;
+#endif
+#ifndef OPENSSL_NO_DSA
+        if((flags & ENGINE_METHOD_DSA) && !ENGINE_set_default_DSA(e))
+                return 0;
+#endif
+#ifndef OPENSSL_NO_DH
+        if((flags & ENGINE_METHOD_DH) && !ENGINE_set_default_DH(e))
+                return 0;
+#endif
+#ifndef OPENSSL_NO_ECDH
+        if((flags & ENGINE_METHOD_ECDH) && !ENGINE_set_default_ECDH(e))
+                return 0;
+#endif
+#ifndef OPENSSL_NO_ECDSA
+        if((flags & ENGINE_METHOD_ECDSA) && !ENGINE_set_default_ECDSA(e))
+                return 0;
+#endif
+        if((flags & ENGINE_METHOD_RAND) && !ENGINE_set_default_RAND(e))
+                return 0;
+        if((flags & ENGINE_METHOD_PKEY_METHS)
+                                && !ENGINE_set_default_pkey_meths(e))
+                return 0;
+        if((flags & ENGINE_METHOD_PKEY_ASN1_METHS)
+                                && !ENGINE_set_default_pkey_asn1_meths(e))
+                return 0;
+        return 1;
+        }
+
+/* Set default algorithms using a string */
+
+static int int_def_cb(const char *alg, int len, void *arg)
+        {
+        unsigned int *pflags = arg;
+        if (!strncmp(alg, "ALL", len))
+                *pflags |= ENGINE_METHOD_ALL;
+        else if (!strncmp(alg, "RSA", len))
+                *pflags |= ENGINE_METHOD_RSA;
+        else if (!strncmp(alg, "DSA", len))
+                *pflags |= ENGINE_METHOD_DSA;
+        else if (!strncmp(alg, "ECDH", len))
+                *pflags |= ENGINE_METHOD_ECDH;
+        else if (!strncmp(alg, "ECDSA", len))
+                *pflags |= ENGINE_METHOD_ECDSA;
+        else if (!strncmp(alg, "DH", len))
+                *pflags |= ENGINE_METHOD_DH;
+        else if (!strncmp(alg, "RAND", len))
+                *pflags |= ENGINE_METHOD_RAND;
+        else if (!strncmp(alg, "CIPHERS", len))
+                *pflags |= ENGINE_METHOD_CIPHERS;
+        else if (!strncmp(alg, "DIGESTS", len))
+                *pflags |= ENGINE_METHOD_DIGESTS;
+        else if (!strncmp(alg, "PKEY", len))
+                *pflags |=
+                        ENGINE_METHOD_PKEY_METHS|ENGINE_METHOD_PKEY_ASN1_METHS;
+        else if (!strncmp(alg, "PKEY_CRYPTO", len))
+                *pflags |= ENGINE_METHOD_PKEY_METHS;
+        else if (!strncmp(alg, "PKEY_ASN1", len))
+                *pflags |= ENGINE_METHOD_PKEY_ASN1_METHS;
+        else
+                return 0;
+        return 1;
+        }
+
+
+int ENGINE_set_default_string(ENGINE *e, const char *def_list)
+        {
+        unsigned int flags = 0;
+        if (!CONF_parse_list(def_list, ',', 1, int_def_cb, &flags))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_SET_DEFAULT_STRING,
+                                        ENGINE_R_INVALID_STRING);
+                ERR_add_error_data(2, "str=",def_list);
+                return 0;
+                }
+        return ENGINE_set_default(e, flags);
+        }
+
+int ENGINE_register_complete(ENGINE *e)
+        {
+        ENGINE_register_ciphers(e);
+        ENGINE_register_digests(e);
+#ifndef OPENSSL_NO_RSA
+        ENGINE_register_RSA(e);
+#endif
+#ifndef OPENSSL_NO_DSA
+        ENGINE_register_DSA(e);
+#endif
+#ifndef OPENSSL_NO_DH
+        ENGINE_register_DH(e);
+#endif
+#ifndef OPENSSL_NO_ECDH
+        ENGINE_register_ECDH(e);
+#endif
+#ifndef OPENSSL_NO_ECDSA
+        ENGINE_register_ECDSA(e);
+#endif
+        ENGINE_register_RAND(e);
+        ENGINE_register_pkey_meths(e);
+        return 1;
+        }
+
+int ENGINE_register_all_complete(void)
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_complete(e);
+        return 1;
+        }
diff --git a/src/lib/libcrypto/engine/eng_init.c b/src/lib/libcrypto/engine/eng_init.c
new file mode 100644
index 0000000000..7633cf5f1d
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_init.c
@@ -0,0 +1,154 @@
+/* crypto/engine/eng_init.c */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+
+/* Initialise a engine type for use (or up its functional reference count
+ * if it's already in use). This version is only used internally. */
+int engine_unlocked_init(ENGINE *e)
+        {
+        int to_return = 1;
+
+        if((e->funct_ref == 0) && e->init)
+                /* This is the first functional reference and the engine
+                 * requires initialisation so we do it now. */
+                to_return = e->init(e);
+        if(to_return)
+                {
+                /* OK, we return a functional reference which is also a
+                 * structural reference. */
+                e->struct_ref++;
+                e->funct_ref++;
+                engine_ref_debug(e, 0, 1)
+                engine_ref_debug(e, 1, 1)
+                }
+        return to_return;
+        }
+
+/* Free a functional reference to a engine type. This version is only used
+ * internally. */
+int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers)
+        {
+        int to_return = 1;
+
+        /* Reduce the functional reference count here so if it's the terminating
+         * case, we can release the lock safely and call the finish() handler
+         * without risk of a race. We get a race if we leave the count until
+         * after and something else is calling "finish" at the same time -
+         * there's a chance that both threads will together take the count from
+         * 2 to 0 without either calling finish(). */
+        e->funct_ref--;
+        engine_ref_debug(e, 1, -1);
+        if((e->funct_ref == 0) && e->finish)
+                {
+                if(unlock_for_handlers)
+                        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                to_return = e->finish(e);
+                if(unlock_for_handlers)
+                        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+                if(!to_return)
+                        return 0;
+                }
+#ifdef REF_CHECK
+        if(e->funct_ref < 0)
+                {
+                fprintf(stderr,"ENGINE_finish, bad functional reference count\n");
+                abort();
+                }
+#endif
+        /* Release the structural reference too */
+        if(!engine_free_util(e, 0))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_UNLOCKED_FINISH,ENGINE_R_FINISH_FAILED);
+                return 0;
+                }
+        return to_return;
+        }
+
+/* The API (locked) version of "init" */
+int ENGINE_init(ENGINE *e)
+        {
+        int ret;
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_INIT,ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        ret = engine_unlocked_init(e);
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        return ret;
+        }
+
+/* The API (locked) version of "finish" */
+int ENGINE_finish(ENGINE *e)
+        {
+        int to_return = 1;
+
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_FINISH,ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        to_return = engine_unlocked_finish(e, 1);
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        if(!to_return)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_FINISH,ENGINE_R_FINISH_FAILED);
+                return 0;
+                }
+        return to_return;
+        }
diff --git a/src/lib/libcrypto/engine/eng_int.h b/src/lib/libcrypto/engine/eng_int.h
new file mode 100644
index 0000000000..451ef8feb8
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_int.h
@@ -0,0 +1,206 @@
+/* crypto/engine/eng_int.h */
+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
+ * project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
+
+#ifndef HEADER_ENGINE_INT_H
+#define HEADER_ENGINE_INT_H
+
+#include "cryptlib.h"
+/* Take public definitions from engine.h */
+#include <openssl/engine.h>
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* If we compile with this symbol defined, then both reference counts in the
+ * ENGINE structure will be monitored with a line of output on stderr for each
+ * change. This prints the engine's pointer address (truncated to unsigned int),
+ * "struct" or "funct" to indicate the reference type, the before and after
+ * reference count, and the file:line-number pair. The "engine_ref_debug"
+ * statements must come *after* the change. */
+#ifdef ENGINE_REF_COUNT_DEBUG
+
+#define engine_ref_debug(e, isfunct, diff) \
+        fprintf(stderr, "engine: %08x %s from %d to %d (%s:%d)\n", \
+                (unsigned int)(e), (isfunct ? "funct" : "struct"), \
+                ((isfunct) ? ((e)->funct_ref - (diff)) : ((e)->struct_ref - (diff))), \
+                ((isfunct) ? (e)->funct_ref : (e)->struct_ref), \
+                (__FILE__), (__LINE__));
+
+#else
+
+#define engine_ref_debug(e, isfunct, diff)
+
+#endif
+
+/* Any code that will need cleanup operations should use these functions to
+ * register callbacks. ENGINE_cleanup() will call all registered callbacks in
+ * order. NB: both the "add" functions assume CRYPTO_LOCK_ENGINE to already be
+ * held (in "write" mode). */
+typedef void (ENGINE_CLEANUP_CB)(void);
+typedef struct st_engine_cleanup_item
+        {
+        ENGINE_CLEANUP_CB *cb;
+        } ENGINE_CLEANUP_ITEM;
+DECLARE_STACK_OF(ENGINE_CLEANUP_ITEM)
+void engine_cleanup_add_first(ENGINE_CLEANUP_CB *cb);
+void engine_cleanup_add_last(ENGINE_CLEANUP_CB *cb);
+
+/* We need stacks of ENGINEs for use in eng_table.c */
+DECLARE_STACK_OF(ENGINE)
+
+/* If this symbol is defined then engine_table_select(), the function that is
+ * used by RSA, DSA (etc) code to select registered ENGINEs, cache defaults and
+ * functional references (etc), will display debugging summaries to stderr. */
+/* #define ENGINE_TABLE_DEBUG */
+
+/* This represents an implementation table. Dependent code should instantiate it
+ * as a (ENGINE_TABLE *) pointer value set initially to NULL. */
+typedef struct st_engine_table ENGINE_TABLE;
+int engine_table_register(ENGINE_TABLE **table, ENGINE_CLEANUP_CB *cleanup,
+                ENGINE *e, const int *nids, int num_nids, int setdefault);
+void engine_table_unregister(ENGINE_TABLE **table, ENGINE *e);
+void engine_table_cleanup(ENGINE_TABLE **table);
+#ifndef ENGINE_TABLE_DEBUG
+ENGINE *engine_table_select(ENGINE_TABLE **table, int nid);
+#else
+ENGINE *engine_table_select_tmp(ENGINE_TABLE **table, int nid, const char *f, int l);
+#define engine_table_select(t,n) engine_table_select_tmp(t,n,__FILE__,__LINE__)
+#endif
+typedef void (engine_table_doall_cb)(int nid, STACK_OF(ENGINE) *sk, ENGINE *def, void *arg);
+void engine_table_doall(ENGINE_TABLE *table, engine_table_doall_cb *cb, void *arg);
+
+/* Internal versions of API functions that have control over locking. These are
+ * used between C files when functionality needs to be shared but the caller may
+ * already be controlling of the CRYPTO_LOCK_ENGINE lock. */
+int engine_unlocked_init(ENGINE *e);
+int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers);
+int engine_free_util(ENGINE *e, int locked);
+
+/* This function will reset all "set"able values in an ENGINE to NULL. This
+ * won't touch reference counts or ex_data, but is equivalent to calling all the
+ * ENGINE_set_***() functions with a NULL value. */
+void engine_set_all_null(ENGINE *e);
+
+/* NB: Bitwise OR-able values for the "flags" variable in ENGINE are now exposed
+ * in engine.h. */
+
+/* Free up dynamically allocated public key methods associated with ENGINE */
+
+void engine_pkey_meths_free(ENGINE *e);
+void engine_pkey_asn1_meths_free(ENGINE *e);
+
+/* This is a structure for storing implementations of various crypto
+ * algorithms and functions. */
+struct engine_st
+        {
+        const char *id;
+        const char *name;
+        const RSA_METHOD *rsa_meth;
+        const DSA_METHOD *dsa_meth;
+        const DH_METHOD *dh_meth;
+        const ECDH_METHOD *ecdh_meth;
+        const ECDSA_METHOD *ecdsa_meth;
+        const RAND_METHOD *rand_meth;
+        const STORE_METHOD *store_meth;
+        /* Cipher handling is via this callback */
+        ENGINE_CIPHERS_PTR ciphers;
+        /* Digest handling is via this callback */
+        ENGINE_DIGESTS_PTR digests;
+        /* Public key handling via this callback */
+        ENGINE_PKEY_METHS_PTR pkey_meths;
+        /* ASN1 public key handling via this callback */
+        ENGINE_PKEY_ASN1_METHS_PTR pkey_asn1_meths;
+
+        ENGINE_GEN_INT_FUNC_PTR destroy;
+
+        ENGINE_GEN_INT_FUNC_PTR init;
+        ENGINE_GEN_INT_FUNC_PTR finish;
+        ENGINE_CTRL_FUNC_PTR ctrl;
+        ENGINE_LOAD_KEY_PTR load_privkey;
+        ENGINE_LOAD_KEY_PTR load_pubkey;
+
+        ENGINE_SSL_CLIENT_CERT_PTR load_ssl_client_cert;
+
+        const ENGINE_CMD_DEFN *cmd_defns;
+        int flags;
+        /* reference count on the structure itself */
+        int struct_ref;
+        /* reference count on usability of the engine type. NB: This
+         * controls the loading and initialisation of any functionlity
+         * required by this engine, whereas the previous count is
+         * simply to cope with (de)allocation of this structure. Hence,
+         * running_ref <= struct_ref at all times. */
+        int funct_ref;
+        /* A place to store per-ENGINE data */
+        CRYPTO_EX_DATA ex_data;
+        /* Used to maintain the linked-list of engines. */
+        struct engine_st *prev;
+        struct engine_st *next;
+        };
+
+#ifdef  __cplusplus
+}
+#endif
+
+#endif /* HEADER_ENGINE_INT_H */
diff --git a/src/lib/libcrypto/engine/eng_lib.c b/src/lib/libcrypto/engine/eng_lib.c
new file mode 100644
index 0000000000..18a6664645
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_lib.c
@@ -0,0 +1,332 @@
+/* crypto/engine/eng_lib.c */
+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
+ * project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+#include <openssl/rand.h>
+
+/* The "new"/"free" stuff first */
+
+ENGINE *ENGINE_new(void)
+        {
+        ENGINE *ret;
+
+        ret = (ENGINE *)OPENSSL_malloc(sizeof(ENGINE));
+        if(ret == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_NEW, ERR_R_MALLOC_FAILURE);
+                return NULL;
+                }
+        memset(ret, 0, sizeof(ENGINE));
+        ret->struct_ref = 1;
+        engine_ref_debug(ret, 0, 1)
+        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_ENGINE, ret, &ret->ex_data);
+        return ret;
+        }
+
+/* Placed here (close proximity to ENGINE_new) so that modifications to the
+ * elements of the ENGINE structure are more likely to be caught and changed
+ * here. */
+void engine_set_all_null(ENGINE *e)
+        {
+        e->id = NULL;
+        e->name = NULL;
+        e->rsa_meth = NULL;
+        e->dsa_meth = NULL;
+        e->dh_meth = NULL;
+        e->rand_meth = NULL;
+        e->store_meth = NULL;
+        e->ciphers = NULL;
+        e->digests = NULL;
+        e->destroy = NULL;
+        e->init = NULL;
+        e->finish = NULL;
+        e->ctrl = NULL;
+        e->load_privkey = NULL;
+        e->load_pubkey = NULL;
+        e->cmd_defns = NULL;
+        e->flags = 0;
+        }
+
+int engine_free_util(ENGINE *e, int locked)
+        {
+        int i;
+
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_FREE_UTIL,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if(locked)
+                i = CRYPTO_add(&e->struct_ref,-1,CRYPTO_LOCK_ENGINE);
+        else
+                i = --e->struct_ref;
+        engine_ref_debug(e, 0, -1)
+        if (i > 0) return 1;
+#ifdef REF_CHECK
+        if (i < 0)
+                {
+                fprintf(stderr,"ENGINE_free, bad structural reference count\n");
+                abort();
+                }
+#endif
+        /* Free up any dynamically allocated public key methods */
+        engine_pkey_meths_free(e);
+        engine_pkey_asn1_meths_free(e);
+        /* Give the ENGINE a chance to do any structural cleanup corresponding
+         * to allocation it did in its constructor (eg. unload error strings) */
+        if(e->destroy)
+                e->destroy(e);
+        CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ENGINE, e, &e->ex_data);
+        OPENSSL_free(e);
+        return 1;
+        }
+
+int ENGINE_free(ENGINE *e)
+        {
+        return engine_free_util(e, 1);
+        }
+
+/* Cleanup stuff */
+
+/* ENGINE_cleanup() is coded such that anything that does work that will need
+ * cleanup can register a "cleanup" callback here. That way we don't get linker
+ * bloat by referring to all *possible* cleanups, but any linker bloat into code
+ * "X" will cause X's cleanup function to end up here. */
+static STACK_OF(ENGINE_CLEANUP_ITEM) *cleanup_stack = NULL;
+static int int_cleanup_check(int create)
+        {
+        if(cleanup_stack) return 1;
+        if(!create) return 0;
+        cleanup_stack = sk_ENGINE_CLEANUP_ITEM_new_null();
+        return (cleanup_stack ? 1 : 0);
+        }
+static ENGINE_CLEANUP_ITEM *int_cleanup_item(ENGINE_CLEANUP_CB *cb)
+        {
+        ENGINE_CLEANUP_ITEM *item = OPENSSL_malloc(sizeof(
+                                        ENGINE_CLEANUP_ITEM));
+        if(!item) return NULL;
+        item->cb = cb;
+        return item;
+        }
+void engine_cleanup_add_first(ENGINE_CLEANUP_CB *cb)
+        {
+        ENGINE_CLEANUP_ITEM *item;
+        if(!int_cleanup_check(1)) return;
+        item = int_cleanup_item(cb);
+        if(item)
+                sk_ENGINE_CLEANUP_ITEM_insert(cleanup_stack, item, 0);
+        }
+void engine_cleanup_add_last(ENGINE_CLEANUP_CB *cb)
+        {
+        ENGINE_CLEANUP_ITEM *item;
+        if(!int_cleanup_check(1)) return;
+        item = int_cleanup_item(cb);
+        if(item)
+                sk_ENGINE_CLEANUP_ITEM_push(cleanup_stack, item);
+        }
+/* The API function that performs all cleanup */
+static void engine_cleanup_cb_free(ENGINE_CLEANUP_ITEM *item)
+        {
+        (*(item->cb))();
+        OPENSSL_free(item);
+        }
+void ENGINE_cleanup(void)
+        {
+        if(int_cleanup_check(0))
+                {
+                sk_ENGINE_CLEANUP_ITEM_pop_free(cleanup_stack,
+                        engine_cleanup_cb_free);
+                cleanup_stack = NULL;
+                }
+        /* FIXME: This should be handled (somehow) through RAND, eg. by it
+         * registering a cleanup callback. */
+        RAND_set_rand_method(NULL);
+        }
+
+/* Now the "ex_data" support */
+
+int ENGINE_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+                CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+        {
+        return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_ENGINE, argl, argp,
+                        new_func, dup_func, free_func);
+        }
+
+int ENGINE_set_ex_data(ENGINE *e, int idx, void *arg)
+        {
+        return(CRYPTO_set_ex_data(&e->ex_data, idx, arg));
+        }
+
+void *ENGINE_get_ex_data(const ENGINE *e, int idx)
+        {
+        return(CRYPTO_get_ex_data(&e->ex_data, idx));
+        }
+
+/* Functions to get/set an ENGINE's elements - mainly to avoid exposing the
+ * ENGINE structure itself. */
+
+int ENGINE_set_id(ENGINE *e, const char *id)
+        {
+        if(id == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_SET_ID,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        e->id = id;
+        return 1;
+        }
+
+int ENGINE_set_name(ENGINE *e, const char *name)
+        {
+        if(name == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_SET_NAME,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        e->name = name;
+        return 1;
+        }
+
+int ENGINE_set_destroy_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR destroy_f)
+        {
+        e->destroy = destroy_f;
+        return 1;
+        }
+
+int ENGINE_set_init_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR init_f)
+        {
+        e->init = init_f;
+        return 1;
+        }
+
+int ENGINE_set_finish_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR finish_f)
+        {
+        e->finish = finish_f;
+        return 1;
+        }
+
+int ENGINE_set_ctrl_function(ENGINE *e, ENGINE_CTRL_FUNC_PTR ctrl_f)
+        {
+        e->ctrl = ctrl_f;
+        return 1;
+        }
+
+int ENGINE_set_flags(ENGINE *e, int flags)
+        {
+        e->flags = flags;
+        return 1;
+        }
+
+int ENGINE_set_cmd_defns(ENGINE *e, const ENGINE_CMD_DEFN *defns)
+        {
+        e->cmd_defns = defns;
+        return 1;
+        }
+
+const char *ENGINE_get_id(const ENGINE *e)
+        {
+        return e->id;
+        }
+
+const char *ENGINE_get_name(const ENGINE *e)
+        {
+        return e->name;
+        }
+
+ENGINE_GEN_INT_FUNC_PTR ENGINE_get_destroy_function(const ENGINE *e)
+        {
+        return e->destroy;
+        }
+
+ENGINE_GEN_INT_FUNC_PTR ENGINE_get_init_function(const ENGINE *e)
+        {
+        return e->init;
+        }
+
+ENGINE_GEN_INT_FUNC_PTR ENGINE_get_finish_function(const ENGINE *e)
+        {
+        return e->finish;
+        }
+
+ENGINE_CTRL_FUNC_PTR ENGINE_get_ctrl_function(const ENGINE *e)
+        {
+        return e->ctrl;
+        }
+
+int ENGINE_get_flags(const ENGINE *e)
+        {
+        return e->flags;
+        }
+
+const ENGINE_CMD_DEFN *ENGINE_get_cmd_defns(const ENGINE *e)
+        {
+        return e->cmd_defns;
+        }
+
+/* eng_lib.o is pretty much linked into anything that touches ENGINE already, so
+ * put the "static_state" hack here. */
+
+static int internal_static_hack = 0;
+
+void *ENGINE_get_static_state(void)
+        {
+        return &internal_static_hack;
+        }
diff --git a/src/lib/libcrypto/engine/eng_list.c b/src/lib/libcrypto/engine/eng_list.c
new file mode 100644
index 0000000000..27846edb1e
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_list.c
@@ -0,0 +1,433 @@
+/* crypto/engine/eng_list.c */
+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
+ * project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
+
+#include "eng_int.h"
+
+/* The linked-list of pointers to engine types. engine_list_head
+ * incorporates an implicit structural reference but engine_list_tail
+ * does not - the latter is a computational niceity and only points
+ * to something that is already pointed to by its predecessor in the
+ * list (or engine_list_head itself). In the same way, the use of the
+ * "prev" pointer in each ENGINE is to save excessive list iteration,
+ * it doesn't correspond to an extra structural reference. Hence,
+ * engine_list_head, and each non-null "next" pointer account for
+ * the list itself assuming exactly 1 structural reference on each
+ * list member. */
+static ENGINE *engine_list_head = NULL;
+static ENGINE *engine_list_tail = NULL;
+
+/* This cleanup function is only needed internally. If it should be called, we
+ * register it with the "ENGINE_cleanup()" stack to be called during cleanup. */
+
+static void engine_list_cleanup(void)
+        {
+        ENGINE *iterator = engine_list_head;
+
+        while(iterator != NULL)
+                {
+                ENGINE_remove(iterator);
+                iterator = engine_list_head;
+                }
+        return;
+        }
+
+/* These static functions starting with a lower case "engine_" always
+ * take place when CRYPTO_LOCK_ENGINE has been locked up. */
+static int engine_list_add(ENGINE *e)
+        {
+        int conflict = 0;
+        ENGINE *iterator = NULL;
+
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_LIST_ADD,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        iterator = engine_list_head;
+        while(iterator && !conflict)
+                {
+                conflict = (strcmp(iterator->id, e->id) == 0);
+                iterator = iterator->next;
+                }
+        if(conflict)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_LIST_ADD,
+                        ENGINE_R_CONFLICTING_ENGINE_ID);
+                return 0;
+                }
+        if(engine_list_head == NULL)
+                {
+                /* We are adding to an empty list. */
+                if(engine_list_tail)
+                        {
+                        ENGINEerr(ENGINE_F_ENGINE_LIST_ADD,
+                                ENGINE_R_INTERNAL_LIST_ERROR);
+                        return 0;
+                        }
+                engine_list_head = e;
+                e->prev = NULL;
+                /* The first time the list allocates, we should register the
+                 * cleanup. */
+                engine_cleanup_add_last(engine_list_cleanup);
+                }
+        else
+                {
+                /* We are adding to the tail of an existing list. */
+                if((engine_list_tail == NULL) ||
+                                (engine_list_tail->next != NULL))
+                        {
+                        ENGINEerr(ENGINE_F_ENGINE_LIST_ADD,
+                                ENGINE_R_INTERNAL_LIST_ERROR);
+                        return 0;
+                        }
+                engine_list_tail->next = e;
+                e->prev = engine_list_tail;
+                }
+        /* Having the engine in the list assumes a structural
+         * reference. */
+        e->struct_ref++;
+        engine_ref_debug(e, 0, 1)
+        /* However it came to be, e is the last item in the list. */
+        engine_list_tail = e;
+        e->next = NULL;
+        return 1;
+        }
+
+static int engine_list_remove(ENGINE *e)
+        {
+        ENGINE *iterator;
+
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_LIST_REMOVE,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        /* We need to check that e is in our linked list! */
+        iterator = engine_list_head;
+        while(iterator && (iterator != e))
+                iterator = iterator->next;
+        if(iterator == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_LIST_REMOVE,
+                        ENGINE_R_ENGINE_IS_NOT_IN_LIST);
+                return 0;
+                }
+        /* un-link e from the chain. */
+        if(e->next)
+                e->next->prev = e->prev;
+        if(e->prev)
+                e->prev->next = e->next;
+        /* Correct our head/tail if necessary. */
+        if(engine_list_head == e)
+                engine_list_head = e->next;
+        if(engine_list_tail == e)
+                engine_list_tail = e->prev;
+        engine_free_util(e, 0);
+        return 1;
+        }
+
+/* Get the first/last "ENGINE" type available. */
+ENGINE *ENGINE_get_first(void)
+        {
+        ENGINE *ret;
+
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        ret = engine_list_head;
+        if(ret)
+                {
+                ret->struct_ref++;
+                engine_ref_debug(ret, 0, 1)
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        return ret;
+        }
+
+ENGINE *ENGINE_get_last(void)
+        {
+        ENGINE *ret;
+
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        ret = engine_list_tail;
+        if(ret)
+                {
+                ret->struct_ref++;
+                engine_ref_debug(ret, 0, 1)
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        return ret;
+        }
+
+/* Iterate to the next/previous "ENGINE" type (NULL = end of the list). */
+ENGINE *ENGINE_get_next(ENGINE *e)
+        {
+        ENGINE *ret = NULL;
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_GET_NEXT,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        ret = e->next;
+        if(ret)
+                {
+                /* Return a valid structural refernce to the next ENGINE */
+                ret->struct_ref++;
+                engine_ref_debug(ret, 0, 1)
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        /* Release the structural reference to the previous ENGINE */
+        ENGINE_free(e);
+        return ret;
+        }
+
+ENGINE *ENGINE_get_prev(ENGINE *e)
+        {
+        ENGINE *ret = NULL;
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_GET_PREV,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        ret = e->prev;
+        if(ret)
+                {
+                /* Return a valid structural reference to the next ENGINE */
+                ret->struct_ref++;
+                engine_ref_debug(ret, 0, 1)
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        /* Release the structural reference to the previous ENGINE */
+        ENGINE_free(e);
+        return ret;
+        }
+
+/* Add another "ENGINE" type into the list. */
+int ENGINE_add(ENGINE *e)
+        {
+        int to_return = 1;
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_ADD,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if((e->id == NULL) || (e->name == NULL))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_ADD,
+                        ENGINE_R_ID_OR_NAME_MISSING);
+                }
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        if(!engine_list_add(e))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_ADD,
+                        ENGINE_R_INTERNAL_LIST_ERROR);
+                to_return = 0;
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        return to_return;
+        }
+
+/* Remove an existing "ENGINE" type from the array. */
+int ENGINE_remove(ENGINE *e)
+        {
+        int to_return = 1;
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_REMOVE,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        if(!engine_list_remove(e))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_REMOVE,
+                        ENGINE_R_INTERNAL_LIST_ERROR);
+                to_return = 0;
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        return to_return;
+        }
+
+static void engine_cpy(ENGINE *dest, const ENGINE *src)
+        {
+        dest->id = src->id;
+        dest->name = src->name;
+#ifndef OPENSSL_NO_RSA
+        dest->rsa_meth = src->rsa_meth;
+#endif
+#ifndef OPENSSL_NO_DSA
+        dest->dsa_meth = src->dsa_meth;
+#endif
+#ifndef OPENSSL_NO_DH
+        dest->dh_meth = src->dh_meth;
+#endif
+#ifndef OPENSSL_NO_ECDH
+        dest->ecdh_meth = src->ecdh_meth;
+#endif
+#ifndef OPENSSL_NO_ECDSA
+        dest->ecdsa_meth = src->ecdsa_meth;
+#endif
+        dest->rand_meth = src->rand_meth;
+        dest->store_meth = src->store_meth;
+        dest->ciphers = src->ciphers;
+        dest->digests = src->digests;
+        dest->pkey_meths = src->pkey_meths;
+        dest->destroy = src->destroy;
+        dest->init = src->init;
+        dest->finish = src->finish;
+        dest->ctrl = src->ctrl;
+        dest->load_privkey = src->load_privkey;
+        dest->load_pubkey = src->load_pubkey;
+        dest->cmd_defns = src->cmd_defns;
+        dest->flags = src->flags;
+        }
+
+ENGINE *ENGINE_by_id(const char *id)
+        {
+        ENGINE *iterator;
+        char *load_dir = NULL;
+        if(id == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_BY_ID,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return NULL;
+                }
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        iterator = engine_list_head;
+        while(iterator && (strcmp(id, iterator->id) != 0))
+                iterator = iterator->next;
+        if(iterator)
+                {
+                /* We need to return a structural reference. If this is an
+                 * ENGINE type that returns copies, make a duplicate - otherwise
+                 * increment the existing ENGINE's reference count. */
+                if(iterator->flags & ENGINE_FLAGS_BY_ID_COPY)
+                        {
+                        ENGINE *cp = ENGINE_new();
+                        if(!cp)
+                                iterator = NULL;
+                        else
+                                {
+                                engine_cpy(cp, iterator);
+                                iterator = cp;
+                                }
+                        }
+                else
+                        {
+                        iterator->struct_ref++;
+                        engine_ref_debug(iterator, 0, 1)
+                        }
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+#if 0
+        if(iterator == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_BY_ID,
+                        ENGINE_R_NO_SUCH_ENGINE);
+                ERR_add_error_data(2, "id=", id);
+                }
+        return iterator;
+#else
+        /* EEK! Experimental code starts */
+        if(iterator) return iterator;
+        /* Prevent infinite recusrion if we're looking for the dynamic engine. */
+        if (strcmp(id, "dynamic"))
+                {
+#ifdef OPENSSL_SYS_VMS
+                if((load_dir = getenv("OPENSSL_ENGINES")) == 0) load_dir = "SSLROOT:[ENGINES]";
+#else
+                if((load_dir = getenv("OPENSSL_ENGINES")) == 0) load_dir = ENGINESDIR;
+#endif
+                iterator = ENGINE_by_id("dynamic");
+                if(!iterator || !ENGINE_ctrl_cmd_string(iterator, "ID", id, 0) ||
+                                !ENGINE_ctrl_cmd_string(iterator, "DIR_LOAD", "2", 0) ||
+                                !ENGINE_ctrl_cmd_string(iterator, "DIR_ADD",
+                                        load_dir, 0) ||
+                                !ENGINE_ctrl_cmd_string(iterator, "LOAD", NULL, 0))
+                                goto notfound;
+                return iterator;
+                }
+notfound:
+        ENGINE_free(iterator);
+        ENGINEerr(ENGINE_F_ENGINE_BY_ID,ENGINE_R_NO_SUCH_ENGINE);
+        ERR_add_error_data(2, "id=", id);
+        return NULL;
+        /* EEK! Experimental code ends */
+#endif
+        }
+
+int ENGINE_up_ref(ENGINE *e)
+        {
+        if (e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_UP_REF,ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        CRYPTO_add(&e->struct_ref,1,CRYPTO_LOCK_ENGINE);
+        return 1;
+        }
diff --git a/src/lib/libcrypto/engine/eng_openssl.c b/src/lib/libcrypto/engine/eng_openssl.c
new file mode 100644
index 0000000000..9abb95cc22
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_openssl.c
@@ -0,0 +1,384 @@
+/* crypto/engine/eng_openssl.c */
+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
+ * project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
+
+
+#include <stdio.h>
+#include <openssl/crypto.h>
+#include "cryptlib.h"
+#include <openssl/engine.h>
+#include <openssl/dso.h>
+#include <openssl/pem.h>
+#include <openssl/evp.h>
+#include <openssl/rand.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+
+/* This testing gunk is implemented (and explained) lower down. It also assumes
+ * the application explicitly calls "ENGINE_load_openssl()" because this is no
+ * longer automatic in ENGINE_load_builtin_engines(). */
+#define TEST_ENG_OPENSSL_RC4
+#define TEST_ENG_OPENSSL_PKEY
+/* #define TEST_ENG_OPENSSL_RC4_OTHERS */
+#define TEST_ENG_OPENSSL_RC4_P_INIT
+/* #define TEST_ENG_OPENSSL_RC4_P_CIPHER */
+#define TEST_ENG_OPENSSL_SHA
+/* #define TEST_ENG_OPENSSL_SHA_OTHERS */
+/* #define TEST_ENG_OPENSSL_SHA_P_INIT */
+/* #define TEST_ENG_OPENSSL_SHA_P_UPDATE */
+/* #define TEST_ENG_OPENSSL_SHA_P_FINAL */
+
+/* Now check what of those algorithms are actually enabled */
+#ifdef OPENSSL_NO_RC4
+#undef TEST_ENG_OPENSSL_RC4
+#undef TEST_ENG_OPENSSL_RC4_OTHERS
+#undef TEST_ENG_OPENSSL_RC4_P_INIT
+#undef TEST_ENG_OPENSSL_RC4_P_CIPHER
+#endif
+#if defined(OPENSSL_NO_SHA) || defined(OPENSSL_NO_SHA0) || defined(OPENSSL_NO_SHA1)
+#undef TEST_ENG_OPENSSL_SHA
+#undef TEST_ENG_OPENSSL_SHA_OTHERS
+#undef TEST_ENG_OPENSSL_SHA_P_INIT
+#undef TEST_ENG_OPENSSL_SHA_P_UPDATE
+#undef TEST_ENG_OPENSSL_SHA_P_FINAL 
+#endif
+
+#ifdef TEST_ENG_OPENSSL_RC4
+static int openssl_ciphers(ENGINE *e, const EVP_CIPHER **cipher,
+                                const int **nids, int nid);
+#endif
+#ifdef TEST_ENG_OPENSSL_SHA
+static int openssl_digests(ENGINE *e, const EVP_MD **digest,
+                                const int **nids, int nid);
+#endif
+
+#ifdef TEST_ENG_OPENSSL_PKEY
+static EVP_PKEY *openssl_load_privkey(ENGINE *eng, const char *key_id,
+        UI_METHOD *ui_method, void *callback_data);
+#endif
+
+/* The constants used when creating the ENGINE */
+static const char *engine_openssl_id = "openssl";
+static const char *engine_openssl_name = "Software engine support";
+
+/* This internal function is used by ENGINE_openssl() and possibly by the
+ * "dynamic" ENGINE support too */
+static int bind_helper(ENGINE *e)
+        {
+        if(!ENGINE_set_id(e, engine_openssl_id)
+                        || !ENGINE_set_name(e, engine_openssl_name)
+#ifndef TEST_ENG_OPENSSL_NO_ALGORITHMS
+#ifndef OPENSSL_NO_RSA
+                        || !ENGINE_set_RSA(e, RSA_get_default_method())
+#endif
+#ifndef OPENSSL_NO_DSA
+                        || !ENGINE_set_DSA(e, DSA_get_default_method())
+#endif
+#ifndef OPENSSL_NO_ECDH
+                        || !ENGINE_set_ECDH(e, ECDH_OpenSSL())
+#endif
+#ifndef OPENSSL_NO_ECDSA
+                        || !ENGINE_set_ECDSA(e, ECDSA_OpenSSL())
+#endif
+#ifndef OPENSSL_NO_DH
+                        || !ENGINE_set_DH(e, DH_get_default_method())
+#endif
+                        || !ENGINE_set_RAND(e, RAND_SSLeay())
+#ifdef TEST_ENG_OPENSSL_RC4
+                        || !ENGINE_set_ciphers(e, openssl_ciphers)
+#endif
+#ifdef TEST_ENG_OPENSSL_SHA
+                        || !ENGINE_set_digests(e, openssl_digests)
+#endif
+#endif
+#ifdef TEST_ENG_OPENSSL_PKEY
+                        || !ENGINE_set_load_privkey_function(e, openssl_load_privkey)
+#endif
+                        )
+                return 0;
+        /* If we add errors to this ENGINE, ensure the error handling is setup here */
+        /* openssl_load_error_strings(); */
+        return 1;
+        }
+
+static ENGINE *engine_openssl(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!bind_helper(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_openssl(void)
+        {
+        ENGINE *toadd = engine_openssl();
+        if(!toadd) return;
+        ENGINE_add(toadd);
+        /* If the "add" worked, it gets a structural reference. So either way,
+         * we release our just-created reference. */
+        ENGINE_free(toadd);
+        ERR_clear_error();
+        }
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library. */
+#ifdef ENGINE_DYNAMIC_SUPPORT
+static int bind_fn(ENGINE *e, const char *id)
+        {
+        if(id && (strcmp(id, engine_openssl_id) != 0))
+                return 0;
+        if(!bind_helper(e))
+                return 0;
+        return 1;
+        }
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
+#endif /* ENGINE_DYNAMIC_SUPPORT */
+
+#ifdef TEST_ENG_OPENSSL_RC4
+/* This section of code compiles an "alternative implementation" of two modes of
+ * RC4 into this ENGINE. The result is that EVP_CIPHER operation for "rc4"
+ * should under normal circumstances go via this support rather than the default
+ * EVP support. There are other symbols to tweak the testing;
+ *    TEST_ENC_OPENSSL_RC4_OTHERS - print a one line message to stderr each time
+ *        we're asked for a cipher we don't support (should not happen).
+ *    TEST_ENG_OPENSSL_RC4_P_INIT - print a one line message to stderr each time
+ *        the "init_key" handler is called.
+ *    TEST_ENG_OPENSSL_RC4_P_CIPHER - ditto for the "cipher" handler.
+ */
+#include <openssl/rc4.h>
+#define TEST_RC4_KEY_SIZE               16
+static int test_cipher_nids[] = {NID_rc4,NID_rc4_40};
+static int test_cipher_nids_number = 2;
+typedef struct {
+        unsigned char key[TEST_RC4_KEY_SIZE];
+        RC4_KEY ks;
+        } TEST_RC4_KEY;
+#define test(ctx) ((TEST_RC4_KEY *)(ctx)->cipher_data)
+static int test_rc4_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                        const unsigned char *iv, int enc)
+        {
+#ifdef TEST_ENG_OPENSSL_RC4_P_INIT
+        fprintf(stderr, "(TEST_ENG_OPENSSL_RC4) test_init_key() called\n");
+#endif
+        memcpy(&test(ctx)->key[0],key,EVP_CIPHER_CTX_key_length(ctx));
+        RC4_set_key(&test(ctx)->ks,EVP_CIPHER_CTX_key_length(ctx),
+                test(ctx)->key);
+        return 1;
+        }
+static int test_rc4_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                      const unsigned char *in, size_t inl)
+        {
+#ifdef TEST_ENG_OPENSSL_RC4_P_CIPHER
+        fprintf(stderr, "(TEST_ENG_OPENSSL_RC4) test_cipher() called\n");
+#endif
+        RC4(&test(ctx)->ks,inl,in,out);
+        return 1;
+        }
+static const EVP_CIPHER test_r4_cipher=
+        {
+        NID_rc4,
+        1,TEST_RC4_KEY_SIZE,0,
+        EVP_CIPH_VARIABLE_LENGTH,
+        test_rc4_init_key,
+        test_rc4_cipher,
+        NULL,
+        sizeof(TEST_RC4_KEY),
+        NULL,
+        NULL,
+        NULL,
+        NULL
+        };
+static const EVP_CIPHER test_r4_40_cipher=
+        {
+        NID_rc4_40,
+        1,5 /* 40 bit */,0,
+        EVP_CIPH_VARIABLE_LENGTH,
+        test_rc4_init_key,
+        test_rc4_cipher,
+        NULL,
+        sizeof(TEST_RC4_KEY),
+        NULL, 
+        NULL,
+        NULL,
+        NULL
+        };
+static int openssl_ciphers(ENGINE *e, const EVP_CIPHER **cipher,
+                        const int **nids, int nid)
+        {
+        if(!cipher)
+                {
+                /* We are returning a list of supported nids */
+                *nids = test_cipher_nids;
+                return test_cipher_nids_number;
+                }
+        /* We are being asked for a specific cipher */
+        if(nid == NID_rc4)
+                *cipher = &test_r4_cipher;
+        else if(nid == NID_rc4_40)
+                *cipher = &test_r4_40_cipher;
+        else
+                {
+#ifdef TEST_ENG_OPENSSL_RC4_OTHERS
+                fprintf(stderr, "(TEST_ENG_OPENSSL_RC4) returning NULL for "
+                                "nid %d\n", nid);
+#endif
+                *cipher = NULL;
+                return 0;
+                }
+        return 1;
+        }
+#endif
+
+#ifdef TEST_ENG_OPENSSL_SHA
+/* Much the same sort of comment as for TEST_ENG_OPENSSL_RC4 */
+#include <openssl/sha.h>
+static int test_digest_nids[] = {NID_sha1};
+static int test_digest_nids_number = 1;
+static int test_sha1_init(EVP_MD_CTX *ctx)
+        {
+#ifdef TEST_ENG_OPENSSL_SHA_P_INIT
+        fprintf(stderr, "(TEST_ENG_OPENSSL_SHA) test_sha1_init() called\n");
+#endif
+        return SHA1_Init(ctx->md_data);
+        }
+static int test_sha1_update(EVP_MD_CTX *ctx,const void *data,size_t count)
+        {
+#ifdef TEST_ENG_OPENSSL_SHA_P_UPDATE
+        fprintf(stderr, "(TEST_ENG_OPENSSL_SHA) test_sha1_update() called\n");
+#endif
+        return SHA1_Update(ctx->md_data,data,count);
+        }
+static int test_sha1_final(EVP_MD_CTX *ctx,unsigned char *md)
+        {
+#ifdef TEST_ENG_OPENSSL_SHA_P_FINAL
+        fprintf(stderr, "(TEST_ENG_OPENSSL_SHA) test_sha1_final() called\n");
+#endif
+        return SHA1_Final(md,ctx->md_data);
+        }
+static const EVP_MD test_sha_md=
+        {
+        NID_sha1,
+        NID_sha1WithRSAEncryption,
+        SHA_DIGEST_LENGTH,
+        0,
+        test_sha1_init,
+        test_sha1_update,
+        test_sha1_final,
+        NULL,
+        NULL,
+        EVP_PKEY_RSA_method,
+        SHA_CBLOCK,
+        sizeof(EVP_MD *)+sizeof(SHA_CTX),
+        };
+static int openssl_digests(ENGINE *e, const EVP_MD **digest,
+                        const int **nids, int nid)
+        {
+        if(!digest)
+                {
+                /* We are returning a list of supported nids */
+                *nids = test_digest_nids;
+                return test_digest_nids_number;
+                }
+        /* We are being asked for a specific digest */
+        if(nid == NID_sha1)
+                *digest = &test_sha_md;
+        else
+                {
+#ifdef TEST_ENG_OPENSSL_SHA_OTHERS
+                fprintf(stderr, "(TEST_ENG_OPENSSL_SHA) returning NULL for "
+                                "nid %d\n", nid);
+#endif
+                *digest = NULL;
+                return 0;
+                }
+        return 1;
+        }
+#endif
+
+#ifdef TEST_ENG_OPENSSL_PKEY
+static EVP_PKEY *openssl_load_privkey(ENGINE *eng, const char *key_id,
+        UI_METHOD *ui_method, void *callback_data)
+        {
+        BIO *in;
+        EVP_PKEY *key;
+        fprintf(stderr, "(TEST_ENG_OPENSSL_PKEY)Loading Private key %s\n", key_id);
+        in = BIO_new_file(key_id, "r");
+        if (!in)
+                return NULL;
+        key = PEM_read_bio_PrivateKey(in, NULL, 0, NULL);
+        BIO_free(in);
+        return key;
+        }
+#endif
diff --git a/src/lib/libcrypto/engine/eng_padlock.c b/src/lib/libcrypto/engine/eng_padlock.c
new file mode 100644
index 0000000000..743558ab33
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_padlock.c
@@ -0,0 +1,1219 @@
+/* 
+ * Support for VIA PadLock Advanced Cryptography Engine (ACE)
+ * Written by Michal Ludvig <michal@logix.cz>
+ *            http://www.logix.cz/michal
+ *
+ * Big thanks to Andy Polyakov for a help with optimization, 
+ * assembler fixes, port to MS Windows and a lot of other 
+ * valuable work on this engine!
+ */
+
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+#include <stdio.h>
+#include <string.h>
+
+#include <openssl/opensslconf.h>
+#include <openssl/crypto.h>
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+#include <openssl/evp.h>
+#ifndef OPENSSL_NO_AES
+#include <openssl/aes.h>
+#endif
+#include <openssl/rand.h>
+#include <openssl/err.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_PADLOCK
+
+/* Attempt to have a single source for both 0.9.7 and 0.9.8 :-) */
+#if (OPENSSL_VERSION_NUMBER >= 0x00908000L)
+#  ifndef OPENSSL_NO_DYNAMIC_ENGINE
+#    define DYNAMIC_ENGINE
+#  endif
+#elif (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+#  ifdef ENGINE_DYNAMIC_SUPPORT
+#    define DYNAMIC_ENGINE
+#  endif
+#else
+#  error "Only OpenSSL >= 0.9.7 is supported"
+#endif
+
+/* VIA PadLock AES is available *ONLY* on some x86 CPUs.
+   Not only that it doesn't exist elsewhere, but it
+   even can't be compiled on other platforms!
+ 
+   In addition, because of the heavy use of inline assembler,
+   compiler choice is limited to GCC and Microsoft C. */
+#undef COMPILE_HW_PADLOCK
+#if !defined(I386_ONLY) && !defined(OPENSSL_NO_INLINE_ASM)
+# if (defined(__GNUC__) && (defined(__i386__) || defined(__i386))) || \
+     (defined(_MSC_VER) && defined(_M_IX86))
+#  define COMPILE_HW_PADLOCK
+static ENGINE *ENGINE_padlock (void);
+# endif
+#endif
+
+void ENGINE_load_padlock (void)
+{
+/* On non-x86 CPUs it just returns. */
+#ifdef COMPILE_HW_PADLOCK
+        ENGINE *toadd = ENGINE_padlock ();
+        if (!toadd) return;
+        ENGINE_add (toadd);
+        ENGINE_free (toadd);
+        ERR_clear_error ();
+#endif
+}
+
+#ifdef COMPILE_HW_PADLOCK
+/* We do these includes here to avoid header problems on platforms that
+   do not have the VIA padlock anyway... */
+#ifdef _MSC_VER
+# include <malloc.h>
+# define alloca _alloca
+#elif defined(NETWARE_CLIB) && defined(__GNUC__)
+  void *alloca(size_t);
+# define alloca(s) __builtin_alloca(s)
+#else
+# include <stdlib.h>
+#endif
+
+/* Function for ENGINE detection and control */
+static int padlock_available(void);
+static int padlock_init(ENGINE *e);
+
+/* RNG Stuff */
+static RAND_METHOD padlock_rand;
+
+/* Cipher Stuff */
+#ifndef OPENSSL_NO_AES
+static int padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid);
+#endif
+
+/* Engine names */
+static const char *padlock_id = "padlock";
+static char padlock_name[100];
+
+/* Available features */
+static int padlock_use_ace = 0; /* Advanced Cryptography Engine */
+static int padlock_use_rng = 0; /* Random Number Generator */
+#ifndef OPENSSL_NO_AES
+static int padlock_aes_align_required = 1;
+#endif
+
+/* ===== Engine "management" functions ===== */
+
+/* Prepare the ENGINE structure for registration */
+static int
+padlock_bind_helper(ENGINE *e)
+{
+        /* Check available features */
+        padlock_available();
+
+#if 1   /* disable RNG for now, see commentary in vicinity of RNG code */
+        padlock_use_rng=0;
+#endif
+
+        /* Generate a nice engine name with available features */
+        BIO_snprintf(padlock_name, sizeof(padlock_name),
+                "VIA PadLock (%s, %s)", 
+                 padlock_use_rng ? "RNG" : "no-RNG",
+                 padlock_use_ace ? "ACE" : "no-ACE");
+
+        /* Register everything or return with an error */ 
+        if (!ENGINE_set_id(e, padlock_id) ||
+            !ENGINE_set_name(e, padlock_name) ||
+
+            !ENGINE_set_init_function(e, padlock_init) ||
+#ifndef OPENSSL_NO_AES
+            (padlock_use_ace && !ENGINE_set_ciphers (e, padlock_ciphers)) ||
+#endif
+            (padlock_use_rng && !ENGINE_set_RAND (e, &padlock_rand))) {
+                return 0;
+        }
+
+        /* Everything looks good */
+        return 1;
+}
+
+/* Constructor */
+static ENGINE *
+ENGINE_padlock(void)
+{
+        ENGINE *eng = ENGINE_new();
+
+        if (!eng) {
+                return NULL;
+        }
+
+        if (!padlock_bind_helper(eng)) {
+                ENGINE_free(eng);
+                return NULL;
+        }
+
+        return eng;
+}
+
+/* Check availability of the engine */
+static int
+padlock_init(ENGINE *e)
+{
+        return (padlock_use_rng || padlock_use_ace);
+}
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library.
+ */
+#ifdef DYNAMIC_ENGINE
+static int
+padlock_bind_fn(ENGINE *e, const char *id)
+{
+        if (id && (strcmp(id, padlock_id) != 0)) {
+                return 0;
+        }
+
+        if (!padlock_bind_helper(e))  {
+                return 0;
+        }
+
+        return 1;
+}
+
+IMPLEMENT_DYNAMIC_CHECK_FN ()
+IMPLEMENT_DYNAMIC_BIND_FN (padlock_bind_fn)
+#endif /* DYNAMIC_ENGINE */
+
+/* ===== Here comes the "real" engine ===== */
+
+#ifndef OPENSSL_NO_AES
+/* Some AES-related constants */
+#define AES_BLOCK_SIZE          16
+#define AES_KEY_SIZE_128        16
+#define AES_KEY_SIZE_192        24
+#define AES_KEY_SIZE_256        32
+
+/* Here we store the status information relevant to the 
+   current context. */
+/* BIG FAT WARNING:
+ *      Inline assembler in PADLOCK_XCRYPT_ASM()
+ *      depends on the order of items in this structure.
+ *      Don't blindly modify, reorder, etc!
+ */
+struct padlock_cipher_data
+{
+        unsigned char iv[AES_BLOCK_SIZE];       /* Initialization vector */
+        union { unsigned int pad[4];
+                struct {
+                        int rounds:4;
+                        int dgst:1;     /* n/a in C3 */
+                        int align:1;    /* n/a in C3 */
+                        int ciphr:1;    /* n/a in C3 */
+                        unsigned int keygen:1;
+                        int interm:1;
+                        unsigned int encdec:1;
+                        int ksize:2;
+                } b;
+        } cword;                /* Control word */
+        AES_KEY ks;             /* Encryption key */
+};
+
+/*
+ * Essentially this variable belongs in thread local storage.
+ * Having this variable global on the other hand can only cause
+ * few bogus key reloads [if any at all on single-CPU system],
+ * so we accept the penatly...
+ */
+static volatile struct padlock_cipher_data *padlock_saved_context;
+#endif
+
+/*
+ * =======================================================
+ * Inline assembler section(s).
+ * =======================================================
+ * Order of arguments is chosen to facilitate Windows port
+ * using __fastcall calling convention. If you wish to add
+ * more routines, keep in mind that first __fastcall
+ * argument is passed in %ecx and second - in %edx.
+ * =======================================================
+ */
+#if defined(__GNUC__) && __GNUC__>=2
+/*
+ * As for excessive "push %ebx"/"pop %ebx" found all over.
+ * When generating position-independent code GCC won't let
+ * us use "b" in assembler templates nor even respect "ebx"
+ * in "clobber description." Therefore the trouble...
+ */
+
+/* Helper function - check if a CPUID instruction
+   is available on this CPU */
+static int
+padlock_insn_cpuid_available(void)
+{
+        int result = -1;
+
+        /* We're checking if the bit #21 of EFLAGS 
+           can be toggled. If yes = CPUID is available. */
+        asm volatile (
+                "pushf\n"
+                "popl %%eax\n"
+                "xorl $0x200000, %%eax\n"
+                "movl %%eax, %%ecx\n"
+                "andl $0x200000, %%ecx\n"
+                "pushl %%eax\n"
+                "popf\n"
+                "pushf\n"
+                "popl %%eax\n"
+                "andl $0x200000, %%eax\n"
+                "xorl %%eax, %%ecx\n"
+                "movl %%ecx, %0\n"
+                : "=r" (result) : : "eax", "ecx");
+        
+        return (result == 0);
+}
+
+/* Load supported features of the CPU to see if
+   the PadLock is available. */
+static int
+padlock_available(void)
+{
+        char vendor_string[16];
+        unsigned int eax, edx;
+
+        /* First check if the CPUID instruction is available at all... */
+        if (! padlock_insn_cpuid_available())
+                return 0;
+
+        /* Are we running on the Centaur (VIA) CPU? */
+        eax = 0x00000000;
+        vendor_string[12] = 0;
+        asm volatile (
+                "pushl  %%ebx\n"
+                "cpuid\n"
+                "movl   %%ebx,(%%edi)\n"
+                "movl   %%edx,4(%%edi)\n"
+                "movl   %%ecx,8(%%edi)\n"
+                "popl   %%ebx"
+                : "+a"(eax) : "D"(vendor_string) : "ecx", "edx");
+        if (strcmp(vendor_string, "CentaurHauls") != 0)
+                return 0;
+
+        /* Check for Centaur Extended Feature Flags presence */
+        eax = 0xC0000000;
+        asm volatile ("pushl %%ebx; cpuid; popl %%ebx"
+                : "+a"(eax) : : "ecx", "edx");
+        if (eax < 0xC0000001)
+                return 0;
+
+        /* Read the Centaur Extended Feature Flags */
+        eax = 0xC0000001;
+        asm volatile ("pushl %%ebx; cpuid; popl %%ebx"
+                : "+a"(eax), "=d"(edx) : : "ecx");
+
+        /* Fill up some flags */
+        padlock_use_ace = ((edx & (0x3<<6)) == (0x3<<6));
+        padlock_use_rng = ((edx & (0x3<<2)) == (0x3<<2));
+
+        return padlock_use_ace + padlock_use_rng;
+}
+
+#ifndef OPENSSL_NO_AES
+/* Our own htonl()/ntohl() */
+static inline void
+padlock_bswapl(AES_KEY *ks)
+{
+        size_t i = sizeof(ks->rd_key)/sizeof(ks->rd_key[0]);
+        unsigned int *key = ks->rd_key;
+
+        while (i--) {
+                asm volatile ("bswapl %0" : "+r"(*key));
+                key++;
+        }
+}
+#endif
+
+/* Force key reload from memory to the CPU microcode.
+   Loading EFLAGS from the stack clears EFLAGS[30] 
+   which does the trick. */
+static inline void
+padlock_reload_key(void)
+{
+        asm volatile ("pushfl; popfl");
+}
+
+#ifndef OPENSSL_NO_AES
+/*
+ * This is heuristic key context tracing. At first one
+ * believes that one should use atomic swap instructions,
+ * but it's not actually necessary. Point is that if
+ * padlock_saved_context was changed by another thread
+ * after we've read it and before we compare it with cdata,
+ * our key *shall* be reloaded upon thread context switch
+ * and we are therefore set in either case...
+ */
+static inline void
+padlock_verify_context(struct padlock_cipher_data *cdata)
+{
+        asm volatile (
+        "pushfl\n"
+"       btl     $30,(%%esp)\n"
+"       jnc     1f\n"
+"       cmpl    %2,%1\n"
+"       je      1f\n"
+"       popfl\n"
+"       subl    $4,%%esp\n"
+"1:     addl    $4,%%esp\n"
+"       movl    %2,%0"
+        :"+m"(padlock_saved_context)
+        : "r"(padlock_saved_context), "r"(cdata) : "cc");
+}
+
+/* Template for padlock_xcrypt_* modes */
+/* BIG FAT WARNING: 
+ *      The offsets used with 'leal' instructions
+ *      describe items of the 'padlock_cipher_data'
+ *      structure.
+ */
+#define PADLOCK_XCRYPT_ASM(name,rep_xcrypt)     \
+static inline void *name(size_t cnt,            \
+        struct padlock_cipher_data *cdata,      \
+        void *out, const void *inp)             \
+{       void *iv;                               \
+        asm volatile ( "pushl   %%ebx\n"        \
+                "       leal    16(%0),%%edx\n" \
+                "       leal    32(%0),%%ebx\n" \
+                        rep_xcrypt "\n"         \
+                "       popl    %%ebx"          \
+                : "=a"(iv), "=c"(cnt), "=D"(out), "=S"(inp) \
+                : "0"(cdata), "1"(cnt), "2"(out), "3"(inp)  \
+                : "edx", "cc", "memory");       \
+        return iv;                              \
+}
+
+/* Generate all functions with appropriate opcodes */
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb, ".byte 0xf3,0x0f,0xa7,0xc8")     /* rep xcryptecb */
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc, ".byte 0xf3,0x0f,0xa7,0xd0")     /* rep xcryptcbc */
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb, ".byte 0xf3,0x0f,0xa7,0xe0")     /* rep xcryptcfb */
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb, ".byte 0xf3,0x0f,0xa7,0xe8")     /* rep xcryptofb */
+#endif
+
+/* The RNG call itself */
+static inline unsigned int
+padlock_xstore(void *addr, unsigned int edx_in)
+{
+        unsigned int eax_out;
+
+        asm volatile (".byte 0x0f,0xa7,0xc0"    /* xstore */
+            : "=a"(eax_out),"=m"(*(unsigned *)addr)
+            : "D"(addr), "d" (edx_in)
+            );
+
+        return eax_out;
+}
+
+/* Why not inline 'rep movsd'? I failed to find information on what
+ * value in Direction Flag one can expect and consequently have to
+ * apply "better-safe-than-sorry" approach and assume "undefined."
+ * I could explicitly clear it and restore the original value upon
+ * return from padlock_aes_cipher, but it's presumably too much
+ * trouble for too little gain...
+ *
+ * In case you wonder 'rep xcrypt*' instructions above are *not*
+ * affected by the Direction Flag and pointers advance toward
+ * larger addresses unconditionally.
+ */ 
+static inline unsigned char *
+padlock_memcpy(void *dst,const void *src,size_t n)
+{
+        long       *d=dst;
+        const long *s=src;
+
+        n /= sizeof(*d);
+        do { *d++ = *s++; } while (--n);
+
+        return dst;
+}
+
+#elif defined(_MSC_VER)
+/*
+ * Unlike GCC these are real functions. In order to minimize impact
+ * on performance we adhere to __fastcall calling convention in
+ * order to get two first arguments passed through %ecx and %edx.
+ * Which kind of suits very well, as instructions in question use
+ * both %ecx and %edx as input:-)
+ */
+#define REP_XCRYPT(code)                \
+        _asm _emit 0xf3                 \
+        _asm _emit 0x0f _asm _emit 0xa7 \
+        _asm _emit code
+
+/* BIG FAT WARNING: 
+ *      The offsets used with 'lea' instructions
+ *      describe items of the 'padlock_cipher_data'
+ *      structure.
+ */
+#define PADLOCK_XCRYPT_ASM(name,code)   \
+static void * __fastcall                \
+        name (size_t cnt, void *cdata,  \
+        void *outp, const void *inp)    \
+{       _asm    mov     eax,edx         \
+        _asm    lea     edx,[eax+16]    \
+        _asm    lea     ebx,[eax+32]    \
+        _asm    mov     edi,outp        \
+        _asm    mov     esi,inp         \
+        REP_XCRYPT(code)                \
+}
+
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb,0xc8)
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc,0xd0)
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb,0xe0)
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb,0xe8)
+
+static int __fastcall
+padlock_xstore(void *outp,unsigned int code)
+{       _asm    mov     edi,ecx
+        _asm _emit 0x0f _asm _emit 0xa7 _asm _emit 0xc0
+}
+
+static void __fastcall
+padlock_reload_key(void)
+{       _asm pushfd _asm popfd          }
+
+static void __fastcall
+padlock_verify_context(void *cdata)
+{       _asm    {
+                pushfd
+                bt      DWORD PTR[esp],30
+                jnc     skip
+                cmp     ecx,padlock_saved_context
+                je      skip
+                popfd
+                sub     esp,4
+        skip:   add     esp,4
+                mov     padlock_saved_context,ecx
+                }
+}
+
+static int
+padlock_available(void)
+{       _asm    {
+                pushfd
+                pop     eax
+                mov     ecx,eax
+                xor     eax,1<<21
+                push    eax
+                popfd
+                pushfd
+                pop     eax
+                xor     eax,ecx
+                bt      eax,21
+                jnc     noluck
+                mov     eax,0
+                cpuid
+                xor     eax,eax
+                cmp     ebx,'tneC'
+                jne     noluck
+                cmp     edx,'Hrua'
+                jne     noluck
+                cmp     ecx,'slua'
+                jne     noluck
+                mov     eax,0xC0000000
+                cpuid
+                mov     edx,eax
+                xor     eax,eax
+                cmp     edx,0xC0000001
+                jb      noluck
+                mov     eax,0xC0000001
+                cpuid
+                xor     eax,eax
+                bt      edx,6
+                jnc     skip_a
+                bt      edx,7
+                jnc     skip_a
+                mov     padlock_use_ace,1
+                inc     eax
+        skip_a: bt      edx,2
+                jnc     skip_r
+                bt      edx,3
+                jnc     skip_r
+                mov     padlock_use_rng,1
+                inc     eax
+        skip_r:
+        noluck:
+                }
+}
+
+static void __fastcall
+padlock_bswapl(void *key)
+{       _asm    {
+                pushfd
+                cld
+                mov     esi,ecx
+                mov     edi,ecx
+                mov     ecx,60
+        up:     lodsd
+                bswap   eax
+                stosd
+                loop    up
+                popfd
+                }
+}
+
+/* MS actually specifies status of Direction Flag and compiler even
+ * manages to compile following as 'rep movsd' all by itself...
+ */
+#define padlock_memcpy(o,i,n) ((unsigned char *)memcpy((o),(i),(n)&~3U))
+#endif
+
+/* ===== AES encryption/decryption ===== */
+#ifndef OPENSSL_NO_AES
+
+#if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb)
+#define NID_aes_128_cfb NID_aes_128_cfb128
+#endif
+
+#if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb)
+#define NID_aes_128_ofb NID_aes_128_ofb128
+#endif
+
+#if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb)
+#define NID_aes_192_cfb NID_aes_192_cfb128
+#endif
+
+#if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb)
+#define NID_aes_192_ofb NID_aes_192_ofb128
+#endif
+
+#if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb)
+#define NID_aes_256_cfb NID_aes_256_cfb128
+#endif
+
+#if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb)
+#define NID_aes_256_ofb NID_aes_256_ofb128
+#endif
+
+/* List of supported ciphers. */
+static int padlock_cipher_nids[] = {
+        NID_aes_128_ecb,
+        NID_aes_128_cbc,
+        NID_aes_128_cfb,
+        NID_aes_128_ofb,
+
+        NID_aes_192_ecb,
+        NID_aes_192_cbc,
+        NID_aes_192_cfb,
+        NID_aes_192_ofb,
+
+        NID_aes_256_ecb,
+        NID_aes_256_cbc,
+        NID_aes_256_cfb,
+        NID_aes_256_ofb,
+};
+static int padlock_cipher_nids_num = (sizeof(padlock_cipher_nids)/
+                                      sizeof(padlock_cipher_nids[0]));
+
+/* Function prototypes ... */
+static int padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                                const unsigned char *iv, int enc);
+static int padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                              const unsigned char *in, size_t nbytes);
+
+#define NEAREST_ALIGNED(ptr) ( (unsigned char *)(ptr) +         \
+        ( (0x10 - ((size_t)(ptr) & 0x0F)) & 0x0F )      )
+#define ALIGNED_CIPHER_DATA(ctx) ((struct padlock_cipher_data *)\
+        NEAREST_ALIGNED(ctx->cipher_data))
+
+#define EVP_CIPHER_block_size_ECB       AES_BLOCK_SIZE
+#define EVP_CIPHER_block_size_CBC       AES_BLOCK_SIZE
+#define EVP_CIPHER_block_size_OFB       1
+#define EVP_CIPHER_block_size_CFB       1
+
+/* Declaring so many ciphers by hand would be a pain.
+   Instead introduce a bit of preprocessor magic :-) */
+#define DECLARE_AES_EVP(ksize,lmode,umode)      \
+static const EVP_CIPHER padlock_aes_##ksize##_##lmode = {       \
+        NID_aes_##ksize##_##lmode,              \
+        EVP_CIPHER_block_size_##umode,  \
+        AES_KEY_SIZE_##ksize,           \
+        AES_BLOCK_SIZE,                 \
+        0 | EVP_CIPH_##umode##_MODE,    \
+        padlock_aes_init_key,           \
+        padlock_aes_cipher,             \
+        NULL,                           \
+        sizeof(struct padlock_cipher_data) + 16,        \
+        EVP_CIPHER_set_asn1_iv,         \
+        EVP_CIPHER_get_asn1_iv,         \
+        NULL,                           \
+        NULL                            \
+}
+
+DECLARE_AES_EVP(128,ecb,ECB);
+DECLARE_AES_EVP(128,cbc,CBC);
+DECLARE_AES_EVP(128,cfb,CFB);
+DECLARE_AES_EVP(128,ofb,OFB);
+
+DECLARE_AES_EVP(192,ecb,ECB);
+DECLARE_AES_EVP(192,cbc,CBC);
+DECLARE_AES_EVP(192,cfb,CFB);
+DECLARE_AES_EVP(192,ofb,OFB);
+
+DECLARE_AES_EVP(256,ecb,ECB);
+DECLARE_AES_EVP(256,cbc,CBC);
+DECLARE_AES_EVP(256,cfb,CFB);
+DECLARE_AES_EVP(256,ofb,OFB);
+
+static int
+padlock_ciphers (ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid)
+{
+        /* No specific cipher => return a list of supported nids ... */
+        if (!cipher) {
+                *nids = padlock_cipher_nids;
+                return padlock_cipher_nids_num;
+        }
+
+        /* ... or the requested "cipher" otherwise */
+        switch (nid) {
+          case NID_aes_128_ecb:
+            *cipher = &padlock_aes_128_ecb;
+            break;
+          case NID_aes_128_cbc:
+            *cipher = &padlock_aes_128_cbc;
+            break;
+          case NID_aes_128_cfb:
+            *cipher = &padlock_aes_128_cfb;
+            break;
+          case NID_aes_128_ofb:
+            *cipher = &padlock_aes_128_ofb;
+            break;
+
+          case NID_aes_192_ecb:
+            *cipher = &padlock_aes_192_ecb;
+            break;
+          case NID_aes_192_cbc:
+            *cipher = &padlock_aes_192_cbc;
+            break;
+          case NID_aes_192_cfb:
+            *cipher = &padlock_aes_192_cfb;
+            break;
+          case NID_aes_192_ofb:
+            *cipher = &padlock_aes_192_ofb;
+            break;
+
+          case NID_aes_256_ecb:
+            *cipher = &padlock_aes_256_ecb;
+            break;
+          case NID_aes_256_cbc:
+            *cipher = &padlock_aes_256_cbc;
+            break;
+          case NID_aes_256_cfb:
+            *cipher = &padlock_aes_256_cfb;
+            break;
+          case NID_aes_256_ofb:
+            *cipher = &padlock_aes_256_ofb;
+            break;
+
+          default:
+            /* Sorry, we don't support this NID */
+            *cipher = NULL;
+            return 0;
+        }
+
+        return 1;
+}
+
+/* Prepare the encryption key for PadLock usage */
+static int
+padlock_aes_init_key (EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                      const unsigned char *iv, int enc)
+{
+        struct padlock_cipher_data *cdata;
+        int key_len = EVP_CIPHER_CTX_key_length(ctx) * 8;
+
+        if (key==NULL) return 0;        /* ERROR */
+
+        cdata = ALIGNED_CIPHER_DATA(ctx);
+        memset(cdata, 0, sizeof(struct padlock_cipher_data));
+
+        /* Prepare Control word. */
+        if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE)
+                cdata->cword.b.encdec = 0;
+        else
+                cdata->cword.b.encdec = (ctx->encrypt == 0);
+        cdata->cword.b.rounds = 10 + (key_len - 128) / 32;
+        cdata->cword.b.ksize = (key_len - 128) / 64;
+
+        switch(key_len) {
+                case 128:
+                        /* PadLock can generate an extended key for
+                           AES128 in hardware */
+                        memcpy(cdata->ks.rd_key, key, AES_KEY_SIZE_128);
+                        cdata->cword.b.keygen = 0;
+                        break;
+
+                case 192:
+                case 256:
+                        /* Generate an extended AES key in software.
+                           Needed for AES192/AES256 */
+                        /* Well, the above applies to Stepping 8 CPUs
+                           and is listed as hardware errata. They most
+                           likely will fix it at some point and then
+                           a check for stepping would be due here. */
+                        if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CFB_MODE ||
+                            EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE ||
+                            enc)
+                                AES_set_encrypt_key(key, key_len, &cdata->ks);
+                        else
+                                AES_set_decrypt_key(key, key_len, &cdata->ks);
+#ifndef AES_ASM
+                        /* OpenSSL C functions use byte-swapped extended key. */
+                        padlock_bswapl(&cdata->ks);
+#endif
+                        cdata->cword.b.keygen = 1;
+                        break;
+
+                default:
+                        /* ERROR */
+                        return 0;
+        }
+
+        /*
+         * This is done to cover for cases when user reuses the
+         * context for new key. The catch is that if we don't do
+         * this, padlock_eas_cipher might proceed with old key...
+         */
+        padlock_reload_key ();
+
+        return 1;
+}
+
+/* 
+ * Simplified version of padlock_aes_cipher() used when
+ * 1) both input and output buffers are at aligned addresses.
+ * or when
+ * 2) running on a newer CPU that doesn't require aligned buffers.
+ */
+static int
+padlock_aes_cipher_omnivorous(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
+                const unsigned char *in_arg, size_t nbytes)
+{
+        struct padlock_cipher_data *cdata;
+        void  *iv;
+
+        cdata = ALIGNED_CIPHER_DATA(ctx);
+        padlock_verify_context(cdata);
+
+        switch (EVP_CIPHER_CTX_mode(ctx)) {
+        case EVP_CIPH_ECB_MODE:
+                padlock_xcrypt_ecb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
+                break;
+
+        case EVP_CIPH_CBC_MODE:
+                memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+                iv = padlock_xcrypt_cbc(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
+                memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
+                break;
+
+        case EVP_CIPH_CFB_MODE:
+                memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+                iv = padlock_xcrypt_cfb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
+                memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
+                break;
+
+        case EVP_CIPH_OFB_MODE:
+                memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+                padlock_xcrypt_ofb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
+                memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);
+                break;
+
+        default:
+                return 0;
+        }
+
+        memset(cdata->iv, 0, AES_BLOCK_SIZE);
+
+        return 1;
+}
+
+#ifndef  PADLOCK_CHUNK
+# define PADLOCK_CHUNK  512     /* Must be a power of 2 larger than 16 */
+#endif
+#if PADLOCK_CHUNK<16 || PADLOCK_CHUNK&(PADLOCK_CHUNK-1)
+# error "insane PADLOCK_CHUNK..."
+#endif
+
+/* Re-align the arguments to 16-Bytes boundaries and run the 
+   encryption function itself. This function is not AES-specific. */
+static int
+padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
+                   const unsigned char *in_arg, size_t nbytes)
+{
+        struct padlock_cipher_data *cdata;
+        const  void *inp;
+        unsigned char  *out;
+        void  *iv;
+        int    inp_misaligned, out_misaligned, realign_in_loop;
+        size_t chunk, allocated=0;
+
+        /* ctx->num is maintained in byte-oriented modes,
+           such as CFB and OFB... */
+        if ((chunk = ctx->num)) { /* borrow chunk variable */
+                unsigned char *ivp=ctx->iv;
+
+                switch (EVP_CIPHER_CTX_mode(ctx)) {
+                case EVP_CIPH_CFB_MODE:
+                        if (chunk >= AES_BLOCK_SIZE)
+                                return 0; /* bogus value */
+
+                        if (ctx->encrypt)
+                                while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
+                                        ivp[chunk] = *(out_arg++) = *(in_arg++) ^ ivp[chunk];
+                                        chunk++, nbytes--;
+                                }
+                        else    while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
+                                        unsigned char c = *(in_arg++);
+                                        *(out_arg++) = c ^ ivp[chunk];
+                                        ivp[chunk++] = c, nbytes--;
+                                }
+
+                        ctx->num = chunk%AES_BLOCK_SIZE;
+                        break;
+                case EVP_CIPH_OFB_MODE:
+                        if (chunk >= AES_BLOCK_SIZE)
+                                return 0; /* bogus value */
+
+                        while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
+                                *(out_arg++) = *(in_arg++) ^ ivp[chunk];
+                                chunk++, nbytes--;
+                        }
+
+                        ctx->num = chunk%AES_BLOCK_SIZE;
+                        break;
+                }
+        }
+
+        if (nbytes == 0)
+                return 1;
+#if 0
+        if (nbytes % AES_BLOCK_SIZE)
+                return 0; /* are we expected to do tail processing? */
+#else
+        /* nbytes is always multiple of AES_BLOCK_SIZE in ECB and CBC
+           modes and arbitrary value in byte-oriented modes, such as
+           CFB and OFB... */
+#endif
+
+        /* VIA promises CPUs that won't require alignment in the future.
+           For now padlock_aes_align_required is initialized to 1 and
+           the condition is never met... */
+        /* C7 core is capable to manage unaligned input in non-ECB[!]
+           mode, but performance penalties appear to be approximately
+           same as for software alignment below or ~3x. They promise to
+           improve it in the future, but for now we can just as well
+           pretend that it can only handle aligned input... */
+        if (!padlock_aes_align_required && (nbytes%AES_BLOCK_SIZE)==0)
+                return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);
+
+        inp_misaligned = (((size_t)in_arg) & 0x0F);
+        out_misaligned = (((size_t)out_arg) & 0x0F);
+
+        /* Note that even if output is aligned and input not,
+         * I still prefer to loop instead of copy the whole
+         * input and then encrypt in one stroke. This is done
+         * in order to improve L1 cache utilization... */
+        realign_in_loop = out_misaligned|inp_misaligned;
+
+        if (!realign_in_loop && (nbytes%AES_BLOCK_SIZE)==0)
+                return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);
+
+        /* this takes one "if" out of the loops */
+        chunk  = nbytes;
+        chunk %= PADLOCK_CHUNK;
+        if (chunk==0) chunk = PADLOCK_CHUNK;
+
+        if (out_misaligned) {
+                /* optmize for small input */
+                allocated = (chunk<nbytes?PADLOCK_CHUNK:nbytes);
+                out = alloca(0x10 + allocated);
+                out = NEAREST_ALIGNED(out);
+        }
+        else
+                out = out_arg;
+
+        cdata = ALIGNED_CIPHER_DATA(ctx);
+        padlock_verify_context(cdata);
+
+        switch (EVP_CIPHER_CTX_mode(ctx)) {
+        case EVP_CIPH_ECB_MODE:
+                do      {
+                        if (inp_misaligned)
+                                inp = padlock_memcpy(out, in_arg, chunk);
+                        else
+                                inp = in_arg;
+                        in_arg += chunk;
+
+                        padlock_xcrypt_ecb(chunk/AES_BLOCK_SIZE, cdata, out, inp);
+
+                        if (out_misaligned)
+                                out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
+                        else
+                                out     = out_arg+=chunk;
+
+                        nbytes -= chunk;
+                        chunk   = PADLOCK_CHUNK;
+                } while (nbytes);
+                break;
+
+        case EVP_CIPH_CBC_MODE:
+                memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+                goto cbc_shortcut;
+                do      {
+                        if (iv != cdata->iv)
+                                memcpy(cdata->iv, iv, AES_BLOCK_SIZE);
+                        chunk = PADLOCK_CHUNK;
+                cbc_shortcut: /* optimize for small input */
+                        if (inp_misaligned)
+                                inp = padlock_memcpy(out, in_arg, chunk);
+                        else
+                                inp = in_arg;
+                        in_arg += chunk;
+
+                        iv = padlock_xcrypt_cbc(chunk/AES_BLOCK_SIZE, cdata, out, inp);
+
+                        if (out_misaligned)
+                                out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
+                        else
+                                out     = out_arg+=chunk;
+
+                } while (nbytes -= chunk);
+                memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
+                break;
+
+        case EVP_CIPH_CFB_MODE:
+                memcpy (iv = cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+                chunk &= ~(AES_BLOCK_SIZE-1);
+                if (chunk)      goto cfb_shortcut;
+                else            goto cfb_skiploop;
+                do      {
+                        if (iv != cdata->iv)
+                                memcpy(cdata->iv, iv, AES_BLOCK_SIZE);
+                        chunk = PADLOCK_CHUNK;
+                cfb_shortcut: /* optimize for small input */
+                        if (inp_misaligned)
+                                inp = padlock_memcpy(out, in_arg, chunk);
+                        else
+                                inp = in_arg;
+                        in_arg += chunk;
+
+                        iv = padlock_xcrypt_cfb(chunk/AES_BLOCK_SIZE, cdata, out, inp);
+
+                        if (out_misaligned)
+                                out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
+                        else
+                                out     = out_arg+=chunk;
+
+                        nbytes -= chunk;
+                } while (nbytes >= AES_BLOCK_SIZE);
+
+                cfb_skiploop:
+                if (nbytes) {
+                        unsigned char *ivp = cdata->iv;
+
+                        if (iv != ivp) {
+                                memcpy(ivp, iv, AES_BLOCK_SIZE);
+                                iv = ivp;
+                        }
+                        ctx->num = nbytes;
+                        if (cdata->cword.b.encdec) {
+                                cdata->cword.b.encdec=0;
+                                padlock_reload_key();
+                                padlock_xcrypt_ecb(1,cdata,ivp,ivp);
+                                cdata->cword.b.encdec=1;
+                                padlock_reload_key();
+                                while(nbytes) {
+                                        unsigned char c = *(in_arg++);
+                                        *(out_arg++) = c ^ *ivp;
+                                        *(ivp++) = c, nbytes--;
+                                }
+                        }
+                        else {  padlock_reload_key();
+                                padlock_xcrypt_ecb(1,cdata,ivp,ivp);
+                                padlock_reload_key();
+                                while (nbytes) {
+                                        *ivp = *(out_arg++) = *(in_arg++) ^ *ivp;
+                                        ivp++, nbytes--;
+                                }
+                        }
+                }
+
+                memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
+                break;
+
+        case EVP_CIPH_OFB_MODE:
+                memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+                chunk &= ~(AES_BLOCK_SIZE-1);
+                if (chunk) do   {
+                        if (inp_misaligned)
+                                inp = padlock_memcpy(out, in_arg, chunk);
+                        else
+                                inp = in_arg;
+                        in_arg += chunk;
+
+                        padlock_xcrypt_ofb(chunk/AES_BLOCK_SIZE, cdata, out, inp);
+
+                        if (out_misaligned)
+                                out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
+                        else
+                                out     = out_arg+=chunk;
+
+                        nbytes -= chunk;
+                        chunk   = PADLOCK_CHUNK;
+                } while (nbytes >= AES_BLOCK_SIZE);
+
+                if (nbytes) {
+                        unsigned char *ivp = cdata->iv;
+
+                        ctx->num = nbytes;
+                        padlock_reload_key();   /* empirically found */
+                        padlock_xcrypt_ecb(1,cdata,ivp,ivp);
+                        padlock_reload_key();   /* empirically found */
+                        while (nbytes) {
+                                *(out_arg++) = *(in_arg++) ^ *ivp;
+                                ivp++, nbytes--;
+                        }
+                }
+
+                memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);
+                break;
+
+        default:
+                return 0;
+        }
+
+        /* Clean the realign buffer if it was used */
+        if (out_misaligned) {
+                volatile unsigned long *p=(void *)out;
+                size_t   n = allocated/sizeof(*p);
+                while (n--) *p++=0;
+        }
+
+        memset(cdata->iv, 0, AES_BLOCK_SIZE);
+
+        return 1;
+}
+
+#endif /* OPENSSL_NO_AES */
+
+/* ===== Random Number Generator ===== */
+/*
+ * This code is not engaged. The reason is that it does not comply
+ * with recommendations for VIA RNG usage for secure applications
+ * (posted at http://www.via.com.tw/en/viac3/c3.jsp) nor does it
+ * provide meaningful error control...
+ */
+/* Wrapper that provides an interface between the API and 
+   the raw PadLock RNG */
+static int
+padlock_rand_bytes(unsigned char *output, int count)
+{
+        unsigned int eax, buf;
+
+        while (count >= 8) {
+                eax = padlock_xstore(output, 0);
+                if (!(eax&(1<<6)))      return 0; /* RNG disabled */
+                /* this ---vv--- covers DC bias, Raw Bits and String Filter */
+                if (eax&(0x1F<<10))     return 0;
+                if ((eax&0x1F)==0)      continue; /* no data, retry... */
+                if ((eax&0x1F)!=8)      return 0; /* fatal failure...  */
+                output += 8;
+                count  -= 8;
+        }
+        while (count > 0) {
+                eax = padlock_xstore(&buf, 3);
+                if (!(eax&(1<<6)))      return 0; /* RNG disabled */
+                /* this ---vv--- covers DC bias, Raw Bits and String Filter */
+                if (eax&(0x1F<<10))     return 0;
+                if ((eax&0x1F)==0)      continue; /* no data, retry... */
+                if ((eax&0x1F)!=1)      return 0; /* fatal failure...  */
+                *output++ = (unsigned char)buf;
+                count--;
+        }
+        *(volatile unsigned int *)&buf=0;
+
+        return 1;
+}
+
+/* Dummy but necessary function */
+static int
+padlock_rand_status(void)
+{
+        return 1;
+}
+
+/* Prepare structure for registration */
+static RAND_METHOD padlock_rand = {
+        NULL,                   /* seed */
+        padlock_rand_bytes,     /* bytes */
+        NULL,                   /* cleanup */
+        NULL,                   /* add */
+        padlock_rand_bytes,     /* pseudorand */
+        padlock_rand_status,    /* rand status */
+};
+
+#endif /* COMPILE_HW_PADLOCK */
+
+#endif /* !OPENSSL_NO_HW_PADLOCK */
+#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libcrypto/engine/eng_pkey.c b/src/lib/libcrypto/engine/eng_pkey.c
new file mode 100644
index 0000000000..1dfa2e3664
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_pkey.c
@@ -0,0 +1,196 @@
+/* crypto/engine/eng_pkey.c */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+
+/* Basic get/set stuff */
+
+int ENGINE_set_load_privkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpriv_f)
+        {
+        e->load_privkey = loadpriv_f;
+        return 1;
+        }
+
+int ENGINE_set_load_pubkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpub_f)
+        {
+        e->load_pubkey = loadpub_f;
+        return 1;
+        }
+
+int ENGINE_set_load_ssl_client_cert_function(ENGINE *e,
+                                ENGINE_SSL_CLIENT_CERT_PTR loadssl_f)
+        {
+        e->load_ssl_client_cert = loadssl_f;
+        return 1;
+        }
+
+ENGINE_LOAD_KEY_PTR ENGINE_get_load_privkey_function(const ENGINE *e)
+        {
+        return e->load_privkey;
+        }
+
+ENGINE_LOAD_KEY_PTR ENGINE_get_load_pubkey_function(const ENGINE *e)
+        {
+        return e->load_pubkey;
+        }
+
+ENGINE_SSL_CLIENT_CERT_PTR ENGINE_get_ssl_client_cert_function(const ENGINE *e)
+        {
+        return e->load_ssl_client_cert;
+        }
+
+/* API functions to load public/private keys */
+
+EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
+        UI_METHOD *ui_method, void *callback_data)
+        {
+        EVP_PKEY *pkey;
+
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_LOAD_PRIVATE_KEY,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        if(e->funct_ref == 0)
+                {
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                ENGINEerr(ENGINE_F_ENGINE_LOAD_PRIVATE_KEY,
+                        ENGINE_R_NOT_INITIALISED);
+                return 0;
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        if (!e->load_privkey)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_LOAD_PRIVATE_KEY,
+                        ENGINE_R_NO_LOAD_FUNCTION);
+                return 0;
+                }
+        pkey = e->load_privkey(e, key_id, ui_method, callback_data);
+        if (!pkey)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_LOAD_PRIVATE_KEY,
+                        ENGINE_R_FAILED_LOADING_PRIVATE_KEY);
+                return 0;
+                }
+        return pkey;
+        }
+
+EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id,
+        UI_METHOD *ui_method, void *callback_data)
+        {
+        EVP_PKEY *pkey;
+
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_LOAD_PUBLIC_KEY,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        if(e->funct_ref == 0)
+                {
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                ENGINEerr(ENGINE_F_ENGINE_LOAD_PUBLIC_KEY,
+                        ENGINE_R_NOT_INITIALISED);
+                return 0;
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        if (!e->load_pubkey)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_LOAD_PUBLIC_KEY,
+                        ENGINE_R_NO_LOAD_FUNCTION);
+                return 0;
+                }
+        pkey = e->load_pubkey(e, key_id, ui_method, callback_data);
+        if (!pkey)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_LOAD_PUBLIC_KEY,
+                        ENGINE_R_FAILED_LOADING_PUBLIC_KEY);
+                return 0;
+                }
+        return pkey;
+        }
+
+int ENGINE_load_ssl_client_cert(ENGINE *e, SSL *s,
+        STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **ppkey,
+        STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data)
+        {
+
+        if(e == NULL)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_LOAD_SSL_CLIENT_CERT,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        if(e->funct_ref == 0)
+                {
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                ENGINEerr(ENGINE_F_ENGINE_LOAD_SSL_CLIENT_CERT,
+                        ENGINE_R_NOT_INITIALISED);
+                return 0;
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        if (!e->load_ssl_client_cert)
+                {
+                ENGINEerr(ENGINE_F_ENGINE_LOAD_SSL_CLIENT_CERT,
+                        ENGINE_R_NO_LOAD_FUNCTION);
+                return 0;
+                }
+        return e->load_ssl_client_cert(e, s, ca_dn, pcert, ppkey, pother,
+                                        ui_method, callback_data);
+        }
diff --git a/src/lib/libcrypto/engine/eng_rdrand.c b/src/lib/libcrypto/engine/eng_rdrand.c
new file mode 100644
index 0000000000..a9ba5ae6f9
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_rdrand.c
@@ -0,0 +1,142 @@
+/* ====================================================================
+ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include <openssl/opensslconf.h>
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/engine.h>
+#include <openssl/rand.h>
+#include <openssl/err.h>
+
+#if (defined(__i386)   || defined(__i386__)   || defined(_M_IX86) || \
+     defined(__x86_64) || defined(__x86_64__) || \
+     defined(_M_AMD64) || defined (_M_X64)) && defined(OPENSSL_CPUID_OBJ)
+
+size_t OPENSSL_ia32_rdrand(void);
+
+static int get_random_bytes (unsigned char *buf, int num)
+        {
+        size_t rnd;
+
+        while (num>=(int)sizeof(size_t)) {
+                if ((rnd = OPENSSL_ia32_rdrand()) == 0) return 0;
+
+                *((size_t *)buf) = rnd;
+                buf += sizeof(size_t);
+                num -= sizeof(size_t);
+        }
+        if (num) {
+                if ((rnd = OPENSSL_ia32_rdrand()) == 0) return 0;
+
+                memcpy (buf,&rnd,num);
+        }
+
+        return 1;
+        }
+
+static int random_status (void)
+{       return 1;       }
+
+static RAND_METHOD rdrand_meth =
+        {
+        NULL,   /* seed */
+        get_random_bytes,
+        NULL,   /* cleanup */
+        NULL,   /* add */
+        get_random_bytes,
+        random_status,
+        };
+
+static int rdrand_init(ENGINE *e)
+{       return 1;       }
+
+static const char *engine_e_rdrand_id = "rdrand";
+static const char *engine_e_rdrand_name = "Intel RDRAND engine";
+
+static int bind_helper(ENGINE *e)
+        {
+        if (!ENGINE_set_id(e, engine_e_rdrand_id) ||
+            !ENGINE_set_name(e, engine_e_rdrand_name) ||
+            !ENGINE_set_init_function(e, rdrand_init) ||
+            !ENGINE_set_RAND(e, &rdrand_meth) )
+                return 0;
+
+        return 1;
+        }
+
+static ENGINE *ENGINE_rdrand(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!bind_helper(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_rdrand (void)
+        {
+        extern unsigned int OPENSSL_ia32cap_P[];
+
+        if (OPENSSL_ia32cap_P[1] & (1<<(62-32)))
+                {
+                ENGINE *toadd = ENGINE_rdrand();
+                if(!toadd) return;
+                ENGINE_add(toadd);
+                ENGINE_free(toadd);
+                ERR_clear_error();
+                }
+        }
+#else
+void ENGINE_load_rdrand (void) {}
+#endif
diff --git a/src/lib/libcrypto/engine/eng_rsax.c b/src/lib/libcrypto/engine/eng_rsax.c
new file mode 100644
index 0000000000..96e63477ee
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_rsax.c
@@ -0,0 +1,668 @@
+/* crypto/engine/eng_rsax.c */
+/* Copyright (c) 2010-2010 Intel Corp.
+ *   Author: Vinodh.Gopal@intel.com
+ *           Jim Guilford
+ *           Erdinc.Ozturk@intel.com
+ *           Maxim.Perminov@intel.com
+ *           Ying.Huang@intel.com
+ *
+ * More information about algorithm used can be found at:
+ *   http://www.cse.buffalo.edu/srds2009/escs2009_submission_Gopal.pdf
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ */
+
+#include <openssl/opensslconf.h>
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/crypto.h>
+#include <openssl/buffer.h>
+#include <openssl/engine.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#include <openssl/bn.h>
+#include <openssl/err.h>
+
+/* RSAX is available **ONLY* on x86_64 CPUs */
+#undef COMPILE_RSAX
+
+#if (defined(__x86_64) || defined(__x86_64__) || \
+     defined(_M_AMD64) || defined (_M_X64)) && !defined(OPENSSL_NO_ASM)
+#define COMPILE_RSAX
+static ENGINE *ENGINE_rsax (void);
+#endif
+
+void ENGINE_load_rsax (void)
+        {
+/* On non-x86 CPUs it just returns. */
+#ifdef COMPILE_RSAX
+        ENGINE *toadd = ENGINE_rsax();
+        if(!toadd) return;
+        ENGINE_add(toadd);
+        ENGINE_free(toadd);
+        ERR_clear_error();
+#endif
+        }
+
+#ifdef COMPILE_RSAX
+#define E_RSAX_LIB_NAME "rsax engine"
+
+static int e_rsax_destroy(ENGINE *e);
+static int e_rsax_init(ENGINE *e);
+static int e_rsax_finish(ENGINE *e);
+static int e_rsax_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void));
+
+#ifndef OPENSSL_NO_RSA
+/* RSA stuff */
+static int e_rsax_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
+static int e_rsax_rsa_finish(RSA *r);
+#endif
+
+static const ENGINE_CMD_DEFN e_rsax_cmd_defns[] = {
+        {0, NULL, NULL, 0}
+        };
+
+#ifndef OPENSSL_NO_RSA
+/* Our internal RSA_METHOD that we provide pointers to */
+static RSA_METHOD e_rsax_rsa =
+        {
+        "Intel RSA-X method",
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        e_rsax_rsa_mod_exp,
+        NULL,
+        NULL,
+        e_rsax_rsa_finish,
+        RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE,
+        NULL,
+        NULL,
+        NULL
+        };
+#endif
+
+/* Constants used when creating the ENGINE */
+static const char *engine_e_rsax_id = "rsax";
+static const char *engine_e_rsax_name = "RSAX engine support";
+
+/* This internal function is used by ENGINE_rsax() */
+static int bind_helper(ENGINE *e)
+        {
+#ifndef OPENSSL_NO_RSA
+        const RSA_METHOD *meth1;
+#endif
+        if(!ENGINE_set_id(e, engine_e_rsax_id) ||
+                        !ENGINE_set_name(e, engine_e_rsax_name) ||
+#ifndef OPENSSL_NO_RSA
+                        !ENGINE_set_RSA(e, &e_rsax_rsa) ||
+#endif
+                        !ENGINE_set_destroy_function(e, e_rsax_destroy) ||
+                        !ENGINE_set_init_function(e, e_rsax_init) ||
+                        !ENGINE_set_finish_function(e, e_rsax_finish) ||
+                        !ENGINE_set_ctrl_function(e, e_rsax_ctrl) ||
+                        !ENGINE_set_cmd_defns(e, e_rsax_cmd_defns))
+                return 0;
+
+#ifndef OPENSSL_NO_RSA
+        meth1 = RSA_PKCS1_SSLeay();
+        e_rsax_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
+        e_rsax_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
+        e_rsax_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
+        e_rsax_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
+        e_rsax_rsa.bn_mod_exp = meth1->bn_mod_exp;
+#endif
+        return 1;
+        }
+
+static ENGINE *ENGINE_rsax(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!bind_helper(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+#ifndef OPENSSL_NO_RSA
+/* Used to attach our own key-data to an RSA structure */
+static int rsax_ex_data_idx = -1;
+#endif
+
+static int e_rsax_destroy(ENGINE *e)
+        {
+        return 1;
+        }
+
+/* (de)initialisation functions. */
+static int e_rsax_init(ENGINE *e)
+        {
+#ifndef OPENSSL_NO_RSA
+        if (rsax_ex_data_idx == -1)
+                rsax_ex_data_idx = RSA_get_ex_new_index(0,
+                        NULL,
+                        NULL, NULL, NULL);
+#endif
+        if (rsax_ex_data_idx  == -1)
+                return 0;
+        return 1;
+        }
+
+static int e_rsax_finish(ENGINE *e)
+        {
+        return 1;
+        }
+
+static int e_rsax_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+        {
+        int to_return = 1;
+
+        switch(cmd)
+                {
+        /* The command isn't understood by this engine */
+        default:
+                to_return = 0;
+                break;
+                }
+
+        return to_return;
+        }
+
+
+#ifndef OPENSSL_NO_RSA
+
+#ifdef _WIN32
+typedef unsigned __int64 UINT64;
+#else
+typedef unsigned long long UINT64;
+#endif
+typedef unsigned short UINT16;
+
+/* Table t is interleaved in the following manner:
+ * The order in memory is t[0][0], t[0][1], ..., t[0][7], t[1][0], ...
+ * A particular 512-bit value is stored in t[][index] rather than the more
+ * normal t[index][]; i.e. the qwords of a particular entry in t are not
+ * adjacent in memory
+ */
+
+/* Init BIGNUM b from the interleaved UINT64 array */
+static int interleaved_array_to_bn_512(BIGNUM* b, UINT64 *array);
+
+/* Extract array elements from BIGNUM b
+ * To set the whole array from b, call with n=8
+ */
+static int bn_extract_to_array_512(const BIGNUM* b, unsigned int n, UINT64 *array);
+
+struct mod_ctx_512 {
+    UINT64 t[8][8];
+    UINT64 m[8];
+    UINT64 m1[8]; /* 2^278 % m */
+    UINT64 m2[8]; /* 2^640 % m */
+    UINT64 k1[2]; /* (- 1/m) % 2^128 */
+};
+
+static int mod_exp_pre_compute_data_512(UINT64 *m, struct mod_ctx_512 *data);
+
+void mod_exp_512(UINT64 *result, /* 512 bits, 8 qwords */
+                 UINT64 *g,      /* 512 bits, 8 qwords */
+                 UINT64 *exp,    /* 512 bits, 8 qwords */
+                 struct mod_ctx_512 *data);
+
+typedef struct st_e_rsax_mod_ctx
+{
+  UINT64 type;
+  union {
+    struct mod_ctx_512 b512;
+  } ctx;
+
+} E_RSAX_MOD_CTX;
+
+static E_RSAX_MOD_CTX *e_rsax_get_ctx(RSA *rsa, int idx, BIGNUM* m)
+{
+        E_RSAX_MOD_CTX *hptr;
+
+        if (idx < 0 || idx > 2)
+           return NULL;
+
+        hptr = RSA_get_ex_data(rsa, rsax_ex_data_idx);
+        if (!hptr) {
+            hptr = OPENSSL_malloc(3*sizeof(E_RSAX_MOD_CTX));
+            if (!hptr) return NULL;
+            hptr[2].type = hptr[1].type= hptr[0].type = 0;
+            RSA_set_ex_data(rsa, rsax_ex_data_idx, hptr);
+        }
+
+        if (hptr[idx].type == (UINT64)BN_num_bits(m))
+            return hptr+idx;
+
+        if (BN_num_bits(m) == 512) {
+            UINT64 _m[8];
+            bn_extract_to_array_512(m, 8, _m);
+            memset( &hptr[idx].ctx.b512, 0, sizeof(struct mod_ctx_512));
+            mod_exp_pre_compute_data_512(_m, &hptr[idx].ctx.b512);
+        }
+
+        hptr[idx].type = BN_num_bits(m);
+        return hptr+idx;
+}
+
+static int e_rsax_rsa_finish(RSA *rsa)
+        {
+        E_RSAX_MOD_CTX *hptr = RSA_get_ex_data(rsa, rsax_ex_data_idx);
+        if(hptr)
+                {
+                OPENSSL_free(hptr);
+                RSA_set_ex_data(rsa, rsax_ex_data_idx, NULL);
+                }
+        if (rsa->_method_mod_n)
+                BN_MONT_CTX_free(rsa->_method_mod_n);
+        if (rsa->_method_mod_p)
+                BN_MONT_CTX_free(rsa->_method_mod_p);
+        if (rsa->_method_mod_q)
+                BN_MONT_CTX_free(rsa->_method_mod_q);
+        return 1;
+        }
+
+
+static int e_rsax_bn_mod_exp(BIGNUM *r, const BIGNUM *g, const BIGNUM *e,
+                    const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont, E_RSAX_MOD_CTX* rsax_mod_ctx )
+{
+        if (rsax_mod_ctx && BN_get_flags(e, BN_FLG_CONSTTIME) != 0) {
+           if (BN_num_bits(m) == 512) {
+                UINT64 _r[8];
+                UINT64 _g[8];
+                UINT64 _e[8];
+
+                /* Init the arrays from the BIGNUMs */
+                bn_extract_to_array_512(g, 8, _g);
+                bn_extract_to_array_512(e, 8, _e);
+
+                mod_exp_512(_r, _g, _e, &rsax_mod_ctx->ctx.b512);
+                /* Return the result in the BIGNUM */
+                interleaved_array_to_bn_512(r, _r);
+                return 1;
+           }
+        }
+
+        return BN_mod_exp_mont(r, g, e, m, ctx, in_mont);
+}
+
+/* Declares for the Intel CIAP 512-bit / CRT / 1024 bit RSA modular
+ * exponentiation routine precalculations and a structure to hold the
+ * necessary values.  These files are meant to live in crypto/rsa/ in
+ * the target openssl.
+ */
+
+/*
+ * Local method: extracts a piece from a BIGNUM, to fit it into
+ * an array. Call with n=8 to extract an entire 512-bit BIGNUM
+ */
+static int bn_extract_to_array_512(const BIGNUM* b, unsigned int n, UINT64 *array)
+{
+        int i;
+        UINT64 tmp;
+        unsigned char bn_buff[64];
+        memset(bn_buff, 0, 64);
+        if (BN_num_bytes(b) > 64) {
+                printf ("Can't support this byte size\n");
+                return 0; }
+        if (BN_num_bytes(b)!=0) {
+                if (!BN_bn2bin(b, bn_buff+(64-BN_num_bytes(b)))) {
+                        printf ("Error's in bn2bin\n");
+                        /* We have to error, here */
+                        return 0; } }
+        while (n-- > 0) {
+                array[n] = 0;
+                for (i=7; i>=0; i--) {
+                        tmp = bn_buff[63-(n*8+i)];
+                        array[n] |= tmp << (8*i); } }
+        return 1;
+}
+
+/* Init a 512-bit BIGNUM from the UINT64*_ (8 * 64) interleaved array */
+static int interleaved_array_to_bn_512(BIGNUM* b, UINT64 *array)
+{
+        unsigned char tmp[64];
+        int n=8;
+        int i;
+        while (n-- > 0) {
+                for (i = 7; i>=0; i--) {
+                        tmp[63-(n*8+i)] = (unsigned char)(array[n]>>(8*i)); } }
+        BN_bin2bn(tmp, 64, b);
+        return 0;
+}
+
+
+/* The main 512bit precompute call */
+static int mod_exp_pre_compute_data_512(UINT64 *m, struct mod_ctx_512 *data)
+ {
+    BIGNUM two_768, two_640, two_128, two_512, tmp, _m, tmp2;
+
+    /* We need a BN_CTX for the modulo functions */
+    BN_CTX* ctx;
+    /* Some tmps */
+    UINT64 _t[8];
+    int i, j, ret = 0;
+
+    /* Init _m with m */
+    BN_init(&_m);
+    interleaved_array_to_bn_512(&_m, m);
+    memset(_t, 0, 64);
+
+    /* Inits */
+    BN_init(&two_768);
+    BN_init(&two_640);
+    BN_init(&two_128);
+    BN_init(&two_512);
+    BN_init(&tmp);
+    BN_init(&tmp2);
+
+    /* Create our context */
+    if ((ctx=BN_CTX_new()) == NULL) { goto err; }
+        BN_CTX_start(ctx);
+
+    /*
+     * For production, if you care, these only need to be set once,
+     * and may be made constants.
+     */
+    BN_lshift(&two_768, BN_value_one(), 768);
+    BN_lshift(&two_640, BN_value_one(), 640);
+    BN_lshift(&two_128, BN_value_one(), 128);
+    BN_lshift(&two_512, BN_value_one(), 512);
+
+    if (0 == (m[7] & 0x8000000000000000)) {
+        exit(1);
+    }
+    if (0 == (m[0] & 0x1)) { /* Odd modulus required for Mont */
+        exit(1);
+    }
+
+    /* Precompute m1 */
+    BN_mod(&tmp, &two_768, &_m, ctx);
+    if (!bn_extract_to_array_512(&tmp, 8, &data->m1[0])) {
+            goto err; }
+
+    /* Precompute m2 */
+    BN_mod(&tmp, &two_640, &_m, ctx);
+    if (!bn_extract_to_array_512(&tmp, 8, &data->m2[0])) {
+            goto err;
+    }
+
+    /*
+     * Precompute k1, a 128b number = ((-1)* m-1 ) mod 2128; k1 should
+     * be non-negative.
+     */
+    BN_mod_inverse(&tmp, &_m, &two_128, ctx);
+    if (!BN_is_zero(&tmp)) { BN_sub(&tmp, &two_128, &tmp); }
+    if (!bn_extract_to_array_512(&tmp, 2, &data->k1[0])) {
+            goto err; }
+
+    /* Precompute t */
+    for (i=0; i<8; i++) {
+        BN_zero(&tmp);
+        if (i & 1) { BN_add(&tmp, &two_512, &tmp); }
+        if (i & 2) { BN_add(&tmp, &two_512, &tmp); }
+        if (i & 4) { BN_add(&tmp, &two_640, &tmp); }
+
+        BN_nnmod(&tmp2, &tmp, &_m, ctx);
+        if (!bn_extract_to_array_512(&tmp2, 8, _t)) {
+                goto err; }
+        for (j=0; j<8; j++) data->t[j][i] = _t[j]; }
+
+    /* Precompute m */
+    for (i=0; i<8; i++) {
+        data->m[i] = m[i]; }
+
+    ret = 1;
+
+err:
+    /* Cleanup */
+        if (ctx != NULL) {
+                BN_CTX_end(ctx); BN_CTX_free(ctx); }
+    BN_free(&two_768);
+    BN_free(&two_640);
+    BN_free(&two_128);
+    BN_free(&two_512);
+    BN_free(&tmp);
+    BN_free(&tmp2);
+    BN_free(&_m);
+
+    return ret;
+}
+
+
+static int e_rsax_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
+        {
+        BIGNUM *r1,*m1,*vrfy;
+        BIGNUM local_dmp1,local_dmq1,local_c,local_r1;
+        BIGNUM *dmp1,*dmq1,*c,*pr1;
+        int ret=0;
+
+        BN_CTX_start(ctx);
+        r1 = BN_CTX_get(ctx);
+        m1 = BN_CTX_get(ctx);
+        vrfy = BN_CTX_get(ctx);
+
+        {
+                BIGNUM local_p, local_q;
+                BIGNUM *p = NULL, *q = NULL;
+                int error = 0;
+
+                /* Make sure BN_mod_inverse in Montgomery
+                 * intialization uses the BN_FLG_CONSTTIME flag
+                 * (unless RSA_FLAG_NO_CONSTTIME is set)
+                 */
+                if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                        {
+                        BN_init(&local_p);
+                        p = &local_p;
+                        BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);
+
+                        BN_init(&local_q);
+                        q = &local_q;
+                        BN_with_flags(q, rsa->q, BN_FLG_CONSTTIME);
+                        }
+                else
+                        {
+                        p = rsa->p;
+                        q = rsa->q;
+                        }
+
+                if (rsa->flags & RSA_FLAG_CACHE_PRIVATE)
+                        {
+                        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_p, CRYPTO_LOCK_RSA, p, ctx))
+                                error = 1;
+                        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_q, CRYPTO_LOCK_RSA, q, ctx))
+                                error = 1;
+                        }
+
+                /* clean up */
+                if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                        {
+                        BN_free(&local_p);
+                        BN_free(&local_q);
+                        }
+                if ( error )
+                        goto err;
+        }
+
+        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
+                if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))
+                        goto err;
+
+        /* compute I mod q */
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                {
+                c = &local_c;
+                BN_with_flags(c, I, BN_FLG_CONSTTIME);
+                if (!BN_mod(r1,c,rsa->q,ctx)) goto err;
+                }
+        else
+                {
+                if (!BN_mod(r1,I,rsa->q,ctx)) goto err;
+                }
+
+        /* compute r1^dmq1 mod q */
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                {
+                dmq1 = &local_dmq1;
+                BN_with_flags(dmq1, rsa->dmq1, BN_FLG_CONSTTIME);
+                }
+        else
+                dmq1 = rsa->dmq1;
+
+        if (!e_rsax_bn_mod_exp(m1,r1,dmq1,rsa->q,ctx,
+                rsa->_method_mod_q, e_rsax_get_ctx(rsa, 0, rsa->q) )) goto err;
+
+        /* compute I mod p */
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                {
+                c = &local_c;
+                BN_with_flags(c, I, BN_FLG_CONSTTIME);
+                if (!BN_mod(r1,c,rsa->p,ctx)) goto err;
+                }
+        else
+                {
+                if (!BN_mod(r1,I,rsa->p,ctx)) goto err;
+                }
+
+        /* compute r1^dmp1 mod p */
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                {
+                dmp1 = &local_dmp1;
+                BN_with_flags(dmp1, rsa->dmp1, BN_FLG_CONSTTIME);
+                }
+        else
+                dmp1 = rsa->dmp1;
+
+        if (!e_rsax_bn_mod_exp(r0,r1,dmp1,rsa->p,ctx,
+                rsa->_method_mod_p, e_rsax_get_ctx(rsa, 1, rsa->p) )) goto err;
+
+        if (!BN_sub(r0,r0,m1)) goto err;
+        /* This will help stop the size of r0 increasing, which does
+         * affect the multiply if it optimised for a power of 2 size */
+        if (BN_is_negative(r0))
+                if (!BN_add(r0,r0,rsa->p)) goto err;
+
+        if (!BN_mul(r1,r0,rsa->iqmp,ctx)) goto err;
+
+        /* Turn BN_FLG_CONSTTIME flag on before division operation */
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                {
+                pr1 = &local_r1;
+                BN_with_flags(pr1, r1, BN_FLG_CONSTTIME);
+                }
+        else
+                pr1 = r1;
+        if (!BN_mod(r0,pr1,rsa->p,ctx)) goto err;
+
+        /* If p < q it is occasionally possible for the correction of
+         * adding 'p' if r0 is negative above to leave the result still
+         * negative. This can break the private key operations: the following
+         * second correction should *always* correct this rare occurrence.
+         * This will *never* happen with OpenSSL generated keys because
+         * they ensure p > q [steve]
+         */
+        if (BN_is_negative(r0))
+                if (!BN_add(r0,r0,rsa->p)) goto err;
+        if (!BN_mul(r1,r0,rsa->q,ctx)) goto err;
+        if (!BN_add(r0,r1,m1)) goto err;
+
+        if (rsa->e && rsa->n)
+                {
+                if (!e_rsax_bn_mod_exp(vrfy,r0,rsa->e,rsa->n,ctx,rsa->_method_mod_n, e_rsax_get_ctx(rsa, 2, rsa->n) ))
+                    goto err;
+
+                /* If 'I' was greater than (or equal to) rsa->n, the operation
+                 * will be equivalent to using 'I mod n'. However, the result of
+                 * the verify will *always* be less than 'n' so we don't check
+                 * for absolute equality, just congruency. */
+                if (!BN_sub(vrfy, vrfy, I)) goto err;
+                if (!BN_mod(vrfy, vrfy, rsa->n, ctx)) goto err;
+                if (BN_is_negative(vrfy))
+                        if (!BN_add(vrfy, vrfy, rsa->n)) goto err;
+                if (!BN_is_zero(vrfy))
+                        {
+                        /* 'I' and 'vrfy' aren't congruent mod n. Don't leak
+                         * miscalculated CRT output, just do a raw (slower)
+                         * mod_exp and return that instead. */
+
+                        BIGNUM local_d;
+                        BIGNUM *d = NULL;
+
+                        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                                {
+                                d = &local_d;
+                                BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
+                                }
+                        else
+                                d = rsa->d;
+                        if (!e_rsax_bn_mod_exp(r0,I,d,rsa->n,ctx,
+                                                   rsa->_method_mod_n, e_rsax_get_ctx(rsa, 2, rsa->n) )) goto err;
+                        }
+                }
+        ret=1;
+
+err:
+        BN_CTX_end(ctx);
+
+        return ret;
+        }
+#endif /* !OPENSSL_NO_RSA */
+#endif /* !COMPILE_RSAX */
diff --git a/src/lib/libcrypto/engine/eng_table.c b/src/lib/libcrypto/engine/eng_table.c
new file mode 100644
index 0000000000..4fde948185
--- /dev/null
+++ b/src/lib/libcrypto/engine/eng_table.c
@@ -0,0 +1,351 @@
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/lhash.h>
+#include "eng_int.h"
+
+/* The type of the items in the table */
+typedef struct st_engine_pile
+        {
+        /* The 'nid' of this algorithm/mode */
+        int nid;
+        /* ENGINEs that implement this algorithm/mode. */
+        STACK_OF(ENGINE) *sk;
+        /* The default ENGINE to perform this algorithm/mode. */
+        ENGINE *funct;
+        /* Zero if 'sk' is newer than the cached 'funct', non-zero otherwise */
+        int uptodate;
+        } ENGINE_PILE;
+
+DECLARE_LHASH_OF(ENGINE_PILE);
+
+/* The type exposed in eng_int.h */
+struct st_engine_table
+        {
+        LHASH_OF(ENGINE_PILE) piles;
+        }; /* ENGINE_TABLE */
+
+
+typedef struct st_engine_pile_doall
+        {
+        engine_table_doall_cb *cb;
+        void *arg;
+        } ENGINE_PILE_DOALL;
+        
+
+/* Global flags (ENGINE_TABLE_FLAG_***). */
+static unsigned int table_flags = 0;
+
+/* API function manipulating 'table_flags' */
+unsigned int ENGINE_get_table_flags(void)
+        {
+        return table_flags;
+        }
+
+void ENGINE_set_table_flags(unsigned int flags)
+        {
+        table_flags = flags;
+        }
+
+/* Internal functions for the "piles" hash table */
+static unsigned long engine_pile_hash(const ENGINE_PILE *c)
+        {
+        return c->nid;
+        }
+
+static int engine_pile_cmp(const ENGINE_PILE *a, const ENGINE_PILE *b)
+        {
+        return a->nid - b->nid;
+        }
+static IMPLEMENT_LHASH_HASH_FN(engine_pile, ENGINE_PILE)
+static IMPLEMENT_LHASH_COMP_FN(engine_pile, ENGINE_PILE)
+
+static int int_table_check(ENGINE_TABLE **t, int create)
+        {
+        LHASH_OF(ENGINE_PILE) *lh;
+
+        if(*t) return 1;
+        if(!create) return 0;
+        if((lh = lh_ENGINE_PILE_new()) == NULL)
+                return 0;
+        *t = (ENGINE_TABLE *)lh;
+        return 1;
+        }
+
+/* Privately exposed (via eng_int.h) functions for adding and/or removing
+ * ENGINEs from the implementation table */
+int engine_table_register(ENGINE_TABLE **table, ENGINE_CLEANUP_CB *cleanup,
+                ENGINE *e, const int *nids, int num_nids, int setdefault)
+        {
+        int ret = 0, added = 0;
+        ENGINE_PILE tmplate, *fnd;
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        if(!(*table))
+                added = 1;
+        if(!int_table_check(table, 1))
+                goto end;
+        if(added)
+                /* The cleanup callback needs to be added */
+                engine_cleanup_add_first(cleanup);
+        while(num_nids--)
+                {
+                tmplate.nid = *nids;
+                fnd = lh_ENGINE_PILE_retrieve(&(*table)->piles, &tmplate);
+                if(!fnd)
+                        {
+                        fnd = OPENSSL_malloc(sizeof(ENGINE_PILE));
+                        if(!fnd) goto end;
+                        fnd->uptodate = 1;
+                        fnd->nid = *nids;
+                        fnd->sk = sk_ENGINE_new_null();
+                        if(!fnd->sk)
+                                {
+                                OPENSSL_free(fnd);
+                                goto end;
+                                }
+                        fnd->funct = NULL;
+                        (void)lh_ENGINE_PILE_insert(&(*table)->piles, fnd);
+                        }
+                /* A registration shouldn't add duplciate entries */
+                (void)sk_ENGINE_delete_ptr(fnd->sk, e);
+                /* if 'setdefault', this ENGINE goes to the head of the list */
+                if(!sk_ENGINE_push(fnd->sk, e))
+                        goto end;
+                /* "touch" this ENGINE_PILE */
+                fnd->uptodate = 0;
+                if(setdefault)
+                        {
+                        if(!engine_unlocked_init(e))
+                                {
+                                ENGINEerr(ENGINE_F_ENGINE_TABLE_REGISTER,
+                                                ENGINE_R_INIT_FAILED);
+                                goto end;
+                                }
+                        if(fnd->funct)
+                                engine_unlocked_finish(fnd->funct, 0);
+                        fnd->funct = e;
+                        fnd->uptodate = 1;
+                        }
+                nids++;
+                }
+        ret = 1;
+end:
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        return ret;
+        }
+static void int_unregister_cb_doall_arg(ENGINE_PILE *pile, ENGINE *e)
+        {
+        int n;
+        /* Iterate the 'c->sk' stack removing any occurance of 'e' */
+        while((n = sk_ENGINE_find(pile->sk, e)) >= 0)
+                {
+                (void)sk_ENGINE_delete(pile->sk, n);
+                pile->uptodate = 0;
+                }
+        if(pile->funct == e)
+                {
+                engine_unlocked_finish(e, 0);
+                pile->funct = NULL;
+                }
+        }
+static IMPLEMENT_LHASH_DOALL_ARG_FN(int_unregister_cb, ENGINE_PILE, ENGINE)
+
+void engine_table_unregister(ENGINE_TABLE **table, ENGINE *e)
+        {
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        if(int_table_check(table, 0))
+                lh_ENGINE_PILE_doall_arg(&(*table)->piles,
+                                         LHASH_DOALL_ARG_FN(int_unregister_cb),
+                                         ENGINE, e);
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        }
+
+static void int_cleanup_cb_doall(ENGINE_PILE *p)
+        {
+        sk_ENGINE_free(p->sk);
+        if(p->funct)
+                engine_unlocked_finish(p->funct, 0);
+        OPENSSL_free(p);
+        }
+static IMPLEMENT_LHASH_DOALL_FN(int_cleanup_cb, ENGINE_PILE)
+
+void engine_table_cleanup(ENGINE_TABLE **table)
+        {
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        if(*table)
+                {
+                lh_ENGINE_PILE_doall(&(*table)->piles,
+                                     LHASH_DOALL_FN(int_cleanup_cb));
+                lh_ENGINE_PILE_free(&(*table)->piles);
+                *table = NULL;
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        }
+
+/* return a functional reference for a given 'nid' */
+#ifndef ENGINE_TABLE_DEBUG
+ENGINE *engine_table_select(ENGINE_TABLE **table, int nid)
+#else
+ENGINE *engine_table_select_tmp(ENGINE_TABLE **table, int nid, const char *f, int l)
+#endif
+        {
+        ENGINE *ret = NULL;
+        ENGINE_PILE tmplate, *fnd=NULL;
+        int initres, loop = 0;
+
+        if(!(*table))
+                {
+#ifdef ENGINE_TABLE_DEBUG
+                fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, nothing "
+                        "registered!\n", f, l, nid);
+#endif
+                return NULL;
+                }
+        ERR_set_mark();
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        /* Check again inside the lock otherwise we could race against cleanup
+         * operations. But don't worry about a fprintf(stderr). */
+        if(!int_table_check(table, 0)) goto end;
+        tmplate.nid = nid;
+        fnd = lh_ENGINE_PILE_retrieve(&(*table)->piles, &tmplate);
+        if(!fnd) goto end;
+        if(fnd->funct && engine_unlocked_init(fnd->funct))
+                {
+#ifdef ENGINE_TABLE_DEBUG
+                fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, using "
+                        "ENGINE '%s' cached\n", f, l, nid, fnd->funct->id);
+#endif
+                ret = fnd->funct;
+                goto end;
+                }
+        if(fnd->uptodate)
+                {
+                ret = fnd->funct;
+                goto end;
+                }
+trynext:
+        ret = sk_ENGINE_value(fnd->sk, loop++);
+        if(!ret)
+                {
+#ifdef ENGINE_TABLE_DEBUG
+                fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, no "
+                                "registered implementations would initialise\n",
+                                f, l, nid);
+#endif
+                goto end;
+                }
+        /* Try to initialise the ENGINE? */
+        if((ret->funct_ref > 0) || !(table_flags & ENGINE_TABLE_FLAG_NOINIT))
+                initres = engine_unlocked_init(ret);
+        else
+                initres = 0;
+        if(initres)
+                {
+                /* Update 'funct' */
+                if((fnd->funct != ret) && engine_unlocked_init(ret))
+                        {
+                        /* If there was a previous default we release it. */
+                        if(fnd->funct)
+                                engine_unlocked_finish(fnd->funct, 0);
+                        fnd->funct = ret;
+#ifdef ENGINE_TABLE_DEBUG
+                        fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, "
+                                "setting default to '%s'\n", f, l, nid, ret->id);
+#endif
+                        }
+#ifdef ENGINE_TABLE_DEBUG
+                fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, using "
+                                "newly initialised '%s'\n", f, l, nid, ret->id);
+#endif
+                goto end;
+                }
+        goto trynext;
+end:
+        /* If it failed, it is unlikely to succeed again until some future
+         * registrations have taken place. In all cases, we cache. */
+        if(fnd) fnd->uptodate = 1;
+#ifdef ENGINE_TABLE_DEBUG
+        if(ret)
+                fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, caching "
+                                "ENGINE '%s'\n", f, l, nid, ret->id);
+        else
+                fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, caching "
+                                "'no matching ENGINE'\n", f, l, nid);
+#endif
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        /* Whatever happened, any failed init()s are not failures in this
+         * context, so clear our error state. */
+        ERR_pop_to_mark();
+        return ret;
+        }
+
+/* Table enumeration */
+
+static void int_cb_doall_arg(ENGINE_PILE *pile, ENGINE_PILE_DOALL *dall)
+        {
+        dall->cb(pile->nid, pile->sk, pile->funct, dall->arg);
+        }
+static IMPLEMENT_LHASH_DOALL_ARG_FN(int_cb, ENGINE_PILE,ENGINE_PILE_DOALL)
+
+void engine_table_doall(ENGINE_TABLE *table, engine_table_doall_cb *cb,
+                                                                void *arg)
+        {
+        ENGINE_PILE_DOALL dall;
+        dall.cb = cb;
+        dall.arg = arg;
+        lh_ENGINE_PILE_doall_arg(&table->piles, LHASH_DOALL_ARG_FN(int_cb),
+                                 ENGINE_PILE_DOALL, &dall);
+        }
diff --git a/src/lib/libcrypto/engine/engine.h b/src/lib/libcrypto/engine/engine.h
new file mode 100644
index 0000000000..9d73abac8e
--- /dev/null
+++ b/src/lib/libcrypto/engine/engine.h
@@ -0,0 +1,834 @@
+/* openssl/engine.h */
+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
+ * project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
+
+#ifndef HEADER_ENGINE_H
+#define HEADER_ENGINE_H
+
+#include <openssl/opensslconf.h>
+
+#ifdef OPENSSL_NO_ENGINE
+#error ENGINE is disabled.
+#endif
+
+#ifndef OPENSSL_NO_DEPRECATED
+#include <openssl/bn.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#ifndef OPENSSL_NO_ECDH
+#include <openssl/ecdh.h>
+#endif
+#ifndef OPENSSL_NO_ECDSA
+#include <openssl/ecdsa.h>
+#endif
+#include <openssl/rand.h>
+#include <openssl/ui.h>
+#include <openssl/err.h>
+#endif
+
+#include <openssl/ossl_typ.h>
+#include <openssl/symhacks.h>
+
+#include <openssl/x509.h>
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* These flags are used to control combinations of algorithm (methods)
+ * by bitwise "OR"ing. */
+#define ENGINE_METHOD_RSA               (unsigned int)0x0001
+#define ENGINE_METHOD_DSA               (unsigned int)0x0002
+#define ENGINE_METHOD_DH                (unsigned int)0x0004
+#define ENGINE_METHOD_RAND              (unsigned int)0x0008
+#define ENGINE_METHOD_ECDH              (unsigned int)0x0010
+#define ENGINE_METHOD_ECDSA             (unsigned int)0x0020
+#define ENGINE_METHOD_CIPHERS           (unsigned int)0x0040
+#define ENGINE_METHOD_DIGESTS           (unsigned int)0x0080
+#define ENGINE_METHOD_STORE             (unsigned int)0x0100
+#define ENGINE_METHOD_PKEY_METHS        (unsigned int)0x0200
+#define ENGINE_METHOD_PKEY_ASN1_METHS   (unsigned int)0x0400
+/* Obvious all-or-nothing cases. */
+#define ENGINE_METHOD_ALL               (unsigned int)0xFFFF
+#define ENGINE_METHOD_NONE              (unsigned int)0x0000
+
+/* This(ese) flag(s) controls behaviour of the ENGINE_TABLE mechanism used
+ * internally to control registration of ENGINE implementations, and can be set
+ * by ENGINE_set_table_flags(). The "NOINIT" flag prevents attempts to
+ * initialise registered ENGINEs if they are not already initialised. */
+#define ENGINE_TABLE_FLAG_NOINIT        (unsigned int)0x0001
+
+/* ENGINE flags that can be set by ENGINE_set_flags(). */
+/* #define ENGINE_FLAGS_MALLOCED        0x0001 */ /* Not used */
+
+/* This flag is for ENGINEs that wish to handle the various 'CMD'-related
+ * control commands on their own. Without this flag, ENGINE_ctrl() handles these
+ * control commands on behalf of the ENGINE using their "cmd_defns" data. */
+#define ENGINE_FLAGS_MANUAL_CMD_CTRL    (int)0x0002
+
+/* This flag is for ENGINEs who return new duplicate structures when found via
+ * "ENGINE_by_id()". When an ENGINE must store state (eg. if ENGINE_ctrl()
+ * commands are called in sequence as part of some stateful process like
+ * key-generation setup and execution), it can set this flag - then each attempt
+ * to obtain the ENGINE will result in it being copied into a new structure.
+ * Normally, ENGINEs don't declare this flag so ENGINE_by_id() just increments
+ * the existing ENGINE's structural reference count. */
+#define ENGINE_FLAGS_BY_ID_COPY         (int)0x0004
+
+/* ENGINEs can support their own command types, and these flags are used in
+ * ENGINE_CTRL_GET_CMD_FLAGS to indicate to the caller what kind of input each
+ * command expects. Currently only numeric and string input is supported. If a
+ * control command supports none of the _NUMERIC, _STRING, or _NO_INPUT options,
+ * then it is regarded as an "internal" control command - and not for use in
+ * config setting situations. As such, they're not available to the
+ * ENGINE_ctrl_cmd_string() function, only raw ENGINE_ctrl() access. Changes to
+ * this list of 'command types' should be reflected carefully in
+ * ENGINE_cmd_is_executable() and ENGINE_ctrl_cmd_string(). */
+
+/* accepts a 'long' input value (3rd parameter to ENGINE_ctrl) */
+#define ENGINE_CMD_FLAG_NUMERIC         (unsigned int)0x0001
+/* accepts string input (cast from 'void*' to 'const char *', 4th parameter to
+ * ENGINE_ctrl) */
+#define ENGINE_CMD_FLAG_STRING          (unsigned int)0x0002
+/* Indicates that the control command takes *no* input. Ie. the control command
+ * is unparameterised. */
+#define ENGINE_CMD_FLAG_NO_INPUT        (unsigned int)0x0004
+/* Indicates that the control command is internal. This control command won't
+ * be shown in any output, and is only usable through the ENGINE_ctrl_cmd()
+ * function. */
+#define ENGINE_CMD_FLAG_INTERNAL        (unsigned int)0x0008
+
+/* NB: These 3 control commands are deprecated and should not be used. ENGINEs
+ * relying on these commands should compile conditional support for
+ * compatibility (eg. if these symbols are defined) but should also migrate the
+ * same functionality to their own ENGINE-specific control functions that can be
+ * "discovered" by calling applications. The fact these control commands
+ * wouldn't be "executable" (ie. usable by text-based config) doesn't change the
+ * fact that application code can find and use them without requiring per-ENGINE
+ * hacking. */
+
+/* These flags are used to tell the ctrl function what should be done.
+ * All command numbers are shared between all engines, even if some don't
+ * make sense to some engines.  In such a case, they do nothing but return
+ * the error ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED. */
+#define ENGINE_CTRL_SET_LOGSTREAM               1
+#define ENGINE_CTRL_SET_PASSWORD_CALLBACK       2
+#define ENGINE_CTRL_HUP                         3 /* Close and reinitialise any
+                                                     handles/connections etc. */
+#define ENGINE_CTRL_SET_USER_INTERFACE          4 /* Alternative to callback */
+#define ENGINE_CTRL_SET_CALLBACK_DATA           5 /* User-specific data, used
+                                                     when calling the password
+                                                     callback and the user
+                                                     interface */
+#define ENGINE_CTRL_LOAD_CONFIGURATION          6 /* Load a configuration, given
+                                                     a string that represents a
+                                                     file name or so */
+#define ENGINE_CTRL_LOAD_SECTION                7 /* Load data from a given
+                                                     section in the already loaded
+                                                     configuration */
+
+/* These control commands allow an application to deal with an arbitrary engine
+ * in a dynamic way. Warn: Negative return values indicate errors FOR THESE
+ * COMMANDS because zero is used to indicate 'end-of-list'. Other commands,
+ * including ENGINE-specific command types, return zero for an error.
+ *
+ * An ENGINE can choose to implement these ctrl functions, and can internally
+ * manage things however it chooses - it does so by setting the
+ * ENGINE_FLAGS_MANUAL_CMD_CTRL flag (using ENGINE_set_flags()). Otherwise the
+ * ENGINE_ctrl() code handles this on the ENGINE's behalf using the cmd_defns
+ * data (set using ENGINE_set_cmd_defns()). This means an ENGINE's ctrl()
+ * handler need only implement its own commands - the above "meta" commands will
+ * be taken care of. */
+
+/* Returns non-zero if the supplied ENGINE has a ctrl() handler. If "not", then
+ * all the remaining control commands will return failure, so it is worth
+ * checking this first if the caller is trying to "discover" the engine's
+ * capabilities and doesn't want errors generated unnecessarily. */
+#define ENGINE_CTRL_HAS_CTRL_FUNCTION           10
+/* Returns a positive command number for the first command supported by the
+ * engine. Returns zero if no ctrl commands are supported. */
+#define ENGINE_CTRL_GET_FIRST_CMD_TYPE          11
+/* The 'long' argument specifies a command implemented by the engine, and the
+ * return value is the next command supported, or zero if there are no more. */
+#define ENGINE_CTRL_GET_NEXT_CMD_TYPE           12
+/* The 'void*' argument is a command name (cast from 'const char *'), and the
+ * return value is the command that corresponds to it. */
+#define ENGINE_CTRL_GET_CMD_FROM_NAME           13
+/* The next two allow a command to be converted into its corresponding string
+ * form. In each case, the 'long' argument supplies the command. In the NAME_LEN
+ * case, the return value is the length of the command name (not counting a
+ * trailing EOL). In the NAME case, the 'void*' argument must be a string buffer
+ * large enough, and it will be populated with the name of the command (WITH a
+ * trailing EOL). */
+#define ENGINE_CTRL_GET_NAME_LEN_FROM_CMD       14
+#define ENGINE_CTRL_GET_NAME_FROM_CMD           15
+/* The next two are similar but give a "short description" of a command. */
+#define ENGINE_CTRL_GET_DESC_LEN_FROM_CMD       16
+#define ENGINE_CTRL_GET_DESC_FROM_CMD           17
+/* With this command, the return value is the OR'd combination of
+ * ENGINE_CMD_FLAG_*** values that indicate what kind of input a given
+ * engine-specific ctrl command expects. */
+#define ENGINE_CTRL_GET_CMD_FLAGS               18
+
+/* ENGINE implementations should start the numbering of their own control
+ * commands from this value. (ie. ENGINE_CMD_BASE, ENGINE_CMD_BASE + 1, etc). */
+#define ENGINE_CMD_BASE                         200
+
+/* NB: These 2 nCipher "chil" control commands are deprecated, and their
+ * functionality is now available through ENGINE-specific control commands
+ * (exposed through the above-mentioned 'CMD'-handling). Code using these 2
+ * commands should be migrated to the more general command handling before these
+ * are removed. */
+
+/* Flags specific to the nCipher "chil" engine */
+#define ENGINE_CTRL_CHIL_SET_FORKCHECK          100
+        /* Depending on the value of the (long)i argument, this sets or
+         * unsets the SimpleForkCheck flag in the CHIL API to enable or
+         * disable checking and workarounds for applications that fork().
+         */
+#define ENGINE_CTRL_CHIL_NO_LOCKING             101
+        /* This prevents the initialisation function from providing mutex
+         * callbacks to the nCipher library. */
+
+/* If an ENGINE supports its own specific control commands and wishes the
+ * framework to handle the above 'ENGINE_CMD_***'-manipulation commands on its
+ * behalf, it should supply a null-terminated array of ENGINE_CMD_DEFN entries
+ * to ENGINE_set_cmd_defns(). It should also implement a ctrl() handler that
+ * supports the stated commands (ie. the "cmd_num" entries as described by the
+ * array). NB: The array must be ordered in increasing order of cmd_num.
+ * "null-terminated" means that the last ENGINE_CMD_DEFN element has cmd_num set
+ * to zero and/or cmd_name set to NULL. */
+typedef struct ENGINE_CMD_DEFN_st
+        {
+        unsigned int cmd_num; /* The command number */
+        const char *cmd_name; /* The command name itself */
+        const char *cmd_desc; /* A short description of the command */
+        unsigned int cmd_flags; /* The input the command expects */
+        } ENGINE_CMD_DEFN;
+
+/* Generic function pointer */
+typedef int (*ENGINE_GEN_FUNC_PTR)(void);
+/* Generic function pointer taking no arguments */
+typedef int (*ENGINE_GEN_INT_FUNC_PTR)(ENGINE *);
+/* Specific control function pointer */
+typedef int (*ENGINE_CTRL_FUNC_PTR)(ENGINE *, int, long, void *, void (*f)(void));
+/* Generic load_key function pointer */
+typedef EVP_PKEY * (*ENGINE_LOAD_KEY_PTR)(ENGINE *, const char *,
+        UI_METHOD *ui_method, void *callback_data);
+typedef int (*ENGINE_SSL_CLIENT_CERT_PTR)(ENGINE *, SSL *ssl,
+        STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,
+        STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data);
+/* These callback types are for an ENGINE's handler for cipher and digest logic.
+ * These handlers have these prototypes;
+ *   int foo(ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid);
+ *   int foo(ENGINE *e, const EVP_MD **digest, const int **nids, int nid);
+ * Looking at how to implement these handlers in the case of cipher support, if
+ * the framework wants the EVP_CIPHER for 'nid', it will call;
+ *   foo(e, &p_evp_cipher, NULL, nid);    (return zero for failure)
+ * If the framework wants a list of supported 'nid's, it will call;
+ *   foo(e, NULL, &p_nids, 0); (returns number of 'nids' or -1 for error)
+ */
+/* Returns to a pointer to the array of supported cipher 'nid's. If the second
+ * parameter is non-NULL it is set to the size of the returned array. */
+typedef int (*ENGINE_CIPHERS_PTR)(ENGINE *, const EVP_CIPHER **, const int **, int);
+typedef int (*ENGINE_DIGESTS_PTR)(ENGINE *, const EVP_MD **, const int **, int);
+typedef int (*ENGINE_PKEY_METHS_PTR)(ENGINE *, EVP_PKEY_METHOD **, const int **, int);
+typedef int (*ENGINE_PKEY_ASN1_METHS_PTR)(ENGINE *, EVP_PKEY_ASN1_METHOD **, const int **, int);
+/* STRUCTURE functions ... all of these functions deal with pointers to ENGINE
+ * structures where the pointers have a "structural reference". This means that
+ * their reference is to allowed access to the structure but it does not imply
+ * that the structure is functional. To simply increment or decrement the
+ * structural reference count, use ENGINE_by_id and ENGINE_free. NB: This is not
+ * required when iterating using ENGINE_get_next as it will automatically
+ * decrement the structural reference count of the "current" ENGINE and
+ * increment the structural reference count of the ENGINE it returns (unless it
+ * is NULL). */
+
+/* Get the first/last "ENGINE" type available. */
+ENGINE *ENGINE_get_first(void);
+ENGINE *ENGINE_get_last(void);
+/* Iterate to the next/previous "ENGINE" type (NULL = end of the list). */
+ENGINE *ENGINE_get_next(ENGINE *e);
+ENGINE *ENGINE_get_prev(ENGINE *e);
+/* Add another "ENGINE" type into the array. */
+int ENGINE_add(ENGINE *e);
+/* Remove an existing "ENGINE" type from the array. */
+int ENGINE_remove(ENGINE *e);
+/* Retrieve an engine from the list by its unique "id" value. */
+ENGINE *ENGINE_by_id(const char *id);
+/* Add all the built-in engines. */
+void ENGINE_load_openssl(void);
+void ENGINE_load_dynamic(void);
+#ifndef OPENSSL_NO_STATIC_ENGINE
+void ENGINE_load_4758cca(void);
+void ENGINE_load_aep(void);
+void ENGINE_load_atalla(void);
+void ENGINE_load_chil(void);
+void ENGINE_load_cswift(void);
+void ENGINE_load_nuron(void);
+void ENGINE_load_sureware(void);
+void ENGINE_load_ubsec(void);
+void ENGINE_load_padlock(void);
+void ENGINE_load_capi(void);
+#ifndef OPENSSL_NO_GMP
+void ENGINE_load_gmp(void);
+#endif
+#ifndef OPENSSL_NO_GOST
+void ENGINE_load_gost(void);
+#endif
+#endif
+void ENGINE_load_cryptodev(void);
+void ENGINE_load_aesni(void);
+void ENGINE_load_builtin_engines(void);
+
+/* Get and set global flags (ENGINE_TABLE_FLAG_***) for the implementation
+ * "registry" handling. */
+unsigned int ENGINE_get_table_flags(void);
+void ENGINE_set_table_flags(unsigned int flags);
+
+/* Manage registration of ENGINEs per "table". For each type, there are 3
+ * functions;
+ *   ENGINE_register_***(e) - registers the implementation from 'e' (if it has one)
+ *   ENGINE_unregister_***(e) - unregister the implementation from 'e'
+ *   ENGINE_register_all_***() - call ENGINE_register_***() for each 'e' in the list
+ * Cleanup is automatically registered from each table when required, so
+ * ENGINE_cleanup() will reverse any "register" operations. */
+
+int ENGINE_register_RSA(ENGINE *e);
+void ENGINE_unregister_RSA(ENGINE *e);
+void ENGINE_register_all_RSA(void);
+
+int ENGINE_register_DSA(ENGINE *e);
+void ENGINE_unregister_DSA(ENGINE *e);
+void ENGINE_register_all_DSA(void);
+
+int ENGINE_register_ECDH(ENGINE *e);
+void ENGINE_unregister_ECDH(ENGINE *e);
+void ENGINE_register_all_ECDH(void);
+
+int ENGINE_register_ECDSA(ENGINE *e);
+void ENGINE_unregister_ECDSA(ENGINE *e);
+void ENGINE_register_all_ECDSA(void);
+
+int ENGINE_register_DH(ENGINE *e);
+void ENGINE_unregister_DH(ENGINE *e);
+void ENGINE_register_all_DH(void);
+
+int ENGINE_register_RAND(ENGINE *e);
+void ENGINE_unregister_RAND(ENGINE *e);
+void ENGINE_register_all_RAND(void);
+
+int ENGINE_register_STORE(ENGINE *e);
+void ENGINE_unregister_STORE(ENGINE *e);
+void ENGINE_register_all_STORE(void);
+
+int ENGINE_register_ciphers(ENGINE *e);
+void ENGINE_unregister_ciphers(ENGINE *e);
+void ENGINE_register_all_ciphers(void);
+
+int ENGINE_register_digests(ENGINE *e);
+void ENGINE_unregister_digests(ENGINE *e);
+void ENGINE_register_all_digests(void);
+
+int ENGINE_register_pkey_meths(ENGINE *e);
+void ENGINE_unregister_pkey_meths(ENGINE *e);
+void ENGINE_register_all_pkey_meths(void);
+
+int ENGINE_register_pkey_asn1_meths(ENGINE *e);
+void ENGINE_unregister_pkey_asn1_meths(ENGINE *e);
+void ENGINE_register_all_pkey_asn1_meths(void);
+
+/* These functions register all support from the above categories. Note, use of
+ * these functions can result in static linkage of code your application may not
+ * need. If you only need a subset of functionality, consider using more
+ * selective initialisation. */
+int ENGINE_register_complete(ENGINE *e);
+int ENGINE_register_all_complete(void);
+
+/* Send parametrised control commands to the engine. The possibilities to send
+ * down an integer, a pointer to data or a function pointer are provided. Any of
+ * the parameters may or may not be NULL, depending on the command number. In
+ * actuality, this function only requires a structural (rather than functional)
+ * reference to an engine, but many control commands may require the engine be
+ * functional. The caller should be aware of trying commands that require an
+ * operational ENGINE, and only use functional references in such situations. */
+int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void));
+
+/* This function tests if an ENGINE-specific command is usable as a "setting".
+ * Eg. in an application's config file that gets processed through
+ * ENGINE_ctrl_cmd_string(). If this returns zero, it is not available to
+ * ENGINE_ctrl_cmd_string(), only ENGINE_ctrl(). */
+int ENGINE_cmd_is_executable(ENGINE *e, int cmd);
+
+/* This function works like ENGINE_ctrl() with the exception of taking a
+ * command name instead of a command number, and can handle optional commands.
+ * See the comment on ENGINE_ctrl_cmd_string() for an explanation on how to
+ * use the cmd_name and cmd_optional. */
+int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name,
+        long i, void *p, void (*f)(void), int cmd_optional);
+
+/* This function passes a command-name and argument to an ENGINE. The cmd_name
+ * is converted to a command number and the control command is called using
+ * 'arg' as an argument (unless the ENGINE doesn't support such a command, in
+ * which case no control command is called). The command is checked for input
+ * flags, and if necessary the argument will be converted to a numeric value. If
+ * cmd_optional is non-zero, then if the ENGINE doesn't support the given
+ * cmd_name the return value will be success anyway. This function is intended
+ * for applications to use so that users (or config files) can supply
+ * engine-specific config data to the ENGINE at run-time to control behaviour of
+ * specific engines. As such, it shouldn't be used for calling ENGINE_ctrl()
+ * functions that return data, deal with binary data, or that are otherwise
+ * supposed to be used directly through ENGINE_ctrl() in application code. Any
+ * "return" data from an ENGINE_ctrl() operation in this function will be lost -
+ * the return value is interpreted as failure if the return value is zero,
+ * success otherwise, and this function returns a boolean value as a result. In
+ * other words, vendors of 'ENGINE'-enabled devices should write ENGINE
+ * implementations with parameterisations that work in this scheme, so that
+ * compliant ENGINE-based applications can work consistently with the same
+ * configuration for the same ENGINE-enabled devices, across applications. */
+int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char *arg,
+                                int cmd_optional);
+
+/* These functions are useful for manufacturing new ENGINE structures. They
+ * don't address reference counting at all - one uses them to populate an ENGINE
+ * structure with personalised implementations of things prior to using it
+ * directly or adding it to the builtin ENGINE list in OpenSSL. These are also
+ * here so that the ENGINE structure doesn't have to be exposed and break binary
+ * compatibility! */
+ENGINE *ENGINE_new(void);
+int ENGINE_free(ENGINE *e);
+int ENGINE_up_ref(ENGINE *e);
+int ENGINE_set_id(ENGINE *e, const char *id);
+int ENGINE_set_name(ENGINE *e, const char *name);
+int ENGINE_set_RSA(ENGINE *e, const RSA_METHOD *rsa_meth);
+int ENGINE_set_DSA(ENGINE *e, const DSA_METHOD *dsa_meth);
+int ENGINE_set_ECDH(ENGINE *e, const ECDH_METHOD *ecdh_meth);
+int ENGINE_set_ECDSA(ENGINE *e, const ECDSA_METHOD *ecdsa_meth);
+int ENGINE_set_DH(ENGINE *e, const DH_METHOD *dh_meth);
+int ENGINE_set_RAND(ENGINE *e, const RAND_METHOD *rand_meth);
+int ENGINE_set_STORE(ENGINE *e, const STORE_METHOD *store_meth);
+int ENGINE_set_destroy_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR destroy_f);
+int ENGINE_set_init_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR init_f);
+int ENGINE_set_finish_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR finish_f);
+int ENGINE_set_ctrl_function(ENGINE *e, ENGINE_CTRL_FUNC_PTR ctrl_f);
+int ENGINE_set_load_privkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpriv_f);
+int ENGINE_set_load_pubkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpub_f);
+int ENGINE_set_load_ssl_client_cert_function(ENGINE *e,
+                                ENGINE_SSL_CLIENT_CERT_PTR loadssl_f);
+int ENGINE_set_ciphers(ENGINE *e, ENGINE_CIPHERS_PTR f);
+int ENGINE_set_digests(ENGINE *e, ENGINE_DIGESTS_PTR f);
+int ENGINE_set_pkey_meths(ENGINE *e, ENGINE_PKEY_METHS_PTR f);
+int ENGINE_set_pkey_asn1_meths(ENGINE *e, ENGINE_PKEY_ASN1_METHS_PTR f);
+int ENGINE_set_flags(ENGINE *e, int flags);
+int ENGINE_set_cmd_defns(ENGINE *e, const ENGINE_CMD_DEFN *defns);
+/* These functions allow control over any per-structure ENGINE data. */
+int ENGINE_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+                CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int ENGINE_set_ex_data(ENGINE *e, int idx, void *arg);
+void *ENGINE_get_ex_data(const ENGINE *e, int idx);
+
+/* This function cleans up anything that needs it. Eg. the ENGINE_add() function
+ * automatically ensures the list cleanup function is registered to be called
+ * from ENGINE_cleanup(). Similarly, all ENGINE_register_*** functions ensure
+ * ENGINE_cleanup() will clean up after them. */
+void ENGINE_cleanup(void);
+
+/* These return values from within the ENGINE structure. These can be useful
+ * with functional references as well as structural references - it depends
+ * which you obtained. Using the result for functional purposes if you only
+ * obtained a structural reference may be problematic! */
+const char *ENGINE_get_id(const ENGINE *e);
+const char *ENGINE_get_name(const ENGINE *e);
+const RSA_METHOD *ENGINE_get_RSA(const ENGINE *e);
+const DSA_METHOD *ENGINE_get_DSA(const ENGINE *e);
+const ECDH_METHOD *ENGINE_get_ECDH(const ENGINE *e);
+const ECDSA_METHOD *ENGINE_get_ECDSA(const ENGINE *e);
+const DH_METHOD *ENGINE_get_DH(const ENGINE *e);
+const RAND_METHOD *ENGINE_get_RAND(const ENGINE *e);
+const STORE_METHOD *ENGINE_get_STORE(const ENGINE *e);
+ENGINE_GEN_INT_FUNC_PTR ENGINE_get_destroy_function(const ENGINE *e);
+ENGINE_GEN_INT_FUNC_PTR ENGINE_get_init_function(const ENGINE *e);
+ENGINE_GEN_INT_FUNC_PTR ENGINE_get_finish_function(const ENGINE *e);
+ENGINE_CTRL_FUNC_PTR ENGINE_get_ctrl_function(const ENGINE *e);
+ENGINE_LOAD_KEY_PTR ENGINE_get_load_privkey_function(const ENGINE *e);
+ENGINE_LOAD_KEY_PTR ENGINE_get_load_pubkey_function(const ENGINE *e);
+ENGINE_SSL_CLIENT_CERT_PTR ENGINE_get_ssl_client_cert_function(const ENGINE *e);
+ENGINE_CIPHERS_PTR ENGINE_get_ciphers(const ENGINE *e);
+ENGINE_DIGESTS_PTR ENGINE_get_digests(const ENGINE *e);
+ENGINE_PKEY_METHS_PTR ENGINE_get_pkey_meths(const ENGINE *e);
+ENGINE_PKEY_ASN1_METHS_PTR ENGINE_get_pkey_asn1_meths(const ENGINE *e);
+const EVP_CIPHER *ENGINE_get_cipher(ENGINE *e, int nid);
+const EVP_MD *ENGINE_get_digest(ENGINE *e, int nid);
+const EVP_PKEY_METHOD *ENGINE_get_pkey_meth(ENGINE *e, int nid);
+const EVP_PKEY_ASN1_METHOD *ENGINE_get_pkey_asn1_meth(ENGINE *e, int nid);
+const EVP_PKEY_ASN1_METHOD *ENGINE_get_pkey_asn1_meth_str(ENGINE *e,
+                                        const char *str, int len);
+const EVP_PKEY_ASN1_METHOD *ENGINE_pkey_asn1_find_str(ENGINE **pe,
+                                        const char *str, int len);
+const ENGINE_CMD_DEFN *ENGINE_get_cmd_defns(const ENGINE *e);
+int ENGINE_get_flags(const ENGINE *e);
+
+/* FUNCTIONAL functions. These functions deal with ENGINE structures
+ * that have (or will) be initialised for use. Broadly speaking, the
+ * structural functions are useful for iterating the list of available
+ * engine types, creating new engine types, and other "list" operations.
+ * These functions actually deal with ENGINEs that are to be used. As
+ * such these functions can fail (if applicable) when particular
+ * engines are unavailable - eg. if a hardware accelerator is not
+ * attached or not functioning correctly. Each ENGINE has 2 reference
+ * counts; structural and functional. Every time a functional reference
+ * is obtained or released, a corresponding structural reference is
+ * automatically obtained or released too. */
+
+/* Initialise a engine type for use (or up its reference count if it's
+ * already in use). This will fail if the engine is not currently
+ * operational and cannot initialise. */
+int ENGINE_init(ENGINE *e);
+/* Free a functional reference to a engine type. This does not require
+ * a corresponding call to ENGINE_free as it also releases a structural
+ * reference. */
+int ENGINE_finish(ENGINE *e);
+
+/* The following functions handle keys that are stored in some secondary
+ * location, handled by the engine.  The storage may be on a card or
+ * whatever. */
+EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
+        UI_METHOD *ui_method, void *callback_data);
+EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id,
+        UI_METHOD *ui_method, void *callback_data);
+int ENGINE_load_ssl_client_cert(ENGINE *e, SSL *s,
+        STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **ppkey,
+        STACK_OF(X509) **pother,
+        UI_METHOD *ui_method, void *callback_data);
+
+/* This returns a pointer for the current ENGINE structure that
+ * is (by default) performing any RSA operations. The value returned
+ * is an incremented reference, so it should be free'd (ENGINE_finish)
+ * before it is discarded. */
+ENGINE *ENGINE_get_default_RSA(void);
+/* Same for the other "methods" */
+ENGINE *ENGINE_get_default_DSA(void);
+ENGINE *ENGINE_get_default_ECDH(void);
+ENGINE *ENGINE_get_default_ECDSA(void);
+ENGINE *ENGINE_get_default_DH(void);
+ENGINE *ENGINE_get_default_RAND(void);
+/* These functions can be used to get a functional reference to perform
+ * ciphering or digesting corresponding to "nid". */
+ENGINE *ENGINE_get_cipher_engine(int nid);
+ENGINE *ENGINE_get_digest_engine(int nid);
+ENGINE *ENGINE_get_pkey_meth_engine(int nid);
+ENGINE *ENGINE_get_pkey_asn1_meth_engine(int nid);
+
+/* This sets a new default ENGINE structure for performing RSA
+ * operations. If the result is non-zero (success) then the ENGINE
+ * structure will have had its reference count up'd so the caller
+ * should still free their own reference 'e'. */
+int ENGINE_set_default_RSA(ENGINE *e);
+int ENGINE_set_default_string(ENGINE *e, const char *def_list);
+/* Same for the other "methods" */
+int ENGINE_set_default_DSA(ENGINE *e);
+int ENGINE_set_default_ECDH(ENGINE *e);
+int ENGINE_set_default_ECDSA(ENGINE *e);
+int ENGINE_set_default_DH(ENGINE *e);
+int ENGINE_set_default_RAND(ENGINE *e);
+int ENGINE_set_default_ciphers(ENGINE *e);
+int ENGINE_set_default_digests(ENGINE *e);
+int ENGINE_set_default_pkey_meths(ENGINE *e);
+int ENGINE_set_default_pkey_asn1_meths(ENGINE *e);
+
+/* The combination "set" - the flags are bitwise "OR"d from the
+ * ENGINE_METHOD_*** defines above. As with the "ENGINE_register_complete()"
+ * function, this function can result in unnecessary static linkage. If your
+ * application requires only specific functionality, consider using more
+ * selective functions. */
+int ENGINE_set_default(ENGINE *e, unsigned int flags);
+
+void ENGINE_add_conf_module(void);
+
+/* Deprecated functions ... */
+/* int ENGINE_clear_defaults(void); */
+
+/**************************/
+/* DYNAMIC ENGINE SUPPORT */
+/**************************/
+
+/* Binary/behaviour compatibility levels */
+#define OSSL_DYNAMIC_VERSION            (unsigned long)0x00020000
+/* Binary versions older than this are too old for us (whether we're a loader or
+ * a loadee) */
+#define OSSL_DYNAMIC_OLDEST             (unsigned long)0x00020000
+
+/* When compiling an ENGINE entirely as an external shared library, loadable by
+ * the "dynamic" ENGINE, these types are needed. The 'dynamic_fns' structure
+ * type provides the calling application's (or library's) error functionality
+ * and memory management function pointers to the loaded library. These should
+ * be used/set in the loaded library code so that the loading application's
+ * 'state' will be used/changed in all operations. The 'static_state' pointer
+ * allows the loaded library to know if it shares the same static data as the
+ * calling application (or library), and thus whether these callbacks need to be
+ * set or not. */
+typedef void *(*dyn_MEM_malloc_cb)(size_t);
+typedef void *(*dyn_MEM_realloc_cb)(void *, size_t);
+typedef void (*dyn_MEM_free_cb)(void *);
+typedef struct st_dynamic_MEM_fns {
+        dyn_MEM_malloc_cb                       malloc_cb;
+        dyn_MEM_realloc_cb                      realloc_cb;
+        dyn_MEM_free_cb                         free_cb;
+        } dynamic_MEM_fns;
+/* FIXME: Perhaps the memory and locking code (crypto.h) should declare and use
+ * these types so we (and any other dependant code) can simplify a bit?? */
+typedef void (*dyn_lock_locking_cb)(int,int,const char *,int);
+typedef int (*dyn_lock_add_lock_cb)(int*,int,int,const char *,int);
+typedef struct CRYPTO_dynlock_value *(*dyn_dynlock_create_cb)(
+                                                const char *,int);
+typedef void (*dyn_dynlock_lock_cb)(int,struct CRYPTO_dynlock_value *,
+                                                const char *,int);
+typedef void (*dyn_dynlock_destroy_cb)(struct CRYPTO_dynlock_value *,
+                                                const char *,int);
+typedef struct st_dynamic_LOCK_fns {
+        dyn_lock_locking_cb                     lock_locking_cb;
+        dyn_lock_add_lock_cb                    lock_add_lock_cb;
+        dyn_dynlock_create_cb                   dynlock_create_cb;
+        dyn_dynlock_lock_cb                     dynlock_lock_cb;
+        dyn_dynlock_destroy_cb                  dynlock_destroy_cb;
+        } dynamic_LOCK_fns;
+/* The top-level structure */
+typedef struct st_dynamic_fns {
+        void                                    *static_state;
+        const ERR_FNS                           *err_fns;
+        const CRYPTO_EX_DATA_IMPL               *ex_data_fns;
+        dynamic_MEM_fns                         mem_fns;
+        dynamic_LOCK_fns                        lock_fns;
+        } dynamic_fns;
+
+/* The version checking function should be of this prototype. NB: The
+ * ossl_version value passed in is the OSSL_DYNAMIC_VERSION of the loading code.
+ * If this function returns zero, it indicates a (potential) version
+ * incompatibility and the loaded library doesn't believe it can proceed.
+ * Otherwise, the returned value is the (latest) version supported by the
+ * loading library. The loader may still decide that the loaded code's version
+ * is unsatisfactory and could veto the load. The function is expected to
+ * be implemented with the symbol name "v_check", and a default implementation
+ * can be fully instantiated with IMPLEMENT_DYNAMIC_CHECK_FN(). */
+typedef unsigned long (*dynamic_v_check_fn)(unsigned long ossl_version);
+#define IMPLEMENT_DYNAMIC_CHECK_FN() \
+        OPENSSL_EXPORT unsigned long v_check(unsigned long v); \
+        OPENSSL_EXPORT unsigned long v_check(unsigned long v) { \
+                if(v >= OSSL_DYNAMIC_OLDEST) return OSSL_DYNAMIC_VERSION; \
+                return 0; }
+
+/* This function is passed the ENGINE structure to initialise with its own
+ * function and command settings. It should not adjust the structural or
+ * functional reference counts. If this function returns zero, (a) the load will
+ * be aborted, (b) the previous ENGINE state will be memcpy'd back onto the
+ * structure, and (c) the shared library will be unloaded. So implementations
+ * should do their own internal cleanup in failure circumstances otherwise they
+ * could leak. The 'id' parameter, if non-NULL, represents the ENGINE id that
+ * the loader is looking for. If this is NULL, the shared library can choose to
+ * return failure or to initialise a 'default' ENGINE. If non-NULL, the shared
+ * library must initialise only an ENGINE matching the passed 'id'. The function
+ * is expected to be implemented with the symbol name "bind_engine". A standard
+ * implementation can be instantiated with IMPLEMENT_DYNAMIC_BIND_FN(fn) where
+ * the parameter 'fn' is a callback function that populates the ENGINE structure
+ * and returns an int value (zero for failure). 'fn' should have prototype;
+ *    [static] int fn(ENGINE *e, const char *id); */
+typedef int (*dynamic_bind_engine)(ENGINE *e, const char *id,
+                                const dynamic_fns *fns);
+#define IMPLEMENT_DYNAMIC_BIND_FN(fn) \
+        OPENSSL_EXPORT \
+        int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns); \
+        OPENSSL_EXPORT \
+        int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { \
+                if(ENGINE_get_static_state() == fns->static_state) goto skip_cbs; \
+                if(!CRYPTO_set_mem_functions(fns->mem_fns.malloc_cb, \
+                        fns->mem_fns.realloc_cb, fns->mem_fns.free_cb)) \
+                        return 0; \
+                CRYPTO_set_locking_callback(fns->lock_fns.lock_locking_cb); \
+                CRYPTO_set_add_lock_callback(fns->lock_fns.lock_add_lock_cb); \
+                CRYPTO_set_dynlock_create_callback(fns->lock_fns.dynlock_create_cb); \
+                CRYPTO_set_dynlock_lock_callback(fns->lock_fns.dynlock_lock_cb); \
+                CRYPTO_set_dynlock_destroy_callback(fns->lock_fns.dynlock_destroy_cb); \
+                if(!CRYPTO_set_ex_data_implementation(fns->ex_data_fns)) \
+                        return 0; \
+                if(!ERR_set_implementation(fns->err_fns)) return 0; \
+        skip_cbs: \
+                if(!fn(e,id)) return 0; \
+                return 1; }
+
+/* If the loading application (or library) and the loaded ENGINE library share
+ * the same static data (eg. they're both dynamically linked to the same
+ * libcrypto.so) we need a way to avoid trying to set system callbacks - this
+ * would fail, and for the same reason that it's unnecessary to try. If the
+ * loaded ENGINE has (or gets from through the loader) its own copy of the
+ * libcrypto static data, we will need to set the callbacks. The easiest way to
+ * detect this is to have a function that returns a pointer to some static data
+ * and let the loading application and loaded ENGINE compare their respective
+ * values. */
+void *ENGINE_get_static_state(void);
+
+#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
+void ENGINE_setup_bsd_cryptodev(void);
+#endif
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+void ERR_load_ENGINE_strings(void);
+
+/* Error codes for the ENGINE functions. */
+
+/* Function codes. */
+#define ENGINE_F_DYNAMIC_CTRL                            180
+#define ENGINE_F_DYNAMIC_GET_DATA_CTX                    181
+#define ENGINE_F_DYNAMIC_LOAD                            182
+#define ENGINE_F_DYNAMIC_SET_DATA_CTX                    183
+#define ENGINE_F_ENGINE_ADD                              105
+#define ENGINE_F_ENGINE_BY_ID                            106
+#define ENGINE_F_ENGINE_CMD_IS_EXECUTABLE                170
+#define ENGINE_F_ENGINE_CTRL                             142
+#define ENGINE_F_ENGINE_CTRL_CMD                         178
+#define ENGINE_F_ENGINE_CTRL_CMD_STRING                  171
+#define ENGINE_F_ENGINE_FINISH                           107
+#define ENGINE_F_ENGINE_FREE_UTIL                        108
+#define ENGINE_F_ENGINE_GET_CIPHER                       185
+#define ENGINE_F_ENGINE_GET_DEFAULT_TYPE                 177
+#define ENGINE_F_ENGINE_GET_DIGEST                       186
+#define ENGINE_F_ENGINE_GET_NEXT                         115
+#define ENGINE_F_ENGINE_GET_PKEY_ASN1_METH               193
+#define ENGINE_F_ENGINE_GET_PKEY_METH                    192
+#define ENGINE_F_ENGINE_GET_PREV                         116
+#define ENGINE_F_ENGINE_INIT                             119
+#define ENGINE_F_ENGINE_LIST_ADD                         120
+#define ENGINE_F_ENGINE_LIST_REMOVE                      121
+#define ENGINE_F_ENGINE_LOAD_PRIVATE_KEY                 150
+#define ENGINE_F_ENGINE_LOAD_PUBLIC_KEY                  151
+#define ENGINE_F_ENGINE_LOAD_SSL_CLIENT_CERT             194
+#define ENGINE_F_ENGINE_NEW                              122
+#define ENGINE_F_ENGINE_REMOVE                           123
+#define ENGINE_F_ENGINE_SET_DEFAULT_STRING               189
+#define ENGINE_F_ENGINE_SET_DEFAULT_TYPE                 126
+#define ENGINE_F_ENGINE_SET_ID                           129
+#define ENGINE_F_ENGINE_SET_NAME                         130
+#define ENGINE_F_ENGINE_TABLE_REGISTER                   184
+#define ENGINE_F_ENGINE_UNLOAD_KEY                       152
+#define ENGINE_F_ENGINE_UNLOCKED_FINISH                  191
+#define ENGINE_F_ENGINE_UP_REF                           190
+#define ENGINE_F_INT_CTRL_HELPER                         172
+#define ENGINE_F_INT_ENGINE_CONFIGURE                    188
+#define ENGINE_F_INT_ENGINE_MODULE_INIT                  187
+#define ENGINE_F_LOG_MESSAGE                             141
+
+/* Reason codes. */
+#define ENGINE_R_ALREADY_LOADED                          100
+#define ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER                133
+#define ENGINE_R_CMD_NOT_EXECUTABLE                      134
+#define ENGINE_R_COMMAND_TAKES_INPUT                     135
+#define ENGINE_R_COMMAND_TAKES_NO_INPUT                  136
+#define ENGINE_R_CONFLICTING_ENGINE_ID                   103
+#define ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED            119
+#define ENGINE_R_DH_NOT_IMPLEMENTED                      139
+#define ENGINE_R_DSA_NOT_IMPLEMENTED                     140
+#define ENGINE_R_DSO_FAILURE                             104
+#define ENGINE_R_DSO_NOT_FOUND                           132
+#define ENGINE_R_ENGINES_SECTION_ERROR                   148
+#define ENGINE_R_ENGINE_CONFIGURATION_ERROR              102
+#define ENGINE_R_ENGINE_IS_NOT_IN_LIST                   105
+#define ENGINE_R_ENGINE_SECTION_ERROR                    149
+#define ENGINE_R_FAILED_LOADING_PRIVATE_KEY              128
+#define ENGINE_R_FAILED_LOADING_PUBLIC_KEY               129
+#define ENGINE_R_FINISH_FAILED                           106
+#define ENGINE_R_GET_HANDLE_FAILED                       107
+#define ENGINE_R_ID_OR_NAME_MISSING                      108
+#define ENGINE_R_INIT_FAILED                             109
+#define ENGINE_R_INTERNAL_LIST_ERROR                     110
+#define ENGINE_R_INVALID_ARGUMENT                        143
+#define ENGINE_R_INVALID_CMD_NAME                        137
+#define ENGINE_R_INVALID_CMD_NUMBER                      138
+#define ENGINE_R_INVALID_INIT_VALUE                      151
+#define ENGINE_R_INVALID_STRING                          150
+#define ENGINE_R_NOT_INITIALISED                         117
+#define ENGINE_R_NOT_LOADED                              112
+#define ENGINE_R_NO_CONTROL_FUNCTION                     120
+#define ENGINE_R_NO_INDEX                                144
+#define ENGINE_R_NO_LOAD_FUNCTION                        125
+#define ENGINE_R_NO_REFERENCE                            130
+#define ENGINE_R_NO_SUCH_ENGINE                          116
+#define ENGINE_R_NO_UNLOAD_FUNCTION                      126
+#define ENGINE_R_PROVIDE_PARAMETERS                      113
+#define ENGINE_R_RSA_NOT_IMPLEMENTED                     141
+#define ENGINE_R_UNIMPLEMENTED_CIPHER                    146
+#define ENGINE_R_UNIMPLEMENTED_DIGEST                    147
+#define ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD         101
+#define ENGINE_R_VERSION_INCOMPATIBILITY                 145
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libcrypto/engine/hw.ec b/src/lib/libcrypto/engine/hw.ec
deleted file mode 100644
index 5481a43918..0000000000
--- a/src/lib/libcrypto/engine/hw.ec
+++ /dev/null
@@ -1,8 +0,0 @@
-L AEPHK         hw_aep_err.h                    hw_aep_err.c
-L ATALLA        hw_atalla_err.h                 hw_atalla_err.c
-L CSWIFT        hw_cswift_err.h                 hw_cswift_err.c
-L HWCRHK        hw_ncipher_err.h                hw_ncipher_err.c
-L NURON         hw_nuron_err.h                  hw_nuron_err.c
-L SUREWARE      hw_sureware_err.h               hw_sureware_err.c
-L UBSEC         hw_ubsec_err.h                  hw_ubsec_err.c
-L CCA4758       hw_4758_cca_err.h               hw_4758_cca_err.c
diff --git a/src/lib/libcrypto/engine/hw_4758_cca.c b/src/lib/libcrypto/engine/hw_4758_cca.c
deleted file mode 100644
index 4f5ae8a46d..0000000000
--- a/src/lib/libcrypto/engine/hw_4758_cca.c
+++ /dev/null
@@ -1,969 +0,0 @@
-/* Author: Maurice Gittens <maurice@gittens.nl>                       */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <openssl/crypto.h>
-/* #include <openssl/pem.h> */
-#include "cryptlib.h"
-#include <openssl/dso.h>
-#include <openssl/x509.h>
-#include <openssl/objects.h>
-#include <openssl/engine.h>
-
-#ifndef OPENSSL_NO_HW
-#ifndef OPENSSL_NO_HW_4758_CCA
-
-#ifdef FLAT_INC
-#include "hw_4758_cca.h"
-#else
-#include "vendor_defns/hw_4758_cca.h"
-#endif
-
-#include "hw_4758_cca_err.c"
-
-static int ibm_4758_cca_destroy(ENGINE *e);
-static int ibm_4758_cca_init(ENGINE *e);
-static int ibm_4758_cca_finish(ENGINE *e);
-static int ibm_4758_cca_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
-
-/* rsa functions */
-/*---------------*/
-#ifndef OPENSSL_NO_RSA
-static int cca_rsa_pub_enc(int flen, const unsigned char *from,
-                unsigned char *to, RSA *rsa,int padding);
-static int cca_rsa_priv_dec(int flen, const unsigned char *from,
-                unsigned char *to, RSA *rsa,int padding);
-static int cca_rsa_sign(int type, const unsigned char *m, unsigned int m_len,
-                unsigned char *sigret, unsigned int *siglen, const RSA *rsa);
-static int cca_rsa_verify(int dtype, const unsigned char *m, unsigned int m_len,
-                unsigned char *sigbuf, unsigned int siglen, const RSA *rsa);
-
-/* utility functions */
-/*-----------------------*/
-static EVP_PKEY *ibm_4758_load_privkey(ENGINE*, const char*,
-                UI_METHOD *ui_method, void *callback_data);
-static EVP_PKEY *ibm_4758_load_pubkey(ENGINE*, const char*,
-                UI_METHOD *ui_method, void *callback_data);
-
-static int getModulusAndExponent(const unsigned char *token, long *exponentLength,
-                unsigned char *exponent, long *modulusLength,
-                long *modulusFieldLength, unsigned char *modulus);
-#endif
-
-/* RAND number functions */
-/*-----------------------*/
-static int cca_get_random_bytes(unsigned char*, int );
-static int cca_random_status(void);
-
-static void cca_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
-                int idx,long argl, void *argp);
-
-/* Function pointers for CCA verbs */
-/*---------------------------------*/
-#ifndef OPENSSL_NO_RSA
-static F_KEYRECORDREAD keyRecordRead;
-static F_DIGITALSIGNATUREGENERATE digitalSignatureGenerate;
-static F_DIGITALSIGNATUREVERIFY digitalSignatureVerify;
-static F_PUBLICKEYEXTRACT publicKeyExtract;
-static F_PKAENCRYPT pkaEncrypt;
-static F_PKADECRYPT pkaDecrypt;
-#endif
-static F_RANDOMNUMBERGENERATE randomNumberGenerate;
-
-/* static variables */
-/*------------------*/
-static const char *CCA4758_LIB_NAME = NULL;
-static const char *get_CCA4758_LIB_NAME(void)
-        {
-        if(CCA4758_LIB_NAME)
-                return CCA4758_LIB_NAME;
-        return CCA_LIB_NAME;
-        }
-static void free_CCA4758_LIB_NAME(void)
-        {
-        if(CCA4758_LIB_NAME)
-                OPENSSL_free((void*)CCA4758_LIB_NAME);
-        CCA4758_LIB_NAME = NULL;
-        }
-static long set_CCA4758_LIB_NAME(const char *name)
-        {
-        free_CCA4758_LIB_NAME();
-        return (((CCA4758_LIB_NAME = BUF_strdup(name)) != NULL) ? 1 : 0);
-        }
-#ifndef OPENSSL_NO_RSA
-static const char* n_keyRecordRead = CSNDKRR;
-static const char* n_digitalSignatureGenerate = CSNDDSG;
-static const char* n_digitalSignatureVerify = CSNDDSV;
-static const char* n_publicKeyExtract = CSNDPKX;
-static const char* n_pkaEncrypt = CSNDPKE;
-static const char* n_pkaDecrypt = CSNDPKD;
-#endif
-static const char* n_randomNumberGenerate = CSNBRNG;
-
-static int hndidx = -1;
-static DSO *dso = NULL;
-
-/* openssl engine initialization structures */
-/*------------------------------------------*/
-
-#define CCA4758_CMD_SO_PATH             ENGINE_CMD_BASE
-static const ENGINE_CMD_DEFN    cca4758_cmd_defns[] = {
-        {CCA4758_CMD_SO_PATH,
-                "SO_PATH",
-                "Specifies the path to the '4758cca' shared library",
-                ENGINE_CMD_FLAG_STRING},
-        {0, NULL, NULL, 0}
-        };
-
-#ifndef OPENSSL_NO_RSA
-static RSA_METHOD ibm_4758_cca_rsa =
-        {
-        "IBM 4758 CCA RSA method",
-        cca_rsa_pub_enc,
-        NULL,
-        NULL,
-        cca_rsa_priv_dec,
-        NULL, /*rsa_mod_exp,*/
-        NULL, /*mod_exp_mont,*/
-        NULL, /* init */
-        NULL, /* finish */
-        RSA_FLAG_SIGN_VER,        /* flags */
-        NULL, /* app_data */
-        cca_rsa_sign, /* rsa_sign */
-        cca_rsa_verify  /* rsa_verify */
-        };
-#endif
-
-static RAND_METHOD ibm_4758_cca_rand =
-        {
-        /* "IBM 4758 RAND method", */
-        NULL, /* seed */
-        cca_get_random_bytes, /* get random bytes from the card */
-        NULL, /* cleanup */
-        NULL, /* add */
-        cca_get_random_bytes, /* pseudo rand */
-        cca_random_status, /* status */
-        };
-
-static const char *engine_4758_cca_id = "4758cca";
-static const char *engine_4758_cca_name = "IBM 4758 CCA hardware engine support";
-
-/* engine implementation */
-/*-----------------------*/
-static int bind_helper(ENGINE *e)
-        {
-        if(!ENGINE_set_id(e, engine_4758_cca_id) ||
-                        !ENGINE_set_name(e, engine_4758_cca_name) ||
-#ifndef OPENSSL_NO_RSA
-                        !ENGINE_set_RSA(e, &ibm_4758_cca_rsa) ||
-#endif
-                        !ENGINE_set_RAND(e, &ibm_4758_cca_rand) ||
-                        !ENGINE_set_destroy_function(e, ibm_4758_cca_destroy) ||
-                        !ENGINE_set_init_function(e, ibm_4758_cca_init) ||
-                        !ENGINE_set_finish_function(e, ibm_4758_cca_finish) ||
-                        !ENGINE_set_ctrl_function(e, ibm_4758_cca_ctrl) ||
-                        !ENGINE_set_load_privkey_function(e, ibm_4758_load_privkey) ||
-                        !ENGINE_set_load_pubkey_function(e, ibm_4758_load_pubkey) ||
-                        !ENGINE_set_cmd_defns(e, cca4758_cmd_defns))
-                return 0;
-        /* Ensure the error handling is set up */
-        ERR_load_CCA4758_strings();
-        return 1;
-        }
-
-#ifndef ENGINE_DYNAMIC_SUPPORT
-static ENGINE *engine_4758_cca(void)
-        {
-        ENGINE *ret = ENGINE_new();
-        if(!ret)
-                return NULL;
-        if(!bind_helper(ret))
-                {
-                ENGINE_free(ret);
-                return NULL;
-                }
-        return ret;
-        }
-
-void ENGINE_load_4758cca(void)
-        {
-        ENGINE *e_4758 = engine_4758_cca();
-        if (!e_4758) return;
-        ENGINE_add(e_4758);
-        ENGINE_free(e_4758);
-        ERR_clear_error();   
-        }
-#endif
-
-static int ibm_4758_cca_destroy(ENGINE *e)
-        {
-        ERR_unload_CCA4758_strings();
-        free_CCA4758_LIB_NAME();
-        return 1;
-        }
-
-static int ibm_4758_cca_init(ENGINE *e)
-        {
-        if(dso)
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_INIT,CCA4758_R_ALREADY_LOADED);
-                goto err;
-                }
-
-        dso = DSO_load(NULL, get_CCA4758_LIB_NAME(), NULL, 0);
-        if(!dso)
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_INIT,CCA4758_R_DSO_FAILURE);
-                goto err;
-                }
-
-#ifndef OPENSSL_NO_RSA
-        if(!(keyRecordRead = (F_KEYRECORDREAD)
-                                DSO_bind_func(dso, n_keyRecordRead)) ||
-                        !(randomNumberGenerate = (F_RANDOMNUMBERGENERATE)
-                                DSO_bind_func(dso, n_randomNumberGenerate)) ||
-                        !(digitalSignatureGenerate = (F_DIGITALSIGNATUREGENERATE)
-                                DSO_bind_func(dso, n_digitalSignatureGenerate)) ||
-                        !(digitalSignatureVerify = (F_DIGITALSIGNATUREVERIFY)
-                                DSO_bind_func(dso, n_digitalSignatureVerify)) ||
-                        !(publicKeyExtract = (F_PUBLICKEYEXTRACT)
-                                DSO_bind_func(dso, n_publicKeyExtract)) ||
-                        !(pkaEncrypt = (F_PKAENCRYPT)
-                                DSO_bind_func(dso, n_pkaEncrypt)) ||
-                        !(pkaDecrypt = (F_PKADECRYPT)
-                                DSO_bind_func(dso, n_pkaDecrypt)))
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_INIT,CCA4758_R_DSO_FAILURE);
-                goto err;
-                }
-#else
-        if(!(randomNumberGenerate = (F_RANDOMNUMBERGENERATE)
-                                DSO_bind_func(dso, n_randomNumberGenerate)))
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_INIT,CCA4758_R_DSO_FAILURE);
-                goto err;
-                }
-#endif
-
-        hndidx = RSA_get_ex_new_index(0, "IBM 4758 CCA RSA key handle",
-                NULL, NULL, cca_ex_free);
-
-        return 1;
-err:
-        if(dso)
-                DSO_free(dso);
-        dso = NULL;
-
-        keyRecordRead = (F_KEYRECORDREAD)0;
-        randomNumberGenerate = (F_RANDOMNUMBERGENERATE)0;
-        digitalSignatureGenerate = (F_DIGITALSIGNATUREGENERATE)0;
-        digitalSignatureVerify = (F_DIGITALSIGNATUREVERIFY)0;
-        publicKeyExtract = (F_PUBLICKEYEXTRACT)0;
-        pkaEncrypt = (F_PKAENCRYPT)0;
-        pkaDecrypt = (F_PKADECRYPT)0;
-        return 0;
-        }
-
-static int ibm_4758_cca_finish(ENGINE *e)
-        {
-        free_CCA4758_LIB_NAME();
-        if(!dso)
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_FINISH,
-                                CCA4758_R_NOT_LOADED);
-                return 0;
-                }
-        if(!DSO_free(dso))
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_FINISH,
-                                CCA4758_R_UNIT_FAILURE);
-                return 0;
-                }
-        dso = NULL;
-        keyRecordRead = (F_KEYRECORDREAD)0;
-        randomNumberGenerate = (F_RANDOMNUMBERGENERATE)0;
-        digitalSignatureGenerate = (F_DIGITALSIGNATUREGENERATE)0;
-        digitalSignatureVerify = (F_DIGITALSIGNATUREVERIFY)0;
-        publicKeyExtract = (F_PUBLICKEYEXTRACT)0;
-        pkaEncrypt = (F_PKAENCRYPT)0;
-        pkaDecrypt = (F_PKADECRYPT)0;
-        return 1;
-        }
-
-static int ibm_4758_cca_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
-        {
-        int initialised = ((dso == NULL) ? 0 : 1);
-        switch(cmd)
-                {
-        case CCA4758_CMD_SO_PATH:
-                if(p == NULL)
-                        {
-                        CCA4758err(CCA4758_F_IBM_4758_CCA_CTRL,
-                                        ERR_R_PASSED_NULL_PARAMETER);
-                        return 0;
-                        }
-                if(initialised)
-                        {
-                        CCA4758err(CCA4758_F_IBM_4758_CCA_CTRL,
-                                        CCA4758_R_ALREADY_LOADED);
-                        return 0;
-                        }
-                return set_CCA4758_LIB_NAME((const char *)p);
-        default:
-                break;
-                }
-        CCA4758err(CCA4758_F_IBM_4758_CCA_CTRL,
-                        CCA4758_R_COMMAND_NOT_IMPLEMENTED);
-        return 0;
-        }
-
-#ifndef OPENSSL_NO_RSA
-
-#define MAX_CCA_PKA_TOKEN_SIZE 2500
-
-static EVP_PKEY *ibm_4758_load_privkey(ENGINE* e, const char* key_id,
-                        UI_METHOD *ui_method, void *callback_data)
-        {
-        RSA *rtmp = NULL;
-        EVP_PKEY *res = NULL;
-        unsigned char* keyToken = NULL;
-        unsigned char pubKeyToken[MAX_CCA_PKA_TOKEN_SIZE];
-        long pubKeyTokenLength = MAX_CCA_PKA_TOKEN_SIZE;
-        long keyTokenLength = MAX_CCA_PKA_TOKEN_SIZE;
-        long returnCode;
-        long reasonCode;
-        long exitDataLength = 0;
-        long ruleArrayLength = 0;
-        unsigned char exitData[8];
-        unsigned char ruleArray[8];
-        unsigned char keyLabel[64];
-        long keyLabelLength = strlen(key_id);
-        unsigned char modulus[256];
-        long modulusFieldLength = sizeof(modulus);
-        long modulusLength = 0;
-        unsigned char exponent[256];
-        long exponentLength = sizeof(exponent);
-
-        if (keyLabelLength > sizeof(keyLabel))
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_LOAD_PRIVKEY,
-                CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
-                return NULL;
-                }
-
-        memset(keyLabel,' ', sizeof(keyLabel));
-        memcpy(keyLabel, key_id, keyLabelLength);
-
-        keyToken = OPENSSL_malloc(MAX_CCA_PKA_TOKEN_SIZE + sizeof(long));
-        if (!keyToken)
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_LOAD_PRIVKEY,
-                                ERR_R_MALLOC_FAILURE);
-                goto err;
-                }
-
-        keyRecordRead(&returnCode, &reasonCode, &exitDataLength,
-                exitData, &ruleArrayLength, ruleArray, keyLabel,
-                &keyTokenLength, keyToken+sizeof(long));
-
-        if (returnCode)
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_LOAD_PRIVKEY,
-                        CCA4758_R_FAILED_LOADING_PRIVATE_KEY);
-                goto err;
-                }
-
-        publicKeyExtract(&returnCode, &reasonCode, &exitDataLength,
-                exitData, &ruleArrayLength, ruleArray, &keyTokenLength,
-                keyToken+sizeof(long), &pubKeyTokenLength, pubKeyToken);
-
-        if (returnCode)
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_LOAD_PRIVKEY,
-                        CCA4758_R_FAILED_LOADING_PRIVATE_KEY);
-                goto err;
-                }
-
-        if (!getModulusAndExponent(pubKeyToken, &exponentLength,
-                        exponent, &modulusLength, &modulusFieldLength,
-                        modulus))
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_LOAD_PRIVKEY,
-                        CCA4758_R_FAILED_LOADING_PRIVATE_KEY);
-                goto err;
-                }
-
-        (*(long*)keyToken) = keyTokenLength;
-        rtmp = RSA_new_method(e);
-        RSA_set_ex_data(rtmp, hndidx, (char *)keyToken);
-
-        rtmp->e = BN_bin2bn(exponent, exponentLength, NULL);
-        rtmp->n = BN_bin2bn(modulus, modulusFieldLength, NULL);
-        rtmp->flags |= RSA_FLAG_EXT_PKEY;
-
-        res = EVP_PKEY_new();
-        EVP_PKEY_assign_RSA(res, rtmp);
-
-        return res;
-err:
-        if (keyToken)
-                OPENSSL_free(keyToken);
-        if (res)
-                EVP_PKEY_free(res);
-        if (rtmp)
-                RSA_free(rtmp);
-        return NULL;
-        }
-
-static EVP_PKEY *ibm_4758_load_pubkey(ENGINE* e, const char* key_id,
-                        UI_METHOD *ui_method, void *callback_data)
-        {
-        RSA *rtmp = NULL;
-        EVP_PKEY *res = NULL;
-        unsigned char* keyToken = NULL;
-        long keyTokenLength = MAX_CCA_PKA_TOKEN_SIZE;
-        long returnCode;
-        long reasonCode;
-        long exitDataLength = 0;
-        long ruleArrayLength = 0;
-        unsigned char exitData[8];
-        unsigned char ruleArray[8];
-        unsigned char keyLabel[64];
-        long keyLabelLength = strlen(key_id);
-        unsigned char modulus[512];
-        long modulusFieldLength = sizeof(modulus);
-        long modulusLength = 0;
-        unsigned char exponent[512];
-        long exponentLength = sizeof(exponent);
-
-        if (keyLabelLength > sizeof(keyLabel))
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_LOAD_PRIVKEY,
-                        CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
-                return NULL;
-                }
-
-        memset(keyLabel,' ', sizeof(keyLabel));
-        memcpy(keyLabel, key_id, keyLabelLength);
-
-        keyToken = OPENSSL_malloc(MAX_CCA_PKA_TOKEN_SIZE + sizeof(long));
-        if (!keyToken)
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_LOAD_PUBKEY,
-                                ERR_R_MALLOC_FAILURE);
-                goto err;
-                }
-
-        keyRecordRead(&returnCode, &reasonCode, &exitDataLength, exitData,
-                &ruleArrayLength, ruleArray, keyLabel, &keyTokenLength,
-                keyToken+sizeof(long));
-
-        if (returnCode)
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_LOAD_PRIVKEY,
-                                ERR_R_MALLOC_FAILURE);
-                goto err;
-                }
-
-        if (!getModulusAndExponent(keyToken+sizeof(long), &exponentLength,
-                        exponent, &modulusLength, &modulusFieldLength, modulus))
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_LOAD_PRIVKEY,
-                        CCA4758_R_FAILED_LOADING_PUBLIC_KEY);
-                goto err;
-                }
-
-        (*(long*)keyToken) = keyTokenLength;
-        rtmp = RSA_new_method(e);
-        RSA_set_ex_data(rtmp, hndidx, (char *)keyToken);
-        rtmp->e = BN_bin2bn(exponent, exponentLength, NULL);
-        rtmp->n = BN_bin2bn(modulus, modulusFieldLength, NULL);
-        rtmp->flags |= RSA_FLAG_EXT_PKEY;
-        res = EVP_PKEY_new();
-        EVP_PKEY_assign_RSA(res, rtmp);
-
-        return res;
-err:
-        if (keyToken)
-                OPENSSL_free(keyToken);
-        if (res)
-                EVP_PKEY_free(res);
-        if (rtmp)
-                RSA_free(rtmp);
-        return NULL;
-        }
-
-static int cca_rsa_pub_enc(int flen, const unsigned char *from,
-                        unsigned char *to, RSA *rsa,int padding)
-        {
-        long returnCode;
-        long reasonCode;
-        long lflen = flen;
-        long exitDataLength = 0;
-        unsigned char exitData[8];
-        long ruleArrayLength = 1;
-        unsigned char ruleArray[8] = "PKCS-1.2";
-        long dataStructureLength = 0;
-        unsigned char dataStructure[8];
-        long outputLength = RSA_size(rsa);
-        long keyTokenLength;
-        unsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);
-
-        keyTokenLength = *(long*)keyToken;
-        keyToken+=sizeof(long);
-
-        pkaEncrypt(&returnCode, &reasonCode, &exitDataLength, exitData,
-                &ruleArrayLength, ruleArray, &lflen, (unsigned char*)from,
-                &dataStructureLength, dataStructure, &keyTokenLength,
-                keyToken, &outputLength, to);
-
-        if (returnCode || reasonCode)
-                return -(returnCode << 16 | reasonCode);
-        return outputLength;
-        }
-
-static int cca_rsa_priv_dec(int flen, const unsigned char *from,
-                        unsigned char *to, RSA *rsa,int padding)
-        {
-        long returnCode;
-        long reasonCode;
-        long lflen = flen;
-        long exitDataLength = 0;
-        unsigned char exitData[8];
-        long ruleArrayLength = 1;
-        unsigned char ruleArray[8] = "PKCS-1.2";
-        long dataStructureLength = 0;
-        unsigned char dataStructure[8];
-        long outputLength = RSA_size(rsa);
-        long keyTokenLength;
-        unsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);
-
-        keyTokenLength = *(long*)keyToken;
-        keyToken+=sizeof(long);
-
-        pkaDecrypt(&returnCode, &reasonCode, &exitDataLength, exitData,
-                &ruleArrayLength, ruleArray, &lflen, (unsigned char*)from,
-                &dataStructureLength, dataStructure, &keyTokenLength,
-                keyToken, &outputLength, to);
-
-        return (returnCode | reasonCode) ? 0 : 1;
-        }
-
-#define SSL_SIG_LEN 36
-
-static int cca_rsa_verify(int type, const unsigned char *m, unsigned int m_len,
-                unsigned char *sigbuf, unsigned int siglen, const RSA *rsa)
-        {
-        long returnCode;
-        long reasonCode;
-        long lsiglen = siglen;
-        long exitDataLength = 0;
-        unsigned char exitData[8];
-        long ruleArrayLength = 1;
-        unsigned char ruleArray[8] = "PKCS-1.1";
-        long keyTokenLength;
-        unsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);
-        long length = SSL_SIG_LEN;
-        long keyLength ;
-        unsigned char *hashBuffer = NULL;
-        X509_SIG sig;
-        ASN1_TYPE parameter;
-        X509_ALGOR algorithm;
-        ASN1_OCTET_STRING digest;
-
-        keyTokenLength = *(long*)keyToken;
-        keyToken+=sizeof(long);
-
-        if (type == NID_md5 || type == NID_sha1)
-                {
-                sig.algor = &algorithm;
-                algorithm.algorithm = OBJ_nid2obj(type);
-
-                if (!algorithm.algorithm)
-                        {
-                        CCA4758err(CCA4758_F_IBM_4758_CCA_VERIFY,
-                                CCA4758_R_UNKNOWN_ALGORITHM_TYPE);
-                        return 0;
-                        }
-
-                if (!algorithm.algorithm->length)
-                        {
-                        CCA4758err(CCA4758_F_IBM_4758_CCA_VERIFY,
-                                CCA4758_R_ASN1_OID_UNKNOWN_FOR_MD);
-                        return 0;
-                        }
-
-                parameter.type = V_ASN1_NULL;
-                parameter.value.ptr = NULL;
-                algorithm.parameter = &parameter;
-
-                sig.digest = &digest;
-                sig.digest->data = (unsigned char*)m;
-                sig.digest->length = m_len;
-
-                length = i2d_X509_SIG(&sig, NULL);
-                }
-
-        keyLength = RSA_size(rsa);
-
-        if (length - RSA_PKCS1_PADDING > keyLength)
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_VERIFY,
-                        CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
-                return 0;
-                }
-
-        switch (type)
-                {
-                case NID_md5_sha1 :
-                        if (m_len != SSL_SIG_LEN)
-                                {
-                                CCA4758err(CCA4758_F_IBM_4758_CCA_VERIFY,
-                                CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
-                                return 0;
-                                }
-
-                        hashBuffer = (unsigned char *)m;
-                        length = m_len;
-                        break;
-                case NID_md5 :
-                        {
-                        unsigned char *ptr;
-                        ptr = hashBuffer = OPENSSL_malloc(
-                                        (unsigned int)keyLength+1);
-                        if (!hashBuffer)
-                                {
-                                CCA4758err(CCA4758_F_IBM_4758_CCA_VERIFY,
-                                                ERR_R_MALLOC_FAILURE);
-                                return 0;
-                                }
-
-                        i2d_X509_SIG(&sig, &ptr);
-                        }
-                        break;
-                case NID_sha1 :
-                        {
-                        unsigned char *ptr;
-                        ptr = hashBuffer = OPENSSL_malloc(
-                                        (unsigned int)keyLength+1);
-                        if (!hashBuffer)
-                                {
-                                CCA4758err(CCA4758_F_IBM_4758_CCA_VERIFY,
-                                                ERR_R_MALLOC_FAILURE);
-                                return 0;
-                                }
-                        i2d_X509_SIG(&sig, &ptr);
-                        }
-                        break;
-                default:
-                        return 0;
-                }
-
-        digitalSignatureVerify(&returnCode, &reasonCode, &exitDataLength,
-                exitData, &ruleArrayLength, ruleArray, &keyTokenLength,
-                keyToken, &length, hashBuffer, &lsiglen, sigbuf);
-
-        if (type == NID_sha1 || type == NID_md5)
-                {
-                OPENSSL_cleanse(hashBuffer, keyLength+1);
-                OPENSSL_free(hashBuffer);
-                }
-
-        return ((returnCode || reasonCode) ? 0 : 1);
-        }
-
-#define SSL_SIG_LEN 36
-
-static int cca_rsa_sign(int type, const unsigned char *m, unsigned int m_len,
-                unsigned char *sigret, unsigned int *siglen, const RSA *rsa)
-        {
-        long returnCode;
-        long reasonCode;
-        long exitDataLength = 0;
-        unsigned char exitData[8];
-        long ruleArrayLength = 1;
-        unsigned char ruleArray[8] = "PKCS-1.1";
-        long outputLength=256;
-        long outputBitLength;
-        long keyTokenLength;
-        unsigned char *hashBuffer = NULL;
-        unsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);
-        long length = SSL_SIG_LEN;
-        long keyLength ;
-        X509_SIG sig;
-        ASN1_TYPE parameter;
-        X509_ALGOR algorithm;
-        ASN1_OCTET_STRING digest;
-
-        keyTokenLength = *(long*)keyToken;
-        keyToken+=sizeof(long);
-
-        if (type == NID_md5 || type == NID_sha1)
-                {
-                sig.algor = &algorithm;
-                algorithm.algorithm = OBJ_nid2obj(type);
-
-                if (!algorithm.algorithm)
-                        {
-                        CCA4758err(CCA4758_F_IBM_4758_CCA_SIGN,
-                                CCA4758_R_UNKNOWN_ALGORITHM_TYPE);
-                        return 0;
-                        }
-
-                if (!algorithm.algorithm->length)
-                        {
-                        CCA4758err(CCA4758_F_IBM_4758_CCA_SIGN,
-                                CCA4758_R_ASN1_OID_UNKNOWN_FOR_MD);
-                        return 0;
-                        }
-
-                parameter.type = V_ASN1_NULL;
-                parameter.value.ptr = NULL;
-                algorithm.parameter = &parameter;
-
-                sig.digest = &digest;
-                sig.digest->data = (unsigned char*)m;
-                sig.digest->length = m_len;
-
-                length = i2d_X509_SIG(&sig, NULL);
-                }
-
-        keyLength = RSA_size(rsa);
-
-        if (length - RSA_PKCS1_PADDING > keyLength)
-                {
-                CCA4758err(CCA4758_F_IBM_4758_CCA_SIGN,
-                        CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
-                return 0;
-                }
-
-        switch (type)
-                {
-                case NID_md5_sha1 :
-                        if (m_len != SSL_SIG_LEN)
-                                {
-                                CCA4758err(CCA4758_F_IBM_4758_CCA_SIGN,
-                                CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
-                                return 0;
-                                }
-                        hashBuffer = (unsigned char*)m;
-                        length = m_len;
-                        break;
-                case NID_md5 :
-                        {
-                        unsigned char *ptr;
-                        ptr = hashBuffer = OPENSSL_malloc(
-                                        (unsigned int)keyLength+1);
-                        if (!hashBuffer)
-                                {
-                                CCA4758err(CCA4758_F_IBM_4758_CCA_VERIFY,
-                                                ERR_R_MALLOC_FAILURE);
-                                return 0;
-                                }
-                        i2d_X509_SIG(&sig, &ptr);
-                        }
-                        break;
-                case NID_sha1 :
-                        {
-                        unsigned char *ptr;
-                        ptr = hashBuffer = OPENSSL_malloc(
-                                        (unsigned int)keyLength+1);
-                        if (!hashBuffer)
-                                {
-                                CCA4758err(CCA4758_F_IBM_4758_CCA_VERIFY,
-                                                ERR_R_MALLOC_FAILURE);
-                                return 0;
-                                }
-                        i2d_X509_SIG(&sig, &ptr);
-                        }
-                        break;
-                default:
-                        return 0;
-                }
-
-        digitalSignatureGenerate(&returnCode, &reasonCode, &exitDataLength,
-                exitData, &ruleArrayLength, ruleArray, &keyTokenLength,
-                keyToken, &length, hashBuffer, &outputLength, &outputBitLength,
-                sigret);
-
-        if (type == NID_sha1 || type == NID_md5)
-                {
-                OPENSSL_cleanse(hashBuffer, keyLength+1);
-                OPENSSL_free(hashBuffer);
-                }
-
-        *siglen = outputLength;
-
-        return ((returnCode || reasonCode) ? 0 : 1);
-        }
-
-static int getModulusAndExponent(const unsigned char*token, long *exponentLength,
-                unsigned char *exponent, long *modulusLength, long *modulusFieldLength,
-                unsigned char *modulus)
-        {
-        unsigned long len;
-
-        if (*token++ != (char)0x1E) /* internal PKA token? */
-                return 0;
-
-        if (*token++) /* token version must be zero */
-                return 0;
-
-        len = *token++;
-        len = len << 8;
-        len |= (unsigned char)*token++;
-
-        token += 4; /* skip reserved bytes */
-
-        if (*token++ == (char)0x04)
-                {
-                if (*token++) /* token version must be zero */
-                        return 0;
-
-                len = *token++;
-                len = len << 8;
-                len |= (unsigned char)*token++;
-
-                token+=2; /* skip reserved section */
-
-                len = *token++;
-                len = len << 8;
-                len |= (unsigned char)*token++;
-
-                *exponentLength = len;
-
-                len = *token++;
-                len = len << 8;
-                len |= (unsigned char)*token++;
-
-                *modulusLength = len;
-
-                len = *token++;
-                len = len << 8;
-                len |= (unsigned char)*token++;
-
-                *modulusFieldLength = len;
-
-                memcpy(exponent, token, *exponentLength);
-                token+= *exponentLength;
-
-                memcpy(modulus, token, *modulusFieldLength);
-                return 1;
-                }
-        return 0;
-        }
-
-#endif /* OPENSSL_NO_RSA */
-
-static int cca_random_status(void)
-        {
-        return 1;
-        }
-
-static int cca_get_random_bytes(unsigned char* buf, int num)
-        {
-        long ret_code;
-        long reason_code;
-        long exit_data_length;
-        unsigned char exit_data[4];
-        unsigned char form[] = "RANDOM  ";
-        unsigned char rand_buf[8];
-
-        while(num >= sizeof(rand_buf))
-                {
-                randomNumberGenerate(&ret_code, &reason_code, &exit_data_length,
-                        exit_data, form, rand_buf);
-                if (ret_code)
-                        return 0;
-                num -= sizeof(rand_buf);
-                memcpy(buf, rand_buf, sizeof(rand_buf));
-                buf += sizeof(rand_buf);
-                }
-
-        if (num)
-                {
-                randomNumberGenerate(&ret_code, &reason_code, NULL, NULL,
-                        form, rand_buf);
-                if (ret_code)
-                        return 0;
-                memcpy(buf, rand_buf, num);
-                }
-
-        return 1;
-        }
-
-static void cca_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad, int idx,
-                long argl, void *argp)
-        {
-        if (item)
-                OPENSSL_free(item);
-        }
-
-/* Goo to handle building as a dynamic engine */
-#ifdef ENGINE_DYNAMIC_SUPPORT 
-static int bind_fn(ENGINE *e, const char *id)
-        {
-        if(id && (strcmp(id, engine_4758_cca_id) != 0))
-                return 0;
-        if(!bind_helper(e))
-                return 0;
-        return 1;
-        }       
-IMPLEMENT_DYNAMIC_CHECK_FN()
-IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
-#endif /* ENGINE_DYNAMIC_SUPPORT */
-
-#endif /* !OPENSSL_NO_HW_4758_CCA */
-#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libcrypto/engine/hw_4758_cca_err.c b/src/lib/libcrypto/engine/hw_4758_cca_err.c
deleted file mode 100644
index 7ea5c63707..0000000000
--- a/src/lib/libcrypto/engine/hw_4758_cca_err.c
+++ /dev/null
@@ -1,149 +0,0 @@
-/* hw_4758_cca_err.c */
-/* ====================================================================
- * Copyright (c) 1999-2002 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-/* NOTE: this file was auto generated by the mkerr.pl script: any changes
- * made to it will be overwritten when the script next updates this file,
- * only reason strings will be preserved.
- */
-
-#include <stdio.h>
-#include <openssl/err.h>
-#include "hw_4758_cca_err.h"
-
-/* BEGIN ERROR CODES */
-#ifndef OPENSSL_NO_ERR
-static ERR_STRING_DATA CCA4758_str_functs[]=
-        {
-{ERR_PACK(0,CCA4758_F_IBM_4758_CCA_CTRL,0),     "IBM_4758_CCA_CTRL"},
-{ERR_PACK(0,CCA4758_F_IBM_4758_CCA_FINISH,0),   "IBM_4758_CCA_FINISH"},
-{ERR_PACK(0,CCA4758_F_IBM_4758_CCA_INIT,0),     "IBM_4758_CCA_INIT"},
-{ERR_PACK(0,CCA4758_F_IBM_4758_CCA_LOAD_PRIVKEY,0),     "IBM_4758_CCA_LOAD_PRIVKEY"},
-{ERR_PACK(0,CCA4758_F_IBM_4758_CCA_LOAD_PUBKEY,0),      "IBM_4758_CCA_LOAD_PUBKEY"},
-{ERR_PACK(0,CCA4758_F_IBM_4758_CCA_SIGN,0),     "IBM_4758_CCA_SIGN"},
-{ERR_PACK(0,CCA4758_F_IBM_4758_CCA_VERIFY,0),   "IBM_4758_CCA_VERIFY"},
-{0,NULL}
-        };
-
-static ERR_STRING_DATA CCA4758_str_reasons[]=
-        {
-{CCA4758_R_ALREADY_LOADED                ,"already loaded"},
-{CCA4758_R_ASN1_OID_UNKNOWN_FOR_MD       ,"asn1 oid unknown for md"},
-{CCA4758_R_COMMAND_NOT_IMPLEMENTED       ,"command not implemented"},
-{CCA4758_R_DSO_FAILURE                   ,"dso failure"},
-{CCA4758_R_FAILED_LOADING_PRIVATE_KEY    ,"failed loading private key"},
-{CCA4758_R_FAILED_LOADING_PUBLIC_KEY     ,"failed loading public key"},
-{CCA4758_R_NOT_LOADED                    ,"not loaded"},
-{CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL   ,"size too large or too small"},
-{CCA4758_R_UNIT_FAILURE                  ,"unit failure"},
-{CCA4758_R_UNKNOWN_ALGORITHM_TYPE        ,"unknown algorithm type"},
-{0,NULL}
-        };
-
-#endif
-
-#ifdef CCA4758_LIB_NAME
-static ERR_STRING_DATA CCA4758_lib_name[]=
-        {
-{0      ,CCA4758_LIB_NAME},
-{0,NULL}
-        };
-#endif
-
-
-static int CCA4758_lib_error_code=0;
-static int CCA4758_error_init=1;
-
-static void ERR_load_CCA4758_strings(void)
-        {
-        if (CCA4758_lib_error_code == 0)
-                CCA4758_lib_error_code=ERR_get_next_error_library();
-
-        if (CCA4758_error_init)
-                {
-                CCA4758_error_init=0;
-#ifndef OPENSSL_NO_ERR
-                ERR_load_strings(CCA4758_lib_error_code,CCA4758_str_functs);
-                ERR_load_strings(CCA4758_lib_error_code,CCA4758_str_reasons);
-#endif
-
-#ifdef CCA4758_LIB_NAME
-                CCA4758_lib_name->error = ERR_PACK(CCA4758_lib_error_code,0,0);
-                ERR_load_strings(0,CCA4758_lib_name);
-#endif
-                }
-        }
-
-static void ERR_unload_CCA4758_strings(void)
-        {
-        if (CCA4758_error_init == 0)
-                {
-#ifndef OPENSSL_NO_ERR
-                ERR_unload_strings(CCA4758_lib_error_code,CCA4758_str_functs);
-                ERR_unload_strings(CCA4758_lib_error_code,CCA4758_str_reasons);
-#endif
-
-#ifdef CCA4758_LIB_NAME
-                ERR_unload_strings(0,CCA4758_lib_name);
-#endif
-                CCA4758_error_init=1;
-                }
-        }
-
-static void ERR_CCA4758_error(int function, int reason, char *file, int line)
-        {
-        if (CCA4758_lib_error_code == 0)
-                CCA4758_lib_error_code=ERR_get_next_error_library();
-        ERR_PUT_error(CCA4758_lib_error_code,function,reason,file,line);
-        }
diff --git a/src/lib/libcrypto/engine/hw_aep.c b/src/lib/libcrypto/engine/hw_aep.c
deleted file mode 100644
index 5f1772ea99..0000000000
--- a/src/lib/libcrypto/engine/hw_aep.c
+++ /dev/null
@@ -1,1120 +0,0 @@
-/* crypto/engine/hw_aep.c */
-/*
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <openssl/bn.h>
-#include <string.h>
-
-#include <openssl/e_os2.h>
-#if !defined(OPENSSL_SYS_MSDOS) || defined(__DJGPP__)
-#include <sys/types.h>
-#include <unistd.h>
-#else
-#include <process.h>
-typedef int pid_t;
-#endif
-
-#include <openssl/crypto.h>
-#include <openssl/dso.h>
-#include <openssl/engine.h>
-#include <openssl/buffer.h>
-
-#ifndef OPENSSL_NO_HW
-#ifndef OPENSSL_NO_HW_AEP
-#ifdef FLAT_INC
-#include "aep.h"
-#else
-#include "vendor_defns/aep.h"
-#endif
-
-#define AEP_LIB_NAME "aep engine"
-#define FAIL_TO_SW 0x10101010
-
-#include "hw_aep_err.c"
-
-static int aep_init(ENGINE *e);
-static int aep_finish(ENGINE *e);
-static int aep_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
-static int aep_destroy(ENGINE *e);
-
-static AEP_RV aep_get_connection(AEP_CONNECTION_HNDL_PTR hConnection);
-static AEP_RV aep_return_connection(AEP_CONNECTION_HNDL hConnection);
-static AEP_RV aep_close_connection(AEP_CONNECTION_HNDL hConnection);
-static AEP_RV aep_close_all_connections(int use_engine_lock, int *in_use);
-
-/* BIGNUM stuff */
-static int aep_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-        const BIGNUM *m, BN_CTX *ctx);
-
-static AEP_RV aep_mod_exp_crt(BIGNUM *r,const  BIGNUM *a, const BIGNUM *p,
-        const BIGNUM *q, const BIGNUM *dmp1,const BIGNUM *dmq1,
-        const BIGNUM *iqmp, BN_CTX *ctx);
-
-/* RSA stuff */
-#ifndef OPENSSL_NO_RSA
-static int aep_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
-#endif
-
-/* This function is aliased to mod_exp (with the mont stuff dropped). */
-static int aep_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
-
-/* DSA stuff */
-#ifndef OPENSSL_NO_DSA
-static int aep_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
-        BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
-        BN_CTX *ctx, BN_MONT_CTX *in_mont);
-
-static int aep_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
-        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
-        BN_MONT_CTX *m_ctx);
-#endif
-
-/* DH stuff */
-/* This function is aliased to mod_exp (with the DH and mont dropped). */
-#ifndef OPENSSL_NO_DH
-static int aep_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
-        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
-#endif
-
-/* rand stuff   */
-#ifdef AEPRAND
-static int aep_rand(unsigned char *buf, int num);
-static int aep_rand_status(void);
-#endif
-
-/* Bignum conversion stuff */
-static AEP_RV GetBigNumSize(AEP_VOID_PTR ArbBigNum, AEP_U32* BigNumSize);
-static AEP_RV MakeAEPBigNum(AEP_VOID_PTR ArbBigNum, AEP_U32 BigNumSize,
-        unsigned char* AEP_BigNum);
-static AEP_RV ConvertAEPBigNum(void* ArbBigNum, AEP_U32 BigNumSize,
-        unsigned char* AEP_BigNum);
-
-/* The definitions for control commands specific to this engine */
-#define AEP_CMD_SO_PATH         ENGINE_CMD_BASE
-static const ENGINE_CMD_DEFN aep_cmd_defns[] =
-        {
-        { AEP_CMD_SO_PATH,
-          "SO_PATH",
-          "Specifies the path to the 'aep' shared library",
-          ENGINE_CMD_FLAG_STRING
-        },
-        {0, NULL, NULL, 0}
-        };
-
-#ifndef OPENSSL_NO_RSA
-/* Our internal RSA_METHOD that we provide pointers to */
-static RSA_METHOD aep_rsa =
-        {
-        "Aep RSA method",
-        NULL,                /*rsa_pub_encrypt*/
-        NULL,                /*rsa_pub_decrypt*/
-        NULL,                /*rsa_priv_encrypt*/
-        NULL,                /*rsa_priv_encrypt*/
-        aep_rsa_mod_exp,     /*rsa_mod_exp*/
-        aep_mod_exp_mont,    /*bn_mod_exp*/
-        NULL,                /*init*/
-        NULL,                /*finish*/
-        0,                   /*flags*/
-        NULL,                /*app_data*/
-        NULL,                /*rsa_sign*/
-        NULL                 /*rsa_verify*/
-        };
-#endif
-
-#ifndef OPENSSL_NO_DSA
-/* Our internal DSA_METHOD that we provide pointers to */
-static DSA_METHOD aep_dsa =
-        {
-        "Aep DSA method",
-        NULL,                /* dsa_do_sign */
-        NULL,                /* dsa_sign_setup */
-        NULL,                /* dsa_do_verify */
-        aep_dsa_mod_exp,     /* dsa_mod_exp */
-        aep_mod_exp_dsa,     /* bn_mod_exp */
-        NULL,                /* init */
-        NULL,                /* finish */
-        0,                   /* flags */
-        NULL                 /* app_data */
-        };
-#endif
-
-#ifndef OPENSSL_NO_DH
-/* Our internal DH_METHOD that we provide pointers to */
-static DH_METHOD aep_dh =
-        {
-        "Aep DH method",
-        NULL,
-        NULL,
-        aep_mod_exp_dh,
-        NULL,
-        NULL,
-        0,
-        NULL
-        };
-#endif
-
-#ifdef AEPRAND
-/* our internal RAND_method that we provide pointers to  */
-static RAND_METHOD aep_random =
-        {
-        /*"AEP RAND method", */
-        NULL,
-        aep_rand,
-        NULL,
-        NULL,
-        aep_rand,
-        aep_rand_status,
-        };
-#endif
-
-/*Define an array of structures to hold connections*/
-static AEP_CONNECTION_ENTRY aep_app_conn_table[MAX_PROCESS_CONNECTIONS];
-
-/*Used to determine if this is a new process*/
-static pid_t    recorded_pid = 0;
-
-#ifdef AEPRAND
-static AEP_U8   rand_block[RAND_BLK_SIZE];
-static AEP_U32  rand_block_bytes = 0;
-#endif
-
-/* Constants used when creating the ENGINE */
-static const char *engine_aep_id = "aep";
-static const char *engine_aep_name = "Aep hardware engine support";
-
-static int max_key_len = 2176;
-
-
-/* This internal function is used by ENGINE_aep() and possibly by the
- * "dynamic" ENGINE support too */
-static int bind_aep(ENGINE *e)
-        {
-#ifndef OPENSSL_NO_RSA
-        const RSA_METHOD  *meth1;
-#endif
-#ifndef OPENSSL_NO_DSA
-        const DSA_METHOD  *meth2;
-#endif
-#ifndef OPENSSL_NO_DH
-        const DH_METHOD   *meth3;
-#endif
-
-        if(!ENGINE_set_id(e, engine_aep_id) ||
-                !ENGINE_set_name(e, engine_aep_name) ||
-#ifndef OPENSSL_NO_RSA
-                !ENGINE_set_RSA(e, &aep_rsa) ||
-#endif
-#ifndef OPENSSL_NO_DSA
-                !ENGINE_set_DSA(e, &aep_dsa) ||
-#endif
-#ifndef OPENSSL_NO_DH
-                !ENGINE_set_DH(e, &aep_dh) ||
-#endif
-#ifdef AEPRAND
-                !ENGINE_set_RAND(e, &aep_random) ||
-#endif
-                !ENGINE_set_init_function(e, aep_init) ||
-                !ENGINE_set_destroy_function(e, aep_destroy) ||
-                !ENGINE_set_finish_function(e, aep_finish) ||
-                !ENGINE_set_ctrl_function(e, aep_ctrl) ||
-                !ENGINE_set_cmd_defns(e, aep_cmd_defns))
-                return 0;
-
-#ifndef OPENSSL_NO_RSA
-        /* We know that the "PKCS1_SSLeay()" functions hook properly
-         * to the aep-specific mod_exp and mod_exp_crt so we use
-         * those functions. NB: We don't use ENGINE_openssl() or
-         * anything "more generic" because something like the RSAref
-         * code may not hook properly, and if you own one of these
-         * cards then you have the right to do RSA operations on it
-         * anyway! */
-        meth1 = RSA_PKCS1_SSLeay();
-        aep_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
-        aep_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
-        aep_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
-        aep_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
-#endif
-
-
-#ifndef OPENSSL_NO_DSA
-        /* Use the DSA_OpenSSL() method and just hook the mod_exp-ish
-         * bits. */
-        meth2 = DSA_OpenSSL();
-        aep_dsa.dsa_do_sign    = meth2->dsa_do_sign;
-        aep_dsa.dsa_sign_setup = meth2->dsa_sign_setup;
-        aep_dsa.dsa_do_verify  = meth2->dsa_do_verify;
-
-        aep_dsa = *DSA_get_default_method(); 
-        aep_dsa.dsa_mod_exp = aep_dsa_mod_exp; 
-        aep_dsa.bn_mod_exp = aep_mod_exp_dsa;
-#endif
-
-#ifndef OPENSSL_NO_DH
-        /* Much the same for Diffie-Hellman */
-        meth3 = DH_OpenSSL();
-        aep_dh.generate_key = meth3->generate_key;
-        aep_dh.compute_key  = meth3->compute_key;
-        aep_dh.bn_mod_exp   = meth3->bn_mod_exp;
-#endif
-
-        /* Ensure the aep error handling is set up */
-        ERR_load_AEPHK_strings();
-
-        return 1;
-}
-
-#ifdef ENGINE_DYNAMIC_SUPPORT
-static int bind_helper(ENGINE *e, const char *id)
-        {
-        if(id && (strcmp(id, engine_aep_id) != 0))
-                return 0;
-        if(!bind_aep(e))
-                return 0;
-        return 1;
-        }       
-IMPLEMENT_DYNAMIC_CHECK_FN()
-IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)
-#else
-static ENGINE *engine_aep(void)
-        {
-        ENGINE *ret = ENGINE_new();
-        if(!ret)
-                return NULL;
-        if(!bind_aep(ret))
-                {
-                ENGINE_free(ret);
-                return NULL;
-                }
-        return ret;
-        }
-
-void ENGINE_load_aep(void)
-        {
-        /* Copied from eng_[openssl|dyn].c */
-        ENGINE *toadd = engine_aep();
-        if(!toadd) return;
-        ENGINE_add(toadd);
-        ENGINE_free(toadd);
-        ERR_clear_error();
-        }
-#endif
-
-/* This is a process-global DSO handle used for loading and unloading
- * the Aep library. NB: This is only set (or unset) during an
- * init() or finish() call (reference counts permitting) and they're
- * operating with global locks, so this should be thread-safe
- * implicitly. */
-static DSO *aep_dso = NULL;
-
-/* These are the static string constants for the DSO file name and the function
- * symbol names to bind to. 
-*/
-static const char *AEP_LIBNAME = NULL;
-static const char *get_AEP_LIBNAME(void)
-        {
-        if(AEP_LIBNAME)
-                return AEP_LIBNAME;
-        return "aep";
-        }
-static void free_AEP_LIBNAME(void)
-        {
-        if(AEP_LIBNAME)
-                OPENSSL_free((void*)AEP_LIBNAME);
-        AEP_LIBNAME = NULL;
-        }
-static long set_AEP_LIBNAME(const char *name)
-        {
-        free_AEP_LIBNAME();
-        return ((AEP_LIBNAME = BUF_strdup(name)) != NULL ? 1 : 0);
-        }
-
-static const char *AEP_F1    = "AEP_ModExp";
-static const char *AEP_F2    = "AEP_ModExpCrt";
-#ifdef AEPRAND
-static const char *AEP_F3    = "AEP_GenRandom";
-#endif
-static const char *AEP_F4    = "AEP_Finalize";
-static const char *AEP_F5    = "AEP_Initialize";
-static const char *AEP_F6    = "AEP_OpenConnection";
-static const char *AEP_F7    = "AEP_SetBNCallBacks";
-static const char *AEP_F8    = "AEP_CloseConnection";
-
-/* These are the function pointers that are (un)set when the library has
- * successfully (un)loaded. */
-static t_AEP_OpenConnection    *p_AEP_OpenConnection  = NULL;
-static t_AEP_CloseConnection   *p_AEP_CloseConnection = NULL;
-static t_AEP_ModExp            *p_AEP_ModExp          = NULL;
-static t_AEP_ModExpCrt         *p_AEP_ModExpCrt       = NULL;
-#ifdef AEPRAND
-static t_AEP_GenRandom         *p_AEP_GenRandom       = NULL;
-#endif
-static t_AEP_Initialize        *p_AEP_Initialize      = NULL;
-static t_AEP_Finalize          *p_AEP_Finalize        = NULL;
-static t_AEP_SetBNCallBacks    *p_AEP_SetBNCallBacks  = NULL;
-
-/* (de)initialisation functions. */
-static int aep_init(ENGINE *e)
-        {
-        t_AEP_ModExp          *p1;
-        t_AEP_ModExpCrt       *p2;
-#ifdef AEPRAND
-        t_AEP_GenRandom       *p3;
-#endif
-        t_AEP_Finalize        *p4;
-        t_AEP_Initialize      *p5;
-        t_AEP_OpenConnection  *p6;
-        t_AEP_SetBNCallBacks  *p7;
-        t_AEP_CloseConnection *p8;
-
-        int to_return = 0;
- 
-        if(aep_dso != NULL)
-                {
-                AEPHKerr(AEPHK_F_AEP_INIT,AEPHK_R_ALREADY_LOADED);
-                goto err;
-                }
-        /* Attempt to load libaep.so. */
-
-        aep_dso = DSO_load(NULL, get_AEP_LIBNAME(), NULL, 0);
-  
-        if(aep_dso == NULL)
-                {
-                AEPHKerr(AEPHK_F_AEP_INIT,AEPHK_R_NOT_LOADED);
-                goto err;
-                }
-
-        if(     !(p1 = (t_AEP_ModExp *)     DSO_bind_func( aep_dso,AEP_F1))  ||
-                !(p2 = (t_AEP_ModExpCrt*)   DSO_bind_func( aep_dso,AEP_F2))  ||
-#ifdef AEPRAND
-                !(p3 = (t_AEP_GenRandom*)   DSO_bind_func( aep_dso,AEP_F3))  ||
-#endif
-                !(p4 = (t_AEP_Finalize*)    DSO_bind_func( aep_dso,AEP_F4))  ||
-                !(p5 = (t_AEP_Initialize*)  DSO_bind_func( aep_dso,AEP_F5))  ||
-                !(p6 = (t_AEP_OpenConnection*) DSO_bind_func( aep_dso,AEP_F6))  ||
-                !(p7 = (t_AEP_SetBNCallBacks*) DSO_bind_func( aep_dso,AEP_F7))  ||
-                !(p8 = (t_AEP_CloseConnection*) DSO_bind_func( aep_dso,AEP_F8)))
-                {
-                AEPHKerr(AEPHK_F_AEP_INIT,AEPHK_R_NOT_LOADED);
-                goto err;
-                }
-
-        /* Copy the pointers */
-  
-        p_AEP_ModExp           = p1;
-        p_AEP_ModExpCrt        = p2;
-#ifdef AEPRAND
-        p_AEP_GenRandom        = p3;
-#endif
-        p_AEP_Finalize         = p4;
-        p_AEP_Initialize       = p5;
-        p_AEP_OpenConnection   = p6;
-        p_AEP_SetBNCallBacks   = p7;
-        p_AEP_CloseConnection  = p8;
- 
-        to_return = 1;
- 
-        return to_return;
-
- err: 
-
-        if(aep_dso)
-                DSO_free(aep_dso);
-        aep_dso = NULL;
-                
-        p_AEP_OpenConnection    = NULL;
-        p_AEP_ModExp            = NULL;
-        p_AEP_ModExpCrt         = NULL;
-#ifdef AEPRAND
-        p_AEP_GenRandom         = NULL;
-#endif
-        p_AEP_Initialize        = NULL;
-        p_AEP_Finalize          = NULL;
-        p_AEP_SetBNCallBacks    = NULL;
-        p_AEP_CloseConnection   = NULL;
-
-        return to_return;
-        }
-
-/* Destructor (complements the "ENGINE_aep()" constructor) */
-static int aep_destroy(ENGINE *e)
-        {
-        free_AEP_LIBNAME();
-        ERR_unload_AEPHK_strings();
-        return 1;
-        }
-
-static int aep_finish(ENGINE *e)
-        {
-        int to_return = 0, in_use;
-        AEP_RV rv;
-
-        if(aep_dso == NULL)
-                {
-                AEPHKerr(AEPHK_F_AEP_FINISH,AEPHK_R_NOT_LOADED);
-                goto err;
-                }
-
-        rv = aep_close_all_connections(0, &in_use);
-        if (rv != AEP_R_OK)
-                {
-                AEPHKerr(AEPHK_F_AEP_FINISH,AEPHK_R_CLOSE_HANDLES_FAILED);
-                goto err;
-                }
-        if (in_use)
-                {
-                AEPHKerr(AEPHK_F_AEP_FINISH,AEPHK_R_CONNECTIONS_IN_USE);
-                goto err;
-                }
-
-        rv = p_AEP_Finalize();
-        if (rv != AEP_R_OK)
-                {
-                AEPHKerr(AEPHK_F_AEP_FINISH,AEPHK_R_FINALIZE_FAILED);
-                goto err;
-                }
-
-        if(!DSO_free(aep_dso))
-                {
-                AEPHKerr(AEPHK_F_AEP_FINISH,AEPHK_R_UNIT_FAILURE);
-                goto err;
-                }
-
-        aep_dso = NULL;
-        p_AEP_CloseConnection   = NULL;
-        p_AEP_OpenConnection    = NULL;
-        p_AEP_ModExp            = NULL;
-        p_AEP_ModExpCrt         = NULL;
-#ifdef AEPRAND
-        p_AEP_GenRandom         = NULL;
-#endif
-        p_AEP_Initialize        = NULL;
-        p_AEP_Finalize          = NULL;
-        p_AEP_SetBNCallBacks    = NULL;
-
-        to_return = 1;
- err:
-        return to_return;
-        }
-
-static int aep_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
-        {
-        int initialised = ((aep_dso == NULL) ? 0 : 1);
-        switch(cmd)
-                {
-        case AEP_CMD_SO_PATH:
-                if(p == NULL)
-                        {
-                        AEPHKerr(AEPHK_F_AEP_CTRL,
-                                ERR_R_PASSED_NULL_PARAMETER);
-                        return 0;
-                        }
-                if(initialised)
-                        {
-                        AEPHKerr(AEPHK_F_AEP_CTRL,
-                                AEPHK_R_ALREADY_LOADED);
-                        return 0;
-                        }
-                return set_AEP_LIBNAME((const char*)p);
-        default:
-                break;
-                }
-        AEPHKerr(AEPHK_F_AEP_CTRL,AEPHK_R_CTRL_COMMAND_NOT_IMPLEMENTED);
-        return 0;
-        }
-
-static int aep_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-        const BIGNUM *m, BN_CTX *ctx)
-        {
-        int to_return = 0;
-        int     r_len = 0;
-        AEP_CONNECTION_HNDL hConnection;
-        AEP_RV rv;
-        
-        r_len = BN_num_bits(m);
-
-        /* Perform in software if modulus is too large for hardware. */
-
-        if (r_len > max_key_len){
-                AEPHKerr(AEPHK_F_AEP_MOD_EXP, AEPHK_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
-                return BN_mod_exp(r, a, p, m, ctx);
-        } 
-
-        /*Grab a connection from the pool*/
-        rv = aep_get_connection(&hConnection);
-        if (rv != AEP_R_OK)
-                {     
-                AEPHKerr(AEPHK_F_AEP_MOD_EXP,AEPHK_R_GET_HANDLE_FAILED);
-                return BN_mod_exp(r, a, p, m, ctx);
-                }
-
-        /*To the card with the mod exp*/
-        rv = p_AEP_ModExp(hConnection,(void*)a, (void*)p,(void*)m, (void*)r,NULL);
-
-        if (rv !=  AEP_R_OK)
-                {
-                AEPHKerr(AEPHK_F_AEP_MOD_EXP,AEPHK_R_MOD_EXP_FAILED);
-                rv = aep_close_connection(hConnection);
-                return BN_mod_exp(r, a, p, m, ctx);
-                }
-
-        /*Return the connection to the pool*/
-        rv = aep_return_connection(hConnection);
-        if (rv != AEP_R_OK)
-                {
-                AEPHKerr(AEPHK_F_AEP_RAND,AEPHK_R_RETURN_CONNECTION_FAILED); 
-                goto err;
-                }
-
-        to_return = 1;
- err:
-        return to_return;
-        }
-        
-static AEP_RV aep_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-        const BIGNUM *q, const BIGNUM *dmp1,
-        const BIGNUM *dmq1,const BIGNUM *iqmp, BN_CTX *ctx)
-        {
-        AEP_RV rv = AEP_R_OK;
-        AEP_CONNECTION_HNDL hConnection;
-
-        /*Grab a connection from the pool*/
-        rv = aep_get_connection(&hConnection);
-        if (rv != AEP_R_OK)
-                {
-                AEPHKerr(AEPHK_F_AEP_MOD_EXP_CRT,AEPHK_R_GET_HANDLE_FAILED);
-                return FAIL_TO_SW;
-                }
-
-        /*To the card with the mod exp*/
-        rv = p_AEP_ModExpCrt(hConnection,(void*)a, (void*)p, (void*)q, (void*)dmp1,(void*)dmq1,
-                (void*)iqmp,(void*)r,NULL);
-        if (rv != AEP_R_OK)
-                {
-                AEPHKerr(AEPHK_F_AEP_MOD_EXP_CRT,AEPHK_R_MOD_EXP_CRT_FAILED);
-                rv = aep_close_connection(hConnection);
-                return FAIL_TO_SW;
-                }
-
-        /*Return the connection to the pool*/
-        rv = aep_return_connection(hConnection);
-        if (rv != AEP_R_OK)
-                {
-                AEPHKerr(AEPHK_F_AEP_RAND,AEPHK_R_RETURN_CONNECTION_FAILED); 
-                goto err;
-                }
- 
- err:
-        return rv;
-        }
-        
-
-#ifdef AEPRAND
-static int aep_rand(unsigned char *buf,int len )
-        {
-        AEP_RV rv = AEP_R_OK;
-        AEP_CONNECTION_HNDL hConnection;
-
-        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
-
-        /*Can the request be serviced with what's already in the buffer?*/
-        if (len <= rand_block_bytes)
-                {
-                memcpy(buf, &rand_block[RAND_BLK_SIZE - rand_block_bytes], len);
-                rand_block_bytes -= len;
-                CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
-                }
-        else
-                /*If not the get another block of random bytes*/
-                {
-                CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
-
-                rv = aep_get_connection(&hConnection);
-                if (rv !=  AEP_R_OK)
-                        { 
-                        AEPHKerr(AEPHK_F_AEP_RAND,AEPHK_R_GET_HANDLE_FAILED);             
-                        goto err_nounlock;
-                        }
-
-                if (len > RAND_BLK_SIZE)
-                        {
-                        rv = p_AEP_GenRandom(hConnection, len, 2, buf, NULL);
-                        if (rv !=  AEP_R_OK)
-                                {  
-                                AEPHKerr(AEPHK_F_AEP_RAND,AEPHK_R_GET_RANDOM_FAILED); 
-                                goto err_nounlock;
-                                }
-                        }
-                else
-                        {
-                        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
-
-                        rv = p_AEP_GenRandom(hConnection, RAND_BLK_SIZE, 2, &rand_block[0], NULL);
-                        if (rv !=  AEP_R_OK)
-                                {       
-                                AEPHKerr(AEPHK_F_AEP_RAND,AEPHK_R_GET_RANDOM_FAILED); 
-              
-                                goto err;
-                                }
-
-                        rand_block_bytes = RAND_BLK_SIZE;
-
-                        memcpy(buf, &rand_block[RAND_BLK_SIZE - rand_block_bytes], len);
-                        rand_block_bytes -= len;
-
-                        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
-                        }
-
-                rv = aep_return_connection(hConnection);
-                if (rv != AEP_R_OK)
-                        {
-                        AEPHKerr(AEPHK_F_AEP_RAND,AEPHK_R_RETURN_CONNECTION_FAILED); 
-          
-                        goto err_nounlock;
-                        }
-                }
-  
-        return 1;
- err:
-        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
- err_nounlock:
-        return 0;
-        }
-        
-static int aep_rand_status(void)
-{
-        return 1;
-}
-#endif
-
-#ifndef OPENSSL_NO_RSA
-static int aep_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
-        {
-        BN_CTX *ctx = NULL;
-        int to_return = 0;
-        AEP_RV rv = AEP_R_OK;
-
-        if ((ctx = BN_CTX_new()) == NULL)
-                goto err;
-
-        if (!aep_dso)
-                {
-                AEPHKerr(AEPHK_F_AEP_RSA_MOD_EXP,AEPHK_R_NOT_LOADED);
-                goto err;
-                }
-
-        /*See if we have all the necessary bits for a crt*/
-        if (rsa->q && rsa->dmp1 && rsa->dmq1 && rsa->iqmp)
-                {
-                rv =  aep_mod_exp_crt(r0,I,rsa->p,rsa->q, rsa->dmp1,rsa->dmq1,rsa->iqmp,ctx);
-
-                if (rv == FAIL_TO_SW){
-                        const RSA_METHOD *meth = RSA_PKCS1_SSLeay();
-                        to_return = (*meth->rsa_mod_exp)(r0, I, rsa);
-                        goto err;
-                }
-                else if (rv != AEP_R_OK)
-                        goto err;
-                }
-        else
-                {
-                if (!rsa->d || !rsa->n)
-                        {
-                        AEPHKerr(AEPHK_F_AEP_RSA_MOD_EXP,AEPHK_R_MISSING_KEY_COMPONENTS);
-                        goto err;
-                        }
- 
-                rv = aep_mod_exp(r0,I,rsa->d,rsa->n,ctx);
-                if  (rv != AEP_R_OK)
-                        goto err;
-        
-                }
-
-        to_return = 1;
-
- err:
-        if(ctx)
-                BN_CTX_free(ctx);
-        return to_return;
-}
-#endif
-
-#ifndef OPENSSL_NO_DSA
-static int aep_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
-        BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
-        BN_CTX *ctx, BN_MONT_CTX *in_mont)
-        {
-        BIGNUM t;
-        int to_return = 0;
-        BN_init(&t);
-
-        /* let rr = a1 ^ p1 mod m */
-        if (!aep_mod_exp(rr,a1,p1,m,ctx)) goto end;
-        /* let t = a2 ^ p2 mod m */
-        if (!aep_mod_exp(&t,a2,p2,m,ctx)) goto end;
-        /* let rr = rr * t mod m */
-        if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
-        to_return = 1;
- end: 
-        BN_free(&t);
-        return to_return;
-        }
-
-static int aep_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
-        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
-        BN_MONT_CTX *m_ctx)
-        {  
-        return aep_mod_exp(r, a, p, m, ctx); 
-        }
-#endif
-
-/* This function is aliased to mod_exp (with the mont stuff dropped). */
-static int aep_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-        {
-        return aep_mod_exp(r, a, p, m, ctx);
-        }
-
-#ifndef OPENSSL_NO_DH
-/* This function is aliased to mod_exp (with the dh and mont dropped). */
-static int aep_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
-        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
-        BN_MONT_CTX *m_ctx)
-        {
-        return aep_mod_exp(r, a, p, m, ctx);
-        }
-#endif
-
-static AEP_RV aep_get_connection(AEP_CONNECTION_HNDL_PTR phConnection)
-        {
-        int count;
-        AEP_RV rv = AEP_R_OK;
-
-        /*Get the current process id*/
-        pid_t curr_pid;
-
-        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-
-        curr_pid = getpid();
-
-        /*Check if this is the first time this is being called from the current
-          process*/
-        if (recorded_pid != curr_pid)
-                {
-                /*Remember our pid so we can check if we're in a new process*/
-                recorded_pid = curr_pid;
-
-                /*Call Finalize to make sure we have not inherited some data
-                  from a parent process*/
-                p_AEP_Finalize();
-     
-                /*Initialise the AEP API*/
-                rv = p_AEP_Initialize(NULL);
-
-                if (rv != AEP_R_OK)
-                        {
-                        AEPHKerr(AEPHK_F_AEP_GET_CONNECTION,AEPHK_R_INIT_FAILURE);
-                        recorded_pid = 0;
-                        goto end;
-                        }
-
-                /*Set the AEP big num call back functions*/
-                rv = p_AEP_SetBNCallBacks(&GetBigNumSize, &MakeAEPBigNum,
-                        &ConvertAEPBigNum);
-
-                if (rv != AEP_R_OK)
-                        {
-                        AEPHKerr(AEPHK_F_AEP_GET_CONNECTION,AEPHK_R_SETBNCALLBACK_FAILURE);
-                        recorded_pid = 0;
-                        goto end;
-                        }
-
-#ifdef AEPRAND
-                /*Reset the rand byte count*/
-                rand_block_bytes = 0;
-#endif
-
-                /*Init the structures*/
-                for (count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
-                        {
-                        aep_app_conn_table[count].conn_state = NotConnected;
-                        aep_app_conn_table[count].conn_hndl  = 0;
-                        }
-
-                /*Open a connection*/
-                rv = p_AEP_OpenConnection(phConnection);
-
-                if (rv != AEP_R_OK)
-                        {
-                        AEPHKerr(AEPHK_F_AEP_GET_CONNECTION,AEPHK_R_UNIT_FAILURE);
-                        recorded_pid = 0;
-                        goto end;
-                        }
-
-                aep_app_conn_table[0].conn_state = InUse;
-                aep_app_conn_table[0].conn_hndl = *phConnection;
-                goto end;
-                }
-        /*Check the existing connections to see if we can find a free one*/
-        for (count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
-                {
-                if (aep_app_conn_table[count].conn_state == Connected)
-                        {
-                        aep_app_conn_table[count].conn_state = InUse;
-                        *phConnection = aep_app_conn_table[count].conn_hndl;
-                        goto end;
-                        }
-                }
-        /*If no connections available, we're going to have to try
-          to open a new one*/
-        for (count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
-                {
-                if (aep_app_conn_table[count].conn_state == NotConnected)
-                        {
-                        /*Open a connection*/
-                        rv = p_AEP_OpenConnection(phConnection);
-
-                        if (rv != AEP_R_OK)
-                                {             
-                                AEPHKerr(AEPHK_F_AEP_GET_CONNECTION,AEPHK_R_UNIT_FAILURE);
-                                goto end;
-                                }
-
-                        aep_app_conn_table[count].conn_state = InUse;
-                        aep_app_conn_table[count].conn_hndl = *phConnection;
-                        goto end;
-                        }
-                }
-        rv = AEP_R_GENERAL_ERROR;
- end:
-        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-        return rv;
-        }
-
-
-static AEP_RV aep_return_connection(AEP_CONNECTION_HNDL hConnection)
-        {
-        int count;
-
-        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-
-        /*Find the connection item that matches this connection handle*/
-        for(count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
-                {
-                if (aep_app_conn_table[count].conn_hndl == hConnection)
-                        {
-                        aep_app_conn_table[count].conn_state = Connected;
-                        break;
-                        }
-                }
-
-        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-
-        return AEP_R_OK;
-        }
-
-static AEP_RV aep_close_connection(AEP_CONNECTION_HNDL hConnection)
-        {
-        int count;
-        AEP_RV rv = AEP_R_OK;
-
-        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-
-        /*Find the connection item that matches this connection handle*/
-        for(count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
-                {
-                if (aep_app_conn_table[count].conn_hndl == hConnection)
-                        {
-                        rv = p_AEP_CloseConnection(aep_app_conn_table[count].conn_hndl);
-                        if (rv != AEP_R_OK)
-                                goto end;
-                        aep_app_conn_table[count].conn_state = NotConnected;
-                        aep_app_conn_table[count].conn_hndl  = 0;
-                        break;
-                        }
-                }
-
- end:
-        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-        return rv;
-        }
-
-static AEP_RV aep_close_all_connections(int use_engine_lock, int *in_use)
-        {
-        int count;
-        AEP_RV rv = AEP_R_OK;
-
-        *in_use = 0;
-        if (use_engine_lock) CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-        for (count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
-                {
-                switch (aep_app_conn_table[count].conn_state)
-                        {
-                case Connected:
-                        rv = p_AEP_CloseConnection(aep_app_conn_table[count].conn_hndl);
-                        if (rv != AEP_R_OK)
-                                goto end;
-                        aep_app_conn_table[count].conn_state = NotConnected;
-                        aep_app_conn_table[count].conn_hndl  = 0;
-                        break;
-                case InUse:
-                        (*in_use)++;
-                        break;
-                case NotConnected:
-                        break;
-                        }
-                }
- end:
-        if (use_engine_lock) CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-        return rv;
-        }
-
-/*BigNum call back functions, used to convert OpenSSL bignums into AEP bignums.
-  Note only 32bit Openssl build support*/
-
-static AEP_RV GetBigNumSize(AEP_VOID_PTR ArbBigNum, AEP_U32* BigNumSize)
-        {
-        BIGNUM* bn;
-
-        /*Cast the ArbBigNum pointer to our BIGNUM struct*/
-        bn = (BIGNUM*) ArbBigNum;
-
-#ifdef SIXTY_FOUR_BIT_LONG
-        *BigNumSize = bn->top << 3;
-#else
-        /*Size of the bignum in bytes is equal to the bn->top (no of 32 bit
-          words) multiplies by 4*/
-        *BigNumSize = bn->top << 2;
-#endif
-
-        return AEP_R_OK;
-        }
-
-static AEP_RV MakeAEPBigNum(AEP_VOID_PTR ArbBigNum, AEP_U32 BigNumSize,
-        unsigned char* AEP_BigNum)
-        {
-        BIGNUM* bn;
-
-#ifndef SIXTY_FOUR_BIT_LONG
-        unsigned char* buf;
-        int i;
-#endif
-
-        /*Cast the ArbBigNum pointer to our BIGNUM struct*/
-        bn = (BIGNUM*) ArbBigNum;
-
-#ifdef SIXTY_FOUR_BIT_LONG
-        memcpy(AEP_BigNum, bn->d, BigNumSize);
-#else
-        /*Must copy data into a (monotone) least significant byte first format
-          performing endian conversion if necessary*/
-        for(i=0;i<bn->top;i++)
-                {
-                buf = (unsigned char*)&bn->d[i];
-
-                *((AEP_U32*)AEP_BigNum) = (AEP_U32)
-                        ((unsigned) buf[1] << 8 | buf[0]) |
-                        ((unsigned) buf[3] << 8 | buf[2])  << 16;
-
-                AEP_BigNum += 4;
-                }
-#endif
-
-        return AEP_R_OK;
-        }
-
-/*Turn an AEP Big Num back to a user big num*/
-static AEP_RV ConvertAEPBigNum(void* ArbBigNum, AEP_U32 BigNumSize,
-        unsigned char* AEP_BigNum)
-        {
-        BIGNUM* bn;
-#ifndef SIXTY_FOUR_BIT_LONG
-        int i;
-#endif
-
-        bn = (BIGNUM*)ArbBigNum;
-
-        /*Expand the result bn so that it can hold our big num.
-          Size is in bits*/
-        bn_expand(bn, (int)(BigNumSize << 3));
-
-#ifdef SIXTY_FOUR_BIT_LONG
-        bn->top = BigNumSize >> 3;
-        
-        if((BigNumSize & 7) != 0)
-                bn->top++;
-
-        memset(bn->d, 0, bn->top << 3); 
-
-        memcpy(bn->d, AEP_BigNum, BigNumSize);
-#else
-        bn->top = BigNumSize >> 2;
- 
-        for(i=0;i<bn->top;i++)
-                {
-                bn->d[i] = (AEP_U32)
-                        ((unsigned) AEP_BigNum[3] << 8 | AEP_BigNum[2]) << 16 |
-                        ((unsigned) AEP_BigNum[1] << 8 | AEP_BigNum[0]);
-                AEP_BigNum += 4;
-                }
-#endif
-
-        return AEP_R_OK;
-}       
-        
-#endif /* !OPENSSL_NO_HW_AEP */
-#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libcrypto/engine/hw_aep_err.c b/src/lib/libcrypto/engine/hw_aep_err.c
deleted file mode 100644
index 092f532946..0000000000
--- a/src/lib/libcrypto/engine/hw_aep_err.c
+++ /dev/null
@@ -1,157 +0,0 @@
-/* hw_aep_err.c */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-/* NOTE: this file was auto generated by the mkerr.pl script: any changes
- * made to it will be overwritten when the script next updates this file,
- * only reason strings will be preserved.
- */
-
-#include <stdio.h>
-#include <openssl/err.h>
-#include "hw_aep_err.h"
-
-/* BEGIN ERROR CODES */
-#ifndef OPENSSL_NO_ERR
-static ERR_STRING_DATA AEPHK_str_functs[]=
-        {
-{ERR_PACK(0,AEPHK_F_AEP_CTRL,0),        "AEP_CTRL"},
-{ERR_PACK(0,AEPHK_F_AEP_FINISH,0),      "AEP_FINISH"},
-{ERR_PACK(0,AEPHK_F_AEP_GET_CONNECTION,0),      "AEP_GET_CONNECTION"},
-{ERR_PACK(0,AEPHK_F_AEP_INIT,0),        "AEP_INIT"},
-{ERR_PACK(0,AEPHK_F_AEP_MOD_EXP,0),     "AEP_MOD_EXP"},
-{ERR_PACK(0,AEPHK_F_AEP_MOD_EXP_CRT,0), "AEP_MOD_EXP_CRT"},
-{ERR_PACK(0,AEPHK_F_AEP_RAND,0),        "AEP_RAND"},
-{ERR_PACK(0,AEPHK_F_AEP_RSA_MOD_EXP,0), "AEP_RSA_MOD_EXP"},
-{0,NULL}
-        };
-
-static ERR_STRING_DATA AEPHK_str_reasons[]=
-        {
-{AEPHK_R_ALREADY_LOADED                  ,"already loaded"},
-{AEPHK_R_CLOSE_HANDLES_FAILED            ,"close handles failed"},
-{AEPHK_R_CONNECTIONS_IN_USE              ,"connections in use"},
-{AEPHK_R_CTRL_COMMAND_NOT_IMPLEMENTED    ,"ctrl command not implemented"},
-{AEPHK_R_FINALIZE_FAILED                 ,"finalize failed"},
-{AEPHK_R_GET_HANDLE_FAILED               ,"get handle failed"},
-{AEPHK_R_GET_RANDOM_FAILED               ,"get random failed"},
-{AEPHK_R_INIT_FAILURE                    ,"init failure"},
-{AEPHK_R_MISSING_KEY_COMPONENTS          ,"missing key components"},
-{AEPHK_R_MOD_EXP_CRT_FAILED              ,"mod exp crt failed"},
-{AEPHK_R_MOD_EXP_FAILED                  ,"mod exp failed"},
-{AEPHK_R_NOT_LOADED                      ,"not loaded"},
-{AEPHK_R_OK                              ,"ok"},
-{AEPHK_R_RETURN_CONNECTION_FAILED        ,"return connection failed"},
-{AEPHK_R_SETBNCALLBACK_FAILURE           ,"setbncallback failure"},
-{AEPHK_R_SIZE_TOO_LARGE_OR_TOO_SMALL     ,"size too large or too small"},
-{AEPHK_R_UNIT_FAILURE                    ,"unit failure"},
-{0,NULL}
-        };
-
-#endif
-
-#ifdef AEPHK_LIB_NAME
-static ERR_STRING_DATA AEPHK_lib_name[]=
-        {
-{0      ,AEPHK_LIB_NAME},
-{0,NULL}
-        };
-#endif
-
-
-static int AEPHK_lib_error_code=0;
-static int AEPHK_error_init=1;
-
-static void ERR_load_AEPHK_strings(void)
-        {
-        if (AEPHK_lib_error_code == 0)
-                AEPHK_lib_error_code=ERR_get_next_error_library();
-
-        if (AEPHK_error_init)
-                {
-                AEPHK_error_init=0;
-#ifndef OPENSSL_NO_ERR
-                ERR_load_strings(AEPHK_lib_error_code,AEPHK_str_functs);
-                ERR_load_strings(AEPHK_lib_error_code,AEPHK_str_reasons);
-#endif
-
-#ifdef AEPHK_LIB_NAME
-                AEPHK_lib_name->error = ERR_PACK(AEPHK_lib_error_code,0,0);
-                ERR_load_strings(0,AEPHK_lib_name);
-#endif
-                }
-        }
-
-static void ERR_unload_AEPHK_strings(void)
-        {
-        if (AEPHK_error_init == 0)
-                {
-#ifndef OPENSSL_NO_ERR
-                ERR_unload_strings(AEPHK_lib_error_code,AEPHK_str_functs);
-                ERR_unload_strings(AEPHK_lib_error_code,AEPHK_str_reasons);
-#endif
-
-#ifdef AEPHK_LIB_NAME
-                ERR_unload_strings(0,AEPHK_lib_name);
-#endif
-                AEPHK_error_init=1;
-                }
-        }
-
-static void ERR_AEPHK_error(int function, int reason, char *file, int line)
-        {
-        if (AEPHK_lib_error_code == 0)
-                AEPHK_lib_error_code=ERR_get_next_error_library();
-        ERR_PUT_error(AEPHK_lib_error_code,function,reason,file,line);
-        }
diff --git a/src/lib/libcrypto/engine/hw_atalla.c b/src/lib/libcrypto/engine/hw_atalla.c
deleted file mode 100644
index 2b8342bbdd..0000000000
--- a/src/lib/libcrypto/engine/hw_atalla.c
+++ /dev/null
@@ -1,595 +0,0 @@
-/* crypto/engine/hw_atalla.c */
-/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <openssl/crypto.h>
-#include "cryptlib.h"
-#include <openssl/dso.h>
-#include <openssl/engine.h>
-
-#ifndef OPENSSL_NO_HW
-#ifndef OPENSSL_NO_HW_ATALLA
-
-#ifdef FLAT_INC
-#include "atalla.h"
-#else
-#include "vendor_defns/atalla.h"
-#endif
-
-#define ATALLA_LIB_NAME "atalla engine"
-#include "hw_atalla_err.c"
-
-static int atalla_destroy(ENGINE *e);
-static int atalla_init(ENGINE *e);
-static int atalla_finish(ENGINE *e);
-static int atalla_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
-
-/* BIGNUM stuff */
-static int atalla_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx);
-
-#ifndef OPENSSL_NO_RSA
-/* RSA stuff */
-static int atalla_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
-#endif
-/* This function is aliased to mod_exp (with the mont stuff dropped). */
-static int atalla_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
-
-#ifndef OPENSSL_NO_DSA
-/* DSA stuff */
-static int atalla_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
-                BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
-                BN_CTX *ctx, BN_MONT_CTX *in_mont);
-static int atalla_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
-                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
-                BN_MONT_CTX *m_ctx);
-#endif
-
-#ifndef OPENSSL_NO_DH
-/* DH stuff */
-/* This function is alised to mod_exp (with the DH and mont dropped). */
-static int atalla_mod_exp_dh(const DH *dh, BIGNUM *r,
-                const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
-#endif
-
-/* The definitions for control commands specific to this engine */
-#define ATALLA_CMD_SO_PATH              ENGINE_CMD_BASE
-static const ENGINE_CMD_DEFN atalla_cmd_defns[] = {
-        {ATALLA_CMD_SO_PATH,
-                "SO_PATH",
-                "Specifies the path to the 'atasi' shared library",
-                ENGINE_CMD_FLAG_STRING},
-        {0, NULL, NULL, 0}
-        };
-
-#ifndef OPENSSL_NO_RSA
-/* Our internal RSA_METHOD that we provide pointers to */
-static RSA_METHOD atalla_rsa =
-        {
-        "Atalla RSA method",
-        NULL,
-        NULL,
-        NULL,
-        NULL,
-        atalla_rsa_mod_exp,
-        atalla_mod_exp_mont,
-        NULL,
-        NULL,
-        0,
-        NULL,
-        NULL,
-        NULL
-        };
-#endif
-
-#ifndef OPENSSL_NO_DSA
-/* Our internal DSA_METHOD that we provide pointers to */
-static DSA_METHOD atalla_dsa =
-        {
-        "Atalla DSA method",
-        NULL, /* dsa_do_sign */
-        NULL, /* dsa_sign_setup */
-        NULL, /* dsa_do_verify */
-        atalla_dsa_mod_exp, /* dsa_mod_exp */
-        atalla_mod_exp_dsa, /* bn_mod_exp */
-        NULL, /* init */
-        NULL, /* finish */
-        0, /* flags */
-        NULL /* app_data */
-        };
-#endif
-
-#ifndef OPENSSL_NO_DH
-/* Our internal DH_METHOD that we provide pointers to */
-static DH_METHOD atalla_dh =
-        {
-        "Atalla DH method",
-        NULL,
-        NULL,
-        atalla_mod_exp_dh,
-        NULL,
-        NULL,
-        0,
-        NULL
-        };
-#endif
-
-/* Constants used when creating the ENGINE */
-static const char *engine_atalla_id = "atalla";
-static const char *engine_atalla_name = "Atalla hardware engine support";
-
-/* This internal function is used by ENGINE_atalla() and possibly by the
- * "dynamic" ENGINE support too */
-static int bind_helper(ENGINE *e)
-        {
-#ifndef OPENSSL_NO_RSA
-        const RSA_METHOD *meth1;
-#endif
-#ifndef OPENSSL_NO_DSA
-        const DSA_METHOD *meth2;
-#endif
-#ifndef OPENSSL_NO_DH
-        const DH_METHOD *meth3;
-#endif
-        if(!ENGINE_set_id(e, engine_atalla_id) ||
-                        !ENGINE_set_name(e, engine_atalla_name) ||
-#ifndef OPENSSL_NO_RSA
-                        !ENGINE_set_RSA(e, &atalla_rsa) ||
-#endif
-#ifndef OPENSSL_NO_DSA
-                        !ENGINE_set_DSA(e, &atalla_dsa) ||
-#endif
-#ifndef OPENSSL_NO_DH
-                        !ENGINE_set_DH(e, &atalla_dh) ||
-#endif
-                        !ENGINE_set_destroy_function(e, atalla_destroy) ||
-                        !ENGINE_set_init_function(e, atalla_init) ||
-                        !ENGINE_set_finish_function(e, atalla_finish) ||
-                        !ENGINE_set_ctrl_function(e, atalla_ctrl) ||
-                        !ENGINE_set_cmd_defns(e, atalla_cmd_defns))
-                return 0;
-
-#ifndef OPENSSL_NO_RSA
-        /* We know that the "PKCS1_SSLeay()" functions hook properly
-         * to the atalla-specific mod_exp and mod_exp_crt so we use
-         * those functions. NB: We don't use ENGINE_openssl() or
-         * anything "more generic" because something like the RSAref
-         * code may not hook properly, and if you own one of these
-         * cards then you have the right to do RSA operations on it
-         * anyway! */ 
-        meth1 = RSA_PKCS1_SSLeay();
-        atalla_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
-        atalla_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
-        atalla_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
-        atalla_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
-#endif
-
-#ifndef OPENSSL_NO_DSA
-        /* Use the DSA_OpenSSL() method and just hook the mod_exp-ish
-         * bits. */
-        meth2 = DSA_OpenSSL();
-        atalla_dsa.dsa_do_sign = meth2->dsa_do_sign;
-        atalla_dsa.dsa_sign_setup = meth2->dsa_sign_setup;
-        atalla_dsa.dsa_do_verify = meth2->dsa_do_verify;
-#endif
-
-#ifndef OPENSSL_NO_DH
-        /* Much the same for Diffie-Hellman */
-        meth3 = DH_OpenSSL();
-        atalla_dh.generate_key = meth3->generate_key;
-        atalla_dh.compute_key = meth3->compute_key;
-#endif
-
-        /* Ensure the atalla error handling is set up */
-        ERR_load_ATALLA_strings();
-        return 1;
-        }
-
-#ifndef ENGINE_DYNAMIC_SUPPORT
-static ENGINE *engine_atalla(void)
-        {
-        ENGINE *ret = ENGINE_new();
-        if(!ret)
-                return NULL;
-        if(!bind_helper(ret))
-                {
-                ENGINE_free(ret);
-                return NULL;
-                }
-        return ret;
-        }
-
-void ENGINE_load_atalla(void)
-        {
-        /* Copied from eng_[openssl|dyn].c */
-        ENGINE *toadd = engine_atalla();
-        if(!toadd) return;
-        ENGINE_add(toadd);
-        ENGINE_free(toadd);
-        ERR_clear_error();
-        }
-#endif
-
-/* This is a process-global DSO handle used for loading and unloading
- * the Atalla library. NB: This is only set (or unset) during an
- * init() or finish() call (reference counts permitting) and they're
- * operating with global locks, so this should be thread-safe
- * implicitly. */
-static DSO *atalla_dso = NULL;
-
-/* These are the function pointers that are (un)set when the library has
- * successfully (un)loaded. */
-static tfnASI_GetHardwareConfig *p_Atalla_GetHardwareConfig = NULL;
-static tfnASI_RSAPrivateKeyOpFn *p_Atalla_RSAPrivateKeyOpFn = NULL;
-static tfnASI_GetPerformanceStatistics *p_Atalla_GetPerformanceStatistics = NULL;
-
-/* These are the static string constants for the DSO file name and the function
- * symbol names to bind to. Regrettably, the DSO name on *nix appears to be
- * "atasi.so" rather than something more consistent like "libatasi.so". At the
- * time of writing, I'm not sure what the file name on win32 is but clearly
- * native name translation is not possible (eg libatasi.so on *nix, and
- * atasi.dll on win32). For the purposes of testing, I have created a symbollic
- * link called "libatasi.so" so that we can use native name-translation - a
- * better solution will be needed. */
-static const char *ATALLA_LIBNAME = NULL;
-static const char *get_ATALLA_LIBNAME(void)
-        {
-                if(ATALLA_LIBNAME)
-                        return ATALLA_LIBNAME;
-                return "atasi";
-        }
-static void free_ATALLA_LIBNAME(void)
-        {
-                if(ATALLA_LIBNAME)
-                        OPENSSL_free((void*)ATALLA_LIBNAME);
-                ATALLA_LIBNAME = NULL;
-        }
-static long set_ATALLA_LIBNAME(const char *name)
-        {
-        free_ATALLA_LIBNAME();
-        return (((ATALLA_LIBNAME = BUF_strdup(name)) != NULL) ? 1 : 0);
-        }
-static const char *ATALLA_F1 = "ASI_GetHardwareConfig";
-static const char *ATALLA_F2 = "ASI_RSAPrivateKeyOpFn";
-static const char *ATALLA_F3 = "ASI_GetPerformanceStatistics";
-
-/* Destructor (complements the "ENGINE_atalla()" constructor) */
-static int atalla_destroy(ENGINE *e)
-        {
-        free_ATALLA_LIBNAME();
-        /* Unload the atalla error strings so any error state including our
-         * functs or reasons won't lead to a segfault (they simply get displayed
-         * without corresponding string data because none will be found). */
-        ERR_unload_ATALLA_strings();
-        return 1;
-        }
-
-/* (de)initialisation functions. */
-static int atalla_init(ENGINE *e)
-        {
-        tfnASI_GetHardwareConfig *p1;
-        tfnASI_RSAPrivateKeyOpFn *p2;
-        tfnASI_GetPerformanceStatistics *p3;
-        /* Not sure of the origin of this magic value, but Ben's code had it
-         * and it seemed to have been working for a few people. :-) */
-        unsigned int config_buf[1024];
-
-        if(atalla_dso != NULL)
-                {
-                ATALLAerr(ATALLA_F_ATALLA_INIT,ATALLA_R_ALREADY_LOADED);
-                goto err;
-                }
-        /* Attempt to load libatasi.so/atasi.dll/whatever. Needs to be
-         * changed unfortunately because the Atalla drivers don't have
-         * standard library names that can be platform-translated well. */
-        /* TODO: Work out how to actually map to the names the Atalla
-         * drivers really use - for now a symbollic link needs to be
-         * created on the host system from libatasi.so to atasi.so on
-         * unix variants. */
-        atalla_dso = DSO_load(NULL, get_ATALLA_LIBNAME(), NULL, 0);
-        if(atalla_dso == NULL)
-                {
-                ATALLAerr(ATALLA_F_ATALLA_INIT,ATALLA_R_NOT_LOADED);
-                goto err;
-                }
-        if(!(p1 = (tfnASI_GetHardwareConfig *)DSO_bind_func(
-                                atalla_dso, ATALLA_F1)) ||
-                        !(p2 = (tfnASI_RSAPrivateKeyOpFn *)DSO_bind_func(
-                                atalla_dso, ATALLA_F2)) ||
-                        !(p3 = (tfnASI_GetPerformanceStatistics *)DSO_bind_func(
-                                atalla_dso, ATALLA_F3)))
-                {
-                ATALLAerr(ATALLA_F_ATALLA_INIT,ATALLA_R_NOT_LOADED);
-                goto err;
-                }
-        /* Copy the pointers */
-        p_Atalla_GetHardwareConfig = p1;
-        p_Atalla_RSAPrivateKeyOpFn = p2;
-        p_Atalla_GetPerformanceStatistics = p3;
-        /* Perform a basic test to see if there's actually any unit
-         * running. */
-        if(p1(0L, config_buf) != 0)
-                {
-                ATALLAerr(ATALLA_F_ATALLA_INIT,ATALLA_R_UNIT_FAILURE);
-                goto err;
-                }
-        /* Everything's fine. */
-        return 1;
-err:
-        if(atalla_dso)
-                DSO_free(atalla_dso);
-        atalla_dso = NULL;
-        p_Atalla_GetHardwareConfig = NULL;
-        p_Atalla_RSAPrivateKeyOpFn = NULL;
-        p_Atalla_GetPerformanceStatistics = NULL;
-        return 0;
-        }
-
-static int atalla_finish(ENGINE *e)
-        {
-        free_ATALLA_LIBNAME();
-        if(atalla_dso == NULL)
-                {
-                ATALLAerr(ATALLA_F_ATALLA_FINISH,ATALLA_R_NOT_LOADED);
-                return 0;
-                }
-        if(!DSO_free(atalla_dso))
-                {
-                ATALLAerr(ATALLA_F_ATALLA_FINISH,ATALLA_R_UNIT_FAILURE);
-                return 0;
-                }
-        atalla_dso = NULL;
-        p_Atalla_GetHardwareConfig = NULL;
-        p_Atalla_RSAPrivateKeyOpFn = NULL;
-        p_Atalla_GetPerformanceStatistics = NULL;
-        return 1;
-        }
-
-static int atalla_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
-        {
-        int initialised = ((atalla_dso == NULL) ? 0 : 1);
-        switch(cmd)
-                {
-        case ATALLA_CMD_SO_PATH:
-                if(p == NULL)
-                        {
-                        ATALLAerr(ATALLA_F_ATALLA_CTRL,ERR_R_PASSED_NULL_PARAMETER);
-                        return 0;
-                        }
-                if(initialised)
-                        {
-                        ATALLAerr(ATALLA_F_ATALLA_CTRL,ATALLA_R_ALREADY_LOADED);
-                        return 0;
-                        }
-                return set_ATALLA_LIBNAME((const char *)p);
-        default:
-                break;
-                }
-        ATALLAerr(ATALLA_F_ATALLA_CTRL,ATALLA_R_CTRL_COMMAND_NOT_IMPLEMENTED);
-        return 0;
-        }
-
-static int atalla_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                        const BIGNUM *m, BN_CTX *ctx)
-        {
-        /* I need somewhere to store temporary serialised values for
-         * use with the Atalla API calls. A neat cheat - I'll use
-         * BIGNUMs from the BN_CTX but access their arrays directly as
-         * byte arrays <grin>. This way I don't have to clean anything
-         * up. */
-        BIGNUM *modulus;
-        BIGNUM *exponent;
-        BIGNUM *argument;
-        BIGNUM *result;
-        RSAPrivateKey keydata;
-        int to_return, numbytes;
-
-        modulus = exponent = argument = result = NULL;
-        to_return = 0; /* expect failure */
-
-        if(!atalla_dso)
-                {
-                ATALLAerr(ATALLA_F_ATALLA_MOD_EXP,ATALLA_R_NOT_LOADED);
-                goto err;
-                }
-        /* Prepare the params */
-        BN_CTX_start(ctx);
-        modulus = BN_CTX_get(ctx);
-        exponent = BN_CTX_get(ctx);
-        argument = BN_CTX_get(ctx);
-        result = BN_CTX_get(ctx);
-        if (!result)
-                {
-                ATALLAerr(ATALLA_F_ATALLA_MOD_EXP,ATALLA_R_BN_CTX_FULL);
-                goto err;
-                }
-        if(!bn_wexpand(modulus, m->top) || !bn_wexpand(exponent, m->top) ||
-           !bn_wexpand(argument, m->top) || !bn_wexpand(result, m->top))
-                {
-                ATALLAerr(ATALLA_F_ATALLA_MOD_EXP,ATALLA_R_BN_EXPAND_FAIL);
-                goto err;
-                }
-        /* Prepare the key-data */
-        memset(&keydata, 0,sizeof keydata);
-        numbytes = BN_num_bytes(m);
-        memset(exponent->d, 0, numbytes);
-        memset(modulus->d, 0, numbytes);
-        BN_bn2bin(p, (unsigned char *)exponent->d + numbytes - BN_num_bytes(p));
-        BN_bn2bin(m, (unsigned char *)modulus->d + numbytes - BN_num_bytes(m));
-        keydata.privateExponent.data = (unsigned char *)exponent->d;
-        keydata.privateExponent.len = numbytes;
-        keydata.modulus.data = (unsigned char *)modulus->d;
-        keydata.modulus.len = numbytes;
-        /* Prepare the argument */
-        memset(argument->d, 0, numbytes);
-        memset(result->d, 0, numbytes);
-        BN_bn2bin(a, (unsigned char *)argument->d + numbytes - BN_num_bytes(a));
-        /* Perform the operation */
-        if(p_Atalla_RSAPrivateKeyOpFn(&keydata, (unsigned char *)result->d,
-                        (unsigned char *)argument->d,
-                        keydata.modulus.len) != 0)
-                {
-                ATALLAerr(ATALLA_F_ATALLA_MOD_EXP,ATALLA_R_REQUEST_FAILED);
-                goto err;
-                }
-        /* Convert the response */
-        BN_bin2bn((unsigned char *)result->d, numbytes, r);
-        to_return = 1;
-err:
-        BN_CTX_end(ctx);
-        return to_return;
-        }
-
-#ifndef OPENSSL_NO_RSA
-static int atalla_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
-        {
-        BN_CTX *ctx = NULL;
-        int to_return = 0;
-
-        if(!atalla_dso)
-                {
-                ATALLAerr(ATALLA_F_ATALLA_RSA_MOD_EXP,ATALLA_R_NOT_LOADED);
-                goto err;
-                }
-        if((ctx = BN_CTX_new()) == NULL)
-                goto err;
-        if(!rsa->d || !rsa->n)
-                {
-                ATALLAerr(ATALLA_F_ATALLA_RSA_MOD_EXP,ATALLA_R_MISSING_KEY_COMPONENTS);
-                goto err;
-                }
-        to_return = atalla_mod_exp(r0, I, rsa->d, rsa->n, ctx);
-err:
-        if(ctx)
-                BN_CTX_free(ctx);
-        return to_return;
-        }
-#endif
-
-#ifndef OPENSSL_NO_DSA
-/* This code was liberated and adapted from the commented-out code in
- * dsa_ossl.c. Because of the unoptimised form of the Atalla acceleration
- * (it doesn't have a CRT form for RSA), this function means that an
- * Atalla system running with a DSA server certificate can handshake
- * around 5 or 6 times faster/more than an equivalent system running with
- * RSA. Just check out the "signs" statistics from the RSA and DSA parts
- * of "openssl speed -engine atalla dsa1024 rsa1024". */
-static int atalla_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
-                BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
-                BN_CTX *ctx, BN_MONT_CTX *in_mont)
-        {
-        BIGNUM t;
-        int to_return = 0;
- 
-        BN_init(&t);
-        /* let rr = a1 ^ p1 mod m */
-        if (!atalla_mod_exp(rr,a1,p1,m,ctx)) goto end;
-        /* let t = a2 ^ p2 mod m */
-        if (!atalla_mod_exp(&t,a2,p2,m,ctx)) goto end;
-        /* let rr = rr * t mod m */
-        if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
-        to_return = 1;
-end:
-        BN_free(&t);
-        return to_return;
-        }
-
-static int atalla_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
-                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
-                BN_MONT_CTX *m_ctx)
-        {
-        return atalla_mod_exp(r, a, p, m, ctx);
-        }
-#endif
-
-/* This function is aliased to mod_exp (with the mont stuff dropped). */
-static int atalla_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-        {
-        return atalla_mod_exp(r, a, p, m, ctx);
-        }
-
-#ifndef OPENSSL_NO_DH
-/* This function is aliased to mod_exp (with the dh and mont dropped). */
-static int atalla_mod_exp_dh(const DH *dh, BIGNUM *r,
-                const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-        {
-        return atalla_mod_exp(r, a, p, m, ctx);
-        }
-#endif
-
-/* This stuff is needed if this ENGINE is being compiled into a self-contained
- * shared-library. */
-#ifdef ENGINE_DYNAMIC_SUPPORT
-static int bind_fn(ENGINE *e, const char *id)
-        {
-        if(id && (strcmp(id, engine_atalla_id) != 0))
-                return 0;
-        if(!bind_helper(e))
-                return 0;
-        return 1;
-        }
-IMPLEMENT_DYNAMIC_CHECK_FN()
-IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
-#endif /* ENGINE_DYNAMIC_SUPPORT */
-
-#endif /* !OPENSSL_NO_HW_ATALLA */
-#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libcrypto/engine/hw_atalla_err.c b/src/lib/libcrypto/engine/hw_atalla_err.c
deleted file mode 100644
index 1df9c4570c..0000000000
--- a/src/lib/libcrypto/engine/hw_atalla_err.c
+++ /dev/null
@@ -1,145 +0,0 @@
-/* hw_atalla_err.c */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-/* NOTE: this file was auto generated by the mkerr.pl script: any changes
- * made to it will be overwritten when the script next updates this file,
- * only reason strings will be preserved.
- */
-
-#include <stdio.h>
-#include <openssl/err.h>
-#include "hw_atalla_err.h"
-
-/* BEGIN ERROR CODES */
-#ifndef OPENSSL_NO_ERR
-static ERR_STRING_DATA ATALLA_str_functs[]=
-        {
-{ERR_PACK(0,ATALLA_F_ATALLA_CTRL,0),    "ATALLA_CTRL"},
-{ERR_PACK(0,ATALLA_F_ATALLA_FINISH,0),  "ATALLA_FINISH"},
-{ERR_PACK(0,ATALLA_F_ATALLA_INIT,0),    "ATALLA_INIT"},
-{ERR_PACK(0,ATALLA_F_ATALLA_MOD_EXP,0), "ATALLA_MOD_EXP"},
-{ERR_PACK(0,ATALLA_F_ATALLA_RSA_MOD_EXP,0),     "ATALLA_RSA_MOD_EXP"},
-{0,NULL}
-        };
-
-static ERR_STRING_DATA ATALLA_str_reasons[]=
-        {
-{ATALLA_R_ALREADY_LOADED                 ,"already loaded"},
-{ATALLA_R_BN_CTX_FULL                    ,"bn ctx full"},
-{ATALLA_R_BN_EXPAND_FAIL                 ,"bn expand fail"},
-{ATALLA_R_CTRL_COMMAND_NOT_IMPLEMENTED   ,"ctrl command not implemented"},
-{ATALLA_R_MISSING_KEY_COMPONENTS         ,"missing key components"},
-{ATALLA_R_NOT_LOADED                     ,"not loaded"},
-{ATALLA_R_REQUEST_FAILED                 ,"request failed"},
-{ATALLA_R_UNIT_FAILURE                   ,"unit failure"},
-{0,NULL}
-        };
-
-#endif
-
-#ifdef ATALLA_LIB_NAME
-static ERR_STRING_DATA ATALLA_lib_name[]=
-        {
-{0      ,ATALLA_LIB_NAME},
-{0,NULL}
-        };
-#endif
-
-
-static int ATALLA_lib_error_code=0;
-static int ATALLA_error_init=1;
-
-static void ERR_load_ATALLA_strings(void)
-        {
-        if (ATALLA_lib_error_code == 0)
-                ATALLA_lib_error_code=ERR_get_next_error_library();
-
-        if (ATALLA_error_init)
-                {
-                ATALLA_error_init=0;
-#ifndef OPENSSL_NO_ERR
-                ERR_load_strings(ATALLA_lib_error_code,ATALLA_str_functs);
-                ERR_load_strings(ATALLA_lib_error_code,ATALLA_str_reasons);
-#endif
-
-#ifdef ATALLA_LIB_NAME
-                ATALLA_lib_name->error = ERR_PACK(ATALLA_lib_error_code,0,0);
-                ERR_load_strings(0,ATALLA_lib_name);
-#endif
-                }
-        }
-
-static void ERR_unload_ATALLA_strings(void)
-        {
-        if (ATALLA_error_init == 0)
-                {
-#ifndef OPENSSL_NO_ERR
-                ERR_unload_strings(ATALLA_lib_error_code,ATALLA_str_functs);
-                ERR_unload_strings(ATALLA_lib_error_code,ATALLA_str_reasons);
-#endif
-
-#ifdef ATALLA_LIB_NAME
-                ERR_unload_strings(0,ATALLA_lib_name);
-#endif
-                ATALLA_error_init=1;
-                }
-        }
-
-static void ERR_ATALLA_error(int function, int reason, char *file, int line)
-        {
-        if (ATALLA_lib_error_code == 0)
-                ATALLA_lib_error_code=ERR_get_next_error_library();
-        ERR_PUT_error(ATALLA_lib_error_code,function,reason,file,line);
-        }
diff --git a/src/lib/libcrypto/engine/hw_cryptodev.c b/src/lib/libcrypto/engine/hw_cryptodev.c
index 3e7fff1c1e..0e80ca051a 100644
--- a/src/lib/libcrypto/engine/hw_cryptodev.c
+++ b/src/lib/libcrypto/engine/hw_cryptodev.c
@@ -1,6 +1,6 @@
 /*
+ * Copyright (c) 2002-2004 Theo de Raadt
  * Copyright (c) 2002 Bob Beck <beck@openbsd.org>
- * Copyright (c) 2002 Theo de Raadt
  * Copyright (c) 2002 Markus Friedl
  * All rights reserved.
  *
@@ -49,39 +49,57 @@ ENGINE_load_cryptodev(void)
         return;
 }
 
-#else 
+#else
 
 #include <sys/types.h>
 #include <crypto/cryptodev.h>
 #include <sys/ioctl.h>
+
 #include <errno.h>
-#include <stdio.h>
-#include <unistd.h>
 #include <fcntl.h>
+#include <limits.h>
 #include <stdarg.h>
-#include <syslog.h>
-#include <errno.h>
+#include <stdio.h>
 #include <string.h>
+#include <syslog.h>
+#include <unistd.h>
+
+#if defined(__i386__) || defined(__amd64__)
+#include <sys/sysctl.h>
+#include <machine/cpu.h>
+#include <machine/specialreg.h>
+
+#include <ssl/aes.h>
+
+static int check_viac3aes(void);
+#endif
+
+#define CRYPTO_VIAC3_MAX        3
 
 struct dev_crypto_state {
         struct session_op d_sess;
         int d_fd;
 };
 
+struct dev_crypto_cipher {
+        int     c_id;
+        int     c_nid;
+        int     c_ivmax;
+        int     c_keylen;
+};
+
 static u_int32_t cryptodev_asymfeat = 0;
 
 static int get_asym_dev_crypto(void);
 static int open_dev_crypto(void);
 static int get_dev_crypto(void);
-static int cryptodev_max_iv(int cipher);
-static int cryptodev_key_length_valid(int cipher, int len);
-static int cipher_nid_to_cryptodev(int nid);
+static struct dev_crypto_cipher *cipher_nid_to_cryptodev(int nid);
 static int get_cryptodev_ciphers(const int **cnids);
 /*static int get_cryptodev_digests(const int **cnids);*/
 static int cryptodev_usable_ciphers(const int **nids);
 static int cryptodev_usable_digests(const int **nids);
 static int cryptodev_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
-    const unsigned char *in, unsigned int inl);
+    const unsigned char *in, size_t inl);
 static int cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
     const unsigned char *iv, int enc);
 static int cryptodev_cleanup(EVP_CIPHER_CTX *ctx);
@@ -98,8 +116,9 @@ static int cryptodev_asym(struct crypt_kop *kop, int rlen, BIGNUM *r,
 static int cryptodev_bn_mod_exp(BIGNUM *r, const BIGNUM *a,
     const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
 static int cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I,
-    RSA *rsa);
-static int cryptodev_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
+    RSA *rsa, BN_CTX *ctx);
+static int cryptodev_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa,
+    BN_CTX *ctx);
 static int cryptodev_dsa_bn_mod_exp(DSA *dsa, BIGNUM *r, BIGNUM *a,
     const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
 static int cryptodev_dsa_dsa_mod_exp(DSA *dsa, BIGNUM *t1, BIGNUM *g,
@@ -122,18 +141,14 @@ static const ENGINE_CMD_DEFN cryptodev_defns[] = {
         { 0, NULL, NULL, 0 }
 };
 
-static struct {
-        int     id;
-        int     nid;
-        int     ivmax;
-        int     keylen;
-} ciphers[] = {
+static struct dev_crypto_cipher ciphers[] = {
         { CRYPTO_DES_CBC,               NID_des_cbc,            8,       8, },
         { CRYPTO_3DES_CBC,              NID_des_ede3_cbc,       8,      24, },
         { CRYPTO_AES_CBC,               NID_aes_128_cbc,        16,     16, },
+        { CRYPTO_AES_CBC,               NID_aes_192_cbc,        16,     24, },
+        { CRYPTO_AES_CBC,               NID_aes_256_cbc,        16,     32, },
         { CRYPTO_BLF_CBC,               NID_bf_cbc,             8,      16, },
         { CRYPTO_CAST_CBC,              NID_cast5_cbc,          8,      16, },
-        { CRYPTO_SKIPJACK_CBC,          NID_undef,              0,       0, },
         { 0,                            NID_undef,              0,       0, },
 };
 
@@ -153,7 +168,7 @@ static struct {
 #endif
 
 /*
- * Return a fd if /dev/crypto seems usable, 0 otherwise.
+ * Return a fd if /dev/crypto seems usable, -1 otherwise.
  */
 static int
 open_dev_crypto(void)
@@ -180,8 +195,10 @@ get_dev_crypto(void)
 
         if ((fd = open_dev_crypto()) == -1)
                 return (-1);
-        if (ioctl(fd, CRIOGET, &retfd) == -1)
+        if (ioctl(fd, CRIOGET, &retfd) == -1) {
+                close(fd);
                 return (-1);
+        }
 
         /* close on exec */
         if (fcntl(retfd, F_SETFD, 1) == -1) {
@@ -202,48 +219,16 @@ get_asym_dev_crypto(void)
         return fd;
 }
 
-/*
- * XXXX this needs to be set for each alg - and determined from
- * a running card.
- */
-static int
-cryptodev_max_iv(int cipher)
-{
-        int i;
-
-        for (i = 0; ciphers[i].id; i++)
-                if (ciphers[i].id == cipher)
-                        return (ciphers[i].ivmax);
-        return (0);
-}
-
-/*
- * XXXX this needs to be set for each alg - and determined from
- * a running card. For now, fake it out - but most of these
- * for real devices should return 1 for the supported key
- * sizes the device can handle.
- */
-static int
-cryptodev_key_length_valid(int cipher, int len)
-{
-        int i;
-
-        for (i = 0; ciphers[i].id; i++)
-                if (ciphers[i].id == cipher)
-                        return (ciphers[i].keylen == len);
-        return (0);
-}
-
 /* convert libcrypto nids to cryptodev */
-static int
+static struct dev_crypto_cipher *
 cipher_nid_to_cryptodev(int nid)
 {
         int i;
 
-        for (i = 0; ciphers[i].id; i++)
-                if (ciphers[i].nid == nid)
-                        return (ciphers[i].id);
-        return (0);
+        for (i = 0; ciphers[i].c_id; i++)
+                if (ciphers[i].c_nid == nid)
+                        return (&ciphers[i]);
+        return (NULL);
 }
 
 /*
@@ -255,7 +240,7 @@ cipher_nid_to_cryptodev(int nid)
 static int
 get_cryptodev_ciphers(const int **cnids)
 {
-        static int nids[CRYPTO_ALGORITHM_MAX];
+        static int nids[CRYPTO_ALGORITHM_MAX + CRYPTO_VIAC3_MAX + 1];
         struct session_op sess;
         int fd, i, count = 0;
 
@@ -266,18 +251,45 @@ get_cryptodev_ciphers(const int **cnids)
         memset(&sess, 0, sizeof(sess));
         sess.key = (caddr_t)"123456781234567812345678";
 
-        for (i = 0; ciphers[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
-                if (ciphers[i].nid == NID_undef)
+        for (i = 0; ciphers[i].c_id && count <= CRYPTO_ALGORITHM_MAX; i++) {
+                if (ciphers[i].c_nid == NID_undef)
                         continue;
-                sess.cipher = ciphers[i].id;
-                sess.keylen = ciphers[i].keylen;
+                sess.cipher = ciphers[i].c_id;
+                sess.keylen = ciphers[i].c_keylen;
                 sess.mac = 0;
                 if (ioctl(fd, CIOCGSESSION, &sess) != -1 &&
                     ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
-                        nids[count++] = ciphers[i].nid;
+                        nids[count++] = ciphers[i].c_nid;
         }
         close(fd);
 
+#if defined(__i386__) || defined(__amd64__)
+        /*
+         * Always check for the VIA C3 AES instructions;
+         * even if /dev/crypto is disabled.
+         */
+        if (check_viac3aes() >= 1) {
+                int have_NID_aes_128_cbc = 0;
+                int have_NID_aes_192_cbc = 0;
+                int have_NID_aes_256_cbc = 0;
+
+                for (i = 0; i < count; i++) {
+                        if (nids[i] == NID_aes_128_cbc)
+                                have_NID_aes_128_cbc = 1;
+                        if (nids[i] == NID_aes_192_cbc)
+                                have_NID_aes_192_cbc = 1;
+                        if (nids[i] == NID_aes_256_cbc)
+                                have_NID_aes_256_cbc = 1;
+                }
+                if (!have_NID_aes_128_cbc)
+                        nids[count++] = NID_aes_128_cbc;
+                if (!have_NID_aes_192_cbc)
+                        nids[count++] = NID_aes_192_cbc;
+                if (!have_NID_aes_256_cbc)
+                        nids[count++] = NID_aes_256_cbc;
+        }
+#endif
+
         if (count > 0)
                 *cnids = nids;
         else
@@ -371,7 +383,7 @@ cryptodev_usable_digests(const int **nids)
 
 static int
 cryptodev_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
-    const unsigned char *in, unsigned int inl)
+    const unsigned char *in, size_t inl)
 {
         struct crypt_op cryp;
         struct dev_crypto_state *state = ctx->cipher_data;
@@ -429,15 +441,15 @@ cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 {
         struct dev_crypto_state *state = ctx->cipher_data;
         struct session_op *sess = &state->d_sess;
-        int cipher;
+        struct dev_crypto_cipher *cipher;
 
-        if ((cipher = cipher_nid_to_cryptodev(ctx->cipher->nid)) == NID_undef)
+        if ((cipher = cipher_nid_to_cryptodev(ctx->cipher->nid)) == NULL)
                 return (0);
 
-        if (ctx->cipher->iv_len > cryptodev_max_iv(cipher))
+        if (ctx->cipher->iv_len > cipher->c_ivmax)
                 return (0);
 
-        if (!cryptodev_key_length_valid(cipher, ctx->key_len))
+        if (ctx->key_len != cipher->c_keylen)
                 return (0);
 
         memset(sess, 0, sizeof(struct session_op));
@@ -447,7 +459,7 @@ cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 
         sess->key = (unsigned char *)key;
         sess->keylen = ctx->key_len;
-        sess->cipher = cipher;
+        sess->cipher = cipher->c_id;
 
         if (ioctl(state->d_fd, CIOCGSESSION, sess) == -1) {
                 close(state->d_fd);
@@ -552,7 +564,7 @@ const EVP_CIPHER cryptodev_cast_cbc = {
         NULL
 };
 
-const EVP_CIPHER cryptodev_aes_cbc = {
+EVP_CIPHER cryptodev_aes_128_cbc = {
         NID_aes_128_cbc,
         16, 16, 16,
         EVP_CIPH_CBC_MODE,
@@ -565,6 +577,225 @@ const EVP_CIPHER cryptodev_aes_cbc = {
         NULL
 };
 
+EVP_CIPHER cryptodev_aes_192_cbc = {
+        NID_aes_192_cbc,
+        16, 24, 16,
+        EVP_CIPH_CBC_MODE,
+        cryptodev_init_key,
+        cryptodev_cipher,
+        cryptodev_cleanup,
+        sizeof(struct dev_crypto_state),
+        EVP_CIPHER_set_asn1_iv,
+        EVP_CIPHER_get_asn1_iv,
+        NULL
+};
+
+EVP_CIPHER cryptodev_aes_256_cbc = {
+        NID_aes_256_cbc,
+        16, 32, 16,
+        EVP_CIPH_CBC_MODE,
+        cryptodev_init_key,
+        cryptodev_cipher,
+        cryptodev_cleanup,
+        sizeof(struct dev_crypto_state),
+        EVP_CIPHER_set_asn1_iv,
+        EVP_CIPHER_get_asn1_iv,
+        NULL
+};
+
+#if defined(__i386__) || defined(__amd64__)
+
+static inline void
+viac3_xcrypt_cbc(int *cw, const void *src, void *dst, void *key, int rep,
+    void *iv)
+{
+#ifdef notdef
+        printf("cw %p[%x %x %x %x] src %p dst %p key %p rep %x iv %p\n",
+            cw, cw[0], cw[1], cw[2], cw[3],
+            src, dst, key, rep, iv);
+#endif
+#if defined(__i386__)
+
+        /*
+         * Clear bit 30 of EFLAGS.
+         */
+        __asm __volatile("pushfl; popfl");
+
+        /*
+         * Cannot simply place key into "b" register, since the compiler
+         * -pic mode uses that register; so instead we must dance a little.
+         */
+        __asm __volatile("pushl %%ebx; movl %0, %%ebx; rep xcrypt-cbc; popl %%ebx" :
+            : "m" (key), "a" (iv), "c" (rep), "d" (cw), "S" (src), "D" (dst)
+            : "memory", "cc");
+#else
+
+        /*
+         * Clear bit 30 of EFLAGS.
+         */
+        __asm __volatile("pushfq; popfq");
+        __asm __volatile("rep xcrypt-cbc" :
+            : "b" (key), "a" (iv), "c" (rep), "d" (cw), "S" (src), "D" (dst)
+            : "memory", "cc");
+#endif
+
+}
+
+#define ISUNALIGNED(x)  ((long)(x)) & 15
+#define DOALIGN(v)      ((void *)(((long)(v) + 15) & ~15))
+
+static int
+xcrypt_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+    const unsigned char *in, size_t inl)
+{
+        unsigned char *save_iv_store[EVP_MAX_IV_LENGTH + 15];
+        unsigned char *save_iv = DOALIGN(save_iv_store);
+        unsigned char *ivs_store[EVP_MAX_IV_LENGTH + 15];
+        unsigned char *ivs = DOALIGN(ivs_store);
+        void *iiv, *iv = NULL, *ivp = NULL;
+        const void *usein = in;
+        void *useout = out, *spare;
+        int cws[4 + 3], *cw = DOALIGN(cws);
+
+        if (!inl)
+                return (1);
+        if ((inl % ctx->cipher->block_size) != 0)
+                return (0);
+        if (inl > UINT_MAX)
+                return (0);
+
+        if (ISUNALIGNED(in) || ISUNALIGNED(out)) {
+                spare = malloc(inl);
+                if (spare == NULL)
+                        return (0);
+
+                if (ISUNALIGNED(in)) {
+                        bcopy(in, spare, inl);
+                        usein = spare;
+                }
+                if (ISUNALIGNED(out))
+                        useout = spare;
+        }
+
+        cw[0] = C3_CRYPT_CWLO_ALG_AES | C3_CRYPT_CWLO_KEYGEN_SW |
+            C3_CRYPT_CWLO_NORMAL;
+        cw[0] |= ctx->encrypt ? C3_CRYPT_CWLO_ENCRYPT : C3_CRYPT_CWLO_DECRYPT;
+        cw[1] = cw[2] = cw[3] = 0;
+
+        switch (ctx->key_len * 8) {
+        case 128:
+                cw[0] |= C3_CRYPT_CWLO_KEY128;
+                break;
+        case 192:
+                cw[0] |= C3_CRYPT_CWLO_KEY192;
+                break;
+        case 256:
+                cw[0] |= C3_CRYPT_CWLO_KEY256;
+                break;
+        }
+
+        if (ctx->cipher->iv_len) {
+                iv = (caddr_t) ctx->iv;
+                if (!ctx->encrypt) {
+                        iiv = (void *) in + inl - ctx->cipher->iv_len;
+                        memcpy(save_iv, iiv, ctx->cipher->iv_len);
+                }
+        }
+
+        ivp = iv;
+        if (ISUNALIGNED(iv)) {
+                bcopy(iv, ivs, ctx->cipher->iv_len);
+                ivp = ivs;
+        }
+
+        viac3_xcrypt_cbc(cw, usein, useout, ctx->cipher_data,  inl / 16, ivp);
+
+        if (ISUNALIGNED(in) || ISUNALIGNED(out)) {
+                if (ISUNALIGNED(out))
+                        bcopy(spare, out, inl);
+                free(spare);
+        }
+
+        if (ivp == ivs)
+                bcopy(ivp, iv, ctx->cipher->iv_len);
+
+        if (ctx->cipher->iv_len) {
+                if (ctx->encrypt)
+                        iiv = (void *) out + inl - ctx->cipher->iv_len;
+                else
+                        iiv = save_iv;
+                memcpy(ctx->iv, iiv, ctx->cipher->iv_len);
+        }
+        return (1);
+}
+
+static int
+xcrypt_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+    const unsigned char *iv, int enc)
+{
+        AES_KEY *k = ctx->cipher_data;
+#ifndef AES_ASM
+        int i;
+#endif
+
+        bzero(k, sizeof *k);
+        if (enc)
+                AES_set_encrypt_key(key, ctx->key_len * 8, k);
+        else
+                AES_set_decrypt_key(key, ctx->key_len * 8, k);
+
+#ifndef AES_ASM
+        /*
+         * XXX Damn OpenSSL byte swaps the expanded key!!
+         *
+         * XXX But only if we're using the C implementation of AES
+         */
+        for (i = 0; i < 4 * (AES_MAXNR + 1); i++)
+                k->rd_key[i] = htonl(k->rd_key[i]);
+#endif
+
+        return (1);
+}
+
+static int
+xcrypt_cleanup(EVP_CIPHER_CTX *ctx)
+{
+        bzero(ctx->cipher_data, ctx->cipher->ctx_size);
+        return (1);
+}
+
+static int
+check_viac3aes(void)
+{
+        int mib[2] = { CTL_MACHDEP, CPU_XCRYPT }, value;
+        size_t size = sizeof(value);
+
+        if (sysctl(mib, sizeof(mib)/sizeof(mib[0]), &value, &size,
+            NULL, 0) < 0)
+                return (0);
+        if (value == 0)
+                return (0);
+
+        if (value & C3_HAS_AES) {
+                cryptodev_aes_128_cbc.init = xcrypt_init_key;
+                cryptodev_aes_128_cbc.do_cipher = xcrypt_cipher;
+                cryptodev_aes_128_cbc.cleanup = xcrypt_cleanup;
+                cryptodev_aes_128_cbc.ctx_size = sizeof(AES_KEY);
+
+                cryptodev_aes_192_cbc.init = xcrypt_init_key;
+                cryptodev_aes_192_cbc.do_cipher = xcrypt_cipher;
+                cryptodev_aes_192_cbc.cleanup = xcrypt_cleanup;
+                cryptodev_aes_192_cbc.ctx_size = sizeof(AES_KEY);
+
+                cryptodev_aes_256_cbc.init = xcrypt_init_key;
+                cryptodev_aes_256_cbc.do_cipher = xcrypt_cipher;
+                cryptodev_aes_256_cbc.cleanup = xcrypt_cleanup;
+                cryptodev_aes_256_cbc.ctx_size = sizeof(AES_KEY);
+        }
+        return (value);
+}
+#endif /* __i386__ || __amd64__ */
+
 /*
  * Registered by the ENGINE when used to find out how to deal with
  * a particular NID in the ENGINE. this says what we'll do at the
@@ -591,7 +822,13 @@ cryptodev_engine_ciphers(ENGINE *e, const EVP_CIPHER **cipher,
                 *cipher = &cryptodev_cast_cbc;
                 break;
         case NID_aes_128_cbc:
-                *cipher = &cryptodev_aes_cbc;
+                *cipher = &cryptodev_aes_128_cbc;
+                break;
+        case NID_aes_192_cbc:
+                *cipher = &cryptodev_aes_192_cbc;
+                break;
+        case NID_aes_256_cbc:
+                *cipher = &cryptodev_aes_256_cbc;
                 break;
         default:
                 *cipher = NULL;
@@ -758,19 +995,14 @@ err:
 }
 
 static int
-cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
+cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa,
+    BN_CTX *ctx)
 {
-        int r;
-        BN_CTX *ctx;
-
-        ctx = BN_CTX_new();
-        r = cryptodev_bn_mod_exp(r0, I, rsa->d, rsa->n, ctx, NULL);
-        BN_CTX_free(ctx);
-        return (r);
+        return (RSA_PKCS1_SSLeay()->rsa_mod_exp)(r0, I, rsa, ctx);
 }
 
 static int
-cryptodev_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
+cryptodev_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
 {
         struct crypt_kop kop;
         int ret = 1;
@@ -799,7 +1031,7 @@ cryptodev_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
 
         if (cryptodev_asym(&kop, BN_num_bytes(rsa->n), r0, 0, NULL) == -1) {
                 const RSA_METHOD *meth = RSA_PKCS1_SSLeay();
-                ret = (*meth->rsa_mod_exp)(r0, I, rsa);
+                ret = (*meth->rsa_mod_exp)(r0, I, rsa, ctx);
         }
 err:
         zapparams(&kop);
diff --git a/src/lib/libcrypto/engine/hw_cswift.c b/src/lib/libcrypto/engine/hw_cswift.c
deleted file mode 100644
index 1411fd8333..0000000000
--- a/src/lib/libcrypto/engine/hw_cswift.c
+++ /dev/null
@@ -1,1109 +0,0 @@
-/* crypto/engine/hw_cswift.c */
-/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <openssl/crypto.h>
-#include "cryptlib.h"
-#include <openssl/dso.h>
-#include <openssl/engine.h>
-
-#ifndef OPENSSL_NO_HW
-#ifndef OPENSSL_NO_HW_CSWIFT
-
-/* Attribution notice: Rainbow have generously allowed me to reproduce
- * the necessary definitions here from their API. This means the support
- * can build independently of whether application builders have the
- * API or hardware. This will allow developers to easily produce software
- * that has latent hardware support for any users that have accelerators
- * installed, without the developers themselves needing anything extra.
- *
- * I have only clipped the parts from the CryptoSwift header files that
- * are (or seem) relevant to the CryptoSwift support code. This is
- * simply to keep the file sizes reasonable.
- * [Geoff]
- */
-#ifdef FLAT_INC
-#include "cswift.h"
-#else
-#include "vendor_defns/cswift.h"
-#endif
-
-#define CSWIFT_LIB_NAME "cswift engine"
-#include "hw_cswift_err.c"
-
-static int cswift_destroy(ENGINE *e);
-static int cswift_init(ENGINE *e);
-static int cswift_finish(ENGINE *e);
-static int cswift_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
-static int cswift_bn_32copy(SW_LARGENUMBER * out, const BIGNUM * in);
-
-/* BIGNUM stuff */
-static int cswift_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx);
-static int cswift_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *q, const BIGNUM *dmp1, const BIGNUM *dmq1,
-                const BIGNUM *iqmp, BN_CTX *ctx);
-
-#ifndef OPENSSL_NO_RSA
-/* RSA stuff */
-static int cswift_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
-#endif
-/* This function is aliased to mod_exp (with the mont stuff dropped). */
-static int cswift_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
-
-#ifndef OPENSSL_NO_DSA
-/* DSA stuff */
-static DSA_SIG *cswift_dsa_sign(const unsigned char *dgst, int dlen, DSA *dsa);
-static int cswift_dsa_verify(const unsigned char *dgst, int dgst_len,
-                                DSA_SIG *sig, DSA *dsa);
-#endif
-
-#ifndef OPENSSL_NO_DH
-/* DH stuff */
-/* This function is alised to mod_exp (with the DH and mont dropped). */
-static int cswift_mod_exp_dh(const DH *dh, BIGNUM *r,
-                const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
-#endif
-
-/* RAND stuff */
-static int cswift_rand_bytes(unsigned char *buf, int num);
-static int cswift_rand_status(void);
-
-/* The definitions for control commands specific to this engine */
-#define CSWIFT_CMD_SO_PATH              ENGINE_CMD_BASE
-static const ENGINE_CMD_DEFN cswift_cmd_defns[] = {
-        {CSWIFT_CMD_SO_PATH,
-                "SO_PATH",
-                "Specifies the path to the 'cswift' shared library",
-                ENGINE_CMD_FLAG_STRING},
-        {0, NULL, NULL, 0}
-        };
-
-#ifndef OPENSSL_NO_RSA
-/* Our internal RSA_METHOD that we provide pointers to */
-static RSA_METHOD cswift_rsa =
-        {
-        "CryptoSwift RSA method",
-        NULL,
-        NULL,
-        NULL,
-        NULL,
-        cswift_rsa_mod_exp,
-        cswift_mod_exp_mont,
-        NULL,
-        NULL,
-        0,
-        NULL,
-        NULL,
-        NULL
-        };
-#endif
-
-#ifndef OPENSSL_NO_DSA
-/* Our internal DSA_METHOD that we provide pointers to */
-static DSA_METHOD cswift_dsa =
-        {
-        "CryptoSwift DSA method",
-        cswift_dsa_sign,
-        NULL, /* dsa_sign_setup */
-        cswift_dsa_verify,
-        NULL, /* dsa_mod_exp */
-        NULL, /* bn_mod_exp */
-        NULL, /* init */
-        NULL, /* finish */
-        0, /* flags */
-        NULL /* app_data */
-        };
-#endif
-
-#ifndef OPENSSL_NO_DH
-/* Our internal DH_METHOD that we provide pointers to */
-static DH_METHOD cswift_dh =
-        {
-        "CryptoSwift DH method",
-        NULL,
-        NULL,
-        cswift_mod_exp_dh,
-        NULL,
-        NULL,
-        0,
-        NULL
-        };
-#endif
-
-static RAND_METHOD cswift_random =
-    {
-    /* "CryptoSwift RAND method", */
-    NULL,
-    cswift_rand_bytes,
-    NULL,
-    NULL,
-    cswift_rand_bytes,
-    cswift_rand_status,
-    };
-
-
-/* Constants used when creating the ENGINE */
-static const char *engine_cswift_id = "cswift";
-static const char *engine_cswift_name = "CryptoSwift hardware engine support";
-
-/* This internal function is used by ENGINE_cswift() and possibly by the
- * "dynamic" ENGINE support too */
-static int bind_helper(ENGINE *e)
-        {
-#ifndef OPENSSL_NO_RSA
-        const RSA_METHOD *meth1;
-#endif
-#ifndef OPENSSL_NO_DH
-        const DH_METHOD *meth2;
-#endif
-        if(!ENGINE_set_id(e, engine_cswift_id) ||
-                        !ENGINE_set_name(e, engine_cswift_name) ||
-#ifndef OPENSSL_NO_RSA
-                        !ENGINE_set_RSA(e, &cswift_rsa) ||
-#endif
-#ifndef OPENSSL_NO_DSA
-                        !ENGINE_set_DSA(e, &cswift_dsa) ||
-#endif
-#ifndef OPENSSL_NO_DH
-                        !ENGINE_set_DH(e, &cswift_dh) ||
-#endif
-                        !ENGINE_set_RAND(e, &cswift_random) ||
-                        !ENGINE_set_destroy_function(e, cswift_destroy) ||
-                        !ENGINE_set_init_function(e, cswift_init) ||
-                        !ENGINE_set_finish_function(e, cswift_finish) ||
-                        !ENGINE_set_ctrl_function(e, cswift_ctrl) ||
-                        !ENGINE_set_cmd_defns(e, cswift_cmd_defns))
-                return 0;
-
-#ifndef OPENSSL_NO_RSA
-        /* We know that the "PKCS1_SSLeay()" functions hook properly
-         * to the cswift-specific mod_exp and mod_exp_crt so we use
-         * those functions. NB: We don't use ENGINE_openssl() or
-         * anything "more generic" because something like the RSAref
-         * code may not hook properly, and if you own one of these
-         * cards then you have the right to do RSA operations on it
-         * anyway! */ 
-        meth1 = RSA_PKCS1_SSLeay();
-        cswift_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
-        cswift_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
-        cswift_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
-        cswift_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
-#endif
-
-#ifndef OPENSSL_NO_DH
-        /* Much the same for Diffie-Hellman */
-        meth2 = DH_OpenSSL();
-        cswift_dh.generate_key = meth2->generate_key;
-        cswift_dh.compute_key = meth2->compute_key;
-#endif
-
-        /* Ensure the cswift error handling is set up */
-        ERR_load_CSWIFT_strings();
-        return 1;
-        }
-
-#ifndef ENGINE_DYNAMIC_SUPPORT
-static ENGINE *engine_cswift(void)
-        {
-        ENGINE *ret = ENGINE_new();
-        if(!ret)
-                return NULL;
-        if(!bind_helper(ret))
-                {
-                ENGINE_free(ret);
-                return NULL;
-                }
-        return ret;
-        }
-
-void ENGINE_load_cswift(void)
-        {
-        /* Copied from eng_[openssl|dyn].c */
-        ENGINE *toadd = engine_cswift();
-        if(!toadd) return;
-        ENGINE_add(toadd);
-        ENGINE_free(toadd);
-        ERR_clear_error();
-        }
-#endif
-
-/* This is a process-global DSO handle used for loading and unloading
- * the CryptoSwift library. NB: This is only set (or unset) during an
- * init() or finish() call (reference counts permitting) and they're
- * operating with global locks, so this should be thread-safe
- * implicitly. */
-static DSO *cswift_dso = NULL;
-
-/* These are the function pointers that are (un)set when the library has
- * successfully (un)loaded. */
-t_swAcquireAccContext *p_CSwift_AcquireAccContext = NULL;
-t_swAttachKeyParam *p_CSwift_AttachKeyParam = NULL;
-t_swSimpleRequest *p_CSwift_SimpleRequest = NULL;
-t_swReleaseAccContext *p_CSwift_ReleaseAccContext = NULL;
-
-/* Used in the DSO operations. */
-static const char *CSWIFT_LIBNAME = NULL;
-static const char *get_CSWIFT_LIBNAME(void)
-        {
-        if(CSWIFT_LIBNAME)
-                return CSWIFT_LIBNAME;
-        return "swift";
-        }
-static void free_CSWIFT_LIBNAME(void)
-        {
-        if(CSWIFT_LIBNAME)
-                OPENSSL_free((void*)CSWIFT_LIBNAME);
-        CSWIFT_LIBNAME = NULL;
-        }
-static long set_CSWIFT_LIBNAME(const char *name)
-        {
-        free_CSWIFT_LIBNAME();
-        return (((CSWIFT_LIBNAME = BUF_strdup(name)) != NULL) ? 1 : 0);
-        }
-static const char *CSWIFT_F1 = "swAcquireAccContext";
-static const char *CSWIFT_F2 = "swAttachKeyParam";
-static const char *CSWIFT_F3 = "swSimpleRequest";
-static const char *CSWIFT_F4 = "swReleaseAccContext";
-
-
-/* CryptoSwift library functions and mechanics - these are used by the
- * higher-level functions further down. NB: As and where there's no
- * error checking, take a look lower down where these functions are
- * called, the checking and error handling is probably down there. */
-
-/* utility function to obtain a context */
-static int get_context(SW_CONTEXT_HANDLE *hac)
-        {
-        SW_STATUS status;
- 
-        status = p_CSwift_AcquireAccContext(hac);
-        if(status != SW_OK)
-                return 0;
-        return 1;
-        }
- 
-/* similarly to release one. */
-static void release_context(SW_CONTEXT_HANDLE hac)
-        {
-        p_CSwift_ReleaseAccContext(hac);
-        }
-
-/* Destructor (complements the "ENGINE_cswift()" constructor) */
-static int cswift_destroy(ENGINE *e)
-        {
-        free_CSWIFT_LIBNAME();
-        ERR_unload_CSWIFT_strings();
-        return 1;
-        }
-
-/* (de)initialisation functions. */
-static int cswift_init(ENGINE *e)
-        {
-        SW_CONTEXT_HANDLE hac;
-        t_swAcquireAccContext *p1;
-        t_swAttachKeyParam *p2;
-        t_swSimpleRequest *p3;
-        t_swReleaseAccContext *p4;
-
-        if(cswift_dso != NULL)
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_INIT,CSWIFT_R_ALREADY_LOADED);
-                goto err;
-                }
-        /* Attempt to load libswift.so/swift.dll/whatever. */
-        cswift_dso = DSO_load(NULL, get_CSWIFT_LIBNAME(), NULL, 0);
-        if(cswift_dso == NULL)
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_INIT,CSWIFT_R_NOT_LOADED);
-                goto err;
-                }
-        if(!(p1 = (t_swAcquireAccContext *)
-                                DSO_bind_func(cswift_dso, CSWIFT_F1)) ||
-                        !(p2 = (t_swAttachKeyParam *)
-                                DSO_bind_func(cswift_dso, CSWIFT_F2)) ||
-                        !(p3 = (t_swSimpleRequest *)
-                                DSO_bind_func(cswift_dso, CSWIFT_F3)) ||
-                        !(p4 = (t_swReleaseAccContext *)
-                                DSO_bind_func(cswift_dso, CSWIFT_F4)))
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_INIT,CSWIFT_R_NOT_LOADED);
-                goto err;
-                }
-        /* Copy the pointers */
-        p_CSwift_AcquireAccContext = p1;
-        p_CSwift_AttachKeyParam = p2;
-        p_CSwift_SimpleRequest = p3;
-        p_CSwift_ReleaseAccContext = p4;
-        /* Try and get a context - if not, we may have a DSO but no
-         * accelerator! */
-        if(!get_context(&hac))
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_INIT,CSWIFT_R_UNIT_FAILURE);
-                goto err;
-                }
-        release_context(hac);
-        /* Everything's fine. */
-        return 1;
-err:
-        if(cswift_dso)
-        {
-                DSO_free(cswift_dso);
-                cswift_dso = NULL;
-        }
-        p_CSwift_AcquireAccContext = NULL;
-        p_CSwift_AttachKeyParam = NULL;
-        p_CSwift_SimpleRequest = NULL;
-        p_CSwift_ReleaseAccContext = NULL;
-        return 0;
-        }
-
-static int cswift_finish(ENGINE *e)
-        {
-        free_CSWIFT_LIBNAME();
-        if(cswift_dso == NULL)
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_FINISH,CSWIFT_R_NOT_LOADED);
-                return 0;
-                }
-        if(!DSO_free(cswift_dso))
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_FINISH,CSWIFT_R_UNIT_FAILURE);
-                return 0;
-                }
-        cswift_dso = NULL;
-        p_CSwift_AcquireAccContext = NULL;
-        p_CSwift_AttachKeyParam = NULL;
-        p_CSwift_SimpleRequest = NULL;
-        p_CSwift_ReleaseAccContext = NULL;
-        return 1;
-        }
-
-static int cswift_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
-        {
-        int initialised = ((cswift_dso == NULL) ? 0 : 1);
-        switch(cmd)
-                {
-        case CSWIFT_CMD_SO_PATH:
-                if(p == NULL)
-                        {
-                        CSWIFTerr(CSWIFT_F_CSWIFT_CTRL,ERR_R_PASSED_NULL_PARAMETER);
-                        return 0;
-                        }
-                if(initialised)
-                        {
-                        CSWIFTerr(CSWIFT_F_CSWIFT_CTRL,CSWIFT_R_ALREADY_LOADED);
-                        return 0;
-                        }
-                return set_CSWIFT_LIBNAME((const char *)p);
-        default:
-                break;
-                }
-        CSWIFTerr(CSWIFT_F_CSWIFT_CTRL,CSWIFT_R_CTRL_COMMAND_NOT_IMPLEMENTED);
-        return 0;
-        }
-
-/* Un petit mod_exp */
-static int cswift_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                        const BIGNUM *m, BN_CTX *ctx)
-        {
-        /* I need somewhere to store temporary serialised values for
-         * use with the CryptoSwift API calls. A neat cheat - I'll use
-         * BIGNUMs from the BN_CTX but access their arrays directly as
-         * byte arrays <grin>. This way I don't have to clean anything
-         * up. */
-        BIGNUM *modulus;
-        BIGNUM *exponent;
-        BIGNUM *argument;
-        BIGNUM *result;
-        SW_STATUS sw_status;
-        SW_LARGENUMBER arg, res;
-        SW_PARAM sw_param;
-        SW_CONTEXT_HANDLE hac;
-        int to_return, acquired;
- 
-        modulus = exponent = argument = result = NULL;
-        to_return = 0; /* expect failure */
-        acquired = 0;
- 
-        if(!get_context(&hac))
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP,CSWIFT_R_UNIT_FAILURE);
-                goto err;
-                }
-        acquired = 1;
-        /* Prepare the params */
-        BN_CTX_start(ctx);
-        modulus = BN_CTX_get(ctx);
-        exponent = BN_CTX_get(ctx);
-        argument = BN_CTX_get(ctx);
-        result = BN_CTX_get(ctx);
-        if(!result)
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP,CSWIFT_R_BN_CTX_FULL);
-                goto err;
-                }
-        if(!bn_wexpand(modulus, m->top) || !bn_wexpand(exponent, p->top) ||
-                !bn_wexpand(argument, a->top) || !bn_wexpand(result, m->top))
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP,CSWIFT_R_BN_EXPAND_FAIL);
-                goto err;
-                }
-        sw_param.type = SW_ALG_EXP;
-        sw_param.up.exp.modulus.nbytes = BN_bn2bin(m,
-                (unsigned char *)modulus->d);
-        sw_param.up.exp.modulus.value = (unsigned char *)modulus->d;
-        sw_param.up.exp.exponent.nbytes = BN_bn2bin(p,
-                (unsigned char *)exponent->d);
-        sw_param.up.exp.exponent.value = (unsigned char *)exponent->d;
-        /* Attach the key params */
-        sw_status = p_CSwift_AttachKeyParam(hac, &sw_param);
-        switch(sw_status)
-                {
-        case SW_OK:
-                break;
-        case SW_ERR_INPUT_SIZE:
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP,CSWIFT_R_BAD_KEY_SIZE);
-                goto err;
-        default:
-                {
-                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP,CSWIFT_R_REQUEST_FAILED);
-                sprintf(tmpbuf, "%ld", sw_status);
-                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
-                }
-                goto err;
-                }
-        /* Prepare the argument and response */
-        arg.nbytes = BN_bn2bin(a, (unsigned char *)argument->d);
-        arg.value = (unsigned char *)argument->d;
-        res.nbytes = BN_num_bytes(m);
-        memset(result->d, 0, res.nbytes);
-        res.value = (unsigned char *)result->d;
-        /* Perform the operation */
-        if((sw_status = p_CSwift_SimpleRequest(hac, SW_CMD_MODEXP, &arg, 1,
-                &res, 1)) != SW_OK)
-                {
-                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP,CSWIFT_R_REQUEST_FAILED);
-                sprintf(tmpbuf, "%ld", sw_status);
-                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
-                goto err;
-                }
-        /* Convert the response */
-        BN_bin2bn((unsigned char *)result->d, res.nbytes, r);
-        to_return = 1;
-err:
-        if(acquired)
-                release_context(hac);
-        BN_CTX_end(ctx);
-        return to_return;
-        }
-
-
-int cswift_bn_32copy(SW_LARGENUMBER * out, const BIGNUM * in)
-{
-        int mod;
-        int numbytes = BN_num_bytes(in);
-
-        mod = 0;
-        while( ((out->nbytes = (numbytes+mod)) % 32) )
-        {
-                mod++;
-        }
-        out->value = (unsigned char*)OPENSSL_malloc(out->nbytes);
-        if(!out->value)
-        {
-                return 0;
-        }
-        BN_bn2bin(in, &out->value[mod]);
-        if(mod)
-                memset(out->value, 0, mod);
-
-        return 1;
-}
-
-/* Un petit mod_exp chinois */
-static int cswift_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                        const BIGNUM *q, const BIGNUM *dmp1,
-                        const BIGNUM *dmq1, const BIGNUM *iqmp, BN_CTX *ctx)
-        {
-        SW_STATUS sw_status;
-        SW_LARGENUMBER arg, res;
-        SW_PARAM sw_param;
-        SW_CONTEXT_HANDLE hac;
-        BIGNUM *result = NULL;
-        BIGNUM *argument = NULL;
-        int to_return = 0; /* expect failure */
-        int acquired = 0;
-
-        sw_param.up.crt.p.value = NULL;
-        sw_param.up.crt.q.value = NULL;
-        sw_param.up.crt.dmp1.value = NULL;
-        sw_param.up.crt.dmq1.value = NULL;
-        sw_param.up.crt.iqmp.value = NULL;
- 
-        if(!get_context(&hac))
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_UNIT_FAILURE);
-                goto err;
-                }
-        acquired = 1;
-
-        /* Prepare the params */
-        argument = BN_new();
-        result = BN_new();
-        if(!result || !argument)
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_CTX_FULL);
-                goto err;
-                }
-
-
-        sw_param.type = SW_ALG_CRT;
-        /************************************************************************/
-        /* 04/02/2003                                                           */
-        /* Modified by Frederic Giudicelli (deny-all.com) to overcome the       */
-        /* limitation of cswift with values not a multiple of 32                */
-        /************************************************************************/
-        if(!cswift_bn_32copy(&sw_param.up.crt.p, p))
-        {
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_EXPAND_FAIL);
-                goto err;
-        }
-        if(!cswift_bn_32copy(&sw_param.up.crt.q, q))
-        {
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_EXPAND_FAIL);
-                goto err;
-        }
-        if(!cswift_bn_32copy(&sw_param.up.crt.dmp1, dmp1))
-        {
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_EXPAND_FAIL);
-                goto err;
-        }
-        if(!cswift_bn_32copy(&sw_param.up.crt.dmq1, dmq1))
-        {
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_EXPAND_FAIL);
-                goto err;
-        }
-        if(!cswift_bn_32copy(&sw_param.up.crt.iqmp, iqmp))
-        {
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_EXPAND_FAIL);
-                goto err;
-        }
-        if(     !bn_wexpand(argument, a->top) ||
-                        !bn_wexpand(result, p->top + q->top))
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_EXPAND_FAIL);
-                goto err;
-                }
-
-        /* Attach the key params */
-        sw_status = p_CSwift_AttachKeyParam(hac, &sw_param);
-        switch(sw_status)
-                {
-        case SW_OK:
-                break;
-        case SW_ERR_INPUT_SIZE:
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BAD_KEY_SIZE);
-                goto err;
-        default:
-                {
-                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_REQUEST_FAILED);
-                sprintf(tmpbuf, "%ld", sw_status);
-                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
-                }
-                goto err;
-                }
-        /* Prepare the argument and response */
-        arg.nbytes = BN_bn2bin(a, (unsigned char *)argument->d);
-        arg.value = (unsigned char *)argument->d;
-        res.nbytes = 2 * BN_num_bytes(p);
-        memset(result->d, 0, res.nbytes);
-        res.value = (unsigned char *)result->d;
-        /* Perform the operation */
-        if((sw_status = p_CSwift_SimpleRequest(hac, SW_CMD_MODEXP_CRT, &arg, 1,
-                &res, 1)) != SW_OK)
-                {
-                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
-                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_REQUEST_FAILED);
-                sprintf(tmpbuf, "%ld", sw_status);
-                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
-                goto err;
-                }
-        /* Convert the response */
-        BN_bin2bn((unsigned char *)result->d, res.nbytes, r);
-        to_return = 1;
-err:
-        if(sw_param.up.crt.p.value)
-                OPENSSL_free(sw_param.up.crt.p.value);
-        if(sw_param.up.crt.q.value)
-                OPENSSL_free(sw_param.up.crt.q.value);
-        if(sw_param.up.crt.dmp1.value)
-                OPENSSL_free(sw_param.up.crt.dmp1.value);
-        if(sw_param.up.crt.dmq1.value)
-                OPENSSL_free(sw_param.up.crt.dmq1.value);
-        if(sw_param.up.crt.iqmp.value)
-                OPENSSL_free(sw_param.up.crt.iqmp.value);
-        if(result)
-                BN_free(result);
-        if(argument)
-                BN_free(argument);
-        if(acquired)
-                release_context(hac);
-        return to_return;
-        }
- 
-#ifndef OPENSSL_NO_RSA
-static int cswift_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
-        {
-        BN_CTX *ctx;
-        int to_return = 0;
-        const RSA_METHOD * def_rsa_method;
-
-        /* Try the limits of RSA (2048 bits) */
-        if(BN_num_bytes(rsa->p) > 128 ||
-                BN_num_bytes(rsa->q) > 128 ||
-                BN_num_bytes(rsa->dmp1) > 128 ||
-                BN_num_bytes(rsa->dmq1) > 128 ||
-                BN_num_bytes(rsa->iqmp) > 128)
-        {
-#ifdef RSA_NULL
-                def_rsa_method=RSA_null_method();
-#else
-#if 0
-                def_rsa_method=RSA_PKCS1_RSAref();
-#else
-                def_rsa_method=RSA_PKCS1_SSLeay();
-#endif
-#endif
-                if(def_rsa_method)
-                        return def_rsa_method->rsa_mod_exp(r0, I, rsa);
-        }
-
-        if((ctx = BN_CTX_new()) == NULL)
-                goto err;
-        if(!rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_RSA_MOD_EXP,CSWIFT_R_MISSING_KEY_COMPONENTS);
-                goto err;
-                }
-        to_return = cswift_mod_exp_crt(r0, I, rsa->p, rsa->q, rsa->dmp1,
-                rsa->dmq1, rsa->iqmp, ctx);
-err:
-        if(ctx)
-                BN_CTX_free(ctx);
-        return to_return;
-        }
-#endif
-
-/* This function is aliased to mod_exp (with the mont stuff dropped). */
-static int cswift_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-        {
-        const RSA_METHOD * def_rsa_method;
-
-        /* Try the limits of RSA (2048 bits) */
-        if(BN_num_bytes(r) > 256 ||
-                BN_num_bytes(a) > 256 ||
-                BN_num_bytes(m) > 256)
-        {
-#ifdef RSA_NULL
-                def_rsa_method=RSA_null_method();
-#else
-#if 0
-                def_rsa_method=RSA_PKCS1_RSAref();
-#else
-                def_rsa_method=RSA_PKCS1_SSLeay();
-#endif
-#endif
-                if(def_rsa_method)
-                        return def_rsa_method->bn_mod_exp(r, a, p, m, ctx, m_ctx);
-        }
-
-        return cswift_mod_exp(r, a, p, m, ctx);
-        }
-
-#ifndef OPENSSL_NO_DSA
-static DSA_SIG *cswift_dsa_sign(const unsigned char *dgst, int dlen, DSA *dsa)
-        {
-        SW_CONTEXT_HANDLE hac;
-        SW_PARAM sw_param;
-        SW_STATUS sw_status;
-        SW_LARGENUMBER arg, res;
-        unsigned char *ptr;
-        BN_CTX *ctx;
-        BIGNUM *dsa_p = NULL;
-        BIGNUM *dsa_q = NULL;
-        BIGNUM *dsa_g = NULL;
-        BIGNUM *dsa_key = NULL;
-        BIGNUM *result = NULL;
-        DSA_SIG *to_return = NULL;
-        int acquired = 0;
-
-        if((ctx = BN_CTX_new()) == NULL)
-                goto err;
-        if(!get_context(&hac))
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_SIGN,CSWIFT_R_UNIT_FAILURE);
-                goto err;
-                }
-        acquired = 1;
-        /* Prepare the params */
-        BN_CTX_start(ctx);
-        dsa_p = BN_CTX_get(ctx);
-        dsa_q = BN_CTX_get(ctx);
-        dsa_g = BN_CTX_get(ctx);
-        dsa_key = BN_CTX_get(ctx);
-        result = BN_CTX_get(ctx);
-        if(!result)
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_SIGN,CSWIFT_R_BN_CTX_FULL);
-                goto err;
-                }
-        if(!bn_wexpand(dsa_p, dsa->p->top) ||
-                        !bn_wexpand(dsa_q, dsa->q->top) ||
-                        !bn_wexpand(dsa_g, dsa->g->top) ||
-                        !bn_wexpand(dsa_key, dsa->priv_key->top) ||
-                        !bn_wexpand(result, dsa->p->top))
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_SIGN,CSWIFT_R_BN_EXPAND_FAIL);
-                goto err;
-                }
-        sw_param.type = SW_ALG_DSA;
-        sw_param.up.dsa.p.nbytes = BN_bn2bin(dsa->p,
-                                (unsigned char *)dsa_p->d);
-        sw_param.up.dsa.p.value = (unsigned char *)dsa_p->d;
-        sw_param.up.dsa.q.nbytes = BN_bn2bin(dsa->q,
-                                (unsigned char *)dsa_q->d);
-        sw_param.up.dsa.q.value = (unsigned char *)dsa_q->d;
-        sw_param.up.dsa.g.nbytes = BN_bn2bin(dsa->g,
-                                (unsigned char *)dsa_g->d);
-        sw_param.up.dsa.g.value = (unsigned char *)dsa_g->d;
-        sw_param.up.dsa.key.nbytes = BN_bn2bin(dsa->priv_key,
-                                (unsigned char *)dsa_key->d);
-        sw_param.up.dsa.key.value = (unsigned char *)dsa_key->d;
-        /* Attach the key params */
-        sw_status = p_CSwift_AttachKeyParam(hac, &sw_param);
-        switch(sw_status)
-                {
-        case SW_OK:
-                break;
-        case SW_ERR_INPUT_SIZE:
-                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_SIGN,CSWIFT_R_BAD_KEY_SIZE);
-                goto err;
-        default:
-                {
-                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
-                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_SIGN,CSWIFT_R_REQUEST_FAILED);
-                sprintf(tmpbuf, "%ld", sw_status);
-                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
-                }
-                goto err;
-                }
-        /* Prepare the argument and response */
-        arg.nbytes = dlen;
-        arg.value = (unsigned char *)dgst;
-        res.nbytes = BN_num_bytes(dsa->p);
-        memset(result->d, 0, res.nbytes);
-        res.value = (unsigned char *)result->d;
-        /* Perform the operation */
-        sw_status = p_CSwift_SimpleRequest(hac, SW_CMD_DSS_SIGN, &arg, 1,
-                &res, 1);
-        if(sw_status != SW_OK)
-                {
-                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
-                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_SIGN,CSWIFT_R_REQUEST_FAILED);
-                sprintf(tmpbuf, "%ld", sw_status);
-                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
-                goto err;
-                }
-        /* Convert the response */
-        ptr = (unsigned char *)result->d;
-        if((to_return = DSA_SIG_new()) == NULL)
-                goto err;
-        to_return->r = BN_bin2bn((unsigned char *)result->d, 20, NULL);
-        to_return->s = BN_bin2bn((unsigned char *)result->d + 20, 20, NULL);
-
-err:
-        if(acquired)
-                release_context(hac);
-        if(ctx)
-                {
-                BN_CTX_end(ctx);
-                BN_CTX_free(ctx);
-                }
-        return to_return;
-        }
-
-static int cswift_dsa_verify(const unsigned char *dgst, int dgst_len,
-                                DSA_SIG *sig, DSA *dsa)
-        {
-        SW_CONTEXT_HANDLE hac;
-        SW_PARAM sw_param;
-        SW_STATUS sw_status;
-        SW_LARGENUMBER arg[2], res;
-        unsigned long sig_result;
-        BN_CTX *ctx;
-        BIGNUM *dsa_p = NULL;
-        BIGNUM *dsa_q = NULL;
-        BIGNUM *dsa_g = NULL;
-        BIGNUM *dsa_key = NULL;
-        BIGNUM *argument = NULL;
-        int to_return = -1;
-        int acquired = 0;
-
-        if((ctx = BN_CTX_new()) == NULL)
-                goto err;
-        if(!get_context(&hac))
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_VERIFY,CSWIFT_R_UNIT_FAILURE);
-                goto err;
-                }
-        acquired = 1;
-        /* Prepare the params */
-        BN_CTX_start(ctx);
-        dsa_p = BN_CTX_get(ctx);
-        dsa_q = BN_CTX_get(ctx);
-        dsa_g = BN_CTX_get(ctx);
-        dsa_key = BN_CTX_get(ctx);
-        argument = BN_CTX_get(ctx);
-        if(!argument)
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_VERIFY,CSWIFT_R_BN_CTX_FULL);
-                goto err;
-                }
-        if(!bn_wexpand(dsa_p, dsa->p->top) ||
-                        !bn_wexpand(dsa_q, dsa->q->top) ||
-                        !bn_wexpand(dsa_g, dsa->g->top) ||
-                        !bn_wexpand(dsa_key, dsa->pub_key->top) ||
-                        !bn_wexpand(argument, 40))
-                {
-                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_VERIFY,CSWIFT_R_BN_EXPAND_FAIL);
-                goto err;
-                }
-        sw_param.type = SW_ALG_DSA;
-        sw_param.up.dsa.p.nbytes = BN_bn2bin(dsa->p,
-                                (unsigned char *)dsa_p->d);
-        sw_param.up.dsa.p.value = (unsigned char *)dsa_p->d;
-        sw_param.up.dsa.q.nbytes = BN_bn2bin(dsa->q,
-                                (unsigned char *)dsa_q->d);
-        sw_param.up.dsa.q.value = (unsigned char *)dsa_q->d;
-        sw_param.up.dsa.g.nbytes = BN_bn2bin(dsa->g,
-                                (unsigned char *)dsa_g->d);
-        sw_param.up.dsa.g.value = (unsigned char *)dsa_g->d;
-        sw_param.up.dsa.key.nbytes = BN_bn2bin(dsa->pub_key,
-                                (unsigned char *)dsa_key->d);
-        sw_param.up.dsa.key.value = (unsigned char *)dsa_key->d;
-        /* Attach the key params */
-        sw_status = p_CSwift_AttachKeyParam(hac, &sw_param);
-        switch(sw_status)
-                {
-        case SW_OK:
-                break;
-        case SW_ERR_INPUT_SIZE:
-                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_VERIFY,CSWIFT_R_BAD_KEY_SIZE);
-                goto err;
-        default:
-                {
-                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
-                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_VERIFY,CSWIFT_R_REQUEST_FAILED);
-                sprintf(tmpbuf, "%ld", sw_status);
-                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
-                }
-                goto err;
-                }
-        /* Prepare the argument and response */
-        arg[0].nbytes = dgst_len;
-        arg[0].value = (unsigned char *)dgst;
-        arg[1].nbytes = 40;
-        arg[1].value = (unsigned char *)argument->d;
-        memset(arg[1].value, 0, 40);
-        BN_bn2bin(sig->r, arg[1].value + 20 - BN_num_bytes(sig->r));
-        BN_bn2bin(sig->s, arg[1].value + 40 - BN_num_bytes(sig->s));
-        res.nbytes = 4; /* unsigned long */
-        res.value = (unsigned char *)(&sig_result);
-        /* Perform the operation */
-        sw_status = p_CSwift_SimpleRequest(hac, SW_CMD_DSS_VERIFY, arg, 2,
-                &res, 1);
-        if(sw_status != SW_OK)
-                {
-                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
-                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_VERIFY,CSWIFT_R_REQUEST_FAILED);
-                sprintf(tmpbuf, "%ld", sw_status);
-                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
-                goto err;
-                }
-        /* Convert the response */
-        to_return = ((sig_result == 0) ? 0 : 1);
-
-err:
-        if(acquired)
-                release_context(hac);
-        if(ctx)
-                {
-                BN_CTX_end(ctx);
-                BN_CTX_free(ctx);
-                }
-        return to_return;
-        }
-#endif
-
-#ifndef OPENSSL_NO_DH
-/* This function is aliased to mod_exp (with the dh and mont dropped). */
-static int cswift_mod_exp_dh(const DH *dh, BIGNUM *r,
-                const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-        {
-        return cswift_mod_exp(r, a, p, m, ctx);
-        }
-#endif
-
-/* Random bytes are good */
-static int cswift_rand_bytes(unsigned char *buf, int num)
-{
-        SW_CONTEXT_HANDLE hac;
-        SW_STATUS swrc;
-        SW_LARGENUMBER largenum;
-        int acquired = 0;
-        int to_return = 0; /* assume failure */
-        unsigned char buf32[1024];
-
-
-        if (!get_context(&hac))
-        {
-                CSWIFTerr(CSWIFT_F_CSWIFT_CTRL, CSWIFT_R_UNIT_FAILURE);
-                goto err;
-        }
-        acquired = 1;
-
-        /************************************************************************/
-        /* 04/02/2003                                                           */
-        /* Modified by Frederic Giudicelli (deny-all.com) to overcome the       */
-        /* limitation of cswift with values not a multiple of 32                */
-        /************************************************************************/
-
-        while(num >= sizeof(buf32))
-        {
-                largenum.value = buf;
-                largenum.nbytes = sizeof(buf32);
-                /* tell CryptoSwift how many bytes we want and where we want it.
-                 * Note: - CryptoSwift cannot do more than 4096 bytes at a time.
-                 *       - CryptoSwift can only do multiple of 32-bits. */
-                swrc = p_CSwift_SimpleRequest(hac, SW_CMD_RAND, NULL, 0, &largenum, 1);
-                if (swrc != SW_OK)
-                {
-                        char tmpbuf[20];
-                        CSWIFTerr(CSWIFT_F_CSWIFT_CTRL, CSWIFT_R_REQUEST_FAILED);
-                        sprintf(tmpbuf, "%ld", swrc);
-                        ERR_add_error_data(2, "CryptoSwift error number is ", tmpbuf);
-                        goto err;
-                }
-                buf += sizeof(buf32);
-                num -= sizeof(buf32);
-        }
-        if(num)
-        {
-                largenum.nbytes = sizeof(buf32);
-                largenum.value = buf32;
-                swrc = p_CSwift_SimpleRequest(hac, SW_CMD_RAND, NULL, 0, &largenum, 1);
-                if (swrc != SW_OK)
-                {
-                        char tmpbuf[20];
-                        CSWIFTerr(CSWIFT_F_CSWIFT_CTRL, CSWIFT_R_REQUEST_FAILED);
-                        sprintf(tmpbuf, "%ld", swrc);
-                        ERR_add_error_data(2, "CryptoSwift error number is ", tmpbuf);
-                        goto err;
-                }
-                memcpy(buf, largenum.value, num);
-        }
-
-        to_return = 1;  /* success */
-err:
-        if (acquired)
-                release_context(hac);
-
-        return to_return;
-}
-
-static int cswift_rand_status(void)
-{
-        return 1;
-}
-
-
-/* This stuff is needed if this ENGINE is being compiled into a self-contained
- * shared-library. */
-#ifdef ENGINE_DYNAMIC_SUPPORT
-static int bind_fn(ENGINE *e, const char *id)
-        {
-        if(id && (strcmp(id, engine_cswift_id) != 0))
-                return 0;
-        if(!bind_helper(e))
-                return 0;
-        return 1;
-        }       
-IMPLEMENT_DYNAMIC_CHECK_FN()
-IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
-#endif /* ENGINE_DYNAMIC_SUPPORT */
-
-#endif /* !OPENSSL_NO_HW_CSWIFT */
-#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libcrypto/engine/hw_cswift_err.c b/src/lib/libcrypto/engine/hw_cswift_err.c
deleted file mode 100644
index 684f53bf27..0000000000
--- a/src/lib/libcrypto/engine/hw_cswift_err.c
+++ /dev/null
@@ -1,149 +0,0 @@
-/* hw_cswift_err.c */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-/* NOTE: this file was auto generated by the mkerr.pl script: any changes
- * made to it will be overwritten when the script next updates this file,
- * only reason strings will be preserved.
- */
-
-#include <stdio.h>
-#include <openssl/err.h>
-#include "hw_cswift_err.h"
-
-/* BEGIN ERROR CODES */
-#ifndef OPENSSL_NO_ERR
-static ERR_STRING_DATA CSWIFT_str_functs[]=
-        {
-{ERR_PACK(0,CSWIFT_F_CSWIFT_CTRL,0),    "CSWIFT_CTRL"},
-{ERR_PACK(0,CSWIFT_F_CSWIFT_DSA_SIGN,0),        "CSWIFT_DSA_SIGN"},
-{ERR_PACK(0,CSWIFT_F_CSWIFT_DSA_VERIFY,0),      "CSWIFT_DSA_VERIFY"},
-{ERR_PACK(0,CSWIFT_F_CSWIFT_FINISH,0),  "CSWIFT_FINISH"},
-{ERR_PACK(0,CSWIFT_F_CSWIFT_INIT,0),    "CSWIFT_INIT"},
-{ERR_PACK(0,CSWIFT_F_CSWIFT_MOD_EXP,0), "CSWIFT_MOD_EXP"},
-{ERR_PACK(0,CSWIFT_F_CSWIFT_MOD_EXP_CRT,0),     "CSWIFT_MOD_EXP_CRT"},
-{ERR_PACK(0,CSWIFT_F_CSWIFT_RSA_MOD_EXP,0),     "CSWIFT_RSA_MOD_EXP"},
-{0,NULL}
-        };
-
-static ERR_STRING_DATA CSWIFT_str_reasons[]=
-        {
-{CSWIFT_R_ALREADY_LOADED                 ,"already loaded"},
-{CSWIFT_R_BAD_KEY_SIZE                   ,"bad key size"},
-{CSWIFT_R_BN_CTX_FULL                    ,"bn ctx full"},
-{CSWIFT_R_BN_EXPAND_FAIL                 ,"bn expand fail"},
-{CSWIFT_R_CTRL_COMMAND_NOT_IMPLEMENTED   ,"ctrl command not implemented"},
-{CSWIFT_R_MISSING_KEY_COMPONENTS         ,"missing key components"},
-{CSWIFT_R_NOT_LOADED                     ,"not loaded"},
-{CSWIFT_R_REQUEST_FAILED                 ,"request failed"},
-{CSWIFT_R_UNIT_FAILURE                   ,"unit failure"},
-{0,NULL}
-        };
-
-#endif
-
-#ifdef CSWIFT_LIB_NAME
-static ERR_STRING_DATA CSWIFT_lib_name[]=
-        {
-{0      ,CSWIFT_LIB_NAME},
-{0,NULL}
-        };
-#endif
-
-
-static int CSWIFT_lib_error_code=0;
-static int CSWIFT_error_init=1;
-
-static void ERR_load_CSWIFT_strings(void)
-        {
-        if (CSWIFT_lib_error_code == 0)
-                CSWIFT_lib_error_code=ERR_get_next_error_library();
-
-        if (CSWIFT_error_init)
-                {
-                CSWIFT_error_init=0;
-#ifndef OPENSSL_NO_ERR
-                ERR_load_strings(CSWIFT_lib_error_code,CSWIFT_str_functs);
-                ERR_load_strings(CSWIFT_lib_error_code,CSWIFT_str_reasons);
-#endif
-
-#ifdef CSWIFT_LIB_NAME
-                CSWIFT_lib_name->error = ERR_PACK(CSWIFT_lib_error_code,0,0);
-                ERR_load_strings(0,CSWIFT_lib_name);
-#endif
-                }
-        }
-
-static void ERR_unload_CSWIFT_strings(void)
-        {
-        if (CSWIFT_error_init == 0)
-                {
-#ifndef OPENSSL_NO_ERR
-                ERR_unload_strings(CSWIFT_lib_error_code,CSWIFT_str_functs);
-                ERR_unload_strings(CSWIFT_lib_error_code,CSWIFT_str_reasons);
-#endif
-
-#ifdef CSWIFT_LIB_NAME
-                ERR_unload_strings(0,CSWIFT_lib_name);
-#endif
-                CSWIFT_error_init=1;
-                }
-        }
-
-static void ERR_CSWIFT_error(int function, int reason, char *file, int line)
-        {
-        if (CSWIFT_lib_error_code == 0)
-                CSWIFT_lib_error_code=ERR_get_next_error_library();
-        ERR_PUT_error(CSWIFT_lib_error_code,function,reason,file,line);
-        }
diff --git a/src/lib/libcrypto/engine/hw_ncipher.c b/src/lib/libcrypto/engine/hw_ncipher.c
deleted file mode 100644
index 0d1c6b8df0..0000000000
--- a/src/lib/libcrypto/engine/hw_ncipher.c
+++ /dev/null
@@ -1,1388 +0,0 @@
-/* crypto/engine/hw_ncipher.c -*- mode: C; c-file-style: "eay" -*- */
-/* Written by Richard Levitte (richard@levitte.org), Geoff Thorpe
- * (geoff@geoffthorpe.net) and Dr Stephen N Henson (shenson@bigfoot.com)
- * for the OpenSSL project 2000.
- */
-/* ====================================================================
- * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <string.h>
-#include "cryptlib.h"
-#include <openssl/crypto.h>
-#include <openssl/pem.h>
-#include <openssl/dso.h>
-#include <openssl/engine.h>
-#include <openssl/ui.h>
-
-#ifndef OPENSSL_NO_HW
-#ifndef OPENSSL_NO_HW_NCIPHER
-
-/* Attribution notice: nCipher have said several times that it's OK for
- * us to implement a general interface to their boxes, and recently declared
- * their HWCryptoHook to be public, and therefore available for us to use.
- * Thanks, nCipher.
- *
- * The hwcryptohook.h included here is from May 2000.
- * [Richard Levitte]
- */
-#ifdef FLAT_INC
-#include "hwcryptohook.h"
-#else
-#include "vendor_defns/hwcryptohook.h"
-#endif
-
-#define HWCRHK_LIB_NAME "hwcrhk engine"
-#include "hw_ncipher_err.c"
-
-static int hwcrhk_destroy(ENGINE *e);
-static int hwcrhk_init(ENGINE *e);
-static int hwcrhk_finish(ENGINE *e);
-static int hwcrhk_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)()); 
-
-/* Functions to handle mutexes if have dynamic locks */
-static int hwcrhk_mutex_init(HWCryptoHook_Mutex*, HWCryptoHook_CallerContext*);
-static int hwcrhk_mutex_lock(HWCryptoHook_Mutex*);
-static void hwcrhk_mutex_unlock(HWCryptoHook_Mutex*);
-static void hwcrhk_mutex_destroy(HWCryptoHook_Mutex*);
-#if 1 /* This is a HACK which will disappear in 0.9.8 */
-/* Functions to handle mutexes if only have static locks */
-static int hwcrhk_static_mutex_init(HWCryptoHook_Mutex *m,
-                                    HWCryptoHook_CallerContext *c);
-static int hwcrhk_static_mutex_lock(HWCryptoHook_Mutex *m);
-static void hwcrhk_static_mutex_unlock(HWCryptoHook_Mutex *m);
-static void hwcrhk_static_mutex_destroy(HWCryptoHook_Mutex *m);
-#endif
-
-/* BIGNUM stuff */
-static int hwcrhk_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx);
-
-#ifndef OPENSSL_NO_RSA
-/* RSA stuff */
-static int hwcrhk_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa);
-#endif
-/* This function is aliased to mod_exp (with the mont stuff dropped). */
-static int hwcrhk_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
-
-#ifndef OPENSSL_NO_DH
-/* DH stuff */
-/* This function is alised to mod_exp (with the DH and mont dropped). */
-static int hwcrhk_mod_exp_dh(const DH *dh, BIGNUM *r,
-        const BIGNUM *a, const BIGNUM *p,
-        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
-#endif
-
-/* RAND stuff */
-static int hwcrhk_rand_bytes(unsigned char *buf, int num);
-static int hwcrhk_rand_status(void);
-
-/* KM stuff */
-static EVP_PKEY *hwcrhk_load_privkey(ENGINE *eng, const char *key_id,
-        UI_METHOD *ui_method, void *callback_data);
-static EVP_PKEY *hwcrhk_load_pubkey(ENGINE *eng, const char *key_id,
-        UI_METHOD *ui_method, void *callback_data);
-static void hwcrhk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
-        int ind,long argl, void *argp);
-
-/* Interaction stuff */
-static int hwcrhk_insert_card(const char *prompt_info,
-        const char *wrong_info,
-        HWCryptoHook_PassphraseContext *ppctx,
-        HWCryptoHook_CallerContext *cactx);
-static int hwcrhk_get_pass(const char *prompt_info,
-        int *len_io, char *buf,
-        HWCryptoHook_PassphraseContext *ppctx,
-        HWCryptoHook_CallerContext *cactx);
-static void hwcrhk_log_message(void *logstr, const char *message);
-
-/* The definitions for control commands specific to this engine */
-#define HWCRHK_CMD_SO_PATH              ENGINE_CMD_BASE
-#define HWCRHK_CMD_FORK_CHECK           (ENGINE_CMD_BASE + 1)
-#define HWCRHK_CMD_THREAD_LOCKING       (ENGINE_CMD_BASE + 2)
-#define HWCRHK_CMD_SET_USER_INTERFACE   (ENGINE_CMD_BASE + 3)
-#define HWCRHK_CMD_SET_CALLBACK_DATA    (ENGINE_CMD_BASE + 4)
-static const ENGINE_CMD_DEFN hwcrhk_cmd_defns[] = {
-        {HWCRHK_CMD_SO_PATH,
-                "SO_PATH",
-                "Specifies the path to the 'hwcrhk' shared library",
-                ENGINE_CMD_FLAG_STRING},
-        {HWCRHK_CMD_FORK_CHECK,
-                "FORK_CHECK",
-                "Turns fork() checking on or off (boolean)",
-                ENGINE_CMD_FLAG_NUMERIC},
-        {HWCRHK_CMD_THREAD_LOCKING,
-                "THREAD_LOCKING",
-                "Turns thread-safe locking on or off (boolean)",
-                ENGINE_CMD_FLAG_NUMERIC},
-        {HWCRHK_CMD_SET_USER_INTERFACE,
-                "SET_USER_INTERFACE",
-                "Set the global user interface (internal)",
-                ENGINE_CMD_FLAG_INTERNAL},
-        {HWCRHK_CMD_SET_CALLBACK_DATA,
-                "SET_CALLBACK_DATA",
-                "Set the global user interface extra data (internal)",
-                ENGINE_CMD_FLAG_INTERNAL},
-        {0, NULL, NULL, 0}
-        };
-
-#ifndef OPENSSL_NO_RSA
-/* Our internal RSA_METHOD that we provide pointers to */
-static RSA_METHOD hwcrhk_rsa =
-        {
-        "nCipher RSA method",
-        NULL,
-        NULL,
-        NULL,
-        NULL,
-        hwcrhk_rsa_mod_exp,
-        hwcrhk_mod_exp_mont,
-        NULL,
-        NULL,
-        0,
-        NULL,
-        NULL,
-        NULL
-        };
-#endif
-
-#ifndef OPENSSL_NO_DH
-/* Our internal DH_METHOD that we provide pointers to */
-static DH_METHOD hwcrhk_dh =
-        {
-        "nCipher DH method",
-        NULL,
-        NULL,
-        hwcrhk_mod_exp_dh,
-        NULL,
-        NULL,
-        0,
-        NULL
-        };
-#endif
-
-static RAND_METHOD hwcrhk_rand =
-        {
-        /* "nCipher RAND method", */
-        NULL,
-        hwcrhk_rand_bytes,
-        NULL,
-        NULL,
-        hwcrhk_rand_bytes,
-        hwcrhk_rand_status,
-        };
-
-/* Constants used when creating the ENGINE */
-static const char *engine_hwcrhk_id = "chil";
-static const char *engine_hwcrhk_name = "nCipher hardware engine support";
-
-/* Internal stuff for HWCryptoHook */
-
-/* Some structures needed for proper use of thread locks */
-/* hwcryptohook.h has some typedefs that turn struct HWCryptoHook_MutexValue
-   into HWCryptoHook_Mutex */
-struct HWCryptoHook_MutexValue
-        {
-        int lockid;
-        };
-
-/* hwcryptohook.h has some typedefs that turn
-   struct HWCryptoHook_PassphraseContextValue
-   into HWCryptoHook_PassphraseContext */
-struct HWCryptoHook_PassphraseContextValue
-        {
-        UI_METHOD *ui_method;
-        void *callback_data;
-        };
-
-/* hwcryptohook.h has some typedefs that turn
-   struct HWCryptoHook_CallerContextValue
-   into HWCryptoHook_CallerContext */
-struct HWCryptoHook_CallerContextValue
-        {
-        pem_password_cb *password_callback; /* Deprecated!  Only present for
-                                               backward compatibility! */
-        UI_METHOD *ui_method;
-        void *callback_data;
-        };
-
-/* The MPI structure in HWCryptoHook is pretty compatible with OpenSSL
-   BIGNUM's, so lets define a couple of conversion macros */
-#define BN2MPI(mp, bn) \
-    {mp.size = bn->top * sizeof(BN_ULONG); mp.buf = (unsigned char *)bn->d;}
-#define MPI2BN(bn, mp) \
-    {mp.size = bn->dmax * sizeof(BN_ULONG); mp.buf = (unsigned char *)bn->d;}
-
-static BIO *logstream = NULL;
-static int disable_mutex_callbacks = 0;
-
-/* One might wonder why these are needed, since one can pass down at least
-   a UI_METHOD and a pointer to callback data to the key-loading functions.
-   The thing is that the ModExp and RSAImmed functions can load keys as well,
-   if the data they get is in a special, nCipher-defined format (hint: if you
-   look at the private exponent of the RSA data as a string, you'll see this
-   string: "nCipher KM tool key id", followed by some bytes, followed a key
-   identity string, followed by more bytes.  This happens when you use "embed"
-   keys instead of "hwcrhk" keys).  Unfortunately, those functions do not take
-   any passphrase or caller context, and our functions can't really take any
-   callback data either.  Still, the "insert_card" and "get_passphrase"
-   callbacks may be called down the line, and will need to know what user
-   interface callbacks to call, and having callback data from the application
-   may be a nice thing as well, so we need to keep track of that globally. */
-static HWCryptoHook_CallerContext password_context = { NULL, NULL, NULL };
-
-/* Stuff to pass to the HWCryptoHook library */
-static HWCryptoHook_InitInfo hwcrhk_globals = {
-        HWCryptoHook_InitFlags_SimpleForkCheck, /* Flags */
-        &logstream,             /* logstream */
-        sizeof(BN_ULONG),       /* limbsize */
-        0,                      /* mslimb first: false for BNs */
-        -1,                     /* msbyte first: use native */
-        0,                      /* Max mutexes, 0 = no small limit */
-        0,                      /* Max simultaneous, 0 = default */
-
-        /* The next few are mutex stuff: we write wrapper functions
-           around the OS mutex functions.  We initialise them to 0
-           here, and change that to actual function pointers in hwcrhk_init()
-           if dynamic locks are supported (that is, if the application
-           programmer has made sure of setting up callbacks bafore starting
-           this engine) *and* if disable_mutex_callbacks hasn't been set by
-           a call to ENGINE_ctrl(ENGINE_CTRL_CHIL_NO_LOCKING). */
-        sizeof(HWCryptoHook_Mutex),
-        0,
-        0,
-        0,
-        0,
-
-        /* The next few are condvar stuff: we write wrapper functions
-           round the OS functions.  Currently not implemented and not
-           and absolute necessity even in threaded programs, therefore
-           0'ed.  Will hopefully be implemented some day, since it
-           enhances the efficiency of HWCryptoHook.  */
-        0, /* sizeof(HWCryptoHook_CondVar), */
-        0, /* hwcrhk_cv_init, */
-        0, /* hwcrhk_cv_wait, */
-        0, /* hwcrhk_cv_signal, */
-        0, /* hwcrhk_cv_broadcast, */
-        0, /* hwcrhk_cv_destroy, */
-
-        hwcrhk_get_pass,        /* pass phrase */
-        hwcrhk_insert_card,     /* insert a card */
-        hwcrhk_log_message      /* Log message */
-};
-
-
-/* Now, to our own code */
-
-/* This internal function is used by ENGINE_ncipher() and possibly by the
- * "dynamic" ENGINE support too */
-static int bind_helper(ENGINE *e)
-        {
-#ifndef OPENSSL_NO_RSA
-        const RSA_METHOD *meth1;
-#endif
-#ifndef OPENSSL_NO_DH
-        const DH_METHOD *meth2;
-#endif
-        if(!ENGINE_set_id(e, engine_hwcrhk_id) ||
-                        !ENGINE_set_name(e, engine_hwcrhk_name) ||
-#ifndef OPENSSL_NO_RSA
-                        !ENGINE_set_RSA(e, &hwcrhk_rsa) ||
-#endif
-#ifndef OPENSSL_NO_DH
-                        !ENGINE_set_DH(e, &hwcrhk_dh) ||
-#endif
-                        !ENGINE_set_RAND(e, &hwcrhk_rand) ||
-                        !ENGINE_set_destroy_function(e, hwcrhk_destroy) ||
-                        !ENGINE_set_init_function(e, hwcrhk_init) ||
-                        !ENGINE_set_finish_function(e, hwcrhk_finish) ||
-                        !ENGINE_set_ctrl_function(e, hwcrhk_ctrl) ||
-                        !ENGINE_set_load_privkey_function(e, hwcrhk_load_privkey) ||
-                        !ENGINE_set_load_pubkey_function(e, hwcrhk_load_pubkey) ||
-                        !ENGINE_set_cmd_defns(e, hwcrhk_cmd_defns))
-                return 0;
-
-#ifndef OPENSSL_NO_RSA
-        /* We know that the "PKCS1_SSLeay()" functions hook properly
-         * to the cswift-specific mod_exp and mod_exp_crt so we use
-         * those functions. NB: We don't use ENGINE_openssl() or
-         * anything "more generic" because something like the RSAref
-         * code may not hook properly, and if you own one of these
-         * cards then you have the right to do RSA operations on it
-         * anyway! */ 
-        meth1 = RSA_PKCS1_SSLeay();
-        hwcrhk_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
-        hwcrhk_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
-        hwcrhk_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
-        hwcrhk_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
-#endif
-
-#ifndef OPENSSL_NO_DH
-        /* Much the same for Diffie-Hellman */
-        meth2 = DH_OpenSSL();
-        hwcrhk_dh.generate_key = meth2->generate_key;
-        hwcrhk_dh.compute_key = meth2->compute_key;
-#endif
-
-        /* Ensure the hwcrhk error handling is set up */
-        ERR_load_HWCRHK_strings();
-        return 1;
-        }
-
-#ifndef ENGINE_DYNAMIC_SUPPORT
-static ENGINE *engine_ncipher(void)
-        {
-        ENGINE *ret = ENGINE_new();
-        if(!ret)
-                return NULL;
-        if(!bind_helper(ret))
-                {
-                ENGINE_free(ret);
-                return NULL;
-                }
-        return ret;
-        }
-
-void ENGINE_load_chil(void)
-        {
-        /* Copied from eng_[openssl|dyn].c */
-        ENGINE *toadd = engine_ncipher();
-        if(!toadd) return;
-        ENGINE_add(toadd);
-        ENGINE_free(toadd);
-        ERR_clear_error();
-        }
-#endif
-
-/* This is a process-global DSO handle used for loading and unloading
- * the HWCryptoHook library. NB: This is only set (or unset) during an
- * init() or finish() call (reference counts permitting) and they're
- * operating with global locks, so this should be thread-safe
- * implicitly. */
-static DSO *hwcrhk_dso = NULL;
-static HWCryptoHook_ContextHandle hwcrhk_context = 0;
-#ifndef OPENSSL_NO_RSA
-static int hndidx_rsa = -1;    /* Index for KM handle.  Not really used yet. */
-#endif
-
-/* These are the function pointers that are (un)set when the library has
- * successfully (un)loaded. */
-static HWCryptoHook_Init_t *p_hwcrhk_Init = NULL;
-static HWCryptoHook_Finish_t *p_hwcrhk_Finish = NULL;
-static HWCryptoHook_ModExp_t *p_hwcrhk_ModExp = NULL;
-#ifndef OPENSSL_NO_RSA
-static HWCryptoHook_RSA_t *p_hwcrhk_RSA = NULL;
-#endif
-static HWCryptoHook_RandomBytes_t *p_hwcrhk_RandomBytes = NULL;
-#ifndef OPENSSL_NO_RSA
-static HWCryptoHook_RSALoadKey_t *p_hwcrhk_RSALoadKey = NULL;
-static HWCryptoHook_RSAGetPublicKey_t *p_hwcrhk_RSAGetPublicKey = NULL;
-static HWCryptoHook_RSAUnloadKey_t *p_hwcrhk_RSAUnloadKey = NULL;
-#endif
-static HWCryptoHook_ModExpCRT_t *p_hwcrhk_ModExpCRT = NULL;
-
-/* Used in the DSO operations. */
-static const char *HWCRHK_LIBNAME = NULL;
-static void free_HWCRHK_LIBNAME(void)
-        {
-        if(HWCRHK_LIBNAME)
-                OPENSSL_free((void*)HWCRHK_LIBNAME);
-        HWCRHK_LIBNAME = NULL;
-        }
-static const char *get_HWCRHK_LIBNAME(void)
-        {
-        if(HWCRHK_LIBNAME)
-                return HWCRHK_LIBNAME;
-        return "nfhwcrhk";
-        }
-static long set_HWCRHK_LIBNAME(const char *name)
-        {
-        free_HWCRHK_LIBNAME();
-        return (((HWCRHK_LIBNAME = BUF_strdup(name)) != NULL) ? 1 : 0);
-        }
-static const char *n_hwcrhk_Init = "HWCryptoHook_Init";
-static const char *n_hwcrhk_Finish = "HWCryptoHook_Finish";
-static const char *n_hwcrhk_ModExp = "HWCryptoHook_ModExp";
-#ifndef OPENSSL_NO_RSA
-static const char *n_hwcrhk_RSA = "HWCryptoHook_RSA";
-#endif
-static const char *n_hwcrhk_RandomBytes = "HWCryptoHook_RandomBytes";
-#ifndef OPENSSL_NO_RSA
-static const char *n_hwcrhk_RSALoadKey = "HWCryptoHook_RSALoadKey";
-static const char *n_hwcrhk_RSAGetPublicKey = "HWCryptoHook_RSAGetPublicKey";
-static const char *n_hwcrhk_RSAUnloadKey = "HWCryptoHook_RSAUnloadKey";
-#endif
-static const char *n_hwcrhk_ModExpCRT = "HWCryptoHook_ModExpCRT";
-
-/* HWCryptoHook library functions and mechanics - these are used by the
- * higher-level functions further down. NB: As and where there's no
- * error checking, take a look lower down where these functions are
- * called, the checking and error handling is probably down there. */
-
-/* utility function to obtain a context */
-static int get_context(HWCryptoHook_ContextHandle *hac,
-        HWCryptoHook_CallerContext *cac)
-        {
-        char tempbuf[1024];
-        HWCryptoHook_ErrMsgBuf rmsg;
-
-        rmsg.buf = tempbuf;
-        rmsg.size = sizeof(tempbuf);
-
-        *hac = p_hwcrhk_Init(&hwcrhk_globals, sizeof(hwcrhk_globals), &rmsg,
-                cac);
-        if (!*hac)
-                return 0;
-        return 1;
-        }
- 
-/* similarly to release one. */
-static void release_context(HWCryptoHook_ContextHandle hac)
-        {
-        p_hwcrhk_Finish(hac);
-        }
-
-/* Destructor (complements the "ENGINE_ncipher()" constructor) */
-static int hwcrhk_destroy(ENGINE *e)
-        {
-        free_HWCRHK_LIBNAME();
-        ERR_unload_HWCRHK_strings();
-        return 1;
-        }
-
-/* (de)initialisation functions. */
-static int hwcrhk_init(ENGINE *e)
-        {
-        HWCryptoHook_Init_t *p1;
-        HWCryptoHook_Finish_t *p2;
-        HWCryptoHook_ModExp_t *p3;
-#ifndef OPENSSL_NO_RSA
-        HWCryptoHook_RSA_t *p4;
-        HWCryptoHook_RSALoadKey_t *p5;
-        HWCryptoHook_RSAGetPublicKey_t *p6;
-        HWCryptoHook_RSAUnloadKey_t *p7;
-#endif
-        HWCryptoHook_RandomBytes_t *p8;
-        HWCryptoHook_ModExpCRT_t *p9;
-
-        if(hwcrhk_dso != NULL)
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_INIT,HWCRHK_R_ALREADY_LOADED);
-                goto err;
-                }
-        /* Attempt to load libnfhwcrhk.so/nfhwcrhk.dll/whatever. */
-        hwcrhk_dso = DSO_load(NULL, get_HWCRHK_LIBNAME(), NULL, 0);
-        if(hwcrhk_dso == NULL)
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_INIT,HWCRHK_R_DSO_FAILURE);
-                goto err;
-                }
-        if(!(p1 = (HWCryptoHook_Init_t *)
-                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_Init)) ||
-                !(p2 = (HWCryptoHook_Finish_t *)
-                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_Finish)) ||
-                !(p3 = (HWCryptoHook_ModExp_t *)
-                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_ModExp)) ||
-#ifndef OPENSSL_NO_RSA
-                !(p4 = (HWCryptoHook_RSA_t *)
-                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_RSA)) ||
-                !(p5 = (HWCryptoHook_RSALoadKey_t *)
-                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_RSALoadKey)) ||
-                !(p6 = (HWCryptoHook_RSAGetPublicKey_t *)
-                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_RSAGetPublicKey)) ||
-                !(p7 = (HWCryptoHook_RSAUnloadKey_t *)
-                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_RSAUnloadKey)) ||
-#endif
-                !(p8 = (HWCryptoHook_RandomBytes_t *)
-                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_RandomBytes)) ||
-                !(p9 = (HWCryptoHook_ModExpCRT_t *)
-                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_ModExpCRT)))
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_INIT,HWCRHK_R_DSO_FAILURE);
-                goto err;
-                }
-        /* Copy the pointers */
-        p_hwcrhk_Init = p1;
-        p_hwcrhk_Finish = p2;
-        p_hwcrhk_ModExp = p3;
-#ifndef OPENSSL_NO_RSA
-        p_hwcrhk_RSA = p4;
-        p_hwcrhk_RSALoadKey = p5;
-        p_hwcrhk_RSAGetPublicKey = p6;
-        p_hwcrhk_RSAUnloadKey = p7;
-#endif
-        p_hwcrhk_RandomBytes = p8;
-        p_hwcrhk_ModExpCRT = p9;
-
-        /* Check if the application decided to support dynamic locks,
-           and if it does, use them. */
-        if (disable_mutex_callbacks == 0)
-                {
-                if (CRYPTO_get_dynlock_create_callback() != NULL &&
-                        CRYPTO_get_dynlock_lock_callback() != NULL &&
-                        CRYPTO_get_dynlock_destroy_callback() != NULL)
-                        {
-                        hwcrhk_globals.mutex_init = hwcrhk_mutex_init;
-                        hwcrhk_globals.mutex_acquire = hwcrhk_mutex_lock;
-                        hwcrhk_globals.mutex_release = hwcrhk_mutex_unlock;
-                        hwcrhk_globals.mutex_destroy = hwcrhk_mutex_destroy;
-                        }
-                else if (CRYPTO_get_locking_callback() != NULL)
-                        {
-                        HWCRHKerr(HWCRHK_F_HWCRHK_INIT,HWCRHK_R_DYNAMIC_LOCKING_MISSING);
-                        ERR_add_error_data(1,"You HAVE to add dynamic locking callbacks via CRYPTO_set_dynlock_{create,lock,destroy}_callback()");
-#if 1 /* This is a HACK which will disappear in 0.9.8 */
-                        hwcrhk_globals.maxmutexes    = 1; /* Only have one lock */
-                        hwcrhk_globals.mutex_init    = hwcrhk_static_mutex_init;
-                        hwcrhk_globals.mutex_acquire = hwcrhk_static_mutex_lock;
-                        hwcrhk_globals.mutex_release = hwcrhk_static_mutex_unlock;
-                        hwcrhk_globals.mutex_destroy = hwcrhk_static_mutex_destroy;
-#else
-                        goto err;
-#endif
-                        }
-                }
-
-        /* Try and get a context - if not, we may have a DSO but no
-         * accelerator! */
-        if(!get_context(&hwcrhk_context, &password_context))
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_INIT,HWCRHK_R_UNIT_FAILURE);
-                goto err;
-                }
-        /* Everything's fine. */
-#ifndef OPENSSL_NO_RSA
-        if (hndidx_rsa == -1)
-                hndidx_rsa = RSA_get_ex_new_index(0,
-                        "nFast HWCryptoHook RSA key handle",
-                        NULL, NULL, hwcrhk_ex_free);
-#endif
-        return 1;
-err:
-        if(hwcrhk_dso)
-                DSO_free(hwcrhk_dso);
-        hwcrhk_dso = NULL;
-        p_hwcrhk_Init = NULL;
-        p_hwcrhk_Finish = NULL;
-        p_hwcrhk_ModExp = NULL;
-#ifndef OPENSSL_NO_RSA
-        p_hwcrhk_RSA = NULL;
-        p_hwcrhk_RSALoadKey = NULL;
-        p_hwcrhk_RSAGetPublicKey = NULL;
-        p_hwcrhk_RSAUnloadKey = NULL;
-#endif
-        p_hwcrhk_ModExpCRT = NULL;
-        p_hwcrhk_RandomBytes = NULL;
-        return 0;
-        }
-
-static int hwcrhk_finish(ENGINE *e)
-        {
-        int to_return = 1;
-        free_HWCRHK_LIBNAME();
-        if(hwcrhk_dso == NULL)
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_FINISH,HWCRHK_R_NOT_LOADED);
-                to_return = 0;
-                goto err;
-                }
-        release_context(hwcrhk_context);
-        if(!DSO_free(hwcrhk_dso))
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_FINISH,HWCRHK_R_DSO_FAILURE);
-                to_return = 0;
-                goto err;
-                }
- err:
-        if (logstream)
-                BIO_free(logstream);
-        hwcrhk_dso = NULL;
-        p_hwcrhk_Init = NULL;
-        p_hwcrhk_Finish = NULL;
-        p_hwcrhk_ModExp = NULL;
-#ifndef OPENSSL_NO_RSA
-        p_hwcrhk_RSA = NULL;
-        p_hwcrhk_RSALoadKey = NULL;
-        p_hwcrhk_RSAGetPublicKey = NULL;
-        p_hwcrhk_RSAUnloadKey = NULL;
-#endif
-        p_hwcrhk_ModExpCRT = NULL;
-        p_hwcrhk_RandomBytes = NULL;
-        return to_return;
-        }
-
-static int hwcrhk_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
-        {
-        int to_return = 1;
-
-        switch(cmd)
-                {
-        case HWCRHK_CMD_SO_PATH:
-                if(hwcrhk_dso)
-                        {
-                        HWCRHKerr(HWCRHK_F_HWCRHK_CTRL,HWCRHK_R_ALREADY_LOADED);
-                        return 0;
-                        }
-                if(p == NULL)
-                        {
-                        HWCRHKerr(HWCRHK_F_HWCRHK_CTRL,ERR_R_PASSED_NULL_PARAMETER);
-                        return 0;
-                        }
-                return set_HWCRHK_LIBNAME((const char *)p);
-        case ENGINE_CTRL_SET_LOGSTREAM:
-                {
-                BIO *bio = (BIO *)p;
-
-                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-                if (logstream)
-                        {
-                        BIO_free(logstream);
-                        logstream = NULL;
-                        }
-                if (CRYPTO_add(&bio->references,1,CRYPTO_LOCK_BIO) > 1)
-                        logstream = bio;
-                else
-                        HWCRHKerr(HWCRHK_F_HWCRHK_CTRL,HWCRHK_R_BIO_WAS_FREED);
-                }
-                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-                break;
-        case ENGINE_CTRL_SET_PASSWORD_CALLBACK:
-                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-                password_context.password_callback = (pem_password_cb *)f;
-                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-                break;
-        case ENGINE_CTRL_SET_USER_INTERFACE:
-        case HWCRHK_CMD_SET_USER_INTERFACE:
-                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-                password_context.ui_method = (UI_METHOD *)p;
-                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-                break;
-        case ENGINE_CTRL_SET_CALLBACK_DATA:
-        case HWCRHK_CMD_SET_CALLBACK_DATA:
-                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-                password_context.callback_data = p;
-                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-                break;
-        /* this enables or disables the "SimpleForkCheck" flag used in the
-         * initialisation structure. */
-        case ENGINE_CTRL_CHIL_SET_FORKCHECK:
-        case HWCRHK_CMD_FORK_CHECK:
-                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-                if(i)
-                        hwcrhk_globals.flags |=
-                                HWCryptoHook_InitFlags_SimpleForkCheck;
-                else
-                        hwcrhk_globals.flags &=
-                                ~HWCryptoHook_InitFlags_SimpleForkCheck;
-                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-                break;
-        /* This will prevent the initialisation function from "installing"
-         * the mutex-handling callbacks, even if they are available from
-         * within the library (or were provided to the library from the
-         * calling application). This is to remove any baggage for
-         * applications not using multithreading. */
-        case ENGINE_CTRL_CHIL_NO_LOCKING:
-                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-                disable_mutex_callbacks = 1;
-                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-                break;
-        case HWCRHK_CMD_THREAD_LOCKING:
-                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-                disable_mutex_callbacks = ((i == 0) ? 0 : 1);
-                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-                break;
-
-        /* The command isn't understood by this engine */
-        default:
-                HWCRHKerr(HWCRHK_F_HWCRHK_CTRL,
-                        HWCRHK_R_CTRL_COMMAND_NOT_IMPLEMENTED);
-                to_return = 0;
-                break;
-                }
-
-        return to_return;
-        }
-
-static EVP_PKEY *hwcrhk_load_privkey(ENGINE *eng, const char *key_id,
-        UI_METHOD *ui_method, void *callback_data)
-        {
-#ifndef OPENSSL_NO_RSA
-        RSA *rtmp = NULL;
-#endif
-        EVP_PKEY *res = NULL;
-#ifndef OPENSSL_NO_RSA
-        HWCryptoHook_MPI e, n;
-        HWCryptoHook_RSAKeyHandle *hptr;
-#endif
-#if !defined(OPENSSL_NO_RSA)
-        char tempbuf[1024];
-        HWCryptoHook_ErrMsgBuf rmsg;
-#endif
-        HWCryptoHook_PassphraseContext ppctx;
-
-#if !defined(OPENSSL_NO_RSA)
-        rmsg.buf = tempbuf;
-        rmsg.size = sizeof(tempbuf);
-#endif
-
-        if(!hwcrhk_context)
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
-                        HWCRHK_R_NOT_INITIALISED);
-                goto err;
-                }
-#ifndef OPENSSL_NO_RSA
-        hptr = OPENSSL_malloc(sizeof(HWCryptoHook_RSAKeyHandle));
-        if (!hptr)
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
-                        ERR_R_MALLOC_FAILURE);
-                goto err;
-                }
-        ppctx.ui_method = ui_method;
-        ppctx.callback_data = callback_data;
-        if (p_hwcrhk_RSALoadKey(hwcrhk_context, key_id, hptr,
-                &rmsg, &ppctx))
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
-                        HWCRHK_R_CHIL_ERROR);
-                ERR_add_error_data(1,rmsg.buf);
-                goto err;
-                }
-        if (!*hptr)
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
-                        HWCRHK_R_NO_KEY);
-                goto err;
-                }
-#endif
-#ifndef OPENSSL_NO_RSA
-        rtmp = RSA_new_method(eng);
-        RSA_set_ex_data(rtmp, hndidx_rsa, (char *)hptr);
-        rtmp->e = BN_new();
-        rtmp->n = BN_new();
-        rtmp->flags |= RSA_FLAG_EXT_PKEY;
-        MPI2BN(rtmp->e, e);
-        MPI2BN(rtmp->n, n);
-        if (p_hwcrhk_RSAGetPublicKey(*hptr, &n, &e, &rmsg)
-                != HWCRYPTOHOOK_ERROR_MPISIZE)
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PUBKEY,HWCRHK_R_CHIL_ERROR);
-                ERR_add_error_data(1,rmsg.buf);
-                goto err;
-                }
-
-        bn_expand2(rtmp->e, e.size/sizeof(BN_ULONG));
-        bn_expand2(rtmp->n, n.size/sizeof(BN_ULONG));
-        MPI2BN(rtmp->e, e);
-        MPI2BN(rtmp->n, n);
-
-        if (p_hwcrhk_RSAGetPublicKey(*hptr, &n, &e, &rmsg))
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PUBKEY,
-                        HWCRHK_R_CHIL_ERROR);
-                ERR_add_error_data(1,rmsg.buf);
-                goto err;
-                }
-        rtmp->e->top = e.size / sizeof(BN_ULONG);
-        bn_fix_top(rtmp->e);
-        rtmp->n->top = n.size / sizeof(BN_ULONG);
-        bn_fix_top(rtmp->n);
-
-        res = EVP_PKEY_new();
-        EVP_PKEY_assign_RSA(res, rtmp);
-#endif
-
-        if (!res)
-                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PUBKEY,
-                        HWCRHK_R_PRIVATE_KEY_ALGORITHMS_DISABLED);
-
-        return res;
- err:
-        if (res)
-                EVP_PKEY_free(res);
-#ifndef OPENSSL_NO_RSA
-        if (rtmp)
-                RSA_free(rtmp);
-#endif
-        return NULL;
-        }
-
-static EVP_PKEY *hwcrhk_load_pubkey(ENGINE *eng, const char *key_id,
-        UI_METHOD *ui_method, void *callback_data)
-        {
-        EVP_PKEY *res = NULL;
-
-#ifndef OPENSSL_NO_RSA
-        res = hwcrhk_load_privkey(eng, key_id,
-                ui_method, callback_data);
-#endif
-
-        if (res)
-                switch(res->type)
-                        {
-#ifndef OPENSSL_NO_RSA
-                case EVP_PKEY_RSA:
-                        {
-                        RSA *rsa = NULL;
-
-                        CRYPTO_w_lock(CRYPTO_LOCK_EVP_PKEY);
-                        rsa = res->pkey.rsa;
-                        res->pkey.rsa = RSA_new();
-                        res->pkey.rsa->n = rsa->n;
-                        res->pkey.rsa->e = rsa->e;
-                        rsa->n = NULL;
-                        rsa->e = NULL;
-                        CRYPTO_w_unlock(CRYPTO_LOCK_EVP_PKEY);
-                        RSA_free(rsa);
-                        }
-                        break;
-#endif
-                default:
-                        HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PUBKEY,
-                                HWCRHK_R_CTRL_COMMAND_NOT_IMPLEMENTED);
-                        goto err;
-                        }
-
-        return res;
- err:
-        if (res)
-                EVP_PKEY_free(res);
-        return NULL;
-        }
-
-/* A little mod_exp */
-static int hwcrhk_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                        const BIGNUM *m, BN_CTX *ctx)
-        {
-        char tempbuf[1024];
-        HWCryptoHook_ErrMsgBuf rmsg;
-        /* Since HWCryptoHook_MPI is pretty compatible with BIGNUM's,
-           we use them directly, plus a little macro magic.  We only
-           thing we need to make sure of is that enough space is allocated. */
-        HWCryptoHook_MPI m_a, m_p, m_n, m_r;
-        int to_return, ret;
- 
-        to_return = 0; /* expect failure */
-        rmsg.buf = tempbuf;
-        rmsg.size = sizeof(tempbuf);
-
-        if(!hwcrhk_context)
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_MOD_EXP,HWCRHK_R_NOT_INITIALISED);
-                goto err;
-                }
-        /* Prepare the params */
-        bn_expand2(r, m->top);  /* Check for error !! */
-        BN2MPI(m_a, a);
-        BN2MPI(m_p, p);
-        BN2MPI(m_n, m);
-        MPI2BN(r, m_r);
-
-        /* Perform the operation */
-        ret = p_hwcrhk_ModExp(hwcrhk_context, m_a, m_p, m_n, &m_r, &rmsg);
-
-        /* Convert the response */
-        r->top = m_r.size / sizeof(BN_ULONG);
-        bn_fix_top(r);
-
-        if (ret < 0)
-                {
-                /* FIXME: When this error is returned, HWCryptoHook is
-                   telling us that falling back to software computation
-                   might be a good thing. */
-                if(ret == HWCRYPTOHOOK_ERROR_FALLBACK)
-                        {
-                        HWCRHKerr(HWCRHK_F_HWCRHK_MOD_EXP,HWCRHK_R_REQUEST_FALLBACK);
-                        }
-                else
-                        {
-                        HWCRHKerr(HWCRHK_F_HWCRHK_MOD_EXP,HWCRHK_R_REQUEST_FAILED);
-                        }
-                ERR_add_error_data(1,rmsg.buf);
-                goto err;
-                }
-
-        to_return = 1;
-err:
-        return to_return;
-        }
-
-#ifndef OPENSSL_NO_RSA 
-static int hwcrhk_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa)
-        {
-        char tempbuf[1024];
-        HWCryptoHook_ErrMsgBuf rmsg;
-        HWCryptoHook_RSAKeyHandle *hptr;
-        int to_return = 0, ret;
-
-        rmsg.buf = tempbuf;
-        rmsg.size = sizeof(tempbuf);
-
-        if(!hwcrhk_context)
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_MOD_EXP,HWCRHK_R_NOT_INITIALISED);
-                goto err;
-                }
-
-        /* This provides support for nForce keys.  Since that's opaque data
-           all we do is provide a handle to the proper key and let HWCryptoHook
-           take care of the rest. */
-        if ((hptr = (HWCryptoHook_RSAKeyHandle *) RSA_get_ex_data(rsa, hndidx_rsa))
-                != NULL)
-                {
-                HWCryptoHook_MPI m_a, m_r;
-
-                if(!rsa->n)
-                        {
-                        HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,
-                                HWCRHK_R_MISSING_KEY_COMPONENTS);
-                        goto err;
-                        }
-
-                /* Prepare the params */
-                bn_expand2(r, rsa->n->top); /* Check for error !! */
-                BN2MPI(m_a, I);
-                MPI2BN(r, m_r);
-
-                /* Perform the operation */
-                ret = p_hwcrhk_RSA(m_a, *hptr, &m_r, &rmsg);
-
-                /* Convert the response */
-                r->top = m_r.size / sizeof(BN_ULONG);
-                bn_fix_top(r);
-
-                if (ret < 0)
-                        {
-                        /* FIXME: When this error is returned, HWCryptoHook is
-                           telling us that falling back to software computation
-                           might be a good thing. */
-                        if(ret == HWCRYPTOHOOK_ERROR_FALLBACK)
-                                {
-                                HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,
-                                        HWCRHK_R_REQUEST_FALLBACK);
-                                }
-                        else
-                                {
-                                HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,
-                                        HWCRHK_R_REQUEST_FAILED);
-                                }
-                        ERR_add_error_data(1,rmsg.buf);
-                        goto err;
-                        }
-                }
-        else
-                {
-                HWCryptoHook_MPI m_a, m_p, m_q, m_dmp1, m_dmq1, m_iqmp, m_r;
-
-                if(!rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)
-                        {
-                        HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,
-                                HWCRHK_R_MISSING_KEY_COMPONENTS);
-                        goto err;
-                        }
-
-                /* Prepare the params */
-                bn_expand2(r, rsa->n->top); /* Check for error !! */
-                BN2MPI(m_a, I);
-                BN2MPI(m_p, rsa->p);
-                BN2MPI(m_q, rsa->q);
-                BN2MPI(m_dmp1, rsa->dmp1);
-                BN2MPI(m_dmq1, rsa->dmq1);
-                BN2MPI(m_iqmp, rsa->iqmp);
-                MPI2BN(r, m_r);
-
-                /* Perform the operation */
-                ret = p_hwcrhk_ModExpCRT(hwcrhk_context, m_a, m_p, m_q,
-                        m_dmp1, m_dmq1, m_iqmp, &m_r, &rmsg);
-
-                /* Convert the response */
-                r->top = m_r.size / sizeof(BN_ULONG);
-                bn_fix_top(r);
-
-                if (ret < 0)
-                        {
-                        /* FIXME: When this error is returned, HWCryptoHook is
-                           telling us that falling back to software computation
-                           might be a good thing. */
-                        if(ret == HWCRYPTOHOOK_ERROR_FALLBACK)
-                                {
-                                HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,
-                                        HWCRHK_R_REQUEST_FALLBACK);
-                                }
-                        else
-                                {
-                                HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,
-                                        HWCRHK_R_REQUEST_FAILED);
-                                }
-                        ERR_add_error_data(1,rmsg.buf);
-                        goto err;
-                        }
-                }
-        /* If we're here, we must be here with some semblance of success :-) */
-        to_return = 1;
-err:
-        return to_return;
-        }
-#endif
-
-/* This function is aliased to mod_exp (with the mont stuff dropped). */
-static int hwcrhk_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-        {
-        return hwcrhk_mod_exp(r, a, p, m, ctx);
-        }
-
-#ifndef OPENSSL_NO_DH
-/* This function is aliased to mod_exp (with the dh and mont dropped). */
-static int hwcrhk_mod_exp_dh(const DH *dh, BIGNUM *r,
-                const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-        {
-        return hwcrhk_mod_exp(r, a, p, m, ctx);
-        }
-#endif
-
-/* Random bytes are good */
-static int hwcrhk_rand_bytes(unsigned char *buf, int num)
-        {
-        char tempbuf[1024];
-        HWCryptoHook_ErrMsgBuf rmsg;
-        int to_return = 0; /* assume failure */
-        int ret;
-
-        rmsg.buf = tempbuf;
-        rmsg.size = sizeof(tempbuf);
-
-        if(!hwcrhk_context)
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_RAND_BYTES,HWCRHK_R_NOT_INITIALISED);
-                goto err;
-                }
-
-        ret = p_hwcrhk_RandomBytes(hwcrhk_context, buf, num, &rmsg);
-        if (ret < 0)
-                {
-                /* FIXME: When this error is returned, HWCryptoHook is
-                   telling us that falling back to software computation
-                   might be a good thing. */
-                if(ret == HWCRYPTOHOOK_ERROR_FALLBACK)
-                        {
-                        HWCRHKerr(HWCRHK_F_HWCRHK_RAND_BYTES,
-                                HWCRHK_R_REQUEST_FALLBACK);
-                        }
-                else
-                        {
-                        HWCRHKerr(HWCRHK_F_HWCRHK_RAND_BYTES,
-                                HWCRHK_R_REQUEST_FAILED);
-                        }
-                ERR_add_error_data(1,rmsg.buf);
-                goto err;
-                }
-        to_return = 1;
- err:
-        return to_return;
-        }
-
-static int hwcrhk_rand_status(void)
-        {
-        return 1;
-        }
-
-/* This cleans up an RSA KM key, called when ex_data is freed */
-
-static void hwcrhk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
-        int ind,long argl, void *argp)
-{
-        char tempbuf[1024];
-        HWCryptoHook_ErrMsgBuf rmsg;
-#ifndef OPENSSL_NO_RSA
-        HWCryptoHook_RSAKeyHandle *hptr;
-#endif
-#if !defined(OPENSSL_NO_RSA)
-        int ret;
-#endif
-
-        rmsg.buf = tempbuf;
-        rmsg.size = sizeof(tempbuf);
-
-#ifndef OPENSSL_NO_RSA
-        hptr = (HWCryptoHook_RSAKeyHandle *) item;
-        if(hptr)
-                {
-                ret = p_hwcrhk_RSAUnloadKey(*hptr, NULL);
-                OPENSSL_free(hptr);
-                }
-#endif
-}
-
-/* Mutex calls: since the HWCryptoHook model closely follows the POSIX model
- * these just wrap the POSIX functions and add some logging.
- */
-
-static int hwcrhk_mutex_init(HWCryptoHook_Mutex* mt,
-        HWCryptoHook_CallerContext *cactx)
-        {
-        mt->lockid = CRYPTO_get_new_dynlockid();
-        if (mt->lockid == 0)
-                return 1; /* failure */
-        return 0; /* success */
-        }
-
-static int hwcrhk_mutex_lock(HWCryptoHook_Mutex *mt)
-        {
-        CRYPTO_w_lock(mt->lockid);
-        return 0;
-        }
-
-static void hwcrhk_mutex_unlock(HWCryptoHook_Mutex * mt)
-        {
-        CRYPTO_w_unlock(mt->lockid);
-        }
-
-static void hwcrhk_mutex_destroy(HWCryptoHook_Mutex *mt)
-        {
-        CRYPTO_destroy_dynlockid(mt->lockid);
-        }
-
-/* Mutex upcalls to use if the application does not support dynamic locks */
-
-static int hwcrhk_static_mutex_init(HWCryptoHook_Mutex *m,
-        HWCryptoHook_CallerContext *c)
-        {
-        return 0;
-        }
-static int hwcrhk_static_mutex_lock(HWCryptoHook_Mutex *m)
-        {
-        CRYPTO_w_lock(CRYPTO_LOCK_HWCRHK);
-        return 0;
-        }
-static void hwcrhk_static_mutex_unlock(HWCryptoHook_Mutex *m)
-        {
-        CRYPTO_w_unlock(CRYPTO_LOCK_HWCRHK);
-        }
-static void hwcrhk_static_mutex_destroy(HWCryptoHook_Mutex *m)
-        {
-        }
-
-static int hwcrhk_get_pass(const char *prompt_info,
-        int *len_io, char *buf,
-        HWCryptoHook_PassphraseContext *ppctx,
-        HWCryptoHook_CallerContext *cactx)
-        {
-        pem_password_cb *callback = NULL;
-        void *callback_data = NULL;
-        UI_METHOD *ui_method = NULL;
-
-        if (cactx)
-                {
-                if (cactx->ui_method)
-                        ui_method = cactx->ui_method;
-                if (cactx->password_callback)
-                        callback = cactx->password_callback;
-                if (cactx->callback_data)
-                        callback_data = cactx->callback_data;
-                }
-        if (ppctx)
-                {
-                if (ppctx->ui_method)
-                        {
-                        ui_method = ppctx->ui_method;
-                        callback = NULL;
-                        }
-                if (ppctx->callback_data)
-                        callback_data = ppctx->callback_data;
-                }
-        if (callback == NULL && ui_method == NULL)
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_GET_PASS,HWCRHK_R_NO_CALLBACK);
-                return -1;
-                }
-
-        if (ui_method)
-                {
-                UI *ui = UI_new_method(ui_method);
-                if (ui)
-                        {
-                        int ok;
-                        char *prompt = UI_construct_prompt(ui,
-                                "pass phrase", prompt_info);
-
-                        ok = UI_add_input_string(ui,prompt,
-                                UI_INPUT_FLAG_DEFAULT_PWD,
-                                buf,0,(*len_io) - 1);
-                        UI_add_user_data(ui, callback_data);
-                        UI_ctrl(ui, UI_CTRL_PRINT_ERRORS, 1, 0, 0);
-
-                        if (ok >= 0)
-                                do
-                                        {
-                                        ok=UI_process(ui);
-                                        }
-                                while (ok < 0 && UI_ctrl(ui, UI_CTRL_IS_REDOABLE, 0, 0, 0));
-
-                        if (ok >= 0)
-                                *len_io = strlen(buf);
-
-                        UI_free(ui);
-                        OPENSSL_free(prompt);
-                        }
-                }
-        else
-                {
-                *len_io = callback(buf, *len_io, 0, callback_data);
-                }
-        if(!*len_io)
-                return -1;
-        return 0;
-        }
-
-static int hwcrhk_insert_card(const char *prompt_info,
-                      const char *wrong_info,
-                      HWCryptoHook_PassphraseContext *ppctx,
-                      HWCryptoHook_CallerContext *cactx)
-        {
-        int ok = -1;
-        UI *ui;
-        void *callback_data = NULL;
-        UI_METHOD *ui_method = NULL;
-
-        if (cactx)
-                {
-                if (cactx->ui_method)
-                        ui_method = cactx->ui_method;
-                if (cactx->callback_data)
-                        callback_data = cactx->callback_data;
-                }
-        if (ppctx)
-                {
-                if (ppctx->ui_method)
-                        ui_method = ppctx->ui_method;
-                if (ppctx->callback_data)
-                        callback_data = ppctx->callback_data;
-                }
-        if (ui_method == NULL)
-                {
-                HWCRHKerr(HWCRHK_F_HWCRHK_INSERT_CARD,
-                        HWCRHK_R_NO_CALLBACK);
-                return -1;
-                }
-
-        ui = UI_new_method(ui_method);
-
-        if (ui)
-                {
-                char answer;
-                char buf[BUFSIZ];
-
-                if (wrong_info)
-                        BIO_snprintf(buf, sizeof(buf)-1,
-                                "Current card: \"%s\"\n", wrong_info);
-                ok = UI_dup_info_string(ui, buf);
-                if (ok >= 0 && prompt_info)
-                        {
-                        BIO_snprintf(buf, sizeof(buf)-1,
-                                "Insert card \"%s\"", prompt_info);
-                        ok = UI_dup_input_boolean(ui, buf,
-                                "\n then hit <enter> or C<enter> to cancel\n",
-                                "\r\n", "Cc", UI_INPUT_FLAG_ECHO, &answer);
-                        }
-                UI_add_user_data(ui, callback_data);
-
-                if (ok >= 0)
-                        ok = UI_process(ui);
-                UI_free(ui);
-
-                if (ok == -2 || (ok >= 0 && answer == 'C'))
-                        ok = 1;
-                else if (ok < 0)
-                        ok = -1;
-                else
-                        ok = 0;
-                }
-        return ok;
-        }
-
-static void hwcrhk_log_message(void *logstr, const char *message)
-        {
-        BIO *lstream = NULL;
-
-        CRYPTO_w_lock(CRYPTO_LOCK_BIO);
-        if (logstr)
-                lstream=*(BIO **)logstr;
-        if (lstream)
-                {
-                BIO_printf(lstream, "%s\n", message);
-                }
-        CRYPTO_w_unlock(CRYPTO_LOCK_BIO);
-        }
-
-/* This stuff is needed if this ENGINE is being compiled into a self-contained
- * shared-library. */      
-#ifdef ENGINE_DYNAMIC_SUPPORT
-static int bind_fn(ENGINE *e, const char *id)
-        {
-        if(id && (strcmp(id, engine_hwcrhk_id) != 0))
-                return 0;
-        if(!bind_helper(e))
-                return 0;
-        return 1;
-        }       
-IMPLEMENT_DYNAMIC_CHECK_FN()
-IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
-#endif /* ENGINE_DYNAMIC_SUPPORT */
-
-#endif /* !OPENSSL_NO_HW_NCIPHER */
-#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libcrypto/engine/hw_ncipher_err.c b/src/lib/libcrypto/engine/hw_ncipher_err.c
deleted file mode 100644
index 5bc94581b7..0000000000
--- a/src/lib/libcrypto/engine/hw_ncipher_err.c
+++ /dev/null
@@ -1,157 +0,0 @@
-/* hw_ncipher_err.c */
-/* ====================================================================
- * Copyright (c) 1999-2002 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-/* NOTE: this file was auto generated by the mkerr.pl script: any changes
- * made to it will be overwritten when the script next updates this file,
- * only reason strings will be preserved.
- */
-
-#include <stdio.h>
-#include <openssl/err.h>
-#include "hw_ncipher_err.h"
-
-/* BEGIN ERROR CODES */
-#ifndef OPENSSL_NO_ERR
-static ERR_STRING_DATA HWCRHK_str_functs[]=
-        {
-{ERR_PACK(0,HWCRHK_F_HWCRHK_CTRL,0),    "HWCRHK_CTRL"},
-{ERR_PACK(0,HWCRHK_F_HWCRHK_FINISH,0),  "HWCRHK_FINISH"},
-{ERR_PACK(0,HWCRHK_F_HWCRHK_GET_PASS,0),        "HWCRHK_GET_PASS"},
-{ERR_PACK(0,HWCRHK_F_HWCRHK_INIT,0),    "HWCRHK_INIT"},
-{ERR_PACK(0,HWCRHK_F_HWCRHK_INSERT_CARD,0),     "HWCRHK_INSERT_CARD"},
-{ERR_PACK(0,HWCRHK_F_HWCRHK_LOAD_PRIVKEY,0),    "HWCRHK_LOAD_PRIVKEY"},
-{ERR_PACK(0,HWCRHK_F_HWCRHK_LOAD_PUBKEY,0),     "HWCRHK_LOAD_PUBKEY"},
-{ERR_PACK(0,HWCRHK_F_HWCRHK_MOD_EXP,0), "HWCRHK_MOD_EXP"},
-{ERR_PACK(0,HWCRHK_F_HWCRHK_RAND_BYTES,0),      "HWCRHK_RAND_BYTES"},
-{ERR_PACK(0,HWCRHK_F_HWCRHK_RSA_MOD_EXP,0),     "HWCRHK_RSA_MOD_EXP"},
-{0,NULL}
-        };
-
-static ERR_STRING_DATA HWCRHK_str_reasons[]=
-        {
-{HWCRHK_R_ALREADY_LOADED                 ,"already loaded"},
-{HWCRHK_R_BIO_WAS_FREED                  ,"bio was freed"},
-{HWCRHK_R_CHIL_ERROR                     ,"chil error"},
-{HWCRHK_R_CTRL_COMMAND_NOT_IMPLEMENTED   ,"ctrl command not implemented"},
-{HWCRHK_R_DSO_FAILURE                    ,"dso failure"},
-{HWCRHK_R_DYNAMIC_LOCKING_MISSING        ,"dynamic locking missing"},
-{HWCRHK_R_MISSING_KEY_COMPONENTS         ,"missing key components"},
-{HWCRHK_R_NOT_INITIALISED                ,"not initialised"},
-{HWCRHK_R_NOT_LOADED                     ,"not loaded"},
-{HWCRHK_R_NO_CALLBACK                    ,"no callback"},
-{HWCRHK_R_NO_KEY                         ,"no key"},
-{HWCRHK_R_PRIVATE_KEY_ALGORITHMS_DISABLED,"private key algorithms disabled"},
-{HWCRHK_R_REQUEST_FAILED                 ,"request failed"},
-{HWCRHK_R_REQUEST_FALLBACK               ,"request fallback"},
-{HWCRHK_R_UNIT_FAILURE                   ,"unit failure"},
-{0,NULL}
-        };
-
-#endif
-
-#ifdef HWCRHK_LIB_NAME
-static ERR_STRING_DATA HWCRHK_lib_name[]=
-        {
-{0      ,HWCRHK_LIB_NAME},
-{0,NULL}
-        };
-#endif
-
-
-static int HWCRHK_lib_error_code=0;
-static int HWCRHK_error_init=1;
-
-static void ERR_load_HWCRHK_strings(void)
-        {
-        if (HWCRHK_lib_error_code == 0)
-                HWCRHK_lib_error_code=ERR_get_next_error_library();
-
-        if (HWCRHK_error_init)
-                {
-                HWCRHK_error_init=0;
-#ifndef OPENSSL_NO_ERR
-                ERR_load_strings(HWCRHK_lib_error_code,HWCRHK_str_functs);
-                ERR_load_strings(HWCRHK_lib_error_code,HWCRHK_str_reasons);
-#endif
-
-#ifdef HWCRHK_LIB_NAME
-                HWCRHK_lib_name->error = ERR_PACK(HWCRHK_lib_error_code,0,0);
-                ERR_load_strings(0,HWCRHK_lib_name);
-#endif
-                }
-        }
-
-static void ERR_unload_HWCRHK_strings(void)
-        {
-        if (HWCRHK_error_init == 0)
-                {
-#ifndef OPENSSL_NO_ERR
-                ERR_unload_strings(HWCRHK_lib_error_code,HWCRHK_str_functs);
-                ERR_unload_strings(HWCRHK_lib_error_code,HWCRHK_str_reasons);
-#endif
-
-#ifdef HWCRHK_LIB_NAME
-                ERR_unload_strings(0,HWCRHK_lib_name);
-#endif
-                HWCRHK_error_init=1;
-                }
-        }
-
-static void ERR_HWCRHK_error(int function, int reason, char *file, int line)
-        {
-        if (HWCRHK_lib_error_code == 0)
-                HWCRHK_lib_error_code=ERR_get_next_error_library();
-        ERR_PUT_error(HWCRHK_lib_error_code,function,reason,file,line);
-        }
diff --git a/src/lib/libcrypto/engine/hw_ncipher_err.h b/src/lib/libcrypto/engine/hw_ncipher_err.h
deleted file mode 100644
index d232d02319..0000000000
--- a/src/lib/libcrypto/engine/hw_ncipher_err.h
+++ /dev/null
@@ -1,101 +0,0 @@
-/* ====================================================================
- * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#ifndef HEADER_HWCRHK_ERR_H
-#define HEADER_HWCRHK_ERR_H
-
-/* BEGIN ERROR CODES */
-/* The following lines are auto generated by the script mkerr.pl. Any changes
- * made after this point may be overwritten when the script is next run.
- */
-static void ERR_load_HWCRHK_strings(void);
-static void ERR_unload_HWCRHK_strings(void);
-static void ERR_HWCRHK_error(int function, int reason, char *file, int line);
-#define HWCRHKerr(f,r) ERR_HWCRHK_error((f),(r),__FILE__,__LINE__)
-
-/* Error codes for the HWCRHK functions. */
-
-/* Function codes. */
-#define HWCRHK_F_HWCRHK_CTRL                             100
-#define HWCRHK_F_HWCRHK_FINISH                           101
-#define HWCRHK_F_HWCRHK_GET_PASS                         102
-#define HWCRHK_F_HWCRHK_INIT                             103
-#define HWCRHK_F_HWCRHK_INSERT_CARD                      104
-#define HWCRHK_F_HWCRHK_LOAD_PRIVKEY                     105
-#define HWCRHK_F_HWCRHK_LOAD_PUBKEY                      106
-#define HWCRHK_F_HWCRHK_MOD_EXP                          107
-#define HWCRHK_F_HWCRHK_RAND_BYTES                       108
-#define HWCRHK_F_HWCRHK_RSA_MOD_EXP                      109
-
-/* Reason codes. */
-#define HWCRHK_R_ALREADY_LOADED                          100
-#define HWCRHK_R_BIO_WAS_FREED                           101
-#define HWCRHK_R_CHIL_ERROR                              102
-#define HWCRHK_R_CTRL_COMMAND_NOT_IMPLEMENTED            103
-#define HWCRHK_R_DSO_FAILURE                             104
-#define HWCRHK_R_DYNAMIC_LOCKING_MISSING                 114
-#define HWCRHK_R_MISSING_KEY_COMPONENTS                  105
-#define HWCRHK_R_NOT_INITIALISED                         106
-#define HWCRHK_R_NOT_LOADED                              107
-#define HWCRHK_R_NO_CALLBACK                             108
-#define HWCRHK_R_NO_KEY                                  109
-#define HWCRHK_R_PRIVATE_KEY_ALGORITHMS_DISABLED         110
-#define HWCRHK_R_REQUEST_FAILED                          111
-#define HWCRHK_R_REQUEST_FALLBACK                        112
-#define HWCRHK_R_UNIT_FAILURE                            113
-
-#ifdef  __cplusplus
-}
-#endif
-#endif
diff --git a/src/lib/libcrypto/engine/hw_nuron.c b/src/lib/libcrypto/engine/hw_nuron.c
deleted file mode 100644
index fb9188bfe5..0000000000
--- a/src/lib/libcrypto/engine/hw_nuron.c
+++ /dev/null
@@ -1,418 +0,0 @@
-/* crypto/engine/hw_nuron.c */
-/* Written by Ben Laurie for the OpenSSL Project, leaning heavily on Geoff
- * Thorpe's Atalla implementation.
- */
-/* ====================================================================
- * Copyright (c) 2000-2001 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <openssl/crypto.h>
-#include "cryptlib.h"
-#include <openssl/dso.h>
-#include <openssl/engine.h>
-
-
-#ifndef OPENSSL_NO_HW
-#ifndef OPENSSL_NO_HW_NURON
-
-#define NURON_LIB_NAME "nuron engine"
-#include "hw_nuron_err.c"
-
-static const char *NURON_LIBNAME = NULL;
-static const char *get_NURON_LIBNAME(void)
-        {
-        if(NURON_LIBNAME)
-                return NURON_LIBNAME;
-        return "nuronssl";
-        }
-static void free_NURON_LIBNAME(void)
-        {
-        if(NURON_LIBNAME)
-                OPENSSL_free((void*)NURON_LIBNAME);
-        NURON_LIBNAME = NULL;
-        }
-static long set_NURON_LIBNAME(const char *name)
-        {
-        free_NURON_LIBNAME();
-        return (((NURON_LIBNAME = BUF_strdup(name)) != NULL) ? 1 : 0);
-        }
-static const char *NURON_F1 = "nuron_mod_exp";
-
-/* The definitions for control commands specific to this engine */
-#define NURON_CMD_SO_PATH               ENGINE_CMD_BASE
-static const ENGINE_CMD_DEFN nuron_cmd_defns[] = {
-        {NURON_CMD_SO_PATH,
-                "SO_PATH",
-                "Specifies the path to the 'nuronssl' shared library",
-                ENGINE_CMD_FLAG_STRING},
-        {0, NULL, NULL, 0}
-        };
-
-typedef int tfnModExp(BIGNUM *r,const BIGNUM *a,const BIGNUM *p,const BIGNUM *m);
-static tfnModExp *pfnModExp = NULL;
-
-static DSO *pvDSOHandle = NULL;
-
-static int nuron_destroy(ENGINE *e)
-        {
-        free_NURON_LIBNAME();
-        ERR_unload_NURON_strings();
-        return 1;
-        }
-
-static int nuron_init(ENGINE *e)
-        {
-        if(pvDSOHandle != NULL)
-                {
-                NURONerr(NURON_F_NURON_INIT,NURON_R_ALREADY_LOADED);
-                return 0;
-                }
-
-        pvDSOHandle = DSO_load(NULL, get_NURON_LIBNAME(), NULL,
-                DSO_FLAG_NAME_TRANSLATION_EXT_ONLY);
-        if(!pvDSOHandle)
-                {
-                NURONerr(NURON_F_NURON_INIT,NURON_R_DSO_NOT_FOUND);
-                return 0;
-                }
-
-        pfnModExp = (tfnModExp *)DSO_bind_func(pvDSOHandle, NURON_F1);
-        if(!pfnModExp)
-                {
-                NURONerr(NURON_F_NURON_INIT,NURON_R_DSO_FUNCTION_NOT_FOUND);
-                return 0;
-                }
-
-        return 1;
-        }
-
-static int nuron_finish(ENGINE *e)
-        {
-        free_NURON_LIBNAME();
-        if(pvDSOHandle == NULL)
-                {
-                NURONerr(NURON_F_NURON_FINISH,NURON_R_NOT_LOADED);
-                return 0;
-                }
-        if(!DSO_free(pvDSOHandle))
-                {
-                NURONerr(NURON_F_NURON_FINISH,NURON_R_DSO_FAILURE);
-                return 0;
-                }
-        pvDSOHandle=NULL;
-        pfnModExp=NULL;
-        return 1;
-        }
-
-static int nuron_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
-        {
-        int initialised = ((pvDSOHandle == NULL) ? 0 : 1);
-        switch(cmd)
-                {
-        case NURON_CMD_SO_PATH:
-                if(p == NULL)
-                        {
-                        NURONerr(NURON_F_NURON_CTRL,ERR_R_PASSED_NULL_PARAMETER);
-                        return 0;
-                        }
-                if(initialised)
-                        {
-                        NURONerr(NURON_F_NURON_CTRL,NURON_R_ALREADY_LOADED);
-                        return 0;
-                        }
-                return set_NURON_LIBNAME((const char *)p);
-        default:
-                break;
-                }
-        NURONerr(NURON_F_NURON_CTRL,NURON_R_CTRL_COMMAND_NOT_IMPLEMENTED);
-        return 0;
-}
-
-static int nuron_mod_exp(BIGNUM *r,const BIGNUM *a,const BIGNUM *p,
-                         const BIGNUM *m,BN_CTX *ctx)
-        {
-        if(!pvDSOHandle)
-                {
-                NURONerr(NURON_F_NURON_MOD_EXP,NURON_R_NOT_LOADED);
-                return 0;
-                }
-        return pfnModExp(r,a,p,m);
-        }
-
-#ifndef OPENSSL_NO_RSA
-static int nuron_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
-        {
-        return nuron_mod_exp(r0,I,rsa->d,rsa->n,NULL);
-        }
-#endif
-
-#ifndef OPENSSL_NO_DSA
-/* This code was liberated and adapted from the commented-out code in
- * dsa_ossl.c. Because of the unoptimised form of the Atalla acceleration
- * (it doesn't have a CRT form for RSA), this function means that an
- * Atalla system running with a DSA server certificate can handshake
- * around 5 or 6 times faster/more than an equivalent system running with
- * RSA. Just check out the "signs" statistics from the RSA and DSA parts
- * of "openssl speed -engine atalla dsa1024 rsa1024". */
-static int nuron_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
-                             BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
-                             BN_CTX *ctx, BN_MONT_CTX *in_mont)
-        {
-        BIGNUM t;
-        int to_return = 0;
- 
-        BN_init(&t);
-        /* let rr = a1 ^ p1 mod m */
-        if (!nuron_mod_exp(rr,a1,p1,m,ctx))
-                goto end;
-        /* let t = a2 ^ p2 mod m */
-        if (!nuron_mod_exp(&t,a2,p2,m,ctx))
-                goto end;
-        /* let rr = rr * t mod m */
-        if (!BN_mod_mul(rr,rr,&t,m,ctx))
-                goto end;
-        to_return = 1;
-end:
-        BN_free(&t);
-        return to_return;
-        }
-
-
-static int nuron_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
-                             const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
-                             BN_MONT_CTX *m_ctx)
-        {
-        return nuron_mod_exp(r, a, p, m, ctx);
-        }
-#endif
-
-/* This function is aliased to mod_exp (with the mont stuff dropped). */
-static int nuron_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                              const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-        {
-        return nuron_mod_exp(r, a, p, m, ctx);
-        }
-
-#ifndef OPENSSL_NO_DH
-/* This function is aliased to mod_exp (with the dh and mont dropped). */
-static int nuron_mod_exp_dh(const DH *dh, BIGNUM *r,
-                const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-        {
-        return nuron_mod_exp(r, a, p, m, ctx);
-        }
-#endif
-
-#ifndef OPENSSL_NO_RSA
-static RSA_METHOD nuron_rsa =
-        {
-        "Nuron RSA method",
-        NULL,
-        NULL,
-        NULL,
-        NULL,
-        nuron_rsa_mod_exp,
-        nuron_mod_exp_mont,
-        NULL,
-        NULL,
-        0,
-        NULL,
-        NULL,
-        NULL
-        };
-#endif
-
-#ifndef OPENSSL_NO_DSA
-static DSA_METHOD nuron_dsa =
-        {
-        "Nuron DSA method",
-        NULL, /* dsa_do_sign */
-        NULL, /* dsa_sign_setup */
-        NULL, /* dsa_do_verify */
-        nuron_dsa_mod_exp, /* dsa_mod_exp */
-        nuron_mod_exp_dsa, /* bn_mod_exp */
-        NULL, /* init */
-        NULL, /* finish */
-        0, /* flags */
-        NULL /* app_data */
-        };
-#endif
-
-#ifndef OPENSSL_NO_DH
-static DH_METHOD nuron_dh =
-        {
-        "Nuron DH method",
-        NULL,
-        NULL,
-        nuron_mod_exp_dh,
-        NULL,
-        NULL,
-        0,
-        NULL
-        };
-#endif
-
-/* Constants used when creating the ENGINE */
-static const char *engine_nuron_id = "nuron";
-static const char *engine_nuron_name = "Nuron hardware engine support";
-
-/* This internal function is used by ENGINE_nuron() and possibly by the
- * "dynamic" ENGINE support too */
-static int bind_helper(ENGINE *e)
-        {
-#ifndef OPENSSL_NO_RSA
-        const RSA_METHOD *meth1;
-#endif
-#ifndef OPENSSL_NO_DSA
-        const DSA_METHOD *meth2;
-#endif
-#ifndef OPENSSL_NO_DH
-        const DH_METHOD *meth3;
-#endif
-        if(!ENGINE_set_id(e, engine_nuron_id) ||
-                        !ENGINE_set_name(e, engine_nuron_name) ||
-#ifndef OPENSSL_NO_RSA
-                        !ENGINE_set_RSA(e, &nuron_rsa) ||
-#endif
-#ifndef OPENSSL_NO_DSA
-                        !ENGINE_set_DSA(e, &nuron_dsa) ||
-#endif
-#ifndef OPENSSL_NO_DH
-                        !ENGINE_set_DH(e, &nuron_dh) ||
-#endif
-                        !ENGINE_set_destroy_function(e, nuron_destroy) ||
-                        !ENGINE_set_init_function(e, nuron_init) ||
-                        !ENGINE_set_finish_function(e, nuron_finish) ||
-                        !ENGINE_set_ctrl_function(e, nuron_ctrl) ||
-                        !ENGINE_set_cmd_defns(e, nuron_cmd_defns))
-                return 0;
-
-#ifndef OPENSSL_NO_RSA
-        /* We know that the "PKCS1_SSLeay()" functions hook properly
-         * to the nuron-specific mod_exp and mod_exp_crt so we use
-         * those functions. NB: We don't use ENGINE_openssl() or
-         * anything "more generic" because something like the RSAref
-         * code may not hook properly, and if you own one of these
-         * cards then you have the right to do RSA operations on it
-         * anyway! */ 
-        meth1=RSA_PKCS1_SSLeay();
-        nuron_rsa.rsa_pub_enc=meth1->rsa_pub_enc;
-        nuron_rsa.rsa_pub_dec=meth1->rsa_pub_dec;
-        nuron_rsa.rsa_priv_enc=meth1->rsa_priv_enc;
-        nuron_rsa.rsa_priv_dec=meth1->rsa_priv_dec;
-#endif
-
-#ifndef OPENSSL_NO_DSA
-        /* Use the DSA_OpenSSL() method and just hook the mod_exp-ish
-         * bits. */
-        meth2=DSA_OpenSSL();
-        nuron_dsa.dsa_do_sign=meth2->dsa_do_sign;
-        nuron_dsa.dsa_sign_setup=meth2->dsa_sign_setup;
-        nuron_dsa.dsa_do_verify=meth2->dsa_do_verify;
-#endif
-
-#ifndef OPENSSL_NO_DH
-        /* Much the same for Diffie-Hellman */
-        meth3=DH_OpenSSL();
-        nuron_dh.generate_key=meth3->generate_key;
-        nuron_dh.compute_key=meth3->compute_key;
-#endif
-
-        /* Ensure the nuron error handling is set up */
-        ERR_load_NURON_strings();
-        return 1;
-        }
-
-#ifndef ENGINE_DYNAMIC_SUPPORT
-static ENGINE *engine_nuron(void)
-        {
-        ENGINE *ret = ENGINE_new();
-        if(!ret)
-                return NULL;
-        if(!bind_helper(ret))
-                {
-                ENGINE_free(ret);
-                return NULL;
-                }
-        return ret;
-        }
-
-void ENGINE_load_nuron(void)
-        {
-        /* Copied from eng_[openssl|dyn].c */
-        ENGINE *toadd = engine_nuron();
-        if(!toadd) return;
-        ENGINE_add(toadd);
-        ENGINE_free(toadd);
-        ERR_clear_error();
-        }
-#endif
-
-/* This stuff is needed if this ENGINE is being compiled into a self-contained
- * shared-library. */      
-#ifdef ENGINE_DYNAMIC_SUPPORT
-static int bind_fn(ENGINE *e, const char *id)
-        {
-        if(id && (strcmp(id, engine_nuron_id) != 0))
-                return 0;
-        if(!bind_helper(e))
-                return 0;
-        return 1;
-        }       
-IMPLEMENT_DYNAMIC_CHECK_FN()
-IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
-#endif /* ENGINE_DYNAMIC_SUPPORT */
-
-#endif /* !OPENSSL_NO_HW_NURON */
-#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libcrypto/engine/hw_sureware.c b/src/lib/libcrypto/engine/hw_sureware.c
deleted file mode 100644
index fca467e690..0000000000
--- a/src/lib/libcrypto/engine/hw_sureware.c
+++ /dev/null
@@ -1,1039 +0,0 @@
-/* Written by Corinne Dive-Reclus(cdive@baltimore.com)
-* 
-*
-* Redistribution and use in source and binary forms, with or without
-* modification, are permitted provided that the following conditions
-* are met:
-*
-* 1. Redistributions of source code must retain the above copyright
-*    notice, this list of conditions and the following disclaimer. 
-*
-* 2. Redistributions in binary form must reproduce the above copyright
-*    notice, this list of conditions and the following disclaimer in
-*    the documentation and/or other materials provided with the
-*    distribution.
-*
-* 3. All advertising materials mentioning features or use of this
-*    software must display the following acknowledgment:
-*    "This product includes software developed by the OpenSSL Project
-*    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
-*
-* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
-*    endorse or promote products derived from this software without
-*    prior written permission. For written permission, please contact
-*    licensing@OpenSSL.org.
-*
-* 5. Products derived from this software may not be called "OpenSSL"
-*    nor may "OpenSSL" appear in their names without prior written
-*    permission of the OpenSSL Project.
-*
-* 6. Redistributions of any form whatsoever must retain the following
-*    acknowledgment:
-*    "This product includes software developed by the OpenSSL Project
-*    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
-*
-* Written by Corinne Dive-Reclus(cdive@baltimore.com)
-*
-* Copyright@2001 Baltimore Technologies Ltd.
-* All right Reserved.
-*                                                                                                                                                                                               *       
-*               THIS FILE IS PROVIDED BY BALTIMORE TECHNOLOGIES ``AS IS'' AND                                                                                                                                                   *
-*               ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE                                   * 
-*               IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE                              *
-*               ARE DISCLAIMED.  IN NO EVENT SHALL BALTIMORE TECHNOLOGIES BE LIABLE                                             *
-*               FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL                              *
-*               DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS                                 *
-*               OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)                                   *
-*               HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT                              *
-*               LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY                               *
-*               OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF                                  *
-*               SUCH DAMAGE.                                                                                                                                                    *
-====================================================================*/
-
-#include <stdio.h>
-#include "cryptlib.h"
-#include <openssl/crypto.h>
-#include <openssl/pem.h>
-#include <openssl/dso.h>
-#include "eng_int.h"
-#include "engine.h"
-#include <openssl/engine.h>
-
-#ifndef OPENSSL_NO_HW
-#ifndef OPENSSL_NO_HW_SUREWARE
-
-#ifdef FLAT_INC
-#include "sureware.h"
-#else
-#include "vendor_defns/sureware.h"
-#endif
-
-#define SUREWARE_LIB_NAME "sureware engine"
-#include "hw_sureware_err.c"
-
-static int surewarehk_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
-static int surewarehk_destroy(ENGINE *e);
-static int surewarehk_init(ENGINE *e);
-static int surewarehk_finish(ENGINE *e);
-static int surewarehk_modexp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-        const BIGNUM *m, BN_CTX *ctx);
-
-/* RSA stuff */
-static int surewarehk_rsa_priv_dec(int flen,const unsigned char *from,unsigned char *to,
-                        RSA *rsa,int padding);
-static int surewarehk_rsa_sign(int flen,const unsigned char *from,unsigned char *to,
-                            RSA *rsa,int padding);
-
-/* RAND stuff */
-static int surewarehk_rand_bytes(unsigned char *buf, int num);
-static void surewarehk_rand_seed(const void *buf, int num);
-static void surewarehk_rand_add(const void *buf, int num, double entropy);
-
-/* KM stuff */
-static EVP_PKEY *surewarehk_load_privkey(ENGINE *e, const char *key_id,
-        UI_METHOD *ui_method, void *callback_data);
-static EVP_PKEY *surewarehk_load_pubkey(ENGINE *e, const char *key_id,
-        UI_METHOD *ui_method, void *callback_data);
-static void surewarehk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
-        int idx,long argl, void *argp);
-#if 0
-static void surewarehk_dh_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
-        int idx,long argl, void *argp);
-#endif
-
-#ifndef OPENSSL_NO_RSA
-/* This function is aliased to mod_exp (with the mont stuff dropped). */
-static int surewarehk_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-{
-        return surewarehk_modexp(r, a, p, m, ctx);
-}
-
-/* Our internal RSA_METHOD that we provide pointers to */
-static RSA_METHOD surewarehk_rsa =
-        {
-        "SureWare RSA method",
-        NULL, /* pub_enc*/
-        NULL, /* pub_dec*/
-        surewarehk_rsa_sign, /* our rsa_sign is OpenSSL priv_enc*/
-        surewarehk_rsa_priv_dec, /* priv_dec*/
-        NULL, /*mod_exp*/
-        surewarehk_mod_exp_mont, /*mod_exp_mongomery*/
-        NULL, /* init*/
-        NULL, /* finish*/
-        0,      /* RSA flag*/
-        NULL, 
-        NULL, /* OpenSSL sign*/
-        NULL  /* OpenSSL verify*/
-        };
-#endif
-
-#ifndef OPENSSL_NO_DH
-/* Our internal DH_METHOD that we provide pointers to */
-/* This function is aliased to mod_exp (with the dh and mont dropped). */
-static int surewarehk_modexp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
-        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-{
-        return surewarehk_modexp(r, a, p, m, ctx);
-}
-
-static DH_METHOD surewarehk_dh =
-        {
-        "SureWare DH method",
-        NULL,/*gen_key*/
-        NULL,/*agree,*/
-        surewarehk_modexp_dh, /*dh mod exp*/
-        NULL, /* init*/
-        NULL, /* finish*/
-        0,    /* flags*/
-        NULL 
-        };
-#endif
-
-static RAND_METHOD surewarehk_rand =
-        {
-        /* "SureWare RAND method", */
-        surewarehk_rand_seed,
-        surewarehk_rand_bytes,
-        NULL,/*cleanup*/
-        surewarehk_rand_add,
-        surewarehk_rand_bytes,
-        NULL,/*rand_status*/
-        };
-
-#ifndef OPENSSL_NO_DSA
-/* DSA stuff */
-static  DSA_SIG * surewarehk_dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
-static int surewarehk_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
-                BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
-                BN_CTX *ctx, BN_MONT_CTX *in_mont)
-{
-        BIGNUM t;
-        int to_return = 0;
-        BN_init(&t);
-        /* let rr = a1 ^ p1 mod m */
-        if (!surewarehk_modexp(rr,a1,p1,m,ctx)) goto end;
-        /* let t = a2 ^ p2 mod m */
-        if (!surewarehk_modexp(&t,a2,p2,m,ctx)) goto end;
-        /* let rr = rr * t mod m */
-        if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
-        to_return = 1;
-end:
-        BN_free(&t);
-        return to_return;
-}
-
-static DSA_METHOD surewarehk_dsa =
-        {
-         "SureWare DSA method", 
-        surewarehk_dsa_do_sign,
-        NULL,/*sign setup*/
-        NULL,/*verify,*/
-        surewarehk_dsa_mod_exp,/*mod exp*/
-        NULL,/*bn mod exp*/
-        NULL, /*init*/
-        NULL,/*finish*/
-        0,
-        NULL,
-        };
-#endif
-
-static const char *engine_sureware_id = "sureware";
-static const char *engine_sureware_name = "SureWare hardware engine support";
-
-/* Now, to our own code */
-
-/* As this is only ever called once, there's no need for locking
- * (indeed - the lock will already be held by our caller!!!) */
-static int bind_sureware(ENGINE *e)
-{
-#ifndef OPENSSL_NO_RSA
-        const RSA_METHOD *meth1;
-#endif
-#ifndef OPENSSL_NO_DSA
-        const DSA_METHOD *meth2;
-#endif
-#ifndef OPENSSL_NO_DH
-        const DH_METHOD *meth3;
-#endif
-
-        if(!ENGINE_set_id(e, engine_sureware_id) ||
-           !ENGINE_set_name(e, engine_sureware_name) ||
-#ifndef OPENSSL_NO_RSA
-           !ENGINE_set_RSA(e, &surewarehk_rsa) ||
-#endif
-#ifndef OPENSSL_NO_DSA
-           !ENGINE_set_DSA(e, &surewarehk_dsa) ||
-#endif
-#ifndef OPENSSL_NO_DH
-           !ENGINE_set_DH(e, &surewarehk_dh) ||
-#endif
-           !ENGINE_set_RAND(e, &surewarehk_rand) ||
-           !ENGINE_set_destroy_function(e, surewarehk_destroy) ||
-           !ENGINE_set_init_function(e, surewarehk_init) ||
-           !ENGINE_set_finish_function(e, surewarehk_finish) ||
-           !ENGINE_set_ctrl_function(e, surewarehk_ctrl) ||
-           !ENGINE_set_load_privkey_function(e, surewarehk_load_privkey) ||
-           !ENGINE_set_load_pubkey_function(e, surewarehk_load_pubkey))
-          return 0;
-
-#ifndef OPENSSL_NO_RSA
-        /* We know that the "PKCS1_SSLeay()" functions hook properly
-         * to the cswift-specific mod_exp and mod_exp_crt so we use
-         * those functions. NB: We don't use ENGINE_openssl() or
-         * anything "more generic" because something like the RSAref
-         * code may not hook properly, and if you own one of these
-         * cards then you have the right to do RSA operations on it
-         * anyway! */ 
-        meth1 = RSA_PKCS1_SSLeay();
-        if (meth1)
-        {
-                surewarehk_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
-                surewarehk_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
-        }
-#endif
-
-#ifndef OPENSSL_NO_DSA
-        /* Use the DSA_OpenSSL() method and just hook the mod_exp-ish
-         * bits. */
-        meth2 = DSA_OpenSSL();
-        if (meth2)
-        {
-                surewarehk_dsa.dsa_do_verify = meth2->dsa_do_verify;
-        }
-#endif
-
-#ifndef OPENSSL_NO_DH
-        /* Much the same for Diffie-Hellman */
-        meth3 = DH_OpenSSL();
-        if (meth3)
-        {
-                surewarehk_dh.generate_key = meth3->generate_key;
-                surewarehk_dh.compute_key = meth3->compute_key;
-        }
-#endif
-
-        /* Ensure the sureware error handling is set up */
-        ERR_load_SUREWARE_strings();
-        return 1;
-}
-
-#ifdef ENGINE_DYNAMIC_SUPPORT
-static int bind_helper(ENGINE *e, const char *id)
-        {
-        if(id && (strcmp(id, engine_sureware_id) != 0))
-                return 0;
-        if(!bind_sureware(e))
-                return 0;
-        return 1;
-        }       
-IMPLEMENT_DYNAMIC_CHECK_FN()
-IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)
-#else
-static ENGINE *engine_sureware(void)
-        {
-        ENGINE *ret = ENGINE_new();
-        if(!ret)
-                return NULL;
-        if(!bind_sureware(ret))
-                {
-                ENGINE_free(ret);
-                return NULL;
-                }
-        return ret;
-        }
-
-void ENGINE_load_sureware(void)
-        {
-        /* Copied from eng_[openssl|dyn].c */
-        ENGINE *toadd = engine_sureware();
-        if(!toadd) return;
-        ENGINE_add(toadd);
-        ENGINE_free(toadd);
-        ERR_clear_error();
-        }
-#endif
-
-/* This is a process-global DSO handle used for loading and unloading
- * the SureWareHook library. NB: This is only set (or unset) during an
- * init() or finish() call (reference counts permitting) and they're
- * operating with global locks, so this should be thread-safe
- * implicitly. */
-static DSO *surewarehk_dso = NULL;
-#ifndef OPENSSL_NO_RSA
-static int rsaHndidx = -1;      /* Index for KM handle.  Not really used yet. */
-#endif
-#ifndef OPENSSL_NO_DSA
-static int dsaHndidx = -1;      /* Index for KM handle.  Not really used yet. */
-#endif
-
-/* These are the function pointers that are (un)set when the library has
- * successfully (un)loaded. */
-static SureWareHook_Init_t *p_surewarehk_Init = NULL;
-static SureWareHook_Finish_t *p_surewarehk_Finish = NULL;
-static SureWareHook_Rand_Bytes_t *p_surewarehk_Rand_Bytes = NULL;
-static SureWareHook_Rand_Seed_t *p_surewarehk_Rand_Seed = NULL;
-static SureWareHook_Load_Privkey_t *p_surewarehk_Load_Privkey = NULL;
-static SureWareHook_Info_Pubkey_t *p_surewarehk_Info_Pubkey = NULL;
-static SureWareHook_Load_Rsa_Pubkey_t *p_surewarehk_Load_Rsa_Pubkey = NULL;
-static SureWareHook_Load_Dsa_Pubkey_t *p_surewarehk_Load_Dsa_Pubkey = NULL;
-static SureWareHook_Free_t *p_surewarehk_Free=NULL;
-static SureWareHook_Rsa_Priv_Dec_t *p_surewarehk_Rsa_Priv_Dec=NULL;
-static SureWareHook_Rsa_Sign_t *p_surewarehk_Rsa_Sign=NULL;
-static SureWareHook_Dsa_Sign_t *p_surewarehk_Dsa_Sign=NULL;
-static SureWareHook_Mod_Exp_t *p_surewarehk_Mod_Exp=NULL;
-
-/* Used in the DSO operations. */
-static const char *surewarehk_LIBNAME = "SureWareHook";
-static const char *n_surewarehk_Init = "SureWareHook_Init";
-static const char *n_surewarehk_Finish = "SureWareHook_Finish";
-static const char *n_surewarehk_Rand_Bytes="SureWareHook_Rand_Bytes";
-static const char *n_surewarehk_Rand_Seed="SureWareHook_Rand_Seed";
-static const char *n_surewarehk_Load_Privkey="SureWareHook_Load_Privkey";
-static const char *n_surewarehk_Info_Pubkey="SureWareHook_Info_Pubkey";
-static const char *n_surewarehk_Load_Rsa_Pubkey="SureWareHook_Load_Rsa_Pubkey";
-static const char *n_surewarehk_Load_Dsa_Pubkey="SureWareHook_Load_Dsa_Pubkey";
-static const char *n_surewarehk_Free="SureWareHook_Free";
-static const char *n_surewarehk_Rsa_Priv_Dec="SureWareHook_Rsa_Priv_Dec";
-static const char *n_surewarehk_Rsa_Sign="SureWareHook_Rsa_Sign";
-static const char *n_surewarehk_Dsa_Sign="SureWareHook_Dsa_Sign";
-static const char *n_surewarehk_Mod_Exp="SureWareHook_Mod_Exp";
-static BIO *logstream = NULL;
-
-/* SureWareHook library functions and mechanics - these are used by the
- * higher-level functions further down. NB: As and where there's no
- * error checking, take a look lower down where these functions are
- * called, the checking and error handling is probably down there. 
-*/
-static int threadsafe=1;
-static int surewarehk_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
-{
-        int to_return = 1;
-
-        switch(cmd)
-        {
-                case ENGINE_CTRL_SET_LOGSTREAM:
-                {
-                        BIO *bio = (BIO *)p;
-                        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-                        if (logstream)
-                        {
-                                BIO_free(logstream);
-                                logstream = NULL;
-                        }
-                        if (CRYPTO_add(&bio->references,1,CRYPTO_LOCK_BIO) > 1)
-                                logstream = bio;
-                        else
-                                SUREWAREerr(SUREWARE_F_SUREWAREHK_CTRL,SUREWARE_R_BIO_WAS_FREED);
-                }
-                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-                break;
-        /* This will prevent the initialisation function from "installing"
-         * the mutex-handling callbacks, even if they are available from
-         * within the library (or were provided to the library from the
-         * calling application). This is to remove any baggage for
-         * applications not using multithreading. */
-        case ENGINE_CTRL_CHIL_NO_LOCKING:
-                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-                threadsafe = 0;
-                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-                break;
-
-        /* The command isn't understood by this engine */
-        default:
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_CTRL,
-                        ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED);
-                to_return = 0;
-                break;
-                }
-
-        return to_return;
-}
-
-/* Destructor (complements the "ENGINE_surewarehk()" constructor) */
-static int surewarehk_destroy(ENGINE *e)
-{
-        ERR_unload_SUREWARE_strings();
-        return 1;
-}
-
-/* (de)initialisation functions. */
-static int surewarehk_init(ENGINE *e)
-{
-        char msg[64]="ENGINE_init";
-        SureWareHook_Init_t *p1=NULL;
-        SureWareHook_Finish_t *p2=NULL;
-        SureWareHook_Rand_Bytes_t *p3=NULL;
-        SureWareHook_Rand_Seed_t *p4=NULL;
-        SureWareHook_Load_Privkey_t *p5=NULL;
-        SureWareHook_Load_Rsa_Pubkey_t *p6=NULL;
-        SureWareHook_Free_t *p7=NULL;
-        SureWareHook_Rsa_Priv_Dec_t *p8=NULL;
-        SureWareHook_Rsa_Sign_t *p9=NULL;
-        SureWareHook_Dsa_Sign_t *p12=NULL;
-        SureWareHook_Info_Pubkey_t *p13=NULL;
-        SureWareHook_Load_Dsa_Pubkey_t *p14=NULL;
-        SureWareHook_Mod_Exp_t *p15=NULL;
-
-        if(surewarehk_dso != NULL)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,ENGINE_R_ALREADY_LOADED);
-                goto err;
-        }
-        /* Attempt to load libsurewarehk.so/surewarehk.dll/whatever. */
-        surewarehk_dso = DSO_load(NULL, surewarehk_LIBNAME, NULL, 0);
-        if(surewarehk_dso == NULL)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,ENGINE_R_DSO_FAILURE);
-                goto err;
-        }
-        if(!(p1=(SureWareHook_Init_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Init)) ||
-           !(p2=(SureWareHook_Finish_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Finish)) ||
-           !(p3=(SureWareHook_Rand_Bytes_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rand_Bytes)) ||
-           !(p4=(SureWareHook_Rand_Seed_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rand_Seed)) ||
-           !(p5=(SureWareHook_Load_Privkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Load_Privkey)) ||
-           !(p6=(SureWareHook_Load_Rsa_Pubkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Load_Rsa_Pubkey)) ||
-           !(p7=(SureWareHook_Free_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Free)) ||
-           !(p8=(SureWareHook_Rsa_Priv_Dec_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rsa_Priv_Dec)) ||
-           !(p9=(SureWareHook_Rsa_Sign_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rsa_Sign)) ||
-           !(p12=(SureWareHook_Dsa_Sign_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Dsa_Sign)) ||
-           !(p13=(SureWareHook_Info_Pubkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Info_Pubkey)) ||
-           !(p14=(SureWareHook_Load_Dsa_Pubkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Load_Dsa_Pubkey)) ||
-           !(p15=(SureWareHook_Mod_Exp_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Mod_Exp)))
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,ENGINE_R_DSO_FAILURE);
-                goto err;
-        }
-        /* Copy the pointers */
-        p_surewarehk_Init = p1;
-        p_surewarehk_Finish = p2;
-        p_surewarehk_Rand_Bytes = p3;
-        p_surewarehk_Rand_Seed = p4;
-        p_surewarehk_Load_Privkey = p5;
-        p_surewarehk_Load_Rsa_Pubkey = p6;
-        p_surewarehk_Free = p7;
-        p_surewarehk_Rsa_Priv_Dec = p8;
-        p_surewarehk_Rsa_Sign = p9;
-        p_surewarehk_Dsa_Sign = p12;
-        p_surewarehk_Info_Pubkey = p13;
-        p_surewarehk_Load_Dsa_Pubkey = p14;
-        p_surewarehk_Mod_Exp = p15;
-        /* Contact the hardware and initialises it. */
-        if(p_surewarehk_Init(msg,threadsafe)==SUREWAREHOOK_ERROR_UNIT_FAILURE)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,SUREWARE_R_UNIT_FAILURE);
-                goto err;
-        }
-        if(p_surewarehk_Init(msg,threadsafe)==SUREWAREHOOK_ERROR_UNIT_FAILURE)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,SUREWARE_R_UNIT_FAILURE);
-                goto err;
-        }
-        /* try to load the default private key, if failed does not return a failure but
-           wait for an explicit ENGINE_load_privakey */
-        surewarehk_load_privkey(e,NULL,NULL,NULL);
-
-        /* Everything's fine. */
-#ifndef OPENSSL_NO_RSA
-        if (rsaHndidx == -1)
-                rsaHndidx = RSA_get_ex_new_index(0,
-                                                "SureWareHook RSA key handle",
-                                                NULL, NULL, surewarehk_ex_free);
-#endif
-#ifndef OPENSSL_NO_DSA
-        if (dsaHndidx == -1)
-                dsaHndidx = DSA_get_ex_new_index(0,
-                                                "SureWareHook DSA key handle",
-                                                NULL, NULL, surewarehk_ex_free);
-#endif
-
-        return 1;
-err:
-        if(surewarehk_dso)
-                DSO_free(surewarehk_dso);
-        surewarehk_dso = NULL;
-        p_surewarehk_Init = NULL;
-        p_surewarehk_Finish = NULL;
-        p_surewarehk_Rand_Bytes = NULL;
-        p_surewarehk_Rand_Seed = NULL;
-        p_surewarehk_Load_Privkey = NULL;
-        p_surewarehk_Load_Rsa_Pubkey = NULL;
-        p_surewarehk_Free = NULL;
-        p_surewarehk_Rsa_Priv_Dec = NULL;
-        p_surewarehk_Rsa_Sign = NULL;
-        p_surewarehk_Dsa_Sign = NULL;
-        p_surewarehk_Info_Pubkey = NULL;
-        p_surewarehk_Load_Dsa_Pubkey = NULL;
-        p_surewarehk_Mod_Exp = NULL;
-        return 0;
-}
-
-static int surewarehk_finish(ENGINE *e)
-{
-        int to_return = 1;
-        if(surewarehk_dso == NULL)
-                {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_FINISH,ENGINE_R_NOT_LOADED);
-                to_return = 0;
-                goto err;
-                }
-        p_surewarehk_Finish();
-        if(!DSO_free(surewarehk_dso))
-                {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_FINISH,ENGINE_R_DSO_FAILURE);
-                to_return = 0;
-                goto err;
-                }
- err:
-        if (logstream)
-                BIO_free(logstream);
-        surewarehk_dso = NULL;
-        p_surewarehk_Init = NULL;
-        p_surewarehk_Finish = NULL;
-        p_surewarehk_Rand_Bytes = NULL;
-        p_surewarehk_Rand_Seed = NULL;
-        p_surewarehk_Load_Privkey = NULL;
-        p_surewarehk_Load_Rsa_Pubkey = NULL;
-        p_surewarehk_Free = NULL;
-        p_surewarehk_Rsa_Priv_Dec = NULL;
-        p_surewarehk_Rsa_Sign = NULL;
-        p_surewarehk_Dsa_Sign = NULL;
-        p_surewarehk_Info_Pubkey = NULL;
-        p_surewarehk_Load_Dsa_Pubkey = NULL;
-        p_surewarehk_Mod_Exp = NULL;
-        return to_return;
-}
-
-static void surewarehk_error_handling(char *const msg,int func,int ret)
-{
-        switch (ret)
-        {
-                case SUREWAREHOOK_ERROR_UNIT_FAILURE:
-                        ENGINEerr(func,SUREWARE_R_UNIT_FAILURE);
-                        break;
-                case SUREWAREHOOK_ERROR_FALLBACK:
-                        ENGINEerr(func,SUREWARE_R_REQUEST_FALLBACK);
-                        break;
-                case SUREWAREHOOK_ERROR_DATA_SIZE:
-                        ENGINEerr(func,SUREWARE_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
-                        break;
-                case SUREWAREHOOK_ERROR_INVALID_PAD:
-                        ENGINEerr(func,RSA_R_PADDING_CHECK_FAILED);
-                        break;
-                default:
-                        ENGINEerr(func,SUREWARE_R_REQUEST_FAILED);
-                        break;
-                case 1:/*nothing*/
-                        msg[0]='\0';
-        }
-        if (*msg)
-        {
-                ERR_add_error_data(1,msg);
-                if (logstream)
-                {
-                        CRYPTO_w_lock(CRYPTO_LOCK_BIO);
-                        BIO_write(logstream, msg, strlen(msg));
-                        CRYPTO_w_unlock(CRYPTO_LOCK_BIO);
-                }
-        }
-}
-
-static int surewarehk_rand_bytes(unsigned char *buf, int num)
-{
-        int ret=0;
-        char msg[64]="ENGINE_rand_bytes";
-        if(!p_surewarehk_Rand_Bytes)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_RAND_BYTES,ENGINE_R_NOT_INITIALISED);
-        }
-        else
-        {
-                ret = p_surewarehk_Rand_Bytes(msg,buf, num);
-                surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RAND_BYTES,ret);
-        }
-        return ret==1 ? 1 : 0;
-}
-
-static void surewarehk_rand_seed(const void *buf, int num)
-{
-        int ret=0;
-        char msg[64]="ENGINE_rand_seed";
-        if(!p_surewarehk_Rand_Seed)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_RAND_SEED,ENGINE_R_NOT_INITIALISED);
-        }
-        else
-        {
-                ret = p_surewarehk_Rand_Seed(msg,buf, num);
-                surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RAND_SEED,ret);
-        }
-}
-
-static void surewarehk_rand_add(const void *buf, int num, double entropy)
-{
-        surewarehk_rand_seed(buf,num);
-}
-
-static EVP_PKEY* sureware_load_public(ENGINE *e,const char *key_id,char *hptr,unsigned long el,char keytype)
-{
-        EVP_PKEY *res = NULL;
-#ifndef OPENSSL_NO_RSA
-        RSA *rsatmp = NULL;
-#endif
-#ifndef OPENSSL_NO_DSA
-        DSA *dsatmp=NULL;
-#endif
-        char msg[64]="sureware_load_public";
-        int ret=0;
-        if(!p_surewarehk_Load_Rsa_Pubkey || !p_surewarehk_Load_Dsa_Pubkey)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ENGINE_R_NOT_INITIALISED);
-                goto err;
-        }
-        switch (keytype)
-        {
-#ifndef OPENSSL_NO_RSA
-        case 1: /*RSA*/
-                /* set private external reference */
-                rsatmp = RSA_new_method(e);
-                RSA_set_ex_data(rsatmp,rsaHndidx,hptr);
-                rsatmp->flags |= RSA_FLAG_EXT_PKEY;
-
-                /* set public big nums*/
-                rsatmp->e = BN_new();
-                rsatmp->n = BN_new();
-                bn_expand2(rsatmp->e, el/sizeof(BN_ULONG));
-                bn_expand2(rsatmp->n, el/sizeof(BN_ULONG));
-                if (!rsatmp->e || rsatmp->e->dmax!=(int)(el/sizeof(BN_ULONG))|| 
-                        !rsatmp->n || rsatmp->n->dmax!=(int)(el/sizeof(BN_ULONG)))
-                        goto err;
-                ret=p_surewarehk_Load_Rsa_Pubkey(msg,key_id,el,
-                                                 (unsigned long *)rsatmp->n->d,
-                                                 (unsigned long *)rsatmp->e->d);
-                surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ret);
-                if (ret!=1)
-                {
-                        SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_FAILED_LOADING_PUBLIC_KEY);
-                        goto err;
-                }
-                /* normalise pub e and pub n */
-                rsatmp->e->top=el/sizeof(BN_ULONG);
-                bn_fix_top(rsatmp->e);
-                rsatmp->n->top=el/sizeof(BN_ULONG);
-                bn_fix_top(rsatmp->n);
-                /* create an EVP object: engine + rsa key */
-                res = EVP_PKEY_new();
-                EVP_PKEY_assign_RSA(res, rsatmp);
-                break;
-#endif
-
-#ifndef OPENSSL_NO_DSA
-        case 2:/*DSA*/
-                /* set private/public external reference */
-                dsatmp = DSA_new_method(e);
-                DSA_set_ex_data(dsatmp,dsaHndidx,hptr);
-                /*dsatmp->flags |= DSA_FLAG_EXT_PKEY;*/
-
-                /* set public key*/
-                dsatmp->pub_key = BN_new();
-                dsatmp->p = BN_new();
-                dsatmp->q = BN_new();
-                dsatmp->g = BN_new();
-                bn_expand2(dsatmp->pub_key, el/sizeof(BN_ULONG));
-                bn_expand2(dsatmp->p, el/sizeof(BN_ULONG));
-                bn_expand2(dsatmp->q, 20/sizeof(BN_ULONG));
-                bn_expand2(dsatmp->g, el/sizeof(BN_ULONG));
-                if (!dsatmp->pub_key || dsatmp->pub_key->dmax!=(int)(el/sizeof(BN_ULONG))|| 
-                        !dsatmp->p || dsatmp->p->dmax!=(int)(el/sizeof(BN_ULONG)) ||
-                        !dsatmp->q || dsatmp->q->dmax!=20/sizeof(BN_ULONG) ||
-                        !dsatmp->g || dsatmp->g->dmax!=(int)(el/sizeof(BN_ULONG)))
-                        goto err;
-
-                ret=p_surewarehk_Load_Dsa_Pubkey(msg,key_id,el,
-                                                 (unsigned long *)dsatmp->pub_key->d, 
-                                                 (unsigned long *)dsatmp->p->d,
-                                                 (unsigned long *)dsatmp->q->d,
-                                                 (unsigned long *)dsatmp->g->d);
-                surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ret);
-                if (ret!=1)
-                {
-                        SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_FAILED_LOADING_PUBLIC_KEY);
-                        goto err;
-                }
-                /* set parameters */
-                /* normalise pubkey and parameters in case of */
-                dsatmp->pub_key->top=el/sizeof(BN_ULONG);
-                bn_fix_top(dsatmp->pub_key);
-                dsatmp->p->top=el/sizeof(BN_ULONG);
-                bn_fix_top(dsatmp->p);
-                dsatmp->q->top=20/sizeof(BN_ULONG);
-                bn_fix_top(dsatmp->q);
-                dsatmp->g->top=el/sizeof(BN_ULONG);
-                bn_fix_top(dsatmp->g);
-
-                /* create an EVP object: engine + rsa key */
-                res = EVP_PKEY_new();
-                EVP_PKEY_assign_DSA(res, dsatmp);
-                break;
-#endif
-
-        default:
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_FAILED_LOADING_PRIVATE_KEY);
-                goto err;
-        }
-        return res;
- err:
-        if (res)
-                EVP_PKEY_free(res);
-#ifndef OPENSSL_NO_RSA
-        if (rsatmp)
-                RSA_free(rsatmp);
-#endif
-#ifndef OPENSSL_NO_DSA
-        if (dsatmp)
-                DSA_free(dsatmp);
-#endif
-        return NULL;
-}
-
-static EVP_PKEY *surewarehk_load_privkey(ENGINE *e, const char *key_id,
-                                         UI_METHOD *ui_method, void *callback_data)
-{
-        EVP_PKEY *res = NULL;
-        int ret=0;
-        unsigned long el=0;
-        char *hptr=NULL;
-        char keytype=0;
-        char msg[64]="ENGINE_load_privkey";
-
-        if(!p_surewarehk_Load_Privkey)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_NOT_INITIALISED);
-        }
-        else
-        {
-                ret=p_surewarehk_Load_Privkey(msg,key_id,&hptr,&el,&keytype);
-                if (ret!=1)
-                {
-                        SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_FAILED_LOADING_PRIVATE_KEY);
-                        ERR_add_error_data(1,msg);              
-                }
-                else
-                        res=sureware_load_public(e,key_id,hptr,el,keytype);
-        }
-        return res;
-}
-
-static EVP_PKEY *surewarehk_load_pubkey(ENGINE *e, const char *key_id,
-                                         UI_METHOD *ui_method, void *callback_data)
-{
-        EVP_PKEY *res = NULL;
-        int ret=0;
-        unsigned long el=0;
-        char *hptr=NULL;
-        char keytype=0;
-        char msg[64]="ENGINE_load_pubkey";
-
-        if(!p_surewarehk_Info_Pubkey)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ENGINE_R_NOT_INITIALISED);
-        }
-        else
-        {
-                /* call once to identify if DSA or RSA */
-                ret=p_surewarehk_Info_Pubkey(msg,key_id,&el,&keytype);
-                if (ret!=1)
-                {
-                        SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ENGINE_R_FAILED_LOADING_PUBLIC_KEY);
-                        ERR_add_error_data(1,msg);
-                }
-                else
-                        res=sureware_load_public(e,key_id,hptr,el,keytype);
-        }
-        return res;
-}
-
-/* This cleans up an RSA/DSA KM key(do not destroy the key into the hardware)
-, called when ex_data is freed */
-static void surewarehk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
-        int idx,long argl, void *argp)
-{
-        if(!p_surewarehk_Free)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_EX_FREE,ENGINE_R_NOT_INITIALISED);
-        }
-        else
-                p_surewarehk_Free((char *)item,0);
-}
-
-#if 0
-/* This cleans up an DH KM key (destroys the key into hardware), 
-called when ex_data is freed */
-static void surewarehk_dh_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
-        int idx,long argl, void *argp)
-{
-        if(!p_surewarehk_Free)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_EX_FREE,ENGINE_R_NOT_INITIALISED);
-        }
-        else
-                p_surewarehk_Free((char *)item,1);
-}
-#endif
-
-/*
-* return number of decrypted bytes
-*/
-#ifndef OPENSSL_NO_RSA
-static int surewarehk_rsa_priv_dec(int flen,const unsigned char *from,unsigned char *to,
-                        RSA *rsa,int padding)
-{
-        int ret=0,tlen;
-        char *buf=NULL,*hptr=NULL;
-        char msg[64]="ENGINE_rsa_priv_dec";
-        if (!p_surewarehk_Rsa_Priv_Dec)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,ENGINE_R_NOT_INITIALISED);
-        }
-        /* extract ref to private key */
-        else if (!(hptr=RSA_get_ex_data(rsa, rsaHndidx)))
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,SUREWARE_R_MISSING_KEY_COMPONENTS);
-                goto err;
-        }
-        /* analyse what padding we can do into the hardware */
-        if (padding==RSA_PKCS1_PADDING)
-        {
-                /* do it one shot */
-                ret=p_surewarehk_Rsa_Priv_Dec(msg,flen,(unsigned char *)from,&tlen,to,hptr,SUREWARE_PKCS1_PAD);
-                surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,ret);
-                if (ret!=1)
-                        goto err;
-                ret=tlen;
-        }
-        else /* do with no padding into hardware */
-        {
-                ret=p_surewarehk_Rsa_Priv_Dec(msg,flen,(unsigned char *)from,&tlen,to,hptr,SUREWARE_NO_PAD);
-                surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,ret);
-                if (ret!=1)
-                        goto err;
-                /* intermediate buffer for padding */
-                if ((buf=OPENSSL_malloc(tlen)) == NULL)
-                {
-                        RSAerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,ERR_R_MALLOC_FAILURE);
-                        goto err;
-                }
-                memcpy(buf,to,tlen);/* transfert to into buf */
-                switch (padding) /* check padding in software */
-                {
-#ifndef OPENSSL_NO_SHA
-                case RSA_PKCS1_OAEP_PADDING:
-                        ret=RSA_padding_check_PKCS1_OAEP(to,tlen,(unsigned char *)buf,tlen,tlen,NULL,0);
-                        break;
-#endif
-                case RSA_SSLV23_PADDING:
-                        ret=RSA_padding_check_SSLv23(to,tlen,(unsigned char *)buf,flen,tlen);
-                        break;
-                case RSA_NO_PADDING:
-                        ret=RSA_padding_check_none(to,tlen,(unsigned char *)buf,flen,tlen);
-                        break;
-                default:
-                        RSAerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,RSA_R_UNKNOWN_PADDING_TYPE);
-                        goto err;
-                }
-                if (ret < 0)
-                        RSAerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,RSA_R_PADDING_CHECK_FAILED);
-        }
-err:
-        if (buf)
-        {
-                OPENSSL_cleanse(buf,tlen);
-                OPENSSL_free(buf);
-        }
-        return ret;
-}
-
-/*
-* Does what OpenSSL rsa_priv_enc does.
-*/
-static int surewarehk_rsa_sign(int flen,const unsigned char *from,unsigned char *to,
-                            RSA *rsa,int padding)
-{
-        int ret=0,tlen;
-        char *hptr=NULL;
-        char msg[64]="ENGINE_rsa_sign";
-        if (!p_surewarehk_Rsa_Sign)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_ENC,ENGINE_R_NOT_INITIALISED);
-        }
-        /* extract ref to private key */
-        else if (!(hptr=RSA_get_ex_data(rsa, rsaHndidx)))
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_ENC,SUREWARE_R_MISSING_KEY_COMPONENTS);
-        }
-        else
-        {
-                switch (padding)
-                {
-                case RSA_PKCS1_PADDING: /* do it in one shot */
-                        ret=p_surewarehk_Rsa_Sign(msg,flen,(unsigned char *)from,&tlen,to,hptr,SUREWARE_PKCS1_PAD);
-                        surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RSA_PRIV_ENC,ret);
-                        break;
-                case RSA_NO_PADDING:
-                default:
-                        RSAerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_ENC,RSA_R_UNKNOWN_PADDING_TYPE);
-                }
-        }
-        return ret==1 ? tlen : ret;
-}
-
-#endif
-
-#ifndef OPENSSL_NO_DSA
-/* DSA sign and verify */
-static  DSA_SIG * surewarehk_dsa_do_sign(const unsigned char *from, int flen, DSA *dsa)
-{
-        int ret=0;
-        char *hptr=NULL;
-        DSA_SIG *psign=NULL;
-        char msg[64]="ENGINE_dsa_do_sign";
-        if (!p_surewarehk_Dsa_Sign)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,ENGINE_R_NOT_INITIALISED);
-        }
-        /* extract ref to private key */
-        else if (!(hptr=DSA_get_ex_data(dsa, dsaHndidx)))
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,SUREWARE_R_MISSING_KEY_COMPONENTS);
-        }
-        else
-        {
-                if((psign = DSA_SIG_new()) == NULL)
-                {
-                        SUREWAREerr(SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,ERR_R_MALLOC_FAILURE);
-                        goto err;
-                }
-                psign->r=BN_new();
-                psign->s=BN_new();
-                bn_expand2(psign->r, 20/sizeof(BN_ULONG));
-                bn_expand2(psign->s, 20/sizeof(BN_ULONG));
-                if (!psign->r || psign->r->dmax!=20/sizeof(BN_ULONG) ||
-                        !psign->s || psign->s->dmax!=20/sizeof(BN_ULONG))
-                        goto err;
-                ret=p_surewarehk_Dsa_Sign(msg,flen,from,
-                                          (unsigned long *)psign->r->d,
-                                          (unsigned long *)psign->s->d,
-                                          hptr);
-                surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,ret);
-        }
-        psign->r->top=20/sizeof(BN_ULONG);
-        bn_fix_top(psign->r);
-        psign->s->top=20/sizeof(BN_ULONG);
-        bn_fix_top(psign->s);
-
-err:    
-        if (psign)
-        {
-                DSA_SIG_free(psign);
-                psign=NULL;
-        }
-        return psign;
-}
-#endif
-
-static int surewarehk_modexp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                             const BIGNUM *m, BN_CTX *ctx)
-{
-        int ret=0;
-        char msg[64]="ENGINE_modexp";
-        if (!p_surewarehk_Mod_Exp)
-        {
-                SUREWAREerr(SUREWARE_F_SUREWAREHK_MOD_EXP,ENGINE_R_NOT_INITIALISED);
-        }
-        else
-        {
-                bn_expand2(r,m->top);
-                if (r && r->dmax==m->top)
-                {
-                        /* do it*/
-                        ret=p_surewarehk_Mod_Exp(msg,
-                                                 m->top*sizeof(BN_ULONG),
-                                                 (unsigned long *)m->d,
-                                                 p->top*sizeof(BN_ULONG),
-                                                 (unsigned long *)p->d,
-                                                 a->top*sizeof(BN_ULONG),
-                                                 (unsigned long *)a->d,
-                                                 (unsigned long *)r->d);
-                        surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_MOD_EXP,ret);
-                        if (ret==1)
-                        {
-                                /* normalise result */
-                                r->top=m->top;
-                                bn_fix_top(r);
-                        }
-                }
-        }
-        return ret;
-}
-#endif /* !OPENSSL_NO_HW_SureWare */
-#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libcrypto/engine/hw_sureware_err.c b/src/lib/libcrypto/engine/hw_sureware_err.c
deleted file mode 100644
index 69955dadbb..0000000000
--- a/src/lib/libcrypto/engine/hw_sureware_err.c
+++ /dev/null
@@ -1,150 +0,0 @@
-/* hw_sureware_err.c */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-/* NOTE: this file was auto generated by the mkerr.pl script: any changes
- * made to it will be overwritten when the script next updates this file,
- * only reason strings will be preserved.
- */
-
-#include <stdio.h>
-#include <openssl/err.h>
-#include "hw_sureware_err.h"
-
-/* BEGIN ERROR CODES */
-#ifndef OPENSSL_NO_ERR
-static ERR_STRING_DATA SUREWARE_str_functs[]=
-        {
-{ERR_PACK(0,SUREWARE_F_SUREWAREHK_CTRL,0),      "SUREWAREHK_CTRL"},
-{ERR_PACK(0,SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,0),       "SUREWAREHK_DSA_DO_SIGN"},
-{ERR_PACK(0,SUREWARE_F_SUREWAREHK_EX_FREE,0),   "SUREWAREHK_EX_FREE"},
-{ERR_PACK(0,SUREWARE_F_SUREWAREHK_FINISH,0),    "SUREWAREHK_FINISH"},
-{ERR_PACK(0,SUREWARE_F_SUREWAREHK_INIT,0),      "SUREWAREHK_INIT"},
-{ERR_PACK(0,SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY,0),  "SUREWAREHK_LOAD_PRIVATE_KEY"},
-{ERR_PACK(0,SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY,0),   "SUREWAREHK_LOAD_PUBLIC_KEY"},
-{ERR_PACK(0,SUREWARE_F_SUREWAREHK_MOD_EXP,0),   "SUREWAREHK_MOD_EXP"},
-{ERR_PACK(0,SUREWARE_F_SUREWAREHK_RAND_BYTES,0),        "SUREWAREHK_RAND_BYTES"},
-{ERR_PACK(0,SUREWARE_F_SUREWAREHK_RAND_SEED,0), "SUREWAREHK_RAND_SEED"},
-{ERR_PACK(0,SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,0),      "SUREWAREHK_RSA_PRIV_DEC"},
-{ERR_PACK(0,SUREWARE_F_SUREWAREHK_RSA_PRIV_ENC,0),      "SUREWAREHK_RSA_PRIV_ENC"},
-{0,NULL}
-        };
-
-static ERR_STRING_DATA SUREWARE_str_reasons[]=
-        {
-{SUREWARE_R_BIO_WAS_FREED                ,"bio was freed"},
-{SUREWARE_R_MISSING_KEY_COMPONENTS       ,"missing key components"},
-{SUREWARE_R_REQUEST_FAILED               ,"request failed"},
-{SUREWARE_R_REQUEST_FALLBACK             ,"request fallback"},
-{SUREWARE_R_SIZE_TOO_LARGE_OR_TOO_SMALL  ,"size too large or too small"},
-{SUREWARE_R_UNIT_FAILURE                 ,"unit failure"},
-{0,NULL}
-        };
-
-#endif
-
-#ifdef SUREWARE_LIB_NAME
-static ERR_STRING_DATA SUREWARE_lib_name[]=
-        {
-{0      ,SUREWARE_LIB_NAME},
-{0,NULL}
-        };
-#endif
-
-
-static int SUREWARE_lib_error_code=0;
-static int SUREWARE_error_init=1;
-
-static void ERR_load_SUREWARE_strings(void)
-        {
-        if (SUREWARE_lib_error_code == 0)
-                SUREWARE_lib_error_code=ERR_get_next_error_library();
-
-        if (SUREWARE_error_init)
-                {
-                SUREWARE_error_init=0;
-#ifndef OPENSSL_NO_ERR
-                ERR_load_strings(SUREWARE_lib_error_code,SUREWARE_str_functs);
-                ERR_load_strings(SUREWARE_lib_error_code,SUREWARE_str_reasons);
-#endif
-
-#ifdef SUREWARE_LIB_NAME
-                SUREWARE_lib_name->error = ERR_PACK(SUREWARE_lib_error_code,0,0);
-                ERR_load_strings(0,SUREWARE_lib_name);
-#endif
-                }
-        }
-
-static void ERR_unload_SUREWARE_strings(void)
-        {
-        if (SUREWARE_error_init == 0)
-                {
-#ifndef OPENSSL_NO_ERR
-                ERR_unload_strings(SUREWARE_lib_error_code,SUREWARE_str_functs);
-                ERR_unload_strings(SUREWARE_lib_error_code,SUREWARE_str_reasons);
-#endif
-
-#ifdef SUREWARE_LIB_NAME
-                ERR_unload_strings(0,SUREWARE_lib_name);
-#endif
-                SUREWARE_error_init=1;
-                }
-        }
-
-static void ERR_SUREWARE_error(int function, int reason, char *file, int line)
-        {
-        if (SUREWARE_lib_error_code == 0)
-                SUREWARE_lib_error_code=ERR_get_next_error_library();
-        ERR_PUT_error(SUREWARE_lib_error_code,function,reason,file,line);
-        }
diff --git a/src/lib/libcrypto/engine/hw_sureware_err.h b/src/lib/libcrypto/engine/hw_sureware_err.h
deleted file mode 100644
index bc52af5e05..0000000000
--- a/src/lib/libcrypto/engine/hw_sureware_err.h
+++ /dev/null
@@ -1,94 +0,0 @@
-/* ====================================================================
- * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#ifndef HEADER_SUREWARE_ERR_H
-#define HEADER_SUREWARE_ERR_H
-
-/* BEGIN ERROR CODES */
-/* The following lines are auto generated by the script mkerr.pl. Any changes
- * made after this point may be overwritten when the script is next run.
- */
-static void ERR_load_SUREWARE_strings(void);
-static void ERR_unload_SUREWARE_strings(void);
-static void ERR_SUREWARE_error(int function, int reason, char *file, int line);
-#define SUREWAREerr(f,r) ERR_SUREWARE_error((f),(r),__FILE__,__LINE__)
-
-/* Error codes for the SUREWARE functions. */
-
-/* Function codes. */
-#define SUREWARE_F_SUREWAREHK_CTRL                       100
-#define SUREWARE_F_SUREWAREHK_DSA_DO_SIGN                101
-#define SUREWARE_F_SUREWAREHK_EX_FREE                    102
-#define SUREWARE_F_SUREWAREHK_FINISH                     103
-#define SUREWARE_F_SUREWAREHK_INIT                       104
-#define SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY           105
-#define SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY            106
-#define SUREWARE_F_SUREWAREHK_MOD_EXP                    107
-#define SUREWARE_F_SUREWAREHK_RAND_BYTES                 108
-#define SUREWARE_F_SUREWAREHK_RAND_SEED                  109
-#define SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC               110
-#define SUREWARE_F_SUREWAREHK_RSA_PRIV_ENC               111
-
-/* Reason codes. */
-#define SUREWARE_R_BIO_WAS_FREED                         100
-#define SUREWARE_R_MISSING_KEY_COMPONENTS                105
-#define SUREWARE_R_REQUEST_FAILED                        101
-#define SUREWARE_R_REQUEST_FALLBACK                      102
-#define SUREWARE_R_SIZE_TOO_LARGE_OR_TOO_SMALL           103
-#define SUREWARE_R_UNIT_FAILURE                          104
-
-#ifdef  __cplusplus
-}
-#endif
-#endif
diff --git a/src/lib/libcrypto/engine/hw_ubsec.c b/src/lib/libcrypto/engine/hw_ubsec.c
deleted file mode 100644
index 8fb834af31..0000000000
--- a/src/lib/libcrypto/engine/hw_ubsec.c
+++ /dev/null
@@ -1,1061 +0,0 @@
-/* crypto/engine/hw_ubsec.c */
-/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
- * project 2000.
- *
- * Cloned shamelessly by Joe Tardo. 
- */
-/* ====================================================================
- * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <openssl/crypto.h>
-#include "cryptlib.h"
-#include <openssl/dso.h>
-#include <openssl/engine.h>
-
-#ifndef OPENSSL_NO_HW
-#ifndef OPENSSL_NO_HW_UBSEC
-
-#ifdef FLAT_INC
-#include "hw_ubsec.h"
-#else
-#include "vendor_defns/hw_ubsec.h"
-#endif
-
-#define UBSEC_LIB_NAME "ubsec engine"
-#include "hw_ubsec_err.c"
-
-#define FAIL_TO_SOFTWARE -15
-
-static int ubsec_destroy(ENGINE *e);
-static int ubsec_init(ENGINE *e);
-static int ubsec_finish(ENGINE *e);
-static int ubsec_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
-static int ubsec_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx);
-static int ubsec_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                        const BIGNUM *q, const BIGNUM *dp,
-                        const BIGNUM *dq, const BIGNUM *qinv, BN_CTX *ctx);
-#ifndef OPENSSL_NO_RSA
-static int ubsec_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
-#endif
-static int ubsec_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
-#ifndef OPENSSL_NO_DSA
-#ifdef NOT_USED
-static int ubsec_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
-                BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
-                BN_CTX *ctx, BN_MONT_CTX *in_mont);
-static int ubsec_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
-                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
-                BN_MONT_CTX *m_ctx);
-#endif
-static DSA_SIG *ubsec_dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
-static int ubsec_dsa_verify(const unsigned char *dgst, int dgst_len,
-                                DSA_SIG *sig, DSA *dsa);
-#endif
-#ifndef OPENSSL_NO_DH
-static int ubsec_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
-                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
-                BN_MONT_CTX *m_ctx);
-static int ubsec_dh_compute_key(unsigned char *key,const BIGNUM *pub_key,DH *dh);
-static int ubsec_dh_generate_key(DH *dh);
-#endif
-
-#ifdef NOT_USED
-static int ubsec_rand_bytes(unsigned char *buf, int num);
-static int ubsec_rand_status(void);
-#endif
-
-#define UBSEC_CMD_SO_PATH               ENGINE_CMD_BASE
-static const ENGINE_CMD_DEFN ubsec_cmd_defns[] = {
-        {UBSEC_CMD_SO_PATH,
-                "SO_PATH",
-                "Specifies the path to the 'ubsec' shared library",
-                ENGINE_CMD_FLAG_STRING},
-        {0, NULL, NULL, 0}
-        };
-
-#ifndef OPENSSL_NO_RSA
-/* Our internal RSA_METHOD that we provide pointers to */
-static RSA_METHOD ubsec_rsa =
-        {
-        "UBSEC RSA method",
-        NULL,
-        NULL,
-        NULL,
-        NULL,
-        ubsec_rsa_mod_exp,
-        ubsec_mod_exp_mont,
-        NULL,
-        NULL,
-        0,
-        NULL,
-        NULL,
-        NULL
-        };
-#endif
-
-#ifndef OPENSSL_NO_DSA
-/* Our internal DSA_METHOD that we provide pointers to */
-static DSA_METHOD ubsec_dsa =
-        {
-        "UBSEC DSA method",
-        ubsec_dsa_do_sign, /* dsa_do_sign */
-        NULL, /* dsa_sign_setup */
-        ubsec_dsa_verify, /* dsa_do_verify */
-        NULL, /* ubsec_dsa_mod_exp */ /* dsa_mod_exp */
-        NULL, /* ubsec_mod_exp_dsa */ /* bn_mod_exp */
-        NULL, /* init */
-        NULL, /* finish */
-        0, /* flags */
-        NULL /* app_data */
-        };
-#endif
-
-#ifndef OPENSSL_NO_DH
-/* Our internal DH_METHOD that we provide pointers to */
-static DH_METHOD ubsec_dh =
-        {
-        "UBSEC DH method",
-        ubsec_dh_generate_key,
-        ubsec_dh_compute_key,
-        ubsec_mod_exp_dh,
-        NULL,
-        NULL,
-        0,
-        NULL
-        };
-#endif
-
-/* Constants used when creating the ENGINE */
-static const char *engine_ubsec_id = "ubsec";
-static const char *engine_ubsec_name = "UBSEC hardware engine support";
-
-/* This internal function is used by ENGINE_ubsec() and possibly by the
- * "dynamic" ENGINE support too */
-static int bind_helper(ENGINE *e)
-        {
-#ifndef OPENSSL_NO_RSA
-        const RSA_METHOD *meth1;
-#endif
-#ifndef OPENSSL_NO_DH
-#ifndef HAVE_UBSEC_DH
-        const DH_METHOD *meth3;
-#endif /* HAVE_UBSEC_DH */
-#endif
-        if(!ENGINE_set_id(e, engine_ubsec_id) ||
-                        !ENGINE_set_name(e, engine_ubsec_name) ||
-#ifndef OPENSSL_NO_RSA
-                        !ENGINE_set_RSA(e, &ubsec_rsa) ||
-#endif
-#ifndef OPENSSL_NO_DSA
-                        !ENGINE_set_DSA(e, &ubsec_dsa) ||
-#endif
-#ifndef OPENSSL_NO_DH
-                        !ENGINE_set_DH(e, &ubsec_dh) ||
-#endif
-                        !ENGINE_set_destroy_function(e, ubsec_destroy) ||
-                        !ENGINE_set_init_function(e, ubsec_init) ||
-                        !ENGINE_set_finish_function(e, ubsec_finish) ||
-                        !ENGINE_set_ctrl_function(e, ubsec_ctrl) ||
-                        !ENGINE_set_cmd_defns(e, ubsec_cmd_defns))
-                return 0;
-
-#ifndef OPENSSL_NO_RSA
-        /* We know that the "PKCS1_SSLeay()" functions hook properly
-         * to the Broadcom-specific mod_exp and mod_exp_crt so we use
-         * those functions. NB: We don't use ENGINE_openssl() or
-         * anything "more generic" because something like the RSAref
-         * code may not hook properly, and if you own one of these
-         * cards then you have the right to do RSA operations on it
-         * anyway! */ 
-        meth1 = RSA_PKCS1_SSLeay();
-        ubsec_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
-        ubsec_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
-        ubsec_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
-        ubsec_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
-#endif
-
-#ifndef OPENSSL_NO_DH
-#ifndef HAVE_UBSEC_DH
-        /* Much the same for Diffie-Hellman */
-        meth3 = DH_OpenSSL();
-        ubsec_dh.generate_key = meth3->generate_key;
-        ubsec_dh.compute_key = meth3->compute_key;
-#endif /* HAVE_UBSEC_DH */
-#endif
-
-        /* Ensure the ubsec error handling is set up */
-        ERR_load_UBSEC_strings();
-        return 1;
-        }
-
-#ifndef ENGINE_DYNAMIC_SUPPORT
-static ENGINE *engine_ubsec(void)
-        {
-        ENGINE *ret = ENGINE_new();
-        if(!ret)
-                return NULL;
-        if(!bind_helper(ret))
-                {
-                ENGINE_free(ret);
-                return NULL;
-                }
-        return ret;
-        }
-
-void ENGINE_load_ubsec(void)
-        {
-        /* Copied from eng_[openssl|dyn].c */
-        ENGINE *toadd = engine_ubsec();
-        if(!toadd) return;
-        ENGINE_add(toadd);
-        ENGINE_free(toadd);
-        ERR_clear_error();
-        }
-#endif
-
-/* This is a process-global DSO handle used for loading and unloading
- * the UBSEC library. NB: This is only set (or unset) during an
- * init() or finish() call (reference counts permitting) and they're
- * operating with global locks, so this should be thread-safe
- * implicitly. */
-
-static DSO *ubsec_dso = NULL;
-
-/* These are the function pointers that are (un)set when the library has
- * successfully (un)loaded. */
-
-static t_UBSEC_ubsec_bytes_to_bits *p_UBSEC_ubsec_bytes_to_bits = NULL;
-static t_UBSEC_ubsec_bits_to_bytes *p_UBSEC_ubsec_bits_to_bytes = NULL;
-static t_UBSEC_ubsec_open *p_UBSEC_ubsec_open = NULL;
-static t_UBSEC_ubsec_close *p_UBSEC_ubsec_close = NULL;
-#ifndef OPENSSL_NO_DH
-static t_UBSEC_diffie_hellman_generate_ioctl 
-        *p_UBSEC_diffie_hellman_generate_ioctl = NULL;
-static t_UBSEC_diffie_hellman_agree_ioctl *p_UBSEC_diffie_hellman_agree_ioctl = NULL;
-#endif
-/* #ifndef OPENSSL_NO_RSA */
-static t_UBSEC_rsa_mod_exp_ioctl *p_UBSEC_rsa_mod_exp_ioctl = NULL;
-static t_UBSEC_rsa_mod_exp_crt_ioctl *p_UBSEC_rsa_mod_exp_crt_ioctl = NULL;
-/* #endif */
-#ifndef OPENSSL_NO_DSA
-static t_UBSEC_dsa_sign_ioctl *p_UBSEC_dsa_sign_ioctl = NULL;
-static t_UBSEC_dsa_verify_ioctl *p_UBSEC_dsa_verify_ioctl = NULL;
-#endif
-static t_UBSEC_math_accelerate_ioctl *p_UBSEC_math_accelerate_ioctl = NULL;
-static t_UBSEC_rng_ioctl *p_UBSEC_rng_ioctl = NULL;
-static t_UBSEC_max_key_len_ioctl *p_UBSEC_max_key_len_ioctl = NULL;
-
-static int max_key_len = 1024;  /* ??? */
-
-/* 
- * These are the static string constants for the DSO file name and the function
- * symbol names to bind to. 
- */
-
-static const char *UBSEC_LIBNAME = NULL;
-static const char *get_UBSEC_LIBNAME(void)
-        {
-        if(UBSEC_LIBNAME)
-                return UBSEC_LIBNAME;
-        return "ubsec";
-        }
-static void free_UBSEC_LIBNAME(void)
-        {
-        if(UBSEC_LIBNAME)
-                OPENSSL_free((void*)UBSEC_LIBNAME);
-        UBSEC_LIBNAME = NULL;
-        }
-static long set_UBSEC_LIBNAME(const char *name)
-        {
-        free_UBSEC_LIBNAME();
-        return (((UBSEC_LIBNAME = BUF_strdup(name)) != NULL) ? 1 : 0);
-        }
-static const char *UBSEC_F1 = "ubsec_bytes_to_bits";
-static const char *UBSEC_F2 = "ubsec_bits_to_bytes";
-static const char *UBSEC_F3 = "ubsec_open";
-static const char *UBSEC_F4 = "ubsec_close";
-#ifndef OPENSSL_NO_DH
-static const char *UBSEC_F5 = "diffie_hellman_generate_ioctl";
-static const char *UBSEC_F6 = "diffie_hellman_agree_ioctl";
-#endif
-/* #ifndef OPENSSL_NO_RSA */
-static const char *UBSEC_F7 = "rsa_mod_exp_ioctl";
-static const char *UBSEC_F8 = "rsa_mod_exp_crt_ioctl";
-/* #endif */
-#ifndef OPENSSL_NO_DSA
-static const char *UBSEC_F9 = "dsa_sign_ioctl";
-static const char *UBSEC_F10 = "dsa_verify_ioctl";
-#endif
-static const char *UBSEC_F11 = "math_accelerate_ioctl";
-static const char *UBSEC_F12 = "rng_ioctl";
-static const char *UBSEC_F13 = "ubsec_max_key_len_ioctl";
-
-/* Destructor (complements the "ENGINE_ubsec()" constructor) */
-static int ubsec_destroy(ENGINE *e)
-        {
-        free_UBSEC_LIBNAME();
-        ERR_unload_UBSEC_strings();
-        return 1;
-        }
-
-/* (de)initialisation functions. */
-static int ubsec_init(ENGINE *e)
-        {
-        t_UBSEC_ubsec_bytes_to_bits *p1;
-        t_UBSEC_ubsec_bits_to_bytes *p2;
-        t_UBSEC_ubsec_open *p3;
-        t_UBSEC_ubsec_close *p4;
-#ifndef OPENSSL_NO_DH
-        t_UBSEC_diffie_hellman_generate_ioctl *p5;
-        t_UBSEC_diffie_hellman_agree_ioctl *p6;
-#endif
-/* #ifndef OPENSSL_NO_RSA */
-        t_UBSEC_rsa_mod_exp_ioctl *p7;
-        t_UBSEC_rsa_mod_exp_crt_ioctl *p8;
-/* #endif */
-#ifndef OPENSSL_NO_DSA
-        t_UBSEC_dsa_sign_ioctl *p9;
-        t_UBSEC_dsa_verify_ioctl *p10;
-#endif
-        t_UBSEC_math_accelerate_ioctl *p11;
-        t_UBSEC_rng_ioctl *p12;
-        t_UBSEC_max_key_len_ioctl *p13;
-        int fd = 0;
-
-        if(ubsec_dso != NULL)
-                {
-                UBSECerr(UBSEC_F_UBSEC_INIT, UBSEC_R_ALREADY_LOADED);
-                goto err;
-                }
-        /* 
-         * Attempt to load libubsec.so/ubsec.dll/whatever. 
-         */
-        ubsec_dso = DSO_load(NULL, get_UBSEC_LIBNAME(), NULL, 0);
-        if(ubsec_dso == NULL)
-                {
-                UBSECerr(UBSEC_F_UBSEC_INIT, UBSEC_R_DSO_FAILURE);
-                goto err;
-                }
-
-        if (
-        !(p1 = (t_UBSEC_ubsec_bytes_to_bits *) DSO_bind_func(ubsec_dso, UBSEC_F1)) ||
-        !(p2 = (t_UBSEC_ubsec_bits_to_bytes *) DSO_bind_func(ubsec_dso, UBSEC_F2)) ||
-        !(p3 = (t_UBSEC_ubsec_open *) DSO_bind_func(ubsec_dso, UBSEC_F3)) ||
-        !(p4 = (t_UBSEC_ubsec_close *) DSO_bind_func(ubsec_dso, UBSEC_F4)) ||
-#ifndef OPENSSL_NO_DH
-        !(p5 = (t_UBSEC_diffie_hellman_generate_ioctl *) 
-                                DSO_bind_func(ubsec_dso, UBSEC_F5)) ||
-        !(p6 = (t_UBSEC_diffie_hellman_agree_ioctl *) 
-                                DSO_bind_func(ubsec_dso, UBSEC_F6)) ||
-#endif
-/* #ifndef OPENSSL_NO_RSA */
-        !(p7 = (t_UBSEC_rsa_mod_exp_ioctl *) DSO_bind_func(ubsec_dso, UBSEC_F7)) ||
-        !(p8 = (t_UBSEC_rsa_mod_exp_crt_ioctl *) DSO_bind_func(ubsec_dso, UBSEC_F8)) ||
-/* #endif */
-#ifndef OPENSSL_NO_DSA
-        !(p9 = (t_UBSEC_dsa_sign_ioctl *) DSO_bind_func(ubsec_dso, UBSEC_F9)) ||
-        !(p10 = (t_UBSEC_dsa_verify_ioctl *) DSO_bind_func(ubsec_dso, UBSEC_F10)) ||
-#endif
-        !(p11 = (t_UBSEC_math_accelerate_ioctl *) 
-                                DSO_bind_func(ubsec_dso, UBSEC_F11)) ||
-        !(p12 = (t_UBSEC_rng_ioctl *) DSO_bind_func(ubsec_dso, UBSEC_F12)) ||
-        !(p13 = (t_UBSEC_max_key_len_ioctl *) DSO_bind_func(ubsec_dso, UBSEC_F13)))
-                {
-                UBSECerr(UBSEC_F_UBSEC_INIT, UBSEC_R_DSO_FAILURE);
-                goto err;
-                }
-
-        /* Copy the pointers */
-        p_UBSEC_ubsec_bytes_to_bits = p1;
-        p_UBSEC_ubsec_bits_to_bytes = p2;
-        p_UBSEC_ubsec_open = p3;
-        p_UBSEC_ubsec_close = p4;
-#ifndef OPENSSL_NO_DH
-        p_UBSEC_diffie_hellman_generate_ioctl = p5;
-        p_UBSEC_diffie_hellman_agree_ioctl = p6;
-#endif
-#ifndef OPENSSL_NO_RSA
-        p_UBSEC_rsa_mod_exp_ioctl = p7;
-        p_UBSEC_rsa_mod_exp_crt_ioctl = p8;
-#endif
-#ifndef OPENSSL_NO_DSA
-        p_UBSEC_dsa_sign_ioctl = p9;
-        p_UBSEC_dsa_verify_ioctl = p10;
-#endif
-        p_UBSEC_math_accelerate_ioctl = p11;
-        p_UBSEC_rng_ioctl = p12;
-        p_UBSEC_max_key_len_ioctl = p13;
-
-        /* Perform an open to see if there's actually any unit running. */
-        if (((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) > 0) && (p_UBSEC_max_key_len_ioctl(fd, &max_key_len) == 0))
-        {
-           p_UBSEC_ubsec_close(fd);
-           return 1;
-        }
-        else
-        {
-          UBSECerr(UBSEC_F_UBSEC_INIT, UBSEC_R_UNIT_FAILURE);
-        }
-
-err:
-        if(ubsec_dso)
-                DSO_free(ubsec_dso);
-        ubsec_dso = NULL;
-        p_UBSEC_ubsec_bytes_to_bits = NULL;
-        p_UBSEC_ubsec_bits_to_bytes = NULL;
-        p_UBSEC_ubsec_open = NULL;
-        p_UBSEC_ubsec_close = NULL;
-#ifndef OPENSSL_NO_DH
-        p_UBSEC_diffie_hellman_generate_ioctl = NULL;
-        p_UBSEC_diffie_hellman_agree_ioctl = NULL;
-#endif
-#ifndef OPENSSL_NO_RSA
-        p_UBSEC_rsa_mod_exp_ioctl = NULL;
-        p_UBSEC_rsa_mod_exp_crt_ioctl = NULL;
-#endif
-#ifndef OPENSSL_NO_DSA
-        p_UBSEC_dsa_sign_ioctl = NULL;
-        p_UBSEC_dsa_verify_ioctl = NULL;
-#endif
-        p_UBSEC_math_accelerate_ioctl = NULL;
-        p_UBSEC_rng_ioctl = NULL;
-        p_UBSEC_max_key_len_ioctl = NULL;
-
-        return 0;
-        }
-
-static int ubsec_finish(ENGINE *e)
-        {
-        free_UBSEC_LIBNAME();
-        if(ubsec_dso == NULL)
-                {
-                UBSECerr(UBSEC_F_UBSEC_FINISH, UBSEC_R_NOT_LOADED);
-                return 0;
-                }
-        if(!DSO_free(ubsec_dso))
-                {
-                UBSECerr(UBSEC_F_UBSEC_FINISH, UBSEC_R_DSO_FAILURE);
-                return 0;
-                }
-        ubsec_dso = NULL;
-        p_UBSEC_ubsec_bytes_to_bits = NULL;
-        p_UBSEC_ubsec_bits_to_bytes = NULL;
-        p_UBSEC_ubsec_open = NULL;
-        p_UBSEC_ubsec_close = NULL;
-#ifndef OPENSSL_NO_DH
-        p_UBSEC_diffie_hellman_generate_ioctl = NULL;
-        p_UBSEC_diffie_hellman_agree_ioctl = NULL;
-#endif
-#ifndef OPENSSL_NO_RSA
-        p_UBSEC_rsa_mod_exp_ioctl = NULL;
-        p_UBSEC_rsa_mod_exp_crt_ioctl = NULL;
-#endif
-#ifndef OPENSSL_NO_DSA
-        p_UBSEC_dsa_sign_ioctl = NULL;
-        p_UBSEC_dsa_verify_ioctl = NULL;
-#endif
-        p_UBSEC_math_accelerate_ioctl = NULL;
-        p_UBSEC_rng_ioctl = NULL;
-        p_UBSEC_max_key_len_ioctl = NULL;
-        return 1;
-        }
-
-static int ubsec_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
-        {
-        int initialised = ((ubsec_dso == NULL) ? 0 : 1);
-        switch(cmd)
-                {
-        case UBSEC_CMD_SO_PATH:
-                if(p == NULL)
-                        {
-                        UBSECerr(UBSEC_F_UBSEC_CTRL,ERR_R_PASSED_NULL_PARAMETER);
-                        return 0;
-                        }
-                if(initialised)
-                        {
-                        UBSECerr(UBSEC_F_UBSEC_CTRL,UBSEC_R_ALREADY_LOADED);
-                        return 0;
-                        }
-                return set_UBSEC_LIBNAME((const char *)p);
-        default:
-                break;
-                }
-        UBSECerr(UBSEC_F_UBSEC_CTRL,UBSEC_R_CTRL_COMMAND_NOT_IMPLEMENTED);
-        return 0;
-        }
-
-static int ubsec_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx)
-        {
-        int     y_len = 0;
-        int     fd;
-
-        if(ubsec_dso == NULL)
-        {
-                UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_NOT_LOADED);
-                return 0;
-        }
-
-        /* Check if hardware can't handle this argument. */
-        y_len = BN_num_bits(m);
-        if (y_len > max_key_len) {
-                UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
-                return BN_mod_exp(r, a, p, m, ctx);
-        } 
-
-        if(!bn_wexpand(r, m->top))
-        {
-                UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_BN_EXPAND_FAIL);
-                return 0;
-        }
-
-        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0) {
-                fd = 0;
-                UBSECerr(UBSEC_F_UBSEC_INIT, UBSEC_R_UNIT_FAILURE);
-                return BN_mod_exp(r, a, p, m, ctx);
-        }
-
-        if (p_UBSEC_rsa_mod_exp_ioctl(fd, (unsigned char *)a->d, BN_num_bits(a),
-                (unsigned char *)m->d, BN_num_bits(m), (unsigned char *)p->d, 
-                BN_num_bits(p), (unsigned char *)r->d, &y_len) != 0)
-        {
-                UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_REQUEST_FAILED);
-                p_UBSEC_ubsec_close(fd);
-
-                return BN_mod_exp(r, a, p, m, ctx);
-        }
-
-        p_UBSEC_ubsec_close(fd);
-
-        r->top = (BN_num_bits(m)+BN_BITS2-1)/BN_BITS2;
-        return 1;
-        }
-
-#ifndef OPENSSL_NO_RSA
-static int ubsec_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
-        {
-        BN_CTX *ctx;
-        int to_return = 0;
-
-        if((ctx = BN_CTX_new()) == NULL)
-                goto err;
-
-        if(!rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)
-                {
-                UBSECerr(UBSEC_F_UBSEC_RSA_MOD_EXP, UBSEC_R_MISSING_KEY_COMPONENTS);
-                goto err;
-                }
-
-        to_return = ubsec_mod_exp_crt(r0, I, rsa->p, rsa->q, rsa->dmp1,
-                    rsa->dmq1, rsa->iqmp, ctx);
-        if (to_return == FAIL_TO_SOFTWARE)
-        {
-          /*
-           * Do in software as hardware failed.
-           */
-           const RSA_METHOD *meth = RSA_PKCS1_SSLeay();
-           to_return = (*meth->rsa_mod_exp)(r0, I, rsa);
-        }
-err:
-        if(ctx)
-                BN_CTX_free(ctx);
-        return to_return;
-        }
-#endif
-
-static int ubsec_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                        const BIGNUM *q, const BIGNUM *dp,
-                        const BIGNUM *dq, const BIGNUM *qinv, BN_CTX *ctx)
-        {
-        int     y_len,
-                m_len,
-                fd;
-
-        m_len = BN_num_bytes(p) + BN_num_bytes(q) + 1;
-        y_len = BN_num_bits(p) + BN_num_bits(q);
-
-        /* Check if hardware can't handle this argument. */
-        if (y_len > max_key_len) {
-                UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
-                return FAIL_TO_SOFTWARE;
-        } 
-
-        if (!bn_wexpand(r, p->top + q->top + 1)) {
-                UBSECerr(UBSEC_F_UBSEC_RSA_MOD_EXP_CRT, UBSEC_R_BN_EXPAND_FAIL);
-                return 0;
-        }
-
-        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0) {
-                fd = 0;
-                UBSECerr(UBSEC_F_UBSEC_INIT, UBSEC_R_UNIT_FAILURE);
-                return FAIL_TO_SOFTWARE;
-        }
-
-        if (p_UBSEC_rsa_mod_exp_crt_ioctl(fd,
-                (unsigned char *)a->d, BN_num_bits(a), 
-                (unsigned char *)qinv->d, BN_num_bits(qinv),
-                (unsigned char *)dp->d, BN_num_bits(dp),
-                (unsigned char *)p->d, BN_num_bits(p),
-                (unsigned char *)dq->d, BN_num_bits(dq),
-                (unsigned char *)q->d, BN_num_bits(q),
-                (unsigned char *)r->d,  &y_len) != 0) {
-                UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_REQUEST_FAILED);
-                p_UBSEC_ubsec_close(fd);
-                return FAIL_TO_SOFTWARE;
-        }
-
-        p_UBSEC_ubsec_close(fd);
-
-        r->top = (BN_num_bits(p) + BN_num_bits(q) + BN_BITS2 - 1)/BN_BITS2;
-        return 1;
-}
-
-#ifndef OPENSSL_NO_DSA
-#ifdef NOT_USED
-static int ubsec_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
-                BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
-                BN_CTX *ctx, BN_MONT_CTX *in_mont)
-        {
-        BIGNUM t;
-        int to_return = 0;
- 
-        BN_init(&t);
-        /* let rr = a1 ^ p1 mod m */
-        if (!ubsec_mod_exp(rr,a1,p1,m,ctx)) goto end;
-        /* let t = a2 ^ p2 mod m */
-        if (!ubsec_mod_exp(&t,a2,p2,m,ctx)) goto end;
-        /* let rr = rr * t mod m */
-        if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
-        to_return = 1;
-end:
-        BN_free(&t);
-        return to_return;
-        }
-
-static int ubsec_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
-                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
-                BN_MONT_CTX *m_ctx)
-        {
-        return ubsec_mod_exp(r, a, p, m, ctx);
-        }
-#endif
-#endif
-
-/*
- * This function is aliased to mod_exp (with the mont stuff dropped).
- */
-static int ubsec_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-        {
-        int ret = 0;
-
-#ifndef OPENSSL_NO_RSA
-        /* Do in software if the key is too large for the hardware. */
-        if (BN_num_bits(m) > max_key_len)
-                {
-                const RSA_METHOD *meth = RSA_PKCS1_SSLeay();
-                ret = (*meth->bn_mod_exp)(r, a, p, m, ctx, m_ctx);
-                }
-        else
-#endif
-                {
-                ret = ubsec_mod_exp(r, a, p, m, ctx);
-                }
-        
-        return ret;
-        }
-
-#ifndef OPENSSL_NO_DH
-/* This function is aliased to mod_exp (with the dh and mont dropped). */
-static int ubsec_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
-                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
-                BN_MONT_CTX *m_ctx)
-        {
-        return ubsec_mod_exp(r, a, p, m, ctx);
-        }
-#endif
-
-#ifndef OPENSSL_NO_DSA
-static DSA_SIG *ubsec_dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
-        {
-        DSA_SIG *to_return = NULL;
-        int s_len = 160, r_len = 160, d_len, fd;
-        BIGNUM m, *r=NULL, *s=NULL;
-
-        BN_init(&m);
-
-        s = BN_new();
-        r = BN_new();
-        if ((s == NULL) || (r==NULL))
-                goto err;
-
-        d_len = p_UBSEC_ubsec_bytes_to_bits((unsigned char *)dgst, dlen);
-
-        if(!bn_wexpand(r, (160+BN_BITS2-1)/BN_BITS2) ||
-           (!bn_wexpand(s, (160+BN_BITS2-1)/BN_BITS2))) {
-                UBSECerr(UBSEC_F_UBSEC_DSA_SIGN, UBSEC_R_BN_EXPAND_FAIL);
-                goto err;
-        }
-
-        if (BN_bin2bn(dgst,dlen,&m) == NULL) {
-                UBSECerr(UBSEC_F_UBSEC_DSA_SIGN, UBSEC_R_BN_EXPAND_FAIL);
-                goto err;
-        } 
-
-        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0) {
-                const DSA_METHOD *meth;
-                fd = 0;
-                UBSECerr(UBSEC_F_UBSEC_INIT, UBSEC_R_UNIT_FAILURE);
-                meth = DSA_OpenSSL();
-                to_return =  meth->dsa_do_sign(dgst, dlen, dsa);
-                goto err;
-        }
-
-        if (p_UBSEC_dsa_sign_ioctl(fd, 0, /* compute hash before signing */
-                (unsigned char *)dgst, d_len,
-                NULL, 0,  /* compute random value */
-                (unsigned char *)dsa->p->d, BN_num_bits(dsa->p), 
-                (unsigned char *)dsa->q->d, BN_num_bits(dsa->q),
-                (unsigned char *)dsa->g->d, BN_num_bits(dsa->g),
-                (unsigned char *)dsa->priv_key->d, BN_num_bits(dsa->priv_key),
-                (unsigned char *)r->d, &r_len,
-                (unsigned char *)s->d, &s_len ) != 0) {
-                const DSA_METHOD *meth;
-
-                UBSECerr(UBSEC_F_UBSEC_DSA_SIGN, UBSEC_R_REQUEST_FAILED);
-                p_UBSEC_ubsec_close(fd);
-                meth = DSA_OpenSSL();
-                to_return = meth->dsa_do_sign(dgst, dlen, dsa);
-
-                goto err;
-        }
-
-        p_UBSEC_ubsec_close(fd);
-
-        r->top = (160+BN_BITS2-1)/BN_BITS2;
-        s->top = (160+BN_BITS2-1)/BN_BITS2;
-
-        to_return = DSA_SIG_new();
-        if(to_return == NULL) {
-                UBSECerr(UBSEC_F_UBSEC_DSA_SIGN, UBSEC_R_BN_EXPAND_FAIL);
-                goto err;
-        }
-
-        to_return->r = r;
-        to_return->s = s;
-
-err:
-        if (!to_return) {
-                if (r) BN_free(r);
-                if (s) BN_free(s);
-        }                                 
-        BN_clear_free(&m);
-        return to_return;
-}
-
-static int ubsec_dsa_verify(const unsigned char *dgst, int dgst_len,
-                                DSA_SIG *sig, DSA *dsa)
-        {
-        int v_len, d_len;
-        int to_return = 0;
-        int fd;
-        BIGNUM v;
-
-        BN_init(&v);
-
-        if(!bn_wexpand(&v, dsa->p->top)) {
-                UBSECerr(UBSEC_F_UBSEC_DSA_VERIFY ,UBSEC_R_BN_EXPAND_FAIL);
-                goto err;
-        }
-
-        v_len = BN_num_bits(dsa->p);
-
-        d_len = p_UBSEC_ubsec_bytes_to_bits((unsigned char *)dgst, dgst_len);
-
-        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0) {
-                const DSA_METHOD *meth;
-                fd = 0;
-                UBSECerr(UBSEC_F_UBSEC_INIT, UBSEC_R_UNIT_FAILURE);
-                meth = DSA_OpenSSL();
-                to_return = meth->dsa_do_verify(dgst, dgst_len, sig, dsa);
-                goto err;
-        }
-
-        if (p_UBSEC_dsa_verify_ioctl(fd, 0, /* compute hash before signing */
-                (unsigned char *)dgst, d_len,
-                (unsigned char *)dsa->p->d, BN_num_bits(dsa->p), 
-                (unsigned char *)dsa->q->d, BN_num_bits(dsa->q),
-                (unsigned char *)dsa->g->d, BN_num_bits(dsa->g),
-                (unsigned char *)dsa->pub_key->d, BN_num_bits(dsa->pub_key),
-                (unsigned char *)sig->r->d, BN_num_bits(sig->r),
-                (unsigned char *)sig->s->d, BN_num_bits(sig->s),
-                (unsigned char *)v.d, &v_len) != 0) {
-                const DSA_METHOD *meth;
-                UBSECerr(UBSEC_F_UBSEC_DSA_VERIFY , UBSEC_R_REQUEST_FAILED);
-                p_UBSEC_ubsec_close(fd);
-
-                meth = DSA_OpenSSL();
-                to_return = meth->dsa_do_verify(dgst, dgst_len, sig, dsa);
-
-                goto err;
-        }
-
-        p_UBSEC_ubsec_close(fd);
-
-        to_return = 1;
-err:
-        BN_clear_free(&v);
-        return to_return;
-        }
-#endif
-
-#ifndef OPENSSL_NO_DH
-static int ubsec_dh_compute_key (unsigned char *key,const BIGNUM *pub_key,DH *dh)
-        {
-        int      ret      = -1,
-                 k_len,
-                 fd;
-
-        k_len = BN_num_bits(dh->p);
-
-        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0)
-                {
-                const DH_METHOD *meth;
-                ENGINEerr(UBSEC_F_UBSEC_INIT, UBSEC_R_UNIT_FAILURE);
-                meth = DH_OpenSSL();
-                ret = meth->compute_key(key, pub_key, dh);
-                goto err;
-                }
-
-        if (p_UBSEC_diffie_hellman_agree_ioctl(fd,
-                                               (unsigned char *)dh->priv_key->d, BN_num_bits(dh->priv_key),
-                                               (unsigned char *)pub_key->d, BN_num_bits(pub_key),
-                                               (unsigned char *)dh->p->d, BN_num_bits(dh->p),
-                                               key, &k_len) != 0)
-                {
-                /* Hardware's a no go, failover to software */
-                const DH_METHOD *meth;
-                ENGINEerr(UBSEC_F_UBSEC_DH_COMPUTE_KEY, UBSEC_R_REQUEST_FAILED);
-                p_UBSEC_ubsec_close(fd);
-
-                meth = DH_OpenSSL();
-                ret = meth->compute_key(key, pub_key, dh);
-
-                goto err;
-                }
-
-        p_UBSEC_ubsec_close(fd);
-
-        ret = p_UBSEC_ubsec_bits_to_bytes(k_len);
-err:
-        return ret;
-        }
-
-static int ubsec_dh_generate_key (DH *dh)
-        {
-        int      ret               = 0,
-                 random_bits       = 0,
-                 pub_key_len       = 0,
-                 priv_key_len      = 0,
-                 fd;
-        BIGNUM   *pub_key          = NULL;
-        BIGNUM   *priv_key         = NULL;
-
-        /* 
-         *  How many bits should Random x be? dh_key.c
-         *  sets the range from 0 to num_bits(modulus) ???
-         */
-
-        if (dh->priv_key == NULL)
-                {
-                priv_key = BN_new();
-                if (priv_key == NULL) goto err;
-                priv_key_len = BN_num_bits(dh->p);
-                bn_wexpand(priv_key, dh->p->top);
-                do
-                        if (!BN_rand_range(priv_key, dh->p)) goto err;
-                while (BN_is_zero(priv_key));
-                random_bits = BN_num_bits(priv_key);
-                }
-        else
-                {
-                priv_key = dh->priv_key;
-                }
-
-        if (dh->pub_key == NULL)
-                {
-                pub_key = BN_new();
-                pub_key_len = BN_num_bits(dh->p);
-                bn_wexpand(pub_key, dh->p->top);
-                if(pub_key == NULL) goto err;
-                }
-        else
-                {
-                pub_key = dh->pub_key;
-                }
-
-        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0)
-                {
-                const DH_METHOD *meth;
-                ENGINEerr(UBSEC_F_UBSEC_INIT, UBSEC_R_UNIT_FAILURE);
-                meth = DH_OpenSSL();
-                ret = meth->generate_key(dh);
-                goto err;
-                }
-
-        if (p_UBSEC_diffie_hellman_generate_ioctl(fd,
-                                                  (unsigned char *)priv_key->d, &priv_key_len,
-                                                  (unsigned char *)pub_key->d,  &pub_key_len,
-                                                  (unsigned char *)dh->g->d, BN_num_bits(dh->g),
-                                                  (unsigned char *)dh->p->d, BN_num_bits(dh->p),
-                                                  0, 0, random_bits) != 0)
-                {
-                /* Hardware's a no go, failover to software */
-                const DH_METHOD *meth;
-
-                ENGINEerr(UBSEC_F_UBSEC_DH_COMPUTE_KEY, UBSEC_R_REQUEST_FAILED);
-                p_UBSEC_ubsec_close(fd);
-
-                meth = DH_OpenSSL();
-                ret = meth->generate_key(dh);
-
-                goto err;
-                }
-
-        p_UBSEC_ubsec_close(fd);
-
-        dh->pub_key = pub_key;
-        dh->pub_key->top = (pub_key_len + BN_BITS2-1) / BN_BITS2;
-        dh->priv_key = priv_key;
-        dh->priv_key->top = (priv_key_len + BN_BITS2-1) / BN_BITS2;
-
-        ret = 1;
-err:
-        return ret;
-        }
-#endif
-
-#ifdef NOT_USED
-static int ubsec_rand_bytes(unsigned char * buf,
-                            int num)
-        {
-        int      ret      = 0,
-                 fd;
-
-        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0)
-                {
-                const RAND_METHOD *meth;
-                ENGINEerr(UBSEC_F_UBSEC_INIT, UBSEC_R_UNIT_FAILURE);
-                num = p_UBSEC_ubsec_bits_to_bytes(num);
-                meth = RAND_SSLeay();
-                meth->seed(buf, num);
-                ret = meth->bytes(buf, num);
-                goto err;
-                }
-
-        num *= 8; /* bytes to bits */
-
-        if (p_UBSEC_rng_ioctl(fd,
-                              UBSEC_RNG_DIRECT,
-                              buf,
-                              &num) != 0)
-                {
-                /* Hardware's a no go, failover to software */
-                const RAND_METHOD *meth;
-
-                ENGINEerr(UBSEC_F_UBSEC_RNG_BYTES, UBSEC_R_REQUEST_FAILED);
-                p_UBSEC_ubsec_close(fd);
-
-                num = p_UBSEC_ubsec_bits_to_bytes(num);
-                meth = RAND_SSLeay();
-                meth->seed(buf, num);
-                ret = meth->bytes(buf, num);
-
-                goto err;
-                }
-
-        p_UBSEC_ubsec_close(fd);
-
-        ret = 1;
-err:
-        return(ret);
-        }
-
-
-static int ubsec_rand_status(void)
-        {
-        return 0;
-        }
-#endif
-
-/* This stuff is needed if this ENGINE is being compiled into a self-contained
- * shared-library. */
-#ifdef ENGINE_DYNAMIC_SUPPORT
-static int bind_fn(ENGINE *e, const char *id)
-        {
-        if(id && (strcmp(id, engine_ubsec_id) != 0))
-                return 0;
-        if(!bind_helper(e))
-                return 0;
-        return 1;
-        }
-IMPLEMENT_DYNAMIC_CHECK_FN()
-IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
-#endif /* ENGINE_DYNAMIC_SUPPORT */
-
-#endif /* !OPENSSL_NO_HW_UBSEC */
-#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libcrypto/engine/hw_ubsec_err.c b/src/lib/libcrypto/engine/hw_ubsec_err.c
deleted file mode 100644
index d707331fc2..0000000000
--- a/src/lib/libcrypto/engine/hw_ubsec_err.c
+++ /dev/null
@@ -1,151 +0,0 @@
-/* hw_ubsec_err.c */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-/* NOTE: this file was auto generated by the mkerr.pl script: any changes
- * made to it will be overwritten when the script next updates this file,
- * only reason strings will be preserved.
- */
-
-#include <stdio.h>
-#include <openssl/err.h>
-#include "hw_ubsec_err.h"
-
-/* BEGIN ERROR CODES */
-#ifndef OPENSSL_NO_ERR
-static ERR_STRING_DATA UBSEC_str_functs[]=
-        {
-{ERR_PACK(0,UBSEC_F_UBSEC_CTRL,0),      "UBSEC_CTRL"},
-{ERR_PACK(0,UBSEC_F_UBSEC_DH_COMPUTE_KEY,0),    "UBSEC_DH_COMPUTE_KEY"},
-{ERR_PACK(0,UBSEC_F_UBSEC_DSA_SIGN,0),  "UBSEC_DSA_SIGN"},
-{ERR_PACK(0,UBSEC_F_UBSEC_DSA_VERIFY,0),        "UBSEC_DSA_VERIFY"},
-{ERR_PACK(0,UBSEC_F_UBSEC_FINISH,0),    "UBSEC_FINISH"},
-{ERR_PACK(0,UBSEC_F_UBSEC_INIT,0),      "UBSEC_INIT"},
-{ERR_PACK(0,UBSEC_F_UBSEC_MOD_EXP,0),   "UBSEC_MOD_EXP"},
-{ERR_PACK(0,UBSEC_F_UBSEC_RNG_BYTES,0), "UBSEC_RNG_BYTES"},
-{ERR_PACK(0,UBSEC_F_UBSEC_RSA_MOD_EXP,0),       "UBSEC_RSA_MOD_EXP"},
-{ERR_PACK(0,UBSEC_F_UBSEC_RSA_MOD_EXP_CRT,0),   "UBSEC_RSA_MOD_EXP_CRT"},
-{0,NULL}
-        };
-
-static ERR_STRING_DATA UBSEC_str_reasons[]=
-        {
-{UBSEC_R_ALREADY_LOADED                  ,"already loaded"},
-{UBSEC_R_BN_EXPAND_FAIL                  ,"bn expand fail"},
-{UBSEC_R_CTRL_COMMAND_NOT_IMPLEMENTED    ,"ctrl command not implemented"},
-{UBSEC_R_DSO_FAILURE                     ,"dso failure"},
-{UBSEC_R_MISSING_KEY_COMPONENTS          ,"missing key components"},
-{UBSEC_R_NOT_LOADED                      ,"not loaded"},
-{UBSEC_R_REQUEST_FAILED                  ,"request failed"},
-{UBSEC_R_SIZE_TOO_LARGE_OR_TOO_SMALL     ,"size too large or too small"},
-{UBSEC_R_UNIT_FAILURE                    ,"unit failure"},
-{0,NULL}
-        };
-
-#endif
-
-#ifdef UBSEC_LIB_NAME
-static ERR_STRING_DATA UBSEC_lib_name[]=
-        {
-{0      ,UBSEC_LIB_NAME},
-{0,NULL}
-        };
-#endif
-
-
-static int UBSEC_lib_error_code=0;
-static int UBSEC_error_init=1;
-
-static void ERR_load_UBSEC_strings(void)
-        {
-        if (UBSEC_lib_error_code == 0)
-                UBSEC_lib_error_code=ERR_get_next_error_library();
-
-        if (UBSEC_error_init)
-                {
-                UBSEC_error_init=0;
-#ifndef OPENSSL_NO_ERR
-                ERR_load_strings(UBSEC_lib_error_code,UBSEC_str_functs);
-                ERR_load_strings(UBSEC_lib_error_code,UBSEC_str_reasons);
-#endif
-
-#ifdef UBSEC_LIB_NAME
-                UBSEC_lib_name->error = ERR_PACK(UBSEC_lib_error_code,0,0);
-                ERR_load_strings(0,UBSEC_lib_name);
-#endif
-                }
-        }
-
-static void ERR_unload_UBSEC_strings(void)
-        {
-        if (UBSEC_error_init == 0)
-                {
-#ifndef OPENSSL_NO_ERR
-                ERR_unload_strings(UBSEC_lib_error_code,UBSEC_str_functs);
-                ERR_unload_strings(UBSEC_lib_error_code,UBSEC_str_reasons);
-#endif
-
-#ifdef UBSEC_LIB_NAME
-                ERR_unload_strings(0,UBSEC_lib_name);
-#endif
-                UBSEC_error_init=1;
-                }
-        }
-
-static void ERR_UBSEC_error(int function, int reason, char *file, int line)
-        {
-        if (UBSEC_lib_error_code == 0)
-                UBSEC_lib_error_code=ERR_get_next_error_library();
-        ERR_PUT_error(UBSEC_lib_error_code,function,reason,file,line);
-        }
diff --git a/src/lib/libcrypto/engine/tb_asnmth.c b/src/lib/libcrypto/engine/tb_asnmth.c
new file mode 100644
index 0000000000..75090339f7
--- /dev/null
+++ b/src/lib/libcrypto/engine/tb_asnmth.c
@@ -0,0 +1,246 @@
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+#include "asn1_locl.h"
+#include <openssl/evp.h>
+
+/* If this symbol is defined then ENGINE_get_pkey_asn1_meth_engine(), the
+ * function that is used by EVP to hook in pkey_asn1_meth code and cache
+ * defaults (etc), will display brief debugging summaries to stderr with the
+ * 'nid'. */
+/* #define ENGINE_PKEY_ASN1_METH_DEBUG */
+
+static ENGINE_TABLE *pkey_asn1_meth_table = NULL;
+
+void ENGINE_unregister_pkey_asn1_meths(ENGINE *e)
+        {
+        engine_table_unregister(&pkey_asn1_meth_table, e);
+        }
+
+static void engine_unregister_all_pkey_asn1_meths(void)
+        {
+        engine_table_cleanup(&pkey_asn1_meth_table);
+        }
+
+int ENGINE_register_pkey_asn1_meths(ENGINE *e)
+        {
+        if(e->pkey_asn1_meths)
+                {
+                const int *nids;
+                int num_nids = e->pkey_asn1_meths(e, NULL, &nids, 0);
+                if(num_nids > 0)
+                        return engine_table_register(&pkey_asn1_meth_table,
+                                engine_unregister_all_pkey_asn1_meths, e, nids,
+                                        num_nids, 0);
+                }
+        return 1;
+        }
+
+void ENGINE_register_all_pkey_asn1_meths(void)
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_pkey_asn1_meths(e);
+        }
+
+int ENGINE_set_default_pkey_asn1_meths(ENGINE *e)
+        {
+        if(e->pkey_asn1_meths)
+                {
+                const int *nids;
+                int num_nids = e->pkey_asn1_meths(e, NULL, &nids, 0);
+                if(num_nids > 0)
+                        return engine_table_register(&pkey_asn1_meth_table,
+                                engine_unregister_all_pkey_asn1_meths, e, nids,
+                                        num_nids, 1);
+                }
+        return 1;
+        }
+
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references) for a given pkey_asn1_meth 'nid' */
+ENGINE *ENGINE_get_pkey_asn1_meth_engine(int nid)
+        {
+        return engine_table_select(&pkey_asn1_meth_table, nid);
+        }
+
+/* Obtains a pkey_asn1_meth implementation from an ENGINE functional reference */
+const EVP_PKEY_ASN1_METHOD *ENGINE_get_pkey_asn1_meth(ENGINE *e, int nid)
+        {
+        EVP_PKEY_ASN1_METHOD *ret;
+        ENGINE_PKEY_ASN1_METHS_PTR fn = ENGINE_get_pkey_asn1_meths(e);
+        if(!fn || !fn(e, &ret, NULL, nid))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_GET_PKEY_ASN1_METH,
+                                ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD);
+                return NULL;
+                }
+        return ret;
+        }
+
+/* Gets the pkey_asn1_meth callback from an ENGINE structure */
+ENGINE_PKEY_ASN1_METHS_PTR ENGINE_get_pkey_asn1_meths(const ENGINE *e)
+        {
+        return e->pkey_asn1_meths;
+        }
+
+/* Sets the pkey_asn1_meth callback in an ENGINE structure */
+int ENGINE_set_pkey_asn1_meths(ENGINE *e, ENGINE_PKEY_ASN1_METHS_PTR f)
+        {
+        e->pkey_asn1_meths = f;
+        return 1;
+        }
+
+/* Internal function to free up EVP_PKEY_ASN1_METHOD structures before an
+ * ENGINE is destroyed
+ */
+
+void engine_pkey_asn1_meths_free(ENGINE *e)
+        {
+        int i;
+        EVP_PKEY_ASN1_METHOD *pkm;
+        if (e->pkey_asn1_meths)
+                {
+                const int *pknids;
+                int npknids;
+                npknids = e->pkey_asn1_meths(e, NULL, &pknids, 0);
+                for (i = 0; i < npknids; i++)
+                        {
+                        if (e->pkey_asn1_meths(e, &pkm, NULL, pknids[i]))
+                                {
+                                EVP_PKEY_asn1_free(pkm);
+                                }
+                        }
+                }
+        }
+
+/* Find a method based on a string. This does a linear search through
+ * all implemented algorithms. This is OK in practice because only
+ * a small number of algorithms are likely to be implemented in an engine
+ * and it is not used for speed critical operations.
+ */
+
+const EVP_PKEY_ASN1_METHOD *ENGINE_get_pkey_asn1_meth_str(ENGINE *e,
+                                        const char *str, int len)
+        {
+        int i, nidcount;
+        const int *nids;
+        EVP_PKEY_ASN1_METHOD *ameth;
+        if (!e->pkey_asn1_meths)
+                return NULL;
+        if (len == -1)
+                len = strlen(str);
+        nidcount = e->pkey_asn1_meths(e, NULL, &nids, 0);
+        for (i = 0; i < nidcount; i++)
+                {
+                e->pkey_asn1_meths(e, &ameth, NULL, nids[i]);
+                if (((int)strlen(ameth->pem_str) == len) && 
+                                        !strncasecmp(ameth->pem_str, str, len))
+                        return ameth;
+                }
+        return NULL;
+        }
+
+typedef struct 
+        {
+        ENGINE *e;
+        const EVP_PKEY_ASN1_METHOD *ameth;
+        const char *str;
+        int len;
+        } ENGINE_FIND_STR;
+
+static void look_str_cb(int nid, STACK_OF(ENGINE) *sk, ENGINE *def, void *arg)
+        {
+        ENGINE_FIND_STR *lk = arg;
+        int i;
+        if (lk->ameth)
+                return;
+        for (i = 0; i < sk_ENGINE_num(sk); i++)
+                {
+                ENGINE *e = sk_ENGINE_value(sk, i);
+                EVP_PKEY_ASN1_METHOD *ameth;
+                e->pkey_asn1_meths(e, &ameth, NULL, nid);
+                if (((int)strlen(ameth->pem_str) == lk->len) && 
+                                !strncasecmp(ameth->pem_str, lk->str, lk->len))
+                        {
+                        lk->e = e;
+                        lk->ameth = ameth;
+                        return;
+                        }
+                }
+        }
+
+const EVP_PKEY_ASN1_METHOD *ENGINE_pkey_asn1_find_str(ENGINE **pe,
+                                        const char *str, int len)
+        {
+        ENGINE_FIND_STR fstr;
+        fstr.e = NULL;
+        fstr.ameth = NULL;
+        fstr.str = str;
+        fstr.len = len;
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        engine_table_doall(pkey_asn1_meth_table, look_str_cb, &fstr);
+        /* If found obtain a structural reference to engine */
+        if (fstr.e)
+                {
+                fstr.e->struct_ref++;
+                engine_ref_debug(fstr.e, 0, 1)
+                }
+        *pe = fstr.e;
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        return fstr.ameth;
+        }
diff --git a/src/lib/libcrypto/engine/hw_nuron_err.c b/src/lib/libcrypto/engine/tb_cipher.c
index df9d7bde76..177fc1fb73 100644
--- a/src/lib/libcrypto/engine/hw_nuron_err.c
+++ b/src/lib/libcrypto/engine/tb_cipher.c
@@ -1,6 +1,5 @@
-/* hw_nuron_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -22,7 +21,7 @@
  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  *    endorse or promote products derived from this software without
  *    prior written permission. For written permission, please contact
- *    openssl-core@OpenSSL.org.
+ *    licensing@OpenSSL.org.
  *
  * 5. Products derived from this software may not be called "OpenSSL"
  *    nor may "OpenSSL" appear in their names without prior written
@@ -53,90 +52,92 @@
  *
  */
 
-/* NOTE: this file was auto generated by the mkerr.pl script: any changes
- * made to it will be overwritten when the script next updates this file,
- * only reason strings will be preserved.
- */
+#include "eng_int.h"
 
-#include <stdio.h>
-#include <openssl/err.h>
-#include "hw_nuron_err.h"
+/* If this symbol is defined then ENGINE_get_cipher_engine(), the function that
+ * is used by EVP to hook in cipher code and cache defaults (etc), will display
+ * brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_CIPHER_DEBUG */
 
-/* BEGIN ERROR CODES */
-#ifndef OPENSSL_NO_ERR
-static ERR_STRING_DATA NURON_str_functs[]=
-        {
-{ERR_PACK(0,NURON_F_NURON_CTRL,0),      "NURON_CTRL"},
-{ERR_PACK(0,NURON_F_NURON_FINISH,0),    "NURON_FINISH"},
-{ERR_PACK(0,NURON_F_NURON_INIT,0),      "NURON_INIT"},
-{ERR_PACK(0,NURON_F_NURON_MOD_EXP,0),   "NURON_MOD_EXP"},
-{0,NULL}
-        };
+static ENGINE_TABLE *cipher_table = NULL;
 
-static ERR_STRING_DATA NURON_str_reasons[]=
+void ENGINE_unregister_ciphers(ENGINE *e)
         {
-{NURON_R_ALREADY_LOADED                  ,"already loaded"},
-{NURON_R_CTRL_COMMAND_NOT_IMPLEMENTED    ,"ctrl command not implemented"},
-{NURON_R_DSO_FAILURE                     ,"dso failure"},
-{NURON_R_DSO_FUNCTION_NOT_FOUND          ,"dso function not found"},
-{NURON_R_DSO_NOT_FOUND                   ,"dso not found"},
-{NURON_R_NOT_LOADED                      ,"not loaded"},
-{0,NULL}
-        };
+        engine_table_unregister(&cipher_table, e);
+        }
 
-#endif
+static void engine_unregister_all_ciphers(void)
+        {
+        engine_table_cleanup(&cipher_table);
+        }
 
-#ifdef NURON_LIB_NAME
-static ERR_STRING_DATA NURON_lib_name[]=
-        {
-{0      ,NURON_LIB_NAME},
-{0,NULL}
-        };
-#endif
+int ENGINE_register_ciphers(ENGINE *e)
+        {
+        if(e->ciphers)
+                {
+                const int *nids;
+                int num_nids = e->ciphers(e, NULL, &nids, 0);
+                if(num_nids > 0)
+                        return engine_table_register(&cipher_table,
+                                        engine_unregister_all_ciphers, e, nids,
+                                        num_nids, 0);
+                }
+        return 1;
+        }
 
+void ENGINE_register_all_ciphers()
+        {
+        ENGINE *e;
 
-static int NURON_lib_error_code=0;
-static int NURON_error_init=1;
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_ciphers(e);
+        }
 
-static void ERR_load_NURON_strings(void)
+int ENGINE_set_default_ciphers(ENGINE *e)
         {
-        if (NURON_lib_error_code == 0)
-                NURON_lib_error_code=ERR_get_next_error_library();
-
-        if (NURON_error_init)
+        if(e->ciphers)
                 {
-                NURON_error_init=0;
-#ifndef OPENSSL_NO_ERR
-                ERR_load_strings(NURON_lib_error_code,NURON_str_functs);
-                ERR_load_strings(NURON_lib_error_code,NURON_str_reasons);
-#endif
-
-#ifdef NURON_LIB_NAME
-                NURON_lib_name->error = ERR_PACK(NURON_lib_error_code,0,0);
-                ERR_load_strings(0,NURON_lib_name);
-#endif
+                const int *nids;
+                int num_nids = e->ciphers(e, NULL, &nids, 0);
+                if(num_nids > 0)
+                        return engine_table_register(&cipher_table,
+                                        engine_unregister_all_ciphers, e, nids,
+                                        num_nids, 1);
                 }
+        return 1;
         }
 
-static void ERR_unload_NURON_strings(void)
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references) for a given cipher 'nid' */
+ENGINE *ENGINE_get_cipher_engine(int nid)
         {
-        if (NURON_error_init == 0)
-                {
-#ifndef OPENSSL_NO_ERR
-                ERR_unload_strings(NURON_lib_error_code,NURON_str_functs);
-                ERR_unload_strings(NURON_lib_error_code,NURON_str_reasons);
-#endif
+        return engine_table_select(&cipher_table, nid);
+        }
 
-#ifdef NURON_LIB_NAME
-                ERR_unload_strings(0,NURON_lib_name);
-#endif
-                NURON_error_init=1;
+/* Obtains a cipher implementation from an ENGINE functional reference */
+const EVP_CIPHER *ENGINE_get_cipher(ENGINE *e, int nid)
+        {
+        const EVP_CIPHER *ret;
+        ENGINE_CIPHERS_PTR fn = ENGINE_get_ciphers(e);
+        if(!fn || !fn(e, &ret, NULL, nid))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_GET_CIPHER,
+                                ENGINE_R_UNIMPLEMENTED_CIPHER);
+                return NULL;
                 }
+        return ret;
+        }
+
+/* Gets the cipher callback from an ENGINE structure */
+ENGINE_CIPHERS_PTR ENGINE_get_ciphers(const ENGINE *e)
+        {
+        return e->ciphers;
         }
 
-static void ERR_NURON_error(int function, int reason, char *file, int line)
+/* Sets the cipher callback in an ENGINE structure */
+int ENGINE_set_ciphers(ENGINE *e, ENGINE_CIPHERS_PTR f)
         {
-        if (NURON_lib_error_code == 0)
-                NURON_lib_error_code=ERR_get_next_error_library();
-        ERR_PUT_error(NURON_lib_error_code,function,reason,file,line);
+        e->ciphers = f;
+        return 1;
         }
diff --git a/src/lib/libcrypto/engine/hw_ubsec_err.h b/src/lib/libcrypto/engine/tb_dh.c
index 023d3be771..6e9d428761 100644
--- a/src/lib/libcrypto/engine/hw_ubsec_err.h
+++ b/src/lib/libcrypto/engine/tb_dh.c
@@ -1,5 +1,5 @@
 /* ====================================================================
- * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -16,12 +16,12 @@
  * 3. All advertising materials mentioning features or use of this
  *    software must display the following acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  *
  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  *    endorse or promote products derived from this software without
  *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
+ *    licensing@OpenSSL.org.
  *
  * 5. Products derived from this software may not be called "OpenSSL"
  *    nor may "OpenSSL" appear in their names without prior written
@@ -30,7 +30,7 @@
  * 6. Redistributions of any form whatsoever must retain the following
  *    acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  *
  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
@@ -52,44 +52,67 @@
  *
  */
 
-#ifndef HEADER_UBSEC_ERR_H
-#define HEADER_UBSEC_ERR_H
+#include "eng_int.h"
 
-/* BEGIN ERROR CODES */
-/* The following lines are auto generated by the script mkerr.pl. Any changes
- * made after this point may be overwritten when the script is next run.
- */
-static void ERR_load_UBSEC_strings(void);
-static void ERR_unload_UBSEC_strings(void);
-static void ERR_UBSEC_error(int function, int reason, char *file, int line);
-#define UBSECerr(f,r) ERR_UBSEC_error((f),(r),__FILE__,__LINE__)
+/* If this symbol is defined then ENGINE_get_default_DH(), the function that is
+ * used by DH to hook in implementation code and cache defaults (etc), will
+ * display brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_DH_DEBUG */
+
+static ENGINE_TABLE *dh_table = NULL;
+static const int dummy_nid = 1;
+
+void ENGINE_unregister_DH(ENGINE *e)
+        {
+        engine_table_unregister(&dh_table, e);
+        }
+
+static void engine_unregister_all_DH(void)
+        {
+        engine_table_cleanup(&dh_table);
+        }
+
+int ENGINE_register_DH(ENGINE *e)
+        {
+        if(e->dh_meth)
+                return engine_table_register(&dh_table,
+                                engine_unregister_all_DH, e, &dummy_nid, 1, 0);
+        return 1;
+        }
+
+void ENGINE_register_all_DH()
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_DH(e);
+        }
 
-/* Error codes for the UBSEC functions. */
+int ENGINE_set_default_DH(ENGINE *e)
+        {
+        if(e->dh_meth)
+                return engine_table_register(&dh_table,
+                                engine_unregister_all_DH, e, &dummy_nid, 1, 1);
+        return 1;
+        }
 
-/* Function codes. */
-#define UBSEC_F_UBSEC_CTRL                               100
-#define UBSEC_F_UBSEC_DH_COMPUTE_KEY                     101
-#define UBSEC_F_UBSEC_DSA_SIGN                           102
-#define UBSEC_F_UBSEC_DSA_VERIFY                         103
-#define UBSEC_F_UBSEC_FINISH                             104
-#define UBSEC_F_UBSEC_INIT                               105
-#define UBSEC_F_UBSEC_MOD_EXP                            106
-#define UBSEC_F_UBSEC_RNG_BYTES                          107
-#define UBSEC_F_UBSEC_RSA_MOD_EXP                        108
-#define UBSEC_F_UBSEC_RSA_MOD_EXP_CRT                    109
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references). */
+ENGINE *ENGINE_get_default_DH(void)
+        {
+        return engine_table_select(&dh_table, dummy_nid);
+        }
 
-/* Reason codes. */
-#define UBSEC_R_ALREADY_LOADED                           100
-#define UBSEC_R_BN_EXPAND_FAIL                           101
-#define UBSEC_R_CTRL_COMMAND_NOT_IMPLEMENTED             102
-#define UBSEC_R_DSO_FAILURE                              103
-#define UBSEC_R_MISSING_KEY_COMPONENTS                   104
-#define UBSEC_R_NOT_LOADED                               105
-#define UBSEC_R_REQUEST_FAILED                           106
-#define UBSEC_R_SIZE_TOO_LARGE_OR_TOO_SMALL              107
-#define UBSEC_R_UNIT_FAILURE                             108
+/* Obtains an DH implementation from an ENGINE functional reference */
+const DH_METHOD *ENGINE_get_DH(const ENGINE *e)
+        {
+        return e->dh_meth;
+        }
 
-#ifdef  __cplusplus
-}
-#endif
-#endif
+/* Sets an DH implementation in an ENGINE structure */
+int ENGINE_set_DH(ENGINE *e, const DH_METHOD *dh_meth)
+        {
+        e->dh_meth = dh_meth;
+        return 1;
+        }
diff --git a/src/lib/libcrypto/engine/tb_digest.c b/src/lib/libcrypto/engine/tb_digest.c
new file mode 100644
index 0000000000..d3f4bb2747
--- /dev/null
+++ b/src/lib/libcrypto/engine/tb_digest.c
@@ -0,0 +1,143 @@
+/* ====================================================================
+ * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+
+/* If this symbol is defined then ENGINE_get_digest_engine(), the function that
+ * is used by EVP to hook in digest code and cache defaults (etc), will display
+ * brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_DIGEST_DEBUG */
+
+static ENGINE_TABLE *digest_table = NULL;
+
+void ENGINE_unregister_digests(ENGINE *e)
+        {
+        engine_table_unregister(&digest_table, e);
+        }
+
+static void engine_unregister_all_digests(void)
+        {
+        engine_table_cleanup(&digest_table);
+        }
+
+int ENGINE_register_digests(ENGINE *e)
+        {
+        if(e->digests)
+                {
+                const int *nids;
+                int num_nids = e->digests(e, NULL, &nids, 0);
+                if(num_nids > 0)
+                        return engine_table_register(&digest_table,
+                                        engine_unregister_all_digests, e, nids,
+                                        num_nids, 0);
+                }
+        return 1;
+        }
+
+void ENGINE_register_all_digests()
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_digests(e);
+        }
+
+int ENGINE_set_default_digests(ENGINE *e)
+        {
+        if(e->digests)
+                {
+                const int *nids;
+                int num_nids = e->digests(e, NULL, &nids, 0);
+                if(num_nids > 0)
+                        return engine_table_register(&digest_table,
+                                        engine_unregister_all_digests, e, nids,
+                                        num_nids, 1);
+                }
+        return 1;
+        }
+
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references) for a given digest 'nid' */
+ENGINE *ENGINE_get_digest_engine(int nid)
+        {
+        return engine_table_select(&digest_table, nid);
+        }
+
+/* Obtains a digest implementation from an ENGINE functional reference */
+const EVP_MD *ENGINE_get_digest(ENGINE *e, int nid)
+        {
+        const EVP_MD *ret;
+        ENGINE_DIGESTS_PTR fn = ENGINE_get_digests(e);
+        if(!fn || !fn(e, &ret, NULL, nid))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_GET_DIGEST,
+                                ENGINE_R_UNIMPLEMENTED_DIGEST);
+                return NULL;
+                }
+        return ret;
+        }
+
+/* Gets the digest callback from an ENGINE structure */
+ENGINE_DIGESTS_PTR ENGINE_get_digests(const ENGINE *e)
+        {
+        return e->digests;
+        }
+
+/* Sets the digest callback in an ENGINE structure */
+int ENGINE_set_digests(ENGINE *e, ENGINE_DIGESTS_PTR f)
+        {
+        e->digests = f;
+        return 1;
+        }
diff --git a/src/lib/libcrypto/engine/hw_nuron_err.h b/src/lib/libcrypto/engine/tb_dsa.c
index a56bfdf303..e4674f5f07 100644
--- a/src/lib/libcrypto/engine/hw_nuron_err.h
+++ b/src/lib/libcrypto/engine/tb_dsa.c
@@ -1,5 +1,5 @@
 /* ====================================================================
- * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -16,12 +16,12 @@
  * 3. All advertising materials mentioning features or use of this
  *    software must display the following acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  *
  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  *    endorse or promote products derived from this software without
  *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
+ *    licensing@OpenSSL.org.
  *
  * 5. Products derived from this software may not be called "OpenSSL"
  *    nor may "OpenSSL" appear in their names without prior written
@@ -30,7 +30,7 @@
  * 6. Redistributions of any form whatsoever must retain the following
  *    acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  *
  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
@@ -52,35 +52,67 @@
  *
  */
 
-#ifndef HEADER_NURON_ERR_H
-#define HEADER_NURON_ERR_H
+#include "eng_int.h"
 
-/* BEGIN ERROR CODES */
-/* The following lines are auto generated by the script mkerr.pl. Any changes
- * made after this point may be overwritten when the script is next run.
- */
-static void ERR_load_NURON_strings(void);
-static void ERR_unload_NURON_strings(void);
-static void ERR_NURON_error(int function, int reason, char *file, int line);
-#define NURONerr(f,r) ERR_NURON_error((f),(r),__FILE__,__LINE__)
+/* If this symbol is defined then ENGINE_get_default_DSA(), the function that is
+ * used by DSA to hook in implementation code and cache defaults (etc), will
+ * display brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_DSA_DEBUG */
+
+static ENGINE_TABLE *dsa_table = NULL;
+static const int dummy_nid = 1;
+
+void ENGINE_unregister_DSA(ENGINE *e)
+        {
+        engine_table_unregister(&dsa_table, e);
+        }
+
+static void engine_unregister_all_DSA(void)
+        {
+        engine_table_cleanup(&dsa_table);
+        }
+
+int ENGINE_register_DSA(ENGINE *e)
+        {
+        if(e->dsa_meth)
+                return engine_table_register(&dsa_table,
+                                engine_unregister_all_DSA, e, &dummy_nid, 1, 0);
+        return 1;
+        }
+
+void ENGINE_register_all_DSA()
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_DSA(e);
+        }
 
-/* Error codes for the NURON functions. */
+int ENGINE_set_default_DSA(ENGINE *e)
+        {
+        if(e->dsa_meth)
+                return engine_table_register(&dsa_table,
+                                engine_unregister_all_DSA, e, &dummy_nid, 1, 1);
+        return 1;
+        }
 
-/* Function codes. */
-#define NURON_F_NURON_CTRL                               100
-#define NURON_F_NURON_FINISH                             101
-#define NURON_F_NURON_INIT                               102
-#define NURON_F_NURON_MOD_EXP                            103
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references). */
+ENGINE *ENGINE_get_default_DSA(void)
+        {
+        return engine_table_select(&dsa_table, dummy_nid);
+        }
 
-/* Reason codes. */
-#define NURON_R_ALREADY_LOADED                           100
-#define NURON_R_CTRL_COMMAND_NOT_IMPLEMENTED             101
-#define NURON_R_DSO_FAILURE                              102
-#define NURON_R_DSO_FUNCTION_NOT_FOUND                   103
-#define NURON_R_DSO_NOT_FOUND                            104
-#define NURON_R_NOT_LOADED                               105
+/* Obtains an DSA implementation from an ENGINE functional reference */
+const DSA_METHOD *ENGINE_get_DSA(const ENGINE *e)
+        {
+        return e->dsa_meth;
+        }
 
-#ifdef  __cplusplus
-}
-#endif
-#endif
+/* Sets an DSA implementation in an ENGINE structure */
+int ENGINE_set_DSA(ENGINE *e, const DSA_METHOD *dsa_meth)
+        {
+        e->dsa_meth = dsa_meth;
+        return 1;
+        }
diff --git a/src/lib/libcrypto/engine/tb_ecdh.c b/src/lib/libcrypto/engine/tb_ecdh.c
new file mode 100644
index 0000000000..c8ec7812c5
--- /dev/null
+++ b/src/lib/libcrypto/engine/tb_ecdh.c
@@ -0,0 +1,133 @@
+/* crypto/engine/tb_ecdh.c */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
+ * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
+ * to the OpenSSL project.
+ *
+ * The ECC Code is licensed pursuant to the OpenSSL open source
+ * license provided below.
+ *
+ * The ECDH engine software is originally written by Nils Gura and
+ * Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
+/* ====================================================================
+ * Copyright (c) 2000-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+
+/* If this symbol is defined then ENGINE_get_default_ECDH(), the function that is
+ * used by ECDH to hook in implementation code and cache defaults (etc), will
+ * display brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_ECDH_DEBUG */
+
+static ENGINE_TABLE *ecdh_table = NULL;
+static const int dummy_nid = 1;
+
+void ENGINE_unregister_ECDH(ENGINE *e)
+        {
+        engine_table_unregister(&ecdh_table, e);
+        }
+
+static void engine_unregister_all_ECDH(void)
+        {
+        engine_table_cleanup(&ecdh_table);
+        }
+
+int ENGINE_register_ECDH(ENGINE *e)
+        {
+        if(e->ecdh_meth)
+                return engine_table_register(&ecdh_table,
+                                engine_unregister_all_ECDH, e, &dummy_nid, 1, 0);
+        return 1;
+        }
+
+void ENGINE_register_all_ECDH()
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_ECDH(e);
+        }
+
+int ENGINE_set_default_ECDH(ENGINE *e)
+        {
+        if(e->ecdh_meth)
+                return engine_table_register(&ecdh_table,
+                                engine_unregister_all_ECDH, e, &dummy_nid, 1, 1);
+        return 1;
+        }
+
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references). */
+ENGINE *ENGINE_get_default_ECDH(void)
+        {
+        return engine_table_select(&ecdh_table, dummy_nid);
+        }
+
+/* Obtains an ECDH implementation from an ENGINE functional reference */
+const ECDH_METHOD *ENGINE_get_ECDH(const ENGINE *e)
+        {
+        return e->ecdh_meth;
+        }
+
+/* Sets an ECDH implementation in an ENGINE structure */
+int ENGINE_set_ECDH(ENGINE *e, const ECDH_METHOD *ecdh_meth)
+        {
+        e->ecdh_meth = ecdh_meth;
+        return 1;
+        }
diff --git a/src/lib/libcrypto/engine/hw_4758_cca_err.h b/src/lib/libcrypto/engine/tb_ecdsa.c
index 2fc563ab11..005ecb622c 100644
--- a/src/lib/libcrypto/engine/hw_4758_cca_err.h
+++ b/src/lib/libcrypto/engine/tb_ecdsa.c
@@ -1,5 +1,5 @@
 /* ====================================================================
- * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000-2002 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -16,12 +16,12 @@
  * 3. All advertising materials mentioning features or use of this
  *    software must display the following acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  *
  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  *    endorse or promote products derived from this software without
  *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
+ *    licensing@OpenSSL.org.
  *
  * 5. Products derived from this software may not be called "OpenSSL"
  *    nor may "OpenSSL" appear in their names without prior written
@@ -30,7 +30,7 @@
  * 6. Redistributions of any form whatsoever must retain the following
  *    acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  *
  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
@@ -52,42 +52,67 @@
  *
  */
 
-#ifndef HEADER_CCA4758_ERR_H
-#define HEADER_CCA4758_ERR_H
+#include "eng_int.h"
 
-/* BEGIN ERROR CODES */
-/* The following lines are auto generated by the script mkerr.pl. Any changes
- * made after this point may be overwritten when the script is next run.
- */
-static void ERR_load_CCA4758_strings(void);
-static void ERR_unload_CCA4758_strings(void);
-static void ERR_CCA4758_error(int function, int reason, char *file, int line);
-#define CCA4758err(f,r) ERR_CCA4758_error((f),(r),__FILE__,__LINE__)
+/* If this symbol is defined then ENGINE_get_default_ECDSA(), the function that is
+ * used by ECDSA to hook in implementation code and cache defaults (etc), will
+ * display brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_ECDSA_DEBUG */
+
+static ENGINE_TABLE *ecdsa_table = NULL;
+static const int dummy_nid = 1;
+
+void ENGINE_unregister_ECDSA(ENGINE *e)
+        {
+        engine_table_unregister(&ecdsa_table, e);
+        }
+
+static void engine_unregister_all_ECDSA(void)
+        {
+        engine_table_cleanup(&ecdsa_table);
+        }
+
+int ENGINE_register_ECDSA(ENGINE *e)
+        {
+        if(e->ecdsa_meth)
+                return engine_table_register(&ecdsa_table,
+                                engine_unregister_all_ECDSA, e, &dummy_nid, 1, 0);
+        return 1;
+        }
+
+void ENGINE_register_all_ECDSA()
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_ECDSA(e);
+        }
 
-/* Error codes for the CCA4758 functions. */
+int ENGINE_set_default_ECDSA(ENGINE *e)
+        {
+        if(e->ecdsa_meth)
+                return engine_table_register(&ecdsa_table,
+                                engine_unregister_all_ECDSA, e, &dummy_nid, 1, 1);
+        return 1;
+        }
 
-/* Function codes. */
-#define CCA4758_F_IBM_4758_CCA_CTRL                      100
-#define CCA4758_F_IBM_4758_CCA_FINISH                    101
-#define CCA4758_F_IBM_4758_CCA_INIT                      102
-#define CCA4758_F_IBM_4758_CCA_LOAD_PRIVKEY              103
-#define CCA4758_F_IBM_4758_CCA_LOAD_PUBKEY               104
-#define CCA4758_F_IBM_4758_CCA_SIGN                      105
-#define CCA4758_F_IBM_4758_CCA_VERIFY                    106
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references). */
+ENGINE *ENGINE_get_default_ECDSA(void)
+        {
+        return engine_table_select(&ecdsa_table, dummy_nid);
+        }
 
-/* Reason codes. */
-#define CCA4758_R_ALREADY_LOADED                         100
-#define CCA4758_R_ASN1_OID_UNKNOWN_FOR_MD                101
-#define CCA4758_R_COMMAND_NOT_IMPLEMENTED                102
-#define CCA4758_R_DSO_FAILURE                            103
-#define CCA4758_R_FAILED_LOADING_PRIVATE_KEY             104
-#define CCA4758_R_FAILED_LOADING_PUBLIC_KEY              105
-#define CCA4758_R_NOT_LOADED                             106
-#define CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL            107
-#define CCA4758_R_UNIT_FAILURE                           108
-#define CCA4758_R_UNKNOWN_ALGORITHM_TYPE                 109
+/* Obtains an ECDSA implementation from an ENGINE functional reference */
+const ECDSA_METHOD *ENGINE_get_ECDSA(const ENGINE *e)
+        {
+        return e->ecdsa_meth;
+        }
 
-#ifdef  __cplusplus
-}
-#endif
-#endif
+/* Sets an ECDSA implementation in an ENGINE structure */
+int ENGINE_set_ECDSA(ENGINE *e, const ECDSA_METHOD *ecdsa_meth)
+        {
+        e->ecdsa_meth = ecdsa_meth;
+        return 1;
+        }
diff --git a/src/lib/libcrypto/engine/tb_pkmeth.c b/src/lib/libcrypto/engine/tb_pkmeth.c
new file mode 100644
index 0000000000..1cdb967f25
--- /dev/null
+++ b/src/lib/libcrypto/engine/tb_pkmeth.c
@@ -0,0 +1,167 @@
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+#include <openssl/evp.h>
+
+/* If this symbol is defined then ENGINE_get_pkey_meth_engine(), the function
+ * that is used by EVP to hook in pkey_meth code and cache defaults (etc), will
+ * display brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_PKEY_METH_DEBUG */
+
+static ENGINE_TABLE *pkey_meth_table = NULL;
+
+void ENGINE_unregister_pkey_meths(ENGINE *e)
+        {
+        engine_table_unregister(&pkey_meth_table, e);
+        }
+
+static void engine_unregister_all_pkey_meths(void)
+        {
+        engine_table_cleanup(&pkey_meth_table);
+        }
+
+int ENGINE_register_pkey_meths(ENGINE *e)
+        {
+        if(e->pkey_meths)
+                {
+                const int *nids;
+                int num_nids = e->pkey_meths(e, NULL, &nids, 0);
+                if(num_nids > 0)
+                        return engine_table_register(&pkey_meth_table,
+                                engine_unregister_all_pkey_meths, e, nids,
+                                        num_nids, 0);
+                }
+        return 1;
+        }
+
+void ENGINE_register_all_pkey_meths()
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_pkey_meths(e);
+        }
+
+int ENGINE_set_default_pkey_meths(ENGINE *e)
+        {
+        if(e->pkey_meths)
+                {
+                const int *nids;
+                int num_nids = e->pkey_meths(e, NULL, &nids, 0);
+                if(num_nids > 0)
+                        return engine_table_register(&pkey_meth_table,
+                                engine_unregister_all_pkey_meths, e, nids,
+                                        num_nids, 1);
+                }
+        return 1;
+        }
+
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references) for a given pkey_meth 'nid' */
+ENGINE *ENGINE_get_pkey_meth_engine(int nid)
+        {
+        return engine_table_select(&pkey_meth_table, nid);
+        }
+
+/* Obtains a pkey_meth implementation from an ENGINE functional reference */
+const EVP_PKEY_METHOD *ENGINE_get_pkey_meth(ENGINE *e, int nid)
+        {
+        EVP_PKEY_METHOD *ret;
+        ENGINE_PKEY_METHS_PTR fn = ENGINE_get_pkey_meths(e);
+        if(!fn || !fn(e, &ret, NULL, nid))
+                {
+                ENGINEerr(ENGINE_F_ENGINE_GET_PKEY_METH,
+                                ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD);
+                return NULL;
+                }
+        return ret;
+        }
+
+/* Gets the pkey_meth callback from an ENGINE structure */
+ENGINE_PKEY_METHS_PTR ENGINE_get_pkey_meths(const ENGINE *e)
+        {
+        return e->pkey_meths;
+        }
+
+/* Sets the pkey_meth callback in an ENGINE structure */
+int ENGINE_set_pkey_meths(ENGINE *e, ENGINE_PKEY_METHS_PTR f)
+        {
+        e->pkey_meths = f;
+        return 1;
+        }
+
+/* Internal function to free up EVP_PKEY_METHOD structures before an
+ * ENGINE is destroyed
+ */
+
+void engine_pkey_meths_free(ENGINE *e)
+        {
+        int i;
+        EVP_PKEY_METHOD *pkm;
+        if (e->pkey_meths)
+                {
+                const int *pknids;
+                int npknids;
+                npknids = e->pkey_meths(e, NULL, &pknids, 0);
+                for (i = 0; i < npknids; i++)
+                        {
+                        if (e->pkey_meths(e, &pkm, NULL, pknids[i]))
+                                {
+                                EVP_PKEY_meth_free(pkm);
+                                }
+                        }
+                }
+        }
diff --git a/src/lib/libcrypto/engine/hw_aep_err.h b/src/lib/libcrypto/engine/tb_rand.c
index 8fe4cf921f..f36f67c0f6 100644
--- a/src/lib/libcrypto/engine/hw_aep_err.h
+++ b/src/lib/libcrypto/engine/tb_rand.c
@@ -1,5 +1,5 @@
 /* ====================================================================
- * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -16,12 +16,12 @@
  * 3. All advertising materials mentioning features or use of this
  *    software must display the following acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  *
  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  *    endorse or promote products derived from this software without
  *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
+ *    licensing@OpenSSL.org.
  *
  * 5. Products derived from this software may not be called "OpenSSL"
  *    nor may "OpenSSL" appear in their names without prior written
@@ -30,7 +30,7 @@
  * 6. Redistributions of any form whatsoever must retain the following
  *    acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  *
  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
@@ -52,50 +52,67 @@
  *
  */
 
-#ifndef HEADER_AEPHK_ERR_H
-#define HEADER_AEPHK_ERR_H
+#include "eng_int.h"
 
-/* BEGIN ERROR CODES */
-/* The following lines are auto generated by the script mkerr.pl. Any changes
- * made after this point may be overwritten when the script is next run.
- */
-static void ERR_load_AEPHK_strings(void);
-static void ERR_unload_AEPHK_strings(void);
-static void ERR_AEPHK_error(int function, int reason, char *file, int line);
-#define AEPHKerr(f,r) ERR_AEPHK_error((f),(r),__FILE__,__LINE__)
+/* If this symbol is defined then ENGINE_get_default_RAND(), the function that is
+ * used by RAND to hook in implementation code and cache defaults (etc), will
+ * display brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_RAND_DEBUG */
+
+static ENGINE_TABLE *rand_table = NULL;
+static const int dummy_nid = 1;
+
+void ENGINE_unregister_RAND(ENGINE *e)
+        {
+        engine_table_unregister(&rand_table, e);
+        }
+
+static void engine_unregister_all_RAND(void)
+        {
+        engine_table_cleanup(&rand_table);
+        }
+
+int ENGINE_register_RAND(ENGINE *e)
+        {
+        if(e->rand_meth)
+                return engine_table_register(&rand_table,
+                                engine_unregister_all_RAND, e, &dummy_nid, 1, 0);
+        return 1;
+        }
+
+void ENGINE_register_all_RAND()
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_RAND(e);
+        }
 
-/* Error codes for the AEPHK functions. */
+int ENGINE_set_default_RAND(ENGINE *e)
+        {
+        if(e->rand_meth)
+                return engine_table_register(&rand_table,
+                                engine_unregister_all_RAND, e, &dummy_nid, 1, 1);
+        return 1;
+        }
 
-/* Function codes. */
-#define AEPHK_F_AEP_CTRL                                 100
-#define AEPHK_F_AEP_FINISH                               101
-#define AEPHK_F_AEP_GET_CONNECTION                       102
-#define AEPHK_F_AEP_INIT                                 103
-#define AEPHK_F_AEP_MOD_EXP                              104
-#define AEPHK_F_AEP_MOD_EXP_CRT                          105
-#define AEPHK_F_AEP_RAND                                 106
-#define AEPHK_F_AEP_RSA_MOD_EXP                          107
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references). */
+ENGINE *ENGINE_get_default_RAND(void)
+        {
+        return engine_table_select(&rand_table, dummy_nid);
+        }
 
-/* Reason codes. */
-#define AEPHK_R_ALREADY_LOADED                           100
-#define AEPHK_R_CLOSE_HANDLES_FAILED                     101
-#define AEPHK_R_CONNECTIONS_IN_USE                       102
-#define AEPHK_R_CTRL_COMMAND_NOT_IMPLEMENTED             103
-#define AEPHK_R_FINALIZE_FAILED                          104
-#define AEPHK_R_GET_HANDLE_FAILED                        105
-#define AEPHK_R_GET_RANDOM_FAILED                        106
-#define AEPHK_R_INIT_FAILURE                             107
-#define AEPHK_R_MISSING_KEY_COMPONENTS                   108
-#define AEPHK_R_MOD_EXP_CRT_FAILED                       109
-#define AEPHK_R_MOD_EXP_FAILED                           110
-#define AEPHK_R_NOT_LOADED                               111
-#define AEPHK_R_OK                                       112
-#define AEPHK_R_RETURN_CONNECTION_FAILED                 113
-#define AEPHK_R_SETBNCALLBACK_FAILURE                    114
-#define AEPHK_R_SIZE_TOO_LARGE_OR_TOO_SMALL              116
-#define AEPHK_R_UNIT_FAILURE                             115
+/* Obtains an RAND implementation from an ENGINE functional reference */
+const RAND_METHOD *ENGINE_get_RAND(const ENGINE *e)
+        {
+        return e->rand_meth;
+        }
 
-#ifdef  __cplusplus
-}
-#endif
-#endif
+/* Sets an RAND implementation in an ENGINE structure */
+int ENGINE_set_RAND(ENGINE *e, const RAND_METHOD *rand_meth)
+        {
+        e->rand_meth = rand_meth;
+        return 1;
+        }
diff --git a/src/lib/libcrypto/engine/hw_atalla_err.h b/src/lib/libcrypto/engine/tb_rsa.c
index cdac052d8c..fbc707fd26 100644
--- a/src/lib/libcrypto/engine/hw_atalla_err.h
+++ b/src/lib/libcrypto/engine/tb_rsa.c
@@ -1,5 +1,5 @@
 /* ====================================================================
- * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -16,12 +16,12 @@
  * 3. All advertising materials mentioning features or use of this
  *    software must display the following acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  *
  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  *    endorse or promote products derived from this software without
  *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
+ *    licensing@OpenSSL.org.
  *
  * 5. Products derived from this software may not be called "OpenSSL"
  *    nor may "OpenSSL" appear in their names without prior written
@@ -30,7 +30,7 @@
  * 6. Redistributions of any form whatsoever must retain the following
  *    acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  *
  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
@@ -52,38 +52,67 @@
  *
  */
 
-#ifndef HEADER_ATALLA_ERR_H
-#define HEADER_ATALLA_ERR_H
+#include "eng_int.h"
 
-/* BEGIN ERROR CODES */
-/* The following lines are auto generated by the script mkerr.pl. Any changes
- * made after this point may be overwritten when the script is next run.
- */
-static void ERR_load_ATALLA_strings(void);
-static void ERR_unload_ATALLA_strings(void);
-static void ERR_ATALLA_error(int function, int reason, char *file, int line);
-#define ATALLAerr(f,r) ERR_ATALLA_error((f),(r),__FILE__,__LINE__)
+/* If this symbol is defined then ENGINE_get_default_RSA(), the function that is
+ * used by RSA to hook in implementation code and cache defaults (etc), will
+ * display brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_RSA_DEBUG */
+
+static ENGINE_TABLE *rsa_table = NULL;
+static const int dummy_nid = 1;
+
+void ENGINE_unregister_RSA(ENGINE *e)
+        {
+        engine_table_unregister(&rsa_table, e);
+        }
+
+static void engine_unregister_all_RSA(void)
+        {
+        engine_table_cleanup(&rsa_table);
+        }
+
+int ENGINE_register_RSA(ENGINE *e)
+        {
+        if(e->rsa_meth)
+                return engine_table_register(&rsa_table,
+                                engine_unregister_all_RSA, e, &dummy_nid, 1, 0);
+        return 1;
+        }
+
+void ENGINE_register_all_RSA()
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_RSA(e);
+        }
 
-/* Error codes for the ATALLA functions. */
+int ENGINE_set_default_RSA(ENGINE *e)
+        {
+        if(e->rsa_meth)
+                return engine_table_register(&rsa_table,
+                                engine_unregister_all_RSA, e, &dummy_nid, 1, 1);
+        return 1;
+        }
 
-/* Function codes. */
-#define ATALLA_F_ATALLA_CTRL                             100
-#define ATALLA_F_ATALLA_FINISH                           101
-#define ATALLA_F_ATALLA_INIT                             102
-#define ATALLA_F_ATALLA_MOD_EXP                          103
-#define ATALLA_F_ATALLA_RSA_MOD_EXP                      104
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references). */
+ENGINE *ENGINE_get_default_RSA(void)
+        {
+        return engine_table_select(&rsa_table, dummy_nid);
+        }
 
-/* Reason codes. */
-#define ATALLA_R_ALREADY_LOADED                          100
-#define ATALLA_R_BN_CTX_FULL                             101
-#define ATALLA_R_BN_EXPAND_FAIL                          102
-#define ATALLA_R_CTRL_COMMAND_NOT_IMPLEMENTED            103
-#define ATALLA_R_MISSING_KEY_COMPONENTS                  104
-#define ATALLA_R_NOT_LOADED                              105
-#define ATALLA_R_REQUEST_FAILED                          106
-#define ATALLA_R_UNIT_FAILURE                            107
+/* Obtains an RSA implementation from an ENGINE functional reference */
+const RSA_METHOD *ENGINE_get_RSA(const ENGINE *e)
+        {
+        return e->rsa_meth;
+        }
 
-#ifdef  __cplusplus
-}
-#endif
-#endif
+/* Sets an RSA implementation in an ENGINE structure */
+int ENGINE_set_RSA(ENGINE *e, const RSA_METHOD *rsa_meth)
+        {
+        e->rsa_meth = rsa_meth;
+        return 1;
+        }
diff --git a/src/lib/libcrypto/engine/tb_store.c b/src/lib/libcrypto/engine/tb_store.c
new file mode 100644
index 0000000000..8cc435c935
--- /dev/null
+++ b/src/lib/libcrypto/engine/tb_store.c
@@ -0,0 +1,123 @@
+/* ====================================================================
+ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+
+/* If this symbol is defined then ENGINE_get_default_STORE(), the function that is
+ * used by STORE to hook in implementation code and cache defaults (etc), will
+ * display brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_STORE_DEBUG */
+
+static ENGINE_TABLE *store_table = NULL;
+static const int dummy_nid = 1;
+
+void ENGINE_unregister_STORE(ENGINE *e)
+        {
+        engine_table_unregister(&store_table, e);
+        }
+
+static void engine_unregister_all_STORE(void)
+        {
+        engine_table_cleanup(&store_table);
+        }
+
+int ENGINE_register_STORE(ENGINE *e)
+        {
+        if(e->store_meth)
+                return engine_table_register(&store_table,
+                                engine_unregister_all_STORE, e, &dummy_nid, 1, 0);
+        return 1;
+        }
+
+void ENGINE_register_all_STORE()
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_STORE(e);
+        }
+
+/* The following two functions are removed because they're useless. */
+#if 0
+int ENGINE_set_default_STORE(ENGINE *e)
+        {
+        if(e->store_meth)
+                return engine_table_register(&store_table,
+                                engine_unregister_all_STORE, e, &dummy_nid, 1, 1);
+        return 1;
+        }
+#endif
+
+#if 0
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references). */
+ENGINE *ENGINE_get_default_STORE(void)
+        {
+        return engine_table_select(&store_table, dummy_nid);
+        }
+#endif
+
+/* Obtains an STORE implementation from an ENGINE functional reference */
+const STORE_METHOD *ENGINE_get_STORE(const ENGINE *e)
+        {
+        return e->store_meth;
+        }
+
+/* Sets an STORE implementation in an ENGINE structure */
+int ENGINE_set_STORE(ENGINE *e, const STORE_METHOD *store_meth)
+        {
+        e->store_meth = store_meth;
+        return 1;
+        }
diff --git a/src/lib/libcrypto/engine/vendor_defns/aep.h b/src/lib/libcrypto/engine/vendor_defns/aep.h
deleted file mode 100644
index 2b2792d2d6..0000000000
--- a/src/lib/libcrypto/engine/vendor_defns/aep.h
+++ /dev/null
@@ -1,178 +0,0 @@
-/* This header declares the necessary definitions for using the exponentiation
- * acceleration capabilities, and rnd number generation of the AEP card. 
- *
- */
-
-/*
- *
- * Some AEP defines
- *
- */
-
-/*Successful return value*/
-#define AEP_R_OK                                0x00000000
-
-/*Miscelleanous unsuccessful return value*/
-#define AEP_R_GENERAL_ERROR                     0x10000001
-
-/*Insufficient host memory*/
-#define AEP_R_HOST_MEMORY                       0x10000002
-
-#define AEP_R_FUNCTION_FAILED                   0x10000006
-
-/*Invalid arguments in function call*/
-#define AEP_R_ARGUMENTS_BAD                     0x10020000
-
-#define AEP_R_NO_TARGET_RESOURCES                               0x10030000
-
-/*Error occuring on socket operation*/
-#define AEP_R_SOCKERROR                                                 0x10000010
-
-/*Socket has been closed from the other end*/
-#define AEP_R_SOCKEOF                                                   0x10000011
-
-/*Invalid handles*/
-#define AEP_R_CONNECTION_HANDLE_INVALID         0x100000B3
-
-#define AEP_R_TRANSACTION_HANDLE_INVALID                0x10040000
-
-/*Transaction has not yet returned from accelerator*/
-#define AEP_R_TRANSACTION_NOT_READY                             0x00010000
-
-/*There is already a thread waiting on this transaction*/
-#define AEP_R_TRANSACTION_CLAIMED                               0x10050000
-
-/*The transaction timed out*/
-#define AEP_R_TIMED_OUT                                                 0x10060000
-
-#define AEP_R_FXN_NOT_IMPLEMENTED                               0x10070000
-
-#define AEP_R_TARGET_ERROR                                              0x10080000
-
-/*Error in the AEP daemon process*/
-#define AEP_R_DAEMON_ERROR                                              0x10090000
-
-/*Invalid ctx id*/
-#define AEP_R_INVALID_CTX_ID                                    0x10009000
-
-#define AEP_R_NO_KEY_MANAGER                                    0x1000a000
-
-/*Error obtaining a mutex*/
-#define AEP_R_MUTEX_BAD                         0x000001A0
-
-/*Fxn call before AEP_Initialise ot after AEP_Finialise*/
-#define AEP_R_AEPAPI_NOT_INITIALIZED                    0x10000190
-
-/*AEP_Initialise has already been called*/
-#define AEP_R_AEPAPI_ALREADY_INITIALIZED                0x10000191
-
-/*Maximum number of connections to daemon reached*/
-#define AEP_R_NO_MORE_CONNECTION_HNDLS                  0x10000200
-
-/*
- *
- * Some AEP Type definitions
- *
- */
-
-/* an unsigned 8-bit value */
-typedef unsigned char                           AEP_U8;
-
-/* an unsigned 8-bit character */
-typedef char                                    AEP_CHAR;
-
-/* a BYTE-sized Boolean flag */
-typedef AEP_U8                                  AEP_BBOOL;
-
-/*Unsigned value, at least 16 bits long*/
-typedef unsigned short                          AEP_U16;
-
-/* an unsigned value, at least 32 bits long */
-#ifdef SIXTY_FOUR_BIT_LONG
-typedef unsigned int                            AEP_U32;
-#else
-typedef unsigned long                           AEP_U32;
-#endif
-
-#ifdef SIXTY_FOUR_BIT_LONG
-typedef unsigned long                           AEP_U64;
-#else
-typedef struct { unsigned long l1, l2; }        AEP_U64;
-#endif
-
-/* at least 32 bits; each bit is a Boolean flag */
-typedef AEP_U32                 AEP_FLAGS;
-
-typedef AEP_U8          *AEP_U8_PTR;
-typedef AEP_CHAR        *AEP_CHAR_PTR;
-typedef AEP_U32                 *AEP_U32_PTR;
-typedef AEP_U64                 *AEP_U64_PTR;
-typedef void            *AEP_VOID_PTR;
-
-/* Pointer to a AEP_VOID_PTR-- i.e., pointer to pointer to void */
-typedef AEP_VOID_PTR    *AEP_VOID_PTR_PTR;
-
-/*Used to identify an AEP connection handle*/
-typedef AEP_U32                                 AEP_CONNECTION_HNDL;
-
-/*Pointer to an AEP connection handle*/
-typedef AEP_CONNECTION_HNDL     *AEP_CONNECTION_HNDL_PTR;
-
-/*Used by an application (in conjunction with the apps process id) to 
-identify an individual transaction*/
-typedef AEP_U32                                 AEP_TRANSACTION_ID;
-
-/*Pointer to an applications transaction identifier*/
-typedef AEP_TRANSACTION_ID              *AEP_TRANSACTION_ID_PTR;
-
-/*Return value type*/
-typedef AEP_U32                                 AEP_RV;
-
-#define MAX_PROCESS_CONNECTIONS 256
-
-#define RAND_BLK_SIZE 1024
-
-typedef enum{
-        NotConnected=   0,
-        Connected=              1,
-        InUse=                  2
-} AEP_CONNECTION_STATE;
-
-
-typedef struct AEP_CONNECTION_ENTRY{
-        AEP_CONNECTION_STATE    conn_state;
-        AEP_CONNECTION_HNDL     conn_hndl;
-} AEP_CONNECTION_ENTRY;
-
-
-typedef AEP_RV t_AEP_OpenConnection(AEP_CONNECTION_HNDL_PTR phConnection);
-typedef AEP_RV t_AEP_CloseConnection(AEP_CONNECTION_HNDL hConnection);
-
-typedef AEP_RV t_AEP_ModExp(AEP_CONNECTION_HNDL hConnection,
-                            AEP_VOID_PTR pA, AEP_VOID_PTR pP,
-                            AEP_VOID_PTR pN,
-                            AEP_VOID_PTR pResult,
-                            AEP_TRANSACTION_ID* pidTransID);
-
-typedef AEP_RV t_AEP_ModExpCrt(AEP_CONNECTION_HNDL hConnection,
-                               AEP_VOID_PTR pA, AEP_VOID_PTR pP,
-                               AEP_VOID_PTR pQ,
-                               AEP_VOID_PTR pDmp1, AEP_VOID_PTR pDmq1,
-                               AEP_VOID_PTR pIqmp,
-                               AEP_VOID_PTR pResult,
-                               AEP_TRANSACTION_ID* pidTransID);
-
-#ifdef AEPRAND
-typedef AEP_RV t_AEP_GenRandom(AEP_CONNECTION_HNDL hConnection,
-                               AEP_U32 Len,
-                               AEP_U32 Type,
-                               AEP_VOID_PTR pResult,
-                               AEP_TRANSACTION_ID* pidTransID);
-#endif
-
-typedef AEP_RV t_AEP_Initialize(AEP_VOID_PTR pInitArgs);
-typedef AEP_RV t_AEP_Finalize();
-typedef AEP_RV t_AEP_SetBNCallBacks(AEP_RV (*GetBigNumSizeFunc)(),
-                                    AEP_RV (*MakeAEPBigNumFunc)(),
-                                    AEP_RV (*ConverAEPBigNumFunc)());
-
diff --git a/src/lib/libcrypto/engine/vendor_defns/atalla.h b/src/lib/libcrypto/engine/vendor_defns/atalla.h
deleted file mode 100644
index 149970d441..0000000000
--- a/src/lib/libcrypto/engine/vendor_defns/atalla.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/* This header declares the necessary definitions for using the exponentiation
- * acceleration capabilities of Atalla cards. The only cryptographic operation
- * is performed by "ASI_RSAPrivateKeyOpFn" and this takes a structure that
- * defines an "RSA private key". However, it is really only performing a
- * regular mod_exp using the supplied modulus and exponent - no CRT form is
- * being used. Hence, it is a generic mod_exp function in disguise, and we use
- * it as such.
- *
- * Thanks to the people at Atalla for letting me know these definitions are
- * fine and that they can be reproduced here.
- *
- * Geoff.
- */
-
-typedef struct ItemStr
-        {
-        unsigned char *data;
-        int len;
-        } Item;
-
-typedef struct RSAPrivateKeyStr
-        {
-        void *reserved;
-        Item version;
-        Item modulus;
-        Item publicExponent;
-        Item privateExponent;
-        Item prime[2];
-        Item exponent[2];
-        Item coefficient;
-        } RSAPrivateKey;
-
-/* Predeclare the function pointer types that we dynamically load from the DSO.
- * These use the same names and form that Ben's original support code had (in
- * crypto/bn/bn_exp.c) unless of course I've inadvertently changed the style
- * somewhere along the way!
- */
-
-typedef int tfnASI_GetPerformanceStatistics(int reset_flag,
-                                        unsigned int *ret_buf);
-
-typedef int tfnASI_GetHardwareConfig(long card_num, unsigned int *ret_buf);
-
-typedef int tfnASI_RSAPrivateKeyOpFn(RSAPrivateKey * rsaKey,
-                                        unsigned char *output,
-                                        unsigned char *input,
-                                        unsigned int modulus_len);
-
diff --git a/src/lib/libcrypto/engine/vendor_defns/cswift.h b/src/lib/libcrypto/engine/vendor_defns/cswift.h
deleted file mode 100644
index 60079326bb..0000000000
--- a/src/lib/libcrypto/engine/vendor_defns/cswift.h
+++ /dev/null
@@ -1,234 +0,0 @@
-/* Attribution notice: Rainbow have generously allowed me to reproduce
- * the necessary definitions here from their API. This means the support
- * can build independently of whether application builders have the
- * API or hardware. This will allow developers to easily produce software
- * that has latent hardware support for any users that have accelertors
- * installed, without the developers themselves needing anything extra.
- *
- * I have only clipped the parts from the CryptoSwift header files that
- * are (or seem) relevant to the CryptoSwift support code. This is
- * simply to keep the file sizes reasonable.
- * [Geoff]
- */
-
-
-/* NB: These type widths do *not* seem right in general, in particular
- * they're not terribly friendly to 64-bit architectures (unsigned long)
- * will be 64-bit on IA-64 for a start. I'm leaving these alone as they
- * agree with Rainbow's API and this will only be called into question
- * on platforms with Rainbow support anyway! ;-) */
-
-#ifdef __cplusplus
-extern "C" {
-#endif /* __cplusplus */
-
-typedef long              SW_STATUS;              /* status           */
-typedef unsigned char     SW_BYTE;                /* 8 bit byte       */
-typedef unsigned short    SW_U16;                 /* 16 bit number    */
-#if defined(_IRIX)
-#include <sgidefs.h>
-typedef __uint32_t        SW_U32;
-#else
-typedef unsigned long     SW_U32;                 /* 32 bit integer   */
-#endif
- 
-#if defined(OPENSSL_SYS_WIN32)
-  typedef struct _SW_U64 {
-      SW_U32 low32;
-      SW_U32 high32;
-  } SW_U64;                                         /* 64 bit integer   */
-#elif defined(OPENSSL_SYS_MACINTOSH_CLASSIC)
-  typedef longlong SW_U64
-#else /* Unix variants */
-  typedef struct _SW_U64 {
-      SW_U32 low32;
-      SW_U32 high32;
-  } SW_U64;                                         /* 64 bit integer   */
-#endif
-
-/* status codes */
-#define SW_OK                 (0L)
-#define SW_ERR_BASE           (-10000L)
-#define SW_ERR_NO_CARD        (SW_ERR_BASE-1) /* The Card is not present   */
-#define SW_ERR_CARD_NOT_READY (SW_ERR_BASE-2) /* The card has not powered  */
-                                              /*    up yet                 */
-#define SW_ERR_TIME_OUT       (SW_ERR_BASE-3) /* Execution of a command    */
-                                              /*    time out               */
-#define SW_ERR_NO_EXECUTE     (SW_ERR_BASE-4) /* The Card failed to        */
-                                              /*    execute the command    */
-#define SW_ERR_INPUT_NULL_PTR (SW_ERR_BASE-5) /* a required pointer is     */
-                                              /*    NULL                   */
-#define SW_ERR_INPUT_SIZE     (SW_ERR_BASE-6) /* size is invalid, too      */
-                                              /*    small, too large.      */
-#define SW_ERR_INVALID_HANDLE (SW_ERR_BASE-7) /* Invalid SW_ACC_CONTEXT    */
-                                              /*    handle                 */
-#define SW_ERR_PENDING        (SW_ERR_BASE-8) /* A request is already out- */
-                                              /*    standing at this       */
-                                              /*    context handle         */
-#define SW_ERR_AVAILABLE      (SW_ERR_BASE-9) /* A result is available.    */
-#define SW_ERR_NO_PENDING     (SW_ERR_BASE-10)/* No request is pending.    */
-#define SW_ERR_NO_MEMORY      (SW_ERR_BASE-11)/* Not enough memory         */
-#define SW_ERR_BAD_ALGORITHM  (SW_ERR_BASE-12)/* Invalid algorithm type    */
-                                              /*    in SW_PARAM structure  */
-#define SW_ERR_MISSING_KEY    (SW_ERR_BASE-13)/* No key is associated with */
-                                              /*    context.               */
-                                              /*    swAttachKeyParam() is  */
-                                              /*    not called.            */
-#define SW_ERR_KEY_CMD_MISMATCH \
-                              (SW_ERR_BASE-14)/* Cannot perform requested  */
-                                              /*    SW_COMMAND_CODE since  */
-                                              /*    key attached via       */
-                                              /*    swAttachKeyParam()     */
-                                              /*    cannot be used for this*/
-                                              /*    SW_COMMAND_CODE.       */
-#define SW_ERR_NOT_IMPLEMENTED \
-                              (SW_ERR_BASE-15)/* Not implemented           */
-#define SW_ERR_BAD_COMMAND    (SW_ERR_BASE-16)/* Bad command code          */
-#define SW_ERR_BAD_ITEM_SIZE  (SW_ERR_BASE-17)/* too small or too large in */
-                                              /*    the "initems" or       */
-                                              /*    "outitems".            */
-#define SW_ERR_BAD_ACCNUM     (SW_ERR_BASE-18)/* Bad accelerator number    */
-#define SW_ERR_SELFTEST_FAIL  (SW_ERR_BASE-19)/* At least one of the self  */
-                                              /*    test fail, look at the */
-                                              /*    selfTestBitmap in      */
-                                              /*    SW_ACCELERATOR_INFO for*/
-                                              /*    details.               */
-#define SW_ERR_MISALIGN       (SW_ERR_BASE-20)/* Certain alogrithms require*/
-                                              /*    key materials aligned  */
-                                              /*    in certain order, e.g. */
-                                              /*    128 bit for CRT        */
-#define SW_ERR_OUTPUT_NULL_PTR \
-                              (SW_ERR_BASE-21)/* a required pointer is     */
-                                              /*    NULL                   */
-#define SW_ERR_OUTPUT_SIZE \
-                              (SW_ERR_BASE-22)/* size is invalid, too      */
-                                              /*    small, too large.      */
-#define SW_ERR_FIRMWARE_CHECKSUM \
-                              (SW_ERR_BASE-23)/* firmware checksum mismatch*/
-                                              /*    download failed.       */
-#define SW_ERR_UNKNOWN_FIRMWARE \
-                              (SW_ERR_BASE-24)/* unknown firmware error    */
-#define SW_ERR_INTERRUPT      (SW_ERR_BASE-25)/* request is abort when     */
-                                              /*    it's waiting to be     */
-                                              /*    completed.             */
-#define SW_ERR_NVWRITE_FAIL   (SW_ERR_BASE-26)/* error in writing to Non-  */
-                                              /*    volatile memory        */
-#define SW_ERR_NVWRITE_RANGE  (SW_ERR_BASE-27)/* out of range error in     */
-                                              /*    writing to NV memory   */
-#define SW_ERR_RNG_ERROR      (SW_ERR_BASE-28)/* Random Number Generation  */
-                                              /*    failure                */
-#define SW_ERR_DSS_FAILURE    (SW_ERR_BASE-29)/* DSS Sign or Verify failure*/
-#define SW_ERR_MODEXP_FAILURE (SW_ERR_BASE-30)/* Failure in various math   */
-                                              /*    calculations           */
-#define SW_ERR_ONBOARD_MEMORY (SW_ERR_BASE-31)/* Error in accessing on -   */
-                                              /*    board memory           */
-#define SW_ERR_FIRMWARE_VERSION \
-                              (SW_ERR_BASE-32)/* Wrong version in firmware */
-                                              /*    update                 */
-#define SW_ERR_ZERO_WORKING_ACCELERATOR \
-                              (SW_ERR_BASE-44)/* All accelerators are bad  */
-
-
-  /* algorithm type */
-#define SW_ALG_CRT          1
-#define SW_ALG_EXP          2
-#define SW_ALG_DSA          3
-#define SW_ALG_NVDATA       4
-
-  /* command code */
-#define SW_CMD_MODEXP_CRT   1 /* perform Modular Exponentiation using  */
-                              /*  Chinese Remainder Theorem (CRT)      */
-#define SW_CMD_MODEXP       2 /* perform Modular Exponentiation        */
-#define SW_CMD_DSS_SIGN     3 /* perform DSS sign                      */
-#define SW_CMD_DSS_VERIFY   4 /* perform DSS verify                    */
-#define SW_CMD_RAND         5 /* perform random number generation      */
-#define SW_CMD_NVREAD       6 /* perform read to nonvolatile RAM       */
-#define SW_CMD_NVWRITE      7 /* perform write to nonvolatile RAM      */
-
-typedef SW_U32            SW_ALGTYPE;             /* alogrithm type   */
-typedef SW_U32            SW_STATE;               /* state            */
-typedef SW_U32            SW_COMMAND_CODE;        /* command code     */
-typedef SW_U32            SW_COMMAND_BITMAP[4];   /* bitmap           */
-
-typedef struct _SW_LARGENUMBER {
-    SW_U32    nbytes;       /* number of bytes in the buffer "value"  */
-    SW_BYTE*  value;        /* the large integer as a string of       */
-                            /*   bytes in network (big endian) order  */
-} SW_LARGENUMBER;               
-
-#if defined(OPENSSL_SYS_WIN32)
-    #include <windows.h>
-    typedef HANDLE          SW_OSHANDLE;          /* handle to kernel object */
-    #define SW_OS_INVALID_HANDLE  INVALID_HANDLE_VALUE
-    #define SW_CALLCONV _stdcall
-#elif defined(OPENSSL_SYS_MACINTOSH_CLASSIC)
-    /* async callback mechanisms */
-    /* swiftCallbackLevel */
-    #define SW_MAC_CALLBACK_LEVEL_NO         0          
-    #define SW_MAC_CALLBACK_LEVEL_HARDWARE   1  /* from the hardware ISR */
-    #define SW_MAC_CALLBACK_LEVEL_SECONDARY  2  /* as secondary ISR */
-    typedef int             SW_MAC_CALLBACK_LEVEL;
-    typedef int             SW_OSHANDLE;
-    #define SW_OS_INVALID_HANDLE  (-1)
-    #define SW_CALLCONV
-#else /* Unix variants */
-    typedef int             SW_OSHANDLE;          /* handle to driver */
-    #define SW_OS_INVALID_HANDLE  (-1)
-    #define SW_CALLCONV
-#endif 
-
-typedef struct _SW_CRT {
-    SW_LARGENUMBER  p;      /* prime number p                         */
-    SW_LARGENUMBER  q;      /* prime number q                         */
-    SW_LARGENUMBER  dmp1;   /* exponent1                              */
-    SW_LARGENUMBER  dmq1;   /* exponent2                              */
-    SW_LARGENUMBER  iqmp;   /* CRT coefficient                        */
-} SW_CRT;
-
-typedef struct _SW_EXP {
-    SW_LARGENUMBER  modulus; /* modulus                                */
-    SW_LARGENUMBER  exponent;/* exponent                               */
-} SW_EXP;
-
-typedef struct _SW_DSA {
-    SW_LARGENUMBER  p;      /*                                        */
-    SW_LARGENUMBER  q;      /*                                        */
-    SW_LARGENUMBER  g;      /*                                        */
-    SW_LARGENUMBER  key;    /* private/public key                     */
-} SW_DSA;
-
-typedef struct _SW_NVDATA {
-    SW_U32 accnum;          /* accelerator board number               */
-    SW_U32 offset;          /* offset in byte                         */
-} SW_NVDATA;
-
-typedef struct _SW_PARAM {
-    SW_ALGTYPE    type;     /* type of the alogrithm                  */
-    union {
-        SW_CRT    crt;
-        SW_EXP    exp;
-        SW_DSA    dsa;
-        SW_NVDATA nvdata;
-    } up;
-} SW_PARAM;
-
-typedef SW_U32 SW_CONTEXT_HANDLE; /* opaque context handle */
-
-
-/* Now the OpenSSL bits, these function types are the for the function
- * pointers that will bound into the Rainbow shared libraries. */
-typedef SW_STATUS SW_CALLCONV t_swAcquireAccContext(SW_CONTEXT_HANDLE *hac);
-typedef SW_STATUS SW_CALLCONV t_swAttachKeyParam(SW_CONTEXT_HANDLE hac,
-                                                SW_PARAM *key_params);
-typedef SW_STATUS SW_CALLCONV t_swSimpleRequest(SW_CONTEXT_HANDLE hac,
-                                                SW_COMMAND_CODE cmd,
-                                                SW_LARGENUMBER pin[],
-                                                SW_U32 pin_count,
-                                                SW_LARGENUMBER pout[],
-                                                SW_U32 pout_count);
-typedef SW_STATUS SW_CALLCONV t_swReleaseAccContext(SW_CONTEXT_HANDLE hac);
-
-#ifdef __cplusplus
-}
-#endif /* __cplusplus */
-
diff --git a/src/lib/libcrypto/engine/vendor_defns/hw_4758_cca.h b/src/lib/libcrypto/engine/vendor_defns/hw_4758_cca.h
deleted file mode 100644
index 296636e81a..0000000000
--- a/src/lib/libcrypto/engine/vendor_defns/hw_4758_cca.h
+++ /dev/null
@@ -1,149 +0,0 @@
-/**********************************************************************/
-/*                                                                    */
-/*  Prototypes of the CCA verbs used by the 4758 CCA openssl driver   */
-/*                                                                    */
-/*  Maurice Gittens <maurice@gittens.nl>                              */
-/*                                                                    */
-/**********************************************************************/
-
-#ifndef __HW_4758_CCA__
-#define __HW_4758_CCA__
-
-/*
- *  Only WIN32 support for now
- */
-#if defined(WIN32)
-
-  #define CCA_LIB_NAME "CSUNSAPI"
-
-  #define CSNDPKX   "CSNDPKX_32"
-  #define CSNDKRR   "CSNDKRR_32"
-  #define CSNDPKE   "CSNDPKE_32"
-  #define CSNDPKD   "CSNDPKD_32"
-  #define CSNDDSV   "CSNDDSV_32"
-  #define CSNDDSG   "CSNDDSG_32"
-  #define CSNBRNG   "CSNBRNG_32"
-
-  #define SECURITYAPI __stdcall
-#else
-    /* Fixme!!         
-      Find out the values of these constants for other platforms.
-    */
-  #define CCA_LIB_NAME "CSUNSAPI"
-
-  #define CSNDPKX   "CSNDPKX"
-  #define CSNDKRR   "CSNDKRR"
-  #define CSNDPKE   "CSNDPKE"
-  #define CSNDPKD   "CSNDPKD"
-  #define CSNDDSV   "CSNDDSV"
-  #define CSNDDSG   "CSNDDSG"
-  #define CSNBRNG   "CSNBRNG"
-
-  #define SECURITYAPI
-#endif
-
-/*
- * security API prototypes
- */
-
-/* PKA Key Record Read */
-typedef void (SECURITYAPI *F_KEYRECORDREAD)
-             (long          * return_code,
-              long          * reason_code,
-              long          * exit_data_length,
-              unsigned char * exit_data,
-              long          * rule_array_count,
-              unsigned char * rule_array,
-              unsigned char * key_label,
-              long          * key_token_length,
-              unsigned char * key_token);
-
-/* Random Number Generate */
-typedef void (SECURITYAPI *F_RANDOMNUMBERGENERATE)
-             (long          * return_code,
-              long          * reason_code,
-              long          * exit_data_length,
-              unsigned char * exit_data,
-              unsigned char * form,
-              unsigned char * random_number);
-
-/* Digital Signature Generate */
-typedef void (SECURITYAPI *F_DIGITALSIGNATUREGENERATE)
-             (long          * return_code,
-              long          * reason_code,
-              long          * exit_data_length,
-              unsigned char * exit_data,
-              long          * rule_array_count,
-              unsigned char * rule_array,
-              long          * PKA_private_key_id_length,
-              unsigned char * PKA_private_key_id,
-              long          * hash_length,
-              unsigned char * hash,
-              long          * signature_field_length,
-              long          * signature_bit_length,
-              unsigned char * signature_field);
-
-/* Digital Signature Verify */
-typedef void (SECURITYAPI *F_DIGITALSIGNATUREVERIFY)(
-              long          * return_code,
-              long          * reason_code,
-              long          * exit_data_length,
-              unsigned char * exit_data,
-              long          * rule_array_count,
-              unsigned char * rule_array,
-              long          * PKA_public_key_id_length,
-              unsigned char * PKA_public_key_id,
-              long          * hash_length,
-              unsigned char * hash,
-              long          * signature_field_length,
-              unsigned char * signature_field);
-
-/* PKA Public Key Extract */
-typedef void (SECURITYAPI *F_PUBLICKEYEXTRACT)(
-              long          * return_code,
-              long          * reason_code,
-              long          * exit_data_length,
-              unsigned char * exit_data,
-              long          * rule_array_count,
-              unsigned char * rule_array,
-              long          * source_key_identifier_length,
-              unsigned char * source_key_identifier,
-              long          * target_key_token_length,
-              unsigned char * target_key_token);
-
-/* PKA Encrypt */
-typedef void   (SECURITYAPI *F_PKAENCRYPT)
-               (long          *  return_code,
-                 long          *  reason_code,
-                 long          *  exit_data_length,
-                 unsigned char *  exit_data,
-                 long          *  rule_array_count,
-                 unsigned char *  rule_array,
-                 long          *  key_value_length,
-                 unsigned char *  key_value,
-                 long          *  data_struct_length,
-                 unsigned char *  data_struct,
-                 long          *  RSA_public_key_length,
-                 unsigned char *  RSA_public_key,
-                 long          *  RSA_encipher_length,
-                 unsigned char *  RSA_encipher );
-
-/* PKA Decrypt */
-typedef void    (SECURITYAPI *F_PKADECRYPT)
-                (long          *  return_code,
-                 long          *  reason_code,
-                 long          *  exit_data_length,
-                 unsigned char *  exit_data,
-                 long          *  rule_array_count,
-                 unsigned char *  rule_array,
-                 long          *  enciphered_key_length,
-                 unsigned char *  enciphered_key,
-                 long          *  data_struct_length,
-                 unsigned char *  data_struct,
-                 long          *  RSA_private_key_length,
-                 unsigned char *  RSA_private_key,
-                 long          *  key_value_length,
-                 unsigned char *  key_value    );
-
-
-#endif
diff --git a/src/lib/libcrypto/engine/vendor_defns/hw_ubsec.h b/src/lib/libcrypto/engine/vendor_defns/hw_ubsec.h
deleted file mode 100644
index b6619d40f2..0000000000
--- a/src/lib/libcrypto/engine/vendor_defns/hw_ubsec.h
+++ /dev/null
@@ -1,100 +0,0 @@
-/******************************************************************************
- *
- *  Copyright 2000
- *  Broadcom Corporation
- *  16215 Alton Parkway
- *  PO Box 57013
- *  Irvine CA 92619-7013
- *
- *****************************************************************************/
-/* 
- * Broadcom Corporation uBSec SDK 
- */
-/*
- * Character device header file.
- */
-/*
- * Revision History:
- *
- * October 2000 JTT Created.
- */
-
-#define MAX_PUBLIC_KEY_BITS (1024)
-#define MAX_PUBLIC_KEY_BYTES (1024/8)
-#define SHA_BIT_SIZE  (160)
-#define MAX_CRYPTO_KEY_LENGTH 24
-#define MAX_MAC_KEY_LENGTH 64
-#define UBSEC_CRYPTO_DEVICE_NAME ((unsigned char *)"/dev/ubscrypt")
-#define UBSEC_KEY_DEVICE_NAME ((unsigned char *)"/dev/ubskey")
-
-/* Math command types. */
-#define UBSEC_MATH_MODADD 0x0001
-#define UBSEC_MATH_MODSUB 0x0002
-#define UBSEC_MATH_MODMUL 0x0004
-#define UBSEC_MATH_MODEXP 0x0008
-#define UBSEC_MATH_MODREM 0x0010
-#define UBSEC_MATH_MODINV 0x0020
-
-typedef long ubsec_MathCommand_t;
-typedef long ubsec_RNGCommand_t;
-
-typedef struct ubsec_crypto_context_s {
-        unsigned int    flags;
-        unsigned char   crypto[MAX_CRYPTO_KEY_LENGTH];
-        unsigned char   auth[MAX_MAC_KEY_LENGTH];
-} ubsec_crypto_context_t, *ubsec_crypto_context_p;
-
-/* 
- * Predeclare the function pointer types that we dynamically load from the DSO.
- */
-
-typedef int t_UBSEC_ubsec_bytes_to_bits(unsigned char *n, int bytes);
-
-typedef int t_UBSEC_ubsec_bits_to_bytes(int bits);
-
-typedef int t_UBSEC_ubsec_open(unsigned char *device);
-
-typedef int t_UBSEC_ubsec_close(int fd);
-
-typedef int t_UBSEC_diffie_hellman_generate_ioctl (int fd,
-        unsigned char *x, int *x_len, unsigned char *y, int *y_len, 
-        unsigned char *g, int g_len, unsigned char *m, int m_len,
-        unsigned char *userX, int userX_len, int random_bits);
-
-typedef int t_UBSEC_diffie_hellman_agree_ioctl (int fd,
-        unsigned char *x, int x_len, unsigned char *y, int y_len, 
-        unsigned char *m, int m_len, unsigned char *k, int *k_len);
-
-typedef int t_UBSEC_rsa_mod_exp_ioctl (int fd,
-        unsigned char *x, int x_len, unsigned char *m, int m_len,
-        unsigned char *e, int e_len, unsigned char *y, int *y_len);
-
-typedef int t_UBSEC_rsa_mod_exp_crt_ioctl (int fd,
-        unsigned char *x, int x_len, unsigned char *qinv, int qinv_len,
-        unsigned char *edq, int edq_len, unsigned char *q, int q_len,
-        unsigned char *edp, int edp_len, unsigned char *p, int p_len,
-        unsigned char *y, int *y_len);
-
-typedef int t_UBSEC_dsa_sign_ioctl (int fd,
-        int hash, unsigned char *data, int data_len, 
-        unsigned char *rndom, int random_len, 
-        unsigned char *p, int p_len, unsigned char *q, int q_len,
-        unsigned char *g, int g_len, unsigned char *key, int key_len,
-        unsigned char *r, int *r_len, unsigned char *s, int *s_len);
-
-typedef int t_UBSEC_dsa_verify_ioctl (int fd,
-        int hash, unsigned char *data, int data_len,
-        unsigned char *p, int p_len, unsigned char *q, int q_len,
-        unsigned char *g, int g_len, unsigned char *key, int key_len,
-        unsigned char *r, int r_len, unsigned char *s, int s_len,
-        unsigned char *v, int *v_len);
-
-typedef int t_UBSEC_math_accelerate_ioctl(int fd, ubsec_MathCommand_t command,
-        unsigned char *ModN, int *ModN_len, unsigned char *ExpE, int *ExpE_len, 
-        unsigned char *ParamA, int *ParamA_len, unsigned char *ParamB, int *ParamB_len,
-        unsigned char *Result, int *Result_len);
-
-typedef int t_UBSEC_rng_ioctl(int fd, ubsec_RNGCommand_t command,
-        unsigned char *Result, int *Result_len);
-
-typedef int t_UBSEC_max_key_len_ioctl(int fd, int *max_key_len);
diff --git a/src/lib/libcrypto/engine/vendor_defns/hwcryptohook.h b/src/lib/libcrypto/engine/vendor_defns/hwcryptohook.h
deleted file mode 100644
index aaa4d4575e..0000000000
--- a/src/lib/libcrypto/engine/vendor_defns/hwcryptohook.h
+++ /dev/null
@@ -1,486 +0,0 @@
-/*
- * ModExp / RSA (with/without KM) plugin API
- *
- * The application will load a dynamic library which
- * exports entrypoint(s) defined in this file.
- *
- * This set of entrypoints provides only a multithreaded,
- * synchronous-within-each-thread, facility.
- *
- *
- * This file is Copyright 1998-2000 nCipher Corporation Limited.
- *
- * Redistribution and use in source and binary forms, with opr without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the copyright notice,
- *    this list of conditions, and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above
- *    copyright notice, this list of conditions, and the following
- *    disclaimer, in the documentation and/or other materials provided
- *    with the distribution
- *
- * IN NO EVENT SHALL NCIPHER CORPORATION LIMITED (`NCIPHER') AND/OR
- * ANY OTHER AUTHORS OR DISTRIBUTORS OF THIS FILE BE LIABLE for any
- * damages arising directly or indirectly from this file, its use or
- * this licence.  Without prejudice to the generality of the
- * foregoing: all liability shall be excluded for direct, indirect,
- * special, incidental, consequential or other damages or any loss of
- * profits, business, revenue goodwill or anticipated savings;
- * liability shall be excluded even if nCipher or anyone else has been
- * advised of the possibility of damage.  In any event, if the
- * exclusion of liability is not effective, the liability of nCipher
- * or any author or distributor shall be limited to the lesser of the
- * price paid and 1,000 pounds sterling. This licence only fails to
- * exclude or limit liability for death or personal injury arising out
- * of negligence, and only to the extent that such an exclusion or
- * limitation is not effective.
- *
- * NCIPHER AND THE AUTHORS AND DISTRIBUTORS SPECIFICALLY DISCLAIM ALL
- * AND ANY WARRANTIES (WHETHER EXPRESS OR IMPLIED), including, but not
- * limited to, any implied warranties of merchantability, fitness for
- * a particular purpose, satisfactory quality, and/or non-infringement
- * of any third party rights.
- *
- * US Government use: This software and documentation is Commercial
- * Computer Software and Computer Software Documentation, as defined in
- * sub-paragraphs (a)(1) and (a)(5) of DFAR 252.227-7014, "Rights in
- * Noncommercial Computer Software and Noncommercial Computer Software
- * Documentation."  Use, duplication or disclosure by the Government is
- * subject to the terms and conditions specified here.
- *
- * By using or distributing this file you will be accepting these
- * terms and conditions, including the limitation of liability and
- * lack of warranty.  If you do not wish to accept these terms and
- * conditions, DO NOT USE THE FILE.
- *
- *
- * The actual dynamically loadable plugin, and the library files for
- * static linking, which are also provided in some distributions, are
- * not covered by the licence described above.  You should have
- * received a separate licence with terms and conditions for these
- * library files; if you received the library files without a licence,
- * please contact nCipher.
- *
- *
- * $Id: hwcryptohook.h,v 1.1.1.1 2003/05/11 21:35:16 markus Exp $
- */
-
-#ifndef HWCRYPTOHOOK_H
-#define HWCRYPTOHOOK_H
-
-#include <sys/types.h>
-#include <stdio.h>
-
-#ifndef HWCRYPTOHOOK_DECLARE_APPTYPES
-#define HWCRYPTOHOOK_DECLARE_APPTYPES 1
-#endif
-
-#define HWCRYPTOHOOK_ERROR_FAILED   -1
-#define HWCRYPTOHOOK_ERROR_FALLBACK -2
-#define HWCRYPTOHOOK_ERROR_MPISIZE  -3
-
-#if HWCRYPTOHOOK_DECLARE_APPTYPES
-
-/* These structs are defined by the application and opaque to the
- * crypto plugin.  The application may define these as it sees fit.
- * Default declarations are provided here, but the application may
- *  #define HWCRYPTOHOOK_DECLARE_APPTYPES 0
- * to prevent these declarations, and instead provide its own
- * declarations of these types.  (Pointers to them must still be
- * ordinary pointers to structs or unions, or the resulting combined
- * program will have a type inconsistency.)
- */
-typedef struct HWCryptoHook_MutexValue HWCryptoHook_Mutex;
-typedef struct HWCryptoHook_CondVarValue HWCryptoHook_CondVar;
-typedef struct HWCryptoHook_PassphraseContextValue HWCryptoHook_PassphraseContext;
-typedef struct HWCryptoHook_CallerContextValue HWCryptoHook_CallerContext;
-
-#endif /* HWCRYPTOHOOK_DECLARE_APPTYPES */
-
-/* These next two structs are opaque to the application.  The crypto
- * plugin will return pointers to them; the caller simply manipulates
- * the pointers.
- */
-typedef struct HWCryptoHook_Context *HWCryptoHook_ContextHandle;
-typedef struct HWCryptoHook_RSAKey *HWCryptoHook_RSAKeyHandle;
-
-typedef struct {
-  char *buf;
-  size_t size;
-} HWCryptoHook_ErrMsgBuf;
-/* Used for error reporting.  When a HWCryptoHook function fails it
- * will return a sentinel value (0 for pointer-valued functions, or a
- * negative number, usually HWCRYPTOHOOK_ERROR_FAILED, for
- * integer-valued ones).  It will, if an ErrMsgBuf is passed, also put
- * an error message there.
- * 
- * size is the size of the buffer, and will not be modified.  If you
- * pass 0 for size you must pass 0 for buf, and nothing will be
- * recorded (just as if you passed 0 for the struct pointer).
- * Messages written to the buffer will always be null-terminated, even
- * when truncated to fit within size bytes.
- *
- * The contents of the buffer are not defined if there is no error.
- */
-
-typedef struct HWCryptoHook_MPIStruct {
-  unsigned char *buf;
-  size_t size;
-} HWCryptoHook_MPI;
-/* When one of these is returned, a pointer is passed to the function.
- * At call, size is the space available.  Afterwards it is updated to
- * be set to the actual length (which may be more than the space available,
- * if there was not enough room and the result was truncated).
- * buf (the pointer) is not updated.
- *
- * size is in bytes and may be zero at call or return, but must be a
- * multiple of the limb size.  Zero limbs at the MS end are not
- * permitted.
- */
-
-#define HWCryptoHook_InitFlags_FallbackModExp    0x0002UL
-#define HWCryptoHook_InitFlags_FallbackRSAImmed  0x0004UL
-/* Enable requesting fallback to software in case of problems with the
- * hardware support.  This indicates to the crypto provider that the
- * application is prepared to fall back to software operation if the
- * ModExp* or RSAImmed* functions return HWCRYPTOHOOK_ERROR_FALLBACK.
- * Without this flag those calls will never return
- * HWCRYPTOHOOK_ERROR_FALLBACK.  The flag will also cause the crypto
- * provider to avoid repeatedly attempting to contact dead hardware
- * within a short interval, if appropriate.
- */
-
-#define HWCryptoHook_InitFlags_SimpleForkCheck   0x0010UL
-/* Without _SimpleForkCheck the library is allowed to assume that the
- * application will not fork and call the library in the child(ren).
- *
- * When it is specified, this is allowed.  However, after a fork
- * neither parent nor child may unload any loaded keys or call
- * _Finish.  Instead, they should call exit (or die with a signal)
- * without calling _Finish.  After all the children have died the
- * parent may unload keys or call _Finish.
- *
- * This flag only has any effect on UN*X platforms.
- */
-
-typedef struct {
-  unsigned long flags;
-  void *logstream; /* usually a FILE*.  See below. */
-
-  size_t limbsize; /* bignum format - size of radix type, must be power of 2 */
-  int mslimbfirst; /* 0 or 1 */
-  int msbytefirst; /* 0 or 1; -1 = native */
-
-  /* All the callback functions should return 0 on success, or a
-   * nonzero integer (whose value will be visible in the error message
-   * put in the buffer passed to the call).
-   *
-   * If a callback is not available pass a null function pointer.
-   *
-   * The callbacks may not call down again into the crypto plugin.
-   */
-  
-  /* For thread-safety.  Set everything to 0 if you promise only to be
-   * singlethreaded.  maxsimultaneous is the number of calls to
-   * ModExp[Crt]/RSAImmed{Priv,Pub}/RSA.  If you don't know what to
-   * put there then say 0 and the hook library will use a default.
-   *
-   * maxmutexes is a small limit on the number of simultaneous mutexes
-   * which will be requested by the library.  If there is no small
-   * limit, set it to 0.  If the crypto plugin cannot create the
-   * advertised number of mutexes the calls to its functions may fail.
-   * If a low number of mutexes is advertised the plugin will try to
-   * do the best it can.  Making larger numbers of mutexes available
-   * may improve performance and parallelism by reducing contention
-   * over critical sections.  Unavailability of any mutexes, implying
-   * single-threaded operation, should be indicated by the setting
-   * mutex_init et al to 0.
-   */
-  int maxmutexes;
-  int maxsimultaneous;
-  size_t mutexsize;
-  int (*mutex_init)(HWCryptoHook_Mutex*, HWCryptoHook_CallerContext *cactx);
-  int (*mutex_acquire)(HWCryptoHook_Mutex*);
-  void (*mutex_release)(HWCryptoHook_Mutex*);
-  void (*mutex_destroy)(HWCryptoHook_Mutex*);
-
-  /* For greater efficiency, can use condition vars internally for
-   * synchronisation.  In this case maxsimultaneous is ignored, but
-   * the other mutex stuff must be available.  In singlethreaded
-   * programs, set everything to 0.
-   */
-  size_t condvarsize;
-  int (*condvar_init)(HWCryptoHook_CondVar*, HWCryptoHook_CallerContext *cactx);
-  int (*condvar_wait)(HWCryptoHook_CondVar*, HWCryptoHook_Mutex*);
-  void (*condvar_signal)(HWCryptoHook_CondVar*);
-  void (*condvar_broadcast)(HWCryptoHook_CondVar*);
-  void (*condvar_destroy)(HWCryptoHook_CondVar*);
-  
-  /* The semantics of acquiring and releasing mutexes and broadcasting
-   * and waiting on condition variables are expected to be those from
-   * POSIX threads (pthreads).  The mutexes may be (in pthread-speak)
-   * fast mutexes, recursive mutexes, or nonrecursive ones.
-   * 
-   * The _release/_signal/_broadcast and _destroy functions must
-   * always succeed when given a valid argument; if they are given an
-   * invalid argument then the program (crypto plugin + application)
-   * has an internal error, and they should abort the program.
-   */
-
-  int (*getpassphrase)(const char *prompt_info,
-                       int *len_io, char *buf,
-                       HWCryptoHook_PassphraseContext *ppctx,
-                       HWCryptoHook_CallerContext *cactx);
-  /* Passphrases and the prompt_info, if they contain high-bit-set
-   * characters, are UTF-8.  The prompt_info may be a null pointer if
-   * no prompt information is available (it should not be an empty
-   * string).  It will not contain text like `enter passphrase';
-   * instead it might say something like `Operator Card for John
-   * Smith' or `SmartCard in nFast Module #1, Slot #1'.
-   *
-   * buf points to a buffer in which to return the passphrase; on
-   * entry *len_io is the length of the buffer.  It should be updated
-   * by the callback.  The returned passphrase should not be
-   * null-terminated by the callback.
-   */
-  
-  int (*getphystoken)(const char *prompt_info,
-                      const char *wrong_info,
-                      HWCryptoHook_PassphraseContext *ppctx,
-                      HWCryptoHook_CallerContext *cactx);
-  /* Requests that the human user physically insert a different
-   * smartcard, DataKey, etc.  The plugin should check whether the
-   * currently inserted token(s) are appropriate, and if they are it
-   * should not make this call.
-   *
-   * prompt_info is as before.  wrong_info is a description of the
-   * currently inserted token(s) so that the user is told what
-   * something is.  wrong_info, like prompt_info, may be null, but
-   * should not be an empty string.  Its contents should be
-   * syntactically similar to that of prompt_info. 
-   */
-  
-  /* Note that a single LoadKey operation might cause several calls to
-   * getpassphrase and/or requestphystoken.  If requestphystoken is
-   * not provided (ie, a null pointer is passed) then the plugin may
-   * not support loading keys for which authorisation by several cards
-   * is required.  If getpassphrase is not provided then cards with
-   * passphrases may not be supported.
-   *
-   * getpassphrase and getphystoken do not need to check that the
-   * passphrase has been entered correctly or the correct token
-   * inserted; the crypto plugin will do that.  If this is not the
-   * case then the crypto plugin is responsible for calling these
-   * routines again as appropriate until the correct token(s) and
-   * passphrase(s) are supplied as required, or until any retry limits
-   * implemented by the crypto plugin are reached.
-   *
-   * In either case, the application must allow the user to say `no'
-   * or `cancel' to indicate that they do not know the passphrase or
-   * have the appropriate token; this should cause the callback to
-   * return nonzero indicating error.
-   */
-
-  void (*logmessage)(void *logstream, const char *message);
-  /* A log message will be generated at least every time something goes
-   * wrong and an ErrMsgBuf is filled in (or would be if one was
-   * provided).  Other diagnostic information may be written there too,
-   * including more detailed reasons for errors which are reported in an
-   * ErrMsgBuf.
-   *
-   * When a log message is generated, this callback is called.  It
-   * should write a message to the relevant logging arrangements.
-   *
-   * The message string passed will be null-terminated and may be of arbitrary
-   * length.  It will not be prefixed by the time and date, nor by the
-   * name of the library that is generating it - if this is required,
-   * the logmessage callback must do it.  The message will not have a
-   * trailing newline (though it may contain internal newlines).
-   *
-   * If a null pointer is passed for logmessage a default function is
-   * used.  The default function treats logstream as a FILE* which has
-   * been converted to a void*.  If logstream is 0 it does nothing.
-   * Otherwise it prepends the date and time and library name and
-   * writes the message to logstream.  Each line will be prefixed by a
-   * descriptive string containing the date, time and identity of the
-   * crypto plugin.  Errors on the logstream are not reported
-   * anywhere, and the default function doesn't flush the stream, so
-   * the application must set the buffering how it wants it.
-   *
-   * The crypto plugin may also provide a facility to have copies of
-   * log messages sent elsewhere, and or for adjusting the verbosity
-   * of the log messages; any such facilities will be configured by
-   * external means.
-   */
-
-} HWCryptoHook_InitInfo;
-
-typedef
-HWCryptoHook_ContextHandle HWCryptoHook_Init_t(const HWCryptoHook_InitInfo *initinfo,
-                                               size_t initinfosize,
-                                               const HWCryptoHook_ErrMsgBuf *errors,
-                                               HWCryptoHook_CallerContext *cactx);
-extern HWCryptoHook_Init_t HWCryptoHook_Init;
-
-/* Caller should set initinfosize to the size of the HWCryptoHook struct,
- * so it can be extended later.
- *
- * On success, a message for display or logging by the server,
- * including the name and version number of the plugin, will be filled
- * in into *errors; on failure *errors is used for error handling, as
- * usual.
- */
-
-/* All these functions return 0 on success, HWCRYPTOHOOK_ERROR_FAILED
- * on most failures.  HWCRYPTOHOOK_ERROR_MPISIZE means at least one of
- * the output MPI buffer(s) was too small; the sizes of all have been
- * set to the desired size (and for those where the buffer was large
- * enough, the value may have been copied in), and no error message
- * has been recorded.
- *
- * You may pass 0 for the errors struct.  In any case, unless you set
- * _NoStderr at init time then messages may be reported to stderr.
- */
-
-/* The RSAImmed* functions (and key managed RSA) only work with
- * modules which have an RSA patent licence - currently that means KM
- * units; the ModExp* ones work with all modules, so you need a patent
- * licence in the software in the US.  They are otherwise identical.
- */
-
-typedef
-void HWCryptoHook_Finish_t(HWCryptoHook_ContextHandle hwctx);
-extern HWCryptoHook_Finish_t HWCryptoHook_Finish;
-/* You must not have any calls going or keys loaded when you call this. */
-
-typedef
-int HWCryptoHook_RandomBytes_t(HWCryptoHook_ContextHandle hwctx,
-                               unsigned char *buf, size_t len,
-                               const HWCryptoHook_ErrMsgBuf *errors);
-extern HWCryptoHook_RandomBytes_t HWCryptoHook_RandomBytes;
-
-typedef
-int HWCryptoHook_ModExp_t(HWCryptoHook_ContextHandle hwctx,
-                          HWCryptoHook_MPI a,
-                          HWCryptoHook_MPI p,
-                          HWCryptoHook_MPI n,
-                          HWCryptoHook_MPI *r,
-                          const HWCryptoHook_ErrMsgBuf *errors);
-extern HWCryptoHook_ModExp_t HWCryptoHook_ModExp;
-
-typedef
-int HWCryptoHook_RSAImmedPub_t(HWCryptoHook_ContextHandle hwctx,
-                               HWCryptoHook_MPI m,
-                               HWCryptoHook_MPI e,
-                               HWCryptoHook_MPI n,
-                               HWCryptoHook_MPI *r,
-                               const HWCryptoHook_ErrMsgBuf *errors);
-extern HWCryptoHook_RSAImmedPub_t HWCryptoHook_RSAImmedPub;
-
-typedef
-int HWCryptoHook_ModExpCRT_t(HWCryptoHook_ContextHandle hwctx,
-                             HWCryptoHook_MPI a,
-                             HWCryptoHook_MPI p,
-                             HWCryptoHook_MPI q,
-                             HWCryptoHook_MPI dmp1,
-                             HWCryptoHook_MPI dmq1,
-                             HWCryptoHook_MPI iqmp,
-                             HWCryptoHook_MPI *r,
-                             const HWCryptoHook_ErrMsgBuf *errors);
-extern HWCryptoHook_ModExpCRT_t HWCryptoHook_ModExpCRT;
-
-typedef
-int HWCryptoHook_RSAImmedPriv_t(HWCryptoHook_ContextHandle hwctx,
-                                HWCryptoHook_MPI m,
-                                HWCryptoHook_MPI p,
-                                HWCryptoHook_MPI q,
-                                HWCryptoHook_MPI dmp1,
-                                HWCryptoHook_MPI dmq1,
-                                HWCryptoHook_MPI iqmp,
-                                HWCryptoHook_MPI *r,
-                                const HWCryptoHook_ErrMsgBuf *errors);
-extern HWCryptoHook_RSAImmedPriv_t HWCryptoHook_RSAImmedPriv;
-
-/* The RSAImmed* and ModExp* functions may return E_FAILED or
- * E_FALLBACK for failure.
- *
- * E_FAILED means the failure is permanent and definite and there
- *    should be no attempt to fall back to software.  (Eg, for some
- *    applications, which support only the acceleration-only
- *    functions, the `key material' may actually be an encoded key
- *    identifier, and doing the operation in software would give wrong
- *    answers.)
- *
- * E_FALLBACK means that doing the computation in software would seem
- *    reasonable.  If an application pays attention to this and is
- *    able to fall back, it should also set the Fallback init flags.
- */
-
-typedef
-int HWCryptoHook_RSALoadKey_t(HWCryptoHook_ContextHandle hwctx,
-                              const char *key_ident,
-                              HWCryptoHook_RSAKeyHandle *keyhandle_r,
-                              const HWCryptoHook_ErrMsgBuf *errors,
-                              HWCryptoHook_PassphraseContext *ppctx);
-extern HWCryptoHook_RSALoadKey_t HWCryptoHook_RSALoadKey;
-/* The key_ident is a null-terminated string configured by the
- * user via the application's usual configuration mechanisms.
- * It is provided to the user by the crypto provider's key management
- * system.  The user must be able to enter at least any string of between
- * 1 and 1023 characters inclusive, consisting of printable 7-bit
- * ASCII characters.  The provider should avoid using
- * any characters except alphanumerics and the punctuation
- * characters  _ - + . / @ ~  (the user is expected to be able
- * to enter these without quoting).  The string may be case-sensitive.
- * The application may allow the user to enter other NULL-terminated strings,
- * and the provider must cope (returning an error if the string is not
- * valid).
- *
- * If the key does not exist, no error is recorded and 0 is returned;
- * keyhandle_r will be set to 0 instead of to a key handle.
- */
-
-typedef
-int HWCryptoHook_RSAGetPublicKey_t(HWCryptoHook_RSAKeyHandle k,
-                                   HWCryptoHook_MPI *n,
-                                   HWCryptoHook_MPI *e,
-                                   const HWCryptoHook_ErrMsgBuf *errors);
-extern HWCryptoHook_RSAGetPublicKey_t HWCryptoHook_RSAGetPublicKey;
-/* The crypto plugin will not store certificates.
- *
- * Although this function for acquiring the public key value is
- * provided, it is not the purpose of this API to deal fully with the
- * handling of the public key.
- *
- * It is expected that the crypto supplier's key generation program
- * will provide general facilities for producing X.509
- * self-certificates and certificate requests in PEM format.  These
- * will be given to the user so that they can configure them in the
- * application, send them to CAs, or whatever.
- *
- * In case this kind of certificate handling is not appropriate, the
- * crypto supplier's key generation program should be able to be
- * configured not to generate such a self-certificate or certificate
- * request.  Then the application will need to do all of this, and
- * will need to store and handle the public key and certificates
- * itself.
- */
-
-typedef
-int HWCryptoHook_RSAUnloadKey_t(HWCryptoHook_RSAKeyHandle k,
-                                const HWCryptoHook_ErrMsgBuf *errors);
-extern HWCryptoHook_RSAUnloadKey_t HWCryptoHook_RSAUnloadKey;
-/* Might fail due to locking problems, or other serious internal problems. */
-
-typedef
-int HWCryptoHook_RSA_t(HWCryptoHook_MPI m,
-                       HWCryptoHook_RSAKeyHandle k,
-                       HWCryptoHook_MPI *r,
-                       const HWCryptoHook_ErrMsgBuf *errors);
-extern HWCryptoHook_RSA_t HWCryptoHook_RSA;
-/* RSA private key operation (sign or decrypt) - raw, unpadded. */
-
-#endif /*HWCRYPTOHOOK_H*/
diff --git a/src/lib/libcrypto/engine/vendor_defns/sureware.h b/src/lib/libcrypto/engine/vendor_defns/sureware.h
deleted file mode 100644
index 4bc22027f9..0000000000
--- a/src/lib/libcrypto/engine/vendor_defns/sureware.h
+++ /dev/null
@@ -1,239 +0,0 @@
-/*
-* Written by Corinne Dive-Reclus(cdive@baltimore.com)
-*
-* Copyright@2001 Baltimore Technologies Ltd.
-*                                                                                                                                                                                               *       
-*               THIS FILE IS PROVIDED BY BALTIMORE TECHNOLOGIES ``AS IS'' AND                                                                                                                                                   *
-*               ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE                                   * 
-*               IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE                              *
-*               ARE DISCLAIMED.  IN NO EVENT SHALL BALTIMORE TECHNOLOGIES BE LIABLE                                             *
-*               FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL                              *
-*               DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS                                 *
-*               OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)                                   *
-*               HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT                              *
-*               LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY                               *
-*               OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF                                  *
-*               SUCH DAMAGE.                                                                                                                                                    *
-*
-* 
-*/
-#ifdef WIN32
-#define SW_EXPORT       __declspec ( dllexport )
-#else
-#define SW_EXPORT
-#endif
-
-/*
-*       List of exposed SureWare errors
-*/
-#define SUREWAREHOOK_ERROR_FAILED               -1
-#define SUREWAREHOOK_ERROR_FALLBACK             -2
-#define SUREWAREHOOK_ERROR_UNIT_FAILURE -3
-#define SUREWAREHOOK_ERROR_DATA_SIZE -4
-#define SUREWAREHOOK_ERROR_INVALID_PAD -5
-/*
-* -----------------WARNING-----------------------------------
-* In all the following functions:
-* msg is a string with at least 24 bytes free.
-* A 24 bytes string will be concatenated to the existing content of msg. 
-*/
-/*
-*       SureWare Initialisation function
-*       in param threadsafe, if !=0, thread safe enabled
-*       return SureWareHOOK_ERROR_UNIT_FAILURE if failure, 1 if success
-*/
-typedef int SureWareHook_Init_t(char*const msg,int threadsafe);
-extern SW_EXPORT SureWareHook_Init_t SureWareHook_Init;
-/*
-*       SureWare Finish function
-*/
-typedef void SureWareHook_Finish_t();
-extern SW_EXPORT SureWareHook_Finish_t SureWareHook_Finish;
-/*
-*        PRE_CONDITION:
-*               DO NOT CALL ANY OF THE FOLLOWING FUNCTIONS IN CASE OF INIT FAILURE
-*/
-/*
-*       SureWare RAND Bytes function
-*       In case of failure, the content of buf is unpredictable.
-*       return 1 if success
-*                       SureWareHOOK_ERROR_FALLBACK if function not available in hardware
-*                       SureWareHOOK_ERROR_FAILED if error while processing
-*                       SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure
-*                       SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf
-*
-*       in/out param buf : a num bytes long buffer where random bytes will be put
-*       in param num : the number of bytes into buf
-*/
-typedef int SureWareHook_Rand_Bytes_t(char*const msg,unsigned char *buf, int num);
-extern SW_EXPORT SureWareHook_Rand_Bytes_t SureWareHook_Rand_Bytes;
-
-/*
-*       SureWare RAND Seed function
-*       Adds some seed to the Hardware Random Number Generator
-*       return 1 if success
-*                       SureWareHOOK_ERROR_FALLBACK if function not available in hardware
-*                       SureWareHOOK_ERROR_FAILED if error while processing
-*                       SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure
-*                       SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf
-*
-*       in param buf : the seed to add into the HRNG
-*       in param num : the number of bytes into buf
-*/
-typedef int SureWareHook_Rand_Seed_t(char*const msg,const void *buf, int num);
-extern SW_EXPORT SureWareHook_Rand_Seed_t SureWareHook_Rand_Seed;
-
-/*
-*       SureWare Load Private Key function
-*       return 1 if success
-*                       SureWareHOOK_ERROR_FAILED if error while processing
-*       No hardware is contact for this function.
-*
-*       in param key_id :the name of the private protected key file without the extension
-                                                ".sws"
-*       out param hptr : a pointer to a buffer allocated by SureWare_Hook
-*       out param num: the effective key length in bytes
-*       out param keytype: 1 if RSA 2 if DSA
-*/
-typedef int SureWareHook_Load_Privkey_t(char*const msg,const char *key_id,char **hptr,unsigned long *num,char *keytype);
-extern SW_EXPORT SureWareHook_Load_Privkey_t SureWareHook_Load_Privkey;
-
-/*
-*       SureWare Info Public Key function
-*       return 1 if success
-*                       SureWareHOOK_ERROR_FAILED if error while processing
-*       No hardware is contact for this function.
-*
-*       in param key_id :the name of the private protected key file without the extension
-                                                ".swp"
-*       out param hptr : a pointer to a buffer allocated by SureWare_Hook
-*       out param num: the effective key length in bytes
-*       out param keytype: 1 if RSA 2 if DSA
-*/
-typedef int SureWareHook_Info_Pubkey_t(char*const msg,const char *key_id,unsigned long *num,
-                                                                                char *keytype);
-extern SW_EXPORT SureWareHook_Info_Pubkey_t SureWareHook_Info_Pubkey;
-
-/*
-*       SureWare Load Public Key function
-*       return 1 if success
-*                       SureWareHOOK_ERROR_FAILED if error while processing
-*       No hardware is contact for this function.
-*
-*       in param key_id :the name of the public protected key file without the extension
-                                                ".swp"
-*       in param num : the bytes size of n and e
-*       out param n: where to write modulus in bn format
-*       out param e: where to write exponent in bn format
-*/
-typedef int SureWareHook_Load_Rsa_Pubkey_t(char*const msg,const char *key_id,unsigned long num,
-                                                                                unsigned long *n, unsigned long *e);
-extern SW_EXPORT SureWareHook_Load_Rsa_Pubkey_t SureWareHook_Load_Rsa_Pubkey;
-
-/*
-*       SureWare Load DSA Public Key function
-*       return 1 if success
-*                       SureWareHOOK_ERROR_FAILED if error while processing
-*       No hardware is contact for this function.
-*
-*       in param key_id :the name of the public protected key file without the extension
-                                                ".swp"
-*       in param num : the bytes size of n and e
-*       out param pub: where to write pub key in bn format
-*       out param p: where to write prime in bn format
-*       out param q: where to write sunprime (length 20 bytes) in bn format
-*       out param g: where to write base in bn format
-*/
-typedef int SureWareHook_Load_Dsa_Pubkey_t(char*const msg,const char *key_id,unsigned long num,
-                                                                                unsigned long *pub, unsigned long *p,unsigned long*q,
-                                                                                unsigned long *g);
-extern SW_EXPORT SureWareHook_Load_Dsa_Pubkey_t SureWareHook_Load_Dsa_Pubkey;
-
-/*
-*       SureWare Free function
-*       Destroy the key into the hardware if destroy==1
-*/
-typedef void SureWareHook_Free_t(char *p,int destroy);
-extern SW_EXPORT SureWareHook_Free_t SureWareHook_Free;
-
-#define SUREWARE_PKCS1_PAD 1
-#define SUREWARE_ISO9796_PAD 2
-#define SUREWARE_NO_PAD 0
-/*
-* SureWare RSA Private Decryption
-* return 1 if success
-*                       SureWareHOOK_ERROR_FAILED if error while processing
-*                       SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure
-*                       SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf
-*
-*       in param flen : byte size of from and to
-*       in param from : encrypted data buffer, should be a not-null valid pointer
-*       out param tlen: byte size of decrypted data, if error, unexpected value
-*       out param to : decrypted data buffer, should be a not-null valid pointer
-*   in param prsa: a protected key pointer, should be a not-null valid pointer
-*   int padding: padding id as follow
-*                                       SUREWARE_PKCS1_PAD
-*                                       SUREWARE_NO_PAD
-*
-*/
-typedef int SureWareHook_Rsa_Priv_Dec_t(char*const msg,int flen,unsigned char *from,
-                                                                                int *tlen,unsigned char *to,
-                                                                                char *prsa,int padding);
-extern SW_EXPORT SureWareHook_Rsa_Priv_Dec_t SureWareHook_Rsa_Priv_Dec;
-/*
-* SureWare RSA Signature
-* return 1 if success
-*                       SureWareHOOK_ERROR_FAILED if error while processing
-*                       SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure
-*                       SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf
-*
-*       in param flen : byte size of from and to
-*       in param from : encrypted data buffer, should be a not-null valid pointer
-*       out param tlen: byte size of decrypted data, if error, unexpected value
-*       out param to : decrypted data buffer, should be a not-null valid pointer
-*   in param prsa: a protected key pointer, should be a not-null valid pointer
-*   int padding: padding id as follow
-*                                       SUREWARE_PKCS1_PAD
-*                                       SUREWARE_ISO9796_PAD
-*
-*/
-typedef int SureWareHook_Rsa_Sign_t(char*const msg,int flen,unsigned char *from,
-                                                                                int *tlen,unsigned char *to,
-                                                                                char *prsa,int padding);
-extern SW_EXPORT SureWareHook_Rsa_Sign_t SureWareHook_Rsa_Sign;
-/*
-* SureWare DSA Signature
-* return 1 if success
-*                       SureWareHOOK_ERROR_FAILED if error while processing
-*                       SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure
-*                       SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf
-*
-*       in param flen : byte size of from and to
-*       in param from : encrypted data buffer, should be a not-null valid pointer
-*       out param to : decrypted data buffer, should be a 40bytes valid pointer
-*   in param pdsa: a protected key pointer, should be a not-null valid pointer
-*
-*/
-typedef int SureWareHook_Dsa_Sign_t(char*const msg,int flen,const unsigned char *from,
-                                                                                unsigned long *r,unsigned long *s,char *pdsa);
-extern SW_EXPORT SureWareHook_Dsa_Sign_t SureWareHook_Dsa_Sign;
-
-
-/*
-* SureWare Mod Exp
-* return 1 if success
-*                       SureWareHOOK_ERROR_FAILED if error while processing
-*                       SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure
-*                       SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf
-*
-*       mod and res are mlen bytes long.
-*       exp is elen bytes long
-*       data is dlen bytes long
-*       mlen,elen and dlen are all multiple of sizeof(unsigned long)
-*/
-typedef int SureWareHook_Mod_Exp_t(char*const msg,int mlen,const unsigned long *mod,
-                                                                        int elen,const unsigned long *exponent,
-                                                                        int dlen,unsigned long *data,
-                                                                        unsigned long *res);
-extern SW_EXPORT SureWareHook_Mod_Exp_t SureWareHook_Mod_Exp;
-