195 files changed, 10581 insertions, 2795 deletions

diff --git a/src/lib/libcrypto/Attic/Makefile b/src/lib/libcrypto/Attic/Makefile
index 85d9f249c5..947dd5d44e 100644
--- a/src/lib/libcrypto/Attic/Makefile
+++ b/src/lib/libcrypto/Attic/Makefile
@@ -7,7 +7,7 @@ TOP=		..
 CC=             cc
 INCLUDE=        -I. -I$(TOP) -I../include $(ZLIB_INCLUDE)
 # INCLUDES targets sudbirs!
-INCLUDES=       -I.. -I../.. -I../asn1 -I../evp -I../../include $(ZLIB_INCLUDE)
+INCLUDES=       -I.. -I../.. -I../modes -I../asn1 -I../evp -I../../include $(ZLIB_INCLUDE)
 CFLAG=          -g
 MAKEDEPPROG=    makedepend
 MAKEDEPEND=     $(TOP)/util/domd $(TOP) -MD $(MAKEDEPPROG)
@@ -34,8 +34,10 @@ GENERAL=Makefile README crypto-lib.com install.com
 
 LIB= $(TOP)/libcrypto.a
 SHARED_LIB= libcrypto$(SHLIB_EXT)
-LIBSRC= cryptlib.c mem.c mem_clr.c mem_dbg.c cversion.c ex_data.c cpt_err.c ebcdic.c uid.c o_time.c o_str.c o_dir.c
-LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o cpt_err.o ebcdic.o uid.o o_time.o o_str.o o_dir.o $(CPUID_OBJ)
+LIBSRC= cryptlib.c mem.c mem_clr.c mem_dbg.c cversion.c ex_data.c cpt_err.c \
+        ebcdic.c uid.c o_time.c o_str.c o_dir.c o_fips.c o_init.c fips_ers.c
+LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o cpt_err.o ebcdic.o \
+        uid.o o_time.o o_str.o o_dir.o o_fips.o o_init.o fips_ers.o $(CPUID_OBJ)
 
 SRC= $(LIBSRC)
 
@@ -67,14 +69,13 @@ applink.o:	$(TOP)/ms/applink.c
 uplink.o:       $(TOP)/ms/uplink.c applink.o
         $(CC) $(CFLAGS) -c -o $@ $(TOP)/ms/uplink.c
 
-uplink-cof.s:   $(TOP)/ms/uplink.pl
-        $(PERL) $(TOP)/ms/uplink.pl coff > $@
+uplink-x86.s:   $(TOP)/ms/uplink-x86.pl
+        $(PERL) $(TOP)/ms/uplink-x86.pl $(PERLASM_SCHEME) > $@
 
-x86_64cpuid.s: x86_64cpuid.pl
-        $(PERL) x86_64cpuid.pl $(PERLASM_SCHEME) > $@
-ia64cpuid.s: ia64cpuid.S
-        $(CC) $(CFLAGS) -E ia64cpuid.S > $@
+x86_64cpuid.s: x86_64cpuid.pl;  $(PERL) x86_64cpuid.pl $(PERLASM_SCHEME) > $@
+ia64cpuid.s: ia64cpuid.S;       $(CC) $(CFLAGS) -E ia64cpuid.S > $@
 ppccpuid.s:     ppccpuid.pl;    $(PERL) ppccpuid.pl $(PERLASM_SCHEME) $@
+pariscid.s:     pariscid.pl;    $(PERL) pariscid.pl $(PERLASM_SCHEME) $@
 alphacpuid.s:   alphacpuid.pl
         $(PERL) $< | $(CC) -E - | tee $@ > /dev/null
 
@@ -102,6 +103,7 @@ lib:	$(LIB)
         @touch lib
 $(LIB): $(LIBOBJ)
         $(AR) $(LIB) $(LIBOBJ)
+        [ -z "$(FIPSLIBDIR)" ] || $(AR) $(LIB) $(FIPSLIBDIR)fipscanister.o
         $(RANLIB) $(LIB) || echo Never mind.
 
 shared: buildinf.h lib subdirs
@@ -171,6 +173,7 @@ ex_data.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
 ex_data.o: ../include/openssl/ossl_typ.h ../include/openssl/safestack.h
 ex_data.o: ../include/openssl/stack.h ../include/openssl/symhacks.h cryptlib.h
 ex_data.o: ex_data.c
+fips_ers.o: ../include/openssl/opensslconf.h fips_ers.c
 mem.o: ../e_os.h ../include/openssl/bio.h ../include/openssl/buffer.h
 mem.o: ../include/openssl/crypto.h ../include/openssl/e_os2.h
 mem.o: ../include/openssl/err.h ../include/openssl/lhash.h
@@ -191,6 +194,19 @@ mem_dbg.o: ../include/openssl/stack.h ../include/openssl/symhacks.h cryptlib.h
 mem_dbg.o: mem_dbg.c
 o_dir.o: ../e_os.h ../include/openssl/e_os2.h ../include/openssl/opensslconf.h
 o_dir.o: LPdir_unix.c o_dir.c o_dir.h
+o_fips.o: ../e_os.h ../include/openssl/bio.h ../include/openssl/buffer.h
+o_fips.o: ../include/openssl/crypto.h ../include/openssl/e_os2.h
+o_fips.o: ../include/openssl/err.h ../include/openssl/lhash.h
+o_fips.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+o_fips.o: ../include/openssl/ossl_typ.h ../include/openssl/safestack.h
+o_fips.o: ../include/openssl/stack.h ../include/openssl/symhacks.h cryptlib.h
+o_fips.o: o_fips.c
+o_init.o: ../e_os.h ../include/openssl/bio.h ../include/openssl/crypto.h
+o_init.o: ../include/openssl/e_os2.h ../include/openssl/err.h
+o_init.o: ../include/openssl/lhash.h ../include/openssl/opensslconf.h
+o_init.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
+o_init.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+o_init.o: ../include/openssl/symhacks.h o_init.c
 o_str.o: ../e_os.h ../include/openssl/e_os2.h ../include/openssl/opensslconf.h
 o_str.o: o_str.c o_str.h
 o_time.o: ../include/openssl/e_os2.h ../include/openssl/opensslconf.h o_time.c
diff --git a/src/lib/libcrypto/aes/aes.h b/src/lib/libcrypto/aes/aes.h
index d2c99730fe..031abf01b5 100644
--- a/src/lib/libcrypto/aes/aes.h
+++ b/src/lib/libcrypto/aes/aes.h
@@ -90,6 +90,11 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
         AES_KEY *key);
 
+int private_AES_set_encrypt_key(const unsigned char *userKey, const int bits,
+        AES_KEY *key);
+int private_AES_set_decrypt_key(const unsigned char *userKey, const int bits,
+        AES_KEY *key);
+
 void AES_encrypt(const unsigned char *in, unsigned char *out,
         const AES_KEY *key);
 void AES_decrypt(const unsigned char *in, unsigned char *out,
diff --git a/src/lib/libcrypto/aes/aes_core.c b/src/lib/libcrypto/aes/aes_core.c
index a7ec54f4da..8f5210ac70 100644
--- a/src/lib/libcrypto/aes/aes_core.c
+++ b/src/lib/libcrypto/aes/aes_core.c
@@ -625,7 +625,7 @@ static const u32 rcon[] = {
 /**
  * Expand the cipher key into the encryption key schedule.
  */
-int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
+int private_AES_set_encrypt_key(const unsigned char *userKey, const int bits,
                         AES_KEY *key) {
 
         u32 *rk;
@@ -726,7 +726,7 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 /**
  * Expand the cipher key into the decryption key schedule.
  */
-int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
+int private_AES_set_decrypt_key(const unsigned char *userKey, const int bits,
                          AES_KEY *key) {
 
         u32 *rk;
@@ -734,7 +734,7 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
         u32 temp;
 
         /* first, start with an encryption schedule */
-        status = AES_set_encrypt_key(userKey, bits, key);
+        status = private_AES_set_encrypt_key(userKey, bits, key);
         if (status < 0)
                 return status;
 
@@ -1201,7 +1201,7 @@ static const u32 rcon[] = {
 /**
  * Expand the cipher key into the encryption key schedule.
  */
-int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
+int private_AES_set_encrypt_key(const unsigned char *userKey, const int bits,
                         AES_KEY *key) {
         u32 *rk;
         int i = 0;
@@ -1301,7 +1301,7 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 /**
  * Expand the cipher key into the decryption key schedule.
  */
-int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
+int private_AES_set_decrypt_key(const unsigned char *userKey, const int bits,
                          AES_KEY *key) {
 
         u32 *rk;
@@ -1309,7 +1309,7 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
         u32 temp;
 
         /* first, start with an encryption schedule */
-        status = AES_set_encrypt_key(userKey, bits, key);
+        status = private_AES_set_encrypt_key(userKey, bits, key);
         if (status < 0)
                 return status;
 
diff --git a/src/lib/libcrypto/aes/aes_misc.c b/src/lib/libcrypto/aes/aes_misc.c
index 4fead1b4c7..f083488ecb 100644
--- a/src/lib/libcrypto/aes/aes_misc.c
+++ b/src/lib/libcrypto/aes/aes_misc.c
@@ -50,6 +50,7 @@
  */
 
 #include <openssl/opensslv.h>
+#include <openssl/crypto.h>
 #include <openssl/aes.h>
 #include "aes_locl.h"
 
@@ -62,3 +63,23 @@ const char *AES_options(void) {
         return "aes(partial)";
 #endif
 }
+
+/* FIPS wrapper functions to block low level AES calls in FIPS mode */
+
+int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
+                        AES_KEY *key)
+        {
+#ifdef OPENSSL_FIPS
+        fips_cipher_abort(AES);
+#endif
+        return private_AES_set_encrypt_key(userKey, bits, key);
+        }
+
+int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
+                        AES_KEY *key)
+        {
+#ifdef OPENSSL_FIPS
+        fips_cipher_abort(AES);
+#endif
+        return private_AES_set_decrypt_key(userKey, bits, key);
+        }
diff --git a/src/lib/libcrypto/aes/asm/aes-586.pl b/src/lib/libcrypto/aes/asm/aes-586.pl
index aab40e6f1c..687ed811be 100644
--- a/src/lib/libcrypto/aes/asm/aes-586.pl
+++ b/src/lib/libcrypto/aes/asm/aes-586.pl
@@ -39,7 +39,7 @@
 # but exhibits up to 10% improvement on other cores.
 #
 # Second version is "monolithic" replacement for aes_core.c, which in
-# addition to AES_[de|en]crypt implements AES_set_[de|en]cryption_key.
+# addition to AES_[de|en]crypt implements private_AES_set_[de|en]cryption_key.
 # This made it possible to implement little-endian variant of the
 # algorithm without modifying the base C code. Motivating factor for
 # the undertaken effort was that it appeared that in tight IA-32
@@ -2854,12 +2854,12 @@ sub enckey()
     &set_label("exit");
 &function_end("_x86_AES_set_encrypt_key");
 
-# int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
+# int private_AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 #                        AES_KEY *key)
-&function_begin_B("AES_set_encrypt_key");
+&function_begin_B("private_AES_set_encrypt_key");
         &call   ("_x86_AES_set_encrypt_key");
         &ret    ();
-&function_end_B("AES_set_encrypt_key");
+&function_end_B("private_AES_set_encrypt_key");
 
 sub deckey()
 { my ($i,$key,$tp1,$tp2,$tp4,$tp8) = @_;
@@ -2916,9 +2916,9 @@ sub deckey()
         &mov    (&DWP(4*$i,$key),$tp1);
 }
 
-# int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
+# int private_AES_set_decrypt_key(const unsigned char *userKey, const int bits,
 #                        AES_KEY *key)
-&function_begin_B("AES_set_decrypt_key");
+&function_begin_B("private_AES_set_decrypt_key");
         &call   ("_x86_AES_set_encrypt_key");
         &cmp    ("eax",0);
         &je     (&label("proceed"));
@@ -2974,7 +2974,7 @@ sub deckey()
         &jb     (&label("permute"));
 
         &xor    ("eax","eax");                  # return success
-&function_end("AES_set_decrypt_key");
+&function_end("private_AES_set_decrypt_key");
 &asciz("AES for x86, CRYPTOGAMS by <appro\@openssl.org>");
 
 &asm_finish();
diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
index 53e4ef85fd..027b4ae2e5 100755
--- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
@@ -588,6 +588,9 @@ $code.=<<___;
 .globl  AES_encrypt
 .type   AES_encrypt,\@function,3
 .align  16
+.globl  asm_AES_encrypt
+.hidden asm_AES_encrypt
+asm_AES_encrypt:
 AES_encrypt:
         push    %rbx
         push    %rbp
@@ -1184,6 +1187,9 @@ $code.=<<___;
 .globl  AES_decrypt
 .type   AES_decrypt,\@function,3
 .align  16
+.globl  asm_AES_decrypt
+.hidden asm_AES_decrypt
+asm_AES_decrypt:
 AES_decrypt:
         push    %rbx
         push    %rbp
@@ -1277,13 +1283,13 @@ $code.=<<___;
 ___
 }
 
-# int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
+# int private_AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 #                        AES_KEY *key)
 $code.=<<___;
-.globl  AES_set_encrypt_key
-.type   AES_set_encrypt_key,\@function,3
+.globl  private_AES_set_encrypt_key
+.type   private_AES_set_encrypt_key,\@function,3
 .align  16
-AES_set_encrypt_key:
+private_AES_set_encrypt_key:
         push    %rbx
         push    %rbp
         push    %r12                    # redundant, but allows to share 
@@ -1304,7 +1310,7 @@ AES_set_encrypt_key:
         add     \$56,%rsp
 .Lenc_key_epilogue:
         ret
-.size   AES_set_encrypt_key,.-AES_set_encrypt_key
+.size   private_AES_set_encrypt_key,.-private_AES_set_encrypt_key
 
 .type   _x86_64_AES_set_encrypt_key,\@abi-omnipotent
 .align  16
@@ -1547,13 +1553,13 @@ $code.=<<___;
 ___
 }
 
-# int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
+# int private_AES_set_decrypt_key(const unsigned char *userKey, const int bits,
 #                        AES_KEY *key)
 $code.=<<___;
-.globl  AES_set_decrypt_key
-.type   AES_set_decrypt_key,\@function,3
+.globl  private_AES_set_decrypt_key
+.type   private_AES_set_decrypt_key,\@function,3
 .align  16
-AES_set_decrypt_key:
+private_AES_set_decrypt_key:
         push    %rbx
         push    %rbp
         push    %r12
@@ -1622,7 +1628,7 @@ $code.=<<___;
         add     \$56,%rsp
 .Ldec_key_epilogue:
         ret
-.size   AES_set_decrypt_key,.-AES_set_decrypt_key
+.size   private_AES_set_decrypt_key,.-private_AES_set_decrypt_key
 ___
 
 # void AES_cbc_encrypt (const void char *inp, unsigned char *out,
@@ -1648,6 +1654,9 @@ $code.=<<___;
 .type   AES_cbc_encrypt,\@function,6
 .align  16
 .extern OPENSSL_ia32cap_P
+.globl  asm_AES_cbc_encrypt
+.hidden asm_AES_cbc_encrypt
+asm_AES_cbc_encrypt:
 AES_cbc_encrypt:
         cmp     \$0,%rdx        # check length
         je      .Lcbc_epilogue
@@ -2766,13 +2775,13 @@ cbc_se_handler:
         .rva    .LSEH_end_AES_decrypt
         .rva    .LSEH_info_AES_decrypt
 
-        .rva    .LSEH_begin_AES_set_encrypt_key
-        .rva    .LSEH_end_AES_set_encrypt_key
-        .rva    .LSEH_info_AES_set_encrypt_key
+        .rva    .LSEH_begin_private_AES_set_encrypt_key
+        .rva    .LSEH_end_private_AES_set_encrypt_key
+        .rva    .LSEH_info_private_AES_set_encrypt_key
 
-        .rva    .LSEH_begin_AES_set_decrypt_key
-        .rva    .LSEH_end_AES_set_decrypt_key
-        .rva    .LSEH_info_AES_set_decrypt_key
+        .rva    .LSEH_begin_private_AES_set_decrypt_key
+        .rva    .LSEH_end_private_AES_set_decrypt_key
+        .rva    .LSEH_info_private_AES_set_decrypt_key
 
         .rva    .LSEH_begin_AES_cbc_encrypt
         .rva    .LSEH_end_AES_cbc_encrypt
@@ -2788,11 +2797,11 @@ cbc_se_handler:
         .byte   9,0,0,0
         .rva    block_se_handler
         .rva    .Ldec_prologue,.Ldec_epilogue   # HandlerData[]
-.LSEH_info_AES_set_encrypt_key:
+.LSEH_info_private_AES_set_encrypt_key:
         .byte   9,0,0,0
         .rva    key_se_handler
         .rva    .Lenc_key_prologue,.Lenc_key_epilogue   # HandlerData[]
-.LSEH_info_AES_set_decrypt_key:
+.LSEH_info_private_AES_set_decrypt_key:
         .byte   9,0,0,0
         .rva    key_se_handler
         .rva    .Ldec_key_prologue,.Ldec_key_epilogue   # HandlerData[]
diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
index 49e0f4b351..499f3b3f42 100644
--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
@@ -11,6 +11,151 @@
 # OpenSSL context it's used with Intel engine, but can also be used as
 # drop-in replacement for crypto/aes/asm/aes-x86_64.pl [see below for
 # details].
+#
+# Performance.
+#
+# Given aes(enc|dec) instructions' latency asymptotic performance for
+# non-parallelizable modes such as CBC encrypt is 3.75 cycles per byte
+# processed with 128-bit key. And given their throughput asymptotic
+# performance for parallelizable modes is 1.25 cycles per byte. Being
+# asymptotic limit it's not something you commonly achieve in reality,
+# but how close does one get? Below are results collected for
+# different modes and block sized. Pairs of numbers are for en-/
+# decryption.
+#
+#       16-byte     64-byte     256-byte    1-KB        8-KB
+# ECB   4.25/4.25   1.38/1.38   1.28/1.28   1.26/1.26   1.26/1.26
+# CTR   5.42/5.42   1.92/1.92   1.44/1.44   1.28/1.28   1.26/1.26
+# CBC   4.38/4.43   4.15/1.43   4.07/1.32   4.07/1.29   4.06/1.28
+# CCM   5.66/9.42   4.42/5.41   4.16/4.40   4.09/4.15   4.06/4.07   
+# OFB   5.42/5.42   4.64/4.64   4.44/4.44   4.39/4.39   4.38/4.38
+# CFB   5.73/5.85   5.56/5.62   5.48/5.56   5.47/5.55   5.47/5.55
+#
+# ECB, CTR, CBC and CCM results are free from EVP overhead. This means
+# that otherwise used 'openssl speed -evp aes-128-??? -engine aesni
+# [-decrypt]' will exhibit 10-15% worse results for smaller blocks.
+# The results were collected with specially crafted speed.c benchmark
+# in order to compare them with results reported in "Intel Advanced
+# Encryption Standard (AES) New Instruction Set" White Paper Revision
+# 3.0 dated May 2010. All above results are consistently better. This
+# module also provides better performance for block sizes smaller than
+# 128 bytes in points *not* represented in the above table.
+#
+# Looking at the results for 8-KB buffer.
+#
+# CFB and OFB results are far from the limit, because implementation
+# uses "generic" CRYPTO_[c|o]fb128_encrypt interfaces relying on
+# single-block aesni_encrypt, which is not the most optimal way to go.
+# CBC encrypt result is unexpectedly high and there is no documented
+# explanation for it. Seemingly there is a small penalty for feeding
+# the result back to AES unit the way it's done in CBC mode. There is
+# nothing one can do and the result appears optimal. CCM result is
+# identical to CBC, because CBC-MAC is essentially CBC encrypt without
+# saving output. CCM CTR "stays invisible," because it's neatly
+# interleaved wih CBC-MAC. This provides ~30% improvement over
+# "straghtforward" CCM implementation with CTR and CBC-MAC performed
+# disjointly. Parallelizable modes practically achieve the theoretical
+# limit.
+#
+# Looking at how results vary with buffer size.
+#
+# Curves are practically saturated at 1-KB buffer size. In most cases
+# "256-byte" performance is >95%, and "64-byte" is ~90% of "8-KB" one.
+# CTR curve doesn't follow this pattern and is "slowest" changing one
+# with "256-byte" result being 87% of "8-KB." This is because overhead
+# in CTR mode is most computationally intensive. Small-block CCM
+# decrypt is slower than encrypt, because first CTR and last CBC-MAC
+# iterations can't be interleaved.
+#
+# Results for 192- and 256-bit keys.
+#
+# EVP-free results were observed to scale perfectly with number of
+# rounds for larger block sizes, i.e. 192-bit result being 10/12 times
+# lower and 256-bit one - 10/14. Well, in CBC encrypt case differences
+# are a tad smaller, because the above mentioned penalty biases all
+# results by same constant value. In similar way function call
+# overhead affects small-block performance, as well as OFB and CFB
+# results. Differences are not large, most common coefficients are
+# 10/11.7 and 10/13.4 (as opposite to 10/12.0 and 10/14.0), but one
+# observe even 10/11.2 and 10/12.4 (CTR, OFB, CFB)...
+
+# January 2011
+#
+# While Westmere processor features 6 cycles latency for aes[enc|dec]
+# instructions, which can be scheduled every second cycle, Sandy
+# Bridge spends 8 cycles per instruction, but it can schedule them
+# every cycle. This means that code targeting Westmere would perform
+# suboptimally on Sandy Bridge. Therefore this update.
+#
+# In addition, non-parallelizable CBC encrypt (as well as CCM) is
+# optimized. Relative improvement might appear modest, 8% on Westmere,
+# but in absolute terms it's 3.77 cycles per byte encrypted with
+# 128-bit key on Westmere, and 5.07 - on Sandy Bridge. These numbers
+# should be compared to asymptotic limits of 3.75 for Westmere and
+# 5.00 for Sandy Bridge. Actually, the fact that they get this close
+# to asymptotic limits is quite amazing. Indeed, the limit is
+# calculated as latency times number of rounds, 10 for 128-bit key,
+# and divided by 16, the number of bytes in block, or in other words
+# it accounts *solely* for aesenc instructions. But there are extra
+# instructions, and numbers so close to the asymptotic limits mean
+# that it's as if it takes as little as *one* additional cycle to
+# execute all of them. How is it possible? It is possible thanks to
+# out-of-order execution logic, which manages to overlap post-
+# processing of previous block, things like saving the output, with
+# actual encryption of current block, as well as pre-processing of
+# current block, things like fetching input and xor-ing it with
+# 0-round element of the key schedule, with actual encryption of
+# previous block. Keep this in mind...
+#
+# For parallelizable modes, such as ECB, CBC decrypt, CTR, higher
+# performance is achieved by interleaving instructions working on
+# independent blocks. In which case asymptotic limit for such modes
+# can be obtained by dividing above mentioned numbers by AES
+# instructions' interleave factor. Westmere can execute at most 3 
+# instructions at a time, meaning that optimal interleave factor is 3,
+# and that's where the "magic" number of 1.25 come from. "Optimal
+# interleave factor" means that increase of interleave factor does
+# not improve performance. The formula has proven to reflect reality
+# pretty well on Westmere... Sandy Bridge on the other hand can
+# execute up to 8 AES instructions at a time, so how does varying
+# interleave factor affect the performance? Here is table for ECB
+# (numbers are cycles per byte processed with 128-bit key):
+#
+# instruction interleave factor         3x      6x      8x
+# theoretical asymptotic limit          1.67    0.83    0.625
+# measured performance for 8KB block    1.05    0.86    0.84
+#
+# "as if" interleave factor             4.7x    5.8x    6.0x
+#
+# Further data for other parallelizable modes:
+#
+# CBC decrypt                           1.16    0.93    0.93
+# CTR                                   1.14    0.91    n/a
+#
+# Well, given 3x column it's probably inappropriate to call the limit
+# asymptotic, if it can be surpassed, isn't it? What happens there?
+# Rewind to CBC paragraph for the answer. Yes, out-of-order execution
+# magic is responsible for this. Processor overlaps not only the
+# additional instructions with AES ones, but even AES instuctions
+# processing adjacent triplets of independent blocks. In the 6x case
+# additional instructions  still claim disproportionally small amount
+# of additional cycles, but in 8x case number of instructions must be
+# a tad too high for out-of-order logic to cope with, and AES unit
+# remains underutilized... As you can see 8x interleave is hardly
+# justifiable, so there no need to feel bad that 32-bit aesni-x86.pl
+# utilizies 6x interleave because of limited register bank capacity.
+#
+# Higher interleave factors do have negative impact on Westmere
+# performance. While for ECB mode it's negligible ~1.5%, other
+# parallelizables perform ~5% worse, which is outweighed by ~25%
+# improvement on Sandy Bridge. To balance regression on Westmere
+# CTR mode was implemented with 6x aesenc interleave factor.
+
+# April 2011
+#
+# Add aesni_xts_[en|de]crypt. Westmere spends 1.33 cycles processing
+# one byte out of 8KB with 128-bit key, Sandy Bridge - 0.97. Just like
+# in CTR mode AES instruction interleave factor was chosen to be 6x.
 
 $PREFIX="aesni";        # if $PREFIX is set to "AES", the script
                         # generates drop-in replacement for
@@ -29,7 +174,7 @@ die "can't locate x86_64-xlate.pl";
 
 open STDOUT,"| $^X $xlate $flavour $output";
 
-$movkey = $PREFIX eq "aesni" ? "movaps" : "movups";
+$movkey = $PREFIX eq "aesni" ? "movups" : "movups";
 @_4args=$win64? ("%rcx","%rdx","%r8", "%r9") :  # Win64 order
                 ("%rdi","%rsi","%rdx","%rcx");  # Unix order
 
@@ -41,18 +186,20 @@ $inp="%rdi";
 $out="%rsi";
 $len="%rdx";
 $key="%rcx";    # input to and changed by aesni_[en|de]cryptN !!!
-$ivp="%r8";     # cbc
+$ivp="%r8";     # cbc, ctr, ...
 
 $rnds_="%r10d"; # backup copy for $rounds
 $key_="%r11";   # backup copy for $key
 
 # %xmm register layout
-$inout0="%xmm0";        $inout1="%xmm1";
-$inout2="%xmm2";        $inout3="%xmm3";
-$rndkey0="%xmm4";       $rndkey1="%xmm5";
-
-$iv="%xmm6";            $in0="%xmm7";   # used in CBC decrypt
-$in1="%xmm8";           $in2="%xmm9";
+$rndkey0="%xmm0";       $rndkey1="%xmm1";
+$inout0="%xmm2";        $inout1="%xmm3";
+$inout2="%xmm4";        $inout3="%xmm5";
+$inout4="%xmm6";        $inout5="%xmm7";
+$inout6="%xmm8";        $inout7="%xmm9";
+
+$in2="%xmm6";           $in1="%xmm7";   # used in CBC decrypt, CTR, ...
+$in0="%xmm8";           $iv="%xmm9";
 
 # Inline version of internal aesni_[en|de]crypt1.
 #
@@ -60,20 +207,29 @@ $in1="%xmm8";		$in2="%xmm9";
 # cycles which take care of loop variables...
 { my $sn;
 sub aesni_generate1 {
-my ($p,$key,$rounds)=@_;
+my ($p,$key,$rounds,$inout,$ivec)=@_;   $inout=$inout0 if (!defined($inout));
 ++$sn;
 $code.=<<___;
         $movkey ($key),$rndkey0
         $movkey 16($key),$rndkey1
+___
+$code.=<<___ if (defined($ivec));
+        xorps   $rndkey0,$ivec
+        lea     32($key),$key
+        xorps   $ivec,$inout
+___
+$code.=<<___ if (!defined($ivec));
         lea     32($key),$key
-        pxor    $rndkey0,$inout0
+        xorps   $rndkey0,$inout
+___
+$code.=<<___;
 .Loop_${p}1_$sn:
-        aes${p} $rndkey1,$inout0
+        aes${p} $rndkey1,$inout
         dec     $rounds
         $movkey ($key),$rndkey1
         lea     16($key),$key
         jnz     .Loop_${p}1_$sn # loop body is 16 bytes
-        aes${p}last     $rndkey1,$inout0
+        aes${p}last     $rndkey1,$inout
 ___
 }}
 # void $PREFIX_[en|de]crypt (const void *inp,void *out,const AES_KEY *key);
@@ -86,7 +242,7 @@ $code.=<<___;
 .align  16
 ${PREFIX}_encrypt:
         movups  ($inp),$inout0          # load input
-        mov     240($key),$rounds       # pull $rounds
+        mov     240($key),$rounds       # key->rounds
 ___
         &aesni_generate1("enc",$key,$rounds);
 $code.=<<___;
@@ -99,7 +255,7 @@ $code.=<<___;
 .align  16
 ${PREFIX}_decrypt:
         movups  ($inp),$inout0          # load input
-        mov     240($key),$rounds       # pull $rounds
+        mov     240($key),$rounds       # key->rounds
 ___
         &aesni_generate1("dec",$key,$rounds);
 $code.=<<___;
@@ -109,16 +265,16 @@ $code.=<<___;
 ___
 }
 
-# _aesni_[en|de]crypt[34] are private interfaces, N denotes interleave
-# factor. Why 3x subroutine is used in loops? Even though aes[enc|dec]
-# latency is 6, it turned out that it can be scheduled only every
-# *second* cycle. Thus 3x interleave is the one providing optimal
+# _aesni_[en|de]cryptN are private interfaces, N denotes interleave
+# factor. Why 3x subroutine were originally used in loops? Even though
+# aes[enc|dec] latency was originally 6, it could be scheduled only
+# every *2nd* cycle. Thus 3x interleave was the one providing optimal
 # utilization, i.e. when subroutine's throughput is virtually same as
 # of non-interleaved subroutine [for number of input blocks up to 3].
-# This is why it makes no sense to implement 2x subroutine. As soon
-# as/if Intel improves throughput by making it possible to schedule
-# the instructions in question *every* cycles I would have to
-# implement 6x interleave and use it in loop...
+# This is why it makes no sense to implement 2x subroutine.
+# aes[enc|dec] latency in next processor generation is 8, but the
+# instructions can be scheduled every cycle. Optimal interleave for
+# new processor is therefore 8x...
 sub aesni_generate3 {
 my $dir=shift;
 # As already mentioned it takes in $key and $rounds, which are *not*
@@ -131,25 +287,25 @@ _aesni_${dir}rypt3:
         shr     \$1,$rounds
         $movkey 16($key),$rndkey1
         lea     32($key),$key
-        pxor    $rndkey0,$inout0
-        pxor    $rndkey0,$inout1
-        pxor    $rndkey0,$inout2
+        xorps   $rndkey0,$inout0
+        xorps   $rndkey0,$inout1
+        xorps   $rndkey0,$inout2
+        $movkey         ($key),$rndkey0
 
 .L${dir}_loop3:
         aes${dir}       $rndkey1,$inout0
-        $movkey         ($key),$rndkey0
         aes${dir}       $rndkey1,$inout1
         dec             $rounds
         aes${dir}       $rndkey1,$inout2
-        aes${dir}       $rndkey0,$inout0
         $movkey         16($key),$rndkey1
+        aes${dir}       $rndkey0,$inout0
         aes${dir}       $rndkey0,$inout1
         lea             32($key),$key
         aes${dir}       $rndkey0,$inout2
+        $movkey         ($key),$rndkey0
         jnz             .L${dir}_loop3
 
         aes${dir}       $rndkey1,$inout0
-        $movkey         ($key),$rndkey0
         aes${dir}       $rndkey1,$inout1
         aes${dir}       $rndkey1,$inout2
         aes${dir}last   $rndkey0,$inout0
@@ -175,28 +331,28 @@ _aesni_${dir}rypt4:
         shr     \$1,$rounds
         $movkey 16($key),$rndkey1
         lea     32($key),$key
-        pxor    $rndkey0,$inout0
-        pxor    $rndkey0,$inout1
-        pxor    $rndkey0,$inout2
-        pxor    $rndkey0,$inout3
+        xorps   $rndkey0,$inout0
+        xorps   $rndkey0,$inout1
+        xorps   $rndkey0,$inout2
+        xorps   $rndkey0,$inout3
+        $movkey ($key),$rndkey0
 
 .L${dir}_loop4:
         aes${dir}       $rndkey1,$inout0
-        $movkey         ($key),$rndkey0
         aes${dir}       $rndkey1,$inout1
         dec             $rounds
         aes${dir}       $rndkey1,$inout2
         aes${dir}       $rndkey1,$inout3
-        aes${dir}       $rndkey0,$inout0
         $movkey         16($key),$rndkey1
+        aes${dir}       $rndkey0,$inout0
         aes${dir}       $rndkey0,$inout1
         lea             32($key),$key
         aes${dir}       $rndkey0,$inout2
         aes${dir}       $rndkey0,$inout3
+        $movkey         ($key),$rndkey0
         jnz             .L${dir}_loop4
 
         aes${dir}       $rndkey1,$inout0
-        $movkey         ($key),$rndkey0
         aes${dir}       $rndkey1,$inout1
         aes${dir}       $rndkey1,$inout2
         aes${dir}       $rndkey1,$inout3
@@ -208,12 +364,158 @@ _aesni_${dir}rypt4:
 .size   _aesni_${dir}rypt4,.-_aesni_${dir}rypt4
 ___
 }
+sub aesni_generate6 {
+my $dir=shift;
+# As already mentioned it takes in $key and $rounds, which are *not*
+# preserved. $inout[0-5] is cipher/clear text...
+$code.=<<___;
+.type   _aesni_${dir}rypt6,\@abi-omnipotent
+.align  16
+_aesni_${dir}rypt6:
+        $movkey         ($key),$rndkey0
+        shr             \$1,$rounds
+        $movkey         16($key),$rndkey1
+        lea             32($key),$key
+        xorps           $rndkey0,$inout0
+        pxor            $rndkey0,$inout1
+        aes${dir}       $rndkey1,$inout0
+        pxor            $rndkey0,$inout2
+        aes${dir}       $rndkey1,$inout1
+        pxor            $rndkey0,$inout3
+        aes${dir}       $rndkey1,$inout2
+        pxor            $rndkey0,$inout4
+        aes${dir}       $rndkey1,$inout3
+        pxor            $rndkey0,$inout5
+        dec             $rounds
+        aes${dir}       $rndkey1,$inout4
+        $movkey         ($key),$rndkey0
+        aes${dir}       $rndkey1,$inout5
+        jmp             .L${dir}_loop6_enter
+.align  16
+.L${dir}_loop6:
+        aes${dir}       $rndkey1,$inout0
+        aes${dir}       $rndkey1,$inout1
+        dec             $rounds
+        aes${dir}       $rndkey1,$inout2
+        aes${dir}       $rndkey1,$inout3
+        aes${dir}       $rndkey1,$inout4
+        aes${dir}       $rndkey1,$inout5
+.L${dir}_loop6_enter:                           # happens to be 16-byte aligned
+        $movkey         16($key),$rndkey1
+        aes${dir}       $rndkey0,$inout0
+        aes${dir}       $rndkey0,$inout1
+        lea             32($key),$key
+        aes${dir}       $rndkey0,$inout2
+        aes${dir}       $rndkey0,$inout3
+        aes${dir}       $rndkey0,$inout4
+        aes${dir}       $rndkey0,$inout5
+        $movkey         ($key),$rndkey0
+        jnz             .L${dir}_loop6
+
+        aes${dir}       $rndkey1,$inout0
+        aes${dir}       $rndkey1,$inout1
+        aes${dir}       $rndkey1,$inout2
+        aes${dir}       $rndkey1,$inout3
+        aes${dir}       $rndkey1,$inout4
+        aes${dir}       $rndkey1,$inout5
+        aes${dir}last   $rndkey0,$inout0
+        aes${dir}last   $rndkey0,$inout1
+        aes${dir}last   $rndkey0,$inout2
+        aes${dir}last   $rndkey0,$inout3
+        aes${dir}last   $rndkey0,$inout4
+        aes${dir}last   $rndkey0,$inout5
+        ret
+.size   _aesni_${dir}rypt6,.-_aesni_${dir}rypt6
+___
+}
+sub aesni_generate8 {
+my $dir=shift;
+# As already mentioned it takes in $key and $rounds, which are *not*
+# preserved. $inout[0-7] is cipher/clear text...
+$code.=<<___;
+.type   _aesni_${dir}rypt8,\@abi-omnipotent
+.align  16
+_aesni_${dir}rypt8:
+        $movkey         ($key),$rndkey0
+        shr             \$1,$rounds
+        $movkey         16($key),$rndkey1
+        lea             32($key),$key
+        xorps           $rndkey0,$inout0
+        xorps           $rndkey0,$inout1
+        aes${dir}       $rndkey1,$inout0
+        pxor            $rndkey0,$inout2
+        aes${dir}       $rndkey1,$inout1
+        pxor            $rndkey0,$inout3
+        aes${dir}       $rndkey1,$inout2
+        pxor            $rndkey0,$inout4
+        aes${dir}       $rndkey1,$inout3
+        pxor            $rndkey0,$inout5
+        dec             $rounds
+        aes${dir}       $rndkey1,$inout4
+        pxor            $rndkey0,$inout6
+        aes${dir}       $rndkey1,$inout5
+        pxor            $rndkey0,$inout7
+        $movkey         ($key),$rndkey0
+        aes${dir}       $rndkey1,$inout6
+        aes${dir}       $rndkey1,$inout7
+        $movkey         16($key),$rndkey1
+        jmp             .L${dir}_loop8_enter
+.align  16
+.L${dir}_loop8:
+        aes${dir}       $rndkey1,$inout0
+        aes${dir}       $rndkey1,$inout1
+        dec             $rounds
+        aes${dir}       $rndkey1,$inout2
+        aes${dir}       $rndkey1,$inout3
+        aes${dir}       $rndkey1,$inout4
+        aes${dir}       $rndkey1,$inout5
+        aes${dir}       $rndkey1,$inout6
+        aes${dir}       $rndkey1,$inout7
+        $movkey         16($key),$rndkey1
+.L${dir}_loop8_enter:                           # happens to be 16-byte aligned
+        aes${dir}       $rndkey0,$inout0
+        aes${dir}       $rndkey0,$inout1
+        lea             32($key),$key
+        aes${dir}       $rndkey0,$inout2
+        aes${dir}       $rndkey0,$inout3
+        aes${dir}       $rndkey0,$inout4
+        aes${dir}       $rndkey0,$inout5
+        aes${dir}       $rndkey0,$inout6
+        aes${dir}       $rndkey0,$inout7
+        $movkey         ($key),$rndkey0
+        jnz             .L${dir}_loop8
+
+        aes${dir}       $rndkey1,$inout0
+        aes${dir}       $rndkey1,$inout1
+        aes${dir}       $rndkey1,$inout2
+        aes${dir}       $rndkey1,$inout3
+        aes${dir}       $rndkey1,$inout4
+        aes${dir}       $rndkey1,$inout5
+        aes${dir}       $rndkey1,$inout6
+        aes${dir}       $rndkey1,$inout7
+        aes${dir}last   $rndkey0,$inout0
+        aes${dir}last   $rndkey0,$inout1
+        aes${dir}last   $rndkey0,$inout2
+        aes${dir}last   $rndkey0,$inout3
+        aes${dir}last   $rndkey0,$inout4
+        aes${dir}last   $rndkey0,$inout5
+        aes${dir}last   $rndkey0,$inout6
+        aes${dir}last   $rndkey0,$inout7
+        ret
+.size   _aesni_${dir}rypt8,.-_aesni_${dir}rypt8
+___
+}
 &aesni_generate3("enc") if ($PREFIX eq "aesni");
 &aesni_generate3("dec");
 &aesni_generate4("enc") if ($PREFIX eq "aesni");
 &aesni_generate4("dec");
+&aesni_generate6("enc") if ($PREFIX eq "aesni");
+&aesni_generate6("dec");
+&aesni_generate8("enc") if ($PREFIX eq "aesni");
+&aesni_generate8("dec");
 
 if ($PREFIX eq "aesni") {
+########################################################################
 # void aesni_ecb_encrypt (const void *in, void *out,
 #                         size_t length, const AES_KEY *key,
 #                         int enc);
@@ -222,54 +524,98 @@ $code.=<<___;
 .type   aesni_ecb_encrypt,\@function,5
 .align  16
 aesni_ecb_encrypt:
-        cmp     \$16,$len               # check length
-        jb      .Lecb_ret
-
-        mov     240($key),$rounds       # pull $rounds
         and     \$-16,$len
+        jz      .Lecb_ret
+
+        mov     240($key),$rounds       # key->rounds
+        $movkey ($key),$rndkey0
         mov     $key,$key_              # backup $key
-        test    %r8d,%r8d               # 5th argument
         mov     $rounds,$rnds_          # backup $rounds
+        test    %r8d,%r8d               # 5th argument
         jz      .Lecb_decrypt
 #--------------------------- ECB ENCRYPT ------------------------------#
-        sub     \$0x40,$len
-        jbe     .Lecb_enc_tail
-        jmp     .Lecb_enc_loop3
+        cmp     \$0x80,$len
+        jb      .Lecb_enc_tail
+
+        movdqu  ($inp),$inout0
+        movdqu  0x10($inp),$inout1
+        movdqu  0x20($inp),$inout2
+        movdqu  0x30($inp),$inout3
+        movdqu  0x40($inp),$inout4
+        movdqu  0x50($inp),$inout5
+        movdqu  0x60($inp),$inout6
+        movdqu  0x70($inp),$inout7
+        lea     0x80($inp),$inp
+        sub     \$0x80,$len
+        jmp     .Lecb_enc_loop8_enter
 .align 16
-.Lecb_enc_loop3:
-        movups  ($inp),$inout0
-        movups  0x10($inp),$inout1
-        movups  0x20($inp),$inout2
-        call    _aesni_encrypt3
-        sub     \$0x30,$len
-        lea     0x30($inp),$inp
-        lea     0x30($out),$out
-        movups  $inout0,-0x30($out)
-        mov     $rnds_,$rounds          # restore $rounds
-        movups  $inout1,-0x20($out)
+.Lecb_enc_loop8:
+        movups  $inout0,($out)
         mov     $key_,$key              # restore $key
-        movups  $inout2,-0x10($out)
-        ja      .Lecb_enc_loop3
+        movdqu  ($inp),$inout0
+        mov     $rnds_,$rounds          # restore $rounds
+        movups  $inout1,0x10($out)
+        movdqu  0x10($inp),$inout1
+        movups  $inout2,0x20($out)
+        movdqu  0x20($inp),$inout2
+        movups  $inout3,0x30($out)
+        movdqu  0x30($inp),$inout3
+        movups  $inout4,0x40($out)
+        movdqu  0x40($inp),$inout4
+        movups  $inout5,0x50($out)
+        movdqu  0x50($inp),$inout5
+        movups  $inout6,0x60($out)
+        movdqu  0x60($inp),$inout6
+        movups  $inout7,0x70($out)
+        lea     0x80($out),$out
+        movdqu  0x70($inp),$inout7
+        lea     0x80($inp),$inp
+.Lecb_enc_loop8_enter:
+
+        call    _aesni_encrypt8
+
+        sub     \$0x80,$len
+        jnc     .Lecb_enc_loop8
 
-.Lecb_enc_tail:
-        add     \$0x40,$len
+        movups  $inout0,($out)
+        mov     $key_,$key              # restore $key
+        movups  $inout1,0x10($out)
+        mov     $rnds_,$rounds          # restore $rounds
+        movups  $inout2,0x20($out)
+        movups  $inout3,0x30($out)
+        movups  $inout4,0x40($out)
+        movups  $inout5,0x50($out)
+        movups  $inout6,0x60($out)
+        movups  $inout7,0x70($out)
+        lea     0x80($out),$out
+        add     \$0x80,$len
         jz      .Lecb_ret
 
-        cmp     \$0x10,$len
+.Lecb_enc_tail:
         movups  ($inp),$inout0
-        je      .Lecb_enc_one
         cmp     \$0x20,$len
+        jb      .Lecb_enc_one
         movups  0x10($inp),$inout1
         je      .Lecb_enc_two
-        cmp     \$0x30,$len
         movups  0x20($inp),$inout2
-        je      .Lecb_enc_three
+        cmp     \$0x40,$len
+        jb      .Lecb_enc_three
         movups  0x30($inp),$inout3
-        call    _aesni_encrypt4
+        je      .Lecb_enc_four
+        movups  0x40($inp),$inout4
+        cmp     \$0x60,$len
+        jb      .Lecb_enc_five
+        movups  0x50($inp),$inout5
+        je      .Lecb_enc_six
+        movdqu  0x60($inp),$inout6
+        call    _aesni_encrypt8
         movups  $inout0,($out)
         movups  $inout1,0x10($out)
         movups  $inout2,0x20($out)
         movups  $inout3,0x30($out)
+        movups  $inout4,0x40($out)
+        movups  $inout5,0x50($out)
+        movups  $inout6,0x60($out)
         jmp     .Lecb_ret
 .align  16
 .Lecb_enc_one:
@@ -280,6 +626,7 @@ $code.=<<___;
         jmp     .Lecb_ret
 .align  16
 .Lecb_enc_two:
+        xorps   $inout2,$inout2
         call    _aesni_encrypt3
         movups  $inout0,($out)
         movups  $inout1,0x10($out)
@@ -291,47 +638,121 @@ $code.=<<___;
         movups  $inout1,0x10($out)
         movups  $inout2,0x20($out)
         jmp     .Lecb_ret
+.align  16
+.Lecb_enc_four:
+        call    _aesni_encrypt4
+        movups  $inout0,($out)
+        movups  $inout1,0x10($out)
+        movups  $inout2,0x20($out)
+        movups  $inout3,0x30($out)
+        jmp     .Lecb_ret
+.align  16
+.Lecb_enc_five:
+        xorps   $inout5,$inout5
+        call    _aesni_encrypt6
+        movups  $inout0,($out)
+        movups  $inout1,0x10($out)
+        movups  $inout2,0x20($out)
+        movups  $inout3,0x30($out)
+        movups  $inout4,0x40($out)
+        jmp     .Lecb_ret
+.align  16
+.Lecb_enc_six:
+        call    _aesni_encrypt6
+        movups  $inout0,($out)
+        movups  $inout1,0x10($out)
+        movups  $inout2,0x20($out)
+        movups  $inout3,0x30($out)
+        movups  $inout4,0x40($out)
+        movups  $inout5,0x50($out)
+        jmp     .Lecb_ret
 #--------------------------- ECB DECRYPT ------------------------------#
 .align  16
 .Lecb_decrypt:
-        sub     \$0x40,$len
-        jbe     .Lecb_dec_tail
-        jmp     .Lecb_dec_loop3
+        cmp     \$0x80,$len
+        jb      .Lecb_dec_tail
+
+        movdqu  ($inp),$inout0
+        movdqu  0x10($inp),$inout1
+        movdqu  0x20($inp),$inout2
+        movdqu  0x30($inp),$inout3
+        movdqu  0x40($inp),$inout4
+        movdqu  0x50($inp),$inout5
+        movdqu  0x60($inp),$inout6
+        movdqu  0x70($inp),$inout7
+        lea     0x80($inp),$inp
+        sub     \$0x80,$len
+        jmp     .Lecb_dec_loop8_enter
 .align 16
-.Lecb_dec_loop3:
-        movups  ($inp),$inout0
-        movups  0x10($inp),$inout1
-        movups  0x20($inp),$inout2
-        call    _aesni_decrypt3
-        sub     \$0x30,$len
-        lea     0x30($inp),$inp
-        lea     0x30($out),$out
-        movups  $inout0,-0x30($out)
-        mov     $rnds_,$rounds          # restore $rounds
-        movups  $inout1,-0x20($out)
+.Lecb_dec_loop8:
+        movups  $inout0,($out)
         mov     $key_,$key              # restore $key
-        movups  $inout2,-0x10($out)
-        ja      .Lecb_dec_loop3
+        movdqu  ($inp),$inout0
+        mov     $rnds_,$rounds          # restore $rounds
+        movups  $inout1,0x10($out)
+        movdqu  0x10($inp),$inout1
+        movups  $inout2,0x20($out)
+        movdqu  0x20($inp),$inout2
+        movups  $inout3,0x30($out)
+        movdqu  0x30($inp),$inout3
+        movups  $inout4,0x40($out)
+        movdqu  0x40($inp),$inout4
+        movups  $inout5,0x50($out)
+        movdqu  0x50($inp),$inout5
+        movups  $inout6,0x60($out)
+        movdqu  0x60($inp),$inout6
+        movups  $inout7,0x70($out)
+        lea     0x80($out),$out
+        movdqu  0x70($inp),$inout7
+        lea     0x80($inp),$inp
+.Lecb_dec_loop8_enter:
+
+        call    _aesni_decrypt8
+
+        $movkey ($key_),$rndkey0
+        sub     \$0x80,$len
+        jnc     .Lecb_dec_loop8
 
-.Lecb_dec_tail:
-        add     \$0x40,$len
+        movups  $inout0,($out)
+        mov     $key_,$key              # restore $key
+        movups  $inout1,0x10($out)
+        mov     $rnds_,$rounds          # restore $rounds
+        movups  $inout2,0x20($out)
+        movups  $inout3,0x30($out)
+        movups  $inout4,0x40($out)
+        movups  $inout5,0x50($out)
+        movups  $inout6,0x60($out)
+        movups  $inout7,0x70($out)
+        lea     0x80($out),$out
+        add     \$0x80,$len
         jz      .Lecb_ret
 
-        cmp     \$0x10,$len
+.Lecb_dec_tail:
         movups  ($inp),$inout0
-        je      .Lecb_dec_one
         cmp     \$0x20,$len
+        jb      .Lecb_dec_one
         movups  0x10($inp),$inout1
         je      .Lecb_dec_two
-        cmp     \$0x30,$len
         movups  0x20($inp),$inout2
-        je      .Lecb_dec_three
+        cmp     \$0x40,$len
+        jb      .Lecb_dec_three
         movups  0x30($inp),$inout3
-        call    _aesni_decrypt4
+        je      .Lecb_dec_four
+        movups  0x40($inp),$inout4
+        cmp     \$0x60,$len
+        jb      .Lecb_dec_five
+        movups  0x50($inp),$inout5
+        je      .Lecb_dec_six
+        movups  0x60($inp),$inout6
+        $movkey ($key),$rndkey0
+        call    _aesni_decrypt8
         movups  $inout0,($out)
         movups  $inout1,0x10($out)
         movups  $inout2,0x20($out)
         movups  $inout3,0x30($out)
+        movups  $inout4,0x40($out)
+        movups  $inout5,0x50($out)
+        movups  $inout6,0x60($out)
         jmp     .Lecb_ret
 .align  16
 .Lecb_dec_one:
@@ -342,6 +763,7 @@ $code.=<<___;
         jmp     .Lecb_ret
 .align  16
 .Lecb_dec_two:
+        xorps   $inout2,$inout2
         call    _aesni_decrypt3
         movups  $inout0,($out)
         movups  $inout1,0x10($out)
@@ -352,17 +774,1353 @@ $code.=<<___;
         movups  $inout0,($out)
         movups  $inout1,0x10($out)
         movups  $inout2,0x20($out)
+        jmp     .Lecb_ret
+.align  16
+.Lecb_dec_four:
+        call    _aesni_decrypt4
+        movups  $inout0,($out)
+        movups  $inout1,0x10($out)
+        movups  $inout2,0x20($out)
+        movups  $inout3,0x30($out)
+        jmp     .Lecb_ret
+.align  16
+.Lecb_dec_five:
+        xorps   $inout5,$inout5
+        call    _aesni_decrypt6
+        movups  $inout0,($out)
+        movups  $inout1,0x10($out)
+        movups  $inout2,0x20($out)
+        movups  $inout3,0x30($out)
+        movups  $inout4,0x40($out)
+        jmp     .Lecb_ret
+.align  16
+.Lecb_dec_six:
+        call    _aesni_decrypt6
+        movups  $inout0,($out)
+        movups  $inout1,0x10($out)
+        movups  $inout2,0x20($out)
+        movups  $inout3,0x30($out)
+        movups  $inout4,0x40($out)
+        movups  $inout5,0x50($out)
 
 .Lecb_ret:
         ret
 .size   aesni_ecb_encrypt,.-aesni_ecb_encrypt
 ___
+
+{
+######################################################################
+# void aesni_ccm64_[en|de]crypt_blocks (const void *in, void *out,
+#                         size_t blocks, const AES_KEY *key,
+#                         const char *ivec,char *cmac);
+#
+# Handles only complete blocks, operates on 64-bit counter and
+# does not update *ivec! Nor does it finalize CMAC value
+# (see engine/eng_aesni.c for details)
+#
+{
+my $cmac="%r9"; # 6th argument
+
+my $increment="%xmm6";
+my $bswap_mask="%xmm7";
+
+$code.=<<___;
+.globl  aesni_ccm64_encrypt_blocks
+.type   aesni_ccm64_encrypt_blocks,\@function,6
+.align  16
+aesni_ccm64_encrypt_blocks:
+___
+$code.=<<___ if ($win64);
+        lea     -0x58(%rsp),%rsp
+        movaps  %xmm6,(%rsp)
+        movaps  %xmm7,0x10(%rsp)
+        movaps  %xmm8,0x20(%rsp)
+        movaps  %xmm9,0x30(%rsp)
+.Lccm64_enc_body:
+___
+$code.=<<___;
+        mov     240($key),$rounds               # key->rounds
+        movdqu  ($ivp),$iv
+        movdqa  .Lincrement64(%rip),$increment
+        movdqa  .Lbswap_mask(%rip),$bswap_mask
+
+        shr     \$1,$rounds
+        lea     0($key),$key_
+        movdqu  ($cmac),$inout1
+        movdqa  $iv,$inout0
+        mov     $rounds,$rnds_
+        pshufb  $bswap_mask,$iv
+        jmp     .Lccm64_enc_outer
+.align  16
+.Lccm64_enc_outer:
+        $movkey ($key_),$rndkey0
+        mov     $rnds_,$rounds
+        movups  ($inp),$in0                     # load inp
+
+        xorps   $rndkey0,$inout0                # counter
+        $movkey 16($key_),$rndkey1
+        xorps   $in0,$rndkey0
+        lea     32($key_),$key
+        xorps   $rndkey0,$inout1                # cmac^=inp
+        $movkey ($key),$rndkey0
+
+.Lccm64_enc2_loop:
+        aesenc  $rndkey1,$inout0
+        dec     $rounds
+        aesenc  $rndkey1,$inout1
+        $movkey 16($key),$rndkey1
+        aesenc  $rndkey0,$inout0
+        lea     32($key),$key
+        aesenc  $rndkey0,$inout1
+        $movkey 0($key),$rndkey0
+        jnz     .Lccm64_enc2_loop
+        aesenc  $rndkey1,$inout0
+        aesenc  $rndkey1,$inout1
+        paddq   $increment,$iv
+        aesenclast      $rndkey0,$inout0
+        aesenclast      $rndkey0,$inout1
+
+        dec     $len
+        lea     16($inp),$inp
+        xorps   $inout0,$in0                    # inp ^= E(iv)
+        movdqa  $iv,$inout0
+        movups  $in0,($out)                     # save output
+        lea     16($out),$out
+        pshufb  $bswap_mask,$inout0
+        jnz     .Lccm64_enc_outer
+
+        movups  $inout1,($cmac)
+___
+$code.=<<___ if ($win64);
+        movaps  (%rsp),%xmm6
+        movaps  0x10(%rsp),%xmm7
+        movaps  0x20(%rsp),%xmm8
+        movaps  0x30(%rsp),%xmm9
+        lea     0x58(%rsp),%rsp
+.Lccm64_enc_ret:
+___
+$code.=<<___;
+        ret
+.size   aesni_ccm64_encrypt_blocks,.-aesni_ccm64_encrypt_blocks
+___
+######################################################################
+$code.=<<___;
+.globl  aesni_ccm64_decrypt_blocks
+.type   aesni_ccm64_decrypt_blocks,\@function,6
+.align  16
+aesni_ccm64_decrypt_blocks:
+___
+$code.=<<___ if ($win64);
+        lea     -0x58(%rsp),%rsp
+        movaps  %xmm6,(%rsp)
+        movaps  %xmm7,0x10(%rsp)
+        movaps  %xmm8,0x20(%rsp)
+        movaps  %xmm9,0x30(%rsp)
+.Lccm64_dec_body:
+___
+$code.=<<___;
+        mov     240($key),$rounds               # key->rounds
+        movups  ($ivp),$iv
+        movdqu  ($cmac),$inout1
+        movdqa  .Lincrement64(%rip),$increment
+        movdqa  .Lbswap_mask(%rip),$bswap_mask
+
+        movaps  $iv,$inout0
+        mov     $rounds,$rnds_
+        mov     $key,$key_
+        pshufb  $bswap_mask,$iv
+___
+        &aesni_generate1("enc",$key,$rounds);
+$code.=<<___;
+        movups  ($inp),$in0                     # load inp
+        paddq   $increment,$iv
+        lea     16($inp),$inp
+        jmp     .Lccm64_dec_outer
+.align  16
+.Lccm64_dec_outer:
+        xorps   $inout0,$in0                    # inp ^= E(iv)
+        movdqa  $iv,$inout0
+        mov     $rnds_,$rounds
+        movups  $in0,($out)                     # save output
+        lea     16($out),$out
+        pshufb  $bswap_mask,$inout0
+
+        sub     \$1,$len
+        jz      .Lccm64_dec_break
+
+        $movkey ($key_),$rndkey0
+        shr     \$1,$rounds
+        $movkey 16($key_),$rndkey1
+        xorps   $rndkey0,$in0
+        lea     32($key_),$key
+        xorps   $rndkey0,$inout0
+        xorps   $in0,$inout1                    # cmac^=out
+        $movkey ($key),$rndkey0
+
+.Lccm64_dec2_loop:
+        aesenc  $rndkey1,$inout0
+        dec     $rounds
+        aesenc  $rndkey1,$inout1
+        $movkey 16($key),$rndkey1
+        aesenc  $rndkey0,$inout0
+        lea     32($key),$key
+        aesenc  $rndkey0,$inout1
+        $movkey 0($key),$rndkey0
+        jnz     .Lccm64_dec2_loop
+        movups  ($inp),$in0                     # load inp
+        paddq   $increment,$iv
+        aesenc  $rndkey1,$inout0
+        aesenc  $rndkey1,$inout1
+        lea     16($inp),$inp
+        aesenclast      $rndkey0,$inout0
+        aesenclast      $rndkey0,$inout1
+        jmp     .Lccm64_dec_outer
+
+.align  16
+.Lccm64_dec_break:
+        #xorps  $in0,$inout1                    # cmac^=out
+___
+        &aesni_generate1("enc",$key_,$rounds,$inout1,$in0);
+$code.=<<___;
+        movups  $inout1,($cmac)
+___
+$code.=<<___ if ($win64);
+        movaps  (%rsp),%xmm6
+        movaps  0x10(%rsp),%xmm7
+        movaps  0x20(%rsp),%xmm8
+        movaps  0x30(%rsp),%xmm9
+        lea     0x58(%rsp),%rsp
+.Lccm64_dec_ret:
+___
+$code.=<<___;
+        ret
+.size   aesni_ccm64_decrypt_blocks,.-aesni_ccm64_decrypt_blocks
+___
+}
+######################################################################
+# void aesni_ctr32_encrypt_blocks (const void *in, void *out,
+#                         size_t blocks, const AES_KEY *key,
+#                         const char *ivec);
+#
+# Handles only complete blocks, operates on 32-bit counter and
+# does not update *ivec! (see engine/eng_aesni.c for details)
+#
+{
+my $reserved = $win64?0:-0x28;
+my ($in0,$in1,$in2,$in3)=map("%xmm$_",(8..11));
+my ($iv0,$iv1,$ivec)=("%xmm12","%xmm13","%xmm14");
+my $bswap_mask="%xmm15";
+
+$code.=<<___;
+.globl  aesni_ctr32_encrypt_blocks
+.type   aesni_ctr32_encrypt_blocks,\@function,5
+.align  16
+aesni_ctr32_encrypt_blocks:
+___
+$code.=<<___ if ($win64);
+        lea     -0xc8(%rsp),%rsp
+        movaps  %xmm6,0x20(%rsp)
+        movaps  %xmm7,0x30(%rsp)
+        movaps  %xmm8,0x40(%rsp)
+        movaps  %xmm9,0x50(%rsp)
+        movaps  %xmm10,0x60(%rsp)
+        movaps  %xmm11,0x70(%rsp)
+        movaps  %xmm12,0x80(%rsp)
+        movaps  %xmm13,0x90(%rsp)
+        movaps  %xmm14,0xa0(%rsp)
+        movaps  %xmm15,0xb0(%rsp)
+.Lctr32_body:
+___
+$code.=<<___;
+        cmp     \$1,$len
+        je      .Lctr32_one_shortcut
+
+        movdqu  ($ivp),$ivec
+        movdqa  .Lbswap_mask(%rip),$bswap_mask
+        xor     $rounds,$rounds
+        pextrd  \$3,$ivec,$rnds_                # pull 32-bit counter
+        pinsrd  \$3,$rounds,$ivec               # wipe 32-bit counter
+
+        mov     240($key),$rounds               # key->rounds
+        bswap   $rnds_
+        pxor    $iv0,$iv0                       # vector of 3 32-bit counters
+        pxor    $iv1,$iv1                       # vector of 3 32-bit counters
+        pinsrd  \$0,$rnds_,$iv0
+        lea     3($rnds_),$key_
+        pinsrd  \$0,$key_,$iv1
+        inc     $rnds_
+        pinsrd  \$1,$rnds_,$iv0
+        inc     $key_
+        pinsrd  \$1,$key_,$iv1
+        inc     $rnds_
+        pinsrd  \$2,$rnds_,$iv0
+        inc     $key_
+        pinsrd  \$2,$key_,$iv1
+        movdqa  $iv0,$reserved(%rsp)
+        pshufb  $bswap_mask,$iv0
+        movdqa  $iv1,`$reserved+0x10`(%rsp)
+        pshufb  $bswap_mask,$iv1
+
+        pshufd  \$`3<<6`,$iv0,$inout0           # place counter to upper dword
+        pshufd  \$`2<<6`,$iv0,$inout1
+        pshufd  \$`1<<6`,$iv0,$inout2
+        cmp     \$6,$len
+        jb      .Lctr32_tail
+        shr     \$1,$rounds
+        mov     $key,$key_                      # backup $key
+        mov     $rounds,$rnds_                  # backup $rounds
+        sub     \$6,$len
+        jmp     .Lctr32_loop6
+
+.align  16
+.Lctr32_loop6:
+        pshufd  \$`3<<6`,$iv1,$inout3
+        por     $ivec,$inout0                   # merge counter-less ivec
+         $movkey        ($key_),$rndkey0
+        pshufd  \$`2<<6`,$iv1,$inout4
+        por     $ivec,$inout1
+         $movkey        16($key_),$rndkey1
+        pshufd  \$`1<<6`,$iv1,$inout5
+        por     $ivec,$inout2
+        por     $ivec,$inout3
+         xorps          $rndkey0,$inout0
+        por     $ivec,$inout4
+        por     $ivec,$inout5
+
+        # inline _aesni_encrypt6 and interleave last rounds
+        # with own code...
+
+        pxor            $rndkey0,$inout1
+        aesenc          $rndkey1,$inout0
+        lea             32($key_),$key
+        pxor            $rndkey0,$inout2
+        aesenc          $rndkey1,$inout1
+         movdqa         .Lincrement32(%rip),$iv1
+        pxor            $rndkey0,$inout3
+        aesenc          $rndkey1,$inout2
+         movdqa         $reserved(%rsp),$iv0
+        pxor            $rndkey0,$inout4
+        aesenc          $rndkey1,$inout3
+        pxor            $rndkey0,$inout5
+        $movkey         ($key),$rndkey0
+        dec             $rounds
+        aesenc          $rndkey1,$inout4
+        aesenc          $rndkey1,$inout5
+        jmp             .Lctr32_enc_loop6_enter
+.align  16
+.Lctr32_enc_loop6:
+        aesenc          $rndkey1,$inout0
+        aesenc          $rndkey1,$inout1
+        dec             $rounds
+        aesenc          $rndkey1,$inout2
+        aesenc          $rndkey1,$inout3
+        aesenc          $rndkey1,$inout4
+        aesenc          $rndkey1,$inout5
+.Lctr32_enc_loop6_enter:
+        $movkey         16($key),$rndkey1
+        aesenc          $rndkey0,$inout0
+        aesenc          $rndkey0,$inout1
+        lea             32($key),$key
+        aesenc          $rndkey0,$inout2
+        aesenc          $rndkey0,$inout3
+        aesenc          $rndkey0,$inout4
+        aesenc          $rndkey0,$inout5
+        $movkey         ($key),$rndkey0
+        jnz             .Lctr32_enc_loop6
+
+        aesenc          $rndkey1,$inout0
+         paddd          $iv1,$iv0               # increment counter vector
+        aesenc          $rndkey1,$inout1
+         paddd          `$reserved+0x10`(%rsp),$iv1
+        aesenc          $rndkey1,$inout2
+         movdqa         $iv0,$reserved(%rsp)    # save counter vector
+        aesenc          $rndkey1,$inout3
+         movdqa         $iv1,`$reserved+0x10`(%rsp)
+        aesenc          $rndkey1,$inout4
+         pshufb         $bswap_mask,$iv0        # byte swap
+        aesenc          $rndkey1,$inout5
+         pshufb         $bswap_mask,$iv1
+
+        aesenclast      $rndkey0,$inout0
+         movups         ($inp),$in0             # load input
+        aesenclast      $rndkey0,$inout1
+         movups         0x10($inp),$in1
+        aesenclast      $rndkey0,$inout2
+         movups         0x20($inp),$in2
+        aesenclast      $rndkey0,$inout3
+         movups         0x30($inp),$in3
+        aesenclast      $rndkey0,$inout4
+         movups         0x40($inp),$rndkey1
+        aesenclast      $rndkey0,$inout5
+         movups         0x50($inp),$rndkey0
+         lea    0x60($inp),$inp
+
+        xorps   $inout0,$in0                    # xor
+         pshufd \$`3<<6`,$iv0,$inout0
+        xorps   $inout1,$in1
+         pshufd \$`2<<6`,$iv0,$inout1
+        movups  $in0,($out)                     # store output
+        xorps   $inout2,$in2
+         pshufd \$`1<<6`,$iv0,$inout2
+        movups  $in1,0x10($out)
+        xorps   $inout3,$in3
+        movups  $in2,0x20($out)
+        xorps   $inout4,$rndkey1
+        movups  $in3,0x30($out)
+        xorps   $inout5,$rndkey0
+        movups  $rndkey1,0x40($out)
+        movups  $rndkey0,0x50($out)
+        lea     0x60($out),$out
+        mov     $rnds_,$rounds
+        sub     \$6,$len
+        jnc     .Lctr32_loop6
+
+        add     \$6,$len
+        jz      .Lctr32_done
+        mov     $key_,$key                      # restore $key
+        lea     1($rounds,$rounds),$rounds      # restore original value
+
+.Lctr32_tail:
+        por     $ivec,$inout0
+        movups  ($inp),$in0
+        cmp     \$2,$len
+        jb      .Lctr32_one
+
+        por     $ivec,$inout1
+        movups  0x10($inp),$in1
+        je      .Lctr32_two
+
+        pshufd  \$`3<<6`,$iv1,$inout3
+        por     $ivec,$inout2
+        movups  0x20($inp),$in2
+        cmp     \$4,$len
+        jb      .Lctr32_three
+
+        pshufd  \$`2<<6`,$iv1,$inout4
+        por     $ivec,$inout3
+        movups  0x30($inp),$in3
+        je      .Lctr32_four
+
+        por     $ivec,$inout4
+        xorps   $inout5,$inout5
+
+        call    _aesni_encrypt6
+
+        movups  0x40($inp),$rndkey1
+        xorps   $inout0,$in0
+        xorps   $inout1,$in1
+        movups  $in0,($out)
+        xorps   $inout2,$in2
+        movups  $in1,0x10($out)
+        xorps   $inout3,$in3
+        movups  $in2,0x20($out)
+        xorps   $inout4,$rndkey1
+        movups  $in3,0x30($out)
+        movups  $rndkey1,0x40($out)
+        jmp     .Lctr32_done
+
+.align  16
+.Lctr32_one_shortcut:
+        movups  ($ivp),$inout0
+        movups  ($inp),$in0
+        mov     240($key),$rounds               # key->rounds
+.Lctr32_one:
+___
+        &aesni_generate1("enc",$key,$rounds);
+$code.=<<___;
+        xorps   $inout0,$in0
+        movups  $in0,($out)
+        jmp     .Lctr32_done
+
+.align  16
+.Lctr32_two:
+        xorps   $inout2,$inout2
+        call    _aesni_encrypt3
+        xorps   $inout0,$in0
+        xorps   $inout1,$in1
+        movups  $in0,($out)
+        movups  $in1,0x10($out)
+        jmp     .Lctr32_done
+
+.align  16
+.Lctr32_three:
+        call    _aesni_encrypt3
+        xorps   $inout0,$in0
+        xorps   $inout1,$in1
+        movups  $in0,($out)
+        xorps   $inout2,$in2
+        movups  $in1,0x10($out)
+        movups  $in2,0x20($out)
+        jmp     .Lctr32_done
+
+.align  16
+.Lctr32_four:
+        call    _aesni_encrypt4
+        xorps   $inout0,$in0
+        xorps   $inout1,$in1
+        movups  $in0,($out)
+        xorps   $inout2,$in2
+        movups  $in1,0x10($out)
+        xorps   $inout3,$in3
+        movups  $in2,0x20($out)
+        movups  $in3,0x30($out)
+
+.Lctr32_done:
+___
+$code.=<<___ if ($win64);
+        movaps  0x20(%rsp),%xmm6
+        movaps  0x30(%rsp),%xmm7
+        movaps  0x40(%rsp),%xmm8
+        movaps  0x50(%rsp),%xmm9
+        movaps  0x60(%rsp),%xmm10
+        movaps  0x70(%rsp),%xmm11
+        movaps  0x80(%rsp),%xmm12
+        movaps  0x90(%rsp),%xmm13
+        movaps  0xa0(%rsp),%xmm14
+        movaps  0xb0(%rsp),%xmm15
+        lea     0xc8(%rsp),%rsp
+.Lctr32_ret:
+___
+$code.=<<___;
+        ret
+.size   aesni_ctr32_encrypt_blocks,.-aesni_ctr32_encrypt_blocks
+___
 }
 
+######################################################################
+# void aesni_xts_[en|de]crypt(const char *inp,char *out,size_t len,
+#       const AES_KEY *key1, const AES_KEY *key2
+#       const unsigned char iv[16]);
+#
+{
+my @tweak=map("%xmm$_",(10..15));
+my ($twmask,$twres,$twtmp)=("%xmm8","%xmm9",@tweak[4]);
+my ($key2,$ivp,$len_)=("%r8","%r9","%r9");
+my $frame_size = 0x68 + ($win64?160:0);
+
+$code.=<<___;
+.globl  aesni_xts_encrypt
+.type   aesni_xts_encrypt,\@function,6
+.align  16
+aesni_xts_encrypt:
+        lea     -$frame_size(%rsp),%rsp
+___
+$code.=<<___ if ($win64);
+        movaps  %xmm6,0x60(%rsp)
+        movaps  %xmm7,0x70(%rsp)
+        movaps  %xmm8,0x80(%rsp)
+        movaps  %xmm9,0x90(%rsp)
+        movaps  %xmm10,0xa0(%rsp)
+        movaps  %xmm11,0xb0(%rsp)
+        movaps  %xmm12,0xc0(%rsp)
+        movaps  %xmm13,0xd0(%rsp)
+        movaps  %xmm14,0xe0(%rsp)
+        movaps  %xmm15,0xf0(%rsp)
+.Lxts_enc_body:
+___
+$code.=<<___;
+        movups  ($ivp),@tweak[5]                # load clear-text tweak
+        mov     240(%r8),$rounds                # key2->rounds
+        mov     240($key),$rnds_                # key1->rounds
+___
+        # generate the tweak
+        &aesni_generate1("enc",$key2,$rounds,@tweak[5]);
+$code.=<<___;
+        mov     $key,$key_                      # backup $key
+        mov     $rnds_,$rounds                  # backup $rounds
+        mov     $len,$len_                      # backup $len
+        and     \$-16,$len
+
+        movdqa  .Lxts_magic(%rip),$twmask
+        pxor    $twtmp,$twtmp
+        pcmpgtd @tweak[5],$twtmp                # broadcast upper bits
+___
+    for ($i=0;$i<4;$i++) {
+    $code.=<<___;
+        pshufd  \$0x13,$twtmp,$twres
+        pxor    $twtmp,$twtmp
+        movdqa  @tweak[5],@tweak[$i]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+        pand    $twmask,$twres                  # isolate carry and residue
+        pcmpgtd @tweak[5],$twtmp                # broadcat upper bits
+        pxor    $twres,@tweak[5]
+___
+    }
+$code.=<<___;
+        sub     \$16*6,$len
+        jc      .Lxts_enc_short
+
+        shr     \$1,$rounds
+        sub     \$1,$rounds
+        mov     $rounds,$rnds_
+        jmp     .Lxts_enc_grandloop
+
+.align  16
+.Lxts_enc_grandloop:
+        pshufd  \$0x13,$twtmp,$twres
+        movdqa  @tweak[5],@tweak[4]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+        movdqu  `16*0`($inp),$inout0            # load input
+        pand    $twmask,$twres                  # isolate carry and residue
+        movdqu  `16*1`($inp),$inout1
+        pxor    $twres,@tweak[5]
+
+        movdqu  `16*2`($inp),$inout2
+        pxor    @tweak[0],$inout0               # input^=tweak
+        movdqu  `16*3`($inp),$inout3
+        pxor    @tweak[1],$inout1
+        movdqu  `16*4`($inp),$inout4
+        pxor    @tweak[2],$inout2
+        movdqu  `16*5`($inp),$inout5
+        lea     `16*6`($inp),$inp
+        pxor    @tweak[3],$inout3
+        $movkey         ($key_),$rndkey0
+        pxor    @tweak[4],$inout4
+        pxor    @tweak[5],$inout5
+
+        # inline _aesni_encrypt6 and interleave first and last rounds
+        # with own code...
+        $movkey         16($key_),$rndkey1
+        pxor            $rndkey0,$inout0
+        pxor            $rndkey0,$inout1
+         movdqa @tweak[0],`16*0`(%rsp)          # put aside tweaks
+        aesenc          $rndkey1,$inout0
+        lea             32($key_),$key
+        pxor            $rndkey0,$inout2
+         movdqa @tweak[1],`16*1`(%rsp)
+        aesenc          $rndkey1,$inout1
+        pxor            $rndkey0,$inout3
+         movdqa @tweak[2],`16*2`(%rsp)
+        aesenc          $rndkey1,$inout2
+        pxor            $rndkey0,$inout4
+         movdqa @tweak[3],`16*3`(%rsp)
+        aesenc          $rndkey1,$inout3
+        pxor            $rndkey0,$inout5
+        $movkey         ($key),$rndkey0
+        dec             $rounds
+         movdqa @tweak[4],`16*4`(%rsp)
+        aesenc          $rndkey1,$inout4
+         movdqa @tweak[5],`16*5`(%rsp)
+        aesenc          $rndkey1,$inout5
+        pxor    $twtmp,$twtmp
+        pcmpgtd @tweak[5],$twtmp
+        jmp             .Lxts_enc_loop6_enter
+
+.align  16
+.Lxts_enc_loop6:
+        aesenc          $rndkey1,$inout0
+        aesenc          $rndkey1,$inout1
+        dec             $rounds
+        aesenc          $rndkey1,$inout2
+        aesenc          $rndkey1,$inout3
+        aesenc          $rndkey1,$inout4
+        aesenc          $rndkey1,$inout5
+.Lxts_enc_loop6_enter:
+        $movkey         16($key),$rndkey1
+        aesenc          $rndkey0,$inout0
+        aesenc          $rndkey0,$inout1
+        lea             32($key),$key
+        aesenc          $rndkey0,$inout2
+        aesenc          $rndkey0,$inout3
+        aesenc          $rndkey0,$inout4
+        aesenc          $rndkey0,$inout5
+        $movkey         ($key),$rndkey0
+        jnz             .Lxts_enc_loop6
+
+        pshufd  \$0x13,$twtmp,$twres
+        pxor    $twtmp,$twtmp
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         aesenc         $rndkey1,$inout0
+        pand    $twmask,$twres                  # isolate carry and residue
+         aesenc         $rndkey1,$inout1
+        pcmpgtd @tweak[5],$twtmp                # broadcast upper bits
+         aesenc         $rndkey1,$inout2
+        pxor    $twres,@tweak[5]
+         aesenc         $rndkey1,$inout3
+         aesenc         $rndkey1,$inout4
+         aesenc         $rndkey1,$inout5
+         $movkey        16($key),$rndkey1
+
+        pshufd  \$0x13,$twtmp,$twres
+        pxor    $twtmp,$twtmp
+        movdqa  @tweak[5],@tweak[0]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         aesenc         $rndkey0,$inout0
+        pand    $twmask,$twres                  # isolate carry and residue
+         aesenc         $rndkey0,$inout1
+        pcmpgtd @tweak[5],$twtmp                # broadcat upper bits
+         aesenc         $rndkey0,$inout2
+        pxor    $twres,@tweak[5]
+         aesenc         $rndkey0,$inout3
+         aesenc         $rndkey0,$inout4
+         aesenc         $rndkey0,$inout5
+         $movkey        32($key),$rndkey0
+
+        pshufd  \$0x13,$twtmp,$twres
+        pxor    $twtmp,$twtmp
+        movdqa  @tweak[5],@tweak[1]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         aesenc         $rndkey1,$inout0
+        pand    $twmask,$twres                  # isolate carry and residue
+         aesenc         $rndkey1,$inout1
+        pcmpgtd @tweak[5],$twtmp                # broadcat upper bits
+         aesenc         $rndkey1,$inout2
+        pxor    $twres,@tweak[5]
+         aesenc         $rndkey1,$inout3
+         aesenc         $rndkey1,$inout4
+         aesenc         $rndkey1,$inout5
+
+        pshufd  \$0x13,$twtmp,$twres
+        pxor    $twtmp,$twtmp
+        movdqa  @tweak[5],@tweak[2]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         aesenclast     $rndkey0,$inout0
+        pand    $twmask,$twres                  # isolate carry and residue
+         aesenclast     $rndkey0,$inout1
+        pcmpgtd @tweak[5],$twtmp                # broadcat upper bits
+         aesenclast     $rndkey0,$inout2
+        pxor    $twres,@tweak[5]
+         aesenclast     $rndkey0,$inout3
+         aesenclast     $rndkey0,$inout4
+         aesenclast     $rndkey0,$inout5
+
+        pshufd  \$0x13,$twtmp,$twres
+        pxor    $twtmp,$twtmp
+        movdqa  @tweak[5],@tweak[3]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         xorps  `16*0`(%rsp),$inout0            # output^=tweak
+        pand    $twmask,$twres                  # isolate carry and residue
+         xorps  `16*1`(%rsp),$inout1
+        pcmpgtd @tweak[5],$twtmp                # broadcat upper bits
+        pxor    $twres,@tweak[5]
+
+        xorps   `16*2`(%rsp),$inout2
+        movups  $inout0,`16*0`($out)            # write output
+        xorps   `16*3`(%rsp),$inout3
+        movups  $inout1,`16*1`($out)
+        xorps   `16*4`(%rsp),$inout4
+        movups  $inout2,`16*2`($out)
+        xorps   `16*5`(%rsp),$inout5
+        movups  $inout3,`16*3`($out)
+        mov     $rnds_,$rounds                  # restore $rounds
+        movups  $inout4,`16*4`($out)
+        movups  $inout5,`16*5`($out)
+        lea     `16*6`($out),$out
+        sub     \$16*6,$len
+        jnc     .Lxts_enc_grandloop
+
+        lea     3($rounds,$rounds),$rounds      # restore original value
+        mov     $key_,$key                      # restore $key
+        mov     $rounds,$rnds_                  # backup $rounds
+
+.Lxts_enc_short:
+        add     \$16*6,$len
+        jz      .Lxts_enc_done
+
+        cmp     \$0x20,$len
+        jb      .Lxts_enc_one
+        je      .Lxts_enc_two
+
+        cmp     \$0x40,$len
+        jb      .Lxts_enc_three
+        je      .Lxts_enc_four
+
+        pshufd  \$0x13,$twtmp,$twres
+        movdqa  @tweak[5],@tweak[4]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         movdqu ($inp),$inout0
+        pand    $twmask,$twres                  # isolate carry and residue
+         movdqu 16*1($inp),$inout1
+        pxor    $twres,@tweak[5]
+
+        movdqu  16*2($inp),$inout2
+        pxor    @tweak[0],$inout0
+        movdqu  16*3($inp),$inout3
+        pxor    @tweak[1],$inout1
+        movdqu  16*4($inp),$inout4
+        lea     16*5($inp),$inp
+        pxor    @tweak[2],$inout2
+        pxor    @tweak[3],$inout3
+        pxor    @tweak[4],$inout4
+
+        call    _aesni_encrypt6
+
+        xorps   @tweak[0],$inout0
+        movdqa  @tweak[5],@tweak[0]
+        xorps   @tweak[1],$inout1
+        xorps   @tweak[2],$inout2
+        movdqu  $inout0,($out)
+        xorps   @tweak[3],$inout3
+        movdqu  $inout1,16*1($out)
+        xorps   @tweak[4],$inout4
+        movdqu  $inout2,16*2($out)
+        movdqu  $inout3,16*3($out)
+        movdqu  $inout4,16*4($out)
+        lea     16*5($out),$out
+        jmp     .Lxts_enc_done
+
+.align  16
+.Lxts_enc_one:
+        movups  ($inp),$inout0
+        lea     16*1($inp),$inp
+        xorps   @tweak[0],$inout0
+___
+        &aesni_generate1("enc",$key,$rounds);
+$code.=<<___;
+        xorps   @tweak[0],$inout0
+        movdqa  @tweak[1],@tweak[0]
+        movups  $inout0,($out)
+        lea     16*1($out),$out
+        jmp     .Lxts_enc_done
+
+.align  16
+.Lxts_enc_two:
+        movups  ($inp),$inout0
+        movups  16($inp),$inout1
+        lea     32($inp),$inp
+        xorps   @tweak[0],$inout0
+        xorps   @tweak[1],$inout1
+
+        call    _aesni_encrypt3
+
+        xorps   @tweak[0],$inout0
+        movdqa  @tweak[2],@tweak[0]
+        xorps   @tweak[1],$inout1
+        movups  $inout0,($out)
+        movups  $inout1,16*1($out)
+        lea     16*2($out),$out
+        jmp     .Lxts_enc_done
+
+.align  16
+.Lxts_enc_three:
+        movups  ($inp),$inout0
+        movups  16*1($inp),$inout1
+        movups  16*2($inp),$inout2
+        lea     16*3($inp),$inp
+        xorps   @tweak[0],$inout0
+        xorps   @tweak[1],$inout1
+        xorps   @tweak[2],$inout2
+
+        call    _aesni_encrypt3
+
+        xorps   @tweak[0],$inout0
+        movdqa  @tweak[3],@tweak[0]
+        xorps   @tweak[1],$inout1
+        xorps   @tweak[2],$inout2
+        movups  $inout0,($out)
+        movups  $inout1,16*1($out)
+        movups  $inout2,16*2($out)
+        lea     16*3($out),$out
+        jmp     .Lxts_enc_done
+
+.align  16
+.Lxts_enc_four:
+        movups  ($inp),$inout0
+        movups  16*1($inp),$inout1
+        movups  16*2($inp),$inout2
+        xorps   @tweak[0],$inout0
+        movups  16*3($inp),$inout3
+        lea     16*4($inp),$inp
+        xorps   @tweak[1],$inout1
+        xorps   @tweak[2],$inout2
+        xorps   @tweak[3],$inout3
+
+        call    _aesni_encrypt4
+
+        xorps   @tweak[0],$inout0
+        movdqa  @tweak[5],@tweak[0]
+        xorps   @tweak[1],$inout1
+        xorps   @tweak[2],$inout2
+        movups  $inout0,($out)
+        xorps   @tweak[3],$inout3
+        movups  $inout1,16*1($out)
+        movups  $inout2,16*2($out)
+        movups  $inout3,16*3($out)
+        lea     16*4($out),$out
+        jmp     .Lxts_enc_done
+
+.align  16
+.Lxts_enc_done:
+        and     \$15,$len_
+        jz      .Lxts_enc_ret
+        mov     $len_,$len
+
+.Lxts_enc_steal:
+        movzb   ($inp),%eax                     # borrow $rounds ...
+        movzb   -16($out),%ecx                  # ... and $key
+        lea     1($inp),$inp
+        mov     %al,-16($out)
+        mov     %cl,0($out)
+        lea     1($out),$out
+        sub     \$1,$len
+        jnz     .Lxts_enc_steal
+
+        sub     $len_,$out                      # rewind $out
+        mov     $key_,$key                      # restore $key
+        mov     $rnds_,$rounds                  # restore $rounds
+
+        movups  -16($out),$inout0
+        xorps   @tweak[0],$inout0
+___
+        &aesni_generate1("enc",$key,$rounds);
+$code.=<<___;
+        xorps   @tweak[0],$inout0
+        movups  $inout0,-16($out)
+
+.Lxts_enc_ret:
+___
+$code.=<<___ if ($win64);
+        movaps  0x60(%rsp),%xmm6
+        movaps  0x70(%rsp),%xmm7
+        movaps  0x80(%rsp),%xmm8
+        movaps  0x90(%rsp),%xmm9
+        movaps  0xa0(%rsp),%xmm10
+        movaps  0xb0(%rsp),%xmm11
+        movaps  0xc0(%rsp),%xmm12
+        movaps  0xd0(%rsp),%xmm13
+        movaps  0xe0(%rsp),%xmm14
+        movaps  0xf0(%rsp),%xmm15
+___
+$code.=<<___;
+        lea     $frame_size(%rsp),%rsp
+.Lxts_enc_epilogue:
+        ret
+.size   aesni_xts_encrypt,.-aesni_xts_encrypt
+___
+
+$code.=<<___;
+.globl  aesni_xts_decrypt
+.type   aesni_xts_decrypt,\@function,6
+.align  16
+aesni_xts_decrypt:
+        lea     -$frame_size(%rsp),%rsp
+___
+$code.=<<___ if ($win64);
+        movaps  %xmm6,0x60(%rsp)
+        movaps  %xmm7,0x70(%rsp)
+        movaps  %xmm8,0x80(%rsp)
+        movaps  %xmm9,0x90(%rsp)
+        movaps  %xmm10,0xa0(%rsp)
+        movaps  %xmm11,0xb0(%rsp)
+        movaps  %xmm12,0xc0(%rsp)
+        movaps  %xmm13,0xd0(%rsp)
+        movaps  %xmm14,0xe0(%rsp)
+        movaps  %xmm15,0xf0(%rsp)
+.Lxts_dec_body:
+___
+$code.=<<___;
+        movups  ($ivp),@tweak[5]                # load clear-text tweak
+        mov     240($key2),$rounds              # key2->rounds
+        mov     240($key),$rnds_                # key1->rounds
+___
+        # generate the tweak
+        &aesni_generate1("enc",$key2,$rounds,@tweak[5]);
+$code.=<<___;
+        xor     %eax,%eax                       # if ($len%16) len-=16;
+        test    \$15,$len
+        setnz   %al
+        shl     \$4,%rax
+        sub     %rax,$len
+
+        mov     $key,$key_                      # backup $key
+        mov     $rnds_,$rounds                  # backup $rounds
+        mov     $len,$len_                      # backup $len
+        and     \$-16,$len
+
+        movdqa  .Lxts_magic(%rip),$twmask
+        pxor    $twtmp,$twtmp
+        pcmpgtd @tweak[5],$twtmp                # broadcast upper bits
+___
+    for ($i=0;$i<4;$i++) {
+    $code.=<<___;
+        pshufd  \$0x13,$twtmp,$twres
+        pxor    $twtmp,$twtmp
+        movdqa  @tweak[5],@tweak[$i]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+        pand    $twmask,$twres                  # isolate carry and residue
+        pcmpgtd @tweak[5],$twtmp                # broadcat upper bits
+        pxor    $twres,@tweak[5]
+___
+    }
+$code.=<<___;
+        sub     \$16*6,$len
+        jc      .Lxts_dec_short
+
+        shr     \$1,$rounds
+        sub     \$1,$rounds
+        mov     $rounds,$rnds_
+        jmp     .Lxts_dec_grandloop
+
+.align  16
+.Lxts_dec_grandloop:
+        pshufd  \$0x13,$twtmp,$twres
+        movdqa  @tweak[5],@tweak[4]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+        movdqu  `16*0`($inp),$inout0            # load input
+        pand    $twmask,$twres                  # isolate carry and residue
+        movdqu  `16*1`($inp),$inout1
+        pxor    $twres,@tweak[5]
+
+        movdqu  `16*2`($inp),$inout2
+        pxor    @tweak[0],$inout0               # input^=tweak
+        movdqu  `16*3`($inp),$inout3
+        pxor    @tweak[1],$inout1
+        movdqu  `16*4`($inp),$inout4
+        pxor    @tweak[2],$inout2
+        movdqu  `16*5`($inp),$inout5
+        lea     `16*6`($inp),$inp
+        pxor    @tweak[3],$inout3
+        $movkey         ($key_),$rndkey0
+        pxor    @tweak[4],$inout4
+        pxor    @tweak[5],$inout5
+
+        # inline _aesni_decrypt6 and interleave first and last rounds
+        # with own code...
+        $movkey         16($key_),$rndkey1
+        pxor            $rndkey0,$inout0
+        pxor            $rndkey0,$inout1
+         movdqa @tweak[0],`16*0`(%rsp)          # put aside tweaks
+        aesdec          $rndkey1,$inout0
+        lea             32($key_),$key
+        pxor            $rndkey0,$inout2
+         movdqa @tweak[1],`16*1`(%rsp)
+        aesdec          $rndkey1,$inout1
+        pxor            $rndkey0,$inout3
+         movdqa @tweak[2],`16*2`(%rsp)
+        aesdec          $rndkey1,$inout2
+        pxor            $rndkey0,$inout4
+         movdqa @tweak[3],`16*3`(%rsp)
+        aesdec          $rndkey1,$inout3
+        pxor            $rndkey0,$inout5
+        $movkey         ($key),$rndkey0
+        dec             $rounds
+         movdqa @tweak[4],`16*4`(%rsp)
+        aesdec          $rndkey1,$inout4
+         movdqa @tweak[5],`16*5`(%rsp)
+        aesdec          $rndkey1,$inout5
+        pxor    $twtmp,$twtmp
+        pcmpgtd @tweak[5],$twtmp
+        jmp             .Lxts_dec_loop6_enter
+
+.align  16
+.Lxts_dec_loop6:
+        aesdec          $rndkey1,$inout0
+        aesdec          $rndkey1,$inout1
+        dec             $rounds
+        aesdec          $rndkey1,$inout2
+        aesdec          $rndkey1,$inout3
+        aesdec          $rndkey1,$inout4
+        aesdec          $rndkey1,$inout5
+.Lxts_dec_loop6_enter:
+        $movkey         16($key),$rndkey1
+        aesdec          $rndkey0,$inout0
+        aesdec          $rndkey0,$inout1
+        lea             32($key),$key
+        aesdec          $rndkey0,$inout2
+        aesdec          $rndkey0,$inout3
+        aesdec          $rndkey0,$inout4
+        aesdec          $rndkey0,$inout5
+        $movkey         ($key),$rndkey0
+        jnz             .Lxts_dec_loop6
+
+        pshufd  \$0x13,$twtmp,$twres
+        pxor    $twtmp,$twtmp
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         aesdec         $rndkey1,$inout0
+        pand    $twmask,$twres                  # isolate carry and residue
+         aesdec         $rndkey1,$inout1
+        pcmpgtd @tweak[5],$twtmp                # broadcast upper bits
+         aesdec         $rndkey1,$inout2
+        pxor    $twres,@tweak[5]
+         aesdec         $rndkey1,$inout3
+         aesdec         $rndkey1,$inout4
+         aesdec         $rndkey1,$inout5
+         $movkey        16($key),$rndkey1
+
+        pshufd  \$0x13,$twtmp,$twres
+        pxor    $twtmp,$twtmp
+        movdqa  @tweak[5],@tweak[0]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         aesdec         $rndkey0,$inout0
+        pand    $twmask,$twres                  # isolate carry and residue
+         aesdec         $rndkey0,$inout1
+        pcmpgtd @tweak[5],$twtmp                # broadcat upper bits
+         aesdec         $rndkey0,$inout2
+        pxor    $twres,@tweak[5]
+         aesdec         $rndkey0,$inout3
+         aesdec         $rndkey0,$inout4
+         aesdec         $rndkey0,$inout5
+         $movkey        32($key),$rndkey0
+
+        pshufd  \$0x13,$twtmp,$twres
+        pxor    $twtmp,$twtmp
+        movdqa  @tweak[5],@tweak[1]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         aesdec         $rndkey1,$inout0
+        pand    $twmask,$twres                  # isolate carry and residue
+         aesdec         $rndkey1,$inout1
+        pcmpgtd @tweak[5],$twtmp                # broadcat upper bits
+         aesdec         $rndkey1,$inout2
+        pxor    $twres,@tweak[5]
+         aesdec         $rndkey1,$inout3
+         aesdec         $rndkey1,$inout4
+         aesdec         $rndkey1,$inout5
+
+        pshufd  \$0x13,$twtmp,$twres
+        pxor    $twtmp,$twtmp
+        movdqa  @tweak[5],@tweak[2]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         aesdeclast     $rndkey0,$inout0
+        pand    $twmask,$twres                  # isolate carry and residue
+         aesdeclast     $rndkey0,$inout1
+        pcmpgtd @tweak[5],$twtmp                # broadcat upper bits
+         aesdeclast     $rndkey0,$inout2
+        pxor    $twres,@tweak[5]
+         aesdeclast     $rndkey0,$inout3
+         aesdeclast     $rndkey0,$inout4
+         aesdeclast     $rndkey0,$inout5
+
+        pshufd  \$0x13,$twtmp,$twres
+        pxor    $twtmp,$twtmp
+        movdqa  @tweak[5],@tweak[3]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         xorps  `16*0`(%rsp),$inout0            # output^=tweak
+        pand    $twmask,$twres                  # isolate carry and residue
+         xorps  `16*1`(%rsp),$inout1
+        pcmpgtd @tweak[5],$twtmp                # broadcat upper bits
+        pxor    $twres,@tweak[5]
+
+        xorps   `16*2`(%rsp),$inout2
+        movups  $inout0,`16*0`($out)            # write output
+        xorps   `16*3`(%rsp),$inout3
+        movups  $inout1,`16*1`($out)
+        xorps   `16*4`(%rsp),$inout4
+        movups  $inout2,`16*2`($out)
+        xorps   `16*5`(%rsp),$inout5
+        movups  $inout3,`16*3`($out)
+        mov     $rnds_,$rounds                  # restore $rounds
+        movups  $inout4,`16*4`($out)
+        movups  $inout5,`16*5`($out)
+        lea     `16*6`($out),$out
+        sub     \$16*6,$len
+        jnc     .Lxts_dec_grandloop
+
+        lea     3($rounds,$rounds),$rounds      # restore original value
+        mov     $key_,$key                      # restore $key
+        mov     $rounds,$rnds_                  # backup $rounds
+
+.Lxts_dec_short:
+        add     \$16*6,$len
+        jz      .Lxts_dec_done
+
+        cmp     \$0x20,$len
+        jb      .Lxts_dec_one
+        je      .Lxts_dec_two
+
+        cmp     \$0x40,$len
+        jb      .Lxts_dec_three
+        je      .Lxts_dec_four
+
+        pshufd  \$0x13,$twtmp,$twres
+        movdqa  @tweak[5],@tweak[4]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         movdqu ($inp),$inout0
+        pand    $twmask,$twres                  # isolate carry and residue
+         movdqu 16*1($inp),$inout1
+        pxor    $twres,@tweak[5]
+
+        movdqu  16*2($inp),$inout2
+        pxor    @tweak[0],$inout0
+        movdqu  16*3($inp),$inout3
+        pxor    @tweak[1],$inout1
+        movdqu  16*4($inp),$inout4
+        lea     16*5($inp),$inp
+        pxor    @tweak[2],$inout2
+        pxor    @tweak[3],$inout3
+        pxor    @tweak[4],$inout4
+
+        call    _aesni_decrypt6
+
+        xorps   @tweak[0],$inout0
+        xorps   @tweak[1],$inout1
+        xorps   @tweak[2],$inout2
+        movdqu  $inout0,($out)
+        xorps   @tweak[3],$inout3
+        movdqu  $inout1,16*1($out)
+        xorps   @tweak[4],$inout4
+        movdqu  $inout2,16*2($out)
+         pxor           $twtmp,$twtmp
+        movdqu  $inout3,16*3($out)
+         pcmpgtd        @tweak[5],$twtmp
+        movdqu  $inout4,16*4($out)
+        lea     16*5($out),$out
+         pshufd         \$0x13,$twtmp,@tweak[1] # $twres
+        and     \$15,$len_
+        jz      .Lxts_dec_ret
+
+        movdqa  @tweak[5],@tweak[0]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+        pand    $twmask,@tweak[1]               # isolate carry and residue
+        pxor    @tweak[5],@tweak[1]
+        jmp     .Lxts_dec_done2
+
+.align  16
+.Lxts_dec_one:
+        movups  ($inp),$inout0
+        lea     16*1($inp),$inp
+        xorps   @tweak[0],$inout0
+___
+        &aesni_generate1("dec",$key,$rounds);
+$code.=<<___;
+        xorps   @tweak[0],$inout0
+        movdqa  @tweak[1],@tweak[0]
+        movups  $inout0,($out)
+        movdqa  @tweak[2],@tweak[1]
+        lea     16*1($out),$out
+        jmp     .Lxts_dec_done
+
+.align  16
+.Lxts_dec_two:
+        movups  ($inp),$inout0
+        movups  16($inp),$inout1
+        lea     32($inp),$inp
+        xorps   @tweak[0],$inout0
+        xorps   @tweak[1],$inout1
+
+        call    _aesni_decrypt3
+
+        xorps   @tweak[0],$inout0
+        movdqa  @tweak[2],@tweak[0]
+        xorps   @tweak[1],$inout1
+        movdqa  @tweak[3],@tweak[1]
+        movups  $inout0,($out)
+        movups  $inout1,16*1($out)
+        lea     16*2($out),$out
+        jmp     .Lxts_dec_done
+
+.align  16
+.Lxts_dec_three:
+        movups  ($inp),$inout0
+        movups  16*1($inp),$inout1
+        movups  16*2($inp),$inout2
+        lea     16*3($inp),$inp
+        xorps   @tweak[0],$inout0
+        xorps   @tweak[1],$inout1
+        xorps   @tweak[2],$inout2
+
+        call    _aesni_decrypt3
+
+        xorps   @tweak[0],$inout0
+        movdqa  @tweak[3],@tweak[0]
+        xorps   @tweak[1],$inout1
+        movdqa  @tweak[5],@tweak[1]
+        xorps   @tweak[2],$inout2
+        movups  $inout0,($out)
+        movups  $inout1,16*1($out)
+        movups  $inout2,16*2($out)
+        lea     16*3($out),$out
+        jmp     .Lxts_dec_done
+
+.align  16
+.Lxts_dec_four:
+        pshufd  \$0x13,$twtmp,$twres
+        movdqa  @tweak[5],@tweak[4]
+        paddq   @tweak[5],@tweak[5]             # psllq 1,$tweak
+         movups ($inp),$inout0
+        pand    $twmask,$twres                  # isolate carry and residue
+         movups 16*1($inp),$inout1
+        pxor    $twres,@tweak[5]
+
+        movups  16*2($inp),$inout2
+        xorps   @tweak[0],$inout0
+        movups  16*3($inp),$inout3
+        lea     16*4($inp),$inp
+        xorps   @tweak[1],$inout1
+        xorps   @tweak[2],$inout2
+        xorps   @tweak[3],$inout3
+
+        call    _aesni_decrypt4
+
+        xorps   @tweak[0],$inout0
+        movdqa  @tweak[4],@tweak[0]
+        xorps   @tweak[1],$inout1
+        movdqa  @tweak[5],@tweak[1]
+        xorps   @tweak[2],$inout2
+        movups  $inout0,($out)
+        xorps   @tweak[3],$inout3
+        movups  $inout1,16*1($out)
+        movups  $inout2,16*2($out)
+        movups  $inout3,16*3($out)
+        lea     16*4($out),$out
+        jmp     .Lxts_dec_done
+
+.align  16
+.Lxts_dec_done:
+        and     \$15,$len_
+        jz      .Lxts_dec_ret
+.Lxts_dec_done2:
+        mov     $len_,$len
+        mov     $key_,$key                      # restore $key
+        mov     $rnds_,$rounds                  # restore $rounds
+
+        movups  ($inp),$inout0
+        xorps   @tweak[1],$inout0
+___
+        &aesni_generate1("dec",$key,$rounds);
+$code.=<<___;
+        xorps   @tweak[1],$inout0
+        movups  $inout0,($out)
+
+.Lxts_dec_steal:
+        movzb   16($inp),%eax                   # borrow $rounds ...
+        movzb   ($out),%ecx                     # ... and $key
+        lea     1($inp),$inp
+        mov     %al,($out)
+        mov     %cl,16($out)
+        lea     1($out),$out
+        sub     \$1,$len
+        jnz     .Lxts_dec_steal
+
+        sub     $len_,$out                      # rewind $out
+        mov     $key_,$key                      # restore $key
+        mov     $rnds_,$rounds                  # restore $rounds
+
+        movups  ($out),$inout0
+        xorps   @tweak[0],$inout0
+___
+        &aesni_generate1("dec",$key,$rounds);
+$code.=<<___;
+        xorps   @tweak[0],$inout0
+        movups  $inout0,($out)
+
+.Lxts_dec_ret:
+___
+$code.=<<___ if ($win64);
+        movaps  0x60(%rsp),%xmm6
+        movaps  0x70(%rsp),%xmm7
+        movaps  0x80(%rsp),%xmm8
+        movaps  0x90(%rsp),%xmm9
+        movaps  0xa0(%rsp),%xmm10
+        movaps  0xb0(%rsp),%xmm11
+        movaps  0xc0(%rsp),%xmm12
+        movaps  0xd0(%rsp),%xmm13
+        movaps  0xe0(%rsp),%xmm14
+        movaps  0xf0(%rsp),%xmm15
+___
+$code.=<<___;
+        lea     $frame_size(%rsp),%rsp
+.Lxts_dec_epilogue:
+        ret
+.size   aesni_xts_decrypt,.-aesni_xts_decrypt
+___
+} }}
+
+########################################################################
 # void $PREFIX_cbc_encrypt (const void *inp, void *out,
 #                           size_t length, const AES_KEY *key,
 #                           unsigned char *ivp,const int enc);
-$reserved = $win64?0x40:-0x18;  # used in decrypt
+{
+my $reserved = $win64?0x40:-0x18;       # used in decrypt
 $code.=<<___;
 .globl  ${PREFIX}_cbc_encrypt
 .type   ${PREFIX}_cbc_encrypt,\@function,6
@@ -371,30 +2129,30 @@ ${PREFIX}_cbc_encrypt:
         test    $len,$len               # check length
         jz      .Lcbc_ret
 
-        mov     240($key),$rnds_        # pull $rounds
+        mov     240($key),$rnds_        # key->rounds
         mov     $key,$key_              # backup $key
         test    %r9d,%r9d               # 6th argument
         jz      .Lcbc_decrypt
 #--------------------------- CBC ENCRYPT ------------------------------#
         movups  ($ivp),$inout0          # load iv as initial state
-        cmp     \$16,$len
         mov     $rnds_,$rounds
+        cmp     \$16,$len
         jb      .Lcbc_enc_tail
         sub     \$16,$len
         jmp     .Lcbc_enc_loop
-.align 16
+.align  16
 .Lcbc_enc_loop:
         movups  ($inp),$inout1          # load input
         lea     16($inp),$inp
-        pxor    $inout1,$inout0
+        #xorps  $inout1,$inout0
 ___
-        &aesni_generate1("enc",$key,$rounds);
+        &aesni_generate1("enc",$key,$rounds,$inout0,$inout1);
 $code.=<<___;
-        sub     \$16,$len
-        lea     16($out),$out
         mov     $rnds_,$rounds          # restore $rounds
         mov     $key_,$key              # restore $key
-        movups  $inout0,-16($out)       # store output
+        movups  $inout0,0($out)         # store output
+        lea     16($out),$out
+        sub     \$16,$len
         jnc     .Lcbc_enc_loop
         add     \$16,$len
         jnz     .Lcbc_enc_tail
@@ -429,92 +2187,238 @@ $code.=<<___ if ($win64);
 ___
 $code.=<<___;
         movups  ($ivp),$iv
-        sub     \$0x40,$len
         mov     $rnds_,$rounds
+        cmp     \$0x70,$len
         jbe     .Lcbc_dec_tail
-        jmp     .Lcbc_dec_loop3
-.align 16
-.Lcbc_dec_loop3:
-        movups  ($inp),$inout0
+        shr     \$1,$rnds_
+        sub     \$0x70,$len
+        mov     $rnds_,$rounds
+        movaps  $iv,$reserved(%rsp)
+        jmp     .Lcbc_dec_loop8_enter
+.align  16
+.Lcbc_dec_loop8:
+        movaps  $rndkey0,$reserved(%rsp)        # save IV
+        movups  $inout7,($out)
+        lea     0x10($out),$out
+.Lcbc_dec_loop8_enter:
+        $movkey         ($key),$rndkey0
+        movups  ($inp),$inout0                  # load input
         movups  0x10($inp),$inout1
-        movups  0x20($inp),$inout2
-        movaps  $inout0,$in0
-        movaps  $inout1,$in1
-        movaps  $inout2,$in2
-        call    _aesni_decrypt3
-        sub     \$0x30,$len
-        lea     0x30($inp),$inp
-        lea     0x30($out),$out
-        pxor    $iv,$inout0
-        pxor    $in0,$inout1
-        movaps  $in2,$iv
-        pxor    $in1,$inout2
-        movups  $inout0,-0x30($out)
-        mov     $rnds_,$rounds  # restore $rounds
-        movups  $inout1,-0x20($out)
-        mov     $key_,$key      # restore $key
-        movups  $inout2,-0x10($out)
-        ja      .Lcbc_dec_loop3
+        $movkey         16($key),$rndkey1
 
-.Lcbc_dec_tail:
-        add     \$0x40,$len
-        movups  $iv,($ivp)
-        jz      .Lcbc_dec_ret
+        lea             32($key),$key
+        movdqu  0x20($inp),$inout2
+        xorps           $rndkey0,$inout0
+        movdqu  0x30($inp),$inout3
+        xorps           $rndkey0,$inout1
+        movdqu  0x40($inp),$inout4
+        aesdec          $rndkey1,$inout0
+        pxor            $rndkey0,$inout2
+        movdqu  0x50($inp),$inout5
+        aesdec          $rndkey1,$inout1
+        pxor            $rndkey0,$inout3
+        movdqu  0x60($inp),$inout6
+        aesdec          $rndkey1,$inout2
+        pxor            $rndkey0,$inout4
+        movdqu  0x70($inp),$inout7
+        aesdec          $rndkey1,$inout3
+        pxor            $rndkey0,$inout5
+        dec             $rounds
+        aesdec          $rndkey1,$inout4
+        pxor            $rndkey0,$inout6
+        aesdec          $rndkey1,$inout5
+        pxor            $rndkey0,$inout7
+        $movkey         ($key),$rndkey0
+        aesdec          $rndkey1,$inout6
+        aesdec          $rndkey1,$inout7
+        $movkey         16($key),$rndkey1
 
+        call            .Ldec_loop8_enter
+
+        movups  ($inp),$rndkey1         # re-load input
+        movups  0x10($inp),$rndkey0
+        xorps   $reserved(%rsp),$inout0 # ^= IV
+        xorps   $rndkey1,$inout1
+        movups  0x20($inp),$rndkey1
+        xorps   $rndkey0,$inout2
+        movups  0x30($inp),$rndkey0
+        xorps   $rndkey1,$inout3
+        movups  0x40($inp),$rndkey1
+        xorps   $rndkey0,$inout4
+        movups  0x50($inp),$rndkey0
+        xorps   $rndkey1,$inout5
+        movups  0x60($inp),$rndkey1
+        xorps   $rndkey0,$inout6
+        movups  0x70($inp),$rndkey0     # IV
+        xorps   $rndkey1,$inout7
+        movups  $inout0,($out)
+        movups  $inout1,0x10($out)
+        movups  $inout2,0x20($out)
+        movups  $inout3,0x30($out)
+        mov     $rnds_,$rounds          # restore $rounds
+        movups  $inout4,0x40($out)
+        mov     $key_,$key              # restore $key
+        movups  $inout5,0x50($out)
+        lea     0x80($inp),$inp
+        movups  $inout6,0x60($out)
+        lea     0x70($out),$out
+        sub     \$0x80,$len
+        ja      .Lcbc_dec_loop8
+
+        movaps  $inout7,$inout0
+        movaps  $rndkey0,$iv
+        add     \$0x70,$len
+        jle     .Lcbc_dec_tail_collected
+        movups  $inout0,($out)
+        lea     1($rnds_,$rnds_),$rounds
+        lea     0x10($out),$out
+.Lcbc_dec_tail:
         movups  ($inp),$inout0
-        cmp     \$0x10,$len
         movaps  $inout0,$in0
+        cmp     \$0x10,$len
         jbe     .Lcbc_dec_one
+
         movups  0x10($inp),$inout1
-        cmp     \$0x20,$len
         movaps  $inout1,$in1
+        cmp     \$0x20,$len
         jbe     .Lcbc_dec_two
+
         movups  0x20($inp),$inout2
-        cmp     \$0x30,$len
         movaps  $inout2,$in2
+        cmp     \$0x30,$len
         jbe     .Lcbc_dec_three
+
         movups  0x30($inp),$inout3
-        call    _aesni_decrypt4
-        pxor    $iv,$inout0
-        movups  0x30($inp),$iv
-        pxor    $in0,$inout1
+        cmp     \$0x40,$len
+        jbe     .Lcbc_dec_four
+
+        movups  0x40($inp),$inout4
+        cmp     \$0x50,$len
+        jbe     .Lcbc_dec_five
+
+        movups  0x50($inp),$inout5
+        cmp     \$0x60,$len
+        jbe     .Lcbc_dec_six
+
+        movups  0x60($inp),$inout6
+        movaps  $iv,$reserved(%rsp)     # save IV
+        call    _aesni_decrypt8
+        movups  ($inp),$rndkey1
+        movups  0x10($inp),$rndkey0
+        xorps   $reserved(%rsp),$inout0 # ^= IV
+        xorps   $rndkey1,$inout1
+        movups  0x20($inp),$rndkey1
+        xorps   $rndkey0,$inout2
+        movups  0x30($inp),$rndkey0
+        xorps   $rndkey1,$inout3
+        movups  0x40($inp),$rndkey1
+        xorps   $rndkey0,$inout4
+        movups  0x50($inp),$rndkey0
+        xorps   $rndkey1,$inout5
+        movups  0x60($inp),$iv          # IV
+        xorps   $rndkey0,$inout6
         movups  $inout0,($out)
-        pxor    $in1,$inout2
         movups  $inout1,0x10($out)
-        pxor    $in2,$inout3
         movups  $inout2,0x20($out)
-        movaps  $inout3,$inout0
-        lea     0x30($out),$out
+        movups  $inout3,0x30($out)
+        movups  $inout4,0x40($out)
+        movups  $inout5,0x50($out)
+        lea     0x60($out),$out
+        movaps  $inout6,$inout0
+        sub     \$0x70,$len
         jmp     .Lcbc_dec_tail_collected
 .align  16
 .Lcbc_dec_one:
 ___
         &aesni_generate1("dec",$key,$rounds);
 $code.=<<___;
-        pxor    $iv,$inout0
+        xorps   $iv,$inout0
         movaps  $in0,$iv
+        sub     \$0x10,$len
         jmp     .Lcbc_dec_tail_collected
 .align  16
 .Lcbc_dec_two:
+        xorps   $inout2,$inout2
         call    _aesni_decrypt3
-        pxor    $iv,$inout0
-        pxor    $in0,$inout1
+        xorps   $iv,$inout0
+        xorps   $in0,$inout1
         movups  $inout0,($out)
         movaps  $in1,$iv
         movaps  $inout1,$inout0
         lea     0x10($out),$out
+        sub     \$0x20,$len
         jmp     .Lcbc_dec_tail_collected
 .align  16
 .Lcbc_dec_three:
         call    _aesni_decrypt3
-        pxor    $iv,$inout0
-        pxor    $in0,$inout1
+        xorps   $iv,$inout0
+        xorps   $in0,$inout1
         movups  $inout0,($out)
-        pxor    $in1,$inout2
+        xorps   $in1,$inout2
         movups  $inout1,0x10($out)
         movaps  $in2,$iv
         movaps  $inout2,$inout0
         lea     0x20($out),$out
+        sub     \$0x30,$len
+        jmp     .Lcbc_dec_tail_collected
+.align  16
+.Lcbc_dec_four:
+        call    _aesni_decrypt4
+        xorps   $iv,$inout0
+        movups  0x30($inp),$iv
+        xorps   $in0,$inout1
+        movups  $inout0,($out)
+        xorps   $in1,$inout2
+        movups  $inout1,0x10($out)
+        xorps   $in2,$inout3
+        movups  $inout2,0x20($out)
+        movaps  $inout3,$inout0
+        lea     0x30($out),$out
+        sub     \$0x40,$len
+        jmp     .Lcbc_dec_tail_collected
+.align  16
+.Lcbc_dec_five:
+        xorps   $inout5,$inout5
+        call    _aesni_decrypt6
+        movups  0x10($inp),$rndkey1
+        movups  0x20($inp),$rndkey0
+        xorps   $iv,$inout0
+        xorps   $in0,$inout1
+        xorps   $rndkey1,$inout2
+        movups  0x30($inp),$rndkey1
+        xorps   $rndkey0,$inout3
+        movups  0x40($inp),$iv
+        xorps   $rndkey1,$inout4
+        movups  $inout0,($out)
+        movups  $inout1,0x10($out)
+        movups  $inout2,0x20($out)
+        movups  $inout3,0x30($out)
+        lea     0x40($out),$out
+        movaps  $inout4,$inout0
+        sub     \$0x50,$len
+        jmp     .Lcbc_dec_tail_collected
+.align  16
+.Lcbc_dec_six:
+        call    _aesni_decrypt6
+        movups  0x10($inp),$rndkey1
+        movups  0x20($inp),$rndkey0
+        xorps   $iv,$inout0
+        xorps   $in0,$inout1
+        xorps   $rndkey1,$inout2
+        movups  0x30($inp),$rndkey1
+        xorps   $rndkey0,$inout3
+        movups  0x40($inp),$rndkey0
+        xorps   $rndkey1,$inout4
+        movups  0x50($inp),$iv
+        xorps   $rndkey0,$inout5
+        movups  $inout0,($out)
+        movups  $inout1,0x10($out)
+        movups  $inout2,0x20($out)
+        movups  $inout3,0x30($out)
+        movups  $inout4,0x40($out)
+        lea     0x50($out),$out
+        movaps  $inout5,$inout0
+        sub     \$0x60,$len
         jmp     .Lcbc_dec_tail_collected
 .align  16
 .Lcbc_dec_tail_collected:
@@ -523,10 +2427,12 @@ $code.=<<___;
         jnz     .Lcbc_dec_tail_partial
         movups  $inout0,($out)
         jmp     .Lcbc_dec_ret
+.align  16
 .Lcbc_dec_tail_partial:
         movaps  $inout0,$reserved(%rsp)
+        mov     \$16,%rcx
         mov     $out,%rdi
-        mov     $len,%rcx
+        sub     $len,%rcx
         lea     $reserved(%rsp),%rsi
         .long   0x9066A4F3      # rep movsb
 
@@ -544,7 +2450,7 @@ $code.=<<___;
         ret
 .size   ${PREFIX}_cbc_encrypt,.-${PREFIX}_cbc_encrypt
 ___
-
+} 
 # int $PREFIX_set_[en|de]crypt_key (const unsigned char *userKey,
 #                               int bits, AES_KEY *key)
 { my ($inp,$bits,$key) = @_4args;
@@ -556,7 +2462,7 @@ $code.=<<___;
 .align  16
 ${PREFIX}_set_decrypt_key:
         .byte   0x48,0x83,0xEC,0x08     # sub rsp,8
-        call    _aesni_set_encrypt_key
+        call    __aesni_set_encrypt_key
         shl     \$4,$bits               # rounds-1 after _aesni_set_encrypt_key
         test    %eax,%eax
         jnz     .Ldec_key_ret
@@ -576,9 +2482,9 @@ ${PREFIX}_set_decrypt_key:
         aesimc  %xmm1,%xmm1
         lea     16($key),$key
         lea     -16($inp),$inp
-        cmp     $key,$inp
         $movkey %xmm0,16($inp)
         $movkey %xmm1,-16($key)
+        cmp     $key,$inp
         ja      .Ldec_key_inverse
 
         $movkey ($key),%xmm0            # inverse middle
@@ -605,16 +2511,16 @@ $code.=<<___;
 .type   ${PREFIX}_set_encrypt_key,\@abi-omnipotent
 .align  16
 ${PREFIX}_set_encrypt_key:
-_aesni_set_encrypt_key:
+__aesni_set_encrypt_key:
         .byte   0x48,0x83,0xEC,0x08     # sub rsp,8
-        test    $inp,$inp
         mov     \$-1,%rax
+        test    $inp,$inp
         jz      .Lenc_key_ret
         test    $key,$key
         jz      .Lenc_key_ret
 
         movups  ($inp),%xmm0            # pull first 128 bits of *userKey
-        pxor    %xmm4,%xmm4             # low dword of xmm4 is assumed 0
+        xorps   %xmm4,%xmm4             # low dword of xmm4 is assumed 0
         lea     16($key),%rax
         cmp     \$256,$bits
         je      .L14rounds
@@ -729,11 +2635,11 @@ _aesni_set_encrypt_key:
         lea     16(%rax),%rax
 .Lkey_expansion_128_cold:
         shufps  \$0b00010000,%xmm0,%xmm4
-        pxor    %xmm4, %xmm0
+        xorps   %xmm4, %xmm0
         shufps  \$0b10001100,%xmm0,%xmm4
-        pxor    %xmm4, %xmm0
-        pshufd  \$0b11111111,%xmm1,%xmm1        # critical path
-        pxor    %xmm1,%xmm0
+        xorps   %xmm4, %xmm0
+        shufps  \$0b11111111,%xmm1,%xmm1        # critical path
+        xorps   %xmm1,%xmm0
         ret
 
 .align 16
@@ -744,11 +2650,11 @@ _aesni_set_encrypt_key:
         movaps  %xmm2, %xmm5
 .Lkey_expansion_192b_warm:
         shufps  \$0b00010000,%xmm0,%xmm4
-        movaps  %xmm2,%xmm3
-        pxor    %xmm4,%xmm0
+        movdqa  %xmm2,%xmm3
+        xorps   %xmm4,%xmm0
         shufps  \$0b10001100,%xmm0,%xmm4
         pslldq  \$4,%xmm3
-        pxor    %xmm4,%xmm0
+        xorps   %xmm4,%xmm0
         pshufd  \$0b01010101,%xmm1,%xmm1        # critical path
         pxor    %xmm3,%xmm2
         pxor    %xmm1,%xmm0
@@ -772,11 +2678,11 @@ _aesni_set_encrypt_key:
         lea     16(%rax),%rax
 .Lkey_expansion_256a_cold:
         shufps  \$0b00010000,%xmm0,%xmm4
-        pxor    %xmm4,%xmm0
+        xorps   %xmm4,%xmm0
         shufps  \$0b10001100,%xmm0,%xmm4
-        pxor    %xmm4,%xmm0
-        pshufd  \$0b11111111,%xmm1,%xmm1        # critical path
-        pxor    %xmm1,%xmm0
+        xorps   %xmm4,%xmm0
+        shufps  \$0b11111111,%xmm1,%xmm1        # critical path
+        xorps   %xmm1,%xmm0
         ret
 
 .align 16
@@ -785,17 +2691,28 @@ _aesni_set_encrypt_key:
         lea     16(%rax),%rax
 
         shufps  \$0b00010000,%xmm2,%xmm4
-        pxor    %xmm4,%xmm2
+        xorps   %xmm4,%xmm2
         shufps  \$0b10001100,%xmm2,%xmm4
-        pxor    %xmm4,%xmm2
-        pshufd  \$0b10101010,%xmm1,%xmm1        # critical path
-        pxor    %xmm1,%xmm2
+        xorps   %xmm4,%xmm2
+        shufps  \$0b10101010,%xmm1,%xmm1        # critical path
+        xorps   %xmm1,%xmm2
         ret
 .size   ${PREFIX}_set_encrypt_key,.-${PREFIX}_set_encrypt_key
+.size   __aesni_set_encrypt_key,.-__aesni_set_encrypt_key
 ___
 }
 
 $code.=<<___;
+.align  64
+.Lbswap_mask:
+        .byte   15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0
+.Lincrement32:
+        .long   6,6,6,0
+.Lincrement64:
+        .long   1,0,0,0
+.Lxts_magic:
+        .long   0x87,0,1,0
+
 .asciz  "AES for Intel AES-NI, CRYPTOGAMS by <appro\@openssl.org>"
 .align  64
 ___
@@ -810,9 +2727,11 @@ $disp="%r9";
 
 $code.=<<___;
 .extern __imp_RtlVirtualUnwind
-.type   cbc_se_handler,\@abi-omnipotent
+___
+$code.=<<___ if ($PREFIX eq "aesni");
+.type   ecb_se_handler,\@abi-omnipotent
 .align  16
-cbc_se_handler:
+ecb_se_handler:
         push    %rsi
         push    %rdi
         push    %rbx
@@ -825,42 +2744,132 @@ cbc_se_handler:
         sub     \$64,%rsp
 
         mov     152($context),%rax      # pull context->Rsp
+
+        jmp     .Lcommon_seh_tail
+.size   ecb_se_handler,.-ecb_se_handler
+
+.type   ccm64_se_handler,\@abi-omnipotent
+.align  16
+ccm64_se_handler:
+        push    %rsi
+        push    %rdi
+        push    %rbx
+        push    %rbp
+        push    %r12
+        push    %r13
+        push    %r14
+        push    %r15
+        pushfq
+        sub     \$64,%rsp
+
+        mov     120($context),%rax      # pull context->Rax
         mov     248($context),%rbx      # pull context->Rip
 
-        lea     .Lcbc_decrypt(%rip),%r10
-        cmp     %r10,%rbx               # context->Rip<"prologue" label
-        jb      .Lin_prologue
+        mov     8($disp),%rsi           # disp->ImageBase
+        mov     56($disp),%r11          # disp->HandlerData
 
-        lea     .Lcbc_decrypt_body(%rip),%r10
-        cmp     %r10,%rbx               # context->Rip<cbc_decrypt_body
-        jb      .Lrestore_rax
+        mov     0(%r11),%r10d           # HandlerData[0]
+        lea     (%rsi,%r10),%r10        # prologue label
+        cmp     %r10,%rbx               # context->Rip<prologue label
+        jb      .Lcommon_seh_tail
 
-        lea     .Lcbc_ret(%rip),%r10
-        cmp     %r10,%rbx               # context->Rip>="epilogue" label
-        jae     .Lin_prologue
+        mov     152($context),%rax      # pull context->Rsp
 
-        lea     0(%rax),%rsi            # top of stack
+        mov     4(%r11),%r10d           # HandlerData[1]
+        lea     (%rsi,%r10),%r10        # epilogue label
+        cmp     %r10,%rbx               # context->Rip>=epilogue label
+        jae     .Lcommon_seh_tail
+
+        lea     0(%rax),%rsi            # %xmm save area
         lea     512($context),%rdi      # &context.Xmm6
         mov     \$8,%ecx                # 4*sizeof(%xmm0)/sizeof(%rax)
         .long   0xa548f3fc              # cld; rep movsq
         lea     0x58(%rax),%rax         # adjust stack pointer
-        jmp     .Lin_prologue
 
-.Lrestore_rax:
-        mov     120($context),%rax
-.Lin_prologue:
-        mov     8(%rax),%rdi
-        mov     16(%rax),%rsi
-        mov     %rax,152($context)      # restore context->Rsp
-        mov     %rsi,168($context)      # restore context->Rsi
-        mov     %rdi,176($context)      # restore context->Rdi
+        jmp     .Lcommon_seh_tail
+.size   ccm64_se_handler,.-ccm64_se_handler
 
-        jmp     .Lcommon_seh_exit
-.size   cbc_se_handler,.-cbc_se_handler
+.type   ctr32_se_handler,\@abi-omnipotent
+.align  16
+ctr32_se_handler:
+        push    %rsi
+        push    %rdi
+        push    %rbx
+        push    %rbp
+        push    %r12
+        push    %r13
+        push    %r14
+        push    %r15
+        pushfq
+        sub     \$64,%rsp
 
-.type   ecb_se_handler,\@abi-omnipotent
+        mov     120($context),%rax      # pull context->Rax
+        mov     248($context),%rbx      # pull context->Rip
+
+        lea     .Lctr32_body(%rip),%r10
+        cmp     %r10,%rbx               # context->Rip<"prologue" label
+        jb      .Lcommon_seh_tail
+
+        mov     152($context),%rax      # pull context->Rsp
+
+        lea     .Lctr32_ret(%rip),%r10
+        cmp     %r10,%rbx
+        jae     .Lcommon_seh_tail
+
+        lea     0x20(%rax),%rsi         # %xmm save area
+        lea     512($context),%rdi      # &context.Xmm6
+        mov     \$20,%ecx               # 10*sizeof(%xmm0)/sizeof(%rax)
+        .long   0xa548f3fc              # cld; rep movsq
+        lea     0xc8(%rax),%rax         # adjust stack pointer
+
+        jmp     .Lcommon_seh_tail
+.size   ctr32_se_handler,.-ctr32_se_handler
+
+.type   xts_se_handler,\@abi-omnipotent
 .align  16
-ecb_se_handler:
+xts_se_handler:
+        push    %rsi
+        push    %rdi
+        push    %rbx
+        push    %rbp
+        push    %r12
+        push    %r13
+        push    %r14
+        push    %r15
+        pushfq
+        sub     \$64,%rsp
+
+        mov     120($context),%rax      # pull context->Rax
+        mov     248($context),%rbx      # pull context->Rip
+
+        mov     8($disp),%rsi           # disp->ImageBase
+        mov     56($disp),%r11          # disp->HandlerData
+
+        mov     0(%r11),%r10d           # HandlerData[0]
+        lea     (%rsi,%r10),%r10        # prologue lable
+        cmp     %r10,%rbx               # context->Rip<prologue label
+        jb      .Lcommon_seh_tail
+
+        mov     152($context),%rax      # pull context->Rsp
+
+        mov     4(%r11),%r10d           # HandlerData[1]
+        lea     (%rsi,%r10),%r10        # epilogue label
+        cmp     %r10,%rbx               # context->Rip>=epilogue label
+        jae     .Lcommon_seh_tail
+
+        lea     0x60(%rax),%rsi         # %xmm save area
+        lea     512($context),%rdi      # & context.Xmm6
+        mov     \$20,%ecx               # 10*sizeof(%xmm0)/sizeof(%rax)
+        .long   0xa548f3fc              # cld; rep movsq
+        lea     0x68+160(%rax),%rax     # adjust stack pointer
+
+        jmp     .Lcommon_seh_tail
+.size   xts_se_handler,.-xts_se_handler
+___
+$code.=<<___;
+.type   cbc_se_handler,\@abi-omnipotent
+.align  16
+cbc_se_handler:
         push    %rsi
         push    %rdi
         push    %rbx
@@ -873,13 +2882,37 @@ ecb_se_handler:
         sub     \$64,%rsp
 
         mov     152($context),%rax      # pull context->Rsp
+        mov     248($context),%rbx      # pull context->Rip
+
+        lea     .Lcbc_decrypt(%rip),%r10
+        cmp     %r10,%rbx               # context->Rip<"prologue" label
+        jb      .Lcommon_seh_tail
+
+        lea     .Lcbc_decrypt_body(%rip),%r10
+        cmp     %r10,%rbx               # context->Rip<cbc_decrypt_body
+        jb      .Lrestore_cbc_rax
+
+        lea     .Lcbc_ret(%rip),%r10
+        cmp     %r10,%rbx               # context->Rip>="epilogue" label
+        jae     .Lcommon_seh_tail
+
+        lea     0(%rax),%rsi            # top of stack
+        lea     512($context),%rdi      # &context.Xmm6
+        mov     \$8,%ecx                # 4*sizeof(%xmm0)/sizeof(%rax)
+        .long   0xa548f3fc              # cld; rep movsq
+        lea     0x58(%rax),%rax         # adjust stack pointer
+        jmp     .Lcommon_seh_tail
+
+.Lrestore_cbc_rax:
+        mov     120($context),%rax
+
+.Lcommon_seh_tail:
         mov     8(%rax),%rdi
         mov     16(%rax),%rsi
+        mov     %rax,152($context)      # restore context->Rsp
         mov     %rsi,168($context)      # restore context->Rsi
         mov     %rdi,176($context)      # restore context->Rdi
 
-.Lcommon_seh_exit:
-
         mov     40($disp),%rdi          # disp->ContextRecord
         mov     $context,%rsi           # context
         mov     \$154,%ecx              # sizeof(CONTEXT)
@@ -915,10 +2948,33 @@ ecb_se_handler:
 
 .section        .pdata
 .align  4
-        .rva    .LSEH_begin_${PREFIX}_ecb_encrypt
-        .rva    .LSEH_end_${PREFIX}_ecb_encrypt
+___
+$code.=<<___ if ($PREFIX eq "aesni");
+        .rva    .LSEH_begin_aesni_ecb_encrypt
+        .rva    .LSEH_end_aesni_ecb_encrypt
         .rva    .LSEH_info_ecb
 
+        .rva    .LSEH_begin_aesni_ccm64_encrypt_blocks
+        .rva    .LSEH_end_aesni_ccm64_encrypt_blocks
+        .rva    .LSEH_info_ccm64_enc
+
+        .rva    .LSEH_begin_aesni_ccm64_decrypt_blocks
+        .rva    .LSEH_end_aesni_ccm64_decrypt_blocks
+        .rva    .LSEH_info_ccm64_dec
+
+        .rva    .LSEH_begin_aesni_ctr32_encrypt_blocks
+        .rva    .LSEH_end_aesni_ctr32_encrypt_blocks
+        .rva    .LSEH_info_ctr32
+
+        .rva    .LSEH_begin_aesni_xts_encrypt
+        .rva    .LSEH_end_aesni_xts_encrypt
+        .rva    .LSEH_info_xts_enc
+
+        .rva    .LSEH_begin_aesni_xts_decrypt
+        .rva    .LSEH_end_aesni_xts_decrypt
+        .rva    .LSEH_info_xts_dec
+___
+$code.=<<___;
         .rva    .LSEH_begin_${PREFIX}_cbc_encrypt
         .rva    .LSEH_end_${PREFIX}_cbc_encrypt
         .rva    .LSEH_info_cbc
@@ -932,28 +2988,49 @@ ecb_se_handler:
         .rva    .LSEH_info_key
 .section        .xdata
 .align  8
+___
+$code.=<<___ if ($PREFIX eq "aesni");
 .LSEH_info_ecb:
         .byte   9,0,0,0
         .rva    ecb_se_handler
+.LSEH_info_ccm64_enc:
+        .byte   9,0,0,0
+        .rva    ccm64_se_handler
+        .rva    .Lccm64_enc_body,.Lccm64_enc_ret        # HandlerData[]
+.LSEH_info_ccm64_dec:
+        .byte   9,0,0,0
+        .rva    ccm64_se_handler
+        .rva    .Lccm64_dec_body,.Lccm64_dec_ret        # HandlerData[]
+.LSEH_info_ctr32:
+        .byte   9,0,0,0
+        .rva    ctr32_se_handler
+.LSEH_info_xts_enc:
+        .byte   9,0,0,0
+        .rva    xts_se_handler
+        .rva    .Lxts_enc_body,.Lxts_enc_epilogue       # HandlerData[]
+.LSEH_info_xts_dec:
+        .byte   9,0,0,0
+        .rva    xts_se_handler
+        .rva    .Lxts_dec_body,.Lxts_dec_epilogue       # HandlerData[]
+___
+$code.=<<___;
 .LSEH_info_cbc:
         .byte   9,0,0,0
         .rva    cbc_se_handler
 .LSEH_info_key:
         .byte   0x01,0x04,0x01,0x00
-        .byte   0x04,0x02,0x00,0x00
+        .byte   0x04,0x02,0x00,0x00     # sub rsp,8
 ___
 }
 
 sub rex {
- local *opcode=shift;
- my ($dst,$src)=@_;
-
-   if ($dst>=8 || $src>=8) {
-        $rex=0x40;
-        $rex|=0x04 if($dst>=8);
-        $rex|=0x01 if($src>=8);
-        push @opcode,$rex;
-   }
+  local *opcode=shift;
+  my ($dst,$src)=@_;
+  my $rex=0;
+
+    $rex|=0x04                  if($dst>=8);
+    $rex|=0x01                  if($src>=8);
+    push @opcode,$rex|0x40      if($rex);
 }
 
 sub aesni {
@@ -989,4 +3066,3 @@ $code =~ s/\b(aes.*%xmm[0-9]+).*$/aesni($1)/gem;
 print $code;
 
 close STDOUT;
-
diff --git a/src/lib/libcrypto/asn1/a_digest.c b/src/lib/libcrypto/asn1/a_digest.c
index d00d9e22b1..cbdeea6ac0 100644
--- a/src/lib/libcrypto/asn1/a_digest.c
+++ b/src/lib/libcrypto/asn1/a_digest.c
@@ -87,7 +87,8 @@ int ASN1_digest(i2d_of_void *i2d, const EVP_MD *type, char *data,
         p=str;
         i2d(data,&p);
 
-        EVP_Digest(str, i, md, len, type, NULL);
+        if (!EVP_Digest(str, i, md, len, type, NULL))
+                return 0;
         OPENSSL_free(str);
         return(1);
         }
@@ -104,7 +105,8 @@ int ASN1_item_digest(const ASN1_ITEM *it, const EVP_MD *type, void *asn,
         i=ASN1_item_i2d(asn,&str, it);
         if (!str) return(0);
 
-        EVP_Digest(str, i, md, len, type, NULL);
+        if (!EVP_Digest(str, i, md, len, type, NULL))
+                return 0;
         OPENSSL_free(str);
         return(1);
         }
diff --git a/src/lib/libcrypto/asn1/a_int.c b/src/lib/libcrypto/asn1/a_int.c
index 3348b8762c..ad0d2506f6 100644
--- a/src/lib/libcrypto/asn1/a_int.c
+++ b/src/lib/libcrypto/asn1/a_int.c
@@ -386,8 +386,8 @@ long ASN1_INTEGER_get(const ASN1_INTEGER *a)
         
         if (a->length > (int)sizeof(long))
                 {
-                /* hmm... a bit ugly */
-                return(0xffffffffL);
+                /* hmm... a bit ugly, return all ones */
+                return -1;
                 }
         if (a->data == NULL)
                 return 0;
diff --git a/src/lib/libcrypto/asn1/a_sign.c b/src/lib/libcrypto/asn1/a_sign.c
index ff63bfc7be..7b4a193d6b 100644
--- a/src/lib/libcrypto/asn1/a_sign.c
+++ b/src/lib/libcrypto/asn1/a_sign.c
@@ -184,9 +184,9 @@ int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2,
         p=buf_in;
 
         i2d(data,&p);
-        EVP_SignInit_ex(&ctx,type, NULL);
-        EVP_SignUpdate(&ctx,(unsigned char *)buf_in,inl);
-        if (!EVP_SignFinal(&ctx,(unsigned char *)buf_out,
+        if (!EVP_SignInit_ex(&ctx,type, NULL)
+                || !EVP_SignUpdate(&ctx,(unsigned char *)buf_in,inl)
+                || !EVP_SignFinal(&ctx,(unsigned char *)buf_out,
                         (unsigned int *)&outl,pkey))
                 {
                 outl=0;
@@ -218,65 +218,100 @@ int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
              const EVP_MD *type)
         {
         EVP_MD_CTX ctx;
+        EVP_MD_CTX_init(&ctx);
+        if (!EVP_DigestSignInit(&ctx, NULL, type, NULL, pkey))
+                {
+                EVP_MD_CTX_cleanup(&ctx);
+                return 0;
+                }
+        return ASN1_item_sign_ctx(it, algor1, algor2, signature, asn, &ctx);
+        }
+                
+
+int ASN1_item_sign_ctx(const ASN1_ITEM *it,
+                X509_ALGOR *algor1, X509_ALGOR *algor2,
+                ASN1_BIT_STRING *signature, void *asn, EVP_MD_CTX *ctx)
+        {
+        const EVP_MD *type;
+        EVP_PKEY *pkey;
         unsigned char *buf_in=NULL,*buf_out=NULL;
-        int inl=0,outl=0,outll=0;
+        size_t inl=0,outl=0,outll=0;
         int signid, paramtype;
+        int rv;
+
+        type = EVP_MD_CTX_md(ctx);
+        pkey = EVP_PKEY_CTX_get0_pkey(ctx->pctx);
 
-        if (type == NULL)
+        if (!type || !pkey)
                 {
-                int def_nid;
-                if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) > 0)
-                        type = EVP_get_digestbynid(def_nid);
+                ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX, ASN1_R_CONTEXT_NOT_INITIALISED);
+                return 0;
                 }
 
-        if (type == NULL)
+        if (pkey->ameth->item_sign)
                 {
-                ASN1err(ASN1_F_ASN1_ITEM_SIGN, ASN1_R_NO_DEFAULT_DIGEST);
-                return 0;
+                rv = pkey->ameth->item_sign(ctx, it, asn, algor1, algor2,
+                                                signature);
+                if (rv == 1)
+                        outl = signature->length;
+                /* Return value meanings:
+                 * <=0: error.
+                 *   1: method does everything.
+                 *   2: carry on as normal.
+                 *   3: ASN1 method sets algorithm identifiers: just sign.
+                 */
+                if (rv <= 0)
+                        ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX, ERR_R_EVP_LIB);
+                if (rv <= 1)
+                        goto err;
                 }
+        else
+                rv = 2;
 
-        if (type->flags & EVP_MD_FLAG_PKEY_METHOD_SIGNATURE)
+        if (rv == 2)
                 {
-                if (!pkey->ameth ||
-                        !OBJ_find_sigid_by_algs(&signid, EVP_MD_nid(type),
-                                                pkey->ameth->pkey_id))
+                if (type->flags & EVP_MD_FLAG_PKEY_METHOD_SIGNATURE)
                         {
-                        ASN1err(ASN1_F_ASN1_ITEM_SIGN,
-                                ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED);
-                        return 0;
+                        if (!pkey->ameth ||
+                                !OBJ_find_sigid_by_algs(&signid,
+                                                        EVP_MD_nid(type),
+                                                        pkey->ameth->pkey_id))
+                                {
+                                ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX,
+                                        ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED);
+                                return 0;
+                                }
                         }
-                }
-        else
-                signid = type->pkey_type;
+                else
+                        signid = type->pkey_type;
 
-        if (pkey->ameth->pkey_flags & ASN1_PKEY_SIGPARAM_NULL)
-                paramtype = V_ASN1_NULL;
-        else
-                paramtype = V_ASN1_UNDEF;
+                if (pkey->ameth->pkey_flags & ASN1_PKEY_SIGPARAM_NULL)
+                        paramtype = V_ASN1_NULL;
+                else
+                        paramtype = V_ASN1_UNDEF;
 
-        if (algor1)
-                X509_ALGOR_set0(algor1, OBJ_nid2obj(signid), paramtype, NULL);
-        if (algor2)
-                X509_ALGOR_set0(algor2, OBJ_nid2obj(signid), paramtype, NULL);
+                if (algor1)
+                        X509_ALGOR_set0(algor1, OBJ_nid2obj(signid), paramtype, NULL);
+                if (algor2)
+                        X509_ALGOR_set0(algor2, OBJ_nid2obj(signid), paramtype, NULL);
+
+                }
 
-        EVP_MD_CTX_init(&ctx);
         inl=ASN1_item_i2d(asn,&buf_in, it);
         outll=outl=EVP_PKEY_size(pkey);
-        buf_out=(unsigned char *)OPENSSL_malloc((unsigned int)outl);
+        buf_out=OPENSSL_malloc((unsigned int)outl);
         if ((buf_in == NULL) || (buf_out == NULL))
                 {
                 outl=0;
-                ASN1err(ASN1_F_ASN1_ITEM_SIGN,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
 
-        EVP_SignInit_ex(&ctx,type, NULL);
-        EVP_SignUpdate(&ctx,(unsigned char *)buf_in,inl);
-        if (!EVP_SignFinal(&ctx,(unsigned char *)buf_out,
-                        (unsigned int *)&outl,pkey))
+        if (!EVP_DigestSignUpdate(ctx, buf_in, inl)
+                || !EVP_DigestSignFinal(ctx, buf_out, &outl))
                 {
                 outl=0;
-                ASN1err(ASN1_F_ASN1_ITEM_SIGN,ERR_R_EVP_LIB);
+                ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX,ERR_R_EVP_LIB);
                 goto err;
                 }
         if (signature->data != NULL) OPENSSL_free(signature->data);
@@ -289,7 +324,7 @@ int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
         signature->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
         signature->flags|=ASN1_STRING_FLAG_BITS_LEFT;
 err:
-        EVP_MD_CTX_cleanup(&ctx);
+        EVP_MD_CTX_cleanup(ctx);
         if (buf_in != NULL)
                 { OPENSSL_cleanse((char *)buf_in,(unsigned int)inl); OPENSSL_free(buf_in); }
         if (buf_out != NULL)
diff --git a/src/lib/libcrypto/asn1/a_verify.c b/src/lib/libcrypto/asn1/a_verify.c
index cecdb13c70..432722e409 100644
--- a/src/lib/libcrypto/asn1/a_verify.c
+++ b/src/lib/libcrypto/asn1/a_verify.c
@@ -101,8 +101,13 @@ int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *a, ASN1_BIT_STRING *signature,
         p=buf_in;
 
         i2d(data,&p);
-        EVP_VerifyInit_ex(&ctx,type, NULL);
-        EVP_VerifyUpdate(&ctx,(unsigned char *)buf_in,inl);
+        if (!EVP_VerifyInit_ex(&ctx,type, NULL)
+                || !EVP_VerifyUpdate(&ctx,(unsigned char *)buf_in,inl))
+                {
+                ASN1err(ASN1_F_ASN1_VERIFY,ERR_R_EVP_LIB);
+                ret=0;
+                goto err;
+                }
 
         OPENSSL_cleanse(buf_in,(unsigned int)inl);
         OPENSSL_free(buf_in);
@@ -126,11 +131,10 @@ err:
 #endif
 
 
-int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, ASN1_BIT_STRING *signature,
-             void *asn, EVP_PKEY *pkey)
+int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a,
+                ASN1_BIT_STRING *signature, void *asn, EVP_PKEY *pkey)
         {
         EVP_MD_CTX ctx;
-        const EVP_MD *type = NULL;
         unsigned char *buf_in=NULL;
         int ret= -1,inl;
 
@@ -144,25 +148,47 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, ASN1_BIT_STRING *signat
                 ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM);
                 goto err;
                 }
-        type=EVP_get_digestbynid(mdnid);
-        if (type == NULL)
+        if (mdnid == NID_undef)
                 {
-                ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM);
-                goto err;
+                if (!pkey->ameth || !pkey->ameth->item_verify)
+                        {
+                        ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM);
+                        goto err;
+                        }
+                ret = pkey->ameth->item_verify(&ctx, it, asn, a,
+                                                        signature, pkey);
+                /* Return value of 2 means carry on, anything else means we
+                 * exit straight away: either a fatal error of the underlying
+                 * verification routine handles all verification.
+                 */
+                if (ret != 2)
+                        goto err;
+                ret = -1;
                 }
-
-        /* Check public key OID matches public key type */
-        if (EVP_PKEY_type(pknid) != pkey->ameth->pkey_id)
+        else
                 {
-                ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ASN1_R_WRONG_PUBLIC_KEY_TYPE);
-                goto err;
-                }
+                const EVP_MD *type;
+                type=EVP_get_digestbynid(mdnid);
+                if (type == NULL)
+                        {
+                        ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM);
+                        goto err;
+                        }
+
+                /* Check public key OID matches public key type */
+                if (EVP_PKEY_type(pknid) != pkey->ameth->pkey_id)
+                        {
+                        ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ASN1_R_WRONG_PUBLIC_KEY_TYPE);
+                        goto err;
+                        }
+
+                if (!EVP_DigestVerifyInit(&ctx, NULL, type, NULL, pkey))
+                        {
+                        ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ERR_R_EVP_LIB);
+                        ret=0;
+                        goto err;
+                        }
 
-        if (!EVP_VerifyInit_ex(&ctx,type, NULL))
-                {
-                ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ERR_R_EVP_LIB);
-                ret=0;
-                goto err;
                 }
 
         inl = ASN1_item_i2d(asn, &buf_in, it);
@@ -173,13 +199,18 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, ASN1_BIT_STRING *signat
                 goto err;
                 }
 
-        EVP_VerifyUpdate(&ctx,(unsigned char *)buf_in,inl);
+        if (!EVP_DigestVerifyUpdate(&ctx,buf_in,inl))
+                {
+                ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ERR_R_EVP_LIB);
+                ret=0;
+                goto err;
+                }
 
         OPENSSL_cleanse(buf_in,(unsigned int)inl);
         OPENSSL_free(buf_in);
 
-        if (EVP_VerifyFinal(&ctx,(unsigned char *)signature->data,
-                        (unsigned int)signature->length,pkey) <= 0)
+        if (EVP_DigestVerifyFinal(&ctx,signature->data,
+                        (size_t)signature->length) <= 0)
                 {
                 ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ERR_R_EVP_LIB);
                 ret=0;
diff --git a/src/lib/libcrypto/asn1/asn1.h b/src/lib/libcrypto/asn1/asn1.h
index 59540e4e79..220a0c8c63 100644
--- a/src/lib/libcrypto/asn1/asn1.h
+++ b/src/lib/libcrypto/asn1/asn1.h
@@ -235,7 +235,7 @@ typedef struct asn1_object_st
  */
 #define ASN1_STRING_FLAG_MSTRING 0x040 
 /* This is the base type that holds just about everything :-) */
-typedef struct asn1_string_st
+struct asn1_string_st
         {
         int length;
         int type;
@@ -245,7 +245,7 @@ typedef struct asn1_string_st
          * input data has a non-zero 'unused bits' value, it will be
          * handled correctly */
         long flags;
-        } ASN1_STRING;
+        };
 
 /* ASN1_ENCODING structure: this is used to save the received
  * encoding of an ASN1 type. This is useful to get round
@@ -293,7 +293,6 @@ DECLARE_STACK_OF(ASN1_STRING_TABLE)
  * see asn1t.h
  */
 typedef struct ASN1_TEMPLATE_st ASN1_TEMPLATE;
-typedef struct ASN1_ITEM_st ASN1_ITEM;
 typedef struct ASN1_TLC_st ASN1_TLC;
 /* This is just an opaque pointer */
 typedef struct ASN1_VALUE_st ASN1_VALUE;
@@ -1194,6 +1193,7 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_F_ASN1_ITEM_I2D_FP                          193
 #define ASN1_F_ASN1_ITEM_PACK                            198
 #define ASN1_F_ASN1_ITEM_SIGN                            195
+#define ASN1_F_ASN1_ITEM_SIGN_CTX                        220
 #define ASN1_F_ASN1_ITEM_UNPACK                          199
 #define ASN1_F_ASN1_ITEM_VERIFY                          197
 #define ASN1_F_ASN1_MBSTRING_NCOPY                       122
@@ -1266,6 +1266,7 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_F_PKCS5_PBE2_SET_IV                         167
 #define ASN1_F_PKCS5_PBE_SET                             202
 #define ASN1_F_PKCS5_PBE_SET0_ALGOR                      215
+#define ASN1_F_PKCS5_PBKDF2_SET                          219
 #define ASN1_F_SMIME_READ_ASN1                           212
 #define ASN1_F_SMIME_TEXT                                213
 #define ASN1_F_X509_CINF_NEW                             168
@@ -1291,6 +1292,7 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_R_BOOLEAN_IS_WRONG_LENGTH                   106
 #define ASN1_R_BUFFER_TOO_SMALL                          107
 #define ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER           108
+#define ASN1_R_CONTEXT_NOT_INITIALISED                   217
 #define ASN1_R_DATA_IS_WRONG                             109
 #define ASN1_R_DECODE_ERROR                              110
 #define ASN1_R_DECODING_ERROR                            111
diff --git a/src/lib/libcrypto/asn1/asn1_err.c b/src/lib/libcrypto/asn1/asn1_err.c
index 6e04d08f31..1a30bf119b 100644
--- a/src/lib/libcrypto/asn1/asn1_err.c
+++ b/src/lib/libcrypto/asn1/asn1_err.c
@@ -1,6 +1,6 @@
 /* crypto/asn1/asn1_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2009 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -107,6 +107,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_FUNC(ASN1_F_ASN1_ITEM_I2D_FP),     "ASN1_item_i2d_fp"},
 {ERR_FUNC(ASN1_F_ASN1_ITEM_PACK),       "ASN1_item_pack"},
 {ERR_FUNC(ASN1_F_ASN1_ITEM_SIGN),       "ASN1_item_sign"},
+{ERR_FUNC(ASN1_F_ASN1_ITEM_SIGN_CTX),   "ASN1_item_sign_ctx"},
 {ERR_FUNC(ASN1_F_ASN1_ITEM_UNPACK),     "ASN1_item_unpack"},
 {ERR_FUNC(ASN1_F_ASN1_ITEM_VERIFY),     "ASN1_item_verify"},
 {ERR_FUNC(ASN1_F_ASN1_MBSTRING_NCOPY),  "ASN1_mbstring_ncopy"},
@@ -179,6 +180,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_FUNC(ASN1_F_PKCS5_PBE2_SET_IV),    "PKCS5_pbe2_set_iv"},
 {ERR_FUNC(ASN1_F_PKCS5_PBE_SET),        "PKCS5_pbe_set"},
 {ERR_FUNC(ASN1_F_PKCS5_PBE_SET0_ALGOR), "PKCS5_pbe_set0_algor"},
+{ERR_FUNC(ASN1_F_PKCS5_PBKDF2_SET),     "PKCS5_pbkdf2_set"},
 {ERR_FUNC(ASN1_F_SMIME_READ_ASN1),      "SMIME_read_ASN1"},
 {ERR_FUNC(ASN1_F_SMIME_TEXT),   "SMIME_text"},
 {ERR_FUNC(ASN1_F_X509_CINF_NEW),        "X509_CINF_NEW"},
@@ -207,6 +209,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ERR_REASON(ASN1_R_BOOLEAN_IS_WRONG_LENGTH),"boolean is wrong length"},
 {ERR_REASON(ASN1_R_BUFFER_TOO_SMALL)     ,"buffer too small"},
 {ERR_REASON(ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER),"cipher has no object identifier"},
+{ERR_REASON(ASN1_R_CONTEXT_NOT_INITIALISED),"context not initialised"},
 {ERR_REASON(ASN1_R_DATA_IS_WRONG)        ,"data is wrong"},
 {ERR_REASON(ASN1_R_DECODE_ERROR)         ,"decode error"},
 {ERR_REASON(ASN1_R_DECODING_ERROR)       ,"decoding error"},
diff --git a/src/lib/libcrypto/asn1/asn_mime.c b/src/lib/libcrypto/asn1/asn_mime.c
index c1d1b12291..54a704a969 100644
--- a/src/lib/libcrypto/asn1/asn_mime.c
+++ b/src/lib/libcrypto/asn1/asn_mime.c
@@ -377,8 +377,12 @@ static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
         BIO *tmpbio;
         const ASN1_AUX *aux = it->funcs;
         ASN1_STREAM_ARG sarg;
+        int rv = 1;
 
-        if (!(flags & SMIME_DETACHED))
+        /* If data is not deteched or resigning then the output BIO is
+         * already set up to finalise when it is written through.
+         */
+        if (!(flags & SMIME_DETACHED) || (flags & PKCS7_REUSE_DIGEST))
                 {
                 SMIME_crlf_copy(data, out, flags);
                 return 1;
@@ -405,7 +409,7 @@ static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
 
         /* Finalize structure */
         if (aux->asn1_cb(ASN1_OP_DETACHED_POST, &val, it, &sarg) <= 0)
-                return 0;
+                rv = 0;
 
         /* Now remove any digests prepended to the BIO */
 
@@ -416,7 +420,7 @@ static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
                 sarg.ndef_bio = tmpbio;
                 }
 
-        return 1;
+        return rv;
 
         }
 
@@ -486,9 +490,9 @@ ASN1_VALUE *SMIME_read_ASN1(BIO *bio, BIO **bcont, const ASN1_ITEM *it)
 
                 if(strcmp(hdr->value, "application/x-pkcs7-signature") &&
                         strcmp(hdr->value, "application/pkcs7-signature")) {
-                        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                         ASN1err(ASN1_F_SMIME_READ_ASN1,ASN1_R_SIG_INVALID_MIME_TYPE);
                         ERR_add_error_data(2, "type: ", hdr->value);
+                        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                         sk_BIO_pop_free(parts, BIO_vfree);
                         return NULL;
                 }
@@ -801,7 +805,7 @@ static MIME_HEADER *mime_hdr_new(char *name, char *value)
         if(name) {
                 if(!(tmpname = BUF_strdup(name))) return NULL;
                 for(p = tmpname ; *p; p++) {
-                        c = *p;
+                        c = (unsigned char)*p;
                         if(isupper(c)) {
                                 c = tolower(c);
                                 *p = c;
@@ -811,7 +815,7 @@ static MIME_HEADER *mime_hdr_new(char *name, char *value)
         if(value) {
                 if(!(tmpval = BUF_strdup(value))) return NULL;
                 for(p = tmpval ; *p; p++) {
-                        c = *p;
+                        c = (unsigned char)*p;
                         if(isupper(c)) {
                                 c = tolower(c);
                                 *p = c;
@@ -835,7 +839,7 @@ static int mime_hdr_addparam(MIME_HEADER *mhdr, char *name, char *value)
                 tmpname = BUF_strdup(name);
                 if(!tmpname) return 0;
                 for(p = tmpname ; *p; p++) {
-                        c = *p;
+                        c = (unsigned char)*p;
                         if(isupper(c)) {
                                 c = tolower(c);
                                 *p = c;
@@ -858,12 +862,17 @@ static int mime_hdr_addparam(MIME_HEADER *mhdr, char *name, char *value)
 static int mime_hdr_cmp(const MIME_HEADER * const *a,
                         const MIME_HEADER * const *b)
 {
+        if (!(*a)->name || !(*b)->name)
+                return !!(*a)->name - !!(*b)->name;
+
         return(strcmp((*a)->name, (*b)->name));
 }
 
 static int mime_param_cmp(const MIME_PARAM * const *a,
                         const MIME_PARAM * const *b)
 {
+        if (!(*a)->param_name || !(*b)->param_name)
+                return !!(*a)->param_name - !!(*b)->param_name;
         return(strcmp((*a)->param_name, (*b)->param_name));
 }
 
diff --git a/src/lib/libcrypto/asn1/n_pkey.c b/src/lib/libcrypto/asn1/n_pkey.c
index e7d0439062..e251739933 100644
--- a/src/lib/libcrypto/asn1/n_pkey.c
+++ b/src/lib/libcrypto/asn1/n_pkey.c
@@ -129,6 +129,7 @@ int i2d_RSA_NET(const RSA *a, unsigned char **pp,
         unsigned char buf[256],*zz;
         unsigned char key[EVP_MAX_KEY_LENGTH];
         EVP_CIPHER_CTX ctx;
+        EVP_CIPHER_CTX_init(&ctx);
 
         if (a == NULL) return(0);
 
@@ -206,24 +207,28 @@ int i2d_RSA_NET(const RSA *a, unsigned char **pp,
         i = strlen((char *)buf);
         /* If the key is used for SGC the algorithm is modified a little. */
         if(sgckey) {
-                EVP_Digest(buf, i, buf, NULL, EVP_md5(), NULL);
+                if (!EVP_Digest(buf, i, buf, NULL, EVP_md5(), NULL))
+                        goto err;
                 memcpy(buf + 16, "SGCKEYSALT", 10);
                 i = 26;
         }
 
-        EVP_BytesToKey(EVP_rc4(),EVP_md5(),NULL,buf,i,1,key,NULL);
+        if (!EVP_BytesToKey(EVP_rc4(),EVP_md5(),NULL,buf,i,1,key,NULL))
+                goto err;
         OPENSSL_cleanse(buf,256);
 
         /* Encrypt private key in place */
         zz = enckey->enckey->digest->data;
-        EVP_CIPHER_CTX_init(&ctx);
-        EVP_EncryptInit_ex(&ctx,EVP_rc4(),NULL,key,NULL);
-        EVP_EncryptUpdate(&ctx,zz,&i,zz,pkeylen);
-        EVP_EncryptFinal_ex(&ctx,zz + i,&j);
-        EVP_CIPHER_CTX_cleanup(&ctx);
+        if (!EVP_EncryptInit_ex(&ctx,EVP_rc4(),NULL,key,NULL))
+                goto err;
+        if (!EVP_EncryptUpdate(&ctx,zz,&i,zz,pkeylen))
+                goto err;
+        if (!EVP_EncryptFinal_ex(&ctx,zz + i,&j))
+                goto err;
 
         ret = i2d_NETSCAPE_ENCRYPTED_PKEY(enckey, pp);
 err:
+        EVP_CIPHER_CTX_cleanup(&ctx);
         NETSCAPE_ENCRYPTED_PKEY_free(enckey);
         NETSCAPE_PKEY_free(pkey);
         return(ret);
@@ -288,6 +293,7 @@ static RSA *d2i_RSA_NET_2(RSA **a, ASN1_OCTET_STRING *os,
         const unsigned char *zz;
         unsigned char key[EVP_MAX_KEY_LENGTH];
         EVP_CIPHER_CTX ctx;
+        EVP_CIPHER_CTX_init(&ctx);
 
         i=cb((char *)buf,256,"Enter Private Key password:",0);
         if (i != 0)
@@ -298,19 +304,22 @@ static RSA *d2i_RSA_NET_2(RSA **a, ASN1_OCTET_STRING *os,
 
         i = strlen((char *)buf);
         if(sgckey){
-                EVP_Digest(buf, i, buf, NULL, EVP_md5(), NULL);
+                if (!EVP_Digest(buf, i, buf, NULL, EVP_md5(), NULL))
+                        goto err;
                 memcpy(buf + 16, "SGCKEYSALT", 10);
                 i = 26;
         }
                 
-        EVP_BytesToKey(EVP_rc4(),EVP_md5(),NULL,buf,i,1,key,NULL);
+        if (!EVP_BytesToKey(EVP_rc4(),EVP_md5(),NULL,buf,i,1,key,NULL))
+                goto err;
         OPENSSL_cleanse(buf,256);
 
-        EVP_CIPHER_CTX_init(&ctx);
-        EVP_DecryptInit_ex(&ctx,EVP_rc4(),NULL, key,NULL);
-        EVP_DecryptUpdate(&ctx,os->data,&i,os->data,os->length);
-        EVP_DecryptFinal_ex(&ctx,&(os->data[i]),&j);
-        EVP_CIPHER_CTX_cleanup(&ctx);
+        if (!EVP_DecryptInit_ex(&ctx,EVP_rc4(),NULL, key,NULL))
+                goto err;
+        if (!EVP_DecryptUpdate(&ctx,os->data,&i,os->data,os->length))
+                goto err;
+        if (!EVP_DecryptFinal_ex(&ctx,&(os->data[i]),&j))
+                goto err;
         os->length=i+j;
 
         zz=os->data;
@@ -328,6 +337,7 @@ static RSA *d2i_RSA_NET_2(RSA **a, ASN1_OCTET_STRING *os,
                 goto err;
                 }
 err:
+        EVP_CIPHER_CTX_cleanup(&ctx);
         NETSCAPE_PKEY_free(pkey);
         return(ret);
         }
diff --git a/src/lib/libcrypto/asn1/p5_pbev2.c b/src/lib/libcrypto/asn1/p5_pbev2.c
index cb49b6651d..4ea683036b 100644
--- a/src/lib/libcrypto/asn1/p5_pbev2.c
+++ b/src/lib/libcrypto/asn1/p5_pbev2.c
@@ -91,12 +91,10 @@ X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter,
                                  unsigned char *aiv, int prf_nid)
 {
         X509_ALGOR *scheme = NULL, *kalg = NULL, *ret = NULL;
-        int alg_nid;
+        int alg_nid, keylen;
         EVP_CIPHER_CTX ctx;
         unsigned char iv[EVP_MAX_IV_LENGTH];
-        PBKDF2PARAM *kdf = NULL;
         PBE2PARAM *pbe2 = NULL;
-        ASN1_OCTET_STRING *osalt = NULL;
         ASN1_OBJECT *obj;
 
         alg_nid = EVP_CIPHER_type(cipher);
@@ -127,7 +125,8 @@ X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter,
         EVP_CIPHER_CTX_init(&ctx);
 
         /* Dummy cipherinit to just setup the IV, and PRF */
-        EVP_CipherInit_ex(&ctx, cipher, NULL, NULL, iv, 0);
+        if (!EVP_CipherInit_ex(&ctx, cipher, NULL, NULL, iv, 0))
+                goto err;
         if(EVP_CIPHER_param_to_asn1(&ctx, scheme->parameter) < 0) {
                 ASN1err(ASN1_F_PKCS5_PBE2_SET_IV,
                                         ASN1_R_ERROR_SETTING_CIPHER_PARAMS);
@@ -145,55 +144,21 @@ X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter,
                 }
         EVP_CIPHER_CTX_cleanup(&ctx);
 
-        if(!(kdf = PBKDF2PARAM_new())) goto merr;
-        if(!(osalt = M_ASN1_OCTET_STRING_new())) goto merr;
-
-        if (!saltlen) saltlen = PKCS5_SALT_LEN;
-        if (!(osalt->data = OPENSSL_malloc (saltlen))) goto merr;
-        osalt->length = saltlen;
-        if (salt) memcpy (osalt->data, salt, saltlen);
-        else if (RAND_pseudo_bytes (osalt->data, saltlen) < 0) goto merr;
-
-        if(iter <= 0) iter = PKCS5_DEFAULT_ITER;
-        if(!ASN1_INTEGER_set(kdf->iter, iter)) goto merr;
-
-        /* Now include salt in kdf structure */
-        kdf->salt->value.octet_string = osalt;
-        kdf->salt->type = V_ASN1_OCTET_STRING;
-        osalt = NULL;
-
         /* If its RC2 then we'd better setup the key length */
 
-        if(alg_nid == NID_rc2_cbc) {
-                if(!(kdf->keylength = M_ASN1_INTEGER_new())) goto merr;
-                if(!ASN1_INTEGER_set (kdf->keylength,
-                                 EVP_CIPHER_key_length(cipher))) goto merr;
-        }
-
-        /* prf can stay NULL if we are using hmacWithSHA1 */
-        if (prf_nid != NID_hmacWithSHA1)
-                {
-                kdf->prf = X509_ALGOR_new();
-                if (!kdf->prf)
-                        goto merr;
-                X509_ALGOR_set0(kdf->prf, OBJ_nid2obj(prf_nid),
-                                        V_ASN1_NULL, NULL);
-                }
-
-        /* Now setup the PBE2PARAM keyfunc structure */
+        if(alg_nid == NID_rc2_cbc)
+                keylen = EVP_CIPHER_key_length(cipher);
+        else
+                keylen = -1;
 
-        pbe2->keyfunc->algorithm = OBJ_nid2obj(NID_id_pbkdf2);
+        /* Setup keyfunc */
 
-        /* Encode PBKDF2PARAM into parameter of pbe2 */
+        X509_ALGOR_free(pbe2->keyfunc);
 
-        if(!(pbe2->keyfunc->parameter = ASN1_TYPE_new())) goto merr;
+        pbe2->keyfunc = PKCS5_pbkdf2_set(iter, salt, saltlen, prf_nid, keylen);
 
-        if(!ASN1_item_pack(kdf, ASN1_ITEM_rptr(PBKDF2PARAM),
-                         &pbe2->keyfunc->parameter->value.sequence)) goto merr;
-        pbe2->keyfunc->parameter->type = V_ASN1_SEQUENCE;
-
-        PBKDF2PARAM_free(kdf);
-        kdf = NULL;
+        if (!pbe2->keyfunc)
+                goto merr;
 
         /* Now set up top level AlgorithmIdentifier */
 
@@ -219,8 +184,6 @@ X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter,
         err:
         PBE2PARAM_free(pbe2);
         /* Note 'scheme' is freed as part of pbe2 */
-        M_ASN1_OCTET_STRING_free(osalt);
-        PBKDF2PARAM_free(kdf);
         X509_ALGOR_free(kalg);
         X509_ALGOR_free(ret);
 
@@ -233,3 +196,85 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
         {
         return PKCS5_pbe2_set_iv(cipher, iter, salt, saltlen, NULL, -1);
         }
+
+X509_ALGOR *PKCS5_pbkdf2_set(int iter, unsigned char *salt, int saltlen,
+                                int prf_nid, int keylen)
+        {
+        X509_ALGOR *keyfunc = NULL;
+        PBKDF2PARAM *kdf = NULL;
+        ASN1_OCTET_STRING *osalt = NULL;
+
+        if(!(kdf = PBKDF2PARAM_new()))
+                goto merr;
+        if(!(osalt = M_ASN1_OCTET_STRING_new()))
+                goto merr;
+
+        kdf->salt->value.octet_string = osalt;
+        kdf->salt->type = V_ASN1_OCTET_STRING;
+
+        if (!saltlen)
+                saltlen = PKCS5_SALT_LEN;
+        if (!(osalt->data = OPENSSL_malloc (saltlen)))
+                goto merr;
+
+        osalt->length = saltlen;
+
+        if (salt)
+                memcpy (osalt->data, salt, saltlen);
+        else if (RAND_pseudo_bytes (osalt->data, saltlen) < 0)
+                goto merr;
+
+        if(iter <= 0)
+                iter = PKCS5_DEFAULT_ITER;
+
+        if(!ASN1_INTEGER_set(kdf->iter, iter))
+                goto merr;
+
+        /* If have a key len set it up */
+
+        if(keylen > 0) 
+                {
+                if(!(kdf->keylength = M_ASN1_INTEGER_new()))
+                        goto merr;
+                if(!ASN1_INTEGER_set (kdf->keylength, keylen))
+                        goto merr;
+                }
+
+        /* prf can stay NULL if we are using hmacWithSHA1 */
+        if (prf_nid > 0 && prf_nid != NID_hmacWithSHA1)
+                {
+                kdf->prf = X509_ALGOR_new();
+                if (!kdf->prf)
+                        goto merr;
+                X509_ALGOR_set0(kdf->prf, OBJ_nid2obj(prf_nid),
+                                        V_ASN1_NULL, NULL);
+                }
+
+        /* Finally setup the keyfunc structure */
+
+        keyfunc = X509_ALGOR_new();
+        if (!keyfunc)
+                goto merr;
+
+        keyfunc->algorithm = OBJ_nid2obj(NID_id_pbkdf2);
+
+        /* Encode PBKDF2PARAM into parameter of pbe2 */
+
+        if(!(keyfunc->parameter = ASN1_TYPE_new()))
+                goto merr;
+
+        if(!ASN1_item_pack(kdf, ASN1_ITEM_rptr(PBKDF2PARAM),
+                         &keyfunc->parameter->value.sequence))
+                goto merr;
+        keyfunc->parameter->type = V_ASN1_SEQUENCE;
+
+        PBKDF2PARAM_free(kdf);
+        return keyfunc;
+
+        merr:
+        ASN1err(ASN1_F_PKCS5_PBKDF2_SET,ERR_R_MALLOC_FAILURE);
+        PBKDF2PARAM_free(kdf);
+        X509_ALGOR_free(keyfunc);
+        return NULL;
+        }
+
diff --git a/src/lib/libcrypto/asn1/t_crl.c b/src/lib/libcrypto/asn1/t_crl.c
index ee5a687ce8..c61169208a 100644
--- a/src/lib/libcrypto/asn1/t_crl.c
+++ b/src/lib/libcrypto/asn1/t_crl.c
@@ -94,8 +94,7 @@ int X509_CRL_print(BIO *out, X509_CRL *x)
         l = X509_CRL_get_version(x);
         BIO_printf(out, "%8sVersion %lu (0x%lx)\n", "", l+1, l);
         i = OBJ_obj2nid(x->sig_alg->algorithm);
-        BIO_printf(out, "%8sSignature Algorithm: %s\n", "",
-                                 (i == NID_undef) ? "NONE" : OBJ_nid2ln(i));
+        X509_signature_print(out, x->sig_alg, NULL);
         p=X509_NAME_oneline(X509_CRL_get_issuer(x),NULL,0);
         BIO_printf(out,"%8sIssuer: %s\n","",p);
         OPENSSL_free(p);
diff --git a/src/lib/libcrypto/asn1/t_x509.c b/src/lib/libcrypto/asn1/t_x509.c
index e061f2ffad..edbb39a02f 100644
--- a/src/lib/libcrypto/asn1/t_x509.c
+++ b/src/lib/libcrypto/asn1/t_x509.c
@@ -72,6 +72,7 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
+#include "asn1_locl.h"
 
 #ifndef OPENSSL_NO_FP_API
 int X509_print_fp(FILE *fp, X509 *x)
@@ -137,10 +138,10 @@ int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, unsigned long cflag)
                 if (BIO_write(bp,"        Serial Number:",22) <= 0) goto err;
 
                 bs=X509_get_serialNumber(x);
-                if (bs->length <= 4)
+                if (bs->length <= (int)sizeof(long))
                         {
                         l=ASN1_INTEGER_get(bs);
-                        if (l < 0)
+                        if (bs->type == V_ASN1_NEG_INTEGER)
                                 {
                                 l= -l;
                                 neg="-";
@@ -167,12 +168,16 @@ int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, unsigned long cflag)
 
         if(!(cflag & X509_FLAG_NO_SIGNAME))
                 {
+                if(X509_signature_print(bp, x->sig_alg, NULL) <= 0)
+                        goto err;
+#if 0
                 if (BIO_printf(bp,"%8sSignature Algorithm: ","") <= 0) 
                         goto err;
                 if (i2a_ASN1_OBJECT(bp, ci->signature->algorithm) <= 0)
                         goto err;
                 if (BIO_puts(bp, "\n") <= 0)
                         goto err;
+#endif
                 }
 
         if(!(cflag & X509_FLAG_NO_ISSUER))
@@ -255,7 +260,8 @@ int X509_ocspid_print (BIO *bp, X509 *x)
                 goto err;
         i2d_X509_NAME(x->cert_info->subject, &dertmp);
 
-        EVP_Digest(der, derlen, SHA1md, NULL, EVP_sha1(), NULL);
+        if (!EVP_Digest(der, derlen, SHA1md, NULL, EVP_sha1(), NULL))
+                goto err;
         for (i=0; i < SHA_DIGEST_LENGTH; i++)
                 {
                 if (BIO_printf(bp,"%02X",SHA1md[i]) <= 0) goto err;
@@ -268,8 +274,10 @@ int X509_ocspid_print (BIO *bp, X509 *x)
         if (BIO_printf(bp,"\n        Public key OCSP hash: ") <= 0)
                 goto err;
 
-        EVP_Digest(x->cert_info->key->public_key->data,
-                x->cert_info->key->public_key->length, SHA1md, NULL, EVP_sha1(), NULL);
+        if (!EVP_Digest(x->cert_info->key->public_key->data,
+                        x->cert_info->key->public_key->length,
+                        SHA1md, NULL, EVP_sha1(), NULL))
+                goto err;
         for (i=0; i < SHA_DIGEST_LENGTH; i++)
                 {
                 if (BIO_printf(bp,"%02X",SHA1md[i]) <= 0)
@@ -283,23 +291,50 @@ err:
         return(0);
         }
 
-int X509_signature_print(BIO *bp, X509_ALGOR *sigalg, ASN1_STRING *sig)
+int X509_signature_dump(BIO *bp, const ASN1_STRING *sig, int indent)
 {
-        unsigned char *s;
+        const unsigned char *s;
         int i, n;
-        if (BIO_puts(bp,"    Signature Algorithm: ") <= 0) return 0;
-        if (i2a_ASN1_OBJECT(bp, sigalg->algorithm) <= 0) return 0;
 
         n=sig->length;
         s=sig->data;
         for (i=0; i<n; i++)
                 {
                 if ((i%18) == 0)
-                        if (BIO_write(bp,"\n        ",9) <= 0) return 0;
+                        {
+                        if (BIO_write(bp,"\n",1) <= 0) return 0;
+                        if (BIO_indent(bp, indent, indent) <= 0) return 0;
+                        }
                         if (BIO_printf(bp,"%02x%s",s[i],
                                 ((i+1) == n)?"":":") <= 0) return 0;
                 }
         if (BIO_write(bp,"\n",1) != 1) return 0;
+
+        return 1;
+}
+
+int X509_signature_print(BIO *bp, X509_ALGOR *sigalg, ASN1_STRING *sig)
+{
+        int sig_nid;
+        if (BIO_puts(bp,"    Signature Algorithm: ") <= 0) return 0;
+        if (i2a_ASN1_OBJECT(bp, sigalg->algorithm) <= 0) return 0;
+
+        sig_nid = OBJ_obj2nid(sigalg->algorithm);
+        if (sig_nid != NID_undef)
+                {
+                int pkey_nid, dig_nid;
+                const EVP_PKEY_ASN1_METHOD *ameth;
+                if (OBJ_find_sigid_algs(sig_nid, &dig_nid, &pkey_nid))
+                        {
+                        ameth = EVP_PKEY_asn1_find(NULL, pkey_nid);
+                        if (ameth && ameth->sig_print)
+                                return ameth->sig_print(bp, sigalg, sig, 9, 0);
+                        }
+                }
+        if (sig)
+                return X509_signature_dump(bp, sig, 9);
+        else if (BIO_puts(bp, "\n") <= 0)
+                return 0;
         return 1;
 }
 
diff --git a/src/lib/libcrypto/asn1/tasn_prn.c b/src/lib/libcrypto/asn1/tasn_prn.c
index 453698012d..542a091a66 100644
--- a/src/lib/libcrypto/asn1/tasn_prn.c
+++ b/src/lib/libcrypto/asn1/tasn_prn.c
@@ -446,11 +446,11 @@ static int asn1_print_fsname(BIO *out, int indent,
         return 1;
         }
 
-static int asn1_print_boolean_ctx(BIO *out, const int bool,
+static int asn1_print_boolean_ctx(BIO *out, int boolval,
                                                         const ASN1_PCTX *pctx)
         {
         const char *str;
-        switch (bool)
+        switch (boolval)
                 {
                 case -1:
                 str = "BOOL ABSENT";
@@ -574,10 +574,10 @@ static int asn1_primitive_print(BIO *out, ASN1_VALUE **fld,
                 {
                 case V_ASN1_BOOLEAN:
                         {
-                        int bool = *(int *)fld;
-                        if (bool == -1)
-                                bool = it->size;
-                        ret = asn1_print_boolean_ctx(out, bool, pctx);
+                        int boolval = *(int *)fld;
+                        if (boolval == -1)
+                                boolval = it->size;
+                        ret = asn1_print_boolean_ctx(out, boolval, pctx);
                         }
                 break;
 
diff --git a/src/lib/libcrypto/asn1/x_algor.c b/src/lib/libcrypto/asn1/x_algor.c
index 99e53429b7..274e456c73 100644
--- a/src/lib/libcrypto/asn1/x_algor.c
+++ b/src/lib/libcrypto/asn1/x_algor.c
@@ -128,3 +128,17 @@ void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,
                 }
         }
 
+/* Set up an X509_ALGOR DigestAlgorithmIdentifier from an EVP_MD */
+
+void X509_ALGOR_set_md(X509_ALGOR *alg, const EVP_MD *md)
+        {
+        int param_type;
+
+        if (md->flags & EVP_MD_FLAG_DIGALGID_ABSENT)
+                param_type = V_ASN1_UNDEF;
+        else
+                param_type = V_ASN1_NULL;
+
+        X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_MD_type(md)), param_type, NULL);
+
+        }
diff --git a/src/lib/libcrypto/asn1/x_name.c b/src/lib/libcrypto/asn1/x_name.c
index 49be08b4da..d7c2318693 100644
--- a/src/lib/libcrypto/asn1/x_name.c
+++ b/src/lib/libcrypto/asn1/x_name.c
@@ -399,8 +399,7 @@ static int asn1_string_canon(ASN1_STRING *out, ASN1_STRING *in)
         /* If type not in bitmask just copy string across */
         if (!(ASN1_tag2bit(in->type) & ASN1_MASK_CANON))
                 {
-                out->type = in->type;
-                if (!ASN1_STRING_set(out, in->data, in->length))
+                if (!ASN1_STRING_copy(out, in))
                         return 0;
                 return 1;
                 }
diff --git a/src/lib/libcrypto/asn1/x_pubkey.c b/src/lib/libcrypto/asn1/x_pubkey.c
index d42b6a2c54..627ec87f9f 100644
--- a/src/lib/libcrypto/asn1/x_pubkey.c
+++ b/src/lib/libcrypto/asn1/x_pubkey.c
@@ -171,7 +171,16 @@ EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
                 goto error;
                 }
 
-        key->pkey = ret;
+        /* Check to see if another thread set key->pkey first */
+        CRYPTO_w_lock(CRYPTO_LOCK_EVP_PKEY);
+        if (key->pkey)
+                {
+                EVP_PKEY_free(ret);
+                ret = key->pkey;
+                }
+        else
+                key->pkey = ret;
+        CRYPTO_w_unlock(CRYPTO_LOCK_EVP_PKEY);
         CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_EVP_PKEY);
 
         return ret;
diff --git a/src/lib/libcrypto/bf/bf_skey.c b/src/lib/libcrypto/bf/bf_skey.c
index 3673cdee6e..3b0bca41ae 100644
--- a/src/lib/libcrypto/bf/bf_skey.c
+++ b/src/lib/libcrypto/bf/bf_skey.c
@@ -58,11 +58,19 @@
 
 #include <stdio.h>
 #include <string.h>
+#include <openssl/crypto.h>
 #include <openssl/blowfish.h>
 #include "bf_locl.h"
 #include "bf_pi.h"
 
 void BF_set_key(BF_KEY *key, int len, const unsigned char *data)
+#ifdef OPENSSL_FIPS
+        {
+        fips_cipher_abort(BLOWFISH);
+        private_BF_set_key(key, len, data);
+        }
+void private_BF_set_key(BF_KEY *key, int len, const unsigned char *data)
+#endif
         {
         int i;
         BF_LONG *p,ri,in[2];
diff --git a/src/lib/libcrypto/bf/blowfish.h b/src/lib/libcrypto/bf/blowfish.h
index b97e76f9a3..4b6c8920a4 100644
--- a/src/lib/libcrypto/bf/blowfish.h
+++ b/src/lib/libcrypto/bf/blowfish.h
@@ -104,7 +104,9 @@ typedef struct bf_key_st
         BF_LONG S[4*256];
         } BF_KEY;
 
- 
+#ifdef OPENSSL_FIPS 
+void private_BF_set_key(BF_KEY *key, int len, const unsigned char *data);
+#endif
 void BF_set_key(BF_KEY *key, int len, const unsigned char *data);
 
 void BF_encrypt(BF_LONG *data,const BF_KEY *key);
diff --git a/src/lib/libcrypto/bio/b_sock.c b/src/lib/libcrypto/bio/b_sock.c
index d47310d650..41f958be71 100644
--- a/src/lib/libcrypto/bio/b_sock.c
+++ b/src/lib/libcrypto/bio/b_sock.c
@@ -960,7 +960,6 @@ int BIO_set_tcp_ndelay(int s, int on)
 #endif
         return(ret == 0);
         }
-#endif
 
 int BIO_socket_nbio(int s, int mode)
         {
@@ -973,3 +972,4 @@ int BIO_socket_nbio(int s, int mode)
 #endif
         return(ret == 0);
         }
+#endif
diff --git a/src/lib/libcrypto/bio/bio.h b/src/lib/libcrypto/bio/bio.h
index ab47abcf14..05699ab212 100644
--- a/src/lib/libcrypto/bio/bio.h
+++ b/src/lib/libcrypto/bio/bio.h
@@ -68,6 +68,14 @@
 
 #include <openssl/crypto.h>
 
+#ifndef OPENSSL_NO_SCTP
+# ifndef OPENSSL_SYS_VMS
+# include <stdint.h>
+# else
+# include <inttypes.h>
+# endif
+#endif
+
 #ifdef  __cplusplus
 extern "C" {
 #endif
@@ -95,6 +103,9 @@ extern "C" {
 #define BIO_TYPE_BIO            (19|0x0400)             /* (half a) BIO pair */
 #define BIO_TYPE_LINEBUFFER     (20|0x0200)             /* filter */
 #define BIO_TYPE_DGRAM          (21|0x0400|0x0100)
+#ifndef OPENSSL_NO_SCTP
+#define BIO_TYPE_DGRAM_SCTP     (24|0x0400|0x0100)
+#endif
 #define BIO_TYPE_ASN1           (22|0x0200)             /* filter */
 #define BIO_TYPE_COMP           (23|0x0200)             /* filter */
 
@@ -146,6 +157,7 @@ extern "C" {
 /* #endif */
 
 #define BIO_CTRL_DGRAM_QUERY_MTU          40 /* as kernel for current MTU */
+#define BIO_CTRL_DGRAM_GET_FALLBACK_MTU   47
 #define BIO_CTRL_DGRAM_GET_MTU            41 /* get cached value for MTU */
 #define BIO_CTRL_DGRAM_SET_MTU            42 /* set cached value for
                                               * MTU. want to use this
@@ -161,7 +173,22 @@ extern "C" {
 #define BIO_CTRL_DGRAM_SET_PEER           44 /* Destination for the data */
 
 #define BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT   45 /* Next DTLS handshake timeout to
-                                                                                          * adjust socket timeouts */
+                                              * adjust socket timeouts */
+
+#ifndef OPENSSL_NO_SCTP
+/* SCTP stuff */
+#define BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE    50
+#define BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY                51
+#define BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY               52
+#define BIO_CTRL_DGRAM_SCTP_AUTH_CCS_RCVD               53
+#define BIO_CTRL_DGRAM_SCTP_GET_SNDINFO         60
+#define BIO_CTRL_DGRAM_SCTP_SET_SNDINFO         61
+#define BIO_CTRL_DGRAM_SCTP_GET_RCVINFO         62
+#define BIO_CTRL_DGRAM_SCTP_SET_RCVINFO         63
+#define BIO_CTRL_DGRAM_SCTP_GET_PRINFO                  64
+#define BIO_CTRL_DGRAM_SCTP_SET_PRINFO                  65
+#define BIO_CTRL_DGRAM_SCTP_SAVE_SHUTDOWN               70
+#endif
 
 /* modifiers */
 #define BIO_FP_READ             0x02
@@ -331,6 +358,34 @@ typedef struct bio_f_buffer_ctx_struct
 /* Prefix and suffix callback in ASN1 BIO */
 typedef int asn1_ps_func(BIO *b, unsigned char **pbuf, int *plen, void *parg);
 
+#ifndef OPENSSL_NO_SCTP
+/* SCTP parameter structs */
+struct bio_dgram_sctp_sndinfo
+        {
+        uint16_t snd_sid;
+        uint16_t snd_flags;
+        uint32_t snd_ppid;
+        uint32_t snd_context;
+        };
+
+struct bio_dgram_sctp_rcvinfo
+        {
+        uint16_t rcv_sid;
+        uint16_t rcv_ssn;
+        uint16_t rcv_flags;
+        uint32_t rcv_ppid;
+        uint32_t rcv_tsn;
+        uint32_t rcv_cumtsn;
+        uint32_t rcv_context;
+        };
+
+struct bio_dgram_sctp_prinfo
+        {
+        uint16_t pr_policy;
+        uint32_t pr_value;
+        };
+#endif
+
 /* connect BIO stuff */
 #define BIO_CONN_S_BEFORE               1
 #define BIO_CONN_S_GET_IP               2
@@ -628,6 +683,9 @@ BIO_METHOD *BIO_f_linebuffer(void);
 BIO_METHOD *BIO_f_nbio_test(void);
 #ifndef OPENSSL_NO_DGRAM
 BIO_METHOD *BIO_s_datagram(void);
+#ifndef OPENSSL_NO_SCTP
+BIO_METHOD *BIO_s_datagram_sctp(void);
+#endif
 #endif
 
 /* BIO_METHOD *BIO_f_ber(void); */
@@ -670,6 +728,15 @@ int BIO_set_tcp_ndelay(int sock,int turn_on);
 
 BIO *BIO_new_socket(int sock, int close_flag);
 BIO *BIO_new_dgram(int fd, int close_flag);
+#ifndef OPENSSL_NO_SCTP
+BIO *BIO_new_dgram_sctp(int fd, int close_flag);
+int BIO_dgram_is_sctp(BIO *bio);
+int BIO_dgram_sctp_notification_cb(BIO *b,
+                                   void (*handle_notifications)(BIO *bio, void *context, void *buf),
+                                   void *context);
+int BIO_dgram_sctp_wait_for_dry(BIO *b);
+int BIO_dgram_sctp_msg_waiting(BIO *b);
+#endif
 BIO *BIO_new_fd(int fd, int close_flag);
 BIO *BIO_new_connect(char *host_port);
 BIO *BIO_new_accept(char *host_port);
@@ -734,6 +801,7 @@ void ERR_load_BIO_strings(void);
 #define BIO_F_BUFFER_CTRL                                114
 #define BIO_F_CONN_CTRL                                  127
 #define BIO_F_CONN_STATE                                 115
+#define BIO_F_DGRAM_SCTP_READ                            132
 #define BIO_F_FILE_CTRL                                  116
 #define BIO_F_FILE_READ                                  130
 #define BIO_F_LINEBUFFER_CTRL                            129
diff --git a/src/lib/libcrypto/bio/bio_err.c b/src/lib/libcrypto/bio/bio_err.c
index a224edd5a0..0dbfbd80d3 100644
--- a/src/lib/libcrypto/bio/bio_err.c
+++ b/src/lib/libcrypto/bio/bio_err.c
@@ -1,6 +1,6 @@
 /* crypto/bio/bio_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -95,6 +95,7 @@ static ERR_STRING_DATA BIO_str_functs[]=
 {ERR_FUNC(BIO_F_BUFFER_CTRL),   "BUFFER_CTRL"},
 {ERR_FUNC(BIO_F_CONN_CTRL),     "CONN_CTRL"},
 {ERR_FUNC(BIO_F_CONN_STATE),    "CONN_STATE"},
+{ERR_FUNC(BIO_F_DGRAM_SCTP_READ),       "DGRAM_SCTP_READ"},
 {ERR_FUNC(BIO_F_FILE_CTRL),     "FILE_CTRL"},
 {ERR_FUNC(BIO_F_FILE_READ),     "FILE_READ"},
 {ERR_FUNC(BIO_F_LINEBUFFER_CTRL),       "LINEBUFFER_CTRL"},
diff --git a/src/lib/libcrypto/bio/bio_lib.c b/src/lib/libcrypto/bio/bio_lib.c
index e12bc3a2ca..9c9646afa8 100644
--- a/src/lib/libcrypto/bio/bio_lib.c
+++ b/src/lib/libcrypto/bio/bio_lib.c
@@ -521,40 +521,40 @@ void BIO_free_all(BIO *bio)
 
 BIO *BIO_dup_chain(BIO *in)
         {
-        BIO *ret=NULL,*eoc=NULL,*bio,*new;
+        BIO *ret=NULL,*eoc=NULL,*bio,*new_bio;
 
         for (bio=in; bio != NULL; bio=bio->next_bio)
                 {
-                if ((new=BIO_new(bio->method)) == NULL) goto err;
-                new->callback=bio->callback;
-                new->cb_arg=bio->cb_arg;
-                new->init=bio->init;
-                new->shutdown=bio->shutdown;
-                new->flags=bio->flags;
+                if ((new_bio=BIO_new(bio->method)) == NULL) goto err;
+                new_bio->callback=bio->callback;
+                new_bio->cb_arg=bio->cb_arg;
+                new_bio->init=bio->init;
+                new_bio->shutdown=bio->shutdown;
+                new_bio->flags=bio->flags;
 
                 /* This will let SSL_s_sock() work with stdin/stdout */
-                new->num=bio->num;
+                new_bio->num=bio->num;
 
-                if (!BIO_dup_state(bio,(char *)new))
+                if (!BIO_dup_state(bio,(char *)new_bio))
                         {
-                        BIO_free(new);
+                        BIO_free(new_bio);
                         goto err;
                         }
 
                 /* copy app data */
-                if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_BIO, &new->ex_data,
+                if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_BIO, &new_bio->ex_data,
                                         &bio->ex_data))
                         goto err;
 
                 if (ret == NULL)
                         {
-                        eoc=new;
+                        eoc=new_bio;
                         ret=eoc;
                         }
                 else
                         {
-                        BIO_push(eoc,new);
-                        eoc=new;
+                        BIO_push(eoc,new_bio);
+                        eoc=new_bio;
                         }
                 }
         return(ret);
diff --git a/src/lib/libcrypto/bio/bss_bio.c b/src/lib/libcrypto/bio/bss_bio.c
index 76bd48e767..52ef0ebcb3 100644
--- a/src/lib/libcrypto/bio/bss_bio.c
+++ b/src/lib/libcrypto/bio/bss_bio.c
@@ -277,10 +277,10 @@ static int bio_read(BIO *bio, char *buf, int size_)
  */
 /* WARNING: The non-copying interface is largely untested as of yet
  * and may contain bugs. */
-static ssize_t bio_nread0(BIO *bio, char **buf)
+static ossl_ssize_t bio_nread0(BIO *bio, char **buf)
         {
         struct bio_bio_st *b, *peer_b;
-        ssize_t num;
+        ossl_ssize_t num;
         
         BIO_clear_retry_flags(bio);
 
@@ -315,15 +315,15 @@ static ssize_t bio_nread0(BIO *bio, char **buf)
         return num;
         }
 
-static ssize_t bio_nread(BIO *bio, char **buf, size_t num_)
+static ossl_ssize_t bio_nread(BIO *bio, char **buf, size_t num_)
         {
         struct bio_bio_st *b, *peer_b;
-        ssize_t num, available;
+        ossl_ssize_t num, available;
 
         if (num_ > SSIZE_MAX)
                 num = SSIZE_MAX;
         else
-                num = (ssize_t)num_;
+                num = (ossl_ssize_t)num_;
 
         available = bio_nread0(bio, buf);
         if (num > available)
@@ -428,7 +428,7 @@ static int bio_write(BIO *bio, const char *buf, int num_)
  * (example usage:  bio_nwrite0(), write to buffer, bio_nwrite()
  *  or just         bio_nwrite(), write to buffer)
  */
-static ssize_t bio_nwrite0(BIO *bio, char **buf)
+static ossl_ssize_t bio_nwrite0(BIO *bio, char **buf)
         {
         struct bio_bio_st *b;
         size_t num;
@@ -476,15 +476,15 @@ static ssize_t bio_nwrite0(BIO *bio, char **buf)
         return num;
         }
 
-static ssize_t bio_nwrite(BIO *bio, char **buf, size_t num_)
+static ossl_ssize_t bio_nwrite(BIO *bio, char **buf, size_t num_)
         {
         struct bio_bio_st *b;
-        ssize_t num, space;
+        ossl_ssize_t num, space;
 
         if (num_ > SSIZE_MAX)
                 num = SSIZE_MAX;
         else
-                num = (ssize_t)num_;
+                num = (ossl_ssize_t)num_;
 
         space = bio_nwrite0(bio, buf);
         if (num > space)
diff --git a/src/lib/libcrypto/bio/bss_dgram.c b/src/lib/libcrypto/bio/bss_dgram.c
index 71ebe987b6..1b1e4bec81 100644
--- a/src/lib/libcrypto/bio/bss_dgram.c
+++ b/src/lib/libcrypto/bio/bss_dgram.c
@@ -70,6 +70,13 @@
 #include <sys/timeb.h>
 #endif
 
+#ifndef OPENSSL_NO_SCTP
+#include <netinet/sctp.h>
+#include <fcntl.h>
+#define OPENSSL_SCTP_DATA_CHUNK_TYPE            0x00
+#define OPENSSL_SCTP_FORWARD_CUM_TSN_CHUNK_TYPE 0xc0
+#endif
+
 #ifdef OPENSSL_SYS_LINUX
 #define IP_MTU      14 /* linux is lame */
 #endif
@@ -88,6 +95,18 @@ static int dgram_new(BIO *h);
 static int dgram_free(BIO *data);
 static int dgram_clear(BIO *bio);
 
+#ifndef OPENSSL_NO_SCTP
+static int dgram_sctp_write(BIO *h, const char *buf, int num);
+static int dgram_sctp_read(BIO *h, char *buf, int size);
+static int dgram_sctp_puts(BIO *h, const char *str);
+static long dgram_sctp_ctrl(BIO *h, int cmd, long arg1, void *arg2);
+static int dgram_sctp_new(BIO *h);
+static int dgram_sctp_free(BIO *data);
+#ifdef SCTP_AUTHENTICATION_EVENT
+static void dgram_sctp_handle_auth_free_key_event(BIO *b, union sctp_notification *snp);
+#endif
+#endif
+
 static int BIO_dgram_should_retry(int s);
 
 static void get_current_time(struct timeval *t);
@@ -106,6 +125,22 @@ static BIO_METHOD methods_dgramp=
         NULL,
         };
 
+#ifndef OPENSSL_NO_SCTP
+static BIO_METHOD methods_dgramp_sctp=
+        {
+        BIO_TYPE_DGRAM_SCTP,
+        "datagram sctp socket",
+        dgram_sctp_write,
+        dgram_sctp_read,
+        dgram_sctp_puts,
+        NULL, /* dgram_gets, */
+        dgram_sctp_ctrl,
+        dgram_sctp_new,
+        dgram_sctp_free,
+        NULL,
+        };
+#endif
+
 typedef struct bio_dgram_data_st
         {
         union {
@@ -122,6 +157,40 @@ typedef struct bio_dgram_data_st
         struct timeval socket_timeout;
         } bio_dgram_data;
 
+#ifndef OPENSSL_NO_SCTP
+typedef struct bio_dgram_sctp_save_message_st
+        {
+        BIO *bio;
+        char *data;
+        int length;
+        } bio_dgram_sctp_save_message;
+
+typedef struct bio_dgram_sctp_data_st
+        {
+        union {
+                struct sockaddr sa;
+                struct sockaddr_in sa_in;
+#if OPENSSL_USE_IPV6
+                struct sockaddr_in6 sa_in6;
+#endif
+        } peer;
+        unsigned int connected;
+        unsigned int _errno;
+        unsigned int mtu;
+        struct bio_dgram_sctp_sndinfo sndinfo;
+        struct bio_dgram_sctp_rcvinfo rcvinfo;
+        struct bio_dgram_sctp_prinfo prinfo;
+        void (*handle_notifications)(BIO *bio, void *context, void *buf);
+        void* notification_context;
+        int in_handshake;
+        int ccs_rcvd;
+        int ccs_sent;
+        int save_shutdown;
+        int peer_auth_tested;
+        bio_dgram_sctp_save_message saved_message;
+        } bio_dgram_sctp_data;
+#endif
+
 BIO_METHOD *BIO_s_datagram(void)
         {
         return(&methods_dgramp);
@@ -547,6 +616,27 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
                 ret = 0;
 #endif
                 break;
+        case BIO_CTRL_DGRAM_GET_FALLBACK_MTU:
+                switch (data->peer.sa.sa_family)
+                        {
+                        case AF_INET:
+                                ret = 576 - 20 - 8;
+                                break;
+#if OPENSSL_USE_IPV6
+                        case AF_INET6:
+#ifdef IN6_IS_ADDR_V4MAPPED
+                                if (IN6_IS_ADDR_V4MAPPED(&data->peer.sa_in6.sin6_addr))
+                                        ret = 576 - 20 - 8;
+                                else
+#endif
+                                        ret = 1280 - 40 - 8;
+                                break;
+#endif
+                        default:
+                                ret = 576 - 20 - 8;
+                                break;
+                        }
+                break;
         case BIO_CTRL_DGRAM_GET_MTU:
                 return data->mtu;
                 break;
@@ -738,6 +828,912 @@ static int dgram_puts(BIO *bp, const char *str)
         return(ret);
         }
 
+#ifndef OPENSSL_NO_SCTP
+BIO_METHOD *BIO_s_datagram_sctp(void)
+        {
+        return(&methods_dgramp_sctp);
+        }
+
+BIO *BIO_new_dgram_sctp(int fd, int close_flag)
+        {
+        BIO *bio;
+        int ret, optval = 20000;
+        int auth_data = 0, auth_forward = 0;
+        unsigned char *p;
+        struct sctp_authchunk auth;
+        struct sctp_authchunks *authchunks;
+        socklen_t sockopt_len;
+#ifdef SCTP_AUTHENTICATION_EVENT
+#ifdef SCTP_EVENT
+        struct sctp_event event;
+#else
+        struct sctp_event_subscribe event;
+#endif
+#endif
+
+        bio=BIO_new(BIO_s_datagram_sctp());
+        if (bio == NULL) return(NULL);
+        BIO_set_fd(bio,fd,close_flag);
+
+        /* Activate SCTP-AUTH for DATA and FORWARD-TSN chunks */
+        auth.sauth_chunk = OPENSSL_SCTP_DATA_CHUNK_TYPE;
+        ret = setsockopt(fd, IPPROTO_SCTP, SCTP_AUTH_CHUNK, &auth, sizeof(struct sctp_authchunk));
+        OPENSSL_assert(ret >= 0);
+        auth.sauth_chunk = OPENSSL_SCTP_FORWARD_CUM_TSN_CHUNK_TYPE;
+        ret = setsockopt(fd, IPPROTO_SCTP, SCTP_AUTH_CHUNK, &auth, sizeof(struct sctp_authchunk));
+        OPENSSL_assert(ret >= 0);
+
+        /* Test if activation was successful. When using accept(),
+         * SCTP-AUTH has to be activated for the listening socket
+         * already, otherwise the connected socket won't use it. */
+        sockopt_len = (socklen_t)(sizeof(sctp_assoc_t) + 256 * sizeof(uint8_t));
+        authchunks = OPENSSL_malloc(sockopt_len);
+        memset(authchunks, 0, sizeof(sockopt_len));
+        ret = getsockopt(fd, IPPROTO_SCTP, SCTP_LOCAL_AUTH_CHUNKS, authchunks, &sockopt_len);
+        OPENSSL_assert(ret >= 0);
+        
+        for (p = (unsigned char*) authchunks + sizeof(sctp_assoc_t);
+             p < (unsigned char*) authchunks + sockopt_len;
+             p += sizeof(uint8_t))
+                {
+                if (*p == OPENSSL_SCTP_DATA_CHUNK_TYPE) auth_data = 1;
+                if (*p == OPENSSL_SCTP_FORWARD_CUM_TSN_CHUNK_TYPE) auth_forward = 1;
+                }
+                
+        OPENSSL_free(authchunks);
+
+        OPENSSL_assert(auth_data);
+        OPENSSL_assert(auth_forward);
+
+#ifdef SCTP_AUTHENTICATION_EVENT
+#ifdef SCTP_EVENT
+        memset(&event, 0, sizeof(struct sctp_event));
+        event.se_assoc_id = 0;
+        event.se_type = SCTP_AUTHENTICATION_EVENT;
+        event.se_on = 1;
+        ret = setsockopt(fd, IPPROTO_SCTP, SCTP_EVENT, &event, sizeof(struct sctp_event));
+        OPENSSL_assert(ret >= 0);
+#else
+        sockopt_len = (socklen_t) sizeof(struct sctp_event_subscribe);
+        ret = getsockopt(fd, IPPROTO_SCTP, SCTP_EVENTS, &event, &sockopt_len);
+        OPENSSL_assert(ret >= 0);
+
+        event.sctp_authentication_event = 1;
+
+        ret = setsockopt(fd, IPPROTO_SCTP, SCTP_EVENTS, &event, sizeof(struct sctp_event_subscribe));
+        OPENSSL_assert(ret >= 0);
+#endif
+#endif
+
+        /* Disable partial delivery by setting the min size
+         * larger than the max record size of 2^14 + 2048 + 13
+         */
+        ret = setsockopt(fd, IPPROTO_SCTP, SCTP_PARTIAL_DELIVERY_POINT, &optval, sizeof(optval));
+        OPENSSL_assert(ret >= 0);
+
+        return(bio);
+        }
+
+int BIO_dgram_is_sctp(BIO *bio)
+        {
+        return (BIO_method_type(bio) == BIO_TYPE_DGRAM_SCTP);
+        }
+
+static int dgram_sctp_new(BIO *bi)
+        {
+        bio_dgram_sctp_data *data = NULL;
+
+        bi->init=0;
+        bi->num=0;
+        data = OPENSSL_malloc(sizeof(bio_dgram_sctp_data));
+        if (data == NULL)
+                return 0;
+        memset(data, 0x00, sizeof(bio_dgram_sctp_data));
+#ifdef SCTP_PR_SCTP_NONE
+        data->prinfo.pr_policy = SCTP_PR_SCTP_NONE;
+#endif
+    bi->ptr = data;
+
+        bi->flags=0;
+        return(1);
+        }
+
+static int dgram_sctp_free(BIO *a)
+        {
+        bio_dgram_sctp_data *data;
+
+        if (a == NULL) return(0);
+        if ( ! dgram_clear(a))
+                return 0;
+
+        data = (bio_dgram_sctp_data *)a->ptr;
+        if(data != NULL) OPENSSL_free(data);
+
+        return(1);
+        }
+
+#ifdef SCTP_AUTHENTICATION_EVENT
+void dgram_sctp_handle_auth_free_key_event(BIO *b, union sctp_notification *snp)
+        {
+        unsigned int sockopt_len = 0;
+        int ret;
+        struct sctp_authkey_event* authkeyevent = &snp->sn_auth_event;
+
+        if (authkeyevent->auth_indication == SCTP_AUTH_FREE_KEY)
+                {
+                struct sctp_authkeyid authkeyid;
+
+                /* delete key */
+                authkeyid.scact_keynumber = authkeyevent->auth_keynumber;
+                sockopt_len = sizeof(struct sctp_authkeyid);
+                ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_DELETE_KEY,
+                      &authkeyid, sockopt_len);
+                }
+        }
+#endif
+
+static int dgram_sctp_read(BIO *b, char *out, int outl)
+        {
+        int ret = 0, n = 0, i, optval;
+        socklen_t optlen;
+        bio_dgram_sctp_data *data = (bio_dgram_sctp_data *)b->ptr;
+        union sctp_notification *snp;
+        struct msghdr msg;
+        struct iovec iov;
+        struct cmsghdr *cmsg;
+        char cmsgbuf[512];
+
+        if (out != NULL)
+                {
+                clear_socket_error();
+
+                do
+                        {
+                        memset(&data->rcvinfo, 0x00, sizeof(struct bio_dgram_sctp_rcvinfo));
+                        iov.iov_base = out;
+                        iov.iov_len = outl;
+                        msg.msg_name = NULL;
+                        msg.msg_namelen = 0;
+                        msg.msg_iov = &iov;
+                        msg.msg_iovlen = 1;
+                        msg.msg_control = cmsgbuf;
+                        msg.msg_controllen = 512;
+                        msg.msg_flags = 0;
+                        n = recvmsg(b->num, &msg, 0);
+
+                        if (msg.msg_controllen > 0)
+                                {
+                                for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
+                                        {
+                                        if (cmsg->cmsg_level != IPPROTO_SCTP)
+                                                continue;
+#ifdef SCTP_RCVINFO
+                                        if (cmsg->cmsg_type == SCTP_RCVINFO)
+                                                {
+                                                struct sctp_rcvinfo *rcvinfo;
+
+                                                rcvinfo = (struct sctp_rcvinfo *)CMSG_DATA(cmsg);
+                                                data->rcvinfo.rcv_sid = rcvinfo->rcv_sid;
+                                                data->rcvinfo.rcv_ssn = rcvinfo->rcv_ssn;
+                                                data->rcvinfo.rcv_flags = rcvinfo->rcv_flags;
+                                                data->rcvinfo.rcv_ppid = rcvinfo->rcv_ppid;
+                                                data->rcvinfo.rcv_tsn = rcvinfo->rcv_tsn;
+                                                data->rcvinfo.rcv_cumtsn = rcvinfo->rcv_cumtsn;
+                                                data->rcvinfo.rcv_context = rcvinfo->rcv_context;
+                                                }
+#endif
+#ifdef SCTP_SNDRCV
+                                        if (cmsg->cmsg_type == SCTP_SNDRCV)
+                                                {
+                                                struct sctp_sndrcvinfo *sndrcvinfo;
+
+                                                sndrcvinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmsg);
+                                                data->rcvinfo.rcv_sid = sndrcvinfo->sinfo_stream;
+                                                data->rcvinfo.rcv_ssn = sndrcvinfo->sinfo_ssn;
+                                                data->rcvinfo.rcv_flags = sndrcvinfo->sinfo_flags;
+                                                data->rcvinfo.rcv_ppid = sndrcvinfo->sinfo_ppid;
+                                                data->rcvinfo.rcv_tsn = sndrcvinfo->sinfo_tsn;
+                                                data->rcvinfo.rcv_cumtsn = sndrcvinfo->sinfo_cumtsn;
+                                                data->rcvinfo.rcv_context = sndrcvinfo->sinfo_context;
+                                                }
+#endif
+                                        }
+                                }
+
+                        if (n <= 0)
+                                {
+                                if (n < 0)
+                                        ret = n;
+                                break;
+                                }
+
+                        if (msg.msg_flags & MSG_NOTIFICATION)
+                                {
+                                snp = (union sctp_notification*) out;
+                                if (snp->sn_header.sn_type == SCTP_SENDER_DRY_EVENT)
+                                        {
+#ifdef SCTP_EVENT
+                                        struct sctp_event event;
+#else
+                                        struct sctp_event_subscribe event;
+                                        socklen_t eventsize;
+#endif
+                                        /* If a message has been delayed until the socket
+                                         * is dry, it can be sent now.
+                                         */
+                                        if (data->saved_message.length > 0)
+                                                {
+                                                dgram_sctp_write(data->saved_message.bio, data->saved_message.data,
+                                                                 data->saved_message.length);
+                                                OPENSSL_free(data->saved_message.data);
+                                                data->saved_message.length = 0;
+                                                }
+
+                                        /* disable sender dry event */
+#ifdef SCTP_EVENT
+                                        memset(&event, 0, sizeof(struct sctp_event));
+                                        event.se_assoc_id = 0;
+                                        event.se_type = SCTP_SENDER_DRY_EVENT;
+                                        event.se_on = 0;
+                                        i = setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENT, &event, sizeof(struct sctp_event));
+                                        OPENSSL_assert(i >= 0);
+#else
+                                        eventsize = sizeof(struct sctp_event_subscribe);
+                                        i = getsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event, &eventsize);
+                                        OPENSSL_assert(i >= 0);
+
+                                        event.sctp_sender_dry_event = 0;
+
+                                        i = setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event, sizeof(struct sctp_event_subscribe));
+                                        OPENSSL_assert(i >= 0);
+#endif
+                                        }
+
+#ifdef SCTP_AUTHENTICATION_EVENT
+                                if (snp->sn_header.sn_type == SCTP_AUTHENTICATION_EVENT)
+                                        dgram_sctp_handle_auth_free_key_event(b, snp);
+#endif
+
+                                if (data->handle_notifications != NULL)
+                                        data->handle_notifications(b, data->notification_context, (void*) out);
+
+                                memset(out, 0, outl);
+                                }
+                        else
+                                ret += n;
+                        }
+                while ((msg.msg_flags & MSG_NOTIFICATION) && (msg.msg_flags & MSG_EOR) && (ret < outl));
+
+                if (ret > 0 && !(msg.msg_flags & MSG_EOR))
+                        {
+                        /* Partial message read, this should never happen! */
+
+                        /* The buffer was too small, this means the peer sent
+                         * a message that was larger than allowed. */
+                        if (ret == outl)
+                                return -1;
+
+                        /* Test if socket buffer can handle max record
+                         * size (2^14 + 2048 + 13)
+                         */
+                        optlen = (socklen_t) sizeof(int);
+                        ret = getsockopt(b->num, SOL_SOCKET, SO_RCVBUF, &optval, &optlen);
+                        OPENSSL_assert(ret >= 0);
+                        OPENSSL_assert(optval >= 18445);
+
+                        /* Test if SCTP doesn't partially deliver below
+                         * max record size (2^14 + 2048 + 13)
+                         */
+                        optlen = (socklen_t) sizeof(int);
+                        ret = getsockopt(b->num, IPPROTO_SCTP, SCTP_PARTIAL_DELIVERY_POINT,
+                                         &optval, &optlen);
+                        OPENSSL_assert(ret >= 0);
+                        OPENSSL_assert(optval >= 18445);
+
+                        /* Partially delivered notification??? Probably a bug.... */
+                        OPENSSL_assert(!(msg.msg_flags & MSG_NOTIFICATION));
+
+                        /* Everything seems ok till now, so it's most likely
+                         * a message dropped by PR-SCTP.
+                         */
+                        memset(out, 0, outl);
+                        BIO_set_retry_read(b);
+                        return -1;
+                        }
+
+                BIO_clear_retry_flags(b);
+                if (ret < 0)
+                        {
+                        if (BIO_dgram_should_retry(ret))
+                                {
+                                BIO_set_retry_read(b);
+                                data->_errno = get_last_socket_error();
+                                }
+                        }
+
+                /* Test if peer uses SCTP-AUTH before continuing */
+                if (!data->peer_auth_tested)
+                        {
+                        int ii, auth_data = 0, auth_forward = 0;
+                        unsigned char *p;
+                        struct sctp_authchunks *authchunks;
+
+                        optlen = (socklen_t)(sizeof(sctp_assoc_t) + 256 * sizeof(uint8_t));
+                        authchunks = OPENSSL_malloc(optlen);
+                        memset(authchunks, 0, sizeof(optlen));
+                        ii = getsockopt(b->num, IPPROTO_SCTP, SCTP_PEER_AUTH_CHUNKS, authchunks, &optlen);
+                        OPENSSL_assert(ii >= 0);
+
+                        for (p = (unsigned char*) authchunks + sizeof(sctp_assoc_t);
+                                 p < (unsigned char*) authchunks + optlen;
+                                 p += sizeof(uint8_t))
+                                {
+                                if (*p == OPENSSL_SCTP_DATA_CHUNK_TYPE) auth_data = 1;
+                                if (*p == OPENSSL_SCTP_FORWARD_CUM_TSN_CHUNK_TYPE) auth_forward = 1;
+                                }
+
+                        OPENSSL_free(authchunks);
+
+                        if (!auth_data || !auth_forward)
+                                {
+                                BIOerr(BIO_F_DGRAM_SCTP_READ,BIO_R_CONNECT_ERROR);
+                                return -1;
+                                }
+
+                        data->peer_auth_tested = 1;
+                        }
+                }
+        return(ret);
+        }
+
+static int dgram_sctp_write(BIO *b, const char *in, int inl)
+        {
+        int ret;
+        bio_dgram_sctp_data *data = (bio_dgram_sctp_data *)b->ptr;
+        struct bio_dgram_sctp_sndinfo *sinfo = &(data->sndinfo);
+        struct bio_dgram_sctp_prinfo *pinfo = &(data->prinfo);
+        struct bio_dgram_sctp_sndinfo handshake_sinfo;
+        struct iovec iov[1];
+        struct msghdr msg;
+        struct cmsghdr *cmsg;
+#if defined(SCTP_SNDINFO) && defined(SCTP_PRINFO)
+        char cmsgbuf[CMSG_SPACE(sizeof(struct sctp_sndinfo)) + CMSG_SPACE(sizeof(struct sctp_prinfo))];
+        struct sctp_sndinfo *sndinfo;
+        struct sctp_prinfo *prinfo;
+#else
+        char cmsgbuf[CMSG_SPACE(sizeof(struct sctp_sndrcvinfo))];
+        struct sctp_sndrcvinfo *sndrcvinfo;
+#endif
+
+        clear_socket_error();
+
+        /* If we're send anything else than application data,
+         * disable all user parameters and flags.
+         */
+        if (in[0] != 23) {
+                memset(&handshake_sinfo, 0x00, sizeof(struct bio_dgram_sctp_sndinfo));
+#ifdef SCTP_SACK_IMMEDIATELY
+                handshake_sinfo.snd_flags = SCTP_SACK_IMMEDIATELY;
+#endif
+                sinfo = &handshake_sinfo;
+        }
+
+        /* If we have to send a shutdown alert message and the
+         * socket is not dry yet, we have to save it and send it
+         * as soon as the socket gets dry.
+         */
+        if (data->save_shutdown && !BIO_dgram_sctp_wait_for_dry(b))
+        {
+                data->saved_message.bio = b;
+                data->saved_message.length = inl;
+                data->saved_message.data = OPENSSL_malloc(inl);
+                memcpy(data->saved_message.data, in, inl);
+                return inl;
+        }
+
+        iov[0].iov_base = (char *)in;
+        iov[0].iov_len = inl;
+        msg.msg_name = NULL;
+        msg.msg_namelen = 0;
+        msg.msg_iov = iov;
+        msg.msg_iovlen = 1;
+        msg.msg_control = (caddr_t)cmsgbuf;
+        msg.msg_controllen = 0;
+        msg.msg_flags = 0;
+#if defined(SCTP_SNDINFO) && defined(SCTP_PRINFO)
+        cmsg = (struct cmsghdr *)cmsgbuf;
+        cmsg->cmsg_level = IPPROTO_SCTP;
+        cmsg->cmsg_type = SCTP_SNDINFO;
+        cmsg->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndinfo));
+        sndinfo = (struct sctp_sndinfo *)CMSG_DATA(cmsg);
+        memset(sndinfo, 0, sizeof(struct sctp_sndinfo));
+        sndinfo->snd_sid = sinfo->snd_sid;
+        sndinfo->snd_flags = sinfo->snd_flags;
+        sndinfo->snd_ppid = sinfo->snd_ppid;
+        sndinfo->snd_context = sinfo->snd_context;
+        msg.msg_controllen += CMSG_SPACE(sizeof(struct sctp_sndinfo));
+
+        cmsg = (struct cmsghdr *)&cmsgbuf[CMSG_SPACE(sizeof(struct sctp_sndinfo))];
+        cmsg->cmsg_level = IPPROTO_SCTP;
+        cmsg->cmsg_type = SCTP_PRINFO;
+        cmsg->cmsg_len = CMSG_LEN(sizeof(struct sctp_prinfo));
+        prinfo = (struct sctp_prinfo *)CMSG_DATA(cmsg);
+        memset(prinfo, 0, sizeof(struct sctp_prinfo));
+        prinfo->pr_policy = pinfo->pr_policy;
+        prinfo->pr_value = pinfo->pr_value;
+        msg.msg_controllen += CMSG_SPACE(sizeof(struct sctp_prinfo));
+#else
+        cmsg = (struct cmsghdr *)cmsgbuf;
+        cmsg->cmsg_level = IPPROTO_SCTP;
+        cmsg->cmsg_type = SCTP_SNDRCV;
+        cmsg->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
+        sndrcvinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmsg);
+        memset(sndrcvinfo, 0, sizeof(struct sctp_sndrcvinfo));
+        sndrcvinfo->sinfo_stream = sinfo->snd_sid;
+        sndrcvinfo->sinfo_flags = sinfo->snd_flags;
+#ifdef __FreeBSD__
+        sndrcvinfo->sinfo_flags |= pinfo->pr_policy;
+#endif
+        sndrcvinfo->sinfo_ppid = sinfo->snd_ppid;
+        sndrcvinfo->sinfo_context = sinfo->snd_context;
+        sndrcvinfo->sinfo_timetolive = pinfo->pr_value;
+        msg.msg_controllen += CMSG_SPACE(sizeof(struct sctp_sndrcvinfo));
+#endif
+
+        ret = sendmsg(b->num, &msg, 0);
+
+        BIO_clear_retry_flags(b);
+        if (ret <= 0)
+                {
+                if (BIO_dgram_should_retry(ret))
+                        {
+                        BIO_set_retry_write(b);  
+                        data->_errno = get_last_socket_error();
+                        }
+                }
+        return(ret);
+        }
+
+static long dgram_sctp_ctrl(BIO *b, int cmd, long num, void *ptr)
+        {
+        long ret=1;
+        bio_dgram_sctp_data *data = NULL;
+        unsigned int sockopt_len = 0;
+        struct sctp_authkeyid authkeyid;
+        struct sctp_authkey *authkey;
+
+        data = (bio_dgram_sctp_data *)b->ptr;
+
+        switch (cmd)
+                {
+        case BIO_CTRL_DGRAM_QUERY_MTU:
+                /* Set to maximum (2^14)
+                 * and ignore user input to enable transport
+                 * protocol fragmentation.
+                 * Returns always 2^14.
+                 */
+                data->mtu = 16384;
+                ret = data->mtu;
+                break;
+        case BIO_CTRL_DGRAM_SET_MTU:
+                /* Set to maximum (2^14)
+                 * and ignore input to enable transport
+                 * protocol fragmentation.
+                 * Returns always 2^14.
+                 */
+                data->mtu = 16384;
+                ret = data->mtu;
+                break;
+        case BIO_CTRL_DGRAM_SET_CONNECTED:
+        case BIO_CTRL_DGRAM_CONNECT:
+                /* Returns always -1. */
+                ret = -1;
+                break;
+        case BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT:
+                /* SCTP doesn't need the DTLS timer
+                 * Returns always 1.
+                 */
+                break;
+        case BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE:
+                if (num > 0)
+                        data->in_handshake = 1;
+                else
+                        data->in_handshake = 0;
+
+                ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_NODELAY, &data->in_handshake, sizeof(int));
+                break;
+        case BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY:
+                /* New shared key for SCTP AUTH.
+                 * Returns 0 on success, -1 otherwise.
+                 */
+
+                /* Get active key */
+                sockopt_len = sizeof(struct sctp_authkeyid);
+                ret = getsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY, &authkeyid, &sockopt_len);
+                if (ret < 0) break;
+
+                /* Add new key */
+                sockopt_len = sizeof(struct sctp_authkey) + 64 * sizeof(uint8_t);
+                authkey = OPENSSL_malloc(sockopt_len);
+                memset(authkey, 0x00, sockopt_len);
+                authkey->sca_keynumber = authkeyid.scact_keynumber + 1;
+#ifndef __FreeBSD__
+                /* This field is missing in FreeBSD 8.2 and earlier,
+                 * and FreeBSD 8.3 and higher work without it.
+                 */
+                authkey->sca_keylength = 64;
+#endif
+                memcpy(&authkey->sca_key[0], ptr, 64 * sizeof(uint8_t));
+
+                ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_KEY, authkey, sockopt_len);
+                if (ret < 0) break;
+
+                /* Reset active key */
+                ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY,
+                      &authkeyid, sizeof(struct sctp_authkeyid));
+                if (ret < 0) break;
+
+                break;
+        case BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY:
+                /* Returns 0 on success, -1 otherwise. */
+
+                /* Get active key */
+                sockopt_len = sizeof(struct sctp_authkeyid);
+                ret = getsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY, &authkeyid, &sockopt_len);
+                if (ret < 0) break;
+
+                /* Set active key */
+                authkeyid.scact_keynumber = authkeyid.scact_keynumber + 1;
+                ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY,
+                      &authkeyid, sizeof(struct sctp_authkeyid));
+                if (ret < 0) break;
+
+                /* CCS has been sent, so remember that and fall through
+                 * to check if we need to deactivate an old key
+                 */
+                data->ccs_sent = 1;
+
+        case BIO_CTRL_DGRAM_SCTP_AUTH_CCS_RCVD:
+                /* Returns 0 on success, -1 otherwise. */
+
+                /* Has this command really been called or is this just a fall-through? */
+                if (cmd == BIO_CTRL_DGRAM_SCTP_AUTH_CCS_RCVD)
+                        data->ccs_rcvd = 1;
+
+                /* CSS has been both, received and sent, so deactivate an old key */
+                if (data->ccs_rcvd == 1 && data->ccs_sent == 1)
+                        {
+                        /* Get active key */
+                        sockopt_len = sizeof(struct sctp_authkeyid);
+                        ret = getsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_ACTIVE_KEY, &authkeyid, &sockopt_len);
+                        if (ret < 0) break;
+
+                        /* Deactivate key or delete second last key if
+                         * SCTP_AUTHENTICATION_EVENT is not available.
+                         */
+                        authkeyid.scact_keynumber = authkeyid.scact_keynumber - 1;
+#ifdef SCTP_AUTH_DEACTIVATE_KEY
+                        sockopt_len = sizeof(struct sctp_authkeyid);
+                        ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_DEACTIVATE_KEY,
+                              &authkeyid, sockopt_len);
+                        if (ret < 0) break;
+#endif
+#ifndef SCTP_AUTHENTICATION_EVENT
+                        if (authkeyid.scact_keynumber > 0)
+                                {
+                                authkeyid.scact_keynumber = authkeyid.scact_keynumber - 1;
+                                ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_AUTH_DELETE_KEY,
+                                          &authkeyid, sizeof(struct sctp_authkeyid));
+                                if (ret < 0) break;
+                                }
+#endif
+
+                        data->ccs_rcvd = 0;
+                        data->ccs_sent = 0;
+                        }
+                break;
+        case BIO_CTRL_DGRAM_SCTP_GET_SNDINFO:
+                /* Returns the size of the copied struct. */
+                if (num > (long) sizeof(struct bio_dgram_sctp_sndinfo))
+                        num = sizeof(struct bio_dgram_sctp_sndinfo);
+
+                memcpy(ptr, &(data->sndinfo), num);
+                ret = num;
+                break;
+        case BIO_CTRL_DGRAM_SCTP_SET_SNDINFO:
+                /* Returns the size of the copied struct. */
+                if (num > (long) sizeof(struct bio_dgram_sctp_sndinfo))
+                        num = sizeof(struct bio_dgram_sctp_sndinfo);
+
+                memcpy(&(data->sndinfo), ptr, num);
+                break;
+        case BIO_CTRL_DGRAM_SCTP_GET_RCVINFO:
+                /* Returns the size of the copied struct. */
+                if (num > (long) sizeof(struct bio_dgram_sctp_rcvinfo))
+                        num = sizeof(struct bio_dgram_sctp_rcvinfo);
+
+                memcpy(ptr, &data->rcvinfo, num);
+
+                ret = num;
+                break;
+        case BIO_CTRL_DGRAM_SCTP_SET_RCVINFO:
+                /* Returns the size of the copied struct. */
+                if (num > (long) sizeof(struct bio_dgram_sctp_rcvinfo))
+                        num = sizeof(struct bio_dgram_sctp_rcvinfo);
+
+                memcpy(&(data->rcvinfo), ptr, num);
+                break;
+        case BIO_CTRL_DGRAM_SCTP_GET_PRINFO:
+                /* Returns the size of the copied struct. */
+                if (num > (long) sizeof(struct bio_dgram_sctp_prinfo))
+                        num = sizeof(struct bio_dgram_sctp_prinfo);
+
+                memcpy(ptr, &(data->prinfo), num);
+                ret = num;
+                break;
+        case BIO_CTRL_DGRAM_SCTP_SET_PRINFO:
+                /* Returns the size of the copied struct. */
+                if (num > (long) sizeof(struct bio_dgram_sctp_prinfo))
+                        num = sizeof(struct bio_dgram_sctp_prinfo);
+
+                memcpy(&(data->prinfo), ptr, num);
+                break;
+        case BIO_CTRL_DGRAM_SCTP_SAVE_SHUTDOWN:
+                /* Returns always 1. */
+                if (num > 0)
+                        data->save_shutdown = 1;
+                else
+                        data->save_shutdown = 0;
+                break;
+
+        default:
+                /* Pass to default ctrl function to
+                 * process SCTP unspecific commands
+                 */
+                ret=dgram_ctrl(b, cmd, num, ptr);
+                break;
+                }
+        return(ret);
+        }
+
+int BIO_dgram_sctp_notification_cb(BIO *b,
+                                   void (*handle_notifications)(BIO *bio, void *context, void *buf),
+                                   void *context)
+        {
+        bio_dgram_sctp_data *data = (bio_dgram_sctp_data *) b->ptr;
+
+        if (handle_notifications != NULL)
+                {
+                data->handle_notifications = handle_notifications;
+                data->notification_context = context;
+                }
+        else
+                return -1;
+
+        return 0;
+        }
+
+int BIO_dgram_sctp_wait_for_dry(BIO *b)
+{
+        int is_dry = 0;
+        int n, sockflags, ret;
+        union sctp_notification snp;
+        struct msghdr msg;
+        struct iovec iov;
+#ifdef SCTP_EVENT
+        struct sctp_event event;
+#else
+        struct sctp_event_subscribe event;
+        socklen_t eventsize;
+#endif
+        bio_dgram_sctp_data *data = (bio_dgram_sctp_data *)b->ptr;
+
+        /* set sender dry event */
+#ifdef SCTP_EVENT
+        memset(&event, 0, sizeof(struct sctp_event));
+        event.se_assoc_id = 0;
+        event.se_type = SCTP_SENDER_DRY_EVENT;
+        event.se_on = 1;
+        ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENT, &event, sizeof(struct sctp_event));
+#else
+        eventsize = sizeof(struct sctp_event_subscribe);
+        ret = getsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event, &eventsize);
+        if (ret < 0)
+                return -1;
+        
+        event.sctp_sender_dry_event = 1;
+        
+        ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event, sizeof(struct sctp_event_subscribe));
+#endif
+        if (ret < 0)
+                return -1;
+
+        /* peek for notification */
+        memset(&snp, 0x00, sizeof(union sctp_notification));
+        iov.iov_base = (char *)&snp;
+        iov.iov_len = sizeof(union sctp_notification);
+        msg.msg_name = NULL;
+        msg.msg_namelen = 0;
+        msg.msg_iov = &iov;
+        msg.msg_iovlen = 1;
+        msg.msg_control = NULL;
+        msg.msg_controllen = 0;
+        msg.msg_flags = 0;
+
+        n = recvmsg(b->num, &msg, MSG_PEEK);
+        if (n <= 0)
+                {
+                if ((n < 0) && (get_last_socket_error() != EAGAIN) && (get_last_socket_error() != EWOULDBLOCK))
+                        return -1;
+                else
+                        return 0;
+                }
+
+        /* if we find a notification, process it and try again if necessary */
+        while (msg.msg_flags & MSG_NOTIFICATION)
+                {
+                memset(&snp, 0x00, sizeof(union sctp_notification));
+                iov.iov_base = (char *)&snp;
+                iov.iov_len = sizeof(union sctp_notification);
+                msg.msg_name = NULL;
+                msg.msg_namelen = 0;
+                msg.msg_iov = &iov;
+                msg.msg_iovlen = 1;
+                msg.msg_control = NULL;
+                msg.msg_controllen = 0;
+                msg.msg_flags = 0;
+
+                n = recvmsg(b->num, &msg, 0);
+                if (n <= 0)
+                        {
+                        if ((n < 0) && (get_last_socket_error() != EAGAIN) && (get_last_socket_error() != EWOULDBLOCK))
+                                return -1;
+                        else
+                                return is_dry;
+                        }
+                
+                if (snp.sn_header.sn_type == SCTP_SENDER_DRY_EVENT)
+                        {
+                        is_dry = 1;
+
+                        /* disable sender dry event */
+#ifdef SCTP_EVENT
+                        memset(&event, 0, sizeof(struct sctp_event));
+                        event.se_assoc_id = 0;
+                        event.se_type = SCTP_SENDER_DRY_EVENT;
+                        event.se_on = 0;
+                        ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENT, &event, sizeof(struct sctp_event));
+#else
+                        eventsize = (socklen_t) sizeof(struct sctp_event_subscribe);
+                        ret = getsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event, &eventsize);
+                        if (ret < 0)
+                                return -1;
+
+                        event.sctp_sender_dry_event = 0;
+
+                        ret = setsockopt(b->num, IPPROTO_SCTP, SCTP_EVENTS, &event, sizeof(struct sctp_event_subscribe));
+#endif
+                        if (ret < 0)
+                                return -1;
+                        }
+
+#ifdef SCTP_AUTHENTICATION_EVENT
+                if (snp.sn_header.sn_type == SCTP_AUTHENTICATION_EVENT)
+                        dgram_sctp_handle_auth_free_key_event(b, &snp);
+#endif
+
+                if (data->handle_notifications != NULL)
+                        data->handle_notifications(b, data->notification_context, (void*) &snp);
+
+                /* found notification, peek again */
+                memset(&snp, 0x00, sizeof(union sctp_notification));
+                iov.iov_base = (char *)&snp;
+                iov.iov_len = sizeof(union sctp_notification);
+                msg.msg_name = NULL;
+                msg.msg_namelen = 0;
+                msg.msg_iov = &iov;
+                msg.msg_iovlen = 1;
+                msg.msg_control = NULL;
+                msg.msg_controllen = 0;
+                msg.msg_flags = 0;
+
+                /* if we have seen the dry already, don't wait */
+                if (is_dry)
+                        {
+                        sockflags = fcntl(b->num, F_GETFL, 0);
+                        fcntl(b->num, F_SETFL, O_NONBLOCK);
+                        }
+
+                n = recvmsg(b->num, &msg, MSG_PEEK);
+
+                if (is_dry)
+                        {
+                        fcntl(b->num, F_SETFL, sockflags);
+                        }
+
+                if (n <= 0)
+                        {
+                        if ((n < 0) && (get_last_socket_error() != EAGAIN) && (get_last_socket_error() != EWOULDBLOCK))
+                                return -1;
+                        else
+                                return is_dry;
+                        }
+                }
+
+        /* read anything else */
+        return is_dry;
+}
+
+int BIO_dgram_sctp_msg_waiting(BIO *b)
+        {
+        int n, sockflags;
+        union sctp_notification snp;
+        struct msghdr msg;
+        struct iovec iov;
+        bio_dgram_sctp_data *data = (bio_dgram_sctp_data *)b->ptr;
+
+        /* Check if there are any messages waiting to be read */
+        do
+                {
+                memset(&snp, 0x00, sizeof(union sctp_notification));
+                iov.iov_base = (char *)&snp;
+                iov.iov_len = sizeof(union sctp_notification);
+                msg.msg_name = NULL;
+                msg.msg_namelen = 0;
+                msg.msg_iov = &iov;
+                msg.msg_iovlen = 1;
+                msg.msg_control = NULL;
+                msg.msg_controllen = 0;
+                msg.msg_flags = 0;
+
+                sockflags = fcntl(b->num, F_GETFL, 0);
+                fcntl(b->num, F_SETFL, O_NONBLOCK);
+                n = recvmsg(b->num, &msg, MSG_PEEK);
+                fcntl(b->num, F_SETFL, sockflags);
+
+                /* if notification, process and try again */
+                if (n > 0 && (msg.msg_flags & MSG_NOTIFICATION))
+                        {
+#ifdef SCTP_AUTHENTICATION_EVENT
+                        if (snp.sn_header.sn_type == SCTP_AUTHENTICATION_EVENT)
+                                dgram_sctp_handle_auth_free_key_event(b, &snp);
+#endif
+
+                        memset(&snp, 0x00, sizeof(union sctp_notification));
+                        iov.iov_base = (char *)&snp;
+                        iov.iov_len = sizeof(union sctp_notification);
+                        msg.msg_name = NULL;
+                        msg.msg_namelen = 0;
+                        msg.msg_iov = &iov;
+                        msg.msg_iovlen = 1;
+                        msg.msg_control = NULL;
+                        msg.msg_controllen = 0;
+                        msg.msg_flags = 0;
+                        n = recvmsg(b->num, &msg, 0);
+
+                        if (data->handle_notifications != NULL)
+                                data->handle_notifications(b, data->notification_context, (void*) &snp);
+                        }
+
+                } while (n > 0 && (msg.msg_flags & MSG_NOTIFICATION));
+
+        /* Return 1 if there is a message to be read, return 0 otherwise. */
+        if (n > 0)
+                return 1;
+        else
+                return 0;
+        }
+
+static int dgram_sctp_puts(BIO *bp, const char *str)
+        {
+        int n,ret;
+
+        n=strlen(str);
+        ret=dgram_sctp_write(bp,str,n);
+        return(ret);
+        }
+#endif
+
 static int BIO_dgram_should_retry(int i)
         {
         int err;
diff --git a/src/lib/libcrypto/bn/Makefile b/src/lib/libcrypto/bn/Makefile
index aabc4f56b8..672773454c 100644
--- a/src/lib/libcrypto/bn/Makefile
+++ b/src/lib/libcrypto/bn/Makefile
@@ -26,13 +26,13 @@ LIBSRC=	bn_add.c bn_div.c bn_exp.c bn_lib.c bn_ctx.c bn_mul.c bn_mod.c \
         bn_print.c bn_rand.c bn_shift.c bn_word.c bn_blind.c \
         bn_kron.c bn_sqrt.c bn_gcd.c bn_prime.c bn_err.c bn_sqr.c bn_asm.c \
         bn_recp.c bn_mont.c bn_mpi.c bn_exp2.c bn_gf2m.c bn_nist.c \
-        bn_depr.c bn_const.c
+        bn_depr.c bn_const.c bn_x931p.c
 
 LIBOBJ= bn_add.o bn_div.o bn_exp.o bn_lib.o bn_ctx.o bn_mul.o bn_mod.o \
         bn_print.o bn_rand.o bn_shift.o bn_word.o bn_blind.o \
         bn_kron.o bn_sqrt.o bn_gcd.o bn_prime.o bn_err.o bn_sqr.o $(BN_ASM) \
         bn_recp.o bn_mont.o bn_mpi.o bn_exp2.o bn_gf2m.o bn_nist.o \
-        bn_depr.o bn_const.o
+        bn_depr.o bn_const.o bn_x931p.o
 
 SRC= $(LIBSRC)
 
@@ -66,6 +66,8 @@ co-586.s:	asm/co-586.pl ../perlasm/x86asm.pl
         $(PERL) asm/co-586.pl $(PERLASM_SCHEME) $(CFLAGS) $(PROCESSOR) > $@
 x86-mont.s:     asm/x86-mont.pl ../perlasm/x86asm.pl
         $(PERL) asm/x86-mont.pl $(PERLASM_SCHEME) $(CFLAGS) $(PROCESSOR) > $@
+x86-gf2m.s:     asm/x86-gf2m.pl ../perlasm/x86asm.pl
+        $(PERL) asm/x86-gf2m.pl $(PERLASM_SCHEME) $(CFLAGS) $(PROCESSOR) > $@
 
 sparcv8.o:      asm/sparcv8.S
         $(CC) $(CFLAGS) -c asm/sparcv8.S
@@ -82,16 +84,31 @@ bn-mips3.o:	asm/mips3.s
                 as -$$ABI -O -o $@ asm/mips3.s; \
         else    $(CC) -c $(CFLAGS) -o $@ asm/mips3.s; fi
 
+bn-mips.s:      asm/mips.pl
+        $(PERL) asm/mips.pl $(PERLASM_SCHEME) $@
+mips-mont.s:    asm/mips-mont.pl
+        $(PERL) asm/mips-mont.pl $(PERLASM_SCHEME) $@
+
 bn-s390x.o:     asm/s390x.S
         $(CC) $(CFLAGS) -c -o $@ asm/s390x.S
+s390x-gf2m.s:   asm/s390x-gf2m.pl
+        $(PERL) asm/s390x-gf2m.pl $(PERLASM_SCHEME) $@
 
 x86_64-gcc.o:   asm/x86_64-gcc.c
         $(CC) $(CFLAGS) -c -o $@ asm/x86_64-gcc.c
 x86_64-mont.s:  asm/x86_64-mont.pl
         $(PERL) asm/x86_64-mont.pl $(PERLASM_SCHEME) > $@
+x86_64-mont5.s: asm/x86_64-mont5.pl
+        $(PERL) asm/x86_64-mont5.pl $(PERLASM_SCHEME) > $@
+x86_64-gf2m.s:  asm/x86_64-gf2m.pl
+        $(PERL) asm/x86_64-gf2m.pl $(PERLASM_SCHEME) > $@
+modexp512-x86_64.s:     asm/modexp512-x86_64.pl
+        $(PERL) asm/modexp512-x86_64.pl $(PERLASM_SCHEME) > $@
 
 bn-ia64.s:      asm/ia64.S
         $(CC) $(CFLAGS) -E asm/ia64.S > $@
+ia64-mont.s:    asm/ia64-mont.pl
+        $(PERL) asm/ia64-mont.pl $@ $(CFLAGS)
 
 # GNU assembler fails to compile PA-RISC2 modules, insist on calling
 # vendor assembler...
@@ -99,16 +116,22 @@ pa-risc2W.o: asm/pa-risc2W.s
         /usr/ccs/bin/as -o pa-risc2W.o asm/pa-risc2W.s
 pa-risc2.o: asm/pa-risc2.s
         /usr/ccs/bin/as -o pa-risc2.o asm/pa-risc2.s
+parisc-mont.s:  asm/parisc-mont.pl
+        $(PERL) asm/parisc-mont.pl $(PERLASM_SCHEME) $@
 
 # ppc - AIX, Linux, MacOS X...
 bn-ppc.s:       asm/ppc.pl;     $(PERL) asm/ppc.pl $(PERLASM_SCHEME) $@
 ppc-mont.s:     asm/ppc-mont.pl;$(PERL) asm/ppc-mont.pl $(PERLASM_SCHEME) $@
+ppc64-mont.s:   asm/ppc64-mont.pl;$(PERL) asm/ppc64-mont.pl $(PERLASM_SCHEME) $@
 
 alpha-mont.s:   asm/alpha-mont.pl
         $(PERL) $< | $(CC) -E - | tee $@ > /dev/null
 
 # GNU make "catch all"
-%-mont.s:       asm/%-mont.pl;  $(PERL) $< $(CFLAGS) > $@
+%-mont.s:       asm/%-mont.pl;  $(PERL) $< $(PERLASM_SCHEME) $@
+%-gf2m.S:       asm/%-gf2m.pl;  $(PERL) $< $(PERLASM_SCHEME) $@
+
+armv4-gf2m.o:   armv4-gf2m.S
 
 files:
         $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
@@ -345,3 +368,8 @@ bn_word.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
 bn_word.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
 bn_word.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 bn_word.o: ../../include/openssl/symhacks.h ../cryptlib.h bn_lcl.h bn_word.c
+bn_x931p.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
+bn_x931p.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
+bn_x931p.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+bn_x931p.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+bn_x931p.o: ../../include/openssl/symhacks.h bn_x931p.c
diff --git a/src/lib/libcrypto/bn/bn.h b/src/lib/libcrypto/bn/bn.h
index a0bc47837d..f34248ec4f 100644
--- a/src/lib/libcrypto/bn/bn.h
+++ b/src/lib/libcrypto/bn/bn.h
@@ -558,6 +558,17 @@ int	BN_is_prime_ex(const BIGNUM *p,int nchecks, BN_CTX *ctx, BN_GENCB *cb);
 int     BN_is_prime_fasttest_ex(const BIGNUM *p,int nchecks, BN_CTX *ctx,
                 int do_trial_division, BN_GENCB *cb);
 
+int BN_X931_generate_Xpq(BIGNUM *Xp, BIGNUM *Xq, int nbits, BN_CTX *ctx);
+
+int BN_X931_derive_prime_ex(BIGNUM *p, BIGNUM *p1, BIGNUM *p2,
+                        const BIGNUM *Xp, const BIGNUM *Xp1, const BIGNUM *Xp2,
+                        const BIGNUM *e, BN_CTX *ctx, BN_GENCB *cb);
+int BN_X931_generate_prime_ex(BIGNUM *p, BIGNUM *p1, BIGNUM *p2,
+                        BIGNUM *Xp1, BIGNUM *Xp2,
+                        const BIGNUM *Xp,
+                        const BIGNUM *e, BN_CTX *ctx,
+                        BN_GENCB *cb);
+
 BN_MONT_CTX *BN_MONT_CTX_new(void );
 void BN_MONT_CTX_init(BN_MONT_CTX *ctx);
 int BN_mod_mul_montgomery(BIGNUM *r,const BIGNUM *a,const BIGNUM *b,
@@ -612,6 +623,8 @@ int	BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
 int     BN_div_recp(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m,
         BN_RECP_CTX *recp, BN_CTX *ctx);
 
+#ifndef OPENSSL_NO_EC2M
+
 /* Functions for arithmetic over binary polynomials represented by BIGNUMs. 
  *
  * The BIGNUM::neg property of BIGNUMs representing binary polynomials is
@@ -663,6 +676,8 @@ int	BN_GF2m_mod_solve_quad_arr(BIGNUM *r, const BIGNUM *a,
 int     BN_GF2m_poly2arr(const BIGNUM *a, int p[], int max);
 int     BN_GF2m_arr2poly(const int p[], BIGNUM *a);
 
+#endif
+
 /* faster mod functions for the 'NIST primes' 
  * 0 <= a < p^2 */
 int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);
diff --git a/src/lib/libcrypto/bn/bn_div.c b/src/lib/libcrypto/bn/bn_div.c
index 802a43d642..52b3304293 100644
--- a/src/lib/libcrypto/bn/bn_div.c
+++ b/src/lib/libcrypto/bn/bn_div.c
@@ -169,15 +169,13 @@ int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d,
 #endif /* OPENSSL_NO_ASM */
 
 
-/* BN_div[_no_branch] computes  dv := num / divisor,  rounding towards
+/* BN_div computes  dv := num / divisor,  rounding towards
  * zero, and sets up rm  such that  dv*divisor + rm = num  holds.
  * Thus:
  *     dv->neg == num->neg ^ divisor->neg  (unless the result is zero)
  *     rm->neg == num->neg                 (unless the remainder is zero)
  * If 'dv' or 'rm' is NULL, the respective value is not returned.
  */
-static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
-        const BIGNUM *divisor, BN_CTX *ctx);
 int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
            BN_CTX *ctx)
         {
@@ -186,6 +184,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
         BN_ULONG *resp,*wnump;
         BN_ULONG d0,d1;
         int num_n,div_n;
+        int no_branch=0;
 
         /* Invalid zero-padding would have particularly bad consequences
          * in the case of 'num', so don't just rely on bn_check_top() for this one
@@ -200,7 +199,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
 
         if ((BN_get_flags(num, BN_FLG_CONSTTIME) != 0) || (BN_get_flags(divisor, BN_FLG_CONSTTIME) != 0))
                 {
-                return BN_div_no_branch(dv, rm, num, divisor, ctx);
+                no_branch=1;
                 }
 
         bn_check_top(dv);
@@ -214,7 +213,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                 return(0);
                 }
 
-        if (BN_ucmp(num,divisor) < 0)
+        if (!no_branch && BN_ucmp(num,divisor) < 0)
                 {
                 if (rm != NULL)
                         { if (BN_copy(rm,num) == NULL) return(0); }
@@ -239,242 +238,25 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
         norm_shift+=BN_BITS2;
         if (!(BN_lshift(snum,num,norm_shift))) goto err;
         snum->neg=0;
-        div_n=sdiv->top;
-        num_n=snum->top;
-        loop=num_n-div_n;
-        /* Lets setup a 'window' into snum
-         * This is the part that corresponds to the current
-         * 'area' being divided */
-        wnum.neg   = 0;
-        wnum.d     = &(snum->d[loop]);
-        wnum.top   = div_n;
-        /* only needed when BN_ucmp messes up the values between top and max */
-        wnum.dmax  = snum->dmax - loop; /* so we don't step out of bounds */
-
-        /* Get the top 2 words of sdiv */
-        /* div_n=sdiv->top; */
-        d0=sdiv->d[div_n-1];
-        d1=(div_n == 1)?0:sdiv->d[div_n-2];
-
-        /* pointer to the 'top' of snum */
-        wnump= &(snum->d[num_n-1]);
-
-        /* Setup to 'res' */
-        res->neg= (num->neg^divisor->neg);
-        if (!bn_wexpand(res,(loop+1))) goto err;
-        res->top=loop;
-        resp= &(res->d[loop-1]);
-
-        /* space for temp */
-        if (!bn_wexpand(tmp,(div_n+1))) goto err;
 
-        if (BN_ucmp(&wnum,sdiv) >= 0)
+        if (no_branch)
                 {
-                /* If BN_DEBUG_RAND is defined BN_ucmp changes (via
-                 * bn_pollute) the const bignum arguments =>
-                 * clean the values between top and max again */
-                bn_clear_top2max(&wnum);
-                bn_sub_words(wnum.d, wnum.d, sdiv->d, div_n);
-                *resp=1;
-                }
-        else
-                res->top--;
-        /* if res->top == 0 then clear the neg value otherwise decrease
-         * the resp pointer */
-        if (res->top == 0)
-                res->neg = 0;
-        else
-                resp--;
-
-        for (i=0; i<loop-1; i++, wnump--, resp--)
-                {
-                BN_ULONG q,l0;
-                /* the first part of the loop uses the top two words of
-                 * snum and sdiv to calculate a BN_ULONG q such that
-                 * | wnum - sdiv * q | < sdiv */
-#if defined(BN_DIV3W) && !defined(OPENSSL_NO_ASM)
-                BN_ULONG bn_div_3_words(BN_ULONG*,BN_ULONG,BN_ULONG);
-                q=bn_div_3_words(wnump,d1,d0);
-#else
-                BN_ULONG n0,n1,rem=0;
-
-                n0=wnump[0];
-                n1=wnump[-1];
-                if (n0 == d0)
-                        q=BN_MASK2;
-                else                    /* n0 < d0 */
-                        {
-#ifdef BN_LLONG
-                        BN_ULLONG t2;
-
-#if defined(BN_LLONG) && defined(BN_DIV2W) && !defined(bn_div_words)
-                        q=(BN_ULONG)(((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0);
-#else
-                        q=bn_div_words(n0,n1,d0);
-#ifdef BN_DEBUG_LEVITTE
-                        fprintf(stderr,"DEBUG: bn_div_words(0x%08X,0x%08X,0x%08\
-X) -> 0x%08X\n",
-                                n0, n1, d0, q);
-#endif
-#endif
-
-#ifndef REMAINDER_IS_ALREADY_CALCULATED
-                        /*
-                         * rem doesn't have to be BN_ULLONG. The least we
-                         * know it's less that d0, isn't it?
-                         */
-                        rem=(n1-q*d0)&BN_MASK2;
-#endif
-                        t2=(BN_ULLONG)d1*q;
-
-                        for (;;)
-                                {
-                                if (t2 <= ((((BN_ULLONG)rem)<<BN_BITS2)|wnump[-2]))
-                                        break;
-                                q--;
-                                rem += d0;
-                                if (rem < d0) break; /* don't let rem overflow */
-                                t2 -= d1;
-                                }
-#else /* !BN_LLONG */
-                        BN_ULONG t2l,t2h;
-
-                        q=bn_div_words(n0,n1,d0);
-#ifdef BN_DEBUG_LEVITTE
-                        fprintf(stderr,"DEBUG: bn_div_words(0x%08X,0x%08X,0x%08\
-X) -> 0x%08X\n",
-                                n0, n1, d0, q);
-#endif
-#ifndef REMAINDER_IS_ALREADY_CALCULATED
-                        rem=(n1-q*d0)&BN_MASK2;
-#endif
-
-#if defined(BN_UMULT_LOHI)
-                        BN_UMULT_LOHI(t2l,t2h,d1,q);
-#elif defined(BN_UMULT_HIGH)
-                        t2l = d1 * q;
-                        t2h = BN_UMULT_HIGH(d1,q);
-#else
+                /* Since we don't know whether snum is larger than sdiv,
+                 * we pad snum with enough zeroes without changing its
+                 * value. 
+                 */
+                if (snum->top <= sdiv->top+1) 
                         {
-                        BN_ULONG ql, qh;
-                        t2l=LBITS(d1); t2h=HBITS(d1);
-                        ql =LBITS(q);  qh =HBITS(q);
-                        mul64(t2l,t2h,ql,qh); /* t2=(BN_ULLONG)d1*q; */
+                        if (bn_wexpand(snum, sdiv->top + 2) == NULL) goto err;
+                        for (i = snum->top; i < sdiv->top + 2; i++) snum->d[i] = 0;
+                        snum->top = sdiv->top + 2;
                         }
-#endif
-
-                        for (;;)
-                                {
-                                if ((t2h < rem) ||
-                                        ((t2h == rem) && (t2l <= wnump[-2])))
-                                        break;
-                                q--;
-                                rem += d0;
-                                if (rem < d0) break; /* don't let rem overflow */
-                                if (t2l < d1) t2h--; t2l -= d1;
-                                }
-#endif /* !BN_LLONG */
-                        }
-#endif /* !BN_DIV3W */
-
-                l0=bn_mul_words(tmp->d,sdiv->d,div_n,q);
-                tmp->d[div_n]=l0;
-                wnum.d--;
-                /* ingore top values of the bignums just sub the two 
-                 * BN_ULONG arrays with bn_sub_words */
-                if (bn_sub_words(wnum.d, wnum.d, tmp->d, div_n+1))
+                else
                         {
-                        /* Note: As we have considered only the leading
-                         * two BN_ULONGs in the calculation of q, sdiv * q
-                         * might be greater than wnum (but then (q-1) * sdiv
-                         * is less or equal than wnum)
-                         */
-                        q--;
-                        if (bn_add_words(wnum.d, wnum.d, sdiv->d, div_n))
-                                /* we can't have an overflow here (assuming
-                                 * that q != 0, but if q == 0 then tmp is
-                                 * zero anyway) */
-                                (*wnump)++;
+                        if (bn_wexpand(snum, snum->top + 1) == NULL) goto err;
+                        snum->d[snum->top] = 0;
+                        snum->top ++;
                         }
-                /* store part of the result */
-                *resp = q;
-                }
-        bn_correct_top(snum);
-        if (rm != NULL)
-                {
-                /* Keep a copy of the neg flag in num because if rm==num
-                 * BN_rshift() will overwrite it.
-                 */
-                int neg = num->neg;
-                BN_rshift(rm,snum,norm_shift);
-                if (!BN_is_zero(rm))
-                        rm->neg = neg;
-                bn_check_top(rm);
-                }
-        BN_CTX_end(ctx);
-        return(1);
-err:
-        bn_check_top(rm);
-        BN_CTX_end(ctx);
-        return(0);
-        }
-
-
-/* BN_div_no_branch is a special version of BN_div. It does not contain
- * branches that may leak sensitive information.
- */
-static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, 
-        const BIGNUM *divisor, BN_CTX *ctx)
-        {
-        int norm_shift,i,loop;
-        BIGNUM *tmp,wnum,*snum,*sdiv,*res;
-        BN_ULONG *resp,*wnump;
-        BN_ULONG d0,d1;
-        int num_n,div_n;
-
-        bn_check_top(dv);
-        bn_check_top(rm);
-        /* bn_check_top(num); */ /* 'num' has been checked in BN_div() */
-        bn_check_top(divisor);
-
-        if (BN_is_zero(divisor))
-                {
-                BNerr(BN_F_BN_DIV_NO_BRANCH,BN_R_DIV_BY_ZERO);
-                return(0);
-                }
-
-        BN_CTX_start(ctx);
-        tmp=BN_CTX_get(ctx);
-        snum=BN_CTX_get(ctx);
-        sdiv=BN_CTX_get(ctx);
-        if (dv == NULL)
-                res=BN_CTX_get(ctx);
-        else    res=dv;
-        if (sdiv == NULL || res == NULL) goto err;
-
-        /* First we normalise the numbers */
-        norm_shift=BN_BITS2-((BN_num_bits(divisor))%BN_BITS2);
-        if (!(BN_lshift(sdiv,divisor,norm_shift))) goto err;
-        sdiv->neg=0;
-        norm_shift+=BN_BITS2;
-        if (!(BN_lshift(snum,num,norm_shift))) goto err;
-        snum->neg=0;
-
-        /* Since we don't know whether snum is larger than sdiv,
-         * we pad snum with enough zeroes without changing its
-         * value. 
-         */
-        if (snum->top <= sdiv->top+1) 
-                {
-                if (bn_wexpand(snum, sdiv->top + 2) == NULL) goto err;
-                for (i = snum->top; i < sdiv->top + 2; i++) snum->d[i] = 0;
-                snum->top = sdiv->top + 2;
-                }
-        else
-                {
-                if (bn_wexpand(snum, snum->top + 1) == NULL) goto err;
-                snum->d[snum->top] = 0;
-                snum->top ++;
                 }
 
         div_n=sdiv->top;
@@ -500,12 +282,27 @@ static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
         /* Setup to 'res' */
         res->neg= (num->neg^divisor->neg);
         if (!bn_wexpand(res,(loop+1))) goto err;
-        res->top=loop-1;
+        res->top=loop-no_branch;
         resp= &(res->d[loop-1]);
 
         /* space for temp */
         if (!bn_wexpand(tmp,(div_n+1))) goto err;
 
+        if (!no_branch)
+                {
+                if (BN_ucmp(&wnum,sdiv) >= 0)
+                        {
+                        /* If BN_DEBUG_RAND is defined BN_ucmp changes (via
+                         * bn_pollute) the const bignum arguments =>
+                         * clean the values between top and max again */
+                        bn_clear_top2max(&wnum);
+                        bn_sub_words(wnum.d, wnum.d, sdiv->d, div_n);
+                        *resp=1;
+                        }
+                else
+                        res->top--;
+                }
+
         /* if res->top == 0 then clear the neg value otherwise decrease
          * the resp pointer */
         if (res->top == 0)
@@ -638,7 +435,7 @@ X) -> 0x%08X\n",
                         rm->neg = neg;
                 bn_check_top(rm);
                 }
-        bn_correct_top(res);
+        if (no_branch)  bn_correct_top(res);
         BN_CTX_end(ctx);
         return(1);
 err:
@@ -646,5 +443,4 @@ err:
         BN_CTX_end(ctx);
         return(0);
         }
-
 #endif
diff --git a/src/lib/libcrypto/bn/bn_exp.c b/src/lib/libcrypto/bn/bn_exp.c
index d9b6c737fc..2abf6fd678 100644
--- a/src/lib/libcrypto/bn/bn_exp.c
+++ b/src/lib/libcrypto/bn/bn_exp.c
@@ -113,6 +113,18 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
+#include <stdlib.h>
+#ifdef _WIN32
+# include <malloc.h>
+# ifndef alloca
+#  define alloca _alloca
+# endif
+#elif defined(__GNUC__)
+# ifndef alloca
+#  define alloca(s) __builtin_alloca((s))
+# endif
+#endif
+
 /* maximum precomputation table size for *variable* sliding windows */
 #define TABLE_SIZE      32
 
@@ -522,23 +534,17 @@ err:
  * as cache lines are concerned.  The following functions are used to transfer a BIGNUM
  * from/to that table. */
 
-static int MOD_EXP_CTIME_COPY_TO_PREBUF(BIGNUM *b, int top, unsigned char *buf, int idx, int width)
+static int MOD_EXP_CTIME_COPY_TO_PREBUF(const BIGNUM *b, int top, unsigned char *buf, int idx, int width)
         {
         size_t i, j;
 
-        if (bn_wexpand(b, top) == NULL)
-                return 0;
-        while (b->top < top)
-                {
-                b->d[b->top++] = 0;
-                }
-        
+        if (top > b->top)
+                top = b->top; /* this works because 'buf' is explicitly zeroed */
         for (i = 0, j=idx; i < top * sizeof b->d[0]; i++, j+=width)
                 {
                 buf[j] = ((unsigned char*)b->d)[i];
                 }
 
-        bn_correct_top(b);
         return 1;
         }
 
@@ -561,7 +567,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top, unsigned char *buf
 
 /* Given a pointer value, compute the next address that is a cache line multiple. */
 #define MOD_EXP_CTIME_ALIGN(x_) \
-        ((unsigned char*)(x_) + (MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH - (((BN_ULONG)(x_)) & (MOD_EXP_CTIME_MIN_CACHE_LINE_MASK))))
+        ((unsigned char*)(x_) + (MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH - (((size_t)(x_)) & (MOD_EXP_CTIME_MIN_CACHE_LINE_MASK))))
 
 /* This variant of BN_mod_exp_mont() uses fixed windows and the special
  * precomputation memory layout to limit data-dependency to a minimum
@@ -572,17 +578,15 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top, unsigned char *buf
 int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                     const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
         {
-        int i,bits,ret=0,idx,window,wvalue;
+        int i,bits,ret=0,window,wvalue;
         int top;
-        BIGNUM *r;
-        const BIGNUM *aa;
         BN_MONT_CTX *mont=NULL;
 
         int numPowers;
         unsigned char *powerbufFree=NULL;
         int powerbufLen = 0;
         unsigned char *powerbuf=NULL;
-        BIGNUM *computeTemp=NULL, *am=NULL;
+        BIGNUM tmp, am;
 
         bn_check_top(a);
         bn_check_top(p);
@@ -602,10 +606,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                 return ret;
                 }
 
-        /* Initialize BIGNUM context and allocate intermediate result */
         BN_CTX_start(ctx);
-        r = BN_CTX_get(ctx);
-        if (r == NULL) goto err;
 
         /* Allocate a montgomery context if it was not supplied by the caller.
          * If this is not done, things will break in the montgomery part.
@@ -620,40 +621,154 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
 
         /* Get the window size to use with size of p. */
         window = BN_window_bits_for_ctime_exponent_size(bits);
+#if defined(OPENSSL_BN_ASM_MONT5)
+        if (window==6 && bits<=1024) window=5;  /* ~5% improvement of 2048-bit RSA sign */
+#endif
 
         /* Allocate a buffer large enough to hold all of the pre-computed
-         * powers of a.
+         * powers of am, am itself and tmp.
          */
         numPowers = 1 << window;
-        powerbufLen = sizeof(m->d[0])*top*numPowers;
+        powerbufLen = sizeof(m->d[0])*(top*numPowers +
+                                ((2*top)>numPowers?(2*top):numPowers));
+#ifdef alloca
+        if (powerbufLen < 3072)
+                powerbufFree = alloca(powerbufLen+MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH);
+        else
+#endif
         if ((powerbufFree=(unsigned char*)OPENSSL_malloc(powerbufLen+MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH)) == NULL)
                 goto err;
                 
         powerbuf = MOD_EXP_CTIME_ALIGN(powerbufFree);
         memset(powerbuf, 0, powerbufLen);
 
-        /* Initialize the intermediate result. Do this early to save double conversion,
-         * once each for a^0 and intermediate result.
-         */
-        if (!BN_to_montgomery(r,BN_value_one(),mont,ctx)) goto err;
-        if (!MOD_EXP_CTIME_COPY_TO_PREBUF(r, top, powerbuf, 0, numPowers)) goto err;
+#ifdef alloca
+        if (powerbufLen < 3072)
+                powerbufFree = NULL;
+#endif
 
-        /* Initialize computeTemp as a^1 with montgomery precalcs */
-        computeTemp = BN_CTX_get(ctx);
-        am = BN_CTX_get(ctx);
-        if (computeTemp==NULL || am==NULL) goto err;
+        /* lay down tmp and am right after powers table */
+        tmp.d     = (BN_ULONG *)(powerbuf + sizeof(m->d[0])*top*numPowers);
+        am.d      = tmp.d + top;
+        tmp.top   = am.top  = 0;
+        tmp.dmax  = am.dmax = top;
+        tmp.neg   = am.neg  = 0;
+        tmp.flags = am.flags = BN_FLG_STATIC_DATA;
+
+        /* prepare a^0 in Montgomery domain */
+#if 1
+        if (!BN_to_montgomery(&tmp,BN_value_one(),mont,ctx))    goto err;
+#else
+        tmp.d[0] = (0-m->d[0])&BN_MASK2;        /* 2^(top*BN_BITS2) - m */
+        for (i=1;i<top;i++)
+                tmp.d[i] = (~m->d[i])&BN_MASK2;
+        tmp.top = top;
+#endif
 
+        /* prepare a^1 in Montgomery domain */
         if (a->neg || BN_ucmp(a,m) >= 0)
                 {
-                if (!BN_mod(am,a,m,ctx))
-                        goto err;
-                aa= am;
+                if (!BN_mod(&am,a,m,ctx))                       goto err;
+                if (!BN_to_montgomery(&am,&am,mont,ctx))        goto err;
                 }
-        else
-                aa=a;
-        if (!BN_to_montgomery(am,aa,mont,ctx)) goto err;
-        if (!BN_copy(computeTemp, am)) goto err;
-        if (!MOD_EXP_CTIME_COPY_TO_PREBUF(am, top, powerbuf, 1, numPowers)) goto err;
+        else    if (!BN_to_montgomery(&am,a,mont,ctx))          goto err;
+
+#if defined(OPENSSL_BN_ASM_MONT5)
+    /* This optimization uses ideas from http://eprint.iacr.org/2011/239,
+     * specifically optimization of cache-timing attack countermeasures
+     * and pre-computation optimization. */
+
+    /* Dedicated window==4 case improves 512-bit RSA sign by ~15%, but as
+     * 512-bit RSA is hardly relevant, we omit it to spare size... */ 
+    if (window==5)
+        {
+        void bn_mul_mont_gather5(BN_ULONG *rp,const BN_ULONG *ap,
+                        const void *table,const BN_ULONG *np,
+                        const BN_ULONG *n0,int num,int power);
+        void bn_scatter5(const BN_ULONG *inp,size_t num,
+                        void *table,size_t power);
+        void bn_gather5(BN_ULONG *out,size_t num,
+                        void *table,size_t power);
+
+        BN_ULONG *np=mont->N.d, *n0=mont->n0;
+
+        /* BN_to_montgomery can contaminate words above .top
+         * [in BN_DEBUG[_DEBUG] build]... */
+        for (i=am.top; i<top; i++)      am.d[i]=0;
+        for (i=tmp.top; i<top; i++)     tmp.d[i]=0;
+
+        bn_scatter5(tmp.d,top,powerbuf,0);
+        bn_scatter5(am.d,am.top,powerbuf,1);
+        bn_mul_mont(tmp.d,am.d,am.d,np,n0,top);
+        bn_scatter5(tmp.d,top,powerbuf,2);
+
+#if 0
+        for (i=3; i<32; i++)
+                {
+                /* Calculate a^i = a^(i-1) * a */
+                bn_mul_mont_gather5(tmp.d,am.d,powerbuf,np,n0,top,i-1);
+                bn_scatter5(tmp.d,top,powerbuf,i);
+                }
+#else
+        /* same as above, but uses squaring for 1/2 of operations */
+        for (i=4; i<32; i*=2)
+                {
+                bn_mul_mont(tmp.d,tmp.d,tmp.d,np,n0,top);
+                bn_scatter5(tmp.d,top,powerbuf,i);
+                }
+        for (i=3; i<8; i+=2)
+                {
+                int j;
+                bn_mul_mont_gather5(tmp.d,am.d,powerbuf,np,n0,top,i-1);
+                bn_scatter5(tmp.d,top,powerbuf,i);
+                for (j=2*i; j<32; j*=2)
+                        {
+                        bn_mul_mont(tmp.d,tmp.d,tmp.d,np,n0,top);
+                        bn_scatter5(tmp.d,top,powerbuf,j);
+                        }
+                }
+        for (; i<16; i+=2)
+                {
+                bn_mul_mont_gather5(tmp.d,am.d,powerbuf,np,n0,top,i-1);
+                bn_scatter5(tmp.d,top,powerbuf,i);
+                bn_mul_mont(tmp.d,tmp.d,tmp.d,np,n0,top);
+                bn_scatter5(tmp.d,top,powerbuf,2*i);
+                }
+        for (; i<32; i+=2)
+                {
+                bn_mul_mont_gather5(tmp.d,am.d,powerbuf,np,n0,top,i-1);
+                bn_scatter5(tmp.d,top,powerbuf,i);
+                }
+#endif
+        bits--;
+        for (wvalue=0, i=bits%5; i>=0; i--,bits--)
+                wvalue = (wvalue<<1)+BN_is_bit_set(p,bits);
+        bn_gather5(tmp.d,top,powerbuf,wvalue);
+
+        /* Scan the exponent one window at a time starting from the most
+         * significant bits.
+         */
+        while (bits >= 0)
+                {
+                for (wvalue=0, i=0; i<5; i++,bits--)
+                        wvalue = (wvalue<<1)+BN_is_bit_set(p,bits);
+
+                bn_mul_mont(tmp.d,tmp.d,tmp.d,np,n0,top);
+                bn_mul_mont(tmp.d,tmp.d,tmp.d,np,n0,top);
+                bn_mul_mont(tmp.d,tmp.d,tmp.d,np,n0,top);
+                bn_mul_mont(tmp.d,tmp.d,tmp.d,np,n0,top);
+                bn_mul_mont(tmp.d,tmp.d,tmp.d,np,n0,top);
+                bn_mul_mont_gather5(tmp.d,tmp.d,powerbuf,np,n0,top,wvalue);
+                }
+
+        tmp.top=top;
+        bn_correct_top(&tmp);
+        }
+    else
+#endif
+        {
+        if (!MOD_EXP_CTIME_COPY_TO_PREBUF(&tmp, top, powerbuf, 0, numPowers)) goto err;
+        if (!MOD_EXP_CTIME_COPY_TO_PREBUF(&am,  top, powerbuf, 1, numPowers)) goto err;
 
         /* If the window size is greater than 1, then calculate
          * val[i=2..2^winsize-1]. Powers are computed as a*a^(i-1)
@@ -662,62 +777,54 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
          */
         if (window > 1)
                 {
-                for (i=2; i<numPowers; i++)
+                if (!BN_mod_mul_montgomery(&tmp,&am,&am,mont,ctx))      goto err;
+                if (!MOD_EXP_CTIME_COPY_TO_PREBUF(&tmp, top, powerbuf, 2, numPowers)) goto err;
+                for (i=3; i<numPowers; i++)
                         {
                         /* Calculate a^i = a^(i-1) * a */
-                        if (!BN_mod_mul_montgomery(computeTemp,am,computeTemp,mont,ctx))
+                        if (!BN_mod_mul_montgomery(&tmp,&am,&tmp,mont,ctx))
                                 goto err;
-                        if (!MOD_EXP_CTIME_COPY_TO_PREBUF(computeTemp, top, powerbuf, i, numPowers)) goto err;
+                        if (!MOD_EXP_CTIME_COPY_TO_PREBUF(&tmp, top, powerbuf, i, numPowers)) goto err;
                         }
                 }
 
-        /* Adjust the number of bits up to a multiple of the window size.
-         * If the exponent length is not a multiple of the window size, then
-         * this pads the most significant bits with zeros to normalize the
-         * scanning loop to there's no special cases.
-         *
-         * * NOTE: Making the window size a power of two less than the native
-         * * word size ensures that the padded bits won't go past the last
-         * * word in the internal BIGNUM structure. Going past the end will
-         * * still produce the correct result, but causes a different branch
-         * * to be taken in the BN_is_bit_set function.
-         */
-        bits = ((bits+window-1)/window)*window;
-        idx=bits-1;     /* The top bit of the window */
-
-        /* Scan the exponent one window at a time starting from the most
-         * significant bits.
-         */
-        while (idx >= 0)
+        bits--;
+        for (wvalue=0, i=bits%window; i>=0; i--,bits--)
+                wvalue = (wvalue<<1)+BN_is_bit_set(p,bits);
+        if (!MOD_EXP_CTIME_COPY_FROM_PREBUF(&tmp,top,powerbuf,wvalue,numPowers)) goto err;
+ 
+        /* Scan the exponent one window at a time starting from the most
+         * significant bits.
+         */
+        while (bits >= 0)
                 {
                 wvalue=0; /* The 'value' of the window */
                 
                 /* Scan the window, squaring the result as we go */
-                for (i=0; i<window; i++,idx--)
+                for (i=0; i<window; i++,bits--)
                         {
-                        if (!BN_mod_mul_montgomery(r,r,r,mont,ctx))     goto err;
-                        wvalue = (wvalue<<1)+BN_is_bit_set(p,idx);
+                        if (!BN_mod_mul_montgomery(&tmp,&tmp,&tmp,mont,ctx))    goto err;
+                        wvalue = (wvalue<<1)+BN_is_bit_set(p,bits);
                         }
                 
                 /* Fetch the appropriate pre-computed value from the pre-buf */
-                if (!MOD_EXP_CTIME_COPY_FROM_PREBUF(computeTemp, top, powerbuf, wvalue, numPowers)) goto err;
+                if (!MOD_EXP_CTIME_COPY_FROM_PREBUF(&am, top, powerbuf, wvalue, numPowers)) goto err;
 
                 /* Multiply the result into the intermediate result */
-                if (!BN_mod_mul_montgomery(r,r,computeTemp,mont,ctx)) goto err;
+                if (!BN_mod_mul_montgomery(&tmp,&tmp,&am,mont,ctx)) goto err;
                 }
+        }
 
         /* Convert the final result from montgomery to standard format */
-        if (!BN_from_montgomery(rr,r,mont,ctx)) goto err;
+        if (!BN_from_montgomery(rr,&tmp,mont,ctx)) goto err;
         ret=1;
 err:
         if ((in_mont == NULL) && (mont != NULL)) BN_MONT_CTX_free(mont);
         if (powerbuf!=NULL)
                 {
                 OPENSSL_cleanse(powerbuf,powerbufLen);
-                OPENSSL_free(powerbufFree);
+                if (powerbufFree) OPENSSL_free(powerbufFree);
                 }
-        if (am!=NULL) BN_clear(am);
-        if (computeTemp!=NULL) BN_clear(computeTemp);
         BN_CTX_end(ctx);
         return(ret);
         }
@@ -988,4 +1095,3 @@ err:
         bn_check_top(r);
         return(ret);
         }
-
diff --git a/src/lib/libcrypto/bn/bn_gf2m.c b/src/lib/libcrypto/bn/bn_gf2m.c
index 432a3aa338..8a4dc20ad9 100644
--- a/src/lib/libcrypto/bn/bn_gf2m.c
+++ b/src/lib/libcrypto/bn/bn_gf2m.c
@@ -94,6 +94,8 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
+#ifndef OPENSSL_NO_EC2M
+
 /* Maximum number of iterations before BN_GF2m_mod_solve_quad_arr should fail. */
 #define MAX_ITERATIONS 50
 
@@ -122,6 +124,7 @@ static const BN_ULONG SQR_tb[16] =
     SQR_tb[(w) >>  4 & 0xF] <<  8 | SQR_tb[(w)       & 0xF]
 #endif
 
+#if !defined(OPENSSL_BN_ASM_GF2m)
 /* Product of two polynomials a, b each with degree < BN_BITS2 - 1,
  * result is a polynomial r with degree < 2 * BN_BITS - 1
  * The caller MUST ensure that the variables have the right amount
@@ -216,7 +219,9 @@ static void bn_GF2m_mul_2x2(BN_ULONG *r, const BN_ULONG a1, const BN_ULONG a0, c
         r[2] ^= m1 ^ r[1] ^ r[3];  /* h0 ^= m1 ^ l1 ^ h1; */
         r[1] = r[3] ^ r[2] ^ r[0] ^ m1 ^ m0;  /* l1 ^= l0 ^ h0 ^ m0; */
         }
-
+#else
+void bn_GF2m_mul_2x2(BN_ULONG *r, BN_ULONG a1, BN_ULONG a0, BN_ULONG b1, BN_ULONG b0);
+#endif 
 
 /* Add polynomials a and b and store result in r; r could be a or b, a and b 
  * could be equal; r is the bitwise XOR of a and b.
@@ -360,21 +365,17 @@ int BN_GF2m_mod_arr(BIGNUM *r, const BIGNUM *a, const int p[])
 int     BN_GF2m_mod(BIGNUM *r, const BIGNUM *a, const BIGNUM *p)
         {
         int ret = 0;
-        const int max = BN_num_bits(p) + 1;
-        int *arr=NULL;
+        int arr[6];
         bn_check_top(a);
         bn_check_top(p);
-        if ((arr = (int *)OPENSSL_malloc(sizeof(int) * max)) == NULL) goto err;
-        ret = BN_GF2m_poly2arr(p, arr, max);
-        if (!ret || ret > max)
+        ret = BN_GF2m_poly2arr(p, arr, sizeof(arr)/sizeof(arr[0]));
+        if (!ret || ret > (int)(sizeof(arr)/sizeof(arr[0])))
                 {
                 BNerr(BN_F_BN_GF2M_MOD,BN_R_INVALID_LENGTH);
-                goto err;
+                return 0;
                 }
         ret = BN_GF2m_mod_arr(r, a, arr);
         bn_check_top(r);
-err:
-        if (arr) OPENSSL_free(arr);
         return ret;
         }
 
@@ -521,7 +522,7 @@ err:
  */
 int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
         {
-        BIGNUM *b, *c, *u, *v, *tmp;
+        BIGNUM *b, *c = NULL, *u = NULL, *v = NULL, *tmp;
         int ret = 0;
 
         bn_check_top(a);
@@ -529,18 +530,18 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
 
         BN_CTX_start(ctx);
         
-        b = BN_CTX_get(ctx);
-        c = BN_CTX_get(ctx);
-        u = BN_CTX_get(ctx);
-        v = BN_CTX_get(ctx);
-        if (v == NULL) goto err;
+        if ((b = BN_CTX_get(ctx))==NULL) goto err;
+        if ((c = BN_CTX_get(ctx))==NULL) goto err;
+        if ((u = BN_CTX_get(ctx))==NULL) goto err;
+        if ((v = BN_CTX_get(ctx))==NULL) goto err;
 
-        if (!BN_one(b)) goto err;
         if (!BN_GF2m_mod(u, a, p)) goto err;
-        if (!BN_copy(v, p)) goto err;
-
         if (BN_is_zero(u)) goto err;
 
+        if (!BN_copy(v, p)) goto err;
+#if 0
+        if (!BN_one(b)) goto err;
+
         while (1)
                 {
                 while (!BN_is_odd(u))
@@ -565,13 +566,89 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                 if (!BN_GF2m_add(u, u, v)) goto err;
                 if (!BN_GF2m_add(b, b, c)) goto err;
                 }
+#else
+        {
+        int i,  ubits = BN_num_bits(u),
+                vbits = BN_num_bits(v), /* v is copy of p */
+                top = p->top;
+        BN_ULONG *udp,*bdp,*vdp,*cdp;
+
+        bn_wexpand(u,top);      udp = u->d;
+                                for (i=u->top;i<top;i++) udp[i] = 0;
+                                u->top = top;
+        bn_wexpand(b,top);      bdp = b->d;
+                                bdp[0] = 1;
+                                for (i=1;i<top;i++) bdp[i] = 0;
+                                b->top = top;
+        bn_wexpand(c,top);      cdp = c->d;
+                                for (i=0;i<top;i++) cdp[i] = 0;
+                                c->top = top;
+        vdp = v->d;     /* It pays off to "cache" *->d pointers, because
+                         * it allows optimizer to be more aggressive.
+                         * But we don't have to "cache" p->d, because *p
+                         * is declared 'const'... */
+        while (1)
+                {
+                while (ubits && !(udp[0]&1))
+                        {
+                        BN_ULONG u0,u1,b0,b1,mask;
+
+                        u0   = udp[0];
+                        b0   = bdp[0];
+                        mask = (BN_ULONG)0-(b0&1);
+                        b0  ^= p->d[0]&mask;
+                        for (i=0;i<top-1;i++)
+                                {
+                                u1 = udp[i+1];
+                                udp[i] = ((u0>>1)|(u1<<(BN_BITS2-1)))&BN_MASK2;
+                                u0 = u1;
+                                b1 = bdp[i+1]^(p->d[i+1]&mask);
+                                bdp[i] = ((b0>>1)|(b1<<(BN_BITS2-1)))&BN_MASK2;
+                                b0 = b1;
+                                }
+                        udp[i] = u0>>1;
+                        bdp[i] = b0>>1;
+                        ubits--;
+                        }
 
+                if (ubits<=BN_BITS2 && udp[0]==1) break;
+
+                if (ubits<vbits)
+                        {
+                        i = ubits; ubits = vbits; vbits = i;
+                        tmp = u; u = v; v = tmp;
+                        tmp = b; b = c; c = tmp;
+                        udp = vdp; vdp = v->d;
+                        bdp = cdp; cdp = c->d;
+                        }
+                for(i=0;i<top;i++)
+                        {
+                        udp[i] ^= vdp[i];
+                        bdp[i] ^= cdp[i];
+                        }
+                if (ubits==vbits)
+                        {
+                        BN_ULONG ul;
+                        int utop = (ubits-1)/BN_BITS2;
+
+                        while ((ul=udp[utop])==0 && utop) utop--;
+                        ubits = utop*BN_BITS2 + BN_num_bits_word(ul);
+                        }
+                }
+        bn_correct_top(b);
+        }
+#endif
 
         if (!BN_copy(r, b)) goto err;
         bn_check_top(r);
         ret = 1;
 
 err:
+#ifdef BN_DEBUG /* BN_CTX_end would complain about the expanded form */
+        bn_correct_top(c);
+        bn_correct_top(u);
+        bn_correct_top(v);
+#endif
         BN_CTX_end(ctx);
         return ret;
         }
@@ -1033,3 +1110,4 @@ int BN_GF2m_arr2poly(const int p[], BIGNUM *a)
         return 1;
         }
 
+#endif
diff --git a/src/lib/libcrypto/bn/bn_lcl.h b/src/lib/libcrypto/bn/bn_lcl.h
index 8e5e98e3f2..eecfd8cc99 100644
--- a/src/lib/libcrypto/bn/bn_lcl.h
+++ b/src/lib/libcrypto/bn/bn_lcl.h
@@ -238,7 +238,7 @@ extern "C" {
 #  if defined(__DECC)
 #   include <c_asm.h>
 #   define BN_UMULT_HIGH(a,b)   (BN_ULONG)asm("umulh %a0,%a1,%v0",(a),(b))
-#  elif defined(__GNUC__)
+#  elif defined(__GNUC__) && __GNUC__>=2
 #   define BN_UMULT_HIGH(a,b)   ({      \
         register BN_ULONG ret;          \
         asm ("umulh     %1,%2,%0"       \
@@ -247,7 +247,7 @@ extern "C" {
         ret;                    })
 #  endif        /* compiler */
 # elif defined(_ARCH_PPC) && defined(__64BIT__) && defined(SIXTY_FOUR_BIT_LONG)
-#  if defined(__GNUC__)
+#  if defined(__GNUC__) && __GNUC__>=2
 #   define BN_UMULT_HIGH(a,b)   ({      \
         register BN_ULONG ret;          \
         asm ("mulhdu    %0,%1,%2"       \
@@ -257,7 +257,7 @@ extern "C" {
 #  endif        /* compiler */
 # elif (defined(__x86_64) || defined(__x86_64__)) && \
        (defined(SIXTY_FOUR_BIT_LONG) || defined(SIXTY_FOUR_BIT))
-#  if defined(__GNUC__)
+#  if defined(__GNUC__) && __GNUC__>=2
 #   define BN_UMULT_HIGH(a,b)   ({      \
         register BN_ULONG ret,discard;  \
         asm ("mulq      %3"             \
@@ -280,6 +280,19 @@ extern "C" {
 #   define BN_UMULT_HIGH(a,b)           __umulh((a),(b))
 #   define BN_UMULT_LOHI(low,high,a,b)  ((low)=_umul128((a),(b),&(high)))
 #  endif
+# elif defined(__mips) && (defined(SIXTY_FOUR_BIT) || defined(SIXTY_FOUR_BIT_LONG))
+#  if defined(__GNUC__) && __GNUC__>=2
+#   define BN_UMULT_HIGH(a,b)   ({      \
+        register BN_ULONG ret;          \
+        asm ("dmultu    %1,%2"          \
+             : "=h"(ret)                \
+             : "r"(a), "r"(b) : "l");   \
+        ret;                    })
+#   define BN_UMULT_LOHI(low,high,a,b)  \
+        asm ("dmultu    %2,%3"          \
+             : "=l"(low),"=h"(high)     \
+             : "r"(a), "r"(b));
+#  endif
 # endif         /* cpu */
 #endif          /* OPENSSL_NO_ASM */
 
@@ -459,6 +472,10 @@ extern "C" {
         }
 #endif /* !BN_LLONG */
 
+#if defined(OPENSSL_DOING_MAKEDEPEND) && defined(OPENSSL_FIPS)
+#undef bn_div_words
+#endif
+
 void bn_mul_normal(BN_ULONG *r,BN_ULONG *a,int na,BN_ULONG *b,int nb);
 void bn_mul_comba8(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b);
 void bn_mul_comba4(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b);
diff --git a/src/lib/libcrypto/bn/bn_lib.c b/src/lib/libcrypto/bn/bn_lib.c
index 5470fbe6ef..7a5676de69 100644
--- a/src/lib/libcrypto/bn/bn_lib.c
+++ b/src/lib/libcrypto/bn/bn_lib.c
@@ -139,25 +139,6 @@ const BIGNUM *BN_value_one(void)
         return(&const_one);
         }
 
-char *BN_options(void)
-        {
-        static int init=0;
-        static char data[16];
-
-        if (!init)
-                {
-                init++;
-#ifdef BN_LLONG
-                BIO_snprintf(data,sizeof data,"bn(%d,%d)",
-                             (int)sizeof(BN_ULLONG)*8,(int)sizeof(BN_ULONG)*8);
-#else
-                BIO_snprintf(data,sizeof data,"bn(%d,%d)",
-                             (int)sizeof(BN_ULONG)*8,(int)sizeof(BN_ULONG)*8);
-#endif
-                }
-        return(data);
-        }
-
 int BN_num_bits_word(BN_ULONG l)
         {
         static const unsigned char bits[256]={
diff --git a/src/lib/libcrypto/bn/bn_mont.c b/src/lib/libcrypto/bn/bn_mont.c
index 1a866880f5..427b5cf4df 100644
--- a/src/lib/libcrypto/bn/bn_mont.c
+++ b/src/lib/libcrypto/bn/bn_mont.c
@@ -177,31 +177,26 @@ err:
 static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
         {
         BIGNUM *n;
-        BN_ULONG *ap,*np,*rp,n0,v,*nrp;
-        int al,nl,max,i,x,ri;
+        BN_ULONG *ap,*np,*rp,n0,v,carry;
+        int nl,max,i;
 
         n= &(mont->N);
-        /* mont->ri is the size of mont->N in bits (rounded up
-           to the word size) */
-        al=ri=mont->ri/BN_BITS2;
-
         nl=n->top;
-        if ((al == 0) || (nl == 0)) { ret->top=0; return(1); }
+        if (nl == 0) { ret->top=0; return(1); }
 
-        max=(nl+al+1); /* allow for overflow (no?) XXX */
+        max=(2*nl); /* carry is stored separately */
         if (bn_wexpand(r,max) == NULL) return(0);
 
         r->neg^=n->neg;
         np=n->d;
         rp=r->d;
-        nrp= &(r->d[nl]);
 
         /* clear the top words of T */
 #if 1
         for (i=r->top; i<max; i++) /* memset? XXX */
-                r->d[i]=0;
+                rp[i]=0;
 #else
-        memset(&(r->d[r->top]),0,(max-r->top)*sizeof(BN_ULONG)); 
+        memset(&(rp[r->top]),0,(max-r->top)*sizeof(BN_ULONG)); 
 #endif
 
         r->top=max;
@@ -210,7 +205,7 @@ static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
 #ifdef BN_COUNT
         fprintf(stderr,"word BN_from_montgomery_word %d * %d\n",nl,nl);
 #endif
-        for (i=0; i<nl; i++)
+        for (carry=0, i=0; i<nl; i++, rp++)
                 {
 #ifdef __TANDEM
                 {
@@ -228,61 +223,33 @@ static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
 #else
                 v=bn_mul_add_words(rp,np,nl,(rp[0]*n0)&BN_MASK2);
 #endif
-                nrp++;
-                rp++;
-                if (((nrp[-1]+=v)&BN_MASK2) >= v)
-                        continue;
-                else
-                        {
-                        if (((++nrp[0])&BN_MASK2) != 0) continue;
-                        if (((++nrp[1])&BN_MASK2) != 0) continue;
-                        for (x=2; (((++nrp[x])&BN_MASK2) == 0); x++) ;
-                        }
-                }
-        bn_correct_top(r);
-
-        /* mont->ri will be a multiple of the word size and below code
-         * is kind of BN_rshift(ret,r,mont->ri) equivalent */
-        if (r->top <= ri)
-                {
-                ret->top=0;
-                return(1);
+                v = (v+carry+rp[nl])&BN_MASK2;
+                carry |= (v != rp[nl]);
+                carry &= (v <= rp[nl]);
+                rp[nl]=v;
                 }
-        al=r->top-ri;
 
-#define BRANCH_FREE 1
-#if BRANCH_FREE
-        if (bn_wexpand(ret,ri) == NULL) return(0);
-        x=0-(((al-ri)>>(sizeof(al)*8-1))&1);
-        ret->top=x=(ri&~x)|(al&x);      /* min(ri,al) */
+        if (bn_wexpand(ret,nl) == NULL) return(0);
+        ret->top=nl;
         ret->neg=r->neg;
 
         rp=ret->d;
-        ap=&(r->d[ri]);
+        ap=&(r->d[nl]);
 
+#define BRANCH_FREE 1
+#if BRANCH_FREE
         {
-        size_t m1,m2;
-
-        v=bn_sub_words(rp,ap,np,ri);
-        /* this ----------------^^ works even in al<ri case
-         * thanks to zealous zeroing of top of the vector in the
-         * beginning. */
+        BN_ULONG *nrp;
+        size_t m;
 
-        /* if (al==ri && !v) || al>ri) nrp=rp; else nrp=ap; */
-        /* in other words if subtraction result is real, then
+        v=bn_sub_words(rp,ap,np,nl)-carry;
+        /* if subtraction result is real, then
          * trick unconditional memcpy below to perform in-place
          * "refresh" instead of actual copy. */
-        m1=0-(size_t)(((al-ri)>>(sizeof(al)*8-1))&1);   /* al<ri */
-        m2=0-(size_t)(((ri-al)>>(sizeof(al)*8-1))&1);   /* al>ri */
-        m1|=m2;                 /* (al!=ri) */
-        m1|=(0-(size_t)v);      /* (al!=ri || v) */
-        m1&=~m2;                /* (al!=ri || v) && !al>ri */
-        nrp=(BN_ULONG *)(((PTR_SIZE_INT)rp&~m1)|((PTR_SIZE_INT)ap&m1));
-        }
+        m=(0-(size_t)v);
+        nrp=(BN_ULONG *)(((PTR_SIZE_INT)rp&~m)|((PTR_SIZE_INT)ap&m));
 
-        /* 'i<ri' is chosen to eliminate dependency on input data, even
-         * though it results in redundant copy in al<ri case. */
-        for (i=0,ri-=4; i<ri; i+=4)
+        for (i=0,nl-=4; i<nl; i+=4)
                 {
                 BN_ULONG t1,t2,t3,t4;
                 
@@ -295,40 +262,15 @@ static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
                 rp[i+2]=t3;
                 rp[i+3]=t4;
                 }
-        for (ri+=4; i<ri; i++)
+        for (nl+=4; i<nl; i++)
                 rp[i]=nrp[i], ap[i]=0;
-        bn_correct_top(r);
-        bn_correct_top(ret);
+        }
 #else
-        if (bn_wexpand(ret,al) == NULL) return(0);
-        ret->top=al;
-        ret->neg=r->neg;
-
-        rp=ret->d;
-        ap=&(r->d[ri]);
-        al-=4;
-        for (i=0; i<al; i+=4)
-                {
-                BN_ULONG t1,t2,t3,t4;
-                
-                t1=ap[i+0];
-                t2=ap[i+1];
-                t3=ap[i+2];
-                t4=ap[i+3];
-                rp[i+0]=t1;
-                rp[i+1]=t2;
-                rp[i+2]=t3;
-                rp[i+3]=t4;
-                }
-        al+=4;
-        for (; i<al; i++)
-                rp[i]=ap[i];
-
-        if (BN_ucmp(ret, &(mont->N)) >= 0)
-                {
-                if (!BN_usub(ret,ret,&(mont->N))) return(0);
-                }
+        if (bn_sub_words (rp,ap,np,nl)-carry)
+                memcpy(rp,ap,nl*sizeof(BN_ULONG));
 #endif
+        bn_correct_top(r);
+        bn_correct_top(ret);
         bn_check_top(ret);
 
         return(1);
diff --git a/src/lib/libcrypto/bn/bn_nist.c b/src/lib/libcrypto/bn/bn_nist.c
index c6de032696..43caee4770 100644
--- a/src/lib/libcrypto/bn/bn_nist.c
+++ b/src/lib/libcrypto/bn/bn_nist.c
@@ -319,6 +319,13 @@ static void nist_cp_bn(BN_ULONG *buf, BN_ULONG *a, int top)
                                                 :(to[(n)/2] =((m)&1)?(from[(m)/2]>>32):(from[(m)/2]&BN_MASK2l)))
 #define bn_32_set_0(to, n)              (((n)&1)?(to[(n)/2]&=BN_MASK2l):(to[(n)/2]=0));
 #define bn_cp_32(to,n,from,m)           ((m)>=0)?bn_cp_32_naked(to,n,from,m):bn_32_set_0(to,n)
+# if defined(L_ENDIAN)
+#  if defined(__arch64__)
+#   define NIST_INT64 long
+#  else
+#   define NIST_INT64 long long
+#  endif
+# endif
 #else
 #define bn_cp_64(to, n, from, m) \
         { \
@@ -330,13 +337,15 @@ static void nist_cp_bn(BN_ULONG *buf, BN_ULONG *a, int top)
         bn_32_set_0(to, (n)*2); \
         bn_32_set_0(to, (n)*2+1); \
         }
-#if BN_BITS2 == 32
 #define bn_cp_32(to, n, from, m)        (to)[n] = (m>=0)?((from)[m]):0;
 #define bn_32_set_0(to, n)              (to)[n] = (BN_ULONG)0;
-#endif
+# if defined(_WIN32) && !defined(__GNUC__)
+#  define NIST_INT64 __int64
+# elif defined(BN_LLONG)
+#  define NIST_INT64 long long
+# endif
 #endif /* BN_BITS2 != 64 */
 
-
 #define nist_set_192(to, from, a1, a2, a3) \
         { \
         bn_cp_64(to, 0, from, (a3) - 3) \
@@ -350,9 +359,11 @@ int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
         int      top = a->top, i;
         int      carry;
         register BN_ULONG *r_d, *a_d = a->d;
-        BN_ULONG t_d[BN_NIST_192_TOP],
-                 buf[BN_NIST_192_TOP],
-                 c_d[BN_NIST_192_TOP],
+        union   {
+                BN_ULONG        bn[BN_NIST_192_TOP];
+                unsigned int    ui[BN_NIST_192_TOP*sizeof(BN_ULONG)/sizeof(unsigned int)];
+                } buf;
+        BN_ULONG c_d[BN_NIST_192_TOP],
                 *res;
         PTR_SIZE_INT mask;
         static const BIGNUM _bignum_nist_p_192_sqr = {
@@ -385,15 +396,48 @@ int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
         else
                 r_d = a_d;
 
-        nist_cp_bn_0(buf, a_d + BN_NIST_192_TOP, top - BN_NIST_192_TOP, BN_NIST_192_TOP);
+        nist_cp_bn_0(buf.bn, a_d + BN_NIST_192_TOP, top - BN_NIST_192_TOP, BN_NIST_192_TOP);
+
+#if defined(NIST_INT64)
+        {
+        NIST_INT64              acc;    /* accumulator */
+        unsigned int            *rp=(unsigned int *)r_d;
+        const unsigned int      *bp=(const unsigned int *)buf.ui;
+
+        acc  = rp[0];   acc += bp[3*2-6];
+                        acc += bp[5*2-6]; rp[0] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[1];   acc += bp[3*2-5];
+                        acc += bp[5*2-5]; rp[1] = (unsigned int)acc; acc >>= 32;
 
-        nist_set_192(t_d, buf, 0, 3, 3);
+        acc += rp[2];   acc += bp[3*2-6];
+                        acc += bp[4*2-6];
+                        acc += bp[5*2-6]; rp[2] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[3];   acc += bp[3*2-5];
+                        acc += bp[4*2-5];
+                        acc += bp[5*2-5]; rp[3] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[4];   acc += bp[4*2-6];
+                        acc += bp[5*2-6]; rp[4] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[5];   acc += bp[4*2-5];
+                        acc += bp[5*2-5]; rp[5] = (unsigned int)acc;
+
+        carry = (int)(acc>>32);
+        }
+#else
+        {
+        BN_ULONG t_d[BN_NIST_192_TOP];
+
+        nist_set_192(t_d, buf.bn, 0, 3, 3);
         carry = (int)bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP);
-        nist_set_192(t_d, buf, 4, 4, 0);
+        nist_set_192(t_d, buf.bn, 4, 4, 0);
         carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP);
-        nist_set_192(t_d, buf, 5, 5, 5)
+        nist_set_192(t_d, buf.bn, 5, 5, 5)
         carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP);
-
+        }
+#endif
         if (carry > 0)
                 carry = (int)bn_sub_words(r_d,r_d,_nist_p_192[carry-1],BN_NIST_192_TOP);
         else
@@ -435,8 +479,7 @@ int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
         int     top = a->top, i;
         int     carry;
         BN_ULONG *r_d, *a_d = a->d;
-        BN_ULONG t_d[BN_NIST_224_TOP],
-                 buf[BN_NIST_224_TOP],
+        BN_ULONG buf[BN_NIST_224_TOP],
                  c_d[BN_NIST_224_TOP],
                 *res;
         PTR_SIZE_INT mask;
@@ -474,14 +517,54 @@ int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 
 #if BN_BITS2==64
         /* copy upper 256 bits of 448 bit number ... */
-        nist_cp_bn_0(t_d, a_d + (BN_NIST_224_TOP-1), top - (BN_NIST_224_TOP-1), BN_NIST_224_TOP);
+        nist_cp_bn_0(c_d, a_d + (BN_NIST_224_TOP-1), top - (BN_NIST_224_TOP-1), BN_NIST_224_TOP);
         /* ... and right shift by 32 to obtain upper 224 bits */
-        nist_set_224(buf, t_d, 14, 13, 12, 11, 10, 9, 8);
+        nist_set_224(buf, c_d, 14, 13, 12, 11, 10, 9, 8);
         /* truncate lower part to 224 bits too */
         r_d[BN_NIST_224_TOP-1] &= BN_MASK2l;
 #else
         nist_cp_bn_0(buf, a_d + BN_NIST_224_TOP, top - BN_NIST_224_TOP, BN_NIST_224_TOP);
 #endif
+
+#if defined(NIST_INT64) && BN_BITS2!=64
+        {
+        NIST_INT64              acc;    /* accumulator */
+        unsigned int            *rp=(unsigned int *)r_d;
+        const unsigned int      *bp=(const unsigned int *)buf;
+
+        acc  = rp[0];   acc -= bp[7-7];
+                        acc -= bp[11-7]; rp[0] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[1];   acc -= bp[8-7];
+                        acc -= bp[12-7]; rp[1] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[2];   acc -= bp[9-7];
+                        acc -= bp[13-7]; rp[2] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[3];   acc += bp[7-7];
+                        acc += bp[11-7];
+                        acc -= bp[10-7]; rp[3] = (unsigned int)acc; acc>>= 32;
+
+        acc += rp[4];   acc += bp[8-7];
+                        acc += bp[12-7];
+                        acc -= bp[11-7]; rp[4] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[5];   acc += bp[9-7];
+                        acc += bp[13-7];
+                        acc -= bp[12-7]; rp[5] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[6];   acc += bp[10-7];
+                        acc -= bp[13-7]; rp[6] = (unsigned int)acc;
+
+        carry = (int)(acc>>32);
+# if BN_BITS2==64
+        rp[7] = carry;
+# endif
+        }       
+#else
+        {
+        BN_ULONG t_d[BN_NIST_224_TOP];
+
         nist_set_224(t_d, buf, 10, 9, 8, 7, 0, 0, 0);
         carry = (int)bn_add_words(r_d, r_d, t_d, BN_NIST_224_TOP);
         nist_set_224(t_d, buf, 0, 13, 12, 11, 0, 0, 0);
@@ -494,6 +577,8 @@ int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 #if BN_BITS2==64
         carry = (int)(r_d[BN_NIST_224_TOP-1]>>32);
 #endif
+        }
+#endif
         u.f = bn_sub_words;
         if (carry > 0)
                 {
@@ -548,9 +633,11 @@ int BN_nist_mod_256(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
         int     i, top = a->top;
         int     carry = 0;
         register BN_ULONG *a_d = a->d, *r_d;
-        BN_ULONG t_d[BN_NIST_256_TOP],
-                 buf[BN_NIST_256_TOP],
-                 c_d[BN_NIST_256_TOP],
+        union   {
+                BN_ULONG bn[BN_NIST_256_TOP];
+                unsigned int ui[BN_NIST_256_TOP*sizeof(BN_ULONG)/sizeof(unsigned int)];
+                } buf;
+        BN_ULONG c_d[BN_NIST_256_TOP],
                 *res;
         PTR_SIZE_INT mask;
         union { bn_addsub_f f; PTR_SIZE_INT p; } u;
@@ -584,12 +671,87 @@ int BN_nist_mod_256(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
         else
                 r_d = a_d;
 
-        nist_cp_bn_0(buf, a_d + BN_NIST_256_TOP, top - BN_NIST_256_TOP, BN_NIST_256_TOP);
+        nist_cp_bn_0(buf.bn, a_d + BN_NIST_256_TOP, top - BN_NIST_256_TOP, BN_NIST_256_TOP);
+
+#if defined(NIST_INT64)
+        {
+        NIST_INT64              acc;    /* accumulator */
+        unsigned int            *rp=(unsigned int *)r_d;
+        const unsigned int      *bp=(const unsigned int *)buf.ui;
+
+        acc = rp[0];    acc += bp[8-8];
+                        acc += bp[9-8];
+                        acc -= bp[11-8];
+                        acc -= bp[12-8];
+                        acc -= bp[13-8];
+                        acc -= bp[14-8]; rp[0] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[1];   acc += bp[9-8];
+                        acc += bp[10-8];
+                        acc -= bp[12-8];
+                        acc -= bp[13-8];
+                        acc -= bp[14-8];
+                        acc -= bp[15-8]; rp[1] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[2];   acc += bp[10-8];
+                        acc += bp[11-8];
+                        acc -= bp[13-8];
+                        acc -= bp[14-8];
+                        acc -= bp[15-8]; rp[2] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[3];   acc += bp[11-8];
+                        acc += bp[11-8];
+                        acc += bp[12-8];
+                        acc += bp[12-8];
+                        acc += bp[13-8];
+                        acc -= bp[15-8];
+                        acc -= bp[8-8];
+                        acc -= bp[9-8];  rp[3] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[4];   acc += bp[12-8];
+                        acc += bp[12-8];
+                        acc += bp[13-8];
+                        acc += bp[13-8];
+                        acc += bp[14-8];
+                        acc -= bp[9-8];
+                        acc -= bp[10-8]; rp[4] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[5];   acc += bp[13-8];
+                        acc += bp[13-8];
+                        acc += bp[14-8];
+                        acc += bp[14-8];
+                        acc += bp[15-8];
+                        acc -= bp[10-8];
+                        acc -= bp[11-8]; rp[5] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[6];   acc += bp[14-8];
+                        acc += bp[14-8];
+                        acc += bp[15-8];
+                        acc += bp[15-8];
+                        acc += bp[14-8];
+                        acc += bp[13-8];
+                        acc -= bp[8-8];
+                        acc -= bp[9-8];  rp[6] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[7];   acc += bp[15-8];
+                        acc += bp[15-8];
+                        acc += bp[15-8];
+                        acc += bp[8 -8];
+                        acc -= bp[10-8];
+                        acc -= bp[11-8];
+                        acc -= bp[12-8];
+                        acc -= bp[13-8]; rp[7] = (unsigned int)acc;
+
+        carry = (int)(acc>>32);
+        }
+#else
+        {
+        BN_ULONG t_d[BN_NIST_256_TOP];
 
         /*S1*/
-        nist_set_256(t_d, buf, 15, 14, 13, 12, 11, 0, 0, 0);
+        nist_set_256(t_d, buf.bn, 15, 14, 13, 12, 11, 0, 0, 0);
         /*S2*/
-        nist_set_256(c_d, buf, 0, 15, 14, 13, 12, 0, 0, 0);
+        nist_set_256(c_d, buf.bn, 0, 15, 14, 13, 12, 0, 0, 0);
         carry = (int)bn_add_words(t_d, t_d, c_d, BN_NIST_256_TOP);
         /* left shift */
                 {
@@ -607,24 +769,26 @@ int BN_nist_mod_256(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
                 }
         carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_256_TOP);
         /*S3*/
-        nist_set_256(t_d, buf, 15, 14, 0, 0, 0, 10, 9, 8);
+        nist_set_256(t_d, buf.bn, 15, 14, 0, 0, 0, 10, 9, 8);
         carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_256_TOP);
         /*S4*/
-        nist_set_256(t_d, buf, 8, 13, 15, 14, 13, 11, 10, 9);
+        nist_set_256(t_d, buf.bn, 8, 13, 15, 14, 13, 11, 10, 9);
         carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_256_TOP);
         /*D1*/
-        nist_set_256(t_d, buf, 10, 8, 0, 0, 0, 13, 12, 11);
+        nist_set_256(t_d, buf.bn, 10, 8, 0, 0, 0, 13, 12, 11);
         carry -= (int)bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP);
         /*D2*/
-        nist_set_256(t_d, buf, 11, 9, 0, 0, 15, 14, 13, 12);
+        nist_set_256(t_d, buf.bn, 11, 9, 0, 0, 15, 14, 13, 12);
         carry -= (int)bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP);
         /*D3*/
-        nist_set_256(t_d, buf, 12, 0, 10, 9, 8, 15, 14, 13);
+        nist_set_256(t_d, buf.bn, 12, 0, 10, 9, 8, 15, 14, 13);
         carry -= (int)bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP);
         /*D4*/
-        nist_set_256(t_d, buf, 13, 0, 11, 10, 9, 0, 15, 14);
+        nist_set_256(t_d, buf.bn, 13, 0, 11, 10, 9, 0, 15, 14);
         carry -= (int)bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP);
 
+        }
+#endif
         /* see BN_nist_mod_224 for explanation */
         u.f = bn_sub_words;
         if (carry > 0)
@@ -672,9 +836,11 @@ int BN_nist_mod_384(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
         int     i, top = a->top;
         int     carry = 0;
         register BN_ULONG *r_d, *a_d = a->d;
-        BN_ULONG t_d[BN_NIST_384_TOP],
-                 buf[BN_NIST_384_TOP],
-                 c_d[BN_NIST_384_TOP],
+        union   {
+                BN_ULONG bn[BN_NIST_384_TOP];
+                unsigned int ui[BN_NIST_384_TOP*sizeof(BN_ULONG)/sizeof(unsigned int)];
+                } buf;
+        BN_ULONG c_d[BN_NIST_384_TOP],
                 *res;
         PTR_SIZE_INT mask;
         union { bn_addsub_f f; PTR_SIZE_INT p; } u;
@@ -709,10 +875,100 @@ int BN_nist_mod_384(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
         else
                 r_d = a_d;
 
-        nist_cp_bn_0(buf, a_d + BN_NIST_384_TOP, top - BN_NIST_384_TOP, BN_NIST_384_TOP);
+        nist_cp_bn_0(buf.bn, a_d + BN_NIST_384_TOP, top - BN_NIST_384_TOP, BN_NIST_384_TOP);
+
+#if defined(NIST_INT64)
+        {
+        NIST_INT64              acc;    /* accumulator */
+        unsigned int            *rp=(unsigned int *)r_d;
+        const unsigned int      *bp=(const unsigned int *)buf.ui;
+
+        acc = rp[0];    acc += bp[12-12];
+                        acc += bp[21-12];
+                        acc += bp[20-12];
+                        acc -= bp[23-12]; rp[0] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[1];   acc += bp[13-12];
+                        acc += bp[22-12];
+                        acc += bp[23-12];
+                        acc -= bp[12-12];
+                        acc -= bp[20-12]; rp[1] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[2];   acc += bp[14-12];
+                        acc += bp[23-12];
+                        acc -= bp[13-12];
+                        acc -= bp[21-12]; rp[2] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[3];   acc += bp[15-12];
+                        acc += bp[12-12];
+                        acc += bp[20-12];
+                        acc += bp[21-12];
+                        acc -= bp[14-12];
+                        acc -= bp[22-12];
+                        acc -= bp[23-12]; rp[3] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[4];   acc += bp[21-12];
+                        acc += bp[21-12];
+                        acc += bp[16-12];
+                        acc += bp[13-12];
+                        acc += bp[12-12];
+                        acc += bp[20-12];
+                        acc += bp[22-12];
+                        acc -= bp[15-12];
+                        acc -= bp[23-12];
+                        acc -= bp[23-12]; rp[4] = (unsigned int)acc; acc >>= 32;
+
+        acc += rp[5];   acc += bp[22-12];
+                        acc += bp[22-12];
+                        acc += bp[17-12];
+                        acc += bp[14-12];
+                        acc += bp[13-12];
+                        acc += bp[21-12];
+                        acc += bp[23-12];
+                        acc -= bp[16-12]; rp[5] = (unsigned int)acc; acc >>= 32;
+                        
+        acc += rp[6];   acc += bp[23-12];
+                        acc += bp[23-12];
+                        acc += bp[18-12];
+                        acc += bp[15-12];
+                        acc += bp[14-12];
+                        acc += bp[22-12];
+                        acc -= bp[17-12]; rp[6] = (unsigned int)acc; acc >>= 32;
+                        
+        acc += rp[7];   acc += bp[19-12];
+                        acc += bp[16-12];
+                        acc += bp[15-12];
+                        acc += bp[23-12];
+                        acc -= bp[18-12]; rp[7] = (unsigned int)acc; acc >>= 32;
+                        
+        acc += rp[8];   acc += bp[20-12];
+                        acc += bp[17-12];
+                        acc += bp[16-12];
+                        acc -= bp[19-12]; rp[8] = (unsigned int)acc; acc >>= 32;
+                        
+        acc += rp[9];   acc += bp[21-12];
+                        acc += bp[18-12];
+                        acc += bp[17-12];
+                        acc -= bp[20-12]; rp[9] = (unsigned int)acc; acc >>= 32;
+                        
+        acc += rp[10];  acc += bp[22-12];
+                        acc += bp[19-12];
+                        acc += bp[18-12];
+                        acc -= bp[21-12]; rp[10] = (unsigned int)acc; acc >>= 32;
+                        
+        acc += rp[11];  acc += bp[23-12];
+                        acc += bp[20-12];
+                        acc += bp[19-12];
+                        acc -= bp[22-12]; rp[11] = (unsigned int)acc;
+
+        carry = (int)(acc>>32);
+        }
+#else
+        {
+        BN_ULONG t_d[BN_NIST_384_TOP];
 
         /*S1*/
-        nist_set_256(t_d, buf, 0, 0, 0, 0, 0, 23-4, 22-4, 21-4);
+        nist_set_256(t_d, buf.bn, 0, 0, 0, 0, 0, 23-4, 22-4, 21-4);
                 /* left shift */
                 {
                 register BN_ULONG *ap,t,c;
@@ -729,29 +985,31 @@ int BN_nist_mod_384(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
         carry = (int)bn_add_words(r_d+(128/BN_BITS2), r_d+(128/BN_BITS2), 
                 t_d, BN_NIST_256_TOP);
         /*S2 */
-        carry += (int)bn_add_words(r_d, r_d, buf, BN_NIST_384_TOP);
+        carry += (int)bn_add_words(r_d, r_d, buf.bn, BN_NIST_384_TOP);
         /*S3*/
-        nist_set_384(t_d,buf,20,19,18,17,16,15,14,13,12,23,22,21);
+        nist_set_384(t_d,buf.bn,20,19,18,17,16,15,14,13,12,23,22,21);
         carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_384_TOP);
         /*S4*/
-        nist_set_384(t_d,buf,19,18,17,16,15,14,13,12,20,0,23,0);
+        nist_set_384(t_d,buf.bn,19,18,17,16,15,14,13,12,20,0,23,0);
         carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_384_TOP);
         /*S5*/
-        nist_set_384(t_d, buf,0,0,0,0,23,22,21,20,0,0,0,0);
+        nist_set_384(t_d, buf.bn,0,0,0,0,23,22,21,20,0,0,0,0);
         carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_384_TOP);
         /*S6*/
-        nist_set_384(t_d,buf,0,0,0,0,0,0,23,22,21,0,0,20);
+        nist_set_384(t_d,buf.bn,0,0,0,0,0,0,23,22,21,0,0,20);
         carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_384_TOP);
         /*D1*/
-        nist_set_384(t_d,buf,22,21,20,19,18,17,16,15,14,13,12,23);
+        nist_set_384(t_d,buf.bn,22,21,20,19,18,17,16,15,14,13,12,23);
         carry -= (int)bn_sub_words(r_d, r_d, t_d, BN_NIST_384_TOP);
         /*D2*/
-        nist_set_384(t_d,buf,0,0,0,0,0,0,0,23,22,21,20,0);
+        nist_set_384(t_d,buf.bn,0,0,0,0,0,0,0,23,22,21,20,0);
         carry -= (int)bn_sub_words(r_d, r_d, t_d, BN_NIST_384_TOP);
         /*D3*/
-        nist_set_384(t_d,buf,0,0,0,0,0,0,0,23,23,0,0,0);
+        nist_set_384(t_d,buf.bn,0,0,0,0,0,0,0,23,23,0,0,0);
         carry -= (int)bn_sub_words(r_d, r_d, t_d, BN_NIST_384_TOP);
 
+        }
+#endif
         /* see BN_nist_mod_224 for explanation */
         u.f = bn_sub_words;
         if (carry > 0)
diff --git a/src/lib/libcrypto/bn/bn_print.c b/src/lib/libcrypto/bn/bn_print.c
index bebb466d08..1743b6a7e2 100644
--- a/src/lib/libcrypto/bn/bn_print.c
+++ b/src/lib/libcrypto/bn/bn_print.c
@@ -357,3 +357,22 @@ end:
         return(ret);
         }
 #endif
+
+char *BN_options(void)
+        {
+        static int init=0;
+        static char data[16];
+
+        if (!init)
+                {
+                init++;
+#ifdef BN_LLONG
+                BIO_snprintf(data,sizeof data,"bn(%d,%d)",
+                             (int)sizeof(BN_ULLONG)*8,(int)sizeof(BN_ULONG)*8);
+#else
+                BIO_snprintf(data,sizeof data,"bn(%d,%d)",
+                             (int)sizeof(BN_ULONG)*8,(int)sizeof(BN_ULONG)*8);
+#endif
+                }
+        return(data);
+        }
diff --git a/src/lib/libcrypto/bn/bn_shift.c b/src/lib/libcrypto/bn/bn_shift.c
index c4d301afc4..a6fca2c424 100644
--- a/src/lib/libcrypto/bn/bn_shift.c
+++ b/src/lib/libcrypto/bn/bn_shift.c
@@ -99,7 +99,7 @@ int BN_lshift1(BIGNUM *r, const BIGNUM *a)
 int BN_rshift1(BIGNUM *r, const BIGNUM *a)
         {
         BN_ULONG *ap,*rp,t,c;
-        int i;
+        int i,j;
 
         bn_check_top(r);
         bn_check_top(a);
@@ -109,22 +109,25 @@ int BN_rshift1(BIGNUM *r, const BIGNUM *a)
                 BN_zero(r);
                 return(1);
                 }
+        i = a->top;
+        ap= a->d;
+        j = i-(ap[i-1]==1);
         if (a != r)
                 {
-                if (bn_wexpand(r,a->top) == NULL) return(0);
-                r->top=a->top;
+                if (bn_wexpand(r,j) == NULL) return(0);
                 r->neg=a->neg;
                 }
-        ap=a->d;
         rp=r->d;
-        c=0;
-        for (i=a->top-1; i>=0; i--)
+        t=ap[--i];
+        c=(t&1)?BN_TBIT:0;
+        if (t>>=1) rp[i]=t;
+        while (i>0)
                 {
-                t=ap[i];
+                t=ap[--i];
                 rp[i]=((t>>1)&BN_MASK2)|c;
                 c=(t&1)?BN_TBIT:0;
                 }
-        bn_correct_top(r);
+        r->top=j;
         bn_check_top(r);
         return(1);
         }
@@ -182,10 +185,11 @@ int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
                 BN_zero(r);
                 return(1);
                 }
+        i = (BN_num_bits(a)-n+(BN_BITS2-1))/BN_BITS2;
         if (r != a)
                 {
                 r->neg=a->neg;
-                if (bn_wexpand(r,a->top-nw+1) == NULL) return(0);
+                if (bn_wexpand(r,i) == NULL) return(0);
                 }
         else
                 {
@@ -196,7 +200,7 @@ int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
         f= &(a->d[nw]);
         t=r->d;
         j=a->top-nw;
-        r->top=j;
+        r->top=i;
 
         if (rb == 0)
                 {
@@ -212,9 +216,8 @@ int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
                         l= *(f++);
                         *(t++) =(tmp|(l<<lb))&BN_MASK2;
                         }
-                *(t++) =(l>>rb)&BN_MASK2;
+                if ((l = (l>>rb)&BN_MASK2)) *(t) = l;
                 }
-        bn_correct_top(r);
         bn_check_top(r);
         return(1);
         }
diff --git a/src/lib/libcrypto/bn/bntest.c b/src/lib/libcrypto/bn/bntest.c
index 0cd99c5b4b..06f5954acc 100644
--- a/src/lib/libcrypto/bn/bntest.c
+++ b/src/lib/libcrypto/bn/bntest.c
@@ -262,7 +262,7 @@ int main(int argc, char *argv[])
         message(out,"BN_mod_sqrt");
         if (!test_sqrt(out,ctx)) goto err;
         (void)BIO_flush(out);
-
+#ifndef OPENSSL_NO_EC2M
         message(out,"BN_GF2m_add");
         if (!test_gf2m_add(out)) goto err;
         (void)BIO_flush(out);
@@ -298,7 +298,7 @@ int main(int argc, char *argv[])
         message(out,"BN_GF2m_mod_solve_quad");
         if (!test_gf2m_mod_solve_quad(out,ctx)) goto err;
         (void)BIO_flush(out);
-
+#endif
         BN_CTX_free(ctx);
         BIO_free(out);
 
@@ -1061,7 +1061,7 @@ int test_exp(BIO *bp, BN_CTX *ctx)
         BN_free(one);
         return(1);
         }
-
+#ifndef OPENSSL_NO_EC2M
 int test_gf2m_add(BIO *bp)
         {
         BIGNUM a,b,c;
@@ -1636,7 +1636,7 @@ int test_gf2m_mod_solve_quad(BIO *bp,BN_CTX *ctx)
         BN_free(e);
         return ret;
         }
-
+#endif
 static int genprime_cb(int p, int n, BN_GENCB *arg)
         {
         char c='*';
diff --git a/src/lib/libcrypto/buffer/buffer.c b/src/lib/libcrypto/buffer/buffer.c
index bc803ab6c8..d7aa79ad7f 100644
--- a/src/lib/libcrypto/buffer/buffer.c
+++ b/src/lib/libcrypto/buffer/buffer.c
@@ -156,7 +156,7 @@ int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
         /* This limit is sufficient to ensure (len+3)/3*4 < 2**31 */
         if (len > LIMIT_BEFORE_EXPANSION)
                 {
-                BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);
+                BUFerr(BUF_F_BUF_MEM_GROW_CLEAN,ERR_R_MALLOC_FAILURE);
                 return 0;
                 }
         n=(len+3)/3*4;
@@ -179,64 +179,6 @@ int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
         return(len);
         }
 
-char *BUF_strdup(const char *str)
-        {
-        if (str == NULL) return(NULL);
-        return BUF_strndup(str, strlen(str));
-        }
-
-char *BUF_strndup(const char *str, size_t siz)
-        {
-        char *ret;
-
-        if (str == NULL) return(NULL);
-
-        ret=OPENSSL_malloc(siz+1);
-        if (ret == NULL) 
-                {
-                BUFerr(BUF_F_BUF_STRNDUP,ERR_R_MALLOC_FAILURE);
-                return(NULL);
-                }
-        BUF_strlcpy(ret,str,siz+1);
-        return(ret);
-        }
-
-void *BUF_memdup(const void *data, size_t siz)
-        {
-        void *ret;
-
-        if (data == NULL) return(NULL);
-
-        ret=OPENSSL_malloc(siz);
-        if (ret == NULL) 
-                {
-                BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);
-                return(NULL);
-                }
-        return memcpy(ret, data, siz);
-        }       
-
-size_t BUF_strlcpy(char *dst, const char *src, size_t size)
-        {
-        size_t l = 0;
-        for(; size > 1 && *src; size--)
-                {
-                *dst++ = *src++;
-                l++;
-                }
-        if (size)
-                *dst = '\0';
-        return l + strlen(src);
-        }
-
-size_t BUF_strlcat(char *dst, const char *src, size_t size)
-        {
-        size_t l = 0;
-        for(; size > 0 && *dst; size--, dst++)
-                l++;
-        return l + BUF_strlcpy(dst, src, size);
-        }
-
 void BUF_reverse(unsigned char *out, unsigned char *in, size_t size)
         {
         size_t i;
diff --git a/src/lib/libcrypto/cast/c_skey.c b/src/lib/libcrypto/cast/c_skey.c
index 76e40005c9..cb6bf9fee3 100644
--- a/src/lib/libcrypto/cast/c_skey.c
+++ b/src/lib/libcrypto/cast/c_skey.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/crypto.h>
 #include <openssl/cast.h>
 #include "cast_lcl.h"
 #include "cast_s.h"
@@ -71,8 +72,14 @@
 #define S5 CAST_S_table5
 #define S6 CAST_S_table6
 #define S7 CAST_S_table7
-
 void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data)
+#ifdef OPENSSL_FIPS
+        {
+        fips_cipher_abort(CAST);
+        private_CAST_set_key(key, len, data);
+        }
+void private_CAST_set_key(CAST_KEY *key, int len, const unsigned char *data)
+#endif
         {
         CAST_LONG x[16];
         CAST_LONG z[16];
diff --git a/src/lib/libcrypto/cast/cast.h b/src/lib/libcrypto/cast/cast.h
index 1a264f8143..203922ea2b 100644
--- a/src/lib/libcrypto/cast/cast.h
+++ b/src/lib/libcrypto/cast/cast.h
@@ -83,7 +83,9 @@ typedef struct cast_key_st
         int short_key;  /* Use reduced rounds for short key */
         } CAST_KEY;
 
- 
+#ifdef OPENSSL_FIPS 
+void private_CAST_set_key(CAST_KEY *key, int len, const unsigned char *data);
+#endif
 void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data);
 void CAST_ecb_encrypt(const unsigned char *in, unsigned char *out, const CAST_KEY *key,
                       int enc);
diff --git a/src/lib/libcrypto/cms/cms_smime.c b/src/lib/libcrypto/cms/cms_smime.c
index 4a799eb897..8c56e3a852 100644
--- a/src/lib/libcrypto/cms/cms_smime.c
+++ b/src/lib/libcrypto/cms/cms_smime.c
@@ -611,7 +611,10 @@ int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert)
         STACK_OF(CMS_RecipientInfo) *ris;
         CMS_RecipientInfo *ri;
         int i, r;
+        int debug = 0;
         ris = CMS_get0_RecipientInfos(cms);
+        if (ris)
+                debug = cms->d.envelopedData->encryptedContentInfo->debug;
         for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++)
                 {
                 ri = sk_CMS_RecipientInfo_value(ris, i);
@@ -625,17 +628,38 @@ int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert)
                         CMS_RecipientInfo_set0_pkey(ri, pk);
                         r = CMS_RecipientInfo_decrypt(cms, ri);
                         CMS_RecipientInfo_set0_pkey(ri, NULL);
-                        if (r > 0)
-                                return 1;
                         if (cert)
                                 {
+                                /* If not debugging clear any error and
+                                 * return success to avoid leaking of
+                                 * information useful to MMA
+                                 */
+                                if (!debug)
+                                        {
+                                        ERR_clear_error();
+                                        return 1;
+                                        }
+                                if (r > 0)
+                                        return 1;
                                 CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY,
                                                 CMS_R_DECRYPT_ERROR);
                                 return 0;
                                 }
-                        ERR_clear_error();
+                        /* If no cert and not debugging don't leave loop
+                         * after first successful decrypt. Always attempt
+                         * to decrypt all recipients to avoid leaking timing
+                         * of a successful decrypt.
+                         */
+                        else if (r > 0 && debug)
+                                return 1;
                         }
                 }
+        /* If no cert and not debugging always return success */
+        if (!cert && !debug)
+                {
+                ERR_clear_error();
+                return 1;
+                }
 
         CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY, CMS_R_NO_MATCHING_RECIPIENT);
         return 0;
@@ -680,6 +704,30 @@ int CMS_decrypt_set1_key(CMS_ContentInfo *cms,
         return 0;
 
         }
+
+int CMS_decrypt_set1_password(CMS_ContentInfo *cms, 
+                                unsigned char *pass, ossl_ssize_t passlen)
+        {
+        STACK_OF(CMS_RecipientInfo) *ris;
+        CMS_RecipientInfo *ri;
+        int i, r;
+        ris = CMS_get0_RecipientInfos(cms);
+        for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++)
+                {
+                ri = sk_CMS_RecipientInfo_value(ris, i);
+                if (CMS_RecipientInfo_type(ri) != CMS_RECIPINFO_PASS)
+                                continue;
+                CMS_RecipientInfo_set0_password(ri, pass, passlen);
+                r = CMS_RecipientInfo_decrypt(cms, ri);
+                CMS_RecipientInfo_set0_password(ri, NULL, 0);
+                if (r > 0)
+                        return 1;
+                }
+
+        CMSerr(CMS_F_CMS_DECRYPT_SET1_PASSWORD, CMS_R_NO_MATCHING_RECIPIENT);
+        return 0;
+
+        }
         
 int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert,
                                 BIO *dcont, BIO *out,
@@ -694,9 +742,14 @@ int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert,
                 }
         if (!dcont && !check_content(cms))
                 return 0;
+        if (flags & CMS_DEBUG_DECRYPT)
+                cms->d.envelopedData->encryptedContentInfo->debug = 1;
+        else
+                cms->d.envelopedData->encryptedContentInfo->debug = 0;
+        if (!pk && !cert && !dcont && !out)
+                return 1;
         if (pk && !CMS_decrypt_set1_pkey(cms, pk, cert))
                 return 0;
-
         cont = CMS_dataInit(cms, dcont);
         if (!cont)
                 return 0;
diff --git a/src/lib/libcrypto/comp/c_rle.c b/src/lib/libcrypto/comp/c_rle.c
index 18bceae51e..47dfb67fbd 100644
--- a/src/lib/libcrypto/comp/c_rle.c
+++ b/src/lib/libcrypto/comp/c_rle.c
@@ -30,7 +30,7 @@ static int rle_compress_block(COMP_CTX *ctx, unsigned char *out,
         {
         /* int i; */
 
-        if (olen < (ilen+1))
+        if (ilen == 0 || olen < (ilen-1))
                 {
                 /* ZZZZZZZZZZZZZZZZZZZZZZ */
                 return(-1);
@@ -46,7 +46,7 @@ static int rle_expand_block(COMP_CTX *ctx, unsigned char *out,
         {
         int i;
 
-        if (ilen == 0 || olen < (ilen-1))
+        if (olen < (ilen-1))
                 {
                 /* ZZZZZZZZZZZZZZZZZZZZZZ */
                 return(-1);
diff --git a/src/lib/libcrypto/cpt_err.c b/src/lib/libcrypto/cpt_err.c
index 139b9284e4..289005f662 100644
--- a/src/lib/libcrypto/cpt_err.c
+++ b/src/lib/libcrypto/cpt_err.c
@@ -1,6 +1,6 @@
 /* crypto/cpt_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -76,6 +76,7 @@ static ERR_STRING_DATA CRYPTO_str_functs[]=
 {ERR_FUNC(CRYPTO_F_CRYPTO_SET_EX_DATA), "CRYPTO_set_ex_data"},
 {ERR_FUNC(CRYPTO_F_DEF_ADD_INDEX),      "DEF_ADD_INDEX"},
 {ERR_FUNC(CRYPTO_F_DEF_GET_CLASS),      "DEF_GET_CLASS"},
+{ERR_FUNC(CRYPTO_F_FIPS_MODE_SET),      "FIPS_mode_set"},
 {ERR_FUNC(CRYPTO_F_INT_DUP_EX_DATA),    "INT_DUP_EX_DATA"},
 {ERR_FUNC(CRYPTO_F_INT_FREE_EX_DATA),   "INT_FREE_EX_DATA"},
 {ERR_FUNC(CRYPTO_F_INT_NEW_EX_DATA),    "INT_NEW_EX_DATA"},
@@ -84,6 +85,7 @@ static ERR_STRING_DATA CRYPTO_str_functs[]=
 
 static ERR_STRING_DATA CRYPTO_str_reasons[]=
         {
+{ERR_REASON(CRYPTO_R_FIPS_MODE_NOT_SUPPORTED),"fips mode not supported"},
 {ERR_REASON(CRYPTO_R_NO_DYNLOCK_CREATE_CALLBACK),"no dynlock create callback"},
 {0,NULL}
         };
diff --git a/src/lib/libcrypto/cryptlib.c b/src/lib/libcrypto/cryptlib.c
index 24fe123e14..766ea8cac7 100644
--- a/src/lib/libcrypto/cryptlib.c
+++ b/src/lib/libcrypto/cryptlib.c
@@ -409,6 +409,10 @@ int (*CRYPTO_get_add_lock_callback(void))(int *num,int mount,int type,
 void CRYPTO_set_locking_callback(void (*func)(int mode,int type,
                                               const char *file,int line))
         {
+        /* Calling this here ensures initialisation before any threads
+         * are started.
+         */
+        OPENSSL_init();
         locking_callback=func;
         }
 
@@ -661,28 +665,52 @@ const char *CRYPTO_get_lock_name(int type)
         defined(__INTEL__) || \
         defined(__x86_64) || defined(__x86_64__) || defined(_M_AMD64) || defined(_M_X64)
 
-unsigned long  OPENSSL_ia32cap_P=0;
-unsigned long *OPENSSL_ia32cap_loc(void) { return &OPENSSL_ia32cap_P; }
+unsigned int  OPENSSL_ia32cap_P[2];
+unsigned long *OPENSSL_ia32cap_loc(void)
+{   if (sizeof(long)==4)
+        /*
+         * If 32-bit application pulls address of OPENSSL_ia32cap_P[0]
+         * clear second element to maintain the illusion that vector
+         * is 32-bit.
+         */
+        OPENSSL_ia32cap_P[1]=0;
+    return (unsigned long *)OPENSSL_ia32cap_P;
+}
 
 #if defined(OPENSSL_CPUID_OBJ) && !defined(OPENSSL_NO_ASM) && !defined(I386_ONLY)
 #define OPENSSL_CPUID_SETUP
+#if defined(_WIN32)
+typedef unsigned __int64 IA32CAP;
+#else
+typedef unsigned long long IA32CAP;
+#endif
 void OPENSSL_cpuid_setup(void)
 { static int trigger=0;
-  unsigned long OPENSSL_ia32_cpuid(void);
+  IA32CAP OPENSSL_ia32_cpuid(void);
+  IA32CAP vec;
   char *env;
 
     if (trigger)        return;
 
     trigger=1;
-    if ((env=getenv("OPENSSL_ia32cap")))
-        OPENSSL_ia32cap_P = strtoul(env,NULL,0)|(1<<10);
+    if ((env=getenv("OPENSSL_ia32cap"))) {
+        int off = (env[0]=='~')?1:0;
+#if defined(_WIN32)
+        if (!sscanf(env+off,"%I64i",&vec)) vec = strtoul(env+off,NULL,0);
+#else
+        if (!sscanf(env+off,"%lli",(long long *)&vec)) vec = strtoul(env+off,NULL,0);
+#endif
+        if (off) vec = OPENSSL_ia32_cpuid()&~vec;
+    }
     else
-        OPENSSL_ia32cap_P = OPENSSL_ia32_cpuid()|(1<<10);
+        vec = OPENSSL_ia32_cpuid();
     /*
      * |(1<<10) sets a reserved bit to signal that variable
      * was initialized already... This is to avoid interference
      * with cpuid snippets in ELF .init segment.
      */
+    OPENSSL_ia32cap_P[0] = (unsigned int)vec|(1<<10);
+    OPENSSL_ia32cap_P[1] = (unsigned int)(vec>>32);
 }
 #endif
 
diff --git a/src/lib/libcrypto/cryptlib.h b/src/lib/libcrypto/cryptlib.h
index fc249c57f3..1761f6b668 100644
--- a/src/lib/libcrypto/cryptlib.h
+++ b/src/lib/libcrypto/cryptlib.h
@@ -99,7 +99,7 @@ extern "C" {
 #define HEX_SIZE(type)          (sizeof(type)*2)
 
 void OPENSSL_cpuid_setup(void);
-extern unsigned long OPENSSL_ia32cap_P;
+extern unsigned int OPENSSL_ia32cap_P[];
 void OPENSSL_showfatal(const char *,...);
 void *OPENSSL_stderr(void);
 extern int OPENSSL_NONPIC_relocated;
diff --git a/src/lib/libcrypto/crypto-lib.com b/src/lib/libcrypto/crypto-lib.com
index a29c0afd93..c280aa03a8 100644
--- a/src/lib/libcrypto/crypto-lib.com
+++ b/src/lib/libcrypto/crypto-lib.com
@@ -117,7 +117,7 @@ $ ENCRYPT_TYPES = "Basic,"+ -
                   "BUFFER,BIO,STACK,LHASH,RAND,ERR,"+ -
                   "EVP,EVP_2,EVP_3,ASN1,ASN1_2,PEM,X509,X509V3,"+ -
                   "CONF,TXT_DB,PKCS7,PKCS12,COMP,OCSP,UI,KRB5,"+ -
-                  "STORE,CMS,PQUEUE,TS,JPAKE"
+                  "CMS,PQUEUE,TS,JPAKE,SRP,STORE,CMAC"
 $!
 $! Check To Make Sure We Have Valid Command Line Parameters.
 $!
@@ -207,7 +207,8 @@ $!
 $ APPS_DES = "DES/DES,CBC3_ENC"
 $ APPS_PKCS7 = "ENC/ENC;DEC/DEC;SIGN/SIGN;VERIFY/VERIFY,EXAMPLE"
 $
-$ LIB_ = "cryptlib,mem,mem_clr,mem_dbg,cversion,ex_data,cpt_err,ebcdic,uid,o_time,o_str,o_dir"
+$ LIB_ = "cryptlib,mem,mem_clr,mem_dbg,cversion,ex_data,cpt_err,"+ -
+        "ebcdic,uid,o_time,o_str,o_dir,o_fips.c,o_init,fips_ers"
 $ LIB_MD2 = "md2_dgst,md2_one"
 $ LIB_MD4 = "md4_dgst,md4_one"
 $ LIB_MD5 = "md5_dgst,md5_one"
@@ -224,15 +225,16 @@ $ LIB_DES = "set_key,ecb_enc,cbc_enc,"+ -
         "fcrypt,xcbc_enc,rpc_enc,cbc_cksm,"+ -
         "ede_cbcm_enc,des_old,des_old2,read2pwd"
 $ LIB_RC2 = "rc2_ecb,rc2_skey,rc2_cbc,rc2cfb64,rc2ofb64"
-$ LIB_RC4 = "rc4_skey,rc4_enc"
+$ LIB_RC4 = "rc4_skey,rc4_enc,rc4_utl"
 $ LIB_RC5 = "rc5_skey,rc5_ecb,rc5_enc,rc5cfb64,rc5ofb64"
 $ LIB_IDEA = "i_cbc,i_cfb64,i_ofb64,i_ecb,i_skey"
 $ LIB_BF = "bf_skey,bf_ecb,bf_enc,bf_cfb64,bf_ofb64"
 $ LIB_CAST = "c_skey,c_ecb,c_enc,c_cfb64,c_ofb64"
 $ LIB_CAMELLIA = "camellia,cmll_misc,cmll_ecb,cmll_cbc,cmll_ofb,"+ -
-        "cmll_cfb,cmll_ctr"
+        "cmll_cfb,cmll_ctr,cmll_utl"
 $ LIB_SEED = "seed,seed_ecb,seed_cbc,seed_cfb,seed_ofb"
-$ LIB_MODES = "cbc128,ctr128,cts128,cfb128,ofb128"
+$ LIB_MODES = "cbc128,ctr128,cts128,cfb128,ofb128,gcm128,"+ -
+        "ccm128,xts128"
 $ LIB_BN_ASM = "[.asm]vms.mar,vms-helper"
 $ IF F$TRNLNM("OPENSSL_NO_ASM") .OR. ARCH .NES. "VAX" THEN -
      LIB_BN_ASM = "bn_asm"
@@ -240,14 +242,16 @@ $ LIB_BN = "bn_add,bn_div,bn_exp,bn_lib,bn_ctx,bn_mul,bn_mod,"+ -
         "bn_print,bn_rand,bn_shift,bn_word,bn_blind,"+ -
         "bn_kron,bn_sqrt,bn_gcd,bn_prime,bn_err,bn_sqr,"+LIB_BN_ASM+","+ -
         "bn_recp,bn_mont,bn_mpi,bn_exp2,bn_gf2m,bn_nist,"+ -
-        "bn_depr,bn_const"
+        "bn_depr,bn_const,bn_x931p"
 $ LIB_EC = "ec_lib,ecp_smpl,ecp_mont,ecp_nist,ec_cvt,ec_mult,"+ -
         "ec_err,ec_curve,ec_check,ec_print,ec_asn1,ec_key,"+ -
-        "ec2_smpl,ec2_mult,ec_ameth,ec_pmeth,eck_prn"
+        "ec2_smpl,ec2_mult,ec_ameth,ec_pmeth,eck_prn,"+ -
+        "ecp_nistp224,ecp_nistp256,ecp_nistp521,ecp_nistputil,"+ -
+        "ecp_oct,ec2_oct,ec_oct"
 $ LIB_RSA = "rsa_eay,rsa_gen,rsa_lib,rsa_sign,rsa_saos,rsa_err,"+ -
         "rsa_pk1,rsa_ssl,rsa_none,rsa_oaep,rsa_chk,rsa_null,"+ -
         "rsa_pss,rsa_x931,rsa_asn1,rsa_depr,rsa_ameth,rsa_prn,"+ -
-        "rsa_pmeth"
+        "rsa_pmeth,rsa_crpt"
 $ LIB_DSA = "dsa_gen,dsa_key,dsa_lib,dsa_asn1,dsa_vrf,dsa_sign,"+ -
         "dsa_err,dsa_ossl,dsa_depr,dsa_ameth,dsa_pmeth,dsa_prn"
 $ LIB_ECDSA = "ecs_lib,ecs_asn1,ecs_ossl,ecs_sign,ecs_vrf,ecs_err"
@@ -260,10 +264,11 @@ $ LIB_ENGINE = "eng_err,eng_lib,eng_list,eng_init,eng_ctrl,"+ -
         "eng_table,eng_pkey,eng_fat,eng_all,"+ -
         "tb_rsa,tb_dsa,tb_ecdsa,tb_dh,tb_ecdh,tb_rand,tb_store,"+ -
         "tb_cipher,tb_digest,tb_pkmeth,tb_asnmth,"+ -
-        "eng_openssl,eng_dyn,eng_cnf,eng_cryptodev"
+        "eng_openssl,eng_dyn,eng_cnf,eng_cryptodev,"+ -
+        "eng_rsax,eng_rdrand"
 $ LIB_AES = "aes_core,aes_misc,aes_ecb,aes_cbc,aes_cfb,aes_ofb,aes_ctr,"+ -
         "aes_ige,aes_wrap"
-$ LIB_BUFFER = "buffer,buf_err"
+$ LIB_BUFFER = "buffer,buf_str,buf_err"
 $ LIB_BIO = "bio_lib,bio_cb,bio_err,"+ -
         "bss_mem,bss_null,bss_fd,"+ -
         "bss_file,bss_sock,bss_conn,"+ -
@@ -287,7 +292,8 @@ $ LIB_EVP_2 = "m_null,m_md2,m_md4,m_md5,m_sha,m_sha1,m_wp," + -
         "bio_md,bio_b64,bio_enc,evp_err,e_null,"+ -
         "c_all,c_allc,c_alld,evp_lib,bio_ok,"+-
         "evp_pkey,evp_pbe,p5_crpt,p5_crpt2"
-$ LIB_EVP_3 = "e_old,pmeth_lib,pmeth_fn,pmeth_gn,m_sigver"
+$ LIB_EVP_3 = "e_old,pmeth_lib,pmeth_fn,pmeth_gn,m_sigver,evp_fips,"+ -
+        "e_aes_cbc_hmac_sha1,e_rc4_hmac_md5"
 $ LIB_ASN1 = "a_object,a_bitstr,a_utctm,a_gentm,a_time,a_int,a_octet,"+ -
         "a_print,a_type,a_set,a_dup,a_d2i_fp,a_i2d_fp,"+ -
         "a_enum,a_utf8,a_sign,a_digest,a_verify,a_mbstr,a_strex,"+ -
@@ -329,14 +335,17 @@ $ LIB_OCSP = "ocsp_asn,ocsp_ext,ocsp_ht,ocsp_lib,ocsp_cl,"+ -
 $ LIB_UI_COMPAT = ",ui_compat"
 $ LIB_UI = "ui_err,ui_lib,ui_openssl,ui_util"+LIB_UI_COMPAT
 $ LIB_KRB5 = "krb5_asn"
-$ LIB_STORE = "str_err,str_lib,str_meth,str_mem"
 $ LIB_CMS = "cms_lib,cms_asn1,cms_att,cms_io,cms_smime,cms_err,"+ -
-        "cms_sd,cms_dd,cms_cd,cms_env,cms_enc,cms_ess"
+        "cms_sd,cms_dd,cms_cd,cms_env,cms_enc,cms_ess,"+ -
+        "cms_pwri"
 $ LIB_PQUEUE = "pqueue"
 $ LIB_TS = "ts_err,ts_req_utils,ts_req_print,ts_rsp_utils,ts_rsp_print,"+ -
         "ts_rsp_sign,ts_rsp_verify,ts_verify_ctx,ts_lib,ts_conf,"+ -
         "ts_asn1"
 $ LIB_JPAKE = "jpake,jpake_err"
+$ LIB_SRP = "srp_lib,srp_vfy"
+$ LIB_STORE = "str_err,str_lib,str_meth,str_mem"
+$ LIB_CMAC = "cmac,cm_ameth.c,cm_pmeth"
 $!
 $! Setup exceptional compilations
 $!
@@ -1021,7 +1030,7 @@ $!
 $! Set basic C compiler /INCLUDE directories.
 $!
 $ CC_INCLUDES = "SYS$DISK:[.''ARCHD'],SYS$DISK:[],SYS$DISK:[-],"+ -
-   "SYS$DISK:[.ENGINE.VENDOR_DEFNS],SYS$DISK:[.EVP],SYS$DISK:[.ASN1]"
+   "SYS$DISK:[.ENGINE.VENDOR_DEFNS],SYS$DISK:[.MODES],SYS$DISK:[.ASN1],SYS$DISK:[.EVP]"
 $!
 $! Check To See If P3 Is Blank.
 $!
diff --git a/src/lib/libcrypto/crypto.h b/src/lib/libcrypto/crypto.h
index b0360cec51..6aeda0a9ac 100644
--- a/src/lib/libcrypto/crypto.h
+++ b/src/lib/libcrypto/crypto.h
@@ -547,6 +547,33 @@ unsigned long *OPENSSL_ia32cap_loc(void);
 #define OPENSSL_ia32cap (*(OPENSSL_ia32cap_loc()))
 int OPENSSL_isservice(void);
 
+int FIPS_mode(void);
+int FIPS_mode_set(int r);
+
+void OPENSSL_init(void);
+
+#define fips_md_init(alg) fips_md_init_ctx(alg, alg)
+
+#ifdef OPENSSL_FIPS
+#define fips_md_init_ctx(alg, cx) \
+        int alg##_Init(cx##_CTX *c) \
+        { \
+        if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \
+                "Low level API call to digest " #alg " forbidden in FIPS mode!"); \
+        return private_##alg##_Init(c); \
+        } \
+        int private_##alg##_Init(cx##_CTX *c)
+
+#define fips_cipher_abort(alg) \
+        if (FIPS_mode()) OpenSSLDie(__FILE__, __LINE__, \
+                "Low level API call to cipher " #alg " forbidden in FIPS mode!")
+
+#else
+#define fips_md_init_ctx(alg, cx) \
+        int alg##_Init(cx##_CTX *c)
+#define fips_cipher_abort(alg) while(0)
+#endif
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -562,11 +589,13 @@ void ERR_load_CRYPTO_strings(void);
 #define CRYPTO_F_CRYPTO_SET_EX_DATA                      102
 #define CRYPTO_F_DEF_ADD_INDEX                           104
 #define CRYPTO_F_DEF_GET_CLASS                           105
+#define CRYPTO_F_FIPS_MODE_SET                           109
 #define CRYPTO_F_INT_DUP_EX_DATA                         106
 #define CRYPTO_F_INT_FREE_EX_DATA                        107
 #define CRYPTO_F_INT_NEW_EX_DATA                         108
 
 /* Reason codes. */
+#define CRYPTO_R_FIPS_MODE_NOT_SUPPORTED                 101
 #define CRYPTO_R_NO_DYNLOCK_CREATE_CALLBACK              100
 
 #ifdef  __cplusplus
diff --git a/src/lib/libcrypto/des/des.h b/src/lib/libcrypto/des/des.h
index 7318593699..23c8cfc901 100644
--- a/src/lib/libcrypto/des/des.h
+++ b/src/lib/libcrypto/des/des.h
@@ -226,6 +226,9 @@ int DES_set_key(const_DES_cblock *key,DES_key_schedule *schedule);
 int DES_key_sched(const_DES_cblock *key,DES_key_schedule *schedule);
 int DES_set_key_checked(const_DES_cblock *key,DES_key_schedule *schedule);
 void DES_set_key_unchecked(const_DES_cblock *key,DES_key_schedule *schedule);
+#ifdef OPENSSL_FIPS
+void private_DES_set_key_unchecked(const_DES_cblock *key,DES_key_schedule *schedule);
+#endif
 void DES_string_to_key(const char *str,DES_cblock *key);
 void DES_string_to_2keys(const char *str,DES_cblock *key1,DES_cblock *key2);
 void DES_cfb64_encrypt(const unsigned char *in,unsigned char *out,long length,
diff --git a/src/lib/libcrypto/des/set_key.c b/src/lib/libcrypto/des/set_key.c
index 3004cc3ab3..d3e69ca8b5 100644
--- a/src/lib/libcrypto/des/set_key.c
+++ b/src/lib/libcrypto/des/set_key.c
@@ -65,6 +65,8 @@
  */
 #include "des_locl.h"
 
+#include <openssl/crypto.h>
+
 OPENSSL_IMPLEMENT_GLOBAL(int,DES_check_key,0)   /* defaults to false */
 
 static const unsigned char odd_parity[256]={
@@ -335,6 +337,13 @@ int DES_set_key_checked(const_DES_cblock *key, DES_key_schedule *schedule)
         }
 
 void DES_set_key_unchecked(const_DES_cblock *key, DES_key_schedule *schedule)
+#ifdef OPENSSL_FIPS
+        {
+        fips_cipher_abort(DES);
+        private_DES_set_key_unchecked(key, schedule);
+        }
+void private_DES_set_key_unchecked(const_DES_cblock *key, DES_key_schedule *schedule)
+#endif
         {
         static const int shifts2[16]={0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0};
         register DES_LONG c,d,t,s,t2;
diff --git a/src/lib/libcrypto/dh/dh.h b/src/lib/libcrypto/dh/dh.h
index 849309a489..ea59e610ef 100644
--- a/src/lib/libcrypto/dh/dh.h
+++ b/src/lib/libcrypto/dh/dh.h
@@ -86,6 +86,21 @@
                                        * be used for all exponents.
                                        */
 
+/* If this flag is set the DH method is FIPS compliant and can be used
+ * in FIPS mode. This is set in the validated module method. If an
+ * application sets this flag in its own methods it is its reposibility
+ * to ensure the result is compliant.
+ */
+
+#define DH_FLAG_FIPS_METHOD                     0x0400
+
+/* If this flag is set the operations normally disabled in FIPS mode are
+ * permitted it is then the applications responsibility to ensure that the
+ * usage is compliant.
+ */
+
+#define DH_FLAG_NON_FIPS_ALLOW                  0x0400
+
 #ifdef  __cplusplus
 extern "C" {
 #endif
@@ -230,6 +245,9 @@ void ERR_load_DH_strings(void);
 #define DH_F_COMPUTE_KEY                                 102
 #define DH_F_DHPARAMS_PRINT_FP                           101
 #define DH_F_DH_BUILTIN_GENPARAMS                        106
+#define DH_F_DH_COMPUTE_KEY                              114
+#define DH_F_DH_GENERATE_KEY                             115
+#define DH_F_DH_GENERATE_PARAMETERS_EX                   116
 #define DH_F_DH_NEW_METHOD                               105
 #define DH_F_DH_PARAM_DECODE                             107
 #define DH_F_DH_PRIV_DECODE                              110
@@ -249,7 +267,9 @@ void ERR_load_DH_strings(void);
 #define DH_R_DECODE_ERROR                                104
 #define DH_R_INVALID_PUBKEY                              102
 #define DH_R_KEYS_NOT_SET                                108
+#define DH_R_KEY_SIZE_TOO_SMALL                          110
 #define DH_R_MODULUS_TOO_LARGE                           103
+#define DH_R_NON_FIPS_METHOD                             111
 #define DH_R_NO_PARAMETERS_SET                           107
 #define DH_R_NO_PRIVATE_VALUE                            100
 #define DH_R_PARAMETER_ENCODING_ERROR                    105
diff --git a/src/lib/libcrypto/dh/dh_err.c b/src/lib/libcrypto/dh/dh_err.c
index d5cf0c22a3..56d3df7356 100644
--- a/src/lib/libcrypto/dh/dh_err.c
+++ b/src/lib/libcrypto/dh/dh_err.c
@@ -1,6 +1,6 @@
 /* crypto/dh/dh_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -73,6 +73,9 @@ static ERR_STRING_DATA DH_str_functs[]=
 {ERR_FUNC(DH_F_COMPUTE_KEY),    "COMPUTE_KEY"},
 {ERR_FUNC(DH_F_DHPARAMS_PRINT_FP),      "DHparams_print_fp"},
 {ERR_FUNC(DH_F_DH_BUILTIN_GENPARAMS),   "DH_BUILTIN_GENPARAMS"},
+{ERR_FUNC(DH_F_DH_COMPUTE_KEY), "DH_compute_key"},
+{ERR_FUNC(DH_F_DH_GENERATE_KEY),        "DH_generate_key"},
+{ERR_FUNC(DH_F_DH_GENERATE_PARAMETERS_EX),      "DH_generate_parameters_ex"},
 {ERR_FUNC(DH_F_DH_NEW_METHOD),  "DH_new_method"},
 {ERR_FUNC(DH_F_DH_PARAM_DECODE),        "DH_PARAM_DECODE"},
 {ERR_FUNC(DH_F_DH_PRIV_DECODE), "DH_PRIV_DECODE"},
@@ -95,7 +98,9 @@ static ERR_STRING_DATA DH_str_reasons[]=
 {ERR_REASON(DH_R_DECODE_ERROR)           ,"decode error"},
 {ERR_REASON(DH_R_INVALID_PUBKEY)         ,"invalid public key"},
 {ERR_REASON(DH_R_KEYS_NOT_SET)           ,"keys not set"},
+{ERR_REASON(DH_R_KEY_SIZE_TOO_SMALL)     ,"key size too small"},
 {ERR_REASON(DH_R_MODULUS_TOO_LARGE)      ,"modulus too large"},
+{ERR_REASON(DH_R_NON_FIPS_METHOD)        ,"non fips method"},
 {ERR_REASON(DH_R_NO_PARAMETERS_SET)      ,"no parameters set"},
 {ERR_REASON(DH_R_NO_PRIVATE_VALUE)       ,"no private value"},
 {ERR_REASON(DH_R_PARAMETER_ENCODING_ERROR),"parameter encoding error"},
diff --git a/src/lib/libcrypto/dh/dh_gen.c b/src/lib/libcrypto/dh/dh_gen.c
index cfd5b11868..7b1fe9c9cb 100644
--- a/src/lib/libcrypto/dh/dh_gen.c
+++ b/src/lib/libcrypto/dh/dh_gen.c
@@ -66,12 +66,29 @@
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb);
 
 int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb)
         {
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !(ret->meth->flags & DH_FLAG_FIPS_METHOD)
+                        && !(ret->flags & DH_FLAG_NON_FIPS_ALLOW))
+                {
+                DHerr(DH_F_DH_GENERATE_PARAMETERS_EX, DH_R_NON_FIPS_METHOD);
+                return 0;
+                }
+#endif
         if(ret->meth->generate_params)
                 return ret->meth->generate_params(ret, prime_len, generator, cb);
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode())
+                return FIPS_dh_generate_parameters_ex(ret, prime_len,
+                                                        generator, cb);
+#endif
         return dh_builtin_genparams(ret, prime_len, generator, cb);
         }
 
diff --git a/src/lib/libcrypto/dh/dh_key.c b/src/lib/libcrypto/dh/dh_key.c
index e7db440342..89a74db4e6 100644
--- a/src/lib/libcrypto/dh/dh_key.c
+++ b/src/lib/libcrypto/dh/dh_key.c
@@ -73,11 +73,27 @@ static int dh_finish(DH *dh);
 
 int DH_generate_key(DH *dh)
         {
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !(dh->meth->flags & DH_FLAG_FIPS_METHOD)
+                        && !(dh->flags & DH_FLAG_NON_FIPS_ALLOW))
+                {
+                DHerr(DH_F_DH_GENERATE_KEY, DH_R_NON_FIPS_METHOD);
+                return 0;
+                }
+#endif
         return dh->meth->generate_key(dh);
         }
 
 int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
         {
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !(dh->meth->flags & DH_FLAG_FIPS_METHOD)
+                        && !(dh->flags & DH_FLAG_NON_FIPS_ALLOW))
+                {
+                DHerr(DH_F_DH_COMPUTE_KEY, DH_R_NON_FIPS_METHOD);
+                return 0;
+                }
+#endif
         return dh->meth->compute_key(key, pub_key, dh);
         }
 
@@ -138,8 +154,21 @@ static int generate_key(DH *dh)
 
         if (generate_new_key)
                 {
-                l = dh->length ? dh->length : BN_num_bits(dh->p)-1; /* secret exponent length */
-                if (!BN_rand(priv_key, l, 0, 0)) goto err;
+                if (dh->q)
+                        {
+                        do
+                                {
+                                if (!BN_rand_range(priv_key, dh->q))
+                                        goto err;
+                                }
+                        while (BN_is_zero(priv_key) || BN_is_one(priv_key));
+                        }
+                else
+                        {
+                        /* secret exponent length */
+                        l = dh->length ? dh->length : BN_num_bits(dh->p)-1;
+                        if (!BN_rand(priv_key, l, 0, 0)) goto err;
+                        }
                 }
 
         {
diff --git a/src/lib/libcrypto/dh/dh_lib.c b/src/lib/libcrypto/dh/dh_lib.c
index 7aef080e7a..00218f2b92 100644
--- a/src/lib/libcrypto/dh/dh_lib.c
+++ b/src/lib/libcrypto/dh/dh_lib.c
@@ -64,6 +64,10 @@
 #include <openssl/engine.h>
 #endif
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 const char DH_version[]="Diffie-Hellman" OPENSSL_VERSION_PTEXT;
 
 static const DH_METHOD *default_DH_method = NULL;
@@ -76,7 +80,16 @@ void DH_set_default_method(const DH_METHOD *meth)
 const DH_METHOD *DH_get_default_method(void)
         {
         if(!default_DH_method)
+                {
+#ifdef OPENSSL_FIPS
+                if (FIPS_mode())
+                        return FIPS_dh_openssl();
+                else
+                        return DH_OpenSSL();
+#else
                 default_DH_method = DH_OpenSSL();
+#endif
+                }
         return default_DH_method;
         }
 
@@ -156,7 +169,7 @@ DH *DH_new_method(ENGINE *engine)
         ret->counter = NULL;
         ret->method_mont_p=NULL;
         ret->references = 1;
-        ret->flags=ret->meth->flags;
+        ret->flags=ret->meth->flags & ~DH_FLAG_NON_FIPS_ALLOW;
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_DH, ret, &ret->ex_data);
         if ((ret->meth->init != NULL) && !ret->meth->init(ret))
                 {
diff --git a/src/lib/libcrypto/doc/EVP_DigestInit.pod b/src/lib/libcrypto/doc/EVP_DigestInit.pod
index 37a751b1c5..1aa15acb61 100644
--- a/src/lib/libcrypto/doc/EVP_DigestInit.pod
+++ b/src/lib/libcrypto/doc/EVP_DigestInit.pod
@@ -6,7 +6,8 @@ EVP_MD_CTX_init, EVP_MD_CTX_create, EVP_DigestInit_ex, EVP_DigestUpdate,
 EVP_DigestFinal_ex, EVP_MD_CTX_cleanup, EVP_MD_CTX_destroy, EVP_MAX_MD_SIZE,
 EVP_MD_CTX_copy_ex, EVP_MD_CTX_copy, EVP_MD_type, EVP_MD_pkey_type, EVP_MD_size,
 EVP_MD_block_size, EVP_MD_CTX_md, EVP_MD_CTX_size, EVP_MD_CTX_block_size, EVP_MD_CTX_type,
-EVP_md_null, EVP_md2, EVP_md5, EVP_sha, EVP_sha1, EVP_dss, EVP_dss1, EVP_mdc2,
+EVP_md_null, EVP_md2, EVP_md5, EVP_sha, EVP_sha1, EVP_sha224, EVP_sha256,
+EVP_sha384, EVP_sha512, EVP_dss, EVP_dss1, EVP_mdc2,
 EVP_ripemd160, EVP_get_digestbyname, EVP_get_digestbynid, EVP_get_digestbyobj -
 EVP digest routines
 
@@ -33,16 +34,15 @@ EVP digest routines
 
  int EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in);  
 
- #define EVP_MAX_MD_SIZE (16+20) /* The SSLv3 md5+sha1 type */
+ #define EVP_MAX_MD_SIZE 64     /* SHA512 */
 
+ int EVP_MD_type(const EVP_MD *md);
+ int EVP_MD_pkey_type(const EVP_MD *md);        
+ int EVP_MD_size(const EVP_MD *md);
+ int EVP_MD_block_size(const EVP_MD *md);
 
- #define EVP_MD_type(e)                 ((e)->type)
- #define EVP_MD_pkey_type(e)            ((e)->pkey_type)
- #define EVP_MD_size(e)                 ((e)->md_size)
- #define EVP_MD_block_size(e)           ((e)->block_size)
-
- #define EVP_MD_CTX_md(e)               (e)->digest)
- #define EVP_MD_CTX_size(e)             EVP_MD_size((e)->digest)
+ const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx);
+ #define EVP_MD_CTX_size(e)             EVP_MD_size(EVP_MD_CTX_md(e))
  #define EVP_MD_CTX_block_size(e)       EVP_MD_block_size((e)->digest)
  #define EVP_MD_CTX_type(e)             EVP_MD_type((e)->digest)
 
@@ -56,6 +56,11 @@ EVP digest routines
  const EVP_MD *EVP_mdc2(void);
  const EVP_MD *EVP_ripemd160(void);
 
+ const EVP_MD *EVP_sha224(void);
+ const EVP_MD *EVP_sha256(void);
+ const EVP_MD *EVP_sha384(void);
+ const EVP_MD *EVP_sha512(void);
+
  const EVP_MD *EVP_get_digestbyname(const char *name);
  #define EVP_get_digestbynid(a) EVP_get_digestbyname(OBJ_nid2sn(a))
  #define EVP_get_digestbyobj(a) EVP_get_digestbynid(OBJ_obj2nid(a))
@@ -124,12 +129,14 @@ B<EVP_MD_CTX>.
 
 EVP_MD_pkey_type() returns the NID of the public key signing algorithm associated
 with this digest. For example EVP_sha1() is associated with RSA so this will
-return B<NID_sha1WithRSAEncryption>. This "link" between digests and signature
-algorithms may not be retained in future versions of OpenSSL.
+return B<NID_sha1WithRSAEncryption>. Since digests and signature algorithms
+are no longer linked this function is only retained for compatibility
+reasons.
 
-EVP_md2(), EVP_md5(), EVP_sha(), EVP_sha1(), EVP_mdc2() and EVP_ripemd160()
-return B<EVP_MD> structures for the MD2, MD5, SHA, SHA1, MDC2 and RIPEMD160 digest
-algorithms respectively. The associated signature algorithm is RSA in each case.
+EVP_md2(), EVP_md5(), EVP_sha(), EVP_sha1(), EVP_sha224(), EVP_sha256(),
+EVP_sha384(), EVP_sha512(), EVP_mdc2() and EVP_ripemd160() return B<EVP_MD>
+structures for the MD2, MD5, SHA, SHA1, SHA224, SHA256, SHA384, SHA512, MDC2
+and RIPEMD160 digest algorithms respectively. 
 
 EVP_dss() and EVP_dss1() return B<EVP_MD> structures for SHA and SHA1 digest
 algorithms but using DSS (DSA) for the signature algorithm. Note: there is 
@@ -171,8 +178,8 @@ The B<EVP> interface to message digests should almost always be used in
 preference to the low level interfaces. This is because the code then becomes
 transparent to the digest used and much more flexible.
 
-SHA1 is the digest of choice for new applications. The other digest algorithms
-are still in common use.
+New applications should use the SHA2 digest algorithms such as SHA256. 
+The other digest algorithms are still in common use.
 
 For most applications the B<impl> parameter to EVP_DigestInit_ex() will be
 set to NULL to use the default digest implementation.
@@ -187,6 +194,19 @@ implementations of digests to be specified.
 In OpenSSL 0.9.7 and later if digest contexts are not cleaned up after use
 memory leaks will occur. 
 
+Stack allocation of EVP_MD_CTX structures is common, for example:
+
+ EVP_MD_CTX mctx;
+ EVP_MD_CTX_init(&mctx);
+
+This will cause binary compatibility issues if the size of EVP_MD_CTX
+structure changes (this will only happen with a major release of OpenSSL).
+Applications wishing to avoid this should use EVP_MD_CTX_create() instead:
+
+ EVP_MD_CTX *mctx;
+ mctx = EVP_MD_CTX_create();
+
+
 =head1 EXAMPLE
 
 This example digests the data "Test Message\n" and "Hello World\n", using the
@@ -197,7 +217,7 @@ digest name passed on the command line.
 
  main(int argc, char *argv[])
  {
- EVP_MD_CTX mdctx;
+ EVP_MD_CTX *mdctx;
  const EVP_MD *md;
  char mess1[] = "Test Message\n";
  char mess2[] = "Hello World\n";
@@ -218,12 +238,12 @@ digest name passed on the command line.
         exit(1);
  }
 
- EVP_MD_CTX_init(&mdctx);
- EVP_DigestInit_ex(&mdctx, md, NULL);
- EVP_DigestUpdate(&mdctx, mess1, strlen(mess1));
- EVP_DigestUpdate(&mdctx, mess2, strlen(mess2));
- EVP_DigestFinal_ex(&mdctx, md_value, &md_len);
- EVP_MD_CTX_cleanup(&mdctx);
+ mdctx = EVP_MD_CTX_create();
+ EVP_DigestInit_ex(mdctx, md, NULL);
+ EVP_DigestUpdate(mdctx, mess1, strlen(mess1));
+ EVP_DigestUpdate(mdctx, mess2, strlen(mess2));
+ EVP_DigestFinal_ex(mdctx, md_value, &md_len);
+ EVP_MD_CTX_destroy(mdctx);
 
  printf("Digest is: ");
  for(i = 0; i < md_len; i++) printf("%02x", md_value[i]);
diff --git a/src/lib/libcrypto/dsa/Makefile b/src/lib/libcrypto/dsa/Makefile
index 8073c4ecfe..5fef4ca5ad 100644
--- a/src/lib/libcrypto/dsa/Makefile
+++ b/src/lib/libcrypto/dsa/Makefile
@@ -99,8 +99,9 @@ dsa_asn1.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
 dsa_asn1.o: ../../include/openssl/err.h ../../include/openssl/lhash.h
 dsa_asn1.o: ../../include/openssl/opensslconf.h
 dsa_asn1.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
-dsa_asn1.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
-dsa_asn1.o: ../../include/openssl/symhacks.h ../cryptlib.h dsa_asn1.c
+dsa_asn1.o: ../../include/openssl/rand.h ../../include/openssl/safestack.h
+dsa_asn1.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+dsa_asn1.o: ../cryptlib.h dsa_asn1.c
 dsa_depr.o: ../../e_os.h ../../include/openssl/asn1.h
 dsa_depr.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 dsa_depr.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
@@ -189,7 +190,7 @@ dsa_prn.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 dsa_prn.o: ../../include/openssl/ossl_typ.h ../../include/openssl/safestack.h
 dsa_prn.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
 dsa_prn.o: ../cryptlib.h dsa_prn.c
-dsa_sign.o: ../../e_os.h ../../include/openssl/bio.h
+dsa_sign.o: ../../e_os.h ../../include/openssl/bio.h ../../include/openssl/bn.h
 dsa_sign.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 dsa_sign.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
 dsa_sign.o: ../../include/openssl/err.h ../../include/openssl/lhash.h
diff --git a/src/lib/libcrypto/dsa/dsa.h b/src/lib/libcrypto/dsa/dsa.h
index ac50a5c846..a6f6d0b0b2 100644
--- a/src/lib/libcrypto/dsa/dsa.h
+++ b/src/lib/libcrypto/dsa/dsa.h
@@ -97,6 +97,21 @@
                                               * be used for all exponents.
                                               */
 
+/* If this flag is set the DSA method is FIPS compliant and can be used
+ * in FIPS mode. This is set in the validated module method. If an
+ * application sets this flag in its own methods it is its reposibility
+ * to ensure the result is compliant.
+ */
+
+#define DSA_FLAG_FIPS_METHOD                    0x0400
+
+/* If this flag is set the operations normally disabled in FIPS mode are
+ * permitted it is then the applications responsibility to ensure that the
+ * usage is compliant.
+ */
+
+#define DSA_FLAG_NON_FIPS_ALLOW                 0x0400
+
 #ifdef  __cplusplus
 extern "C" {
 #endif
@@ -272,6 +287,8 @@ void ERR_load_DSA_strings(void);
 #define DSA_F_DSAPARAMS_PRINT_FP                         101
 #define DSA_F_DSA_DO_SIGN                                112
 #define DSA_F_DSA_DO_VERIFY                              113
+#define DSA_F_DSA_GENERATE_KEY                           124
+#define DSA_F_DSA_GENERATE_PARAMETERS_EX                 123
 #define DSA_F_DSA_NEW_METHOD                             103
 #define DSA_F_DSA_PARAM_DECODE                           119
 #define DSA_F_DSA_PRINT_FP                               105
@@ -282,6 +299,7 @@ void ERR_load_DSA_strings(void);
 #define DSA_F_DSA_SIGN                                   106
 #define DSA_F_DSA_SIGN_SETUP                             107
 #define DSA_F_DSA_SIG_NEW                                109
+#define DSA_F_DSA_SIG_PRINT                              125
 #define DSA_F_DSA_VERIFY                                 108
 #define DSA_F_I2D_DSA_SIG                                111
 #define DSA_F_OLD_DSA_PRIV_DECODE                        122
@@ -298,6 +316,8 @@ void ERR_load_DSA_strings(void);
 #define DSA_R_INVALID_DIGEST_TYPE                        106
 #define DSA_R_MISSING_PARAMETERS                         101
 #define DSA_R_MODULUS_TOO_LARGE                          103
+#define DSA_R_NEED_NEW_SETUP_VALUES                      110
+#define DSA_R_NON_FIPS_DSA_METHOD                        111
 #define DSA_R_NO_PARAMETERS_SET                          107
 #define DSA_R_PARAMETER_ENCODING_ERROR                   105
 
diff --git a/src/lib/libcrypto/dsa/dsa_asn1.c b/src/lib/libcrypto/dsa/dsa_asn1.c
index c37460b2d6..6058534374 100644
--- a/src/lib/libcrypto/dsa/dsa_asn1.c
+++ b/src/lib/libcrypto/dsa/dsa_asn1.c
@@ -61,6 +61,7 @@
 #include <openssl/dsa.h>
 #include <openssl/asn1.h>
 #include <openssl/asn1t.h>
+#include <openssl/rand.h>
 
 /* Override the default new methods */
 static int sig_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
@@ -87,7 +88,7 @@ ASN1_SEQUENCE_cb(DSA_SIG, sig_cb) = {
         ASN1_SIMPLE(DSA_SIG, s, CBIGNUM)
 } ASN1_SEQUENCE_END_cb(DSA_SIG, DSA_SIG)
 
-IMPLEMENT_ASN1_FUNCTIONS_const(DSA_SIG)
+IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(DSA_SIG, DSA_SIG, DSA_SIG)
 
 /* Override the default free and new methods */
 static int dsa_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
@@ -148,3 +149,40 @@ DSA *DSAparams_dup(DSA *dsa)
         {
         return ASN1_item_dup(ASN1_ITEM_rptr(DSAparams), dsa);
         }
+
+int DSA_sign(int type, const unsigned char *dgst, int dlen, unsigned char *sig,
+             unsigned int *siglen, DSA *dsa)
+        {
+        DSA_SIG *s;
+        RAND_seed(dgst, dlen);
+        s=DSA_do_sign(dgst,dlen,dsa);
+        if (s == NULL)
+                {
+                *siglen=0;
+                return(0);
+                }
+        *siglen=i2d_DSA_SIG(s,&sig);
+        DSA_SIG_free(s);
+        return(1);
+        }
+
+/* data has already been hashed (probably with SHA or SHA-1). */
+/* returns
+ *      1: correct signature
+ *      0: incorrect signature
+ *     -1: error
+ */
+int DSA_verify(int type, const unsigned char *dgst, int dgst_len,
+             const unsigned char *sigbuf, int siglen, DSA *dsa)
+        {
+        DSA_SIG *s;
+        int ret=-1;
+
+        s = DSA_SIG_new();
+        if (s == NULL) return(ret);
+        if (d2i_DSA_SIG(&s,&sigbuf,siglen) == NULL) goto err;
+        ret=DSA_do_verify(dgst,dgst_len,s,dsa);
+err:
+        DSA_SIG_free(s);
+        return(ret);
+        }
diff --git a/src/lib/libcrypto/dsa/dsa_err.c b/src/lib/libcrypto/dsa/dsa_err.c
index bba984e92e..00545b7b9f 100644
--- a/src/lib/libcrypto/dsa/dsa_err.c
+++ b/src/lib/libcrypto/dsa/dsa_err.c
@@ -1,6 +1,6 @@
 /* crypto/dsa/dsa_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -76,6 +76,8 @@ static ERR_STRING_DATA DSA_str_functs[]=
 {ERR_FUNC(DSA_F_DSAPARAMS_PRINT_FP),    "DSAparams_print_fp"},
 {ERR_FUNC(DSA_F_DSA_DO_SIGN),   "DSA_do_sign"},
 {ERR_FUNC(DSA_F_DSA_DO_VERIFY), "DSA_do_verify"},
+{ERR_FUNC(DSA_F_DSA_GENERATE_KEY),      "DSA_generate_key"},
+{ERR_FUNC(DSA_F_DSA_GENERATE_PARAMETERS_EX),    "DSA_generate_parameters_ex"},
 {ERR_FUNC(DSA_F_DSA_NEW_METHOD),        "DSA_new_method"},
 {ERR_FUNC(DSA_F_DSA_PARAM_DECODE),      "DSA_PARAM_DECODE"},
 {ERR_FUNC(DSA_F_DSA_PRINT_FP),  "DSA_print_fp"},
@@ -86,6 +88,7 @@ static ERR_STRING_DATA DSA_str_functs[]=
 {ERR_FUNC(DSA_F_DSA_SIGN),      "DSA_sign"},
 {ERR_FUNC(DSA_F_DSA_SIGN_SETUP),        "DSA_sign_setup"},
 {ERR_FUNC(DSA_F_DSA_SIG_NEW),   "DSA_SIG_new"},
+{ERR_FUNC(DSA_F_DSA_SIG_PRINT), "DSA_SIG_PRINT"},
 {ERR_FUNC(DSA_F_DSA_VERIFY),    "DSA_verify"},
 {ERR_FUNC(DSA_F_I2D_DSA_SIG),   "i2d_DSA_SIG"},
 {ERR_FUNC(DSA_F_OLD_DSA_PRIV_DECODE),   "OLD_DSA_PRIV_DECODE"},
@@ -105,6 +108,8 @@ static ERR_STRING_DATA DSA_str_reasons[]=
 {ERR_REASON(DSA_R_INVALID_DIGEST_TYPE)   ,"invalid digest type"},
 {ERR_REASON(DSA_R_MISSING_PARAMETERS)    ,"missing parameters"},
 {ERR_REASON(DSA_R_MODULUS_TOO_LARGE)     ,"modulus too large"},
+{ERR_REASON(DSA_R_NEED_NEW_SETUP_VALUES) ,"need new setup values"},
+{ERR_REASON(DSA_R_NON_FIPS_DSA_METHOD)   ,"non fips dsa method"},
 {ERR_REASON(DSA_R_NO_PARAMETERS_SET)     ,"no parameters set"},
 {ERR_REASON(DSA_R_PARAMETER_ENCODING_ERROR),"parameter encoding error"},
 {0,NULL}
diff --git a/src/lib/libcrypto/dsa/dsa_gen.c b/src/lib/libcrypto/dsa/dsa_gen.c
index cb0b4538a4..c398761d0d 100644
--- a/src/lib/libcrypto/dsa/dsa_gen.c
+++ b/src/lib/libcrypto/dsa/dsa_gen.c
@@ -81,13 +81,33 @@
 #include <openssl/sha.h>
 #include "dsa_locl.h"
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 int DSA_generate_parameters_ex(DSA *ret, int bits,
                 const unsigned char *seed_in, int seed_len,
                 int *counter_ret, unsigned long *h_ret, BN_GENCB *cb)
         {
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !(ret->meth->flags & DSA_FLAG_FIPS_METHOD)
+                        && !(ret->flags & DSA_FLAG_NON_FIPS_ALLOW))
+                {
+                DSAerr(DSA_F_DSA_GENERATE_PARAMETERS_EX, DSA_R_NON_FIPS_DSA_METHOD);
+                return 0;
+                }
+#endif
         if(ret->meth->dsa_paramgen)
                 return ret->meth->dsa_paramgen(ret, bits, seed_in, seed_len,
                                 counter_ret, h_ret, cb);
+#ifdef OPENSSL_FIPS
+        else if (FIPS_mode())
+                {
+                return FIPS_dsa_generate_parameters_ex(ret, bits, 
+                                                        seed_in, seed_len,
+                                                        counter_ret, h_ret, cb);
+                }
+#endif
         else
                 {
                 const EVP_MD *evpmd;
@@ -105,12 +125,13 @@ int DSA_generate_parameters_ex(DSA *ret, int bits,
                         }
 
                 return dsa_builtin_paramgen(ret, bits, qbits, evpmd,
-                                seed_in, seed_len, counter_ret, h_ret, cb);
+                        seed_in, seed_len, NULL, counter_ret, h_ret, cb);
                 }
         }
 
 int dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits,
         const EVP_MD *evpmd, const unsigned char *seed_in, size_t seed_len,
+        unsigned char *seed_out,
         int *counter_ret, unsigned long *h_ret, BN_GENCB *cb)
         {
         int ok=0;
@@ -201,8 +222,10 @@ int dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits,
                                 }
 
                         /* step 2 */
-                        EVP_Digest(seed, qsize, md,   NULL, evpmd, NULL);
-                        EVP_Digest(buf,  qsize, buf2, NULL, evpmd, NULL);
+                        if (!EVP_Digest(seed, qsize, md,   NULL, evpmd, NULL))
+                                goto err;
+                        if (!EVP_Digest(buf,  qsize, buf2, NULL, evpmd, NULL))
+                                goto err;
                         for (i = 0; i < qsize; i++)
                                 md[i]^=buf2[i];
 
@@ -251,7 +274,9 @@ int dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits,
                                                 break;
                                         }
 
-                                EVP_Digest(buf, qsize, md ,NULL, evpmd, NULL);
+                                if (!EVP_Digest(buf, qsize, md ,NULL, evpmd,
+                                                                        NULL))
+                                        goto err;
 
                                 /* step 8 */
                                 if (!BN_bin2bn(md, qsize, r0))
@@ -332,6 +357,8 @@ err:
                         }
                 if (counter_ret != NULL) *counter_ret=counter;
                 if (h_ret != NULL) *h_ret=h;
+                if (seed_out)
+                        memcpy(seed_out, seed, qsize);
                 }
         if(ctx)
                 {
diff --git a/src/lib/libcrypto/dsa/dsa_key.c b/src/lib/libcrypto/dsa/dsa_key.c
index c4aa86bc6d..9cf669b921 100644
--- a/src/lib/libcrypto/dsa/dsa_key.c
+++ b/src/lib/libcrypto/dsa/dsa_key.c
@@ -64,12 +64,28 @@
 #include <openssl/dsa.h>
 #include <openssl/rand.h>
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 static int dsa_builtin_keygen(DSA *dsa);
 
 int DSA_generate_key(DSA *dsa)
         {
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
+                        && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
+                {
+                DSAerr(DSA_F_DSA_GENERATE_KEY, DSA_R_NON_FIPS_DSA_METHOD);
+                return 0;
+                }
+#endif
         if(dsa->meth->dsa_keygen)
                 return dsa->meth->dsa_keygen(dsa);
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode())
+                return FIPS_dsa_generate_key(dsa);
+#endif
         return dsa_builtin_keygen(dsa);
         }
 
diff --git a/src/lib/libcrypto/dsa/dsa_lib.c b/src/lib/libcrypto/dsa/dsa_lib.c
index e9b75902db..96d8d0c4b4 100644
--- a/src/lib/libcrypto/dsa/dsa_lib.c
+++ b/src/lib/libcrypto/dsa/dsa_lib.c
@@ -70,6 +70,10 @@
 #include <openssl/dh.h>
 #endif
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 const char DSA_version[]="DSA" OPENSSL_VERSION_PTEXT;
 
 static const DSA_METHOD *default_DSA_method = NULL;
@@ -82,7 +86,16 @@ void DSA_set_default_method(const DSA_METHOD *meth)
 const DSA_METHOD *DSA_get_default_method(void)
         {
         if(!default_DSA_method)
+                {
+#ifdef OPENSSL_FIPS
+                if (FIPS_mode())
+                        return FIPS_dsa_openssl();
+                else
+                        return DSA_OpenSSL();
+#else
                 default_DSA_method = DSA_OpenSSL();
+#endif
+                }
         return default_DSA_method;
         }
 
@@ -163,7 +176,7 @@ DSA *DSA_new_method(ENGINE *engine)
         ret->method_mont_p=NULL;
 
         ret->references=1;
-        ret->flags=ret->meth->flags;
+        ret->flags=ret->meth->flags & ~DSA_FLAG_NON_FIPS_ALLOW;
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_DSA, ret, &ret->ex_data);
         if ((ret->meth->init != NULL) && !ret->meth->init(ret))
                 {
@@ -276,7 +289,8 @@ void *DSA_get_ex_data(DSA *d, int idx)
 DH *DSA_dup_DH(const DSA *r)
         {
         /* DSA has p, q, g, optional pub_key, optional priv_key.
-         * DH has p, optional length, g, optional pub_key, optional priv_key.
+         * DH has p, optional length, g, optional pub_key, optional priv_key,
+         * optional q.
          */ 
 
         DH *ret = NULL;
@@ -290,7 +304,11 @@ DH *DSA_dup_DH(const DSA *r)
                 if ((ret->p = BN_dup(r->p)) == NULL)
                         goto err;
         if (r->q != NULL)
+                {
                 ret->length = BN_num_bits(r->q);
+                if ((ret->q = BN_dup(r->q)) == NULL)
+                        goto err;
+                }
         if (r->g != NULL)
                 if ((ret->g = BN_dup(r->g)) == NULL)
                         goto err;
diff --git a/src/lib/libcrypto/dsa/dsa_ossl.c b/src/lib/libcrypto/dsa/dsa_ossl.c
index a3ddd7d281..b3d78e524c 100644
--- a/src/lib/libcrypto/dsa/dsa_ossl.c
+++ b/src/lib/libcrypto/dsa/dsa_ossl.c
@@ -136,6 +136,7 @@ static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
         BN_CTX *ctx=NULL;
         int reason=ERR_R_BN_LIB;
         DSA_SIG *ret=NULL;
+        int noredo = 0;
 
         BN_init(&m);
         BN_init(&xr);
@@ -150,7 +151,7 @@ static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
         if (s == NULL) goto err;
         ctx=BN_CTX_new();
         if (ctx == NULL) goto err;
-
+redo:
         if ((dsa->kinv == NULL) || (dsa->r == NULL))
                 {
                 if (!DSA_sign_setup(dsa,ctx,&kinv,&r)) goto err;
@@ -161,6 +162,7 @@ static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
                 dsa->kinv=NULL;
                 r=dsa->r;
                 dsa->r=NULL;
+                noredo = 1;
                 }
 
         
@@ -181,6 +183,18 @@ static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
 
         ret=DSA_SIG_new();
         if (ret == NULL) goto err;
+        /* Redo if r or s is zero as required by FIPS 186-3: this is
+         * very unlikely.
+         */
+        if (BN_is_zero(r) || BN_is_zero(s))
+                {
+                if (noredo)
+                        {
+                        reason = DSA_R_NEED_NEW_SETUP_VALUES;
+                        goto err;
+                        }
+                goto redo;
+                }
         ret->r = r;
         ret->s = s;
         
diff --git a/src/lib/libcrypto/dsa/dsa_sign.c b/src/lib/libcrypto/dsa/dsa_sign.c
index 17555e5892..c3cc3642ce 100644
--- a/src/lib/libcrypto/dsa/dsa_sign.c
+++ b/src/lib/libcrypto/dsa/dsa_sign.c
@@ -61,30 +61,54 @@
 #include "cryptlib.h"
 #include <openssl/dsa.h>
 #include <openssl/rand.h>
+#include <openssl/bn.h>
 
 DSA_SIG * DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
         {
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
+                        && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
+                {
+                DSAerr(DSA_F_DSA_DO_SIGN, DSA_R_NON_FIPS_DSA_METHOD);
+                return NULL;
+                }
+#endif
         return dsa->meth->dsa_do_sign(dgst, dlen, dsa);
         }
 
-int DSA_sign(int type, const unsigned char *dgst, int dlen, unsigned char *sig,
-             unsigned int *siglen, DSA *dsa)
+int DSA_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
         {
-        DSA_SIG *s;
-        RAND_seed(dgst, dlen);
-        s=DSA_do_sign(dgst,dlen,dsa);
-        if (s == NULL)
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
+                        && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
                 {
-                *siglen=0;
-                return(0);
+                DSAerr(DSA_F_DSA_SIGN_SETUP, DSA_R_NON_FIPS_DSA_METHOD);
+                return 0;
                 }
-        *siglen=i2d_DSA_SIG(s,&sig);
-        DSA_SIG_free(s);
-        return(1);
+#endif
+        return dsa->meth->dsa_sign_setup(dsa, ctx_in, kinvp, rp);
         }
 
-int DSA_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
+DSA_SIG *DSA_SIG_new(void)
         {
-        return dsa->meth->dsa_sign_setup(dsa, ctx_in, kinvp, rp);
+        DSA_SIG *sig;
+        sig = OPENSSL_malloc(sizeof(DSA_SIG));
+        if (!sig)
+                return NULL;
+        sig->r = NULL;
+        sig->s = NULL;
+        return sig;
+        }
+
+void DSA_SIG_free(DSA_SIG *sig)
+        {
+        if (sig)
+                {
+                if (sig->r)
+                        BN_free(sig->r);
+                if (sig->s)
+                        BN_free(sig->s);
+                OPENSSL_free(sig);
+                }
         }
 
diff --git a/src/lib/libcrypto/dsa/dsa_vrf.c b/src/lib/libcrypto/dsa/dsa_vrf.c
index 226a75ff3f..674cb5fa5f 100644
--- a/src/lib/libcrypto/dsa/dsa_vrf.c
+++ b/src/lib/libcrypto/dsa/dsa_vrf.c
@@ -64,26 +64,13 @@
 int DSA_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
                   DSA *dsa)
         {
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
+                        && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
+                {
+                DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_NON_FIPS_DSA_METHOD);
+                return -1;
+                }
+#endif
         return dsa->meth->dsa_do_verify(dgst, dgst_len, sig, dsa);
         }
-
-/* data has already been hashed (probably with SHA or SHA-1). */
-/* returns
- *      1: correct signature
- *      0: incorrect signature
- *     -1: error
- */
-int DSA_verify(int type, const unsigned char *dgst, int dgst_len,
-             const unsigned char *sigbuf, int siglen, DSA *dsa)
-        {
-        DSA_SIG *s;
-        int ret=-1;
-
-        s = DSA_SIG_new();
-        if (s == NULL) return(ret);
-        if (d2i_DSA_SIG(&s,&sigbuf,siglen) == NULL) goto err;
-        ret=DSA_do_verify(dgst,dgst_len,s,dsa);
-err:
-        DSA_SIG_free(s);
-        return(ret);
-        }
diff --git a/src/lib/libcrypto/dso/dso_dlfcn.c b/src/lib/libcrypto/dso/dso_dlfcn.c
index e78004903c..5f351b318d 100644
--- a/src/lib/libcrypto/dso/dso_dlfcn.c
+++ b/src/lib/libcrypto/dso/dso_dlfcn.c
@@ -86,7 +86,8 @@ DSO_METHOD *DSO_METHOD_dlfcn(void)
 # if defined(_AIX) || defined(__CYGWIN__) || \
      defined(__SCO_VERSION__) || defined(_SCO_ELF) || \
      (defined(__osf__) && !defined(RTLD_NEXT))     || \
-     (defined(__OpenBSD__) && (!defined(__ELF__) || !defined(RTLD_SELF)))
+     (defined(__OpenBSD__) && !defined(RTLD_SELF)) || \
+        defined(__ANDROID__)
 #  undef HAVE_DLINFO
 # endif
 #endif
diff --git a/src/lib/libcrypto/ec/ec.h b/src/lib/libcrypto/ec/ec.h
index ee7078130c..9d01325af3 100644
--- a/src/lib/libcrypto/ec/ec.h
+++ b/src/lib/libcrypto/ec/ec.h
@@ -151,7 +151,24 @@ const EC_METHOD *EC_GFp_mont_method(void);
  */
 const EC_METHOD *EC_GFp_nist_method(void);
 
+#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
+/** Returns 64-bit optimized methods for nistp224
+ *  \return  EC_METHOD object
+ */
+const EC_METHOD *EC_GFp_nistp224_method(void);
+
+/** Returns 64-bit optimized methods for nistp256
+ *  \return  EC_METHOD object
+ */
+const EC_METHOD *EC_GFp_nistp256_method(void);
+
+/** Returns 64-bit optimized methods for nistp521
+ *  \return  EC_METHOD object
+ */
+const EC_METHOD *EC_GFp_nistp521_method(void);
+#endif
 
+#ifndef OPENSSL_NO_EC2M
 /********************************************************************/ 
 /*           EC_METHOD for curves over GF(2^m)                      */
 /********************************************************************/
@@ -161,6 +178,8 @@ const EC_METHOD *EC_GFp_nist_method(void);
  */
 const EC_METHOD *EC_GF2m_simple_method(void);
 
+#endif
+
 
 /********************************************************************/
 /*                   EC_GROUP functions                             */
@@ -282,6 +301,7 @@ int EC_GROUP_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, co
  */
 int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);
 
+#ifndef OPENSSL_NO_EC2M
 /** Sets the parameter of a ec over GF2m defined by y^2 + x*y = x^3 + a*x^2 + b
  *  \param  group  EC_GROUP object
  *  \param  p      BIGNUM with the polynomial defining the underlying field
@@ -301,7 +321,7 @@ int EC_GROUP_set_curve_GF2m(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, c
  *  \return 1 on success and 0 if an error occured
  */
 int EC_GROUP_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);
-
+#endif
 /** Returns the number of bits needed to represent a field element 
  *  \param  group  EC_GROUP object
  *  \return number of bits needed to represent a field element
@@ -342,7 +362,7 @@ int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx);
  *  \return newly created EC_GROUP object with the specified parameters
  */
 EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx);
-
+#ifndef OPENSSL_NO_EC2M
 /** Creates a new EC_GROUP object with the specified parameters defined
  *  over GF2m (defined by the equation y^2 + x*y = x^3 + a*x^2 + b)
  *  \param  p    BIGNUM with the polynomial defining the underlying field
@@ -352,7 +372,7 @@ EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, const BIGNUM
  *  \return newly created EC_GROUP object with the specified parameters
  */
 EC_GROUP *EC_GROUP_new_curve_GF2m(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx);
-
+#endif
 /** Creates a EC_GROUP object with a curve specified by a NID
  *  \param  nid  NID of the OID of the curve name
  *  \return newly created EC_GROUP object with specified curve or NULL
@@ -481,7 +501,7 @@ int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group,
  */
 int EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *group, EC_POINT *p,
         const BIGNUM *x, int y_bit, BN_CTX *ctx);
-
+#ifndef OPENSSL_NO_EC2M
 /** Sets the affine coordinates of a EC_POINT over GF2m
  *  \param  group  underlying EC_GROUP object
  *  \param  p      EC_POINT object
@@ -514,7 +534,7 @@ int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *group,
  */
 int EC_POINT_set_compressed_coordinates_GF2m(const EC_GROUP *group, EC_POINT *p,
         const BIGNUM *x, int y_bit, BN_CTX *ctx);
-
+#endif
 /** Encodes a EC_POINT object to a octet string
  *  \param  group  underlying EC_GROUP object
  *  \param  p      EC_POINT object
@@ -653,9 +673,11 @@ int EC_GROUP_have_precompute_mult(const EC_GROUP *group);
 /* EC_GROUP_get_basis_type() returns the NID of the basis type
  * used to represent the field elements */
 int EC_GROUP_get_basis_type(const EC_GROUP *);
+#ifndef OPENSSL_NO_EC2M
 int EC_GROUP_get_trinomial_basis(const EC_GROUP *, unsigned int *k);
 int EC_GROUP_get_pentanomial_basis(const EC_GROUP *, unsigned int *k1, 
         unsigned int *k2, unsigned int *k3);
+#endif
 
 #define OPENSSL_EC_NAMED_CURVE  0x001
 
@@ -689,11 +711,21 @@ typedef struct ec_key_st EC_KEY;
 #define EC_PKEY_NO_PARAMETERS   0x001
 #define EC_PKEY_NO_PUBKEY       0x002
 
+/* some values for the flags field */
+#define EC_FLAG_NON_FIPS_ALLOW  0x1
+#define EC_FLAG_FIPS_CHECKED    0x2
+
 /** Creates a new EC_KEY object.
  *  \return EC_KEY object or NULL if an error occurred.
  */
 EC_KEY *EC_KEY_new(void);
 
+int EC_KEY_get_flags(const EC_KEY *key);
+
+void EC_KEY_set_flags(EC_KEY *key, int flags);
+
+void EC_KEY_clear_flags(EC_KEY *key, int flags);
+
 /** Creates a new EC_KEY object using a named curve as underlying
  *  EC_GROUP object.
  *  \param  nid  NID of the named curve.
@@ -799,6 +831,15 @@ int EC_KEY_generate_key(EC_KEY *key);
  */
 int EC_KEY_check_key(const EC_KEY *key);
 
+/** Sets a public key from affine coordindates performing
+ *  neccessary NIST PKV tests.
+ *  \param  key  the EC_KEY object
+ *  \param  x    public key x coordinate
+ *  \param  y    public key y coordinate
+ *  \return 1 on success and 0 otherwise.
+ */
+int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x, BIGNUM *y);
+
 
 /********************************************************************/
 /*        de- and encoding functions for SEC1 ECPrivateKey          */
@@ -926,6 +967,7 @@ void ERR_load_EC_strings(void);
 /* Error codes for the EC functions. */
 
 /* Function codes. */
+#define EC_F_BN_TO_FELEM                                 224
 #define EC_F_COMPUTE_WNAF                                143
 #define EC_F_D2I_ECPARAMETERS                            144
 #define EC_F_D2I_ECPKPARAMETERS                          145
@@ -968,6 +1010,15 @@ void ERR_load_EC_strings(void);
 #define EC_F_EC_GFP_MONT_FIELD_SQR                       132
 #define EC_F_EC_GFP_MONT_GROUP_SET_CURVE                 189
 #define EC_F_EC_GFP_MONT_GROUP_SET_CURVE_GFP             135
+#define EC_F_EC_GFP_NISTP224_GROUP_SET_CURVE             225
+#define EC_F_EC_GFP_NISTP224_POINTS_MUL                  228
+#define EC_F_EC_GFP_NISTP224_POINT_GET_AFFINE_COORDINATES 226
+#define EC_F_EC_GFP_NISTP256_GROUP_SET_CURVE             230
+#define EC_F_EC_GFP_NISTP256_POINTS_MUL                  231
+#define EC_F_EC_GFP_NISTP256_POINT_GET_AFFINE_COORDINATES 232
+#define EC_F_EC_GFP_NISTP521_GROUP_SET_CURVE             233
+#define EC_F_EC_GFP_NISTP521_POINTS_MUL                  234
+#define EC_F_EC_GFP_NISTP521_POINT_GET_AFFINE_COORDINATES 235
 #define EC_F_EC_GFP_NIST_FIELD_MUL                       200
 #define EC_F_EC_GFP_NIST_FIELD_SQR                       201
 #define EC_F_EC_GFP_NIST_GROUP_SET_CURVE                 202
@@ -1010,6 +1061,7 @@ void ERR_load_EC_strings(void);
 #define EC_F_EC_KEY_NEW                                  182
 #define EC_F_EC_KEY_PRINT                                180
 #define EC_F_EC_KEY_PRINT_FP                             181
+#define EC_F_EC_KEY_SET_PUBLIC_KEY_AFFINE_COORDINATES    229
 #define EC_F_EC_POINTS_MAKE_AFFINE                       136
 #define EC_F_EC_POINT_ADD                                112
 #define EC_F_EC_POINT_CMP                                113
@@ -1040,6 +1092,9 @@ void ERR_load_EC_strings(void);
 #define EC_F_I2D_ECPKPARAMETERS                          191
 #define EC_F_I2D_ECPRIVATEKEY                            192
 #define EC_F_I2O_ECPUBLICKEY                             151
+#define EC_F_NISTP224_PRE_COMP_NEW                       227
+#define EC_F_NISTP256_PRE_COMP_NEW                       236
+#define EC_F_NISTP521_PRE_COMP_NEW                       237
 #define EC_F_O2I_ECPUBLICKEY                             152
 #define EC_F_OLD_EC_PRIV_DECODE                          222
 #define EC_F_PKEY_EC_CTRL                                197
@@ -1052,12 +1107,15 @@ void ERR_load_EC_strings(void);
 /* Reason codes. */
 #define EC_R_ASN1_ERROR                                  115
 #define EC_R_ASN1_UNKNOWN_FIELD                          116
+#define EC_R_BIGNUM_OUT_OF_RANGE                         144
 #define EC_R_BUFFER_TOO_SMALL                            100
+#define EC_R_COORDINATES_OUT_OF_RANGE                    146
 #define EC_R_D2I_ECPKPARAMETERS_FAILURE                  117
 #define EC_R_DECODE_ERROR                                142
 #define EC_R_DISCRIMINANT_IS_ZERO                        118
 #define EC_R_EC_GROUP_NEW_BY_NAME_FAILURE                119
 #define EC_R_FIELD_TOO_LARGE                             143
+#define EC_R_GF2M_NOT_SUPPORTED                          147
 #define EC_R_GROUP2PKPARAMETERS_FAILURE                  120
 #define EC_R_I2D_ECPKPARAMETERS_FAILURE                  121
 #define EC_R_INCOMPATIBLE_OBJECTS                        101
@@ -1092,6 +1150,7 @@ void ERR_load_EC_strings(void);
 #define EC_R_UNKNOWN_GROUP                               129
 #define EC_R_UNKNOWN_ORDER                               114
 #define EC_R_UNSUPPORTED_FIELD                           131
+#define EC_R_WRONG_CURVE_PARAMETERS                      145
 #define EC_R_WRONG_ORDER                                 130
 
 #ifdef  __cplusplus
diff --git a/src/lib/libcrypto/ec/ec2_smpl.c b/src/lib/libcrypto/ec/ec2_smpl.c
index 03deae6674..e0e59c7d82 100644
--- a/src/lib/libcrypto/ec/ec2_smpl.c
+++ b/src/lib/libcrypto/ec/ec2_smpl.c
@@ -71,10 +71,20 @@
 
 #include "ec_lcl.h"
 
+#ifndef OPENSSL_NO_EC2M
+
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 
 const EC_METHOD *EC_GF2m_simple_method(void)
         {
+#ifdef OPENSSL_FIPS
+        return fips_ec_gf2m_simple_method();
+#else
         static const EC_METHOD ret = {
+                EC_FLAGS_DEFAULT_OCT,
                 NID_X9_62_characteristic_two_field,
                 ec_GF2m_simple_group_init,
                 ec_GF2m_simple_group_finish,
@@ -93,9 +103,7 @@ const EC_METHOD *EC_GF2m_simple_method(void)
                 0 /* get_Jprojective_coordinates_GFp */,
                 ec_GF2m_simple_point_set_affine_coordinates,
                 ec_GF2m_simple_point_get_affine_coordinates,
-                ec_GF2m_simple_set_compressed_coordinates,
-                ec_GF2m_simple_point2oct,
-                ec_GF2m_simple_oct2point,
+                0,0,0,
                 ec_GF2m_simple_add,
                 ec_GF2m_simple_dbl,
                 ec_GF2m_simple_invert,
@@ -118,6 +126,7 @@ const EC_METHOD *EC_GF2m_simple_method(void)
                 0 /* field_set_to_one */ };
 
         return &ret;
+#endif
         }
 
 
@@ -405,340 +414,6 @@ int ec_GF2m_simple_point_get_affine_coordinates(const EC_GROUP *group, const EC_
         return ret;
         }
 
-
-/* Calculates and sets the affine coordinates of an EC_POINT from the given
- * compressed coordinates.  Uses algorithm 2.3.4 of SEC 1. 
- * Note that the simple implementation only uses affine coordinates.
- *
- * The method is from the following publication:
- * 
- *     Harper, Menezes, Vanstone:
- *     "Public-Key Cryptosystems with Very Small Key Lengths",
- *     EUROCRYPT '92, Springer-Verlag LNCS 658,
- *     published February 1993
- *
- * US Patents 6,141,420 and 6,618,483 (Vanstone, Mullin, Agnew) describe
- * the same method, but claim no priority date earlier than July 29, 1994
- * (and additionally fail to cite the EUROCRYPT '92 publication as prior art).
- */
-int ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
-        const BIGNUM *x_, int y_bit, BN_CTX *ctx)
-        {
-        BN_CTX *new_ctx = NULL;
-        BIGNUM *tmp, *x, *y, *z;
-        int ret = 0, z0;
-
-        /* clear error queue */
-        ERR_clear_error();
-
-        if (ctx == NULL)
-                {
-                ctx = new_ctx = BN_CTX_new();
-                if (ctx == NULL)
-                        return 0;
-                }
-
-        y_bit = (y_bit != 0) ? 1 : 0;
-
-        BN_CTX_start(ctx);
-        tmp = BN_CTX_get(ctx);
-        x = BN_CTX_get(ctx);
-        y = BN_CTX_get(ctx);
-        z = BN_CTX_get(ctx);
-        if (z == NULL) goto err;
-
-        if (!BN_GF2m_mod_arr(x, x_, group->poly)) goto err;
-        if (BN_is_zero(x))
-                {
-                if (!BN_GF2m_mod_sqrt_arr(y, &group->b, group->poly, ctx)) goto err;
-                }
-        else
-                {
-                if (!group->meth->field_sqr(group, tmp, x, ctx)) goto err;
-                if (!group->meth->field_div(group, tmp, &group->b, tmp, ctx)) goto err;
-                if (!BN_GF2m_add(tmp, &group->a, tmp)) goto err;
-                if (!BN_GF2m_add(tmp, x, tmp)) goto err;
-                if (!BN_GF2m_mod_solve_quad_arr(z, tmp, group->poly, ctx))
-                        {
-                        unsigned long err = ERR_peek_last_error();
-                        
-                        if (ERR_GET_LIB(err) == ERR_LIB_BN && ERR_GET_REASON(err) == BN_R_NO_SOLUTION)
-                                {
-                                ERR_clear_error();
-                                ECerr(EC_F_EC_GF2M_SIMPLE_SET_COMPRESSED_COORDINATES, EC_R_INVALID_COMPRESSED_POINT);
-                                }
-                        else
-                                ECerr(EC_F_EC_GF2M_SIMPLE_SET_COMPRESSED_COORDINATES, ERR_R_BN_LIB);
-                        goto err;
-                        }
-                z0 = (BN_is_odd(z)) ? 1 : 0;
-                if (!group->meth->field_mul(group, y, x, z, ctx)) goto err;
-                if (z0 != y_bit)
-                        {
-                        if (!BN_GF2m_add(y, y, x)) goto err;
-                        }
-                }
-
-        if (!EC_POINT_set_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
-
-        ret = 1;
-
- err:
-        BN_CTX_end(ctx);
-        if (new_ctx != NULL)
-                BN_CTX_free(new_ctx);
-        return ret;
-        }
-
-
-/* Converts an EC_POINT to an octet string.  
- * If buf is NULL, the encoded length will be returned.
- * If the length len of buf is smaller than required an error will be returned.
- */
-size_t ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point, point_conversion_form_t form,
-        unsigned char *buf, size_t len, BN_CTX *ctx)
-        {
-        size_t ret;
-        BN_CTX *new_ctx = NULL;
-        int used_ctx = 0;
-        BIGNUM *x, *y, *yxi;
-        size_t field_len, i, skip;
-
-        if ((form != POINT_CONVERSION_COMPRESSED)
-                && (form != POINT_CONVERSION_UNCOMPRESSED)
-                && (form != POINT_CONVERSION_HYBRID))
-                {
-                ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_INVALID_FORM);
-                goto err;
-                }
-
-        if (EC_POINT_is_at_infinity(group, point))
-                {
-                /* encodes to a single 0 octet */
-                if (buf != NULL)
-                        {
-                        if (len < 1)
-                                {
-                                ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
-                                return 0;
-                                }
-                        buf[0] = 0;
-                        }
-                return 1;
-                }
-
-
-        /* ret := required output buffer length */
-        field_len = (EC_GROUP_get_degree(group) + 7) / 8;
-        ret = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2*field_len;
-
-        /* if 'buf' is NULL, just return required length */
-        if (buf != NULL)
-                {
-                if (len < ret)
-                        {
-                        ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
-                        goto err;
-                        }
-
-                if (ctx == NULL)
-                        {
-                        ctx = new_ctx = BN_CTX_new();
-                        if (ctx == NULL)
-                                return 0;
-                        }
-
-                BN_CTX_start(ctx);
-                used_ctx = 1;
-                x = BN_CTX_get(ctx);
-                y = BN_CTX_get(ctx);
-                yxi = BN_CTX_get(ctx);
-                if (yxi == NULL) goto err;
-
-                if (!EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
-
-                buf[0] = form;
-                if ((form != POINT_CONVERSION_UNCOMPRESSED) && !BN_is_zero(x))
-                        {
-                        if (!group->meth->field_div(group, yxi, y, x, ctx)) goto err;
-                        if (BN_is_odd(yxi)) buf[0]++;
-                        }
-
-                i = 1;
-                
-                skip = field_len - BN_num_bytes(x);
-                if (skip > field_len)
-                        {
-                        ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
-                        goto err;
-                        }
-                while (skip > 0)
-                        {
-                        buf[i++] = 0;
-                        skip--;
-                        }
-                skip = BN_bn2bin(x, buf + i);
-                i += skip;
-                if (i != 1 + field_len)
-                        {
-                        ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
-                        goto err;
-                        }
-
-                if (form == POINT_CONVERSION_UNCOMPRESSED || form == POINT_CONVERSION_HYBRID)
-                        {
-                        skip = field_len - BN_num_bytes(y);
-                        if (skip > field_len)
-                                {
-                                ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
-                                goto err;
-                                }
-                        while (skip > 0)
-                                {
-                                buf[i++] = 0;
-                                skip--;
-                                }
-                        skip = BN_bn2bin(y, buf + i);
-                        i += skip;
-                        }
-
-                if (i != ret)
-                        {
-                        ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
-                        goto err;
-                        }
-                }
-        
-        if (used_ctx)
-                BN_CTX_end(ctx);
-        if (new_ctx != NULL)
-                BN_CTX_free(new_ctx);
-        return ret;
-
- err:
-        if (used_ctx)
-                BN_CTX_end(ctx);
-        if (new_ctx != NULL)
-                BN_CTX_free(new_ctx);
-        return 0;
-        }
-
-
-/* Converts an octet string representation to an EC_POINT. 
- * Note that the simple implementation only uses affine coordinates.
- */
-int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
-        const unsigned char *buf, size_t len, BN_CTX *ctx)
-        {
-        point_conversion_form_t form;
-        int y_bit;
-        BN_CTX *new_ctx = NULL;
-        BIGNUM *x, *y, *yxi;
-        size_t field_len, enc_len;
-        int ret = 0;
-
-        if (len == 0)
-                {
-                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_BUFFER_TOO_SMALL);
-                return 0;
-                }
-        form = buf[0];
-        y_bit = form & 1;
-        form = form & ~1U;
-        if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED)
-                && (form != POINT_CONVERSION_UNCOMPRESSED)
-                && (form != POINT_CONVERSION_HYBRID))
-                {
-                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                return 0;
-                }
-        if ((form == 0 || form == POINT_CONVERSION_UNCOMPRESSED) && y_bit)
-                {
-                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                return 0;
-                }
-
-        if (form == 0)
-                {
-                if (len != 1)
-                        {
-                        ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                        return 0;
-                        }
-
-                return EC_POINT_set_to_infinity(group, point);
-                }
-        
-        field_len = (EC_GROUP_get_degree(group) + 7) / 8;
-        enc_len = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2*field_len;
-
-        if (len != enc_len)
-                {
-                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                return 0;
-                }
-
-        if (ctx == NULL)
-                {
-                ctx = new_ctx = BN_CTX_new();
-                if (ctx == NULL)
-                        return 0;
-                }
-
-        BN_CTX_start(ctx);
-        x = BN_CTX_get(ctx);
-        y = BN_CTX_get(ctx);
-        yxi = BN_CTX_get(ctx);
-        if (yxi == NULL) goto err;
-
-        if (!BN_bin2bn(buf + 1, field_len, x)) goto err;
-        if (BN_ucmp(x, &group->field) >= 0)
-                {
-                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                goto err;
-                }
-
-        if (form == POINT_CONVERSION_COMPRESSED)
-                {
-                if (!EC_POINT_set_compressed_coordinates_GF2m(group, point, x, y_bit, ctx)) goto err;
-                }
-        else
-                {
-                if (!BN_bin2bn(buf + 1 + field_len, field_len, y)) goto err;
-                if (BN_ucmp(y, &group->field) >= 0)
-                        {
-                        ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                        goto err;
-                        }
-                if (form == POINT_CONVERSION_HYBRID)
-                        {
-                        if (!group->meth->field_div(group, yxi, y, x, ctx)) goto err;
-                        if (y_bit != BN_is_odd(yxi))
-                                {
-                                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                                goto err;
-                                }
-                        }
-
-                if (!EC_POINT_set_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
-                }
-        
-        if (!EC_POINT_is_on_curve(group, point, ctx)) /* test required by X9.62 */
-                {
-                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
-                goto err;
-                }
-
-        ret = 1;
-        
- err:
-        BN_CTX_end(ctx);
-        if (new_ctx != NULL)
-                BN_CTX_free(new_ctx);
-        return ret;
-        }
-
-
 /* Computes a + b and stores the result in r.  r could be a or b, a could be b.
  * Uses algorithm A.10.2 of IEEE P1363.
  */
@@ -1040,3 +715,5 @@ int ec_GF2m_simple_field_div(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
         {
         return BN_GF2m_mod_div(r, a, b, &group->field, ctx);
         }
+
+#endif
diff --git a/src/lib/libcrypto/ec/ec_cvt.c b/src/lib/libcrypto/ec/ec_cvt.c
index d45640bab9..bfcbab35fe 100644
--- a/src/lib/libcrypto/ec/ec_cvt.c
+++ b/src/lib/libcrypto/ec/ec_cvt.c
@@ -78,7 +78,32 @@ EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, const BIGNUM
         const EC_METHOD *meth;
         EC_GROUP *ret;
 
+#if defined(OPENSSL_BN_ASM_MONT)
+        /*
+         * This might appear controversial, but the fact is that generic
+         * prime method was observed to deliver better performance even
+         * for NIST primes on a range of platforms, e.g.: 60%-15%
+         * improvement on IA-64, ~25% on ARM, 30%-90% on P4, 20%-25%
+         * in 32-bit build and 35%--12% in 64-bit build on Core2...
+         * Coefficients are relative to optimized bn_nist.c for most
+         * intensive ECDSA verify and ECDH operations for 192- and 521-
+         * bit keys respectively. Choice of these boundary values is
+         * arguable, because the dependency of improvement coefficient
+         * from key length is not a "monotone" curve. For example while
+         * 571-bit result is 23% on ARM, 384-bit one is -1%. But it's
+         * generally faster, sometimes "respectfully" faster, sometimes
+         * "tolerably" slower... What effectively happens is that loop
+         * with bn_mul_add_words is put against bn_mul_mont, and the
+         * latter "wins" on short vectors. Correct solution should be
+         * implementing dedicated NxN multiplication subroutines for
+         * small N. But till it materializes, let's stick to generic
+         * prime method...
+         *                                              <appro>
+         */
+        meth = EC_GFp_mont_method();
+#else
         meth = EC_GFp_nist_method();
+#endif
         
         ret = EC_GROUP_new(meth);
         if (ret == NULL)
@@ -122,7 +147,7 @@ EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, const BIGNUM
         return ret;
         }
 
-
+#ifndef OPENSSL_NO_EC2M
 EC_GROUP *EC_GROUP_new_curve_GF2m(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
         {
         const EC_METHOD *meth;
@@ -142,3 +167,4 @@ EC_GROUP *EC_GROUP_new_curve_GF2m(const BIGNUM *p, const BIGNUM *a, const BIGNUM
 
         return ret;
         }
+#endif
diff --git a/src/lib/libcrypto/ec/ec_err.c b/src/lib/libcrypto/ec/ec_err.c
index 84b4833371..0d19398731 100644
--- a/src/lib/libcrypto/ec/ec_err.c
+++ b/src/lib/libcrypto/ec/ec_err.c
@@ -1,6 +1,6 @@
 /* crypto/ec/ec_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -70,6 +70,7 @@
 
 static ERR_STRING_DATA EC_str_functs[]=
         {
+{ERR_FUNC(EC_F_BN_TO_FELEM),    "BN_TO_FELEM"},
 {ERR_FUNC(EC_F_COMPUTE_WNAF),   "COMPUTE_WNAF"},
 {ERR_FUNC(EC_F_D2I_ECPARAMETERS),       "d2i_ECParameters"},
 {ERR_FUNC(EC_F_D2I_ECPKPARAMETERS),     "d2i_ECPKParameters"},
@@ -112,6 +113,15 @@ static ERR_STRING_DATA EC_str_functs[]=
 {ERR_FUNC(EC_F_EC_GFP_MONT_FIELD_SQR),  "ec_GFp_mont_field_sqr"},
 {ERR_FUNC(EC_F_EC_GFP_MONT_GROUP_SET_CURVE),    "ec_GFp_mont_group_set_curve"},
 {ERR_FUNC(EC_F_EC_GFP_MONT_GROUP_SET_CURVE_GFP),        "EC_GFP_MONT_GROUP_SET_CURVE_GFP"},
+{ERR_FUNC(EC_F_EC_GFP_NISTP224_GROUP_SET_CURVE),        "ec_GFp_nistp224_group_set_curve"},
+{ERR_FUNC(EC_F_EC_GFP_NISTP224_POINTS_MUL),     "ec_GFp_nistp224_points_mul"},
+{ERR_FUNC(EC_F_EC_GFP_NISTP224_POINT_GET_AFFINE_COORDINATES),   "ec_GFp_nistp224_point_get_affine_coordinates"},
+{ERR_FUNC(EC_F_EC_GFP_NISTP256_GROUP_SET_CURVE),        "ec_GFp_nistp256_group_set_curve"},
+{ERR_FUNC(EC_F_EC_GFP_NISTP256_POINTS_MUL),     "ec_GFp_nistp256_points_mul"},
+{ERR_FUNC(EC_F_EC_GFP_NISTP256_POINT_GET_AFFINE_COORDINATES),   "ec_GFp_nistp256_point_get_affine_coordinates"},
+{ERR_FUNC(EC_F_EC_GFP_NISTP521_GROUP_SET_CURVE),        "ec_GFp_nistp521_group_set_curve"},
+{ERR_FUNC(EC_F_EC_GFP_NISTP521_POINTS_MUL),     "ec_GFp_nistp521_points_mul"},
+{ERR_FUNC(EC_F_EC_GFP_NISTP521_POINT_GET_AFFINE_COORDINATES),   "ec_GFp_nistp521_point_get_affine_coordinates"},
 {ERR_FUNC(EC_F_EC_GFP_NIST_FIELD_MUL),  "ec_GFp_nist_field_mul"},
 {ERR_FUNC(EC_F_EC_GFP_NIST_FIELD_SQR),  "ec_GFp_nist_field_sqr"},
 {ERR_FUNC(EC_F_EC_GFP_NIST_GROUP_SET_CURVE),    "ec_GFp_nist_group_set_curve"},
@@ -154,6 +164,7 @@ static ERR_STRING_DATA EC_str_functs[]=
 {ERR_FUNC(EC_F_EC_KEY_NEW),     "EC_KEY_new"},
 {ERR_FUNC(EC_F_EC_KEY_PRINT),   "EC_KEY_print"},
 {ERR_FUNC(EC_F_EC_KEY_PRINT_FP),        "EC_KEY_print_fp"},
+{ERR_FUNC(EC_F_EC_KEY_SET_PUBLIC_KEY_AFFINE_COORDINATES),       "EC_KEY_set_public_key_affine_coordinates"},
 {ERR_FUNC(EC_F_EC_POINTS_MAKE_AFFINE),  "EC_POINTs_make_affine"},
 {ERR_FUNC(EC_F_EC_POINT_ADD),   "EC_POINT_add"},
 {ERR_FUNC(EC_F_EC_POINT_CMP),   "EC_POINT_cmp"},
@@ -184,6 +195,9 @@ static ERR_STRING_DATA EC_str_functs[]=
 {ERR_FUNC(EC_F_I2D_ECPKPARAMETERS),     "i2d_ECPKParameters"},
 {ERR_FUNC(EC_F_I2D_ECPRIVATEKEY),       "i2d_ECPrivateKey"},
 {ERR_FUNC(EC_F_I2O_ECPUBLICKEY),        "i2o_ECPublicKey"},
+{ERR_FUNC(EC_F_NISTP224_PRE_COMP_NEW),  "NISTP224_PRE_COMP_NEW"},
+{ERR_FUNC(EC_F_NISTP256_PRE_COMP_NEW),  "NISTP256_PRE_COMP_NEW"},
+{ERR_FUNC(EC_F_NISTP521_PRE_COMP_NEW),  "NISTP521_PRE_COMP_NEW"},
 {ERR_FUNC(EC_F_O2I_ECPUBLICKEY),        "o2i_ECPublicKey"},
 {ERR_FUNC(EC_F_OLD_EC_PRIV_DECODE),     "OLD_EC_PRIV_DECODE"},
 {ERR_FUNC(EC_F_PKEY_EC_CTRL),   "PKEY_EC_CTRL"},
@@ -199,12 +213,15 @@ static ERR_STRING_DATA EC_str_reasons[]=
         {
 {ERR_REASON(EC_R_ASN1_ERROR)             ,"asn1 error"},
 {ERR_REASON(EC_R_ASN1_UNKNOWN_FIELD)     ,"asn1 unknown field"},
+{ERR_REASON(EC_R_BIGNUM_OUT_OF_RANGE)    ,"bignum out of range"},
 {ERR_REASON(EC_R_BUFFER_TOO_SMALL)       ,"buffer too small"},
+{ERR_REASON(EC_R_COORDINATES_OUT_OF_RANGE),"coordinates out of range"},
 {ERR_REASON(EC_R_D2I_ECPKPARAMETERS_FAILURE),"d2i ecpkparameters failure"},
 {ERR_REASON(EC_R_DECODE_ERROR)           ,"decode error"},
 {ERR_REASON(EC_R_DISCRIMINANT_IS_ZERO)   ,"discriminant is zero"},
 {ERR_REASON(EC_R_EC_GROUP_NEW_BY_NAME_FAILURE),"ec group new by name failure"},
 {ERR_REASON(EC_R_FIELD_TOO_LARGE)        ,"field too large"},
+{ERR_REASON(EC_R_GF2M_NOT_SUPPORTED)     ,"gf2m not supported"},
 {ERR_REASON(EC_R_GROUP2PKPARAMETERS_FAILURE),"group2pkparameters failure"},
 {ERR_REASON(EC_R_I2D_ECPKPARAMETERS_FAILURE),"i2d ecpkparameters failure"},
 {ERR_REASON(EC_R_INCOMPATIBLE_OBJECTS)   ,"incompatible objects"},
@@ -239,6 +256,7 @@ static ERR_STRING_DATA EC_str_reasons[]=
 {ERR_REASON(EC_R_UNKNOWN_GROUP)          ,"unknown group"},
 {ERR_REASON(EC_R_UNKNOWN_ORDER)          ,"unknown order"},
 {ERR_REASON(EC_R_UNSUPPORTED_FIELD)      ,"unsupported field"},
+{ERR_REASON(EC_R_WRONG_CURVE_PARAMETERS) ,"wrong curve parameters"},
 {ERR_REASON(EC_R_WRONG_ORDER)            ,"wrong order"},
 {0,NULL}
         };
diff --git a/src/lib/libcrypto/ec/ec_lcl.h b/src/lib/libcrypto/ec/ec_lcl.h
index 3e2c34b0bc..da7967df38 100644
--- a/src/lib/libcrypto/ec/ec_lcl.h
+++ b/src/lib/libcrypto/ec/ec_lcl.h
@@ -3,7 +3,7 @@
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
 /* ====================================================================
- * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2010 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -82,10 +82,15 @@
 # endif
 #endif
 
+/* Use default functions for poin2oct, oct2point and compressed coordinates */
+#define EC_FLAGS_DEFAULT_OCT    0x1
+
 /* Structure details are not part of the exported interface,
  * so all this may change in future versions. */
 
 struct ec_method_st {
+        /* Various method flags */
+        int flags;
         /* used by EC_METHOD_get_field_type: */
         int field_type; /* a NID */
 
@@ -244,6 +249,7 @@ struct ec_key_st {
         point_conversion_form_t conv_form;
 
         int     references;
+        int     flags;
 
         EC_EXTRA_DATA *method_data;
 } /* EC_KEY */;
@@ -391,3 +397,50 @@ int ec_GF2m_simple_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
         size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
 int ec_GF2m_precompute_mult(EC_GROUP *group, BN_CTX *ctx);
 int ec_GF2m_have_precompute_mult(const EC_GROUP *group);
+
+/* method functions in ec2_mult.c */
+int ec_GF2m_simple_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
+        size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
+int ec_GF2m_precompute_mult(EC_GROUP *group, BN_CTX *ctx);
+int ec_GF2m_have_precompute_mult(const EC_GROUP *group);
+
+#ifndef OPENSSL_EC_NISTP_64_GCC_128
+/* method functions in ecp_nistp224.c */
+int ec_GFp_nistp224_group_init(EC_GROUP *group);
+int ec_GFp_nistp224_group_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, const BIGNUM *n, BN_CTX *);
+int ec_GFp_nistp224_point_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *point, BIGNUM *x, BIGNUM *y, BN_CTX *ctx);
+int ec_GFp_nistp224_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
+int ec_GFp_nistp224_points_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx);
+int ec_GFp_nistp224_precompute_mult(EC_GROUP *group, BN_CTX *ctx);
+int ec_GFp_nistp224_have_precompute_mult(const EC_GROUP *group);
+
+/* method functions in ecp_nistp256.c */
+int ec_GFp_nistp256_group_init(EC_GROUP *group);
+int ec_GFp_nistp256_group_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, const BIGNUM *n, BN_CTX *);
+int ec_GFp_nistp256_point_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *point, BIGNUM *x, BIGNUM *y, BN_CTX *ctx);
+int ec_GFp_nistp256_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
+int ec_GFp_nistp256_points_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx);
+int ec_GFp_nistp256_precompute_mult(EC_GROUP *group, BN_CTX *ctx);
+int ec_GFp_nistp256_have_precompute_mult(const EC_GROUP *group);
+
+/* method functions in ecp_nistp521.c */
+int ec_GFp_nistp521_group_init(EC_GROUP *group);
+int ec_GFp_nistp521_group_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, const BIGNUM *n, BN_CTX *);
+int ec_GFp_nistp521_point_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *point, BIGNUM *x, BIGNUM *y, BN_CTX *ctx);
+int ec_GFp_nistp521_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
+int ec_GFp_nistp521_points_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx);
+int ec_GFp_nistp521_precompute_mult(EC_GROUP *group, BN_CTX *ctx);
+int ec_GFp_nistp521_have_precompute_mult(const EC_GROUP *group);
+
+/* utility functions in ecp_nistputil.c */
+void ec_GFp_nistp_points_make_affine_internal(size_t num, void *point_array,
+        size_t felem_size, void *tmp_felems,
+        void (*felem_one)(void *out),
+        int (*felem_is_zero)(const void *in),
+        void (*felem_assign)(void *out, const void *in),
+        void (*felem_square)(void *out, const void *in),
+        void (*felem_mul)(void *out, const void *in1, const void *in2),
+        void (*felem_inv)(void *out, const void *in),
+        void (*felem_contract)(void *out, const void *in));
+void ec_GFp_nistp_recode_scalar_bits(unsigned char *sign, unsigned char *digit, unsigned char in);
+#endif
diff --git a/src/lib/libcrypto/ec/ec_lib.c b/src/lib/libcrypto/ec/ec_lib.c
index dd7da0fcf9..25247b5803 100644
--- a/src/lib/libcrypto/ec/ec_lib.c
+++ b/src/lib/libcrypto/ec/ec_lib.c
@@ -425,7 +425,7 @@ int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *
         return group->meth->group_get_curve(group, p, a, b, ctx);
         }
 
-
+#ifndef OPENSSL_NO_EC2M
 int EC_GROUP_set_curve_GF2m(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
         {
         if (group->meth->group_set_curve == 0)
@@ -446,7 +446,7 @@ int EC_GROUP_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM
                 }
         return group->meth->group_get_curve(group, p, a, b, ctx);
         }
-
+#endif
 
 int EC_GROUP_get_degree(const EC_GROUP *group)
         {
@@ -856,7 +856,7 @@ int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
         return group->meth->point_set_affine_coordinates(group, point, x, y, ctx);
         }
 
-
+#ifndef OPENSSL_NO_EC2M
 int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *group, EC_POINT *point,
         const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx)
         {
@@ -872,7 +872,7 @@ int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *group, EC_POINT *point,
                 }
         return group->meth->point_set_affine_coordinates(group, point, x, y, ctx);
         }
-
+#endif
 
 int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group, const EC_POINT *point,
         BIGNUM *x, BIGNUM *y, BN_CTX *ctx)
@@ -890,7 +890,7 @@ int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group, const EC_POINT *p
         return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
         }
 
-
+#ifndef OPENSSL_NO_EC2M
 int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *group, const EC_POINT *point,
         BIGNUM *x, BIGNUM *y, BN_CTX *ctx)
         {
@@ -906,75 +906,7 @@ int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *group, const EC_POINT *
                 }
         return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
         }
-
-
-int EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
-        const BIGNUM *x, int y_bit, BN_CTX *ctx)
-        {
-        if (group->meth->point_set_compressed_coordinates == 0)
-                {
-                ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return 0;
-                }
-        if (group->meth != point->meth)
-                {
-                ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP, EC_R_INCOMPATIBLE_OBJECTS);
-                return 0;
-                }
-        return group->meth->point_set_compressed_coordinates(group, point, x, y_bit, ctx);
-        }
-
-
-int EC_POINT_set_compressed_coordinates_GF2m(const EC_GROUP *group, EC_POINT *point,
-        const BIGNUM *x, int y_bit, BN_CTX *ctx)
-        {
-        if (group->meth->point_set_compressed_coordinates == 0)
-                {
-                ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return 0;
-                }
-        if (group->meth != point->meth)
-                {
-                ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GF2M, EC_R_INCOMPATIBLE_OBJECTS);
-                return 0;
-                }
-        return group->meth->point_set_compressed_coordinates(group, point, x, y_bit, ctx);
-        }
-
-
-size_t EC_POINT_point2oct(const EC_GROUP *group, const EC_POINT *point, point_conversion_form_t form,
-        unsigned char *buf, size_t len, BN_CTX *ctx)
-        {
-        if (group->meth->point2oct == 0)
-                {
-                ECerr(EC_F_EC_POINT_POINT2OCT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return 0;
-                }
-        if (group->meth != point->meth)
-                {
-                ECerr(EC_F_EC_POINT_POINT2OCT, EC_R_INCOMPATIBLE_OBJECTS);
-                return 0;
-                }
-        return group->meth->point2oct(group, point, form, buf, len, ctx);
-        }
-
-
-int EC_POINT_oct2point(const EC_GROUP *group, EC_POINT *point,
-        const unsigned char *buf, size_t len, BN_CTX *ctx)
-        {
-        if (group->meth->oct2point == 0)
-                {
-                ECerr(EC_F_EC_POINT_OCT2POINT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return 0;
-                }
-        if (group->meth != point->meth)
-                {
-                ECerr(EC_F_EC_POINT_OCT2POINT, EC_R_INCOMPATIBLE_OBJECTS);
-                return 0;
-                }
-        return group->meth->oct2point(group, point, buf, len, ctx);
-        }
-
+#endif
 
 int EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx)
         {
diff --git a/src/lib/libcrypto/ec/ecp_mont.c b/src/lib/libcrypto/ec/ecp_mont.c
index 9fc4a466a5..079e47431b 100644
--- a/src/lib/libcrypto/ec/ecp_mont.c
+++ b/src/lib/libcrypto/ec/ecp_mont.c
@@ -63,12 +63,20 @@
 
 #include <openssl/err.h>
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 #include "ec_lcl.h"
 
 
 const EC_METHOD *EC_GFp_mont_method(void)
         {
+#ifdef OPENSSL_FIPS
+        return fips_ec_gfp_mont_method();
+#else
         static const EC_METHOD ret = {
+                EC_FLAGS_DEFAULT_OCT,
                 NID_X9_62_prime_field,
                 ec_GFp_mont_group_init,
                 ec_GFp_mont_group_finish,
@@ -87,9 +95,7 @@ const EC_METHOD *EC_GFp_mont_method(void)
                 ec_GFp_simple_get_Jprojective_coordinates_GFp,
                 ec_GFp_simple_point_set_affine_coordinates,
                 ec_GFp_simple_point_get_affine_coordinates,
-                ec_GFp_simple_set_compressed_coordinates,
-                ec_GFp_simple_point2oct,
-                ec_GFp_simple_oct2point,
+                0,0,0,
                 ec_GFp_simple_add,
                 ec_GFp_simple_dbl,
                 ec_GFp_simple_invert,
@@ -108,7 +114,9 @@ const EC_METHOD *EC_GFp_mont_method(void)
                 ec_GFp_mont_field_decode,
                 ec_GFp_mont_field_set_to_one };
 
+
         return &ret;
+#endif
         }
 
 
diff --git a/src/lib/libcrypto/ec/ecp_nist.c b/src/lib/libcrypto/ec/ecp_nist.c
index 2a5682ea41..aad2d5f443 100644
--- a/src/lib/libcrypto/ec/ecp_nist.c
+++ b/src/lib/libcrypto/ec/ecp_nist.c
@@ -67,9 +67,17 @@
 #include <openssl/obj_mac.h>
 #include "ec_lcl.h"
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 const EC_METHOD *EC_GFp_nist_method(void)
         {
+#ifdef OPENSSL_FIPS
+        return fips_ec_gfp_nist_method();
+#else
         static const EC_METHOD ret = {
+                EC_FLAGS_DEFAULT_OCT,
                 NID_X9_62_prime_field,
                 ec_GFp_simple_group_init,
                 ec_GFp_simple_group_finish,
@@ -88,9 +96,7 @@ const EC_METHOD *EC_GFp_nist_method(void)
                 ec_GFp_simple_get_Jprojective_coordinates_GFp,
                 ec_GFp_simple_point_set_affine_coordinates,
                 ec_GFp_simple_point_get_affine_coordinates,
-                ec_GFp_simple_set_compressed_coordinates,
-                ec_GFp_simple_point2oct,
-                ec_GFp_simple_oct2point,
+                0,0,0,
                 ec_GFp_simple_add,
                 ec_GFp_simple_dbl,
                 ec_GFp_simple_invert,
@@ -110,6 +116,7 @@ const EC_METHOD *EC_GFp_nist_method(void)
                 0 /* field_set_to_one */ };
 
         return &ret;
+#endif
         }
 
 int ec_GFp_nist_group_copy(EC_GROUP *dest, const EC_GROUP *src)
diff --git a/src/lib/libcrypto/ec/ecp_smpl.c b/src/lib/libcrypto/ec/ecp_smpl.c
index 66a92e2a90..7cbb321f9a 100644
--- a/src/lib/libcrypto/ec/ecp_smpl.c
+++ b/src/lib/libcrypto/ec/ecp_smpl.c
@@ -65,11 +65,19 @@
 #include <openssl/err.h>
 #include <openssl/symhacks.h>
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 #include "ec_lcl.h"
 
 const EC_METHOD *EC_GFp_simple_method(void)
         {
+#ifdef OPENSSL_FIPS
+        return fips_ec_gfp_simple_method();
+#else
         static const EC_METHOD ret = {
+                EC_FLAGS_DEFAULT_OCT,
                 NID_X9_62_prime_field,
                 ec_GFp_simple_group_init,
                 ec_GFp_simple_group_finish,
@@ -88,9 +96,7 @@ const EC_METHOD *EC_GFp_simple_method(void)
                 ec_GFp_simple_get_Jprojective_coordinates_GFp,
                 ec_GFp_simple_point_set_affine_coordinates,
                 ec_GFp_simple_point_get_affine_coordinates,
-                ec_GFp_simple_set_compressed_coordinates,
-                ec_GFp_simple_point2oct,
-                ec_GFp_simple_oct2point,
+                0,0,0,
                 ec_GFp_simple_add,
                 ec_GFp_simple_dbl,
                 ec_GFp_simple_invert,
@@ -110,6 +116,7 @@ const EC_METHOD *EC_GFp_simple_method(void)
                 0 /* field_set_to_one */ };
 
         return &ret;
+#endif
         }
 
 
@@ -633,372 +640,6 @@ int ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP *group, const EC_P
         return ret;
         }
 
-
-int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
-        const BIGNUM *x_, int y_bit, BN_CTX *ctx)
-        {
-        BN_CTX *new_ctx = NULL;
-        BIGNUM *tmp1, *tmp2, *x, *y;
-        int ret = 0;
-
-        /* clear error queue*/
-        ERR_clear_error();
-
-        if (ctx == NULL)
-                {
-                ctx = new_ctx = BN_CTX_new();
-                if (ctx == NULL)
-                        return 0;
-                }
-
-        y_bit = (y_bit != 0);
-
-        BN_CTX_start(ctx);
-        tmp1 = BN_CTX_get(ctx);
-        tmp2 = BN_CTX_get(ctx);
-        x = BN_CTX_get(ctx);
-        y = BN_CTX_get(ctx);
-        if (y == NULL) goto err;
-
-        /* Recover y.  We have a Weierstrass equation
-         *     y^2 = x^3 + a*x + b,
-         * so  y  is one of the square roots of  x^3 + a*x + b.
-         */
-
-        /* tmp1 := x^3 */
-        if (!BN_nnmod(x, x_, &group->field,ctx)) goto err;
-        if (group->meth->field_decode == 0)
-                {
-                /* field_{sqr,mul} work on standard representation */
-                if (!group->meth->field_sqr(group, tmp2, x_, ctx)) goto err;
-                if (!group->meth->field_mul(group, tmp1, tmp2, x_, ctx)) goto err;
-                }
-        else
-                {
-                if (!BN_mod_sqr(tmp2, x_, &group->field, ctx)) goto err;
-                if (!BN_mod_mul(tmp1, tmp2, x_, &group->field, ctx)) goto err;
-                }
-        
-        /* tmp1 := tmp1 + a*x */
-        if (group->a_is_minus3)
-                {
-                if (!BN_mod_lshift1_quick(tmp2, x, &group->field)) goto err;
-                if (!BN_mod_add_quick(tmp2, tmp2, x, &group->field)) goto err;
-                if (!BN_mod_sub_quick(tmp1, tmp1, tmp2, &group->field)) goto err;
-                }
-        else
-                {
-                if (group->meth->field_decode)
-                        {
-                        if (!group->meth->field_decode(group, tmp2, &group->a, ctx)) goto err;
-                        if (!BN_mod_mul(tmp2, tmp2, x, &group->field, ctx)) goto err;
-                        }
-                else
-                        {
-                        /* field_mul works on standard representation */
-                        if (!group->meth->field_mul(group, tmp2, &group->a, x, ctx)) goto err;
-                        }
-                
-                if (!BN_mod_add_quick(tmp1, tmp1, tmp2, &group->field)) goto err;
-                }
-        
-        /* tmp1 := tmp1 + b */
-        if (group->meth->field_decode)
-                {
-                if (!group->meth->field_decode(group, tmp2, &group->b, ctx)) goto err;
-                if (!BN_mod_add_quick(tmp1, tmp1, tmp2, &group->field)) goto err;
-                }
-        else
-                {
-                if (!BN_mod_add_quick(tmp1, tmp1, &group->b, &group->field)) goto err;
-                }
-        
-        if (!BN_mod_sqrt(y, tmp1, &group->field, ctx))
-                {
-                unsigned long err = ERR_peek_last_error();
-                
-                if (ERR_GET_LIB(err) == ERR_LIB_BN && ERR_GET_REASON(err) == BN_R_NOT_A_SQUARE)
-                        {
-                        ERR_clear_error();
-                        ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES, EC_R_INVALID_COMPRESSED_POINT);
-                        }
-                else
-                        ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES, ERR_R_BN_LIB);
-                goto err;
-                }
-
-        if (y_bit != BN_is_odd(y))
-                {
-                if (BN_is_zero(y))
-                        {
-                        int kron;
-
-                        kron = BN_kronecker(x, &group->field, ctx);
-                        if (kron == -2) goto err;
-
-                        if (kron == 1)
-                                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES, EC_R_INVALID_COMPRESSION_BIT);
-                        else
-                                /* BN_mod_sqrt() should have cought this error (not a square) */
-                                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES, EC_R_INVALID_COMPRESSED_POINT);
-                        goto err;
-                        }
-                if (!BN_usub(y, &group->field, y)) goto err;
-                }
-        if (y_bit != BN_is_odd(y))
-                {
-                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES, ERR_R_INTERNAL_ERROR);
-                goto err;
-                }
-
-        if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx)) goto err;
-
-        ret = 1;
-
- err:
-        BN_CTX_end(ctx);
-        if (new_ctx != NULL)
-                BN_CTX_free(new_ctx);
-        return ret;
-        }
-
-
-size_t ec_GFp_simple_point2oct(const EC_GROUP *group, const EC_POINT *point, point_conversion_form_t form,
-        unsigned char *buf, size_t len, BN_CTX *ctx)
-        {
-        size_t ret;
-        BN_CTX *new_ctx = NULL;
-        int used_ctx = 0;
-        BIGNUM *x, *y;
-        size_t field_len, i, skip;
-
-        if ((form != POINT_CONVERSION_COMPRESSED)
-                && (form != POINT_CONVERSION_UNCOMPRESSED)
-                && (form != POINT_CONVERSION_HYBRID))
-                {
-                ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, EC_R_INVALID_FORM);
-                goto err;
-                }
-
-        if (EC_POINT_is_at_infinity(group, point))
-                {
-                /* encodes to a single 0 octet */
-                if (buf != NULL)
-                        {
-                        if (len < 1)
-                                {
-                                ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
-                                return 0;
-                                }
-                        buf[0] = 0;
-                        }
-                return 1;
-                }
-
-
-        /* ret := required output buffer length */
-        field_len = BN_num_bytes(&group->field);
-        ret = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2*field_len;
-
-        /* if 'buf' is NULL, just return required length */
-        if (buf != NULL)
-                {
-                if (len < ret)
-                        {
-                        ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
-                        goto err;
-                        }
-
-                if (ctx == NULL)
-                        {
-                        ctx = new_ctx = BN_CTX_new();
-                        if (ctx == NULL)
-                                return 0;
-                        }
-
-                BN_CTX_start(ctx);
-                used_ctx = 1;
-                x = BN_CTX_get(ctx);
-                y = BN_CTX_get(ctx);
-                if (y == NULL) goto err;
-
-                if (!EC_POINT_get_affine_coordinates_GFp(group, point, x, y, ctx)) goto err;
-
-                if ((form == POINT_CONVERSION_COMPRESSED || form == POINT_CONVERSION_HYBRID) && BN_is_odd(y))
-                        buf[0] = form + 1;
-                else
-                        buf[0] = form;
-        
-                i = 1;
-                
-                skip = field_len - BN_num_bytes(x);
-                if (skip > field_len)
-                        {
-                        ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
-                        goto err;
-                        }
-                while (skip > 0)
-                        {
-                        buf[i++] = 0;
-                        skip--;
-                        }
-                skip = BN_bn2bin(x, buf + i);
-                i += skip;
-                if (i != 1 + field_len)
-                        {
-                        ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
-                        goto err;
-                        }
-
-                if (form == POINT_CONVERSION_UNCOMPRESSED || form == POINT_CONVERSION_HYBRID)
-                        {
-                        skip = field_len - BN_num_bytes(y);
-                        if (skip > field_len)
-                                {
-                                ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
-                                goto err;
-                                }
-                        while (skip > 0)
-                                {
-                                buf[i++] = 0;
-                                skip--;
-                                }
-                        skip = BN_bn2bin(y, buf + i);
-                        i += skip;
-                        }
-
-                if (i != ret)
-                        {
-                        ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
-                        goto err;
-                        }
-                }
-        
-        if (used_ctx)
-                BN_CTX_end(ctx);
-        if (new_ctx != NULL)
-                BN_CTX_free(new_ctx);
-        return ret;
-
- err:
-        if (used_ctx)
-                BN_CTX_end(ctx);
-        if (new_ctx != NULL)
-                BN_CTX_free(new_ctx);
-        return 0;
-        }
-
-
-int ec_GFp_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
-        const unsigned char *buf, size_t len, BN_CTX *ctx)
-        {
-        point_conversion_form_t form;
-        int y_bit;
-        BN_CTX *new_ctx = NULL;
-        BIGNUM *x, *y;
-        size_t field_len, enc_len;
-        int ret = 0;
-
-        if (len == 0)
-                {
-                ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_BUFFER_TOO_SMALL);
-                return 0;
-                }
-        form = buf[0];
-        y_bit = form & 1;
-        form = form & ~1U;
-        if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED)
-                && (form != POINT_CONVERSION_UNCOMPRESSED)
-                && (form != POINT_CONVERSION_HYBRID))
-                {
-                ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                return 0;
-                }
-        if ((form == 0 || form == POINT_CONVERSION_UNCOMPRESSED) && y_bit)
-                {
-                ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                return 0;
-                }
-
-        if (form == 0)
-                {
-                if (len != 1)
-                        {
-                        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                        return 0;
-                        }
-
-                return EC_POINT_set_to_infinity(group, point);
-                }
-        
-        field_len = BN_num_bytes(&group->field);
-        enc_len = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2*field_len;
-
-        if (len != enc_len)
-                {
-                ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                return 0;
-                }
-
-        if (ctx == NULL)
-                {
-                ctx = new_ctx = BN_CTX_new();
-                if (ctx == NULL)
-                        return 0;
-                }
-
-        BN_CTX_start(ctx);
-        x = BN_CTX_get(ctx);
-        y = BN_CTX_get(ctx);
-        if (y == NULL) goto err;
-
-        if (!BN_bin2bn(buf + 1, field_len, x)) goto err;
-        if (BN_ucmp(x, &group->field) >= 0)
-                {
-                ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                goto err;
-                }
-
-        if (form == POINT_CONVERSION_COMPRESSED)
-                {
-                if (!EC_POINT_set_compressed_coordinates_GFp(group, point, x, y_bit, ctx)) goto err;
-                }
-        else
-                {
-                if (!BN_bin2bn(buf + 1 + field_len, field_len, y)) goto err;
-                if (BN_ucmp(y, &group->field) >= 0)
-                        {
-                        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                        goto err;
-                        }
-                if (form == POINT_CONVERSION_HYBRID)
-                        {
-                        if (y_bit != BN_is_odd(y))
-                                {
-                                ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
-                                goto err;
-                                }
-                        }
-
-                if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx)) goto err;
-                }
-        
-        if (!EC_POINT_is_on_curve(group, point, ctx)) /* test required by X9.62 */
-                {
-                ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
-                goto err;
-                }
-
-        ret = 1;
-        
- err:
-        BN_CTX_end(ctx);
-        if (new_ctx != NULL)
-                BN_CTX_free(new_ctx);
-        return ret;
-        }
-
-
 int ec_GFp_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx)
         {
         int (*field_mul)(const EC_GROUP *, BIGNUM *, const BIGNUM *, const BIGNUM *, BN_CTX *);
diff --git a/src/lib/libcrypto/ec/ectest.c b/src/lib/libcrypto/ec/ectest.c
index 7509cb9c7c..f107782de0 100644
--- a/src/lib/libcrypto/ec/ectest.c
+++ b/src/lib/libcrypto/ec/ectest.c
@@ -94,6 +94,7 @@ int main(int argc, char * argv[]) { puts("Elliptic curves are disabled."); retur
 #include <openssl/objects.h>
 #include <openssl/rand.h>
 #include <openssl/bn.h>
+#include <openssl/opensslconf.h>
 
 #if defined(_MSC_VER) && defined(_MIPS_) && (_MSC_VER/100==12)
 /* suppress "too big too optimize" warning */
@@ -107,10 +108,6 @@ int main(int argc, char * argv[]) { puts("Elliptic curves are disabled."); retur
         EXIT(1); \
 } while (0)
 
-void prime_field_tests(void);
-void char2_field_tests(void);
-void internal_curve_test(void);
-
 #define TIMING_BASE_PT 0
 #define TIMING_RAND_PT 1
 #define TIMING_SIMUL 2
@@ -195,7 +192,50 @@ static void timings(EC_GROUP *group, int type, BN_CTX *ctx)
         }
 #endif
 
-void prime_field_tests()
+/* test multiplication with group order, long and negative scalars */
+static void group_order_tests(EC_GROUP *group)
+        {
+        BIGNUM *n1, *n2, *order;
+        EC_POINT *P = EC_POINT_new(group);
+        EC_POINT *Q = EC_POINT_new(group);
+        BN_CTX *ctx = BN_CTX_new();
+
+        n1 = BN_new(); n2 = BN_new(); order = BN_new();
+        fprintf(stdout, "verify group order ...");
+        fflush(stdout);
+        if (!EC_GROUP_get_order(group, order, ctx)) ABORT;
+        if (!EC_POINT_mul(group, Q, order, NULL, NULL, ctx)) ABORT;
+        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
+        fprintf(stdout, ".");
+        fflush(stdout);
+        if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
+        if (!EC_POINT_mul(group, Q, order, NULL, NULL, ctx)) ABORT;
+        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
+        fprintf(stdout, " ok\n");
+        fprintf(stdout, "long/negative scalar tests ... ");
+        if (!BN_one(n1)) ABORT;
+        /* n1 = 1 - order */
+        if (!BN_sub(n1, n1, order)) ABORT;
+        if(!EC_POINT_mul(group, Q, NULL, P, n1, ctx)) ABORT;
+        if (0 != EC_POINT_cmp(group, Q, P, ctx)) ABORT;
+        /* n2 = 1 + order */
+        if (!BN_add(n2, order, BN_value_one())) ABORT;
+        if(!EC_POINT_mul(group, Q, NULL, P, n2, ctx)) ABORT;
+        if (0 != EC_POINT_cmp(group, Q, P, ctx)) ABORT;
+        /* n2 = (1 - order) * (1 + order) */
+        if (!BN_mul(n2, n1, n2, ctx)) ABORT;
+        if(!EC_POINT_mul(group, Q, NULL, P, n2, ctx)) ABORT;
+        if (0 != EC_POINT_cmp(group, Q, P, ctx)) ABORT;
+        fprintf(stdout, "ok\n");
+        EC_POINT_free(P);
+        EC_POINT_free(Q);
+        BN_free(n1);
+        BN_free(n2);
+        BN_free(order);
+        BN_CTX_free(ctx);
+        }
+
+static void prime_field_tests(void)
         {       
         BN_CTX *ctx = NULL;
         BIGNUM *p, *a, *b;
@@ -321,21 +361,21 @@ void prime_field_tests()
         if (len == 0) ABORT;
         if (!EC_POINT_oct2point(group, P, buf, len, ctx)) ABORT;
         if (0 != EC_POINT_cmp(group, P, Q, ctx)) ABORT;
-        fprintf(stdout, "Generator as octect string, compressed form:\n     ");
+        fprintf(stdout, "Generator as octet string, compressed form:\n     ");
         for (i = 0; i < len; i++) fprintf(stdout, "%02X", buf[i]);
         
         len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_UNCOMPRESSED, buf, sizeof buf, ctx);
         if (len == 0) ABORT;
         if (!EC_POINT_oct2point(group, P, buf, len, ctx)) ABORT;
         if (0 != EC_POINT_cmp(group, P, Q, ctx)) ABORT;
-        fprintf(stdout, "\nGenerator as octect string, uncompressed form:\n     ");
+        fprintf(stdout, "\nGenerator as octet string, uncompressed form:\n     ");
         for (i = 0; i < len; i++) fprintf(stdout, "%02X", buf[i]);
         
         len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_HYBRID, buf, sizeof buf, ctx);
         if (len == 0) ABORT;
         if (!EC_POINT_oct2point(group, P, buf, len, ctx)) ABORT;
         if (0 != EC_POINT_cmp(group, P, Q, ctx)) ABORT;
-        fprintf(stdout, "\nGenerator as octect string, hybrid form:\n     ");
+        fprintf(stdout, "\nGenerator as octet string, hybrid form:\n     ");
         for (i = 0; i < len; i++) fprintf(stdout, "%02X", buf[i]);
         
         if (!EC_POINT_get_Jprojective_coordinates_GFp(group, R, x, y, z, ctx)) ABORT;
@@ -381,17 +421,7 @@ void prime_field_tests()
         if (EC_GROUP_get_degree(group) != 160) ABORT;
         fprintf(stdout, " ok\n");
         
-        fprintf(stdout, "verify group order ...");
-        fflush(stdout);
-        if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
-        fprintf(stdout, ".");
-        fflush(stdout);
-        if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
-        fprintf(stdout, " ok\n");
+        group_order_tests(group);
 
         if (!(P_160 = EC_GROUP_new(EC_GROUP_method_of(group)))) ABORT;
         if (!EC_GROUP_copy(P_160, group)) ABORT;
@@ -425,17 +455,7 @@ void prime_field_tests()
         if (EC_GROUP_get_degree(group) != 192) ABORT;
         fprintf(stdout, " ok\n");
         
-        fprintf(stdout, "verify group order ...");
-        fflush(stdout);
-        if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
-        fprintf(stdout, ".");
-        fflush(stdout);
-        if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
-        fprintf(stdout, " ok\n");
+        group_order_tests(group);
 
         if (!(P_192 = EC_GROUP_new(EC_GROUP_method_of(group)))) ABORT;
         if (!EC_GROUP_copy(P_192, group)) ABORT;
@@ -469,17 +489,7 @@ void prime_field_tests()
         if (EC_GROUP_get_degree(group) != 224) ABORT;
         fprintf(stdout, " ok\n");
         
-        fprintf(stdout, "verify group order ...");
-        fflush(stdout);
-        if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
-        fprintf(stdout, ".");
-        fflush(stdout);
-        if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
-        fprintf(stdout, " ok\n");
+        group_order_tests(group);
 
         if (!(P_224 = EC_GROUP_new(EC_GROUP_method_of(group)))) ABORT;
         if (!EC_GROUP_copy(P_224, group)) ABORT;
@@ -514,17 +524,7 @@ void prime_field_tests()
         if (EC_GROUP_get_degree(group) != 256) ABORT;
         fprintf(stdout, " ok\n");
         
-        fprintf(stdout, "verify group order ...");
-        fflush(stdout);
-        if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
-        fprintf(stdout, ".");
-        fflush(stdout);
-        if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
-        fprintf(stdout, " ok\n");
+        group_order_tests(group);
 
         if (!(P_256 = EC_GROUP_new(EC_GROUP_method_of(group)))) ABORT;
         if (!EC_GROUP_copy(P_256, group)) ABORT;
@@ -563,18 +563,8 @@ void prime_field_tests()
         fprintf(stdout, "verify degree ...");
         if (EC_GROUP_get_degree(group) != 384) ABORT;
         fprintf(stdout, " ok\n");
-        
-        fprintf(stdout, "verify group order ...");
-        fflush(stdout);
-        if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
-        fprintf(stdout, ".");
-        fflush(stdout);
-        if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
-        fprintf(stdout, " ok\n");
+
+        group_order_tests(group);
 
         if (!(P_384 = EC_GROUP_new(EC_GROUP_method_of(group)))) ABORT;
         if (!EC_GROUP_copy(P_384, group)) ABORT;
@@ -619,18 +609,8 @@ void prime_field_tests()
         fprintf(stdout, "verify degree ...");
         if (EC_GROUP_get_degree(group) != 521) ABORT;
         fprintf(stdout, " ok\n");
-        
-        fprintf(stdout, "verify group order ...");
-        fflush(stdout);
-        if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
-        fprintf(stdout, ".");
-        fflush(stdout);
-        if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
-        fprintf(stdout, " ok\n");
+
+        group_order_tests(group);
 
         if (!(P_521 = EC_GROUP_new(EC_GROUP_method_of(group)))) ABORT;
         if (!EC_GROUP_copy(P_521, group)) ABORT;
@@ -659,6 +639,7 @@ void prime_field_tests()
                 points[2] = Q;
                 points[3] = Q;
 
+                if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
                 if (!BN_add(y, z, BN_value_one())) ABORT;
                 if (BN_is_odd(y)) ABORT;
                 if (!BN_rshift1(y, y)) ABORT;
@@ -792,22 +773,14 @@ void prime_field_tests()
         fprintf(stdout, "verify degree ..."); \
         if (EC_GROUP_get_degree(group) != _degree) ABORT; \
         fprintf(stdout, " ok\n"); \
-        fprintf(stdout, "verify group order ..."); \
-        fflush(stdout); \
-        if (!EC_GROUP_get_order(group, z, ctx)) ABORT; \
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT; \
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT; \
-        fprintf(stdout, "."); \
-        fflush(stdout); \
-        if (!EC_GROUP_precompute_mult(group, ctx)) ABORT; \
-        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT; \
-        if (!EC_POINT_is_at_infinity(group, Q)) ABORT; \
-        fprintf(stdout, " ok\n"); \
+        group_order_tests(group); \
         if (!(_variable = EC_GROUP_new(EC_GROUP_method_of(group)))) ABORT; \
-        if (!EC_GROUP_copy(_variable, group)) ABORT;
+        if (!EC_GROUP_copy(_variable, group)) ABORT; \
 
-void char2_field_tests()
-        {       
+#ifndef OPENSSL_NO_EC2M
+
+static void char2_field_tests(void)
+        {
         BN_CTX *ctx = NULL;
         BIGNUM *p, *a, *b;
         EC_GROUP *group;
@@ -1239,8 +1212,9 @@ void char2_field_tests()
         if (C2_B571) EC_GROUP_free(C2_B571);
 
         }
+#endif
 
-void internal_curve_test(void)
+static void internal_curve_test(void)
         {
         EC_builtin_curve *curves = NULL;
         size_t crv_len = 0, n = 0;
@@ -1287,13 +1261,189 @@ void internal_curve_test(void)
                 EC_GROUP_free(group);
                 }
         if (ok)
-                fprintf(stdout, " ok\n");
+                fprintf(stdout, " ok\n\n");
         else
-                fprintf(stdout, " failed\n");
+                {
+                fprintf(stdout, " failed\n\n");
+                ABORT;
+                }
         OPENSSL_free(curves);
         return;
         }
 
+#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
+/* nistp_test_params contains magic numbers for testing our optimized
+ * implementations of several NIST curves with characteristic > 3. */
+struct nistp_test_params
+        {
+        const EC_METHOD* (*meth) ();
+        int degree;
+        /* Qx, Qy and D are taken from
+         * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/ECDSA_Prime.pdf
+         * Otherwise, values are standard curve parameters from FIPS 180-3 */
+        const char *p, *a, *b, *Qx, *Qy, *Gx, *Gy, *order, *d;
+        };
+
+static const struct nistp_test_params nistp_tests_params[] =
+        {
+                {
+                /* P-224 */
+                EC_GFp_nistp224_method,
+                224,
+                "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001", /* p */
+                "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE", /* a */
+                "B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4", /* b */
+                "E84FB0B8E7000CB657D7973CF6B42ED78B301674276DF744AF130B3E", /* Qx */
+                "4376675C6FC5612C21A0FF2D2A89D2987DF7A2BC52183B5982298555", /* Qy */
+                "B70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21", /* Gx */
+                "BD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34", /* Gy */
+                "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D", /* order */
+                "3F0C488E987C80BE0FEE521F8D90BE6034EC69AE11CA72AA777481E8", /* d */
+                },
+                {
+                /* P-256 */
+                EC_GFp_nistp256_method,
+                256,
+                "ffffffff00000001000000000000000000000000ffffffffffffffffffffffff", /* p */
+                "ffffffff00000001000000000000000000000000fffffffffffffffffffffffc", /* a */
+                "5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b", /* b */
+                "b7e08afdfe94bad3f1dc8c734798ba1c62b3a0ad1e9ea2a38201cd0889bc7a19", /* Qx */
+                "3603f747959dbf7a4bb226e41928729063adc7ae43529e61b563bbc606cc5e09", /* Qy */
+                "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296", /* Gx */
+                "4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5", /* Gy */
+                "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551", /* order */
+                "c477f9f65c22cce20657faa5b2d1d8122336f851a508a1ed04e479c34985bf96", /* d */
+                },
+                {
+                /* P-521 */
+                EC_GFp_nistp521_method,
+                521,
+                "1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", /* p */
+                "1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc", /* a */
+                "051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00", /* b */
+                "0098e91eef9a68452822309c52fab453f5f117c1da8ed796b255e9ab8f6410cca16e59df403a6bdc6ca467a37056b1e54b3005d8ac030decfeb68df18b171885d5c4", /* Qx */
+                "0164350c321aecfc1cca1ba4364c9b15656150b4b78d6a48d7d28e7f31985ef17be8554376b72900712c4b83ad668327231526e313f5f092999a4632fd50d946bc2e", /* Qy */
+                "c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66", /* Gx */
+                "11839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650", /* Gy */
+                "1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409", /* order */
+                "0100085f47b8e1b8b11b7eb33028c0b2888e304bfc98501955b45bba1478dc184eeedf09b86a5f7c21994406072787205e69a63709fe35aa93ba333514b24f961722", /* d */
+                },
+        };
+
+void nistp_single_test(const struct nistp_test_params *test)
+        {
+        BN_CTX *ctx;
+        BIGNUM *p, *a, *b, *x, *y, *n, *m, *order;
+        EC_GROUP *NISTP;
+        EC_POINT *G, *P, *Q, *Q_CHECK;
+
+        fprintf(stdout, "\nNIST curve P-%d (optimised implementation):\n", test->degree);
+        ctx = BN_CTX_new();
+        p = BN_new();
+        a = BN_new();
+        b = BN_new();
+        x = BN_new(); y = BN_new();
+        m = BN_new(); n = BN_new(); order = BN_new();
+
+        NISTP = EC_GROUP_new(test->meth());
+        if(!NISTP) ABORT;
+        if (!BN_hex2bn(&p, test->p)) ABORT;
+        if (1 != BN_is_prime_ex(p, BN_prime_checks, ctx, NULL)) ABORT;
+        if (!BN_hex2bn(&a, test->a)) ABORT;
+        if (!BN_hex2bn(&b, test->b)) ABORT;
+        if (!EC_GROUP_set_curve_GFp(NISTP, p, a, b, ctx)) ABORT;
+        G = EC_POINT_new(NISTP);
+        P = EC_POINT_new(NISTP);
+        Q = EC_POINT_new(NISTP);
+        Q_CHECK = EC_POINT_new(NISTP);
+        if(!BN_hex2bn(&x, test->Qx)) ABORT;
+        if(!BN_hex2bn(&y, test->Qy)) ABORT;
+        if(!EC_POINT_set_affine_coordinates_GFp(NISTP, Q_CHECK, x, y, ctx)) ABORT;
+        if (!BN_hex2bn(&x, test->Gx)) ABORT;
+        if (!BN_hex2bn(&y, test->Gy)) ABORT;
+        if (!EC_POINT_set_affine_coordinates_GFp(NISTP, G, x, y, ctx)) ABORT;
+        if (!BN_hex2bn(&order, test->order)) ABORT;
+        if (!EC_GROUP_set_generator(NISTP, G, order, BN_value_one())) ABORT;
+
+        fprintf(stdout, "verify degree ... ");
+        if (EC_GROUP_get_degree(NISTP) != test->degree) ABORT;
+        fprintf(stdout, "ok\n");
+
+        fprintf(stdout, "NIST test vectors ... ");
+        if (!BN_hex2bn(&n, test->d)) ABORT;
+        /* fixed point multiplication */
+        EC_POINT_mul(NISTP, Q, n, NULL, NULL, ctx);
+        if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)) ABORT;
+        /* random point multiplication */
+        EC_POINT_mul(NISTP, Q, NULL, G, n, ctx);
+        if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)) ABORT;
+
+        /* set generator to P = 2*G, where G is the standard generator */
+        if (!EC_POINT_dbl(NISTP, P, G, ctx)) ABORT;
+        if (!EC_GROUP_set_generator(NISTP, P, order, BN_value_one())) ABORT;
+        /* set the scalar to m=n/2, where n is the NIST test scalar */
+        if (!BN_rshift(m, n, 1)) ABORT;
+
+        /* test the non-standard generator */
+        /* fixed point multiplication */
+        EC_POINT_mul(NISTP, Q, m, NULL, NULL, ctx);
+        if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)) ABORT;
+        /* random point multiplication */
+        EC_POINT_mul(NISTP, Q, NULL, P, m, ctx);
+        if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)) ABORT;
+
+        /* now repeat all tests with precomputation */
+        if (!EC_GROUP_precompute_mult(NISTP, ctx)) ABORT;
+
+        /* fixed point multiplication */
+        EC_POINT_mul(NISTP, Q, m, NULL, NULL, ctx);
+        if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)) ABORT;
+        /* random point multiplication */
+        EC_POINT_mul(NISTP, Q, NULL, P, m, ctx);
+        if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)) ABORT;
+
+        /* reset generator */
+        if (!EC_GROUP_set_generator(NISTP, G, order, BN_value_one())) ABORT;
+        /* fixed point multiplication */
+        EC_POINT_mul(NISTP, Q, n, NULL, NULL, ctx);
+        if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)) ABORT;
+        /* random point multiplication */
+        EC_POINT_mul(NISTP, Q, NULL, G, n, ctx);
+        if (0 != EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)) ABORT;
+
+        fprintf(stdout, "ok\n");
+        group_order_tests(NISTP);
+#if 0
+        timings(NISTP, TIMING_BASE_PT, ctx);
+        timings(NISTP, TIMING_RAND_PT, ctx);
+#endif
+        EC_GROUP_free(NISTP);
+        EC_POINT_free(G);
+        EC_POINT_free(P);
+        EC_POINT_free(Q);
+        EC_POINT_free(Q_CHECK);
+        BN_free(n);
+        BN_free(m);
+        BN_free(p);
+        BN_free(a);
+        BN_free(b);
+        BN_free(x);
+        BN_free(y);
+        BN_free(order);
+        BN_CTX_free(ctx);
+        }
+
+void nistp_tests()
+        {
+        unsigned i;
+
+        for (i = 0; i < sizeof(nistp_tests_params) / sizeof(struct nistp_test_params); i++)
+                {
+                nistp_single_test(&nistp_tests_params[i]);
+                }
+        }
+#endif
+
 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 
 int main(int argc, char *argv[])
@@ -1317,7 +1467,12 @@ int main(int argc, char *argv[])
 
         prime_field_tests();
         puts("");
+#ifndef OPENSSL_NO_EC2M
         char2_field_tests();
+#endif
+#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
+        nistp_tests();
+#endif
         /* test the internal curves */
         internal_curve_test();
 
diff --git a/src/lib/libcrypto/engine/Makefile b/src/lib/libcrypto/engine/Makefile
index 9c214824eb..d29bdd09a0 100644
--- a/src/lib/libcrypto/engine/Makefile
+++ b/src/lib/libcrypto/engine/Makefile
@@ -21,12 +21,14 @@ LIBSRC= eng_err.c eng_lib.c eng_list.c eng_init.c eng_ctrl.c \
         eng_table.c eng_pkey.c eng_fat.c eng_all.c \
         tb_rsa.c tb_dsa.c tb_ecdsa.c tb_dh.c tb_ecdh.c tb_rand.c tb_store.c \
         tb_cipher.c tb_digest.c tb_pkmeth.c tb_asnmth.c \
-        eng_openssl.c eng_cnf.c eng_dyn.c eng_cryptodev.c
+        eng_openssl.c eng_cnf.c eng_dyn.c eng_cryptodev.c \
+        eng_rsax.c eng_rdrand.c
 LIBOBJ= eng_err.o eng_lib.o eng_list.o eng_init.o eng_ctrl.o \
         eng_table.o eng_pkey.o eng_fat.o eng_all.o \
         tb_rsa.o tb_dsa.o tb_ecdsa.o tb_dh.o tb_ecdh.o tb_rand.o tb_store.o \
         tb_cipher.o tb_digest.o tb_pkmeth.o tb_asnmth.o \
-        eng_openssl.o eng_cnf.o eng_dyn.o eng_cryptodev.o
+        eng_openssl.o eng_cnf.o eng_dyn.o eng_cryptodev.o \
+        eng_rsax.o eng_rdrand.o
 
 SRC= $(LIBSRC)
 
@@ -249,6 +251,34 @@ eng_pkey.o: ../../include/openssl/pkcs7.h ../../include/openssl/safestack.h
 eng_pkey.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 eng_pkey.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
 eng_pkey.o: ../../include/openssl/x509_vfy.h ../cryptlib.h eng_int.h eng_pkey.c
+eng_rdrand.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+eng_rdrand.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
+eng_rdrand.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+eng_rdrand.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
+eng_rdrand.o: ../../include/openssl/engine.h ../../include/openssl/err.h
+eng_rdrand.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
+eng_rdrand.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+eng_rdrand.o: ../../include/openssl/opensslconf.h
+eng_rdrand.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+eng_rdrand.o: ../../include/openssl/pkcs7.h ../../include/openssl/rand.h
+eng_rdrand.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+eng_rdrand.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+eng_rdrand.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+eng_rdrand.o: eng_rdrand.c
+eng_rsax.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+eng_rsax.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+eng_rsax.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+eng_rsax.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
+eng_rsax.o: ../../include/openssl/ecdsa.h ../../include/openssl/engine.h
+eng_rsax.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+eng_rsax.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
+eng_rsax.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+eng_rsax.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+eng_rsax.o: ../../include/openssl/pkcs7.h ../../include/openssl/rsa.h
+eng_rsax.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+eng_rsax.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+eng_rsax.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+eng_rsax.o: eng_rsax.c
 eng_table.o: ../../e_os.h ../../include/openssl/asn1.h
 eng_table.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 eng_table.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
diff --git a/src/lib/libcrypto/engine/eng_all.c b/src/lib/libcrypto/engine/eng_all.c
index 79d1f2beff..0ae5d672b1 100644
--- a/src/lib/libcrypto/engine/eng_all.c
+++ b/src/lib/libcrypto/engine/eng_all.c
@@ -61,6 +61,8 @@
 
 void ENGINE_load_builtin_engines(void)
         {
+        /* Some ENGINEs need this */
+        OPENSSL_cpuid_setup();
 #if 0
         /* There's no longer any need for an "openssl" ENGINE unless, one day,
          * it is the *only* way for standard builtin implementations to be be
@@ -72,10 +74,12 @@ void ENGINE_load_builtin_engines(void)
         ENGINE_load_cryptodev();
 #endif
 
-#if !defined(OPENSSL_NO_HW) && !defined(OPENSSL_NO_HW_AESNI)
-        ENGINE_load_aesni();
+#ifndef OPENSSL_NO_RSAX
+        ENGINE_load_rsax();
+#endif
+#ifndef OPENSSL_NO_RDRAND
+        ENGINE_load_rdrand();
 #endif
-
         ENGINE_load_dynamic();
 #ifndef OPENSSL_NO_STATIC_ENGINE
 #ifndef OPENSSL_NO_HW
@@ -117,6 +121,7 @@ void ENGINE_load_builtin_engines(void)
         ENGINE_load_capi();
 #endif
 #endif
+        ENGINE_register_all_complete();
         }
 
 #if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
diff --git a/src/lib/libcrypto/engine/eng_cryptodev.c b/src/lib/libcrypto/engine/eng_cryptodev.c
index 10b3856b4e..a7abac1a7b 100644
--- a/src/lib/libcrypto/engine/eng_cryptodev.c
+++ b/src/lib/libcrypto/engine/eng_cryptodev.c
@@ -79,8 +79,6 @@ struct dev_crypto_state {
         unsigned char digest_res[HASH_MAX_LEN];
         char *mac_data;
         int mac_len;
-
-        int copy;
 #endif
 };
 
@@ -199,6 +197,7 @@ get_dev_crypto(void)
 
         if ((fd = open_dev_crypto()) == -1)
                 return (-1);
+#ifndef CRIOGET_NOT_NEEDED
         if (ioctl(fd, CRIOGET, &retfd) == -1)
                 return (-1);
 
@@ -207,9 +206,19 @@ get_dev_crypto(void)
                 close(retfd);
                 return (-1);
         }
+#else
+        retfd = fd;
+#endif
         return (retfd);
 }
 
+static void put_dev_crypto(int fd)
+{
+#ifndef CRIOGET_NOT_NEEDED
+        close(fd);
+#endif
+}
+
 /* Caching version for asym operations */
 static int
 get_asym_dev_crypto(void)
@@ -251,7 +260,7 @@ get_cryptodev_ciphers(const int **cnids)
                     ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
                         nids[count++] = ciphers[i].nid;
         }
-        close(fd);
+        put_dev_crypto(fd);
 
         if (count > 0)
                 *cnids = nids;
@@ -290,7 +299,7 @@ get_cryptodev_digests(const int **cnids)
                     ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
                         nids[count++] = digests[i].nid;
         }
-        close(fd);
+        put_dev_crypto(fd);
 
         if (count > 0)
                 *cnids = nids;
@@ -435,7 +444,7 @@ cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
         sess->cipher = cipher;
 
         if (ioctl(state->d_fd, CIOCGSESSION, sess) == -1) {
-                close(state->d_fd);
+                put_dev_crypto(state->d_fd);
                 state->d_fd = -1;
                 return (0);
         }
@@ -472,7 +481,7 @@ cryptodev_cleanup(EVP_CIPHER_CTX *ctx)
         } else {
                 ret = 1;
         }
-        close(state->d_fd);
+        put_dev_crypto(state->d_fd);
         state->d_fd = -1;
 
         return (ret);
@@ -685,7 +694,7 @@ static int cryptodev_digest_init(EVP_MD_CTX *ctx)
         sess->mac = digest;
 
         if (ioctl(state->d_fd, CIOCGSESSION, sess) < 0) {
-                close(state->d_fd);
+                put_dev_crypto(state->d_fd);
                 state->d_fd = -1;
                 printf("cryptodev_digest_init: Open session failed\n");
                 return (0);
@@ -757,14 +766,12 @@ static int cryptodev_digest_final(EVP_MD_CTX *ctx, unsigned char *md)
         if (! (ctx->flags & EVP_MD_CTX_FLAG_ONESHOT) ) {
                 /* if application doesn't support one buffer */
                 memset(&cryp, 0, sizeof(cryp));
-
                 cryp.ses = sess->ses;
                 cryp.flags = 0;
                 cryp.len = state->mac_len;
                 cryp.src = state->mac_data;
                 cryp.dst = NULL;
                 cryp.mac = (caddr_t)md;
-
                 if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
                         printf("cryptodev_digest_final: digest failed\n");
                         return (0);
@@ -785,6 +792,9 @@ static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx)
         struct dev_crypto_state *state = ctx->md_data;
         struct session_op *sess = &state->d_sess;
 
+        if (state == NULL)
+          return 0;
+
         if (state->d_fd < 0) {
                 printf("cryptodev_digest_cleanup: illegal input\n");
                 return (0);
@@ -796,16 +806,13 @@ static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx)
                 state->mac_len = 0;
         }
 
-        if (state->copy)
-                return 1;
-
         if (ioctl(state->d_fd, CIOCFSESSION, &sess->ses) < 0) {
                 printf("cryptodev_digest_cleanup: failed to close session\n");
                 ret = 0;
         } else {
                 ret = 1;
         }
-        close(state->d_fd);     
+        put_dev_crypto(state->d_fd);    
         state->d_fd = -1;
 
         return (ret);
@@ -815,15 +822,39 @@ static int cryptodev_digest_copy(EVP_MD_CTX *to,const EVP_MD_CTX *from)
 {
         struct dev_crypto_state *fstate = from->md_data;
         struct dev_crypto_state *dstate = to->md_data;
+        struct session_op *sess;
+        int digest;
 
-        memcpy(dstate, fstate, sizeof(struct dev_crypto_state));
+        if (dstate == NULL || fstate == NULL)
+          return 1;
 
-        if (fstate->mac_len != 0) {
-                dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
-                memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len);
+        memcpy(dstate, fstate, sizeof(struct dev_crypto_state));
+
+        sess = &dstate->d_sess;
+
+        digest = digest_nid_to_cryptodev(to->digest->type);
+
+        sess->mackey = dstate->dummy_mac_key;
+        sess->mackeylen = digest_key_length(to->digest->type);
+        sess->mac = digest;
+
+        dstate->d_fd = get_dev_crypto();
+
+        if (ioctl(dstate->d_fd, CIOCGSESSION, sess) < 0) {
+                put_dev_crypto(dstate->d_fd);
+                dstate->d_fd = -1;
+                printf("cryptodev_digest_init: Open session failed\n");
+                return (0);
         }
 
-        dstate->copy = 1;
+        if (fstate->mac_len != 0) {
+                if (fstate->mac_data != NULL)
+                        {
+                        dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
+                        memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len);
+                        dstate->mac_len = fstate->mac_len;
+                        }
+        }
 
         return 1;
 }
@@ -1346,11 +1377,11 @@ ENGINE_load_cryptodev(void)
          * find out what asymmetric crypto algorithms we support
          */
         if (ioctl(fd, CIOCASYMFEAT, &cryptodev_asymfeat) == -1) {
-                close(fd);
+                put_dev_crypto(fd);
                 ENGINE_free(engine);
                 return;
         }
-        close(fd);
+        put_dev_crypto(fd);
 
         if (!ENGINE_set_id(engine, "cryptodev") ||
             !ENGINE_set_name(engine, "BSD cryptodev engine") ||
diff --git a/src/lib/libcrypto/engine/eng_fat.c b/src/lib/libcrypto/engine/eng_fat.c
index db66e62350..789b8d57e5 100644
--- a/src/lib/libcrypto/engine/eng_fat.c
+++ b/src/lib/libcrypto/engine/eng_fat.c
@@ -176,6 +176,7 @@ int ENGINE_register_all_complete(void)
         ENGINE *e;
 
         for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
-                ENGINE_register_complete(e);
+                if (!(e->flags & ENGINE_FLAGS_NO_REGISTER_ALL))
+                        ENGINE_register_complete(e);
         return 1;
         }
diff --git a/src/lib/libcrypto/engine/engine.h b/src/lib/libcrypto/engine/engine.h
index 9d73abac8e..f8be497724 100644
--- a/src/lib/libcrypto/engine/engine.h
+++ b/src/lib/libcrypto/engine/engine.h
@@ -141,6 +141,13 @@ extern "C" {
  * the existing ENGINE's structural reference count. */
 #define ENGINE_FLAGS_BY_ID_COPY         (int)0x0004
 
+/* This flag if for an ENGINE that does not want its methods registered as 
+ * part of ENGINE_register_all_complete() for example if the methods are
+ * not usable as default methods.
+ */
+
+#define ENGINE_FLAGS_NO_REGISTER_ALL    (int)0x0008
+
 /* ENGINEs can support their own command types, and these flags are used in
  * ENGINE_CTRL_GET_CMD_FLAGS to indicate to the caller what kind of input each
  * command expects. Currently only numeric and string input is supported. If a
@@ -344,7 +351,8 @@ void ENGINE_load_gost(void);
 #endif
 #endif
 void ENGINE_load_cryptodev(void);
-void ENGINE_load_aesni(void);
+void ENGINE_load_rsax(void);
+void ENGINE_load_rdrand(void);
 void ENGINE_load_builtin_engines(void);
 
 /* Get and set global flags (ENGINE_TABLE_FLAG_***) for the implementation
diff --git a/src/lib/libcrypto/err/err.c b/src/lib/libcrypto/err/err.c
index 69713a6e2f..fcdb244008 100644
--- a/src/lib/libcrypto/err/err.c
+++ b/src/lib/libcrypto/err/err.c
@@ -1066,6 +1066,13 @@ void ERR_set_error_data(char *data, int flags)
 void ERR_add_error_data(int num, ...)
         {
         va_list args;
+        va_start(args, num);
+        ERR_add_error_vdata(num, args);
+        va_end(args);
+        }
+
+void ERR_add_error_vdata(int num, va_list args)
+        {
         int i,n,s;
         char *str,*p,*a;
 
@@ -1074,7 +1081,6 @@ void ERR_add_error_data(int num, ...)
         if (str == NULL) return;
         str[0]='\0';
 
-        va_start(args, num);
         n=0;
         for (i=0; i<num; i++)
                 {
@@ -1090,7 +1096,7 @@ void ERR_add_error_data(int num, ...)
                                 if (p == NULL)
                                         {
                                         OPENSSL_free(str);
-                                        goto err;
+                                        return;
                                         }
                                 else
                                         str=p;
@@ -1099,9 +1105,6 @@ void ERR_add_error_data(int num, ...)
                         }
                 }
         ERR_set_error_data(str,ERR_TXT_MALLOCED|ERR_TXT_STRING);
-
-err:
-        va_end(args);
         }
 
 int ERR_set_mark(void)
diff --git a/src/lib/libcrypto/err/err.h b/src/lib/libcrypto/err/err.h
index b9f8c16d47..974cc9cc6f 100644
--- a/src/lib/libcrypto/err/err.h
+++ b/src/lib/libcrypto/err/err.h
@@ -344,8 +344,9 @@ void ERR_print_errors_fp(FILE *fp);
 #endif
 #ifndef OPENSSL_NO_BIO
 void ERR_print_errors(BIO *bp);
-void ERR_add_error_data(int num, ...);
 #endif
+void ERR_add_error_data(int num, ...);
+void ERR_add_error_vdata(int num, va_list args);
 void ERR_load_strings(int lib,ERR_STRING_DATA str[]);
 void ERR_unload_strings(int lib,ERR_STRING_DATA str[]);
 void ERR_load_ERR_strings(void);
diff --git a/src/lib/libcrypto/err/err_all.c b/src/lib/libcrypto/err/err_all.c
index fc049e8e88..bd8946d8ba 100644
--- a/src/lib/libcrypto/err/err_all.c
+++ b/src/lib/libcrypto/err/err_all.c
@@ -104,6 +104,10 @@
 #endif
 #include <openssl/comp.h>
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 void ERR_load_crypto_strings(void)
         {
 #ifndef OPENSSL_NO_ERR
@@ -157,4 +161,7 @@ void ERR_load_crypto_strings(void)
 #endif
         ERR_load_COMP_strings();
 #endif
+#ifdef OPENSSL_FIPS
+        ERR_load_FIPS_strings();
+#endif
         }
diff --git a/src/lib/libcrypto/evp/Makefile b/src/lib/libcrypto/evp/Makefile
index 82825e5299..0fe1b96bff 100644
--- a/src/lib/libcrypto/evp/Makefile
+++ b/src/lib/libcrypto/evp/Makefile
@@ -28,7 +28,8 @@ LIBSRC= encode.c digest.c evp_enc.c evp_key.c evp_acnf.c \
         bio_md.c bio_b64.c bio_enc.c evp_err.c e_null.c \
         c_all.c c_allc.c c_alld.c evp_lib.c bio_ok.c \
         evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c \
-        e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c
+        e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c evp_fips.c \
+        e_aes_cbc_hmac_sha1.c e_rc4_hmac_md5.c
 
 LIBOBJ= encode.o digest.o evp_enc.o evp_key.o evp_acnf.o \
         e_des.o e_bf.o e_idea.o e_des3.o e_camellia.o\
@@ -40,7 +41,8 @@ LIBOBJ=	encode.o digest.o evp_enc.o evp_key.o evp_acnf.o \
         bio_md.o bio_b64.o bio_enc.o evp_err.o e_null.o \
         c_all.o c_allc.o c_alld.o evp_lib.o bio_ok.o \
         evp_pkey.o evp_pbe.o p5_crpt.o p5_crpt2.o \
-        e_old.o pmeth_lib.o pmeth_fn.o pmeth_gn.o m_sigver.o
+        e_old.o pmeth_lib.o pmeth_fn.o pmeth_gn.o m_sigver.o evp_fips.o \
+        e_aes_cbc_hmac_sha1.o e_rc4_hmac_md5.o
 
 SRC= $(LIBSRC)
 
@@ -189,11 +191,27 @@ e_aes.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
 e_aes.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
 e_aes.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 e_aes.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
-e_aes.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
-e_aes.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-e_aes.o: ../../include/openssl/ossl_typ.h ../../include/openssl/safestack.h
-e_aes.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h e_aes.c
-e_aes.o: evp_locl.h
+e_aes.o: ../../include/openssl/modes.h ../../include/openssl/obj_mac.h
+e_aes.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+e_aes.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+e_aes.o: ../../include/openssl/rand.h ../../include/openssl/safestack.h
+e_aes.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+e_aes.o: ../modes/modes_lcl.h e_aes.c evp_locl.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/bio.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/crypto.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/e_os2.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/evp.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/obj_mac.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/objects.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/opensslconf.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/opensslv.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/ossl_typ.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/safestack.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/sha.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/stack.h
+e_aes_cbc_hmac_sha1.o: ../../include/openssl/symhacks.h e_aes_cbc_hmac_sha1.c
+e_aes_cbc_hmac_sha1.o: evp_locl.h
 e_bf.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
 e_bf.o: ../../include/openssl/blowfish.h ../../include/openssl/buffer.h
 e_bf.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
@@ -279,7 +297,18 @@ e_rc4.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
 e_rc4.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 e_rc4.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rc4.h
 e_rc4.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
-e_rc4.o: ../../include/openssl/symhacks.h ../cryptlib.h e_rc4.c
+e_rc4.o: ../../include/openssl/symhacks.h ../cryptlib.h e_rc4.c evp_locl.h
+e_rc4_hmac_md5.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+e_rc4_hmac_md5.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+e_rc4_hmac_md5.o: ../../include/openssl/evp.h ../../include/openssl/md5.h
+e_rc4_hmac_md5.o: ../../include/openssl/obj_mac.h
+e_rc4_hmac_md5.o: ../../include/openssl/objects.h
+e_rc4_hmac_md5.o: ../../include/openssl/opensslconf.h
+e_rc4_hmac_md5.o: ../../include/openssl/opensslv.h
+e_rc4_hmac_md5.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rc4.h
+e_rc4_hmac_md5.o: ../../include/openssl/safestack.h
+e_rc4_hmac_md5.o: ../../include/openssl/stack.h
+e_rc4_hmac_md5.o: ../../include/openssl/symhacks.h e_rc4_hmac_md5.c
 e_rc5.o: ../../e_os.h ../../include/openssl/bio.h
 e_rc5.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 e_rc5.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
@@ -349,6 +378,13 @@ evp_err.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 evp_err.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
 evp_err.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 evp_err.o: ../../include/openssl/symhacks.h evp_err.c
+evp_fips.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+evp_fips.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+evp_fips.o: ../../include/openssl/evp.h ../../include/openssl/obj_mac.h
+evp_fips.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+evp_fips.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+evp_fips.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+evp_fips.o: ../../include/openssl/symhacks.h evp_fips.c
 evp_key.o: ../../e_os.h ../../include/openssl/asn1.h
 evp_key.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 evp_key.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
@@ -383,7 +419,7 @@ evp_pbe.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs12.h
 evp_pbe.o: ../../include/openssl/pkcs7.h ../../include/openssl/safestack.h
 evp_pbe.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 evp_pbe.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
-evp_pbe.o: ../../include/openssl/x509_vfy.h ../cryptlib.h evp_pbe.c
+evp_pbe.o: ../../include/openssl/x509_vfy.h ../cryptlib.h evp_locl.h evp_pbe.c
 evp_pkey.o: ../../e_os.h ../../include/openssl/asn1.h
 evp_pkey.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 evp_pkey.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
@@ -456,7 +492,7 @@ m_md4.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
 m_md4.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 m_md4.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 m_md4.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
-m_md4.o: ../../include/openssl/x509_vfy.h ../cryptlib.h m_md4.c
+m_md4.o: ../../include/openssl/x509_vfy.h ../cryptlib.h evp_locl.h m_md4.c
 m_md5.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
 m_md5.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 m_md5.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
@@ -469,7 +505,7 @@ m_md5.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
 m_md5.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 m_md5.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 m_md5.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
-m_md5.o: ../../include/openssl/x509_vfy.h ../cryptlib.h m_md5.c
+m_md5.o: ../../include/openssl/x509_vfy.h ../cryptlib.h evp_locl.h m_md5.c
 m_mdc2.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
 m_mdc2.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 m_mdc2.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
@@ -484,7 +520,7 @@ m_mdc2.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 m_mdc2.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 m_mdc2.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
 m_mdc2.o: ../../include/openssl/ui_compat.h ../../include/openssl/x509.h
-m_mdc2.o: ../../include/openssl/x509_vfy.h ../cryptlib.h m_mdc2.c
+m_mdc2.o: ../../include/openssl/x509_vfy.h ../cryptlib.h evp_locl.h m_mdc2.c
 m_null.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
 m_null.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 m_null.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
@@ -510,7 +546,8 @@ m_ripemd.o: ../../include/openssl/pkcs7.h ../../include/openssl/ripemd.h
 m_ripemd.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 m_ripemd.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 m_ripemd.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
-m_ripemd.o: ../../include/openssl/x509_vfy.h ../cryptlib.h m_ripemd.c
+m_ripemd.o: ../../include/openssl/x509_vfy.h ../cryptlib.h evp_locl.h
+m_ripemd.o: m_ripemd.c
 m_sha.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
 m_sha.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 m_sha.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
@@ -523,7 +560,7 @@ m_sha.o: ../../include/openssl/pkcs7.h ../../include/openssl/rsa.h
 m_sha.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 m_sha.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
 m_sha.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-m_sha.o: ../cryptlib.h m_sha.c
+m_sha.o: ../cryptlib.h evp_locl.h m_sha.c
 m_sha1.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
 m_sha1.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 m_sha1.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
@@ -563,7 +600,7 @@ m_wp.o: ../../include/openssl/pkcs7.h ../../include/openssl/safestack.h
 m_wp.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 m_wp.o: ../../include/openssl/symhacks.h ../../include/openssl/whrlpool.h
 m_wp.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-m_wp.o: ../cryptlib.h m_wp.c
+m_wp.o: ../cryptlib.h evp_locl.h m_wp.c
 names.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
 names.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 names.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
@@ -601,7 +638,8 @@ p5_crpt2.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
 p5_crpt2.o: ../../include/openssl/pkcs7.h ../../include/openssl/safestack.h
 p5_crpt2.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 p5_crpt2.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
-p5_crpt2.o: ../../include/openssl/x509_vfy.h ../cryptlib.h p5_crpt2.c
+p5_crpt2.o: ../../include/openssl/x509_vfy.h ../cryptlib.h evp_locl.h
+p5_crpt2.o: p5_crpt2.c
 p_dec.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
 p_dec.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
 p_dec.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
diff --git a/src/lib/libcrypto/evp/bio_md.c b/src/lib/libcrypto/evp/bio_md.c
index 9841e32e1a..144fdfd56a 100644
--- a/src/lib/libcrypto/evp/bio_md.c
+++ b/src/lib/libcrypto/evp/bio_md.c
@@ -153,8 +153,12 @@ static int md_write(BIO *b, const char *in, int inl)
                 {
                 if (ret > 0)
                         {
-                        EVP_DigestUpdate(ctx,(const unsigned char *)in,
-                                (unsigned int)ret);
+                        if (!EVP_DigestUpdate(ctx,(const unsigned char *)in,
+                                (unsigned int)ret))
+                                {
+                                BIO_clear_retry_flags(b);
+                                return 0;
+                                }
                         }
                 }
         if(b->next_bio != NULL)
@@ -220,7 +224,8 @@ static long md_ctrl(BIO *b, int cmd, long num, void *ptr)
         case BIO_CTRL_DUP:
                 dbio=ptr;
                 dctx=dbio->ptr;
-                EVP_MD_CTX_copy_ex(dctx,ctx);
+                if (!EVP_MD_CTX_copy_ex(dctx,ctx))
+                        return 0;
                 b->init=1;
                 break;
         default:
diff --git a/src/lib/libcrypto/evp/bio_ok.c b/src/lib/libcrypto/evp/bio_ok.c
index 98bc1ab409..e64335353f 100644
--- a/src/lib/libcrypto/evp/bio_ok.c
+++ b/src/lib/libcrypto/evp/bio_ok.c
@@ -133,10 +133,10 @@ static int ok_new(BIO *h);
 static int ok_free(BIO *data);
 static long ok_callback_ctrl(BIO *h, int cmd, bio_info_cb *fp);
 
-static void sig_out(BIO* b);
-static void sig_in(BIO* b);
-static void block_out(BIO* b);
-static void block_in(BIO* b);
+static int sig_out(BIO* b);
+static int sig_in(BIO* b);
+static int block_out(BIO* b);
+static int block_in(BIO* b);
 #define OK_BLOCK_SIZE   (1024*4)
 #define OK_BLOCK_BLOCK  4
 #define IOBS            (OK_BLOCK_SIZE+ OK_BLOCK_BLOCK+ 3*EVP_MAX_MD_SIZE)
@@ -266,10 +266,24 @@ static int ok_read(BIO *b, char *out, int outl)
                 ctx->buf_len+= i;
 
                 /* no signature yet -- check if we got one */
-                if (ctx->sigio == 1) sig_in(b);
+                if (ctx->sigio == 1)
+                        {
+                        if (!sig_in(b))
+                                {
+                                BIO_clear_retry_flags(b);
+                                return 0;
+                                }
+                        }
 
                 /* signature ok -- check if we got block */
-                if (ctx->sigio == 0) block_in(b);
+                if (ctx->sigio == 0)
+                        {
+                        if (!block_in(b))
+                                {
+                                BIO_clear_retry_flags(b);
+                                return 0;
+                                }
+                        }
 
                 /* invalid block -- cancel */
                 if (ctx->cont <= 0) break;
@@ -293,7 +307,8 @@ static int ok_write(BIO *b, const char *in, int inl)
 
         if ((ctx == NULL) || (b->next_bio == NULL) || (b->init == 0)) return(0);
 
-        if(ctx->sigio) sig_out(b);
+        if(ctx->sigio && !sig_out(b))
+                return 0;
 
         do{
                 BIO_clear_retry_flags(b);
@@ -332,7 +347,11 @@ static int ok_write(BIO *b, const char *in, int inl)
 
                 if(ctx->buf_len >= OK_BLOCK_SIZE+ OK_BLOCK_BLOCK)
                         {
-                        block_out(b);
+                        if (!block_out(b))
+                                {
+                                BIO_clear_retry_flags(b);
+                                return 0;
+                                }
                         }
         }while(inl > 0);
 
@@ -379,7 +398,8 @@ static long ok_ctrl(BIO *b, int cmd, long num, void *ptr)
         case BIO_CTRL_FLUSH:
                 /* do a final write */
                 if(ctx->blockout == 0)
-                        block_out(b);
+                        if (!block_out(b))
+                                return 0;
 
                 while (ctx->blockout)
                         {
@@ -408,7 +428,8 @@ static long ok_ctrl(BIO *b, int cmd, long num, void *ptr)
                 break;
         case BIO_C_SET_MD:
                 md=ptr;
-                EVP_DigestInit_ex(&ctx->md, md, NULL);
+                if (!EVP_DigestInit_ex(&ctx->md, md, NULL))
+                        return 0;
                 b->init=1;
                 break;
         case BIO_C_GET_MD:
@@ -455,7 +476,7 @@ static void longswap(void *_ptr, size_t len)
         }
 }
 
-static void sig_out(BIO* b)
+static int sig_out(BIO* b)
         {
         BIO_OK_CTX *ctx;
         EVP_MD_CTX *md;
@@ -463,9 +484,10 @@ static void sig_out(BIO* b)
         ctx=b->ptr;
         md=&ctx->md;
 
-        if(ctx->buf_len+ 2* md->digest->md_size > OK_BLOCK_SIZE) return;
+        if(ctx->buf_len+ 2* md->digest->md_size > OK_BLOCK_SIZE) return 1;
 
-        EVP_DigestInit_ex(md, md->digest, NULL);
+        if (!EVP_DigestInit_ex(md, md->digest, NULL))
+                goto berr;
         /* FIXME: there's absolutely no guarantee this makes any sense at all,
          * particularly now EVP_MD_CTX has been restructured.
          */
@@ -474,14 +496,20 @@ static void sig_out(BIO* b)
         longswap(&(ctx->buf[ctx->buf_len]), md->digest->md_size);
         ctx->buf_len+= md->digest->md_size;
 
-        EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN));
-        EVP_DigestFinal_ex(md, &(ctx->buf[ctx->buf_len]), NULL);
+        if (!EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN)))
+                goto berr;
+        if (!EVP_DigestFinal_ex(md, &(ctx->buf[ctx->buf_len]), NULL))
+                goto berr;
         ctx->buf_len+= md->digest->md_size;
         ctx->blockout= 1;
         ctx->sigio= 0;
+        return 1;
+        berr:
+        BIO_clear_retry_flags(b);
+        return 0;
         }
 
-static void sig_in(BIO* b)
+static int sig_in(BIO* b)
         {
         BIO_OK_CTX *ctx;
         EVP_MD_CTX *md;
@@ -491,15 +519,18 @@ static void sig_in(BIO* b)
         ctx=b->ptr;
         md=&ctx->md;
 
-        if((int)(ctx->buf_len-ctx->buf_off) < 2*md->digest->md_size) return;
+        if((int)(ctx->buf_len-ctx->buf_off) < 2*md->digest->md_size) return 1;
 
-        EVP_DigestInit_ex(md, md->digest, NULL);
+        if (!EVP_DigestInit_ex(md, md->digest, NULL))
+                goto berr;
         memcpy(md->md_data, &(ctx->buf[ctx->buf_off]), md->digest->md_size);
         longswap(md->md_data, md->digest->md_size);
         ctx->buf_off+= md->digest->md_size;
 
-        EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN));
-        EVP_DigestFinal_ex(md, tmp, NULL);
+        if (!EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN)))
+                goto berr;
+        if (!EVP_DigestFinal_ex(md, tmp, NULL))
+                goto berr;
         ret= memcmp(&(ctx->buf[ctx->buf_off]), tmp, md->digest->md_size) == 0;
         ctx->buf_off+= md->digest->md_size;
         if(ret == 1)
@@ -516,9 +547,13 @@ static void sig_in(BIO* b)
                 {
                 ctx->cont= 0;
                 }
+        return 1;
+        berr:
+        BIO_clear_retry_flags(b);
+        return 0;
         }
 
-static void block_out(BIO* b)
+static int block_out(BIO* b)
         {
         BIO_OK_CTX *ctx;
         EVP_MD_CTX *md;
@@ -532,13 +567,20 @@ static void block_out(BIO* b)
         ctx->buf[1]=(unsigned char)(tl>>16);
         ctx->buf[2]=(unsigned char)(tl>>8);
         ctx->buf[3]=(unsigned char)(tl);
-        EVP_DigestUpdate(md, (unsigned char*) &(ctx->buf[OK_BLOCK_BLOCK]), tl);
-        EVP_DigestFinal_ex(md, &(ctx->buf[ctx->buf_len]), NULL);
+        if (!EVP_DigestUpdate(md,
+                (unsigned char*) &(ctx->buf[OK_BLOCK_BLOCK]), tl))
+                goto berr;
+        if (!EVP_DigestFinal_ex(md, &(ctx->buf[ctx->buf_len]), NULL))
+                goto berr;
         ctx->buf_len+= md->digest->md_size;
         ctx->blockout= 1;
+        return 1;
+        berr:
+        BIO_clear_retry_flags(b);
+        return 0;
         }
 
-static void block_in(BIO* b)
+static int block_in(BIO* b)
         {
         BIO_OK_CTX *ctx;
         EVP_MD_CTX *md;
@@ -554,10 +596,13 @@ static void block_in(BIO* b)
         tl|=ctx->buf[2]; tl<<=8;
         tl|=ctx->buf[3];
 
-        if (ctx->buf_len < tl+ OK_BLOCK_BLOCK+ md->digest->md_size) return;
+        if (ctx->buf_len < tl+ OK_BLOCK_BLOCK+ md->digest->md_size) return 1;
  
-        EVP_DigestUpdate(md, (unsigned char*) &(ctx->buf[OK_BLOCK_BLOCK]), tl);
-        EVP_DigestFinal_ex(md, tmp, NULL);
+        if (!EVP_DigestUpdate(md,
+                        (unsigned char*) &(ctx->buf[OK_BLOCK_BLOCK]), tl))
+                goto berr;
+        if (!EVP_DigestFinal_ex(md, tmp, NULL))
+                goto berr;
         if(memcmp(&(ctx->buf[tl+ OK_BLOCK_BLOCK]), tmp, md->digest->md_size) == 0)
                 {
                 /* there might be parts from next block lurking around ! */
@@ -571,5 +616,9 @@ static void block_in(BIO* b)
                 {
                 ctx->cont= 0;
                 }
+        return 1;
+        berr:
+        BIO_clear_retry_flags(b);
+        return 0;
         }
 
diff --git a/src/lib/libcrypto/evp/c_allc.c b/src/lib/libcrypto/evp/c_allc.c
index c5f9268378..2a45d435e5 100644
--- a/src/lib/libcrypto/evp/c_allc.c
+++ b/src/lib/libcrypto/evp/c_allc.c
@@ -98,6 +98,9 @@ void OpenSSL_add_all_ciphers(void)
 #ifndef OPENSSL_NO_RC4
         EVP_add_cipher(EVP_rc4());
         EVP_add_cipher(EVP_rc4_40());
+#ifndef OPENSSL_NO_MD5
+        EVP_add_cipher(EVP_rc4_hmac_md5());
+#endif
 #endif
 
 #ifndef OPENSSL_NO_IDEA
@@ -166,9 +169,9 @@ void OpenSSL_add_all_ciphers(void)
         EVP_add_cipher(EVP_aes_128_cfb1());
         EVP_add_cipher(EVP_aes_128_cfb8());
         EVP_add_cipher(EVP_aes_128_ofb());
-#if 0
         EVP_add_cipher(EVP_aes_128_ctr());
-#endif
+        EVP_add_cipher(EVP_aes_128_gcm());
+        EVP_add_cipher(EVP_aes_128_xts());
         EVP_add_cipher_alias(SN_aes_128_cbc,"AES128");
         EVP_add_cipher_alias(SN_aes_128_cbc,"aes128");
         EVP_add_cipher(EVP_aes_192_ecb());
@@ -177,9 +180,8 @@ void OpenSSL_add_all_ciphers(void)
         EVP_add_cipher(EVP_aes_192_cfb1());
         EVP_add_cipher(EVP_aes_192_cfb8());
         EVP_add_cipher(EVP_aes_192_ofb());
-#if 0
         EVP_add_cipher(EVP_aes_192_ctr());
-#endif
+        EVP_add_cipher(EVP_aes_192_gcm());
         EVP_add_cipher_alias(SN_aes_192_cbc,"AES192");
         EVP_add_cipher_alias(SN_aes_192_cbc,"aes192");
         EVP_add_cipher(EVP_aes_256_ecb());
@@ -188,11 +190,15 @@ void OpenSSL_add_all_ciphers(void)
         EVP_add_cipher(EVP_aes_256_cfb1());
         EVP_add_cipher(EVP_aes_256_cfb8());
         EVP_add_cipher(EVP_aes_256_ofb());
-#if 0
         EVP_add_cipher(EVP_aes_256_ctr());
-#endif
+        EVP_add_cipher(EVP_aes_256_gcm());
+        EVP_add_cipher(EVP_aes_256_xts());
         EVP_add_cipher_alias(SN_aes_256_cbc,"AES256");
         EVP_add_cipher_alias(SN_aes_256_cbc,"aes256");
+#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
+        EVP_add_cipher(EVP_aes_128_cbc_hmac_sha1());
+        EVP_add_cipher(EVP_aes_256_cbc_hmac_sha1());
+#endif
 #endif
 
 #ifndef OPENSSL_NO_CAMELLIA
diff --git a/src/lib/libcrypto/evp/digest.c b/src/lib/libcrypto/evp/digest.c
index 982ba2b136..467e6b5ae9 100644
--- a/src/lib/libcrypto/evp/digest.c
+++ b/src/lib/libcrypto/evp/digest.c
@@ -117,6 +117,10 @@
 #include <openssl/engine.h>
 #endif
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 void EVP_MD_CTX_init(EVP_MD_CTX *ctx)
         {
         memset(ctx,'\0',sizeof *ctx);
@@ -225,12 +229,26 @@ skip_to_init:
                 }
         if (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT)
                 return 1;
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode())
+                {
+                if (FIPS_digestinit(ctx, type))
+                        return 1;
+                OPENSSL_free(ctx->md_data);
+                ctx->md_data = NULL;
+                return 0;
+                }
+#endif
         return ctx->digest->init(ctx);
         }
 
 int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data, size_t count)
         {
+#ifdef OPENSSL_FIPS
+        return FIPS_digestupdate(ctx, data, count);
+#else
         return ctx->update(ctx,data,count);
+#endif
         }
 
 /* The caller can assume that this removes any secret data from the context */
@@ -245,8 +263,10 @@ int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *size)
 /* The caller can assume that this removes any secret data from the context */
 int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *size)
         {
+#ifdef OPENSSL_FIPS
+        return FIPS_digestfinal(ctx, md, size);
+#else
         int ret;
-
         OPENSSL_assert(ctx->digest->md_size <= EVP_MAX_MD_SIZE);
         ret=ctx->digest->final(ctx,md);
         if (size != NULL)
@@ -258,6 +278,7 @@ int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *size)
                 }
         memset(ctx->md_data,0,ctx->digest->ctx_size);
         return ret;
+#endif
         }
 
 int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
@@ -351,6 +372,7 @@ void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx)
 /* This call frees resources associated with the context */
 int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
         {
+#ifndef OPENSSL_FIPS
         /* Don't assume ctx->md_data was cleaned in EVP_Digest_Final,
          * because sometimes only copies of the context are ever finalised.
          */
@@ -363,6 +385,7 @@ int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
                 OPENSSL_cleanse(ctx->md_data,ctx->digest->ctx_size);
                 OPENSSL_free(ctx->md_data);
                 }
+#endif
         if (ctx->pctx)
                 EVP_PKEY_CTX_free(ctx->pctx);
 #ifndef OPENSSL_NO_ENGINE
@@ -371,6 +394,9 @@ int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
                  * functional reference we held for this reason. */
                 ENGINE_finish(ctx->engine);
 #endif
+#ifdef OPENSSL_FIPS
+        FIPS_md_ctx_cleanup(ctx);
+#endif
         memset(ctx,'\0',sizeof *ctx);
 
         return 1;
diff --git a/src/lib/libcrypto/evp/e_aes.c b/src/lib/libcrypto/evp/e_aes.c
index bd6c0a3a62..1e4af0cb75 100644
--- a/src/lib/libcrypto/evp/e_aes.c
+++ b/src/lib/libcrypto/evp/e_aes.c
@@ -1,5 +1,5 @@
 /* ====================================================================
- * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2001-2011 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -56,57 +56,511 @@
 #include <assert.h>
 #include <openssl/aes.h>
 #include "evp_locl.h"
-
-static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
-                                        const unsigned char *iv, int enc);
+#ifndef OPENSSL_FIPS
+#include "modes_lcl.h"
+#include <openssl/rand.h>
 
 typedef struct
         {
         AES_KEY ks;
+        block128_f block;
+        union {
+                cbc128_f cbc;
+                ctr128_f ctr;
+        } stream;
         } EVP_AES_KEY;
 
-#define data(ctx)       EVP_C_DATA(EVP_AES_KEY,ctx)
-
-IMPLEMENT_BLOCK_CIPHER(aes_128, ks, AES, EVP_AES_KEY,
-                       NID_aes_128, 16, 16, 16, 128,
-                       0, aes_init_key, NULL, 
-                       EVP_CIPHER_set_asn1_iv,
-                       EVP_CIPHER_get_asn1_iv,
-                       NULL)
-IMPLEMENT_BLOCK_CIPHER(aes_192, ks, AES, EVP_AES_KEY,
-                       NID_aes_192, 16, 24, 16, 128,
-                       0, aes_init_key, NULL, 
-                       EVP_CIPHER_set_asn1_iv,
-                       EVP_CIPHER_get_asn1_iv,
-                       NULL)
-IMPLEMENT_BLOCK_CIPHER(aes_256, ks, AES, EVP_AES_KEY,
-                       NID_aes_256, 16, 32, 16, 128,
-                       0, aes_init_key, NULL, 
-                       EVP_CIPHER_set_asn1_iv,
-                       EVP_CIPHER_get_asn1_iv,
-                       NULL)
-
-#define IMPLEMENT_AES_CFBR(ksize,cbits) IMPLEMENT_CFBR(aes,AES,EVP_AES_KEY,ks,ksize,cbits,16)
-
-IMPLEMENT_AES_CFBR(128,1)
-IMPLEMENT_AES_CFBR(192,1)
-IMPLEMENT_AES_CFBR(256,1)
-
-IMPLEMENT_AES_CFBR(128,8)
-IMPLEMENT_AES_CFBR(192,8)
-IMPLEMENT_AES_CFBR(256,8)
+typedef struct
+        {
+        AES_KEY ks;             /* AES key schedule to use */
+        int key_set;            /* Set if key initialised */
+        int iv_set;             /* Set if an iv is set */
+        GCM128_CONTEXT gcm;
+        unsigned char *iv;      /* Temporary IV store */
+        int ivlen;              /* IV length */
+        int taglen;
+        int iv_gen;             /* It is OK to generate IVs */
+        int tls_aad_len;        /* TLS AAD length */
+        ctr128_f ctr;
+        } EVP_AES_GCM_CTX;
+
+typedef struct
+        {
+        AES_KEY ks1, ks2;       /* AES key schedules to use */
+        XTS128_CONTEXT xts;
+        void     (*stream)(const unsigned char *in,
+                        unsigned char *out, size_t length,
+                        const AES_KEY *key1, const AES_KEY *key2,
+                        const unsigned char iv[16]);
+        } EVP_AES_XTS_CTX;
+
+typedef struct
+        {
+        AES_KEY ks;             /* AES key schedule to use */
+        int key_set;            /* Set if key initialised */
+        int iv_set;             /* Set if an iv is set */
+        int tag_set;            /* Set if tag is valid */
+        int len_set;            /* Set if message length set */
+        int L, M;               /* L and M parameters from RFC3610 */
+        CCM128_CONTEXT ccm;
+        ccm128_f str;
+        } EVP_AES_CCM_CTX;
+
+#define MAXBITCHUNK     ((size_t)1<<(sizeof(size_t)*8-4))
+
+#ifdef VPAES_ASM
+int vpaes_set_encrypt_key(const unsigned char *userKey, int bits,
+                        AES_KEY *key);
+int vpaes_set_decrypt_key(const unsigned char *userKey, int bits,
+                        AES_KEY *key);
+
+void vpaes_encrypt(const unsigned char *in, unsigned char *out,
+                        const AES_KEY *key);
+void vpaes_decrypt(const unsigned char *in, unsigned char *out,
+                        const AES_KEY *key);
+
+void vpaes_cbc_encrypt(const unsigned char *in,
+                        unsigned char *out,
+                        size_t length,
+                        const AES_KEY *key,
+                        unsigned char *ivec, int enc);
+#endif
+#ifdef BSAES_ASM
+void bsaes_cbc_encrypt(const unsigned char *in, unsigned char *out,
+                        size_t length, const AES_KEY *key,
+                        unsigned char ivec[16], int enc);
+void bsaes_ctr32_encrypt_blocks(const unsigned char *in, unsigned char *out,
+                        size_t len, const AES_KEY *key,
+                        const unsigned char ivec[16]);
+void bsaes_xts_encrypt(const unsigned char *inp, unsigned char *out,
+                        size_t len, const AES_KEY *key1,
+                        const AES_KEY *key2, const unsigned char iv[16]);
+void bsaes_xts_decrypt(const unsigned char *inp, unsigned char *out,
+                        size_t len, const AES_KEY *key1,
+                        const AES_KEY *key2, const unsigned char iv[16]);
+#endif
+#ifdef AES_CTR_ASM
+void AES_ctr32_encrypt(const unsigned char *in, unsigned char *out,
+                        size_t blocks, const AES_KEY *key,
+                        const unsigned char ivec[AES_BLOCK_SIZE]);
+#endif
+#ifdef AES_XTS_ASM
+void AES_xts_encrypt(const char *inp,char *out,size_t len,
+                        const AES_KEY *key1, const AES_KEY *key2,
+                        const unsigned char iv[16]);
+void AES_xts_decrypt(const char *inp,char *out,size_t len,
+                        const AES_KEY *key1, const AES_KEY *key2,
+                        const unsigned char iv[16]);
+#endif
+
+#if     defined(AES_ASM) && !defined(I386_ONLY) &&      (  \
+        ((defined(__i386)       || defined(__i386__)    || \
+          defined(_M_IX86)) && defined(OPENSSL_IA32_SSE2))|| \
+        defined(__x86_64)       || defined(__x86_64__)  || \
+        defined(_M_AMD64)       || defined(_M_X64)      || \
+        defined(__INTEL__)                              )
+
+extern unsigned int OPENSSL_ia32cap_P[2];
+
+#ifdef VPAES_ASM
+#define VPAES_CAPABLE   (OPENSSL_ia32cap_P[1]&(1<<(41-32)))
+#endif
+#ifdef BSAES_ASM
+#define BSAES_CAPABLE   VPAES_CAPABLE
+#endif
+/*
+ * AES-NI section
+ */
+#define AESNI_CAPABLE   (OPENSSL_ia32cap_P[1]&(1<<(57-32)))
+
+int aesni_set_encrypt_key(const unsigned char *userKey, int bits,
+                        AES_KEY *key);
+int aesni_set_decrypt_key(const unsigned char *userKey, int bits,
+                        AES_KEY *key);
+
+void aesni_encrypt(const unsigned char *in, unsigned char *out,
+                        const AES_KEY *key);
+void aesni_decrypt(const unsigned char *in, unsigned char *out,
+                        const AES_KEY *key);
+
+void aesni_ecb_encrypt(const unsigned char *in,
+                        unsigned char *out,
+                        size_t length,
+                        const AES_KEY *key,
+                        int enc);
+void aesni_cbc_encrypt(const unsigned char *in,
+                        unsigned char *out,
+                        size_t length,
+                        const AES_KEY *key,
+                        unsigned char *ivec, int enc);
+
+void aesni_ctr32_encrypt_blocks(const unsigned char *in,
+                        unsigned char *out,
+                        size_t blocks,
+                        const void *key,
+                        const unsigned char *ivec);
+
+void aesni_xts_encrypt(const unsigned char *in,
+                        unsigned char *out,
+                        size_t length,
+                        const AES_KEY *key1, const AES_KEY *key2,
+                        const unsigned char iv[16]);
+
+void aesni_xts_decrypt(const unsigned char *in,
+                        unsigned char *out,
+                        size_t length,
+                        const AES_KEY *key1, const AES_KEY *key2,
+                        const unsigned char iv[16]);
+
+void aesni_ccm64_encrypt_blocks (const unsigned char *in,
+                        unsigned char *out,
+                        size_t blocks,
+                        const void *key,
+                        const unsigned char ivec[16],
+                        unsigned char cmac[16]);
+
+void aesni_ccm64_decrypt_blocks (const unsigned char *in,
+                        unsigned char *out,
+                        size_t blocks,
+                        const void *key,
+                        const unsigned char ivec[16],
+                        unsigned char cmac[16]);
+
+static int aesni_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                   const unsigned char *iv, int enc)
+        {
+        int ret, mode;
+        EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
+
+        mode = ctx->cipher->flags & EVP_CIPH_MODE;
+        if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE)
+            && !enc)
+                { 
+                ret = aesni_set_decrypt_key(key, ctx->key_len*8, ctx->cipher_data);
+                dat->block      = (block128_f)aesni_decrypt;
+                dat->stream.cbc = mode==EVP_CIPH_CBC_MODE ?
+                                        (cbc128_f)aesni_cbc_encrypt :
+                                        NULL;
+                }
+        else    {
+                ret = aesni_set_encrypt_key(key, ctx->key_len*8, ctx->cipher_data);
+                dat->block      = (block128_f)aesni_encrypt;
+                if (mode==EVP_CIPH_CBC_MODE)
+                        dat->stream.cbc = (cbc128_f)aesni_cbc_encrypt;
+                else if (mode==EVP_CIPH_CTR_MODE)
+                        dat->stream.ctr = (ctr128_f)aesni_ctr32_encrypt_blocks;
+                else
+                        dat->stream.cbc = NULL;
+                }
+
+        if(ret < 0)
+                {
+                EVPerr(EVP_F_AESNI_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED);
+                return 0;
+                }
+
+        return 1;
+        }
+
+static int aesni_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
+        const unsigned char *in, size_t len)
+{
+        aesni_cbc_encrypt(in,out,len,ctx->cipher_data,ctx->iv,ctx->encrypt);
+
+        return 1;
+}
+
+static int aesni_ecb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
+        const unsigned char *in, size_t len)
+{
+        size_t  bl = ctx->cipher->block_size;
+
+        if (len<bl)     return 1;
+
+        aesni_ecb_encrypt(in,out,len,ctx->cipher_data,ctx->encrypt);
+
+        return 1;
+}
+
+#define aesni_ofb_cipher aes_ofb_cipher
+static int aesni_ofb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
+        const unsigned char *in,size_t len);
+
+#define aesni_cfb_cipher aes_cfb_cipher
+static int aesni_cfb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
+        const unsigned char *in,size_t len);
+
+#define aesni_cfb8_cipher aes_cfb8_cipher
+static int aesni_cfb8_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
+        const unsigned char *in,size_t len);
+
+#define aesni_cfb1_cipher aes_cfb1_cipher
+static int aesni_cfb1_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
+        const unsigned char *in,size_t len);
+
+#define aesni_ctr_cipher aes_ctr_cipher
+static int aesni_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                const unsigned char *in, size_t len);
+
+static int aesni_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                        const unsigned char *iv, int enc)
+        {
+        EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
+        if (!iv && !key)
+                return 1;
+        if (key)
+                {
+                aesni_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks);
+                CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
+                                (block128_f)aesni_encrypt);
+                gctx->ctr = (ctr128_f)aesni_ctr32_encrypt_blocks;
+                /* If we have an iv can set it directly, otherwise use
+                 * saved IV.
+                 */
+                if (iv == NULL && gctx->iv_set)
+                        iv = gctx->iv;
+                if (iv)
+                        {
+                        CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
+                        gctx->iv_set = 1;
+                        }
+                gctx->key_set = 1;
+                }
+        else
+                {
+                /* If key set use IV, otherwise copy */
+                if (gctx->key_set)
+                        CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
+                else
+                        memcpy(gctx->iv, iv, gctx->ivlen);
+                gctx->iv_set = 1;
+                gctx->iv_gen = 0;
+                }
+        return 1;
+        }
+
+#define aesni_gcm_cipher aes_gcm_cipher
+static int aesni_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                const unsigned char *in, size_t len);
+
+static int aesni_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                        const unsigned char *iv, int enc)
+        {
+        EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
+        if (!iv && !key)
+                return 1;
+
+        if (key)
+                {
+                /* key_len is two AES keys */
+                if (enc)
+                        {
+                        aesni_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1);
+                        xctx->xts.block1 = (block128_f)aesni_encrypt;
+                        xctx->stream = aesni_xts_encrypt;
+                        }
+                else
+                        {
+                        aesni_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1);
+                        xctx->xts.block1 = (block128_f)aesni_decrypt;
+                        xctx->stream = aesni_xts_decrypt;
+                        }
+
+                aesni_set_encrypt_key(key + ctx->key_len/2,
+                                                ctx->key_len * 4, &xctx->ks2);
+                xctx->xts.block2 = (block128_f)aesni_encrypt;
+
+                xctx->xts.key1 = &xctx->ks1;
+                }
+
+        if (iv)
+                {
+                xctx->xts.key2 = &xctx->ks2;
+                memcpy(ctx->iv, iv, 16);
+                }
+
+        return 1;
+        }
+
+#define aesni_xts_cipher aes_xts_cipher
+static int aesni_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                const unsigned char *in, size_t len);
+
+static int aesni_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                        const unsigned char *iv, int enc)
+        {
+        EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
+        if (!iv && !key)
+                return 1;
+        if (key)
+                {
+                aesni_set_encrypt_key(key, ctx->key_len * 8, &cctx->ks);
+                CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
+                                        &cctx->ks, (block128_f)aesni_encrypt);
+                cctx->str = enc?(ccm128_f)aesni_ccm64_encrypt_blocks :
+                                (ccm128_f)aesni_ccm64_decrypt_blocks;
+                cctx->key_set = 1;
+                }
+        if (iv)
+                {
+                memcpy(ctx->iv, iv, 15 - cctx->L);
+                cctx->iv_set = 1;
+                }
+        return 1;
+        }
+
+#define aesni_ccm_cipher aes_ccm_cipher
+static int aesni_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                const unsigned char *in, size_t len);
+
+#define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
+static const EVP_CIPHER aesni_##keylen##_##mode = { \
+        nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
+        flags|EVP_CIPH_##MODE##_MODE,   \
+        aesni_init_key,                 \
+        aesni_##mode##_cipher,          \
+        NULL,                           \
+        sizeof(EVP_AES_KEY),            \
+        NULL,NULL,NULL,NULL }; \
+static const EVP_CIPHER aes_##keylen##_##mode = { \
+        nid##_##keylen##_##nmode,blocksize,     \
+        keylen/8,ivlen, \
+        flags|EVP_CIPH_##MODE##_MODE,   \
+        aes_init_key,                   \
+        aes_##mode##_cipher,            \
+        NULL,                           \
+        sizeof(EVP_AES_KEY),            \
+        NULL,NULL,NULL,NULL }; \
+const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
+{ return AESNI_CAPABLE?&aesni_##keylen##_##mode:&aes_##keylen##_##mode; }
+
+#define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \
+static const EVP_CIPHER aesni_##keylen##_##mode = { \
+        nid##_##keylen##_##mode,blocksize, \
+        (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
+        flags|EVP_CIPH_##MODE##_MODE,   \
+        aesni_##mode##_init_key,        \
+        aesni_##mode##_cipher,          \
+        aes_##mode##_cleanup,           \
+        sizeof(EVP_AES_##MODE##_CTX),   \
+        NULL,NULL,aes_##mode##_ctrl,NULL }; \
+static const EVP_CIPHER aes_##keylen##_##mode = { \
+        nid##_##keylen##_##mode,blocksize, \
+        (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
+        flags|EVP_CIPH_##MODE##_MODE,   \
+        aes_##mode##_init_key,          \
+        aes_##mode##_cipher,            \
+        aes_##mode##_cleanup,           \
+        sizeof(EVP_AES_##MODE##_CTX),   \
+        NULL,NULL,aes_##mode##_ctrl,NULL }; \
+const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
+{ return AESNI_CAPABLE?&aesni_##keylen##_##mode:&aes_##keylen##_##mode; }
+
+#else
+
+#define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
+static const EVP_CIPHER aes_##keylen##_##mode = { \
+        nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
+        flags|EVP_CIPH_##MODE##_MODE,   \
+        aes_init_key,                   \
+        aes_##mode##_cipher,            \
+        NULL,                           \
+        sizeof(EVP_AES_KEY),            \
+        NULL,NULL,NULL,NULL }; \
+const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
+{ return &aes_##keylen##_##mode; }
+
+#define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \
+static const EVP_CIPHER aes_##keylen##_##mode = { \
+        nid##_##keylen##_##mode,blocksize, \
+        (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
+        flags|EVP_CIPH_##MODE##_MODE,   \
+        aes_##mode##_init_key,          \
+        aes_##mode##_cipher,            \
+        aes_##mode##_cleanup,           \
+        sizeof(EVP_AES_##MODE##_CTX),   \
+        NULL,NULL,aes_##mode##_ctrl,NULL }; \
+const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
+{ return &aes_##keylen##_##mode; }
+#endif
+
+#define BLOCK_CIPHER_generic_pack(nid,keylen,flags)             \
+        BLOCK_CIPHER_generic(nid,keylen,16,16,cbc,cbc,CBC,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)     \
+        BLOCK_CIPHER_generic(nid,keylen,16,0,ecb,ecb,ECB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)      \
+        BLOCK_CIPHER_generic(nid,keylen,1,16,ofb128,ofb,OFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)   \
+        BLOCK_CIPHER_generic(nid,keylen,1,16,cfb128,cfb,CFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)   \
+        BLOCK_CIPHER_generic(nid,keylen,1,16,cfb1,cfb1,CFB,flags)       \
+        BLOCK_CIPHER_generic(nid,keylen,1,16,cfb8,cfb8,CFB,flags)       \
+        BLOCK_CIPHER_generic(nid,keylen,1,16,ctr,ctr,CTR,flags)
 
 static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
                    const unsigned char *iv, int enc)
         {
-        int ret;
+        int ret, mode;
+        EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
 
-        if ((ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_CFB_MODE
-            || (ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_OFB_MODE
-            || enc) 
-                ret=AES_set_encrypt_key(key, ctx->key_len * 8, ctx->cipher_data);
+        mode = ctx->cipher->flags & EVP_CIPH_MODE;
+        if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE)
+            && !enc)
+#ifdef BSAES_CAPABLE
+            if (BSAES_CAPABLE && mode==EVP_CIPH_CBC_MODE)
+                {
+                ret = AES_set_decrypt_key(key,ctx->key_len*8,&dat->ks);
+                dat->block      = (block128_f)AES_decrypt;
+                dat->stream.cbc = (cbc128_f)bsaes_cbc_encrypt;
+                }
+            else
+#endif
+#ifdef VPAES_CAPABLE
+            if (VPAES_CAPABLE)
+                {
+                ret = vpaes_set_decrypt_key(key,ctx->key_len*8,&dat->ks);
+                dat->block      = (block128_f)vpaes_decrypt;
+                dat->stream.cbc = mode==EVP_CIPH_CBC_MODE ?
+                                        (cbc128_f)vpaes_cbc_encrypt :
+                                        NULL;
+                }
+            else
+#endif
+                {
+                ret = AES_set_decrypt_key(key,ctx->key_len*8,&dat->ks);
+                dat->block      = (block128_f)AES_decrypt;
+                dat->stream.cbc = mode==EVP_CIPH_CBC_MODE ?
+                                        (cbc128_f)AES_cbc_encrypt :
+                                        NULL;
+                }
         else
-                ret=AES_set_decrypt_key(key, ctx->key_len * 8, ctx->cipher_data);
+#ifdef BSAES_CAPABLE
+            if (BSAES_CAPABLE && mode==EVP_CIPH_CTR_MODE)
+                {
+                ret = AES_set_encrypt_key(key,ctx->key_len*8,&dat->ks);
+                dat->block      = (block128_f)AES_encrypt;
+                dat->stream.ctr = (ctr128_f)bsaes_ctr32_encrypt_blocks;
+                }
+            else
+#endif
+#ifdef VPAES_CAPABLE
+            if (VPAES_CAPABLE)
+                {
+                ret = vpaes_set_encrypt_key(key,ctx->key_len*8,&dat->ks);
+                dat->block      = (block128_f)vpaes_encrypt;
+                dat->stream.cbc = mode==EVP_CIPH_CBC_MODE ?
+                                        (cbc128_f)vpaes_cbc_encrypt :
+                                        NULL;
+                }
+            else
+#endif
+                {
+                ret = AES_set_encrypt_key(key,ctx->key_len*8,&dat->ks);
+                dat->block      = (block128_f)AES_encrypt;
+                dat->stream.cbc = mode==EVP_CIPH_CBC_MODE ?
+                                        (cbc128_f)AES_cbc_encrypt :
+                                        NULL;
+#ifdef AES_CTR_ASM
+                if (mode==EVP_CIPH_CTR_MODE)
+                        dat->stream.ctr = (ctr128_f)AES_ctr32_encrypt;
+#endif
+                }
 
         if(ret < 0)
                 {
@@ -117,4 +571,743 @@ static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
         return 1;
         }
 
+static int aes_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
+        const unsigned char *in, size_t len)
+{
+        EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
+
+        if (dat->stream.cbc)
+                (*dat->stream.cbc)(in,out,len,&dat->ks,ctx->iv,ctx->encrypt);
+        else if (ctx->encrypt)
+                CRYPTO_cbc128_encrypt(in,out,len,&dat->ks,ctx->iv,dat->block);
+        else
+                CRYPTO_cbc128_encrypt(in,out,len,&dat->ks,ctx->iv,dat->block);
+
+        return 1;
+}
+
+static int aes_ecb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
+        const unsigned char *in, size_t len)
+{
+        size_t  bl = ctx->cipher->block_size;
+        size_t  i;
+        EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
+
+        if (len<bl)     return 1;
+
+        for (i=0,len-=bl;i<=len;i+=bl)
+                (*dat->block)(in+i,out+i,&dat->ks);
+
+        return 1;
+}
+
+static int aes_ofb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
+        const unsigned char *in,size_t len)
+{
+        EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
+
+        CRYPTO_ofb128_encrypt(in,out,len,&dat->ks,
+                        ctx->iv,&ctx->num,dat->block);
+        return 1;
+}
+
+static int aes_cfb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
+        const unsigned char *in,size_t len)
+{
+        EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
+
+        CRYPTO_cfb128_encrypt(in,out,len,&dat->ks,
+                        ctx->iv,&ctx->num,ctx->encrypt,dat->block);
+        return 1;
+}
+
+static int aes_cfb8_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
+        const unsigned char *in,size_t len)
+{
+        EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
+
+        CRYPTO_cfb128_8_encrypt(in,out,len,&dat->ks,
+                        ctx->iv,&ctx->num,ctx->encrypt,dat->block);
+        return 1;
+}
+
+static int aes_cfb1_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
+        const unsigned char *in,size_t len)
+{
+        EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
+
+        if (ctx->flags&EVP_CIPH_FLAG_LENGTH_BITS) {
+                CRYPTO_cfb128_1_encrypt(in,out,len,&dat->ks,
+                        ctx->iv,&ctx->num,ctx->encrypt,dat->block);
+                return 1;
+        }
+
+        while (len>=MAXBITCHUNK) {
+                CRYPTO_cfb128_1_encrypt(in,out,MAXBITCHUNK*8,&dat->ks,
+                        ctx->iv,&ctx->num,ctx->encrypt,dat->block);
+                len-=MAXBITCHUNK;
+        }
+        if (len)
+                CRYPTO_cfb128_1_encrypt(in,out,len*8,&dat->ks,
+                        ctx->iv,&ctx->num,ctx->encrypt,dat->block);
+        
+        return 1;
+}
+
+static int aes_ctr_cipher (EVP_CIPHER_CTX *ctx, unsigned char *out,
+                const unsigned char *in, size_t len)
+{
+        unsigned int num = ctx->num;
+        EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
+
+        if (dat->stream.ctr)
+                CRYPTO_ctr128_encrypt_ctr32(in,out,len,&dat->ks,
+                        ctx->iv,ctx->buf,&num,dat->stream.ctr);
+        else
+                CRYPTO_ctr128_encrypt(in,out,len,&dat->ks,
+                        ctx->iv,ctx->buf,&num,dat->block);
+        ctx->num = (size_t)num;
+        return 1;
+}
+
+BLOCK_CIPHER_generic_pack(NID_aes,128,EVP_CIPH_FLAG_FIPS)
+BLOCK_CIPHER_generic_pack(NID_aes,192,EVP_CIPH_FLAG_FIPS)
+BLOCK_CIPHER_generic_pack(NID_aes,256,EVP_CIPH_FLAG_FIPS)
+
+static int aes_gcm_cleanup(EVP_CIPHER_CTX *c)
+        {
+        EVP_AES_GCM_CTX *gctx = c->cipher_data;
+        OPENSSL_cleanse(&gctx->gcm, sizeof(gctx->gcm));
+        if (gctx->iv != c->iv)
+                OPENSSL_free(gctx->iv);
+        return 1;
+        }
+
+/* increment counter (64-bit int) by 1 */
+static void ctr64_inc(unsigned char *counter) {
+        int n=8;
+        unsigned char  c;
+
+        do {
+                --n;
+                c = counter[n];
+                ++c;
+                counter[n] = c;
+                if (c) return;
+        } while (n);
+}
+
+static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
+        {
+        EVP_AES_GCM_CTX *gctx = c->cipher_data;
+        switch (type)
+                {
+        case EVP_CTRL_INIT:
+                gctx->key_set = 0;
+                gctx->iv_set = 0;
+                gctx->ivlen = c->cipher->iv_len;
+                gctx->iv = c->iv;
+                gctx->taglen = -1;
+                gctx->iv_gen = 0;
+                gctx->tls_aad_len = -1;
+                return 1;
+
+        case EVP_CTRL_GCM_SET_IVLEN:
+                if (arg <= 0)
+                        return 0;
+#ifdef OPENSSL_FIPS
+                if (FIPS_module_mode() && !(c->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)
+                                                 && arg < 12)
+                        return 0;
+#endif
+                /* Allocate memory for IV if needed */
+                if ((arg > EVP_MAX_IV_LENGTH) && (arg > gctx->ivlen))
+                        {
+                        if (gctx->iv != c->iv)
+                                OPENSSL_free(gctx->iv);
+                        gctx->iv = OPENSSL_malloc(arg);
+                        if (!gctx->iv)
+                                return 0;
+                        }
+                gctx->ivlen = arg;
+                return 1;
+
+        case EVP_CTRL_GCM_SET_TAG:
+                if (arg <= 0 || arg > 16 || c->encrypt)
+                        return 0;
+                memcpy(c->buf, ptr, arg);
+                gctx->taglen = arg;
+                return 1;
+
+        case EVP_CTRL_GCM_GET_TAG:
+                if (arg <= 0 || arg > 16 || !c->encrypt || gctx->taglen < 0)
+                        return 0;
+                memcpy(ptr, c->buf, arg);
+                return 1;
+
+        case EVP_CTRL_GCM_SET_IV_FIXED:
+                /* Special case: -1 length restores whole IV */
+                if (arg == -1)
+                        {
+                        memcpy(gctx->iv, ptr, gctx->ivlen);
+                        gctx->iv_gen = 1;
+                        return 1;
+                        }
+                /* Fixed field must be at least 4 bytes and invocation field
+                 * at least 8.
+                 */
+                if ((arg < 4) || (gctx->ivlen - arg) < 8)
+                        return 0;
+                if (arg)
+                        memcpy(gctx->iv, ptr, arg);
+                if (c->encrypt &&
+                        RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)
+                        return 0;
+                gctx->iv_gen = 1;
+                return 1;
+
+        case EVP_CTRL_GCM_IV_GEN:
+                if (gctx->iv_gen == 0 || gctx->key_set == 0)
+                        return 0;
+                CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen);
+                if (arg <= 0 || arg > gctx->ivlen)
+                        arg = gctx->ivlen;
+                memcpy(ptr, gctx->iv + gctx->ivlen - arg, arg);
+                /* Invocation field will be at least 8 bytes in size and
+                 * so no need to check wrap around or increment more than
+                 * last 8 bytes.
+                 */
+                ctr64_inc(gctx->iv + gctx->ivlen - 8);
+                gctx->iv_set = 1;
+                return 1;
+
+        case EVP_CTRL_GCM_SET_IV_INV:
+                if (gctx->iv_gen == 0 || gctx->key_set == 0 || c->encrypt)
+                        return 0;
+                memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg);
+                CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen);
+                gctx->iv_set = 1;
+                return 1;
+
+        case EVP_CTRL_AEAD_TLS1_AAD:
+                /* Save the AAD for later use */
+                if (arg != 13)
+                        return 0;
+                memcpy(c->buf, ptr, arg);
+                gctx->tls_aad_len = arg;
+                        {
+                        unsigned int len=c->buf[arg-2]<<8|c->buf[arg-1];
+                        /* Correct length for explicit IV */
+                        len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
+                        /* If decrypting correct for tag too */
+                        if (!c->encrypt)
+                                len -= EVP_GCM_TLS_TAG_LEN;
+                        c->buf[arg-2] = len>>8;
+                        c->buf[arg-1] = len & 0xff;
+                        }
+                /* Extra padding: tag appended to record */
+                return EVP_GCM_TLS_TAG_LEN;
+
+        default:
+                return -1;
+
+                }
+        }
+
+static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                        const unsigned char *iv, int enc)
+        {
+        EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
+        if (!iv && !key)
+                return 1;
+        if (key)
+                { do {
+#ifdef BSAES_CAPABLE
+                if (BSAES_CAPABLE)
+                        {
+                        AES_set_encrypt_key(key,ctx->key_len*8,&gctx->ks);
+                        CRYPTO_gcm128_init(&gctx->gcm,&gctx->ks,
+                                        (block128_f)AES_encrypt);
+                        gctx->ctr = (ctr128_f)bsaes_ctr32_encrypt_blocks;
+                        break;
+                        }
+                else
+#endif
+#ifdef VPAES_CAPABLE
+                if (VPAES_CAPABLE)
+                        {
+                        vpaes_set_encrypt_key(key,ctx->key_len*8,&gctx->ks);
+                        CRYPTO_gcm128_init(&gctx->gcm,&gctx->ks,
+                                        (block128_f)vpaes_encrypt);
+                        gctx->ctr = NULL;
+                        break;
+                        }
+#endif
+                AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks);
+                CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, (block128_f)AES_encrypt);
+#ifdef AES_CTR_ASM
+                gctx->ctr = (ctr128_f)AES_ctr32_encrypt;
+#else
+                gctx->ctr = NULL;
+#endif
+                } while (0);
+
+                /* If we have an iv can set it directly, otherwise use
+                 * saved IV.
+                 */
+                if (iv == NULL && gctx->iv_set)
+                        iv = gctx->iv;
+                if (iv)
+                        {
+                        CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
+                        gctx->iv_set = 1;
+                        }
+                gctx->key_set = 1;
+                }
+        else
+                {
+                /* If key set use IV, otherwise copy */
+                if (gctx->key_set)
+                        CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
+                else
+                        memcpy(gctx->iv, iv, gctx->ivlen);
+                gctx->iv_set = 1;
+                gctx->iv_gen = 0;
+                }
+        return 1;
+        }
+
+/* Handle TLS GCM packet format. This consists of the last portion of the IV
+ * followed by the payload and finally the tag. On encrypt generate IV,
+ * encrypt payload and write the tag. On verify retrieve IV, decrypt payload
+ * and verify tag.
+ */
+
+static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                const unsigned char *in, size_t len)
+        {
+        EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
+        int rv = -1;
+        /* Encrypt/decrypt must be performed in place */
+        if (out != in || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN+EVP_GCM_TLS_TAG_LEN))
+                return -1;
+        /* Set IV from start of buffer or generate IV and write to start
+         * of buffer.
+         */
+        if (EVP_CIPHER_CTX_ctrl(ctx, ctx->encrypt ?
+                                EVP_CTRL_GCM_IV_GEN : EVP_CTRL_GCM_SET_IV_INV,
+                                EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)
+                goto err;
+        /* Use saved AAD */
+        if (CRYPTO_gcm128_aad(&gctx->gcm, ctx->buf, gctx->tls_aad_len))
+                goto err;
+        /* Fix buffer and length to point to payload */
+        in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
+        out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
+        len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
+        if (ctx->encrypt)
+                {
+                /* Encrypt payload */
+                if (gctx->ctr)
+                        {
+                        if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm,
+                                                        in, out, len,
+                                                        gctx->ctr))
+                                goto err;
+                        }
+                else    {
+                        if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, len))
+                                goto err;
+                        }
+                out += len;
+                /* Finally write tag */
+                CRYPTO_gcm128_tag(&gctx->gcm, out, EVP_GCM_TLS_TAG_LEN);
+                rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
+                }
+        else
+                {
+                /* Decrypt */
+                if (gctx->ctr)
+                        {
+                        if (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm,
+                                                        in, out, len,
+                                                        gctx->ctr))
+                                goto err;
+                        }
+                else    {
+                        if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, len))
+                                goto err;
+                        }
+                /* Retrieve tag */
+                CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf,
+                                        EVP_GCM_TLS_TAG_LEN);
+                /* If tag mismatch wipe buffer */
+                if (memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN))
+                        {
+                        OPENSSL_cleanse(out, len);
+                        goto err;
+                        }
+                rv = len;
+                }
+
+        err:
+        gctx->iv_set = 0;
+        gctx->tls_aad_len = -1;
+        return rv;
+        }
+
+static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                const unsigned char *in, size_t len)
+        {
+        EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
+        /* If not set up, return error */
+        if (!gctx->key_set)
+                return -1;
+
+        if (gctx->tls_aad_len >= 0)
+                return aes_gcm_tls_cipher(ctx, out, in, len);
+
+        if (!gctx->iv_set)
+                return -1;
+        if (!ctx->encrypt && gctx->taglen < 0)
+                return -1;
+        if (in)
+                {
+                if (out == NULL)
+                        {
+                        if (CRYPTO_gcm128_aad(&gctx->gcm, in, len))
+                                return -1;
+                        }
+                else if (ctx->encrypt)
+                        {
+                        if (gctx->ctr)
+                                {
+                                if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm,
+                                                        in, out, len,
+                                                        gctx->ctr))
+                                        return -1;
+                                }
+                        else    {
+                                if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, len))
+                                        return -1;
+                                }
+                        }
+                else
+                        {
+                        if (gctx->ctr)
+                                {
+                                if (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm,
+                                                        in, out, len,
+                                                        gctx->ctr))
+                                        return -1;
+                                }
+                        else    {
+                                if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, len))
+                                        return -1;
+                                }
+                        }
+                return len;
+                }
+        else
+                {
+                if (!ctx->encrypt)
+                        {
+                        if (CRYPTO_gcm128_finish(&gctx->gcm,
+                                        ctx->buf, gctx->taglen) != 0)
+                                return -1;
+                        gctx->iv_set = 0;
+                        return 0;
+                        }
+                CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 16);
+                gctx->taglen = 16;
+                /* Don't reuse the IV */
+                gctx->iv_set = 0;
+                return 0;
+                }
+
+        }
+
+#define CUSTOM_FLAGS    (EVP_CIPH_FLAG_DEFAULT_ASN1 \
+                | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \
+                | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT)
+
+BLOCK_CIPHER_custom(NID_aes,128,1,12,gcm,GCM,
+                EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
+BLOCK_CIPHER_custom(NID_aes,192,1,12,gcm,GCM,
+                EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
+BLOCK_CIPHER_custom(NID_aes,256,1,12,gcm,GCM,
+                EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
+
+static int aes_xts_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
+        {
+        EVP_AES_XTS_CTX *xctx = c->cipher_data;
+        if (type != EVP_CTRL_INIT)
+                return -1;
+        /* key1 and key2 are used as an indicator both key and IV are set */
+        xctx->xts.key1 = NULL;
+        xctx->xts.key2 = NULL;
+        return 1;
+        }
+
+static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                        const unsigned char *iv, int enc)
+        {
+        EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
+        if (!iv && !key)
+                return 1;
+
+        if (key) do
+                {
+#ifdef AES_XTS_ASM
+                xctx->stream = enc ? AES_xts_encrypt : AES_xts_decrypt;
+#else
+                xctx->stream = NULL;
+#endif
+                /* key_len is two AES keys */
+#ifdef BSAES_CAPABLE
+                if (BSAES_CAPABLE)
+                        xctx->stream = enc ? bsaes_xts_encrypt : bsaes_xts_decrypt;
+                else
+#endif
+#ifdef VPAES_CAPABLE
+                if (VPAES_CAPABLE)
+                    {
+                    if (enc)
+                        {
+                        vpaes_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1);
+                        xctx->xts.block1 = (block128_f)vpaes_encrypt;
+                        }
+                    else
+                        {
+                        vpaes_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1);
+                        xctx->xts.block1 = (block128_f)vpaes_decrypt;
+                        }
+
+                vpaes_set_encrypt_key(key + ctx->key_len/2,
+                                                ctx->key_len * 4, &xctx->ks2);
+                xctx->xts.block2 = (block128_f)vpaes_encrypt;
+
+                xctx->xts.key1 = &xctx->ks1;
+                break;
+                }
+#endif
+                if (enc)
+                        {
+                        AES_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1);
+                        xctx->xts.block1 = (block128_f)AES_encrypt;
+                        }
+                else
+                        {
+                        AES_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1);
+                        xctx->xts.block1 = (block128_f)AES_decrypt;
+                        }
+
+                AES_set_encrypt_key(key + ctx->key_len/2,
+                                                ctx->key_len * 4, &xctx->ks2);
+                xctx->xts.block2 = (block128_f)AES_encrypt;
+
+                xctx->xts.key1 = &xctx->ks1;
+                } while (0);
+
+        if (iv)
+                {
+                xctx->xts.key2 = &xctx->ks2;
+                memcpy(ctx->iv, iv, 16);
+                }
+
+        return 1;
+        }
+
+static int aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                const unsigned char *in, size_t len)
+        {
+        EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
+        if (!xctx->xts.key1 || !xctx->xts.key2)
+                return 0;
+        if (!out || !in || len<AES_BLOCK_SIZE)
+                return 0;
+#ifdef OPENSSL_FIPS
+        /* Requirement of SP800-38E */
+        if (FIPS_module_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) &&
+                        (len > (1UL<<20)*16))
+                {
+                EVPerr(EVP_F_AES_XTS_CIPHER, EVP_R_TOO_LARGE);
+                return 0;
+                }
+#endif
+        if (xctx->stream)
+                (*xctx->stream)(in, out, len,
+                                xctx->xts.key1, xctx->xts.key2, ctx->iv);
+        else if (CRYPTO_xts128_encrypt(&xctx->xts, ctx->iv, in, out, len,
+                                                                ctx->encrypt))
+                return 0;
+        return 1;
+        }
+
+#define aes_xts_cleanup NULL
+
+#define XTS_FLAGS       (EVP_CIPH_FLAG_DEFAULT_ASN1 | EVP_CIPH_CUSTOM_IV \
+                         | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT)
+
+BLOCK_CIPHER_custom(NID_aes,128,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|XTS_FLAGS)
+BLOCK_CIPHER_custom(NID_aes,256,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|XTS_FLAGS)
+
+static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
+        {
+        EVP_AES_CCM_CTX *cctx = c->cipher_data;
+        switch (type)
+                {
+        case EVP_CTRL_INIT:
+                cctx->key_set = 0;
+                cctx->iv_set = 0;
+                cctx->L = 8;
+                cctx->M = 12;
+                cctx->tag_set = 0;
+                cctx->len_set = 0;
+                return 1;
+
+        case EVP_CTRL_CCM_SET_IVLEN:
+                arg = 15 - arg;
+        case EVP_CTRL_CCM_SET_L:
+                if (arg < 2 || arg > 8)
+                        return 0;
+                cctx->L = arg;
+                return 1;
+
+        case EVP_CTRL_CCM_SET_TAG:
+                if ((arg & 1) || arg < 4 || arg > 16)
+                        return 0;
+                if ((c->encrypt && ptr) || (!c->encrypt && !ptr))
+                        return 0;
+                if (ptr)
+                        {
+                        cctx->tag_set = 1;
+                        memcpy(c->buf, ptr, arg);
+                        }
+                cctx->M = arg;
+                return 1;
+
+        case EVP_CTRL_CCM_GET_TAG:
+                if (!c->encrypt || !cctx->tag_set)
+                        return 0;
+                if(!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))
+                        return 0;
+                cctx->tag_set = 0;
+                cctx->iv_set = 0;
+                cctx->len_set = 0;
+                return 1;
+
+        default:
+                return -1;
+
+                }
+        }
+
+static int aes_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                        const unsigned char *iv, int enc)
+        {
+        EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
+        if (!iv && !key)
+                return 1;
+        if (key) do
+                {
+#ifdef VPAES_CAPABLE
+                if (VPAES_CAPABLE)
+                        {
+                        vpaes_set_encrypt_key(key, ctx->key_len*8, &cctx->ks);
+                        CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
+                                        &cctx->ks, (block128_f)vpaes_encrypt);
+                        cctx->key_set = 1;
+                        break;
+                        }
+#endif
+                AES_set_encrypt_key(key, ctx->key_len * 8, &cctx->ks);
+                CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
+                                        &cctx->ks, (block128_f)AES_encrypt);
+                cctx->str = NULL;
+                cctx->key_set = 1;
+                } while (0);
+        if (iv)
+                {
+                memcpy(ctx->iv, iv, 15 - cctx->L);
+                cctx->iv_set = 1;
+                }
+        return 1;
+        }
+
+static int aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+                const unsigned char *in, size_t len)
+        {
+        EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
+        CCM128_CONTEXT *ccm = &cctx->ccm;
+        /* If not set up, return error */
+        if (!cctx->iv_set && !cctx->key_set)
+                return -1;
+        if (!ctx->encrypt && !cctx->tag_set)
+                return -1;
+        if (!out)
+                {
+                if (!in)
+                        {
+                        if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L,len))
+                                return -1;
+                        cctx->len_set = 1;
+                        return len;
+                        }
+                /* If have AAD need message length */
+                if (!cctx->len_set && len)
+                        return -1;
+                CRYPTO_ccm128_aad(ccm, in, len);
+                return len;
+                }
+        /* EVP_*Final() doesn't return any data */
+        if (!in)
+                return 0;
+        /* If not set length yet do it */
+        if (!cctx->len_set)
+                {
+                if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L, len))
+                        return -1;
+                cctx->len_set = 1;
+                }
+        if (ctx->encrypt)
+                {
+                if (cctx->str ? CRYPTO_ccm128_encrypt_ccm64(ccm, in, out, len,
+                                                cctx->str) :
+                                CRYPTO_ccm128_encrypt(ccm, in, out, len))
+                        return -1;
+                cctx->tag_set = 1;
+                return len;
+                }
+        else
+                {
+                int rv = -1;
+                if (cctx->str ? !CRYPTO_ccm128_decrypt_ccm64(ccm, in, out, len,
+                                                cctx->str) :
+                                !CRYPTO_ccm128_decrypt(ccm, in, out, len))
+                        {
+                        unsigned char tag[16];
+                        if (CRYPTO_ccm128_tag(ccm, tag, cctx->M))
+                                {
+                                if (!memcmp(tag, ctx->buf, cctx->M))
+                                        rv = len;
+                                }
+                        }
+                if (rv == -1)
+                        OPENSSL_cleanse(out, len);
+                cctx->iv_set = 0;
+                cctx->tag_set = 0;
+                cctx->len_set = 0;
+                return rv;
+                }
+
+        }
+
+#define aes_ccm_cleanup NULL
+
+BLOCK_CIPHER_custom(NID_aes,128,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
+BLOCK_CIPHER_custom(NID_aes,192,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
+BLOCK_CIPHER_custom(NID_aes,256,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
+
+#endif
 #endif
diff --git a/src/lib/libcrypto/evp/e_des3.c b/src/lib/libcrypto/evp/e_des3.c
index 3232cfe024..1e69972662 100644
--- a/src/lib/libcrypto/evp/e_des3.c
+++ b/src/lib/libcrypto/evp/e_des3.c
@@ -65,6 +65,8 @@
 #include <openssl/des.h>
 #include <openssl/rand.h>
 
+#ifndef OPENSSL_FIPS
+
 static int des_ede_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
                             const unsigned char *iv,int enc);
 
@@ -311,3 +313,4 @@ const EVP_CIPHER *EVP_des_ede3(void)
         return &des_ede3_ecb;
 }
 #endif
+#endif
diff --git a/src/lib/libcrypto/evp/e_null.c b/src/lib/libcrypto/evp/e_null.c
index 7cf50e1416..f0c1f78b5f 100644
--- a/src/lib/libcrypto/evp/e_null.c
+++ b/src/lib/libcrypto/evp/e_null.c
@@ -61,6 +61,8 @@
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 
+#ifndef OPENSSL_FIPS
+
 static int null_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
         const unsigned char *iv,int enc);
 static int null_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
@@ -99,4 +101,4 @@ static int null_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                 memcpy((char *)out,(const char *)in,inl);
         return 1;
         }
-
+#endif
diff --git a/src/lib/libcrypto/evp/e_rc2.c b/src/lib/libcrypto/evp/e_rc2.c
index f78d781129..d4c33b58d4 100644
--- a/src/lib/libcrypto/evp/e_rc2.c
+++ b/src/lib/libcrypto/evp/e_rc2.c
@@ -183,7 +183,8 @@ static int rc2_get_asn1_type_and_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
                 key_bits =rc2_magic_to_meth((int)num);
                 if (!key_bits)
                         return(-1);
-                if(i > 0) EVP_CipherInit_ex(c, NULL, NULL, NULL, iv, -1);
+                if(i > 0 && !EVP_CipherInit_ex(c, NULL, NULL, NULL, iv, -1))
+                        return -1;
                 EVP_CIPHER_CTX_ctrl(c, EVP_CTRL_SET_RC2_KEY_BITS, key_bits, NULL);
                 EVP_CIPHER_CTX_set_key_length(c, key_bits / 8);
                 }
diff --git a/src/lib/libcrypto/evp/e_rc4.c b/src/lib/libcrypto/evp/e_rc4.c
index 8b5175e0fd..b4f6bda82d 100644
--- a/src/lib/libcrypto/evp/e_rc4.c
+++ b/src/lib/libcrypto/evp/e_rc4.c
@@ -62,6 +62,7 @@
 #ifndef OPENSSL_NO_RC4
 
 #include <openssl/evp.h>
+#include "evp_locl.h"
 #include <openssl/objects.h>
 #include <openssl/rc4.h>
 
diff --git a/src/lib/libcrypto/evp/evp.h b/src/lib/libcrypto/evp/evp.h
index da93e945f5..aa9616e11b 100644
--- a/src/lib/libcrypto/evp/evp.h
+++ b/src/lib/libcrypto/evp/evp.h
@@ -83,7 +83,7 @@
 #define EVP_RC5_32_12_16_KEY_SIZE       16
 */
 #define EVP_MAX_MD_SIZE                 64      /* longest known is SHA512 */
-#define EVP_MAX_KEY_LENGTH              32
+#define EVP_MAX_KEY_LENGTH              64
 #define EVP_MAX_IV_LENGTH               16
 #define EVP_MAX_BLOCK_LENGTH            32
 
@@ -116,6 +116,7 @@
 #define EVP_PKEY_DH     NID_dhKeyAgreement
 #define EVP_PKEY_EC     NID_X9_62_id_ecPublicKey
 #define EVP_PKEY_HMAC   NID_hmac
+#define EVP_PKEY_CMAC   NID_cmac
 
 #ifdef  __cplusplus
 extern "C" {
@@ -216,6 +217,8 @@ typedef int evp_verify_method(int type,const unsigned char *m,
 
 #define EVP_MD_FLAG_DIGALGID_CUSTOM             0x0018
 
+#define EVP_MD_FLAG_FIPS        0x0400 /* Note if suitable for use in FIPS mode */
+
 /* Digest ctrls */
 
 #define EVP_MD_CTRL_DIGALGID                    0x1
@@ -325,6 +328,10 @@ struct evp_cipher_st
 #define         EVP_CIPH_CBC_MODE               0x2
 #define         EVP_CIPH_CFB_MODE               0x3
 #define         EVP_CIPH_OFB_MODE               0x4
+#define         EVP_CIPH_CTR_MODE               0x5
+#define         EVP_CIPH_GCM_MODE               0x6
+#define         EVP_CIPH_CCM_MODE               0x7
+#define         EVP_CIPH_XTS_MODE               0x10001
 #define         EVP_CIPH_MODE                   0xF0007
 /* Set if variable length cipher */
 #define         EVP_CIPH_VARIABLE_LENGTH        0x8
@@ -346,6 +353,15 @@ struct evp_cipher_st
 #define         EVP_CIPH_FLAG_DEFAULT_ASN1      0x1000
 /* Buffer length in bits not bytes: CFB1 mode only */
 #define         EVP_CIPH_FLAG_LENGTH_BITS       0x2000
+/* Note if suitable for use in FIPS mode */
+#define         EVP_CIPH_FLAG_FIPS              0x4000
+/* Allow non FIPS cipher in FIPS mode */
+#define         EVP_CIPH_FLAG_NON_FIPS_ALLOW    0x8000
+/* Cipher handles any and all padding logic as well
+ * as finalisation.
+ */
+#define         EVP_CIPH_FLAG_CUSTOM_CIPHER     0x100000
+#define         EVP_CIPH_FLAG_AEAD_CIPHER       0x200000
 
 /* ctrl() values */
 
@@ -358,7 +374,36 @@ struct evp_cipher_st
 #define         EVP_CTRL_RAND_KEY               0x6
 #define         EVP_CTRL_PBE_PRF_NID            0x7
 #define         EVP_CTRL_COPY                   0x8
-#define         EVP_CTRL_SET_ACSS_MODE          0x9
+#define         EVP_CTRL_GCM_SET_IVLEN          0x9
+#define         EVP_CTRL_GCM_GET_TAG            0x10
+#define         EVP_CTRL_GCM_SET_TAG            0x11
+#define         EVP_CTRL_GCM_SET_IV_FIXED       0x12
+#define         EVP_CTRL_GCM_IV_GEN             0x13
+#define         EVP_CTRL_CCM_SET_IVLEN          EVP_CTRL_GCM_SET_IVLEN
+#define         EVP_CTRL_CCM_GET_TAG            EVP_CTRL_GCM_GET_TAG
+#define         EVP_CTRL_CCM_SET_TAG            EVP_CTRL_GCM_SET_TAG
+#define         EVP_CTRL_CCM_SET_L              0x14
+#define         EVP_CTRL_CCM_SET_MSGLEN         0x15
+/* AEAD cipher deduces payload length and returns number of bytes
+ * required to store MAC and eventual padding. Subsequent call to
+ * EVP_Cipher even appends/verifies MAC.
+ */
+#define         EVP_CTRL_AEAD_TLS1_AAD          0x16
+/* Used by composite AEAD ciphers, no-op in GCM, CCM... */
+#define         EVP_CTRL_AEAD_SET_MAC_KEY       0x17
+/* Set the GCM invocation field, decrypt only */
+#define         EVP_CTRL_GCM_SET_IV_INV         0x18
+
+/* OpenBSD extension */
+#define         EVP_CTRL_SET_ACSS_MODE          0x80
+
+/* GCM TLS constants */
+/* Length of fixed part of IV derived from PRF */
+#define EVP_GCM_TLS_FIXED_IV_LEN                        4
+/* Length of explicit part of IV part of TLS records */
+#define EVP_GCM_TLS_EXPLICIT_IV_LEN                     8
+/* Length of tag for TLS */
+#define EVP_GCM_TLS_TAG_LEN                             16
 
 typedef struct evp_cipher_info_st
         {
@@ -376,7 +421,7 @@ struct evp_cipher_ctx_st
         unsigned char  oiv[EVP_MAX_IV_LENGTH];  /* original iv */
         unsigned char  iv[EVP_MAX_IV_LENGTH];   /* working iv */
         unsigned char buf[EVP_MAX_BLOCK_LENGTH];/* saved partial block */
-        int num;                                /* used by cfb/ofb mode */
+        int num;                                /* used by cfb/ofb/ctr mode */
 
         void *app_data;         /* application stuff */
         int key_len;            /* May change for variable length cipher */
@@ -696,6 +741,9 @@ const EVP_MD *EVP_dev_crypto_md5(void);
 #ifndef OPENSSL_NO_RC4
 const EVP_CIPHER *EVP_rc4(void);
 const EVP_CIPHER *EVP_rc4_40(void);
+#ifndef OPENSSL_NO_MD5
+const EVP_CIPHER *EVP_rc4_hmac_md5(void);
+#endif
 #endif
 #ifndef OPENSSL_NO_IDEA
 const EVP_CIPHER *EVP_idea_ecb(void);
@@ -742,9 +790,10 @@ const EVP_CIPHER *EVP_aes_128_cfb8(void);
 const EVP_CIPHER *EVP_aes_128_cfb128(void);
 # define EVP_aes_128_cfb EVP_aes_128_cfb128
 const EVP_CIPHER *EVP_aes_128_ofb(void);
-#if 0
 const EVP_CIPHER *EVP_aes_128_ctr(void);
-#endif
+const EVP_CIPHER *EVP_aes_128_gcm(void);
+const EVP_CIPHER *EVP_aes_128_ccm(void);
+const EVP_CIPHER *EVP_aes_128_xts(void);
 const EVP_CIPHER *EVP_aes_192_ecb(void);
 const EVP_CIPHER *EVP_aes_192_cbc(void);
 const EVP_CIPHER *EVP_aes_192_cfb1(void);
@@ -752,9 +801,9 @@ const EVP_CIPHER *EVP_aes_192_cfb8(void);
 const EVP_CIPHER *EVP_aes_192_cfb128(void);
 # define EVP_aes_192_cfb EVP_aes_192_cfb128
 const EVP_CIPHER *EVP_aes_192_ofb(void);
-#if 0
 const EVP_CIPHER *EVP_aes_192_ctr(void);
-#endif
+const EVP_CIPHER *EVP_aes_192_gcm(void);
+const EVP_CIPHER *EVP_aes_192_ccm(void);
 const EVP_CIPHER *EVP_aes_256_ecb(void);
 const EVP_CIPHER *EVP_aes_256_cbc(void);
 const EVP_CIPHER *EVP_aes_256_cfb1(void);
@@ -762,8 +811,13 @@ const EVP_CIPHER *EVP_aes_256_cfb8(void);
 const EVP_CIPHER *EVP_aes_256_cfb128(void);
 # define EVP_aes_256_cfb EVP_aes_256_cfb128
 const EVP_CIPHER *EVP_aes_256_ofb(void);
-#if 0
 const EVP_CIPHER *EVP_aes_256_ctr(void);
+const EVP_CIPHER *EVP_aes_256_gcm(void);
+const EVP_CIPHER *EVP_aes_256_ccm(void);
+const EVP_CIPHER *EVP_aes_256_xts(void);
+#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
+const EVP_CIPHER *EVP_aes_128_cbc_hmac_sha1(void);
+const EVP_CIPHER *EVP_aes_256_cbc_hmac_sha1(void);
 #endif
 #endif
 #ifndef OPENSSL_NO_ACSS
@@ -1051,13 +1105,22 @@ void EVP_PKEY_asn1_set_ctrl(EVP_PKEY_ASN1_METHOD *ameth,
 #define EVP_PKEY_CTRL_CMS_DECRYPT       10
 #define EVP_PKEY_CTRL_CMS_SIGN          11
 
+#define EVP_PKEY_CTRL_CIPHER            12
+
 #define EVP_PKEY_ALG_CTRL               0x1000
 
 
 #define EVP_PKEY_FLAG_AUTOARGLEN        2
+/* Method handles all operations: don't assume any digest related
+ * defaults.
+ */
+#define EVP_PKEY_FLAG_SIGCTX_CUSTOM     4
 
 const EVP_PKEY_METHOD *EVP_PKEY_meth_find(int type);
 EVP_PKEY_METHOD* EVP_PKEY_meth_new(int id, int flags);
+void EVP_PKEY_meth_get0_info(int *ppkey_id, int *pflags,
+                                const EVP_PKEY_METHOD *meth);
+void EVP_PKEY_meth_copy(EVP_PKEY_METHOD *dst, const EVP_PKEY_METHOD *src);
 void EVP_PKEY_meth_free(EVP_PKEY_METHOD *pmeth);
 int EVP_PKEY_meth_add0(const EVP_PKEY_METHOD *pmeth);
 
@@ -1075,7 +1138,7 @@ int EVP_PKEY_CTX_get_operation(EVP_PKEY_CTX *ctx);
 void EVP_PKEY_CTX_set0_keygen_info(EVP_PKEY_CTX *ctx, int *dat, int datlen);
 
 EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e,
-                                unsigned char *key, int keylen);
+                                const unsigned char *key, int keylen);
 
 void EVP_PKEY_CTX_set_data(EVP_PKEY_CTX *ctx, void *data);
 void *EVP_PKEY_CTX_get_data(EVP_PKEY_CTX *ctx);
@@ -1194,9 +1257,13 @@ void ERR_load_EVP_strings(void);
 /* Error codes for the EVP functions. */
 
 /* Function codes. */
-#define EVP_F_AESNI_INIT_KEY                             165
+#define EVP_F_AESNI_INIT_KEY                             165
+#define EVP_F_AESNI_XTS_CIPHER                           176
 #define EVP_F_AES_INIT_KEY                               133
+#define EVP_F_AES_XTS                                    172
+#define EVP_F_AES_XTS_CIPHER                             175
 #define EVP_F_CAMELLIA_INIT_KEY                          159
+#define EVP_F_CMAC_INIT                                  173
 #define EVP_F_D2I_PKEY                                   100
 #define EVP_F_DO_SIGVER_INIT                             161
 #define EVP_F_DSAPKEY2PKCS8                              134
@@ -1251,15 +1318,24 @@ void ERR_load_EVP_strings(void);
 #define EVP_F_EVP_RIJNDAEL                               126
 #define EVP_F_EVP_SIGNFINAL                              107
 #define EVP_F_EVP_VERIFYFINAL                            108
+#define EVP_F_FIPS_CIPHERINIT                            166
+#define EVP_F_FIPS_CIPHER_CTX_COPY                       170
+#define EVP_F_FIPS_CIPHER_CTX_CTRL                       167
+#define EVP_F_FIPS_CIPHER_CTX_SET_KEY_LENGTH             171
+#define EVP_F_FIPS_DIGESTINIT                            168
+#define EVP_F_FIPS_MD_CTX_COPY                           169
+#define EVP_F_HMAC_INIT_EX                               174
 #define EVP_F_INT_CTX_NEW                                157
 #define EVP_F_PKCS5_PBE_KEYIVGEN                         117
 #define EVP_F_PKCS5_V2_PBE_KEYIVGEN                      118
+#define EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN                   164
 #define EVP_F_PKCS8_SET_BROKEN                           112
 #define EVP_F_PKEY_SET_TYPE                              158
 #define EVP_F_RC2_MAGIC_TO_METH                          109
 #define EVP_F_RC5_CTRL                                   125
 
 /* Reason codes. */
+#define EVP_R_AES_IV_SETUP_FAILED                        162
 #define EVP_R_AES_KEY_SETUP_FAILED                       143
 #define EVP_R_ASN1_LIB                                   140
 #define EVP_R_BAD_BLOCK_LENGTH                           136
@@ -1277,6 +1353,7 @@ void ERR_load_EVP_strings(void);
 #define EVP_R_DECODE_ERROR                               114
 #define EVP_R_DIFFERENT_KEY_TYPES                        101
 #define EVP_R_DIFFERENT_PARAMETERS                       153
+#define EVP_R_DISABLED_FOR_FIPS                          163
 #define EVP_R_ENCODE_ERROR                               115
 #define EVP_R_EVP_PBE_CIPHERINIT_ERROR                   119
 #define EVP_R_EXPECTING_AN_RSA_KEY                       127
@@ -1308,6 +1385,7 @@ void ERR_load_EVP_strings(void);
 #define EVP_R_PRIVATE_KEY_DECODE_ERROR                   145
 #define EVP_R_PRIVATE_KEY_ENCODE_ERROR                   146
 #define EVP_R_PUBLIC_KEY_NOT_RSA                         106
+#define EVP_R_TOO_LARGE                                  164
 #define EVP_R_UNKNOWN_CIPHER                             160
 #define EVP_R_UNKNOWN_DIGEST                             161
 #define EVP_R_UNKNOWN_PBE_ALGORITHM                      121
diff --git a/src/lib/libcrypto/evp/evp_enc.c b/src/lib/libcrypto/evp/evp_enc.c
index c268d25cb4..0c54f05e6e 100644
--- a/src/lib/libcrypto/evp/evp_enc.c
+++ b/src/lib/libcrypto/evp/evp_enc.c
@@ -64,8 +64,18 @@
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
 #include "evp_locl.h"
 
+#ifdef OPENSSL_FIPS
+#define M_do_cipher(ctx, out, in, inl) FIPS_cipher(ctx, out, in, inl)
+#else
+#define M_do_cipher(ctx, out, in, inl) ctx->cipher->do_cipher(ctx, out, in, inl)
+#endif
+
+
 const char EVP_version[]="EVP" OPENSSL_VERSION_PTEXT;
 
 void EVP_CIPHER_CTX_init(EVP_CIPHER_CTX *ctx)
@@ -115,10 +125,14 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
                 /* Ensure a context left lying around from last time is cleared
                  * (the previous check attempted to avoid this if the same
                  * ENGINE and EVP_CIPHER could be used). */
-                EVP_CIPHER_CTX_cleanup(ctx);
-
-                /* Restore encrypt field: it is zeroed by cleanup */
-                ctx->encrypt = enc;
+                if (ctx->cipher)
+                        {
+                        unsigned long flags = ctx->flags;
+                        EVP_CIPHER_CTX_cleanup(ctx);
+                        /* Restore encrypt and flags */
+                        ctx->encrypt = enc;
+                        ctx->flags = flags;
+                        }
 #ifndef OPENSSL_NO_ENGINE
                 if(impl)
                         {
@@ -155,6 +169,10 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
                         ctx->engine = NULL;
 #endif
 
+#ifdef OPENSSL_FIPS
+                if (FIPS_mode())
+                        return FIPS_cipherinit(ctx, cipher, key, iv, enc);
+#endif
                 ctx->cipher=cipher;
                 if (ctx->cipher->ctx_size)
                         {
@@ -188,6 +206,10 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
 #ifndef OPENSSL_NO_ENGINE
 skip_to_init:
 #endif
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode())
+                return FIPS_cipherinit(ctx, cipher, key, iv, enc);
+#endif
         /* we assume block size is a power of 2 in *cryptUpdate */
         OPENSSL_assert(ctx->cipher->block_size == 1
             || ctx->cipher->block_size == 8
@@ -214,6 +236,13 @@ skip_to_init:
                         memcpy(ctx->iv, ctx->oiv, EVP_CIPHER_CTX_iv_length(ctx));
                         break;
 
+                        case EVP_CIPH_CTR_MODE:
+                        ctx->num = 0;
+                        /* Don't reuse IV for CTR mode */
+                        if(iv)
+                                memcpy(ctx->iv, iv, EVP_CIPHER_CTX_iv_length(ctx));
+                        break;
+
                         default:
                         return 0;
                         break;
@@ -280,6 +309,16 @@ int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
         {
         int i,j,bl;
 
+        if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER)
+                {
+                i = M_do_cipher(ctx, out, in, inl);
+                if (i < 0)
+                        return 0;
+                else
+                        *outl = i;
+                return 1;
+                }
+
         if (inl <= 0)
                 {
                 *outl = 0;
@@ -288,7 +327,7 @@ int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
 
         if(ctx->buf_len == 0 && (inl&(ctx->block_mask)) == 0)
                 {
-                if(ctx->cipher->do_cipher(ctx,out,in,inl))
+                if(M_do_cipher(ctx,out,in,inl))
                         {
                         *outl=inl;
                         return 1;
@@ -315,7 +354,7 @@ int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
                         {
                         j=bl-i;
                         memcpy(&(ctx->buf[i]),in,j);
-                        if(!ctx->cipher->do_cipher(ctx,out,ctx->buf,bl)) return 0;
+                        if(!M_do_cipher(ctx,out,ctx->buf,bl)) return 0;
                         inl-=j;
                         in+=j;
                         out+=bl;
@@ -328,7 +367,7 @@ int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
         inl-=i;
         if (inl > 0)
                 {
-                if(!ctx->cipher->do_cipher(ctx,out,in,inl)) return 0;
+                if(!M_do_cipher(ctx,out,in,inl)) return 0;
                 *outl+=inl;
                 }
 
@@ -350,6 +389,16 @@ int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
         int n,ret;
         unsigned int i, b, bl;
 
+        if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER)
+                {
+                ret = M_do_cipher(ctx, out, NULL, 0);
+                if (ret < 0)
+                        return 0;
+                else 
+                        *outl = ret;
+                return 1;
+                }
+
         b=ctx->cipher->block_size;
         OPENSSL_assert(b <= sizeof ctx->buf);
         if (b == 1)
@@ -372,7 +421,7 @@ int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
         n=b-bl;
         for (i=bl; i<b; i++)
                 ctx->buf[i]=n;
-        ret=ctx->cipher->do_cipher(ctx,out,ctx->buf,b);
+        ret=M_do_cipher(ctx,out,ctx->buf,b);
 
 
         if(ret)
@@ -387,6 +436,19 @@ int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
         int fix_len;
         unsigned int b;
 
+        if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER)
+                {
+                fix_len = M_do_cipher(ctx, out, in, inl);
+                if (fix_len < 0)
+                        {
+                        *outl = 0;
+                        return 0;
+                        }
+                else
+                        *outl = fix_len;
+                return 1;
+                }
+
         if (inl <= 0)
                 {
                 *outl = 0;
@@ -440,8 +502,18 @@ int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
         {
         int i,n;
         unsigned int b;
-
         *outl=0;
+
+        if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER)
+                {
+                i = M_do_cipher(ctx, out, NULL, 0);
+                if (i < 0)
+                        return 0;
+                else
+                        *outl = i;
+                return 1;
+                }
+
         b=ctx->cipher->block_size;
         if (ctx->flags & EVP_CIPH_NO_PADDING)
                 {
@@ -496,6 +568,7 @@ void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx)
 
 int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *c)
         {
+#ifndef OPENSSL_FIPS
         if (c->cipher != NULL)
                 {
                 if(c->cipher->cleanup && !c->cipher->cleanup(c))
@@ -506,12 +579,16 @@ int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *c)
                 }
         if (c->cipher_data)
                 OPENSSL_free(c->cipher_data);
+#endif
 #ifndef OPENSSL_NO_ENGINE
         if (c->engine)
                 /* The EVP_CIPHER we used belongs to an ENGINE, release the
                  * functional reference we held for this reason. */
                 ENGINE_finish(c->engine);
 #endif
+#ifdef OPENSSL_FIPS
+        FIPS_cipher_ctx_cleanup(c);
+#endif
         memset(c,0,sizeof(EVP_CIPHER_CTX));
         return 1;
         }
diff --git a/src/lib/libcrypto/evp/evp_err.c b/src/lib/libcrypto/evp/evp_err.c
index 6b585c7483..db0f76d59b 100644
--- a/src/lib/libcrypto/evp/evp_err.c
+++ b/src/lib/libcrypto/evp/evp_err.c
@@ -1,6 +1,6 @@
 /* crypto/evp/evp_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2008 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -71,8 +71,12 @@
 static ERR_STRING_DATA EVP_str_functs[]=
         {
 {ERR_FUNC(EVP_F_AESNI_INIT_KEY),        "AESNI_INIT_KEY"},
+{ERR_FUNC(EVP_F_AESNI_XTS_CIPHER),      "AESNI_XTS_CIPHER"},
 {ERR_FUNC(EVP_F_AES_INIT_KEY),  "AES_INIT_KEY"},
+{ERR_FUNC(EVP_F_AES_XTS),       "AES_XTS"},
+{ERR_FUNC(EVP_F_AES_XTS_CIPHER),        "AES_XTS_CIPHER"},
 {ERR_FUNC(EVP_F_CAMELLIA_INIT_KEY),     "CAMELLIA_INIT_KEY"},
+{ERR_FUNC(EVP_F_CMAC_INIT),     "CMAC_INIT"},
 {ERR_FUNC(EVP_F_D2I_PKEY),      "D2I_PKEY"},
 {ERR_FUNC(EVP_F_DO_SIGVER_INIT),        "DO_SIGVER_INIT"},
 {ERR_FUNC(EVP_F_DSAPKEY2PKCS8), "DSAPKEY2PKCS8"},
@@ -87,7 +91,7 @@ static ERR_STRING_DATA EVP_str_functs[]=
 {ERR_FUNC(EVP_F_EVP_DIGESTINIT_EX),     "EVP_DigestInit_ex"},
 {ERR_FUNC(EVP_F_EVP_ENCRYPTFINAL_EX),   "EVP_EncryptFinal_ex"},
 {ERR_FUNC(EVP_F_EVP_MD_CTX_COPY_EX),    "EVP_MD_CTX_copy_ex"},
-{ERR_FUNC(EVP_F_EVP_MD_SIZE),   "EVP_MD_SIZE"},
+{ERR_FUNC(EVP_F_EVP_MD_SIZE),   "EVP_MD_size"},
 {ERR_FUNC(EVP_F_EVP_OPENINIT),  "EVP_OpenInit"},
 {ERR_FUNC(EVP_F_EVP_PBE_ALG_ADD),       "EVP_PBE_alg_add"},
 {ERR_FUNC(EVP_F_EVP_PBE_ALG_ADD_TYPE),  "EVP_PBE_alg_add_type"},
@@ -127,9 +131,17 @@ static ERR_STRING_DATA EVP_str_functs[]=
 {ERR_FUNC(EVP_F_EVP_RIJNDAEL),  "EVP_RIJNDAEL"},
 {ERR_FUNC(EVP_F_EVP_SIGNFINAL), "EVP_SignFinal"},
 {ERR_FUNC(EVP_F_EVP_VERIFYFINAL),       "EVP_VerifyFinal"},
+{ERR_FUNC(EVP_F_FIPS_CIPHERINIT),       "FIPS_CIPHERINIT"},
+{ERR_FUNC(EVP_F_FIPS_CIPHER_CTX_COPY),  "FIPS_CIPHER_CTX_COPY"},
+{ERR_FUNC(EVP_F_FIPS_CIPHER_CTX_CTRL),  "FIPS_CIPHER_CTX_CTRL"},
+{ERR_FUNC(EVP_F_FIPS_CIPHER_CTX_SET_KEY_LENGTH),        "FIPS_CIPHER_CTX_SET_KEY_LENGTH"},
+{ERR_FUNC(EVP_F_FIPS_DIGESTINIT),       "FIPS_DIGESTINIT"},
+{ERR_FUNC(EVP_F_FIPS_MD_CTX_COPY),      "FIPS_MD_CTX_COPY"},
+{ERR_FUNC(EVP_F_HMAC_INIT_EX),  "HMAC_Init_ex"},
 {ERR_FUNC(EVP_F_INT_CTX_NEW),   "INT_CTX_NEW"},
 {ERR_FUNC(EVP_F_PKCS5_PBE_KEYIVGEN),    "PKCS5_PBE_keyivgen"},
 {ERR_FUNC(EVP_F_PKCS5_V2_PBE_KEYIVGEN), "PKCS5_v2_PBE_keyivgen"},
+{ERR_FUNC(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN),      "PKCS5_V2_PBKDF2_KEYIVGEN"},
 {ERR_FUNC(EVP_F_PKCS8_SET_BROKEN),      "PKCS8_set_broken"},
 {ERR_FUNC(EVP_F_PKEY_SET_TYPE), "PKEY_SET_TYPE"},
 {ERR_FUNC(EVP_F_RC2_MAGIC_TO_METH),     "RC2_MAGIC_TO_METH"},
@@ -139,6 +151,7 @@ static ERR_STRING_DATA EVP_str_functs[]=
 
 static ERR_STRING_DATA EVP_str_reasons[]=
         {
+{ERR_REASON(EVP_R_AES_IV_SETUP_FAILED)   ,"aes iv setup failed"},
 {ERR_REASON(EVP_R_AES_KEY_SETUP_FAILED)  ,"aes key setup failed"},
 {ERR_REASON(EVP_R_ASN1_LIB)              ,"asn1 lib"},
 {ERR_REASON(EVP_R_BAD_BLOCK_LENGTH)      ,"bad block length"},
@@ -156,6 +169,7 @@ static ERR_STRING_DATA EVP_str_reasons[]=
 {ERR_REASON(EVP_R_DECODE_ERROR)          ,"decode error"},
 {ERR_REASON(EVP_R_DIFFERENT_KEY_TYPES)   ,"different key types"},
 {ERR_REASON(EVP_R_DIFFERENT_PARAMETERS)  ,"different parameters"},
+{ERR_REASON(EVP_R_DISABLED_FOR_FIPS)     ,"disabled for fips"},
 {ERR_REASON(EVP_R_ENCODE_ERROR)          ,"encode error"},
 {ERR_REASON(EVP_R_EVP_PBE_CIPHERINIT_ERROR),"evp pbe cipherinit error"},
 {ERR_REASON(EVP_R_EXPECTING_AN_RSA_KEY)  ,"expecting an rsa key"},
@@ -187,6 +201,7 @@ static ERR_STRING_DATA EVP_str_reasons[]=
 {ERR_REASON(EVP_R_PRIVATE_KEY_DECODE_ERROR),"private key decode error"},
 {ERR_REASON(EVP_R_PRIVATE_KEY_ENCODE_ERROR),"private key encode error"},
 {ERR_REASON(EVP_R_PUBLIC_KEY_NOT_RSA)    ,"public key not rsa"},
+{ERR_REASON(EVP_R_TOO_LARGE)             ,"too large"},
 {ERR_REASON(EVP_R_UNKNOWN_CIPHER)        ,"unknown cipher"},
 {ERR_REASON(EVP_R_UNKNOWN_DIGEST)        ,"unknown digest"},
 {ERR_REASON(EVP_R_UNKNOWN_PBE_ALGORITHM) ,"unknown pbe algorithm"},
diff --git a/src/lib/libcrypto/evp/evp_key.c b/src/lib/libcrypto/evp/evp_key.c
index 839d6a3a16..7961fbebf2 100644
--- a/src/lib/libcrypto/evp/evp_key.c
+++ b/src/lib/libcrypto/evp/evp_key.c
@@ -120,7 +120,7 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
         unsigned char md_buf[EVP_MAX_MD_SIZE];
         int niv,nkey,addmd=0;
         unsigned int mds=0,i;
-
+        int rv = 0;
         nkey=type->key_len;
         niv=type->iv_len;
         OPENSSL_assert(nkey <= EVP_MAX_KEY_LENGTH);
@@ -134,17 +134,24 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
                 if (!EVP_DigestInit_ex(&c,md, NULL))
                         return 0;
                 if (addmd++)
-                        EVP_DigestUpdate(&c,&(md_buf[0]),mds);
-                EVP_DigestUpdate(&c,data,datal);
+                        if (!EVP_DigestUpdate(&c,&(md_buf[0]),mds))
+                                goto err;
+                if (!EVP_DigestUpdate(&c,data,datal))
+                        goto err;
                 if (salt != NULL)
-                        EVP_DigestUpdate(&c,salt,PKCS5_SALT_LEN);
-                EVP_DigestFinal_ex(&c,&(md_buf[0]),&mds);
+                        if (!EVP_DigestUpdate(&c,salt,PKCS5_SALT_LEN))
+                                goto err;
+                if (!EVP_DigestFinal_ex(&c,&(md_buf[0]),&mds))
+                        goto err;
 
                 for (i=1; i<(unsigned int)count; i++)
                         {
-                        EVP_DigestInit_ex(&c,md, NULL);
-                        EVP_DigestUpdate(&c,&(md_buf[0]),mds);
-                        EVP_DigestFinal_ex(&c,&(md_buf[0]),&mds);
+                        if (!EVP_DigestInit_ex(&c,md, NULL))
+                                goto err;
+                        if (!EVP_DigestUpdate(&c,&(md_buf[0]),mds))
+                                goto err;
+                        if (!EVP_DigestFinal_ex(&c,&(md_buf[0]),&mds))
+                                goto err;
                         }
                 i=0;
                 if (nkey)
@@ -173,8 +180,10 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
                         }
                 if ((nkey == 0) && (niv == 0)) break;
                 }
+        rv = type->key_len;
+        err:
         EVP_MD_CTX_cleanup(&c);
         OPENSSL_cleanse(&(md_buf[0]),EVP_MAX_MD_SIZE);
-        return(type->key_len);
+        return rv;
         }
 
diff --git a/src/lib/libcrypto/evp/evp_lib.c b/src/lib/libcrypto/evp/evp_lib.c
index 40951a04f0..b180e4828a 100644
--- a/src/lib/libcrypto/evp/evp_lib.c
+++ b/src/lib/libcrypto/evp/evp_lib.c
@@ -67,6 +67,8 @@ int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
 
         if (c->cipher->set_asn1_parameters != NULL)
                 ret=c->cipher->set_asn1_parameters(c,type);
+        else if (c->cipher->flags & EVP_CIPH_FLAG_DEFAULT_ASN1)
+                ret=EVP_CIPHER_set_asn1_iv(c, type);
         else
                 ret=-1;
         return(ret);
@@ -78,6 +80,8 @@ int EVP_CIPHER_asn1_to_param(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
 
         if (c->cipher->get_asn1_parameters != NULL)
                 ret=c->cipher->get_asn1_parameters(c,type);
+        else if (c->cipher->flags & EVP_CIPH_FLAG_DEFAULT_ASN1)
+                ret=EVP_CIPHER_get_asn1_iv(c, type);
         else
                 ret=-1;
         return(ret);
diff --git a/src/lib/libcrypto/evp/evp_locl.h b/src/lib/libcrypto/evp/evp_locl.h
index 292d74c188..08c0a66d39 100644
--- a/src/lib/libcrypto/evp/evp_locl.h
+++ b/src/lib/libcrypto/evp/evp_locl.h
@@ -343,3 +343,43 @@ struct evp_pkey_method_st
         } /* EVP_PKEY_METHOD */;
 
 void evp_pkey_set_cb_translate(BN_GENCB *cb, EVP_PKEY_CTX *ctx);
+
+int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
+                             ASN1_TYPE *param,
+                             const EVP_CIPHER *c, const EVP_MD *md, int en_de);
+
+#ifdef OPENSSL_FIPS
+
+#ifdef OPENSSL_DOING_MAKEDEPEND
+#undef SHA1_Init
+#undef SHA1_Update
+#undef SHA224_Init
+#undef SHA256_Init
+#undef SHA384_Init
+#undef SHA512_Init
+#undef DES_set_key_unchecked
+#endif
+
+#define RIPEMD160_Init  private_RIPEMD160_Init
+#define WHIRLPOOL_Init  private_WHIRLPOOL_Init
+#define MD5_Init        private_MD5_Init
+#define MD4_Init        private_MD4_Init
+#define MD2_Init        private_MD2_Init
+#define MDC2_Init       private_MDC2_Init
+#define SHA_Init        private_SHA_Init
+#define SHA1_Init       private_SHA1_Init
+#define SHA224_Init     private_SHA224_Init
+#define SHA256_Init     private_SHA256_Init
+#define SHA384_Init     private_SHA384_Init
+#define SHA512_Init     private_SHA512_Init
+
+#define BF_set_key      private_BF_set_key
+#define CAST_set_key    private_CAST_set_key
+#define idea_set_encrypt_key    private_idea_set_encrypt_key
+#define SEED_set_key    private_SEED_set_key
+#define RC2_set_key     private_RC2_set_key
+#define RC4_set_key     private_RC4_set_key
+#define DES_set_key_unchecked   private_DES_set_key_unchecked
+#define Camellia_set_key        private_Camellia_set_key
+
+#endif
diff --git a/src/lib/libcrypto/evp/evp_pbe.c b/src/lib/libcrypto/evp/evp_pbe.c
index c9d932d205..f8c32d825e 100644
--- a/src/lib/libcrypto/evp/evp_pbe.c
+++ b/src/lib/libcrypto/evp/evp_pbe.c
@@ -61,6 +61,7 @@
 #include <openssl/evp.h>
 #include <openssl/pkcs12.h>
 #include <openssl/x509.h>
+#include "evp_locl.h"
 
 /* Password based encryption (PBE) functions */
 
@@ -87,6 +88,10 @@ static const EVP_PBE_CTL builtin_pbe[] =
         {EVP_PBE_TYPE_OUTER, NID_pbeWithSHA1AndRC2_CBC,
                         NID_rc2_64_cbc, NID_sha1, PKCS5_PBE_keyivgen},
 
+#ifndef OPENSSL_NO_HMAC
+        {EVP_PBE_TYPE_OUTER, NID_id_pbkdf2, -1, -1, PKCS5_v2_PBKDF2_keyivgen},
+#endif
+
         {EVP_PBE_TYPE_OUTER, NID_pbe_WithSHA1And128BitRC4,
                         NID_rc4, NID_sha1, PKCS12_PBE_keyivgen},
         {EVP_PBE_TYPE_OUTER, NID_pbe_WithSHA1And40BitRC4,
diff --git a/src/lib/libcrypto/evp/evptests.txt b/src/lib/libcrypto/evp/evptests.txt
index beb12144b6..c273707c14 100644
--- a/src/lib/libcrypto/evp/evptests.txt
+++ b/src/lib/libcrypto/evp/evptests.txt
@@ -158,6 +158,19 @@ AES-256-OFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:B7B
 AES-256-OFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:E1C656305ED1A7A6563805746FE03EDC:30C81C46A35CE411E5FBC1191A0A52EF:71AB47A086E86EEDF39D1C5BBA97C408:0
 AES-256-OFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:41635BE625B48AFC1666DD42A09D96E7:F69F2445DF4F9B17AD2B417BE66C3710:0126141D67F37BE8538F5A8BE740E484:0
 
+# AES Counter test vectors from RFC3686
+aes-128-ctr:AE6852F8121067CC4BF7A5765577F39E:00000030000000000000000000000001:53696E676C6520626C6F636B206D7367:E4095D4FB7A7B3792D6175A3261311B8:1
+aes-128-ctr:7E24067817FAE0D743D6CE1F32539163:006CB6DBC0543B59DA48D90B00000001:000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F:5104A106168A72D9790D41EE8EDAD388EB2E1EFC46DA57C8FCE630DF9141BE28:1
+aes-128-ctr:7691BE035E5020A8AC6E618529F9A0DC:00E0017B27777F3F4A1786F000000001:000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F20212223:C1CF48A89F2FFDD9CF4652E9EFDB72D74540A42BDE6D7836D59A5CEAAEF3105325B2072F:1
+
+aes-192-ctr:16AF5B145FC9F579C175F93E3BFB0EED863D06CCFDB78515:0000004836733C147D6D93CB00000001:53696E676C6520626C6F636B206D7367:4B55384FE259C9C84E7935A003CBE928:1
+aes-192-ctr:7C5CB2401B3DC33C19E7340819E0F69C678C3DB8E6F6A91A:0096B03B020C6EADC2CB500D00000001:000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F:453243FC609B23327EDFAAFA7131CD9F8490701C5AD4A79CFC1FE0FF42F4FB00:1
+aes-192-ctr:02BF391EE8ECB159B959617B0965279BF59B60A786D3E0FE:0007BDFD5CBD60278DCC091200000001:000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F20212223:96893FC55E5C722F540B7DD1DDF7E758D288BC95C69165884536C811662F2188ABEE0935:1
+
+aes-256-ctr:776BEFF2851DB06F4C8A0542C8696F6C6A81AF1EEC96B4D37FC1D689E6C1C104:00000060DB5672C97AA8F0B200000001:53696E676C6520626C6F636B206D7367:145AD01DBF824EC7560863DC71E3E0C0:1
+aes-256-ctr:F6D66D6BD52D59BB0796365879EFF886C66DD51A5B6A99744B50590C87A23884:00FAAC24C1585EF15A43D87500000001:000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F:F05E231B3894612C49EE000B804EB2A9B8306B508F839D6A5530831D9344AF1C:1
+aes-256-ctr:FF7A617CE69148E4F1726E2F43581DE2AA62D9F805532EDFF1EED687FB54153D:001CC5B751A51D70A1C1114800000001:000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F20212223:EB6C52821D0BBBF7CE7594462ACA4FAAB407DF866569FD07F48CC0B583D6071F1EC0E6B8:1
+
 # DES ECB tests (from destest)
 
 DES-ECB:0000000000000000::0000000000000000:8CA64DE9C1B123A7
diff --git a/src/lib/libcrypto/evp/m_dss.c b/src/lib/libcrypto/evp/m_dss.c
index 48c2689504..4ad63ada6f 100644
--- a/src/lib/libcrypto/evp/m_dss.c
+++ b/src/lib/libcrypto/evp/m_dss.c
@@ -66,6 +66,7 @@
 #endif
 
 #ifndef OPENSSL_NO_SHA
+#ifndef OPENSSL_FIPS
 
 static int init(EVP_MD_CTX *ctx)
         { return SHA1_Init(ctx->md_data); }
@@ -97,3 +98,4 @@ const EVP_MD *EVP_dss(void)
         return(&dsa_md);
         }
 #endif
+#endif
diff --git a/src/lib/libcrypto/evp/m_dss1.c b/src/lib/libcrypto/evp/m_dss1.c
index 4f03fb70e0..f80170efeb 100644
--- a/src/lib/libcrypto/evp/m_dss1.c
+++ b/src/lib/libcrypto/evp/m_dss1.c
@@ -68,6 +68,8 @@
 #include <openssl/dsa.h>
 #endif
 
+#ifndef OPENSSL_FIPS 
+
 static int init(EVP_MD_CTX *ctx)
         { return SHA1_Init(ctx->md_data); }
 
@@ -98,3 +100,4 @@ const EVP_MD *EVP_dss1(void)
         return(&dss1_md);
         }
 #endif
+#endif
diff --git a/src/lib/libcrypto/evp/m_md4.c b/src/lib/libcrypto/evp/m_md4.c
index 1e0b7c5b42..6d47f61b27 100644
--- a/src/lib/libcrypto/evp/m_md4.c
+++ b/src/lib/libcrypto/evp/m_md4.c
@@ -69,6 +69,8 @@
 #include <openssl/rsa.h>
 #endif
 
+#include "evp_locl.h"
+
 static int init(EVP_MD_CTX *ctx)
         { return MD4_Init(ctx->md_data); }
 
diff --git a/src/lib/libcrypto/evp/m_md5.c b/src/lib/libcrypto/evp/m_md5.c
index 63c142119e..9a8bae0258 100644
--- a/src/lib/libcrypto/evp/m_md5.c
+++ b/src/lib/libcrypto/evp/m_md5.c
@@ -68,6 +68,7 @@
 #ifndef OPENSSL_NO_RSA
 #include <openssl/rsa.h>
 #endif
+#include "evp_locl.h"
 
 static int init(EVP_MD_CTX *ctx)
         { return MD5_Init(ctx->md_data); }
diff --git a/src/lib/libcrypto/evp/m_mdc2.c b/src/lib/libcrypto/evp/m_mdc2.c
index b08d559803..3602bed316 100644
--- a/src/lib/libcrypto/evp/m_mdc2.c
+++ b/src/lib/libcrypto/evp/m_mdc2.c
@@ -69,6 +69,8 @@
 #include <openssl/rsa.h>
 #endif
 
+#include "evp_locl.h"
+
 static int init(EVP_MD_CTX *ctx)
         { return MDC2_Init(ctx->md_data); }
 
diff --git a/src/lib/libcrypto/evp/m_ripemd.c b/src/lib/libcrypto/evp/m_ripemd.c
index a1d60ee78d..7bf4804cf8 100644
--- a/src/lib/libcrypto/evp/m_ripemd.c
+++ b/src/lib/libcrypto/evp/m_ripemd.c
@@ -68,6 +68,7 @@
 #ifndef OPENSSL_NO_RSA
 #include <openssl/rsa.h>
 #endif
+#include "evp_locl.h"
 
 static int init(EVP_MD_CTX *ctx)
         { return RIPEMD160_Init(ctx->md_data); }
diff --git a/src/lib/libcrypto/evp/m_sha.c b/src/lib/libcrypto/evp/m_sha.c
index acccc8f92d..8769cdd42f 100644
--- a/src/lib/libcrypto/evp/m_sha.c
+++ b/src/lib/libcrypto/evp/m_sha.c
@@ -67,6 +67,7 @@
 #ifndef OPENSSL_NO_RSA
 #include <openssl/rsa.h>
 #endif
+#include "evp_locl.h"
 
 static int init(EVP_MD_CTX *ctx)
         { return SHA_Init(ctx->md_data); }
diff --git a/src/lib/libcrypto/evp/m_sha1.c b/src/lib/libcrypto/evp/m_sha1.c
index 9a2790fdea..3cb11f1ebb 100644
--- a/src/lib/libcrypto/evp/m_sha1.c
+++ b/src/lib/libcrypto/evp/m_sha1.c
@@ -59,6 +59,8 @@
 #include <stdio.h>
 #include "cryptlib.h"
 
+#ifndef OPENSSL_FIPS
+
 #ifndef OPENSSL_NO_SHA
 
 #include <openssl/evp.h>
@@ -68,6 +70,7 @@
 #include <openssl/rsa.h>
 #endif
 
+
 static int init(EVP_MD_CTX *ctx)
         { return SHA1_Init(ctx->md_data); }
 
@@ -202,3 +205,5 @@ static const EVP_MD sha512_md=
 const EVP_MD *EVP_sha512(void)
         { return(&sha512_md); }
 #endif  /* ifndef OPENSSL_NO_SHA512 */
+
+#endif
diff --git a/src/lib/libcrypto/evp/names.c b/src/lib/libcrypto/evp/names.c
index f2869f5c78..6311ad7cfb 100644
--- a/src/lib/libcrypto/evp/names.c
+++ b/src/lib/libcrypto/evp/names.c
@@ -66,6 +66,10 @@ int EVP_add_cipher(const EVP_CIPHER *c)
         {
         int r;
 
+        if (c == NULL) return 0;
+
+        OPENSSL_init();
+
         r=OBJ_NAME_add(OBJ_nid2sn(c->nid),OBJ_NAME_TYPE_CIPHER_METH,(const char *)c);
         if (r == 0) return(0);
         check_defer(c->nid);
@@ -78,6 +82,7 @@ int EVP_add_digest(const EVP_MD *md)
         {
         int r;
         const char *name;
+        OPENSSL_init();
 
         name=OBJ_nid2sn(md->type);
         r=OBJ_NAME_add(name,OBJ_NAME_TYPE_MD_METH,(const char *)md);
diff --git a/src/lib/libcrypto/evp/p5_crpt.c b/src/lib/libcrypto/evp/p5_crpt.c
index 7ecfa8dad9..294cc90d87 100644
--- a/src/lib/libcrypto/evp/p5_crpt.c
+++ b/src/lib/libcrypto/evp/p5_crpt.c
@@ -82,6 +82,8 @@ int PKCS5_PBE_keyivgen(EVP_CIPHER_CTX *cctx, const char *pass, int passlen,
         unsigned char *salt;
         const unsigned char *pbuf;
         int mdsize;
+        int rv = 0;
+        EVP_MD_CTX_init(&ctx);
 
         /* Extract useful info from parameter */
         if (param == NULL || param->type != V_ASN1_SEQUENCE ||
@@ -104,29 +106,38 @@ int PKCS5_PBE_keyivgen(EVP_CIPHER_CTX *cctx, const char *pass, int passlen,
         if(!pass) passlen = 0;
         else if(passlen == -1) passlen = strlen(pass);
 
-        EVP_MD_CTX_init(&ctx);
-        EVP_DigestInit_ex(&ctx, md, NULL);
-        EVP_DigestUpdate(&ctx, pass, passlen);
-        EVP_DigestUpdate(&ctx, salt, saltlen);
+        if (!EVP_DigestInit_ex(&ctx, md, NULL))
+                goto err;
+        if (!EVP_DigestUpdate(&ctx, pass, passlen))
+                goto err;
+        if (!EVP_DigestUpdate(&ctx, salt, saltlen))
+                goto err;
         PBEPARAM_free(pbe);
-        EVP_DigestFinal_ex(&ctx, md_tmp, NULL);
+        if (!EVP_DigestFinal_ex(&ctx, md_tmp, NULL))
+                goto err;
         mdsize = EVP_MD_size(md);
         if (mdsize < 0)
             return 0;
         for (i = 1; i < iter; i++) {
-                EVP_DigestInit_ex(&ctx, md, NULL);
-                EVP_DigestUpdate(&ctx, md_tmp, mdsize);
-                EVP_DigestFinal_ex (&ctx, md_tmp, NULL);
+                if (!EVP_DigestInit_ex(&ctx, md, NULL))
+                        goto err;
+                if (!EVP_DigestUpdate(&ctx, md_tmp, mdsize))
+                        goto err;
+                if (!EVP_DigestFinal_ex (&ctx, md_tmp, NULL))
+                        goto err;
         }
-        EVP_MD_CTX_cleanup(&ctx);
         OPENSSL_assert(EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp));
         memcpy(key, md_tmp, EVP_CIPHER_key_length(cipher));
         OPENSSL_assert(EVP_CIPHER_iv_length(cipher) <= 16);
         memcpy(iv, md_tmp + (16 - EVP_CIPHER_iv_length(cipher)),
                                                  EVP_CIPHER_iv_length(cipher));
-        EVP_CipherInit_ex(cctx, cipher, NULL, key, iv, en_de);
+        if (!EVP_CipherInit_ex(cctx, cipher, NULL, key, iv, en_de))
+                goto err;
         OPENSSL_cleanse(md_tmp, EVP_MAX_MD_SIZE);
         OPENSSL_cleanse(key, EVP_MAX_KEY_LENGTH);
         OPENSSL_cleanse(iv, EVP_MAX_IV_LENGTH);
-        return 1;
+        rv = 1;
+        err:
+        EVP_MD_CTX_cleanup(&ctx);
+        return rv;
 }
diff --git a/src/lib/libcrypto/evp/p5_crpt2.c b/src/lib/libcrypto/evp/p5_crpt2.c
index 334379f310..975d004df4 100644
--- a/src/lib/libcrypto/evp/p5_crpt2.c
+++ b/src/lib/libcrypto/evp/p5_crpt2.c
@@ -62,6 +62,7 @@
 #include <openssl/x509.h>
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
+#include "evp_locl.h"
 
 /* set this to print out info about the keygen algorithm */
 /* #define DEBUG_PKCS5V2 */
@@ -110,10 +111,14 @@ int PKCS5_PBKDF2_HMAC(const char *pass, int passlen,
                 itmp[1] = (unsigned char)((i >> 16) & 0xff);
                 itmp[2] = (unsigned char)((i >> 8) & 0xff);
                 itmp[3] = (unsigned char)(i & 0xff);
-                HMAC_Init_ex(&hctx, pass, passlen, digest, NULL);
-                HMAC_Update(&hctx, salt, saltlen);
-                HMAC_Update(&hctx, itmp, 4);
-                HMAC_Final(&hctx, digtmp, NULL);
+                if (!HMAC_Init_ex(&hctx, pass, passlen, digest, NULL)
+                        || !HMAC_Update(&hctx, salt, saltlen)
+                        || !HMAC_Update(&hctx, itmp, 4)
+                        || !HMAC_Final(&hctx, digtmp, NULL))
+                        {
+                        HMAC_CTX_cleanup(&hctx);
+                        return 0;
+                        }
                 memcpy(p, digtmp, cplen);
                 for(j = 1; j < iter; j++)
                         {
@@ -168,27 +173,24 @@ int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
                          ASN1_TYPE *param, const EVP_CIPHER *c, const EVP_MD *md,
                          int en_de)
 {
-        unsigned char *salt, key[EVP_MAX_KEY_LENGTH];
         const unsigned char *pbuf;
-        int saltlen, iter, plen;
-        unsigned int keylen;
+        int plen;
         PBE2PARAM *pbe2 = NULL;
         const EVP_CIPHER *cipher;
-        PBKDF2PARAM *kdf = NULL;
-        const EVP_MD *prfmd;
-        int prf_nid, hmac_md_nid;
+
+        int rv = 0;
 
         if (param == NULL || param->type != V_ASN1_SEQUENCE ||
             param->value.sequence == NULL) {
                 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
-                return 0;
+                goto err;
         }
 
         pbuf = param->value.sequence->data;
         plen = param->value.sequence->length;
         if(!(pbe2 = d2i_PBE2PARAM(NULL, &pbuf, plen))) {
                 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
-                return 0;
+                goto err;
         }
 
         /* See if we recognise the key derivation function */
@@ -211,38 +213,63 @@ int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
         }
 
         /* Fixup cipher based on AlgorithmIdentifier */
-        EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, en_de);
+        if (!EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, en_de))
+                goto err;
         if(EVP_CIPHER_asn1_to_param(ctx, pbe2->encryption->parameter) < 0) {
                 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,
                                         EVP_R_CIPHER_PARAMETER_ERROR);
                 goto err;
         }
+        rv = PKCS5_v2_PBKDF2_keyivgen(ctx, pass, passlen,
+                                        pbe2->keyfunc->parameter, c, md, en_de);
+        err:
+        PBE2PARAM_free(pbe2);
+        return rv;
+}
+
+int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
+                         ASN1_TYPE *param,
+                         const EVP_CIPHER *c, const EVP_MD *md, int en_de)
+{
+        unsigned char *salt, key[EVP_MAX_KEY_LENGTH];
+        const unsigned char *pbuf;
+        int saltlen, iter, plen;
+        int rv = 0;
+        unsigned int keylen = 0;
+        int prf_nid, hmac_md_nid;
+        PBKDF2PARAM *kdf = NULL;
+        const EVP_MD *prfmd;
+
+        if (EVP_CIPHER_CTX_cipher(ctx) == NULL)
+                {
+                EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN,EVP_R_NO_CIPHER_SET);
+                goto err;
+                }
         keylen = EVP_CIPHER_CTX_key_length(ctx);
         OPENSSL_assert(keylen <= sizeof key);
 
-        /* Now decode key derivation function */
+        /* Decode parameter */
 
-        if(!pbe2->keyfunc->parameter ||
-                 (pbe2->keyfunc->parameter->type != V_ASN1_SEQUENCE))
+        if(!param || (param->type != V_ASN1_SEQUENCE))
                 {
-                EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
+                EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN,EVP_R_DECODE_ERROR);
                 goto err;
                 }
 
-        pbuf = pbe2->keyfunc->parameter->value.sequence->data;
-        plen = pbe2->keyfunc->parameter->value.sequence->length;
+        pbuf = param->value.sequence->data;
+        plen = param->value.sequence->length;
+
         if(!(kdf = d2i_PBKDF2PARAM(NULL, &pbuf, plen)) ) {
-                EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
+                EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN,EVP_R_DECODE_ERROR);
                 goto err;
         }
 
-        PBE2PARAM_free(pbe2);
-        pbe2 = NULL;
+        keylen = EVP_CIPHER_CTX_key_length(ctx);
 
         /* Now check the parameters of the kdf */
 
         if(kdf->keylength && (ASN1_INTEGER_get(kdf->keylength) != (int)keylen)){
-                EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,
+                EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN,
                                                 EVP_R_UNSUPPORTED_KEYLENGTH);
                 goto err;
         }
@@ -254,19 +281,19 @@ int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
 
         if (!EVP_PBE_find(EVP_PBE_TYPE_PRF, prf_nid, NULL, &hmac_md_nid, 0))
                 {
-                EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN, EVP_R_UNSUPPORTED_PRF);
+                EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN, EVP_R_UNSUPPORTED_PRF);
                 goto err;
                 }
 
         prfmd = EVP_get_digestbynid(hmac_md_nid);
         if (prfmd == NULL)
                 {
-                EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN, EVP_R_UNSUPPORTED_PRF);
+                EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN, EVP_R_UNSUPPORTED_PRF);
                 goto err;
                 }
 
         if(kdf->salt->type != V_ASN1_OCTET_STRING) {
-                EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,
+                EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN,
                                                 EVP_R_UNSUPPORTED_SALT_TYPE);
                 goto err;
         }
@@ -278,15 +305,11 @@ int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
         if(!PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, iter, prfmd,
                                                    keylen, key))
                 goto err;
-        EVP_CipherInit_ex(ctx, NULL, NULL, key, NULL, en_de);
-        OPENSSL_cleanse(key, keylen);
-        PBKDF2PARAM_free(kdf);
-        return 1;
-
+        rv = EVP_CipherInit_ex(ctx, NULL, NULL, key, NULL, en_de);
         err:
-        PBE2PARAM_free(pbe2);
+        OPENSSL_cleanse(key, keylen);
         PBKDF2PARAM_free(kdf);
-        return 0;
+        return rv;
 }
 
 #ifdef DEBUG_PKCS5V2
diff --git a/src/lib/libcrypto/evp/p_open.c b/src/lib/libcrypto/evp/p_open.c
index 53a59a295c..c748fbea87 100644
--- a/src/lib/libcrypto/evp/p_open.c
+++ b/src/lib/libcrypto/evp/p_open.c
@@ -115,7 +115,8 @@ int EVP_OpenFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
         int i;
 
         i=EVP_DecryptFinal_ex(ctx,out,outl);
-        EVP_DecryptInit_ex(ctx,NULL,NULL,NULL,NULL);
+        if (i)
+                i = EVP_DecryptInit_ex(ctx,NULL,NULL,NULL,NULL);
         return(i);
         }
 #else /* !OPENSSL_NO_RSA */
diff --git a/src/lib/libcrypto/evp/p_seal.c b/src/lib/libcrypto/evp/p_seal.c
index d8324526e7..e5919b0fbf 100644
--- a/src/lib/libcrypto/evp/p_seal.c
+++ b/src/lib/libcrypto/evp/p_seal.c
@@ -110,6 +110,7 @@ int EVP_SealFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
         {
         int i;
         i = EVP_EncryptFinal_ex(ctx,out,outl);
-        EVP_EncryptInit_ex(ctx,NULL,NULL,NULL,NULL);
+        if (i) 
+                i = EVP_EncryptInit_ex(ctx,NULL,NULL,NULL,NULL);
         return i;
         }
diff --git a/src/lib/libcrypto/evp/p_sign.c b/src/lib/libcrypto/evp/p_sign.c
index bb893f5bde..dfa48c157c 100644
--- a/src/lib/libcrypto/evp/p_sign.c
+++ b/src/lib/libcrypto/evp/p_sign.c
@@ -80,18 +80,20 @@ int EVP_SignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, unsigned int *siglen,
         {
         unsigned char m[EVP_MAX_MD_SIZE];
         unsigned int m_len;
-        int i,ok=0,v;
+        int i=0,ok=0,v;
         EVP_MD_CTX tmp_ctx;
+        EVP_PKEY_CTX *pkctx = NULL;
 
         *siglen=0;
         EVP_MD_CTX_init(&tmp_ctx);
-        EVP_MD_CTX_copy_ex(&tmp_ctx,ctx);   
-        EVP_DigestFinal_ex(&tmp_ctx,&(m[0]),&m_len);
+        if (!EVP_MD_CTX_copy_ex(&tmp_ctx,ctx))
+                goto err;  
+        if (!EVP_DigestFinal_ex(&tmp_ctx,&(m[0]),&m_len))
+                goto err;
         EVP_MD_CTX_cleanup(&tmp_ctx);
 
         if (ctx->digest->flags & EVP_MD_FLAG_PKEY_METHOD_SIGNATURE)
                 {
-                EVP_PKEY_CTX *pkctx = NULL;
                 size_t sltmp = (size_t)EVP_PKEY_size(pkey);
                 i = 0;
                 pkctx = EVP_PKEY_CTX_new(pkey, NULL);
diff --git a/src/lib/libcrypto/evp/p_verify.c b/src/lib/libcrypto/evp/p_verify.c
index 41d4b67130..5f5c409f45 100644
--- a/src/lib/libcrypto/evp/p_verify.c
+++ b/src/lib/libcrypto/evp/p_verify.c
@@ -67,17 +67,19 @@ int EVP_VerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sigbuf,
         {
         unsigned char m[EVP_MAX_MD_SIZE];
         unsigned int m_len;
-        int i,ok=0,v;
+        int i=-1,ok=0,v;
         EVP_MD_CTX tmp_ctx;
+        EVP_PKEY_CTX *pkctx = NULL;
 
         EVP_MD_CTX_init(&tmp_ctx);
-        EVP_MD_CTX_copy_ex(&tmp_ctx,ctx);     
-        EVP_DigestFinal_ex(&tmp_ctx,&(m[0]),&m_len);
+        if (!EVP_MD_CTX_copy_ex(&tmp_ctx,ctx))
+                goto err;    
+        if (!EVP_DigestFinal_ex(&tmp_ctx,&(m[0]),&m_len))
+                goto err;
         EVP_MD_CTX_cleanup(&tmp_ctx);
 
         if (ctx->digest->flags & EVP_MD_FLAG_PKEY_METHOD_SIGNATURE)
                 {
-                EVP_PKEY_CTX *pkctx = NULL;
                 i = -1;
                 pkctx = EVP_PKEY_CTX_new(pkey, NULL);
                 if (!pkctx)
diff --git a/src/lib/libcrypto/hmac/hmac.c b/src/lib/libcrypto/hmac/hmac.c
index 6c98fc43a3..ba27cbf56f 100644
--- a/src/lib/libcrypto/hmac/hmac.c
+++ b/src/lib/libcrypto/hmac/hmac.c
@@ -61,12 +61,34 @@
 #include "cryptlib.h"
 #include <openssl/hmac.h>
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
                   const EVP_MD *md, ENGINE *impl)
         {
         int i,j,reset=0;
         unsigned char pad[HMAC_MAX_MD_CBLOCK];
 
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode())
+                {
+                /* If we have an ENGINE need to allow non FIPS */
+                if ((impl || ctx->i_ctx.engine)
+                        &&  !(ctx->i_ctx.flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW))
+                        {
+                        EVPerr(EVP_F_HMAC_INIT_EX, EVP_R_DISABLED_FOR_FIPS);
+                        return 0;
+                        }
+                /* Other algorithm blocking will be done in FIPS_cmac_init,
+                 * via FIPS_hmac_init_ex().
+                 */
+                if (!impl && !ctx->i_ctx.engine)
+                        return FIPS_hmac_init_ex(ctx, key, len, md, NULL);
+                }
+#endif
+
         if (md != NULL)
                 {
                 reset=1;
@@ -133,6 +155,10 @@ int HMAC_Init(HMAC_CTX *ctx, const void *key, int len, const EVP_MD *md)
 
 int HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len)
         {
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !ctx->i_ctx.engine)
+                return FIPS_hmac_update(ctx, data, len);
+#endif
         return EVP_DigestUpdate(&ctx->md_ctx,data,len);
         }
 
@@ -140,6 +166,10 @@ int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len)
         {
         unsigned int i;
         unsigned char buf[EVP_MAX_MD_SIZE];
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !ctx->i_ctx.engine)
+                return FIPS_hmac_final(ctx, md, len);
+#endif
 
         if (!EVP_DigestFinal_ex(&ctx->md_ctx,buf,&i))
                 goto err;
@@ -179,6 +209,13 @@ int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx)
 
 void HMAC_CTX_cleanup(HMAC_CTX *ctx)
         {
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !ctx->i_ctx.engine)
+                {
+                FIPS_hmac_ctx_cleanup(ctx);
+                return;
+                }
+#endif
         EVP_MD_CTX_cleanup(&ctx->i_ctx);
         EVP_MD_CTX_cleanup(&ctx->o_ctx);
         EVP_MD_CTX_cleanup(&ctx->md_ctx);
diff --git a/src/lib/libcrypto/idea/idea.h b/src/lib/libcrypto/idea/idea.h
index 5782e54b0f..e9a1e7f1a5 100644
--- a/src/lib/libcrypto/idea/idea.h
+++ b/src/lib/libcrypto/idea/idea.h
@@ -83,6 +83,9 @@ typedef struct idea_key_st
 const char *idea_options(void);
 void idea_ecb_encrypt(const unsigned char *in, unsigned char *out,
         IDEA_KEY_SCHEDULE *ks);
+#ifdef OPENSSL_FIPS
+void private_idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks);
+#endif
 void idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks);
 void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk);
 void idea_cbc_encrypt(const unsigned char *in, unsigned char *out,
diff --git a/src/lib/libcrypto/md2/md2.h b/src/lib/libcrypto/md2/md2.h
index a46120e7d4..d59c9f2593 100644
--- a/src/lib/libcrypto/md2/md2.h
+++ b/src/lib/libcrypto/md2/md2.h
@@ -81,6 +81,9 @@ typedef struct MD2state_st
         } MD2_CTX;
 
 const char *MD2_options(void);
+#ifdef OPENSSL_FIPS
+int private_MD2_Init(MD2_CTX *c);
+#endif
 int MD2_Init(MD2_CTX *c);
 int MD2_Update(MD2_CTX *c, const unsigned char *data, size_t len);
 int MD2_Final(unsigned char *md, MD2_CTX *c);
diff --git a/src/lib/libcrypto/md2/md2_dgst.c b/src/lib/libcrypto/md2/md2_dgst.c
index c57b3da288..bf89def73e 100644
--- a/src/lib/libcrypto/md2/md2_dgst.c
+++ b/src/lib/libcrypto/md2/md2_dgst.c
@@ -116,7 +116,7 @@ const char *MD2_options(void)
                 return("md2(int)");
         }
 
-int MD2_Init(MD2_CTX *c)
+fips_md_init(MD2)
         {
         c->num=0;
         memset(c->state,0,sizeof c->state);
diff --git a/src/lib/libcrypto/md4/md4.h b/src/lib/libcrypto/md4/md4.h
index c3ed9b3f75..a55368a790 100644
--- a/src/lib/libcrypto/md4/md4.h
+++ b/src/lib/libcrypto/md4/md4.h
@@ -105,6 +105,9 @@ typedef struct MD4state_st
         unsigned int num;
         } MD4_CTX;
 
+#ifdef OPENSSL_FIPS
+int private_MD4_Init(MD4_CTX *c);
+#endif
 int MD4_Init(MD4_CTX *c);
 int MD4_Update(MD4_CTX *c, const void *data, size_t len);
 int MD4_Final(unsigned char *md, MD4_CTX *c);
diff --git a/src/lib/libcrypto/md4/md4_dgst.c b/src/lib/libcrypto/md4/md4_dgst.c
index e0c42e8596..82c2cb2d98 100644
--- a/src/lib/libcrypto/md4/md4_dgst.c
+++ b/src/lib/libcrypto/md4/md4_dgst.c
@@ -57,8 +57,9 @@
  */
 
 #include <stdio.h>
-#include "md4_locl.h"
 #include <openssl/opensslv.h>
+#include <openssl/crypto.h>
+#include "md4_locl.h"
 
 const char MD4_version[]="MD4" OPENSSL_VERSION_PTEXT;
 
@@ -70,7 +71,7 @@ const char MD4_version[]="MD4" OPENSSL_VERSION_PTEXT;
 #define INIT_DATA_C (unsigned long)0x98badcfeL
 #define INIT_DATA_D (unsigned long)0x10325476L
 
-int MD4_Init(MD4_CTX *c)
+fips_md_init(MD4)
         {
         memset (c,0,sizeof(*c));
         c->A=INIT_DATA_A;
diff --git a/src/lib/libcrypto/md5/md5.h b/src/lib/libcrypto/md5/md5.h
index 4cbf84386b..541cc925fe 100644
--- a/src/lib/libcrypto/md5/md5.h
+++ b/src/lib/libcrypto/md5/md5.h
@@ -105,6 +105,9 @@ typedef struct MD5state_st
         unsigned int num;
         } MD5_CTX;
 
+#ifdef OPENSSL_FIPS
+int private_MD5_Init(MD5_CTX *c);
+#endif
 int MD5_Init(MD5_CTX *c);
 int MD5_Update(MD5_CTX *c, const void *data, size_t len);
 int MD5_Final(unsigned char *md, MD5_CTX *c);
diff --git a/src/lib/libcrypto/md5/md5_dgst.c b/src/lib/libcrypto/md5/md5_dgst.c
index beace632e3..265890de52 100644
--- a/src/lib/libcrypto/md5/md5_dgst.c
+++ b/src/lib/libcrypto/md5/md5_dgst.c
@@ -59,6 +59,7 @@
 #include <stdio.h>
 #include "md5_locl.h"
 #include <openssl/opensslv.h>
+#include <openssl/crypto.h>
 
 const char MD5_version[]="MD5" OPENSSL_VERSION_PTEXT;
 
@@ -70,7 +71,7 @@ const char MD5_version[]="MD5" OPENSSL_VERSION_PTEXT;
 #define INIT_DATA_C (unsigned long)0x98badcfeL
 #define INIT_DATA_D (unsigned long)0x10325476L
 
-int MD5_Init(MD5_CTX *c)
+fips_md_init(MD5)
         {
         memset (c,0,sizeof(*c));
         c->A=INIT_DATA_A;
diff --git a/src/lib/libcrypto/mdc2/Makefile b/src/lib/libcrypto/mdc2/Makefile
index 1d064f17a6..141553149d 100644
--- a/src/lib/libcrypto/mdc2/Makefile
+++ b/src/lib/libcrypto/mdc2/Makefile
@@ -84,10 +84,10 @@ mdc2_one.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
 mdc2_one.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 mdc2_one.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
 mdc2_one.o: ../../include/openssl/ui_compat.h ../cryptlib.h mdc2_one.c
-mdc2dgst.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
-mdc2dgst.o: ../../include/openssl/e_os2.h ../../include/openssl/mdc2.h
-mdc2dgst.o: ../../include/openssl/opensslconf.h
-mdc2dgst.o: ../../include/openssl/ossl_typ.h ../../include/openssl/safestack.h
-mdc2dgst.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
-mdc2dgst.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
-mdc2dgst.o: mdc2dgst.c
+mdc2dgst.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+mdc2dgst.o: ../../include/openssl/des_old.h ../../include/openssl/e_os2.h
+mdc2dgst.o: ../../include/openssl/mdc2.h ../../include/openssl/opensslconf.h
+mdc2dgst.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+mdc2dgst.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+mdc2dgst.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
+mdc2dgst.o: ../../include/openssl/ui_compat.h mdc2dgst.c
diff --git a/src/lib/libcrypto/mdc2/mdc2.h b/src/lib/libcrypto/mdc2/mdc2.h
index 72778a5212..f3e8e579d2 100644
--- a/src/lib/libcrypto/mdc2/mdc2.h
+++ b/src/lib/libcrypto/mdc2/mdc2.h
@@ -81,6 +81,9 @@ typedef struct mdc2_ctx_st
         } MDC2_CTX;
 
 
+#ifdef OPENSSL_FIPS
+int private_MDC2_Init(MDC2_CTX *c);
+#endif
 int MDC2_Init(MDC2_CTX *c);
 int MDC2_Update(MDC2_CTX *c, const unsigned char *data, size_t len);
 int MDC2_Final(unsigned char *md, MDC2_CTX *c);
diff --git a/src/lib/libcrypto/mem.c b/src/lib/libcrypto/mem.c
index 9ecb8d26b1..24ccf729ca 100644
--- a/src/lib/libcrypto/mem.c
+++ b/src/lib/libcrypto/mem.c
@@ -125,6 +125,7 @@ static long (*get_debug_options_func)(void) = NULL;
 int CRYPTO_set_mem_functions(void *(*m)(size_t), void *(*r)(void *, size_t),
         void (*f)(void *))
         {
+        OPENSSL_init();
         if (!allow_customize)
                 return 0;
         if ((m == 0) || (r == 0) || (f == 0))
@@ -186,6 +187,7 @@ int CRYPTO_set_mem_debug_functions(void (*m)(void *,int,const char *,int,int),
         {
         if (!allow_customize_debug)
                 return 0;
+        OPENSSL_init();
         malloc_debug_func=m;
         realloc_debug_func=r;
         free_debug_func=f;
diff --git a/src/lib/libcrypto/objects/obj_mac.num b/src/lib/libcrypto/objects/obj_mac.num
index 8c50aac27f..1d0a7c802d 100644
--- a/src/lib/libcrypto/objects/obj_mac.num
+++ b/src/lib/libcrypto/objects/obj_mac.num
@@ -890,3 +890,30 @@ houseIdentifier		889
 supportedAlgorithms             890
 deltaRevocationList             891
 dmdName         892
+id_alg_PWRI_KEK         893
+cmac            894
+aes_128_gcm             895
+aes_128_ccm             896
+id_aes128_wrap_pad              897
+aes_192_gcm             898
+aes_192_ccm             899
+id_aes192_wrap_pad              900
+aes_256_gcm             901
+aes_256_ccm             902
+id_aes256_wrap_pad              903
+aes_128_ctr             904
+aes_192_ctr             905
+aes_256_ctr             906
+id_camellia128_wrap             907
+id_camellia192_wrap             908
+id_camellia256_wrap             909
+anyExtendedKeyUsage             910
+mgf1            911
+rsassaPss               912
+aes_128_xts             913
+aes_256_xts             914
+rc4_hmac_md5            915
+aes_128_cbc_hmac_sha1           916
+aes_192_cbc_hmac_sha1           917
+aes_256_cbc_hmac_sha1           918
+rsaesOaep               919
diff --git a/src/lib/libcrypto/objects/objects.txt b/src/lib/libcrypto/objects/objects.txt
index e61fe60cbf..d3bfad72a2 100644
--- a/src/lib/libcrypto/objects/objects.txt
+++ b/src/lib/libcrypto/objects/objects.txt
@@ -166,6 +166,10 @@ pkcs1 3			: RSA-MD4		: md4WithRSAEncryption
 pkcs1 4                 : RSA-MD5               : md5WithRSAEncryption
 pkcs1 5                 : RSA-SHA1              : sha1WithRSAEncryption
 # According to PKCS #1 version 2.1
+pkcs1 7                 : RSAES-OAEP            : rsaesOaep
+pkcs1 8                 : MGF1                  : mgf1
+pkcs1 10                : RSASSA-PSS            : rsassaPss
+
 pkcs1 11                : RSA-SHA256            : sha256WithRSAEncryption
 pkcs1 12                : RSA-SHA384            : sha384WithRSAEncryption
 pkcs1 13                : RSA-SHA512            : sha512WithRSAEncryption
@@ -299,6 +303,7 @@ id-smime-alg 4		: id-smime-alg-RC2wrap
 id-smime-alg 5          : id-smime-alg-ESDH
 id-smime-alg 6          : id-smime-alg-CMS3DESwrap
 id-smime-alg 7          : id-smime-alg-CMSRC2wrap
+id-smime-alg 9          : id-alg-PWRI-KEK
 
 # S/MIME Certificate Distribution
 id-smime-cd 1           : id-smime-cd-ldap
@@ -770,6 +775,10 @@ id-ce 55		: targetInformation	: X509v3 AC Targeting
 !Cname no-rev-avail
 id-ce 56                : noRevAvail            : X509v3 No Revocation Available
 
+# From RFC5280
+ext-key-usage 0         : anyExtendedKeyUsage   : Any Extended Key Usage
+
+
 !Cname netscape
 2 16 840 1 113730       : Netscape              : Netscape Communications Corp.
 !Cname netscape-cert-extension
@@ -846,6 +855,10 @@ aes 2			: AES-128-CBC		: aes-128-cbc
 aes 3                   : AES-128-OFB           : aes-128-ofb
 !Cname aes-128-cfb128
 aes 4                   : AES-128-CFB           : aes-128-cfb
+aes 5                   : id-aes128-wrap
+aes 6                   : id-aes128-GCM         : aes-128-gcm
+aes 7                   : id-aes128-CCM         : aes-128-ccm
+aes 8                   : id-aes128-wrap-pad
 
 aes 21                  : AES-192-ECB           : aes-192-ecb
 aes 22                  : AES-192-CBC           : aes-192-cbc
@@ -853,6 +866,10 @@ aes 22			: AES-192-CBC		: aes-192-cbc
 aes 23                  : AES-192-OFB           : aes-192-ofb
 !Cname aes-192-cfb128
 aes 24                  : AES-192-CFB           : aes-192-cfb
+aes 25                  : id-aes192-wrap
+aes 26                  : id-aes192-GCM         : aes-192-gcm
+aes 27                  : id-aes192-CCM         : aes-192-ccm
+aes 28                  : id-aes192-wrap-pad
 
 aes 41                  : AES-256-ECB           : aes-256-ecb
 aes 42                  : AES-256-CBC           : aes-256-cbc
@@ -860,6 +877,10 @@ aes 42			: AES-256-CBC		: aes-256-cbc
 aes 43                  : AES-256-OFB           : aes-256-ofb
 !Cname aes-256-cfb128
 aes 44                  : AES-256-CFB           : aes-256-cfb
+aes 45                  : id-aes256-wrap
+aes 46                  : id-aes256-GCM         : aes-256-gcm
+aes 47                  : id-aes256-CCM         : aes-256-ccm
+aes 48                  : id-aes256-wrap-pad
 
 # There are no OIDs for these modes...
 
@@ -869,15 +890,16 @@ aes 44			: AES-256-CFB		: aes-256-cfb
                         : AES-128-CFB8          : aes-128-cfb8
                         : AES-192-CFB8          : aes-192-cfb8
                         : AES-256-CFB8          : aes-256-cfb8
+                        : AES-128-CTR           : aes-128-ctr
+                        : AES-192-CTR           : aes-192-ctr
+                        : AES-256-CTR           : aes-256-ctr
+                        : AES-128-XTS           : aes-128-xts
+                        : AES-256-XTS           : aes-256-xts
                         : DES-CFB1              : des-cfb1
                         : DES-CFB8              : des-cfb8
                         : DES-EDE3-CFB1         : des-ede3-cfb1
                         : DES-EDE3-CFB8         : des-ede3-cfb8
 
-aes 5                   : id-aes128-wrap 
-aes 25                  : id-aes192-wrap 
-aes 45                  : id-aes256-wrap 
-
 # OIDs for SHA224, SHA256, SHA385 and SHA512, according to x9.84.
 !Alias nist_hashalgs nistAlgorithms 2
 nist_hashalgs 1         : SHA256                : sha256
@@ -1211,6 +1233,9 @@ cryptocom 1 8 1		: id-GostR3410-2001-ParamSet-cc : GOST R 3410-2001 Parameter Se
 1 2 392 200011 61 1 1 1 2 : CAMELLIA-128-CBC            : camellia-128-cbc
 1 2 392 200011 61 1 1 1 3 : CAMELLIA-192-CBC            : camellia-192-cbc
 1 2 392 200011 61 1 1 1 4 : CAMELLIA-256-CBC            : camellia-256-cbc
+1 2 392 200011 61 1 1 3 2 : id-camellia128-wrap
+1 2 392 200011 61 1 1 3 3 : id-camellia192-wrap
+1 2 392 200011 61 1 1 3 4 : id-camellia256-wrap
 
 # Definitions for Camellia cipher - ECB, CFB, OFB MODE
 
@@ -1257,3 +1282,11 @@ kisa 1 6                : SEED-OFB      : seed-ofb
 # There is no OID that just denotes "HMAC" oddly enough...
 
                         : HMAC                          : hmac
+# Nor CMAC either
+                        : CMAC                          : cmac
+
+# Synthetic composite ciphersuites
+                        : RC4-HMAC-MD5                  : rc4-hmac-md5
+                        : AES-128-CBC-HMAC-SHA1         : aes-128-cbc-hmac-sha1
+                        : AES-192-CBC-HMAC-SHA1         : aes-192-cbc-hmac-sha1
+                        : AES-256-CBC-HMAC-SHA1         : aes-256-cbc-hmac-sha1
diff --git a/src/lib/libcrypto/ocsp/ocsp_lib.c b/src/lib/libcrypto/ocsp/ocsp_lib.c
index e92b86c060..a94dc838ee 100644
--- a/src/lib/libcrypto/ocsp/ocsp_lib.c
+++ b/src/lib/libcrypto/ocsp/ocsp_lib.c
@@ -124,7 +124,8 @@ OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst,
         if (!(ASN1_OCTET_STRING_set(cid->issuerNameHash, md, i))) goto err;
 
         /* Calculate the issuerKey hash, excluding tag and length */
-        EVP_Digest(issuerKey->data, issuerKey->length, md, &i, dgst, NULL);
+        if (!EVP_Digest(issuerKey->data, issuerKey->length, md, &i, dgst, NULL))
+                goto err;
 
         if (!(ASN1_OCTET_STRING_set(cid->issuerKeyHash, md, i))) goto err;
 
diff --git a/src/lib/libcrypto/opensslv.h b/src/lib/libcrypto/opensslv.h
index d6d61a0c7d..71be3590af 100644
--- a/src/lib/libcrypto/opensslv.h
+++ b/src/lib/libcrypto/opensslv.h
@@ -25,11 +25,11 @@
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-#define OPENSSL_VERSION_NUMBER  0x1000006fL
+#define OPENSSL_VERSION_NUMBER  0x1000103fL
 #ifdef OPENSSL_FIPS
-#define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0f-fips 4 Jan 2012"
+#define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.1c-fips 10 May 2012"
 #else
-#define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0f 4 Jan 2012"
+#define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.1c 10 May 2012"
 #endif
 #define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
diff --git a/src/lib/libcrypto/ossl_typ.h b/src/lib/libcrypto/ossl_typ.h
index 12bd7014de..ea9227f6f9 100644
--- a/src/lib/libcrypto/ossl_typ.h
+++ b/src/lib/libcrypto/ossl_typ.h
@@ -91,10 +91,12 @@ typedef struct asn1_string_st ASN1_TIME;
 typedef struct asn1_string_st ASN1_GENERALIZEDTIME;
 typedef struct asn1_string_st ASN1_VISIBLESTRING;
 typedef struct asn1_string_st ASN1_UTF8STRING;
+typedef struct asn1_string_st ASN1_STRING;
 typedef int ASN1_BOOLEAN;
 typedef int ASN1_NULL;
 #endif
 
+typedef struct ASN1_ITEM_st ASN1_ITEM;
 typedef struct asn1_pctx_st ASN1_PCTX;
 
 #ifdef OPENSSL_SYS_WIN32
diff --git a/src/lib/libcrypto/perlasm/x86_64-xlate.pl b/src/lib/libcrypto/perlasm/x86_64-xlate.pl
index 68b4c1ca80..50ff91e2f0 100755
--- a/src/lib/libcrypto/perlasm/x86_64-xlate.pl
+++ b/src/lib/libcrypto/perlasm/x86_64-xlate.pl
@@ -62,12 +62,8 @@ my $flavour = shift;
 my $output  = shift;
 if ($flavour =~ /\./) { $output = $flavour; undef $flavour; }
 
-{ my ($stddev,$stdino,@junk)=stat(STDOUT);
-  my ($outdev,$outino,@junk)=stat($output);
-
-    open STDOUT,">$output" || die "can't open $output: $!"
-        if (1 || $stddev!=$outdev || $stdino!=$outino);
-}
+open STDOUT,">$output" || die "can't open $output: $!"
+        if (defined($output));
 
 my $gas=1;      $gas=0 if ($output =~ /\.asm$/);
 my $elf=1;      $elf=0 if (!$gas);
@@ -116,12 +112,16 @@ my %globals;
             $line = substr($line,@+[0]); $line =~ s/^\s+//;
 
             undef $self->{sz};
-            if ($self->{op} =~ /^(movz)b.*/) {  # movz is pain...
+            if ($self->{op} =~ /^(movz)x?([bw]).*/) {   # movz is pain...
                 $self->{op} = $1;
-                $self->{sz} = "b";
+                $self->{sz} = $2;
             } elsif ($self->{op} =~ /call|jmp/) {
                 $self->{sz} = "";
-            } elsif ($self->{op} =~ /^p/ && $' !~ /^(ush|op)/) { # SSEn
+            } elsif ($self->{op} =~ /^p/ && $' !~ /^(ush|op|insrw)/) { # SSEn
+                $self->{sz} = "";
+            } elsif ($self->{op} =~ /^v/) { # VEX
+                $self->{sz} = "";
+            } elsif ($self->{op} =~ /movq/ && $line =~ /%xmm/) {
                 $self->{sz} = "";
             } elsif ($self->{op} =~ /([a-z]{3,})([qlwb])$/) {
                 $self->{op} = $1;
@@ -247,35 +247,39 @@ my %globals;
         $self->{index} =~ s/^[er](.?[0-9xpi])[d]?$/r\1/;
         $self->{base}  =~ s/^[er](.?[0-9xpi])[d]?$/r\1/;
 
+        # Solaris /usr/ccs/bin/as can't handle multiplications
+        # in $self->{label}, new gas requires sign extension...
+        use integer;
+        $self->{label} =~ s/(?<![\w\$\.])(0x?[0-9a-f]+)/oct($1)/egi;
+        $self->{label} =~ s/([0-9]+\s*[\*\/\%]\s*[0-9]+)/eval($1)/eg;
+        $self->{label} =~ s/([0-9]+)/$1<<32>>32/eg;
+
         if ($gas) {
-            # Solaris /usr/ccs/bin/as can't handle multiplications
-            # in $self->{label}, new gas requires sign extension...
-            use integer;
-            $self->{label} =~ s/(?<![\w\$\.])(0x?[0-9a-f]+)/oct($1)/egi;
-            $self->{label} =~ s/([0-9]+\s*[\*\/\%]\s*[0-9]+)/eval($1)/eg;
-            $self->{label} =~ s/([0-9]+)/$1<<32>>32/eg;
             $self->{label} =~ s/^___imp_/__imp__/   if ($flavour eq "mingw64");
 
             if (defined($self->{index})) {
-                sprintf "%s%s(%%%s,%%%s,%d)",$self->{asterisk},
-                                        $self->{label},$self->{base},
+                sprintf "%s%s(%s,%%%s,%d)",$self->{asterisk},
+                                        $self->{label},
+                                        $self->{base}?"%$self->{base}":"",
                                         $self->{index},$self->{scale};
             } else {
                 sprintf "%s%s(%%%s)",   $self->{asterisk},$self->{label},$self->{base};
             }
         } else {
-            %szmap = ( b=>"BYTE$PTR", w=>"WORD$PTR", l=>"DWORD$PTR", q=>"QWORD$PTR" );
+            %szmap = (  b=>"BYTE$PTR", w=>"WORD$PTR", l=>"DWORD$PTR",
+                        q=>"QWORD$PTR",o=>"OWORD$PTR",x=>"XMMWORD$PTR" );
 
             $self->{label} =~ s/\./\$/g;
             $self->{label} =~ s/(?<![\w\$\.])0x([0-9a-f]+)/0$1h/ig;
             $self->{label} = "($self->{label})" if ($self->{label} =~ /[\*\+\-\/]/);
-            $sz="q" if ($self->{asterisk});
+            $sz="q" if ($self->{asterisk} || opcode->mnemonic() eq "movq");
+            $sz="l" if (opcode->mnemonic() eq "movd");
 
             if (defined($self->{index})) {
-                sprintf "%s[%s%s*%d+%s]",$szmap{$sz},
+                sprintf "%s[%s%s*%d%s]",$szmap{$sz},
                                         $self->{label}?"$self->{label}+":"",
                                         $self->{index},$self->{scale},
-                                        $self->{base};
+                                        $self->{base}?"+$self->{base}":"";
             } elsif ($self->{base} eq "rip") {
                 sprintf "%s[%s]",$szmap{$sz},$self->{label};
             } else {
@@ -507,6 +511,12 @@ my %globals;
                     }
                 } elsif ($dir =~ /\.(text|data)/) {
                     $current_segment=".$1";
+                } elsif ($dir =~ /\.hidden/) {
+                    if    ($flavour eq "macosx")  { $self->{value} = ".private_extern\t$prefix$line"; }
+                    elsif ($flavour eq "mingw64") { $self->{value} = ""; }
+                } elsif ($dir =~ /\.comm/) {
+                    $self->{value} = "$dir\t$prefix$line";
+                    $self->{value} =~ s|,([0-9]+),([0-9]+)$|",$1,".log($2)/log(2)|e if ($flavour eq "macosx");
                 }
                 $line = "";
                 return $self;
@@ -556,7 +566,8 @@ my %globals;
                                             $v.=" READONLY";
                                             $v.=" ALIGN(".($1 eq "p" ? 4 : 8).")" if ($masm>=$masmref);
                                         } elsif ($line=~/\.CRT\$/i) {
-                                            $v.=" READONLY DWORD";
+                                            $v.=" READONLY ";
+                                            $v.=$masm>=$masmref ? "ALIGN(8)" : "DWORD";
                                         }
                                     }
                                     $current_segment = $line;
@@ -578,7 +589,7 @@ my %globals;
                                             $self->{value}="${decor}SEH_end_$current_function->{name}:";
                                             $self->{value}.=":\n" if($masm);
                                         }
-                                        $self->{value}.="$current_function->{name}\tENDP" if($masm);
+                                        $self->{value}.="$current_function->{name}\tENDP" if($masm && $current_function->{name});
                                         undef $current_function;
                                     }
                                     last;
@@ -614,6 +625,19 @@ my %globals;
                                                 .join(",",@str) if (@str);
                                     last;
                                   };
+                /\.comm/    && do { my @str=split(/,\s*/,$line);
+                                    my $v=undef;
+                                    if ($nasm) {
+                                        $v.="common     $prefix@str[0] @str[1]";
+                                    } else {
+                                        $v="$current_segment\tENDS\n" if ($current_segment);
+                                        $current_segment = "_DATA";
+                                        $v.="$current_segment\tSEGMENT\n";
+                                        $v.="COMM       @str[0]:DWORD:".@str[1]/4;
+                                    }
+                                    $self->{value} = $v;
+                                    last;
+                                  };
             }
             $line = "";
         }
@@ -626,11 +650,135 @@ my %globals;
     }
 }
 
+sub rex {
+ local *opcode=shift;
+ my ($dst,$src,$rex)=@_;
+
+   $rex|=0x04 if($dst>=8);
+   $rex|=0x01 if($src>=8);
+   push @opcode,($rex|0x40) if ($rex);
+}
+
+# older gas and ml64 don't handle SSE>2 instructions
+my %regrm = (   "%eax"=>0, "%ecx"=>1, "%edx"=>2, "%ebx"=>3,
+                "%esp"=>4, "%ebp"=>5, "%esi"=>6, "%edi"=>7      );
+
+my $movq = sub {        # elderly gas can't handle inter-register movq
+  my $arg = shift;
+  my @opcode=(0x66);
+    if ($arg =~ /%xmm([0-9]+),\s*%r(\w+)/) {
+        my ($src,$dst)=($1,$2);
+        if ($dst !~ /[0-9]+/)   { $dst = $regrm{"%e$dst"}; }
+        rex(\@opcode,$src,$dst,0x8);
+        push @opcode,0x0f,0x7e;
+        push @opcode,0xc0|(($src&7)<<3)|($dst&7);       # ModR/M
+        @opcode;
+    } elsif ($arg =~ /%r(\w+),\s*%xmm([0-9]+)/) {
+        my ($src,$dst)=($2,$1);
+        if ($dst !~ /[0-9]+/)   { $dst = $regrm{"%e$dst"}; }
+        rex(\@opcode,$src,$dst,0x8);
+        push @opcode,0x0f,0x6e;
+        push @opcode,0xc0|(($src&7)<<3)|($dst&7);       # ModR/M
+        @opcode;
+    } else {
+        ();
+    }
+};
+
+my $pextrd = sub {
+    if (shift =~ /\$([0-9]+),\s*%xmm([0-9]+),\s*(%\w+)/) {
+      my @opcode=(0x66);
+        $imm=$1;
+        $src=$2;
+        $dst=$3;
+        if ($dst =~ /%r([0-9]+)d/)      { $dst = $1; }
+        elsif ($dst =~ /%e/)            { $dst = $regrm{$dst}; }
+        rex(\@opcode,$src,$dst);
+        push @opcode,0x0f,0x3a,0x16;
+        push @opcode,0xc0|(($src&7)<<3)|($dst&7);       # ModR/M
+        push @opcode,$imm;
+        @opcode;
+    } else {
+        ();
+    }
+};
+
+my $pinsrd = sub {
+    if (shift =~ /\$([0-9]+),\s*(%\w+),\s*%xmm([0-9]+)/) {
+      my @opcode=(0x66);
+        $imm=$1;
+        $src=$2;
+        $dst=$3;
+        if ($src =~ /%r([0-9]+)/)       { $src = $1; }
+        elsif ($src =~ /%e/)            { $src = $regrm{$src}; }
+        rex(\@opcode,$dst,$src);
+        push @opcode,0x0f,0x3a,0x22;
+        push @opcode,0xc0|(($dst&7)<<3)|($src&7);       # ModR/M
+        push @opcode,$imm;
+        @opcode;
+    } else {
+        ();
+    }
+};
+
+my $pshufb = sub {
+    if (shift =~ /%xmm([0-9]+),\s*%xmm([0-9]+)/) {
+      my @opcode=(0x66);
+        rex(\@opcode,$2,$1);
+        push @opcode,0x0f,0x38,0x00;
+        push @opcode,0xc0|($1&7)|(($2&7)<<3);           # ModR/M
+        @opcode;
+    } else {
+        ();
+    }
+};
+
+my $palignr = sub {
+    if (shift =~ /\$([0-9]+),\s*%xmm([0-9]+),\s*%xmm([0-9]+)/) {
+      my @opcode=(0x66);
+        rex(\@opcode,$3,$2);
+        push @opcode,0x0f,0x3a,0x0f;
+        push @opcode,0xc0|($2&7)|(($3&7)<<3);           # ModR/M
+        push @opcode,$1;
+        @opcode;
+    } else {
+        ();
+    }
+};
+
+my $pclmulqdq = sub {
+    if (shift =~ /\$([x0-9a-f]+),\s*%xmm([0-9]+),\s*%xmm([0-9]+)/) {
+      my @opcode=(0x66);
+        rex(\@opcode,$3,$2);
+        push @opcode,0x0f,0x3a,0x44;
+        push @opcode,0xc0|($2&7)|(($3&7)<<3);           # ModR/M
+        my $c=$1;
+        push @opcode,$c=~/^0/?oct($c):$c;
+        @opcode;
+    } else {
+        ();
+    }
+};
+
+my $rdrand = sub {
+    if (shift =~ /%[er](\w+)/) {
+      my @opcode=();
+      my $dst=$1;
+        if ($dst !~ /[0-9]+/) { $dst = $regrm{"%e$dst"}; }
+        rex(\@opcode,0,$1,8);
+        push @opcode,0x0f,0xc7,0xf0|($dst&7);
+        @opcode;
+    } else {
+        ();
+    }
+};
+
 print "#include <machine/asm.h>\n";
 
 if ($nasm) {
     print <<___;
 default rel
+%define XMMWORD
 ___
 } elsif ($masm) {
     print <<___;
@@ -647,14 +795,22 @@ while($line=<>) {
 
     undef $label;
     undef $opcode;
-    undef $sz;
     undef @args;
 
     if ($label=label->re(\$line))       { print $label->out(); }
 
     if (directive->re(\$line)) {
         printf "%s",directive->out();
-    } elsif ($opcode=opcode->re(\$line)) { ARGUMENT: while (1) {
+    } elsif ($opcode=opcode->re(\$line)) {
+        my $asm = eval("\$".$opcode->mnemonic());
+        undef @bytes;
+        
+        if ((ref($asm) eq 'CODE') && scalar(@bytes=&$asm($line))) {
+            print $gas?".byte\t":"DB\t",join(',',@bytes),"\n";
+            next;
+        }
+
+        ARGUMENT: while (1) {
         my $arg;
 
         if ($arg=register->re(\$line))  { opcode->size($arg->size()); }
@@ -670,19 +826,26 @@ while($line=<>) {
         $line =~ s/^,\s*//;
         } # ARGUMENT:
 
-        $sz=opcode->size();
-
         if ($#args>=0) {
             my $insn;
+            my $sz=opcode->size();
+
             if ($gas) {
                 $insn = $opcode->out($#args>=1?$args[$#args]->size():$sz);
+                @args = map($_->out($sz),@args);
+                printf "\t%s\t%s",$insn,join(",",@args);
             } else {
                 $insn = $opcode->out();
-                $insn .= $sz if (map($_->out() =~ /x?mm/,@args));
+                foreach (@args) {
+                    my $arg = $_->out();
+                    # $insn.=$sz compensates for movq, pinsrw, ...
+                    if ($arg =~ /^xmm[0-9]+$/) { $insn.=$sz; $sz="x" if(!$sz); last; }
+                    if ($arg =~ /^mm[0-9]+$/)  { $insn.=$sz; $sz="q" if(!$sz); last; }
+                }
                 @args = reverse(@args);
                 undef $sz if ($nasm && $opcode->mnemonic() eq "lea");
+                printf "\t%s\t%s",$insn,join(",",map($_->out($sz),@args));
             }
-            printf "\t%s\t%s",$insn,join(",",map($_->out($sz),@args));
         } else {
             printf "\t%s",$opcode->out();
         }
diff --git a/src/lib/libcrypto/perlasm/x86asm.pl b/src/lib/libcrypto/perlasm/x86asm.pl
index 4756a28e59..bf783cff26 100644
--- a/src/lib/libcrypto/perlasm/x86asm.pl
+++ b/src/lib/libcrypto/perlasm/x86asm.pl
@@ -87,6 +87,57 @@ sub ::movq
     {   &::generic("movq",@_);                  }
 }
 
+# SSE>2 instructions
+my %regrm = (   "eax"=>0, "ecx"=>1, "edx"=>2, "ebx"=>3,
+                "esp"=>4, "ebp"=>5, "esi"=>6, "edi"=>7  );
+sub ::pextrd
+{ my($dst,$src,$imm)=@_;
+    if ("$dst:$src" =~ /(e[a-dsd][ixp]):xmm([0-7])/)
+    {   &::data_byte(0x66,0x0f,0x3a,0x16,0xc0|($2<<3)|$regrm{$1},$imm); }
+    else
+    {   &::generic("pextrd",@_);                }
+}
+
+sub ::pinsrd
+{ my($dst,$src,$imm)=@_;
+    if ("$dst:$src" =~ /xmm([0-7]):(e[a-dsd][ixp])/)
+    {   &::data_byte(0x66,0x0f,0x3a,0x22,0xc0|($1<<3)|$regrm{$2},$imm); }
+    else
+    {   &::generic("pinsrd",@_);                }
+}
+
+sub ::pshufb
+{ my($dst,$src)=@_;
+    if ("$dst:$src" =~ /xmm([0-7]):xmm([0-7])/)
+    {   &data_byte(0x66,0x0f,0x38,0x00,0xc0|($1<<3)|$2);        }
+    else
+    {   &::generic("pshufb",@_);                }
+}
+
+sub ::palignr
+{ my($dst,$src,$imm)=@_;
+    if ("$dst:$src" =~ /xmm([0-7]):xmm([0-7])/)
+    {   &::data_byte(0x66,0x0f,0x3a,0x0f,0xc0|($1<<3)|$2,$imm); }
+    else
+    {   &::generic("palignr",@_);               }
+}
+
+sub ::pclmulqdq
+{ my($dst,$src,$imm)=@_;
+    if ("$dst:$src" =~ /xmm([0-7]):xmm([0-7])/)
+    {   &::data_byte(0x66,0x0f,0x3a,0x44,0xc0|($1<<3)|$2,$imm); }
+    else
+    {   &::generic("pclmulqdq",@_);             }
+}
+
+sub ::rdrand
+{ my ($dst)=@_;
+    if ($dst =~ /(e[a-dsd][ixp])/)
+    {   &::data_byte(0x0f,0xc7,0xf0|$regrm{$dst});      }
+    else
+    {   &::generic("rdrand",@_);        }
+}
+
 # label management
 $lbdecor="L";           # local label decoration, set by package
 $label="000";
@@ -174,7 +225,7 @@ sub ::asm_init
     $filename=$fn;
     $i386=$cpu;
 
-    $elf=$cpp=$coff=$aout=$macosx=$win32=$netware=$mwerks=$openbsd=0;
+    $elf=$cpp=$coff=$aout=$macosx=$win32=$netware=$mwerks=$openbsd=$android=0;
     if    (($type eq "elf"))
     {   $elf=1;                 require "x86gas.pl";    }
     elsif (($type eq "a\.out"))
@@ -195,6 +246,8 @@ sub ::asm_init
     {   $openbsd=$elf=1;        require "x86gas.pl";    }
     elsif (($type eq "openbsd-a.out"))
     {   $openbsd=1;             require "x86gas.pl";    }
+    elsif (($type eq "android"))
+    {   $elf=1; $android=1;     require "x86gas.pl";    }
     else
     {   print STDERR <<"EOF";
 Pick one target type from
diff --git a/src/lib/libcrypto/perlasm/x86gas.pl b/src/lib/libcrypto/perlasm/x86gas.pl
index 9a1cce026e..d4baea514b 100644
--- a/src/lib/libcrypto/perlasm/x86gas.pl
+++ b/src/lib/libcrypto/perlasm/x86gas.pl
@@ -45,9 +45,8 @@ sub ::generic
     undef $suffix if ($dst =~ m/^%[xm]/o || $src =~ m/^%[xm]/o);
 
     if ($#_==0)                         { &::emit($opcode);             }
-    elsif ($opcode =~ m/^j/o && $#_==1) { &::emit($opcode,@arg);        }
-    elsif ($opcode eq "call" && $#_==1) { &::emit($opcode,@arg);        }
-    elsif ($opcode =~ m/^set/&& $#_==1) { &::emit($opcode,@arg);        }
+    elsif ($#_==1 && $opcode =~ m/^(call|clflush|j|loop|set)/o)
+                                        { &::emit($opcode,@arg);        }
     else                                { &::emit($opcode.$suffix,@arg);}
 
   1;
@@ -91,6 +90,7 @@ sub ::DWP
 }
 sub ::QWP       { &::DWP(@_);   }
 sub ::BP        { &::DWP(@_);   }
+sub ::WP        { &::DWP(@_);   }
 sub ::BC        { @_;           }
 sub ::DWC       { @_;           }
 
@@ -149,22 +149,24 @@ sub ::public_label
 {   push(@out,".globl\t".&::LABEL($_[0],$nmdecor.$_[0])."\n");   }
 
 sub ::file_end
-{   if (grep {/\b${nmdecor}OPENSSL_ia32cap_P\b/i} @out) {
-        my $tmp=".comm\t${nmdecor}OPENSSL_ia32cap_P,4";
-        if ($::elf)     { push (@out,"$tmp,4\n"); }
-        else            { push (@out,"$tmp\n"); }
-    }
-    if ($::macosx)
+{   if ($::macosx)
     {   if (%non_lazy_ptr)
         {   push(@out,".section __IMPORT,__pointers,non_lazy_symbol_pointers\n");
             foreach $i (keys %non_lazy_ptr)
             {   push(@out,"$non_lazy_ptr{$i}:\n.indirect_symbol\t$i\n.long\t0\n");   }
         }
     }
+    if (grep {/\b${nmdecor}OPENSSL_ia32cap_P\b/i} @out) {
+        my $tmp=".comm\t${nmdecor}OPENSSL_ia32cap_P,8";
+        if ($::macosx)  { push (@out,"$tmp,2\n"); }
+        elsif ($::elf)  { push (@out,"$tmp,4\n"); }
+        else            { push (@out,"$tmp\n"); }
+    }
     push(@out,$initseg) if ($initseg);
 }
 
 sub ::data_byte {   push(@out,".byte\t".join(',',@_)."\n");   }
+sub ::data_short{   push(@out,".value\t".join(',',@_)."\n");  }
 sub ::data_word {   push(@out,".long\t".join(',',@_)."\n");   }
 
 sub ::align
@@ -189,7 +191,7 @@ sub ::picmeup
        &::lea($dst,&::DWP($sym));
        &::emitraw("#endif /* PIC */");
     }
-    elsif ($::pic && ($::elf || $::aout))
+    if (($::pic && ($::elf || $::aout)) || $::macosx)
     {   if (!defined($base))
         {   &::call(&::label("PIC_me_up"));
             &::set_label("PIC_me_up");
@@ -225,14 +227,17 @@ PIC_EPILOGUE
 .align  $align
 .Linitalign:
 ___
+    } elsif ($::android)
+    {   $initseg.=<<___;
+.section        .init_array
+.align  4
+.long   $f
+___
     }
     elsif ($::elf)
     {   $initseg.=<<___;
 .section        .init
         call    $f
-        jmp     .Linitalign
-.align  $align
-.Linitalign:
 ___
     }
     elsif ($::coff)
diff --git a/src/lib/libcrypto/perlasm/x86nasm.pl b/src/lib/libcrypto/perlasm/x86nasm.pl
index ce2bed9bb2..ca2511c9eb 100644
--- a/src/lib/libcrypto/perlasm/x86nasm.pl
+++ b/src/lib/libcrypto/perlasm/x86nasm.pl
@@ -19,6 +19,8 @@ sub ::generic
         {   $_[0] = "NEAR $_[0]";       }
         elsif ($opcode eq "lea" && $#_==1)  # wipe storage qualifier from lea
         {   $_[1] =~ s/^[^\[]*\[/\[/o;  }
+        elsif ($opcode eq "clflush" && $#_==0)
+        {   $_[0] =~ s/^[^\[]*\[/\[/o;  }
     }
     &::emit($opcode,@_);
   1;
@@ -67,6 +69,7 @@ sub get_mem
 }
 sub ::BP        { &get_mem("BYTE",@_);  }
 sub ::DWP       { &get_mem("DWORD",@_); }
+sub ::WP        { &get_mem("WORD",@_);  }
 sub ::QWP       { &get_mem("",@_);      }
 sub ::BC        { (($::mwerks)?"":"BYTE ")."@_";  }
 sub ::DWC       { (($::mwerks)?"":"DWORD ")."@_"; }
@@ -114,7 +117,7 @@ sub ::file_end
 {   if (grep {/\b${nmdecor}OPENSSL_ia32cap_P\b/i} @out)
     {   my $comm=<<___;
 ${drdecor}segment       .bss
-${drdecor}common        ${nmdecor}OPENSSL_ia32cap_P 4
+${drdecor}common        ${nmdecor}OPENSSL_ia32cap_P 8
 ___
         # comment out OPENSSL_ia32cap_P declarations
         grep {s/(^extern\s+${nmdecor}OPENSSL_ia32cap_P)/\;$1/} @out;
@@ -135,7 +138,8 @@ sub ::public_label
 
 sub ::data_byte
 {   push(@out,(($::mwerks)?".byte\t":"db\t").join(',',@_)."\n");        }
-
+sub ::data_short
+{   push(@out,(($::mwerks)?".word\t":"dw\t").join(',',@_)."\n");        }
 sub ::data_word
 {   push(@out,(($::mwerks)?".long\t":"dd\t").join(',',@_)."\n");        }
 
@@ -163,4 +167,11 @@ sub ::dataseg
     else                { push(@out,"section\t.data align=4\n"); }
 }
 
+sub ::safeseh
+{ my $nm=shift;
+    push(@out,"%if      __NASM_VERSION_ID__ >= 0x02030000\n");
+    push(@out,"safeseh  ".&::LABEL($nm,$nmdecor.$nm)."\n");
+    push(@out,"%endif\n");
+}
+
 1;
diff --git a/src/lib/libcrypto/pkcs12/p12_decr.c b/src/lib/libcrypto/pkcs12/p12_decr.c
index ba77dbbe32..9d3557e8d7 100644
--- a/src/lib/libcrypto/pkcs12/p12_decr.c
+++ b/src/lib/libcrypto/pkcs12/p12_decr.c
@@ -89,7 +89,14 @@ unsigned char * PKCS12_pbe_crypt(X509_ALGOR *algor, const char *pass,
                 goto err;
         }
 
-        EVP_CipherUpdate(&ctx, out, &i, in, inlen);
+        if (!EVP_CipherUpdate(&ctx, out, &i, in, inlen))
+                {
+                OPENSSL_free(out);
+                out = NULL;
+                PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,ERR_R_EVP_LIB);
+                goto err;
+                }
+
         outlen = i;
         if(!EVP_CipherFinal_ex(&ctx, out + i, &i)) {
                 OPENSSL_free(out);
diff --git a/src/lib/libcrypto/pkcs12/p12_key.c b/src/lib/libcrypto/pkcs12/p12_key.c
index 424203f648..c55c7b60b3 100644
--- a/src/lib/libcrypto/pkcs12/p12_key.c
+++ b/src/lib/libcrypto/pkcs12/p12_key.c
@@ -152,14 +152,16 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,
         for (i = 0; i < Slen; i++) *p++ = salt[i % saltlen];
         for (i = 0; i < Plen; i++) *p++ = pass[i % passlen];
         for (;;) {
-                EVP_DigestInit_ex(&ctx, md_type, NULL);
-                EVP_DigestUpdate(&ctx, D, v);
-                EVP_DigestUpdate(&ctx, I, Ilen);
-                EVP_DigestFinal_ex(&ctx, Ai, NULL);
+                if (!EVP_DigestInit_ex(&ctx, md_type, NULL)
+                        || !EVP_DigestUpdate(&ctx, D, v)
+                        || !EVP_DigestUpdate(&ctx, I, Ilen)
+                        || !EVP_DigestFinal_ex(&ctx, Ai, NULL))
+                        goto err;
                 for (j = 1; j < iter; j++) {
-                        EVP_DigestInit_ex(&ctx, md_type, NULL);
-                        EVP_DigestUpdate(&ctx, Ai, u);
-                        EVP_DigestFinal_ex(&ctx, Ai, NULL);
+                        if (!EVP_DigestInit_ex(&ctx, md_type, NULL)
+                                || !EVP_DigestUpdate(&ctx, Ai, u)
+                                || !EVP_DigestFinal_ex(&ctx, Ai, NULL))
+                        goto err;
                 }
                 memcpy (out, Ai, min (n, u));
                 if (u >= n) {
diff --git a/src/lib/libcrypto/pkcs12/p12_kiss.c b/src/lib/libcrypto/pkcs12/p12_kiss.c
index 292cc3ed4a..206b1b0b18 100644
--- a/src/lib/libcrypto/pkcs12/p12_kiss.c
+++ b/src/lib/libcrypto/pkcs12/p12_kiss.c
@@ -167,7 +167,7 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
         if (cert && *cert)
                 X509_free(*cert);
         if (x)
-                X509_free(*cert);
+                X509_free(x);
         if (ocerts)
                 sk_X509_pop_free(ocerts, X509_free);
         return 0;
diff --git a/src/lib/libcrypto/pkcs12/p12_mutl.c b/src/lib/libcrypto/pkcs12/p12_mutl.c
index 9ab740d51f..96de1bd11e 100644
--- a/src/lib/libcrypto/pkcs12/p12_mutl.c
+++ b/src/lib/libcrypto/pkcs12/p12_mutl.c
@@ -97,10 +97,14 @@ int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen,
                 return 0;
         }
         HMAC_CTX_init(&hmac);
-        HMAC_Init_ex(&hmac, key, md_size, md_type, NULL);
-        HMAC_Update(&hmac, p12->authsafes->d.data->data,
-                                         p12->authsafes->d.data->length);
-        HMAC_Final(&hmac, mac, maclen);
+        if (!HMAC_Init_ex(&hmac, key, md_size, md_type, NULL)
+                || !HMAC_Update(&hmac, p12->authsafes->d.data->data,
+                                         p12->authsafes->d.data->length)
+                || !HMAC_Final(&hmac, mac, maclen))
+                {
+                HMAC_CTX_cleanup(&hmac);
+                return 0;
+                }
         HMAC_CTX_cleanup(&hmac);
         return 1;
 }
diff --git a/src/lib/libcrypto/pkcs7/pk7_doit.c b/src/lib/libcrypto/pkcs7/pk7_doit.c
index 3bf1a367bb..77fda3b82a 100644
--- a/src/lib/libcrypto/pkcs7/pk7_doit.c
+++ b/src/lib/libcrypto/pkcs7/pk7_doit.c
@@ -204,11 +204,11 @@ static int pkcs7_decrypt_rinfo(unsigned char **pek, int *peklen,
         unsigned char *ek = NULL;
         size_t eklen;
 
-        int ret = 0;
+        int ret = -1;
 
         pctx = EVP_PKEY_CTX_new(pkey, NULL);
         if (!pctx)
-                return 0;
+                return -1;
 
         if (EVP_PKEY_decrypt_init(pctx) <= 0)
                 goto err;
@@ -235,12 +235,19 @@ static int pkcs7_decrypt_rinfo(unsigned char **pek, int *peklen,
         if (EVP_PKEY_decrypt(pctx, ek, &eklen,
                                 ri->enc_key->data, ri->enc_key->length) <= 0)
                 {
+                ret = 0;
                 PKCS7err(PKCS7_F_PKCS7_DECRYPT_RINFO, ERR_R_EVP_LIB);
                 goto err;
                 }
 
         ret = 1;
 
+        if (*pek)
+                {
+                OPENSSL_cleanse(*pek, *peklen);
+                OPENSSL_free(*pek);
+                }
+
         *pek = ek;
         *peklen = eklen;
 
@@ -423,6 +430,8 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         STACK_OF(X509_ALGOR) *md_sk=NULL;
         STACK_OF(PKCS7_RECIP_INFO) *rsk=NULL;
         PKCS7_RECIP_INFO *ri=NULL;
+       unsigned char *ek = NULL, *tkey = NULL;
+       int eklen = 0, tkeylen = 0;
 
         i=OBJ_obj2nid(p7->type);
         p7->state=PKCS7_S_HEADER;
@@ -500,8 +509,6 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 int max;
                 X509_OBJECT ret;
 #endif
-                unsigned char *ek = NULL;
-                int eklen;
 
                 if ((etmp=BIO_new(BIO_f_cipher())) == NULL)
                         {
@@ -534,29 +541,28 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                         }
 
                 /* If we haven't got a certificate try each ri in turn */
-
                 if (pcert == NULL)
                         {
+                        /* Always attempt to decrypt all rinfo even
+                         * after sucess as a defence against MMA timing
+                         * attacks.
+                         */
                         for (i=0; i<sk_PKCS7_RECIP_INFO_num(rsk); i++)
                                 {
                                 ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
+                                
                                 if (pkcs7_decrypt_rinfo(&ek, &eklen,
-                                                        ri, pkey) > 0)
-                                        break;
+                                                        ri, pkey) < 0)
+                                        goto err;
                                 ERR_clear_error();
-                                ri = NULL;
-                                }
-                        if (ri == NULL)
-                                {
-                                PKCS7err(PKCS7_F_PKCS7_DATADECODE,
-                                      PKCS7_R_NO_RECIPIENT_MATCHES_KEY);
-                                goto err;
                                 }
                         }
                 else
                         {
-                        if (pkcs7_decrypt_rinfo(&ek, &eklen, ri, pkey) <= 0)
+                        /* Only exit on fatal errors, not decrypt failure */
+                        if (pkcs7_decrypt_rinfo(&ek, &eklen, ri, pkey) < 0)
                                 goto err;
+                        ERR_clear_error();
                         }
 
                 evp_ctx=NULL;
@@ -565,6 +571,19 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                         goto err;
                 if (EVP_CIPHER_asn1_to_param(evp_ctx,enc_alg->parameter) < 0)
                         goto err;
+                /* Generate random key as MMA defence */
+                tkeylen = EVP_CIPHER_CTX_key_length(evp_ctx);
+                tkey = OPENSSL_malloc(tkeylen);
+                if (!tkey)
+                        goto err;
+                if (EVP_CIPHER_CTX_rand_key(evp_ctx, tkey) <= 0)
+                        goto err;
+                if (ek == NULL)
+                        {
+                        ek = tkey;
+                        eklen = tkeylen;
+                        tkey = NULL;
+                        }
 
                 if (eklen != EVP_CIPHER_CTX_key_length(evp_ctx)) {
                         /* Some S/MIME clients don't use the same key
@@ -573,11 +592,16 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                          */
                         if(!EVP_CIPHER_CTX_set_key_length(evp_ctx, eklen))
                                 {
-                                PKCS7err(PKCS7_F_PKCS7_DATADECODE,
-                                        PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH);
-                                goto err;
+                                /* Use random key as MMA defence */
+                                OPENSSL_cleanse(ek, eklen);
+                                OPENSSL_free(ek);
+                                ek = tkey;
+                                eklen = tkeylen;
+                                tkey = NULL;
                                 }
                 } 
+                /* Clear errors so we don't leak information useful in MMA */
+                ERR_clear_error();
                 if (EVP_CipherInit_ex(evp_ctx,NULL,NULL,ek,NULL,0) <= 0)
                         goto err;
 
@@ -585,6 +609,13 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                         {
                         OPENSSL_cleanse(ek,eklen);
                         OPENSSL_free(ek);
+                       ek = NULL;
+                        }
+                if (tkey)
+                        {
+                        OPENSSL_cleanse(tkey,tkeylen);
+                        OPENSSL_free(tkey);
+                       tkey = NULL;
                         }
 
                 if (out == NULL)
@@ -627,6 +658,16 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         if (0)
                 {
 err:
+               if (ek)
+                       {
+                       OPENSSL_cleanse(ek,eklen);
+                       OPENSSL_free(ek);
+                       }
+               if (tkey)
+                       {
+                       OPENSSL_cleanse(tkey,tkeylen);
+                       OPENSSL_free(tkey);
+                       }
                 if (out != NULL) BIO_free_all(out);
                 if (btmp != NULL) BIO_free_all(btmp);
                 if (etmp != NULL) BIO_free_all(etmp);
@@ -676,7 +717,11 @@ static int do_pkcs7_signed_attrib(PKCS7_SIGNER_INFO *si, EVP_MD_CTX *mctx)
                 }
 
         /* Add digest */
-        EVP_DigestFinal_ex(mctx, md_data,&md_len);
+        if (!EVP_DigestFinal_ex(mctx, md_data,&md_len))
+                {
+                PKCS7err(PKCS7_F_DO_PKCS7_SIGNED_ATTRIB, ERR_R_EVP_LIB);
+                return 0;
+                }
         if (!PKCS7_add1_attrib_digest(si, md_data, md_len))
                 {
                 PKCS7err(PKCS7_F_DO_PKCS7_SIGNED_ATTRIB, ERR_R_MALLOC_FAILURE);
@@ -784,7 +829,8 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
 
                         /* We now have the EVP_MD_CTX, lets do the
                          * signing. */
-                        EVP_MD_CTX_copy_ex(&ctx_tmp,mdc);
+                        if (!EVP_MD_CTX_copy_ex(&ctx_tmp,mdc))
+                                goto err;
 
                         sk=si->auth_attr;
 
@@ -822,7 +868,8 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                 if (!PKCS7_find_digest(&mdc, bio,
                                 OBJ_obj2nid(p7->d.digest->md->algorithm)))
                         goto err;
-                EVP_DigestFinal_ex(mdc,md_data,&md_len);
+                if (!EVP_DigestFinal_ex(mdc,md_data,&md_len))
+                        goto err;
                 M_ASN1_OCTET_STRING_set(p7->d.digest->digest, md_data, md_len);
                 }
 
@@ -1015,7 +1062,8 @@ int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
 
         /* mdc is the digest ctx that we want, unless there are attributes,
          * in which case the digest is the signed attributes */
-        EVP_MD_CTX_copy_ex(&mdc_tmp,mdc);
+        if (!EVP_MD_CTX_copy_ex(&mdc_tmp,mdc))
+                goto err;
 
         sk=si->auth_attr;
         if ((sk != NULL) && (sk_X509_ATTRIBUTE_num(sk) != 0))
@@ -1025,7 +1073,8 @@ int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
                 int alen;
                 ASN1_OCTET_STRING *message_digest;
 
-                EVP_DigestFinal_ex(&mdc_tmp,md_dat,&md_len);
+                if (!EVP_DigestFinal_ex(&mdc_tmp,md_dat,&md_len))
+                        goto err;
                 message_digest=PKCS7_digest_from_attributes(sk);
                 if (!message_digest)
                         {
@@ -1050,7 +1099,8 @@ for (ii=0; ii<md_len; ii++) printf("%02X",md_dat[ii]); printf(" calc\n");
                         goto err;
                         }
 
-                EVP_VerifyInit_ex(&mdc_tmp,EVP_get_digestbynid(md_type), NULL);
+                if (!EVP_VerifyInit_ex(&mdc_tmp,EVP_get_digestbynid(md_type), NULL))
+                        goto err;
 
                 alen = ASN1_item_i2d((ASN1_VALUE *)sk, &abuf,
                                                 ASN1_ITEM_rptr(PKCS7_ATTR_VERIFY));
@@ -1060,7 +1110,8 @@ for (ii=0; ii<md_len; ii++) printf("%02X",md_dat[ii]); printf(" calc\n");
                         ret = -1;
                         goto err;
                         }
-                EVP_VerifyUpdate(&mdc_tmp, abuf, alen);
+                if (!EVP_VerifyUpdate(&mdc_tmp, abuf, alen))
+                        goto err;
 
                 OPENSSL_free(abuf);
                 }
diff --git a/src/lib/libcrypto/pkcs7/pk7_smime.c b/src/lib/libcrypto/pkcs7/pk7_smime.c
index 86742d0dcd..a5104f8d05 100644
--- a/src/lib/libcrypto/pkcs7/pk7_smime.c
+++ b/src/lib/libcrypto/pkcs7/pk7_smime.c
@@ -573,15 +573,34 @@ int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags)
                         return 0;
                 }
                 ret = SMIME_text(bread, data);
+                if (ret > 0 && BIO_method_type(tmpmem) == BIO_TYPE_CIPHER)
+                        {
+                        if (!BIO_get_cipher_status(tmpmem))
+                                ret = 0;
+                        }
                 BIO_free_all(bread);
                 return ret;
         } else {
                 for(;;) {
                         i = BIO_read(tmpmem, buf, sizeof(buf));
-                        if(i <= 0) break;
-                        BIO_write(data, buf, i);
+                        if(i <= 0)
+                                {
+                                ret = 1;
+                                if (BIO_method_type(tmpmem) == BIO_TYPE_CIPHER)
+                                        {
+                                        if (!BIO_get_cipher_status(tmpmem))
+                                                ret = 0;
+                                        }
+                                        
+                                break;
+                                }
+                        if (BIO_write(data, buf, i) != i)
+                                {
+                                ret = 0;
+                                break;
+                                }
                 }
                 BIO_free_all(tmpmem);
-                return 1;
+                return ret;
         }
 }
diff --git a/src/lib/libcrypto/rand/md_rand.c b/src/lib/libcrypto/rand/md_rand.c
index b2f04ff13e..fcdd3f2a84 100644
--- a/src/lib/libcrypto/rand/md_rand.c
+++ b/src/lib/libcrypto/rand/md_rand.c
@@ -109,6 +109,8 @@
  *
  */
 
+#define OPENSSL_FIPSEVP
+
 #ifdef MD_RAND_DEBUG
 # ifndef NDEBUG
 #   define NDEBUG
@@ -157,13 +159,14 @@ const char RAND_version[]="RAND" OPENSSL_VERSION_PTEXT;
 static void ssleay_rand_cleanup(void);
 static void ssleay_rand_seed(const void *buf, int num);
 static void ssleay_rand_add(const void *buf, int num, double add_entropy);
-static int ssleay_rand_bytes(unsigned char *buf, int num);
+static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo);
+static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num);
 static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num);
 static int ssleay_rand_status(void);
 
 RAND_METHOD rand_ssleay_meth={
         ssleay_rand_seed,
-        ssleay_rand_bytes,
+        ssleay_rand_nopseudo_bytes,
         ssleay_rand_cleanup,
         ssleay_rand_add,
         ssleay_rand_pseudo_bytes,
@@ -328,7 +331,7 @@ static void ssleay_rand_seed(const void *buf, int num)
         ssleay_rand_add(buf, num, (double)num);
         }
 
-static int ssleay_rand_bytes(unsigned char *buf, int num)
+static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
         {
         static volatile int stirred_pool = 0;
         int i,j,k,st_num,st_idx;
@@ -517,7 +520,9 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
         EVP_MD_CTX_cleanup(&m);
         if (ok)
                 return(1);
-        else
+        else if (pseudo)
+                return 0;
+        else 
                 {
                 RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED);
                 ERR_add_error_data(1, "You need to read the OpenSSL FAQ, "
@@ -526,22 +531,16 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
                 }
         }
 
+static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num)
+        {
+        return ssleay_rand_bytes(buf, num, 0);
+        }
+
 /* pseudo-random bytes that are guaranteed to be unique but not
    unpredictable */
 static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num) 
         {
-        int ret;
-        unsigned long err;
-
-        ret = RAND_bytes(buf, num);
-        if (ret == 0)
-                {
-                err = ERR_peek_error();
-                if (ERR_GET_LIB(err) == ERR_LIB_RAND &&
-                    ERR_GET_REASON(err) == RAND_R_PRNG_NOT_SEEDED)
-                        ERR_clear_error();
-                }
-        return (ret);
+        return ssleay_rand_bytes(buf, num, 1);
         }
 
 static int ssleay_rand_status(void)
diff --git a/src/lib/libcrypto/rand/rand.h b/src/lib/libcrypto/rand/rand.h
index ac6c021763..dc8fcf94c5 100644
--- a/src/lib/libcrypto/rand/rand.h
+++ b/src/lib/libcrypto/rand/rand.h
@@ -119,6 +119,11 @@ int RAND_event(UINT, WPARAM, LPARAM);
 
 #endif
 
+#ifdef OPENSSL_FIPS
+void RAND_set_fips_drbg_type(int type, int flags);
+int RAND_init_fips(void);
+#endif
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -129,9 +134,13 @@ void ERR_load_RAND_strings(void);
 
 /* Function codes. */
 #define RAND_F_RAND_GET_RAND_METHOD                      101
+#define RAND_F_RAND_INIT_FIPS                            102
 #define RAND_F_SSLEAY_RAND_BYTES                         100
 
 /* Reason codes. */
+#define RAND_R_ERROR_INITIALISING_DRBG                   102
+#define RAND_R_ERROR_INSTANTIATING_DRBG                  103
+#define RAND_R_NO_FIPS_RANDOM_METHOD_SET                 101
 #define RAND_R_PRNG_NOT_SEEDED                           100
 
 #ifdef  __cplusplus
diff --git a/src/lib/libcrypto/rand/rand_err.c b/src/lib/libcrypto/rand/rand_err.c
index 03cda4dd92..b8586c8f4a 100644
--- a/src/lib/libcrypto/rand/rand_err.c
+++ b/src/lib/libcrypto/rand/rand_err.c
@@ -1,6 +1,6 @@
 /* crypto/rand/rand_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -71,12 +71,16 @@
 static ERR_STRING_DATA RAND_str_functs[]=
         {
 {ERR_FUNC(RAND_F_RAND_GET_RAND_METHOD), "RAND_get_rand_method"},
+{ERR_FUNC(RAND_F_RAND_INIT_FIPS),       "RAND_init_fips"},
 {ERR_FUNC(RAND_F_SSLEAY_RAND_BYTES),    "SSLEAY_RAND_BYTES"},
 {0,NULL}
         };
 
 static ERR_STRING_DATA RAND_str_reasons[]=
         {
+{ERR_REASON(RAND_R_ERROR_INITIALISING_DRBG),"error initialising drbg"},
+{ERR_REASON(RAND_R_ERROR_INSTANTIATING_DRBG),"error instantiating drbg"},
+{ERR_REASON(RAND_R_NO_FIPS_RANDOM_METHOD_SET),"no fips random method set"},
 {ERR_REASON(RAND_R_PRNG_NOT_SEEDED)      ,"PRNG not seeded"},
 {0,NULL}
         };
diff --git a/src/lib/libcrypto/rand/rand_lib.c b/src/lib/libcrypto/rand/rand_lib.c
index 513e338985..daf1dab973 100644
--- a/src/lib/libcrypto/rand/rand_lib.c
+++ b/src/lib/libcrypto/rand/rand_lib.c
@@ -60,10 +60,16 @@
 #include <time.h>
 #include "cryptlib.h"
 #include <openssl/rand.h>
+
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#include <openssl/fips_rand.h>
+#endif
+
 #ifndef OPENSSL_NO_ENGINE
 /* non-NULL if default_RAND_meth is ENGINE-provided */
 static ENGINE *funct_ref =NULL;
@@ -174,3 +180,116 @@ int RAND_status(void)
                 return meth->status();
         return 0;
         }
+
+#ifdef OPENSSL_FIPS
+
+/* FIPS DRBG initialisation code. This sets up the DRBG for use by the
+ * rest of OpenSSL. 
+ */
+
+/* Entropy gatherer: use standard OpenSSL PRNG to seed (this will gather
+ * entropy internally through RAND_poll().
+ */
+
+static size_t drbg_get_entropy(DRBG_CTX *ctx, unsigned char **pout,
+                                int entropy, size_t min_len, size_t max_len)
+        {
+        /* Round up request to multiple of block size */
+        min_len = ((min_len + 19) / 20) * 20;
+        *pout = OPENSSL_malloc(min_len);
+        if (!*pout)
+                return 0;
+        if (RAND_SSLeay()->bytes(*pout, min_len) <= 0)
+                {
+                OPENSSL_free(*pout);
+                *pout = NULL;
+                return 0;
+                }
+        return min_len;
+        }
+
+static void drbg_free_entropy(DRBG_CTX *ctx, unsigned char *out, size_t olen)
+        {
+        OPENSSL_cleanse(out, olen);
+        OPENSSL_free(out);
+        }
+
+/* Set "additional input" when generating random data. This uses the
+ * current PID, a time value and a counter.
+ */
+
+static size_t drbg_get_adin(DRBG_CTX *ctx, unsigned char **pout)
+        {
+        /* Use of static variables is OK as this happens under a lock */
+        static unsigned char buf[16];
+        static unsigned long counter;
+        FIPS_get_timevec(buf, &counter);
+        *pout = buf;
+        return sizeof(buf);
+        }
+
+/* RAND_add() and RAND_seed() pass through to OpenSSL PRNG so it is 
+ * correctly seeded by RAND_poll().
+ */
+
+static int drbg_rand_add(DRBG_CTX *ctx, const void *in, int inlen,
+                                double entropy)
+        {
+        RAND_SSLeay()->add(in, inlen, entropy);
+        return 1;
+        }
+
+static int drbg_rand_seed(DRBG_CTX *ctx, const void *in, int inlen)
+        {
+        RAND_SSLeay()->seed(in, inlen);
+        return 1;
+        }
+
+#ifndef OPENSSL_DRBG_DEFAULT_TYPE
+#define OPENSSL_DRBG_DEFAULT_TYPE       NID_aes_256_ctr
+#endif
+#ifndef OPENSSL_DRBG_DEFAULT_FLAGS
+#define OPENSSL_DRBG_DEFAULT_FLAGS      DRBG_FLAG_CTR_USE_DF
+#endif 
+
+static int fips_drbg_type = OPENSSL_DRBG_DEFAULT_TYPE;
+static int fips_drbg_flags = OPENSSL_DRBG_DEFAULT_FLAGS;
+
+void RAND_set_fips_drbg_type(int type, int flags)
+        {
+        fips_drbg_type = type;
+        fips_drbg_flags = flags;
+        }
+
+int RAND_init_fips(void)
+        {
+        DRBG_CTX *dctx;
+        size_t plen;
+        unsigned char pers[32], *p;
+        dctx = FIPS_get_default_drbg();
+        if (FIPS_drbg_init(dctx, fips_drbg_type, fips_drbg_flags) <= 0)
+                {
+                RANDerr(RAND_F_RAND_INIT_FIPS, RAND_R_ERROR_INITIALISING_DRBG);
+                return 0;
+                }
+                
+        FIPS_drbg_set_callbacks(dctx,
+                                drbg_get_entropy, drbg_free_entropy, 20,
+                                drbg_get_entropy, drbg_free_entropy);
+        FIPS_drbg_set_rand_callbacks(dctx, drbg_get_adin, 0,
+                                        drbg_rand_seed, drbg_rand_add);
+        /* Personalisation string: a string followed by date time vector */
+        strcpy((char *)pers, "OpenSSL DRBG2.0");
+        plen = drbg_get_adin(dctx, &p);
+        memcpy(pers + 16, p, plen);
+
+        if (FIPS_drbg_instantiate(dctx, pers, sizeof(pers)) <= 0)
+                {
+                RANDerr(RAND_F_RAND_INIT_FIPS, RAND_R_ERROR_INSTANTIATING_DRBG);
+                return 0;
+                }
+        FIPS_rand_set_method(FIPS_drbg_method());
+        return 1;
+        }
+
+#endif
diff --git a/src/lib/libcrypto/rand/randfile.c b/src/lib/libcrypto/rand/randfile.c
index bc7d9c5804..030e07f418 100644
--- a/src/lib/libcrypto/rand/randfile.c
+++ b/src/lib/libcrypto/rand/randfile.c
@@ -137,7 +137,7 @@ int RAND_load_file(const char *file, long bytes)
         in=fopen(file,"rb");
 #endif
         if (in == NULL) goto err;
-#if defined(S_IFBLK) && defined(S_IFCHR) && !defined(OPNESSL_NO_POSIX_IO)
+#if defined(S_IFBLK) && defined(S_IFCHR) && !defined(OPENSSL_NO_POSIX_IO)
         if (sb.st_mode & (S_IFBLK | S_IFCHR)) {
           /* this file is a device. we don't want read an infinite number
            * of bytes from a random device, nor do we want to use buffered
diff --git a/src/lib/libcrypto/rc2/rc2.h b/src/lib/libcrypto/rc2/rc2.h
index 34c8362317..e542ec94ff 100644
--- a/src/lib/libcrypto/rc2/rc2.h
+++ b/src/lib/libcrypto/rc2/rc2.h
@@ -79,7 +79,9 @@ typedef struct rc2_key_st
         RC2_INT data[64];
         } RC2_KEY;
 
- 
+#ifdef OPENSSL_FIPS 
+void private_RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,int bits);
+#endif
 void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,int bits);
 void RC2_ecb_encrypt(const unsigned char *in,unsigned char *out,RC2_KEY *key,
                      int enc);
diff --git a/src/lib/libcrypto/rc2/rc2_skey.c b/src/lib/libcrypto/rc2/rc2_skey.c
index 0150b0e035..6668ac011f 100644
--- a/src/lib/libcrypto/rc2/rc2_skey.c
+++ b/src/lib/libcrypto/rc2/rc2_skey.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/crypto.h>
 #include <openssl/rc2.h>
 #include "rc2_locl.h"
 
@@ -95,6 +96,13 @@ static const unsigned char key_table[256]={
  * the same as specifying 1024 for the 'bits' parameter.  Bsafe uses
  * a version where the bits parameter is the same as len*8 */
 void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data, int bits)
+#ifdef OPENSSL_FIPS
+        {
+        fips_cipher_abort(RC2);
+        private_RC2_set_key(key, len, data, bits);
+        }
+void private_RC2_set_key(RC2_KEY *key, int len, const unsigned char *data, int bits)
+#endif
         {
         int i,j;
         unsigned char *k;
diff --git a/src/lib/libcrypto/rc4/asm/rc4-586.pl b/src/lib/libcrypto/rc4/asm/rc4-586.pl
index 38a44a70ef..5c9ac6ad28 100644
--- a/src/lib/libcrypto/rc4/asm/rc4-586.pl
+++ b/src/lib/libcrypto/rc4/asm/rc4-586.pl
@@ -28,6 +28,34 @@
 #
 #                                       <appro@fy.chalmers.se>
 
+# May 2011
+#
+# Optimize for Core2 and Westmere [and incidentally Opteron]. Current
+# performance in cycles per processed byte (less is better) and
+# improvement relative to previous version of this module is:
+#
+# Pentium       10.2                    # original numbers
+# Pentium III   7.8(*)
+# Intel P4      7.5
+#
+# Opteron       6.1/+20%                # new MMX numbers
+# Core2         5.3/+67%(**)
+# Westmere      5.1/+94%(**)
+# Sandy Bridge  5.0/+8%
+# Atom          12.6/+6%
+#
+# (*)   PIII can actually deliver 6.6 cycles per byte with MMX code,
+#       but this specific code performs poorly on Core2. And vice
+#       versa, below MMX/SSE code delivering 5.8/7.1 on Core2 performs
+#       poorly on PIII, at 8.0/14.5:-( As PIII is not a "hot" CPU
+#       [anymore], I chose to discard PIII-specific code path and opt
+#       for original IALU-only code, which is why MMX/SSE code path
+#       is guarded by SSE2 bit (see below), not MMX/SSE.
+# (**)  Performance vs. block size on Core2 and Westmere had a maximum
+#       at ... 64 bytes block size. And it was quite a maximum, 40-60%
+#       in comparison to largest 8KB block size. Above improvement
+#       coefficients are for the largest block size.
+
 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
 push(@INC,"${dir}","${dir}../../perlasm");
 require "x86asm.pl";
@@ -62,6 +90,68 @@ sub RC4_loop {
         &$func  ($out,&DWP(0,$dat,$ty,4));
 }
 
+if ($alt=0) {
+  # >20% faster on Atom and Sandy Bridge[!], 8% faster on Opteron,
+  # but ~40% slower on Core2 and Westmere... Attempt to add movz
+  # brings down Opteron by 25%, Atom and Sandy Bridge by 15%, yet
+  # on Core2 with movz it's almost 20% slower than below alternative
+  # code... Yes, it's a total mess...
+  my @XX=($xx,$out);
+  $RC4_loop_mmx = sub {         # SSE actually...
+    my $i=shift;
+    my $j=$i<=0?0:$i>>1;
+    my $mm=$i<=0?"mm0":"mm".($i&1);
+
+        &add    (&LB($yy),&LB($tx));
+        &lea    (@XX[1],&DWP(1,@XX[0]));
+        &pxor   ("mm2","mm0")                           if ($i==0);
+        &psllq  ("mm1",8)                               if ($i==0);
+        &and    (@XX[1],0xff);
+        &pxor   ("mm0","mm0")                           if ($i<=0);
+        &mov    ($ty,&DWP(0,$dat,$yy,4));
+        &mov    (&DWP(0,$dat,$yy,4),$tx);
+        &pxor   ("mm1","mm2")                           if ($i==0);
+        &mov    (&DWP(0,$dat,$XX[0],4),$ty);
+        &add    (&LB($ty),&LB($tx));
+        &movd   (@XX[0],"mm7")                          if ($i==0);
+        &mov    ($tx,&DWP(0,$dat,@XX[1],4));
+        &pxor   ("mm1","mm1")                           if ($i==1);
+        &movq   ("mm2",&QWP(0,$inp))                    if ($i==1);
+        &movq   (&QWP(-8,(@XX[0],$inp)),"mm1")          if ($i==0);
+        &pinsrw ($mm,&DWP(0,$dat,$ty,4),$j);
+
+        push    (@XX,shift(@XX))                        if ($i>=0);
+  }
+} else {
+  # Using pinsrw here improves performane on Intel CPUs by 2-3%, but
+  # brings down AMD by 7%...
+  $RC4_loop_mmx = sub {
+    my $i=shift;
+
+        &add    (&LB($yy),&LB($tx));
+        &psllq  ("mm1",8*(($i-1)&7))                    if (abs($i)!=1);
+        &mov    ($ty,&DWP(0,$dat,$yy,4));
+        &mov    (&DWP(0,$dat,$yy,4),$tx);
+        &mov    (&DWP(0,$dat,$xx,4),$ty);
+        &inc    ($xx);
+        &add    ($ty,$tx);
+        &movz   ($xx,&LB($xx));                         # (*)
+        &movz   ($ty,&LB($ty));                         # (*)
+        &pxor   ("mm2",$i==1?"mm0":"mm1")               if ($i>=0);
+        &movq   ("mm0",&QWP(0,$inp))                    if ($i<=0);
+        &movq   (&QWP(-8,($out,$inp)),"mm2")            if ($i==0);
+        &mov    ($tx,&DWP(0,$dat,$xx,4));
+        &movd   ($i>0?"mm1":"mm2",&DWP(0,$dat,$ty,4));
+
+        # (*)   This is the key to Core2 and Westmere performance.
+        #       Whithout movz out-of-order execution logic confuses
+        #       itself and fails to reorder loads and stores. Problem
+        #       appears to be fixed in Sandy Bridge...
+  }
+}
+
+&external_label("OPENSSL_ia32cap_P");
+
 # void RC4(RC4_KEY *key,size_t len,const unsigned char *inp,unsigned char *out);
 &function_begin("RC4");
         &mov    ($dat,&wparam(0));      # load key schedule pointer
@@ -94,11 +184,56 @@ sub RC4_loop {
         &and    ($ty,-4);               # how many 4-byte chunks?
         &jz     (&label("loop1"));
 
+        &test   ($ty,-8);
+        &mov    (&wparam(3),$out);      # $out as accumulator in these loops
+        &jz     (&label("go4loop4"));
+
+        &picmeup($out,"OPENSSL_ia32cap_P");
+        &bt     (&DWP(0,$out),26);      # check SSE2 bit [could have been MMX]
+        &jnc    (&label("go4loop4"));
+
+        &mov    ($out,&wparam(3))       if (!$alt);
+        &movd   ("mm7",&wparam(3))      if ($alt);
+        &and    ($ty,-8);
+        &lea    ($ty,&DWP(-8,$inp,$ty));
+        &mov    (&DWP(-4,$dat),$ty);    # save input+(len/8)*8-8
+
+        &$RC4_loop_mmx(-1);
+        &jmp(&label("loop_mmx_enter"));
+
+        &set_label("loop_mmx",16);
+                &$RC4_loop_mmx(0);
+        &set_label("loop_mmx_enter");
+                for     ($i=1;$i<8;$i++) { &$RC4_loop_mmx($i); }
+                &mov    ($ty,$yy);
+                &xor    ($yy,$yy);              # this is second key to Core2
+                &mov    (&LB($yy),&LB($ty));    # and Westmere performance...
+                &cmp    ($inp,&DWP(-4,$dat));
+                &lea    ($inp,&DWP(8,$inp));
+        &jb     (&label("loop_mmx"));
+
+    if ($alt) {
+        &movd   ($out,"mm7");
+        &pxor   ("mm2","mm0");
+        &psllq  ("mm1",8);
+        &pxor   ("mm1","mm2");
+        &movq   (&QWP(-8,$out,$inp),"mm1");
+    } else {
+        &psllq  ("mm1",56);
+        &pxor   ("mm2","mm1");
+        &movq   (&QWP(-8,$out,$inp),"mm2");
+    }
+        &emms   ();
+
+        &cmp    ($inp,&wparam(1));      # compare to input+len
+        &je     (&label("done"));
+        &jmp    (&label("loop1"));
+
+&set_label("go4loop4",16);
         &lea    ($ty,&DWP(-4,$inp,$ty));
         &mov    (&wparam(2),$ty);       # save input+(len/4)*4-4
-        &mov    (&wparam(3),$out);      # $out as accumulator in this loop
 
-        &set_label("loop4",16);
+        &set_label("loop4");
                 for ($i=0;$i<4;$i++) { RC4_loop($i); }
                 &ror    ($out,8);
                 &xor    ($out,&DWP(0,$inp));
@@ -151,7 +286,7 @@ sub RC4_loop {
 
 &set_label("done");
         &dec    (&LB($xx));
-        &mov    (&BP(-4,$dat),&LB($yy));        # save key->y
+        &mov    (&DWP(-4,$dat),$yy);            # save key->y
         &mov    (&BP(-8,$dat),&LB($xx));        # save key->x
 &set_label("abort");
 &function_end("RC4");
@@ -164,10 +299,8 @@ $idi="ebp";
 $ido="ecx";
 $idx="edx";
 
-&external_label("OPENSSL_ia32cap_P");
-
 # void RC4_set_key(RC4_KEY *key,int len,const unsigned char *data);
-&function_begin("RC4_set_key");
+&function_begin("private_RC4_set_key");
         &mov    ($out,&wparam(0));              # load key
         &mov    ($idi,&wparam(1));              # load len
         &mov    ($inp,&wparam(2));              # load data
@@ -245,7 +378,7 @@ $idx="edx";
         &xor    ("eax","eax");
         &mov    (&DWP(-8,$out),"eax");          # key->x=0;
         &mov    (&DWP(-4,$out),"eax");          # key->y=0;
-&function_end("RC4_set_key");
+&function_end("private_RC4_set_key");
 
 # const char *RC4_options(void);
 &function_begin_B("RC4_options");
@@ -254,14 +387,21 @@ $idx="edx";
         &blindpop("eax");
         &lea    ("eax",&DWP(&label("opts")."-".&label("pic_point"),"eax"));
         &picmeup("edx","OPENSSL_ia32cap_P");
-        &bt     (&DWP(0,"edx"),20);
-        &jnc    (&label("skip"));
-          &add  ("eax",12);
-        &set_label("skip");
+        &mov    ("edx",&DWP(0,"edx"));
+        &bt     ("edx",20);
+        &jc     (&label("1xchar"));
+        &bt     ("edx",26);
+        &jnc    (&label("ret"));
+        &add    ("eax",25);
+        &ret    ();
+&set_label("1xchar");
+        &add    ("eax",12);
+&set_label("ret");
         &ret    ();
 &set_label("opts",64);
 &asciz  ("rc4(4x,int)");
 &asciz  ("rc4(1x,char)");
+&asciz  ("rc4(8x,mmx)");
 &asciz  ("RC4 for x86, CRYPTOGAMS by <appro\@openssl.org>");
 &align  (64);
 &function_end_B("RC4_options");
diff --git a/src/lib/libcrypto/rc4/asm/rc4-x86_64.pl b/src/lib/libcrypto/rc4/asm/rc4-x86_64.pl
index 544386bf53..ac2c05074e 100755
--- a/src/lib/libcrypto/rc4/asm/rc4-x86_64.pl
+++ b/src/lib/libcrypto/rc4/asm/rc4-x86_64.pl
@@ -7,6 +7,8 @@
 # details see http://www.openssl.org/~appro/cryptogams/.
 # ====================================================================
 #
+# July 2004
+#
 # 2.22x RC4 tune-up:-) It should be noted though that my hand [as in
 # "hand-coded assembler"] doesn't stand for the whole improvement
 # coefficient. It turned out that eliminating RC4_CHAR from config
@@ -19,6 +21,8 @@
 # to operate on partial registers, it turned out to be the best bet.
 # At least for AMD... How IA32E would perform remains to be seen...
 
+# November 2004
+#
 # As was shown by Marc Bevand reordering of couple of load operations
 # results in even higher performance gain of 3.3x:-) At least on
 # Opteron... For reference, 1x in this case is RC4_CHAR C-code
@@ -26,6 +30,8 @@
 # Latter means that if you want to *estimate* what to expect from
 # *your* Opteron, then multiply 54 by 3.3 and clock frequency in GHz.
 
+# November 2004
+#
 # Intel P4 EM64T core was found to run the AMD64 code really slow...
 # The only way to achieve comparable performance on P4 was to keep
 # RC4_CHAR. Kind of ironic, huh? As it's apparently impossible to
@@ -33,10 +39,14 @@
 # on either AMD and Intel platforms, I implement both cases. See
 # rc4_skey.c for further details...
 
+# April 2005
+#
 # P4 EM64T core appears to be "allergic" to 64-bit inc/dec. Replacing 
 # those with add/sub results in 50% performance improvement of folded
 # loop...
 
+# May 2005
+#
 # As was shown by Zou Nanhai loop unrolling can improve Intel EM64T
 # performance by >30% [unlike P4 32-bit case that is]. But this is
 # provided that loads are reordered even more aggressively! Both code
@@ -50,6 +60,8 @@
 # is not implemented, then this final RC4_CHAR code-path should be
 # preferred, as it provides better *all-round* performance].
 
+# March 2007
+#
 # Intel Core2 was observed to perform poorly on both code paths:-( It
 # apparently suffers from some kind of partial register stall, which
 # occurs in 64-bit mode only [as virtually identical 32-bit loop was
@@ -58,6 +70,37 @@
 # fit for Core2 and therefore the code was modified to skip cloop8 on
 # this CPU.
 
+# May 2010
+#
+# Intel Westmere was observed to perform suboptimally. Adding yet
+# another movzb to cloop1 improved performance by almost 50%! Core2
+# performance is improved too, but nominally...
+
+# May 2011
+#
+# The only code path that was not modified is P4-specific one. Non-P4
+# Intel code path optimization is heavily based on submission by Maxim
+# Perminov, Maxim Locktyukhin and Jim Guilford of Intel. I've used
+# some of the ideas even in attempt to optmize the original RC4_INT
+# code path... Current performance in cycles per processed byte (less
+# is better) and improvement coefficients relative to previous
+# version of this module are:
+#
+# Opteron       5.3/+0%(*)
+# P4            6.5
+# Core2         6.2/+15%(**)
+# Westmere      4.2/+60%
+# Sandy Bridge  4.2/+120%
+# Atom          9.3/+80%
+#
+# (*)   But corresponding loop has less instructions, which should have
+#       positive effect on upcoming Bulldozer, which has one less ALU.
+#       For reference, Intel code runs at 6.8 cpb rate on Opteron.
+# (**)  Note that Core2 result is ~15% lower than corresponding result
+#       for 32-bit code, meaning that it's possible to improve it,
+#       but more than likely at the cost of the others (see rc4-586.pl
+#       to get the idea)...
+
 $flavour = shift;
 $output  = shift;
 if ($flavour =~ /\./) { $output = $flavour; undef $flavour; }
@@ -76,13 +119,10 @@ $len="%rsi";	    # arg2
 $inp="%rdx";        # arg3
 $out="%rcx";        # arg4
 
-@XX=("%r8","%r10");
-@TX=("%r9","%r11");
-$YY="%r12";
-$TY="%r13";
-
+{
 $code=<<___;
 .text
+.extern OPENSSL_ia32cap_P
 
 .globl  RC4
 .type   RC4,\@function,4
@@ -95,48 +135,173 @@ RC4:	or	$len,$len
         push    %r12
         push    %r13
 .Lprologue:
+        mov     $len,%r11
+        mov     $inp,%r12
+        mov     $out,%r13
+___
+my $len="%r11";         # reassign input arguments
+my $inp="%r12";
+my $out="%r13";
 
-        add     \$8,$dat
-        movl    -8($dat),$XX[0]#d
-        movl    -4($dat),$YY#d
+my @XX=("%r10","%rsi");
+my @TX=("%rax","%rbx");
+my $YY="%rcx";
+my $TY="%rdx";
+
+$code.=<<___;
+        xor     $XX[0],$XX[0]
+        xor     $YY,$YY
+
+        lea     8($dat),$dat
+        mov     -8($dat),$XX[0]#b
+        mov     -4($dat),$YY#b
         cmpl    \$-1,256($dat)
         je      .LRC4_CHAR
+        mov     OPENSSL_ia32cap_P(%rip),%r8d
+        xor     $TX[1],$TX[1]
         inc     $XX[0]#b
+        sub     $XX[0],$TX[1]
+        sub     $inp,$out
         movl    ($dat,$XX[0],4),$TX[0]#d
-        test    \$-8,$len
+        test    \$-16,$len
         jz      .Lloop1
-        jmp     .Lloop8
+        bt      \$30,%r8d       # Intel CPU?
+        jc      .Lintel
+        and     \$7,$TX[1]
+        lea     1($XX[0]),$XX[1]
+        jz      .Loop8
+        sub     $TX[1],$len
+.Loop8_warmup:
+        add     $TX[0]#b,$YY#b
+        movl    ($dat,$YY,4),$TY#d
+        movl    $TX[0]#d,($dat,$YY,4)
+        movl    $TY#d,($dat,$XX[0],4)
+        add     $TY#b,$TX[0]#b
+        inc     $XX[0]#b
+        movl    ($dat,$TX[0],4),$TY#d
+        movl    ($dat,$XX[0],4),$TX[0]#d
+        xorb    ($inp),$TY#b
+        movb    $TY#b,($out,$inp)
+        lea     1($inp),$inp
+        dec     $TX[1]
+        jnz     .Loop8_warmup
+
+        lea     1($XX[0]),$XX[1]
+        jmp     .Loop8
 .align  16
-.Lloop8:
+.Loop8:
 ___
 for ($i=0;$i<8;$i++) {
+$code.=<<___ if ($i==7);
+        add     \$8,$XX[1]#b
+___
 $code.=<<___;
         add     $TX[0]#b,$YY#b
-        mov     $XX[0],$XX[1]
         movl    ($dat,$YY,4),$TY#d
-        ror     \$8,%rax                        # ror is redundant when $i=0
-        inc     $XX[1]#b
-        movl    ($dat,$XX[1],4),$TX[1]#d
-        cmp     $XX[1],$YY
         movl    $TX[0]#d,($dat,$YY,4)
-        cmove   $TX[0],$TX[1]
-        movl    $TY#d,($dat,$XX[0],4)
+        movl    `4*($i==7?-1:$i)`($dat,$XX[1],4),$TX[1]#d
+        ror     \$8,%r8                         # ror is redundant when $i=0
+        movl    $TY#d,4*$i($dat,$XX[0],4)
         add     $TX[0]#b,$TY#b
-        movb    ($dat,$TY,4),%al
+        movb    ($dat,$TY,4),%r8b
 ___
-push(@TX,shift(@TX)); push(@XX,shift(@XX));     # "rotate" registers
+push(@TX,shift(@TX)); #push(@XX,shift(@XX));    # "rotate" registers
 }
 $code.=<<___;
-        ror     \$8,%rax
+        add     \$8,$XX[0]#b
+        ror     \$8,%r8
         sub     \$8,$len
 
-        xor     ($inp),%rax
-        add     \$8,$inp
-        mov     %rax,($out)
-        add     \$8,$out
+        xor     ($inp),%r8
+        mov     %r8,($out,$inp)
+        lea     8($inp),$inp
 
         test    \$-8,$len
-        jnz     .Lloop8
+        jnz     .Loop8
+        cmp     \$0,$len
+        jne     .Lloop1
+        jmp     .Lexit
+
+.align  16
+.Lintel:
+        test    \$-32,$len
+        jz      .Lloop1
+        and     \$15,$TX[1]
+        jz      .Loop16_is_hot
+        sub     $TX[1],$len
+.Loop16_warmup:
+        add     $TX[0]#b,$YY#b
+        movl    ($dat,$YY,4),$TY#d
+        movl    $TX[0]#d,($dat,$YY,4)
+        movl    $TY#d,($dat,$XX[0],4)
+        add     $TY#b,$TX[0]#b
+        inc     $XX[0]#b
+        movl    ($dat,$TX[0],4),$TY#d
+        movl    ($dat,$XX[0],4),$TX[0]#d
+        xorb    ($inp),$TY#b
+        movb    $TY#b,($out,$inp)
+        lea     1($inp),$inp
+        dec     $TX[1]
+        jnz     .Loop16_warmup
+
+        mov     $YY,$TX[1]
+        xor     $YY,$YY
+        mov     $TX[1]#b,$YY#b
+
+.Loop16_is_hot:
+        lea     ($dat,$XX[0],4),$XX[1]
+___
+sub RC4_loop {
+  my $i=shift;
+  my $j=$i<0?0:$i;
+  my $xmm="%xmm".($j&1);
+
+    $code.="    add     \$16,$XX[0]#b\n"                if ($i==15);
+    $code.="    movdqu  ($inp),%xmm2\n"                 if ($i==15);
+    $code.="    add     $TX[0]#b,$YY#b\n"               if ($i<=0);
+    $code.="    movl    ($dat,$YY,4),$TY#d\n";
+    $code.="    pxor    %xmm0,%xmm2\n"                  if ($i==0);
+    $code.="    psllq   \$8,%xmm1\n"                    if ($i==0);
+    $code.="    pxor    $xmm,$xmm\n"                    if ($i<=1);
+    $code.="    movl    $TX[0]#d,($dat,$YY,4)\n";
+    $code.="    add     $TY#b,$TX[0]#b\n";
+    $code.="    movl    `4*($j+1)`($XX[1]),$TX[1]#d\n"  if ($i<15);
+    $code.="    movz    $TX[0]#b,$TX[0]#d\n";
+    $code.="    movl    $TY#d,4*$j($XX[1])\n";
+    $code.="    pxor    %xmm1,%xmm2\n"                  if ($i==0);
+    $code.="    lea     ($dat,$XX[0],4),$XX[1]\n"       if ($i==15);
+    $code.="    add     $TX[1]#b,$YY#b\n"               if ($i<15);
+    $code.="    pinsrw  \$`($j>>1)&7`,($dat,$TX[0],4),$xmm\n";
+    $code.="    movdqu  %xmm2,($out,$inp)\n"            if ($i==0);
+    $code.="    lea     16($inp),$inp\n"                if ($i==0);
+    $code.="    movl    ($XX[1]),$TX[1]#d\n"            if ($i==15);
+}
+        RC4_loop(-1);
+$code.=<<___;
+        jmp     .Loop16_enter
+.align  16
+.Loop16:
+___
+
+for ($i=0;$i<16;$i++) {
+    $code.=".Loop16_enter:\n"           if ($i==1);
+        RC4_loop($i);
+        push(@TX,shift(@TX));           # "rotate" registers
+}
+$code.=<<___;
+        mov     $YY,$TX[1]
+        xor     $YY,$YY                 # keyword to partial register
+        sub     \$16,$len
+        mov     $TX[1]#b,$YY#b
+        test    \$-16,$len
+        jnz     .Loop16
+
+        psllq   \$8,%xmm1
+        pxor    %xmm0,%xmm2
+        pxor    %xmm1,%xmm2
+        movdqu  %xmm2,($out,$inp)
+        lea     16($inp),$inp
+
         cmp     \$0,$len
         jne     .Lloop1
         jmp     .Lexit
@@ -152,9 +317,8 @@ $code.=<<___;
         movl    ($dat,$TX[0],4),$TY#d
         movl    ($dat,$XX[0],4),$TX[0]#d
         xorb    ($inp),$TY#b
-        inc     $inp
-        movb    $TY#b,($out)
-        inc     $out
+        movb    $TY#b,($out,$inp)
+        lea     1($inp),$inp
         dec     $len
         jnz     .Lloop1
         jmp     .Lexit
@@ -165,13 +329,11 @@ $code.=<<___;
         movzb   ($dat,$XX[0]),$TX[0]#d
         test    \$-8,$len
         jz      .Lcloop1
-        cmpl    \$0,260($dat)
-        jnz     .Lcloop1
         jmp     .Lcloop8
 .align  16
 .Lcloop8:
-        mov     ($inp),%eax
-        mov     4($inp),%ebx
+        mov     ($inp),%r8d
+        mov     4($inp),%r9d
 ___
 # unroll 2x4-wise, because 64-bit rotates kill Intel P4...
 for ($i=0;$i<4;$i++) {
@@ -188,8 +350,8 @@ $code.=<<___;
         mov     $TX[0],$TX[1]
 .Lcmov$i:
         add     $TX[0]#b,$TY#b
-        xor     ($dat,$TY),%al
-        ror     \$8,%eax
+        xor     ($dat,$TY),%r8b
+        ror     \$8,%r8d
 ___
 push(@TX,shift(@TX)); push(@XX,shift(@XX));     # "rotate" registers
 }
@@ -207,16 +369,16 @@ $code.=<<___;
         mov     $TX[0],$TX[1]
 .Lcmov$i:
         add     $TX[0]#b,$TY#b
-        xor     ($dat,$TY),%bl
-        ror     \$8,%ebx
+        xor     ($dat,$TY),%r9b
+        ror     \$8,%r9d
 ___
 push(@TX,shift(@TX)); push(@XX,shift(@XX));     # "rotate" registers
 }
 $code.=<<___;
         lea     -8($len),$len
-        mov     %eax,($out)
+        mov     %r8d,($out)
         lea     8($inp),$inp
-        mov     %ebx,4($out)
+        mov     %r9d,4($out)
         lea     8($out),$out
 
         test    \$-8,$len
@@ -229,6 +391,7 @@ $code.=<<___;
 .align  16
 .Lcloop1:
         add     $TX[0]#b,$YY#b
+        movzb   $YY#b,$YY#d
         movzb   ($dat,$YY),$TY#d
         movb    $TX[0]#b,($dat,$YY)
         movb    $TY#b,($dat,$XX[0])
@@ -260,16 +423,16 @@ $code.=<<___;
         ret
 .size   RC4,.-RC4
 ___
+}
 
 $idx="%r8";
 $ido="%r9";
 
 $code.=<<___;
-.extern OPENSSL_ia32cap_P
-.globl  RC4_set_key
-.type   RC4_set_key,\@function,3
+.globl  private_RC4_set_key
+.type   private_RC4_set_key,\@function,3
 .align  16
-RC4_set_key:
+private_RC4_set_key:
         lea     8($dat),$dat
         lea     ($inp,$len),$inp
         neg     $len
@@ -280,12 +443,9 @@ RC4_set_key:
         xor     %r11,%r11
 
         mov     PIC_GOT(OPENSSL_ia32cap_P),$idx#d
-        bt      \$20,$idx#d
-        jnc     .Lw1stloop
-        bt      \$30,$idx#d
-        setc    $ido#b
-        mov     $ido#d,260($dat)
-        jmp     .Lc1stloop
+        bt      \$20,$idx#d     # RC4_CHAR?
+        jc      .Lc1stloop
+        jmp     .Lw1stloop
 
 .align  16
 .Lw1stloop:
@@ -339,7 +499,7 @@ RC4_set_key:
         mov     %eax,-8($dat)
         mov     %eax,-4($dat)
         ret
-.size   RC4_set_key,.-RC4_set_key
+.size   private_RC4_set_key,.-private_RC4_set_key
 
 .globl  RC4_options
 .type   RC4_options,\@abi-omnipotent
@@ -348,18 +508,20 @@ RC4_options:
         lea     .Lopts(%rip),%rax
         mov     PIC_GOT(OPENSSL_ia32cap_P),%edx
         bt      \$20,%edx
-        jnc     .Ldone
-        add     \$12,%rax
+        jc      .L8xchar
         bt      \$30,%edx
         jnc     .Ldone
-        add     \$13,%rax
+        add     \$25,%rax
+        ret
+.L8xchar:
+        add     \$12,%rax
 .Ldone:
         ret
 .align  64
 .Lopts:
 .asciz  "rc4(8x,int)"
 .asciz  "rc4(8x,char)"
-.asciz  "rc4(1x,char)"
+.asciz  "rc4(16x,int)"
 .asciz  "RC4 for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
 .align  64
 .size   RC4_options,.-RC4_options
@@ -482,22 +644,32 @@ key_se_handler:
         .rva    .LSEH_end_RC4
         .rva    .LSEH_info_RC4
 
-        .rva    .LSEH_begin_RC4_set_key
-        .rva    .LSEH_end_RC4_set_key
-        .rva    .LSEH_info_RC4_set_key
+        .rva    .LSEH_begin_private_RC4_set_key
+        .rva    .LSEH_end_private_RC4_set_key
+        .rva    .LSEH_info_private_RC4_set_key
 
 .section        .xdata
 .align  8
 .LSEH_info_RC4:
         .byte   9,0,0,0
         .rva    stream_se_handler
-.LSEH_info_RC4_set_key:
+.LSEH_info_private_RC4_set_key:
         .byte   9,0,0,0
         .rva    key_se_handler
 ___
 }
 
-$code =~ s/#([bwd])/$1/gm;
+sub reg_part {
+my ($reg,$conv)=@_;
+    if ($reg =~ /%r[0-9]+/)     { $reg .= $conv; }
+    elsif ($conv eq "b")        { $reg =~ s/%[er]([^x]+)x?/%$1l/;       }
+    elsif ($conv eq "w")        { $reg =~ s/%[er](.+)/%$1/;             }
+    elsif ($conv eq "d")        { $reg =~ s/%[er](.+)/%e$1/;            }
+    return $reg;
+}
+
+$code =~ s/(%[a-z0-9]+)#([bwd])/reg_part($1,$2)/gem;
+$code =~ s/\`([^\`]*)\`/eval $1/gem;
 
 print $code;
 
diff --git a/src/lib/libcrypto/rc4/rc4.h b/src/lib/libcrypto/rc4/rc4.h
index 29d1acccf5..88ceb46bc5 100644
--- a/src/lib/libcrypto/rc4/rc4.h
+++ b/src/lib/libcrypto/rc4/rc4.h
@@ -79,6 +79,7 @@ typedef struct rc4_key_st
  
 const char *RC4_options(void);
 void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data);
+void private_RC4_set_key(RC4_KEY *key, int len, const unsigned char *data);
 void RC4(RC4_KEY *key, size_t len, const unsigned char *indata,
                 unsigned char *outdata);
 
diff --git a/src/lib/libcrypto/rc4/rc4_skey.c b/src/lib/libcrypto/rc4/rc4_skey.c
index b22c40b0bd..fda27636e7 100644
--- a/src/lib/libcrypto/rc4/rc4_skey.c
+++ b/src/lib/libcrypto/rc4/rc4_skey.c
@@ -85,7 +85,7 @@ const char *RC4_options(void)
  * Date: Wed, 14 Sep 1994 06:35:31 GMT
  */
 
-void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data)
+void private_RC4_set_key(RC4_KEY *key, int len, const unsigned char *data)
         {
         register RC4_INT tmp;
         register int id1,id2;
@@ -104,40 +104,6 @@ void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data)
                 d[(n)]=d[id2]; \
                 d[id2]=tmp; }
 
-#if defined(OPENSSL_CPUID_OBJ) && !defined(OPENSSL_NO_ASM)
-# if    defined(__i386)   || defined(__i386__)   || defined(_M_IX86) || \
-        defined(__INTEL__) || \
-        defined(__x86_64) || defined(__x86_64__) || defined(_M_AMD64)
-        if (sizeof(RC4_INT) > 1) {
-                /*
-                 * Unlike all other x86 [and x86_64] implementations,
-                 * Intel P4 core [including EM64T] was found to perform
-                 * poorly with wider RC4_INT. Performance improvement
-                 * for IA-32 hand-coded assembler turned out to be 2.8x
-                 * if re-coded for RC4_CHAR! It's however inappropriate
-                 * to just switch to RC4_CHAR for x86[_64], as non-P4
-                 * implementations suffer from significant performance
-                 * losses then, e.g. PIII exhibits >2x deterioration,
-                 * and so does Opteron. In order to assure optimal
-                 * all-round performance, let us [try to] detect P4 at
-                 * run-time by checking upon HTT bit in CPU capability
-                 * vector and set up compressed key schedule, which is
-                 * recognized by correspondingly updated assembler
-                 * module...
-                 *                              <appro@fy.chalmers.se>
-                 */
-                if (OPENSSL_ia32cap_P & (1<<28)) {
-                        unsigned char *cp=(unsigned char *)d;
-
-                        for (i=0;i<256;i++) cp[i]=i;
-                        for (i=0;i<256;i++) SK_LOOP(cp,i);
-                        /* mark schedule as compressed! */
-                        d[256/sizeof(RC4_INT)]=-1;
-                        return;
-                }
-        }
-# endif
-#endif
         for (i=0; i < 256; i++) d[i]=i;
         for (i=0; i < 256; i+=4)
                 {
diff --git a/src/lib/libcrypto/ripemd/ripemd.h b/src/lib/libcrypto/ripemd/ripemd.h
index 5942eb6180..189bd8c90e 100644
--- a/src/lib/libcrypto/ripemd/ripemd.h
+++ b/src/lib/libcrypto/ripemd/ripemd.h
@@ -91,6 +91,9 @@ typedef struct RIPEMD160state_st
         unsigned int   num;
         } RIPEMD160_CTX;
 
+#ifdef OPENSSL_FIPS
+int private_RIPEMD160_Init(RIPEMD160_CTX *c);
+#endif
 int RIPEMD160_Init(RIPEMD160_CTX *c);
 int RIPEMD160_Update(RIPEMD160_CTX *c, const void *data, size_t len);
 int RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c);
diff --git a/src/lib/libcrypto/ripemd/rmd_dgst.c b/src/lib/libcrypto/ripemd/rmd_dgst.c
index 2097a66c03..9ff1a0705e 100644
--- a/src/lib/libcrypto/ripemd/rmd_dgst.c
+++ b/src/lib/libcrypto/ripemd/rmd_dgst.c
@@ -59,6 +59,7 @@
 #include <stdio.h>
 #include "rmd_locl.h"
 #include <openssl/opensslv.h>
+#include <openssl/crypto.h>
 
 const char RMD160_version[]="RIPE-MD160" OPENSSL_VERSION_PTEXT;
 
@@ -69,7 +70,7 @@ const char RMD160_version[]="RIPE-MD160" OPENSSL_VERSION_PTEXT;
      void ripemd160_block(RIPEMD160_CTX *c, unsigned long *p,size_t num);
 #  endif
 
-int RIPEMD160_Init(RIPEMD160_CTX *c)
+fips_md_init(RIPEMD160)
         {
         memset (c,0,sizeof(*c));
         c->A=RIPEMD160_A;
diff --git a/src/lib/libcrypto/rsa/Makefile b/src/lib/libcrypto/rsa/Makefile
index bb64223e05..f798d2f749 100644
--- a/src/lib/libcrypto/rsa/Makefile
+++ b/src/lib/libcrypto/rsa/Makefile
@@ -20,11 +20,11 @@ LIB=$(TOP)/libcrypto.a
 LIBSRC= rsa_eay.c rsa_gen.c rsa_lib.c rsa_sign.c rsa_saos.c rsa_err.c \
         rsa_pk1.c rsa_ssl.c rsa_none.c rsa_oaep.c rsa_chk.c rsa_null.c \
         rsa_pss.c rsa_x931.c rsa_asn1.c rsa_depr.c rsa_ameth.c rsa_prn.c \
-        rsa_pmeth.c
+        rsa_pmeth.c rsa_crpt.c
 LIBOBJ= rsa_eay.o rsa_gen.o rsa_lib.o rsa_sign.o rsa_saos.o rsa_err.o \
         rsa_pk1.o rsa_ssl.o rsa_none.o rsa_oaep.o rsa_chk.o rsa_null.o \
         rsa_pss.o rsa_x931.o rsa_asn1.o rsa_depr.o rsa_ameth.o rsa_prn.o \
-        rsa_pmeth.o
+        rsa_pmeth.o rsa_crpt.o
 
 SRC= $(LIBSRC)
 
@@ -100,11 +100,16 @@ rsa_asn1.o: ../../e_os.h ../../include/openssl/asn1.h
 rsa_asn1.o: ../../include/openssl/asn1t.h ../../include/openssl/bio.h
 rsa_asn1.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 rsa_asn1.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
-rsa_asn1.o: ../../include/openssl/err.h ../../include/openssl/lhash.h
+rsa_asn1.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
+rsa_asn1.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
+rsa_asn1.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
+rsa_asn1.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
 rsa_asn1.o: ../../include/openssl/opensslconf.h
 rsa_asn1.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
-rsa_asn1.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_asn1.o: ../../include/openssl/pkcs7.h ../../include/openssl/rsa.h
+rsa_asn1.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 rsa_asn1.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+rsa_asn1.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 rsa_asn1.o: ../cryptlib.h rsa_asn1.c
 rsa_chk.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 rsa_chk.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
@@ -114,6 +119,21 @@ rsa_chk.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
 rsa_chk.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 rsa_chk.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
 rsa_chk.o: rsa_chk.c
+rsa_crpt.o: ../../e_os.h ../../include/openssl/asn1.h
+rsa_crpt.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
+rsa_crpt.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
+rsa_crpt.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+rsa_crpt.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
+rsa_crpt.o: ../../include/openssl/engine.h ../../include/openssl/err.h
+rsa_crpt.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
+rsa_crpt.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+rsa_crpt.o: ../../include/openssl/opensslconf.h
+rsa_crpt.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+rsa_crpt.o: ../../include/openssl/pkcs7.h ../../include/openssl/rand.h
+rsa_crpt.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+rsa_crpt.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+rsa_crpt.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
+rsa_crpt.o: ../../include/openssl/x509_vfy.h ../cryptlib.h rsa_crpt.c
 rsa_depr.o: ../../e_os.h ../../include/openssl/asn1.h
 rsa_depr.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 rsa_depr.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
@@ -205,11 +225,12 @@ rsa_pk1.o: ../../include/openssl/symhacks.h ../cryptlib.h rsa_pk1.c
 rsa_pmeth.o: ../../e_os.h ../../include/openssl/asn1.h
 rsa_pmeth.o: ../../include/openssl/asn1t.h ../../include/openssl/bio.h
 rsa_pmeth.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
-rsa_pmeth.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
-rsa_pmeth.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
-rsa_pmeth.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
-rsa_pmeth.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
-rsa_pmeth.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+rsa_pmeth.o: ../../include/openssl/cms.h ../../include/openssl/crypto.h
+rsa_pmeth.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+rsa_pmeth.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
+rsa_pmeth.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+rsa_pmeth.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
+rsa_pmeth.o: ../../include/openssl/objects.h
 rsa_pmeth.o: ../../include/openssl/opensslconf.h
 rsa_pmeth.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
 rsa_pmeth.o: ../../include/openssl/pkcs7.h ../../include/openssl/rsa.h
diff --git a/src/lib/libcrypto/rsa/rsa.h b/src/lib/libcrypto/rsa/rsa.h
index cf74343657..4814a2fc15 100644
--- a/src/lib/libcrypto/rsa/rsa.h
+++ b/src/lib/libcrypto/rsa/rsa.h
@@ -222,12 +222,22 @@ struct rsa_st
         EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, EVP_PKEY_CTRL_RSA_PADDING, \
                                 pad, NULL)
 
+#define EVP_PKEY_CTX_get_rsa_padding(ctx, ppad) \
+        EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, \
+                                EVP_PKEY_CTRL_GET_RSA_PADDING, 0, ppad)
+
 #define EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, len) \
         EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, \
                                 (EVP_PKEY_OP_SIGN|EVP_PKEY_OP_VERIFY), \
                                 EVP_PKEY_CTRL_RSA_PSS_SALTLEN, \
                                 len, NULL)
 
+#define EVP_PKEY_CTX_get_rsa_pss_saltlen(ctx, plen) \
+        EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, \
+                                (EVP_PKEY_OP_SIGN|EVP_PKEY_OP_VERIFY), \
+                                EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN, \
+                                0, plen)
+
 #define EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, bits) \
         EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_KEYGEN, \
                                 EVP_PKEY_CTRL_RSA_KEYGEN_BITS, bits, NULL)
@@ -236,11 +246,24 @@ struct rsa_st
         EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_KEYGEN, \
                                 EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP, 0, pubexp)
 
+#define  EVP_PKEY_CTX_set_rsa_mgf1_md(ctx, md)  \
+                EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_SIG,  \
+                                EVP_PKEY_CTRL_RSA_MGF1_MD, 0, (void *)md)
+
+#define  EVP_PKEY_CTX_get_rsa_mgf1_md(ctx, pmd) \
+                EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_SIG,  \
+                                EVP_PKEY_CTRL_GET_RSA_MGF1_MD, 0, (void *)pmd)
+
 #define EVP_PKEY_CTRL_RSA_PADDING       (EVP_PKEY_ALG_CTRL + 1)
 #define EVP_PKEY_CTRL_RSA_PSS_SALTLEN   (EVP_PKEY_ALG_CTRL + 2)
 
 #define EVP_PKEY_CTRL_RSA_KEYGEN_BITS   (EVP_PKEY_ALG_CTRL + 3)
 #define EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP (EVP_PKEY_ALG_CTRL + 4)
+#define EVP_PKEY_CTRL_RSA_MGF1_MD       (EVP_PKEY_ALG_CTRL + 5)
+
+#define EVP_PKEY_CTRL_GET_RSA_PADDING           (EVP_PKEY_ALG_CTRL + 6)
+#define EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN       (EVP_PKEY_ALG_CTRL + 7)
+#define EVP_PKEY_CTRL_GET_RSA_MGF1_MD           (EVP_PKEY_ALG_CTRL + 8)
 
 #define RSA_PKCS1_PADDING       1
 #define RSA_SSLV23_PADDING      2
@@ -300,6 +323,16 @@ const RSA_METHOD *RSA_null_method(void);
 DECLARE_ASN1_ENCODE_FUNCTIONS_const(RSA, RSAPublicKey)
 DECLARE_ASN1_ENCODE_FUNCTIONS_const(RSA, RSAPrivateKey)
 
+typedef struct rsa_pss_params_st
+        {
+        X509_ALGOR *hashAlgorithm;
+        X509_ALGOR *maskGenAlgorithm;
+        ASN1_INTEGER *saltLength;
+        ASN1_INTEGER *trailerField;
+        } RSA_PSS_PARAMS;
+
+DECLARE_ASN1_FUNCTIONS(RSA_PSS_PARAMS)
+
 #ifndef OPENSSL_NO_FP_API
 int     RSA_print_fp(FILE *fp, const RSA *r,int offset);
 #endif
@@ -380,6 +413,14 @@ int RSA_padding_add_PKCS1_PSS(RSA *rsa, unsigned char *EM,
                         const unsigned char *mHash,
                         const EVP_MD *Hash, int sLen);
 
+int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash,
+                        const EVP_MD *Hash, const EVP_MD *mgf1Hash, 
+                        const unsigned char *EM, int sLen);
+
+int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM,
+                        const unsigned char *mHash,
+                        const EVP_MD *Hash, const EVP_MD *mgf1Hash, int sLen);
+
 int RSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
         CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 int RSA_set_ex_data(RSA *r,int idx,void *arg);
@@ -388,6 +429,25 @@ void *RSA_get_ex_data(const RSA *r, int idx);
 RSA *RSAPublicKey_dup(RSA *rsa);
 RSA *RSAPrivateKey_dup(RSA *rsa);
 
+/* If this flag is set the RSA method is FIPS compliant and can be used
+ * in FIPS mode. This is set in the validated module method. If an
+ * application sets this flag in its own methods it is its responsibility
+ * to ensure the result is compliant.
+ */
+
+#define RSA_FLAG_FIPS_METHOD                    0x0400
+
+/* If this flag is set the operations normally disabled in FIPS mode are
+ * permitted it is then the applications responsibility to ensure that the
+ * usage is compliant.
+ */
+
+#define RSA_FLAG_NON_FIPS_ALLOW                 0x0400
+/* Application has decided PRNG is good enough to generate a key: don't
+ * check.
+ */
+#define RSA_FLAG_CHECKED                        0x0800
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -405,6 +465,7 @@ void ERR_load_RSA_strings(void);
 #define RSA_F_PKEY_RSA_CTRL                              143
 #define RSA_F_PKEY_RSA_CTRL_STR                          144
 #define RSA_F_PKEY_RSA_SIGN                              142
+#define RSA_F_PKEY_RSA_VERIFY                            154
 #define RSA_F_PKEY_RSA_VERIFYRECOVER                     141
 #define RSA_F_RSA_BUILTIN_KEYGEN                         129
 #define RSA_F_RSA_CHECK_KEY                              123
@@ -413,6 +474,8 @@ void ERR_load_RSA_strings(void);
 #define RSA_F_RSA_EAY_PUBLIC_DECRYPT                     103
 #define RSA_F_RSA_EAY_PUBLIC_ENCRYPT                     104
 #define RSA_F_RSA_GENERATE_KEY                           105
+#define RSA_F_RSA_GENERATE_KEY_EX                        155
+#define RSA_F_RSA_ITEM_VERIFY                            156
 #define RSA_F_RSA_MEMORY_LOCK                            130
 #define RSA_F_RSA_NEW_METHOD                             106
 #define RSA_F_RSA_NULL                                   124
@@ -424,6 +487,7 @@ void ERR_load_RSA_strings(void);
 #define RSA_F_RSA_PADDING_ADD_NONE                       107
 #define RSA_F_RSA_PADDING_ADD_PKCS1_OAEP                 121
 #define RSA_F_RSA_PADDING_ADD_PKCS1_PSS                  125
+#define RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1             148
 #define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1               108
 #define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2               109
 #define RSA_F_RSA_PADDING_ADD_SSLV23                     110
@@ -436,8 +500,12 @@ void ERR_load_RSA_strings(void);
 #define RSA_F_RSA_PADDING_CHECK_X931                     128
 #define RSA_F_RSA_PRINT                                  115
 #define RSA_F_RSA_PRINT_FP                               116
+#define RSA_F_RSA_PRIVATE_DECRYPT                        150
+#define RSA_F_RSA_PRIVATE_ENCRYPT                        151
 #define RSA_F_RSA_PRIV_DECODE                            137
 #define RSA_F_RSA_PRIV_ENCODE                            138
+#define RSA_F_RSA_PUBLIC_DECRYPT                         152
+#define RSA_F_RSA_PUBLIC_ENCRYPT                         153
 #define RSA_F_RSA_PUB_DECODE                             139
 #define RSA_F_RSA_SETUP_BLINDING                         136
 #define RSA_F_RSA_SIGN                                   117
@@ -445,6 +513,7 @@ void ERR_load_RSA_strings(void);
 #define RSA_F_RSA_VERIFY                                 119
 #define RSA_F_RSA_VERIFY_ASN1_OCTET_STRING               120
 #define RSA_F_RSA_VERIFY_PKCS1_PSS                       126
+#define RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1                  149
 
 /* Reason codes. */
 #define RSA_R_ALGORITHM_MISMATCH                         100
@@ -470,19 +539,24 @@ void ERR_load_RSA_strings(void);
 #define RSA_R_INVALID_HEADER                             137
 #define RSA_R_INVALID_KEYBITS                            145
 #define RSA_R_INVALID_MESSAGE_LENGTH                     131
+#define RSA_R_INVALID_MGF1_MD                            156
 #define RSA_R_INVALID_PADDING                            138
 #define RSA_R_INVALID_PADDING_MODE                       141
+#define RSA_R_INVALID_PSS_PARAMETERS                     149
 #define RSA_R_INVALID_PSS_SALTLEN                        146
+#define RSA_R_INVALID_SALT_LENGTH                        150
 #define RSA_R_INVALID_TRAILER                            139
 #define RSA_R_INVALID_X931_DIGEST                        142
 #define RSA_R_IQMP_NOT_INVERSE_OF_Q                      126
 #define RSA_R_KEY_SIZE_TOO_SMALL                         120
 #define RSA_R_LAST_OCTET_INVALID                         134
 #define RSA_R_MODULUS_TOO_LARGE                          105
+#define RSA_R_NON_FIPS_RSA_METHOD                        157
 #define RSA_R_NO_PUBLIC_EXPONENT                         140
 #define RSA_R_NULL_BEFORE_BLOCK_MISSING                  113
 #define RSA_R_N_DOES_NOT_EQUAL_P_Q                       127
 #define RSA_R_OAEP_DECODING_ERROR                        121
+#define RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE         158
 #define RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE   148
 #define RSA_R_PADDING_CHECK_FAILED                       114
 #define RSA_R_P_NOT_PRIME                                128
@@ -493,7 +567,12 @@ void ERR_load_RSA_strings(void);
 #define RSA_R_SSLV3_ROLLBACK_ATTACK                      115
 #define RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 116
 #define RSA_R_UNKNOWN_ALGORITHM_TYPE                     117
+#define RSA_R_UNKNOWN_MASK_DIGEST                        151
 #define RSA_R_UNKNOWN_PADDING_TYPE                       118
+#define RSA_R_UNKNOWN_PSS_DIGEST                         152
+#define RSA_R_UNSUPPORTED_MASK_ALGORITHM                 153
+#define RSA_R_UNSUPPORTED_MASK_PARAMETER                 154
+#define RSA_R_UNSUPPORTED_SIGNATURE_TYPE                 155
 #define RSA_R_VALUE_MISSING                              147
 #define RSA_R_WRONG_SIGNATURE_LENGTH                     119
 
diff --git a/src/lib/libcrypto/rsa/rsa_asn1.c b/src/lib/libcrypto/rsa/rsa_asn1.c
index 4efca8cdc8..6ed5de3db4 100644
--- a/src/lib/libcrypto/rsa/rsa_asn1.c
+++ b/src/lib/libcrypto/rsa/rsa_asn1.c
@@ -60,6 +60,7 @@
 #include "cryptlib.h"
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
+#include <openssl/x509.h>
 #include <openssl/asn1t.h>
 
 /* Override the default free and new methods */
@@ -96,6 +97,15 @@ ASN1_SEQUENCE_cb(RSAPublicKey, rsa_cb) = {
         ASN1_SIMPLE(RSA, e, BIGNUM),
 } ASN1_SEQUENCE_END_cb(RSA, RSAPublicKey)
 
+ASN1_SEQUENCE(RSA_PSS_PARAMS) = {
+        ASN1_EXP_OPT(RSA_PSS_PARAMS, hashAlgorithm, X509_ALGOR,0),
+        ASN1_EXP_OPT(RSA_PSS_PARAMS, maskGenAlgorithm, X509_ALGOR,1),
+        ASN1_EXP_OPT(RSA_PSS_PARAMS, saltLength, ASN1_INTEGER,2),
+        ASN1_EXP_OPT(RSA_PSS_PARAMS, trailerField, ASN1_INTEGER,3)
+} ASN1_SEQUENCE_END(RSA_PSS_PARAMS)
+
+IMPLEMENT_ASN1_FUNCTIONS(RSA_PSS_PARAMS)
+
 IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(RSA, RSAPrivateKey, RSAPrivateKey)
 
 IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(RSA, RSAPublicKey, RSAPublicKey)
diff --git a/src/lib/libcrypto/rsa/rsa_err.c b/src/lib/libcrypto/rsa/rsa_err.c
index cf9f1106b0..46e0bf9980 100644
--- a/src/lib/libcrypto/rsa/rsa_err.c
+++ b/src/lib/libcrypto/rsa/rsa_err.c
@@ -1,6 +1,6 @@
 /* crypto/rsa/rsa_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2008 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -78,6 +78,7 @@ static ERR_STRING_DATA RSA_str_functs[]=
 {ERR_FUNC(RSA_F_PKEY_RSA_CTRL), "PKEY_RSA_CTRL"},
 {ERR_FUNC(RSA_F_PKEY_RSA_CTRL_STR),     "PKEY_RSA_CTRL_STR"},
 {ERR_FUNC(RSA_F_PKEY_RSA_SIGN), "PKEY_RSA_SIGN"},
+{ERR_FUNC(RSA_F_PKEY_RSA_VERIFY),       "PKEY_RSA_VERIFY"},
 {ERR_FUNC(RSA_F_PKEY_RSA_VERIFYRECOVER),        "PKEY_RSA_VERIFYRECOVER"},
 {ERR_FUNC(RSA_F_RSA_BUILTIN_KEYGEN),    "RSA_BUILTIN_KEYGEN"},
 {ERR_FUNC(RSA_F_RSA_CHECK_KEY), "RSA_check_key"},
@@ -86,6 +87,8 @@ static ERR_STRING_DATA RSA_str_functs[]=
 {ERR_FUNC(RSA_F_RSA_EAY_PUBLIC_DECRYPT),        "RSA_EAY_PUBLIC_DECRYPT"},
 {ERR_FUNC(RSA_F_RSA_EAY_PUBLIC_ENCRYPT),        "RSA_EAY_PUBLIC_ENCRYPT"},
 {ERR_FUNC(RSA_F_RSA_GENERATE_KEY),      "RSA_generate_key"},
+{ERR_FUNC(RSA_F_RSA_GENERATE_KEY_EX),   "RSA_generate_key_ex"},
+{ERR_FUNC(RSA_F_RSA_ITEM_VERIFY),       "RSA_ITEM_VERIFY"},
 {ERR_FUNC(RSA_F_RSA_MEMORY_LOCK),       "RSA_memory_lock"},
 {ERR_FUNC(RSA_F_RSA_NEW_METHOD),        "RSA_new_method"},
 {ERR_FUNC(RSA_F_RSA_NULL),      "RSA_NULL"},
@@ -97,6 +100,7 @@ static ERR_STRING_DATA RSA_str_functs[]=
 {ERR_FUNC(RSA_F_RSA_PADDING_ADD_NONE),  "RSA_padding_add_none"},
 {ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP),    "RSA_padding_add_PKCS1_OAEP"},
 {ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_PSS),     "RSA_padding_add_PKCS1_PSS"},
+{ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1),        "RSA_padding_add_PKCS1_PSS_mgf1"},
 {ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1),  "RSA_padding_add_PKCS1_type_1"},
 {ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2),  "RSA_padding_add_PKCS1_type_2"},
 {ERR_FUNC(RSA_F_RSA_PADDING_ADD_SSLV23),        "RSA_padding_add_SSLv23"},
@@ -109,8 +113,12 @@ static ERR_STRING_DATA RSA_str_functs[]=
 {ERR_FUNC(RSA_F_RSA_PADDING_CHECK_X931),        "RSA_padding_check_X931"},
 {ERR_FUNC(RSA_F_RSA_PRINT),     "RSA_print"},
 {ERR_FUNC(RSA_F_RSA_PRINT_FP),  "RSA_print_fp"},
+{ERR_FUNC(RSA_F_RSA_PRIVATE_DECRYPT),   "RSA_private_decrypt"},
+{ERR_FUNC(RSA_F_RSA_PRIVATE_ENCRYPT),   "RSA_private_encrypt"},
 {ERR_FUNC(RSA_F_RSA_PRIV_DECODE),       "RSA_PRIV_DECODE"},
 {ERR_FUNC(RSA_F_RSA_PRIV_ENCODE),       "RSA_PRIV_ENCODE"},
+{ERR_FUNC(RSA_F_RSA_PUBLIC_DECRYPT),    "RSA_public_decrypt"},
+{ERR_FUNC(RSA_F_RSA_PUBLIC_ENCRYPT),    "RSA_public_encrypt"},
 {ERR_FUNC(RSA_F_RSA_PUB_DECODE),        "RSA_PUB_DECODE"},
 {ERR_FUNC(RSA_F_RSA_SETUP_BLINDING),    "RSA_setup_blinding"},
 {ERR_FUNC(RSA_F_RSA_SIGN),      "RSA_sign"},
@@ -118,6 +126,7 @@ static ERR_STRING_DATA RSA_str_functs[]=
 {ERR_FUNC(RSA_F_RSA_VERIFY),    "RSA_verify"},
 {ERR_FUNC(RSA_F_RSA_VERIFY_ASN1_OCTET_STRING),  "RSA_verify_ASN1_OCTET_STRING"},
 {ERR_FUNC(RSA_F_RSA_VERIFY_PKCS1_PSS),  "RSA_verify_PKCS1_PSS"},
+{ERR_FUNC(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1),     "RSA_verify_PKCS1_PSS_mgf1"},
 {0,NULL}
         };
 
@@ -146,19 +155,24 @@ static ERR_STRING_DATA RSA_str_reasons[]=
 {ERR_REASON(RSA_R_INVALID_HEADER)        ,"invalid header"},
 {ERR_REASON(RSA_R_INVALID_KEYBITS)       ,"invalid keybits"},
 {ERR_REASON(RSA_R_INVALID_MESSAGE_LENGTH),"invalid message length"},
+{ERR_REASON(RSA_R_INVALID_MGF1_MD)       ,"invalid mgf1 md"},
 {ERR_REASON(RSA_R_INVALID_PADDING)       ,"invalid padding"},
 {ERR_REASON(RSA_R_INVALID_PADDING_MODE)  ,"invalid padding mode"},
+{ERR_REASON(RSA_R_INVALID_PSS_PARAMETERS),"invalid pss parameters"},
 {ERR_REASON(RSA_R_INVALID_PSS_SALTLEN)   ,"invalid pss saltlen"},
+{ERR_REASON(RSA_R_INVALID_SALT_LENGTH)   ,"invalid salt length"},
 {ERR_REASON(RSA_R_INVALID_TRAILER)       ,"invalid trailer"},
 {ERR_REASON(RSA_R_INVALID_X931_DIGEST)   ,"invalid x931 digest"},
 {ERR_REASON(RSA_R_IQMP_NOT_INVERSE_OF_Q) ,"iqmp not inverse of q"},
 {ERR_REASON(RSA_R_KEY_SIZE_TOO_SMALL)    ,"key size too small"},
 {ERR_REASON(RSA_R_LAST_OCTET_INVALID)    ,"last octet invalid"},
 {ERR_REASON(RSA_R_MODULUS_TOO_LARGE)     ,"modulus too large"},
+{ERR_REASON(RSA_R_NON_FIPS_RSA_METHOD)   ,"non fips rsa method"},
 {ERR_REASON(RSA_R_NO_PUBLIC_EXPONENT)    ,"no public exponent"},
 {ERR_REASON(RSA_R_NULL_BEFORE_BLOCK_MISSING),"null before block missing"},
 {ERR_REASON(RSA_R_N_DOES_NOT_EQUAL_P_Q)  ,"n does not equal p q"},
 {ERR_REASON(RSA_R_OAEP_DECODING_ERROR)   ,"oaep decoding error"},
+{ERR_REASON(RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE),"operation not allowed in fips mode"},
 {ERR_REASON(RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE),"operation not supported for this keytype"},
 {ERR_REASON(RSA_R_PADDING_CHECK_FAILED)  ,"padding check failed"},
 {ERR_REASON(RSA_R_P_NOT_PRIME)           ,"p not prime"},
@@ -169,7 +183,12 @@ static ERR_STRING_DATA RSA_str_reasons[]=
 {ERR_REASON(RSA_R_SSLV3_ROLLBACK_ATTACK) ,"sslv3 rollback attack"},
 {ERR_REASON(RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD),"the asn1 object identifier is not known for this md"},
 {ERR_REASON(RSA_R_UNKNOWN_ALGORITHM_TYPE),"unknown algorithm type"},
+{ERR_REASON(RSA_R_UNKNOWN_MASK_DIGEST)   ,"unknown mask digest"},
 {ERR_REASON(RSA_R_UNKNOWN_PADDING_TYPE)  ,"unknown padding type"},
+{ERR_REASON(RSA_R_UNKNOWN_PSS_DIGEST)    ,"unknown pss digest"},
+{ERR_REASON(RSA_R_UNSUPPORTED_MASK_ALGORITHM),"unsupported mask algorithm"},
+{ERR_REASON(RSA_R_UNSUPPORTED_MASK_PARAMETER),"unsupported mask parameter"},
+{ERR_REASON(RSA_R_UNSUPPORTED_SIGNATURE_TYPE),"unsupported signature type"},
 {ERR_REASON(RSA_R_VALUE_MISSING)         ,"value missing"},
 {ERR_REASON(RSA_R_WRONG_SIGNATURE_LENGTH),"wrong signature length"},
 {0,NULL}
diff --git a/src/lib/libcrypto/rsa/rsa_gen.c b/src/lib/libcrypto/rsa/rsa_gen.c
index 767f7ab682..42290cce66 100644
--- a/src/lib/libcrypto/rsa/rsa_gen.c
+++ b/src/lib/libcrypto/rsa/rsa_gen.c
@@ -67,6 +67,9 @@
 #include "cryptlib.h"
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
 
 static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb);
 
@@ -77,8 +80,20 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
  * now just because key-generation is part of RSA_METHOD. */
 int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
         {
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
+                        && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
+                {
+                RSAerr(RSA_F_RSA_GENERATE_KEY_EX, RSA_R_NON_FIPS_RSA_METHOD);
+                return 0;
+                }
+#endif
         if(rsa->meth->rsa_keygen)
                 return rsa->meth->rsa_keygen(rsa, bits, e_value, cb);
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode())
+                return FIPS_rsa_generate_key_ex(rsa, bits, e_value, cb);
+#endif
         return rsa_builtin_keygen(rsa, bits, e_value, cb);
         }
 
diff --git a/src/lib/libcrypto/rsa/rsa_lib.c b/src/lib/libcrypto/rsa/rsa_lib.c
index de45088d76..c95ceafc82 100644
--- a/src/lib/libcrypto/rsa/rsa_lib.c
+++ b/src/lib/libcrypto/rsa/rsa_lib.c
@@ -67,6 +67,10 @@
 #include <openssl/engine.h>
 #endif
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 const char RSA_version[]="RSA" OPENSSL_VERSION_PTEXT;
 
 static const RSA_METHOD *default_RSA_meth=NULL;
@@ -87,12 +91,15 @@ const RSA_METHOD *RSA_get_default_method(void)
         {
         if (default_RSA_meth == NULL)
                 {
+#ifdef OPENSSL_FIPS
+                if (FIPS_mode())
+                        return FIPS_rsa_pkcs1_ssleay();
+                else
+                        return RSA_PKCS1_SSLeay();
+#else
 #ifdef RSA_NULL
                 default_RSA_meth=RSA_null_method();
 #else
-#if 0 /* was: #ifdef RSAref */
-                default_RSA_meth=RSA_PKCS1_RSAref();
-#else
                 default_RSA_meth=RSA_PKCS1_SSLeay();
 #endif
 #endif
@@ -181,7 +188,7 @@ RSA *RSA_new_method(ENGINE *engine)
         ret->blinding=NULL;
         ret->mt_blinding=NULL;
         ret->bignum_data=NULL;
-        ret->flags=ret->meth->flags;
+        ret->flags=ret->meth->flags & ~RSA_FLAG_NON_FIPS_ALLOW;
         if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_RSA, ret, &ret->ex_data))
                 {
 #ifndef OPENSSL_NO_ENGINE
@@ -280,163 +287,6 @@ void *RSA_get_ex_data(const RSA *r, int idx)
         return(CRYPTO_get_ex_data(&r->ex_data,idx));
         }
 
-int RSA_size(const RSA *r)
-        {
-        return(BN_num_bytes(r->n));
-        }
-
-int RSA_public_encrypt(int flen, const unsigned char *from, unsigned char *to,
-             RSA *rsa, int padding)
-        {
-        return(rsa->meth->rsa_pub_enc(flen, from, to, rsa, padding));
-        }
-
-int RSA_private_encrypt(int flen, const unsigned char *from, unsigned char *to,
-             RSA *rsa, int padding)
-        {
-        return(rsa->meth->rsa_priv_enc(flen, from, to, rsa, padding));
-        }
-
-int RSA_private_decrypt(int flen, const unsigned char *from, unsigned char *to,
-             RSA *rsa, int padding)
-        {
-        return(rsa->meth->rsa_priv_dec(flen, from, to, rsa, padding));
-        }
-
-int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to,
-             RSA *rsa, int padding)
-        {
-        return(rsa->meth->rsa_pub_dec(flen, from, to, rsa, padding));
-        }
-
-int RSA_flags(const RSA *r)
-        {
-        return((r == NULL)?0:r->meth->flags);
-        }
-
-void RSA_blinding_off(RSA *rsa)
-        {
-        if (rsa->blinding != NULL)
-                {
-                BN_BLINDING_free(rsa->blinding);
-                rsa->blinding=NULL;
-                }
-        rsa->flags &= ~RSA_FLAG_BLINDING;
-        rsa->flags |= RSA_FLAG_NO_BLINDING;
-        }
-
-int RSA_blinding_on(RSA *rsa, BN_CTX *ctx)
-        {
-        int ret=0;
-
-        if (rsa->blinding != NULL)
-                RSA_blinding_off(rsa);
-
-        rsa->blinding = RSA_setup_blinding(rsa, ctx);
-        if (rsa->blinding == NULL)
-                goto err;
-
-        rsa->flags |= RSA_FLAG_BLINDING;
-        rsa->flags &= ~RSA_FLAG_NO_BLINDING;
-        ret=1;
-err:
-        return(ret);
-        }
-
-static BIGNUM *rsa_get_public_exp(const BIGNUM *d, const BIGNUM *p,
-        const BIGNUM *q, BN_CTX *ctx)
-{
-        BIGNUM *ret = NULL, *r0, *r1, *r2;
-
-        if (d == NULL || p == NULL || q == NULL)
-                return NULL;
-
-        BN_CTX_start(ctx);
-        r0 = BN_CTX_get(ctx);
-        r1 = BN_CTX_get(ctx);
-        r2 = BN_CTX_get(ctx);
-        if (r2 == NULL)
-                goto err;
-
-        if (!BN_sub(r1, p, BN_value_one())) goto err;
-        if (!BN_sub(r2, q, BN_value_one())) goto err;
-        if (!BN_mul(r0, r1, r2, ctx)) goto err;
-
-        ret = BN_mod_inverse(NULL, d, r0, ctx);
-err:
-        BN_CTX_end(ctx);
-        return ret;
-}
-
-BN_BLINDING *RSA_setup_blinding(RSA *rsa, BN_CTX *in_ctx)
-{
-        BIGNUM local_n;
-        BIGNUM *e,*n;
-        BN_CTX *ctx;
-        BN_BLINDING *ret = NULL;
-
-        if (in_ctx == NULL)
-                {
-                if ((ctx = BN_CTX_new()) == NULL) return 0;
-                }
-        else
-                ctx = in_ctx;
-
-        BN_CTX_start(ctx);
-        e  = BN_CTX_get(ctx);
-        if (e == NULL)
-                {
-                RSAerr(RSA_F_RSA_SETUP_BLINDING, ERR_R_MALLOC_FAILURE);
-                goto err;
-                }
-
-        if (rsa->e == NULL)
-                {
-                e = rsa_get_public_exp(rsa->d, rsa->p, rsa->q, ctx);
-                if (e == NULL)
-                        {
-                        RSAerr(RSA_F_RSA_SETUP_BLINDING, RSA_R_NO_PUBLIC_EXPONENT);
-                        goto err;
-                        }
-                }
-        else
-                e = rsa->e;
-
-        
-        if ((RAND_status() == 0) && rsa->d != NULL && rsa->d->d != NULL)
-                {
-                /* if PRNG is not properly seeded, resort to secret
-                 * exponent as unpredictable seed */
-                RAND_add(rsa->d->d, rsa->d->dmax * sizeof rsa->d->d[0], 0.0);
-                }
-
-        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
-                {
-                /* Set BN_FLG_CONSTTIME flag */
-                n = &local_n;
-                BN_with_flags(n, rsa->n, BN_FLG_CONSTTIME);
-                }
-        else
-                n = rsa->n;
-
-        ret = BN_BLINDING_create_param(NULL, e, n, ctx,
-                        rsa->meth->bn_mod_exp, rsa->_method_mod_n);
-        if (ret == NULL)
-                {
-                RSAerr(RSA_F_RSA_SETUP_BLINDING, ERR_R_BN_LIB);
-                goto err;
-                }
-        CRYPTO_THREADID_current(BN_BLINDING_thread_id(ret));
-err:
-        BN_CTX_end(ctx);
-        if (in_ctx == NULL)
-                BN_CTX_free(ctx);
-        if(rsa->e == NULL)
-                BN_free(e);
-
-        return ret;
-}
-
 int RSA_memory_lock(RSA *r)
         {
         int i,j,k,off;
diff --git a/src/lib/libcrypto/rsa/rsa_oaep.c b/src/lib/libcrypto/rsa/rsa_oaep.c
index 18d307ea9e..553d212ebe 100644
--- a/src/lib/libcrypto/rsa/rsa_oaep.c
+++ b/src/lib/libcrypto/rsa/rsa_oaep.c
@@ -56,7 +56,8 @@ int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
         seed = to + 1;
         db = to + SHA_DIGEST_LENGTH + 1;
 
-        EVP_Digest((void *)param, plen, db, NULL, EVP_sha1(), NULL);
+        if (!EVP_Digest((void *)param, plen, db, NULL, EVP_sha1(), NULL))
+                return 0;
         memset(db + SHA_DIGEST_LENGTH, 0,
                 emlen - flen - 2 * SHA_DIGEST_LENGTH - 1);
         db[emlen - flen - SHA_DIGEST_LENGTH - 1] = 0x01;
@@ -145,7 +146,8 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
         for (i = 0; i < dblen; i++)
                 db[i] ^= maskeddb[i];
 
-        EVP_Digest((void *)param, plen, phash, NULL, EVP_sha1(), NULL);
+        if (!EVP_Digest((void *)param, plen, phash, NULL, EVP_sha1(), NULL))
+                return -1;
 
         if (memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad)
                 goto decoding_err;
diff --git a/src/lib/libcrypto/rsa/rsa_sign.c b/src/lib/libcrypto/rsa/rsa_sign.c
index 0be4ec7fb0..b6f6037ae0 100644
--- a/src/lib/libcrypto/rsa/rsa_sign.c
+++ b/src/lib/libcrypto/rsa/rsa_sign.c
@@ -77,6 +77,14 @@ int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
         const unsigned char *s = NULL;
         X509_ALGOR algor;
         ASN1_OCTET_STRING digest;
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
+                        && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
+                {
+                RSAerr(RSA_F_RSA_SIGN, RSA_R_NON_FIPS_RSA_METHOD);
+                return 0;
+                }
+#endif
         if((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_sign)
                 {
                 return rsa->meth->rsa_sign(type, m, m_len,
@@ -153,6 +161,15 @@ int int_rsa_verify(int dtype, const unsigned char *m,
         unsigned char *s;
         X509_SIG *sig=NULL;
 
+#ifdef OPENSSL_FIPS
+        if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
+                        && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
+                {
+                RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_NON_FIPS_RSA_METHOD);
+                return 0;
+                }
+#endif
+
         if (siglen != (unsigned int)RSA_size(rsa))
                 {
                 RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_WRONG_SIGNATURE_LENGTH);
@@ -182,6 +199,22 @@ int int_rsa_verify(int dtype, const unsigned char *m,
         i=RSA_public_decrypt((int)siglen,sigbuf,s,rsa,RSA_PKCS1_PADDING);
 
         if (i <= 0) goto err;
+        /* Oddball MDC2 case: signature can be OCTET STRING.
+         * check for correct tag and length octets.
+         */
+        if (dtype == NID_mdc2 && i == 18 && s[0] == 0x04 && s[1] == 0x10)
+                {
+                if (rm)
+                        {
+                        memcpy(rm, s + 2, 16);
+                        *prm_len = 16;
+                        ret = 1;
+                        }
+                else if(memcmp(m, s + 2, 16))
+                        RSAerr(RSA_F_INT_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
+                else
+                        ret = 1;
+                }
 
         /* Special case: SSL signature */
         if(dtype == NID_md5_sha1) {
diff --git a/src/lib/libcrypto/sha/asm/sha1-586.pl b/src/lib/libcrypto/sha/asm/sha1-586.pl
index a1f876281a..1084d227fe 100644
--- a/src/lib/libcrypto/sha/asm/sha1-586.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-586.pl
@@ -12,6 +12,8 @@
 # commentary below], and in 2006 the rest was rewritten in order to
 # gain freedom to liberate licensing terms.
 
+# January, September 2004.
+#
 # It was noted that Intel IA-32 C compiler generates code which
 # performs ~30% *faster* on P4 CPU than original *hand-coded*
 # SHA1 assembler implementation. To address this problem (and
@@ -31,12 +33,92 @@
 # ----------------------------------------------------------------
 #                                       <appro@fy.chalmers.se>
 
+# August 2009.
+#
+# George Spelvin has tipped that F_40_59(b,c,d) can be rewritten as
+# '(c&d) + (b&(c^d))', which allows to accumulate partial results
+# and lighten "pressure" on scratch registers. This resulted in
+# >12% performance improvement on contemporary AMD cores (with no
+# degradation on other CPUs:-). Also, the code was revised to maximize
+# "distance" between instructions producing input to 'lea' instruction
+# and the 'lea' instruction itself, which is essential for Intel Atom
+# core and resulted in ~15% improvement.
+
+# October 2010.
+#
+# Add SSSE3, Supplemental[!] SSE3, implementation. The idea behind it
+# is to offload message schedule denoted by Wt in NIST specification,
+# or Xupdate in OpenSSL source, to SIMD unit. The idea is not novel,
+# and in SSE2 context was first explored by Dean Gaudet in 2004, see
+# http://arctic.org/~dean/crypto/sha1.html. Since then several things
+# have changed that made it interesting again:
+#
+# a) XMM units became faster and wider;
+# b) instruction set became more versatile;
+# c) an important observation was made by Max Locktykhin, which made
+#    it possible to reduce amount of instructions required to perform
+#    the operation in question, for further details see
+#    http://software.intel.com/en-us/articles/improving-the-performance-of-the-secure-hash-algorithm-1/.
+
+# April 2011.
+#
+# Add AVX code path, probably most controversial... The thing is that
+# switch to AVX alone improves performance by as little as 4% in
+# comparison to SSSE3 code path. But below result doesn't look like
+# 4% improvement... Trouble is that Sandy Bridge decodes 'ro[rl]' as
+# pair of µ-ops, and it's the additional µ-ops, two per round, that
+# make it run slower than Core2 and Westmere. But 'sh[rl]d' is decoded
+# as single µ-op by Sandy Bridge and it's replacing 'ro[rl]' with
+# equivalent 'sh[rl]d' that is responsible for the impressive 5.1
+# cycles per processed byte. But 'sh[rl]d' is not something that used
+# to be fast, nor does it appear to be fast in upcoming Bulldozer
+# [according to its optimization manual]. Which is why AVX code path
+# is guarded by *both* AVX and synthetic bit denoting Intel CPUs.
+# One can argue that it's unfair to AMD, but without 'sh[rl]d' it
+# makes no sense to keep the AVX code path. If somebody feels that
+# strongly, it's probably more appropriate to discuss possibility of
+# using vector rotate XOP on AMD...
+
+######################################################################
+# Current performance is summarized in following table. Numbers are
+# CPU clock cycles spent to process single byte (less is better).
+#
+#               x86             SSSE3           AVX
+# Pentium       15.7            -
+# PIII          11.5            -
+# P4            10.6            -
+# AMD K8        7.1             -
+# Core2         7.3             6.1/+20%        -
+# Atom          12.5            9.5(*)/+32%     -
+# Westmere      7.3             5.6/+30%        -
+# Sandy Bridge  8.8             6.2/+40%        5.1(**)/+70%
+#
+# (*)   Loop is 1056 instructions long and expected result is ~8.25.
+#       It remains mystery [to me] why ILP is limited to 1.7.
+#
+# (**)  As per above comment, the result is for AVX *plus* sh[rl]d.
+
 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
 push(@INC,"${dir}","${dir}../../perlasm");
 require "x86asm.pl";
 
 &asm_init($ARGV[0],"sha1-586.pl",$ARGV[$#ARGV] eq "386");
 
+$xmm=$ymm=0;
+for (@ARGV) { $xmm=1 if (/-DOPENSSL_IA32_SSE2/); }
+
+$ymm=1 if ($xmm &&
+                `$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
+                        =~ /GNU assembler version ([2-9]\.[0-9]+)/ &&
+                $1>=2.19);      # first version supporting AVX
+
+$ymm=1 if ($xmm && !$ymm && $ARGV[0] eq "win32n" && 
+                `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)/ &&
+                $1>=2.03);      # first version supporting AVX
+
+&external_label("OPENSSL_ia32cap_P") if ($xmm);
+
+
 $A="eax";
 $B="ebx";
 $C="ecx";
@@ -47,6 +129,10 @@ $tmp1="ebp";
 
 @V=($A,$B,$C,$D,$E,$T);
 
+$alt=0; # 1 denotes alternative IALU implementation, which performs
+        # 8% *worse* on P4, same on Westmere and Atom, 2% better on
+        # Sandy Bridge...
+
 sub BODY_00_15
         {
         local($n,$a,$b,$c,$d,$e,$f)=@_;
@@ -59,16 +145,18 @@ sub BODY_00_15
         &rotl($tmp1,5);                 # tmp1=ROTATE(a,5)
          &xor($f,$d);
         &add($tmp1,$e);                 # tmp1+=e;
-         &and($f,$b);
-        &mov($e,&swtmp($n%16));         # e becomes volatile and is loaded
+         &mov($e,&swtmp($n%16));        # e becomes volatile and is loaded
                                         # with xi, also note that e becomes
                                         # f in next round...
-         &xor($f,$d);                   # f holds F_00_19(b,c,d)
+        &and($f,$b);
         &rotr($b,2);                    # b=ROTATE(b,30)
-         &lea($tmp1,&DWP(0x5a827999,$tmp1,$e)); # tmp1+=K_00_19+xi
+         &xor($f,$d);                   # f holds F_00_19(b,c,d)
+        &lea($tmp1,&DWP(0x5a827999,$tmp1,$e));  # tmp1+=K_00_19+xi
 
-        if ($n==15) { &add($f,$tmp1); } # f+=tmp1
+        if ($n==15) { &mov($e,&swtmp(($n+1)%16));# pre-fetch f for next round
+                      &add($f,$tmp1); } # f+=tmp1
         else        { &add($tmp1,$f); } # f becomes a in next round
+        &mov($tmp1,$a)                  if ($alt && $n==15);
         }
 
 sub BODY_16_19
@@ -77,22 +165,41 @@ sub BODY_16_19
 
         &comment("16_19 $n");
 
-        &mov($f,&swtmp($n%16));         # f to hold Xupdate(xi,xa,xb,xc,xd)
-         &mov($tmp1,$c);                # tmp1 to hold F_00_19(b,c,d)
-        &xor($f,&swtmp(($n+2)%16));
-         &xor($tmp1,$d);
-        &xor($f,&swtmp(($n+8)%16));
-         &and($tmp1,$b);                # tmp1 holds F_00_19(b,c,d)
-        &rotr($b,2);                    # b=ROTATE(b,30)
+if ($alt) {
+        &xor($c,$d);
+         &xor($f,&swtmp(($n+2)%16));    # f to hold Xupdate(xi,xa,xb,xc,xd)
+        &and($tmp1,$c);                 # tmp1 to hold F_00_19(b,c,d), b&=c^d
+         &xor($f,&swtmp(($n+8)%16));
+        &xor($tmp1,$d);                 # tmp1=F_00_19(b,c,d)
+         &xor($f,&swtmp(($n+13)%16));   # f holds xa^xb^xc^xd
+        &rotl($f,1);                    # f=ROTATE(f,1)
+         &add($e,$tmp1);                # e+=F_00_19(b,c,d)
+        &xor($c,$d);                    # restore $c
+         &mov($tmp1,$a);                # b in next round
+        &rotr($b,$n==16?2:7);           # b=ROTATE(b,30)
+         &mov(&swtmp($n%16),$f);        # xi=f
+        &rotl($a,5);                    # ROTATE(a,5)
+         &lea($f,&DWP(0x5a827999,$f,$e));# f+=F_00_19(b,c,d)+e
+        &mov($e,&swtmp(($n+1)%16));     # pre-fetch f for next round
+         &add($f,$a);                   # f+=ROTATE(a,5)
+} else {
+        &mov($tmp1,$c);                 # tmp1 to hold F_00_19(b,c,d)
+         &xor($f,&swtmp(($n+2)%16));    # f to hold Xupdate(xi,xa,xb,xc,xd)
+        &xor($tmp1,$d);
+         &xor($f,&swtmp(($n+8)%16));
+        &and($tmp1,$b);
          &xor($f,&swtmp(($n+13)%16));   # f holds xa^xb^xc^xd
         &rotl($f,1);                    # f=ROTATE(f,1)
          &xor($tmp1,$d);                # tmp1=F_00_19(b,c,d)
-        &mov(&swtmp($n%16),$f);         # xi=f
-        &lea($f,&DWP(0x5a827999,$f,$e));# f+=K_00_19+e
-         &mov($e,$a);                   # e becomes volatile
-        &rotl($e,5);                    # e=ROTATE(a,5)
-         &add($f,$tmp1);                # f+=F_00_19(b,c,d)
-        &add($f,$e);                    # f+=ROTATE(a,5)
+        &add($e,$tmp1);                 # e+=F_00_19(b,c,d)
+         &mov($tmp1,$a);
+        &rotr($b,2);                    # b=ROTATE(b,30)
+         &mov(&swtmp($n%16),$f);        # xi=f
+        &rotl($tmp1,5);                 # ROTATE(a,5)
+         &lea($f,&DWP(0x5a827999,$f,$e));# f+=F_00_19(b,c,d)+e
+        &mov($e,&swtmp(($n+1)%16));     # pre-fetch f for next round
+         &add($f,$tmp1);                # f+=ROTATE(a,5)
+}
         }
 
 sub BODY_20_39
@@ -102,21 +209,41 @@ sub BODY_20_39
 
         &comment("20_39 $n");
 
+if ($alt) {
+        &xor($tmp1,$c);                 # tmp1 to hold F_20_39(b,c,d), b^=c
+         &xor($f,&swtmp(($n+2)%16));    # f to hold Xupdate(xi,xa,xb,xc,xd)
+        &xor($tmp1,$d);                 # tmp1 holds F_20_39(b,c,d)
+         &xor($f,&swtmp(($n+8)%16));
+        &add($e,$tmp1);                 # e+=F_20_39(b,c,d)
+         &xor($f,&swtmp(($n+13)%16));   # f holds xa^xb^xc^xd
+        &rotl($f,1);                    # f=ROTATE(f,1)
+         &mov($tmp1,$a);                # b in next round
+        &rotr($b,7);                    # b=ROTATE(b,30)
+         &mov(&swtmp($n%16),$f)         if($n<77);# xi=f
+        &rotl($a,5);                    # ROTATE(a,5)
+         &xor($b,$c)                    if($n==39);# warm up for BODY_40_59
+        &and($tmp1,$b)                  if($n==39);
+         &lea($f,&DWP($K,$f,$e));       # f+=e+K_XX_YY
+        &mov($e,&swtmp(($n+1)%16))      if($n<79);# pre-fetch f for next round
+         &add($f,$a);                   # f+=ROTATE(a,5)
+        &rotr($a,5)                     if ($n==79);
+} else {
         &mov($tmp1,$b);                 # tmp1 to hold F_20_39(b,c,d)
-         &mov($f,&swtmp($n%16));        # f to hold Xupdate(xi,xa,xb,xc,xd)
-        &rotr($b,2);                    # b=ROTATE(b,30)
-         &xor($f,&swtmp(($n+2)%16));
+         &xor($f,&swtmp(($n+2)%16));    # f to hold Xupdate(xi,xa,xb,xc,xd)
         &xor($tmp1,$c);
          &xor($f,&swtmp(($n+8)%16));
         &xor($tmp1,$d);                 # tmp1 holds F_20_39(b,c,d)
          &xor($f,&swtmp(($n+13)%16));   # f holds xa^xb^xc^xd
         &rotl($f,1);                    # f=ROTATE(f,1)
-         &add($tmp1,$e);
-        &mov(&swtmp($n%16),$f);         # xi=f
-         &mov($e,$a);                   # e becomes volatile
-        &rotl($e,5);                    # e=ROTATE(a,5)
-         &lea($f,&DWP($K,$f,$tmp1));    # f+=K_20_39+e
-        &add($f,$e);                    # f+=ROTATE(a,5)
+         &add($e,$tmp1);                # e+=F_20_39(b,c,d)
+        &rotr($b,2);                    # b=ROTATE(b,30)
+         &mov($tmp1,$a);
+        &rotl($tmp1,5);                 # ROTATE(a,5)
+         &mov(&swtmp($n%16),$f) if($n<77);# xi=f
+        &lea($f,&DWP($K,$f,$e));        # f+=e+K_XX_YY
+         &mov($e,&swtmp(($n+1)%16)) if($n<79);# pre-fetch f for next round
+        &add($f,$tmp1);                 # f+=ROTATE(a,5)
+}
         }
 
 sub BODY_40_59
@@ -125,41 +252,86 @@ sub BODY_40_59
 
         &comment("40_59 $n");
 
-        &mov($f,&swtmp($n%16));         # f to hold Xupdate(xi,xa,xb,xc,xd)
-         &mov($tmp1,&swtmp(($n+2)%16));
-        &xor($f,$tmp1);
-         &mov($tmp1,&swtmp(($n+8)%16));
-        &xor($f,$tmp1);
-         &mov($tmp1,&swtmp(($n+13)%16));
-        &xor($f,$tmp1);                 # f holds xa^xb^xc^xd
-         &mov($tmp1,$b);                # tmp1 to hold F_40_59(b,c,d)
+if ($alt) {
+        &add($e,$tmp1);                 # e+=b&(c^d)
+         &xor($f,&swtmp(($n+2)%16));    # f to hold Xupdate(xi,xa,xb,xc,xd)
+        &mov($tmp1,$d);
+         &xor($f,&swtmp(($n+8)%16));
+        &xor($c,$d);                    # restore $c
+         &xor($f,&swtmp(($n+13)%16));   # f holds xa^xb^xc^xd
         &rotl($f,1);                    # f=ROTATE(f,1)
-         &or($tmp1,$c);
-        &mov(&swtmp($n%16),$f);         # xi=f
-         &and($tmp1,$d);
-        &lea($f,&DWP(0x8f1bbcdc,$f,$e));# f+=K_40_59+e
-         &mov($e,$b);                   # e becomes volatile and is used
-                                        # to calculate F_40_59(b,c,d)
+         &and($tmp1,$c);
+        &rotr($b,7);                    # b=ROTATE(b,30)
+         &add($e,$tmp1);                # e+=c&d
+        &mov($tmp1,$a);                 # b in next round
+         &mov(&swtmp($n%16),$f);        # xi=f
+        &rotl($a,5);                    # ROTATE(a,5)
+         &xor($b,$c)                    if ($n<59);
+        &and($tmp1,$b)                  if ($n<59);# tmp1 to hold F_40_59(b,c,d)
+         &lea($f,&DWP(0x8f1bbcdc,$f,$e));# f+=K_40_59+e+(b&(c^d))
+        &mov($e,&swtmp(($n+1)%16));     # pre-fetch f for next round
+         &add($f,$a);                   # f+=ROTATE(a,5)
+} else {
+        &mov($tmp1,$c);                 # tmp1 to hold F_40_59(b,c,d)
+         &xor($f,&swtmp(($n+2)%16));    # f to hold Xupdate(xi,xa,xb,xc,xd)
+        &xor($tmp1,$d);
+         &xor($f,&swtmp(($n+8)%16));
+        &and($tmp1,$b);
+         &xor($f,&swtmp(($n+13)%16));   # f holds xa^xb^xc^xd
+        &rotl($f,1);                    # f=ROTATE(f,1)
+         &add($tmp1,$e);                # b&(c^d)+=e
         &rotr($b,2);                    # b=ROTATE(b,30)
-         &and($e,$c);
-        &or($tmp1,$e);                  # tmp1 holds F_40_59(b,c,d)             
-         &mov($e,$a);
-        &rotl($e,5);                    # e=ROTATE(a,5)
-         &add($f,$tmp1);                # f+=tmp1;
+         &mov($e,$a);                   # e becomes volatile
+        &rotl($e,5);                    # ROTATE(a,5)
+         &mov(&swtmp($n%16),$f);        # xi=f
+        &lea($f,&DWP(0x8f1bbcdc,$f,$tmp1));# f+=K_40_59+e+(b&(c^d))
+         &mov($tmp1,$c);
         &add($f,$e);                    # f+=ROTATE(a,5)
+         &and($tmp1,$d);
+        &mov($e,&swtmp(($n+1)%16));     # pre-fetch f for next round
+         &add($f,$tmp1);                # f+=c&d
+}
         }
 
 &function_begin("sha1_block_data_order");
+if ($xmm) {
+  &static_label("ssse3_shortcut");
+  &static_label("avx_shortcut")         if ($ymm);
+  &static_label("K_XX_XX");
+
+        &call   (&label("pic_point"));  # make it PIC!
+  &set_label("pic_point");
+        &blindpop($tmp1);
+        &picmeup($T,"OPENSSL_ia32cap_P",$tmp1,&label("pic_point"));
+        &lea    ($tmp1,&DWP(&label("K_XX_XX")."-".&label("pic_point"),$tmp1));
+
+        &mov    ($A,&DWP(0,$T));
+        &mov    ($D,&DWP(4,$T));
+        &test   ($D,1<<9);              # check SSSE3 bit
+        &jz     (&label("x86"));
+        &test   ($A,1<<24);             # check FXSR bit
+        &jz     (&label("x86"));
+        if ($ymm) {
+                &and    ($D,1<<28);             # mask AVX bit
+                &and    ($A,1<<30);             # mask "Intel CPU" bit
+                &or     ($A,$D);
+                &cmp    ($A,1<<28|1<<30);
+                &je     (&label("avx_shortcut"));
+        }
+        &jmp    (&label("ssse3_shortcut"));
+  &set_label("x86",16);
+}
         &mov($tmp1,&wparam(0)); # SHA_CTX *c
         &mov($T,&wparam(1));    # const void *input
         &mov($A,&wparam(2));    # size_t num
-        &stack_push(16);        # allocate X[16]
+        &stack_push(16+3);      # allocate X[16]
         &shl($A,6);
         &add($A,$T);
         &mov(&wparam(2),$A);    # pointer beyond the end of input
         &mov($E,&DWP(16,$tmp1));# pre-load E
+        &jmp(&label("loop"));
 
-        &set_label("loop",16);
+&set_label("loop",16);
 
         # copy input chunk to X, but reversing byte order!
         for ($i=0; $i<16; $i+=4)
@@ -213,8 +385,845 @@ sub BODY_40_59
         &mov(&DWP(16,$tmp1),$C);
         &jb(&label("loop"));
 
-        &stack_pop(16);
+        &stack_pop(16+3);
 &function_end("sha1_block_data_order");
+
+if ($xmm) {
+######################################################################
+# The SSSE3 implementation.
+#
+# %xmm[0-7] are used as ring @X[] buffer containing quadruples of last
+# 32 elements of the message schedule or Xupdate outputs. First 4
+# quadruples are simply byte-swapped input, next 4 are calculated
+# according to method originally suggested by Dean Gaudet (modulo
+# being implemented in SSSE3). Once 8 quadruples or 32 elements are
+# collected, it switches to routine proposed by Max Locktyukhin.
+#
+# Calculations inevitably require temporary reqisters, and there are
+# no %xmm registers left to spare. For this reason part of the ring
+# buffer, X[2..4] to be specific, is offloaded to 3 quadriples ring
+# buffer on the stack. Keep in mind that X[2] is alias X[-6], X[3] -
+# X[-5], and X[4] - X[-4]...
+#
+# Another notable optimization is aggressive stack frame compression
+# aiming to minimize amount of 9-byte instructions...
+#
+# Yet another notable optimization is "jumping" $B variable. It means
+# that there is no register permanently allocated for $B value. This
+# allowed to eliminate one instruction from body_20_39...
+#
+my $Xi=4;                       # 4xSIMD Xupdate round, start pre-seeded
+my @X=map("xmm$_",(4..7,0..3)); # pre-seeded for $Xi=4
+my @V=($A,$B,$C,$D,$E);
+my $j=0;                        # hash round
+my @T=($T,$tmp1);
+my $inp;
+
+my $_rol=sub { &rol(@_) };
+my $_ror=sub { &ror(@_) };
+
+&function_begin("_sha1_block_data_order_ssse3");
+        &call   (&label("pic_point"));  # make it PIC!
+        &set_label("pic_point");
+        &blindpop($tmp1);
+        &lea    ($tmp1,&DWP(&label("K_XX_XX")."-".&label("pic_point"),$tmp1));
+&set_label("ssse3_shortcut");
+
+        &movdqa (@X[3],&QWP(0,$tmp1));          # K_00_19
+        &movdqa (@X[4],&QWP(16,$tmp1));         # K_20_39
+        &movdqa (@X[5],&QWP(32,$tmp1));         # K_40_59
+        &movdqa (@X[6],&QWP(48,$tmp1));         # K_60_79
+        &movdqa (@X[2],&QWP(64,$tmp1));         # pbswap mask
+
+        &mov    ($E,&wparam(0));                # load argument block
+        &mov    ($inp=@T[1],&wparam(1));
+        &mov    ($D,&wparam(2));
+        &mov    (@T[0],"esp");
+
+        # stack frame layout
+        #
+        # +0    X[0]+K  X[1]+K  X[2]+K  X[3]+K  # XMM->IALU xfer area
+        #       X[4]+K  X[5]+K  X[6]+K  X[7]+K
+        #       X[8]+K  X[9]+K  X[10]+K X[11]+K
+        #       X[12]+K X[13]+K X[14]+K X[15]+K
+        #
+        # +64   X[0]    X[1]    X[2]    X[3]    # XMM->XMM backtrace area
+        #       X[4]    X[5]    X[6]    X[7]
+        #       X[8]    X[9]    X[10]   X[11]   # even borrowed for K_00_19
+        #
+        # +112  K_20_39 K_20_39 K_20_39 K_20_39 # constants
+        #       K_40_59 K_40_59 K_40_59 K_40_59
+        #       K_60_79 K_60_79 K_60_79 K_60_79
+        #       K_00_19 K_00_19 K_00_19 K_00_19
+        #       pbswap mask
+        #
+        # +192  ctx                             # argument block
+        # +196  inp
+        # +200  end
+        # +204  esp
+        &sub    ("esp",208);
+        &and    ("esp",-64);
+
+        &movdqa (&QWP(112+0,"esp"),@X[4]);      # copy constants
+        &movdqa (&QWP(112+16,"esp"),@X[5]);
+        &movdqa (&QWP(112+32,"esp"),@X[6]);
+        &shl    ($D,6);                         # len*64
+        &movdqa (&QWP(112+48,"esp"),@X[3]);
+        &add    ($D,$inp);                      # end of input
+        &movdqa (&QWP(112+64,"esp"),@X[2]);
+        &add    ($inp,64);
+        &mov    (&DWP(192+0,"esp"),$E);         # save argument block
+        &mov    (&DWP(192+4,"esp"),$inp);
+        &mov    (&DWP(192+8,"esp"),$D);
+        &mov    (&DWP(192+12,"esp"),@T[0]);     # save original %esp
+
+        &mov    ($A,&DWP(0,$E));                # load context
+        &mov    ($B,&DWP(4,$E));
+        &mov    ($C,&DWP(8,$E));
+        &mov    ($D,&DWP(12,$E));
+        &mov    ($E,&DWP(16,$E));
+        &mov    (@T[0],$B);                     # magic seed
+
+        &movdqu (@X[-4&7],&QWP(-64,$inp));      # load input to %xmm[0-3]
+        &movdqu (@X[-3&7],&QWP(-48,$inp));
+        &movdqu (@X[-2&7],&QWP(-32,$inp));
+        &movdqu (@X[-1&7],&QWP(-16,$inp));
+        &pshufb (@X[-4&7],@X[2]);               # byte swap
+        &pshufb (@X[-3&7],@X[2]);
+        &pshufb (@X[-2&7],@X[2]);
+        &movdqa (&QWP(112-16,"esp"),@X[3]);     # borrow last backtrace slot
+        &pshufb (@X[-1&7],@X[2]);
+        &paddd  (@X[-4&7],@X[3]);               # add K_00_19
+        &paddd  (@X[-3&7],@X[3]);
+        &paddd  (@X[-2&7],@X[3]);
+        &movdqa (&QWP(0,"esp"),@X[-4&7]);       # X[]+K xfer to IALU
+        &psubd  (@X[-4&7],@X[3]);               # restore X[]
+        &movdqa (&QWP(0+16,"esp"),@X[-3&7]);
+        &psubd  (@X[-3&7],@X[3]);
+        &movdqa (&QWP(0+32,"esp"),@X[-2&7]);
+        &psubd  (@X[-2&7],@X[3]);
+        &movdqa (@X[0],@X[-3&7]);
+        &jmp    (&label("loop"));
+
+######################################################################
+# SSE instruction sequence is first broken to groups of indepentent
+# instructions, independent in respect to their inputs and shifter
+# (not all architectures have more than one). Then IALU instructions
+# are "knitted in" between the SSE groups. Distance is maintained for
+# SSE latency of 2 in hope that it fits better upcoming AMD Bulldozer
+# [which allegedly also implements SSSE3]...
+#
+# Temporary registers usage. X[2] is volatile at the entry and at the
+# end is restored from backtrace ring buffer. X[3] is expected to
+# contain current K_XX_XX constant and is used to caclulate X[-1]+K
+# from previous round, it becomes volatile the moment the value is
+# saved to stack for transfer to IALU. X[4] becomes volatile whenever
+# X[-4] is accumulated and offloaded to backtrace ring buffer, at the
+# end it is loaded with next K_XX_XX [which becomes X[3] in next
+# round]...
+#
+sub Xupdate_ssse3_16_31()               # recall that $Xi starts wtih 4
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 40 instructions
+  my ($a,$b,$c,$d,$e);
+
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &palignr(@X[0],@X[-4&7],8);     # compose "X[-14]" in "X[0]"
+        &movdqa (@X[2],@X[-1&7]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+          &paddd        (@X[3],@X[-1&7]);
+          &movdqa       (&QWP(64+16*(($Xi-4)%3),"esp"),@X[-4&7]);# save X[] to backtrace buffer
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &psrldq (@X[2],4);              # "X[-3]", 3 dwords
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &pxor   (@X[0],@X[-4&7]);       # "X[0]"^="X[-16]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &pxor   (@X[2],@X[-2&7]);       # "X[-3]"^"X[-8]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &pxor   (@X[0],@X[2]);          # "X[0]"^="X[-3]"^"X[-8]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+          &movdqa       (&QWP(0+16*(($Xi-1)&3),"esp"),@X[3]);   # X[]+K xfer to IALU
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &movdqa (@X[4],@X[0]);
+        &movdqa (@X[2],@X[0]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &pslldq (@X[4],12);             # "X[0]"<<96, extract one dword
+        &paddd  (@X[0],@X[0]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &psrld  (@X[2],31);
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &movdqa (@X[3],@X[4]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &psrld  (@X[4],30);
+        &por    (@X[0],@X[2]);          # "X[0]"<<<=1
+         eval(shift(@insns));
+         eval(shift(@insns));
+          &movdqa       (@X[2],&QWP(64+16*(($Xi-6)%3),"esp")) if ($Xi>5);       # restore X[] from backtrace buffer
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &pslld  (@X[3],2);
+        &pxor   (@X[0],@X[4]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+          &movdqa       (@X[4],&QWP(112-16+16*(($Xi)/5),"esp"));        # K_XX_XX
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &pxor   (@X[0],@X[3]);          # "X[0]"^=("X[0]"<<96)<<<2
+          &movdqa       (@X[1],@X[-2&7])        if ($Xi<7);
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+         foreach (@insns) { eval; }     # remaining instructions [if any]
+
+  $Xi++;        push(@X,shift(@X));     # "rotate" X[]
+}
+
+sub Xupdate_ssse3_32_79()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 to 48 instructions
+  my ($a,$b,$c,$d,$e);
+
+        &movdqa (@X[2],@X[-1&7])        if ($Xi==8);
+         eval(shift(@insns));           # body_20_39
+        &pxor   (@X[0],@X[-4&7]);       # "X[0]"="X[-32]"^"X[-16]"
+        &palignr(@X[2],@X[-2&7],8);     # compose "X[-6]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+
+        &pxor   (@X[0],@X[-7&7]);       # "X[0]"^="X[-28]"
+          &movdqa       (&QWP(64+16*(($Xi-4)%3),"esp"),@X[-4&7]);       # save X[] to backtrace buffer
+         eval(shift(@insns));
+         eval(shift(@insns));
+         if ($Xi%5) {
+          &movdqa       (@X[4],@X[3]);  # "perpetuate" K_XX_XX...
+         } else {                       # ... or load next one
+          &movdqa       (@X[4],&QWP(112-16+16*($Xi/5),"esp"));
+         }
+          &paddd        (@X[3],@X[-1&7]);
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+        &pxor   (@X[0],@X[2]);          # "X[0]"^="X[-6]"
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+
+        &movdqa (@X[2],@X[0]);
+          &movdqa       (&QWP(0+16*(($Xi-1)&3),"esp"),@X[3]);   # X[]+K xfer to IALU
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+        &pslld  (@X[0],2);
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+        &psrld  (@X[2],30);
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+        &por    (@X[0],@X[2]);          # "X[0]"<<<=2
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+          &movdqa       (@X[2],&QWP(64+16*(($Xi-6)%3),"esp")) if($Xi<19);       # restore X[] from backtrace buffer
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # ror
+          &movdqa       (@X[3],@X[0])   if ($Xi<19);
+         eval(shift(@insns));
+
+         foreach (@insns) { eval; }     # remaining instructions
+
+  $Xi++;        push(@X,shift(@X));     # "rotate" X[]
+}
+
+sub Xuplast_ssse3_80()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 instructions
+  my ($a,$b,$c,$d,$e);
+
+         eval(shift(@insns));
+          &paddd        (@X[3],@X[-1&7]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+          &movdqa       (&QWP(0+16*(($Xi-1)&3),"esp"),@X[3]);   # X[]+K xfer IALU
+
+         foreach (@insns) { eval; }             # remaining instructions
+
+        &mov    ($inp=@T[1],&DWP(192+4,"esp"));
+        &cmp    ($inp,&DWP(192+8,"esp"));
+        &je     (&label("done"));
+
+        &movdqa (@X[3],&QWP(112+48,"esp"));     # K_00_19
+        &movdqa (@X[2],&QWP(112+64,"esp"));     # pbswap mask
+        &movdqu (@X[-4&7],&QWP(0,$inp));        # load input
+        &movdqu (@X[-3&7],&QWP(16,$inp));
+        &movdqu (@X[-2&7],&QWP(32,$inp));
+        &movdqu (@X[-1&7],&QWP(48,$inp));
+        &add    ($inp,64);
+        &pshufb (@X[-4&7],@X[2]);               # byte swap
+        &mov    (&DWP(192+4,"esp"),$inp);
+        &movdqa (&QWP(112-16,"esp"),@X[3]);     # borrow last backtrace slot
+
+  $Xi=0;
+}
+
+sub Xloop_ssse3()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 instructions
+  my ($a,$b,$c,$d,$e);
+
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &pshufb (@X[($Xi-3)&7],@X[2]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &paddd  (@X[($Xi-4)&7],@X[3]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &movdqa (&QWP(0+16*$Xi,"esp"),@X[($Xi-4)&7]);   # X[]+K xfer to IALU
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &psubd  (@X[($Xi-4)&7],@X[3]);
+
+        foreach (@insns) { eval; }
+  $Xi++;
+}
+
+sub Xtail_ssse3()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 instructions
+  my ($a,$b,$c,$d,$e);
+
+        foreach (@insns) { eval; }
+}
+
+sub body_00_19 () {
+        (
+        '($a,$b,$c,$d,$e)=@V;'.
+        '&add   ($e,&DWP(4*($j&15),"esp"));',   # X[]+K xfer
+        '&xor   ($c,$d);',
+        '&mov   (@T[1],$a);',   # $b in next round
+        '&$_rol ($a,5);',
+        '&and   (@T[0],$c);',   # ($b&($c^$d))
+        '&xor   ($c,$d);',      # restore $c
+        '&xor   (@T[0],$d);',
+        '&add   ($e,$a);',
+        '&$_ror ($b,$j?7:2);',  # $b>>>2
+        '&add   ($e,@T[0]);'    .'$j++; unshift(@V,pop(@V)); unshift(@T,pop(@T));'
+        );
+}
+
+sub body_20_39 () {
+        (
+        '($a,$b,$c,$d,$e)=@V;'.
+        '&add   ($e,&DWP(4*($j++&15),"esp"));', # X[]+K xfer
+        '&xor   (@T[0],$d);',   # ($b^$d)
+        '&mov   (@T[1],$a);',   # $b in next round
+        '&$_rol ($a,5);',
+        '&xor   (@T[0],$c);',   # ($b^$d^$c)
+        '&add   ($e,$a);',
+        '&$_ror ($b,7);',       # $b>>>2
+        '&add   ($e,@T[0]);'    .'unshift(@V,pop(@V)); unshift(@T,pop(@T));'
+        );
+}
+
+sub body_40_59 () {
+        (
+        '($a,$b,$c,$d,$e)=@V;'.
+        '&mov   (@T[1],$c);',
+        '&xor   ($c,$d);',
+        '&add   ($e,&DWP(4*($j++&15),"esp"));', # X[]+K xfer
+        '&and   (@T[1],$d);',
+        '&and   (@T[0],$c);',   # ($b&($c^$d))
+        '&$_ror ($b,7);',       # $b>>>2
+        '&add   ($e,@T[1]);',
+        '&mov   (@T[1],$a);',   # $b in next round
+        '&$_rol ($a,5);',
+        '&add   ($e,@T[0]);',
+        '&xor   ($c,$d);',      # restore $c
+        '&add   ($e,$a);'       .'unshift(@V,pop(@V)); unshift(@T,pop(@T));'
+        );
+}
+
+&set_label("loop",16);
+        &Xupdate_ssse3_16_31(\&body_00_19);
+        &Xupdate_ssse3_16_31(\&body_00_19);
+        &Xupdate_ssse3_16_31(\&body_00_19);
+        &Xupdate_ssse3_16_31(\&body_00_19);
+        &Xupdate_ssse3_32_79(\&body_00_19);
+        &Xupdate_ssse3_32_79(\&body_20_39);
+        &Xupdate_ssse3_32_79(\&body_20_39);
+        &Xupdate_ssse3_32_79(\&body_20_39);
+        &Xupdate_ssse3_32_79(\&body_20_39);
+        &Xupdate_ssse3_32_79(\&body_20_39);
+        &Xupdate_ssse3_32_79(\&body_40_59);
+        &Xupdate_ssse3_32_79(\&body_40_59);
+        &Xupdate_ssse3_32_79(\&body_40_59);
+        &Xupdate_ssse3_32_79(\&body_40_59);
+        &Xupdate_ssse3_32_79(\&body_40_59);
+        &Xupdate_ssse3_32_79(\&body_20_39);
+        &Xuplast_ssse3_80(\&body_20_39);        # can jump to "done"
+
+                                $saved_j=$j; @saved_V=@V;
+
+        &Xloop_ssse3(\&body_20_39);
+        &Xloop_ssse3(\&body_20_39);
+        &Xloop_ssse3(\&body_20_39);
+
+        &mov    (@T[1],&DWP(192,"esp"));        # update context
+        &add    ($A,&DWP(0,@T[1]));
+        &add    (@T[0],&DWP(4,@T[1]));          # $b
+        &add    ($C,&DWP(8,@T[1]));
+        &mov    (&DWP(0,@T[1]),$A);
+        &add    ($D,&DWP(12,@T[1]));
+        &mov    (&DWP(4,@T[1]),@T[0]);
+        &add    ($E,&DWP(16,@T[1]));
+        &mov    (&DWP(8,@T[1]),$C);
+        &mov    ($B,@T[0]);
+        &mov    (&DWP(12,@T[1]),$D);
+        &mov    (&DWP(16,@T[1]),$E);
+        &movdqa (@X[0],@X[-3&7]);
+
+        &jmp    (&label("loop"));
+
+&set_label("done",16);          $j=$saved_j; @V=@saved_V;
+
+        &Xtail_ssse3(\&body_20_39);
+        &Xtail_ssse3(\&body_20_39);
+        &Xtail_ssse3(\&body_20_39);
+
+        &mov    (@T[1],&DWP(192,"esp"));        # update context
+        &add    ($A,&DWP(0,@T[1]));
+        &mov    ("esp",&DWP(192+12,"esp"));     # restore %esp
+        &add    (@T[0],&DWP(4,@T[1]));          # $b
+        &add    ($C,&DWP(8,@T[1]));
+        &mov    (&DWP(0,@T[1]),$A);
+        &add    ($D,&DWP(12,@T[1]));
+        &mov    (&DWP(4,@T[1]),@T[0]);
+        &add    ($E,&DWP(16,@T[1]));
+        &mov    (&DWP(8,@T[1]),$C);
+        &mov    (&DWP(12,@T[1]),$D);
+        &mov    (&DWP(16,@T[1]),$E);
+
+&function_end("_sha1_block_data_order_ssse3");
+
+if ($ymm) {
+my $Xi=4;                       # 4xSIMD Xupdate round, start pre-seeded
+my @X=map("xmm$_",(4..7,0..3)); # pre-seeded for $Xi=4
+my @V=($A,$B,$C,$D,$E);
+my $j=0;                        # hash round
+my @T=($T,$tmp1);
+my $inp;
+
+my $_rol=sub { &shld(@_[0],@_) };
+my $_ror=sub { &shrd(@_[0],@_) };
+
+&function_begin("_sha1_block_data_order_avx");
+        &call   (&label("pic_point"));  # make it PIC!
+        &set_label("pic_point");
+        &blindpop($tmp1);
+        &lea    ($tmp1,&DWP(&label("K_XX_XX")."-".&label("pic_point"),$tmp1));
+&set_label("avx_shortcut");
+        &vzeroall();
+
+        &vmovdqa(@X[3],&QWP(0,$tmp1));          # K_00_19
+        &vmovdqa(@X[4],&QWP(16,$tmp1));         # K_20_39
+        &vmovdqa(@X[5],&QWP(32,$tmp1));         # K_40_59
+        &vmovdqa(@X[6],&QWP(48,$tmp1));         # K_60_79
+        &vmovdqa(@X[2],&QWP(64,$tmp1));         # pbswap mask
+
+        &mov    ($E,&wparam(0));                # load argument block
+        &mov    ($inp=@T[1],&wparam(1));
+        &mov    ($D,&wparam(2));
+        &mov    (@T[0],"esp");
+
+        # stack frame layout
+        #
+        # +0    X[0]+K  X[1]+K  X[2]+K  X[3]+K  # XMM->IALU xfer area
+        #       X[4]+K  X[5]+K  X[6]+K  X[7]+K
+        #       X[8]+K  X[9]+K  X[10]+K X[11]+K
+        #       X[12]+K X[13]+K X[14]+K X[15]+K
+        #
+        # +64   X[0]    X[1]    X[2]    X[3]    # XMM->XMM backtrace area
+        #       X[4]    X[5]    X[6]    X[7]
+        #       X[8]    X[9]    X[10]   X[11]   # even borrowed for K_00_19
+        #
+        # +112  K_20_39 K_20_39 K_20_39 K_20_39 # constants
+        #       K_40_59 K_40_59 K_40_59 K_40_59
+        #       K_60_79 K_60_79 K_60_79 K_60_79
+        #       K_00_19 K_00_19 K_00_19 K_00_19
+        #       pbswap mask
+        #
+        # +192  ctx                             # argument block
+        # +196  inp
+        # +200  end
+        # +204  esp
+        &sub    ("esp",208);
+        &and    ("esp",-64);
+
+        &vmovdqa(&QWP(112+0,"esp"),@X[4]);      # copy constants
+        &vmovdqa(&QWP(112+16,"esp"),@X[5]);
+        &vmovdqa(&QWP(112+32,"esp"),@X[6]);
+        &shl    ($D,6);                         # len*64
+        &vmovdqa(&QWP(112+48,"esp"),@X[3]);
+        &add    ($D,$inp);                      # end of input
+        &vmovdqa(&QWP(112+64,"esp"),@X[2]);
+        &add    ($inp,64);
+        &mov    (&DWP(192+0,"esp"),$E);         # save argument block
+        &mov    (&DWP(192+4,"esp"),$inp);
+        &mov    (&DWP(192+8,"esp"),$D);
+        &mov    (&DWP(192+12,"esp"),@T[0]);     # save original %esp
+
+        &mov    ($A,&DWP(0,$E));                # load context
+        &mov    ($B,&DWP(4,$E));
+        &mov    ($C,&DWP(8,$E));
+        &mov    ($D,&DWP(12,$E));
+        &mov    ($E,&DWP(16,$E));
+        &mov    (@T[0],$B);                     # magic seed
+
+        &vmovdqu(@X[-4&7],&QWP(-64,$inp));      # load input to %xmm[0-3]
+        &vmovdqu(@X[-3&7],&QWP(-48,$inp));
+        &vmovdqu(@X[-2&7],&QWP(-32,$inp));
+        &vmovdqu(@X[-1&7],&QWP(-16,$inp));
+        &vpshufb(@X[-4&7],@X[-4&7],@X[2]);      # byte swap
+        &vpshufb(@X[-3&7],@X[-3&7],@X[2]);
+        &vpshufb(@X[-2&7],@X[-2&7],@X[2]);
+        &vmovdqa(&QWP(112-16,"esp"),@X[3]);     # borrow last backtrace slot
+        &vpshufb(@X[-1&7],@X[-1&7],@X[2]);
+        &vpaddd (@X[0],@X[-4&7],@X[3]);         # add K_00_19
+        &vpaddd (@X[1],@X[-3&7],@X[3]);
+        &vpaddd (@X[2],@X[-2&7],@X[3]);
+        &vmovdqa(&QWP(0,"esp"),@X[0]);          # X[]+K xfer to IALU
+        &vmovdqa(&QWP(0+16,"esp"),@X[1]);
+        &vmovdqa(&QWP(0+32,"esp"),@X[2]);
+        &jmp    (&label("loop"));
+
+sub Xupdate_avx_16_31()         # recall that $Xi starts wtih 4
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 40 instructions
+  my ($a,$b,$c,$d,$e);
+
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vpalignr(@X[0],@X[-3&7],@X[-4&7],8);   # compose "X[-14]" in "X[0]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+          &vpaddd       (@X[3],@X[3],@X[-1&7]);
+          &vmovdqa      (&QWP(64+16*(($Xi-4)%3),"esp"),@X[-4&7]);# save X[] to backtrace buffer
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vpsrldq(@X[2],@X[-1&7],4);             # "X[-3]", 3 dwords
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vpxor  (@X[0],@X[0],@X[-4&7]);         # "X[0]"^="X[-16]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpxor  (@X[2],@X[2],@X[-2&7]);         # "X[-3]"^"X[-8]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+          &vmovdqa      (&QWP(0+16*(($Xi-1)&3),"esp"),@X[3]);   # X[]+K xfer to IALU
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpxor  (@X[0],@X[0],@X[2]);            # "X[0]"^="X[-3]"^"X[-8]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpsrld (@X[2],@X[0],31);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpslldq(@X[4],@X[0],12);               # "X[0]"<<96, extract one dword
+        &vpaddd (@X[0],@X[0],@X[0]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpsrld (@X[3],@X[4],30);
+        &vpor   (@X[0],@X[0],@X[2]);            # "X[0]"<<<=1
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpslld (@X[4],@X[4],2);
+          &vmovdqa      (@X[2],&QWP(64+16*(($Xi-6)%3),"esp")) if ($Xi>5);       # restore X[] from backtrace buffer
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vpxor  (@X[0],@X[0],@X[3]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpxor  (@X[0],@X[0],@X[4]);            # "X[0]"^=("X[0]"<<96)<<<2
+         eval(shift(@insns));
+         eval(shift(@insns));
+          &vmovdqa      (@X[4],&QWP(112-16+16*(($Xi)/5),"esp"));        # K_XX_XX
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+         foreach (@insns) { eval; }     # remaining instructions [if any]
+
+  $Xi++;        push(@X,shift(@X));     # "rotate" X[]
+}
+
+sub Xupdate_avx_32_79()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 to 48 instructions
+  my ($a,$b,$c,$d,$e);
+
+        &vpalignr(@X[2],@X[-1&7],@X[-2&7],8);   # compose "X[-6]"
+        &vpxor  (@X[0],@X[0],@X[-4&7]); # "X[0]"="X[-32]"^"X[-16]"
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+
+        &vpxor  (@X[0],@X[0],@X[-7&7]); # "X[0]"^="X[-28]"
+          &vmovdqa      (&QWP(64+16*(($Xi-4)%3),"esp"),@X[-4&7]);       # save X[] to backtrace buffer
+         eval(shift(@insns));
+         eval(shift(@insns));
+         if ($Xi%5) {
+          &vmovdqa      (@X[4],@X[3]);  # "perpetuate" K_XX_XX...
+         } else {                       # ... or load next one
+          &vmovdqa      (@X[4],&QWP(112-16+16*($Xi/5),"esp"));
+         }
+          &vpaddd       (@X[3],@X[3],@X[-1&7]);
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+        &vpxor  (@X[0],@X[0],@X[2]);            # "X[0]"^="X[-6]"
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+
+        &vpsrld (@X[2],@X[0],30);
+          &vmovdqa      (&QWP(0+16*(($Xi-1)&3),"esp"),@X[3]);   # X[]+K xfer to IALU
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+        &vpslld (@X[0],@X[0],2);
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+        &vpor   (@X[0],@X[0],@X[2]);    # "X[0]"<<<=2
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+          &vmovdqa      (@X[2],&QWP(64+16*(($Xi-6)%3),"esp")) if($Xi<19);       # restore X[] from backtrace buffer
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+         foreach (@insns) { eval; }     # remaining instructions
+
+  $Xi++;        push(@X,shift(@X));     # "rotate" X[]
+}
+
+sub Xuplast_avx_80()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 instructions
+  my ($a,$b,$c,$d,$e);
+
+         eval(shift(@insns));
+          &vpaddd       (@X[3],@X[3],@X[-1&7]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+          &vmovdqa      (&QWP(0+16*(($Xi-1)&3),"esp"),@X[3]);   # X[]+K xfer IALU
+
+         foreach (@insns) { eval; }             # remaining instructions
+
+        &mov    ($inp=@T[1],&DWP(192+4,"esp"));
+        &cmp    ($inp,&DWP(192+8,"esp"));
+        &je     (&label("done"));
+
+        &vmovdqa(@X[3],&QWP(112+48,"esp"));     # K_00_19
+        &vmovdqa(@X[2],&QWP(112+64,"esp"));     # pbswap mask
+        &vmovdqu(@X[-4&7],&QWP(0,$inp));        # load input
+        &vmovdqu(@X[-3&7],&QWP(16,$inp));
+        &vmovdqu(@X[-2&7],&QWP(32,$inp));
+        &vmovdqu(@X[-1&7],&QWP(48,$inp));
+        &add    ($inp,64);
+        &vpshufb(@X[-4&7],@X[-4&7],@X[2]);              # byte swap
+        &mov    (&DWP(192+4,"esp"),$inp);
+        &vmovdqa(&QWP(112-16,"esp"),@X[3]);     # borrow last backtrace slot
+
+  $Xi=0;
+}
+
+sub Xloop_avx()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 instructions
+  my ($a,$b,$c,$d,$e);
+
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vpshufb        (@X[($Xi-3)&7],@X[($Xi-3)&7],@X[2]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vpaddd (@X[$Xi&7],@X[($Xi-4)&7],@X[3]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vmovdqa        (&QWP(0+16*$Xi,"esp"),@X[$Xi&7]);       # X[]+K xfer to IALU
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        foreach (@insns) { eval; }
+  $Xi++;
+}
+
+sub Xtail_avx()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 instructions
+  my ($a,$b,$c,$d,$e);
+
+        foreach (@insns) { eval; }
+}
+
+&set_label("loop",16);
+        &Xupdate_avx_16_31(\&body_00_19);
+        &Xupdate_avx_16_31(\&body_00_19);
+        &Xupdate_avx_16_31(\&body_00_19);
+        &Xupdate_avx_16_31(\&body_00_19);
+        &Xupdate_avx_32_79(\&body_00_19);
+        &Xupdate_avx_32_79(\&body_20_39);
+        &Xupdate_avx_32_79(\&body_20_39);
+        &Xupdate_avx_32_79(\&body_20_39);
+        &Xupdate_avx_32_79(\&body_20_39);
+        &Xupdate_avx_32_79(\&body_20_39);
+        &Xupdate_avx_32_79(\&body_40_59);
+        &Xupdate_avx_32_79(\&body_40_59);
+        &Xupdate_avx_32_79(\&body_40_59);
+        &Xupdate_avx_32_79(\&body_40_59);
+        &Xupdate_avx_32_79(\&body_40_59);
+        &Xupdate_avx_32_79(\&body_20_39);
+        &Xuplast_avx_80(\&body_20_39);  # can jump to "done"
+
+                                $saved_j=$j; @saved_V=@V;
+
+        &Xloop_avx(\&body_20_39);
+        &Xloop_avx(\&body_20_39);
+        &Xloop_avx(\&body_20_39);
+
+        &mov    (@T[1],&DWP(192,"esp"));        # update context
+        &add    ($A,&DWP(0,@T[1]));
+        &add    (@T[0],&DWP(4,@T[1]));          # $b
+        &add    ($C,&DWP(8,@T[1]));
+        &mov    (&DWP(0,@T[1]),$A);
+        &add    ($D,&DWP(12,@T[1]));
+        &mov    (&DWP(4,@T[1]),@T[0]);
+        &add    ($E,&DWP(16,@T[1]));
+        &mov    (&DWP(8,@T[1]),$C);
+        &mov    ($B,@T[0]);
+        &mov    (&DWP(12,@T[1]),$D);
+        &mov    (&DWP(16,@T[1]),$E);
+
+        &jmp    (&label("loop"));
+
+&set_label("done",16);          $j=$saved_j; @V=@saved_V;
+
+        &Xtail_avx(\&body_20_39);
+        &Xtail_avx(\&body_20_39);
+        &Xtail_avx(\&body_20_39);
+
+        &vzeroall();
+
+        &mov    (@T[1],&DWP(192,"esp"));        # update context
+        &add    ($A,&DWP(0,@T[1]));
+        &mov    ("esp",&DWP(192+12,"esp"));     # restore %esp
+        &add    (@T[0],&DWP(4,@T[1]));          # $b
+        &add    ($C,&DWP(8,@T[1]));
+        &mov    (&DWP(0,@T[1]),$A);
+        &add    ($D,&DWP(12,@T[1]));
+        &mov    (&DWP(4,@T[1]),@T[0]);
+        &add    ($E,&DWP(16,@T[1]));
+        &mov    (&DWP(8,@T[1]),$C);
+        &mov    (&DWP(12,@T[1]),$D);
+        &mov    (&DWP(16,@T[1]),$E);
+&function_end("_sha1_block_data_order_avx");
+}
+&set_label("K_XX_XX",64);
+&data_word(0x5a827999,0x5a827999,0x5a827999,0x5a827999);        # K_00_19
+&data_word(0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1);        # K_20_39
+&data_word(0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc);        # K_40_59
+&data_word(0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6);        # K_60_79
+&data_word(0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f);        # pbswap mask
+}
 &asciz("SHA1 block transform for x86, CRYPTOGAMS by <appro\@openssl.org>");
 
 &asm_finish();
diff --git a/src/lib/libcrypto/sha/sha.h b/src/lib/libcrypto/sha/sha.h
index 16cacf9fc0..8a6bf4bbbb 100644
--- a/src/lib/libcrypto/sha/sha.h
+++ b/src/lib/libcrypto/sha/sha.h
@@ -106,6 +106,9 @@ typedef struct SHAstate_st
         } SHA_CTX;
 
 #ifndef OPENSSL_NO_SHA0
+#ifdef OPENSSL_FIPS
+int private_SHA_Init(SHA_CTX *c);
+#endif
 int SHA_Init(SHA_CTX *c);
 int SHA_Update(SHA_CTX *c, const void *data, size_t len);
 int SHA_Final(unsigned char *md, SHA_CTX *c);
@@ -113,6 +116,9 @@ unsigned char *SHA(const unsigned char *d, size_t n, unsigned char *md);
 void SHA_Transform(SHA_CTX *c, const unsigned char *data);
 #endif
 #ifndef OPENSSL_NO_SHA1
+#ifdef OPENSSL_FIPS
+int private_SHA1_Init(SHA_CTX *c);
+#endif
 int SHA1_Init(SHA_CTX *c);
 int SHA1_Update(SHA_CTX *c, const void *data, size_t len);
 int SHA1_Final(unsigned char *md, SHA_CTX *c);
@@ -135,6 +141,10 @@ typedef struct SHA256state_st
         } SHA256_CTX;
 
 #ifndef OPENSSL_NO_SHA256
+#ifdef OPENSSL_FIPS
+int private_SHA224_Init(SHA256_CTX *c);
+int private_SHA256_Init(SHA256_CTX *c);
+#endif
 int SHA224_Init(SHA256_CTX *c);
 int SHA224_Update(SHA256_CTX *c, const void *data, size_t len);
 int SHA224_Final(unsigned char *md, SHA256_CTX *c);
@@ -182,6 +192,10 @@ typedef struct SHA512state_st
 #endif
 
 #ifndef OPENSSL_NO_SHA512
+#ifdef OPENSSL_FIPS
+int private_SHA384_Init(SHA512_CTX *c);
+int private_SHA512_Init(SHA512_CTX *c);
+#endif
 int SHA384_Init(SHA512_CTX *c);
 int SHA384_Update(SHA512_CTX *c, const void *data, size_t len);
 int SHA384_Final(unsigned char *md, SHA512_CTX *c);
diff --git a/src/lib/libcrypto/sha/sha1dgst.c b/src/lib/libcrypto/sha/sha1dgst.c
index 50d1925cde..81219af088 100644
--- a/src/lib/libcrypto/sha/sha1dgst.c
+++ b/src/lib/libcrypto/sha/sha1dgst.c
@@ -57,6 +57,7 @@
  */
 
 #include <openssl/opensslconf.h>
+#include <openssl/crypto.h>
 #if !defined(OPENSSL_NO_SHA1) && !defined(OPENSSL_NO_SHA)
 
 #undef  SHA_0
diff --git a/src/lib/libcrypto/sha/sha_dgst.c b/src/lib/libcrypto/sha/sha_dgst.c
index 70eb56032c..c946ad827d 100644
--- a/src/lib/libcrypto/sha/sha_dgst.c
+++ b/src/lib/libcrypto/sha/sha_dgst.c
@@ -57,6 +57,7 @@
  */
 
 #include <openssl/opensslconf.h>
+#include <openssl/crypto.h>
 #if !defined(OPENSSL_NO_SHA0) && !defined(OPENSSL_NO_SHA)
 
 #undef  SHA_1
diff --git a/src/lib/libcrypto/sha/sha_locl.h b/src/lib/libcrypto/sha/sha_locl.h
index 672c26eee1..7a0c3ca8d8 100644
--- a/src/lib/libcrypto/sha/sha_locl.h
+++ b/src/lib/libcrypto/sha/sha_locl.h
@@ -122,7 +122,11 @@ void sha1_block_data_order (SHA_CTX *c, const void *p,size_t num);
 #define INIT_DATA_h3 0x10325476UL
 #define INIT_DATA_h4 0xc3d2e1f0UL
 
-int HASH_INIT (SHA_CTX *c)
+#ifdef SHA_0
+fips_md_init(SHA)
+#else
+fips_md_init_ctx(SHA1, SHA)
+#endif
         {
         memset (c,0,sizeof(*c));
         c->h0=INIT_DATA_h0;
diff --git a/src/lib/libcrypto/stack/safestack.h b/src/lib/libcrypto/stack/safestack.h
index 3e76aa58f5..ea3aa0d800 100644
--- a/src/lib/libcrypto/stack/safestack.h
+++ b/src/lib/libcrypto/stack/safestack.h
@@ -1459,6 +1459,94 @@ DECLARE_SPECIAL_STACK_OF(OPENSSL_BLOCK, void)
 #define sk_POLICY_MAPPING_sort(st) SKM_sk_sort(POLICY_MAPPING, (st))
 #define sk_POLICY_MAPPING_is_sorted(st) SKM_sk_is_sorted(POLICY_MAPPING, (st))
 
+#define sk_SRP_gN_new(cmp) SKM_sk_new(SRP_gN, (cmp))
+#define sk_SRP_gN_new_null() SKM_sk_new_null(SRP_gN)
+#define sk_SRP_gN_free(st) SKM_sk_free(SRP_gN, (st))
+#define sk_SRP_gN_num(st) SKM_sk_num(SRP_gN, (st))
+#define sk_SRP_gN_value(st, i) SKM_sk_value(SRP_gN, (st), (i))
+#define sk_SRP_gN_set(st, i, val) SKM_sk_set(SRP_gN, (st), (i), (val))
+#define sk_SRP_gN_zero(st) SKM_sk_zero(SRP_gN, (st))
+#define sk_SRP_gN_push(st, val) SKM_sk_push(SRP_gN, (st), (val))
+#define sk_SRP_gN_unshift(st, val) SKM_sk_unshift(SRP_gN, (st), (val))
+#define sk_SRP_gN_find(st, val) SKM_sk_find(SRP_gN, (st), (val))
+#define sk_SRP_gN_find_ex(st, val) SKM_sk_find_ex(SRP_gN, (st), (val))
+#define sk_SRP_gN_delete(st, i) SKM_sk_delete(SRP_gN, (st), (i))
+#define sk_SRP_gN_delete_ptr(st, ptr) SKM_sk_delete_ptr(SRP_gN, (st), (ptr))
+#define sk_SRP_gN_insert(st, val, i) SKM_sk_insert(SRP_gN, (st), (val), (i))
+#define sk_SRP_gN_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SRP_gN, (st), (cmp))
+#define sk_SRP_gN_dup(st) SKM_sk_dup(SRP_gN, st)
+#define sk_SRP_gN_pop_free(st, free_func) SKM_sk_pop_free(SRP_gN, (st), (free_func))
+#define sk_SRP_gN_shift(st) SKM_sk_shift(SRP_gN, (st))
+#define sk_SRP_gN_pop(st) SKM_sk_pop(SRP_gN, (st))
+#define sk_SRP_gN_sort(st) SKM_sk_sort(SRP_gN, (st))
+#define sk_SRP_gN_is_sorted(st) SKM_sk_is_sorted(SRP_gN, (st))
+
+#define sk_SRP_gN_cache_new(cmp) SKM_sk_new(SRP_gN_cache, (cmp))
+#define sk_SRP_gN_cache_new_null() SKM_sk_new_null(SRP_gN_cache)
+#define sk_SRP_gN_cache_free(st) SKM_sk_free(SRP_gN_cache, (st))
+#define sk_SRP_gN_cache_num(st) SKM_sk_num(SRP_gN_cache, (st))
+#define sk_SRP_gN_cache_value(st, i) SKM_sk_value(SRP_gN_cache, (st), (i))
+#define sk_SRP_gN_cache_set(st, i, val) SKM_sk_set(SRP_gN_cache, (st), (i), (val))
+#define sk_SRP_gN_cache_zero(st) SKM_sk_zero(SRP_gN_cache, (st))
+#define sk_SRP_gN_cache_push(st, val) SKM_sk_push(SRP_gN_cache, (st), (val))
+#define sk_SRP_gN_cache_unshift(st, val) SKM_sk_unshift(SRP_gN_cache, (st), (val))
+#define sk_SRP_gN_cache_find(st, val) SKM_sk_find(SRP_gN_cache, (st), (val))
+#define sk_SRP_gN_cache_find_ex(st, val) SKM_sk_find_ex(SRP_gN_cache, (st), (val))
+#define sk_SRP_gN_cache_delete(st, i) SKM_sk_delete(SRP_gN_cache, (st), (i))
+#define sk_SRP_gN_cache_delete_ptr(st, ptr) SKM_sk_delete_ptr(SRP_gN_cache, (st), (ptr))
+#define sk_SRP_gN_cache_insert(st, val, i) SKM_sk_insert(SRP_gN_cache, (st), (val), (i))
+#define sk_SRP_gN_cache_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SRP_gN_cache, (st), (cmp))
+#define sk_SRP_gN_cache_dup(st) SKM_sk_dup(SRP_gN_cache, st)
+#define sk_SRP_gN_cache_pop_free(st, free_func) SKM_sk_pop_free(SRP_gN_cache, (st), (free_func))
+#define sk_SRP_gN_cache_shift(st) SKM_sk_shift(SRP_gN_cache, (st))
+#define sk_SRP_gN_cache_pop(st) SKM_sk_pop(SRP_gN_cache, (st))
+#define sk_SRP_gN_cache_sort(st) SKM_sk_sort(SRP_gN_cache, (st))
+#define sk_SRP_gN_cache_is_sorted(st) SKM_sk_is_sorted(SRP_gN_cache, (st))
+
+#define sk_SRP_user_pwd_new(cmp) SKM_sk_new(SRP_user_pwd, (cmp))
+#define sk_SRP_user_pwd_new_null() SKM_sk_new_null(SRP_user_pwd)
+#define sk_SRP_user_pwd_free(st) SKM_sk_free(SRP_user_pwd, (st))
+#define sk_SRP_user_pwd_num(st) SKM_sk_num(SRP_user_pwd, (st))
+#define sk_SRP_user_pwd_value(st, i) SKM_sk_value(SRP_user_pwd, (st), (i))
+#define sk_SRP_user_pwd_set(st, i, val) SKM_sk_set(SRP_user_pwd, (st), (i), (val))
+#define sk_SRP_user_pwd_zero(st) SKM_sk_zero(SRP_user_pwd, (st))
+#define sk_SRP_user_pwd_push(st, val) SKM_sk_push(SRP_user_pwd, (st), (val))
+#define sk_SRP_user_pwd_unshift(st, val) SKM_sk_unshift(SRP_user_pwd, (st), (val))
+#define sk_SRP_user_pwd_find(st, val) SKM_sk_find(SRP_user_pwd, (st), (val))
+#define sk_SRP_user_pwd_find_ex(st, val) SKM_sk_find_ex(SRP_user_pwd, (st), (val))
+#define sk_SRP_user_pwd_delete(st, i) SKM_sk_delete(SRP_user_pwd, (st), (i))
+#define sk_SRP_user_pwd_delete_ptr(st, ptr) SKM_sk_delete_ptr(SRP_user_pwd, (st), (ptr))
+#define sk_SRP_user_pwd_insert(st, val, i) SKM_sk_insert(SRP_user_pwd, (st), (val), (i))
+#define sk_SRP_user_pwd_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SRP_user_pwd, (st), (cmp))
+#define sk_SRP_user_pwd_dup(st) SKM_sk_dup(SRP_user_pwd, st)
+#define sk_SRP_user_pwd_pop_free(st, free_func) SKM_sk_pop_free(SRP_user_pwd, (st), (free_func))
+#define sk_SRP_user_pwd_shift(st) SKM_sk_shift(SRP_user_pwd, (st))
+#define sk_SRP_user_pwd_pop(st) SKM_sk_pop(SRP_user_pwd, (st))
+#define sk_SRP_user_pwd_sort(st) SKM_sk_sort(SRP_user_pwd, (st))
+#define sk_SRP_user_pwd_is_sorted(st) SKM_sk_is_sorted(SRP_user_pwd, (st))
+
+#define sk_SRTP_PROTECTION_PROFILE_new(cmp) SKM_sk_new(SRTP_PROTECTION_PROFILE, (cmp))
+#define sk_SRTP_PROTECTION_PROFILE_new_null() SKM_sk_new_null(SRTP_PROTECTION_PROFILE)
+#define sk_SRTP_PROTECTION_PROFILE_free(st) SKM_sk_free(SRTP_PROTECTION_PROFILE, (st))
+#define sk_SRTP_PROTECTION_PROFILE_num(st) SKM_sk_num(SRTP_PROTECTION_PROFILE, (st))
+#define sk_SRTP_PROTECTION_PROFILE_value(st, i) SKM_sk_value(SRTP_PROTECTION_PROFILE, (st), (i))
+#define sk_SRTP_PROTECTION_PROFILE_set(st, i, val) SKM_sk_set(SRTP_PROTECTION_PROFILE, (st), (i), (val))
+#define sk_SRTP_PROTECTION_PROFILE_zero(st) SKM_sk_zero(SRTP_PROTECTION_PROFILE, (st))
+#define sk_SRTP_PROTECTION_PROFILE_push(st, val) SKM_sk_push(SRTP_PROTECTION_PROFILE, (st), (val))
+#define sk_SRTP_PROTECTION_PROFILE_unshift(st, val) SKM_sk_unshift(SRTP_PROTECTION_PROFILE, (st), (val))
+#define sk_SRTP_PROTECTION_PROFILE_find(st, val) SKM_sk_find(SRTP_PROTECTION_PROFILE, (st), (val))
+#define sk_SRTP_PROTECTION_PROFILE_find_ex(st, val) SKM_sk_find_ex(SRTP_PROTECTION_PROFILE, (st), (val))
+#define sk_SRTP_PROTECTION_PROFILE_delete(st, i) SKM_sk_delete(SRTP_PROTECTION_PROFILE, (st), (i))
+#define sk_SRTP_PROTECTION_PROFILE_delete_ptr(st, ptr) SKM_sk_delete_ptr(SRTP_PROTECTION_PROFILE, (st), (ptr))
+#define sk_SRTP_PROTECTION_PROFILE_insert(st, val, i) SKM_sk_insert(SRTP_PROTECTION_PROFILE, (st), (val), (i))
+#define sk_SRTP_PROTECTION_PROFILE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SRTP_PROTECTION_PROFILE, (st), (cmp))
+#define sk_SRTP_PROTECTION_PROFILE_dup(st) SKM_sk_dup(SRTP_PROTECTION_PROFILE, st)
+#define sk_SRTP_PROTECTION_PROFILE_pop_free(st, free_func) SKM_sk_pop_free(SRTP_PROTECTION_PROFILE, (st), (free_func))
+#define sk_SRTP_PROTECTION_PROFILE_shift(st) SKM_sk_shift(SRTP_PROTECTION_PROFILE, (st))
+#define sk_SRTP_PROTECTION_PROFILE_pop(st) SKM_sk_pop(SRTP_PROTECTION_PROFILE, (st))
+#define sk_SRTP_PROTECTION_PROFILE_sort(st) SKM_sk_sort(SRTP_PROTECTION_PROFILE, (st))
+#define sk_SRTP_PROTECTION_PROFILE_is_sorted(st) SKM_sk_is_sorted(SRTP_PROTECTION_PROFILE, (st))
+
 #define sk_SSL_CIPHER_new(cmp) SKM_sk_new(SSL_CIPHER, (cmp))
 #define sk_SSL_CIPHER_new_null() SKM_sk_new_null(SSL_CIPHER)
 #define sk_SSL_CIPHER_free(st) SKM_sk_free(SSL_CIPHER, (st))
@@ -2056,31 +2144,6 @@ DECLARE_SPECIAL_STACK_OF(OPENSSL_BLOCK, void)
 #define sk_OPENSSL_STRING_is_sorted(st) SKM_sk_is_sorted(OPENSSL_STRING, (st))
 
 
-#define sk_OPENSSL_PSTRING_new(cmp) ((STACK_OF(OPENSSL_PSTRING) *)sk_new(CHECKED_SK_CMP_FUNC(OPENSSL_STRING, cmp)))
-#define sk_OPENSSL_PSTRING_new_null() ((STACK_OF(OPENSSL_PSTRING) *)sk_new_null())
-#define sk_OPENSSL_PSTRING_push(st, val) sk_push(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val))
-#define sk_OPENSSL_PSTRING_find(st, val) sk_find(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val))
-#define sk_OPENSSL_PSTRING_value(st, i) ((OPENSSL_PSTRING)sk_value(CHECKED_STACK_OF(OPENSSL_PSTRING, st), i))
-#define sk_OPENSSL_PSTRING_num(st) SKM_sk_num(OPENSSL_PSTRING, st)
-#define sk_OPENSSL_PSTRING_pop_free(st, free_func) sk_pop_free(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_SK_FREE_FUNC2(OPENSSL_PSTRING, free_func))
-#define sk_OPENSSL_PSTRING_insert(st, val, i) sk_insert(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val), i)
-#define sk_OPENSSL_PSTRING_free(st) SKM_sk_free(OPENSSL_PSTRING, st)
-#define sk_OPENSSL_PSTRING_set(st, i, val) sk_set(CHECKED_STACK_OF(OPENSSL_PSTRING, st), i, CHECKED_PTR_OF(OPENSSL_STRING, val))
-#define sk_OPENSSL_PSTRING_zero(st) SKM_sk_zero(OPENSSL_PSTRING, (st))
-#define sk_OPENSSL_PSTRING_unshift(st, val) sk_unshift(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val))
-#define sk_OPENSSL_PSTRING_find_ex(st, val) sk_find_ex((_STACK *)CHECKED_CONST_PTR_OF(STACK_OF(OPENSSL_PSTRING), st), CHECKED_CONST_PTR_OF(OPENSSL_STRING, val))
-#define sk_OPENSSL_PSTRING_delete(st, i) SKM_sk_delete(OPENSSL_PSTRING, (st), (i))
-#define sk_OPENSSL_PSTRING_delete_ptr(st, ptr) (OPENSSL_PSTRING *)sk_delete_ptr(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, ptr))
-#define sk_OPENSSL_PSTRING_set_cmp_func(st, cmp)  \
-        ((int (*)(const OPENSSL_STRING * const *,const OPENSSL_STRING * const *)) \
-        sk_set_cmp_func(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_SK_CMP_FUNC(OPENSSL_STRING, cmp)))
-#define sk_OPENSSL_PSTRING_dup(st) SKM_sk_dup(OPENSSL_PSTRING, st)
-#define sk_OPENSSL_PSTRING_shift(st) SKM_sk_shift(OPENSSL_PSTRING, (st))
-#define sk_OPENSSL_PSTRING_pop(st) (OPENSSL_STRING *)sk_pop(CHECKED_STACK_OF(OPENSSL_PSTRING, st))
-#define sk_OPENSSL_PSTRING_sort(st) SKM_sk_sort(OPENSSL_PSTRING, (st))
-#define sk_OPENSSL_PSTRING_is_sorted(st) SKM_sk_is_sorted(OPENSSL_PSTRING, (st))
-
-
 #define sk_OPENSSL_BLOCK_new(cmp) ((STACK_OF(OPENSSL_BLOCK) *)sk_new(CHECKED_SK_CMP_FUNC(void, cmp)))
 #define sk_OPENSSL_BLOCK_new_null() ((STACK_OF(OPENSSL_BLOCK) *)sk_new_null())
 #define sk_OPENSSL_BLOCK_push(st, val) sk_push(CHECKED_STACK_OF(OPENSSL_BLOCK, st), CHECKED_PTR_OF(void, val))
@@ -2106,6 +2169,31 @@ DECLARE_SPECIAL_STACK_OF(OPENSSL_BLOCK, void)
 #define sk_OPENSSL_BLOCK_is_sorted(st) SKM_sk_is_sorted(OPENSSL_BLOCK, (st))
 
 
+#define sk_OPENSSL_PSTRING_new(cmp) ((STACK_OF(OPENSSL_PSTRING) *)sk_new(CHECKED_SK_CMP_FUNC(OPENSSL_STRING, cmp)))
+#define sk_OPENSSL_PSTRING_new_null() ((STACK_OF(OPENSSL_PSTRING) *)sk_new_null())
+#define sk_OPENSSL_PSTRING_push(st, val) sk_push(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val))
+#define sk_OPENSSL_PSTRING_find(st, val) sk_find(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val))
+#define sk_OPENSSL_PSTRING_value(st, i) ((OPENSSL_PSTRING)sk_value(CHECKED_STACK_OF(OPENSSL_PSTRING, st), i))
+#define sk_OPENSSL_PSTRING_num(st) SKM_sk_num(OPENSSL_PSTRING, st)
+#define sk_OPENSSL_PSTRING_pop_free(st, free_func) sk_pop_free(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_SK_FREE_FUNC2(OPENSSL_PSTRING, free_func))
+#define sk_OPENSSL_PSTRING_insert(st, val, i) sk_insert(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val), i)
+#define sk_OPENSSL_PSTRING_free(st) SKM_sk_free(OPENSSL_PSTRING, st)
+#define sk_OPENSSL_PSTRING_set(st, i, val) sk_set(CHECKED_STACK_OF(OPENSSL_PSTRING, st), i, CHECKED_PTR_OF(OPENSSL_STRING, val))
+#define sk_OPENSSL_PSTRING_zero(st) SKM_sk_zero(OPENSSL_PSTRING, (st))
+#define sk_OPENSSL_PSTRING_unshift(st, val) sk_unshift(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val))
+#define sk_OPENSSL_PSTRING_find_ex(st, val) sk_find_ex((_STACK *)CHECKED_CONST_PTR_OF(STACK_OF(OPENSSL_PSTRING), st), CHECKED_CONST_PTR_OF(OPENSSL_STRING, val))
+#define sk_OPENSSL_PSTRING_delete(st, i) SKM_sk_delete(OPENSSL_PSTRING, (st), (i))
+#define sk_OPENSSL_PSTRING_delete_ptr(st, ptr) (OPENSSL_PSTRING *)sk_delete_ptr(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, ptr))
+#define sk_OPENSSL_PSTRING_set_cmp_func(st, cmp)  \
+        ((int (*)(const OPENSSL_STRING * const *,const OPENSSL_STRING * const *)) \
+        sk_set_cmp_func(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_SK_CMP_FUNC(OPENSSL_STRING, cmp)))
+#define sk_OPENSSL_PSTRING_dup(st) SKM_sk_dup(OPENSSL_PSTRING, st)
+#define sk_OPENSSL_PSTRING_shift(st) SKM_sk_shift(OPENSSL_PSTRING, (st))
+#define sk_OPENSSL_PSTRING_pop(st) (OPENSSL_STRING *)sk_pop(CHECKED_STACK_OF(OPENSSL_PSTRING, st))
+#define sk_OPENSSL_PSTRING_sort(st) SKM_sk_sort(OPENSSL_PSTRING, (st))
+#define sk_OPENSSL_PSTRING_is_sorted(st) SKM_sk_is_sorted(OPENSSL_PSTRING, (st))
+
+
 #define d2i_ASN1_SET_OF_ACCESS_DESCRIPTION(st, pp, length, d2i_func, free_func, ex_tag, ex_class) \
         SKM_ASN1_SET_OF_d2i(ACCESS_DESCRIPTION, (st), (pp), (length), (d2i_func), (free_func), (ex_tag), (ex_class)) 
 #define i2d_ASN1_SET_OF_ACCESS_DESCRIPTION(st, pp, i2d_func, ex_tag, ex_class, is_set) \
diff --git a/src/lib/libcrypto/symhacks.h b/src/lib/libcrypto/symhacks.h
index 3fd4a81692..403f592dcd 100644
--- a/src/lib/libcrypto/symhacks.h
+++ b/src/lib/libcrypto/symhacks.h
@@ -176,7 +176,6 @@
 #define SSL_CTX_set_default_passwd_cb_userdata  SSL_CTX_set_def_passwd_cb_ud
 #undef SSL_COMP_get_compression_methods
 #define SSL_COMP_get_compression_methods        SSL_COMP_get_compress_methods
-
 #undef ssl_add_clienthello_renegotiate_ext
 #define ssl_add_clienthello_renegotiate_ext     ssl_add_clienthello_reneg_ext
 #undef ssl_add_serverhello_renegotiate_ext
@@ -185,6 +184,26 @@
 #define ssl_parse_clienthello_renegotiate_ext   ssl_parse_clienthello_reneg_ext
 #undef ssl_parse_serverhello_renegotiate_ext
 #define ssl_parse_serverhello_renegotiate_ext   ssl_parse_serverhello_reneg_ext
+#undef SSL_srp_server_param_with_username
+#define SSL_srp_server_param_with_username      SSL_srp_server_param_with_un
+#undef SSL_CTX_set_srp_client_pwd_callback
+#define SSL_CTX_set_srp_client_pwd_callback     SSL_CTX_set_srp_client_pwd_cb
+#undef SSL_CTX_set_srp_verify_param_callback
+#define SSL_CTX_set_srp_verify_param_callback   SSL_CTX_set_srp_vfy_param_cb
+#undef SSL_CTX_set_srp_username_callback
+#define SSL_CTX_set_srp_username_callback       SSL_CTX_set_srp_un_cb
+#undef ssl_add_clienthello_use_srtp_ext
+#define ssl_add_clienthello_use_srtp_ext ssl_add_clihello_use_srtp_ext
+#undef ssl_add_serverhello_use_srtp_ext
+#define ssl_add_serverhello_use_srtp_ext ssl_add_serhello_use_srtp_ext
+#undef ssl_parse_clienthello_use_srtp_ext
+#define ssl_parse_clienthello_use_srtp_ext ssl_parse_clihello_use_srtp_ext
+#undef ssl_parse_serverhello_use_srtp_ext
+#define ssl_parse_serverhello_use_srtp_ext ssl_parse_serhello_use_srtp_ext
+#undef SSL_CTX_set_next_protos_advertised_cb
+#define SSL_CTX_set_next_protos_advertised_cb SSL_CTX_set_next_protos_adv_cb
+#undef SSL_CTX_set_next_proto_select_cb
+#define SSL_CTX_set_next_proto_select_cb SSL_CTX_set_next_proto_sel_cb
 
 /* Hack some long ENGINE names */
 #undef ENGINE_get_default_BN_mod_exp_crt
@@ -238,6 +257,9 @@
 #define EC_GROUP_get_point_conversion_form      EC_GROUP_get_point_conv_form
 #undef EC_GROUP_clear_free_all_extra_data
 #define EC_GROUP_clear_free_all_extra_data      EC_GROUP_clr_free_all_xtra_data
+#undef EC_KEY_set_public_key_affine_coordinates
+#define EC_KEY_set_public_key_affine_coordinates \
+                                                EC_KEY_set_pub_key_aff_coords
 #undef EC_POINT_set_Jprojective_coordinates_GFp
 #define EC_POINT_set_Jprojective_coordinates_GFp \
                                                 EC_POINT_set_Jproj_coords_GFp
@@ -399,6 +421,12 @@
 #undef dtls1_retransmit_buffered_messages
 #define dtls1_retransmit_buffered_messages      dtls1_retransmit_buffered_msgs
 
+/* Hack some long SRP names */
+#undef SRP_generate_server_master_secret
+#define SRP_generate_server_master_secret       SRP_gen_server_master_secret
+#undef SRP_generate_client_master_secret
+#define SRP_generate_client_master_secret       SRP_gen_client_master_secret
+
 /* Hack some long UI names */
 #undef UI_method_get_prompt_constructor
 #define UI_method_get_prompt_constructor        UI_method_get_prompt_constructr
diff --git a/src/lib/libcrypto/ts/ts_rsp_verify.c b/src/lib/libcrypto/ts/ts_rsp_verify.c
index ed0252d7d7..a003207428 100644
--- a/src/lib/libcrypto/ts/ts_rsp_verify.c
+++ b/src/lib/libcrypto/ts/ts_rsp_verify.c
@@ -616,12 +616,15 @@ static int TS_compute_imprint(BIO *data, TS_TST_INFO *tst_info,
                 goto err;
                 }
 
-        EVP_DigestInit(&md_ctx, md);
+        if (!EVP_DigestInit(&md_ctx, md))
+                goto err;
         while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0)
                 {
-                EVP_DigestUpdate(&md_ctx, buffer, length);
+                if (!EVP_DigestUpdate(&md_ctx, buffer, length))
+                        goto err;
                 }
-        EVP_DigestFinal(&md_ctx, *imprint, NULL);
+        if (!EVP_DigestFinal(&md_ctx, *imprint, NULL))
+                goto err;
 
         return 1;
  err:
diff --git a/src/lib/libcrypto/ui/ui.h b/src/lib/libcrypto/ui/ui.h
index 2b1cfa2289..bd78aa413f 100644
--- a/src/lib/libcrypto/ui/ui.h
+++ b/src/lib/libcrypto/ui/ui.h
@@ -316,7 +316,7 @@ int (*UI_method_get_writer(UI_METHOD *method))(UI*,UI_STRING*);
 int (*UI_method_get_flusher(UI_METHOD *method))(UI*);
 int (*UI_method_get_reader(UI_METHOD *method))(UI*,UI_STRING*);
 int (*UI_method_get_closer(UI_METHOD *method))(UI*);
-char* (*UI_method_get_prompt_constructor(UI_METHOD *method))(UI*, const char*, const char*);
+char * (*UI_method_get_prompt_constructor(UI_METHOD *method))(UI*, const char*, const char*);
 
 /* The following functions are helpers for method writers to access relevant
    data from a UI_STRING. */
diff --git a/src/lib/libcrypto/ui/ui_openssl.c b/src/lib/libcrypto/ui/ui_openssl.c
index 1e3dba0833..e319faa47b 100644
--- a/src/lib/libcrypto/ui/ui_openssl.c
+++ b/src/lib/libcrypto/ui/ui_openssl.c
@@ -122,7 +122,7 @@
  * sigaction and fileno included. -pedantic would be more appropriate for
  * the intended purposes, but we can't prevent users from adding -ansi.
  */
-#ifndef _POSIX_C_SOURCE
+#if !defined(_POSIX_C_SOURCE) && defined(OPENSSL_SYS_VMS)
 #define _POSIX_C_SOURCE 2
 #endif
 #include <signal.h>
diff --git a/src/lib/libcrypto/util/cygwin.sh b/src/lib/libcrypto/util/cygwin.sh
index d6228521e6..cfdb04d2a4 100644
--- a/src/lib/libcrypto/util/cygwin.sh
+++ b/src/lib/libcrypto/util/cygwin.sh
@@ -11,6 +11,7 @@ CONFIG_OPTIONS="--prefix=/usr shared zlib no-idea no-rc5"
 INSTALL_PREFIX=/tmp/install/INSTALL
 
 VERSION=
+SHLIB_VERSION_NUMBER=
 SUBVERSION=$1
 
 function cleanup()
@@ -28,6 +29,13 @@ function get_openssl_version()
     echo "       Check value of variable VERSION in Makefile."
     exit 1
   fi
+  eval `grep '^SHLIB_VERSION_NUMBER=' Makefile`
+  if [ -z "${SHLIB_VERSION_NUMBER}" ]
+  then
+    echo "Error: Couldn't retrieve OpenSSL shared lib version from Makefile."
+    echo " Check value of variable SHLIB_VERSION_NUMBER in Makefile."
+    exit 1
+  fi
 }
 
 function base_install()
@@ -124,7 +132,7 @@ strip usr/bin/*.exe usr/bin/*.dll usr/lib/engines/*.so
 chmod u-w usr/lib/engines/*.so
 
 # Runtime package
-tar cjf libopenssl${VERSION//[!0-9]/}-${VERSION}-${SUBVERSION}.tar.bz2 \
+tar cjf libopenssl${SHLIB_VERSION_NUMBER//[!0-9]/}-${VERSION}-${SUBVERSION}.tar.bz2 \
      usr/bin/cyg*dll
 # Base package
 find etc usr/bin/openssl.exe usr/bin/c_rehash usr/lib/engines usr/share/doc \
@@ -139,7 +147,7 @@ tar cjfT openssl-devel-${VERSION}-${SUBVERSION}.tar.bz2 -
 
 ls -l openssl-${VERSION}-${SUBVERSION}.tar.bz2
 ls -l openssl-devel-${VERSION}-${SUBVERSION}.tar.bz2
-ls -l libopenssl${VERSION//[!0-9]/}-${VERSION}-${SUBVERSION}.tar.bz2
+ls -l libopenssl${SHLIB_VERSION_NUMBER//[!0-9]/}-${VERSION}-${SUBVERSION}.tar.bz2
 
 cleanup
 
diff --git a/src/lib/libcrypto/util/libeay.num b/src/lib/libcrypto/util/libeay.num
index 1467ab6243..93f80ba0c6 100644
--- a/src/lib/libcrypto/util/libeay.num
+++ b/src/lib/libcrypto/util/libeay.num
@@ -1050,7 +1050,7 @@ ASN1_TYPE_get_octetstring               1077	EXIST::FUNCTION:
 ASN1_TYPE_set_int_octetstring           1078    EXIST::FUNCTION:
 ASN1_TYPE_set_octetstring               1079    EXIST::FUNCTION:
 ASN1_UTCTIME_set_string                 1080    EXIST::FUNCTION:
-ERR_add_error_data                      1081    EXIST::FUNCTION:BIO
+ERR_add_error_data                      1081    EXIST::FUNCTION:
 ERR_set_error_data                      1082    EXIST::FUNCTION:
 EVP_CIPHER_asn1_to_param                1083    EXIST::FUNCTION:
 EVP_CIPHER_param_to_asn1                1084    EXIST::FUNCTION:
@@ -2808,7 +2808,7 @@ FIPS_corrupt_rsa                        3249	NOEXIST::FUNCTION:
 FIPS_selftest_des                       3250    NOEXIST::FUNCTION:
 EVP_aes_128_cfb1                        3251    EXIST::FUNCTION:AES
 EVP_aes_192_cfb8                        3252    EXIST::FUNCTION:AES
-FIPS_mode_set                           3253    NOEXIST::FUNCTION:
+FIPS_mode_set                           3253    EXIST::FUNCTION:
 FIPS_selftest_dsa                       3254    NOEXIST::FUNCTION:
 EVP_aes_256_cfb8                        3255    EXIST::FUNCTION:AES
 FIPS_allow_md5                          3256    NOEXIST::FUNCTION:
@@ -2838,23 +2838,23 @@ AES_cfb1_encrypt                        3279	EXIST::FUNCTION:AES
 EVP_des_ede3_cfb1                       3280    EXIST::FUNCTION:DES
 FIPS_rand_check                         3281    NOEXIST::FUNCTION:
 FIPS_md5_allowed                        3282    NOEXIST::FUNCTION:
-FIPS_mode                               3283    NOEXIST::FUNCTION:
+FIPS_mode                               3283    EXIST::FUNCTION:
 FIPS_selftest_failed                    3284    NOEXIST::FUNCTION:
 sk_is_sorted                            3285    EXIST::FUNCTION:
 X509_check_ca                           3286    EXIST::FUNCTION:
-private_idea_set_encrypt_key            3287    NOEXIST::FUNCTION:
+private_idea_set_encrypt_key            3287    EXIST:OPENSSL_FIPS:FUNCTION:IDEA
 HMAC_CTX_set_flags                      3288    EXIST::FUNCTION:HMAC
-private_SHA_Init                        3289    NOEXIST::FUNCTION:
-private_CAST_set_key                    3290    NOEXIST::FUNCTION:
-private_RIPEMD160_Init                  3291    NOEXIST::FUNCTION:
+private_SHA_Init                        3289    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA0
+private_CAST_set_key                    3290    EXIST:OPENSSL_FIPS:FUNCTION:CAST
+private_RIPEMD160_Init                  3291    EXIST:OPENSSL_FIPS:FUNCTION:RIPEMD
 private_RC5_32_set_key                  3292    NOEXIST::FUNCTION:
-private_MD5_Init                        3293    NOEXIST::FUNCTION:
-private_RC4_set_key                     3294    NOEXIST::FUNCTION:
-private_MDC2_Init                       3295    NOEXIST::FUNCTION:
-private_RC2_set_key                     3296    NOEXIST::FUNCTION:
-private_MD4_Init                        3297    NOEXIST::FUNCTION:
-private_BF_set_key                      3298    NOEXIST::FUNCTION:
-private_MD2_Init                        3299    NOEXIST::FUNCTION:
+private_MD5_Init                        3293    EXIST:OPENSSL_FIPS:FUNCTION:MD5
+private_RC4_set_key                     3294    EXIST::FUNCTION:RC4
+private_MDC2_Init                       3295    EXIST:OPENSSL_FIPS:FUNCTION:MDC2
+private_RC2_set_key                     3296    EXIST:OPENSSL_FIPS:FUNCTION:RC2
+private_MD4_Init                        3297    EXIST:OPENSSL_FIPS:FUNCTION:MD4
+private_BF_set_key                      3298    EXIST:OPENSSL_FIPS:FUNCTION:BF
+private_MD2_Init                        3299    EXIST:OPENSSL_FIPS:FUNCTION:MD2
 d2i_PROXY_CERT_INFO_EXTENSION           3300    EXIST::FUNCTION:
 PROXY_POLICY_it                         3301    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
 PROXY_POLICY_it                         3301    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
@@ -2882,7 +2882,7 @@ RSA_verify_PKCS1_PSS                    3321	EXIST::FUNCTION:RSA
 RSA_padding_add_X931                    3322    EXIST::FUNCTION:RSA
 RSA_padding_add_PKCS1_PSS               3323    EXIST::FUNCTION:RSA
 PKCS1_MGF1                              3324    EXIST::FUNCTION:RSA
-BN_X931_generate_Xpq                    3325    NOEXIST::FUNCTION:
+BN_X931_generate_Xpq                    3325    EXIST::FUNCTION:
 RSA_X931_generate_key                   3326    NOEXIST::FUNCTION:
 BN_X931_derive_prime                    3327    NOEXIST::FUNCTION:
 BN_X931_generate_prime                  3328    NOEXIST::FUNCTION:
@@ -2906,7 +2906,7 @@ STORE_parse_attrs_start                 3343	NOEXIST::FUNCTION:
 POLICY_CONSTRAINTS_free                 3344    EXIST::FUNCTION:
 EVP_PKEY_add1_attr_by_NID               3345    EXIST::FUNCTION:
 BN_nist_mod_192                         3346    EXIST::FUNCTION:
-EC_GROUP_get_trinomial_basis            3347    EXIST::FUNCTION:EC
+EC_GROUP_get_trinomial_basis            3347    EXIST::FUNCTION:EC,EC2M
 STORE_set_method                        3348    NOEXIST::FUNCTION:
 GENERAL_SUBTREE_free                    3349    EXIST::FUNCTION:
 NAME_CONSTRAINTS_it                     3350    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
@@ -2921,14 +2921,14 @@ SHA512_Update                           3356	EXIST:!VMSVAX:FUNCTION:SHA,SHA512
 i2d_ECPrivateKey                        3357    EXIST::FUNCTION:EC
 BN_get0_nist_prime_192                  3358    EXIST::FUNCTION:
 STORE_modify_certificate                3359    NOEXIST::FUNCTION:
-EC_POINT_set_affine_coordinates_GF2m    3360    EXIST:!VMS:FUNCTION:EC
-EC_POINT_set_affine_coords_GF2m         3360    EXIST:VMS:FUNCTION:EC
-BN_GF2m_mod_exp_arr                     3361    EXIST::FUNCTION:
+EC_POINT_set_affine_coordinates_GF2m    3360    EXIST:!VMS:FUNCTION:EC,EC2M
+EC_POINT_set_affine_coords_GF2m         3360    EXIST:VMS:FUNCTION:EC,EC2M
+BN_GF2m_mod_exp_arr                     3361    EXIST::FUNCTION:EC2M
 STORE_ATTR_INFO_modify_number           3362    NOEXIST::FUNCTION:
 X509_keyid_get0                         3363    EXIST::FUNCTION:
 ENGINE_load_gmp                         3364    EXIST::FUNCTION:ENGINE,GMP,STATIC_ENGINE
 pitem_new                               3365    EXIST::FUNCTION:
-BN_GF2m_mod_mul_arr                     3366    EXIST::FUNCTION:
+BN_GF2m_mod_mul_arr                     3366    EXIST::FUNCTION:EC2M
 STORE_list_public_key_endp              3367    NOEXIST::FUNCTION:
 o2i_ECPublicKey                         3368    EXIST::FUNCTION:EC
 EC_KEY_copy                             3369    EXIST::FUNCTION:EC
@@ -2945,7 +2945,7 @@ X509_VERIFY_PARAM_inherit               3378	EXIST::FUNCTION:
 EC_POINT_point2bn                       3379    EXIST::FUNCTION:EC
 STORE_ATTR_INFO_set_dn                  3380    NOEXIST::FUNCTION:
 X509_policy_tree_get0_policies          3381    EXIST::FUNCTION:
-EC_GROUP_new_curve_GF2m                 3382    EXIST::FUNCTION:EC
+EC_GROUP_new_curve_GF2m                 3382    EXIST::FUNCTION:EC,EC2M
 STORE_destroy_method                    3383    NOEXIST::FUNCTION:
 ENGINE_unregister_STORE                 3384    EXIST::FUNCTION:ENGINE
 EVP_PKEY_get1_EC_KEY                    3385    EXIST::FUNCTION:EC
@@ -2961,7 +2961,7 @@ ENGINE_get_static_state                 3393	EXIST::FUNCTION:ENGINE
 pqueue_iterator                         3394    EXIST::FUNCTION:
 ECDSA_SIG_new                           3395    EXIST::FUNCTION:ECDSA
 OPENSSL_DIR_end                         3396    EXIST::FUNCTION:
-BN_GF2m_mod_sqr                         3397    EXIST::FUNCTION:
+BN_GF2m_mod_sqr                         3397    EXIST::FUNCTION:EC2M
 EC_POINT_bn2point                       3398    EXIST::FUNCTION:EC
 X509_VERIFY_PARAM_set_depth             3399    EXIST::FUNCTION:
 EC_KEY_set_asn1_flag                    3400    EXIST::FUNCTION:EC
@@ -2974,7 +2974,7 @@ EC_GROUP_get_point_conv_form            3405	EXIST:VMS:FUNCTION:EC
 STORE_method_set_store_function         3406    NOEXIST::FUNCTION:
 STORE_ATTR_INFO_in                      3407    NOEXIST::FUNCTION:
 PEM_read_bio_ECPKParameters             3408    EXIST::FUNCTION:EC
-EC_GROUP_get_pentanomial_basis          3409    EXIST::FUNCTION:EC
+EC_GROUP_get_pentanomial_basis          3409    EXIST::FUNCTION:EC,EC2M
 EVP_PKEY_add1_attr_by_txt               3410    EXIST::FUNCTION:
 BN_BLINDING_set_flags                   3411    EXIST::FUNCTION:
 X509_VERIFY_PARAM_set1_policies         3412    EXIST::FUNCTION:
@@ -2982,10 +2982,10 @@ X509_VERIFY_PARAM_set1_name             3413	EXIST::FUNCTION:
 X509_VERIFY_PARAM_set_purpose           3414    EXIST::FUNCTION:
 STORE_get_number                        3415    NOEXIST::FUNCTION:
 ECDSA_sign_setup                        3416    EXIST::FUNCTION:ECDSA
-BN_GF2m_mod_solve_quad_arr              3417    EXIST::FUNCTION:
+BN_GF2m_mod_solve_quad_arr              3417    EXIST::FUNCTION:EC2M
 EC_KEY_up_ref                           3418    EXIST::FUNCTION:EC
 POLICY_MAPPING_free                     3419    EXIST::FUNCTION:
-BN_GF2m_mod_div                         3420    EXIST::FUNCTION:
+BN_GF2m_mod_div                         3420    EXIST::FUNCTION:EC2M
 X509_VERIFY_PARAM_set_flags             3421    EXIST::FUNCTION:
 EC_KEY_free                             3422    EXIST::FUNCTION:EC
 STORE_meth_set_list_next_fn             3423    NOEXIST::FUNCTION:
@@ -2999,7 +2999,7 @@ STORE_method_set_list_end_function      3427	NOEXIST::FUNCTION:
 pqueue_print                            3428    EXIST::FUNCTION:
 EC_GROUP_have_precompute_mult           3429    EXIST::FUNCTION:EC
 EC_KEY_print_fp                         3430    EXIST::FUNCTION:EC,FP_API
-BN_GF2m_mod_arr                         3431    EXIST::FUNCTION:
+BN_GF2m_mod_arr                         3431    EXIST::FUNCTION:EC2M
 PEM_write_bio_X509_CERT_PAIR            3432    EXIST::FUNCTION:
 EVP_PKEY_cmp                            3433    EXIST::FUNCTION:
 X509_policy_level_node_count            3434    EXIST::FUNCTION:
@@ -3020,7 +3020,7 @@ X509_policy_node_get0_qualifiers        3448	EXIST:!VMS:FUNCTION:
 X509_pcy_node_get0_qualifiers           3448    EXIST:VMS:FUNCTION:
 STORE_list_crl_end                      3449    NOEXIST::FUNCTION:
 EVP_PKEY_set1_EC_KEY                    3450    EXIST::FUNCTION:EC
-BN_GF2m_mod_sqrt_arr                    3451    EXIST::FUNCTION:
+BN_GF2m_mod_sqrt_arr                    3451    EXIST::FUNCTION:EC2M
 i2d_ECPrivateKey_bio                    3452    EXIST::FUNCTION:BIO,EC
 ECPKParameters_print_fp                 3453    EXIST::FUNCTION:EC,FP_API
 pqueue_find                             3454    EXIST::FUNCTION:
@@ -3037,7 +3037,7 @@ PKCS12_add_safes                        3464	EXIST::FUNCTION:
 BN_BLINDING_convert_ex                  3465    EXIST::FUNCTION:
 X509_policy_tree_free                   3466    EXIST::FUNCTION:
 OPENSSL_ia32cap_loc                     3467    EXIST::FUNCTION:
-BN_GF2m_poly2arr                        3468    EXIST::FUNCTION:
+BN_GF2m_poly2arr                        3468    EXIST::FUNCTION:EC2M
 STORE_ctrl                              3469    NOEXIST::FUNCTION:
 STORE_ATTR_INFO_compare                 3470    NOEXIST::FUNCTION:
 BN_get0_nist_prime_224                  3471    EXIST::FUNCTION:
@@ -3061,7 +3061,7 @@ STORE_method_set_delete_function        3486	NOEXIST::FUNCTION:
 STORE_list_certificate_next             3487    NOEXIST::FUNCTION:
 ASN1_generate_nconf                     3488    EXIST::FUNCTION:
 BUF_memdup                              3489    EXIST::FUNCTION:
-BN_GF2m_mod_mul                         3490    EXIST::FUNCTION:
+BN_GF2m_mod_mul                         3490    EXIST::FUNCTION:EC2M
 STORE_meth_get_list_next_fn             3491    NOEXIST::FUNCTION:
 STORE_method_get_list_next_function     3491    NOEXIST::FUNCTION:
 STORE_ATTR_INFO_get0_dn                 3492    NOEXIST::FUNCTION:
@@ -3072,7 +3072,7 @@ STORE_ATTR_INFO_free                    3496	NOEXIST::FUNCTION:
 STORE_get_private_key                   3497    NOEXIST::FUNCTION:
 EVP_PKEY_get_attr_count                 3498    EXIST::FUNCTION:
 STORE_ATTR_INFO_new                     3499    NOEXIST::FUNCTION:
-EC_GROUP_get_curve_GF2m                 3500    EXIST::FUNCTION:EC
+EC_GROUP_get_curve_GF2m                 3500    EXIST::FUNCTION:EC,EC2M
 STORE_meth_set_revoke_fn                3501    NOEXIST::FUNCTION:
 STORE_method_set_revoke_function        3501    NOEXIST::FUNCTION:
 STORE_store_number                      3502    NOEXIST::FUNCTION:
@@ -3088,7 +3088,7 @@ BIO_dump_indent_fp                      3511	EXIST::FUNCTION:FP_API
 EC_KEY_set_group                        3512    EXIST::FUNCTION:EC
 BUF_strndup                             3513    EXIST::FUNCTION:
 STORE_list_certificate_start            3514    NOEXIST::FUNCTION:
-BN_GF2m_mod                             3515    EXIST::FUNCTION:
+BN_GF2m_mod                             3515    EXIST::FUNCTION:EC2M
 X509_REQ_check_private_key              3516    EXIST::FUNCTION:
 EC_GROUP_get_seed_len                   3517    EXIST::FUNCTION:EC
 ERR_load_STORE_strings                  3518    NOEXIST::FUNCTION:
@@ -3117,19 +3117,19 @@ STORE_method_set_get_function           3536	NOEXIST::FUNCTION:
 STORE_modify_number                     3537    NOEXIST::FUNCTION:
 STORE_method_get_store_function         3538    NOEXIST::FUNCTION:
 STORE_store_private_key                 3539    NOEXIST::FUNCTION:
-BN_GF2m_mod_sqr_arr                     3540    EXIST::FUNCTION:
+BN_GF2m_mod_sqr_arr                     3540    EXIST::FUNCTION:EC2M
 RSA_setup_blinding                      3541    EXIST::FUNCTION:RSA
 BIO_s_datagram                          3542    EXIST::FUNCTION:DGRAM
 STORE_Memory                            3543    NOEXIST::FUNCTION:
 sk_find_ex                              3544    EXIST::FUNCTION:
-EC_GROUP_set_curve_GF2m                 3545    EXIST::FUNCTION:EC
+EC_GROUP_set_curve_GF2m                 3545    EXIST::FUNCTION:EC,EC2M
 ENGINE_set_default_ECDSA                3546    EXIST::FUNCTION:ENGINE
 POLICY_CONSTRAINTS_new                  3547    EXIST::FUNCTION:
-BN_GF2m_mod_sqrt                        3548    EXIST::FUNCTION:
+BN_GF2m_mod_sqrt                        3548    EXIST::FUNCTION:EC2M
 ECDH_set_default_method                 3549    EXIST::FUNCTION:ECDH
 EC_KEY_generate_key                     3550    EXIST::FUNCTION:EC
 SHA384_Update                           3551    EXIST:!VMSVAX:FUNCTION:SHA,SHA512
-BN_GF2m_arr2poly                        3552    EXIST::FUNCTION:
+BN_GF2m_arr2poly                        3552    EXIST::FUNCTION:EC2M
 STORE_method_get_get_function           3553    NOEXIST::FUNCTION:
 STORE_meth_set_cleanup_fn               3554    NOEXIST::FUNCTION:
 STORE_method_set_cleanup_function       3554    NOEXIST::FUNCTION:
@@ -3154,7 +3154,7 @@ EC_GROUP_get_degree                     3570	EXIST::FUNCTION:EC
 ASN1_generate_v3                        3571    EXIST::FUNCTION:
 STORE_ATTR_INFO_modify_cstr             3572    NOEXIST::FUNCTION:
 X509_policy_tree_level_count            3573    EXIST::FUNCTION:
-BN_GF2m_add                             3574    EXIST::FUNCTION:
+BN_GF2m_add                             3574    EXIST::FUNCTION:EC2M
 EC_KEY_get0_group                       3575    EXIST::FUNCTION:EC
 STORE_generate_crl                      3576    NOEXIST::FUNCTION:
 STORE_store_public_key                  3577    NOEXIST::FUNCTION:
@@ -3179,8 +3179,8 @@ STORE_store_certificate                 3593	NOEXIST::FUNCTION:
 OBJ_bsearch_ex                          3594    NOEXIST::FUNCTION:
 X509_STORE_CTX_set_default              3595    EXIST::FUNCTION:
 STORE_ATTR_INFO_set_sha1str             3596    NOEXIST::FUNCTION:
-BN_GF2m_mod_inv                         3597    EXIST::FUNCTION:
-BN_GF2m_mod_exp                         3598    EXIST::FUNCTION:
+BN_GF2m_mod_inv                         3597    EXIST::FUNCTION:EC2M
+BN_GF2m_mod_exp                         3598    EXIST::FUNCTION:EC2M
 STORE_modify_public_key                 3599    NOEXIST::FUNCTION:
 STORE_meth_get_list_start_fn            3600    NOEXIST::FUNCTION:
 STORE_method_get_list_start_function    3600    NOEXIST::FUNCTION:
@@ -3188,7 +3188,7 @@ EC_GROUP_get0_seed                      3601	EXIST::FUNCTION:EC
 STORE_store_arbitrary                   3602    NOEXIST::FUNCTION:
 STORE_meth_set_unlock_store_fn          3603    NOEXIST::FUNCTION:
 STORE_method_set_unlock_store_function  3603    NOEXIST::FUNCTION:
-BN_GF2m_mod_div_arr                     3604    EXIST::FUNCTION:
+BN_GF2m_mod_div_arr                     3604    EXIST::FUNCTION:EC2M
 ENGINE_set_ECDSA                        3605    EXIST::FUNCTION:ENGINE
 STORE_create_method                     3606    NOEXIST::FUNCTION:
 ECPKParameters_print                    3607    EXIST::FUNCTION:BIO,EC
@@ -3211,8 +3211,8 @@ EC_KEY_get_enc_flags                    3622	EXIST::FUNCTION:EC
 ASN1_const_check_infinite_end           3623    EXIST::FUNCTION:
 EVP_PKEY_delete_attr                    3624    EXIST::FUNCTION:
 ECDSA_set_default_method                3625    EXIST::FUNCTION:ECDSA
-EC_POINT_set_compressed_coordinates_GF2m 3626   EXIST:!VMS:FUNCTION:EC
-EC_POINT_set_compr_coords_GF2m          3626    EXIST:VMS:FUNCTION:EC
+EC_POINT_set_compressed_coordinates_GF2m 3626   EXIST:!VMS:FUNCTION:EC,EC2M
+EC_POINT_set_compr_coords_GF2m          3626    EXIST:VMS:FUNCTION:EC,EC2M
 EC_GROUP_cmp                            3627    EXIST::FUNCTION:EC
 STORE_revoke_certificate                3628    NOEXIST::FUNCTION:
 BN_get0_nist_prime_256                  3629    EXIST::FUNCTION:
@@ -3241,7 +3241,7 @@ POLICY_CONSTRAINTS_it                   3649	EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTI
 STORE_get_ex_new_index                  3650    NOEXIST::FUNCTION:
 EVP_PKEY_get_attr_by_OBJ                3651    EXIST::FUNCTION:
 X509_VERIFY_PARAM_add0_policy           3652    EXIST::FUNCTION:
-BN_GF2m_mod_solve_quad                  3653    EXIST::FUNCTION:
+BN_GF2m_mod_solve_quad                  3653    EXIST::FUNCTION:EC2M
 SHA256                                  3654    EXIST::FUNCTION:SHA,SHA256
 i2d_ECPrivateKey_fp                     3655    EXIST::FUNCTION:EC,FP_API
 X509_policy_tree_get0_user_policies     3656    EXIST:!VMS:FUNCTION:
@@ -3249,8 +3249,8 @@ X509_pcy_tree_get0_usr_policies         3656	EXIST:VMS:FUNCTION:
 OPENSSL_DIR_read                        3657    EXIST::FUNCTION:
 ENGINE_register_all_ECDSA               3658    EXIST::FUNCTION:ENGINE
 X509_VERIFY_PARAM_lookup                3659    EXIST::FUNCTION:
-EC_POINT_get_affine_coordinates_GF2m    3660    EXIST:!VMS:FUNCTION:EC
-EC_POINT_get_affine_coords_GF2m         3660    EXIST:VMS:FUNCTION:EC
+EC_POINT_get_affine_coordinates_GF2m    3660    EXIST:!VMS:FUNCTION:EC,EC2M
+EC_POINT_get_affine_coords_GF2m         3660    EXIST:VMS:FUNCTION:EC,EC2M
 EC_GROUP_dup                            3661    EXIST::FUNCTION:EC
 ENGINE_get_default_ECDSA                3662    EXIST::FUNCTION:ENGINE
 EC_KEY_new                              3663    EXIST::FUNCTION:EC
@@ -3332,7 +3332,7 @@ STORE_list_certificate_end              3734	NOEXIST::FUNCTION:
 STORE_get_crl                           3735    NOEXIST::FUNCTION:
 X509_POLICY_NODE_print                  3736    EXIST::FUNCTION:
 SHA384_Init                             3737    EXIST:!VMSVAX:FUNCTION:SHA,SHA512
-EC_GF2m_simple_method                   3738    EXIST::FUNCTION:EC
+EC_GF2m_simple_method                   3738    EXIST::FUNCTION:EC,EC2M
 ECDSA_set_ex_data                       3739    EXIST::FUNCTION:ECDSA
 SHA384_Final                            3740    EXIST:!VMSVAX:FUNCTION:SHA,SHA512
 PKCS7_set_digest                        3741    EXIST::FUNCTION:
@@ -3364,7 +3364,7 @@ BIO_dump_cb                             3764	EXIST::FUNCTION:
 SHA256_Update                           3765    EXIST::FUNCTION:SHA,SHA256
 pqueue_insert                           3766    EXIST::FUNCTION:
 pitem_free                              3767    EXIST::FUNCTION:
-BN_GF2m_mod_inv_arr                     3768    EXIST::FUNCTION:
+BN_GF2m_mod_inv_arr                     3768    EXIST::FUNCTION:EC2M
 ENGINE_unregister_ECDSA                 3769    EXIST::FUNCTION:ENGINE
 BN_BLINDING_set_thread_id               3770    EXIST::FUNCTION:DEPRECATED
 get_rfc3526_prime_8192                  3771    EXIST::FUNCTION:
@@ -3670,7 +3670,7 @@ int_EVP_MD_set_engine_callbacks         4056	NOEXIST::FUNCTION:
 int_CRYPTO_set_do_dynlock_callback      4057    NOEXIST::FUNCTION:
 FIPS_rng_stick                          4058    NOEXIST::FUNCTION:
 EVP_CIPHER_CTX_set_flags                4059    EXIST::FUNCTION:
-BN_X931_generate_prime_ex               4060    NOEXIST::FUNCTION:
+BN_X931_generate_prime_ex               4060    EXIST::FUNCTION:
 FIPS_selftest_check                     4061    NOEXIST::FUNCTION:
 FIPS_rand_set_dt                        4062    NOEXIST::FUNCTION:
 CRYPTO_dbg_pop_info                     4063    NOEXIST::FUNCTION:
@@ -3695,14 +3695,14 @@ FIPS_rand_test_mode                     4081	NOEXIST::FUNCTION:
 FIPS_rand_reset                         4082    NOEXIST::FUNCTION:
 FIPS_dsa_new                            4083    NOEXIST::FUNCTION:
 int_RAND_set_callbacks                  4084    NOEXIST::FUNCTION:
-BN_X931_derive_prime_ex                 4085    NOEXIST::FUNCTION:
+BN_X931_derive_prime_ex                 4085    EXIST::FUNCTION:
 int_ERR_lib_init                        4086    NOEXIST::FUNCTION:
 int_EVP_CIPHER_init_engine_callbacks    4087    NOEXIST::FUNCTION:
 FIPS_rsa_free                           4088    NOEXIST::FUNCTION:
 FIPS_dsa_sig_encode                     4089    NOEXIST::FUNCTION:
 CRYPTO_dbg_remove_all_info              4090    NOEXIST::FUNCTION:
-OPENSSL_init                            4091    NOEXIST::FUNCTION:
-private_Camellia_set_key                4092    NOEXIST::FUNCTION:
+OPENSSL_init                            4091    EXIST::FUNCTION:
+private_Camellia_set_key                4092    EXIST:OPENSSL_FIPS:FUNCTION:CAMELLIA
 CRYPTO_strdup                           4093    EXIST::FUNCTION:
 JPAKE_STEP3A_process                    4094    EXIST::FUNCTION:JPAKE
 JPAKE_STEP1_release                     4095    EXIST::FUNCTION:JPAKE
@@ -4194,4 +4194,119 @@ OPENSSL_memcmp                          4565	EXIST::FUNCTION:
 OPENSSL_strncasecmp                     4566    EXIST::FUNCTION:
 OPENSSL_gmtime                          4567    EXIST::FUNCTION:
 OPENSSL_gmtime_adj                      4568    EXIST::FUNCTION:
-ENGINE_load_aesni                       4569    EXIST::FUNCTION:ENGINE
+SRP_VBASE_get_by_user                   4569    EXIST::FUNCTION:SRP
+SRP_Calc_server_key                     4570    EXIST::FUNCTION:SRP
+SRP_create_verifier                     4571    EXIST::FUNCTION:SRP
+SRP_create_verifier_BN                  4572    EXIST::FUNCTION:SRP
+SRP_Calc_u                              4573    EXIST::FUNCTION:SRP
+SRP_VBASE_free                          4574    EXIST::FUNCTION:SRP
+SRP_Calc_client_key                     4575    EXIST::FUNCTION:SRP
+SRP_get_default_gN                      4576    EXIST::FUNCTION:SRP
+SRP_Calc_x                              4577    EXIST::FUNCTION:SRP
+SRP_Calc_B                              4578    EXIST::FUNCTION:SRP
+SRP_VBASE_new                           4579    EXIST::FUNCTION:SRP
+SRP_check_known_gN_param                4580    EXIST::FUNCTION:SRP
+SRP_Calc_A                              4581    EXIST::FUNCTION:SRP
+SRP_Verify_A_mod_N                      4582    EXIST::FUNCTION:SRP
+SRP_VBASE_init                          4583    EXIST::FUNCTION:SRP
+SRP_Verify_B_mod_N                      4584    EXIST::FUNCTION:SRP
+EC_KEY_set_public_key_affine_coordinates 4585   EXIST:!VMS:FUNCTION:EC
+EC_KEY_set_pub_key_aff_coords           4585    EXIST:VMS:FUNCTION:EC
+EVP_aes_192_ctr                         4586    EXIST::FUNCTION:AES
+EVP_PKEY_meth_get0_info                 4587    EXIST::FUNCTION:
+EVP_PKEY_meth_copy                      4588    EXIST::FUNCTION:
+ERR_add_error_vdata                     4589    EXIST::FUNCTION:
+EVP_aes_128_ctr                         4590    EXIST::FUNCTION:AES
+EVP_aes_256_ctr                         4591    EXIST::FUNCTION:AES
+EC_GFp_nistp224_method                  4592    EXIST::FUNCTION:EC,EC_NISTP_64_GCC_128
+EC_KEY_get_flags                        4593    EXIST::FUNCTION:EC
+RSA_padding_add_PKCS1_PSS_mgf1          4594    EXIST::FUNCTION:RSA
+EVP_aes_128_xts                         4595    EXIST::FUNCTION:AES
+private_SHA224_Init                     4596    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
+private_AES_set_decrypt_key             4597    EXIST::FUNCTION:AES
+private_WHIRLPOOL_Init                  4598    EXIST:OPENSSL_FIPS:FUNCTION:WHIRLPOOL
+EVP_aes_256_xts                         4599    EXIST::FUNCTION:AES
+private_SHA512_Init                     4600    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
+EVP_aes_128_gcm                         4601    EXIST::FUNCTION:AES
+EC_KEY_clear_flags                      4602    EXIST::FUNCTION:EC
+EC_KEY_set_flags                        4603    EXIST::FUNCTION:EC
+private_DES_set_key_unchecked           4604    EXIST:OPENSSL_FIPS:FUNCTION:DES
+EVP_aes_256_ccm                         4605    EXIST::FUNCTION:AES
+private_AES_set_encrypt_key             4606    EXIST::FUNCTION:AES
+RSA_verify_PKCS1_PSS_mgf1               4607    EXIST::FUNCTION:RSA
+private_SHA1_Init                       4608    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA1
+EVP_aes_128_ccm                         4609    EXIST::FUNCTION:AES
+private_SEED_set_key                    4610    EXIST:OPENSSL_FIPS:FUNCTION:SEED
+EVP_aes_192_gcm                         4611    EXIST::FUNCTION:AES
+X509_ALGOR_set_md                       4612    EXIST::FUNCTION:
+private_SHA256_Init                     4613    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
+RAND_init_fips                          4614    EXIST:OPENSSL_FIPS:FUNCTION:
+EVP_aes_256_gcm                         4615    EXIST::FUNCTION:AES
+private_SHA384_Init                     4616    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
+EVP_aes_192_ccm                         4617    EXIST::FUNCTION:AES
+CMAC_CTX_copy                           4618    EXIST::FUNCTION:
+CMAC_CTX_free                           4619    EXIST::FUNCTION:
+CMAC_CTX_get0_cipher_ctx                4620    EXIST::FUNCTION:
+CMAC_CTX_cleanup                        4621    EXIST::FUNCTION:
+CMAC_Init                               4622    EXIST::FUNCTION:
+CMAC_Update                             4623    EXIST::FUNCTION:
+CMAC_resume                             4624    EXIST::FUNCTION:
+CMAC_CTX_new                            4625    EXIST::FUNCTION:
+CMAC_Final                              4626    EXIST::FUNCTION:
+CRYPTO_ctr128_encrypt_ctr32             4627    EXIST::FUNCTION:
+CRYPTO_gcm128_release                   4628    EXIST::FUNCTION:
+CRYPTO_ccm128_decrypt_ccm64             4629    EXIST::FUNCTION:
+CRYPTO_ccm128_encrypt                   4630    EXIST::FUNCTION:
+CRYPTO_gcm128_encrypt                   4631    EXIST::FUNCTION:
+CRYPTO_xts128_encrypt                   4632    EXIST::FUNCTION:
+EVP_rc4_hmac_md5                        4633    EXIST::FUNCTION:MD5,RC4
+CRYPTO_nistcts128_decrypt_block         4634    EXIST::FUNCTION:
+CRYPTO_gcm128_setiv                     4635    EXIST::FUNCTION:
+CRYPTO_nistcts128_encrypt               4636    EXIST::FUNCTION:
+EVP_aes_128_cbc_hmac_sha1               4637    EXIST::FUNCTION:AES,SHA,SHA1
+CRYPTO_gcm128_tag                       4638    EXIST::FUNCTION:
+CRYPTO_ccm128_encrypt_ccm64             4639    EXIST::FUNCTION:
+ENGINE_load_rdrand                      4640    EXIST::FUNCTION:ENGINE
+CRYPTO_ccm128_setiv                     4641    EXIST::FUNCTION:
+CRYPTO_nistcts128_encrypt_block         4642    EXIST::FUNCTION:
+CRYPTO_gcm128_aad                       4643    EXIST::FUNCTION:
+CRYPTO_ccm128_init                      4644    EXIST::FUNCTION:
+CRYPTO_nistcts128_decrypt               4645    EXIST::FUNCTION:
+CRYPTO_gcm128_new                       4646    EXIST::FUNCTION:
+CRYPTO_ccm128_tag                       4647    EXIST::FUNCTION:
+CRYPTO_ccm128_decrypt                   4648    EXIST::FUNCTION:
+CRYPTO_ccm128_aad                       4649    EXIST::FUNCTION:
+CRYPTO_gcm128_init                      4650    EXIST::FUNCTION:
+CRYPTO_gcm128_decrypt                   4651    EXIST::FUNCTION:
+ENGINE_load_rsax                        4652    EXIST::FUNCTION:ENGINE
+CRYPTO_gcm128_decrypt_ctr32             4653    EXIST::FUNCTION:
+CRYPTO_gcm128_encrypt_ctr32             4654    EXIST::FUNCTION:
+CRYPTO_gcm128_finish                    4655    EXIST::FUNCTION:
+EVP_aes_256_cbc_hmac_sha1               4656    EXIST::FUNCTION:AES,SHA,SHA1
+PKCS5_pbkdf2_set                        4657    EXIST::FUNCTION:
+CMS_add0_recipient_password             4658    EXIST::FUNCTION:CMS
+CMS_decrypt_set1_password               4659    EXIST::FUNCTION:CMS
+CMS_RecipientInfo_set0_password         4660    EXIST::FUNCTION:CMS
+RAND_set_fips_drbg_type                 4661    EXIST:OPENSSL_FIPS:FUNCTION:
+X509_REQ_sign_ctx                       4662    EXIST::FUNCTION:EVP
+RSA_PSS_PARAMS_new                      4663    EXIST::FUNCTION:RSA
+X509_CRL_sign_ctx                       4664    EXIST::FUNCTION:EVP
+X509_signature_dump                     4665    EXIST::FUNCTION:EVP
+d2i_RSA_PSS_PARAMS                      4666    EXIST::FUNCTION:RSA
+RSA_PSS_PARAMS_it                       4667    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:RSA
+RSA_PSS_PARAMS_it                       4667    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:RSA
+RSA_PSS_PARAMS_free                     4668    EXIST::FUNCTION:RSA
+X509_sign_ctx                           4669    EXIST::FUNCTION:EVP
+i2d_RSA_PSS_PARAMS                      4670    EXIST::FUNCTION:RSA
+ASN1_item_sign_ctx                      4671    EXIST::FUNCTION:EVP
+EC_GFp_nistp521_method                  4672    EXIST::FUNCTION:EC,EC_NISTP_64_GCC_128
+EC_GFp_nistp256_method                  4673    EXIST::FUNCTION:EC,EC_NISTP_64_GCC_128
+OPENSSL_stderr                          4674    EXIST::FUNCTION:
+OPENSSL_cpuid_setup                     4675    EXIST::FUNCTION:
+OPENSSL_showfatal                       4676    EXIST::FUNCTION:
+BIO_new_dgram_sctp                      4677    EXIST::FUNCTION:SCTP
+BIO_dgram_sctp_msg_waiting              4678    EXIST::FUNCTION:SCTP
+BIO_dgram_sctp_wait_for_dry             4679    EXIST::FUNCTION:SCTP
+BIO_s_datagram_sctp                     4680    EXIST::FUNCTION:DGRAM,SCTP
+BIO_dgram_is_sctp                       4681    EXIST::FUNCTION:SCTP
+BIO_dgram_sctp_notification_cb          4682    EXIST::FUNCTION:SCTP
diff --git a/src/lib/libcrypto/util/mk1mf.pl b/src/lib/libcrypto/util/mk1mf.pl
index 1dcef2b8a2..458f830401 100644
--- a/src/lib/libcrypto/util/mk1mf.pl
+++ b/src/lib/libcrypto/util/mk1mf.pl
@@ -18,6 +18,8 @@ local $zlib_opt = 0;	# 0 = no zlib, 1 = static, 2 = dynamic
 local $zlib_lib = "";
 local $perl_asm = 0;    # 1 to autobuild asm files from perl scripts
 
+my $ex_l_libs = "";
+
 # Options to import from top level Makefile
 
 my %mf_import = (
@@ -40,7 +42,9 @@ my %mf_import = (
         SHA1_ASM_OBJ   => \$mf_sha_asm,
         RMD160_ASM_OBJ => \$mf_rmd_asm,
         WP_ASM_OBJ     => \$mf_wp_asm,
-        CMLL_ENC       => \$mf_cm_asm
+        CMLL_ENC       => \$mf_cm_asm,
+        BASEADDR       => \$baseaddr,
+        FIPSDIR        => \$fipsdir,
 );
 
 
@@ -104,6 +108,7 @@ and [options] can be one of
         just-ssl                                - remove all non-ssl keys/digest
         no-asm                                  - No x86 asm
         no-krb5                                 - No KRB5
+        no-srp                                  - No SRP
         no-ec                                   - No EC
         no-ecdsa                                - No ECDSA
         no-ecdh                                 - No ECDH
@@ -228,6 +233,8 @@ else
         $cflags.=' -DTERMIO';
         }
 
+$fipsdir =~ s/\//${o}/g;
+
 $out_dir=(defined($VARS{'OUT'}))?$VARS{'OUT'}:$out_def.($debug?".dbg":"");
 $tmp_dir=(defined($VARS{'TMP'}))?$VARS{'TMP'}:$tmp_def.($debug?".dbg":"");
 $inc_dir=(defined($VARS{'INC'}))?$VARS{'INC'}:$inc_def;
@@ -261,6 +268,7 @@ $cflags.=" -DOPENSSL_NO_SOCK" if $no_sock;
 $cflags.=" -DOPENSSL_NO_SSL2" if $no_ssl2;
 $cflags.=" -DOPENSSL_NO_SSL3" if $no_ssl3;
 $cflags.=" -DOPENSSL_NO_TLSEXT" if $no_tlsext;
+$cflags.=" -DOPENSSL_NO_SRP" if $no_srp;
 $cflags.=" -DOPENSSL_NO_CMS" if $no_cms;
 $cflags.=" -DOPENSSL_NO_ERR"  if $no_err;
 $cflags.=" -DOPENSSL_NO_KRB5" if $no_krb5;
@@ -270,7 +278,9 @@ $cflags.=" -DOPENSSL_NO_ECDH" if $no_ecdh;
 $cflags.=" -DOPENSSL_NO_GOST" if $no_gost;
 $cflags.=" -DOPENSSL_NO_ENGINE"   if $no_engine;
 $cflags.=" -DOPENSSL_NO_HW"   if $no_hw;
+$cflags.=" -DOPENSSL_FIPS"    if $fips;
 $cflags.=" -DOPENSSL_NO_JPAKE"    if $no_jpake;
+$cflags.=" -DOPENSSL_NO_EC2M"    if $no_ec2m;
 $cflags.= " -DZLIB" if $zlib_opt;
 $cflags.= " -DZLIB_SHARED" if $zlib_opt == 2;
 
@@ -404,6 +414,11 @@ else
         \$(CP) \"\$(O_CRYPTO)\" \"\$(INSTALLTOP)${o}lib\"
 EOF
         $ex_libs .= " $zlib_lib" if $zlib_opt == 1;
+        if ($fips)
+                {
+                $build_targets .= " \$(LIB_D)$o$crypto_compat \$(PREMAIN_DSO_EXE)";
+                $ex_l_libs .= " \$(O_FIPSCANISTER)";
+                }
         }
 
 $defs= <<"EOF";
@@ -465,6 +480,18 @@ MKLIB=$bin_dir$mklib
 MLFLAGS=$mlflags
 ASM=$bin_dir$asm
 
+# FIPS validated module and support file locations
+
+FIPSDIR=$fipsdir
+BASEADDR=$baseaddr
+FIPSLIB_D=\$(FIPSDIR)${o}lib
+FIPS_PREMAIN_SRC=\$(FIPSLIB_D)${o}fips_premain.c
+O_FIPSCANISTER=\$(FIPSLIB_D)${o}fipscanister.lib
+FIPS_SHA1_EXE=\$(FIPSDIR)${o}bin${o}fips_standalone_sha1${exep}
+E_PREMAIN_DSO=fips_premain_dso
+PREMAIN_DSO_EXE=\$(BIN_D)${o}fips_premain_dso$exep
+FIPSLINK=\$(PERL) \$(FIPSDIR)${o}bin${o}fipslink.pl
+
 ######################################################
 # You should not need to touch anything below this point
 ######################################################
@@ -497,7 +524,7 @@ SO_CRYPTO= $plib\$(CRYPTO)$so_shlibp
 L_SSL=     \$(LIB_D)$o$plib\$(SSL)$libp
 L_CRYPTO=  \$(LIB_D)$o$plib\$(CRYPTO)$libp
 
-L_LIBS= \$(L_SSL) \$(L_CRYPTO)
+L_LIBS= \$(L_SSL) \$(L_CRYPTO) $ex_l_libs
 
 ######################################################
 # Don't touch anything below this point
@@ -513,7 +540,7 @@ LIBS_DEP=\$(O_CRYPTO) \$(O_SSL)
 EOF
 
 $rules=<<"EOF";
-all: banner \$(TMP_D) \$(BIN_D) \$(TEST_D) \$(LIB_D) \$(INCO_D) headers lib exe
+all: banner \$(TMP_D) \$(BIN_D) \$(TEST_D) \$(LIB_D) \$(INCO_D) headers lib exe $build_targets
 
 banner:
 $banner
@@ -629,6 +656,16 @@ $rules.=&do_compile_rule("\$(OBJ_D)",$test,"\$(APP_CFLAGS)");
 $defs.=&do_defs("E_OBJ",$e_exe,"\$(OBJ_D)",$obj);
 $rules.=&do_compile_rule("\$(OBJ_D)",$e_exe,'-DMONOLITH $(APP_CFLAGS)');
 
+# Special case rule for fips_premain_dso
+
+if ($fips)
+        {
+        $rules.=&cc_compile_target("\$(OBJ_D)${o}\$(E_PREMAIN_DSO)$obj",
+                "\$(FIPS_PREMAIN_SRC)",
+                "-DFINGERPRINT_PREMAIN_DSO_LOAD \$(SHLIB_CFLAGS)", "");
+        $rules.=&do_link_rule("\$(PREMAIN_DSO_EXE)","\$(OBJ_D)${o}\$(E_PREMAIN_DSO)$obj \$(CRYPTOOBJ) \$(O_FIPSCANISTER)","","\$(EX_LIBS)", 1);
+        }
+
 foreach (values %lib_nam)
         {
         $lib_obj=$lib_obj{$_};
@@ -677,7 +714,28 @@ foreach (split(/\s+/,$engines))
 
 
 $rules.= &do_lib_rule("\$(SSLOBJ)","\$(O_SSL)",$ssl,$shlib,"\$(SO_SSL)");
-$rules.= &do_lib_rule("\$(CRYPTOOBJ)","\$(O_CRYPTO)",$crypto,$shlib,"\$(SO_CRYPTO)");
+
+if ($fips)
+        {
+        if ($shlib)
+                {
+                $rules.= &do_lib_rule("\$(CRYPTOOBJ) \$(O_FIPSCANISTER)",
+                                "\$(O_CRYPTO)", "$crypto",
+                                $shlib, "\$(SO_CRYPTO)", "\$(BASEADDR)");
+                }
+        else
+                {
+                $rules.= &do_lib_rule("\$(CRYPTOOBJ)",
+                        "\$(O_CRYPTO)",$crypto,$shlib,"\$(SO_CRYPTO)", "");
+                $rules.= &do_lib_rule("\$(CRYPTOOBJ) \$(O_FIPSCANISTER)",
+                        "\$(LIB_D)$o$crypto_compat",$crypto,$shlib,"\$(SO_CRYPTO)", "");
+                }
+        }
+        else
+        {
+        $rules.= &do_lib_rule("\$(CRYPTOOBJ)","\$(O_CRYPTO)",$crypto,$shlib,
+                                                        "\$(SO_CRYPTO)");
+        }
 
 foreach (split(" ",$otherlibs))
         {
@@ -687,7 +745,7 @@ foreach (split(" ",$otherlibs))
 
         }
 
-$rules.=&do_link_rule("\$(BIN_D)$o\$(E_EXE)$exep","\$(E_OBJ)","\$(LIBS_DEP)","\$(L_LIBS) \$(EX_LIBS)");
+$rules.=&do_link_rule("\$(BIN_D)$o\$(E_EXE)$exep","\$(E_OBJ)","\$(LIBS_DEP)","\$(L_LIBS) \$(EX_LIBS)", ($fips && !$shlib) ? 2 : 0);
 
 print $defs;
 
@@ -781,6 +839,8 @@ sub var_add
         @a=grep(!/(^sha1)|(_sha1$)|(m_dss1$)/,@a) if $no_sha1;
         @a=grep(!/_mdc2$/,@a) if $no_mdc2;
 
+        @a=grep(!/(srp)/,@a) if $no_srp;
+
         @a=grep(!/^engine$/,@a) if $no_engine;
         @a=grep(!/^hw$/,@a) if $no_hw;
         @a=grep(!/(^rsa$)|(^genrsa$)/,@a) if $no_rsa;
@@ -939,14 +999,15 @@ sub Sasm_compile_target
 
 sub cc_compile_target
         {
-        local($target,$source,$ex_flags)=@_;
+        local($target,$source,$ex_flags, $srcd)=@_;
         local($ret);
         
         $ex_flags.=" -DMK1MF_BUILD -D$platform_cpp_symbol" if ($source =~ /cversion/);
         $target =~ s/\//$o/g if $o ne "/";
         $source =~ s/\//$o/g if $o ne "/";
-        $ret ="$target: \$(SRC_D)$o$source\n\t";
-        $ret.="\$(CC) ${ofile}$target $ex_flags -c \$(SRC_D)$o$source\n\n";
+        $srcd = "\$(SRC_D)$o" unless defined $srcd;
+        $ret ="$target: $srcd$source\n\t";
+        $ret.="\$(CC) ${ofile}$target $ex_flags -c $srcd$source\n\n";
         return($ret);
         }
 
@@ -1056,8 +1117,11 @@ sub read_options
                 "no-ssl2" => \$no_ssl2,
                 "no-ssl3" => \$no_ssl3,
                 "no-tlsext" => \$no_tlsext,
+                "no-srp" => \$no_srp,
                 "no-cms" => \$no_cms,
+                "no-ec2m" => \$no_ec2m,
                 "no-jpake" => \$no_jpake,
+                "no-ec_nistp_64_gcc_128" => 0,
                 "no-err" => \$no_err,
                 "no-sock" => \$no_sock,
                 "no-krb5" => \$no_krb5,
@@ -1067,11 +1131,12 @@ sub read_options
                 "no-gost" => \$no_gost,
                 "no-engine" => \$no_engine,
                 "no-hw" => \$no_hw,
+                "no-rsax" => 0,
                 "just-ssl" =>
                         [\$no_rc2, \$no_idea, \$no_des, \$no_bf, \$no_cast,
                           \$no_md2, \$no_sha, \$no_mdc2, \$no_dsa, \$no_dh,
                           \$no_ssl2, \$no_err, \$no_ripemd, \$no_rc5,
-                          \$no_aes, \$no_camellia, \$no_seed],
+                          \$no_aes, \$no_camellia, \$no_seed, \$no_srp],
                 "rsaref" => 0,
                 "gcc" => \$gcc,
                 "debug" => \$debug,
@@ -1079,6 +1144,7 @@ sub read_options
                 "shlib" => \$shlib,
                 "dll" => \$shlib,
                 "shared" => 0,
+                "no-sctp" => 0,
                 "no-gmp" => 0,
                 "no-rfc3779" => 0,
                 "no-montasm" => 0,
@@ -1086,6 +1152,7 @@ sub read_options
                 "no-store" => 0,
                 "no-zlib" => 0,
                 "no-zlib-dynamic" => 0,
+                "fips" => \$fips
                 );
 
         if (exists $valid_options{$_})
diff --git a/src/lib/libcrypto/util/mkdef.pl b/src/lib/libcrypto/util/mkdef.pl
index ab47329097..9a8c7b87d1 100644
--- a/src/lib/libcrypto/util/mkdef.pl
+++ b/src/lib/libcrypto/util/mkdef.pl
@@ -79,13 +79,15 @@ my $OS2=0;
 my $safe_stack_def = 0;
 
 my @known_platforms = ( "__FreeBSD__", "PERL5", "NeXT",
-                        "EXPORT_VAR_AS_FUNCTION", "ZLIB" );
+                        "EXPORT_VAR_AS_FUNCTION", "ZLIB", "OPENSSL_FIPS" );
 my @known_ossl_platforms = ( "VMS", "WIN16", "WIN32", "WINNT", "OS2" );
 my @known_algorithms = ( "RC2", "RC4", "RC5", "IDEA", "DES", "BF",
                          "CAST", "MD2", "MD4", "MD5", "SHA", "SHA0", "SHA1",
                          "SHA256", "SHA512", "RIPEMD",
-                         "MDC2", "WHIRLPOOL", "RSA", "DSA", "DH", "EC", "ECDH", "ECDSA",
+                         "MDC2", "WHIRLPOOL", "RSA", "DSA", "DH", "EC", "ECDH", "ECDSA", "EC2M",
                          "HMAC", "AES", "CAMELLIA", "SEED", "GOST",
+                         # EC_NISTP_64_GCC_128
+                         "EC_NISTP_64_GCC_128",
                          # Envelope "algorithms"
                          "EVP", "X509", "ASN1_TYPEDEFS",
                          # Helper "algorithms"
@@ -98,7 +100,7 @@ my @known_algorithms = ( "RC2", "RC4", "RC5", "IDEA", "DES", "BF",
                          # RFC3779
                          "RFC3779",
                          # TLS
-                         "TLSEXT", "PSK",
+                         "TLSEXT", "PSK", "SRP", "HEARTBEATS",
                          # CMS
                          "CMS",
                          # CryptoAPI Engine
@@ -107,8 +109,14 @@ my @known_algorithms = ( "RC2", "RC4", "RC5", "IDEA", "DES", "BF",
                          "SSL2",
                          # JPAKE
                          "JPAKE",
+                         # NEXTPROTONEG
+                         "NEXTPROTONEG",
                          # Deprecated functions
-                         "DEPRECATED" );
+                         "DEPRECATED",
+                         # Hide SSL internals
+                         "SSL_INTERN",
+                         # SCTP
+                         "SCTP");
 
 my $options="";
 open(IN,"<Makefile") || die "unable to open Makefile!\n";
@@ -127,7 +135,10 @@ my $no_rsa; my $no_dsa; my $no_dh; my $no_hmac=0; my $no_aes; my $no_krb5;
 my $no_ec; my $no_ecdsa; my $no_ecdh; my $no_engine; my $no_hw;
 my $no_fp_api; my $no_static_engine=1; my $no_gmp; my $no_deprecated;
 my $no_rfc3779; my $no_psk; my $no_tlsext; my $no_cms; my $no_capieng;
-my $no_jpake; my $no_ssl2;
+my $no_jpake; my $no_srp; my $no_ssl2; my $no_ec2m; my $no_nistp_gcc; 
+my $no_nextprotoneg; my $no_sctp;
+
+my $fips;
 
 my $zlib;
 
@@ -151,6 +162,7 @@ foreach (@ARGV, split(/ /, $options))
         }
         $VMS=1 if $_ eq "VMS";
         $OS2=1 if $_ eq "OS2";
+        $fips=1 if /^fips/;
         if ($_ eq "zlib" || $_ eq "enable-zlib" || $_ eq "zlib-dynamic"
                          || $_ eq "enable-zlib-dynamic") {
                 $zlib = 1;
@@ -215,9 +227,14 @@ foreach (@ARGV, split(/ /, $options))
         elsif (/^no-rfc3779$/)  { $no_rfc3779=1; }
         elsif (/^no-tlsext$/)   { $no_tlsext=1; }
         elsif (/^no-cms$/)      { $no_cms=1; }
+        elsif (/^no-ec2m$/)     { $no_ec2m=1; }
+        elsif (/^no-ec_nistp_64_gcc_128$/)      { $no_nistp_gcc=1; }
+        elsif (/^no-nextprotoneg$/)     { $no_nextprotoneg=1; }
         elsif (/^no-ssl2$/)     { $no_ssl2=1; }
         elsif (/^no-capieng$/)  { $no_capieng=1; }
         elsif (/^no-jpake$/)    { $no_jpake=1; }
+        elsif (/^no-srp$/)      { $no_srp=1; }
+        elsif (/^no-sctp$/)     { $no_sctp=1; }
         }
 
 
@@ -254,8 +271,10 @@ $max_crypto = $max_num;
 my $ssl="ssl/ssl.h";
 $ssl.=" ssl/kssl.h";
 $ssl.=" ssl/tls1.h";
+$ssl.=" ssl/srtp.h";
 
 my $crypto ="crypto/crypto.h";
+$crypto.=" crypto/cryptlib.h";
 $crypto.=" crypto/o_dir.h";
 $crypto.=" crypto/o_str.h";
 $crypto.=" crypto/o_time.h";
@@ -285,6 +304,7 @@ $crypto.=" crypto/ec/ec.h" ; # unless $no_ec;
 $crypto.=" crypto/ecdsa/ecdsa.h" ; # unless $no_ecdsa;
 $crypto.=" crypto/ecdh/ecdh.h" ; # unless $no_ecdh;
 $crypto.=" crypto/hmac/hmac.h" ; # unless $no_hmac;
+$crypto.=" crypto/cmac/cmac.h" ; # unless $no_hmac;
 
 $crypto.=" crypto/engine/engine.h"; # unless $no_engine;
 $crypto.=" crypto/stack/stack.h" ; # unless $no_stack;
@@ -319,6 +339,7 @@ $crypto.=" crypto/pqueue/pqueue.h";
 $crypto.=" crypto/cms/cms.h";
 $crypto.=" crypto/jpake/jpake.h";
 $crypto.=" crypto/modes/modes.h";
+$crypto.=" crypto/srp/srp.h";
 
 my $symhacks="crypto/symhacks.h";
 
@@ -1126,6 +1147,9 @@ sub is_valid
                         if ($keyword eq "EXPORT_VAR_AS_FUNCTION" && ($VMSVAX || $W32 || $W16)) {
                                 return 1;
                         }
+                        if ($keyword eq "OPENSSL_FIPS" && $fips) {
+                                return 1;
+                        }
                         if ($keyword eq "ZLIB" && $zlib) { return 1; }
                         return 0;
                 } else {
@@ -1172,9 +1196,15 @@ sub is_valid
                         if ($keyword eq "TLSEXT" && $no_tlsext) { return 0; }
                         if ($keyword eq "PSK" && $no_psk) { return 0; }
                         if ($keyword eq "CMS" && $no_cms) { return 0; }
+                        if ($keyword eq "EC2M" && $no_ec2m) { return 0; }
+                        if ($keyword eq "NEXTPROTONEG" && $no_nextprotoneg) { return 0; }
+                        if ($keyword eq "EC_NISTP_64_GCC_128" && $no_nistp_gcc)
+                                        { return 0; }
                         if ($keyword eq "SSL2" && $no_ssl2) { return 0; }
                         if ($keyword eq "CAPIENG" && $no_capieng) { return 0; }
                         if ($keyword eq "JPAKE" && $no_jpake) { return 0; }
+                        if ($keyword eq "SRP" && $no_srp) { return 0; }
+                        if ($keyword eq "SCTP" && $no_sctp) { return 0; }
                         if ($keyword eq "DEPRECATED" && $no_deprecated) { return 0; }
 
                         # Nothing recognise as true
diff --git a/src/lib/libcrypto/util/mkfiles.pl b/src/lib/libcrypto/util/mkfiles.pl
index 6d15831450..7d9a9d5e5c 100644
--- a/src/lib/libcrypto/util/mkfiles.pl
+++ b/src/lib/libcrypto/util/mkfiles.pl
@@ -15,6 +15,7 @@ my @dirs = (
 "crypto/sha",
 "crypto/mdc2",
 "crypto/hmac",
+"crypto/cmac",
 "crypto/ripemd",
 "crypto/des",
 "crypto/rc2",
@@ -62,6 +63,7 @@ my @dirs = (
 "crypto/pqueue",
 "crypto/whrlpool",
 "crypto/ts",
+"crypto/srp",
 "ssl",
 "apps",
 "engines",
diff --git a/src/lib/libcrypto/util/pl/VC-32.pl b/src/lib/libcrypto/util/pl/VC-32.pl
index 5f25fc41bf..c503bd52b9 100644
--- a/src/lib/libcrypto/util/pl/VC-32.pl
+++ b/src/lib/libcrypto/util/pl/VC-32.pl
@@ -6,6 +6,16 @@
 $ssl=   "ssleay32";
 $crypto="libeay32";
 
+if ($fips && !$shlib)
+        {
+        $crypto="libeayfips32";
+        $crypto_compat = "libeaycompat32.lib";
+        }
+else
+        {
+        $crypto="libeay32";
+        }
+
 $o='\\';
 $cp='$(PERL) util/copy.pl';
 $mkdir='$(PERL) util/mkdir-p.pl';
@@ -33,7 +43,7 @@ if ($FLAVOR =~ /WIN64/)
     # considered safe to ignore.
     # 
     $base_cflags= " $mf_cflag";
-    my $f = $shlib?' /MD':' /MT';
+    my $f = $shlib || $fips ?' /MD':' /MT';
     $lib_cflag='/Zl' if (!$shlib);      # remove /DEFAULTLIBs from static lib
     $opt_cflags=$f.' /Ox';
     $dbg_cflags=$f.'d /Od -DDEBUG -D_DEBUG';
@@ -114,7 +124,7 @@ elsif ($FLAVOR =~ /CE/)
 else    # Win32
     {
     $base_cflags= " $mf_cflag";
-    my $f = $shlib?' /MD':' /MT';
+    my $f = $shlib || $fips ?' /MD':' /MT';
     $lib_cflag='/Zl' if (!$shlib);      # remove /DEFAULTLIBs from static lib
     $opt_cflags=$f.' /Ox /O2 /Ob2';
     $dbg_cflags=$f.'d /Od -DDEBUG -D_DEBUG';
@@ -266,10 +276,19 @@ elsif ($shlib && $FLAVOR =~ /CE/)
 
 sub do_lib_rule
         {
-        local($objs,$target,$name,$shlib)=@_;
+        my($objs,$target,$name,$shlib,$ign,$base_addr) = @_;
         local($ret);
 
         $taget =~ s/\//$o/g if $o ne '/';
+        my $base_arg;
+        if ($base_addr ne "")
+                {
+                $base_arg= " /base:$base_addr";
+                }
+        else
+                {
+                $base_arg = "";
+                }
         if ($name ne "")
                 {
                 $name =~ tr/a-z/A-Z/;
@@ -277,17 +296,37 @@ sub do_lib_rule
                 }
 
 #       $target="\$(LIB_D)$o$target";
-        $ret.="$target: $objs\n";
+#       $ret.="$target: $objs\n";
         if (!$shlib)
                 {
 #               $ret.="\t\$(RM) \$(O_$Name)\n";
+                $ret.="$target: $objs\n";
                 $ret.="\t\$(MKLIB) $lfile$target @<<\n  $objs\n<<\n";
                 }
         else
                 {
                 local($ex)=($target =~ /O_CRYPTO/)?'':' $(L_CRYPTO)';
                 $ex.=" $zlib_lib" if $zlib_opt == 1 && $target =~ /O_CRYPTO/;
-                $ret.="\t\$(LINK) \$(MLFLAGS) $efile$target $name @<<\n  \$(SHLIB_EX_OBJ) $objs $ex \$(EX_LIBS)\n<<\n";
+
+                if ($fips && $target =~ /O_CRYPTO/)
+                        {
+                        $ret.="$target: $objs \$(PREMAIN_DSO_EXE)";
+                        $ret.="\n\tSET FIPS_LINK=\$(LINK)\n";
+                        $ret.="\tSET FIPS_CC=\$(CC)\n";
+                        $ret.="\tSET FIPS_CC_ARGS=/Fo\$(OBJ_D)${o}fips_premain.obj \$(SHLIB_CFLAGS) -c\n";
+                        $ret.="\tSET PREMAIN_DSO_EXE=\$(PREMAIN_DSO_EXE)\n";
+                        $ret.="\tSET FIPS_SHA1_EXE=\$(FIPS_SHA1_EXE)\n";
+                        $ret.="\tSET FIPS_TARGET=$target\n";
+                        $ret.="\tSET FIPSLIB_D=\$(FIPSLIB_D)\n";
+                        $ret.="\t\$(FIPSLINK) \$(MLFLAGS) /map $base_arg $efile$target ";
+                        $ret.="$name @<<\n  \$(SHLIB_EX_OBJ) $objs \$(EX_LIBS) ";
+                        $ret.="\$(OBJ_D)${o}fips_premain.obj $ex\n<<\n";
+                        }
+                else
+                        {
+                        $ret.="$target: $objs";
+                        $ret.="\n\t\$(LINK) \$(MLFLAGS) $efile$target $name @<<\n  \$(SHLIB_EX_OBJ) $objs $ex \$(EX_LIBS)\n<<\n";
+                        }
                 $ret.="\tIF EXIST \$@.manifest mt -nologo -manifest \$@.manifest -outputresource:\$@;2\n\n";
                 }
         $ret.="\n";
@@ -296,15 +335,35 @@ sub do_lib_rule
 
 sub do_link_rule
         {
-        local($target,$files,$dep_libs,$libs)=@_;
+        my($target,$files,$dep_libs,$libs,$standalone)=@_;
         local($ret,$_);
-        
         $file =~ s/\//$o/g if $o ne '/';
         $n=&bname($targer);
         $ret.="$target: $files $dep_libs\n";
-        $ret.="\t\$(LINK) \$(LFLAGS) $efile$target @<<\n";
-        $ret.="  \$(APP_EX_OBJ) $files $libs\n<<\n";
-        $ret.="\tIF EXIST \$@.manifest mt -nologo -manifest \$@.manifest -outputresource:\$@;1\n\n";
+        if ($standalone == 1)
+                {
+                $ret.="  \$(LINK) \$(LFLAGS) $efile$target @<<\n\t";
+                $ret.= "\$(EX_LIBS) " if ($files =~ /O_FIPSCANISTER/ && !$fipscanisterbuild);
+                $ret.="$files $libs\n<<\n";
+                }
+        elsif ($standalone == 2)
+                {
+                $ret.="\tSET FIPS_LINK=\$(LINK)\n";
+                $ret.="\tSET FIPS_CC=\$(CC)\n";
+                $ret.="\tSET FIPS_CC_ARGS=/Fo\$(OBJ_D)${o}fips_premain.obj \$(SHLIB_CFLAGS) -c\n";
+                $ret.="\tSET PREMAIN_DSO_EXE=\n";
+                $ret.="\tSET FIPS_TARGET=$target\n";
+                $ret.="\tSET FIPS_SHA1_EXE=\$(FIPS_SHA1_EXE)\n";
+                $ret.="\tSET FIPSLIB_D=\$(FIPSLIB_D)\n";
+                $ret.="\t\$(FIPSLINK) \$(LFLAGS) /map $efile$target @<<\n";
+                $ret.="\t\$(APP_EX_OBJ) $files \$(OBJ_D)${o}fips_premain.obj $libs\n<<\n";
+                }
+        else
+                {
+                $ret.="\t\$(LINK) \$(LFLAGS) $efile$target @<<\n";
+                $ret.="\t\$(APP_EX_OBJ) $files $libs\n<<\n";
+                }
+        $ret.="\tIF EXIST \$@.manifest mt -nologo -manifest \$@.manifest -outputresource:\$@;1\n\n";
         return($ret);
         }
 
diff --git a/src/lib/libcrypto/util/ssleay.num b/src/lib/libcrypto/util/ssleay.num
index 15a58e7b13..37655bc40a 100644
--- a/src/lib/libcrypto/util/ssleay.num
+++ b/src/lib/libcrypto/util/ssleay.num
@@ -259,3 +259,64 @@ SSL_set_session_secret_cb               307	EXIST::FUNCTION:
 SSL_set_session_ticket_ext_cb           308     EXIST::FUNCTION:
 SSL_set1_param                          309     EXIST::FUNCTION:
 SSL_CTX_set1_param                      310     EXIST::FUNCTION:
+SSL_tls1_key_exporter                   311     NOEXIST::FUNCTION:
+SSL_renegotiate_abbreviated             312     EXIST::FUNCTION:
+TLSv1_1_method                          313     EXIST::FUNCTION:
+TLSv1_1_client_method                   314     EXIST::FUNCTION:
+TLSv1_1_server_method                   315     EXIST::FUNCTION:
+SSL_CTX_set_srp_client_pwd_callback     316     EXIST:!VMS:FUNCTION:SRP
+SSL_CTX_set_srp_client_pwd_cb           316     EXIST:VMS:FUNCTION:SRP
+SSL_get_srp_g                           317     EXIST::FUNCTION:SRP
+SSL_CTX_set_srp_username_callback       318     EXIST:!VMS:FUNCTION:SRP
+SSL_CTX_set_srp_un_cb                   318     EXIST:VMS:FUNCTION:SRP
+SSL_get_srp_userinfo                    319     EXIST::FUNCTION:SRP
+SSL_set_srp_server_param                320     EXIST::FUNCTION:SRP
+SSL_set_srp_server_param_pw             321     EXIST::FUNCTION:SRP
+SSL_get_srp_N                           322     EXIST::FUNCTION:SRP
+SSL_get_srp_username                    323     EXIST::FUNCTION:SRP
+SSL_CTX_set_srp_password                324     EXIST::FUNCTION:SRP
+SSL_CTX_set_srp_strength                325     EXIST::FUNCTION:SRP
+SSL_CTX_set_srp_verify_param_callback   326     EXIST:!VMS:FUNCTION:SRP
+SSL_CTX_set_srp_vfy_param_cb            326     EXIST:VMS:FUNCTION:SRP
+SSL_CTX_set_srp_miss_srp_un_cb          327     NOEXIST::FUNCTION:
+SSL_CTX_set_srp_missing_srp_username_callback 327       NOEXIST::FUNCTION:
+SSL_CTX_set_srp_cb_arg                  328     EXIST::FUNCTION:SRP
+SSL_CTX_set_srp_username                329     EXIST::FUNCTION:SRP
+SSL_CTX_SRP_CTX_init                    330     EXIST::FUNCTION:SRP
+SSL_SRP_CTX_init                        331     EXIST::FUNCTION:SRP
+SRP_Calc_A_param                        332     EXIST::FUNCTION:SRP
+SRP_generate_server_master_secret       333     EXIST:!VMS:FUNCTION:SRP
+SRP_gen_server_master_secret            333     EXIST:VMS:FUNCTION:SRP
+SSL_CTX_SRP_CTX_free                    334     EXIST::FUNCTION:SRP
+SRP_generate_client_master_secret       335     EXIST:!VMS:FUNCTION:SRP
+SRP_gen_client_master_secret            335     EXIST:VMS:FUNCTION:SRP
+SSL_srp_server_param_with_username      336     EXIST:!VMS:FUNCTION:SRP
+SSL_srp_server_param_with_un            336     EXIST:VMS:FUNCTION:SRP
+SRP_have_to_put_srp_username            337     NOEXIST::FUNCTION:
+SSL_SRP_CTX_free                        338     EXIST::FUNCTION:SRP
+SSL_set_debug                           339     EXIST::FUNCTION:
+SSL_SESSION_get0_peer                   340     EXIST::FUNCTION:
+TLSv1_2_client_method                   341     EXIST::FUNCTION:
+SSL_SESSION_set1_id_context             342     EXIST::FUNCTION:
+TLSv1_2_server_method                   343     EXIST::FUNCTION:
+SSL_cache_hit                           344     EXIST::FUNCTION:
+SSL_get0_kssl_ctx                       345     EXIST::FUNCTION:KRB5
+SSL_set0_kssl_ctx                       346     EXIST::FUNCTION:KRB5
+SSL_SESSION_get0_id                     347     NOEXIST::FUNCTION:
+SSL_set_state                           348     EXIST::FUNCTION:
+SSL_CIPHER_get_id                       349     EXIST::FUNCTION:
+TLSv1_2_method                          350     EXIST::FUNCTION:
+SSL_SESSION_get_id_len                  351     NOEXIST::FUNCTION:
+kssl_ctx_get0_client_princ              352     EXIST::FUNCTION:KRB5
+SSL_export_keying_material              353     EXIST::FUNCTION:TLSEXT
+SSL_set_tlsext_use_srtp                 354     EXIST::FUNCTION:
+SSL_CTX_set_next_protos_advertised_cb   355     EXIST:!VMS:FUNCTION:NEXTPROTONEG
+SSL_CTX_set_next_protos_adv_cb          355     EXIST:VMS:FUNCTION:NEXTPROTONEG
+SSL_get0_next_proto_negotiated          356     EXIST::FUNCTION:NEXTPROTONEG
+SSL_get_selected_srtp_profile           357     EXIST::FUNCTION:
+SSL_CTX_set_tlsext_use_srtp             358     EXIST::FUNCTION:
+SSL_select_next_proto                   359     EXIST::FUNCTION:NEXTPROTONEG
+SSL_get_srtp_profiles                   360     EXIST::FUNCTION:
+SSL_CTX_set_next_proto_select_cb        361     EXIST:!VMS:FUNCTION:NEXTPROTONEG
+SSL_CTX_set_next_proto_sel_cb           361     EXIST:VMS:FUNCTION:NEXTPROTONEG
+SSL_SESSION_get_compress_id             362     EXIST::FUNCTION:
diff --git a/src/lib/libcrypto/x509/x509.h b/src/lib/libcrypto/x509/x509.h
index e6f8a40395..092dd7450d 100644
--- a/src/lib/libcrypto/x509/x509.h
+++ b/src/lib/libcrypto/x509/x509.h
@@ -657,11 +657,15 @@ int NETSCAPE_SPKI_set_pubkey(NETSCAPE_SPKI *x, EVP_PKEY *pkey);
 
 int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki);
 
+int X509_signature_dump(BIO *bp,const ASN1_STRING *sig, int indent);
 int X509_signature_print(BIO *bp,X509_ALGOR *alg, ASN1_STRING *sig);
 
 int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
+int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx);
 int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md);
+int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx);
 int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md);
+int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx);
 int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md);
 
 int X509_pubkey_digest(const X509 *data,const EVP_MD *type,
@@ -763,6 +767,7 @@ X509_ALGOR *X509_ALGOR_dup(X509_ALGOR *xn);
 int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval);
 void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,
                                                 X509_ALGOR *algor);
+void X509_ALGOR_set_md(X509_ALGOR *alg, const EVP_MD *md);
 
 X509_NAME *X509_NAME_dup(X509_NAME *xn);
 X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne);
@@ -896,6 +901,9 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *algor1,
 int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
         ASN1_BIT_STRING *signature,
         void *data, EVP_PKEY *pkey, const EVP_MD *type);
+int ASN1_item_sign_ctx(const ASN1_ITEM *it,
+                X509_ALGOR *algor1, X509_ALGOR *algor2,
+                ASN1_BIT_STRING *signature, void *asn, EVP_MD_CTX *ctx);
 #endif
 
 int             X509_set_version(X509 *x,long version);
@@ -1161,6 +1169,9 @@ X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter,
                                  unsigned char *salt, int saltlen,
                                  unsigned char *aiv, int prf_nid);
 
+X509_ALGOR *PKCS5_pbkdf2_set(int iter, unsigned char *salt, int saltlen,
+                                int prf_nid, int keylen);
+
 /* PKCS#8 utilities */
 
 DECLARE_ASN1_FUNCTIONS(PKCS8_PRIV_KEY_INFO)
diff --git a/src/lib/libcrypto/x509/x509_cmp.c b/src/lib/libcrypto/x509/x509_cmp.c
index 4bc9da07e0..7c2aaee2e9 100644
--- a/src/lib/libcrypto/x509/x509_cmp.c
+++ b/src/lib/libcrypto/x509/x509_cmp.c
@@ -87,15 +87,20 @@ unsigned long X509_issuer_and_serial_hash(X509 *a)
         EVP_MD_CTX_init(&ctx);
         f=X509_NAME_oneline(a->cert_info->issuer,NULL,0);
         ret=strlen(f);
-        EVP_DigestInit_ex(&ctx, EVP_md5(), NULL);
-        EVP_DigestUpdate(&ctx,(unsigned char *)f,ret);
+        if (!EVP_DigestInit_ex(&ctx, EVP_md5(), NULL))
+                goto err;
+        if (!EVP_DigestUpdate(&ctx,(unsigned char *)f,ret))
+                goto err;
         OPENSSL_free(f);
-        EVP_DigestUpdate(&ctx,(unsigned char *)a->cert_info->serialNumber->data,
-                (unsigned long)a->cert_info->serialNumber->length);
-        EVP_DigestFinal_ex(&ctx,&(md[0]),NULL);
+        if(!EVP_DigestUpdate(&ctx,(unsigned char *)a->cert_info->serialNumber->data,
+                (unsigned long)a->cert_info->serialNumber->length))
+                goto err;
+        if (!EVP_DigestFinal_ex(&ctx,&(md[0]),NULL))
+                goto err;
         ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                 ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
                 )&0xffffffffL;
+        err:
         EVP_MD_CTX_cleanup(&ctx);
         return(ret);
         }
@@ -219,7 +224,9 @@ unsigned long X509_NAME_hash(X509_NAME *x)
 
         /* Make sure X509_NAME structure contains valid cached encoding */
         i2d_X509_NAME(x,NULL);
-        EVP_Digest(x->canon_enc, x->canon_enclen, md, NULL, EVP_sha1(), NULL);
+        if (!EVP_Digest(x->canon_enc, x->canon_enclen, md, NULL, EVP_sha1(),
+                NULL))
+                return 0;
 
         ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                 ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
@@ -234,12 +241,18 @@ unsigned long X509_NAME_hash(X509_NAME *x)
 
 unsigned long X509_NAME_hash_old(X509_NAME *x)
         {
+        EVP_MD_CTX md_ctx;
         unsigned long ret=0;
         unsigned char md[16];
 
         /* Make sure X509_NAME structure contains valid cached encoding */
         i2d_X509_NAME(x,NULL);
-        EVP_Digest(x->bytes->data, x->bytes->length, md, NULL, EVP_md5(), NULL);
+        EVP_MD_CTX_init(&md_ctx);
+        EVP_MD_CTX_set_flags(&md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+        EVP_DigestInit_ex(&md_ctx, EVP_md5(), NULL);
+        EVP_DigestUpdate(&md_ctx, x->bytes->data, x->bytes->length);
+        EVP_DigestFinal_ex(&md_ctx,md,NULL);
+        EVP_MD_CTX_cleanup(&md_ctx);
 
         ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                 ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
diff --git a/src/lib/libcrypto/x509/x509_lu.c b/src/lib/libcrypto/x509/x509_lu.c
index 3a6e04a1de..38525a8cdd 100644
--- a/src/lib/libcrypto/x509/x509_lu.c
+++ b/src/lib/libcrypto/x509/x509_lu.c
@@ -87,7 +87,7 @@ void X509_LOOKUP_free(X509_LOOKUP *ctx)
         if (ctx == NULL) return;
         if (    (ctx->method != NULL) &&
                 (ctx->method->free != NULL))
-                ctx->method->free(ctx);
+                (*ctx->method->free)(ctx);
         OPENSSL_free(ctx);
         }
 
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 701ec565e9..b0779db023 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -153,7 +153,6 @@ static int x509_subject_cmp(X509 **a, X509 **b)
 int X509_verify_cert(X509_STORE_CTX *ctx)
         {
         X509 *x,*xtmp,*chain_ss=NULL;
-        X509_NAME *xn;
         int bad_chain = 0;
         X509_VERIFY_PARAM *param = ctx->param;
         int depth,i,ok=0;
@@ -205,7 +204,6 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                                          */
 
                 /* If we are self signed, we break */
-                xn=X509_get_issuer_name(x);
                 if (ctx->check_issued(ctx, x,x)) break;
 
                 /* If we were passed a cert chain, use it first */
@@ -242,7 +240,6 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
 
         i=sk_X509_num(ctx->chain);
         x=sk_X509_value(ctx->chain,i-1);
-        xn = X509_get_subject_name(x);
         if (ctx->check_issued(ctx, x, x))
                 {
                 /* we have a self signed certificate */
@@ -291,7 +288,6 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                 if (depth < num) break;
 
                 /* If we are self signed, we break */
-                xn=X509_get_issuer_name(x);
                 if (ctx->check_issued(ctx,x,x)) break;
 
                 ok = ctx->get_issuer(&xtmp, ctx, x);
@@ -310,7 +306,6 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                 }
 
         /* we now have our chain, lets check it... */
-        xn=X509_get_issuer_name(x);
 
         /* Is last certificate looked up self signed? */
         if (!ctx->check_issued(ctx,x,x))
diff --git a/src/lib/libcrypto/x509/x509type.c b/src/lib/libcrypto/x509/x509type.c
index 3385ad3f67..9702ec5310 100644
--- a/src/lib/libcrypto/x509/x509type.c
+++ b/src/lib/libcrypto/x509/x509type.c
@@ -100,20 +100,26 @@ int X509_certificate_type(X509 *x, EVP_PKEY *pkey)
                 break;
                 }
 
-        i=X509_get_signature_type(x);
-        switch (i)
+        i=OBJ_obj2nid(x->sig_alg->algorithm);
+        if (i && OBJ_find_sigid_algs(i, NULL, &i))
                 {
-        case EVP_PKEY_RSA:
-                ret|=EVP_PKS_RSA;
-                break;
-        case EVP_PKEY_DSA:
-                ret|=EVP_PKS_DSA;
-                break;
-        case EVP_PKEY_EC:
-                ret|=EVP_PKS_EC;
-                break;
-        default:
-                break;
+
+                switch (i)
+                        {
+                case NID_rsaEncryption:
+                case NID_rsa:
+                        ret|=EVP_PKS_RSA;
+                        break;
+                case NID_dsa:
+                case NID_dsa_2:
+                        ret|=EVP_PKS_DSA;
+                        break;
+                case NID_X9_62_id_ecPublicKey:
+                        ret|=EVP_PKS_EC;
+                        break;
+                default:
+                        break;
+                        }
                 }
 
         if (EVP_PKEY_size(pk) <= 1024/8)/* /8 because it's 1024 bits we look
diff --git a/src/lib/libcrypto/x509/x_all.c b/src/lib/libcrypto/x509/x_all.c
index 8ec88c215a..b94aeeb873 100644
--- a/src/lib/libcrypto/x509/x_all.c
+++ b/src/lib/libcrypto/x509/x_all.c
@@ -95,12 +95,25 @@ int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
                 x->sig_alg, x->signature, x->cert_info,pkey,md));
         }
 
+int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx)
+        {
+        return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CINF),
+                x->cert_info->signature,
+                x->sig_alg, x->signature, x->cert_info, ctx);
+        }
+
 int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md)
         {
         return(ASN1_item_sign(ASN1_ITEM_rptr(X509_REQ_INFO),x->sig_alg, NULL,
                 x->signature, x->req_info,pkey,md));
         }
 
+int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx)
+        {
+        return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_REQ_INFO),
+                x->sig_alg, NULL, x->signature, x->req_info, ctx);
+        }
+
 int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md)
         {
         x->crl->enc.modified = 1;
@@ -108,6 +121,12 @@ int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md)
                 x->sig_alg, x->signature, x->crl,pkey,md));
         }
 
+int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx)
+        {
+        return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CRL_INFO),
+                x->crl->sig_alg, x->sig_alg, x->signature, x->crl, ctx);
+        }
+
 int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md)
         {
         return(ASN1_item_sign(ASN1_ITEM_rptr(NETSCAPE_SPKAC), x->sig_algor,NULL,
diff --git a/src/lib/libcrypto/x509v3/v3_asid.c b/src/lib/libcrypto/x509v3/v3_asid.c
index 3f434c0603..1587e8ed72 100644
--- a/src/lib/libcrypto/x509v3/v3_asid.c
+++ b/src/lib/libcrypto/x509v3/v3_asid.c
@@ -358,6 +358,20 @@ static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
       goto done;
   }
 
+  /*
+   * Check for inverted range.
+   */
+  i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
+  {
+    ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
+    ASN1_INTEGER *a_min, *a_max;
+    if (a != NULL && a->type == ASIdOrRange_range) {
+      extract_min_max(a, &a_min, &a_max);
+      if (ASN1_INTEGER_cmp(a_min, a_max) > 0)
+        goto done;
+    }
+  }
+
   ret = 1;
 
  done:
@@ -392,9 +406,18 @@ static int ASIdentifierChoice_canonize(ASIdentifierChoice *choice)
     return 1;
 
   /*
-   * We have a list.  Sort it.
+   * If not a list, or if empty list, it's broken.
+   */
+  if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
+      sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0) {
+    X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
+              X509V3_R_EXTENSION_VALUE_ERROR);
+    return 0;
+  }
+
+  /*
+   * We have a non-empty list.  Sort it.
    */
-  OPENSSL_assert(choice->type == ASIdentifierChoice_asIdsOrRanges);
   sk_ASIdOrRange_sort(choice->u.asIdsOrRanges);
 
   /*
@@ -415,6 +438,13 @@ static int ASIdentifierChoice_canonize(ASIdentifierChoice *choice)
     OPENSSL_assert(ASN1_INTEGER_cmp(a_min, b_min) <= 0);
 
     /*
+     * Punt inverted ranges.
+     */
+    if (ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
+        ASN1_INTEGER_cmp(b_min, b_max) > 0)
+      goto done;
+
+    /*
      * Check for overlaps.
      */
     if (ASN1_INTEGER_cmp(a_max, b_min) >= 0) {
@@ -465,12 +495,26 @@ static int ASIdentifierChoice_canonize(ASIdentifierChoice *choice)
         break;
       }
       ASIdOrRange_free(b);
-      sk_ASIdOrRange_delete(choice->u.asIdsOrRanges, i + 1);
+      (void) sk_ASIdOrRange_delete(choice->u.asIdsOrRanges, i + 1);
       i--;
       continue;
     }
   }
 
+  /*
+   * Check for final inverted range.
+   */
+  i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
+  {
+    ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
+    ASN1_INTEGER *a_min, *a_max;
+    if (a != NULL && a->type == ASIdOrRange_range) {
+      extract_min_max(a, &a_min, &a_max);
+      if (ASN1_INTEGER_cmp(a_min, a_max) > 0)
+        goto done;
+    }
+  }
+
   OPENSSL_assert(ASIdentifierChoice_is_canonical(choice)); /* Paranoia */
 
   ret = 1;
@@ -498,6 +542,7 @@ static void *v2i_ASIdentifiers(const struct v3_ext_method *method,
                                struct v3_ext_ctx *ctx,
                                STACK_OF(CONF_VALUE) *values)
 {
+  ASN1_INTEGER *min = NULL, *max = NULL;
   ASIdentifiers *asid = NULL;
   int i;
 
@@ -508,7 +553,6 @@ static void *v2i_ASIdentifiers(const struct v3_ext_method *method,
 
   for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
     CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
-    ASN1_INTEGER *min = NULL, *max = NULL;
     int i1, i2, i3, is_range, which;
 
     /*
@@ -578,18 +622,19 @@ static void *v2i_ASIdentifiers(const struct v3_ext_method *method,
       max = s2i_ASN1_INTEGER(NULL, s + i2);
       OPENSSL_free(s);
       if (min == NULL || max == NULL) {
-        ASN1_INTEGER_free(min);
-        ASN1_INTEGER_free(max);
         X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
         goto err;
       }
+      if (ASN1_INTEGER_cmp(min, max) > 0) {
+        X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_EXTENSION_VALUE_ERROR);
+        goto err;
+      }
     }
     if (!v3_asid_add_id_or_range(asid, which, min, max)) {
-      ASN1_INTEGER_free(min);
-      ASN1_INTEGER_free(max);
       X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
       goto err;
     }
+    min = max = NULL;
   }
 
   /*
@@ -601,6 +646,8 @@ static void *v2i_ASIdentifiers(const struct v3_ext_method *method,
 
  err:
   ASIdentifiers_free(asid);
+  ASN1_INTEGER_free(min);
+  ASN1_INTEGER_free(max);
   return NULL;
 }
 
diff --git a/src/lib/libcrypto/x509v3/v3_skey.c b/src/lib/libcrypto/x509v3/v3_skey.c
index 202c9e4896..0a984fbaa8 100644
--- a/src/lib/libcrypto/x509v3/v3_skey.c
+++ b/src/lib/libcrypto/x509v3/v3_skey.c
@@ -129,7 +129,8 @@ static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method,
                 goto err;
         }
 
-        EVP_Digest(pk->data, pk->length, pkey_dig, &diglen, EVP_sha1(), NULL);
+        if (!EVP_Digest(pk->data, pk->length, pkey_dig, &diglen, EVP_sha1(), NULL))
+                goto err;
 
         if(!M_ASN1_OCTET_STRING_set(oct, pkey_dig, diglen)) {
                 X509V3err(X509V3_F_S2I_SKEY_ID,ERR_R_MALLOC_FAILURE);
diff --git a/src/lib/libcrypto/x86_64cpuid.pl b/src/lib/libcrypto/x86_64cpuid.pl
index b771a8539d..58e9bedcf0 100644
--- a/src/lib/libcrypto/x86_64cpuid.pl
+++ b/src/lib/libcrypto/x86_64cpuid.pl
@@ -7,16 +7,25 @@ if ($flavour =~ /\./) { $output = $flavour; undef $flavour; }
 $win64=0; $win64=1 if ($flavour =~ /[nm]asm|mingw64/ || $output =~ /\.asm$/);
 
 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
-open STDOUT,"| $^X ${dir}perlasm/x86_64-xlate.pl $flavour $output";
+( $xlate="${dir}x86_64-xlate.pl" and -f $xlate ) or
+( $xlate="${dir}perlasm/x86_64-xlate.pl" and -f $xlate) or
+die "can't locate x86_64-xlate.pl";
+
+open STDOUT,"| $^X $xlate $flavour $output";
+
+($arg1,$arg2,$arg3,$arg4)=$win64?("%rcx","%rdx","%r8", "%r9") : # Win64 order
+                                 ("%rdi","%rsi","%rdx","%rcx"); # Unix order
 
-if ($win64)     { $arg1="%rcx"; $arg2="%rdx"; }
-else            { $arg1="%rdi"; $arg2="%rsi"; }
 print<<___;
 #include <machine/asm.h>
 .extern         OPENSSL_cpuid_setup
+.hidden         OPENSSL_cpuid_setup
 .section        .init
         call    PIC_PLT(OPENSSL_cpuid_setup)
 
+.hidden OPENSSL_ia32cap_P
+.comm   OPENSSL_ia32cap_P,8,4
+
 .text
 
 .globl  OPENSSL_atomic_add
@@ -47,7 +56,7 @@ OPENSSL_rdtsc:
 .type   OPENSSL_ia32_cpuid,\@abi-omnipotent
 .align  16
 OPENSSL_ia32_cpuid:
-        mov     %rbx,%r8
+        mov     %rbx,%r8                # save %rbx
 
         xor     %eax,%eax
         cpuid
@@ -79,7 +88,15 @@ OPENSSL_ia32_cpuid:
         # AMD specific
         mov     \$0x80000000,%eax
         cpuid
-        cmp     \$0x80000008,%eax
+        cmp     \$0x80000001,%eax
+        jb      .Lintel
+        mov     %eax,%r10d
+        mov     \$0x80000001,%eax
+        cpuid
+        or      %ecx,%r9d
+        and     \$0x00000801,%r9d       # isolate AMD XOP bit, 1<<11
+
+        cmp     \$0x80000008,%r10d
         jb      .Lintel
 
         mov     \$0x80000008,%eax
@@ -90,12 +107,12 @@ OPENSSL_ia32_cpuid:
         mov     \$1,%eax
         cpuid
         bt      \$28,%edx               # test hyper-threading bit
-        jnc     .Ldone
+        jnc     .Lgeneric
         shr     \$16,%ebx               # number of logical processors
         cmp     %r10b,%bl
-        ja      .Ldone
+        ja      .Lgeneric
         and     \$0xefffffff,%edx       # ~(1<<28)
-        jmp     .Ldone
+        jmp     .Lgeneric
 
 .Lintel:
         cmp     \$4,%r11d
@@ -112,30 +129,47 @@ OPENSSL_ia32_cpuid:
 .Lnocacheinfo:
         mov     \$1,%eax
         cpuid
+        and     \$0xbfefffff,%edx       # force reserved bits to 0
         cmp     \$0,%r9d
         jne     .Lnotintel
-        or      \$0x00100000,%edx       # use reserved 20th bit to engage RC4_CHAR
+        or      \$0x40000000,%edx       # set reserved bit#30 on Intel CPUs
         and     \$15,%ah
         cmp     \$15,%ah                # examine Family ID
-        je      .Lnotintel
-        or      \$0x40000000,%edx       # use reserved bit to skip unrolled loop
+        jne     .Lnotintel
+        or      \$0x00100000,%edx       # set reserved bit#20 to engage RC4_CHAR
 .Lnotintel:
         bt      \$28,%edx               # test hyper-threading bit
-        jnc     .Ldone
+        jnc     .Lgeneric
         and     \$0xefffffff,%edx       # ~(1<<28)
         cmp     \$0,%r10d
-        je      .Ldone
+        je      .Lgeneric
 
         or      \$0x10000000,%edx       # 1<<28
         shr     \$16,%ebx
         cmp     \$1,%bl                 # see if cache is shared
-        ja      .Ldone
+        ja      .Lgeneric
         and     \$0xefffffff,%edx       # ~(1<<28)
+.Lgeneric:
+        and     \$0x00000800,%r9d       # isolate AMD XOP flag
+        and     \$0xfffff7ff,%ecx
+        or      %ecx,%r9d               # merge AMD XOP flag
+
+        mov     %edx,%r10d              # %r9d:%r10d is copy of %ecx:%edx
+        bt      \$27,%r9d               # check OSXSAVE bit
+        jnc     .Lclear_avx
+        xor     %ecx,%ecx               # XCR0
+        .byte   0x0f,0x01,0xd0          # xgetbv
+        and     \$6,%eax                # isolate XMM and YMM state support
+        cmp     \$6,%eax
+        je      .Ldone
+.Lclear_avx:
+        mov     \$0xefffe7ff,%eax       # ~(1<<28|1<<12|1<<11)
+        and     %eax,%r9d               # clear AVX, FMA and AMD XOP bits
 .Ldone:
-        shl     \$32,%rcx
-        mov     %edx,%eax
-        mov     %r8,%rbx
-        or      %rcx,%rax
+        shl     \$32,%r9
+        mov     %r10d,%eax
+        mov     %r8,%rbx                # restore %rbx
+        or      %r9,%rax
         ret
 .size   OPENSSL_ia32_cpuid,.-OPENSSL_ia32_cpuid
 
@@ -230,4 +264,21 @@ OPENSSL_wipe_cpu:
 .size   OPENSSL_wipe_cpu,.-OPENSSL_wipe_cpu
 ___
 
+print<<___;
+.globl  OPENSSL_ia32_rdrand
+.type   OPENSSL_ia32_rdrand,\@abi-omnipotent
+.align  16
+OPENSSL_ia32_rdrand:
+        mov     \$8,%ecx
+.Loop_rdrand:
+        rdrand  %rax
+        jc      .Lbreak_rdrand
+        loop    .Loop_rdrand
+.Lbreak_rdrand:
+        cmp     \$0,%rax
+        cmove   %rcx,%rax
+        ret
+.size   OPENSSL_ia32_rdrand,.-OPENSSL_ia32_rdrand
+___
+
 close STDOUT;   # flush