6 files changed, 300 insertions, 189 deletions

diff --git a/src/lib/libcrypto/rsa/rsa.h b/src/lib/libcrypto/rsa/rsa.h
index fc3bb5f86d..0b639cd37f 100644
--- a/src/lib/libcrypto/rsa/rsa.h
+++ b/src/lib/libcrypto/rsa/rsa.h
@@ -157,33 +157,41 @@ struct rsa_st
 #define RSA_3   0x3L
 #define RSA_F4  0x10001L
 
-#define RSA_METHOD_FLAG_NO_CHECK        0x01 /* don't check pub/private match */
+#define RSA_METHOD_FLAG_NO_CHECK        0x0001 /* don't check pub/private match */
 
-#define RSA_FLAG_CACHE_PUBLIC           0x02
-#define RSA_FLAG_CACHE_PRIVATE          0x04
-#define RSA_FLAG_BLINDING               0x08
-#define RSA_FLAG_THREAD_SAFE            0x10
+#define RSA_FLAG_CACHE_PUBLIC           0x0002
+#define RSA_FLAG_CACHE_PRIVATE          0x0004
+#define RSA_FLAG_BLINDING               0x0008
+#define RSA_FLAG_THREAD_SAFE            0x0010
 /* This flag means the private key operations will be handled by rsa_mod_exp
  * and that they do not depend on the private key components being present:
  * for example a key stored in external hardware. Without this flag bn_mod_exp
  * gets called when private key components are absent.
  */
-#define RSA_FLAG_EXT_PKEY               0x20
+#define RSA_FLAG_EXT_PKEY               0x0020
 
 /* This flag in the RSA_METHOD enables the new rsa_sign, rsa_verify functions.
  */
-#define RSA_FLAG_SIGN_VER               0x40
-
-#define RSA_FLAG_NO_BLINDING            0x80 /* new with 0.9.6j and 0.9.7b; the built-in
-                                              * RSA implementation now uses blinding by
-                                              * default (ignoring RSA_FLAG_BLINDING),
-                                              * but other engines might not need it
-                                              */
+#define RSA_FLAG_SIGN_VER               0x0040
+
+#define RSA_FLAG_NO_BLINDING            0x0080 /* new with 0.9.6j and 0.9.7b; the built-in
+                                                * RSA implementation now uses blinding by
+                                                * default (ignoring RSA_FLAG_BLINDING),
+                                                * but other engines might not need it
+                                                */
+#define RSA_FLAG_NO_EXP_CONSTTIME       0x0100 /* new with 0.9.7h; the built-in RSA
+                                                * implementation now uses constant time
+                                                * modular exponentiation for secret exponents
+                                                * by default. This flag causes the
+                                                * faster variable sliding window method to
+                                                * be used for all exponents.
+                                                */
 
 #define RSA_PKCS1_PADDING       1
 #define RSA_SSLV23_PADDING      2
 #define RSA_NO_PADDING          3
 #define RSA_PKCS1_OAEP_PADDING  4
+#define RSA_X931_PADDING        5
 
 #define RSA_PKCS1_PADDING_SIZE  11
 
@@ -196,6 +204,15 @@ int	RSA_size(const RSA *);
 RSA *   RSA_generate_key(int bits, unsigned long e,void
                 (*callback)(int,int,void *),void *cb_arg);
 int     RSA_check_key(const RSA *);
+#ifdef OPENSSL_FIPS
+int RSA_X931_derive(RSA *rsa, BIGNUM *p1, BIGNUM *p2, BIGNUM *q1, BIGNUM *q2,
+                        void (*cb)(int, int, void *), void *cb_arg,
+                        const BIGNUM *Xp1, const BIGNUM *Xp2, const BIGNUM *Xp,
+                        const BIGNUM *Xq1, const BIGNUM *Xq2, const BIGNUM *Xq,
+                        const BIGNUM *e);
+RSA *RSA_X931_generate_key(int bits, const BIGNUM *e,
+             void (*cb)(int,int,void *), void *cb_arg);
+#endif
         /* next 4 return -1 on error */
 int     RSA_public_encrypt(int flen, const unsigned char *from,
                 unsigned char *to, RSA *rsa,int padding);
@@ -268,6 +285,8 @@ int RSA_padding_add_PKCS1_type_2(unsigned char *to,int tlen,
         const unsigned char *f,int fl);
 int RSA_padding_check_PKCS1_type_2(unsigned char *to,int tlen,
         const unsigned char *f,int fl,int rsa_len);
+int PKCS1_MGF1(unsigned char *mask, long len,
+        const unsigned char *seed, long seedlen, const EVP_MD *dgst);
 int RSA_padding_add_PKCS1_OAEP(unsigned char *to,int tlen,
         const unsigned char *f,int fl,
         const unsigned char *p,int pl);
@@ -282,6 +301,17 @@ int RSA_padding_add_none(unsigned char *to,int tlen,
         const unsigned char *f,int fl);
 int RSA_padding_check_none(unsigned char *to,int tlen,
         const unsigned char *f,int fl,int rsa_len);
+int RSA_padding_add_X931(unsigned char *to,int tlen,
+        const unsigned char *f,int fl);
+int RSA_padding_check_X931(unsigned char *to,int tlen,
+        const unsigned char *f,int fl,int rsa_len);
+int RSA_X931_hash_id(int nid);
+
+int RSA_verify_PKCS1_PSS(RSA *rsa, const unsigned char *mHash,
+                        const EVP_MD *Hash, const unsigned char *EM, int sLen);
+int RSA_padding_add_PKCS1_PSS(RSA *rsa, unsigned char *EM,
+                        const unsigned char *mHash,
+                        const EVP_MD *Hash, int sLen);
 
 int RSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
         CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
@@ -311,20 +341,24 @@ void ERR_load_RSA_strings(void);
 #define RSA_F_RSA_NULL                                   124
 #define RSA_F_RSA_PADDING_ADD_NONE                       107
 #define RSA_F_RSA_PADDING_ADD_PKCS1_OAEP                 121
+#define RSA_F_RSA_PADDING_ADD_PKCS1_PSS                  125
 #define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1               108
 #define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2               109
 #define RSA_F_RSA_PADDING_ADD_SSLV23                     110
+#define RSA_F_RSA_PADDING_ADD_X931                       127
 #define RSA_F_RSA_PADDING_CHECK_NONE                     111
 #define RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP               122
 #define RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1             112
 #define RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2             113
 #define RSA_F_RSA_PADDING_CHECK_SSLV23                   114
+#define RSA_F_RSA_PADDING_CHECK_X931                     128
 #define RSA_F_RSA_PRINT                                  115
 #define RSA_F_RSA_PRINT_FP                               116
 #define RSA_F_RSA_SIGN                                   117
 #define RSA_F_RSA_SIGN_ASN1_OCTET_STRING                 118
 #define RSA_F_RSA_VERIFY                                 119
 #define RSA_F_RSA_VERIFY_ASN1_OCTET_STRING               120
+#define RSA_F_RSA_VERIFY_PKCS1_PSS                       126
 
 /* Reason codes. */
 #define RSA_R_ALGORITHM_MISMATCH                         100
@@ -344,9 +378,14 @@ void ERR_load_RSA_strings(void);
 #define RSA_R_DMP1_NOT_CONGRUENT_TO_D                    124
 #define RSA_R_DMQ1_NOT_CONGRUENT_TO_D                    125
 #define RSA_R_D_E_NOT_CONGRUENT_TO_1                     123
+#define RSA_R_FIRST_OCTET_INVALID                        133
+#define RSA_R_INVALID_HEADER                             137
 #define RSA_R_INVALID_MESSAGE_LENGTH                     131
+#define RSA_R_INVALID_PADDING                            138
+#define RSA_R_INVALID_TRAILER                            139
 #define RSA_R_IQMP_NOT_INVERSE_OF_Q                      126
 #define RSA_R_KEY_SIZE_TOO_SMALL                         120
+#define RSA_R_LAST_OCTET_INVALID                         134
 #define RSA_R_NULL_BEFORE_BLOCK_MISSING                  113
 #define RSA_R_N_DOES_NOT_EQUAL_P_Q                       127
 #define RSA_R_OAEP_DECODING_ERROR                        121
@@ -354,6 +393,8 @@ void ERR_load_RSA_strings(void);
 #define RSA_R_P_NOT_PRIME                                128
 #define RSA_R_Q_NOT_PRIME                                129
 #define RSA_R_RSA_OPERATIONS_NOT_SUPPORTED               130
+#define RSA_R_SLEN_CHECK_FAILED                          136
+#define RSA_R_SLEN_RECOVERY_FAILED                       135
 #define RSA_R_SSLV3_ROLLBACK_ATTACK                      115
 #define RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 116
 #define RSA_R_UNKNOWN_ALGORITHM_TYPE                     117
diff --git a/src/lib/libcrypto/rsa/rsa_eay.c b/src/lib/libcrypto/rsa/rsa_eay.c
index d4caab3f95..be4ac96ce3 100644
--- a/src/lib/libcrypto/rsa/rsa_eay.c
+++ b/src/lib/libcrypto/rsa/rsa_eay.c
@@ -55,6 +55,59 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 
 #include <stdio.h>
 #include "cryptlib.h"
@@ -145,30 +198,13 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
                 goto err;
                 }
 
-        if ((rsa->_method_mod_n == NULL) && (rsa->flags & RSA_FLAG_CACHE_PUBLIC))
+        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
                 {
-                BN_MONT_CTX* bn_mont_ctx;
-                if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
-                        goto err;
-                if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->n,ctx))
-                        {
-                        BN_MONT_CTX_free(bn_mont_ctx);
+                if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n,
+                                        CRYPTO_LOCK_RSA, rsa->n, ctx))
                         goto err;
-                        }
-                if (rsa->_method_mod_n == NULL) /* other thread may have finished first */
-                        {
-                        CRYPTO_w_lock(CRYPTO_LOCK_RSA);
-                        if (rsa->_method_mod_n == NULL)
-                                {
-                                rsa->_method_mod_n = bn_mont_ctx;
-                                bn_mont_ctx = NULL;
-                                }
-                        CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
-                        }
-                if (bn_mont_ctx)
-                        BN_MONT_CTX_free(bn_mont_ctx);
                 }
-                
+
         if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx,
                 rsa->_method_mod_n)) goto err;
 
@@ -249,7 +285,7 @@ err:
 static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        BIGNUM f,ret;
+        BIGNUM f,ret, *res;
         int i,j,k,num=0,r= -1;
         unsigned char *buf=NULL;
         BN_CTX *ctx=NULL;
@@ -331,19 +367,43 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                 (rsa->dmp1 != NULL) &&
                 (rsa->dmq1 != NULL) &&
                 (rsa->iqmp != NULL)) )
-                { if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err; }
+                { 
+                if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err;
+                }
         else
                 {
-                if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx,NULL)) goto err;
+                BIGNUM local_d;
+                BIGNUM *d = NULL;
+                
+                if (!(rsa->flags & RSA_FLAG_NO_EXP_CONSTTIME))
+                        {
+                        BN_init(&local_d);
+                        d = &local_d;
+                        BN_with_flags(d, rsa->d, BN_FLG_EXP_CONSTTIME);
+                        }
+                else
+                        d = rsa->d;
+                if (!rsa->meth->bn_mod_exp(&ret,&f,d,rsa->n,ctx,NULL)) goto err;
                 }
 
         if (blinding)
                 if (!BN_BLINDING_invert(&ret, blinding, ctx)) goto err;
 
+        if (padding == RSA_X931_PADDING)
+                {
+                BN_sub(&f, rsa->n, &ret);
+                if (BN_cmp(&ret, &f))
+                        res = &f;
+                else
+                        res = &ret;
+                }
+        else
+                res = &ret;
+
         /* put in leading 0 bytes if the number is less than the
          * length of the modulus */
-        j=BN_num_bytes(&ret);
-        i=BN_bn2bin(&ret,&(to[num-j]));
+        j=BN_num_bytes(res);
+        i=BN_bn2bin(res,&(to[num-j]));
         for (k=0; k<(num-i); k++)
                 to[k]=0;
 
@@ -444,10 +504,22 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                 (rsa->dmp1 != NULL) &&
                 (rsa->dmq1 != NULL) &&
                 (rsa->iqmp != NULL)) )
-                { if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err; }
+                {
+                if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err;
+                }
         else
                 {
-                if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx,NULL))
+                BIGNUM local_d;
+                BIGNUM *d = NULL;
+                
+                if (!(rsa->flags & RSA_FLAG_NO_EXP_CONSTTIME))
+                        {
+                        d = &local_d;
+                        BN_with_flags(d, rsa->d, BN_FLG_EXP_CONSTTIME);
+                        }
+                else
+                        d = rsa->d;
+                if (!rsa->meth->bn_mod_exp(&ret,&f,d,rsa->n,ctx,NULL))
                         goto err;
                 }
 
@@ -534,33 +606,20 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
                 }
 
         /* do the decrypt */
-        if ((rsa->_method_mod_n == NULL) && (rsa->flags & RSA_FLAG_CACHE_PUBLIC))
+
+        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
                 {
-                BN_MONT_CTX* bn_mont_ctx;
-                if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
-                        goto err;
-                if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->n,ctx))
-                        {
-                        BN_MONT_CTX_free(bn_mont_ctx);
+                if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n,
+                                        CRYPTO_LOCK_RSA, rsa->n, ctx))
                         goto err;
-                        }
-                if (rsa->_method_mod_n == NULL) /* other thread may have finished first */
-                        {
-                        CRYPTO_w_lock(CRYPTO_LOCK_RSA);
-                        if (rsa->_method_mod_n == NULL)
-                                {
-                                rsa->_method_mod_n = bn_mont_ctx;
-                                bn_mont_ctx = NULL;
-                                }
-                        CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
-                        }
-                if (bn_mont_ctx)
-                        BN_MONT_CTX_free(bn_mont_ctx);
                 }
-                
+
         if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx,
                 rsa->_method_mod_n)) goto err;
 
+        if ((padding == RSA_X931_PADDING) && ((ret.d[0] & 0xf) != 12))
+                BN_sub(&ret, rsa->n, &ret);
+
         p=buf;
         i=BN_bn2bin(&ret,p);
 
@@ -594,6 +653,8 @@ err:
 static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
         {
         BIGNUM r1,m1,vrfy;
+        BIGNUM local_dmp1, local_dmq1;
+        BIGNUM *dmp1, *dmq1;
         int ret=0;
         BN_CTX *ctx;
 
@@ -604,61 +665,34 @@ static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
 
         if (rsa->flags & RSA_FLAG_CACHE_PRIVATE)
                 {
-                if (rsa->_method_mod_p == NULL)
-                        {
-                        BN_MONT_CTX* bn_mont_ctx;
-                        if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
-                                goto err;
-                        if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->p,ctx))
-                                {
-                                BN_MONT_CTX_free(bn_mont_ctx);
-                                goto err;
-                                }
-                        if (rsa->_method_mod_p == NULL) /* other thread may have finished first */
-                                {
-                                CRYPTO_w_lock(CRYPTO_LOCK_RSA);
-                                if (rsa->_method_mod_p == NULL)
-                                        {
-                                        rsa->_method_mod_p = bn_mont_ctx;
-                                        bn_mont_ctx = NULL;
-                                        }
-                                CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
-                                }
-                        if (bn_mont_ctx)
-                                BN_MONT_CTX_free(bn_mont_ctx);
-                        }
-
-                if (rsa->_method_mod_q == NULL)
-                        {
-                        BN_MONT_CTX* bn_mont_ctx;
-                        if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
-                                goto err;
-                        if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->q,ctx))
-                                {
-                                BN_MONT_CTX_free(bn_mont_ctx);
-                                goto err;
-                                }
-                        if (rsa->_method_mod_q == NULL) /* other thread may have finished first */
-                                {
-                                CRYPTO_w_lock(CRYPTO_LOCK_RSA);
-                                if (rsa->_method_mod_q == NULL)
-                                        {
-                                        rsa->_method_mod_q = bn_mont_ctx;
-                                        bn_mont_ctx = NULL;
-                                        }
-                                CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
-                                }
-                        if (bn_mont_ctx)
-                                BN_MONT_CTX_free(bn_mont_ctx);
-                        }
+                if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_p,
+                                        CRYPTO_LOCK_RSA, rsa->p, ctx))
+                        goto err;
+                if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_q,
+                                        CRYPTO_LOCK_RSA, rsa->q, ctx))
+                        goto err;
                 }
-                
+
         if (!BN_mod(&r1,I,rsa->q,ctx)) goto err;
-        if (!rsa->meth->bn_mod_exp(&m1,&r1,rsa->dmq1,rsa->q,ctx,
+        if (!(rsa->flags & RSA_FLAG_NO_EXP_CONSTTIME))
+                {
+                dmq1 = &local_dmq1;
+                BN_with_flags(dmq1, rsa->dmq1, BN_FLG_EXP_CONSTTIME);
+                }
+        else
+                dmq1 = rsa->dmq1;
+        if (!rsa->meth->bn_mod_exp(&m1,&r1,dmq1,rsa->q,ctx,
                 rsa->_method_mod_q)) goto err;
 
         if (!BN_mod(&r1,I,rsa->p,ctx)) goto err;
-        if (!rsa->meth->bn_mod_exp(r0,&r1,rsa->dmp1,rsa->p,ctx,
+        if (!(rsa->flags & RSA_FLAG_NO_EXP_CONSTTIME))
+                {
+                dmp1 = &local_dmp1;
+                BN_with_flags(dmp1, rsa->dmp1, BN_FLG_EXP_CONSTTIME);
+                }
+        else
+                dmp1 = rsa->dmp1;
+        if (!rsa->meth->bn_mod_exp(r0,&r1,dmp1,rsa->p,ctx,
                 rsa->_method_mod_p)) goto err;
 
         if (!BN_sub(r0,r0,&m1)) goto err;
@@ -693,10 +727,23 @@ static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
                 if (vrfy.neg)
                         if (!BN_add(&vrfy, &vrfy, rsa->n)) goto err;
                 if (!BN_is_zero(&vrfy))
+                        {
                         /* 'I' and 'vrfy' aren't congruent mod n. Don't leak
                          * miscalculated CRT output, just do a raw (slower)
                          * mod_exp and return that instead. */
-                        if (!rsa->meth->bn_mod_exp(r0,I,rsa->d,rsa->n,ctx,NULL)) goto err;
+
+                        BIGNUM local_d;
+                        BIGNUM *d = NULL;
+                
+                        if (!(rsa->flags & RSA_FLAG_NO_EXP_CONSTTIME))
+                                {
+                                d = &local_d;
+                                BN_with_flags(d, rsa->d, BN_FLG_EXP_CONSTTIME);
+                                }
+                        else
+                                d = rsa->d;
+                        if (!rsa->meth->bn_mod_exp(r0,I,d,rsa->n,ctx,NULL)) goto err;
+                        }
                 }
         ret=1;
 err:
diff --git a/src/lib/libcrypto/rsa/rsa_err.c b/src/lib/libcrypto/rsa/rsa_err.c
index a7766c3b76..2ec4b30ff7 100644
--- a/src/lib/libcrypto/rsa/rsa_err.c
+++ b/src/lib/libcrypto/rsa/rsa_err.c
@@ -1,6 +1,6 @@
 /* crypto/rsa/rsa_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -64,70 +64,85 @@
 
 /* BEGIN ERROR CODES */
 #ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(ERR_LIB_RSA,func,0)
+#define ERR_REASON(reason) ERR_PACK(ERR_LIB_RSA,0,reason)
+
 static ERR_STRING_DATA RSA_str_functs[]=
         {
-{ERR_PACK(0,RSA_F_MEMORY_LOCK,0),       "MEMORY_LOCK"},
-{ERR_PACK(0,RSA_F_RSA_CHECK_KEY,0),     "RSA_check_key"},
-{ERR_PACK(0,RSA_F_RSA_EAY_PRIVATE_DECRYPT,0),   "RSA_EAY_PRIVATE_DECRYPT"},
-{ERR_PACK(0,RSA_F_RSA_EAY_PRIVATE_ENCRYPT,0),   "RSA_EAY_PRIVATE_ENCRYPT"},
-{ERR_PACK(0,RSA_F_RSA_EAY_PUBLIC_DECRYPT,0),    "RSA_EAY_PUBLIC_DECRYPT"},
-{ERR_PACK(0,RSA_F_RSA_EAY_PUBLIC_ENCRYPT,0),    "RSA_EAY_PUBLIC_ENCRYPT"},
-{ERR_PACK(0,RSA_F_RSA_GENERATE_KEY,0),  "RSA_generate_key"},
-{ERR_PACK(0,RSA_F_RSA_NEW_METHOD,0),    "RSA_new_method"},
-{ERR_PACK(0,RSA_F_RSA_NULL,0),  "RSA_NULL"},
-{ERR_PACK(0,RSA_F_RSA_PADDING_ADD_NONE,0),      "RSA_padding_add_none"},
-{ERR_PACK(0,RSA_F_RSA_PADDING_ADD_PKCS1_OAEP,0),        "RSA_padding_add_PKCS1_OAEP"},
-{ERR_PACK(0,RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1,0),      "RSA_padding_add_PKCS1_type_1"},
-{ERR_PACK(0,RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2,0),      "RSA_padding_add_PKCS1_type_2"},
-{ERR_PACK(0,RSA_F_RSA_PADDING_ADD_SSLV23,0),    "RSA_padding_add_SSLv23"},
-{ERR_PACK(0,RSA_F_RSA_PADDING_CHECK_NONE,0),    "RSA_padding_check_none"},
-{ERR_PACK(0,RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP,0),      "RSA_padding_check_PKCS1_OAEP"},
-{ERR_PACK(0,RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,0),    "RSA_padding_check_PKCS1_type_1"},
-{ERR_PACK(0,RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,0),    "RSA_padding_check_PKCS1_type_2"},
-{ERR_PACK(0,RSA_F_RSA_PADDING_CHECK_SSLV23,0),  "RSA_padding_check_SSLv23"},
-{ERR_PACK(0,RSA_F_RSA_PRINT,0), "RSA_print"},
-{ERR_PACK(0,RSA_F_RSA_PRINT_FP,0),      "RSA_print_fp"},
-{ERR_PACK(0,RSA_F_RSA_SIGN,0),  "RSA_sign"},
-{ERR_PACK(0,RSA_F_RSA_SIGN_ASN1_OCTET_STRING,0),        "RSA_sign_ASN1_OCTET_STRING"},
-{ERR_PACK(0,RSA_F_RSA_VERIFY,0),        "RSA_verify"},
-{ERR_PACK(0,RSA_F_RSA_VERIFY_ASN1_OCTET_STRING,0),      "RSA_verify_ASN1_OCTET_STRING"},
+{ERR_FUNC(RSA_F_MEMORY_LOCK),   "MEMORY_LOCK"},
+{ERR_FUNC(RSA_F_RSA_CHECK_KEY), "RSA_check_key"},
+{ERR_FUNC(RSA_F_RSA_EAY_PRIVATE_DECRYPT),       "RSA_EAY_PRIVATE_DECRYPT"},
+{ERR_FUNC(RSA_F_RSA_EAY_PRIVATE_ENCRYPT),       "RSA_EAY_PRIVATE_ENCRYPT"},
+{ERR_FUNC(RSA_F_RSA_EAY_PUBLIC_DECRYPT),        "RSA_EAY_PUBLIC_DECRYPT"},
+{ERR_FUNC(RSA_F_RSA_EAY_PUBLIC_ENCRYPT),        "RSA_EAY_PUBLIC_ENCRYPT"},
+{ERR_FUNC(RSA_F_RSA_GENERATE_KEY),      "RSA_generate_key"},
+{ERR_FUNC(RSA_F_RSA_NEW_METHOD),        "RSA_new_method"},
+{ERR_FUNC(RSA_F_RSA_NULL),      "RSA_NULL"},
+{ERR_FUNC(RSA_F_RSA_PADDING_ADD_NONE),  "RSA_padding_add_none"},
+{ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP),    "RSA_padding_add_PKCS1_OAEP"},
+{ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_PSS),     "RSA_padding_add_PKCS1_PSS"},
+{ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1),  "RSA_padding_add_PKCS1_type_1"},
+{ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2),  "RSA_padding_add_PKCS1_type_2"},
+{ERR_FUNC(RSA_F_RSA_PADDING_ADD_SSLV23),        "RSA_padding_add_SSLv23"},
+{ERR_FUNC(RSA_F_RSA_PADDING_ADD_X931),  "RSA_padding_add_X931"},
+{ERR_FUNC(RSA_F_RSA_PADDING_CHECK_NONE),        "RSA_padding_check_none"},
+{ERR_FUNC(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP),  "RSA_padding_check_PKCS1_OAEP"},
+{ERR_FUNC(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1),        "RSA_padding_check_PKCS1_type_1"},
+{ERR_FUNC(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2),        "RSA_padding_check_PKCS1_type_2"},
+{ERR_FUNC(RSA_F_RSA_PADDING_CHECK_SSLV23),      "RSA_padding_check_SSLv23"},
+{ERR_FUNC(RSA_F_RSA_PADDING_CHECK_X931),        "RSA_padding_check_X931"},
+{ERR_FUNC(RSA_F_RSA_PRINT),     "RSA_print"},
+{ERR_FUNC(RSA_F_RSA_PRINT_FP),  "RSA_print_fp"},
+{ERR_FUNC(RSA_F_RSA_SIGN),      "RSA_sign"},
+{ERR_FUNC(RSA_F_RSA_SIGN_ASN1_OCTET_STRING),    "RSA_sign_ASN1_OCTET_STRING"},
+{ERR_FUNC(RSA_F_RSA_VERIFY),    "RSA_verify"},
+{ERR_FUNC(RSA_F_RSA_VERIFY_ASN1_OCTET_STRING),  "RSA_verify_ASN1_OCTET_STRING"},
+{ERR_FUNC(RSA_F_RSA_VERIFY_PKCS1_PSS),  "RSA_verify_PKCS1_PSS"},
 {0,NULL}
         };
 
 static ERR_STRING_DATA RSA_str_reasons[]=
         {
-{RSA_R_ALGORITHM_MISMATCH                ,"algorithm mismatch"},
-{RSA_R_BAD_E_VALUE                       ,"bad e value"},
-{RSA_R_BAD_FIXED_HEADER_DECRYPT          ,"bad fixed header decrypt"},
-{RSA_R_BAD_PAD_BYTE_COUNT                ,"bad pad byte count"},
-{RSA_R_BAD_SIGNATURE                     ,"bad signature"},
-{RSA_R_BLOCK_TYPE_IS_NOT_01              ,"block type is not 01"},
-{RSA_R_BLOCK_TYPE_IS_NOT_02              ,"block type is not 02"},
-{RSA_R_DATA_GREATER_THAN_MOD_LEN         ,"data greater than mod len"},
-{RSA_R_DATA_TOO_LARGE                    ,"data too large"},
-{RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE       ,"data too large for key size"},
-{RSA_R_DATA_TOO_LARGE_FOR_MODULUS        ,"data too large for modulus"},
-{RSA_R_DATA_TOO_SMALL                    ,"data too small"},
-{RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE       ,"data too small for key size"},
-{RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY        ,"digest too big for rsa key"},
-{RSA_R_DMP1_NOT_CONGRUENT_TO_D           ,"dmp1 not congruent to d"},
-{RSA_R_DMQ1_NOT_CONGRUENT_TO_D           ,"dmq1 not congruent to d"},
-{RSA_R_D_E_NOT_CONGRUENT_TO_1            ,"d e not congruent to 1"},
-{RSA_R_INVALID_MESSAGE_LENGTH            ,"invalid message length"},
-{RSA_R_IQMP_NOT_INVERSE_OF_Q             ,"iqmp not inverse of q"},
-{RSA_R_KEY_SIZE_TOO_SMALL                ,"key size too small"},
-{RSA_R_NULL_BEFORE_BLOCK_MISSING         ,"null before block missing"},
-{RSA_R_N_DOES_NOT_EQUAL_P_Q              ,"n does not equal p q"},
-{RSA_R_OAEP_DECODING_ERROR               ,"oaep decoding error"},
-{RSA_R_PADDING_CHECK_FAILED              ,"padding check failed"},
-{RSA_R_P_NOT_PRIME                       ,"p not prime"},
-{RSA_R_Q_NOT_PRIME                       ,"q not prime"},
-{RSA_R_RSA_OPERATIONS_NOT_SUPPORTED      ,"rsa operations not supported"},
-{RSA_R_SSLV3_ROLLBACK_ATTACK             ,"sslv3 rollback attack"},
-{RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD,"the asn1 object identifier is not known for this md"},
-{RSA_R_UNKNOWN_ALGORITHM_TYPE            ,"unknown algorithm type"},
-{RSA_R_UNKNOWN_PADDING_TYPE              ,"unknown padding type"},
-{RSA_R_WRONG_SIGNATURE_LENGTH            ,"wrong signature length"},
+{ERR_REASON(RSA_R_ALGORITHM_MISMATCH)    ,"algorithm mismatch"},
+{ERR_REASON(RSA_R_BAD_E_VALUE)           ,"bad e value"},
+{ERR_REASON(RSA_R_BAD_FIXED_HEADER_DECRYPT),"bad fixed header decrypt"},
+{ERR_REASON(RSA_R_BAD_PAD_BYTE_COUNT)    ,"bad pad byte count"},
+{ERR_REASON(RSA_R_BAD_SIGNATURE)         ,"bad signature"},
+{ERR_REASON(RSA_R_BLOCK_TYPE_IS_NOT_01)  ,"block type is not 01"},
+{ERR_REASON(RSA_R_BLOCK_TYPE_IS_NOT_02)  ,"block type is not 02"},
+{ERR_REASON(RSA_R_DATA_GREATER_THAN_MOD_LEN),"data greater than mod len"},
+{ERR_REASON(RSA_R_DATA_TOO_LARGE)        ,"data too large"},
+{ERR_REASON(RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE),"data too large for key size"},
+{ERR_REASON(RSA_R_DATA_TOO_LARGE_FOR_MODULUS),"data too large for modulus"},
+{ERR_REASON(RSA_R_DATA_TOO_SMALL)        ,"data too small"},
+{ERR_REASON(RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE),"data too small for key size"},
+{ERR_REASON(RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY),"digest too big for rsa key"},
+{ERR_REASON(RSA_R_DMP1_NOT_CONGRUENT_TO_D),"dmp1 not congruent to d"},
+{ERR_REASON(RSA_R_DMQ1_NOT_CONGRUENT_TO_D),"dmq1 not congruent to d"},
+{ERR_REASON(RSA_R_D_E_NOT_CONGRUENT_TO_1),"d e not congruent to 1"},
+{ERR_REASON(RSA_R_FIRST_OCTET_INVALID)   ,"first octet invalid"},
+{ERR_REASON(RSA_R_INVALID_HEADER)        ,"invalid header"},
+{ERR_REASON(RSA_R_INVALID_MESSAGE_LENGTH),"invalid message length"},
+{ERR_REASON(RSA_R_INVALID_PADDING)       ,"invalid padding"},
+{ERR_REASON(RSA_R_INVALID_TRAILER)       ,"invalid trailer"},
+{ERR_REASON(RSA_R_IQMP_NOT_INVERSE_OF_Q) ,"iqmp not inverse of q"},
+{ERR_REASON(RSA_R_KEY_SIZE_TOO_SMALL)    ,"key size too small"},
+{ERR_REASON(RSA_R_LAST_OCTET_INVALID)    ,"last octet invalid"},
+{ERR_REASON(RSA_R_NULL_BEFORE_BLOCK_MISSING),"null before block missing"},
+{ERR_REASON(RSA_R_N_DOES_NOT_EQUAL_P_Q)  ,"n does not equal p q"},
+{ERR_REASON(RSA_R_OAEP_DECODING_ERROR)   ,"oaep decoding error"},
+{ERR_REASON(RSA_R_SLEN_RECOVERY_FAILED)  ,"salt length recovery failed"},
+{ERR_REASON(RSA_R_PADDING_CHECK_FAILED)  ,"padding check failed"},
+{ERR_REASON(RSA_R_P_NOT_PRIME)           ,"p not prime"},
+{ERR_REASON(RSA_R_Q_NOT_PRIME)           ,"q not prime"},
+{ERR_REASON(RSA_R_RSA_OPERATIONS_NOT_SUPPORTED),"rsa operations not supported"},
+{ERR_REASON(RSA_R_SSLV3_ROLLBACK_ATTACK) ,"sslv3 rollback attack"},
+{ERR_REASON(RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD),"the asn1 object identifier is not known for this md"},
+{ERR_REASON(RSA_R_UNKNOWN_ALGORITHM_TYPE),"unknown algorithm type"},
+{ERR_REASON(RSA_R_UNKNOWN_PADDING_TYPE)  ,"unknown padding type"},
+{ERR_REASON(RSA_R_WRONG_SIGNATURE_LENGTH),"wrong signature length"},
+{ERR_REASON(RSA_R_SLEN_CHECK_FAILED)     ,"salt length check failed"},
 {0,NULL}
         };
 
@@ -141,8 +156,8 @@ void ERR_load_RSA_strings(void)
                 {
                 init=0;
 #ifndef OPENSSL_NO_ERR
-                ERR_load_strings(ERR_LIB_RSA,RSA_str_functs);
-                ERR_load_strings(ERR_LIB_RSA,RSA_str_reasons);
+                ERR_load_strings(0,RSA_str_functs);
+                ERR_load_strings(0,RSA_str_reasons);
 #endif
 
                 }
diff --git a/src/lib/libcrypto/rsa/rsa_gen.c b/src/lib/libcrypto/rsa/rsa_gen.c
index adb5e34da5..dd1422cc98 100644
--- a/src/lib/libcrypto/rsa/rsa_gen.c
+++ b/src/lib/libcrypto/rsa/rsa_gen.c
@@ -184,7 +184,8 @@ err:
                 RSAerr(RSA_F_RSA_GENERATE_KEY,ERR_LIB_BN);
                 ok=0;
                 }
-        BN_CTX_end(ctx);
+        if (ctx != NULL)
+                BN_CTX_end(ctx);
         BN_CTX_free(ctx);
         BN_CTX_free(ctx2);
         
diff --git a/src/lib/libcrypto/rsa/rsa_oaep.c b/src/lib/libcrypto/rsa/rsa_oaep.c
index e3f7c608ec..d43ecaca63 100644
--- a/src/lib/libcrypto/rsa/rsa_oaep.c
+++ b/src/lib/libcrypto/rsa/rsa_oaep.c
@@ -28,9 +28,6 @@
 #include <openssl/rand.h>
 #include <openssl/sha.h>
 
-int MGF1(unsigned char *mask, long len,
-        const unsigned char *seed, long seedlen);
-
 int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
         const unsigned char *from, int flen,
         const unsigned char *param, int plen)
@@ -76,11 +73,13 @@ int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
            20);
 #endif
 
-        MGF1(dbmask, emlen - SHA_DIGEST_LENGTH, seed, SHA_DIGEST_LENGTH);
+        PKCS1_MGF1(dbmask, emlen - SHA_DIGEST_LENGTH, seed, SHA_DIGEST_LENGTH,
+                                                                EVP_sha1());
         for (i = 0; i < emlen - SHA_DIGEST_LENGTH; i++)
                 db[i] ^= dbmask[i];
 
-        MGF1(seedmask, SHA_DIGEST_LENGTH, db, emlen - SHA_DIGEST_LENGTH);
+        PKCS1_MGF1(seedmask, SHA_DIGEST_LENGTH, db, emlen - SHA_DIGEST_LENGTH,
+                                                                EVP_sha1());
         for (i = 0; i < SHA_DIGEST_LENGTH; i++)
                 seed[i] ^= seedmask[i];
 
@@ -126,11 +125,11 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
                 return -1;
                 }
 
-        MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen);
+        PKCS1_MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen, EVP_sha1());
         for (i = lzero; i < SHA_DIGEST_LENGTH; i++)
                 seed[i] ^= from[i - lzero];
   
-        MGF1(db, dblen, seed, SHA_DIGEST_LENGTH);
+        PKCS1_MGF1(db, dblen, seed, SHA_DIGEST_LENGTH, EVP_sha1());
         for (i = 0; i < dblen; i++)
                 db[i] ^= maskeddb[i];
 
@@ -170,28 +169,30 @@ decoding_err:
         return -1;
         }
 
-int MGF1(unsigned char *mask, long len,
-        const unsigned char *seed, long seedlen)
+int PKCS1_MGF1(unsigned char *mask, long len,
+        const unsigned char *seed, long seedlen, const EVP_MD *dgst)
         {
         long i, outlen = 0;
         unsigned char cnt[4];
         EVP_MD_CTX c;
-        unsigned char md[SHA_DIGEST_LENGTH];
+        unsigned char md[EVP_MAX_MD_SIZE];
+        int mdlen;
 
         EVP_MD_CTX_init(&c);
+        mdlen = EVP_MD_size(dgst);
         for (i = 0; outlen < len; i++)
                 {
                 cnt[0] = (unsigned char)((i >> 24) & 255);
                 cnt[1] = (unsigned char)((i >> 16) & 255);
                 cnt[2] = (unsigned char)((i >> 8)) & 255;
                 cnt[3] = (unsigned char)(i & 255);
-                EVP_DigestInit_ex(&c,EVP_sha1(), NULL);
+                EVP_DigestInit_ex(&c,dgst, NULL);
                 EVP_DigestUpdate(&c, seed, seedlen);
                 EVP_DigestUpdate(&c, cnt, 4);
-                if (outlen + SHA_DIGEST_LENGTH <= len)
+                if (outlen + mdlen <= len)
                         {
                         EVP_DigestFinal_ex(&c, mask + outlen, NULL);
-                        outlen += SHA_DIGEST_LENGTH;
+                        outlen += mdlen;
                         }
                 else
                         {
@@ -203,4 +204,9 @@ int MGF1(unsigned char *mask, long len,
         EVP_MD_CTX_cleanup(&c);
         return 0;
         }
+
+int MGF1(unsigned char *mask, long len, const unsigned char *seed, long seedlen)
+        {
+        return PKCS1_MGF1(mask, len, seed, seedlen, EVP_sha1());
+        }
 #endif
diff --git a/src/lib/libcrypto/rsa/rsa_test.c b/src/lib/libcrypto/rsa/rsa_test.c
index 924e9ad1f6..218bb2a39b 100644
--- a/src/lib/libcrypto/rsa/rsa_test.c
+++ b/src/lib/libcrypto/rsa/rsa_test.c
@@ -227,10 +227,10 @@ int main(int argc, char *argv[])
 
     plen = sizeof(ptext_ex) - 1;
 
-    for (v = 0; v < 3; v++)
+    for (v = 0; v < 6; v++)
         {
         key = RSA_new();
-        switch (v) {
+        switch (v%3) {
     case 0:
         clen = key1(key, ctext_ex);
         break;
@@ -241,6 +241,7 @@ int main(int argc, char *argv[])
         clen = key3(key, ctext_ex);
         break;
         }
+        if (v/3 > 1) key->flags |= RSA_FLAG_NO_EXP_CONSTTIME;
 
         num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
                                  RSA_PKCS1_PADDING);