228 files changed, 70819 insertions, 38 deletions

diff --git a/src/lib/libssl/src/INSTALL.NW b/src/lib/libssl/src/INSTALL.NW
new file mode 100644
index 0000000000..609a7309e1
--- /dev/null
+++ b/src/lib/libssl/src/INSTALL.NW
@@ -0,0 +1,454 @@
+
+INSTALLATION ON THE NETWARE PLATFORM
+------------------------------------
+
+Notes about building OpenSSL for NetWare.
+
+
+BUILD PLATFORM:
+---------------
+The build scripts (batch files, perl scripts, etc) have been developed and
+tested on W2K.  The scripts should run fine on other Windows platforms
+(NT, Win9x, WinXP) but they have not been tested.  They may require some
+modifications.
+
+
+Supported NetWare Platforms - NetWare 5.x, NetWare 6.x:
+-------------------------------------------------------
+OpenSSL can either use the WinSock interfaces introduced in NetWare 5,
+or the BSD socket interface.  Previous versions of NetWare, 4.x and 3.x,
+are only supported if OpenSSL is build for CLIB and BSD sockets;
+WinSock builds only support NetWare 5 and up.
+
+On NetWare there are two c-runtime libraries.  There is the legacy CLIB 
+interfaces and the newer LIBC interfaces.  Being ANSI-C libraries, the 
+functionality in CLIB and LIBC is similar but the LIBC interfaces are built 
+using Novell Kernal Services (NKS) which is designed to leverage 
+multi-processor environments.
+
+The NetWare port of OpenSSL can be configured to build using CLIB or LIBC.
+The CLIB build was developed and tested using NetWare 5.0 sp6.0a.  The LIBC 
+build was developed and tested using the NetWare 6.0 FCS.  
+
+The necessary LIBC functionality ships with NetWare 6.  However, earlier 
+NetWare 5.x versions will require updates in order to run the OpenSSL LIBC
+build (NetWare 5.1 SP8 is known to work).
+
+As of June 2005, the LIBC build can be configured to use BSD sockets instead
+of WinSock sockets. Call Configure (usually through netware\build.bat) using
+a target of "netware-libc-bsdsock" instead of "netware-libc".
+
+As of June 2007, support for CLIB and BSD sockets is also now available
+using a target of "netware-clib-bsdsock" instead of "netware-clib";
+also gcc builds are now supported on both Linux and Win32 (post 0.9.8e).
+
+REQUIRED TOOLS:
+---------------
+Based upon the configuration and build options used, some or all of the
+following tools may be required:
+
+* Perl for Win32 - required (http://www.activestate.com/ActivePerl)
+   Used to run the various perl scripts on the build platform.
+
+* Perl 5.8.0 for NetWare v3.20 (or later) - required 
+   (http://developer.novell.com) Used to run the test script on NetWare 
+   after building.
+
+* Compiler / Linker - required:
+   Metrowerks CodeWarrior PDK 2.1 (or later) for NetWare (commercial):
+      Provides command line tools used for building.
+      Tools:
+      mwccnlm.exe  - C/C++ Compiler for NetWare
+      mwldnlm.exe  - Linker for NetWare
+      mwasmnlm.exe - x86 assembler for NetWare (if using assembly option)
+
+   gcc / nlmconv Cross-Compiler, available from Novell Forge (free):
+         http://forge.novell.com/modules/xfmod/project/?aunixnw
+
+* Assemblers - optional:
+   If you intend to build using the assembly options you will need an
+   assembler.  Work has been completed to support two assemblers, Metrowerks
+   and NASM.  However, during development, a bug was found in the Metrowerks
+   assembler which generates incorrect code.  Until this problem is fixed,
+   the Metrowerks assembler cannot be used.
+
+   mwasmnlm.exe - Metrowerks x86 assembler - part of CodeWarrior tools.
+         (version 2.2 Built Aug 23, 1999 - not useable due to code
+          generation bug)
+
+   nasmw.exe - Netwide Assembler NASM
+         version 0.98 was used in development and testing
+
+* Make Tool - required:
+   In order to build you will need a make tool.  Two make tools are
+   supported, GNU make (gmake.exe) or Microsoft nmake.exe.
+
+   make.exe - GNU make for Windows (version 3.75 used for development)
+         http://gnuwin32.sourceforge.net/packages/make.htm
+
+   nmake.exe - Microsoft make (Version 6.00.8168.0 used for development)
+         http://support.microsoft.com/kb/132084/EN-US/
+
+* Novell Developer Kit (NDK) - required: (http://developer.novell.com)
+
+   CLIB - BUILDS:
+
+      WinSock2 Developer Components for NetWare:
+         For initial development, the October 27, 2000 version was used.
+         However, future versions should also work.
+
+         NOTE:  The WinSock2 components include headers & import files for
+         NetWare, but you will also need the winsock2.h and supporting
+         headers (pshpack4.h, poppack.h, qos.h) delivered in the
+         Microsoft SDK.  Note: The winsock2.h support headers may change
+         with various versions of winsock2.h.  Check the dependencies
+         section on the NDK WinSock2 download page for the latest
+         information on dependencies. These components are unsupported by
+         Novell. They are provided as a courtesy, but it is strongly
+         suggested that all development be done using LIBC, not CLIB.
+
+         As of June 2005, the WinSock2 components are available at:
+         http://forgeftp.novell.com//ws2comp/
+
+
+      NLM and NetWare libraries for C (including CLIB and XPlat):
+         If you are going to build a CLIB version of OpenSSL, you will
+         need the CLIB headers and imports.  The March, 2001 NDK release or 
+         later is recommended.
+
+         Earlier versions should work but haven't been tested.  In recent
+         versions the import files have been consolidated and function
+         names moved.  This means you may run into link problems
+         (undefined symbols) when using earlier versions.   The functions
+         are available in earlier versions, but you will have to modifiy
+         the make files to include additional import files (see
+         openssl\util\pl\netware.pl).
+
+
+   LIBC - BUILDS:
+   
+      Libraries for C (LIBC) - LIBC headers and import files
+         If you are going to build a LIBC version of OpenSSL, you will
+         need the LIBC headers and imports.  The March 14, 2002 NDK release or
+         later is required.  
+         
+         NOTE: The LIBC SDK includes the necessary WinSock2 support.
+         It is not necessary to download the WinSock2 NDK when building for
+         LIBC. The LIBC SDK also includes the appropriate BSD socket support
+         if configuring to use BSD sockets.
+
+
+BUILDING:
+---------
+Before building, you will need to set a few environment variables.  You can
+set them manually or you can modify the "netware\set_env.bat" file.
+
+The set_env.bat file is a template you can use to set up the path
+and environment variables you will need to build.  Modify the
+various lines to point to YOUR tools and run set_env.bat.
+
+   netware\set_env.bat <target> [compiler]
+
+      target        - "netware-clib" - CLIB NetWare build
+                    - "netware-libc" - LIBC NetWare build
+
+      compiler      - "gnuc"         - GNU GCC Compiler
+                    - "codewarrior"  - MetroWerks CodeWarrior (default)
+
+If you don't use set_env.bat, you will need to set up the following
+environment variables:
+
+   PATH - Set PATH to point to the tools you will use.
+
+   INCLUDE - The location of the NDK include files.
+         
+            CLIB ex: set INCLUDE=c:\ndk\nwsdk\include\nlm
+            LIBC ex: set INCLUDE=c:\ndk\libc\include
+
+   PRELUDE - The absolute path of the prelude object to link with.  For
+            a CLIB build it is recommended you use the "clibpre.o" files shipped
+            with the Metrowerks PDK for NetWare.  For a LIBC build you should 
+            use the "libcpre.o" file delivered with the LIBC NDK components.
+
+            CLIB ex: set PRELUDE=c:\ndk\nwsdk\imports\clibpre.o
+            LIBC ex: set PRELUDE=c:\ndk\libc\imports\libcpre.o
+
+   IMPORTS - The locaton of the NDK import files.
+
+            CLIB ex: set IMPORTS=c:\ndk\nwsdk\imports
+            LIBC ex: set IMPORTS=c:\ndk\libc\imports
+
+
+In order to build, you need to run the Perl scripts to configure the build
+process and generate a make file.  There is a batch file,
+"netware\build.bat", to automate the process.
+
+Build.bat runs the build configuration scripts and generates a make file.
+If an assembly option is specified, it also runs the scripts to generate 
+the assembly code.  Always run build.bat from the "openssl" directory.
+
+   netware\build [target] [debug opts] [assembly opts] [configure opts]
+
+      target        - "netware-clib" - CLIB NetWare build (WinSock Sockets)
+                    - "netware-clib-bsdsock" - CLIB NetWare build (BSD Sockets)
+                    - "netware-libc" - LIBC NetWare build (WinSock Sockets)
+                    - "netware-libc-bsdsock" - LIBC NetWare build (BSD Sockets)
+ 
+      debug opts    - "debug"  - build debug
+
+      assembly opts - "nw-mwasm" - use Metrowerks assembler
+                      "nw-nasm"  - use NASM assembler
+                      "no-asm"   - don't use assembly
+
+      configure opts- all unrecognized arguments are passed to the
+                      perl 'configure' script. See that script for
+                      internal documentation regarding options that
+                      are available.
+
+   examples:
+
+      CLIB build, debug, without assembly:
+         netware\build.bat netware-clib debug no-asm
+
+      LIBC build, non-debug, using NASM assembly, add mdc2 support:
+         netware\build.bat netware-libc nw-nasm enable-mdc2
+
+      LIBC build, BSD sockets, non-debug, without assembly:
+         netware\build.bat netware-libc-bsdsock no-asm
+
+Running build.bat generates a make file to be processed by your make 
+tool (gmake or nmake):
+
+   CLIB ex: gmake -f netware\nlm_clib_dbg.mak 
+   LIBC ex: gmake -f netware\nlm_libc.mak 
+   LIBC ex: gmake -f netware\nlm_libc_bsdsock.mak 
+
+
+You can also run the build scripts manually if you do not want to use the
+build.bat file.  Run the following scripts in the "\openssl"
+subdirectory (in the order listed below):
+
+   perl configure no-asm [other config opts] [netware-clib|netware-libc|netware-libc-bsdsock]
+      configures no assembly build for specified netware environment
+      (CLIB or LIBC).
+
+   perl util\mkfiles.pl >MINFO
+      generates a listing of source files (used by mk1mf)
+
+   perl util\mk1mf.pl no-asm [other config opts] [netware-clib|netware-libc|netware-libc-bsdsock >netware\nlm.mak
+      generates the makefile for NetWare
+
+   gmake -f netware\nlm.mak
+      build with the make tool (nmake.exe also works)
+
+NOTE:  If you are building using the assembly option, you must also run the
+various Perl scripts to generate the assembly files.  See build.bat
+for an example of running the various assembly scripts.  You must use the
+"no-asm" option to build without assembly.  The configure and mk1mf scripts
+also have various other options.  See the scripts for more information.
+
+
+The output from the build is placed in the following directories:
+
+   CLIB Debug build:
+      out_nw_clib.dbg     - static libs & test nlm(s)
+      tmp_nw_clib.dbg     - temporary build files
+      outinc_nw_clib      - necessary include files
+
+   CLIB Non-debug build:
+      out_nw_clib         - static libs & test nlm(s)
+      tmp_nw_clib         - temporary build files
+      outinc_nw_clib      - necesary include files
+
+   LIBC Debug build:
+      out_nw_libc.dbg     - static libs & test nlm(s)
+      tmp_nw_libc.dbg     - temporary build files
+      outinc_nw_libc      - necessary include files
+
+   LIBC Non-debug build:
+      out_nw_libc         - static libs & test nlm(s)
+      tmp_nw_libc         - temporary build files
+      outinc_nw_libc      - necesary include files
+
+
+TESTING:
+--------
+The build process creates the OpenSSL static libs ( crypto.lib, ssl.lib,
+rsaglue.lib ) and several test programs.  You should copy the test programs
+to your NetWare server and run the tests.
+
+The batch file "netware\cpy_tests.bat" will copy all the necessary files
+to your server for testing.  In order to run the batch file, you need a
+drive mapped to your target server.  It will create an "OpenSSL" directory
+on the drive and copy the test files to it.  CAUTION: If a directory with the
+name of "OpenSSL" already exists, it will be deleted.
+
+To run cpy_tests.bat:
+
+   netware\cpy_tests [output directory] [NetWare drive]
+
+      output directory - "out_nw_clib.dbg", "out_nw_libc", etc.
+      NetWare drive    - drive letter of mapped drive
+
+      CLIB ex: netware\cpy_tests out_nw_clib m:
+      LIBC ex: netware\cpy_tests out_nw_libc m:
+
+
+The Perl script, "do_tests.pl", in the "OpenSSL" directory on the server
+should be used to execute the tests.  Before running the script, make sure
+your SEARCH PATH includes the "OpenSSL" directory.  For example, if you
+copied the files to the "sys:" volume you use the command:
+
+   SEARCH ADD SYS:\OPENSSL
+
+
+To run do_tests.pl type (at the console prompt):
+
+   perl \openssl\do_tests.pl [options]
+
+      options:
+         -p    - pause after executing each test
+
+The do_tests.pl script generates a log file "\openssl\test_out\tests.log"
+which should be reviewed for errors.  Any errors will be denoted by the word
+"ERROR" in the log.
+
+DEVELOPING WITH THE OPENSSL SDK:
+--------------------------------
+Now that everything is built and tested, you are ready to use the OpenSSL
+libraries in your development.
+
+There is no real installation procedure, just copy the static libs and
+headers to your build location.  The libs (crypto.lib & ssl.lib) are
+located in the appropriate "out_nw_XXXX" directory 
+(out_nw_clib, out_nw_libc, etc).  
+
+The headers are located in the appropriate "outinc_nw_XXX" directory 
+(outinc_nw_clib, outinc_nw_libc).  
+
+One suggestion is to create the following directory 
+structure for the OpenSSL SDK:
+
+   \openssl
+      |- bin
+      |   |- openssl.nlm
+      |   |- (other tests you want)
+      |
+      |- lib
+      |   | - crypto.lib
+      |   | - ssl.lib
+      |
+      |- include
+      |   | - openssl
+      |   |    | - (all the headers in "outinc_nw\openssl")
+
+
+The program "openssl.nlm" can be very useful.  It has dozens of
+options and you may want to keep it handy for debugging, testing, etc.
+
+When building your apps using OpenSSL, define "NETWARE".  It is needed by
+some of the OpenSSL headers.  One way to do this is with a compile option,
+for example "-DNETWARE".
+
+
+
+NOTES:
+------
+
+Resource leaks in Tests
+------------------------
+Some OpenSSL tests do not clean up resources and NetWare reports
+the resource leaks when the tests unload.  If this really bugs you,
+you can stop the messages by setting the developer option off at the console
+prompt (set developer option = off).  Or better yet, fix the tests to
+clean up the resources!
+
+
+Multi-threaded Development
+---------------------------
+The NetWare version of OpenSSL is thread-safe, however multi-threaded
+applications must provide the necessary locking function callbacks.  This
+is described in doc\threads.doc.  The file "openssl-x.x.x\crypto\threads\mttest.c"
+is a multi-threaded test program and demonstrates the locking functions.
+
+
+What is openssl2.nlm?
+---------------------
+The openssl program has numerous options and can be used for many different
+things.  Many of the options operate in an interactive mode requiring the
+user to enter data.  Because of this, a default screen is created for the
+program.  However, when running the test script it is not desirable to
+have a seperate screen.  Therefore, the build also creates openssl2.nlm.
+Openssl2.nlm is functionally identical but uses the console screen.
+Openssl2 can be used when a non-interactive mode is desired.
+
+NOTE:  There are may other possibilities (command line options, etc)
+which could have been used to address the screen issue.  The openssl2.nlm
+option was chosen because it impacted only the build not the code.
+
+
+Why only static libraries?
+--------------------------
+Globals, globals, and more globals.  The OpenSSL code uses many global
+variables that are allocated and initialized when used for the first time.
+
+On NetWare, most applications (at least historically) run in the kernel.
+When running in the kernel, there is one instance of global variables.
+For regular application type NLM(s) this isn't a problem because they are
+the only ones using the globals.  However, for a library NLM (an NLM which
+exposes functions and has no threads of execution), the globals cause
+problems.  Applications could inadvertently step on each other if they
+change some globals.  Even worse, the first application that triggers a
+global to be allocated and initialized has the allocated memory charged to
+itself.  Now when that application unloads, NetWare will clean up all the
+applicaton's memory.  The global pointer variables inside OpenSSL now
+point to freed memory.  An abend waiting to happen!
+
+To work correctly in the kernel, library NLM(s) that use globals need to
+provide a set of globals (instance data) for each application.  Another
+option is to require the library only be loaded in a protected address
+space along with the application using it.
+
+Modifying the OpenSSL code to provide a set of globals (instance data) for
+each application isn't technically difficult, but due to the large number
+globals it would require substantial code changes and it wasn't done.  Hence,
+the build currently only builds static libraries which are then linked
+into each application.
+
+NOTE:  If you are building a library NLM that uses the OpenSSL static
+libraries, you will still have to deal with the global variable issue.
+This is because when you link in the OpenSSL code you bring in all the
+globals.  One possible solution for the global pointer variables is to
+register memory functions with OpenSSL which allocate memory and charge it
+to your library NLM (see the function CRYPTO_set_mem_functions).  However,
+be aware that now all memory allocated by OpenSSL is charged to your NLM.
+
+
+CodeWarrior Tools and W2K
+---------------------------
+There have been problems reported with the CodeWarrior Linker
+(mwldnlm.exe) in the PDK 2.1 for NetWare when running on Windows 2000.  The
+problems cause the link step to fail.  The only work around is to obtain an
+updated linker from Metrowerks.  It is expected Metrowerks will release
+PDK 3.0 (in beta testing at this time - May, 2001) in the near future which
+will fix these problems.
+
+
+Makefile "vclean"
+------------------
+The generated makefile has a "vclean" target which cleans up the build
+directories.  If you have been building successfully and suddenly
+experience problems, use "vclean" (gmake -f netware\nlm_xxxx.mak vclean) and retry.
+
+
+"Undefined Symbol" Linker errors
+--------------------------------
+There have been linker errors reported when doing a CLIB build.  The problems
+occur because some versions of the CLIB SDK import files inadvertently 
+left out some symbols.  One symbol in particular is "_lrotl".  The missing
+functions are actually delivered in the binaries, but they were left out of
+the import files.  The issues should be fixed in the September 2001 release 
+of the NDK.  If you experience the problems you can temporarily
+work around it by manually adding the missing symbols to your version of 
+"clib.imp".
+
diff --git a/src/lib/libssl/src/INSTALL.W64 b/src/lib/libssl/src/INSTALL.W64
new file mode 100644
index 0000000000..9fa7a19205
--- /dev/null
+++ b/src/lib/libssl/src/INSTALL.W64
@@ -0,0 +1,66 @@
+
+ INSTALLATION ON THE WIN64 PLATFORM
+ ----------------------------------
+
+ Caveat lector
+ -------------
+
+ As of moment of this writing Win64 support is classified "initial"
+ for the following reasons.
+
+ - No assembler modules are engaged upon initial 0.9.8 release.
+ - API might change within 0.9.8 life-span, *but* in a manner which
+   doesn't break backward binary compatibility. Or in other words,
+   application programs compiled with initial 0.9.8 headers will
+   be expected to work with future minor release .DLL without need
+   to re-compile, even if future minor release features modified API.
+ - Above mentioned API modifications have everything to do with
+   elimination of a number of limitations, which are normally
+   considered inherent to 32-bit platforms. Which in turn is why they
+   are treated as limitations on 64-bit platform such as Win64:-)
+   The current list comprises [but not necessarily limited to]:
+
+   - null-terminated strings may not be longer than 2G-1 bytes,
+     longer strings are treated as zero-length;
+   - dynamically and *internally* allocated chunks can't be larger
+     than 2G-1 bytes;
+   - inability to encrypt/decrypt chunks of data larger than 4GB
+     [it's possibly to *hash* chunks of arbitrary size through];
+
+   Neither of these is actually big deal and hardly encountered
+   in real-life applications.
+
+ Compiling procedure
+ -------------------
+
+ You will need Perl. You can run under Cygwin or you can download
+ ActiveState Perl from http://www.activestate.com/ActivePerl.
+
+ You will need Microsoft Platform SDK, available for download at
+ http://www.microsoft.com/msdownload/platformsdk/sdkupdate/. As per
+ April 2005 Platform SDK is equipped with Win64 compilers, as well
+ as assemblers, but it might change in the future.
+
+ To build for Win64/x64:
+
+ > perl Configure VC-WIN64A
+ > ms\do_win64a
+ > nmake -f ms\ntdll.mak
+ > cd out32dll
+ > ..\ms\test
+
+ To build for Win64/IA64:
+
+ > perl Configure VC-WIN64I
+ > ms\do_win64i
+ > nmake -f ms\ntdll.mak
+ > cd out32dll
+ > ..\ms\test
+
+ Naturally test-suite itself has to be executed on the target platform.
+
+ Installation
+ ------------
+
+ TBD, for now see INSTALL.W32.
+
diff --git a/src/lib/libssl/src/Makefile.shared b/src/lib/libssl/src/Makefile.shared
new file mode 100644
index 0000000000..97035a3c01
--- /dev/null
+++ b/src/lib/libssl/src/Makefile.shared
@@ -0,0 +1,609 @@
+#
+# Helper makefile to link shared libraries in a portable way.
+# This is much simpler than libtool, and hopefully not too error-prone.
+#
+# The following variables need to be set on the command line to build
+# properly
+
+# CC contains the current compiler.  This one MUST be defined
+CC=cc
+CFLAGS=$(CFLAG)
+# LDFLAGS contains flags to be used when temporary object files (when building
+# shared libraries) are created, or when an application is linked.
+# SHARED_LDFLAGS contains flags to be used when the shared library is created.
+LDFLAGS=
+SHARED_LDFLAGS=
+
+# LIBNAME contains just the name of the library, without prefix ("lib"
+# on Unix, "cyg" for certain forms under Cygwin...) or suffix (.a, .so,
+# .dll, ...).  This one MUST have a value when using this makefile to
+# build shared libraries.
+# For example, to build libfoo.so, you need to do the following:
+#LIBNAME=foo
+LIBNAME=
+
+# APPNAME contains just the name of the application, without suffix (""
+# on Unix, ".exe" on Windows, ...).  This one MUST have a value when using
+# this makefile to build applications.
+# For example, to build foo, you need to do the following:
+#APPNAME=foo
+APPNAME=
+
+# OBJECTS contains all the object files to link together into the application.
+# This must contain at least one object file.
+#OBJECTS=foo.o
+OBJECTS=
+
+# LIBEXTRAS contains extra modules to link together with the library.
+# For example, if a second library, say libbar.a needs to be linked into
+# libfoo.so, you need to do the following:
+#LIBEXTRAS=libbar.a
+# Note that this MUST be used when using the link_o targets, to hold the
+# names of all object files that go into the target library.
+LIBEXTRAS=
+
+# LIBVERSION contains the current version of the library.
+# For example, to build libfoo.so.1.2, you need to do the following:
+#LIBVERSION=1.2
+LIBVERSION=
+
+# LIBCOMPATVERSIONS contains the compatibility versions (a list) of
+# the library.  They MUST be in decreasing order.
+# For example, if libfoo.so.1.2.1 is backward compatible with libfoo.so.1.2
+# and libfoo.so.1, you need to do the following:
+#LIBCOMPATVERSIONS=1.2 1
+# Note that on systems that use sonames, the last number will appear as
+# part of it.
+# It's also possible, for systems that support it (Tru64, for example),
+# to add extra compatibility info with more precision, by adding a second
+# list of versions, separated from the first with a semicolon, like this:
+#LIBCOMPATVERSIONS=1.2 1;1.2.0 1.1.2 1.1.1 1.1.0 1.0.0
+LIBCOMPATVERSIONS=
+
+# LIBDEPS contains all the flags necessary to cover all necessary
+# dependencies to other libraries.
+LIBDEPS=
+
+#------------------------------------------------------------------------------
+# The rest is private to this makefile.
+
+SET_X=:
+#SET_X=set -x
+
+top:
+        echo "Trying to use this makefile interactively?  Don't."
+
+CALC_VERSIONS=  \
+        SHLIB_COMPAT=; SHLIB_SOVER=; \
+        if [ -n "$(LIBVERSION)$(LIBCOMPATVERSIONS)" ]; then \
+                prev=""; \
+                for v in `echo "$(LIBVERSION) $(LIBCOMPATVERSIONS)" | cut -d';' -f1`; do \
+                        SHLIB_SOVER_NODOT=$$v; \
+                        SHLIB_SOVER=.$$v; \
+                        if [ -n "$$prev" ]; then \
+                                SHLIB_COMPAT="$$SHLIB_COMPAT .$$prev"; \
+                        fi; \
+                        prev=$$v; \
+                done; \
+        fi
+
+LINK_APP=       \
+  ( $(SET_X);   \
+    LIBDEPS="$${LIBDEPS:-$(LIBDEPS)}"; \
+    LDCMD="$${LDCMD:-$(CC)}"; LDFLAGS="$${LDFLAGS:-$(CFLAGS)}"; \
+    LIBPATH=`for x in $$LIBDEPS; do if echo $$x | grep '^ *-L' > /dev/null 2>&1; then echo $$x | sed -e 's/^ *-L//'; fi; done | uniq`; \
+    LIBPATH=`echo $$LIBPATH | sed -e 's/ /:/g'`; \
+    LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
+    $${LDCMD} $${LDFLAGS} -o $${APPNAME:=$(APPNAME)} $(OBJECTS) $${LIBDEPS} )
+
+LINK_SO=        \
+  ( $(SET_X);   \
+    LIBDEPS="$${LIBDEPS:-$(LIBDEPS)}"; \
+    SHAREDCMD="$${SHAREDCMD:-$(CC)}"; \
+    SHAREDFLAGS="$${SHAREDFLAGS:-$(CFLAGS) $(SHARED_LDFLAGS)}"; \
+    nm -Pg $$SHOBJECTS | grep ' [BDT] ' | cut -f1 -d' ' > lib$(LIBNAME).exp; \
+    LIBPATH=`for x in $$LIBDEPS; do if echo $$x | grep '^ *-L' > /dev/null 2>&1; then echo $$x | sed -e 's/^ *-L//'; fi; done | uniq`; \
+    LIBPATH=`echo $$LIBPATH | sed -e 's/ /:/g'`; \
+    LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
+    $${SHAREDCMD} $${SHAREDFLAGS} \
+        -o $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX \
+        $$ALLSYMSFLAGS $$SHOBJECTS $$NOALLSYMSFLAGS $$LIBDEPS \
+  ) && $(SYMLINK_SO); \
+  ( $(SET_X); rm -f lib$(LIBNAME).exp )
+
+SYMLINK_SO=     \
+        if [ -n "$$INHIBIT_SYMLINKS" ]; then :; else \
+                prev=$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX; \
+                if [ -n "$$SHLIB_COMPAT" ]; then \
+                        for x in $$SHLIB_COMPAT; do \
+                                ( $(SET_X); rm -f $$SHLIB$$x$$SHLIB_SUFFIX; \
+                                  ln -s $$prev $$SHLIB$$x$$SHLIB_SUFFIX ); \
+                                prev=$$SHLIB$$x$$SHLIB_SUFFIX; \
+                        done; \
+                fi; \
+                if [ -n "$$SHLIB_SOVER" ]; then \
+                        ( $(SET_X); rm -f $$SHLIB$$SHLIB_SUFFIX; \
+                          ln -s $$prev $$SHLIB$$SHLIB_SUFFIX ); \
+                fi; \
+        fi
+
+LINK_SO_A=      SHOBJECTS="lib$(LIBNAME).a $(LIBEXTRAS)"; $(LINK_SO)
+LINK_SO_O=      SHOBJECTS="$(LIBEXTRAS)"; $(LINK_SO)
+
+LINK_SO_A_VIA_O=        \
+  SHOBJECTS=lib$(LIBNAME).o; \
+  ALL=$$ALLSYMSFLAGS; ALLSYMSFLAGS=; NOALLSYMSFLAGS=; \
+  ( $(SET_X); \
+    ld $(LDFLAGS) -r -o lib$(LIBNAME).o $$ALL lib$(LIBNAME).a $(LIBEXTRAS) ); \
+  $(LINK_SO) && rm -f $(LIBNAME).o
+
+LINK_SO_A_UNPACKED=     \
+  UNPACKDIR=link_tmp.$$$$; rm -rf $$UNPACKDIR; mkdir $$UNPACKDIR; \
+  (cd $$UNPACKDIR; ar x ../lib$(LIBNAME).a) && \
+  ([ -z "$(LIBEXTRAS)" ] || cp $(LIBEXTRAS) $$UNPACKDIR) && \
+  SHOBJECTS=$$UNPACKDIR/*.o; \
+  $(LINK_SO) && rm -rf $$UNPACKDIR
+
+DETECT_GNU_LD=(${CC} -Wl,-V /dev/null 2>&1 | grep '^GNU ld' )>/dev/null
+
+DO_GNU_SO=$(CALC_VERSIONS); \
+        SHLIB=lib$(LIBNAME).so; \
+        SHLIB_SUFFIX=; \
+        ALLSYMSFLAGS='-Wl,--whole-archive'; \
+        NOALLSYMSFLAGS='-Wl,--no-whole-archive'; \
+        SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-Bsymbolic -Wl,-soname=$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"
+
+DO_GNU_APP=LDFLAGS="$(CFLAGS) -Wl,-rpath,$(LIBRPATH)"
+
+#This is rather special.  It's a special target with which one can link
+#applications without bothering with any features that have anything to
+#do with shared libraries, for example when linking against static
+#libraries.  It's mostly here to avoid a lot of conditionals everywhere
+#else...
+link_app.:
+        $(LINK_APP)
+
+link_o.gnu:
+        @ $(DO_GNU_SO); $(LINK_SO_O)
+link_a.gnu:
+        @ $(DO_GNU_SO); $(LINK_SO_A)
+link_app.gnu:
+        @ $(DO_GNU_APP); $(LINK_APP)
+
+link_o.bsd:
+        @if ${DETECT_GNU_LD}; then $(DO_GNU_SO); else \
+        $(CALC_VERSIONS); \
+        SHLIB=lib$(LIBNAME).so; \
+        SHLIB_SUFFIX=; \
+        LIBDEPS=" "; \
+        ALLSYMSFLAGS="-Wl,-Bforcearchive"; \
+        NOALLSYMSFLAGS=; \
+        SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -nostdlib"; \
+        fi; $(LINK_SO_O)
+link_a.bsd:
+        @if ${DETECT_GNU_LD}; then $(DO_GNU_SO); else \
+        $(CALC_VERSIONS); \
+        SHLIB=lib$(LIBNAME).so; \
+        SHLIB_SUFFIX=; \
+        LIBDEPS=" "; \
+        ALLSYMSFLAGS="-Wl,-Bforcearchive"; \
+        NOALLSYMSFLAGS=; \
+        SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -nostdlib"; \
+        fi; $(LINK_SO_A)
+link_app.bsd:
+        @if ${DETECT_GNU_LD}; then $(DO_GNU_APP); else \
+        LDFLAGS="$(CFLAGS) -Wl,-rpath,$(LIBPATH)"; \
+        fi; $(LINK_APP)
+
+# For Darwin AKA Mac OS/X (dyld)
+# link_o.darwin produces .so, because we let it use dso_dlfcn module,
+# which has .so extension hard-coded. One can argue that one should
+# develop special dso module for MacOS X. At least manual encourages
+# to use native NSModule(3) API and refers to dlfcn as termporary hack.
+link_o.darwin:
+        @ $(CALC_VERSIONS); \
+        SHLIB=lib$(LIBNAME); \
+        SHLIB_SUFFIX=.so; \
+        ALLSYMSFLAGS='-all_load'; \
+        NOALLSYMSFLAGS=''; \
+        SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS)"; \
+        if [ -n "$(LIBVERSION)" ]; then \
+                SHAREDFLAGS="$$SHAREDFLAGS -current_version $(LIBVERSION)"; \
+        fi; \
+        if [ -n "$$SHLIB_SOVER_NODOT" ]; then \
+                SHAREDFLAGS="$$SHAREDFLAGS -compatibility_version $$SHLIB_SOVER_NODOT"; \
+        fi; \
+        $(LINK_SO_O)
+link_a.darwin:
+        @ $(CALC_VERSIONS); \
+        SHLIB=lib$(LIBNAME); \
+        SHLIB_SUFFIX=.dylib; \
+        ALLSYMSFLAGS='-all_load'; \
+        NOALLSYMSFLAGS=''; \
+        SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS)"; \
+        if [ -n "$(LIBVERSION)" ]; then \
+                SHAREDFLAGS="$$SHAREDFLAGS -current_version $(LIBVERSION)"; \
+        fi; \
+        if [ -n "$$SHLIB_SOVER_NODOT" ]; then \
+                SHAREDFLAGS="$$SHAREDFLAGS -compatibility_version $$SHLIB_SOVER_NODOT"; \
+        fi; \
+        SHAREDFLAGS="$$SHAREDFLAGS -install_name ${INSTALLTOP}/lib/$$SHLIB${SHLIB_EXT}"; \
+        $(LINK_SO_A)
+link_app.darwin:        # is there run-path on darwin?
+        $(LINK_APP)
+
+link_o.cygwin:
+        @ $(CALC_VERSIONS); \
+        INHIBIT_SYMLINKS=yes; \
+        SHLIB=cyg$(LIBNAME); \
+        base=-Wl,--enable-auto-image-base; \
+        if expr $(PLATFORM) : 'mingw' > /dev/null; then \
+                SHLIB=$(LIBNAME)eay32; base=; \
+        fi; \
+        SHLIB_SUFFIX=.dll; \
+        LIBVERSION="$(LIBVERSION)"; \
+        SHLIB_SOVER=${LIBVERSION:+"-$(LIBVERSION)"}; \
+        ALLSYMSFLAGS='-Wl,--whole-archive'; \
+        NOALLSYMSFLAGS='-Wl,--no-whole-archive'; \
+        SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared $$base -Wl,-Bsymbolic -Wl,--out-implib,lib$(LIBNAME).dll.a"; \
+        $(LINK_SO_O)
+link_a.cygwin:
+        @ $(CALC_VERSIONS); \
+        INHIBIT_SYMLINKS=yes; \
+        SHLIB=cyg$(LIBNAME); \
+        base=-Wl,--enable-auto-image-base; \
+        if expr $(PLATFORM) : 'mingw' > /dev/null; then \
+                SHLIB=$(LIBNAME)eay32; \
+                base=;  [ $(LIBNAME) = "crypto" ] && base=-Wl,--image-base,0x63000000; \
+        fi; \
+        SHLIB_SUFFIX=.dll; \
+        SHLIB_SOVER=-$(LIBVERSION); \
+        ALLSYMSFLAGS='-Wl,--whole-archive'; \
+        NOALLSYMSFLAGS='-Wl,--no-whole-archive'; \
+        SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared $$base -Wl,-Bsymbolic -Wl,--out-implib,lib$(LIBNAME).dll.a"; \
+        [ -f apps/$$SHLIB$$SHLIB_SUFFIX ] && rm apps/$$SHLIB$$SHLIB_SUFFIX; \
+        [ -f test/$$SHLIB$$SHLIB_SUFFIX ] && rm test/$$SHLIB$$SHLIB_SUFFIX; \
+        $(LINK_SO_A) || exit 1; \
+        cp -p $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX apps/; \
+        cp -p $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX test/
+link_app.cygwin:
+        $(LINK_APP)
+
+link_o.alpha-osf1:
+        @ if ${DETECT_GNU_LD}; then \
+                $(DO_GNU_SO); \
+        else \
+                SHLIB=lib$(LIBNAME).so; \
+                SHLIB_SUFFIX=; \
+                SHLIB_HIST=`echo "$(LIBCOMPATVERSIONS)" | cut -d';' -f2 | sed -e 's/ */:/'`; \
+                if [ -n "$$SHLIB_HIST" ]; then \
+                        SHLIB_HIST="$${SHLIB_HIST}:$(LIBVERSION)"; \
+                else \
+                        SHLIB_HIST="$(LIBVERSION)"; \
+                fi; \
+                SHLIB_SOVER=; \
+                ALLSYMSFLAGS='-all'; \
+                NOALLSYMSFLAGS='-none'; \
+                SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-B,symbolic"; \
+                if [ -n "$$SHLIB_HIST" ]; then \
+                        SHAREDFLAGS="$$SHAREDFLAGS -set_version $$SHLIB_HIST"; \
+                fi; \
+        fi; \
+        $(LINK_SO_O)
+link_a.alpha-osf1:
+        @ if ${DETECT_GNU_LD}; then \
+                $(DO_GNU_SO); \
+        else \
+                SHLIB=lib$(LIBNAME).so; \
+                SHLIB_SUFFIX=; \
+                SHLIB_HIST=`echo "$(LIBCOMPATVERSIONS)" | cut -d';' -f2 | sed -e 's/ */:/'`; \
+                if [ -n "$$SHLIB_HIST" ]; then \
+                        SHLIB_HIST="$${SHLIB_HIST}:$(LIBVERSION)"; \
+                else \
+                        SHLIB_HIST="$(LIBVERSION)"; \
+                fi; \
+                SHLIB_SOVER=; \
+                ALLSYMSFLAGS='-all'; \
+                NOALLSYMSFLAGS='-none'; \
+                SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-B,symbolic"; \
+                if [ -n "$$SHLIB_HIST" ]; then \
+                        SHAREDFLAGS="$$SHAREDFLAGS -set_version $$SHLIB_HIST"; \
+                fi; \
+        fi; \
+        $(LINK_SO_A)
+link_app.alpha-osf1:
+        @if ${DETECT_GNU_LD}; then \
+                $(DO_GNU_APP); \
+        else \
+                LDFLAGS="$(CFLAGS) -rpath $(LIBRPATH)"; \
+        fi; \
+        $(LINK_APP)
+
+link_o.solaris:
+        @ if ${DETECT_GNU_LD}; then \
+                $(DO_GNU_SO); \
+        else \
+                $(CALC_VERSIONS); \
+                MINUSZ='-z '; \
+                ($(CC) -v 2>&1 | grep gcc) > /dev/null && MINUSZ='-Wl,-z,'; \
+                SHLIB=lib$(LIBNAME).so; \
+                SHLIB_SUFFIX=; \
+                ALLSYMSFLAGS="$${MINUSZ}allextract"; \
+                NOALLSYMSFLAGS="$${MINUSZ}defaultextract"; \
+                SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -h $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX -Wl,-Bsymbolic"; \
+        fi; \
+        $(LINK_SO_O)
+link_a.solaris:
+        @ if ${DETECT_GNU_LD}; then \
+                $(DO_GNU_SO); \
+        else \
+                $(CALC_VERSIONS); \
+                MINUSZ='-z '; \
+                (${CC} -v 2>&1 | grep gcc) > /dev/null && MINUSZ='-Wl,-z,'; \
+                SHLIB=lib$(LIBNAME).so; \
+                SHLIB_SUFFIX=;\
+                ALLSYMSFLAGS="$${MINUSZ}allextract"; \
+                NOALLSYMSFLAGS="$${MINUSZ}defaultextract"; \
+                SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -h $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX -Wl,-Bsymbolic"; \
+        fi; \
+        $(LINK_SO_A)
+link_app.solaris:
+        @ if ${DETECT_GNU_LD}; then \
+                $(DO_GNU_APP); \
+        else \
+                LDFLAGS="$(CFLAGS) -R $(LIBRPATH)"; \
+        fi; \
+        $(LINK_APP)
+
+# OpenServer 5 native compilers used
+link_o.svr3:
+        @ if ${DETECT_GNU_LD}; then \
+                $(DO_GNU_SO); \
+        else \
+                $(CALC_VERSIONS); \
+                SHLIB=lib$(LIBNAME).so; \
+                SHLIB_SUFFIX=; \
+                ALLSYMSFLAGS=''; \
+                NOALLSYMSFLAGS=''; \
+                SHAREDFLAGS="$(CFLAGS) -G -h $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"; \
+        fi; \
+        $(LINK_SO_O)
+link_a.svr3:
+        @ if ${DETECT_GNU_LD}; then \
+                $(DO_GNU_SO); \
+        else \
+                $(CALC_VERSIONS); \
+                SHLIB=lib$(LIBNAME).so; \
+                SHLIB_SUFFIX=; \
+                ALLSYMSFLAGS=''; \
+                NOALLSYMSFLAGS=''; \
+                SHAREDFLAGS="$(CFLAGS) -G -h $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"; \
+        fi; \
+        $(LINK_SO_A_UNPACKED)
+link_app.svr3:
+        @${DETECT_GNU_LD} && $(DO_GNU_APP); \
+        $(LINK_APP)
+
+# UnixWare 7 and OpenUNIX 8 native compilers used
+link_o.svr5:
+        @ if ${DETECT_GNU_LD}; then \
+                $(DO_GNU_SO); \
+        else \
+                $(CALC_VERSIONS); \
+                SHARE_FLAG='-G'; \
+                ($(CC) -v 2>&1 | grep gcc) > /dev/null && SHARE_FLAG='-shared'; \
+                SHLIB=lib$(LIBNAME).so; \
+                SHLIB_SUFFIX=; \
+                ALLSYMSFLAGS=''; \
+                NOALLSYMSFLAGS=''; \
+                SHAREDFLAGS="$(CFLAGS) $${SHARE_FLAG} -h $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"; \
+        fi; \
+        $(LINK_SO_O)
+link_a.svr5:
+        @ if ${DETECT_GNU_LD}; then \
+                $(DO_GNU_SO); \
+        else \
+                $(CALC_VERSIONS); \
+                SHARE_FLAG='-G'; \
+                (${CC} -v 2>&1 | grep gcc) > /dev/null && SHARE_FLAG='-shared'; \
+                SHLIB=lib$(LIBNAME).so; \
+                SHLIB_SUFFIX=; \
+                ALLSYMSFLAGS=''; \
+                NOALLSYMSFLAGS=''; \
+                SHAREDFLAGS="$(CFLAGS) $${SHARE_FLAG} -h $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"; \
+        fi; \
+        $(LINK_SO_A_UNPACKED)
+link_app.svr5:
+        @${DETECT_GNU_LD} && $(DO_GNU_APP); \
+        $(LINK_APP)
+
+link_o.irix:
+        @ if ${DETECT_GNU_LD}; then \
+                $(DO_GNU_SO); \
+        else \
+                $(CALC_VERSIONS); \
+                SHLIB=lib$(LIBNAME).so; \
+                SHLIB_SUFFIX=; \
+                MINUSWL=""; \
+                ($(CC) -v 2>&1 | grep gcc) > /dev/null && MINUSWL="-Wl,"; \
+                ALLSYMSFLAGS="$${MINUSWL}-all"; \
+                NOALLSYMSFLAGS="$${MINUSWL}-none"; \
+                SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-soname,$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX,-B,symbolic"; \
+        fi; \
+        $(LINK_SO_O)
+link_a.irix:
+        @ if ${DETECT_GNU_LD}; then \
+                $(DO_GNU_SO); \
+        else \
+                $(CALC_VERSIONS); \
+                SHLIB=lib$(LIBNAME).so; \
+                SHLIB_SUFFIX=; \
+                MINUSWL=""; \
+                ($(CC) -v 2>&1 | grep gcc) > /dev/null && MINUSWL="-Wl,"; \
+                ALLSYMSFLAGS="$${MINUSWL}-all"; \
+                NOALLSYMSFLAGS="$${MINUSWL}-none"; \
+                SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-soname,$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX,-B,symbolic"; \
+        fi; \
+        $(LINK_SO_A)
+link_app.irix:
+        @LDFLAGS="$(CFLAGS) -Wl,-rpath,$(LIBRPATH)"; \
+        $(LINK_APP)
+
+# 32-bit PA-RISC HP-UX embeds the -L pathname of libs we link with, so
+# we compensate for it with +cdp ../: and +cdp ./:. Yes, these rewrite
+# rules imply that we can only link one level down in catalog structure,
+# but that's what takes place for the moment of this writing. +cdp option
+# was introduced in HP-UX 11.x and applies in 32-bit PA-RISC link
+# editor context only [it's simply ignored in other cases, which are all
+# ELFs by the way].
+#
+link_o.hpux:
+        @if ${DETECT_GNU_LD}; then $(DO_GNU_SO); else \
+        $(CALC_VERSIONS); \
+        SHLIB=lib$(LIBNAME).sl; \
+        expr "$(CFLAGS)" : '.*DSO_DLFCN' > /dev/null && SHLIB=lib$(LIBNAME).so; \
+        SHLIB_SUFFIX=; \
+        ALLSYMSFLAGS='-Wl,-Fl'; \
+        NOALLSYMSFLAGS=''; \
+        expr $(PLATFORM) : 'hpux64' > /dev/null && ALLSYMSFLAGS='-Wl,+forceload'; \
+        SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -Wl,-B,symbolic,+vnocompatwarnings,-z,+s,+h,$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX,+cdp,../:,+cdp,./:"; \
+        fi; \
+        rm -f $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX || :; \
+        $(LINK_SO_O) && chmod a=rx $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX
+link_a.hpux:
+        @if ${DETECT_GNU_LD}; then $(DO_GNU_SO); else \
+        $(CALC_VERSIONS); \
+        SHLIB=lib$(LIBNAME).sl; \
+        expr $(PLATFORM) : '.*ia64' > /dev/null && SHLIB=lib$(LIBNAME).so; \
+        SHLIB_SUFFIX=; \
+        ALLSYMSFLAGS='-Wl,-Fl'; \
+        NOALLSYMSFLAGS=''; \
+        expr $(PLATFORM) : 'hpux64' > /dev/null && ALLSYMSFLAGS='-Wl,+forceload'; \
+        SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -Wl,-B,symbolic,+vnocompatwarnings,-z,+s,+h,$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX,+cdp,../:,+cdp,./:"; \
+        fi; \
+        rm -f $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX || :; \
+        $(LINK_SO_A) && chmod a=rx $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX
+link_app.hpux:
+        @if ${DETECT_GNU_LD}; then $(DO_GNU_APP); else \
+        LDFLAGS="$(CFLAGS) -Wl,+s,+cdp,../:,+cdp,./:,+b,$(LIBRPATH)"; \
+        fi; \
+        $(LINK_APP)
+
+link_o.aix:
+        @ $(CALC_VERSIONS); \
+        OBJECT_MODE=`expr x$(SHARED_LDFLAGS) : 'x\-[a-z]*\(64\)'` || :; \
+        OBJECT_MODE=$${OBJECT_MODE:-32}; export OBJECT_MODE; \
+        SHLIB=lib$(LIBNAME).so; \
+        SHLIB_SUFFIX=; \
+        ALLSYMSFLAGS=''; \
+        NOALLSYMSFLAGS=''; \
+        SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -Wl,-G,-bexpall,-bnolibpath,-bM:SRE'; \
+        $(LINK_SO_O);
+link_a.aix:
+        @ $(CALC_VERSIONS); \
+        OBJECT_MODE=`expr x$(SHARED_LDFLAGS) : 'x\-[a-z]*\(64\)'` || : ; \
+        OBJECT_MODE=$${OBJECT_MODE:-32}; export OBJECT_MODE; \
+        SHLIB=lib$(LIBNAME).so; \
+        SHLIB_SUFFIX=; \
+        ALLSYMSFLAGS='-bnogc'; \
+        NOALLSYMSFLAGS=''; \
+        SHAREDFLAGS='$(CFLAGS) $(SHARED_LDFLAGS) -Wl,-G,-bexpall,-bnolibpath,-bM:SRE'; \
+        $(LINK_SO_A_VIA_O)
+link_app.aix:
+        LDFLAGS="$(CFLAGS) -Wl,-brtl,-blibpath:$(LIBRPATH):$${LIBPATH:-/usr/lib:/lib}"; \
+        $(LINK_APP)
+
+link_o.reliantunix:
+        @ $(CALC_VERSIONS); \
+        SHLIB=lib$(LIBNAME).so; \
+        SHLIB_SUFFIX=; \
+        ALLSYMSFLAGS=; \
+        NOALLSYMSFLAGS=''; \
+        SHAREDFLAGS='$(CFLAGS) -G'; \
+        $(LINK_SO_O)
+link_a.reliantunix:
+        @ $(CALC_VERSIONS); \
+        SHLIB=lib$(LIBNAME).so; \
+        SHLIB_SUFFIX=; \
+        ALLSYMSFLAGS=; \
+        NOALLSYMSFLAGS=''; \
+        SHAREDFLAGS='$(CFLAGS) -G'; \
+        $(LINK_SO_A_UNPACKED)
+link_app.reliantunix:
+        $(LINK_APP)
+
+# Targets to build symbolic links when needed
+symlink.gnu symlink.solaris symlink.svr3 symlink.svr5 symlink.irix \
+symlink.aix symlink.reliantunix:
+        @ $(CALC_VERSIONS); \
+        SHLIB=lib$(LIBNAME).so; \
+        $(SYMLINK_SO)
+symlink.darwin:
+        @ $(CALC_VERSIONS); \
+        SHLIB=lib$(LIBNAME); \
+        SHLIB_SUFFIX=.dylib; \
+        $(SYMLINK_SO)
+symlink.hpux:
+        @ $(CALC_VERSIONS); \
+        SHLIB=lib$(LIBNAME).sl; \
+        expr $(PLATFORM) : '.*ia64' > /dev/null && SHLIB=lib$(LIBNAME).so; \
+        $(SYMLINK_SO)
+# The following lines means those specific architectures do no symlinks
+symlink.cygwin symlink.alpha-osf1 symlink.tru64 symlink.tru64-rpath:
+
+# Compatibility targets
+link_o.bsd-gcc-shared link_o.linux-shared link_o.gnu-shared: link_o.gnu
+link_a.bsd-gcc-shared link_a.linux-shared link_a.gnu-shared: link_a.gnu
+link_app.bsd-gcc-shared link_app.linux-shared link_app.gnu-shared: link_app.gnu
+symlink.bsd-gcc-shared symlink.bsd-shared symlink.linux-shared symlink.gnu-shared: symlink.gnu
+link_o.bsd-shared: link_o.bsd
+link_a.bsd-shared: link_a.bsd
+link_app.bsd-shared: link_app.bsd
+link_o.darwin-shared: link_o.darwin
+link_a.darwin-shared: link_a.darwin
+link_app.darwin-shared: link_app.darwin
+symlink.darwin-shared: symlink.darwin
+link_o.cygwin-shared: link_o.cygwin
+link_a.cygwin-shared: link_a.cygwin
+link_app.cygwin-shared: link_app.cygwin
+symlink.cygwin-shared: symlink.cygwin
+link_o.alpha-osf1-shared: link_o.alpha-osf1
+link_a.alpha-osf1-shared: link_a.alpha-osf1
+link_app.alpha-osf1-shared: link_app.alpha-osf1
+symlink.alpha-osf1-shared: symlink.alpha-osf1
+link_o.tru64-shared: link_o.tru64
+link_a.tru64-shared: link_a.tru64
+link_app.tru64-shared: link_app.tru64
+symlink.tru64-shared: symlink.tru64
+link_o.tru64-shared-rpath: link_o.tru64-rpath
+link_a.tru64-shared-rpath: link_a.tru64-rpath
+link_app.tru64-shared-rpath: link_app.tru64-rpath
+symlink.tru64-shared-rpath: symlink.tru64-rpath
+link_o.solaris-shared: link_o.solaris
+link_a.solaris-shared: link_a.solaris
+link_app.solaris-shared: link_app.solaris
+symlink.solaris-shared: symlink.solaris
+link_o.svr3-shared: link_o.svr3
+link_a.svr3-shared: link_a.svr3
+link_app.svr3-shared: link_app.svr3
+symlink.svr3-shared: symlink.svr3
+link_o.svr5-shared: link_o.svr5
+link_a.svr5-shared: link_a.svr5
+link_app.svr5-shared: link_app.svr5
+symlink.svr5-shared: symlink.svr5
+link_o.irix-shared: link_o.irix
+link_a.irix-shared: link_a.irix
+link_app.irix-shared: link_app.irix
+symlink.irix-shared: symlink.irix
+link_o.hpux-shared: link_o.hpux
+link_a.hpux-shared: link_a.hpux
+link_app.hpux-shared: link_app.hpux
+symlink.hpux-shared: symlink.hpux
+link_o.aix-shared: link_o.aix
+link_a.aix-shared: link_a.aix
+link_app.aix-shared: link_app.aix
+symlink.aix-shared: symlink.aix
+link_o.reliantunix-shared: link_o.reliantunix
+link_a.reliantunix-shared: link_a.reliantunix
+link_app.reliantunix-shared: link_app.reliantunix
+symlink.reliantunix-shared: symlink.reliantunix
diff --git a/src/lib/libssl/src/apps/cms.c b/src/lib/libssl/src/apps/cms.c
new file mode 100644
index 0000000000..6d227acabe
--- /dev/null
+++ b/src/lib/libssl/src/apps/cms.c
@@ -0,0 +1,1347 @@
+/* apps/cms.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+/* CMS utility function */
+
+#include <stdio.h>
+#include <string.h>
+#include "apps.h"
+
+#ifndef OPENSSL_NO_CMS
+
+#include <openssl/crypto.h>
+#include <openssl/pem.h>
+#include <openssl/err.h>
+#include <openssl/x509_vfy.h>
+#include <openssl/x509v3.h>
+#include <openssl/cms.h>
+
+#undef PROG
+#define PROG cms_main
+static int save_certs(char *signerfile, STACK_OF(X509) *signers);
+static int cms_cb(int ok, X509_STORE_CTX *ctx);
+static void receipt_request_print(BIO *out, CMS_ContentInfo *cms);
+static CMS_ReceiptRequest *make_receipt_request(STACK *rr_to, int rr_allorfirst,
+                                                                STACK *rr_from);
+
+#define SMIME_OP        0x10
+#define SMIME_IP        0x20
+#define SMIME_SIGNERS   0x40
+#define SMIME_ENCRYPT           (1 | SMIME_OP)
+#define SMIME_DECRYPT           (2 | SMIME_IP)
+#define SMIME_SIGN              (3 | SMIME_OP | SMIME_SIGNERS)
+#define SMIME_VERIFY            (4 | SMIME_IP)
+#define SMIME_CMSOUT            (5 | SMIME_IP | SMIME_OP)
+#define SMIME_RESIGN            (6 | SMIME_IP | SMIME_OP | SMIME_SIGNERS)
+#define SMIME_DATAOUT           (7 | SMIME_IP)
+#define SMIME_DATA_CREATE       (8 | SMIME_OP)
+#define SMIME_DIGEST_VERIFY     (9 | SMIME_IP)
+#define SMIME_DIGEST_CREATE     (10 | SMIME_OP)
+#define SMIME_UNCOMPRESS        (11 | SMIME_IP)
+#define SMIME_COMPRESS          (12 | SMIME_OP)
+#define SMIME_ENCRYPTED_DECRYPT (13 | SMIME_IP)
+#define SMIME_ENCRYPTED_ENCRYPT (14 | SMIME_OP)
+#define SMIME_SIGN_RECEIPT      (15 | SMIME_IP | SMIME_OP)
+#define SMIME_VERIFY_RECEIPT    (16 | SMIME_IP)
+
+int MAIN(int, char **);
+
+int MAIN(int argc, char **argv)
+        {
+        ENGINE *e = NULL;
+        int operation = 0;
+        int ret = 0;
+        char **args;
+        const char *inmode = "r", *outmode = "w";
+        char *infile = NULL, *outfile = NULL, *rctfile = NULL;
+        char *signerfile = NULL, *recipfile = NULL;
+        STACK *sksigners = NULL, *skkeys = NULL;
+        char *certfile = NULL, *keyfile = NULL, *contfile=NULL;
+        char *certsoutfile = NULL;
+        const EVP_CIPHER *cipher = NULL;
+        CMS_ContentInfo *cms = NULL, *rcms = NULL;
+        X509_STORE *store = NULL;
+        X509 *cert = NULL, *recip = NULL, *signer = NULL;
+        EVP_PKEY *key = NULL;
+        STACK_OF(X509) *encerts = NULL, *other = NULL;
+        BIO *in = NULL, *out = NULL, *indata = NULL, *rctin = NULL;
+        int badarg = 0;
+        int flags = CMS_DETACHED;
+        int rr_print = 0, rr_allorfirst = -1;
+        STACK *rr_to = NULL, *rr_from = NULL;
+        CMS_ReceiptRequest *rr = NULL;
+        char *to = NULL, *from = NULL, *subject = NULL;
+        char *CAfile = NULL, *CApath = NULL;
+        char *passargin = NULL, *passin = NULL;
+        char *inrand = NULL;
+        int need_rand = 0;
+        const EVP_MD *sign_md = NULL;
+        int informat = FORMAT_SMIME, outformat = FORMAT_SMIME;
+        int rctformat = FORMAT_SMIME, keyform = FORMAT_PEM;
+#ifndef OPENSSL_NO_ENGINE
+        char *engine=NULL;
+#endif
+        unsigned char *secret_key = NULL, *secret_keyid = NULL;
+        size_t secret_keylen = 0, secret_keyidlen = 0;
+
+        ASN1_OBJECT *econtent_type = NULL;
+
+        X509_VERIFY_PARAM *vpm = NULL;
+
+        args = argv + 1;
+        ret = 1;
+
+        apps_startup();
+
+        if (bio_err == NULL)
+                {
+                if ((bio_err = BIO_new(BIO_s_file())) != NULL)
+                        BIO_set_fp(bio_err, stderr, BIO_NOCLOSE|BIO_FP_TEXT);
+                }
+
+        if (!load_config(bio_err, NULL))
+                goto end;
+
+        while (!badarg && *args && *args[0] == '-')
+                {
+                if (!strcmp (*args, "-encrypt"))
+                        operation = SMIME_ENCRYPT;
+                else if (!strcmp (*args, "-decrypt"))
+                        operation = SMIME_DECRYPT;
+                else if (!strcmp (*args, "-sign"))
+                        operation = SMIME_SIGN;
+                else if (!strcmp (*args, "-sign_receipt"))
+                        operation = SMIME_SIGN_RECEIPT;
+                else if (!strcmp (*args, "-resign"))
+                        operation = SMIME_RESIGN;
+                else if (!strcmp (*args, "-verify"))
+                        operation = SMIME_VERIFY;
+                else if (!strcmp(*args,"-verify_receipt"))
+                        {
+                        operation = SMIME_VERIFY_RECEIPT;
+                        if (!args[1])
+                                goto argerr;
+                        args++;
+                        rctfile = *args;
+                        }
+                else if (!strcmp (*args, "-cmsout"))
+                        operation = SMIME_CMSOUT;
+                else if (!strcmp (*args, "-data_out"))
+                        operation = SMIME_DATAOUT;
+                else if (!strcmp (*args, "-data_create"))
+                        operation = SMIME_DATA_CREATE;
+                else if (!strcmp (*args, "-digest_verify"))
+                        operation = SMIME_DIGEST_VERIFY;
+                else if (!strcmp (*args, "-digest_create"))
+                        operation = SMIME_DIGEST_CREATE;
+                else if (!strcmp (*args, "-compress"))
+                        operation = SMIME_COMPRESS;
+                else if (!strcmp (*args, "-uncompress"))
+                        operation = SMIME_UNCOMPRESS;
+                else if (!strcmp (*args, "-EncryptedData_decrypt"))
+                        operation = SMIME_ENCRYPTED_DECRYPT;
+                else if (!strcmp (*args, "-EncryptedData_encrypt"))
+                        operation = SMIME_ENCRYPTED_ENCRYPT;
+#ifndef OPENSSL_NO_DES
+                else if (!strcmp (*args, "-des3")) 
+                                cipher = EVP_des_ede3_cbc();
+                else if (!strcmp (*args, "-des")) 
+                                cipher = EVP_des_cbc();
+#endif
+#ifndef OPENSSL_NO_SEED
+                else if (!strcmp (*args, "-seed")) 
+                                cipher = EVP_seed_cbc();
+#endif
+#ifndef OPENSSL_NO_RC2
+                else if (!strcmp (*args, "-rc2-40")) 
+                                cipher = EVP_rc2_40_cbc();
+                else if (!strcmp (*args, "-rc2-128")) 
+                                cipher = EVP_rc2_cbc();
+                else if (!strcmp (*args, "-rc2-64")) 
+                                cipher = EVP_rc2_64_cbc();
+#endif
+#ifndef OPENSSL_NO_AES
+                else if (!strcmp(*args,"-aes128"))
+                                cipher = EVP_aes_128_cbc();
+                else if (!strcmp(*args,"-aes192"))
+                                cipher = EVP_aes_192_cbc();
+                else if (!strcmp(*args,"-aes256"))
+                                cipher = EVP_aes_256_cbc();
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+                else if (!strcmp(*args,"-camellia128"))
+                                cipher = EVP_camellia_128_cbc();
+                else if (!strcmp(*args,"-camellia192"))
+                                cipher = EVP_camellia_192_cbc();
+                else if (!strcmp(*args,"-camellia256"))
+                                cipher = EVP_camellia_256_cbc();
+#endif
+                else if (!strcmp (*args, "-text")) 
+                                flags |= CMS_TEXT;
+                else if (!strcmp (*args, "-nointern")) 
+                                flags |= CMS_NOINTERN;
+                else if (!strcmp (*args, "-noverify") 
+                        || !strcmp (*args, "-no_signer_cert_verify")) 
+                                flags |= CMS_NO_SIGNER_CERT_VERIFY;
+                else if (!strcmp (*args, "-nocerts")) 
+                                flags |= CMS_NOCERTS;
+                else if (!strcmp (*args, "-noattr")) 
+                                flags |= CMS_NOATTR;
+                else if (!strcmp (*args, "-nodetach")) 
+                                flags &= ~CMS_DETACHED;
+                else if (!strcmp (*args, "-nosmimecap"))
+                                flags |= CMS_NOSMIMECAP;
+                else if (!strcmp (*args, "-binary"))
+                                flags |= CMS_BINARY;
+                else if (!strcmp (*args, "-keyid"))
+                                flags |= CMS_USE_KEYID;
+                else if (!strcmp (*args, "-nosigs"))
+                                flags |= CMS_NOSIGS;
+                else if (!strcmp (*args, "-no_content_verify"))
+                                flags |= CMS_NO_CONTENT_VERIFY;
+                else if (!strcmp (*args, "-no_attr_verify"))
+                                flags |= CMS_NO_ATTR_VERIFY;
+                else if (!strcmp (*args, "-stream"))
+                                {
+                                args++;
+                                continue;
+                                }
+                else if (!strcmp (*args, "-indef"))
+                                {
+                                args++;
+                                continue;
+                                }
+                else if (!strcmp (*args, "-noindef"))
+                                flags &= ~CMS_STREAM;
+                else if (!strcmp (*args, "-nooldmime"))
+                                flags |= CMS_NOOLDMIMETYPE;
+                else if (!strcmp (*args, "-crlfeol"))
+                                flags |= CMS_CRLFEOL;
+                else if (!strcmp (*args, "-receipt_request_print"))
+                                rr_print = 1;
+                else if (!strcmp (*args, "-receipt_request_all"))
+                                rr_allorfirst = 0;
+                else if (!strcmp (*args, "-receipt_request_first"))
+                                rr_allorfirst = 1;
+                else if (!strcmp(*args,"-receipt_request_from"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        args++;
+                        if (!rr_from)
+                                rr_from = sk_new_null();
+                        sk_push(rr_from, *args);
+                        }
+                else if (!strcmp(*args,"-receipt_request_to"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        args++;
+                        if (!rr_to)
+                                rr_to = sk_new_null();
+                        sk_push(rr_to, *args);
+                        }
+                else if (!strcmp(*args,"-secretkey"))
+                        {
+                        long ltmp;
+                        if (!args[1])
+                                goto argerr;
+                        args++;
+                        secret_key = string_to_hex(*args, &ltmp);
+                        if (!secret_key)
+                                {
+                                BIO_printf(bio_err, "Invalid key %s\n", *args);
+                                goto argerr;
+                                }
+                        secret_keylen = (size_t)ltmp;
+                        }
+                else if (!strcmp(*args,"-secretkeyid"))
+                        {
+                        long ltmp;
+                        if (!args[1])
+                                goto argerr;
+                        args++;
+                        secret_keyid = string_to_hex(*args, &ltmp);
+                        if (!secret_keyid)
+                                {
+                                BIO_printf(bio_err, "Invalid id %s\n", *args);
+                                goto argerr;
+                                }
+                        secret_keyidlen = (size_t)ltmp;
+                        }
+                else if (!strcmp(*args,"-econtent_type"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        args++;
+                        econtent_type = OBJ_txt2obj(*args, 0);
+                        if (!econtent_type)
+                                {
+                                BIO_printf(bio_err, "Invalid OID %s\n", *args);
+                                goto argerr;
+                                }
+                        }
+                else if (!strcmp(*args,"-rand"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        args++;
+                        inrand = *args;
+                        need_rand = 1;
+                        }
+#ifndef OPENSSL_NO_ENGINE
+                else if (!strcmp(*args,"-engine"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        engine = *++args;
+                        }
+#endif
+                else if (!strcmp(*args,"-passin"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        passargin = *++args;
+                        }
+                else if (!strcmp (*args, "-to"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        to = *++args;
+                        }
+                else if (!strcmp (*args, "-from"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        from = *++args;
+                        }
+                else if (!strcmp (*args, "-subject"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        subject = *++args;
+                        }
+                else if (!strcmp (*args, "-signer"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        /* If previous -signer argument add signer to list */
+
+                        if (signerfile)
+                                {
+                                if (!sksigners)
+                                        sksigners = sk_new_null();
+                                sk_push(sksigners, signerfile);
+                                if (!keyfile)
+                                        keyfile = signerfile;
+                                if (!skkeys)
+                                        skkeys = sk_new_null();
+                                sk_push(skkeys, keyfile);
+                                keyfile = NULL;
+                                }
+                        signerfile = *++args;
+                        }
+                else if (!strcmp (*args, "-recip"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        recipfile = *++args;
+                        }
+                else if (!strcmp (*args, "-certsout"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        certsoutfile = *++args;
+                        }
+                else if (!strcmp (*args, "-md"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        sign_md = EVP_get_digestbyname(*++args);
+                        if (sign_md == NULL)
+                                {
+                                BIO_printf(bio_err, "Unknown digest %s\n",
+                                                        *args);
+                                goto argerr;
+                                }
+                        }
+                else if (!strcmp (*args, "-inkey"))
+                        {
+                        if (!args[1])   
+                                goto argerr;
+                        /* If previous -inkey arument add signer to list */
+                        if (keyfile)
+                                {
+                                if (!signerfile)
+                                        {
+                                        BIO_puts(bio_err, "Illegal -inkey without -signer\n");
+                                        goto argerr;
+                                        }
+                                if (!sksigners)
+                                        sksigners = sk_new_null();
+                                sk_push(sksigners, signerfile);
+                                signerfile = NULL;
+                                if (!skkeys)
+                                        skkeys = sk_new_null();
+                                sk_push(skkeys, keyfile);
+                                }
+                        keyfile = *++args;
+                        }
+                else if (!strcmp (*args, "-keyform"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        keyform = str2fmt(*++args);
+                        }
+                else if (!strcmp (*args, "-rctform"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        rctformat = str2fmt(*++args);
+                        }
+                else if (!strcmp (*args, "-certfile"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        certfile = *++args;
+                        }
+                else if (!strcmp (*args, "-CAfile"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        CAfile = *++args;
+                        }
+                else if (!strcmp (*args, "-CApath"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        CApath = *++args;
+                        }
+                else if (!strcmp (*args, "-in"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        infile = *++args;
+                        }
+                else if (!strcmp (*args, "-inform"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        informat = str2fmt(*++args);
+                        }
+                else if (!strcmp (*args, "-outform"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        outformat = str2fmt(*++args);
+                        }
+                else if (!strcmp (*args, "-out"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        outfile = *++args;
+                        }
+                else if (!strcmp (*args, "-content"))
+                        {
+                        if (!args[1])
+                                goto argerr;
+                        contfile = *++args;
+                        }
+                else if (args_verify(&args, NULL, &badarg, bio_err, &vpm))
+                        continue;
+                else if ((cipher = EVP_get_cipherbyname(*args + 1)) == NULL)
+                        badarg = 1;
+                args++;
+                }
+
+        if (((rr_allorfirst != -1) || rr_from) && !rr_to)
+                {
+                BIO_puts(bio_err, "No Signed Receipts Recipients\n");
+                goto argerr;
+                }
+
+        if (!(operation & SMIME_SIGNERS)  && (rr_to || rr_from))
+                {
+                BIO_puts(bio_err, "Signed receipts only allowed with -sign\n");
+                goto argerr;
+                }
+        if (!(operation & SMIME_SIGNERS) && (skkeys || sksigners))
+                {
+                BIO_puts(bio_err, "Multiple signers or keys not allowed\n");
+                goto argerr;
+                }
+
+        if (operation & SMIME_SIGNERS)
+                {
+                if (keyfile && !signerfile)
+                        {
+                        BIO_puts(bio_err, "Illegal -inkey without -signer\n");
+                        goto argerr;
+                        }
+                /* Check to see if any final signer needs to be appended */
+                if (signerfile)
+                        {
+                        if (!sksigners)
+                                sksigners = sk_new_null();
+                        sk_push(sksigners, signerfile);
+                        if (!skkeys)
+                                skkeys = sk_new_null();
+                        if (!keyfile)
+                                keyfile = signerfile;
+                        sk_push(skkeys, keyfile);
+                        }
+                if (!sksigners)
+                        {
+                        BIO_printf(bio_err, "No signer certificate specified\n");
+                        badarg = 1;
+                        }
+                signerfile = NULL;
+                keyfile = NULL;
+                need_rand = 1;
+                }
+
+        else if (operation == SMIME_DECRYPT)
+                {
+                if (!recipfile && !keyfile && !secret_key)
+                        {
+                        BIO_printf(bio_err, "No recipient certificate or key specified\n");
+                        badarg = 1;
+                        }
+                }
+        else if (operation == SMIME_ENCRYPT)
+                {
+                if (!*args && !secret_key)
+                        {
+                        BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n");
+                        badarg = 1;
+                        }
+                need_rand = 1;
+                }
+        else if (!operation)
+                badarg = 1;
+
+        if (badarg)
+                {
+                argerr:
+                BIO_printf (bio_err, "Usage cms [options] cert.pem ...\n");
+                BIO_printf (bio_err, "where options are\n");
+                BIO_printf (bio_err, "-encrypt       encrypt message\n");
+                BIO_printf (bio_err, "-decrypt       decrypt encrypted message\n");
+                BIO_printf (bio_err, "-sign          sign message\n");
+                BIO_printf (bio_err, "-verify        verify signed message\n");
+                BIO_printf (bio_err, "-cmsout        output CMS structure\n");
+#ifndef OPENSSL_NO_DES
+                BIO_printf (bio_err, "-des3          encrypt with triple DES\n");
+                BIO_printf (bio_err, "-des           encrypt with DES\n");
+#endif
+#ifndef OPENSSL_NO_SEED
+                BIO_printf (bio_err, "-seed          encrypt with SEED\n");
+#endif
+#ifndef OPENSSL_NO_RC2
+                BIO_printf (bio_err, "-rc2-40        encrypt with RC2-40 (default)\n");
+                BIO_printf (bio_err, "-rc2-64        encrypt with RC2-64\n");
+                BIO_printf (bio_err, "-rc2-128       encrypt with RC2-128\n");
+#endif
+#ifndef OPENSSL_NO_AES
+                BIO_printf (bio_err, "-aes128, -aes192, -aes256\n");
+                BIO_printf (bio_err, "               encrypt PEM output with cbc aes\n");
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+                BIO_printf (bio_err, "-camellia128, -camellia192, -camellia256\n");
+                BIO_printf (bio_err, "               encrypt PEM output with cbc camellia\n");
+#endif
+                BIO_printf (bio_err, "-nointern      don't search certificates in message for signer\n");
+                BIO_printf (bio_err, "-nosigs        don't verify message signature\n");
+                BIO_printf (bio_err, "-noverify      don't verify signers certificate\n");
+                BIO_printf (bio_err, "-nocerts       don't include signers certificate when signing\n");
+                BIO_printf (bio_err, "-nodetach      use opaque signing\n");
+                BIO_printf (bio_err, "-noattr        don't include any signed attributes\n");
+                BIO_printf (bio_err, "-binary        don't translate message to text\n");
+                BIO_printf (bio_err, "-certfile file other certificates file\n");
+                BIO_printf (bio_err, "-certsout file certificate output file\n");
+                BIO_printf (bio_err, "-signer file   signer certificate file\n");
+                BIO_printf (bio_err, "-recip  file   recipient certificate file for decryption\n");
+                BIO_printf (bio_err, "-skeyid        use subject key identifier\n");
+                BIO_printf (bio_err, "-in file       input file\n");
+                BIO_printf (bio_err, "-inform arg    input format SMIME (default), PEM or DER\n");
+                BIO_printf (bio_err, "-inkey file    input private key (if not signer or recipient)\n");
+                BIO_printf (bio_err, "-keyform arg   input private key format (PEM or ENGINE)\n");
+                BIO_printf (bio_err, "-out file      output file\n");
+                BIO_printf (bio_err, "-outform arg   output format SMIME (default), PEM or DER\n");
+                BIO_printf (bio_err, "-content file  supply or override content for detached signature\n");
+                BIO_printf (bio_err, "-to addr       to address\n");
+                BIO_printf (bio_err, "-from ad       from address\n");
+                BIO_printf (bio_err, "-subject s     subject\n");
+                BIO_printf (bio_err, "-text          include or delete text MIME headers\n");
+                BIO_printf (bio_err, "-CApath dir    trusted certificates directory\n");
+                BIO_printf (bio_err, "-CAfile file   trusted certificates file\n");
+                BIO_printf (bio_err, "-crl_check     check revocation status of signer's certificate using CRLs\n");
+                BIO_printf (bio_err, "-crl_check_all check revocation status of signer's certificate chain using CRLs\n");
+#ifndef OPENSSL_NO_ENGINE
+                BIO_printf (bio_err, "-engine e      use engine e, possibly a hardware device.\n");
+#endif
+                BIO_printf (bio_err, "-passin arg    input file pass phrase source\n");
+                BIO_printf(bio_err,  "-rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
+                BIO_printf(bio_err,  "               load the file (or the files in the directory) into\n");
+                BIO_printf(bio_err,  "               the random number generator\n");
+                BIO_printf (bio_err, "cert.pem       recipient certificate(s) for encryption\n");
+                goto end;
+                }
+
+#ifndef OPENSSL_NO_ENGINE
+        e = setup_engine(bio_err, engine, 0);
+#endif
+
+        if (!app_passwd(bio_err, passargin, NULL, &passin, NULL))
+                {
+                BIO_printf(bio_err, "Error getting password\n");
+                goto end;
+                }
+
+        if (need_rand)
+                {
+                app_RAND_load_file(NULL, bio_err, (inrand != NULL));
+                if (inrand != NULL)
+                        BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
+                                app_RAND_load_files(inrand));
+                }
+
+        ret = 2;
+
+        if (!(operation & SMIME_SIGNERS))
+                flags &= ~CMS_DETACHED;
+
+        if (operation & SMIME_OP)
+                {
+                if (outformat == FORMAT_ASN1)
+                        outmode = "wb";
+                }
+        else
+                {
+                if (flags & CMS_BINARY)
+                        outmode = "wb";
+                }
+
+        if (operation & SMIME_IP)
+                {
+                if (informat == FORMAT_ASN1)
+                        inmode = "rb";
+                }
+        else
+                {
+                if (flags & CMS_BINARY)
+                        inmode = "rb";
+                }
+
+        if (operation == SMIME_ENCRYPT)
+                {
+                if (!cipher)
+                        {
+#ifndef OPENSSL_NO_DES                  
+                        cipher = EVP_des_ede3_cbc();
+#else
+                        BIO_printf(bio_err, "No cipher selected\n");
+                        goto end;
+#endif
+                        }
+
+                if (secret_key && !secret_keyid)
+                        {
+                        BIO_printf(bio_err, "No sectre key id\n");
+                        goto end;
+                        }
+
+                if (*args)
+                        encerts = sk_X509_new_null();
+                while (*args)
+                        {
+                        if (!(cert = load_cert(bio_err,*args,FORMAT_PEM,
+                                NULL, e, "recipient certificate file")))
+                                goto end;
+                        sk_X509_push(encerts, cert);
+                        cert = NULL;
+                        args++;
+                        }
+                }
+
+        if (certfile)
+                {
+                if (!(other = load_certs(bio_err,certfile,FORMAT_PEM, NULL,
+                        e, "certificate file")))
+                        {
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+                }
+
+        if (recipfile && (operation == SMIME_DECRYPT))
+                {
+                if (!(recip = load_cert(bio_err,recipfile,FORMAT_PEM,NULL,
+                        e, "recipient certificate file")))
+                        {
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+                }
+
+        if (operation == SMIME_SIGN_RECEIPT)
+                {
+                if (!(signer = load_cert(bio_err,signerfile,FORMAT_PEM,NULL,
+                        e, "receipt signer certificate file")))
+                        {
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+                }
+
+        if (operation == SMIME_DECRYPT)
+                {
+                if (!keyfile)
+                        keyfile = recipfile;
+                }
+        else if ((operation == SMIME_SIGN) || (operation == SMIME_SIGN_RECEIPT))
+                {
+                if (!keyfile)
+                        keyfile = signerfile;
+                }
+        else keyfile = NULL;
+
+        if (keyfile)
+                {
+                key = load_key(bio_err, keyfile, keyform, 0, passin, e,
+                               "signing key file");
+                if (!key)
+                        goto end;
+                }
+
+        if (infile)
+                {
+                if (!(in = BIO_new_file(infile, inmode)))
+                        {
+                        BIO_printf (bio_err,
+                                 "Can't open input file %s\n", infile);
+                        goto end;
+                        }
+                }
+        else
+                in = BIO_new_fp(stdin, BIO_NOCLOSE);
+
+        if (operation & SMIME_IP)
+                {
+                if (informat == FORMAT_SMIME) 
+                        cms = SMIME_read_CMS(in, &indata);
+                else if (informat == FORMAT_PEM) 
+                        cms = PEM_read_bio_CMS(in, NULL, NULL, NULL);
+                else if (informat == FORMAT_ASN1) 
+                        cms = d2i_CMS_bio(in, NULL);
+                else
+                        {
+                        BIO_printf(bio_err, "Bad input format for CMS file\n");
+                        goto end;
+                        }
+
+                if (!cms)
+                        {
+                        BIO_printf(bio_err, "Error reading S/MIME message\n");
+                        goto end;
+                        }
+                if (contfile)
+                        {
+                        BIO_free(indata);
+                        if (!(indata = BIO_new_file(contfile, "rb")))
+                                {
+                                BIO_printf(bio_err, "Can't read content file %s\n", contfile);
+                                goto end;
+                                }
+                        }
+                if (certsoutfile)
+                        {
+                        STACK_OF(X509) *allcerts;
+                        allcerts = CMS_get1_certs(cms);
+                        if (!save_certs(certsoutfile, allcerts))
+                                {
+                                BIO_printf(bio_err,
+                                                "Error writing certs to %s\n",
+                                                                certsoutfile);
+                                ret = 5;
+                                goto end;
+                                }
+                        sk_X509_pop_free(allcerts, X509_free);
+                        }
+                }
+
+        if (rctfile)
+                {
+                char *rctmode = (rctformat == FORMAT_ASN1) ? "rb" : "r";
+                if (!(rctin = BIO_new_file(rctfile, rctmode)))
+                        {
+                        BIO_printf (bio_err,
+                                 "Can't open receipt file %s\n", rctfile);
+                        goto end;
+                        }
+                
+                if (rctformat == FORMAT_SMIME) 
+                        rcms = SMIME_read_CMS(rctin, NULL);
+                else if (rctformat == FORMAT_PEM) 
+                        rcms = PEM_read_bio_CMS(rctin, NULL, NULL, NULL);
+                else if (rctformat == FORMAT_ASN1) 
+                        rcms = d2i_CMS_bio(rctin, NULL);
+                else
+                        {
+                        BIO_printf(bio_err, "Bad input format for receipt\n");
+                        goto end;
+                        }
+
+                if (!rcms)
+                        {
+                        BIO_printf(bio_err, "Error reading receipt\n");
+                        goto end;
+                        }
+                }
+
+        if (outfile)
+                {
+                if (!(out = BIO_new_file(outfile, outmode)))
+                        {
+                        BIO_printf (bio_err,
+                                 "Can't open output file %s\n", outfile);
+                        goto end;
+                        }
+                }
+        else
+                {
+                out = BIO_new_fp(stdout, BIO_NOCLOSE);
+#ifdef OPENSSL_SYS_VMS
+                {
+                    BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+                    out = BIO_push(tmpbio, out);
+                }
+#endif
+                }
+
+        if ((operation == SMIME_VERIFY) || (operation == SMIME_VERIFY_RECEIPT))
+                {
+                if (!(store = setup_verify(bio_err, CAfile, CApath)))
+                        goto end;
+                X509_STORE_set_verify_cb_func(store, cms_cb);
+                if (vpm)
+                        X509_STORE_set1_param(store, vpm);
+                }
+
+
+        ret = 3;
+
+        if (operation == SMIME_DATA_CREATE)
+                {
+                cms = CMS_data_create(in, flags);
+                }
+        else if (operation == SMIME_DIGEST_CREATE)
+                {
+                cms = CMS_digest_create(in, sign_md, flags);
+                }
+        else if (operation == SMIME_COMPRESS)
+                {
+                cms = CMS_compress(in, -1, flags);
+                }
+        else if (operation == SMIME_ENCRYPT)
+                {
+                flags |= CMS_PARTIAL;
+                cms = CMS_encrypt(encerts, in, cipher, flags);
+                if (!cms)
+                        goto end;
+                if (secret_key)
+                        {
+                        if (!CMS_add0_recipient_key(cms, NID_undef, 
+                                                secret_key, secret_keylen,
+                                                secret_keyid, secret_keyidlen,
+                                                NULL, NULL, NULL))
+                                goto end;
+                        /* NULL these because call absorbs them */
+                        secret_key = NULL;
+                        secret_keyid = NULL;
+                        }
+                if (!(flags & CMS_STREAM))
+                        {
+                        if (!CMS_final(cms, in, NULL, flags))
+                                goto end;
+                        }
+                }
+        else if (operation == SMIME_ENCRYPTED_ENCRYPT)
+                {
+                cms = CMS_EncryptedData_encrypt(in, cipher,
+                                                secret_key, secret_keylen,
+                                                flags);
+
+                }
+        else if (operation == SMIME_SIGN_RECEIPT)
+                {
+                CMS_ContentInfo *srcms = NULL;
+                STACK_OF(CMS_SignerInfo) *sis;
+                CMS_SignerInfo *si;
+                sis = CMS_get0_SignerInfos(cms);
+                if (!sis)
+                        goto end;
+                si = sk_CMS_SignerInfo_value(sis, 0);
+                srcms = CMS_sign_receipt(si, signer, key, other, flags);
+                if (!srcms)
+                        goto end;
+                CMS_ContentInfo_free(cms);
+                cms = srcms;
+                }
+        else if (operation & SMIME_SIGNERS)
+                {
+                int i;
+                /* If detached data content we enable streaming if
+                 * S/MIME output format.
+                 */
+                if (operation == SMIME_SIGN)
+                        {
+                                
+                        if (flags & CMS_DETACHED)
+                                {
+                                if (outformat == FORMAT_SMIME)
+                                        flags |= CMS_STREAM;
+                                }
+                        flags |= CMS_PARTIAL;
+                        cms = CMS_sign(NULL, NULL, other, in, flags);
+                        if (!cms)
+                                goto end;
+                        if (econtent_type)
+                                CMS_set1_eContentType(cms, econtent_type);
+
+                        if (rr_to)
+                                {
+                                rr = make_receipt_request(rr_to, rr_allorfirst,
+                                                                rr_from);
+                                if (!rr)
+                                        {
+                                        BIO_puts(bio_err,
+                                "Signed Receipt Request Creation Error\n");
+                                        goto end;
+                                        }
+                                }
+                        }
+                else
+                        flags |= CMS_REUSE_DIGEST;
+                for (i = 0; i < sk_num(sksigners); i++)
+                        {
+                        CMS_SignerInfo *si;
+                        signerfile = sk_value(sksigners, i);
+                        keyfile = sk_value(skkeys, i);
+                        signer = load_cert(bio_err, signerfile,FORMAT_PEM, NULL,
+                                        e, "signer certificate");
+                        if (!signer)
+                                goto end;
+                        key = load_key(bio_err, keyfile, keyform, 0, passin, e,
+                               "signing key file");
+                        if (!key)
+                                goto end;
+                        si = CMS_add1_signer(cms, signer, key, sign_md, flags);
+                        if (!si)
+                                goto end;
+                        if (rr && !CMS_add1_ReceiptRequest(si, rr))
+                                goto end;
+                        X509_free(signer);
+                        signer = NULL;
+                        EVP_PKEY_free(key);
+                        key = NULL;
+                        }
+                /* If not streaming or resigning finalize structure */
+                if ((operation == SMIME_SIGN) && !(flags & CMS_STREAM))
+                        {
+                        if (!CMS_final(cms, in, NULL, flags))
+                                goto end;
+                        }
+                }
+
+        if (!cms)
+                {
+                BIO_printf(bio_err, "Error creating CMS structure\n");
+                goto end;
+                }
+
+        ret = 4;
+        if (operation == SMIME_DECRYPT)
+                {
+
+                if (secret_key)
+                        {
+                        if (!CMS_decrypt_set1_key(cms,
+                                                secret_key, secret_keylen,
+                                                secret_keyid, secret_keyidlen))
+                                {
+                                BIO_puts(bio_err,
+                                        "Error decrypting CMS using secret key\n");
+                                goto end;
+                                }
+                        }
+
+                if (key)
+                        {
+                        if (!CMS_decrypt_set1_pkey(cms, key, recip))
+                                {
+                                BIO_puts(bio_err,
+                                        "Error decrypting CMS using private key\n");
+                                goto end;
+                                }
+                        }
+
+                if (!CMS_decrypt(cms, NULL, NULL, indata, out, flags))
+                        {
+                        BIO_printf(bio_err, "Error decrypting CMS structure\n");
+                        goto end;
+                        }
+                }
+        else if (operation == SMIME_DATAOUT)
+                {
+                if (!CMS_data(cms, out, flags))
+                        goto end;
+                }
+        else if (operation == SMIME_UNCOMPRESS)
+                {
+                if (!CMS_uncompress(cms, indata, out, flags))
+                        goto end;
+                }
+        else if (operation == SMIME_DIGEST_VERIFY)
+                {
+                if (CMS_digest_verify(cms, indata, out, flags) > 0)
+                        BIO_printf(bio_err, "Verification successful\n");
+                else
+                        {
+                        BIO_printf(bio_err, "Verification failure\n");
+                        goto end;
+                        }
+                }
+        else if (operation == SMIME_ENCRYPTED_DECRYPT)
+                {
+                if (!CMS_EncryptedData_decrypt(cms, secret_key, secret_keylen,
+                                                indata, out, flags))
+                        goto end;
+                }
+        else if (operation == SMIME_VERIFY)
+                {
+                if (CMS_verify(cms, other, store, indata, out, flags) > 0)
+                        BIO_printf(bio_err, "Verification successful\n");
+                else
+                        {
+                        BIO_printf(bio_err, "Verification failure\n");
+                        goto end;
+                        }
+                if (signerfile)
+                        {
+                        STACK_OF(X509) *signers;
+                        signers = CMS_get0_signers(cms);
+                        if (!save_certs(signerfile, signers))
+                                {
+                                BIO_printf(bio_err,
+                                                "Error writing signers to %s\n",
+                                                                signerfile);
+                                ret = 5;
+                                goto end;
+                                }
+                        sk_X509_free(signers);
+                        }
+                if (rr_print)
+                        receipt_request_print(bio_err, cms);
+                                        
+                }
+        else if (operation == SMIME_VERIFY_RECEIPT)
+                {
+                if (CMS_verify_receipt(rcms, cms, other, store, flags) > 0)
+                        BIO_printf(bio_err, "Verification successful\n");
+                else
+                        {
+                        BIO_printf(bio_err, "Verification failure\n");
+                        goto end;
+                        }
+                }
+        else
+                {
+                if (outformat == FORMAT_SMIME)
+                        {
+                        if (to)
+                                BIO_printf(out, "To: %s\n", to);
+                        if (from)
+                                BIO_printf(out, "From: %s\n", from);
+                        if (subject)
+                                BIO_printf(out, "Subject: %s\n", subject);
+                        if (operation == SMIME_RESIGN)
+                                ret = SMIME_write_CMS(out, cms, indata, flags);
+                        else
+                                ret = SMIME_write_CMS(out, cms, in, flags);
+                        }
+                else if (outformat == FORMAT_PEM) 
+                        ret = PEM_write_bio_CMS(out, cms);
+                else if (outformat == FORMAT_ASN1) 
+                        ret = i2d_CMS_bio(out,cms);
+                else
+                        {
+                        BIO_printf(bio_err, "Bad output format for CMS file\n");
+                        goto end;
+                        }
+                if (ret <= 0)
+                        {
+                        ret = 6;
+                        goto end;
+                        }
+                }
+        ret = 0;
+end:
+        if (ret)
+                ERR_print_errors(bio_err);
+        if (need_rand)
+                app_RAND_write_file(NULL, bio_err);
+        sk_X509_pop_free(encerts, X509_free);
+        sk_X509_pop_free(other, X509_free);
+        if (vpm)
+                X509_VERIFY_PARAM_free(vpm);
+        if (sksigners)
+                sk_free(sksigners);
+        if (skkeys)
+                sk_free(skkeys);
+        if (secret_key)
+                OPENSSL_free(secret_key);
+        if (secret_keyid)
+                OPENSSL_free(secret_keyid);
+        if (econtent_type)
+                ASN1_OBJECT_free(econtent_type);
+        if (rr)
+                CMS_ReceiptRequest_free(rr);
+        if (rr_to)
+                sk_free(rr_to);
+        if (rr_from)
+                sk_free(rr_from);
+        X509_STORE_free(store);
+        X509_free(cert);
+        X509_free(recip);
+        X509_free(signer);
+        EVP_PKEY_free(key);
+        CMS_ContentInfo_free(cms);
+        CMS_ContentInfo_free(rcms);
+        BIO_free(rctin);
+        BIO_free(in);
+        BIO_free(indata);
+        BIO_free_all(out);
+        if (passin) OPENSSL_free(passin);
+        return (ret);
+}
+
+static int save_certs(char *signerfile, STACK_OF(X509) *signers)
+        {
+        int i;
+        BIO *tmp;
+        if (!signerfile)
+                return 1;
+        tmp = BIO_new_file(signerfile, "w");
+        if (!tmp) return 0;
+        for(i = 0; i < sk_X509_num(signers); i++)
+                PEM_write_bio_X509(tmp, sk_X509_value(signers, i));
+        BIO_free(tmp);
+        return 1;
+        }
+        
+
+/* Minimal callback just to output policy info (if any) */
+
+static int cms_cb(int ok, X509_STORE_CTX *ctx)
+        {
+        int error;
+
+        error = X509_STORE_CTX_get_error(ctx);
+
+        if ((error != X509_V_ERR_NO_EXPLICIT_POLICY)
+                && ((error != X509_V_OK) || (ok != 2)))
+                return ok;
+
+        policies_print(NULL, ctx);
+
+        return ok;
+
+        }
+
+static void gnames_stack_print(BIO *out, STACK_OF(GENERAL_NAMES) *gns)
+        {
+        STACK_OF(GENERAL_NAME) *gens;
+        GENERAL_NAME *gen;
+        int i, j;
+        for (i = 0; i < sk_GENERAL_NAMES_num(gns); i++)
+                {
+                gens = sk_GENERAL_NAMES_value(gns, i);
+                for (j = 0; j < sk_GENERAL_NAME_num(gens); j++)
+                        {
+                        gen = sk_GENERAL_NAME_value(gens, j);
+                        BIO_puts(out, "    ");
+                        GENERAL_NAME_print(out, gen);
+                        BIO_puts(out, "\n");
+                        }
+                }
+        return;
+        }
+
+static void receipt_request_print(BIO *out, CMS_ContentInfo *cms)
+        {
+        STACK_OF(CMS_SignerInfo) *sis;
+        CMS_SignerInfo *si;
+        CMS_ReceiptRequest *rr;
+        int allorfirst;
+        STACK_OF(GENERAL_NAMES) *rto, *rlist;
+        ASN1_STRING *scid;
+        int i, rv;
+        sis = CMS_get0_SignerInfos(cms);
+        for (i = 0; i < sk_CMS_SignerInfo_num(sis); i++)
+                {
+                si = sk_CMS_SignerInfo_value(sis, i);
+                rv = CMS_get1_ReceiptRequest(si, &rr);
+                BIO_printf(bio_err, "Signer %d:\n", i + 1);
+                if (rv == 0)
+                        BIO_puts(bio_err, "  No Receipt Request\n");
+                else if (rv < 0)
+                        {
+                        BIO_puts(bio_err, "  Receipt Request Parse Error\n");
+                        ERR_print_errors(bio_err);
+                        }
+                else
+                        {
+                        char *id;
+                        int idlen;
+                        CMS_ReceiptRequest_get0_values(rr, &scid, &allorfirst,
+                                                        &rlist, &rto);
+                        BIO_puts(out, "  Signed Content ID:\n");
+                        idlen = ASN1_STRING_length(scid);
+                        id = (char *)ASN1_STRING_data(scid);
+                        BIO_dump_indent(out, id, idlen, 4);
+                        BIO_puts(out, "  Receipts From");
+                        if (rlist)
+                                {
+                                BIO_puts(out, " List:\n");
+                                gnames_stack_print(out, rlist);
+                                }
+                        else if (allorfirst == 1)
+                                BIO_puts(out, ": First Tier\n");
+                        else if (allorfirst == 0)
+                                BIO_puts(out, ": All\n");
+                        else
+                                BIO_printf(out, " Unknown (%d)\n", allorfirst);
+                        BIO_puts(out, "  Receipts To:\n");
+                        gnames_stack_print(out, rto);
+                        }
+                if (rr)
+                        CMS_ReceiptRequest_free(rr);
+                }
+        }
+
+static STACK_OF(GENERAL_NAMES) *make_names_stack(STACK *ns)
+        {
+        int i;
+        STACK_OF(GENERAL_NAMES) *ret;
+        GENERAL_NAMES *gens = NULL;
+        GENERAL_NAME *gen = NULL;
+        ret = sk_GENERAL_NAMES_new_null();
+        if (!ret)
+                goto err;
+        for (i = 0; i < sk_num(ns); i++)
+                {
+                CONF_VALUE cnf;
+                cnf.name = "email";
+                cnf.value = sk_value(ns, i);
+                gen = v2i_GENERAL_NAME(NULL, NULL, &cnf);
+                if (!gen)
+                        goto err;
+                gens = GENERAL_NAMES_new();
+                if (!gens)
+                        goto err;
+                if (!sk_GENERAL_NAME_push(gens, gen))
+                        goto err;
+                gen = NULL;
+                if (!sk_GENERAL_NAMES_push(ret, gens))
+                        goto err;
+                gens = NULL;
+                }
+
+        return ret;
+
+        err:
+        if (ret)
+                sk_GENERAL_NAMES_pop_free(ret, GENERAL_NAMES_free);
+        if (gens)
+                GENERAL_NAMES_free(gens);
+        if (gen)
+                GENERAL_NAME_free(gen);
+        return NULL;
+        }
+
+
+static CMS_ReceiptRequest *make_receipt_request(STACK *rr_to, int rr_allorfirst,
+                                                                STACK *rr_from)
+        {
+        STACK_OF(GENERAL_NAMES) *rct_to, *rct_from;
+        CMS_ReceiptRequest *rr;
+        rct_to = make_names_stack(rr_to);
+        if (!rct_to)
+                goto err;
+        if (rr_from)
+                {
+                rct_from = make_names_stack(rr_from);
+                if (!rct_from)
+                        goto err;
+                }
+        else
+                rct_from = NULL;
+        rr = CMS_ReceiptRequest_create0(NULL, -1, rr_allorfirst, rct_from,
+                                                rct_to);
+        return rr;
+        err:
+        return NULL;
+        }
+
+#endif
diff --git a/src/lib/libssl/src/apps/ec.c b/src/lib/libssl/src/apps/ec.c
new file mode 100644
index 0000000000..771e15f357
--- /dev/null
+++ b/src/lib/libssl/src/apps/ec.c
@@ -0,0 +1,403 @@
+/* apps/ec.c */
+/*
+ * Written by Nils Larsch for the OpenSSL project.
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <openssl/opensslconf.h>
+#ifndef OPENSSL_NO_EC
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "apps.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+
+#undef PROG
+#define PROG    ec_main
+
+/* -inform arg    - input format - default PEM (one of DER, NET or PEM)
+ * -outform arg   - output format - default PEM
+ * -in arg        - input file - default stdin
+ * -out arg       - output file - default stdout
+ * -des           - encrypt output if PEM format with DES in cbc mode
+ * -text          - print a text version
+ * -param_out     - print the elliptic curve parameters
+ * -conv_form arg - specifies the point encoding form
+ * -param_enc arg - specifies the parameter encoding
+ */
+
+int MAIN(int, char **);
+
+int MAIN(int argc, char **argv)
+{
+#ifndef OPENSSL_NO_ENGINE
+        ENGINE  *e = NULL;
+#endif
+        int     ret = 1;
+        EC_KEY  *eckey = NULL;
+        const EC_GROUP *group;
+        int     i, badops = 0;
+        const EVP_CIPHER *enc = NULL;
+        BIO     *in = NULL, *out = NULL;
+        int     informat, outformat, text=0, noout=0;
+        int     pubin = 0, pubout = 0, param_out = 0;
+        char    *infile, *outfile, *prog, *engine;
+        char    *passargin = NULL, *passargout = NULL;
+        char    *passin = NULL, *passout = NULL;
+        point_conversion_form_t form = POINT_CONVERSION_UNCOMPRESSED;
+        int     new_form = 0;
+        int     asn1_flag = OPENSSL_EC_NAMED_CURVE;
+        int     new_asn1_flag = 0;
+
+        apps_startup();
+
+        if (bio_err == NULL)
+                if ((bio_err=BIO_new(BIO_s_file())) != NULL)
+                        BIO_set_fp(bio_err, stderr, BIO_NOCLOSE|BIO_FP_TEXT);
+
+        if (!load_config(bio_err, NULL))
+                goto end;
+
+        engine = NULL;
+        infile = NULL;
+        outfile = NULL;
+        informat = FORMAT_PEM;
+        outformat = FORMAT_PEM;
+
+        prog = argv[0];
+        argc--;
+        argv++;
+        while (argc >= 1)
+                {
+                if (strcmp(*argv,"-inform") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        informat=str2fmt(*(++argv));
+                        }
+                else if (strcmp(*argv,"-outform") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        outformat=str2fmt(*(++argv));
+                        }
+                else if (strcmp(*argv,"-in") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        infile= *(++argv);
+                        }
+                else if (strcmp(*argv,"-out") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        outfile= *(++argv);
+                        }
+                else if (strcmp(*argv,"-passin") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargin= *(++argv);
+                        }
+                else if (strcmp(*argv,"-passout") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passargout= *(++argv);
+                        }
+                else if (strcmp(*argv, "-engine") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        engine= *(++argv);
+                        }
+                else if (strcmp(*argv, "-noout") == 0)
+                        noout = 1;
+                else if (strcmp(*argv, "-text") == 0)
+                        text = 1;
+                else if (strcmp(*argv, "-conv_form") == 0)
+                        {
+                        if (--argc < 1)
+                                goto bad;
+                        ++argv;
+                        new_form = 1;
+                        if (strcmp(*argv, "compressed") == 0)
+                                form = POINT_CONVERSION_COMPRESSED;
+                        else if (strcmp(*argv, "uncompressed") == 0)
+                                form = POINT_CONVERSION_UNCOMPRESSED;
+                        else if (strcmp(*argv, "hybrid") == 0)
+                                form = POINT_CONVERSION_HYBRID;
+                        else
+                                goto bad;
+                        }
+                else if (strcmp(*argv, "-param_enc") == 0)
+                        {
+                        if (--argc < 1)
+                                goto bad;
+                        ++argv;
+                        new_asn1_flag = 1;
+                        if (strcmp(*argv, "named_curve") == 0)
+                                asn1_flag = OPENSSL_EC_NAMED_CURVE;
+                        else if (strcmp(*argv, "explicit") == 0)
+                                asn1_flag = 0;
+                        else
+                                goto bad;
+                        }
+                else if (strcmp(*argv, "-param_out") == 0)
+                        param_out = 1;
+                else if (strcmp(*argv, "-pubin") == 0)
+                        pubin=1;
+                else if (strcmp(*argv, "-pubout") == 0)
+                        pubout=1;
+                else if ((enc=EVP_get_cipherbyname(&(argv[0][1]))) == NULL)
+                        {
+                        BIO_printf(bio_err, "unknown option %s\n", *argv);
+                        badops=1;
+                        break;
+                        }
+                argc--;
+                argv++;
+                }
+
+        if (badops)
+                {
+bad:
+                BIO_printf(bio_err, "%s [options] <infile >outfile\n", prog);
+                BIO_printf(bio_err, "where options are\n");
+                BIO_printf(bio_err, " -inform arg     input format - "
+                                "DER or PEM\n");
+                BIO_printf(bio_err, " -outform arg    output format - "
+                                "DER or PEM\n");
+                BIO_printf(bio_err, " -in arg         input file\n");
+                BIO_printf(bio_err, " -passin arg     input file pass "
+                                "phrase source\n");
+                BIO_printf(bio_err, " -out arg        output file\n");
+                BIO_printf(bio_err, " -passout arg    output file pass "
+                                "phrase source\n");
+                BIO_printf(bio_err, " -engine e       use engine e, "
+                                "possibly a hardware device.\n");
+                BIO_printf(bio_err, " -des            encrypt PEM output, "
+                                "instead of 'des' every other \n"
+                                "                 cipher "
+                                "supported by OpenSSL can be used\n");
+                BIO_printf(bio_err, " -text           print the key\n");
+                BIO_printf(bio_err, " -noout          don't print key out\n");
+                BIO_printf(bio_err, " -param_out      print the elliptic "
+                                "curve parameters\n");
+                BIO_printf(bio_err, " -conv_form arg  specifies the "
+                                "point conversion form \n");
+                BIO_printf(bio_err, "                 possible values:"
+                                " compressed\n");
+                BIO_printf(bio_err, "                                 "
+                                " uncompressed (default)\n");
+                BIO_printf(bio_err, "                                  "
+                                " hybrid\n");
+                BIO_printf(bio_err, " -param_enc arg  specifies the way"
+                                " the ec parameters are encoded\n");
+                BIO_printf(bio_err, "                 in the asn1 der "
+                                "encoding\n");
+                BIO_printf(bio_err, "                 possible values:"
+                                " named_curve (default)\n");
+                BIO_printf(bio_err,"                                  "
+                                "explicit\n");
+                goto end;
+                }
+
+        ERR_load_crypto_strings();
+
+#ifndef OPENSSL_NO_ENGINE
+        e = setup_engine(bio_err, engine, 0);
+#endif
+
+        if(!app_passwd(bio_err, passargin, passargout, &passin, &passout)) 
+                {
+                BIO_printf(bio_err, "Error getting passwords\n");
+                goto end;
+                }
+
+        in = BIO_new(BIO_s_file());
+        out = BIO_new(BIO_s_file());
+        if ((in == NULL) || (out == NULL))
+                {
+                ERR_print_errors(bio_err);
+                goto end;
+                }
+
+        if (infile == NULL)
+                BIO_set_fp(in, stdin, BIO_NOCLOSE);
+        else
+                {
+                if (BIO_read_filename(in, infile) <= 0)
+                        {
+                        perror(infile);
+                        goto end;
+                        }
+                }
+
+        BIO_printf(bio_err, "read EC key\n");
+        if (informat == FORMAT_ASN1) 
+                {
+                if (pubin) 
+                        eckey = d2i_EC_PUBKEY_bio(in, NULL);
+                else 
+                        eckey = d2i_ECPrivateKey_bio(in, NULL);
+                } 
+        else if (informat == FORMAT_PEM) 
+                {
+                if (pubin) 
+                        eckey = PEM_read_bio_EC_PUBKEY(in, NULL, NULL, 
+                                NULL);
+                else 
+                        eckey = PEM_read_bio_ECPrivateKey(in, NULL, NULL,
+                                passin);
+                } 
+        else
+                {
+                BIO_printf(bio_err, "bad input format specified for key\n");
+                goto end;
+                }
+        if (eckey == NULL)
+                {
+                BIO_printf(bio_err,"unable to load Key\n");
+                ERR_print_errors(bio_err);
+                goto end;
+                }
+
+        if (outfile == NULL)
+                {
+                BIO_set_fp(out, stdout, BIO_NOCLOSE);
+#ifdef OPENSSL_SYS_VMS
+                        {
+                        BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+                        out = BIO_push(tmpbio, out);
+                        }
+#endif
+                }
+        else
+                {
+                if (BIO_write_filename(out, outfile) <= 0)
+                        {
+                        perror(outfile);
+                        goto end;
+                        }
+                }
+
+        group = EC_KEY_get0_group(eckey);
+
+        if (new_form)
+                EC_KEY_set_conv_form(eckey, form);
+
+        if (new_asn1_flag)
+                EC_KEY_set_asn1_flag(eckey, asn1_flag);
+
+        if (text) 
+                if (!EC_KEY_print(out, eckey, 0))
+                        {
+                        perror(outfile);
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+
+        if (noout) 
+                {
+                ret = 0;
+                goto end;
+                }
+
+        BIO_printf(bio_err, "writing EC key\n");
+        if (outformat == FORMAT_ASN1) 
+                {
+                if (param_out)
+                        i = i2d_ECPKParameters_bio(out, group);
+                else if (pubin || pubout) 
+                        i = i2d_EC_PUBKEY_bio(out, eckey);
+                else 
+                        i = i2d_ECPrivateKey_bio(out, eckey);
+                } 
+        else if (outformat == FORMAT_PEM) 
+                {
+                if (param_out)
+                        i = PEM_write_bio_ECPKParameters(out, group);
+                else if (pubin || pubout)
+                        i = PEM_write_bio_EC_PUBKEY(out, eckey);
+                else 
+                        i = PEM_write_bio_ECPrivateKey(out, eckey, enc,
+                                                NULL, 0, NULL, passout);
+                } 
+        else 
+                {
+                BIO_printf(bio_err, "bad output format specified for "
+                        "outfile\n");
+                goto end;
+                }
+
+        if (!i)
+                {
+                BIO_printf(bio_err, "unable to write private key\n");
+                ERR_print_errors(bio_err);
+                }
+        else
+                ret=0;
+end:
+        if (in)
+                BIO_free(in);
+        if (out)
+                BIO_free_all(out);
+        if (eckey)
+                EC_KEY_free(eckey);
+        if (passin)
+                OPENSSL_free(passin);
+        if (passout)
+                OPENSSL_free(passout);
+        apps_shutdown();
+        OPENSSL_EXIT(ret);
+}
+#endif
diff --git a/src/lib/libssl/src/apps/ecparam.c b/src/lib/libssl/src/apps/ecparam.c
new file mode 100644
index 0000000000..4e1fc837ed
--- /dev/null
+++ b/src/lib/libssl/src/apps/ecparam.c
@@ -0,0 +1,728 @@
+/* apps/ecparam.c */
+/*
+ * Written by Nils Larsch for the OpenSSL project.
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * The elliptic curve binary polynomial software is originally written by 
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
+
+#include <openssl/opensslconf.h>
+#ifndef OPENSSL_NO_EC
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <string.h>
+#include "apps.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/bn.h>
+#include <openssl/ec.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+
+#undef PROG
+#define PROG    ecparam_main
+
+/* -inform arg      - input format - default PEM (DER or PEM)
+ * -outform arg     - output format - default PEM
+ * -in  arg         - input file  - default stdin
+ * -out arg         - output file - default stdout
+ * -noout           - do not print the ec parameter
+ * -text            - print the ec parameters in text form
+ * -check           - validate the ec parameters
+ * -C               - print a 'C' function creating the parameters
+ * -name arg        - use the ec parameters with 'short name' name
+ * -list_curves     - prints a list of all currently available curve 'short names'
+ * -conv_form arg   - specifies the point conversion form 
+ *                  - possible values: compressed
+ *                                     uncompressed (default)
+ *                                     hybrid
+ * -param_enc arg   - specifies the way the ec parameters are encoded
+ *                    in the asn1 der encoding
+ *                    possible values: named_curve (default)
+ *                                     explicit
+ * -no_seed         - if 'explicit' parameters are choosen do not use the seed
+ * -genkey          - generate ec key
+ * -rand file       - files to use for random number input
+ * -engine e        - use engine e, possibly a hardware device
+ */
+
+
+static int ecparam_print_var(BIO *,BIGNUM *,const char *,int,unsigned char *);
+
+int MAIN(int, char **);
+
+int MAIN(int argc, char **argv)
+        {
+        EC_GROUP *group = NULL;
+        point_conversion_form_t form = POINT_CONVERSION_UNCOMPRESSED; 
+        int     new_form = 0;
+        int     asn1_flag = OPENSSL_EC_NAMED_CURVE;
+        int     new_asn1_flag = 0;
+        char    *curve_name = NULL, *inrand = NULL;
+        int     list_curves = 0, no_seed = 0, check = 0,
+                badops = 0, text = 0, i, need_rand = 0, genkey = 0;
+        char    *infile = NULL, *outfile = NULL, *prog;
+        BIO     *in = NULL, *out = NULL;
+        int     informat, outformat, noout = 0, C = 0, ret = 1;
+#ifndef OPENSSL_NO_ENGINE
+        ENGINE  *e = NULL;
+#endif
+        char    *engine = NULL;
+
+        BIGNUM  *ec_p = NULL, *ec_a = NULL, *ec_b = NULL,
+                *ec_gen = NULL, *ec_order = NULL, *ec_cofactor = NULL;
+        unsigned char *buffer = NULL;
+
+        apps_startup();
+
+        if (bio_err == NULL)
+                if ((bio_err=BIO_new(BIO_s_file())) != NULL)
+                        BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
+
+        if (!load_config(bio_err, NULL))
+                goto end;
+
+        informat=FORMAT_PEM;
+        outformat=FORMAT_PEM;
+
+        prog=argv[0];
+        argc--;
+        argv++;
+        while (argc >= 1)
+                {
+                if      (strcmp(*argv,"-inform") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        informat=str2fmt(*(++argv));
+                        }
+                else if (strcmp(*argv,"-outform") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        outformat=str2fmt(*(++argv));
+                        }
+                else if (strcmp(*argv,"-in") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        infile= *(++argv);
+                        }
+                else if (strcmp(*argv,"-out") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        outfile= *(++argv);
+                        }
+                else if (strcmp(*argv,"-text") == 0)
+                        text = 1;
+                else if (strcmp(*argv,"-C") == 0)
+                        C = 1;
+                else if (strcmp(*argv,"-check") == 0)
+                        check = 1;
+                else if (strcmp (*argv, "-name") == 0)
+                        {
+                        if (--argc < 1)
+                                goto bad;
+                        curve_name = *(++argv);
+                        }
+                else if (strcmp(*argv, "-list_curves") == 0)
+                        list_curves = 1;
+                else if (strcmp(*argv, "-conv_form") == 0)
+                        {
+                        if (--argc < 1)
+                                goto bad;
+                        ++argv;
+                        new_form = 1;
+                        if (strcmp(*argv, "compressed") == 0)
+                                form = POINT_CONVERSION_COMPRESSED;
+                        else if (strcmp(*argv, "uncompressed") == 0)
+                                form = POINT_CONVERSION_UNCOMPRESSED;
+                        else if (strcmp(*argv, "hybrid") == 0)
+                                form = POINT_CONVERSION_HYBRID;
+                        else
+                                goto bad;
+                        }
+                else if (strcmp(*argv, "-param_enc") == 0)
+                        {
+                        if (--argc < 1)
+                                goto bad;
+                        ++argv;
+                        new_asn1_flag = 1;
+                        if (strcmp(*argv, "named_curve") == 0)
+                                asn1_flag = OPENSSL_EC_NAMED_CURVE;
+                        else if (strcmp(*argv, "explicit") == 0)
+                                asn1_flag = 0;
+                        else
+                                goto bad;
+                        }
+                else if (strcmp(*argv, "-no_seed") == 0)
+                        no_seed = 1;
+                else if (strcmp(*argv, "-noout") == 0)
+                        noout=1;
+                else if (strcmp(*argv,"-genkey") == 0)
+                        {
+                        genkey=1;
+                        need_rand=1;
+                        }
+                else if (strcmp(*argv, "-rand") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        inrand= *(++argv);
+                        need_rand=1;
+                        }
+                else if(strcmp(*argv, "-engine") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        engine = *(++argv);
+                        }       
+                else
+                        {
+                        BIO_printf(bio_err,"unknown option %s\n",*argv);
+                        badops=1;
+                        break;
+                        }
+                argc--;
+                argv++;
+                }
+
+        if (badops)
+                {
+bad:
+                BIO_printf(bio_err, "%s [options] <infile >outfile\n",prog);
+                BIO_printf(bio_err, "where options are\n");
+                BIO_printf(bio_err, " -inform arg       input format - "
+                                "default PEM (DER or PEM)\n");
+                BIO_printf(bio_err, " -outform arg      output format - "
+                                "default PEM\n");
+                BIO_printf(bio_err, " -in  arg          input file  - "
+                                "default stdin\n");
+                BIO_printf(bio_err, " -out arg          output file - "
+                                "default stdout\n");
+                BIO_printf(bio_err, " -noout            do not print the "
+                                "ec parameter\n");
+                BIO_printf(bio_err, " -text             print the ec "
+                                "parameters in text form\n");
+                BIO_printf(bio_err, " -check            validate the ec "
+                                "parameters\n");
+                BIO_printf(bio_err, " -C                print a 'C' "
+                                "function creating the parameters\n");
+                BIO_printf(bio_err, " -name arg         use the "
+                                "ec parameters with 'short name' name\n");
+                BIO_printf(bio_err, " -list_curves      prints a list of "
+                                "all currently available curve 'short names'\n");
+                BIO_printf(bio_err, " -conv_form arg    specifies the "
+                                "point conversion form \n");
+                BIO_printf(bio_err, "                   possible values:"
+                                " compressed\n");
+                BIO_printf(bio_err, "                                   "
+                                " uncompressed (default)\n");
+                BIO_printf(bio_err, "                                   "
+                                " hybrid\n");
+                BIO_printf(bio_err, " -param_enc arg    specifies the way"
+                                " the ec parameters are encoded\n");
+                BIO_printf(bio_err, "                   in the asn1 der "
+                                "encoding\n");
+                BIO_printf(bio_err, "                   possible values:"
+                                " named_curve (default)\n");
+                BIO_printf(bio_err, "                                   "
+                                " explicit\n");
+                BIO_printf(bio_err, " -no_seed          if 'explicit'"
+                                " parameters are choosen do not"
+                                " use the seed\n");
+                BIO_printf(bio_err, " -genkey           generate ec"
+                                " key\n");
+                BIO_printf(bio_err, " -rand file        files to use for"
+                                " random number input\n");
+                BIO_printf(bio_err, " -engine e         use engine e, "
+                                "possibly a hardware device\n");
+                goto end;
+                }
+
+        ERR_load_crypto_strings();
+
+        in=BIO_new(BIO_s_file());
+        out=BIO_new(BIO_s_file());
+        if ((in == NULL) || (out == NULL))
+                {
+                ERR_print_errors(bio_err);
+                goto end;
+                }
+
+        if (infile == NULL)
+                BIO_set_fp(in,stdin,BIO_NOCLOSE);
+        else
+                {
+                if (BIO_read_filename(in,infile) <= 0)
+                        {
+                        perror(infile);
+                        goto end;
+                        }
+                }
+        if (outfile == NULL)
+                {
+                BIO_set_fp(out,stdout,BIO_NOCLOSE);
+#ifdef OPENSSL_SYS_VMS
+                {
+                BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+                out = BIO_push(tmpbio, out);
+                }
+#endif
+                }
+        else
+                {
+                if (BIO_write_filename(out,outfile) <= 0)
+                        {
+                        perror(outfile);
+                        goto end;
+                        }
+                }
+
+#ifndef OPENSSL_NO_ENGINE
+        e = setup_engine(bio_err, engine, 0);
+#endif
+
+        if (list_curves)
+                {
+                EC_builtin_curve *curves = NULL;
+                size_t crv_len = 0;
+                size_t n = 0;
+
+                crv_len = EC_get_builtin_curves(NULL, 0);
+
+                curves = OPENSSL_malloc((int)(sizeof(EC_builtin_curve) * crv_len));
+
+                if (curves == NULL)
+                        goto end;
+
+                if (!EC_get_builtin_curves(curves, crv_len))
+                        {
+                        OPENSSL_free(curves);
+                        goto end;
+                        }
+
+                
+                for (n = 0; n < crv_len; n++)
+                        {
+                        const char *comment;
+                        const char *sname;
+                        comment = curves[n].comment;
+                        sname   = OBJ_nid2sn(curves[n].nid);
+                        if (comment == NULL)
+                                comment = "CURVE DESCRIPTION NOT AVAILABLE";
+                        if (sname == NULL)
+                                sname = "";
+
+                        BIO_printf(out, "  %-10s: ", sname);
+                        BIO_printf(out, "%s\n", comment);
+                        } 
+
+                OPENSSL_free(curves);
+                ret = 0;
+                goto end;
+                }
+
+        if (curve_name != NULL)
+                {
+                int nid;
+
+                /* workaround for the SECG curve names secp192r1
+                 * and secp256r1 (which are the same as the curves
+                 * prime192v1 and prime256v1 defined in X9.62)
+                 */
+                if (!strcmp(curve_name, "secp192r1"))
+                        {
+                        BIO_printf(bio_err, "using curve name prime192v1 "
+                                "instead of secp192r1\n");
+                        nid = NID_X9_62_prime192v1;
+                        }
+                else if (!strcmp(curve_name, "secp256r1"))
+                        {
+                        BIO_printf(bio_err, "using curve name prime256v1 "
+                                "instead of secp256r1\n");
+                        nid = NID_X9_62_prime256v1;
+                        }
+                else
+                        nid = OBJ_sn2nid(curve_name);
+        
+                if (nid == 0)
+                        {
+                        BIO_printf(bio_err, "unknown curve name (%s)\n", 
+                                curve_name);
+                        goto end;
+                        }
+
+                group = EC_GROUP_new_by_curve_name(nid);
+                if (group == NULL)
+                        {
+                        BIO_printf(bio_err, "unable to create curve (%s)\n", 
+                                curve_name);
+                        goto end;
+                        }
+                EC_GROUP_set_asn1_flag(group, asn1_flag);
+                EC_GROUP_set_point_conversion_form(group, form);
+                }
+        else if (informat == FORMAT_ASN1)
+                {
+                group = d2i_ECPKParameters_bio(in, NULL);
+                }
+        else if (informat == FORMAT_PEM)
+                {
+                group = PEM_read_bio_ECPKParameters(in,NULL,NULL,NULL);
+                }
+        else
+                {
+                BIO_printf(bio_err, "bad input format specified\n");
+                goto end;
+                }
+
+        if (group == NULL)
+                {
+                BIO_printf(bio_err, 
+                        "unable to load elliptic curve parameters\n");
+                ERR_print_errors(bio_err);
+                goto end;
+                }
+
+        if (new_form)
+                EC_GROUP_set_point_conversion_form(group, form);
+
+        if (new_asn1_flag)
+                EC_GROUP_set_asn1_flag(group, asn1_flag);
+
+        if (no_seed)
+                {
+                EC_GROUP_set_seed(group, NULL, 0);
+                }
+
+        if (text)
+                {
+                if (!ECPKParameters_print(out, group, 0))
+                        goto end;
+                }
+
+        if (check)
+                {
+                if (group == NULL)
+                        BIO_printf(bio_err, "no elliptic curve parameters\n");
+                BIO_printf(bio_err, "checking elliptic curve parameters: ");
+                if (!EC_GROUP_check(group, NULL))
+                        {
+                        BIO_printf(bio_err, "failed\n");
+                        ERR_print_errors(bio_err);
+                        }
+                else
+                        BIO_printf(bio_err, "ok\n");
+                        
+                }
+
+        if (C)
+                {
+                size_t  buf_len = 0, tmp_len = 0;
+                const EC_POINT *point;
+                int     is_prime, len = 0;
+                const EC_METHOD *meth = EC_GROUP_method_of(group);
+
+                if ((ec_p = BN_new()) == NULL || (ec_a = BN_new()) == NULL ||
+                    (ec_b = BN_new()) == NULL || (ec_gen = BN_new()) == NULL ||
+                    (ec_order = BN_new()) == NULL || 
+                    (ec_cofactor = BN_new()) == NULL )
+                        {
+                        perror("OPENSSL_malloc");
+                        goto end;
+                        }
+
+                is_prime = (EC_METHOD_get_field_type(meth) == 
+                        NID_X9_62_prime_field);
+
+                if (is_prime)
+                        {
+                        if (!EC_GROUP_get_curve_GFp(group, ec_p, ec_a,
+                                ec_b, NULL))
+                                goto end;
+                        }
+                else
+                        {
+                        /* TODO */
+                        goto end;
+                        }
+
+                if ((point = EC_GROUP_get0_generator(group)) == NULL)
+                        goto end;
+                if (!EC_POINT_point2bn(group, point, 
+                        EC_GROUP_get_point_conversion_form(group), ec_gen, 
+                        NULL))
+                        goto end;
+                if (!EC_GROUP_get_order(group, ec_order, NULL))
+                        goto end;
+                if (!EC_GROUP_get_cofactor(group, ec_cofactor, NULL))
+                        goto end;
+
+                if (!ec_p || !ec_a || !ec_b || !ec_gen || 
+                        !ec_order || !ec_cofactor)
+                        goto end;
+
+                len = BN_num_bits(ec_order);
+
+                if ((tmp_len = (size_t)BN_num_bytes(ec_p)) > buf_len)
+                        buf_len = tmp_len;
+                if ((tmp_len = (size_t)BN_num_bytes(ec_a)) > buf_len)
+                        buf_len = tmp_len;
+                if ((tmp_len = (size_t)BN_num_bytes(ec_b)) > buf_len)
+                        buf_len = tmp_len;
+                if ((tmp_len = (size_t)BN_num_bytes(ec_gen)) > buf_len)
+                        buf_len = tmp_len;
+                if ((tmp_len = (size_t)BN_num_bytes(ec_order)) > buf_len)
+                        buf_len = tmp_len;
+                if ((tmp_len = (size_t)BN_num_bytes(ec_cofactor)) > buf_len)
+                        buf_len = tmp_len;
+
+                buffer = (unsigned char *)OPENSSL_malloc(buf_len);
+
+                if (buffer == NULL)
+                        {
+                        perror("OPENSSL_malloc");
+                        goto end;
+                        }
+
+                ecparam_print_var(out, ec_p, "ec_p", len, buffer);
+                ecparam_print_var(out, ec_a, "ec_a", len, buffer);
+                ecparam_print_var(out, ec_b, "ec_b", len, buffer);
+                ecparam_print_var(out, ec_gen, "ec_gen", len, buffer);
+                ecparam_print_var(out, ec_order, "ec_order", len, buffer);
+                ecparam_print_var(out, ec_cofactor, "ec_cofactor", len, 
+                        buffer);
+
+                BIO_printf(out, "\n\n");
+
+                BIO_printf(out, "EC_GROUP *get_ec_group_%d(void)\n\t{\n", len);
+                BIO_printf(out, "\tint ok=0;\n");
+                BIO_printf(out, "\tEC_GROUP *group = NULL;\n");
+                BIO_printf(out, "\tEC_POINT *point = NULL;\n");
+                BIO_printf(out, "\tBIGNUM   *tmp_1 = NULL, *tmp_2 = NULL, "
+                                "*tmp_3 = NULL;\n\n");
+                BIO_printf(out, "\tif ((tmp_1 = BN_bin2bn(ec_p_%d, "
+                                "sizeof(ec_p_%d), NULL)) == NULL)\n\t\t"
+                                "goto err;\n", len, len);
+                BIO_printf(out, "\tif ((tmp_2 = BN_bin2bn(ec_a_%d, "
+                                "sizeof(ec_a_%d), NULL)) == NULL)\n\t\t"
+                                "goto err;\n", len, len);
+                BIO_printf(out, "\tif ((tmp_3 = BN_bin2bn(ec_b_%d, "
+                                "sizeof(ec_b_%d), NULL)) == NULL)\n\t\t"
+                                "goto err;\n", len, len);
+                if (is_prime)
+                        {
+                        BIO_printf(out, "\tif ((group = EC_GROUP_new_curve_"
+                                "GFp(tmp_1, tmp_2, tmp_3, NULL)) == NULL)"
+                                "\n\t\tgoto err;\n\n");
+                        }
+                else
+                        {
+                        /* TODO */
+                        goto end;
+                        }
+                BIO_printf(out, "\t/* build generator */\n");
+                BIO_printf(out, "\tif ((tmp_1 = BN_bin2bn(ec_gen_%d, "
+                                "sizeof(ec_gen_%d), tmp_1)) == NULL)"
+                                "\n\t\tgoto err;\n", len, len);
+                BIO_printf(out, "\tpoint = EC_POINT_bn2point(group, tmp_1, "
+                                "NULL, NULL);\n");
+                BIO_printf(out, "\tif (point == NULL)\n\t\tgoto err;\n");
+                BIO_printf(out, "\tif ((tmp_2 = BN_bin2bn(ec_order_%d, "
+                                "sizeof(ec_order_%d), tmp_2)) == NULL)"
+                                "\n\t\tgoto err;\n", len, len);
+                BIO_printf(out, "\tif ((tmp_3 = BN_bin2bn(ec_cofactor_%d, "
+                                "sizeof(ec_cofactor_%d), tmp_3)) == NULL)"
+                                "\n\t\tgoto err;\n", len, len);
+                BIO_printf(out, "\tif (!EC_GROUP_set_generator(group, point,"
+                                " tmp_2, tmp_3))\n\t\tgoto err;\n");
+                BIO_printf(out, "\n\tok=1;\n");
+                BIO_printf(out, "err:\n");
+                BIO_printf(out, "\tif (tmp_1)\n\t\tBN_free(tmp_1);\n");
+                BIO_printf(out, "\tif (tmp_2)\n\t\tBN_free(tmp_2);\n");
+                BIO_printf(out, "\tif (tmp_3)\n\t\tBN_free(tmp_3);\n");
+                BIO_printf(out, "\tif (point)\n\t\tEC_POINT_free(point);\n");
+                BIO_printf(out, "\tif (!ok)\n");
+                BIO_printf(out, "\t\t{\n");
+                BIO_printf(out, "\t\tEC_GROUP_free(group);\n");
+                BIO_printf(out, "\t\tgroup = NULL;\n");
+                BIO_printf(out, "\t\t}\n");
+                BIO_printf(out, "\treturn(group);\n\t}\n");
+        }
+
+        if (!noout)
+                {
+                if (outformat == FORMAT_ASN1)
+                        i = i2d_ECPKParameters_bio(out, group);
+                else if (outformat == FORMAT_PEM)
+                        i = PEM_write_bio_ECPKParameters(out, group);
+                else    
+                        {
+                        BIO_printf(bio_err,"bad output format specified for"
+                                " outfile\n");
+                        goto end;
+                        }
+                if (!i)
+                        {
+                        BIO_printf(bio_err, "unable to write elliptic "
+                                "curve parameters\n");
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+                }
+        
+        if (need_rand)
+                {
+                app_RAND_load_file(NULL, bio_err, (inrand != NULL));
+                if (inrand != NULL)
+                        BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
+                                app_RAND_load_files(inrand));
+                }
+
+        if (genkey)
+                {
+                EC_KEY *eckey = EC_KEY_new();
+
+                if (eckey == NULL)
+                        goto end;
+
+                assert(need_rand);
+
+                if (EC_KEY_set_group(eckey, group) == 0)
+                        goto end;
+                
+                if (!EC_KEY_generate_key(eckey))
+                        {
+                        EC_KEY_free(eckey);
+                        goto end;
+                        }
+                if (outformat == FORMAT_ASN1)
+                        i = i2d_ECPrivateKey_bio(out, eckey);
+                else if (outformat == FORMAT_PEM)
+                        i = PEM_write_bio_ECPrivateKey(out, eckey, NULL,
+                                NULL, 0, NULL, NULL);
+                else    
+                        {
+                        BIO_printf(bio_err, "bad output format specified "
+                                "for outfile\n");
+                        EC_KEY_free(eckey);
+                        goto end;
+                        }
+                EC_KEY_free(eckey);
+                }
+
+        if (need_rand)
+                app_RAND_write_file(NULL, bio_err);
+
+        ret=0;
+end:
+        if (ec_p)
+                BN_free(ec_p);
+        if (ec_a)
+                BN_free(ec_a);
+        if (ec_b)
+                BN_free(ec_b);
+        if (ec_gen)
+                BN_free(ec_gen);
+        if (ec_order)
+                BN_free(ec_order);
+        if (ec_cofactor)
+                BN_free(ec_cofactor);
+        if (buffer)
+                OPENSSL_free(buffer);
+        if (in != NULL)
+                BIO_free(in);
+        if (out != NULL)
+                BIO_free_all(out);
+        if (group != NULL)
+                EC_GROUP_free(group);
+        apps_shutdown();
+        OPENSSL_EXIT(ret);
+}
+
+static int ecparam_print_var(BIO *out, BIGNUM *in, const char *var,
+        int len, unsigned char *buffer)
+        {
+        BIO_printf(out, "static unsigned char %s_%d[] = {", var, len);
+        if (BN_is_zero(in))
+                BIO_printf(out, "\n\t0x00");
+        else 
+                {
+                int i, l;
+
+                l = BN_bn2bin(in, buffer);
+                for (i=0; i<l-1; i++)
+                        {
+                        if ((i%12) == 0) 
+                                BIO_printf(out, "\n\t");
+                        BIO_printf(out, "0x%02X,", buffer[i]);
+                        }
+                if ((i%12) == 0) 
+                        BIO_printf(out, "\n\t");
+                BIO_printf(out, "0x%02X", buffer[i]);
+                }
+        BIO_printf(out, "\n\t};\n\n");
+        return 1;
+        }
+#endif
diff --git a/src/lib/libssl/src/apps/timeouts.h b/src/lib/libssl/src/apps/timeouts.h
new file mode 100644
index 0000000000..89b5dc76f6
--- /dev/null
+++ b/src/lib/libssl/src/apps/timeouts.h
@@ -0,0 +1,67 @@
+/* apps/timeouts.h */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef INCLUDED_TIMEOUTS_H
+#define INCLUDED_TIMEOUTS_H
+
+/* numbers in us */
+#define DGRAM_RCV_TIMEOUT         250000
+#define DGRAM_SND_TIMEOUT         250000
+
+#endif /* ! INCLUDED_TIMEOUTS_H */
diff --git a/src/lib/libssl/src/certs/README.RootCerts b/src/lib/libssl/src/certs/README.RootCerts
new file mode 100644
index 0000000000..c760b61033
--- /dev/null
+++ b/src/lib/libssl/src/certs/README.RootCerts
@@ -0,0 +1,4 @@
+The OpenSSL project does not (any longer) include root CA certificates.
+
+Please check out the FAQ:
+  * How can I set up a bundle of commercial root CA certificates?
diff --git a/src/lib/libssl/src/crypto/LPdir_nyi.c b/src/lib/libssl/src/crypto/LPdir_nyi.c
new file mode 100644
index 0000000000..6c1a50e6a8
--- /dev/null
+++ b/src/lib/libssl/src/crypto/LPdir_nyi.c
@@ -0,0 +1,42 @@
+/* $LP: LPlib/source/LPdir_win.c,v 1.1 2004/06/14 10:07:56 _cvs_levitte Exp $ */
+/*
+ * Copyright (c) 2004, Richard Levitte <richard@levitte.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef LPDIR_H
+#include "LPdir.h"
+#endif
+
+struct LP_dir_context_st { void *dummy; };
+const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
+        {
+        errno = EINVAL;
+        return 0;
+        }
+int LP_find_file_end(LP_DIR_CTX **ctx)
+        {
+        errno = EINVAL;
+        return 0;
+        }
diff --git a/src/lib/libssl/src/crypto/LPdir_unix.c b/src/lib/libssl/src/crypto/LPdir_unix.c
new file mode 100644
index 0000000000..b004cd99e8
--- /dev/null
+++ b/src/lib/libssl/src/crypto/LPdir_unix.c
@@ -0,0 +1,127 @@
+/* $LP: LPlib/source/LPdir_unix.c,v 1.11 2004/09/23 22:07:22 _cvs_levitte Exp $ */
+/*
+ * Copyright (c) 2004, Richard Levitte <richard@levitte.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stddef.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <string.h>
+#include <sys/types.h>
+#include <dirent.h>
+#include <errno.h>
+#ifndef LPDIR_H
+#include "LPdir.h"
+#endif
+
+/* The POSIXly macro for the maximum number of characters in a file path
+   is NAME_MAX.  However, some operating systems use PATH_MAX instead.
+   Therefore, it seems natural to first check for PATH_MAX and use that,
+   and if it doesn't exist, use NAME_MAX. */
+#if defined(PATH_MAX)
+# define LP_ENTRY_SIZE PATH_MAX
+#elif defined(NAME_MAX)
+# define LP_ENTRY_SIZE NAME_MAX
+#endif
+
+/* Of course, there's the possibility that neither PATH_MAX nor NAME_MAX
+   exist.  It's also possible that NAME_MAX exists but is define to a
+   very small value (HP-UX offers 14), so we need to check if we got a
+   result, and if it meets a minimum standard, and create or change it
+   if not. */
+#if !defined(LP_ENTRY_SIZE) || LP_ENTRY_SIZE<255
+# undef LP_ENTRY_SIZE
+# define LP_ENTRY_SIZE 255
+#endif
+
+struct LP_dir_context_st
+{
+  DIR *dir;
+  char entry_name[LP_ENTRY_SIZE+1];
+};
+
+const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
+{
+  struct dirent *direntry = NULL;
+
+  if (ctx == NULL || directory == NULL)
+    {
+      errno = EINVAL;
+      return 0;
+    }
+
+  errno = 0;
+  if (*ctx == NULL)
+    {
+      *ctx = (LP_DIR_CTX *)malloc(sizeof(LP_DIR_CTX));
+      if (*ctx == NULL)
+        {
+          errno = ENOMEM;
+          return 0;
+        }
+      memset(*ctx, '\0', sizeof(LP_DIR_CTX));
+
+      (*ctx)->dir = opendir(directory);
+      if ((*ctx)->dir == NULL)
+        {
+          int save_errno = errno; /* Probably not needed, but I'm paranoid */
+          free(*ctx);
+          *ctx = NULL;
+          errno = save_errno;
+          return 0;
+        }
+    }
+
+  direntry = readdir((*ctx)->dir);
+  if (direntry == NULL)
+    {
+      return 0;
+    }
+
+  strncpy((*ctx)->entry_name, direntry->d_name, sizeof((*ctx)->entry_name) - 1);
+  (*ctx)->entry_name[sizeof((*ctx)->entry_name) - 1] = '\0';
+  return (*ctx)->entry_name;
+}
+
+int LP_find_file_end(LP_DIR_CTX **ctx)
+{
+  if (ctx != NULL && *ctx != NULL)
+    {
+      int ret = closedir((*ctx)->dir);
+
+      free(*ctx);
+      switch (ret)
+        {
+        case 0:
+          return 1;
+        case -1:
+          return 0;
+        default:
+          break;
+        }
+    }
+  errno = EINVAL;
+  return 0;
+}
diff --git a/src/lib/libssl/src/crypto/LPdir_vms.c b/src/lib/libssl/src/crypto/LPdir_vms.c
new file mode 100644
index 0000000000..85b427a623
--- /dev/null
+++ b/src/lib/libssl/src/crypto/LPdir_vms.c
@@ -0,0 +1,199 @@
+/* $LP: LPlib/source/LPdir_vms.c,v 1.20 2004/08/26 13:36:05 _cvs_levitte Exp $ */
+/*
+ * Copyright (c) 2004, Richard Levitte <richard@levitte.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <descrip.h>
+#include <namdef.h>
+#include <rmsdef.h>
+#include <libfildef.h>
+#include <lib$routines.h>
+#include <strdef.h>
+#include <str$routines.h>
+#include <stsdef.h>
+#ifndef LPDIR_H
+#include "LPdir.h"
+#endif
+
+/* Because some compiler options hide this macor */
+#ifndef EVMSERR
+#define EVMSERR         65535  /* error for non-translatable VMS errors */
+#endif
+
+struct LP_dir_context_st
+{
+  unsigned long VMS_context;
+#ifdef NAML$C_MAXRSS
+  char filespec[NAML$C_MAXRSS+1];
+  char result[NAML$C_MAXRSS+1];
+#else
+  char filespec[256];
+  char result[256];
+#endif
+  struct dsc$descriptor_d filespec_dsc;
+  struct dsc$descriptor_d result_dsc;
+};
+
+const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
+{
+  int status;
+  char *p, *r;
+  size_t l;
+  unsigned long flags = 0;
+#ifdef NAML$C_MAXRSS
+  flags |= LIB$M_FIL_LONG_NAMES;
+#endif
+
+  if (ctx == NULL || directory == NULL)
+    {
+      errno = EINVAL;
+      return 0;
+    }
+
+  errno = 0;
+  if (*ctx == NULL)
+    {
+      size_t filespeclen = strlen(directory);
+      char *filespec = NULL;
+
+      /* MUST be a VMS directory specification!  Let's estimate if it is. */
+      if (directory[filespeclen-1] != ']'
+          && directory[filespeclen-1] != '>'
+          && directory[filespeclen-1] != ':')
+        {
+          errno = EINVAL;
+          return 0;
+        }
+
+      filespeclen += 4;         /* "*.*;" */
+
+      if (filespeclen >
+#ifdef NAML$C_MAXRSS
+          NAML$C_MAXRSS
+#else
+          255
+#endif
+          )
+        {
+          errno = ENAMETOOLONG;
+          return 0;
+        }
+
+      *ctx = (LP_DIR_CTX *)malloc(sizeof(LP_DIR_CTX));
+      if (*ctx == NULL)
+        {
+          errno = ENOMEM;
+          return 0;
+        }
+      memset(*ctx, '\0', sizeof(LP_DIR_CTX));
+
+      strcpy((*ctx)->filespec,directory);
+      strcat((*ctx)->filespec,"*.*;");
+      (*ctx)->filespec_dsc.dsc$w_length = filespeclen;
+      (*ctx)->filespec_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
+      (*ctx)->filespec_dsc.dsc$b_class = DSC$K_CLASS_S;
+      (*ctx)->filespec_dsc.dsc$a_pointer = (*ctx)->filespec;
+      (*ctx)->result_dsc.dsc$w_length = 0;
+      (*ctx)->result_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
+      (*ctx)->result_dsc.dsc$b_class = DSC$K_CLASS_D;
+      (*ctx)->result_dsc.dsc$a_pointer = 0;
+    }
+
+  (*ctx)->result_dsc.dsc$w_length = 0;
+  (*ctx)->result_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
+  (*ctx)->result_dsc.dsc$b_class = DSC$K_CLASS_D;
+  (*ctx)->result_dsc.dsc$a_pointer = 0;
+
+  status = lib$find_file(&(*ctx)->filespec_dsc, &(*ctx)->result_dsc,
+                         &(*ctx)->VMS_context, 0, 0, 0, &flags);
+
+  if (status == RMS$_NMF)
+    {
+      errno = 0;
+      vaxc$errno = status;
+      return NULL;
+    }
+
+  if(!$VMS_STATUS_SUCCESS(status))
+    {
+      errno = EVMSERR;
+      vaxc$errno = status;
+      return NULL;
+    }
+
+  /* Quick, cheap and dirty way to discard any device and directory,
+     since we only want file names */
+  l = (*ctx)->result_dsc.dsc$w_length;
+  p = (*ctx)->result_dsc.dsc$a_pointer;
+  r = p;
+  for (; *p; p++)
+    {
+      if (*p == '^' && p[1] != '\0') /* Take care of ODS-5 escapes */
+        {
+          p++;
+        }
+      else if (*p == ':' || *p == '>' || *p == ']')
+        {
+          l -= p + 1 - r;
+          r = p + 1;
+        }
+      else if (*p == ';')
+        {
+          l = p - r;
+          break;
+        }
+    }
+
+  strncpy((*ctx)->result, r, l);
+  (*ctx)->result[l] = '\0';
+  str$free1_dx(&(*ctx)->result_dsc);
+
+  return (*ctx)->result;
+}
+
+int LP_find_file_end(LP_DIR_CTX **ctx)
+{
+  if (ctx != NULL && *ctx != NULL)
+    {
+      int status = lib$find_file_end(&(*ctx)->VMS_context);
+
+      free(*ctx);
+
+      if(!$VMS_STATUS_SUCCESS(status))
+        {
+          errno = EVMSERR;
+          vaxc$errno = status;
+          return 0;
+        }
+      return 1;
+    }
+  errno = EINVAL;
+  return 0;
+}
+
diff --git a/src/lib/libssl/src/crypto/LPdir_win.c b/src/lib/libssl/src/crypto/LPdir_win.c
new file mode 100644
index 0000000000..09b475beed
--- /dev/null
+++ b/src/lib/libssl/src/crypto/LPdir_win.c
@@ -0,0 +1,155 @@
+/* $LP: LPlib/source/LPdir_win.c,v 1.10 2004/08/26 13:36:05 _cvs_levitte Exp $ */
+/*
+ * Copyright (c) 2004, Richard Levitte <richard@levitte.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include <windows.h>
+#include <tchar.h>
+#ifndef LPDIR_H
+#include "LPdir.h"
+#endif
+
+/* We're most likely overcautious here, but let's reserve for
+    broken WinCE headers and explicitly opt for UNICODE call.
+    Keep in mind that our WinCE builds are compiled with -DUNICODE
+    [as well as -D_UNICODE]. */
+#if defined(LP_SYS_WINCE) && !defined(FindFirstFile)
+# define FindFirstFile FindFirstFileW
+#endif
+#if defined(LP_SYS_WINCE) && !defined(FindFirstFile)
+# define FindNextFile FindNextFileW
+#endif
+
+#ifndef NAME_MAX
+#define NAME_MAX 255
+#endif
+
+struct LP_dir_context_st
+{
+  WIN32_FIND_DATA ctx;
+  HANDLE handle;
+  char entry_name[NAME_MAX+1];
+};
+
+const char *LP_find_file(LP_DIR_CTX **ctx, const char *directory)
+{
+  struct dirent *direntry = NULL;
+
+  if (ctx == NULL || directory == NULL)
+    {
+      errno = EINVAL;
+      return 0;
+    }
+
+  errno = 0;
+  if (*ctx == NULL)
+    {
+      *ctx = (LP_DIR_CTX *)malloc(sizeof(LP_DIR_CTX));
+      if (*ctx == NULL)
+        {
+          errno = ENOMEM;
+          return 0;
+        }
+      memset(*ctx, '\0', sizeof(LP_DIR_CTX));
+
+      if (sizeof(TCHAR) != sizeof(char))
+        {
+          TCHAR *wdir = NULL;
+          /* len_0 denotes string length *with* trailing 0 */ 
+          size_t index = 0,len_0 = strlen(directory) + 1;
+
+          wdir = (TCHAR *)malloc(len_0 * sizeof(TCHAR));
+          if (wdir == NULL)
+            {
+              free(*ctx);
+              *ctx = NULL;
+              errno = ENOMEM;
+              return 0;
+            }
+
+#ifdef LP_MULTIBYTE_AVAILABLE
+          if (!MultiByteToWideChar(CP_ACP, 0, directory, len_0, (WCHAR *)wdir, len_0))
+#endif
+            for (index = 0; index < len_0; index++)
+              wdir[index] = (TCHAR)directory[index];
+
+          (*ctx)->handle = FindFirstFile(wdir, &(*ctx)->ctx);
+
+          free(wdir);
+        }
+      else
+        (*ctx)->handle = FindFirstFile((TCHAR *)directory, &(*ctx)->ctx);
+
+      if ((*ctx)->handle == INVALID_HANDLE_VALUE)
+        {
+          free(*ctx);
+          *ctx = NULL;
+          errno = EINVAL;
+          return 0;
+        }
+    }
+  else
+    {
+      if (FindNextFile((*ctx)->handle, &(*ctx)->ctx) == FALSE)
+        {
+          return 0;
+        }
+    }
+
+  if (sizeof(TCHAR) != sizeof(char))
+    {
+      TCHAR *wdir = (*ctx)->ctx.cFileName;
+      size_t index, len_0 = 0;
+
+      while (wdir[len_0] && len_0 < (sizeof((*ctx)->entry_name) - 1)) len_0++;
+      len_0++;
+
+#ifdef LP_MULTIBYTE_AVAILABLE
+      if (!WideCharToMultiByte(CP_ACP, 0, (WCHAR *)wdir, len_0, (*ctx)->entry_name,
+                               sizeof((*ctx)->entry_name), NULL, 0))
+#endif
+        for (index = 0; index < len_0; index++)
+          (*ctx)->entry_name[index] = (char)wdir[index];
+    }
+  else
+    strncpy((*ctx)->entry_name, (const char *)(*ctx)->ctx.cFileName,
+            sizeof((*ctx)->entry_name)-1);
+
+  (*ctx)->entry_name[sizeof((*ctx)->entry_name)-1] = '\0';
+
+  return (*ctx)->entry_name;
+}
+
+int LP_find_file_end(LP_DIR_CTX **ctx)
+{
+  if (ctx != NULL && *ctx != NULL)
+    {
+      FindClose((*ctx)->handle);
+      free(*ctx);
+      *ctx = NULL;
+      return 1;
+    }
+  errno = EINVAL;
+  return 0;
+}
diff --git a/src/lib/libssl/src/crypto/LPdir_win32.c b/src/lib/libssl/src/crypto/LPdir_win32.c
new file mode 100644
index 0000000000..e39872da52
--- /dev/null
+++ b/src/lib/libssl/src/crypto/LPdir_win32.c
@@ -0,0 +1,30 @@
+/* $LP: LPlib/source/LPdir_win32.c,v 1.3 2004/08/26 13:36:05 _cvs_levitte Exp $ */
+/*
+ * Copyright (c) 2004, Richard Levitte <richard@levitte.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#define LP_SYS_WIN32
+#define LP_MULTIBYTE_AVAILABLE
+#include "LPdir_win.c"
diff --git a/src/lib/libssl/src/crypto/LPdir_wince.c b/src/lib/libssl/src/crypto/LPdir_wince.c
new file mode 100644
index 0000000000..ab0e1e6f4f
--- /dev/null
+++ b/src/lib/libssl/src/crypto/LPdir_wince.c
@@ -0,0 +1,31 @@
+/* $LP: LPlib/source/LPdir_wince.c,v 1.3 2004/08/26 13:36:05 _cvs_levitte Exp $ */
+/*
+ * Copyright (c) 2004, Richard Levitte <richard@levitte.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#define LP_SYS_WINCE
+/* We might want to define LP_MULTIBYTE_AVAILABLE here.  It's currently
+   under investigation what the exact conditions would be */
+#include "LPdir_win.c"
diff --git a/src/lib/libssl/src/crypto/aes/aes_ige.c b/src/lib/libssl/src/crypto/aes/aes_ige.c
new file mode 100644
index 0000000000..45d7096181
--- /dev/null
+++ b/src/lib/libssl/src/crypto/aes/aes_ige.c
@@ -0,0 +1,323 @@
+/* crypto/aes/aes_ige.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+
+#include "cryptlib.h"
+
+#include <openssl/aes.h>
+#include "aes_locl.h"
+
+#define N_WORDS (AES_BLOCK_SIZE / sizeof(unsigned long))
+typedef struct {
+        unsigned long data[N_WORDS];
+} aes_block_t;
+
+/* XXX: probably some better way to do this */
+#if defined(__i386__) || defined(__x86_64__)
+#define UNALIGNED_MEMOPS_ARE_FAST 1
+#else
+#define UNALIGNED_MEMOPS_ARE_FAST 0
+#endif
+
+#if UNALIGNED_MEMOPS_ARE_FAST
+#define load_block(d, s)        (d) = *(const aes_block_t *)(s)
+#define store_block(d, s)       *(aes_block_t *)(d) = (s)
+#else
+#define load_block(d, s)        memcpy((d).data, (s), AES_BLOCK_SIZE)
+#define store_block(d, s)       memcpy((d), (s).data, AES_BLOCK_SIZE)
+#endif
+
+/* N.B. The IV for this mode is _twice_ the block size */
+
+void AES_ige_encrypt(const unsigned char *in, unsigned char *out,
+                                         const unsigned long length, const AES_KEY *key,
+                                         unsigned char *ivec, const int enc)
+        {
+        unsigned long n;
+        unsigned long len;
+
+        OPENSSL_assert(in && out && key && ivec);
+        OPENSSL_assert((AES_ENCRYPT == enc)||(AES_DECRYPT == enc));
+        OPENSSL_assert((length%AES_BLOCK_SIZE) == 0);
+
+        len = length / AES_BLOCK_SIZE;
+
+        if (AES_ENCRYPT == enc)
+                {
+                if (in != out &&
+                    (UNALIGNED_MEMOPS_ARE_FAST || ((size_t)in|(size_t)out|(size_t)ivec)%sizeof(long)==0))
+                        {
+                        aes_block_t *ivp = (aes_block_t *)ivec;
+                        aes_block_t *iv2p = (aes_block_t *)(ivec + AES_BLOCK_SIZE);
+
+                        while (len)
+                                {
+                                aes_block_t *inp = (aes_block_t *)in;
+                                aes_block_t *outp = (aes_block_t *)out;
+
+                                for(n=0 ; n < N_WORDS; ++n)
+                                        outp->data[n] = inp->data[n] ^ ivp->data[n];
+                                AES_encrypt((unsigned char *)outp->data, (unsigned char *)outp->data, key);
+                                for(n=0 ; n < N_WORDS; ++n)
+                                        outp->data[n] ^= iv2p->data[n];
+                                ivp = outp;
+                                iv2p = inp;
+                                --len;
+                                in += AES_BLOCK_SIZE;
+                                out += AES_BLOCK_SIZE;
+                                }
+                        memcpy(ivec, ivp->data, AES_BLOCK_SIZE);
+                        memcpy(ivec + AES_BLOCK_SIZE, iv2p->data, AES_BLOCK_SIZE);
+                        }
+                else
+                        {
+                        aes_block_t tmp, tmp2;
+                        aes_block_t iv;
+                        aes_block_t iv2;
+
+                        load_block(iv, ivec);
+                        load_block(iv2, ivec + AES_BLOCK_SIZE);
+
+                        while (len)
+                                {
+                                load_block(tmp, in);
+                                for(n=0 ; n < N_WORDS; ++n)
+                                        tmp2.data[n] = tmp.data[n] ^ iv.data[n];
+                                AES_encrypt((unsigned char *)tmp2.data, (unsigned char *)tmp2.data, key);
+                                for(n=0 ; n < N_WORDS; ++n)
+                                        tmp2.data[n] ^= iv2.data[n];
+                                store_block(out, tmp2);
+                                iv = tmp2;
+                                iv2 = tmp;
+                                --len;
+                                in += AES_BLOCK_SIZE;
+                                out += AES_BLOCK_SIZE;
+                                }
+                        memcpy(ivec, iv.data, AES_BLOCK_SIZE);
+                        memcpy(ivec + AES_BLOCK_SIZE, iv2.data, AES_BLOCK_SIZE);
+                        }
+                }
+        else
+                {
+                if (in != out &&
+                    (UNALIGNED_MEMOPS_ARE_FAST || ((size_t)in|(size_t)out|(size_t)ivec)%sizeof(long)==0))
+                        {
+                        aes_block_t *ivp = (aes_block_t *)ivec;
+                        aes_block_t *iv2p = (aes_block_t *)(ivec + AES_BLOCK_SIZE);
+
+                        while (len)
+                                {
+                                aes_block_t tmp;
+                                aes_block_t *inp = (aes_block_t *)in;
+                                aes_block_t *outp = (aes_block_t *)out;
+
+                                for(n=0 ; n < N_WORDS; ++n)
+                                        tmp.data[n] = inp->data[n] ^ iv2p->data[n];
+                                AES_decrypt((unsigned char *)tmp.data, (unsigned char *)outp->data, key);
+                                for(n=0 ; n < N_WORDS; ++n)
+                                        outp->data[n] ^= ivp->data[n];
+                                ivp = inp;
+                                iv2p = outp;
+                                --len;
+                                in += AES_BLOCK_SIZE;
+                                out += AES_BLOCK_SIZE;
+                                }
+                        memcpy(ivec, ivp->data, AES_BLOCK_SIZE);
+                        memcpy(ivec + AES_BLOCK_SIZE, iv2p->data, AES_BLOCK_SIZE);
+                        }
+                else
+                        {
+                        aes_block_t tmp, tmp2;
+                        aes_block_t iv;
+                        aes_block_t iv2;
+
+                        load_block(iv, ivec);
+                        load_block(iv2, ivec + AES_BLOCK_SIZE);
+
+                        while (len)
+                                {
+                                load_block(tmp, in);
+                                tmp2 = tmp;
+                                for(n=0 ; n < N_WORDS; ++n)
+                                        tmp.data[n] ^= iv2.data[n];
+                                AES_decrypt((unsigned char *)tmp.data, (unsigned char *)tmp.data, key);
+                                for(n=0 ; n < N_WORDS; ++n)
+                                        tmp.data[n] ^= iv.data[n];
+                                store_block(out, tmp);
+                                iv = tmp2;
+                                iv2 = tmp;
+                                --len;
+                                in += AES_BLOCK_SIZE;
+                                out += AES_BLOCK_SIZE;
+                                }
+                        memcpy(ivec, iv.data, AES_BLOCK_SIZE);
+                        memcpy(ivec + AES_BLOCK_SIZE, iv2.data, AES_BLOCK_SIZE);
+                        }
+                }
+        }
+
+/*
+ * Note that its effectively impossible to do biIGE in anything other
+ * than a single pass, so no provision is made for chaining.
+ */
+
+/* N.B. The IV for this mode is _four times_ the block size */
+
+void AES_bi_ige_encrypt(const unsigned char *in, unsigned char *out,
+                                                const unsigned long length, const AES_KEY *key,
+                                                const AES_KEY *key2, const unsigned char *ivec,
+                                                const int enc)
+        {
+        unsigned long n;
+        unsigned long len = length;
+        unsigned char tmp[AES_BLOCK_SIZE];
+        unsigned char tmp2[AES_BLOCK_SIZE];
+        unsigned char tmp3[AES_BLOCK_SIZE];
+        unsigned char prev[AES_BLOCK_SIZE];
+        const unsigned char *iv;
+        const unsigned char *iv2;
+
+        OPENSSL_assert(in && out && key && ivec);
+        OPENSSL_assert((AES_ENCRYPT == enc)||(AES_DECRYPT == enc));
+        OPENSSL_assert((length%AES_BLOCK_SIZE) == 0);
+
+        if (AES_ENCRYPT == enc)
+                {
+                /* XXX: Do a separate case for when in != out (strictly should
+                   check for overlap, too) */
+
+                /* First the forward pass */ 
+                iv = ivec;
+                iv2 = ivec + AES_BLOCK_SIZE;
+                while (len >= AES_BLOCK_SIZE)
+                        {
+                        for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
+                                out[n] = in[n] ^ iv[n];
+                        AES_encrypt(out, out, key);
+                        for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
+                                out[n] ^= iv2[n];
+                        iv = out;
+                        memcpy(prev, in, AES_BLOCK_SIZE);
+                        iv2 = prev;
+                        len -= AES_BLOCK_SIZE;
+                        in += AES_BLOCK_SIZE;
+                        out += AES_BLOCK_SIZE;
+                        }
+
+                /* And now backwards */
+                iv = ivec + AES_BLOCK_SIZE*2;
+                iv2 = ivec + AES_BLOCK_SIZE*3;
+                len = length;
+                while(len >= AES_BLOCK_SIZE)
+                        {
+                        out -= AES_BLOCK_SIZE;
+                        /* XXX: reduce copies by alternating between buffers */
+                        memcpy(tmp, out, AES_BLOCK_SIZE);
+                        for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
+                                out[n] ^= iv[n];
+                        /*                      hexdump(stdout, "out ^ iv", out, AES_BLOCK_SIZE); */
+                        AES_encrypt(out, out, key);
+                        /*                      hexdump(stdout,"enc", out, AES_BLOCK_SIZE); */
+                        /*                      hexdump(stdout,"iv2", iv2, AES_BLOCK_SIZE); */
+                        for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
+                                out[n] ^= iv2[n];
+                        /*                      hexdump(stdout,"out", out, AES_BLOCK_SIZE); */
+                        iv = out;
+                        memcpy(prev, tmp, AES_BLOCK_SIZE);
+                        iv2 = prev;
+                        len -= AES_BLOCK_SIZE;
+                        }
+                }
+        else
+                {
+                /* First backwards */
+                iv = ivec + AES_BLOCK_SIZE*2;
+                iv2 = ivec + AES_BLOCK_SIZE*3;
+                in += length;
+                out += length;
+                while (len >= AES_BLOCK_SIZE)
+                        {
+                        in -= AES_BLOCK_SIZE;
+                        out -= AES_BLOCK_SIZE;
+                        memcpy(tmp, in, AES_BLOCK_SIZE);
+                        memcpy(tmp2, in, AES_BLOCK_SIZE);
+                        for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
+                                tmp[n] ^= iv2[n];
+                        AES_decrypt(tmp, out, key);
+                        for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
+                                out[n] ^= iv[n];
+                        memcpy(tmp3, tmp2, AES_BLOCK_SIZE);
+                        iv = tmp3;
+                        iv2 = out;
+                        len -= AES_BLOCK_SIZE;
+                        }
+
+                /* And now forwards */
+                iv = ivec;
+                iv2 = ivec + AES_BLOCK_SIZE;
+                len = length;
+                while (len >= AES_BLOCK_SIZE)
+                        {
+                        memcpy(tmp, out, AES_BLOCK_SIZE);
+                        memcpy(tmp2, out, AES_BLOCK_SIZE);
+                        for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
+                                tmp[n] ^= iv2[n];
+                        AES_decrypt(tmp, out, key);
+                        for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
+                                out[n] ^= iv[n];
+                        memcpy(tmp3, tmp2, AES_BLOCK_SIZE);
+                        iv = tmp3;
+                        iv2 = out;
+                        len -= AES_BLOCK_SIZE;
+                        in += AES_BLOCK_SIZE;
+                        out += AES_BLOCK_SIZE;
+                        }
+                }
+        }
diff --git a/src/lib/libssl/src/crypto/aes/aes_wrap.c b/src/lib/libssl/src/crypto/aes/aes_wrap.c
new file mode 100644
index 0000000000..9feacd65d8
--- /dev/null
+++ b/src/lib/libssl/src/crypto/aes/aes_wrap.c
@@ -0,0 +1,259 @@
+/* crypto/aes/aes_wrap.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include "cryptlib.h"
+#include <openssl/aes.h>
+#include <openssl/bio.h>
+
+static const unsigned char default_iv[] = {
+  0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6,
+};
+
+int AES_wrap_key(AES_KEY *key, const unsigned char *iv,
+                unsigned char *out,
+                const unsigned char *in, unsigned int inlen)
+        {
+        unsigned char *A, B[16], *R;
+        unsigned int i, j, t;
+        if ((inlen & 0x7) || (inlen < 8))
+                return -1;
+        A = B;
+        t = 1;
+        memcpy(out + 8, in, inlen);
+        if (!iv)
+                iv = default_iv;
+
+        memcpy(A, iv, 8);
+
+        for (j = 0; j < 6; j++)
+                {
+                R = out + 8;
+                for (i = 0; i < inlen; i += 8, t++, R += 8)
+                        {
+                        memcpy(B + 8, R, 8);
+                        AES_encrypt(B, B, key);
+                        A[7] ^= (unsigned char)(t & 0xff);
+                        if (t > 0xff)   
+                                {
+                                A[6] ^= (unsigned char)((t & 0xff) >> 8);
+                                A[5] ^= (unsigned char)((t & 0xff) >> 16);
+                                A[4] ^= (unsigned char)((t & 0xff) >> 24);
+                                }
+                        memcpy(R, B + 8, 8);
+                        }
+                }
+        memcpy(out, A, 8);
+        return inlen + 8;
+        }
+
+int AES_unwrap_key(AES_KEY *key, const unsigned char *iv,
+                unsigned char *out,
+                const unsigned char *in, unsigned int inlen)
+        {
+        unsigned char *A, B[16], *R;
+        unsigned int i, j, t;
+        inlen -= 8;
+        if (inlen & 0x7)
+                return -1;
+        if (inlen < 8)
+                return -1;
+        A = B;
+        t =  6 * (inlen >> 3);
+        memcpy(A, in, 8);
+        memcpy(out, in + 8, inlen);
+        for (j = 0; j < 6; j++)
+                {
+                R = out + inlen - 8;
+                for (i = 0; i < inlen; i += 8, t--, R -= 8)
+                        {
+                        A[7] ^= (unsigned char)(t & 0xff);
+                        if (t > 0xff)   
+                                {
+                                A[6] ^= (unsigned char)((t & 0xff) >> 8);
+                                A[5] ^= (unsigned char)((t & 0xff) >> 16);
+                                A[4] ^= (unsigned char)((t & 0xff) >> 24);
+                                }
+                        memcpy(B + 8, R, 8);
+                        AES_decrypt(B, B, key);
+                        memcpy(R, B + 8, 8);
+                        }
+                }
+        if (!iv)
+                iv = default_iv;
+        if (memcmp(A, iv, 8))
+                {
+                OPENSSL_cleanse(out, inlen);
+                return 0;
+                }
+        return inlen;
+        }
+
+#ifdef AES_WRAP_TEST
+
+int AES_wrap_unwrap_test(const unsigned char *kek, int keybits,
+                         const unsigned char *iv,
+                         const unsigned char *eout,
+                         const unsigned char *key, int keylen)
+        {
+        unsigned char *otmp = NULL, *ptmp = NULL;
+        int r, ret = 0;
+        AES_KEY wctx;
+        otmp = OPENSSL_malloc(keylen + 8);
+        ptmp = OPENSSL_malloc(keylen);
+        if (!otmp || !ptmp)
+                return 0;
+        if (AES_set_encrypt_key(kek, keybits, &wctx))
+                goto err;
+        r = AES_wrap_key(&wctx, iv, otmp, key, keylen);
+        if (r <= 0)
+                goto err;
+
+        if (eout && memcmp(eout, otmp, keylen))
+                goto err;
+                
+        if (AES_set_decrypt_key(kek, keybits, &wctx))
+                goto err;
+        r = AES_unwrap_key(&wctx, iv, ptmp, otmp, r);
+
+        if (memcmp(key, ptmp, keylen))
+                goto err;
+
+        ret = 1;
+
+        err:
+        if (otmp)
+                OPENSSL_free(otmp);
+        if (ptmp)
+                OPENSSL_free(ptmp);
+
+        return ret;
+
+        }
+
+
+
+int main(int argc, char **argv)
+{
+
+static const unsigned char kek[] = {
+  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+  0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+  0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
+};
+
+static const unsigned char key[] = {
+  0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
+  0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
+  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
+};
+
+static const unsigned char e1[] = {
+  0x1f, 0xa6, 0x8b, 0x0a, 0x81, 0x12, 0xb4, 0x47,
+  0xae, 0xf3, 0x4b, 0xd8, 0xfb, 0x5a, 0x7b, 0x82,
+  0x9d, 0x3e, 0x86, 0x23, 0x71, 0xd2, 0xcf, 0xe5
+};
+
+static const unsigned char e2[] = {
+  0x96, 0x77, 0x8b, 0x25, 0xae, 0x6c, 0xa4, 0x35,
+  0xf9, 0x2b, 0x5b, 0x97, 0xc0, 0x50, 0xae, 0xd2,
+  0x46, 0x8a, 0xb8, 0xa1, 0x7a, 0xd8, 0x4e, 0x5d
+};
+
+static const unsigned char e3[] = {
+  0x64, 0xe8, 0xc3, 0xf9, 0xce, 0x0f, 0x5b, 0xa2,
+  0x63, 0xe9, 0x77, 0x79, 0x05, 0x81, 0x8a, 0x2a,
+  0x93, 0xc8, 0x19, 0x1e, 0x7d, 0x6e, 0x8a, 0xe7
+};
+
+static const unsigned char e4[] = {
+  0x03, 0x1d, 0x33, 0x26, 0x4e, 0x15, 0xd3, 0x32,
+  0x68, 0xf2, 0x4e, 0xc2, 0x60, 0x74, 0x3e, 0xdc,
+  0xe1, 0xc6, 0xc7, 0xdd, 0xee, 0x72, 0x5a, 0x93,
+  0x6b, 0xa8, 0x14, 0x91, 0x5c, 0x67, 0x62, 0xd2
+};
+
+static const unsigned char e5[] = {
+  0xa8, 0xf9, 0xbc, 0x16, 0x12, 0xc6, 0x8b, 0x3f,
+  0xf6, 0xe6, 0xf4, 0xfb, 0xe3, 0x0e, 0x71, 0xe4,
+  0x76, 0x9c, 0x8b, 0x80, 0xa3, 0x2c, 0xb8, 0x95,
+  0x8c, 0xd5, 0xd1, 0x7d, 0x6b, 0x25, 0x4d, 0xa1
+};
+
+static const unsigned char e6[] = {
+  0x28, 0xc9, 0xf4, 0x04, 0xc4, 0xb8, 0x10, 0xf4,
+  0xcb, 0xcc, 0xb3, 0x5c, 0xfb, 0x87, 0xf8, 0x26,
+  0x3f, 0x57, 0x86, 0xe2, 0xd8, 0x0e, 0xd3, 0x26,
+  0xcb, 0xc7, 0xf0, 0xe7, 0x1a, 0x99, 0xf4, 0x3b,
+  0xfb, 0x98, 0x8b, 0x9b, 0x7a, 0x02, 0xdd, 0x21
+};
+
+        AES_KEY wctx, xctx;
+        int ret;
+        ret = AES_wrap_unwrap_test(kek, 128, NULL, e1, key, 16);
+        fprintf(stderr, "Key test result %d\n", ret);
+        ret = AES_wrap_unwrap_test(kek, 192, NULL, e2, key, 16);
+        fprintf(stderr, "Key test result %d\n", ret);
+        ret = AES_wrap_unwrap_test(kek, 256, NULL, e3, key, 16);
+        fprintf(stderr, "Key test result %d\n", ret);
+        ret = AES_wrap_unwrap_test(kek, 192, NULL, e4, key, 24);
+        fprintf(stderr, "Key test result %d\n", ret);
+        ret = AES_wrap_unwrap_test(kek, 256, NULL, e5, key, 24);
+        fprintf(stderr, "Key test result %d\n", ret);
+        ret = AES_wrap_unwrap_test(kek, 256, NULL, e6, key, 32);
+        fprintf(stderr, "Key test result %d\n", ret);
+}
+        
+        
+#endif
diff --git a/src/lib/libssl/src/crypto/aes/asm/aes-ia64.S b/src/lib/libssl/src/crypto/aes/asm/aes-ia64.S
new file mode 100644
index 0000000000..7f6c4c3662
--- /dev/null
+++ b/src/lib/libssl/src/crypto/aes/asm/aes-ia64.S
@@ -0,0 +1,1123 @@
+// ====================================================================
+// Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+// project. Rights for redistribution and usage in source and binary
+// forms are granted according to the OpenSSL license.
+// ====================================================================
+//
+// What's wrong with compiler generated code? Compiler never uses
+// variable 'shr' which is pairable with 'extr'/'dep' instructions.
+// Then it uses 'zxt' which is an I-type, but can be replaced with
+// 'and' which in turn can be assigned to M-port [there're double as
+// much M-ports as there're I-ports on Itanium 2]. By sacrificing few
+// registers for small constants (255, 24 and 16) to be used with
+// 'shr' and 'and' instructions I can achieve better ILP, Intruction
+// Level Parallelism, and performance. This code outperforms GCC 3.3
+// generated code by over factor of 2 (two), GCC 3.4 - by 70% and
+// HP C - by 40%. Measured best-case scenario, i.e. aligned
+// big-endian input, ECB timing on Itanium 2 is (18 + 13*rounds)
+// ticks per block, or 9.25 CPU cycles per byte for 128 bit key.
+
+// Version 1.2 mitigates the hazard of cache-timing attacks by
+// a) compressing S-boxes from 8KB to 2KB+256B, b) scheduling
+// references to S-boxes for L2 cache latency, c) prefetching T[ed]4
+// prior last round. As result performance dropped to (26 + 15*rounds)
+// ticks per block or 11 cycles per byte processed with 128-bit key.
+// This is ~16% deterioration. For reference Itanium 2 L1 cache has
+// 64 bytes line size and L2 - 128 bytes...
+
+.ident  "aes-ia64.S, version 1.2"
+.ident  "IA-64 ISA artwork by Andy Polyakov <appro@fy.chalmers.se>"
+.explicit
+.text
+
+rk0=r8;     rk1=r9;
+
+pfssave=r2;
+lcsave=r10;
+prsave=r3;
+maskff=r11;
+twenty4=r14;
+sixteen=r15;
+
+te00=r16;   te11=r17;   te22=r18;   te33=r19;
+te01=r20;   te12=r21;   te23=r22;   te30=r23;
+te02=r24;   te13=r25;   te20=r26;   te31=r27;
+te03=r28;   te10=r29;   te21=r30;   te32=r31;
+
+// these are rotating...
+t0=r32;     s0=r33;
+t1=r34;     s1=r35;
+t2=r36;     s2=r37;
+t3=r38;     s3=r39;
+
+te0=r40;    te1=r41;    te2=r42;    te3=r43;
+
+#if defined(_HPUX_SOURCE) && !defined(_LP64)
+# define ADDP   addp4
+#else
+# define ADDP   add
+#endif
+
+// Offsets from Te0
+#define TE0     0
+#define TE2     2
+#if defined(_HPUX_SOURCE) || defined(B_ENDIAN)
+#define TE1     3
+#define TE3     1
+#else
+#define TE1     1
+#define TE3     3
+#endif
+
+// This implies that AES_KEY comprises 32-bit key schedule elements
+// even on LP64 platforms.
+#ifndef KSZ
+# define KSZ    4
+# define LDKEY  ld4
+#endif
+
+.proc   _ia64_AES_encrypt#
+// Input:       rk0-rk1
+//              te0
+//              te3     as AES_KEY->rounds!!!
+//              s0-s3
+//              maskff,twenty4,sixteen
+// Output:      r16,r20,r24,r28 as s0-s3
+// Clobber:     r16-r31,rk0-rk1,r32-r43
+.align  32
+_ia64_AES_encrypt:
+        .prologue
+        .altrp  b6
+        .body
+{ .mmi; alloc   r16=ar.pfs,12,0,0,8
+        LDKEY   t0=[rk0],2*KSZ
+        mov     pr.rot=1<<16    }
+{ .mmi; LDKEY   t1=[rk1],2*KSZ
+        add     te1=TE1,te0
+        add     te3=-3,te3      };;
+{ .mib; LDKEY   t2=[rk0],2*KSZ
+        mov     ar.ec=2         }
+{ .mib; LDKEY   t3=[rk1],2*KSZ
+        add     te2=TE2,te0
+        brp.loop.imp    .Le_top,.Le_end-16      };;
+
+{ .mmi; xor     s0=s0,t0
+        xor     s1=s1,t1
+        mov     ar.lc=te3       }
+{ .mmi; xor     s2=s2,t2
+        xor     s3=s3,t3
+        add     te3=TE3,te0     };;
+
+.align  32
+.Le_top:
+{ .mmi; (p0)    LDKEY   t0=[rk0],2*KSZ          // 0/0:rk[0]
+        (p0)    and     te33=s3,maskff          // 0/0:s3&0xff
+        (p0)    extr.u  te22=s2,8,8     }       // 0/0:s2>>8&0xff
+{ .mmi; (p0)    LDKEY   t1=[rk1],2*KSZ          // 0/1:rk[1]
+        (p0)    and     te30=s0,maskff          // 0/1:s0&0xff
+        (p0)    shr.u   te00=s0,twenty4 };;     // 0/0:s0>>24
+{ .mmi; (p0)    LDKEY   t2=[rk0],2*KSZ          // 1/2:rk[2]
+        (p0)    shladd  te33=te33,3,te3         // 1/0:te0+s0>>24
+        (p0)    extr.u  te23=s3,8,8     }       // 1/1:s3>>8&0xff
+{ .mmi; (p0)    LDKEY   t3=[rk1],2*KSZ          // 1/3:rk[3]
+        (p0)    shladd  te30=te30,3,te3         // 1/1:te3+s0
+        (p0)    shr.u   te01=s1,twenty4 };;     // 1/1:s1>>24
+{ .mmi; (p0)    ld4     te33=[te33]             // 2/0:te3[s3&0xff]
+        (p0)    shladd  te22=te22,3,te2         // 2/0:te2+s2>>8&0xff
+        (p0)    extr.u  te20=s0,8,8     }       // 2/2:s0>>8&0xff
+{ .mmi; (p0)    ld4     te30=[te30]             // 2/1:te3[s0]
+        (p0)    shladd  te23=te23,3,te2         // 2/1:te2+s3>>8
+        (p0)    shr.u   te02=s2,twenty4 };;     // 2/2:s2>>24
+{ .mmi; (p0)    ld4     te22=[te22]             // 3/0:te2[s2>>8]
+        (p0)    shladd  te20=te20,3,te2         // 3/2:te2+s0>>8
+        (p0)    extr.u  te21=s1,8,8     }       // 3/3:s1>>8&0xff
+{ .mmi; (p0)    ld4     te23=[te23]             // 3/1:te2[s3>>8]
+        (p0)    shladd  te00=te00,3,te0         // 3/0:te0+s0>>24
+        (p0)    shr.u   te03=s3,twenty4 };;     // 3/3:s3>>24
+{ .mmi; (p0)    ld4     te20=[te20]             // 4/2:te2[s0>>8]
+        (p0)    shladd  te21=te21,3,te2         // 4/3:te3+s2
+        (p0)    extr.u  te11=s1,16,8    }       // 4/0:s1>>16&0xff
+{ .mmi; (p0)    ld4     te00=[te00]             // 4/0:te0[s0>>24]
+        (p0)    shladd  te01=te01,3,te0         // 4/1:te0+s1>>24
+        (p0)    shr.u   te13=s3,sixteen };;     // 4/2:s3>>16
+{ .mmi; (p0)    ld4     te21=[te21]             // 5/3:te2[s1>>8]
+        (p0)    shladd  te11=te11,3,te1         // 5/0:te1+s1>>16
+        (p0)    extr.u  te12=s2,16,8    }       // 5/1:s2>>16&0xff
+{ .mmi; (p0)    ld4     te01=[te01]             // 5/1:te0[s1>>24]
+        (p0)    shladd  te02=te02,3,te0         // 5/2:te0+s2>>24
+        (p0)    and     te31=s1,maskff  };;     // 5/2:s1&0xff
+{ .mmi; (p0)    ld4     te11=[te11]             // 6/0:te1[s1>>16]
+        (p0)    shladd  te12=te12,3,te1         // 6/1:te1+s2>>16
+        (p0)    extr.u  te10=s0,16,8    }       // 6/3:s0>>16&0xff
+{ .mmi; (p0)    ld4     te02=[te02]             // 6/2:te0[s2>>24]
+        (p0)    shladd  te03=te03,3,te0         // 6/3:te1+s0>>16
+        (p0)    and     te32=s2,maskff  };;     // 6/3:s2&0xff
+
+{ .mmi; (p0)    ld4     te12=[te12]             // 7/1:te1[s2>>16]
+        (p0)    shladd  te31=te31,3,te3         // 7/2:te3+s1&0xff
+        (p0)    and     te13=te13,maskff}       // 7/2:s3>>16&0xff
+{ .mmi; (p0)    ld4     te03=[te03]             // 7/3:te0[s3>>24]
+        (p0)    shladd  te32=te32,3,te3         // 7/3:te3+s2
+        (p0)    xor     t0=t0,te33      };;     // 7/0:
+{ .mmi; (p0)    ld4     te31=[te31]             // 8/2:te3[s1]
+        (p0)    shladd  te13=te13,3,te1         // 8/2:te1+s3>>16
+        (p0)    xor     t0=t0,te22      }       // 8/0:
+{ .mmi; (p0)    ld4     te32=[te32]             // 8/3:te3[s2]
+        (p0)    shladd  te10=te10,3,te1         // 8/3:te1+s0>>16
+        (p0)    xor     t1=t1,te30      };;     // 8/1:
+{ .mmi; (p0)    ld4     te13=[te13]             // 9/2:te1[s3>>16]
+        (p0)    ld4     te10=[te10]             // 9/3:te1[s0>>16]
+        (p0)    xor     t0=t0,te00      };;     // 9/0:         !L2 scheduling
+{ .mmi; (p0)    xor     t1=t1,te23              // 10[9]/1:     
+        (p0)    xor     t2=t2,te20              // 10[9]/2:
+        (p0)    xor     t3=t3,te21      };;     // 10[9]/3:
+{ .mmi; (p0)    xor     t0=t0,te11              // 11[10]/0:done!
+        (p0)    xor     t1=t1,te01              // 11[10]/1:
+        (p0)    xor     t2=t2,te02      };;     // 11[10]/2:    !L2 scheduling
+{ .mmi; (p0)    xor     t3=t3,te03              // 12[10]/3:
+        (p16)   cmp.eq  p0,p17=r0,r0    };;     // 12[10]/clear (p17)
+{ .mmi; (p0)    xor     t1=t1,te12              // 13[11]/1:done!
+        (p0)    xor     t2=t2,te31              // 13[11]/2:
+        (p0)    xor     t3=t3,te32      }       // 13[11]/3:
+{ .mmi; (p17)   add     te0=2048,te0            // 13[11]/
+        (p17)   add     te1=2048+64-TE1,te1};;  // 13[11]/
+{ .mib; (p0)    xor     t2=t2,te13              // 14[12]/2:done!
+        (p17)   add     te2=2048+128-TE2,te2}   // 14[12]/
+{ .mib; (p0)    xor     t3=t3,te10              // 14[12]/3:done!
+        (p17)   add     te3=2048+192-TE3,te3    // 14[12]/
+        br.ctop.sptk    .Le_top         };;
+.Le_end:
+
+
+{ .mmi; ld8     te12=[te0]              // prefetch Te4
+        ld8     te31=[te1]      }
+{ .mmi; ld8     te10=[te2]
+        ld8     te32=[te3]      }
+
+{ .mmi; LDKEY   t0=[rk0],2*KSZ          // 0/0:rk[0]
+        and     te33=s3,maskff          // 0/0:s3&0xff
+        extr.u  te22=s2,8,8     }       // 0/0:s2>>8&0xff
+{ .mmi; LDKEY   t1=[rk1],2*KSZ          // 0/1:rk[1]
+        and     te30=s0,maskff          // 0/1:s0&0xff
+        shr.u   te00=s0,twenty4 };;     // 0/0:s0>>24
+{ .mmi; LDKEY   t2=[rk0],2*KSZ          // 1/2:rk[2]
+        add     te33=te33,te0           // 1/0:te0+s0>>24
+        extr.u  te23=s3,8,8     }       // 1/1:s3>>8&0xff
+{ .mmi; LDKEY   t3=[rk1],2*KSZ          // 1/3:rk[3]
+        add     te30=te30,te0           // 1/1:te0+s0
+        shr.u   te01=s1,twenty4 };;     // 1/1:s1>>24
+{ .mmi; ld1     te33=[te33]             // 2/0:te0[s3&0xff]
+        add     te22=te22,te0           // 2/0:te0+s2>>8&0xff
+        extr.u  te20=s0,8,8     }       // 2/2:s0>>8&0xff
+{ .mmi; ld1     te30=[te30]             // 2/1:te0[s0]
+        add     te23=te23,te0           // 2/1:te0+s3>>8
+        shr.u   te02=s2,twenty4 };;     // 2/2:s2>>24
+{ .mmi; ld1     te22=[te22]             // 3/0:te0[s2>>8]
+        add     te20=te20,te0           // 3/2:te0+s0>>8
+        extr.u  te21=s1,8,8     }       // 3/3:s1>>8&0xff
+{ .mmi; ld1     te23=[te23]             // 3/1:te0[s3>>8]
+        add     te00=te00,te0           // 3/0:te0+s0>>24
+        shr.u   te03=s3,twenty4 };;     // 3/3:s3>>24
+{ .mmi; ld1     te20=[te20]             // 4/2:te0[s0>>8]
+        add     te21=te21,te0           // 4/3:te0+s2
+        extr.u  te11=s1,16,8    }       // 4/0:s1>>16&0xff
+{ .mmi; ld1     te00=[te00]             // 4/0:te0[s0>>24]
+        add     te01=te01,te0           // 4/1:te0+s1>>24
+        shr.u   te13=s3,sixteen };;     // 4/2:s3>>16
+{ .mmi; ld1     te21=[te21]             // 5/3:te0[s1>>8]
+        add     te11=te11,te0           // 5/0:te0+s1>>16
+        extr.u  te12=s2,16,8    }       // 5/1:s2>>16&0xff
+{ .mmi; ld1     te01=[te01]             // 5/1:te0[s1>>24]
+        add     te02=te02,te0           // 5/2:te0+s2>>24
+        and     te31=s1,maskff  };;     // 5/2:s1&0xff
+{ .mmi; ld1     te11=[te11]             // 6/0:te0[s1>>16]
+        add     te12=te12,te0           // 6/1:te0+s2>>16
+        extr.u  te10=s0,16,8    }       // 6/3:s0>>16&0xff
+{ .mmi; ld1     te02=[te02]             // 6/2:te0[s2>>24]
+        add     te03=te03,te0           // 6/3:te0+s0>>16
+        and     te32=s2,maskff  };;     // 6/3:s2&0xff
+
+{ .mmi; ld1     te12=[te12]             // 7/1:te0[s2>>16]
+        add     te31=te31,te0           // 7/2:te0+s1&0xff
+        dep     te33=te22,te33,8,8}     // 7/0:
+{ .mmi; ld1     te03=[te03]             // 7/3:te0[s3>>24]
+        add     te32=te32,te0           // 7/3:te0+s2
+        and     te13=te13,maskff};;     // 7/2:s3>>16&0xff
+{ .mmi; ld1     te31=[te31]             // 8/2:te0[s1]
+        add     te13=te13,te0           // 8/2:te0+s3>>16
+        dep     te30=te23,te30,8,8}     // 8/1:
+{ .mmi; ld1     te32=[te32]             // 8/3:te0[s2]
+        add     te10=te10,te0           // 8/3:te0+s0>>16
+        shl     te00=te00,twenty4};;    // 8/0:
+{ .mii; ld1     te13=[te13]             // 9/2:te0[s3>>16]
+        dep     te33=te11,te33,16,8     // 9/0:
+        shl     te01=te01,twenty4};;    // 9/1:
+{ .mii; ld1     te10=[te10]             // 10/3:te0[s0>>16]
+        dep     te31=te20,te31,8,8      // 10/2:
+        shl     te02=te02,twenty4};;    // 10/2:
+{ .mii; xor     t0=t0,te33              // 11/0:
+        dep     te32=te21,te32,8,8      // 11/3:
+        shl     te12=te12,sixteen};;    // 11/1:
+{ .mii; xor     r16=t0,te00             // 12/0:done!
+        dep     te31=te13,te31,16,8     // 12/2:
+        shl     te03=te03,twenty4};;    // 12/3:
+{ .mmi; xor     t1=t1,te01              // 13/1:
+        xor     t2=t2,te02              // 13/2:
+        dep     te32=te10,te32,16,8};;  // 13/3:
+{ .mmi; xor     t1=t1,te30              // 14/1:
+        xor     r24=t2,te31             // 14/2:done!
+        xor     t3=t3,te32      };;     // 14/3:
+{ .mib; xor     r20=t1,te12             // 15/1:done!
+        xor     r28=t3,te03             // 15/3:done!
+        br.ret.sptk     b6      };;
+.endp   _ia64_AES_encrypt#
+
+// void AES_encrypt (const void *in,void *out,const AES_KEY *key);
+.global AES_encrypt#
+.proc   AES_encrypt#
+.align  32
+AES_encrypt:
+        .prologue
+        .save   ar.pfs,pfssave
+{ .mmi; alloc   pfssave=ar.pfs,3,1,12,0
+        and     out0=3,in0
+        mov     r3=ip                   }
+{ .mmi; ADDP    in0=0,in0
+        mov     loc0=psr.um
+        ADDP    out11=KSZ*60,in2        };;     // &AES_KEY->rounds
+
+{ .mmi; ld4     out11=[out11]                   // AES_KEY->rounds
+        add     out8=(AES_Te#-AES_encrypt#),r3  // Te0
+        .save   pr,prsave
+        mov     prsave=pr               }
+{ .mmi; rum     1<<3                            // clear um.ac
+        .save   ar.lc,lcsave
+        mov     lcsave=ar.lc            };;
+
+        .body
+#if defined(_HPUX_SOURCE)       // HPUX is big-endian, cut 15+15 cycles...
+{ .mib; cmp.ne  p6,p0=out0,r0
+        add     out0=4,in0
+(p6)    br.dpnt.many    .Le_i_unaligned };;
+
+{ .mmi; ld4     out1=[in0],8            // s0
+        and     out9=3,in1
+        mov     twenty4=24              }
+{ .mmi; ld4     out3=[out0],8           // s1
+        ADDP    rk0=0,in2
+        mov     sixteen=16              };;
+{ .mmi; ld4     out5=[in0]              // s2
+        cmp.ne  p6,p0=out9,r0
+        mov     maskff=0xff             }
+{ .mmb; ld4     out7=[out0]             // s3
+        ADDP    rk1=KSZ,in2
+        br.call.sptk.many       b6=_ia64_AES_encrypt    };;
+
+{ .mib; ADDP    in0=4,in1
+        ADDP    in1=0,in1
+(p6)    br.spnt .Le_o_unaligned         };;
+
+{ .mii; mov     psr.um=loc0
+        mov     ar.pfs=pfssave
+        mov     ar.lc=lcsave            };;
+{ .mmi; st4     [in1]=r16,8             // s0
+        st4     [in0]=r20,8             // s1
+        mov     pr=prsave,0x1ffff       };;
+{ .mmb; st4     [in1]=r24               // s2
+        st4     [in0]=r28               // s3
+        br.ret.sptk.many        b0      };;
+#endif
+
+.align  32
+.Le_i_unaligned:
+{ .mmi; add     out0=1,in0
+        add     out2=2,in0
+        add     out4=3,in0      };;
+{ .mmi; ld1     r16=[in0],4
+        ld1     r17=[out0],4    }//;;
+{ .mmi; ld1     r18=[out2],4
+        ld1     out1=[out4],4   };;     // s0
+{ .mmi; ld1     r20=[in0],4
+        ld1     r21=[out0],4    }//;;
+{ .mmi; ld1     r22=[out2],4
+        ld1     out3=[out4],4   };;     // s1
+{ .mmi; ld1     r24=[in0],4
+        ld1     r25=[out0],4    }//;;
+{ .mmi; ld1     r26=[out2],4
+        ld1     out5=[out4],4   };;     // s2
+{ .mmi; ld1     r28=[in0]
+        ld1     r29=[out0]      }//;;
+{ .mmi; ld1     r30=[out2]
+        ld1     out7=[out4]     };;     // s3
+
+{ .mii;
+        dep     out1=r16,out1,24,8      //;;
+        dep     out3=r20,out3,24,8      }//;;
+{ .mii; ADDP    rk0=0,in2
+        dep     out5=r24,out5,24,8      //;;
+        dep     out7=r28,out7,24,8      };;
+{ .mii; ADDP    rk1=KSZ,in2
+        dep     out1=r17,out1,16,8      //;;
+        dep     out3=r21,out3,16,8      }//;;
+{ .mii; mov     twenty4=24
+        dep     out5=r25,out5,16,8      //;;
+        dep     out7=r29,out7,16,8      };;
+{ .mii; mov     sixteen=16
+        dep     out1=r18,out1,8,8       //;;
+        dep     out3=r22,out3,8,8       }//;;
+{ .mii; mov     maskff=0xff
+        dep     out5=r26,out5,8,8       //;;
+        dep     out7=r30,out7,8,8       };;
+
+{ .mib; br.call.sptk.many       b6=_ia64_AES_encrypt    };;
+
+.Le_o_unaligned:
+{ .mii; ADDP    out0=0,in1
+        extr.u  r17=r16,8,8                     // s0
+        shr.u   r19=r16,twenty4         }//;;
+{ .mii; ADDP    out1=1,in1
+        extr.u  r18=r16,16,8
+        shr.u   r23=r20,twenty4         }//;;   // s1
+{ .mii; ADDP    out2=2,in1
+        extr.u  r21=r20,8,8
+        shr.u   r22=r20,sixteen         }//;;
+{ .mii; ADDP    out3=3,in1
+        extr.u  r25=r24,8,8                     // s2
+        shr.u   r27=r24,twenty4         };;
+{ .mii; st1     [out3]=r16,4
+        extr.u  r26=r24,16,8
+        shr.u   r31=r28,twenty4         }//;;   // s3
+{ .mii; st1     [out2]=r17,4
+        extr.u  r29=r28,8,8
+        shr.u   r30=r28,sixteen         }//;;
+
+{ .mmi; st1     [out1]=r18,4
+        st1     [out0]=r19,4            };;
+{ .mmi; st1     [out3]=r20,4
+        st1     [out2]=r21,4            }//;;
+{ .mmi; st1     [out1]=r22,4
+        st1     [out0]=r23,4            };;
+{ .mmi; st1     [out3]=r24,4
+        st1     [out2]=r25,4
+        mov     pr=prsave,0x1ffff       }//;;
+{ .mmi; st1     [out1]=r26,4
+        st1     [out0]=r27,4
+        mov     ar.pfs=pfssave          };;
+{ .mmi; st1     [out3]=r28
+        st1     [out2]=r29
+        mov     ar.lc=lcsave            }//;;
+{ .mmi; st1     [out1]=r30
+        st1     [out0]=r31              }
+{ .mfb; mov     psr.um=loc0                     // restore user mask
+        br.ret.sptk.many        b0      };;
+.endp   AES_encrypt#
+
+// *AES_decrypt are autogenerated by the following script:
+#if 0
+#!/usr/bin/env perl
+print "// *AES_decrypt are autogenerated by the following script:\n#if 0\n";
+open(PROG,'<'.$0); while(<PROG>) { print; } close(PROG);
+print "#endif\n";
+while(<>) {
+        $process=1      if (/\.proc\s+_ia64_AES_encrypt/);
+        next            if (!$process);
+
+        #s/te00=s0/td00=s0/;    s/te00/td00/g;
+        s/te11=s1/td13=s3/;     s/te11/td13/g;
+        #s/te22=s2/td22=s2/;    s/te22/td22/g;
+        s/te33=s3/td31=s1/;     s/te33/td31/g;
+
+        #s/te01=s1/td01=s1/;    s/te01/td01/g;
+        s/te12=s2/td10=s0/;     s/te12/td10/g;
+        #s/te23=s3/td23=s3/;    s/te23/td23/g;
+        s/te30=s0/td32=s2/;     s/te30/td32/g;
+
+        #s/te02=s2/td02=s2/;    s/te02/td02/g;
+        s/te13=s3/td11=s1/;     s/te13/td11/g;
+        #s/te20=s0/td20=s0/;    s/te20/td20/g;
+        s/te31=s1/td33=s3/;     s/te31/td33/g;
+
+        #s/te03=s3/td03=s3/;    s/te03/td03/g;
+        s/te10=s0/td12=s2/;     s/te10/td12/g;
+        #s/te21=s1/td21=s1/;    s/te21/td21/g;
+        s/te32=s2/td30=s0/;     s/te32/td30/g;
+
+        s/td/te/g;
+
+        s/AES_encrypt/AES_decrypt/g;
+        s/\.Le_/.Ld_/g;
+        s/AES_Te#/AES_Td#/g;
+
+        print;
+
+        exit            if (/\.endp\s+AES_decrypt/);
+}
+#endif
+.proc   _ia64_AES_decrypt#
+// Input:       rk0-rk1
+//              te0
+//              te3     as AES_KEY->rounds!!!
+//              s0-s3
+//              maskff,twenty4,sixteen
+// Output:      r16,r20,r24,r28 as s0-s3
+// Clobber:     r16-r31,rk0-rk1,r32-r43
+.align  32
+_ia64_AES_decrypt:
+        .prologue
+        .altrp  b6
+        .body
+{ .mmi; alloc   r16=ar.pfs,12,0,0,8
+        LDKEY   t0=[rk0],2*KSZ
+        mov     pr.rot=1<<16    }
+{ .mmi; LDKEY   t1=[rk1],2*KSZ
+        add     te1=TE1,te0
+        add     te3=-3,te3      };;
+{ .mib; LDKEY   t2=[rk0],2*KSZ
+        mov     ar.ec=2         }
+{ .mib; LDKEY   t3=[rk1],2*KSZ
+        add     te2=TE2,te0
+        brp.loop.imp    .Ld_top,.Ld_end-16      };;
+
+{ .mmi; xor     s0=s0,t0
+        xor     s1=s1,t1
+        mov     ar.lc=te3       }
+{ .mmi; xor     s2=s2,t2
+        xor     s3=s3,t3
+        add     te3=TE3,te0     };;
+
+.align  32
+.Ld_top:
+{ .mmi; (p0)    LDKEY   t0=[rk0],2*KSZ          // 0/0:rk[0]
+        (p0)    and     te31=s1,maskff          // 0/0:s3&0xff
+        (p0)    extr.u  te22=s2,8,8     }       // 0/0:s2>>8&0xff
+{ .mmi; (p0)    LDKEY   t1=[rk1],2*KSZ          // 0/1:rk[1]
+        (p0)    and     te32=s2,maskff          // 0/1:s0&0xff
+        (p0)    shr.u   te00=s0,twenty4 };;     // 0/0:s0>>24
+{ .mmi; (p0)    LDKEY   t2=[rk0],2*KSZ          // 1/2:rk[2]
+        (p0)    shladd  te31=te31,3,te3         // 1/0:te0+s0>>24
+        (p0)    extr.u  te23=s3,8,8     }       // 1/1:s3>>8&0xff
+{ .mmi; (p0)    LDKEY   t3=[rk1],2*KSZ          // 1/3:rk[3]
+        (p0)    shladd  te32=te32,3,te3         // 1/1:te3+s0
+        (p0)    shr.u   te01=s1,twenty4 };;     // 1/1:s1>>24
+{ .mmi; (p0)    ld4     te31=[te31]             // 2/0:te3[s3&0xff]
+        (p0)    shladd  te22=te22,3,te2         // 2/0:te2+s2>>8&0xff
+        (p0)    extr.u  te20=s0,8,8     }       // 2/2:s0>>8&0xff
+{ .mmi; (p0)    ld4     te32=[te32]             // 2/1:te3[s0]
+        (p0)    shladd  te23=te23,3,te2         // 2/1:te2+s3>>8
+        (p0)    shr.u   te02=s2,twenty4 };;     // 2/2:s2>>24
+{ .mmi; (p0)    ld4     te22=[te22]             // 3/0:te2[s2>>8]
+        (p0)    shladd  te20=te20,3,te2         // 3/2:te2+s0>>8
+        (p0)    extr.u  te21=s1,8,8     }       // 3/3:s1>>8&0xff
+{ .mmi; (p0)    ld4     te23=[te23]             // 3/1:te2[s3>>8]
+        (p0)    shladd  te00=te00,3,te0         // 3/0:te0+s0>>24
+        (p0)    shr.u   te03=s3,twenty4 };;     // 3/3:s3>>24
+{ .mmi; (p0)    ld4     te20=[te20]             // 4/2:te2[s0>>8]
+        (p0)    shladd  te21=te21,3,te2         // 4/3:te3+s2
+        (p0)    extr.u  te13=s3,16,8    }       // 4/0:s1>>16&0xff
+{ .mmi; (p0)    ld4     te00=[te00]             // 4/0:te0[s0>>24]
+        (p0)    shladd  te01=te01,3,te0         // 4/1:te0+s1>>24
+        (p0)    shr.u   te11=s1,sixteen };;     // 4/2:s3>>16
+{ .mmi; (p0)    ld4     te21=[te21]             // 5/3:te2[s1>>8]
+        (p0)    shladd  te13=te13,3,te1         // 5/0:te1+s1>>16
+        (p0)    extr.u  te10=s0,16,8    }       // 5/1:s2>>16&0xff
+{ .mmi; (p0)    ld4     te01=[te01]             // 5/1:te0[s1>>24]
+        (p0)    shladd  te02=te02,3,te0         // 5/2:te0+s2>>24
+        (p0)    and     te33=s3,maskff  };;     // 5/2:s1&0xff
+{ .mmi; (p0)    ld4     te13=[te13]             // 6/0:te1[s1>>16]
+        (p0)    shladd  te10=te10,3,te1         // 6/1:te1+s2>>16
+        (p0)    extr.u  te12=s2,16,8    }       // 6/3:s0>>16&0xff
+{ .mmi; (p0)    ld4     te02=[te02]             // 6/2:te0[s2>>24]
+        (p0)    shladd  te03=te03,3,te0         // 6/3:te1+s0>>16
+        (p0)    and     te30=s0,maskff  };;     // 6/3:s2&0xff
+
+{ .mmi; (p0)    ld4     te10=[te10]             // 7/1:te1[s2>>16]
+        (p0)    shladd  te33=te33,3,te3         // 7/2:te3+s1&0xff
+        (p0)    and     te11=te11,maskff}       // 7/2:s3>>16&0xff
+{ .mmi; (p0)    ld4     te03=[te03]             // 7/3:te0[s3>>24]
+        (p0)    shladd  te30=te30,3,te3         // 7/3:te3+s2
+        (p0)    xor     t0=t0,te31      };;     // 7/0:
+{ .mmi; (p0)    ld4     te33=[te33]             // 8/2:te3[s1]
+        (p0)    shladd  te11=te11,3,te1         // 8/2:te1+s3>>16
+        (p0)    xor     t0=t0,te22      }       // 8/0:
+{ .mmi; (p0)    ld4     te30=[te30]             // 8/3:te3[s2]
+        (p0)    shladd  te12=te12,3,te1         // 8/3:te1+s0>>16
+        (p0)    xor     t1=t1,te32      };;     // 8/1:
+{ .mmi; (p0)    ld4     te11=[te11]             // 9/2:te1[s3>>16]
+        (p0)    ld4     te12=[te12]             // 9/3:te1[s0>>16]
+        (p0)    xor     t0=t0,te00      };;     // 9/0:         !L2 scheduling
+{ .mmi; (p0)    xor     t1=t1,te23              // 10[9]/1:     
+        (p0)    xor     t2=t2,te20              // 10[9]/2:
+        (p0)    xor     t3=t3,te21      };;     // 10[9]/3:
+{ .mmi; (p0)    xor     t0=t0,te13              // 11[10]/0:done!
+        (p0)    xor     t1=t1,te01              // 11[10]/1:
+        (p0)    xor     t2=t2,te02      };;     // 11[10]/2:    !L2 scheduling
+{ .mmi; (p0)    xor     t3=t3,te03              // 12[10]/3:
+        (p16)   cmp.eq  p0,p17=r0,r0    };;     // 12[10]/clear (p17)
+{ .mmi; (p0)    xor     t1=t1,te10              // 13[11]/1:done!
+        (p0)    xor     t2=t2,te33              // 13[11]/2:
+        (p0)    xor     t3=t3,te30      }       // 13[11]/3:
+{ .mmi; (p17)   add     te0=2048,te0            // 13[11]/
+        (p17)   add     te1=2048+64-TE1,te1};;  // 13[11]/
+{ .mib; (p0)    xor     t2=t2,te11              // 14[12]/2:done!
+        (p17)   add     te2=2048+128-TE2,te2}   // 14[12]/
+{ .mib; (p0)    xor     t3=t3,te12              // 14[12]/3:done!
+        (p17)   add     te3=2048+192-TE3,te3    // 14[12]/
+        br.ctop.sptk    .Ld_top         };;
+.Ld_end:
+
+
+{ .mmi; ld8     te10=[te0]              // prefetch Td4
+        ld8     te33=[te1]      }
+{ .mmi; ld8     te12=[te2]
+        ld8     te30=[te3]      }
+
+{ .mmi; LDKEY   t0=[rk0],2*KSZ          // 0/0:rk[0]
+        and     te31=s1,maskff          // 0/0:s3&0xff
+        extr.u  te22=s2,8,8     }       // 0/0:s2>>8&0xff
+{ .mmi; LDKEY   t1=[rk1],2*KSZ          // 0/1:rk[1]
+        and     te32=s2,maskff          // 0/1:s0&0xff
+        shr.u   te00=s0,twenty4 };;     // 0/0:s0>>24
+{ .mmi; LDKEY   t2=[rk0],2*KSZ          // 1/2:rk[2]
+        add     te31=te31,te0           // 1/0:te0+s0>>24
+        extr.u  te23=s3,8,8     }       // 1/1:s3>>8&0xff
+{ .mmi; LDKEY   t3=[rk1],2*KSZ          // 1/3:rk[3]
+        add     te32=te32,te0           // 1/1:te0+s0
+        shr.u   te01=s1,twenty4 };;     // 1/1:s1>>24
+{ .mmi; ld1     te31=[te31]             // 2/0:te0[s3&0xff]
+        add     te22=te22,te0           // 2/0:te0+s2>>8&0xff
+        extr.u  te20=s0,8,8     }       // 2/2:s0>>8&0xff
+{ .mmi; ld1     te32=[te32]             // 2/1:te0[s0]
+        add     te23=te23,te0           // 2/1:te0+s3>>8
+        shr.u   te02=s2,twenty4 };;     // 2/2:s2>>24
+{ .mmi; ld1     te22=[te22]             // 3/0:te0[s2>>8]
+        add     te20=te20,te0           // 3/2:te0+s0>>8
+        extr.u  te21=s1,8,8     }       // 3/3:s1>>8&0xff
+{ .mmi; ld1     te23=[te23]             // 3/1:te0[s3>>8]
+        add     te00=te00,te0           // 3/0:te0+s0>>24
+        shr.u   te03=s3,twenty4 };;     // 3/3:s3>>24
+{ .mmi; ld1     te20=[te20]             // 4/2:te0[s0>>8]
+        add     te21=te21,te0           // 4/3:te0+s2
+        extr.u  te13=s3,16,8    }       // 4/0:s1>>16&0xff
+{ .mmi; ld1     te00=[te00]             // 4/0:te0[s0>>24]
+        add     te01=te01,te0           // 4/1:te0+s1>>24
+        shr.u   te11=s1,sixteen };;     // 4/2:s3>>16
+{ .mmi; ld1     te21=[te21]             // 5/3:te0[s1>>8]
+        add     te13=te13,te0           // 5/0:te0+s1>>16
+        extr.u  te10=s0,16,8    }       // 5/1:s2>>16&0xff
+{ .mmi; ld1     te01=[te01]             // 5/1:te0[s1>>24]
+        add     te02=te02,te0           // 5/2:te0+s2>>24
+        and     te33=s3,maskff  };;     // 5/2:s1&0xff
+{ .mmi; ld1     te13=[te13]             // 6/0:te0[s1>>16]
+        add     te10=te10,te0           // 6/1:te0+s2>>16
+        extr.u  te12=s2,16,8    }       // 6/3:s0>>16&0xff
+{ .mmi; ld1     te02=[te02]             // 6/2:te0[s2>>24]
+        add     te03=te03,te0           // 6/3:te0+s0>>16
+        and     te30=s0,maskff  };;     // 6/3:s2&0xff
+
+{ .mmi; ld1     te10=[te10]             // 7/1:te0[s2>>16]
+        add     te33=te33,te0           // 7/2:te0+s1&0xff
+        dep     te31=te22,te31,8,8}     // 7/0:
+{ .mmi; ld1     te03=[te03]             // 7/3:te0[s3>>24]
+        add     te30=te30,te0           // 7/3:te0+s2
+        and     te11=te11,maskff};;     // 7/2:s3>>16&0xff
+{ .mmi; ld1     te33=[te33]             // 8/2:te0[s1]
+        add     te11=te11,te0           // 8/2:te0+s3>>16
+        dep     te32=te23,te32,8,8}     // 8/1:
+{ .mmi; ld1     te30=[te30]             // 8/3:te0[s2]
+        add     te12=te12,te0           // 8/3:te0+s0>>16
+        shl     te00=te00,twenty4};;    // 8/0:
+{ .mii; ld1     te11=[te11]             // 9/2:te0[s3>>16]
+        dep     te31=te13,te31,16,8     // 9/0:
+        shl     te01=te01,twenty4};;    // 9/1:
+{ .mii; ld1     te12=[te12]             // 10/3:te0[s0>>16]
+        dep     te33=te20,te33,8,8      // 10/2:
+        shl     te02=te02,twenty4};;    // 10/2:
+{ .mii; xor     t0=t0,te31              // 11/0:
+        dep     te30=te21,te30,8,8      // 11/3:
+        shl     te10=te10,sixteen};;    // 11/1:
+{ .mii; xor     r16=t0,te00             // 12/0:done!
+        dep     te33=te11,te33,16,8     // 12/2:
+        shl     te03=te03,twenty4};;    // 12/3:
+{ .mmi; xor     t1=t1,te01              // 13/1:
+        xor     t2=t2,te02              // 13/2:
+        dep     te30=te12,te30,16,8};;  // 13/3:
+{ .mmi; xor     t1=t1,te32              // 14/1:
+        xor     r24=t2,te33             // 14/2:done!
+        xor     t3=t3,te30      };;     // 14/3:
+{ .mib; xor     r20=t1,te10             // 15/1:done!
+        xor     r28=t3,te03             // 15/3:done!
+        br.ret.sptk     b6      };;
+.endp   _ia64_AES_decrypt#
+
+// void AES_decrypt (const void *in,void *out,const AES_KEY *key);
+.global AES_decrypt#
+.proc   AES_decrypt#
+.align  32
+AES_decrypt:
+        .prologue
+        .save   ar.pfs,pfssave
+{ .mmi; alloc   pfssave=ar.pfs,3,1,12,0
+        and     out0=3,in0
+        mov     r3=ip                   }
+{ .mmi; ADDP    in0=0,in0
+        mov     loc0=psr.um
+        ADDP    out11=KSZ*60,in2        };;     // &AES_KEY->rounds
+
+{ .mmi; ld4     out11=[out11]                   // AES_KEY->rounds
+        add     out8=(AES_Td#-AES_decrypt#),r3  // Te0
+        .save   pr,prsave
+        mov     prsave=pr               }
+{ .mmi; rum     1<<3                            // clear um.ac
+        .save   ar.lc,lcsave
+        mov     lcsave=ar.lc            };;
+
+        .body
+#if defined(_HPUX_SOURCE)       // HPUX is big-endian, cut 15+15 cycles...
+{ .mib; cmp.ne  p6,p0=out0,r0
+        add     out0=4,in0
+(p6)    br.dpnt.many    .Ld_i_unaligned };;
+
+{ .mmi; ld4     out1=[in0],8            // s0
+        and     out9=3,in1
+        mov     twenty4=24              }
+{ .mmi; ld4     out3=[out0],8           // s1
+        ADDP    rk0=0,in2
+        mov     sixteen=16              };;
+{ .mmi; ld4     out5=[in0]              // s2
+        cmp.ne  p6,p0=out9,r0
+        mov     maskff=0xff             }
+{ .mmb; ld4     out7=[out0]             // s3
+        ADDP    rk1=KSZ,in2
+        br.call.sptk.many       b6=_ia64_AES_decrypt    };;
+
+{ .mib; ADDP    in0=4,in1
+        ADDP    in1=0,in1
+(p6)    br.spnt .Ld_o_unaligned         };;
+
+{ .mii; mov     psr.um=loc0
+        mov     ar.pfs=pfssave
+        mov     ar.lc=lcsave            };;
+{ .mmi; st4     [in1]=r16,8             // s0
+        st4     [in0]=r20,8             // s1
+        mov     pr=prsave,0x1ffff       };;
+{ .mmb; st4     [in1]=r24               // s2
+        st4     [in0]=r28               // s3
+        br.ret.sptk.many        b0      };;
+#endif
+
+.align  32
+.Ld_i_unaligned:
+{ .mmi; add     out0=1,in0
+        add     out2=2,in0
+        add     out4=3,in0      };;
+{ .mmi; ld1     r16=[in0],4
+        ld1     r17=[out0],4    }//;;
+{ .mmi; ld1     r18=[out2],4
+        ld1     out1=[out4],4   };;     // s0
+{ .mmi; ld1     r20=[in0],4
+        ld1     r21=[out0],4    }//;;
+{ .mmi; ld1     r22=[out2],4
+        ld1     out3=[out4],4   };;     // s1
+{ .mmi; ld1     r24=[in0],4
+        ld1     r25=[out0],4    }//;;
+{ .mmi; ld1     r26=[out2],4
+        ld1     out5=[out4],4   };;     // s2
+{ .mmi; ld1     r28=[in0]
+        ld1     r29=[out0]      }//;;
+{ .mmi; ld1     r30=[out2]
+        ld1     out7=[out4]     };;     // s3
+
+{ .mii;
+        dep     out1=r16,out1,24,8      //;;
+        dep     out3=r20,out3,24,8      }//;;
+{ .mii; ADDP    rk0=0,in2
+        dep     out5=r24,out5,24,8      //;;
+        dep     out7=r28,out7,24,8      };;
+{ .mii; ADDP    rk1=KSZ,in2
+        dep     out1=r17,out1,16,8      //;;
+        dep     out3=r21,out3,16,8      }//;;
+{ .mii; mov     twenty4=24
+        dep     out5=r25,out5,16,8      //;;
+        dep     out7=r29,out7,16,8      };;
+{ .mii; mov     sixteen=16
+        dep     out1=r18,out1,8,8       //;;
+        dep     out3=r22,out3,8,8       }//;;
+{ .mii; mov     maskff=0xff
+        dep     out5=r26,out5,8,8       //;;
+        dep     out7=r30,out7,8,8       };;
+
+{ .mib; br.call.sptk.many       b6=_ia64_AES_decrypt    };;
+
+.Ld_o_unaligned:
+{ .mii; ADDP    out0=0,in1
+        extr.u  r17=r16,8,8                     // s0
+        shr.u   r19=r16,twenty4         }//;;
+{ .mii; ADDP    out1=1,in1
+        extr.u  r18=r16,16,8
+        shr.u   r23=r20,twenty4         }//;;   // s1
+{ .mii; ADDP    out2=2,in1
+        extr.u  r21=r20,8,8
+        shr.u   r22=r20,sixteen         }//;;
+{ .mii; ADDP    out3=3,in1
+        extr.u  r25=r24,8,8                     // s2
+        shr.u   r27=r24,twenty4         };;
+{ .mii; st1     [out3]=r16,4
+        extr.u  r26=r24,16,8
+        shr.u   r31=r28,twenty4         }//;;   // s3
+{ .mii; st1     [out2]=r17,4
+        extr.u  r29=r28,8,8
+        shr.u   r30=r28,sixteen         }//;;
+
+{ .mmi; st1     [out1]=r18,4
+        st1     [out0]=r19,4            };;
+{ .mmi; st1     [out3]=r20,4
+        st1     [out2]=r21,4            }//;;
+{ .mmi; st1     [out1]=r22,4
+        st1     [out0]=r23,4            };;
+{ .mmi; st1     [out3]=r24,4
+        st1     [out2]=r25,4
+        mov     pr=prsave,0x1ffff       }//;;
+{ .mmi; st1     [out1]=r26,4
+        st1     [out0]=r27,4
+        mov     ar.pfs=pfssave          };;
+{ .mmi; st1     [out3]=r28
+        st1     [out2]=r29
+        mov     ar.lc=lcsave            }//;;
+{ .mmi; st1     [out1]=r30
+        st1     [out0]=r31              }
+{ .mfb; mov     psr.um=loc0                     // restore user mask
+        br.ret.sptk.many        b0      };;
+.endp   AES_decrypt#
+
+// leave it in .text segment...
+.align  64
+.global AES_Te#
+.type   AES_Te#,@object
+AES_Te: data4   0xc66363a5,0xc66363a5, 0xf87c7c84,0xf87c7c84
+        data4   0xee777799,0xee777799, 0xf67b7b8d,0xf67b7b8d
+        data4   0xfff2f20d,0xfff2f20d, 0xd66b6bbd,0xd66b6bbd
+        data4   0xde6f6fb1,0xde6f6fb1, 0x91c5c554,0x91c5c554
+        data4   0x60303050,0x60303050, 0x02010103,0x02010103
+        data4   0xce6767a9,0xce6767a9, 0x562b2b7d,0x562b2b7d
+        data4   0xe7fefe19,0xe7fefe19, 0xb5d7d762,0xb5d7d762
+        data4   0x4dababe6,0x4dababe6, 0xec76769a,0xec76769a
+        data4   0x8fcaca45,0x8fcaca45, 0x1f82829d,0x1f82829d
+        data4   0x89c9c940,0x89c9c940, 0xfa7d7d87,0xfa7d7d87
+        data4   0xeffafa15,0xeffafa15, 0xb25959eb,0xb25959eb
+        data4   0x8e4747c9,0x8e4747c9, 0xfbf0f00b,0xfbf0f00b
+        data4   0x41adadec,0x41adadec, 0xb3d4d467,0xb3d4d467
+        data4   0x5fa2a2fd,0x5fa2a2fd, 0x45afafea,0x45afafea
+        data4   0x239c9cbf,0x239c9cbf, 0x53a4a4f7,0x53a4a4f7
+        data4   0xe4727296,0xe4727296, 0x9bc0c05b,0x9bc0c05b
+        data4   0x75b7b7c2,0x75b7b7c2, 0xe1fdfd1c,0xe1fdfd1c
+        data4   0x3d9393ae,0x3d9393ae, 0x4c26266a,0x4c26266a
+        data4   0x6c36365a,0x6c36365a, 0x7e3f3f41,0x7e3f3f41
+        data4   0xf5f7f702,0xf5f7f702, 0x83cccc4f,0x83cccc4f
+        data4   0x6834345c,0x6834345c, 0x51a5a5f4,0x51a5a5f4
+        data4   0xd1e5e534,0xd1e5e534, 0xf9f1f108,0xf9f1f108
+        data4   0xe2717193,0xe2717193, 0xabd8d873,0xabd8d873
+        data4   0x62313153,0x62313153, 0x2a15153f,0x2a15153f
+        data4   0x0804040c,0x0804040c, 0x95c7c752,0x95c7c752
+        data4   0x46232365,0x46232365, 0x9dc3c35e,0x9dc3c35e
+        data4   0x30181828,0x30181828, 0x379696a1,0x379696a1
+        data4   0x0a05050f,0x0a05050f, 0x2f9a9ab5,0x2f9a9ab5
+        data4   0x0e070709,0x0e070709, 0x24121236,0x24121236
+        data4   0x1b80809b,0x1b80809b, 0xdfe2e23d,0xdfe2e23d
+        data4   0xcdebeb26,0xcdebeb26, 0x4e272769,0x4e272769
+        data4   0x7fb2b2cd,0x7fb2b2cd, 0xea75759f,0xea75759f
+        data4   0x1209091b,0x1209091b, 0x1d83839e,0x1d83839e
+        data4   0x582c2c74,0x582c2c74, 0x341a1a2e,0x341a1a2e
+        data4   0x361b1b2d,0x361b1b2d, 0xdc6e6eb2,0xdc6e6eb2
+        data4   0xb45a5aee,0xb45a5aee, 0x5ba0a0fb,0x5ba0a0fb
+        data4   0xa45252f6,0xa45252f6, 0x763b3b4d,0x763b3b4d
+        data4   0xb7d6d661,0xb7d6d661, 0x7db3b3ce,0x7db3b3ce
+        data4   0x5229297b,0x5229297b, 0xdde3e33e,0xdde3e33e
+        data4   0x5e2f2f71,0x5e2f2f71, 0x13848497,0x13848497
+        data4   0xa65353f5,0xa65353f5, 0xb9d1d168,0xb9d1d168
+        data4   0x00000000,0x00000000, 0xc1eded2c,0xc1eded2c
+        data4   0x40202060,0x40202060, 0xe3fcfc1f,0xe3fcfc1f
+        data4   0x79b1b1c8,0x79b1b1c8, 0xb65b5bed,0xb65b5bed
+        data4   0xd46a6abe,0xd46a6abe, 0x8dcbcb46,0x8dcbcb46
+        data4   0x67bebed9,0x67bebed9, 0x7239394b,0x7239394b
+        data4   0x944a4ade,0x944a4ade, 0x984c4cd4,0x984c4cd4
+        data4   0xb05858e8,0xb05858e8, 0x85cfcf4a,0x85cfcf4a
+        data4   0xbbd0d06b,0xbbd0d06b, 0xc5efef2a,0xc5efef2a
+        data4   0x4faaaae5,0x4faaaae5, 0xedfbfb16,0xedfbfb16
+        data4   0x864343c5,0x864343c5, 0x9a4d4dd7,0x9a4d4dd7
+        data4   0x66333355,0x66333355, 0x11858594,0x11858594
+        data4   0x8a4545cf,0x8a4545cf, 0xe9f9f910,0xe9f9f910
+        data4   0x04020206,0x04020206, 0xfe7f7f81,0xfe7f7f81
+        data4   0xa05050f0,0xa05050f0, 0x783c3c44,0x783c3c44
+        data4   0x259f9fba,0x259f9fba, 0x4ba8a8e3,0x4ba8a8e3
+        data4   0xa25151f3,0xa25151f3, 0x5da3a3fe,0x5da3a3fe
+        data4   0x804040c0,0x804040c0, 0x058f8f8a,0x058f8f8a
+        data4   0x3f9292ad,0x3f9292ad, 0x219d9dbc,0x219d9dbc
+        data4   0x70383848,0x70383848, 0xf1f5f504,0xf1f5f504
+        data4   0x63bcbcdf,0x63bcbcdf, 0x77b6b6c1,0x77b6b6c1
+        data4   0xafdada75,0xafdada75, 0x42212163,0x42212163
+        data4   0x20101030,0x20101030, 0xe5ffff1a,0xe5ffff1a
+        data4   0xfdf3f30e,0xfdf3f30e, 0xbfd2d26d,0xbfd2d26d
+        data4   0x81cdcd4c,0x81cdcd4c, 0x180c0c14,0x180c0c14
+        data4   0x26131335,0x26131335, 0xc3ecec2f,0xc3ecec2f
+        data4   0xbe5f5fe1,0xbe5f5fe1, 0x359797a2,0x359797a2
+        data4   0x884444cc,0x884444cc, 0x2e171739,0x2e171739
+        data4   0x93c4c457,0x93c4c457, 0x55a7a7f2,0x55a7a7f2
+        data4   0xfc7e7e82,0xfc7e7e82, 0x7a3d3d47,0x7a3d3d47
+        data4   0xc86464ac,0xc86464ac, 0xba5d5de7,0xba5d5de7
+        data4   0x3219192b,0x3219192b, 0xe6737395,0xe6737395
+        data4   0xc06060a0,0xc06060a0, 0x19818198,0x19818198
+        data4   0x9e4f4fd1,0x9e4f4fd1, 0xa3dcdc7f,0xa3dcdc7f
+        data4   0x44222266,0x44222266, 0x542a2a7e,0x542a2a7e
+        data4   0x3b9090ab,0x3b9090ab, 0x0b888883,0x0b888883
+        data4   0x8c4646ca,0x8c4646ca, 0xc7eeee29,0xc7eeee29
+        data4   0x6bb8b8d3,0x6bb8b8d3, 0x2814143c,0x2814143c
+        data4   0xa7dede79,0xa7dede79, 0xbc5e5ee2,0xbc5e5ee2
+        data4   0x160b0b1d,0x160b0b1d, 0xaddbdb76,0xaddbdb76
+        data4   0xdbe0e03b,0xdbe0e03b, 0x64323256,0x64323256
+        data4   0x743a3a4e,0x743a3a4e, 0x140a0a1e,0x140a0a1e
+        data4   0x924949db,0x924949db, 0x0c06060a,0x0c06060a
+        data4   0x4824246c,0x4824246c, 0xb85c5ce4,0xb85c5ce4
+        data4   0x9fc2c25d,0x9fc2c25d, 0xbdd3d36e,0xbdd3d36e
+        data4   0x43acacef,0x43acacef, 0xc46262a6,0xc46262a6
+        data4   0x399191a8,0x399191a8, 0x319595a4,0x319595a4
+        data4   0xd3e4e437,0xd3e4e437, 0xf279798b,0xf279798b
+        data4   0xd5e7e732,0xd5e7e732, 0x8bc8c843,0x8bc8c843
+        data4   0x6e373759,0x6e373759, 0xda6d6db7,0xda6d6db7
+        data4   0x018d8d8c,0x018d8d8c, 0xb1d5d564,0xb1d5d564
+        data4   0x9c4e4ed2,0x9c4e4ed2, 0x49a9a9e0,0x49a9a9e0
+        data4   0xd86c6cb4,0xd86c6cb4, 0xac5656fa,0xac5656fa
+        data4   0xf3f4f407,0xf3f4f407, 0xcfeaea25,0xcfeaea25
+        data4   0xca6565af,0xca6565af, 0xf47a7a8e,0xf47a7a8e
+        data4   0x47aeaee9,0x47aeaee9, 0x10080818,0x10080818
+        data4   0x6fbabad5,0x6fbabad5, 0xf0787888,0xf0787888
+        data4   0x4a25256f,0x4a25256f, 0x5c2e2e72,0x5c2e2e72
+        data4   0x381c1c24,0x381c1c24, 0x57a6a6f1,0x57a6a6f1
+        data4   0x73b4b4c7,0x73b4b4c7, 0x97c6c651,0x97c6c651
+        data4   0xcbe8e823,0xcbe8e823, 0xa1dddd7c,0xa1dddd7c
+        data4   0xe874749c,0xe874749c, 0x3e1f1f21,0x3e1f1f21
+        data4   0x964b4bdd,0x964b4bdd, 0x61bdbddc,0x61bdbddc
+        data4   0x0d8b8b86,0x0d8b8b86, 0x0f8a8a85,0x0f8a8a85
+        data4   0xe0707090,0xe0707090, 0x7c3e3e42,0x7c3e3e42
+        data4   0x71b5b5c4,0x71b5b5c4, 0xcc6666aa,0xcc6666aa
+        data4   0x904848d8,0x904848d8, 0x06030305,0x06030305
+        data4   0xf7f6f601,0xf7f6f601, 0x1c0e0e12,0x1c0e0e12
+        data4   0xc26161a3,0xc26161a3, 0x6a35355f,0x6a35355f
+        data4   0xae5757f9,0xae5757f9, 0x69b9b9d0,0x69b9b9d0
+        data4   0x17868691,0x17868691, 0x99c1c158,0x99c1c158
+        data4   0x3a1d1d27,0x3a1d1d27, 0x279e9eb9,0x279e9eb9
+        data4   0xd9e1e138,0xd9e1e138, 0xebf8f813,0xebf8f813
+        data4   0x2b9898b3,0x2b9898b3, 0x22111133,0x22111133
+        data4   0xd26969bb,0xd26969bb, 0xa9d9d970,0xa9d9d970
+        data4   0x078e8e89,0x078e8e89, 0x339494a7,0x339494a7
+        data4   0x2d9b9bb6,0x2d9b9bb6, 0x3c1e1e22,0x3c1e1e22
+        data4   0x15878792,0x15878792, 0xc9e9e920,0xc9e9e920
+        data4   0x87cece49,0x87cece49, 0xaa5555ff,0xaa5555ff
+        data4   0x50282878,0x50282878, 0xa5dfdf7a,0xa5dfdf7a
+        data4   0x038c8c8f,0x038c8c8f, 0x59a1a1f8,0x59a1a1f8
+        data4   0x09898980,0x09898980, 0x1a0d0d17,0x1a0d0d17
+        data4   0x65bfbfda,0x65bfbfda, 0xd7e6e631,0xd7e6e631
+        data4   0x844242c6,0x844242c6, 0xd06868b8,0xd06868b8
+        data4   0x824141c3,0x824141c3, 0x299999b0,0x299999b0
+        data4   0x5a2d2d77,0x5a2d2d77, 0x1e0f0f11,0x1e0f0f11
+        data4   0x7bb0b0cb,0x7bb0b0cb, 0xa85454fc,0xa85454fc
+        data4   0x6dbbbbd6,0x6dbbbbd6, 0x2c16163a,0x2c16163a
+// Te4:
+        data1   0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5
+        data1   0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76
+        data1   0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0
+        data1   0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0
+        data1   0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc
+        data1   0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15
+        data1   0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a
+        data1   0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75
+        data1   0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0
+        data1   0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84
+        data1   0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b
+        data1   0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf
+        data1   0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85
+        data1   0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8
+        data1   0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5
+        data1   0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2
+        data1   0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17
+        data1   0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73
+        data1   0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88
+        data1   0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb
+        data1   0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c
+        data1   0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79
+        data1   0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9
+        data1   0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08
+        data1   0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6
+        data1   0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a
+        data1   0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e
+        data1   0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e
+        data1   0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94
+        data1   0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf
+        data1   0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68
+        data1   0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
+.size   AES_Te#,2048+256        // HP-UX assembler fails to ".-AES_Te#"
+
+.align  64
+.global AES_Td#
+.type   AES_Td#,@object
+AES_Td: data4   0x51f4a750,0x51f4a750, 0x7e416553,0x7e416553
+        data4   0x1a17a4c3,0x1a17a4c3, 0x3a275e96,0x3a275e96
+        data4   0x3bab6bcb,0x3bab6bcb, 0x1f9d45f1,0x1f9d45f1
+        data4   0xacfa58ab,0xacfa58ab, 0x4be30393,0x4be30393
+        data4   0x2030fa55,0x2030fa55, 0xad766df6,0xad766df6
+        data4   0x88cc7691,0x88cc7691, 0xf5024c25,0xf5024c25
+        data4   0x4fe5d7fc,0x4fe5d7fc, 0xc52acbd7,0xc52acbd7
+        data4   0x26354480,0x26354480, 0xb562a38f,0xb562a38f
+        data4   0xdeb15a49,0xdeb15a49, 0x25ba1b67,0x25ba1b67
+        data4   0x45ea0e98,0x45ea0e98, 0x5dfec0e1,0x5dfec0e1
+        data4   0xc32f7502,0xc32f7502, 0x814cf012,0x814cf012
+        data4   0x8d4697a3,0x8d4697a3, 0x6bd3f9c6,0x6bd3f9c6
+        data4   0x038f5fe7,0x038f5fe7, 0x15929c95,0x15929c95
+        data4   0xbf6d7aeb,0xbf6d7aeb, 0x955259da,0x955259da
+        data4   0xd4be832d,0xd4be832d, 0x587421d3,0x587421d3
+        data4   0x49e06929,0x49e06929, 0x8ec9c844,0x8ec9c844
+        data4   0x75c2896a,0x75c2896a, 0xf48e7978,0xf48e7978
+        data4   0x99583e6b,0x99583e6b, 0x27b971dd,0x27b971dd
+        data4   0xbee14fb6,0xbee14fb6, 0xf088ad17,0xf088ad17
+        data4   0xc920ac66,0xc920ac66, 0x7dce3ab4,0x7dce3ab4
+        data4   0x63df4a18,0x63df4a18, 0xe51a3182,0xe51a3182
+        data4   0x97513360,0x97513360, 0x62537f45,0x62537f45
+        data4   0xb16477e0,0xb16477e0, 0xbb6bae84,0xbb6bae84
+        data4   0xfe81a01c,0xfe81a01c, 0xf9082b94,0xf9082b94
+        data4   0x70486858,0x70486858, 0x8f45fd19,0x8f45fd19
+        data4   0x94de6c87,0x94de6c87, 0x527bf8b7,0x527bf8b7
+        data4   0xab73d323,0xab73d323, 0x724b02e2,0x724b02e2
+        data4   0xe31f8f57,0xe31f8f57, 0x6655ab2a,0x6655ab2a
+        data4   0xb2eb2807,0xb2eb2807, 0x2fb5c203,0x2fb5c203
+        data4   0x86c57b9a,0x86c57b9a, 0xd33708a5,0xd33708a5
+        data4   0x302887f2,0x302887f2, 0x23bfa5b2,0x23bfa5b2
+        data4   0x02036aba,0x02036aba, 0xed16825c,0xed16825c
+        data4   0x8acf1c2b,0x8acf1c2b, 0xa779b492,0xa779b492
+        data4   0xf307f2f0,0xf307f2f0, 0x4e69e2a1,0x4e69e2a1
+        data4   0x65daf4cd,0x65daf4cd, 0x0605bed5,0x0605bed5
+        data4   0xd134621f,0xd134621f, 0xc4a6fe8a,0xc4a6fe8a
+        data4   0x342e539d,0x342e539d, 0xa2f355a0,0xa2f355a0
+        data4   0x058ae132,0x058ae132, 0xa4f6eb75,0xa4f6eb75
+        data4   0x0b83ec39,0x0b83ec39, 0x4060efaa,0x4060efaa
+        data4   0x5e719f06,0x5e719f06, 0xbd6e1051,0xbd6e1051
+        data4   0x3e218af9,0x3e218af9, 0x96dd063d,0x96dd063d
+        data4   0xdd3e05ae,0xdd3e05ae, 0x4de6bd46,0x4de6bd46
+        data4   0x91548db5,0x91548db5, 0x71c45d05,0x71c45d05
+        data4   0x0406d46f,0x0406d46f, 0x605015ff,0x605015ff
+        data4   0x1998fb24,0x1998fb24, 0xd6bde997,0xd6bde997
+        data4   0x894043cc,0x894043cc, 0x67d99e77,0x67d99e77
+        data4   0xb0e842bd,0xb0e842bd, 0x07898b88,0x07898b88
+        data4   0xe7195b38,0xe7195b38, 0x79c8eedb,0x79c8eedb
+        data4   0xa17c0a47,0xa17c0a47, 0x7c420fe9,0x7c420fe9
+        data4   0xf8841ec9,0xf8841ec9, 0x00000000,0x00000000
+        data4   0x09808683,0x09808683, 0x322bed48,0x322bed48
+        data4   0x1e1170ac,0x1e1170ac, 0x6c5a724e,0x6c5a724e
+        data4   0xfd0efffb,0xfd0efffb, 0x0f853856,0x0f853856
+        data4   0x3daed51e,0x3daed51e, 0x362d3927,0x362d3927
+        data4   0x0a0fd964,0x0a0fd964, 0x685ca621,0x685ca621
+        data4   0x9b5b54d1,0x9b5b54d1, 0x24362e3a,0x24362e3a
+        data4   0x0c0a67b1,0x0c0a67b1, 0x9357e70f,0x9357e70f
+        data4   0xb4ee96d2,0xb4ee96d2, 0x1b9b919e,0x1b9b919e
+        data4   0x80c0c54f,0x80c0c54f, 0x61dc20a2,0x61dc20a2
+        data4   0x5a774b69,0x5a774b69, 0x1c121a16,0x1c121a16
+        data4   0xe293ba0a,0xe293ba0a, 0xc0a02ae5,0xc0a02ae5
+        data4   0x3c22e043,0x3c22e043, 0x121b171d,0x121b171d
+        data4   0x0e090d0b,0x0e090d0b, 0xf28bc7ad,0xf28bc7ad
+        data4   0x2db6a8b9,0x2db6a8b9, 0x141ea9c8,0x141ea9c8
+        data4   0x57f11985,0x57f11985, 0xaf75074c,0xaf75074c
+        data4   0xee99ddbb,0xee99ddbb, 0xa37f60fd,0xa37f60fd
+        data4   0xf701269f,0xf701269f, 0x5c72f5bc,0x5c72f5bc
+        data4   0x44663bc5,0x44663bc5, 0x5bfb7e34,0x5bfb7e34
+        data4   0x8b432976,0x8b432976, 0xcb23c6dc,0xcb23c6dc
+        data4   0xb6edfc68,0xb6edfc68, 0xb8e4f163,0xb8e4f163
+        data4   0xd731dcca,0xd731dcca, 0x42638510,0x42638510
+        data4   0x13972240,0x13972240, 0x84c61120,0x84c61120
+        data4   0x854a247d,0x854a247d, 0xd2bb3df8,0xd2bb3df8
+        data4   0xaef93211,0xaef93211, 0xc729a16d,0xc729a16d
+        data4   0x1d9e2f4b,0x1d9e2f4b, 0xdcb230f3,0xdcb230f3
+        data4   0x0d8652ec,0x0d8652ec, 0x77c1e3d0,0x77c1e3d0
+        data4   0x2bb3166c,0x2bb3166c, 0xa970b999,0xa970b999
+        data4   0x119448fa,0x119448fa, 0x47e96422,0x47e96422
+        data4   0xa8fc8cc4,0xa8fc8cc4, 0xa0f03f1a,0xa0f03f1a
+        data4   0x567d2cd8,0x567d2cd8, 0x223390ef,0x223390ef
+        data4   0x87494ec7,0x87494ec7, 0xd938d1c1,0xd938d1c1
+        data4   0x8ccaa2fe,0x8ccaa2fe, 0x98d40b36,0x98d40b36
+        data4   0xa6f581cf,0xa6f581cf, 0xa57ade28,0xa57ade28
+        data4   0xdab78e26,0xdab78e26, 0x3fadbfa4,0x3fadbfa4
+        data4   0x2c3a9de4,0x2c3a9de4, 0x5078920d,0x5078920d
+        data4   0x6a5fcc9b,0x6a5fcc9b, 0x547e4662,0x547e4662
+        data4   0xf68d13c2,0xf68d13c2, 0x90d8b8e8,0x90d8b8e8
+        data4   0x2e39f75e,0x2e39f75e, 0x82c3aff5,0x82c3aff5
+        data4   0x9f5d80be,0x9f5d80be, 0x69d0937c,0x69d0937c
+        data4   0x6fd52da9,0x6fd52da9, 0xcf2512b3,0xcf2512b3
+        data4   0xc8ac993b,0xc8ac993b, 0x10187da7,0x10187da7
+        data4   0xe89c636e,0xe89c636e, 0xdb3bbb7b,0xdb3bbb7b
+        data4   0xcd267809,0xcd267809, 0x6e5918f4,0x6e5918f4
+        data4   0xec9ab701,0xec9ab701, 0x834f9aa8,0x834f9aa8
+        data4   0xe6956e65,0xe6956e65, 0xaaffe67e,0xaaffe67e
+        data4   0x21bccf08,0x21bccf08, 0xef15e8e6,0xef15e8e6
+        data4   0xbae79bd9,0xbae79bd9, 0x4a6f36ce,0x4a6f36ce
+        data4   0xea9f09d4,0xea9f09d4, 0x29b07cd6,0x29b07cd6
+        data4   0x31a4b2af,0x31a4b2af, 0x2a3f2331,0x2a3f2331
+        data4   0xc6a59430,0xc6a59430, 0x35a266c0,0x35a266c0
+        data4   0x744ebc37,0x744ebc37, 0xfc82caa6,0xfc82caa6
+        data4   0xe090d0b0,0xe090d0b0, 0x33a7d815,0x33a7d815
+        data4   0xf104984a,0xf104984a, 0x41ecdaf7,0x41ecdaf7
+        data4   0x7fcd500e,0x7fcd500e, 0x1791f62f,0x1791f62f
+        data4   0x764dd68d,0x764dd68d, 0x43efb04d,0x43efb04d
+        data4   0xccaa4d54,0xccaa4d54, 0xe49604df,0xe49604df
+        data4   0x9ed1b5e3,0x9ed1b5e3, 0x4c6a881b,0x4c6a881b
+        data4   0xc12c1fb8,0xc12c1fb8, 0x4665517f,0x4665517f
+        data4   0x9d5eea04,0x9d5eea04, 0x018c355d,0x018c355d
+        data4   0xfa877473,0xfa877473, 0xfb0b412e,0xfb0b412e
+        data4   0xb3671d5a,0xb3671d5a, 0x92dbd252,0x92dbd252
+        data4   0xe9105633,0xe9105633, 0x6dd64713,0x6dd64713
+        data4   0x9ad7618c,0x9ad7618c, 0x37a10c7a,0x37a10c7a
+        data4   0x59f8148e,0x59f8148e, 0xeb133c89,0xeb133c89
+        data4   0xcea927ee,0xcea927ee, 0xb761c935,0xb761c935
+        data4   0xe11ce5ed,0xe11ce5ed, 0x7a47b13c,0x7a47b13c
+        data4   0x9cd2df59,0x9cd2df59, 0x55f2733f,0x55f2733f
+        data4   0x1814ce79,0x1814ce79, 0x73c737bf,0x73c737bf
+        data4   0x53f7cdea,0x53f7cdea, 0x5ffdaa5b,0x5ffdaa5b
+        data4   0xdf3d6f14,0xdf3d6f14, 0x7844db86,0x7844db86
+        data4   0xcaaff381,0xcaaff381, 0xb968c43e,0xb968c43e
+        data4   0x3824342c,0x3824342c, 0xc2a3405f,0xc2a3405f
+        data4   0x161dc372,0x161dc372, 0xbce2250c,0xbce2250c
+        data4   0x283c498b,0x283c498b, 0xff0d9541,0xff0d9541
+        data4   0x39a80171,0x39a80171, 0x080cb3de,0x080cb3de
+        data4   0xd8b4e49c,0xd8b4e49c, 0x6456c190,0x6456c190
+        data4   0x7bcb8461,0x7bcb8461, 0xd532b670,0xd532b670
+        data4   0x486c5c74,0x486c5c74, 0xd0b85742,0xd0b85742
+// Td4:
+        data1   0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38
+        data1   0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb
+        data1   0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87
+        data1   0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb
+        data1   0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d
+        data1   0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e
+        data1   0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2
+        data1   0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25
+        data1   0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16
+        data1   0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92
+        data1   0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda
+        data1   0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84
+        data1   0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a
+        data1   0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06
+        data1   0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02
+        data1   0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b
+        data1   0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea
+        data1   0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73
+        data1   0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85
+        data1   0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e
+        data1   0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89
+        data1   0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b
+        data1   0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20
+        data1   0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4
+        data1   0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31
+        data1   0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f
+        data1   0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d
+        data1   0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef
+        data1   0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0
+        data1   0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61
+        data1   0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26
+        data1   0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d
+.size   AES_Td#,2048+256        // HP-UX assembler fails to ".-AES_Td#"
diff --git a/src/lib/libssl/src/crypto/aes/asm/aes-x86_64.pl b/src/lib/libssl/src/crypto/aes/asm/aes-x86_64.pl
new file mode 100755
index 0000000000..44e0bf8cae
--- /dev/null
+++ b/src/lib/libssl/src/crypto/aes/asm/aes-x86_64.pl
@@ -0,0 +1,1578 @@
+#!/usr/bin/env perl
+#
+# ====================================================================
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# project. Rights for redistribution and usage in source and binary
+# forms are granted according to the OpenSSL license.
+# ====================================================================
+#
+# Version 1.2.
+#
+# aes-*-cbc benchmarks are improved by >70% [compared to gcc 3.3.2 on
+# Opteron 240 CPU] plus all the bells-n-whistles from 32-bit version
+# [you'll notice a lot of resemblance], such as compressed S-boxes
+# in little-endian byte order, prefetch of these tables in CBC mode,
+# as well as avoiding L1 cache aliasing between stack frame and key
+# schedule and already mentioned tables, compressed Td4...
+#
+# Performance in number of cycles per processed byte for 128-bit key:
+#
+#               ECB             CBC encrypt
+# AMD64         13.7            13.0(*)
+# EM64T         20.2            18.6(*)
+#
+# (*)   CBC benchmarks are better than ECB thanks to custom ABI used
+#       by the private block encryption function.
+
+$verticalspin=1;        # unlike 32-bit version $verticalspin performs
+                        # ~15% better on both AMD and Intel cores
+$output=shift;
+open STDOUT,"| $^X ../perlasm/x86_64-xlate.pl $output";
+
+$code=".text\n";
+
+$s0="%eax";
+$s1="%ebx";
+$s2="%ecx";
+$s3="%edx";
+$acc0="%esi";
+$acc1="%edi";
+$acc2="%ebp";
+$inp="%r8";
+$out="%r9";
+$t0="%r10d";
+$t1="%r11d";
+$t2="%r12d";
+$rnds="%r13d";
+$sbox="%r14";
+$key="%r15";
+
+sub hi() { my $r=shift; $r =~ s/%[er]([a-d])x/%\1h/;    $r; }
+sub lo() { my $r=shift; $r =~ s/%[er]([a-d])x/%\1l/;
+                        $r =~ s/%[er]([sd]i)/%\1l/;
+                        $r =~ s/%(r[0-9]+)[d]?/%\1b/;   $r; }
+sub _data_word()
+{ my $i;
+    while(defined($i=shift)) { $code.=sprintf".long\t0x%08x,0x%08x\n",$i,$i; }
+}
+sub data_word()
+{ my $i;
+  my $last=pop(@_);
+    $code.=".long\t";
+    while(defined($i=shift)) { $code.=sprintf"0x%08x,",$i; }
+    $code.=sprintf"0x%08x\n",$last;
+}
+
+sub data_byte()
+{ my $i;
+  my $last=pop(@_);
+    $code.=".byte\t";
+    while(defined($i=shift)) { $code.=sprintf"0x%02x,",$i&0xff; }
+    $code.=sprintf"0x%02x\n",$last&0xff;
+}
+
+sub encvert()
+{ my $t3="%r8d";        # zaps $inp!
+
+$code.=<<___;
+        # favor 3-way issue Opteron pipeline...
+        movzb   `&lo("$s0")`,$acc0
+        movzb   `&lo("$s1")`,$acc1
+        movzb   `&lo("$s2")`,$acc2
+        mov     0($sbox,$acc0,8),$t0
+        mov     0($sbox,$acc1,8),$t1
+        mov     0($sbox,$acc2,8),$t2
+
+        movzb   `&hi("$s1")`,$acc0
+        movzb   `&hi("$s2")`,$acc1
+        movzb   `&lo("$s3")`,$acc2
+        xor     3($sbox,$acc0,8),$t0
+        xor     3($sbox,$acc1,8),$t1
+        mov     0($sbox,$acc2,8),$t3
+
+        movzb   `&hi("$s3")`,$acc0
+        shr     \$16,$s2
+        movzb   `&hi("$s0")`,$acc2
+        xor     3($sbox,$acc0,8),$t2
+        shr     \$16,$s3
+        xor     3($sbox,$acc2,8),$t3
+
+        shr     \$16,$s1
+        lea     16($key),$key
+        shr     \$16,$s0
+
+        movzb   `&lo("$s2")`,$acc0
+        movzb   `&lo("$s3")`,$acc1
+        movzb   `&lo("$s0")`,$acc2
+        xor     2($sbox,$acc0,8),$t0
+        xor     2($sbox,$acc1,8),$t1
+        xor     2($sbox,$acc2,8),$t2
+
+        movzb   `&hi("$s3")`,$acc0
+        movzb   `&hi("$s0")`,$acc1
+        movzb   `&lo("$s1")`,$acc2
+        xor     1($sbox,$acc0,8),$t0
+        xor     1($sbox,$acc1,8),$t1
+        xor     2($sbox,$acc2,8),$t3
+
+        mov     12($key),$s3
+        movzb   `&hi("$s1")`,$acc1
+        movzb   `&hi("$s2")`,$acc2
+        mov     0($key),$s0
+        xor     1($sbox,$acc1,8),$t2
+        xor     1($sbox,$acc2,8),$t3
+
+        mov     4($key),$s1
+        mov     8($key),$s2
+        xor     $t0,$s0
+        xor     $t1,$s1
+        xor     $t2,$s2
+        xor     $t3,$s3
+___
+}
+
+sub enclastvert()
+{ my $t3="%r8d";        # zaps $inp!
+
+$code.=<<___;
+        movzb   `&lo("$s0")`,$acc0
+        movzb   `&lo("$s1")`,$acc1
+        movzb   `&lo("$s2")`,$acc2
+        mov     2($sbox,$acc0,8),$t0
+        mov     2($sbox,$acc1,8),$t1
+        mov     2($sbox,$acc2,8),$t2
+
+        and     \$0x000000ff,$t0
+        and     \$0x000000ff,$t1
+        and     \$0x000000ff,$t2
+
+        movzb   `&lo("$s3")`,$acc0
+        movzb   `&hi("$s1")`,$acc1
+        movzb   `&hi("$s2")`,$acc2
+        mov     2($sbox,$acc0,8),$t3
+        mov     0($sbox,$acc1,8),$acc1  #$t0
+        mov     0($sbox,$acc2,8),$acc2  #$t1
+
+        and     \$0x000000ff,$t3
+        and     \$0x0000ff00,$acc1
+        and     \$0x0000ff00,$acc2
+
+        xor     $acc1,$t0
+        xor     $acc2,$t1
+        shr     \$16,$s2
+
+        movzb   `&hi("$s3")`,$acc0
+        movzb   `&hi("$s0")`,$acc1
+        shr     \$16,$s3
+        mov     0($sbox,$acc0,8),$acc0  #$t2
+        mov     0($sbox,$acc1,8),$acc1  #$t3
+
+        and     \$0x0000ff00,$acc0
+        and     \$0x0000ff00,$acc1
+        shr     \$16,$s1
+        xor     $acc0,$t2
+        xor     $acc1,$t3
+        shr     \$16,$s0
+
+        movzb   `&lo("$s2")`,$acc0
+        movzb   `&lo("$s3")`,$acc1
+        movzb   `&lo("$s0")`,$acc2
+        mov     0($sbox,$acc0,8),$acc0  #$t0
+        mov     0($sbox,$acc1,8),$acc1  #$t1
+        mov     0($sbox,$acc2,8),$acc2  #$t2
+
+        and     \$0x00ff0000,$acc0
+        and     \$0x00ff0000,$acc1
+        and     \$0x00ff0000,$acc2
+
+        xor     $acc0,$t0
+        xor     $acc1,$t1
+        xor     $acc2,$t2
+
+        movzb   `&lo("$s1")`,$acc0
+        movzb   `&hi("$s3")`,$acc1
+        movzb   `&hi("$s0")`,$acc2
+        mov     0($sbox,$acc0,8),$acc0  #$t3
+        mov     2($sbox,$acc1,8),$acc1  #$t0
+        mov     2($sbox,$acc2,8),$acc2  #$t1
+
+        and     \$0x00ff0000,$acc0
+        and     \$0xff000000,$acc1
+        and     \$0xff000000,$acc2
+
+        xor     $acc0,$t3
+        xor     $acc1,$t0
+        xor     $acc2,$t1
+
+        movzb   `&hi("$s1")`,$acc0
+        movzb   `&hi("$s2")`,$acc1
+        mov     16+12($key),$s3
+        mov     2($sbox,$acc0,8),$acc0  #$t2
+        mov     2($sbox,$acc1,8),$acc1  #$t3
+        mov     16+0($key),$s0
+
+        and     \$0xff000000,$acc0
+        and     \$0xff000000,$acc1
+
+        xor     $acc0,$t2
+        xor     $acc1,$t3
+
+        mov     16+4($key),$s1
+        mov     16+8($key),$s2
+        xor     $t0,$s0
+        xor     $t1,$s1
+        xor     $t2,$s2
+        xor     $t3,$s3
+___
+}
+
+sub encstep()
+{ my ($i,@s) = @_;
+  my $tmp0=$acc0;
+  my $tmp1=$acc1;
+  my $tmp2=$acc2;
+  my $out=($t0,$t1,$t2,$s[0])[$i];
+
+        if ($i==3) {
+                $tmp0=$s[1];
+                $tmp1=$s[2];
+                $tmp2=$s[3];
+        }
+        $code.="        movzb   ".&lo($s[0]).",$out\n";
+        $code.="        mov     $s[2],$tmp1\n"          if ($i!=3);
+        $code.="        lea     16($key),$key\n"        if ($i==0);
+
+        $code.="        movzb   ".&hi($s[1]).",$tmp0\n";
+        $code.="        mov     0($sbox,$out,8),$out\n";
+
+        $code.="        shr     \$16,$tmp1\n";
+        $code.="        mov     $s[3],$tmp2\n"          if ($i!=3);
+        $code.="        xor     3($sbox,$tmp0,8),$out\n";
+
+        $code.="        movzb   ".&lo($tmp1).",$tmp1\n";
+        $code.="        shr     \$24,$tmp2\n";
+        $code.="        xor     4*$i($key),$out\n";
+
+        $code.="        xor     2($sbox,$tmp1,8),$out\n";
+        $code.="        xor     1($sbox,$tmp2,8),$out\n";
+
+        $code.="        mov     $t0,$s[1]\n"            if ($i==3);
+        $code.="        mov     $t1,$s[2]\n"            if ($i==3);
+        $code.="        mov     $t2,$s[3]\n"            if ($i==3);
+        $code.="\n";
+}
+
+sub enclast()
+{ my ($i,@s)=@_;
+  my $tmp0=$acc0;
+  my $tmp1=$acc1;
+  my $tmp2=$acc2;
+  my $out=($t0,$t1,$t2,$s[0])[$i];
+
+        if ($i==3) {
+                $tmp0=$s[1];
+                $tmp1=$s[2];
+                $tmp2=$s[3];
+        }
+        $code.="        movzb   ".&lo($s[0]).",$out\n";
+        $code.="        mov     $s[2],$tmp1\n"          if ($i!=3);
+
+        $code.="        mov     2($sbox,$out,8),$out\n";
+        $code.="        shr     \$16,$tmp1\n";
+        $code.="        mov     $s[3],$tmp2\n"          if ($i!=3);
+
+        $code.="        and     \$0x000000ff,$out\n";
+        $code.="        movzb   ".&hi($s[1]).",$tmp0\n";
+        $code.="        movzb   ".&lo($tmp1).",$tmp1\n";
+        $code.="        shr     \$24,$tmp2\n";
+
+        $code.="        mov     0($sbox,$tmp0,8),$tmp0\n";
+        $code.="        mov     0($sbox,$tmp1,8),$tmp1\n";
+        $code.="        mov     2($sbox,$tmp2,8),$tmp2\n";
+
+        $code.="        and     \$0x0000ff00,$tmp0\n";
+        $code.="        and     \$0x00ff0000,$tmp1\n";
+        $code.="        and     \$0xff000000,$tmp2\n";
+
+        $code.="        xor     $tmp0,$out\n";
+        $code.="        mov     $t0,$s[1]\n"            if ($i==3);
+        $code.="        xor     $tmp1,$out\n";
+        $code.="        mov     $t1,$s[2]\n"            if ($i==3);
+        $code.="        xor     $tmp2,$out\n";
+        $code.="        mov     $t2,$s[3]\n"            if ($i==3);
+        $code.="\n";
+}
+
+$code.=<<___;
+.type   _x86_64_AES_encrypt,\@abi-omnipotent
+.align  16
+_x86_64_AES_encrypt:
+        xor     0($key),$s0                     # xor with key
+        xor     4($key),$s1
+        xor     8($key),$s2
+        xor     12($key),$s3
+
+        mov     240($key),$rnds                 # load key->rounds
+        sub     \$1,$rnds
+        jmp     .Lenc_loop
+.align  16
+.Lenc_loop:
+___
+        if ($verticalspin) { &encvert(); }
+        else {  &encstep(0,$s0,$s1,$s2,$s3);
+                &encstep(1,$s1,$s2,$s3,$s0);
+                &encstep(2,$s2,$s3,$s0,$s1);
+                &encstep(3,$s3,$s0,$s1,$s2);
+        }
+$code.=<<___;
+        sub     \$1,$rnds
+        jnz     .Lenc_loop
+___
+        if ($verticalspin) { &enclastvert(); }
+        else {  &enclast(0,$s0,$s1,$s2,$s3);
+                &enclast(1,$s1,$s2,$s3,$s0);
+                &enclast(2,$s2,$s3,$s0,$s1);
+                &enclast(3,$s3,$s0,$s1,$s2);
+                $code.=<<___;
+                xor     16+0($key),$s0          # xor with key
+                xor     16+4($key),$s1
+                xor     16+8($key),$s2
+                xor     16+12($key),$s3
+___
+        }
+$code.=<<___;
+        .byte   0xf3,0xc3                       # rep ret
+.size   _x86_64_AES_encrypt,.-_x86_64_AES_encrypt
+___
+
+# void AES_encrypt (const void *inp,void *out,const AES_KEY *key);
+$code.=<<___;
+.globl  AES_encrypt
+.type   AES_encrypt,\@function,3
+.align  16
+AES_encrypt:
+        push    %rbx
+        push    %rbp
+        push    %r12
+        push    %r13
+        push    %r14
+        push    %r15
+
+        mov     %rdx,$key
+        mov     %rdi,$inp
+        mov     %rsi,$out
+
+        .picmeup        $sbox
+        lea     AES_Te-.($sbox),$sbox
+
+        mov     0($inp),$s0
+        mov     4($inp),$s1
+        mov     8($inp),$s2
+        mov     12($inp),$s3
+
+        call    _x86_64_AES_encrypt
+
+        mov     $s0,0($out)
+        mov     $s1,4($out)
+        mov     $s2,8($out)
+        mov     $s3,12($out)
+
+        pop     %r15
+        pop     %r14
+        pop     %r13
+        pop     %r12
+        pop     %rbp
+        pop     %rbx
+        ret
+.size   AES_encrypt,.-AES_encrypt
+___
+
+#------------------------------------------------------------------#
+
+sub decvert()
+{ my $t3="%r8d";        # zaps $inp!
+
+$code.=<<___;
+        # favor 3-way issue Opteron pipeline...
+        movzb   `&lo("$s0")`,$acc0
+        movzb   `&lo("$s1")`,$acc1
+        movzb   `&lo("$s2")`,$acc2
+        mov     0($sbox,$acc0,8),$t0
+        mov     0($sbox,$acc1,8),$t1
+        mov     0($sbox,$acc2,8),$t2
+
+        movzb   `&hi("$s3")`,$acc0
+        movzb   `&hi("$s0")`,$acc1
+        movzb   `&lo("$s3")`,$acc2
+        xor     3($sbox,$acc0,8),$t0
+        xor     3($sbox,$acc1,8),$t1
+        mov     0($sbox,$acc2,8),$t3
+
+        movzb   `&hi("$s1")`,$acc0
+        shr     \$16,$s0
+        movzb   `&hi("$s2")`,$acc2
+        xor     3($sbox,$acc0,8),$t2
+        shr     \$16,$s3
+        xor     3($sbox,$acc2,8),$t3
+
+        shr     \$16,$s1
+        lea     16($key),$key
+        shr     \$16,$s2
+
+        movzb   `&lo("$s2")`,$acc0
+        movzb   `&lo("$s3")`,$acc1
+        movzb   `&lo("$s0")`,$acc2
+        xor     2($sbox,$acc0,8),$t0
+        xor     2($sbox,$acc1,8),$t1
+        xor     2($sbox,$acc2,8),$t2
+
+        movzb   `&hi("$s1")`,$acc0
+        movzb   `&hi("$s2")`,$acc1
+        movzb   `&lo("$s1")`,$acc2
+        xor     1($sbox,$acc0,8),$t0
+        xor     1($sbox,$acc1,8),$t1
+        xor     2($sbox,$acc2,8),$t3
+
+        movzb   `&hi("$s3")`,$acc0
+        mov     12($key),$s3
+        movzb   `&hi("$s0")`,$acc2
+        xor     1($sbox,$acc0,8),$t2
+        mov     0($key),$s0
+        xor     1($sbox,$acc2,8),$t3
+
+        xor     $t0,$s0
+        mov     4($key),$s1
+        mov     8($key),$s2
+        xor     $t2,$s2
+        xor     $t1,$s1
+        xor     $t3,$s3
+___
+}
+
+sub declastvert()
+{ my $t3="%r8d";        # zaps $inp!
+
+$code.=<<___;
+        movzb   `&lo("$s0")`,$acc0
+        movzb   `&lo("$s1")`,$acc1
+        movzb   `&lo("$s2")`,$acc2
+        movzb   2048($sbox,$acc0,1),$t0
+        movzb   2048($sbox,$acc1,1),$t1
+        movzb   2048($sbox,$acc2,1),$t2
+
+        movzb   `&lo("$s3")`,$acc0
+        movzb   `&hi("$s3")`,$acc1
+        movzb   `&hi("$s0")`,$acc2
+        movzb   2048($sbox,$acc0,1),$t3
+        movzb   2048($sbox,$acc1,1),$acc1       #$t0
+        movzb   2048($sbox,$acc2,1),$acc2       #$t1
+
+        shl     \$8,$acc1
+        shl     \$8,$acc2
+
+        xor     $acc1,$t0
+        xor     $acc2,$t1
+        shr     \$16,$s3
+
+        movzb   `&hi("$s1")`,$acc0
+        movzb   `&hi("$s2")`,$acc1
+        shr     \$16,$s0
+        movzb   2048($sbox,$acc0,1),$acc0       #$t2
+        movzb   2048($sbox,$acc1,1),$acc1       #$t3
+
+        shl     \$8,$acc0
+        shl     \$8,$acc1
+        shr     \$16,$s1
+        xor     $acc0,$t2
+        xor     $acc1,$t3
+        shr     \$16,$s2
+
+        movzb   `&lo("$s2")`,$acc0
+        movzb   `&lo("$s3")`,$acc1
+        movzb   `&lo("$s0")`,$acc2
+        movzb   2048($sbox,$acc0,1),$acc0       #$t0
+        movzb   2048($sbox,$acc1,1),$acc1       #$t1
+        movzb   2048($sbox,$acc2,1),$acc2       #$t2
+
+        shl     \$16,$acc0
+        shl     \$16,$acc1
+        shl     \$16,$acc2
+
+        xor     $acc0,$t0
+        xor     $acc1,$t1
+        xor     $acc2,$t2
+
+        movzb   `&lo("$s1")`,$acc0
+        movzb   `&hi("$s1")`,$acc1
+        movzb   `&hi("$s2")`,$acc2
+        movzb   2048($sbox,$acc0,1),$acc0       #$t3
+        movzb   2048($sbox,$acc1,1),$acc1       #$t0
+        movzb   2048($sbox,$acc2,1),$acc2       #$t1
+
+        shl     \$16,$acc0
+        shl     \$24,$acc1
+        shl     \$24,$acc2
+
+        xor     $acc0,$t3
+        xor     $acc1,$t0
+        xor     $acc2,$t1
+
+        movzb   `&hi("$s3")`,$acc0
+        movzb   `&hi("$s0")`,$acc1
+        mov     16+12($key),$s3
+        movzb   2048($sbox,$acc0,1),$acc0       #$t2
+        movzb   2048($sbox,$acc1,1),$acc1       #$t3
+        mov     16+0($key),$s0
+
+        shl     \$24,$acc0
+        shl     \$24,$acc1
+
+        xor     $acc0,$t2
+        xor     $acc1,$t3
+
+        mov     16+4($key),$s1
+        mov     16+8($key),$s2
+        xor     $t0,$s0
+        xor     $t1,$s1
+        xor     $t2,$s2
+        xor     $t3,$s3
+___
+}
+
+sub decstep()
+{ my ($i,@s) = @_;
+  my $tmp0=$acc0;
+  my $tmp1=$acc1;
+  my $tmp2=$acc2;
+  my $out=($t0,$t1,$t2,$s[0])[$i];
+
+        $code.="        mov     $s[0],$out\n"           if ($i!=3);
+                        $tmp1=$s[2]                     if ($i==3);
+        $code.="        mov     $s[2],$tmp1\n"          if ($i!=3);
+        $code.="        and     \$0xFF,$out\n";
+
+        $code.="        mov     0($sbox,$out,8),$out\n";
+        $code.="        shr     \$16,$tmp1\n";
+                        $tmp2=$s[3]                     if ($i==3);
+        $code.="        mov     $s[3],$tmp2\n"          if ($i!=3);
+
+                        $tmp0=$s[1]                     if ($i==3);
+        $code.="        movzb   ".&hi($s[1]).",$tmp0\n";
+        $code.="        and     \$0xFF,$tmp1\n";
+        $code.="        shr     \$24,$tmp2\n";
+
+        $code.="        xor     3($sbox,$tmp0,8),$out\n";
+        $code.="        xor     2($sbox,$tmp1,8),$out\n";
+        $code.="        xor     1($sbox,$tmp2,8),$out\n";
+
+        $code.="        mov     $t2,$s[1]\n"            if ($i==3);
+        $code.="        mov     $t1,$s[2]\n"            if ($i==3);
+        $code.="        mov     $t0,$s[3]\n"            if ($i==3);
+        $code.="\n";
+}
+
+sub declast()
+{ my ($i,@s)=@_;
+  my $tmp0=$acc0;
+  my $tmp1=$acc1;
+  my $tmp2=$acc2;
+  my $out=($t0,$t1,$t2,$s[0])[$i];
+
+        $code.="        mov     $s[0],$out\n"           if ($i!=3);
+                        $tmp1=$s[2]                     if ($i==3);
+        $code.="        mov     $s[2],$tmp1\n"          if ($i!=3);
+        $code.="        and     \$0xFF,$out\n";
+
+        $code.="        movzb   2048($sbox,$out,1),$out\n";
+        $code.="        shr     \$16,$tmp1\n";
+                        $tmp2=$s[3]                     if ($i==3);
+        $code.="        mov     $s[3],$tmp2\n"          if ($i!=3);
+
+                        $tmp0=$s[1]                     if ($i==3);
+        $code.="        movzb   ".&hi($s[1]).",$tmp0\n";
+        $code.="        and     \$0xFF,$tmp1\n";
+        $code.="        shr     \$24,$tmp2\n";
+
+        $code.="        movzb   2048($sbox,$tmp0,1),$tmp0\n";
+        $code.="        movzb   2048($sbox,$tmp1,1),$tmp1\n";
+        $code.="        movzb   2048($sbox,$tmp2,1),$tmp2\n";
+
+        $code.="        shl     \$8,$tmp0\n";
+        $code.="        shl     \$16,$tmp1\n";
+        $code.="        shl     \$24,$tmp2\n";
+
+        $code.="        xor     $tmp0,$out\n";
+        $code.="        mov     $t2,$s[1]\n"            if ($i==3);
+        $code.="        xor     $tmp1,$out\n";
+        $code.="        mov     $t1,$s[2]\n"            if ($i==3);
+        $code.="        xor     $tmp2,$out\n";
+        $code.="        mov     $t0,$s[3]\n"            if ($i==3);
+        $code.="\n";
+}
+
+$code.=<<___;
+.type   _x86_64_AES_decrypt,\@abi-omnipotent
+.align  16
+_x86_64_AES_decrypt:
+        xor     0($key),$s0                     # xor with key
+        xor     4($key),$s1
+        xor     8($key),$s2
+        xor     12($key),$s3
+
+        mov     240($key),$rnds                 # load key->rounds
+        sub     \$1,$rnds
+        jmp     .Ldec_loop
+.align  16
+.Ldec_loop:
+___
+        if ($verticalspin) { &decvert(); }
+        else {  &decstep(0,$s0,$s3,$s2,$s1);
+                &decstep(1,$s1,$s0,$s3,$s2);
+                &decstep(2,$s2,$s1,$s0,$s3);
+                &decstep(3,$s3,$s2,$s1,$s0);
+                $code.=<<___;
+                lea     16($key),$key
+                xor     0($key),$s0                     # xor with key
+                xor     4($key),$s1
+                xor     8($key),$s2
+                xor     12($key),$s3
+___
+        }
+$code.=<<___;
+        sub     \$1,$rnds
+        jnz     .Ldec_loop
+___
+        if ($verticalspin) { &declastvert(); }
+        else {  &declast(0,$s0,$s3,$s2,$s1);
+                &declast(1,$s1,$s0,$s3,$s2);
+                &declast(2,$s2,$s1,$s0,$s3);
+                &declast(3,$s3,$s2,$s1,$s0);
+                $code.=<<___;
+                xor     16+0($key),$s0                  # xor with key
+                xor     16+4($key),$s1
+                xor     16+8($key),$s2
+                xor     16+12($key),$s3
+___
+        }
+$code.=<<___;
+        .byte   0xf3,0xc3                       # rep ret
+.size   _x86_64_AES_decrypt,.-_x86_64_AES_decrypt
+___
+
+# void AES_decrypt (const void *inp,void *out,const AES_KEY *key);
+$code.=<<___;
+.globl  AES_decrypt
+.type   AES_decrypt,\@function,3
+.align  16
+AES_decrypt:
+        push    %rbx
+        push    %rbp
+        push    %r12
+        push    %r13
+        push    %r14
+        push    %r15
+
+        mov     %rdx,$key
+        mov     %rdi,$inp
+        mov     %rsi,$out
+
+        .picmeup        $sbox
+        lea     AES_Td-.($sbox),$sbox
+
+        # prefetch Td4
+        lea     2048+128($sbox),$sbox;
+        mov     0-128($sbox),$s0
+        mov     32-128($sbox),$s1
+        mov     64-128($sbox),$s2
+        mov     96-128($sbox),$s3
+        mov     128-128($sbox),$s0
+        mov     160-128($sbox),$s1
+        mov     192-128($sbox),$s2
+        mov     224-128($sbox),$s3
+        lea     -2048-128($sbox),$sbox;
+
+        mov     0($inp),$s0
+        mov     4($inp),$s1
+        mov     8($inp),$s2
+        mov     12($inp),$s3
+
+        call    _x86_64_AES_decrypt
+
+        mov     $s0,0($out)
+        mov     $s1,4($out)
+        mov     $s2,8($out)
+        mov     $s3,12($out)
+
+        pop     %r15
+        pop     %r14
+        pop     %r13
+        pop     %r12
+        pop     %rbp
+        pop     %rbx
+        ret
+.size   AES_decrypt,.-AES_decrypt
+___
+#------------------------------------------------------------------#
+
+sub enckey()
+{
+$code.=<<___;
+        movz    %dl,%esi                # rk[i]>>0
+        mov     2(%rbp,%rsi,8),%ebx
+        movz    %dh,%esi                # rk[i]>>8
+        and     \$0xFF000000,%ebx
+        xor     %ebx,%eax
+
+        mov     2(%rbp,%rsi,8),%ebx
+        shr     \$16,%edx
+        and     \$0x000000FF,%ebx
+        movz    %dl,%esi                # rk[i]>>16
+        xor     %ebx,%eax
+
+        mov     0(%rbp,%rsi,8),%ebx
+        movz    %dh,%esi                # rk[i]>>24
+        and     \$0x0000FF00,%ebx
+        xor     %ebx,%eax
+
+        mov     0(%rbp,%rsi,8),%ebx
+        and     \$0x00FF0000,%ebx
+        xor     %ebx,%eax
+
+        xor     2048(%rbp,%rcx,4),%eax          # rcon
+___
+}
+
+# int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
+#                        AES_KEY *key)
+$code.=<<___;
+.globl  AES_set_encrypt_key
+.type   AES_set_encrypt_key,\@function,3
+.align  16
+AES_set_encrypt_key:
+        push    %rbx
+        push    %rbp
+
+        mov     %esi,%ecx                       # %ecx=bits
+        mov     %rdi,%rsi                       # %rsi=userKey
+        mov     %rdx,%rdi                       # %rdi=key
+
+        test    \$-1,%rsi
+        jz      .Lbadpointer
+        test    \$-1,%rdi
+        jz      .Lbadpointer
+
+        .picmeup %rbp
+        lea     AES_Te-.(%rbp),%rbp
+
+        cmp     \$128,%ecx
+        je      .L10rounds
+        cmp     \$192,%ecx
+        je      .L12rounds
+        cmp     \$256,%ecx
+        je      .L14rounds
+        mov     \$-2,%rax                       # invalid number of bits
+        jmp     .Lexit
+
+.L10rounds:
+        mov     0(%rsi),%eax                    # copy first 4 dwords
+        mov     4(%rsi),%ebx
+        mov     8(%rsi),%ecx
+        mov     12(%rsi),%edx
+        mov     %eax,0(%rdi)
+        mov     %ebx,4(%rdi)
+        mov     %ecx,8(%rdi)
+        mov     %edx,12(%rdi)
+
+        xor     %ecx,%ecx
+        jmp     .L10shortcut
+.align  4
+.L10loop:
+                mov     0(%rdi),%eax                    # rk[0]
+                mov     12(%rdi),%edx                   # rk[3]
+.L10shortcut:
+___
+                &enckey ();
+$code.=<<___;
+                mov     %eax,16(%rdi)                   # rk[4]
+                xor     4(%rdi),%eax
+                mov     %eax,20(%rdi)                   # rk[5]
+                xor     8(%rdi),%eax
+                mov     %eax,24(%rdi)                   # rk[6]
+                xor     12(%rdi),%eax
+                mov     %eax,28(%rdi)                   # rk[7]
+                add     \$1,%ecx
+                lea     16(%rdi),%rdi
+                cmp     \$10,%ecx
+        jl      .L10loop
+
+        movl    \$10,80(%rdi)                   # setup number of rounds
+        xor     %rax,%rax
+        jmp     .Lexit
+
+.L12rounds:
+        mov     0(%rsi),%eax                    # copy first 6 dwords
+        mov     4(%rsi),%ebx
+        mov     8(%rsi),%ecx
+        mov     12(%rsi),%edx
+        mov     %eax,0(%rdi)
+        mov     %ebx,4(%rdi)
+        mov     %ecx,8(%rdi)
+        mov     %edx,12(%rdi)
+        mov     16(%rsi),%ecx
+        mov     20(%rsi),%edx
+        mov     %ecx,16(%rdi)
+        mov     %edx,20(%rdi)
+
+        xor     %ecx,%ecx
+        jmp     .L12shortcut
+.align  4
+.L12loop:
+                mov     0(%rdi),%eax                    # rk[0]
+                mov     20(%rdi),%edx                   # rk[5]
+.L12shortcut:
+___
+                &enckey ();
+$code.=<<___;
+                mov     %eax,24(%rdi)                   # rk[6]
+                xor     4(%rdi),%eax
+                mov     %eax,28(%rdi)                   # rk[7]
+                xor     8(%rdi),%eax
+                mov     %eax,32(%rdi)                   # rk[8]
+                xor     12(%rdi),%eax
+                mov     %eax,36(%rdi)                   # rk[9]
+
+                cmp     \$7,%ecx
+                je      .L12break
+                add     \$1,%ecx
+
+                xor     16(%rdi),%eax
+                mov     %eax,40(%rdi)                   # rk[10]
+                xor     20(%rdi),%eax
+                mov     %eax,44(%rdi)                   # rk[11]
+
+                lea     24(%rdi),%rdi
+        jmp     .L12loop
+.L12break:
+        movl    \$12,72(%rdi)           # setup number of rounds
+        xor     %rax,%rax
+        jmp     .Lexit
+
+.L14rounds:             
+        mov     0(%rsi),%eax                    # copy first 8 dwords
+        mov     4(%rsi),%ebx
+        mov     8(%rsi),%ecx
+        mov     12(%rsi),%edx
+        mov     %eax,0(%rdi)
+        mov     %ebx,4(%rdi)
+        mov     %ecx,8(%rdi)
+        mov     %edx,12(%rdi)
+        mov     16(%rsi),%eax
+        mov     20(%rsi),%ebx
+        mov     24(%rsi),%ecx
+        mov     28(%rsi),%edx
+        mov     %eax,16(%rdi)
+        mov     %ebx,20(%rdi)
+        mov     %ecx,24(%rdi)
+        mov     %edx,28(%rdi)
+
+        xor     %ecx,%ecx
+        jmp     .L14shortcut
+.align  4
+.L14loop:
+                mov     28(%rdi),%edx                   # rk[4]
+.L14shortcut:
+                mov     0(%rdi),%eax                    # rk[0]
+___
+                &enckey ();
+$code.=<<___;
+                mov     %eax,32(%rdi)                   # rk[8]
+                xor     4(%rdi),%eax
+                mov     %eax,36(%rdi)                   # rk[9]
+                xor     8(%rdi),%eax
+                mov     %eax,40(%rdi)                   # rk[10]
+                xor     12(%rdi),%eax
+                mov     %eax,44(%rdi)                   # rk[11]
+
+                cmp     \$6,%ecx
+                je      .L14break
+                add     \$1,%ecx
+
+                mov     %eax,%edx
+                mov     16(%rdi),%eax                   # rk[4]
+                movz    %dl,%esi                        # rk[11]>>0
+                mov     2(%rbp,%rsi,8),%ebx
+                movz    %dh,%esi                        # rk[11]>>8
+                and     \$0x000000FF,%ebx
+                xor     %ebx,%eax
+
+                mov     0(%rbp,%rsi,8),%ebx
+                shr     \$16,%edx
+                and     \$0x0000FF00,%ebx
+                movz    %dl,%esi                        # rk[11]>>16
+                xor     %ebx,%eax
+
+                mov     0(%rbp,%rsi,8),%ebx
+                movz    %dh,%esi                        # rk[11]>>24
+                and     \$0x00FF0000,%ebx
+                xor     %ebx,%eax
+
+                mov     2(%rbp,%rsi,8),%ebx
+                and     \$0xFF000000,%ebx
+                xor     %ebx,%eax
+
+                mov     %eax,48(%rdi)                   # rk[12]
+                xor     20(%rdi),%eax
+                mov     %eax,52(%rdi)                   # rk[13]
+                xor     24(%rdi),%eax
+                mov     %eax,56(%rdi)                   # rk[14]
+                xor     28(%rdi),%eax
+                mov     %eax,60(%rdi)                   # rk[15]
+
+                lea     32(%rdi),%rdi
+        jmp     .L14loop
+.L14break:
+        movl    \$14,48(%rdi)           # setup number of rounds
+        xor     %rax,%rax
+        jmp     .Lexit
+
+.Lbadpointer:
+        mov     \$-1,%rax
+.Lexit:
+        pop     %rbp
+        pop     %rbx
+        ret
+.size   AES_set_encrypt_key,.-AES_set_encrypt_key
+___
+
+sub deckey()
+{ my ($i,$ptr,$te,$td) = @_;
+$code.=<<___;
+        mov     $i($ptr),%eax
+        mov     %eax,%edx
+        movz    %ah,%ebx
+        shr     \$16,%edx
+        and     \$0xFF,%eax
+        movzb   2($te,%rax,8),%rax
+        movzb   2($te,%rbx,8),%rbx
+        mov     0($td,%rax,8),%eax
+        xor     3($td,%rbx,8),%eax
+        movzb   %dh,%ebx
+        and     \$0xFF,%edx
+        movzb   2($te,%rdx,8),%rdx
+        movzb   2($te,%rbx,8),%rbx
+        xor     2($td,%rdx,8),%eax
+        xor     1($td,%rbx,8),%eax
+        mov     %eax,$i($ptr)
+___
+}
+
+# int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
+#                        AES_KEY *key)
+$code.=<<___;
+.globl  AES_set_decrypt_key
+.type   AES_set_decrypt_key,\@function,3
+.align  16
+AES_set_decrypt_key:
+        push    %rdx
+        call    AES_set_encrypt_key
+        cmp     \$0,%eax
+        je      .Lproceed
+        lea     24(%rsp),%rsp
+        ret
+.Lproceed:
+        mov     (%rsp),%r8              # restore key schedule
+        mov     %rbx,(%rsp)
+
+        mov     240(%r8),%ecx           # pull number of rounds
+        xor     %rdi,%rdi
+        lea     (%rdi,%rcx,4),%rcx
+        mov     %r8,%rsi
+        lea     (%r8,%rcx,4),%rdi       # pointer to last chunk
+.align  4
+.Linvert:
+                mov     0(%rsi),%rax
+                mov     8(%rsi),%rbx
+                mov     0(%rdi),%rcx
+                mov     8(%rdi),%rdx
+                mov     %rax,0(%rdi)
+                mov     %rbx,8(%rdi)
+                mov     %rcx,0(%rsi)
+                mov     %rdx,8(%rsi)
+                lea     16(%rsi),%rsi
+                lea     -16(%rdi),%rdi
+                cmp     %rsi,%rdi
+        jne     .Linvert
+
+        .picmeup %r9
+        lea     AES_Td-.(%r9),%rdi
+        lea     AES_Te-AES_Td(%rdi),%r9
+
+        mov     %r8,%rsi
+        mov     240(%r8),%ecx           # pull number of rounds
+        sub     \$1,%ecx
+.align  4
+.Lpermute:
+                lea     16(%rsi),%rsi
+___
+                &deckey (0,"%rsi","%r9","%rdi");
+                &deckey (4,"%rsi","%r9","%rdi");
+                &deckey (8,"%rsi","%r9","%rdi");
+                &deckey (12,"%rsi","%r9","%rdi");
+$code.=<<___;
+                sub     \$1,%ecx
+        jnz     .Lpermute
+
+        xor     %rax,%rax
+        pop     %rbx
+        ret
+.size   AES_set_decrypt_key,.-AES_set_decrypt_key
+___
+
+# void AES_cbc_encrypt (const void char *inp, unsigned char *out,
+#                       size_t length, const AES_KEY *key,
+#                       unsigned char *ivp,const int enc);
+{
+# stack frame layout
+# -8(%rsp)              return address
+my $_rsp="0(%rsp)";             # saved %rsp
+my $_len="8(%rsp)";             # copy of 3rd parameter, length
+my $_key="16(%rsp)";            # copy of 4th parameter, key
+my $_ivp="24(%rsp)";            # copy of 5th parameter, ivp
+my $keyp="32(%rsp)";            # one to pass as $key
+my $ivec="40(%rsp)";            # ivec[16]
+my $aes_key="56(%rsp)";         # copy of aes_key
+my $mark="56+240(%rsp)";        # copy of aes_key->rounds
+
+$code.=<<___;
+.globl  AES_cbc_encrypt
+.type   AES_cbc_encrypt,\@function,6
+.align  16
+AES_cbc_encrypt:
+        cmp     \$0,%rdx        # check length
+        je      .Lcbc_just_ret
+        push    %rbx
+        push    %rbp
+        push    %r12
+        push    %r13
+        push    %r14
+        push    %r15
+        pushfq
+        cld
+        mov     %r9d,%r9d       # clear upper half of enc
+
+        .picmeup $sbox
+.Lcbc_pic_point:
+
+        cmp     \$0,%r9
+        je      .LDECRYPT
+
+        lea     AES_Te-.Lcbc_pic_point($sbox),$sbox
+
+        # allocate aligned stack frame...
+        lea     -64-248(%rsp),$key
+        and     \$-64,$key
+
+        # ... and make it doesn't alias with AES_Te modulo 4096
+        mov     $sbox,%r10
+        lea     2048($sbox),%r11
+        mov     $key,%r12
+        and     \$0xFFF,%r10    # s = $sbox&0xfff
+        and     \$0xFFF,%r11    # e = ($sbox+2048)&0xfff
+        and     \$0xFFF,%r12    # p = %rsp&0xfff
+
+        cmp     %r11,%r12       # if (p=>e) %rsp =- (p-e);
+        jb      .Lcbc_te_break_out
+        sub     %r11,%r12
+        sub     %r12,$key
+        jmp     .Lcbc_te_ok
+.Lcbc_te_break_out:             # else %rsp -= (p-s)&0xfff + framesz
+        sub     %r10,%r12
+        and     \$0xFFF,%r12
+        add     \$320,%r12
+        sub     %r12,$key
+.align  4
+.Lcbc_te_ok:
+
+        xchg    %rsp,$key
+        add     \$8,%rsp        # reserve for return address!
+        mov     $key,$_rsp      # save %rsp
+        mov     %rdx,$_len      # save copy of len
+        mov     %rcx,$_key      # save copy of key
+        mov     %r8,$_ivp       # save copy of ivp
+        movl    \$0,$mark       # copy of aes_key->rounds = 0;
+        mov     %r8,%rbp        # rearrange input arguments
+        mov     %rsi,$out
+        mov     %rdi,$inp
+        mov     %rcx,$key
+
+        # do we copy key schedule to stack?
+        mov     $key,%r10
+        sub     $sbox,%r10
+        and     \$0xfff,%r10
+        cmp     \$2048,%r10
+        jb      .Lcbc_do_ecopy
+        cmp     \$4096-248,%r10
+        jb      .Lcbc_skip_ecopy
+.align  4
+.Lcbc_do_ecopy:
+                mov     $key,%rsi
+                lea     $aes_key,%rdi
+                lea     $aes_key,$key
+                mov     \$240/8,%ecx
+                .long   0x90A548F3      # rep movsq
+                mov     (%rsi),%eax     # copy aes_key->rounds
+                mov     %eax,(%rdi)
+.Lcbc_skip_ecopy:
+        mov     $key,$keyp      # save key pointer
+
+        mov     \$16,%ecx
+.align  4
+.Lcbc_prefetch_te:
+                mov     0($sbox),%r10
+                mov     32($sbox),%r11
+                mov     64($sbox),%r12
+                mov     96($sbox),%r13
+                lea     128($sbox),$sbox
+                sub     \$1,%ecx
+        jnz     .Lcbc_prefetch_te
+        sub     \$2048,$sbox
+
+        test    \$-16,%rdx              # check upon length
+        mov     %rdx,%r10
+        mov     0(%rbp),$s0             # load iv
+        mov     4(%rbp),$s1
+        mov     8(%rbp),$s2
+        mov     12(%rbp),$s3
+        jz      .Lcbc_enc_tail          # short input...
+
+.align  4
+.Lcbc_enc_loop:
+                xor     0($inp),$s0
+                xor     4($inp),$s1
+                xor     8($inp),$s2
+                xor     12($inp),$s3
+                mov     $inp,$ivec      # if ($verticalspin) save inp
+
+                mov     $keyp,$key      # restore key
+                call    _x86_64_AES_encrypt
+
+                mov     $ivec,$inp      # if ($verticalspin) restore inp
+                mov     $s0,0($out)
+                mov     $s1,4($out)
+                mov     $s2,8($out)
+                mov     $s3,12($out)
+
+                mov     $_len,%r10
+                lea     16($inp),$inp
+                lea     16($out),$out
+                sub     \$16,%r10
+                test    \$-16,%r10
+                mov     %r10,$_len
+        jnz     .Lcbc_enc_loop
+        test    \$15,%r10
+        jnz     .Lcbc_enc_tail
+        mov     $_ivp,%rbp      # restore ivp
+        mov     $s0,0(%rbp)     # save ivec
+        mov     $s1,4(%rbp)
+        mov     $s2,8(%rbp)
+        mov     $s3,12(%rbp)
+
+.align  4
+.Lcbc_cleanup:
+        cmpl    \$0,$mark       # was the key schedule copied?
+        lea     $aes_key,%rdi
+        mov     $_rsp,%rsp
+        je      .Lcbc_exit
+                mov     \$240/8,%ecx
+                xor     %rax,%rax
+                .long   0x90AB48F3      # rep stosq
+.Lcbc_exit:
+        popfq
+        pop     %r15
+        pop     %r14
+        pop     %r13
+        pop     %r12
+        pop     %rbp
+        pop     %rbx
+.Lcbc_just_ret:
+        ret
+.align  4
+.Lcbc_enc_tail:
+        cmp     $inp,$out
+        je      .Lcbc_enc_in_place
+        mov     %r10,%rcx
+        mov     $inp,%rsi
+        mov     $out,%rdi
+        .long   0xF689A4F3              # rep movsb
+.Lcbc_enc_in_place:
+        mov     \$16,%rcx               # zero tail
+        sub     %r10,%rcx
+        xor     %rax,%rax
+        .long   0xF689AAF3              # rep stosb
+        mov     $out,$inp               # this is not a mistake!
+        movq    \$16,$_len              # len=16
+        jmp     .Lcbc_enc_loop          # one more spin...
+#----------------------------- DECRYPT -----------------------------#
+.align  16
+.LDECRYPT:
+        lea     AES_Td-.Lcbc_pic_point($sbox),$sbox
+
+        # allocate aligned stack frame...
+        lea     -64-248(%rsp),$key
+        and     \$-64,$key
+
+        # ... and make it doesn't alias with AES_Td modulo 4096
+        mov     $sbox,%r10
+        lea     2304($sbox),%r11
+        mov     $key,%r12
+        and     \$0xFFF,%r10    # s = $sbox&0xfff
+        and     \$0xFFF,%r11    # e = ($sbox+2048+256)&0xfff
+        and     \$0xFFF,%r12    # p = %rsp&0xfff
+
+        cmp     %r11,%r12       # if (p=>e) %rsp =- (p-e);
+        jb      .Lcbc_td_break_out
+        sub     %r11,%r12
+        sub     %r12,$key
+        jmp     .Lcbc_td_ok
+.Lcbc_td_break_out:             # else %rsp -= (p-s)&0xfff + framesz
+        sub     %r10,%r12
+        and     \$0xFFF,%r12
+        add     \$320,%r12
+        sub     %r12,$key
+.align  4
+.Lcbc_td_ok:
+
+        xchg    %rsp,$key
+        add     \$8,%rsp        # reserve for return address!
+        mov     $key,$_rsp      # save %rsp
+        mov     %rdx,$_len      # save copy of len
+        mov     %rcx,$_key      # save copy of key
+        mov     %r8,$_ivp       # save copy of ivp
+        movl    \$0,$mark       # copy of aes_key->rounds = 0;
+        mov     %r8,%rbp        # rearrange input arguments
+        mov     %rsi,$out
+        mov     %rdi,$inp
+        mov     %rcx,$key
+
+        # do we copy key schedule to stack?
+        mov     $key,%r10
+        sub     $sbox,%r10
+        and     \$0xfff,%r10
+        cmp     \$2304,%r10
+        jb      .Lcbc_do_dcopy
+        cmp     \$4096-248,%r10
+        jb      .Lcbc_skip_dcopy
+.align  4
+.Lcbc_do_dcopy:
+                mov     $key,%rsi
+                lea     $aes_key,%rdi
+                lea     $aes_key,$key
+                mov     \$240/8,%ecx
+                .long   0x90A548F3      # rep movsq
+                mov     (%rsi),%eax     # copy aes_key->rounds
+                mov     %eax,(%rdi)
+.Lcbc_skip_dcopy:
+        mov     $key,$keyp      # save key pointer
+
+        mov     \$18,%ecx
+.align  4
+.Lcbc_prefetch_td:
+                mov     0($sbox),%r10
+                mov     32($sbox),%r11
+                mov     64($sbox),%r12
+                mov     96($sbox),%r13
+                lea     128($sbox),$sbox
+                sub     \$1,%ecx
+        jnz     .Lcbc_prefetch_td
+        sub     \$2304,$sbox
+
+        cmp     $inp,$out
+        je      .Lcbc_dec_in_place
+
+        mov     %rbp,$ivec
+.align  4
+.Lcbc_dec_loop:
+                mov     0($inp),$s0             # read input
+                mov     4($inp),$s1
+                mov     8($inp),$s2
+                mov     12($inp),$s3
+                mov     $inp,8+$ivec    # if ($verticalspin) save inp
+
+                mov     $keyp,$key      # restore key
+                call    _x86_64_AES_decrypt
+
+                mov     $ivec,%rbp      # load ivp
+                mov     8+$ivec,$inp    # if ($verticalspin) restore inp
+                xor     0(%rbp),$s0     # xor iv
+                xor     4(%rbp),$s1
+                xor     8(%rbp),$s2
+                xor     12(%rbp),$s3
+                mov     $inp,%rbp       # current input, next iv
+
+                mov     $_len,%r10      # load len
+                sub     \$16,%r10
+                jc      .Lcbc_dec_partial
+                mov     %r10,$_len      # update len
+                mov     %rbp,$ivec      # update ivp
+
+                mov     $s0,0($out)     # write output
+                mov     $s1,4($out)
+                mov     $s2,8($out)
+                mov     $s3,12($out)
+
+                lea     16($inp),$inp
+                lea     16($out),$out
+        jnz     .Lcbc_dec_loop
+.Lcbc_dec_end:
+        mov     $_ivp,%r12              # load user ivp
+        mov     0(%rbp),%r10            # load iv
+        mov     8(%rbp),%r11
+        mov     %r10,0(%r12)            # copy back to user
+        mov     %r11,8(%r12)
+        jmp     .Lcbc_cleanup
+
+.align  4
+.Lcbc_dec_partial:
+        mov     $s0,0+$ivec             # dump output to stack
+        mov     $s1,4+$ivec
+        mov     $s2,8+$ivec
+        mov     $s3,12+$ivec
+        mov     $out,%rdi
+        lea     $ivec,%rsi
+        mov     \$16,%rcx
+        add     %r10,%rcx               # number of bytes to copy
+        .long   0xF689A4F3              # rep movsb
+        jmp     .Lcbc_dec_end
+
+.align  16
+.Lcbc_dec_in_place:
+                mov     0($inp),$s0     # load input
+                mov     4($inp),$s1
+                mov     8($inp),$s2
+                mov     12($inp),$s3
+
+                mov     $inp,$ivec      # if ($verticalspin) save inp
+                mov     $keyp,$key
+                call    _x86_64_AES_decrypt
+
+                mov     $ivec,$inp      # if ($verticalspin) restore inp
+                mov     $_ivp,%rbp
+                xor     0(%rbp),$s0
+                xor     4(%rbp),$s1
+                xor     8(%rbp),$s2
+                xor     12(%rbp),$s3
+
+                mov     0($inp),%r10    # copy input to iv
+                mov     8($inp),%r11
+                mov     %r10,0(%rbp)
+                mov     %r11,8(%rbp)
+
+                mov     $s0,0($out)     # save output [zaps input]
+                mov     $s1,4($out)
+                mov     $s2,8($out)
+                mov     $s3,12($out)
+
+                mov     $_len,%rcx
+                lea     16($inp),$inp
+                lea     16($out),$out
+                sub     \$16,%rcx
+                jc      .Lcbc_dec_in_place_partial
+                mov     %rcx,$_len
+        jnz     .Lcbc_dec_in_place
+        jmp     .Lcbc_cleanup
+
+.align  4
+.Lcbc_dec_in_place_partial:
+        # one can argue if this is actually required
+        lea     ($out,%rcx),%rdi
+        lea     (%rbp,%rcx),%rsi
+        neg     %rcx
+        .long   0xF689A4F3      # rep movsb     # restore tail
+        jmp     .Lcbc_cleanup
+.size   AES_cbc_encrypt,.-AES_cbc_encrypt
+___
+}
+
+$code.=<<___;
+.globl  AES_Te
+.align  64
+AES_Te:
+___
+        &_data_word(0xa56363c6, 0x847c7cf8, 0x997777ee, 0x8d7b7bf6);
+        &_data_word(0x0df2f2ff, 0xbd6b6bd6, 0xb16f6fde, 0x54c5c591);
+        &_data_word(0x50303060, 0x03010102, 0xa96767ce, 0x7d2b2b56);
+        &_data_word(0x19fefee7, 0x62d7d7b5, 0xe6abab4d, 0x9a7676ec);
+        &_data_word(0x45caca8f, 0x9d82821f, 0x40c9c989, 0x877d7dfa);
+        &_data_word(0x15fafaef, 0xeb5959b2, 0xc947478e, 0x0bf0f0fb);
+        &_data_word(0xecadad41, 0x67d4d4b3, 0xfda2a25f, 0xeaafaf45);
+        &_data_word(0xbf9c9c23, 0xf7a4a453, 0x967272e4, 0x5bc0c09b);
+        &_data_word(0xc2b7b775, 0x1cfdfde1, 0xae93933d, 0x6a26264c);
+        &_data_word(0x5a36366c, 0x413f3f7e, 0x02f7f7f5, 0x4fcccc83);
+        &_data_word(0x5c343468, 0xf4a5a551, 0x34e5e5d1, 0x08f1f1f9);
+        &_data_word(0x937171e2, 0x73d8d8ab, 0x53313162, 0x3f15152a);
+        &_data_word(0x0c040408, 0x52c7c795, 0x65232346, 0x5ec3c39d);
+        &_data_word(0x28181830, 0xa1969637, 0x0f05050a, 0xb59a9a2f);
+        &_data_word(0x0907070e, 0x36121224, 0x9b80801b, 0x3de2e2df);
+        &_data_word(0x26ebebcd, 0x6927274e, 0xcdb2b27f, 0x9f7575ea);
+        &_data_word(0x1b090912, 0x9e83831d, 0x742c2c58, 0x2e1a1a34);
+        &_data_word(0x2d1b1b36, 0xb26e6edc, 0xee5a5ab4, 0xfba0a05b);
+        &_data_word(0xf65252a4, 0x4d3b3b76, 0x61d6d6b7, 0xceb3b37d);
+        &_data_word(0x7b292952, 0x3ee3e3dd, 0x712f2f5e, 0x97848413);
+        &_data_word(0xf55353a6, 0x68d1d1b9, 0x00000000, 0x2cededc1);
+        &_data_word(0x60202040, 0x1ffcfce3, 0xc8b1b179, 0xed5b5bb6);
+        &_data_word(0xbe6a6ad4, 0x46cbcb8d, 0xd9bebe67, 0x4b393972);
+        &_data_word(0xde4a4a94, 0xd44c4c98, 0xe85858b0, 0x4acfcf85);
+        &_data_word(0x6bd0d0bb, 0x2aefefc5, 0xe5aaaa4f, 0x16fbfbed);
+        &_data_word(0xc5434386, 0xd74d4d9a, 0x55333366, 0x94858511);
+        &_data_word(0xcf45458a, 0x10f9f9e9, 0x06020204, 0x817f7ffe);
+        &_data_word(0xf05050a0, 0x443c3c78, 0xba9f9f25, 0xe3a8a84b);
+        &_data_word(0xf35151a2, 0xfea3a35d, 0xc0404080, 0x8a8f8f05);
+        &_data_word(0xad92923f, 0xbc9d9d21, 0x48383870, 0x04f5f5f1);
+        &_data_word(0xdfbcbc63, 0xc1b6b677, 0x75dadaaf, 0x63212142);
+        &_data_word(0x30101020, 0x1affffe5, 0x0ef3f3fd, 0x6dd2d2bf);
+        &_data_word(0x4ccdcd81, 0x140c0c18, 0x35131326, 0x2fececc3);
+        &_data_word(0xe15f5fbe, 0xa2979735, 0xcc444488, 0x3917172e);
+        &_data_word(0x57c4c493, 0xf2a7a755, 0x827e7efc, 0x473d3d7a);
+        &_data_word(0xac6464c8, 0xe75d5dba, 0x2b191932, 0x957373e6);
+        &_data_word(0xa06060c0, 0x98818119, 0xd14f4f9e, 0x7fdcdca3);
+        &_data_word(0x66222244, 0x7e2a2a54, 0xab90903b, 0x8388880b);
+        &_data_word(0xca46468c, 0x29eeeec7, 0xd3b8b86b, 0x3c141428);
+        &_data_word(0x79dedea7, 0xe25e5ebc, 0x1d0b0b16, 0x76dbdbad);
+        &_data_word(0x3be0e0db, 0x56323264, 0x4e3a3a74, 0x1e0a0a14);
+        &_data_word(0xdb494992, 0x0a06060c, 0x6c242448, 0xe45c5cb8);
+        &_data_word(0x5dc2c29f, 0x6ed3d3bd, 0xefacac43, 0xa66262c4);
+        &_data_word(0xa8919139, 0xa4959531, 0x37e4e4d3, 0x8b7979f2);
+        &_data_word(0x32e7e7d5, 0x43c8c88b, 0x5937376e, 0xb76d6dda);
+        &_data_word(0x8c8d8d01, 0x64d5d5b1, 0xd24e4e9c, 0xe0a9a949);
+        &_data_word(0xb46c6cd8, 0xfa5656ac, 0x07f4f4f3, 0x25eaeacf);
+        &_data_word(0xaf6565ca, 0x8e7a7af4, 0xe9aeae47, 0x18080810);
+        &_data_word(0xd5baba6f, 0x887878f0, 0x6f25254a, 0x722e2e5c);
+        &_data_word(0x241c1c38, 0xf1a6a657, 0xc7b4b473, 0x51c6c697);
+        &_data_word(0x23e8e8cb, 0x7cdddda1, 0x9c7474e8, 0x211f1f3e);
+        &_data_word(0xdd4b4b96, 0xdcbdbd61, 0x868b8b0d, 0x858a8a0f);
+        &_data_word(0x907070e0, 0x423e3e7c, 0xc4b5b571, 0xaa6666cc);
+        &_data_word(0xd8484890, 0x05030306, 0x01f6f6f7, 0x120e0e1c);
+        &_data_word(0xa36161c2, 0x5f35356a, 0xf95757ae, 0xd0b9b969);
+        &_data_word(0x91868617, 0x58c1c199, 0x271d1d3a, 0xb99e9e27);
+        &_data_word(0x38e1e1d9, 0x13f8f8eb, 0xb398982b, 0x33111122);
+        &_data_word(0xbb6969d2, 0x70d9d9a9, 0x898e8e07, 0xa7949433);
+        &_data_word(0xb69b9b2d, 0x221e1e3c, 0x92878715, 0x20e9e9c9);
+        &_data_word(0x49cece87, 0xff5555aa, 0x78282850, 0x7adfdfa5);
+        &_data_word(0x8f8c8c03, 0xf8a1a159, 0x80898909, 0x170d0d1a);
+        &_data_word(0xdabfbf65, 0x31e6e6d7, 0xc6424284, 0xb86868d0);
+        &_data_word(0xc3414182, 0xb0999929, 0x772d2d5a, 0x110f0f1e);
+        &_data_word(0xcbb0b07b, 0xfc5454a8, 0xd6bbbb6d, 0x3a16162c);
+#rcon:
+$code.=<<___;
+        .long   0x00000001, 0x00000002, 0x00000004, 0x00000008
+        .long   0x00000010, 0x00000020, 0x00000040, 0x00000080
+        .long   0x0000001b, 0x00000036, 0, 0, 0, 0, 0, 0
+___
+$code.=<<___;
+.globl  AES_Td
+.align  64
+AES_Td:
+___
+        &_data_word(0x50a7f451, 0x5365417e, 0xc3a4171a, 0x965e273a);
+        &_data_word(0xcb6bab3b, 0xf1459d1f, 0xab58faac, 0x9303e34b);
+        &_data_word(0x55fa3020, 0xf66d76ad, 0x9176cc88, 0x254c02f5);
+        &_data_word(0xfcd7e54f, 0xd7cb2ac5, 0x80443526, 0x8fa362b5);
+        &_data_word(0x495ab1de, 0x671bba25, 0x980eea45, 0xe1c0fe5d);
+        &_data_word(0x02752fc3, 0x12f04c81, 0xa397468d, 0xc6f9d36b);
+        &_data_word(0xe75f8f03, 0x959c9215, 0xeb7a6dbf, 0xda595295);
+        &_data_word(0x2d83bed4, 0xd3217458, 0x2969e049, 0x44c8c98e);
+        &_data_word(0x6a89c275, 0x78798ef4, 0x6b3e5899, 0xdd71b927);
+        &_data_word(0xb64fe1be, 0x17ad88f0, 0x66ac20c9, 0xb43ace7d);
+        &_data_word(0x184adf63, 0x82311ae5, 0x60335197, 0x457f5362);
+        &_data_word(0xe07764b1, 0x84ae6bbb, 0x1ca081fe, 0x942b08f9);
+        &_data_word(0x58684870, 0x19fd458f, 0x876cde94, 0xb7f87b52);
+        &_data_word(0x23d373ab, 0xe2024b72, 0x578f1fe3, 0x2aab5566);
+        &_data_word(0x0728ebb2, 0x03c2b52f, 0x9a7bc586, 0xa50837d3);
+        &_data_word(0xf2872830, 0xb2a5bf23, 0xba6a0302, 0x5c8216ed);
+        &_data_word(0x2b1ccf8a, 0x92b479a7, 0xf0f207f3, 0xa1e2694e);
+        &_data_word(0xcdf4da65, 0xd5be0506, 0x1f6234d1, 0x8afea6c4);
+        &_data_word(0x9d532e34, 0xa055f3a2, 0x32e18a05, 0x75ebf6a4);
+        &_data_word(0x39ec830b, 0xaaef6040, 0x069f715e, 0x51106ebd);
+        &_data_word(0xf98a213e, 0x3d06dd96, 0xae053edd, 0x46bde64d);
+        &_data_word(0xb58d5491, 0x055dc471, 0x6fd40604, 0xff155060);
+        &_data_word(0x24fb9819, 0x97e9bdd6, 0xcc434089, 0x779ed967);
+        &_data_word(0xbd42e8b0, 0x888b8907, 0x385b19e7, 0xdbeec879);
+        &_data_word(0x470a7ca1, 0xe90f427c, 0xc91e84f8, 0x00000000);
+        &_data_word(0x83868009, 0x48ed2b32, 0xac70111e, 0x4e725a6c);
+        &_data_word(0xfbff0efd, 0x5638850f, 0x1ed5ae3d, 0x27392d36);
+        &_data_word(0x64d90f0a, 0x21a65c68, 0xd1545b9b, 0x3a2e3624);
+        &_data_word(0xb1670a0c, 0x0fe75793, 0xd296eeb4, 0x9e919b1b);
+        &_data_word(0x4fc5c080, 0xa220dc61, 0x694b775a, 0x161a121c);
+        &_data_word(0x0aba93e2, 0xe52aa0c0, 0x43e0223c, 0x1d171b12);
+        &_data_word(0x0b0d090e, 0xadc78bf2, 0xb9a8b62d, 0xc8a91e14);
+        &_data_word(0x8519f157, 0x4c0775af, 0xbbdd99ee, 0xfd607fa3);
+        &_data_word(0x9f2601f7, 0xbcf5725c, 0xc53b6644, 0x347efb5b);
+        &_data_word(0x7629438b, 0xdcc623cb, 0x68fcedb6, 0x63f1e4b8);
+        &_data_word(0xcadc31d7, 0x10856342, 0x40229713, 0x2011c684);
+        &_data_word(0x7d244a85, 0xf83dbbd2, 0x1132f9ae, 0x6da129c7);
+        &_data_word(0x4b2f9e1d, 0xf330b2dc, 0xec52860d, 0xd0e3c177);
+        &_data_word(0x6c16b32b, 0x99b970a9, 0xfa489411, 0x2264e947);
+        &_data_word(0xc48cfca8, 0x1a3ff0a0, 0xd82c7d56, 0xef903322);
+        &_data_word(0xc74e4987, 0xc1d138d9, 0xfea2ca8c, 0x360bd498);
+        &_data_word(0xcf81f5a6, 0x28de7aa5, 0x268eb7da, 0xa4bfad3f);
+        &_data_word(0xe49d3a2c, 0x0d927850, 0x9bcc5f6a, 0x62467e54);
+        &_data_word(0xc2138df6, 0xe8b8d890, 0x5ef7392e, 0xf5afc382);
+        &_data_word(0xbe805d9f, 0x7c93d069, 0xa92dd56f, 0xb31225cf);
+        &_data_word(0x3b99acc8, 0xa77d1810, 0x6e639ce8, 0x7bbb3bdb);
+        &_data_word(0x097826cd, 0xf418596e, 0x01b79aec, 0xa89a4f83);
+        &_data_word(0x656e95e6, 0x7ee6ffaa, 0x08cfbc21, 0xe6e815ef);
+        &_data_word(0xd99be7ba, 0xce366f4a, 0xd4099fea, 0xd67cb029);
+        &_data_word(0xafb2a431, 0x31233f2a, 0x3094a5c6, 0xc066a235);
+        &_data_word(0x37bc4e74, 0xa6ca82fc, 0xb0d090e0, 0x15d8a733);
+        &_data_word(0x4a9804f1, 0xf7daec41, 0x0e50cd7f, 0x2ff69117);
+        &_data_word(0x8dd64d76, 0x4db0ef43, 0x544daacc, 0xdf0496e4);
+        &_data_word(0xe3b5d19e, 0x1b886a4c, 0xb81f2cc1, 0x7f516546);
+        &_data_word(0x04ea5e9d, 0x5d358c01, 0x737487fa, 0x2e410bfb);
+        &_data_word(0x5a1d67b3, 0x52d2db92, 0x335610e9, 0x1347d66d);
+        &_data_word(0x8c61d79a, 0x7a0ca137, 0x8e14f859, 0x893c13eb);
+        &_data_word(0xee27a9ce, 0x35c961b7, 0xede51ce1, 0x3cb1477a);
+        &_data_word(0x59dfd29c, 0x3f73f255, 0x79ce1418, 0xbf37c773);
+        &_data_word(0xeacdf753, 0x5baafd5f, 0x146f3ddf, 0x86db4478);
+        &_data_word(0x81f3afca, 0x3ec468b9, 0x2c342438, 0x5f40a3c2);
+        &_data_word(0x72c31d16, 0x0c25e2bc, 0x8b493c28, 0x41950dff);
+        &_data_word(0x7101a839, 0xdeb30c08, 0x9ce4b4d8, 0x90c15664);
+        &_data_word(0x6184cb7b, 0x70b632d5, 0x745c6c48, 0x4257b8d0);
+#Td4:
+        &data_byte(0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38);
+        &data_byte(0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb);
+        &data_byte(0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87);
+        &data_byte(0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb);
+        &data_byte(0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d);
+        &data_byte(0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e);
+        &data_byte(0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2);
+        &data_byte(0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25);
+        &data_byte(0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16);
+        &data_byte(0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92);
+        &data_byte(0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda);
+        &data_byte(0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84);
+        &data_byte(0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a);
+        &data_byte(0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06);
+        &data_byte(0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02);
+        &data_byte(0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b);
+        &data_byte(0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea);
+        &data_byte(0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73);
+        &data_byte(0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85);
+        &data_byte(0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e);
+        &data_byte(0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89);
+        &data_byte(0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b);
+        &data_byte(0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20);
+        &data_byte(0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4);
+        &data_byte(0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31);
+        &data_byte(0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f);
+        &data_byte(0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d);
+        &data_byte(0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef);
+        &data_byte(0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0);
+        &data_byte(0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61);
+        &data_byte(0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26);
+        &data_byte(0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d);
+
+$code =~ s/\`([^\`]*)\`/eval($1)/gem;
+
+print $code;
+
+close STDOUT;
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_gen.c b/src/lib/libssl/src/crypto/asn1/asn1_gen.c
new file mode 100644
index 0000000000..26c832781e
--- /dev/null
+++ b/src/lib/libssl/src/crypto/asn1/asn1_gen.c
@@ -0,0 +1,848 @@
+/* asn1_gen.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 2002.
+ */
+/* ====================================================================
+ * Copyright (c) 2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+#include <openssl/x509v3.h>
+
+#define ASN1_GEN_FLAG           0x10000
+#define ASN1_GEN_FLAG_IMP       (ASN1_GEN_FLAG|1)
+#define ASN1_GEN_FLAG_EXP       (ASN1_GEN_FLAG|2)
+#define ASN1_GEN_FLAG_TAG       (ASN1_GEN_FLAG|3)
+#define ASN1_GEN_FLAG_BITWRAP   (ASN1_GEN_FLAG|4)
+#define ASN1_GEN_FLAG_OCTWRAP   (ASN1_GEN_FLAG|5)
+#define ASN1_GEN_FLAG_SEQWRAP   (ASN1_GEN_FLAG|6)
+#define ASN1_GEN_FLAG_SETWRAP   (ASN1_GEN_FLAG|7)
+#define ASN1_GEN_FLAG_FORMAT    (ASN1_GEN_FLAG|8)
+
+#define ASN1_GEN_STR(str,val)   {str, sizeof(str) - 1, val}
+
+#define ASN1_FLAG_EXP_MAX       20
+
+/* Input formats */
+
+/* ASCII: default */
+#define ASN1_GEN_FORMAT_ASCII   1
+/* UTF8 */
+#define ASN1_GEN_FORMAT_UTF8    2
+/* Hex */
+#define ASN1_GEN_FORMAT_HEX     3
+/* List of bits */
+#define ASN1_GEN_FORMAT_BITLIST 4
+
+
+struct tag_name_st
+        {
+        const char *strnam;
+        int len;
+        int tag;
+        };
+
+typedef struct
+        {
+        int exp_tag;
+        int exp_class;
+        int exp_constructed;
+        int exp_pad;
+        long exp_len;
+        } tag_exp_type;
+
+typedef struct
+        {
+        int imp_tag;
+        int imp_class;
+        int utype;
+        int format;
+        const char *str;
+        tag_exp_type exp_list[ASN1_FLAG_EXP_MAX];
+        int exp_count;
+        } tag_exp_arg;
+
+static int bitstr_cb(const char *elem, int len, void *bitstr);
+static int asn1_cb(const char *elem, int len, void *bitstr);
+static int append_exp(tag_exp_arg *arg, int exp_tag, int exp_class, int exp_constructed, int exp_pad, int imp_ok);
+static int parse_tagging(const char *vstart, int vlen, int *ptag, int *pclass);
+static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf);
+static ASN1_TYPE *asn1_str2type(const char *str, int format, int utype);
+static int asn1_str2tag(const char *tagstr, int len);
+
+ASN1_TYPE *ASN1_generate_nconf(char *str, CONF *nconf)
+        {
+        X509V3_CTX cnf;
+
+        if (!nconf)
+                return ASN1_generate_v3(str, NULL);
+
+        X509V3_set_nconf(&cnf, nconf);
+        return ASN1_generate_v3(str, &cnf);
+        }
+
+ASN1_TYPE *ASN1_generate_v3(char *str, X509V3_CTX *cnf)
+        {
+        ASN1_TYPE *ret;
+        tag_exp_arg asn1_tags;
+        tag_exp_type *etmp;
+
+        int i, len;
+
+        unsigned char *orig_der = NULL, *new_der = NULL;
+        const unsigned char *cpy_start;
+        unsigned char *p;
+        const unsigned char *cp;
+        int cpy_len;
+        long hdr_len;
+        int hdr_constructed = 0, hdr_tag, hdr_class;
+        int r;
+
+        asn1_tags.imp_tag = -1;
+        asn1_tags.imp_class = -1;
+        asn1_tags.format = ASN1_GEN_FORMAT_ASCII;
+        asn1_tags.exp_count = 0;
+        if (CONF_parse_list(str, ',', 1, asn1_cb, &asn1_tags) != 0)
+                return NULL;
+
+        if ((asn1_tags.utype == V_ASN1_SEQUENCE) || (asn1_tags.utype == V_ASN1_SET))
+                {
+                if (!cnf)
+                        {
+                        ASN1err(ASN1_F_ASN1_GENERATE_V3, ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG);
+                        return NULL;
+                        }
+                ret = asn1_multi(asn1_tags.utype, asn1_tags.str, cnf);
+                }
+        else
+                ret = asn1_str2type(asn1_tags.str, asn1_tags.format, asn1_tags.utype);
+
+        if (!ret)
+                return NULL;
+
+        /* If no tagging return base type */
+        if ((asn1_tags.imp_tag == -1) && (asn1_tags.exp_count == 0))
+                return ret;
+
+        /* Generate the encoding */
+        cpy_len = i2d_ASN1_TYPE(ret, &orig_der);
+        ASN1_TYPE_free(ret);
+        ret = NULL;
+        /* Set point to start copying for modified encoding */
+        cpy_start = orig_der;
+
+        /* Do we need IMPLICIT tagging? */
+        if (asn1_tags.imp_tag != -1)
+                {
+                /* If IMPLICIT we will replace the underlying tag */
+                /* Skip existing tag+len */
+                r = ASN1_get_object(&cpy_start, &hdr_len, &hdr_tag, &hdr_class, cpy_len);
+                if (r & 0x80)
+                        goto err;
+                /* Update copy length */
+                cpy_len -= cpy_start - orig_der;
+                /* For IMPLICIT tagging the length should match the
+                 * original length and constructed flag should be
+                 * consistent.
+                 */
+                if (r & 0x1)
+                        {
+                        /* Indefinite length constructed */
+                        hdr_constructed = 2;
+                        hdr_len = 0;
+                        }
+                else
+                        /* Just retain constructed flag */
+                        hdr_constructed = r & V_ASN1_CONSTRUCTED;
+                /* Work out new length with IMPLICIT tag: ignore constructed
+                 * because it will mess up if indefinite length
+                 */
+                len = ASN1_object_size(0, hdr_len, asn1_tags.imp_tag);
+                }
+        else
+                len = cpy_len;
+
+        /* Work out length in any EXPLICIT, starting from end */
+
+        for(i = 0, etmp = asn1_tags.exp_list + asn1_tags.exp_count - 1; i < asn1_tags.exp_count; i++, etmp--)
+                {
+                /* Content length: number of content octets + any padding */
+                len += etmp->exp_pad;
+                etmp->exp_len = len;
+                /* Total object length: length including new header */
+                len = ASN1_object_size(0, len, etmp->exp_tag);
+                }
+
+        /* Allocate buffer for new encoding */
+
+        new_der = OPENSSL_malloc(len);
+
+        /* Generate tagged encoding */
+
+        p = new_der;
+
+        /* Output explicit tags first */
+
+        for (i = 0, etmp = asn1_tags.exp_list; i < asn1_tags.exp_count; i++, etmp++)
+                {
+                ASN1_put_object(&p, etmp->exp_constructed, etmp->exp_len,
+                                        etmp->exp_tag, etmp->exp_class);
+                if (etmp->exp_pad)
+                        *p++ = 0;
+                }
+
+        /* If IMPLICIT, output tag */
+
+        if (asn1_tags.imp_tag != -1)
+                ASN1_put_object(&p, hdr_constructed, hdr_len,
+                                        asn1_tags.imp_tag, asn1_tags.imp_class);
+
+        /* Copy across original encoding */
+        memcpy(p, cpy_start, cpy_len);
+
+        cp = new_der;
+
+        /* Obtain new ASN1_TYPE structure */
+        ret = d2i_ASN1_TYPE(NULL, &cp, len);
+
+        err:
+        if (orig_der)
+                OPENSSL_free(orig_der);
+        if (new_der)
+                OPENSSL_free(new_der);
+
+        return ret;
+
+        }
+
+static int asn1_cb(const char *elem, int len, void *bitstr)
+        {
+        tag_exp_arg *arg = bitstr;
+        int i;
+        int utype;
+        int vlen = 0;
+        const char *p, *vstart = NULL;
+
+        int tmp_tag, tmp_class;
+
+        for(i = 0, p = elem; i < len; p++, i++)
+                {
+                /* Look for the ':' in name value pairs */
+                if (*p == ':')
+                        {
+                        vstart = p + 1;
+                        vlen = len - (vstart - elem);
+                        len = p - elem;
+                        break;
+                        }
+                }
+
+        utype = asn1_str2tag(elem, len);
+
+        if (utype == -1)
+                {
+                ASN1err(ASN1_F_ASN1_CB, ASN1_R_UNKNOWN_TAG);
+                ERR_add_error_data(2, "tag=", elem);
+                return -1;
+                }
+
+        /* If this is not a modifier mark end of string and exit */
+        if (!(utype & ASN1_GEN_FLAG))
+                {
+                arg->utype = utype;
+                arg->str = vstart;
+                /* If no value and not end of string, error */
+                if (!vstart && elem[len])
+                        {
+                        ASN1err(ASN1_F_ASN1_CB, ASN1_R_MISSING_VALUE);
+                        return -1;
+                        }
+                return 0;
+                }
+
+        switch(utype)
+                {
+
+                case ASN1_GEN_FLAG_IMP:
+                /* Check for illegal multiple IMPLICIT tagging */
+                if (arg->imp_tag != -1)
+                        {
+                        ASN1err(ASN1_F_ASN1_CB, ASN1_R_ILLEGAL_NESTED_TAGGING);
+                        return -1;
+                        }
+                if (!parse_tagging(vstart, vlen, &arg->imp_tag, &arg->imp_class))
+                        return -1;
+                break;
+
+                case ASN1_GEN_FLAG_EXP:
+
+                if (!parse_tagging(vstart, vlen, &tmp_tag, &tmp_class))
+                        return -1;
+                if (!append_exp(arg, tmp_tag, tmp_class, 1, 0, 0))
+                        return -1;
+                break;
+
+                case ASN1_GEN_FLAG_SEQWRAP:
+                if (!append_exp(arg, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, 1, 0, 1))
+                        return -1;
+                break;
+
+                case ASN1_GEN_FLAG_SETWRAP:
+                if (!append_exp(arg, V_ASN1_SET, V_ASN1_UNIVERSAL, 1, 0, 1))
+                        return -1;
+                break;
+
+                case ASN1_GEN_FLAG_BITWRAP:
+                if (!append_exp(arg, V_ASN1_BIT_STRING, V_ASN1_UNIVERSAL, 0, 1, 1))
+                        return -1;
+                break;
+
+                case ASN1_GEN_FLAG_OCTWRAP:
+                if (!append_exp(arg, V_ASN1_OCTET_STRING, V_ASN1_UNIVERSAL, 0, 0, 1))
+                        return -1;
+                break;
+
+                case ASN1_GEN_FLAG_FORMAT:
+                if (!strncmp(vstart, "ASCII", 5))
+                        arg->format = ASN1_GEN_FORMAT_ASCII;
+                else if (!strncmp(vstart, "UTF8", 4))
+                        arg->format = ASN1_GEN_FORMAT_UTF8;
+                else if (!strncmp(vstart, "HEX", 3))
+                        arg->format = ASN1_GEN_FORMAT_HEX;
+                else if (!strncmp(vstart, "BITLIST", 3))
+                        arg->format = ASN1_GEN_FORMAT_BITLIST;
+                else
+                        {
+                        ASN1err(ASN1_F_ASN1_CB, ASN1_R_UNKOWN_FORMAT);
+                        return -1;
+                        }
+                break;
+
+                }
+
+        return 1;
+
+        }
+
+static int parse_tagging(const char *vstart, int vlen, int *ptag, int *pclass)
+        {
+        char erch[2];
+        long tag_num;
+        char *eptr;
+        if (!vstart)
+                return 0;
+        tag_num = strtoul(vstart, &eptr, 10);
+        /* Check we haven't gone past max length: should be impossible */
+        if (eptr && *eptr && (eptr > vstart + vlen))
+                return 0;
+        if (tag_num < 0)
+                {
+                ASN1err(ASN1_F_PARSE_TAGGING, ASN1_R_INVALID_NUMBER);
+                return 0;
+                }
+        *ptag = tag_num;
+        /* If we have non numeric characters, parse them */
+        if (eptr)
+                vlen -= eptr - vstart;
+        else 
+                vlen = 0;
+        if (vlen)
+                {
+                switch (*eptr)
+                        {
+
+                        case 'U':
+                        *pclass = V_ASN1_UNIVERSAL;
+                        break;
+
+                        case 'A':
+                        *pclass = V_ASN1_APPLICATION;
+                        break;
+
+                        case 'P':
+                        *pclass = V_ASN1_PRIVATE;
+                        break;
+
+                        case 'C':
+                        *pclass = V_ASN1_CONTEXT_SPECIFIC;
+                        break;
+
+                        default:
+                        erch[0] = *eptr;
+                        erch[1] = 0;
+                        ASN1err(ASN1_F_PARSE_TAGGING, ASN1_R_INVALID_MODIFIER);
+                        ERR_add_error_data(2, "Char=", erch);
+                        return 0;
+                        break;
+
+                        }
+                }
+        else
+                *pclass = V_ASN1_CONTEXT_SPECIFIC;
+
+        return 1;
+
+        }
+
+/* Handle multiple types: SET and SEQUENCE */
+
+static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf)
+        {
+        ASN1_TYPE *ret = NULL, *typ = NULL;
+        STACK_OF(ASN1_TYPE) *sk = NULL;
+        STACK_OF(CONF_VALUE) *sect = NULL;
+        unsigned char *der = NULL, *p;
+        int derlen;
+        int i, is_set;
+        sk = sk_ASN1_TYPE_new_null();
+        if (section)
+                {
+                if (!cnf)
+                        goto bad;
+                sect = X509V3_get_section(cnf, (char *)section);
+                if (!sect)
+                        goto bad;
+                for (i = 0; i < sk_CONF_VALUE_num(sect); i++)
+                        {
+                        typ = ASN1_generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf);
+                        if (!typ)
+                                goto bad;
+                        sk_ASN1_TYPE_push(sk, typ);
+                        typ = NULL;
+                        }
+                }
+
+        /* Now we has a STACK of the components, convert to the correct form */
+
+        if (utype == V_ASN1_SET)
+                is_set = 1;
+        else
+                is_set = 0;
+
+
+        derlen = i2d_ASN1_SET_OF_ASN1_TYPE(sk, NULL, i2d_ASN1_TYPE, utype,
+                                           V_ASN1_UNIVERSAL, is_set);
+        der = OPENSSL_malloc(derlen);
+        p = der;
+        i2d_ASN1_SET_OF_ASN1_TYPE(sk, &p, i2d_ASN1_TYPE, utype,
+                                  V_ASN1_UNIVERSAL, is_set);
+
+        if (!(ret = ASN1_TYPE_new()))
+                goto bad;
+
+        if (!(ret->value.asn1_string = ASN1_STRING_type_new(utype)))
+                goto bad;
+
+        ret->type = utype;
+
+        ret->value.asn1_string->data = der;
+        ret->value.asn1_string->length = derlen;
+
+        der = NULL;
+
+        bad:
+
+        if (der)
+                OPENSSL_free(der);
+
+        if (sk)
+                sk_ASN1_TYPE_pop_free(sk, ASN1_TYPE_free);
+        if (typ)
+                ASN1_TYPE_free(typ);
+        if (sect)
+                X509V3_section_free(cnf, sect);
+
+        return ret;
+        }
+
+static int append_exp(tag_exp_arg *arg, int exp_tag, int exp_class, int exp_constructed, int exp_pad, int imp_ok)
+        {
+        tag_exp_type *exp_tmp;
+        /* Can only have IMPLICIT if permitted */
+        if ((arg->imp_tag != -1) && !imp_ok)
+                {
+                ASN1err(ASN1_F_APPEND_EXP, ASN1_R_ILLEGAL_IMPLICIT_TAG);
+                return 0;
+                }
+
+        if (arg->exp_count == ASN1_FLAG_EXP_MAX)
+                {
+                ASN1err(ASN1_F_APPEND_EXP, ASN1_R_DEPTH_EXCEEDED);
+                return 0;
+                }
+
+        exp_tmp = &arg->exp_list[arg->exp_count++];
+
+        /* If IMPLICIT set tag to implicit value then
+         * reset implicit tag since it has been used.
+         */
+        if (arg->imp_tag != -1)
+                {
+                exp_tmp->exp_tag = arg->imp_tag;
+                exp_tmp->exp_class = arg->imp_class;
+                arg->imp_tag = -1;
+                arg->imp_class = -1;
+                }
+        else
+                {
+                exp_tmp->exp_tag = exp_tag;
+                exp_tmp->exp_class = exp_class;
+                }
+        exp_tmp->exp_constructed = exp_constructed;
+        exp_tmp->exp_pad = exp_pad;
+
+        return 1;
+        }
+
+
+static int asn1_str2tag(const char *tagstr, int len)
+        {
+        unsigned int i;
+        static struct tag_name_st *tntmp, tnst [] = {
+                ASN1_GEN_STR("BOOL", V_ASN1_BOOLEAN),
+                ASN1_GEN_STR("BOOLEAN", V_ASN1_BOOLEAN),
+                ASN1_GEN_STR("NULL", V_ASN1_NULL),
+                ASN1_GEN_STR("INT", V_ASN1_INTEGER),
+                ASN1_GEN_STR("INTEGER", V_ASN1_INTEGER),
+                ASN1_GEN_STR("ENUM", V_ASN1_ENUMERATED),
+                ASN1_GEN_STR("ENUMERATED", V_ASN1_ENUMERATED),
+                ASN1_GEN_STR("OID", V_ASN1_OBJECT),
+                ASN1_GEN_STR("OBJECT", V_ASN1_OBJECT),
+                ASN1_GEN_STR("UTCTIME", V_ASN1_UTCTIME),
+                ASN1_GEN_STR("UTC", V_ASN1_UTCTIME),
+                ASN1_GEN_STR("GENERALIZEDTIME", V_ASN1_GENERALIZEDTIME),
+                ASN1_GEN_STR("GENTIME", V_ASN1_GENERALIZEDTIME),
+                ASN1_GEN_STR("OCT", V_ASN1_OCTET_STRING),
+                ASN1_GEN_STR("OCTETSTRING", V_ASN1_OCTET_STRING),
+                ASN1_GEN_STR("BITSTR", V_ASN1_BIT_STRING),
+                ASN1_GEN_STR("BITSTRING", V_ASN1_BIT_STRING),
+                ASN1_GEN_STR("UNIVERSALSTRING", V_ASN1_UNIVERSALSTRING),
+                ASN1_GEN_STR("UNIV", V_ASN1_UNIVERSALSTRING),
+                ASN1_GEN_STR("IA5", V_ASN1_IA5STRING),
+                ASN1_GEN_STR("IA5STRING", V_ASN1_IA5STRING),
+                ASN1_GEN_STR("UTF8", V_ASN1_UTF8STRING),
+                ASN1_GEN_STR("UTF8String", V_ASN1_UTF8STRING),
+                ASN1_GEN_STR("BMP", V_ASN1_BMPSTRING),
+                ASN1_GEN_STR("BMPSTRING", V_ASN1_BMPSTRING),
+                ASN1_GEN_STR("VISIBLESTRING", V_ASN1_VISIBLESTRING),
+                ASN1_GEN_STR("VISIBLE", V_ASN1_VISIBLESTRING),
+                ASN1_GEN_STR("PRINTABLESTRING", V_ASN1_PRINTABLESTRING),
+                ASN1_GEN_STR("PRINTABLE", V_ASN1_PRINTABLESTRING),
+                ASN1_GEN_STR("T61", V_ASN1_T61STRING),
+                ASN1_GEN_STR("T61STRING", V_ASN1_T61STRING),
+                ASN1_GEN_STR("TELETEXSTRING", V_ASN1_T61STRING),
+                ASN1_GEN_STR("GeneralString", V_ASN1_GENERALSTRING),
+                ASN1_GEN_STR("GENSTR", V_ASN1_GENERALSTRING),
+
+                /* Special cases */
+                ASN1_GEN_STR("SEQUENCE", V_ASN1_SEQUENCE),
+                ASN1_GEN_STR("SEQ", V_ASN1_SEQUENCE),
+                ASN1_GEN_STR("SET", V_ASN1_SET),
+                /* type modifiers */
+                /* Explicit tag */
+                ASN1_GEN_STR("EXP", ASN1_GEN_FLAG_EXP),
+                ASN1_GEN_STR("EXPLICIT", ASN1_GEN_FLAG_EXP),
+                /* Implicit tag */
+                ASN1_GEN_STR("IMP", ASN1_GEN_FLAG_IMP),
+                ASN1_GEN_STR("IMPLICIT", ASN1_GEN_FLAG_IMP),
+                /* OCTET STRING wrapper */
+                ASN1_GEN_STR("OCTWRAP", ASN1_GEN_FLAG_OCTWRAP),
+                /* SEQUENCE wrapper */
+                ASN1_GEN_STR("SEQWRAP", ASN1_GEN_FLAG_SEQWRAP),
+                /* SET wrapper */
+                ASN1_GEN_STR("SETWRAP", ASN1_GEN_FLAG_SETWRAP),
+                /* BIT STRING wrapper */
+                ASN1_GEN_STR("BITWRAP", ASN1_GEN_FLAG_BITWRAP),
+                ASN1_GEN_STR("FORM", ASN1_GEN_FLAG_FORMAT),
+                ASN1_GEN_STR("FORMAT", ASN1_GEN_FLAG_FORMAT),
+        };
+
+        if (len == -1)
+                len = strlen(tagstr);
+        
+        tntmp = tnst;   
+        for (i = 0; i < sizeof(tnst) / sizeof(struct tag_name_st); i++, tntmp++)
+                {
+                if ((len == tntmp->len) && !strncmp(tntmp->strnam, tagstr, len))
+                        return tntmp->tag;
+                }
+        
+        return -1;
+        }
+
+static ASN1_TYPE *asn1_str2type(const char *str, int format, int utype)
+        {
+        ASN1_TYPE *atmp = NULL;
+
+        CONF_VALUE vtmp;
+
+        unsigned char *rdata;
+        long rdlen;
+
+        int no_unused = 1;
+
+        if (!(atmp = ASN1_TYPE_new()))
+                {
+                ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE);
+                return NULL;
+                }
+
+        if (!str)
+                str = "";
+
+        switch(utype)
+                {
+
+                case V_ASN1_NULL:
+                if (str && *str)
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_NULL_VALUE);
+                        goto bad_form;
+                        }
+                break;
+                
+                case V_ASN1_BOOLEAN:
+                if (format != ASN1_GEN_FORMAT_ASCII)
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_NOT_ASCII_FORMAT);
+                        goto bad_form;
+                        }
+                vtmp.name = NULL;
+                vtmp.section = NULL;
+                vtmp.value = (char *)str;
+                if (!X509V3_get_value_bool(&vtmp, &atmp->value.boolean))
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_BOOLEAN);
+                        goto bad_str;
+                        }
+                break;
+
+                case V_ASN1_INTEGER:
+                case V_ASN1_ENUMERATED:
+                if (format != ASN1_GEN_FORMAT_ASCII)
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_INTEGER_NOT_ASCII_FORMAT);
+                        goto bad_form;
+                        }
+                if (!(atmp->value.integer = s2i_ASN1_INTEGER(NULL, (char *)str)))
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_INTEGER);
+                        goto bad_str;
+                        }
+                break;
+
+                case V_ASN1_OBJECT:
+                if (format != ASN1_GEN_FORMAT_ASCII)
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_OBJECT_NOT_ASCII_FORMAT);
+                        goto bad_form;
+                        }
+                if (!(atmp->value.object = OBJ_txt2obj(str, 0)))
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_OBJECT);
+                        goto bad_str;
+                        }
+                break;
+
+                case V_ASN1_UTCTIME:
+                case V_ASN1_GENERALIZEDTIME:
+                if (format != ASN1_GEN_FORMAT_ASCII)
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_TIME_NOT_ASCII_FORMAT);
+                        goto bad_form;
+                        }
+                if (!(atmp->value.asn1_string = ASN1_STRING_new()))
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE);
+                        goto bad_str;
+                        }
+                if (!ASN1_STRING_set(atmp->value.asn1_string, str, -1))
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE);
+                        goto bad_str;
+                        }
+                atmp->value.asn1_string->type = utype;
+                if (!ASN1_TIME_check(atmp->value.asn1_string))
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_TIME_VALUE);
+                        goto bad_str;
+                        }
+
+                break;
+
+                case V_ASN1_BMPSTRING:
+                case V_ASN1_PRINTABLESTRING:
+                case V_ASN1_IA5STRING:
+                case V_ASN1_T61STRING:
+                case V_ASN1_UTF8STRING:
+                case V_ASN1_VISIBLESTRING:
+                case V_ASN1_UNIVERSALSTRING:
+                case V_ASN1_GENERALSTRING:
+
+                if (format == ASN1_GEN_FORMAT_ASCII)
+                        format = MBSTRING_ASC;
+                else if (format == ASN1_GEN_FORMAT_UTF8)
+                        format = MBSTRING_UTF8;
+                else
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_FORMAT);
+                        goto bad_form;
+                        }
+
+
+                if (ASN1_mbstring_copy(&atmp->value.asn1_string, (unsigned char *)str,
+                                                -1, format, ASN1_tag2bit(utype)) <= 0)
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE);
+                        goto bad_str;
+                        }
+                
+
+                break;
+
+                case V_ASN1_BIT_STRING:
+
+                case V_ASN1_OCTET_STRING:
+
+                if (!(atmp->value.asn1_string = ASN1_STRING_new()))
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE);
+                        goto bad_form;
+                        }
+
+                if (format == ASN1_GEN_FORMAT_HEX)
+                        {
+
+                        if (!(rdata = string_to_hex((char *)str, &rdlen)))
+                                {
+                                ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_HEX);
+                                goto bad_str;
+                                }
+
+                        atmp->value.asn1_string->data = rdata;
+                        atmp->value.asn1_string->length = rdlen;
+                        atmp->value.asn1_string->type = utype;
+
+                        }
+                else if (format == ASN1_GEN_FORMAT_ASCII)
+                        ASN1_STRING_set(atmp->value.asn1_string, str, -1);
+                else if ((format == ASN1_GEN_FORMAT_BITLIST) && (utype == V_ASN1_BIT_STRING))
+                        {
+                        if (!CONF_parse_list(str, ',', 1, bitstr_cb, atmp->value.bit_string))
+                                {
+                                ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_LIST_ERROR);
+                                goto bad_str;
+                                }
+                        no_unused = 0;
+                        
+                        }
+                else 
+                        {
+                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_BITSTRING_FORMAT);
+                        goto bad_form;
+                        }
+
+                if ((utype == V_ASN1_BIT_STRING) && no_unused)
+                        {
+                        atmp->value.asn1_string->flags
+                                &= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
+                        atmp->value.asn1_string->flags
+                                |= ASN1_STRING_FLAG_BITS_LEFT;
+                        }
+
+
+                break;
+
+                default:
+                ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_UNSUPPORTED_TYPE);
+                goto bad_str;
+                break;
+                }
+
+
+        atmp->type = utype;
+        return atmp;
+
+
+        bad_str:
+        ERR_add_error_data(2, "string=", str);
+        bad_form:
+
+        ASN1_TYPE_free(atmp);
+        return NULL;
+
+        }
+
+static int bitstr_cb(const char *elem, int len, void *bitstr)
+        {
+        long bitnum;
+        char *eptr;
+        if (!elem)
+                return 0;
+        bitnum = strtoul(elem, &eptr, 10);
+        if (eptr && *eptr && (eptr != elem + len))
+                return 0;
+        if (bitnum < 0)
+                {
+                ASN1err(ASN1_F_BITSTR_CB, ASN1_R_INVALID_NUMBER);
+                return 0;
+                }
+        if (!ASN1_BIT_STRING_set_bit(bitstr, bitnum, 1))
+                {
+                ASN1err(ASN1_F_BITSTR_CB, ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        return 1;
+        }
+
diff --git a/src/lib/libssl/src/crypto/asn1/asn_mime.c b/src/lib/libssl/src/crypto/asn1/asn_mime.c
new file mode 100644
index 0000000000..fe7c4ec7ab
--- /dev/null
+++ b/src/lib/libssl/src/crypto/asn1/asn_mime.c
@@ -0,0 +1,874 @@
+/* asn_mime.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+
+#include <stdio.h>
+#include <ctype.h>
+#include "cryptlib.h"
+#include <openssl/rand.h>
+#include <openssl/x509.h>
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
+
+/* Generalised MIME like utilities for streaming ASN1. Although many
+ * have a PKCS7/CMS like flavour others are more general purpose.
+ */
+
+/* MIME format structures
+ * Note that all are translated to lower case apart from
+ * parameter values. Quotes are stripped off
+ */
+
+typedef struct {
+char *param_name;                       /* Param name e.g. "micalg" */
+char *param_value;                      /* Param value e.g. "sha1" */
+} MIME_PARAM;
+
+DECLARE_STACK_OF(MIME_PARAM)
+IMPLEMENT_STACK_OF(MIME_PARAM)
+
+typedef struct {
+char *name;                             /* Name of line e.g. "content-type" */
+char *value;                            /* Value of line e.g. "text/plain" */
+STACK_OF(MIME_PARAM) *params;           /* Zero or more parameters */
+} MIME_HEADER;
+
+DECLARE_STACK_OF(MIME_HEADER)
+IMPLEMENT_STACK_OF(MIME_HEADER)
+
+static char * strip_ends(char *name);
+static char * strip_start(char *name);
+static char * strip_end(char *name);
+static MIME_HEADER *mime_hdr_new(char *name, char *value);
+static int mime_hdr_addparam(MIME_HEADER *mhdr, char *name, char *value);
+static STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio);
+static int mime_hdr_cmp(const MIME_HEADER * const *a,
+                        const MIME_HEADER * const *b);
+static int mime_param_cmp(const MIME_PARAM * const *a,
+                        const MIME_PARAM * const *b);
+static void mime_param_free(MIME_PARAM *param);
+static int mime_bound_check(char *line, int linelen, char *bound, int blen);
+static int multi_split(BIO *bio, char *bound, STACK_OF(BIO) **ret);
+static int strip_eol(char *linebuf, int *plen);
+static MIME_HEADER *mime_hdr_find(STACK_OF(MIME_HEADER) *hdrs, char *name);
+static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, char *name);
+static void mime_hdr_free(MIME_HEADER *hdr);
+
+#define MAX_SMLEN 1024
+#define mime_debug(x) /* x */
+
+/* Base 64 read and write of ASN1 structure */
+
+static int B64_write_ASN1(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
+                                const ASN1_ITEM *it)
+        {
+        BIO *b64;
+        int r;
+        b64 = BIO_new(BIO_f_base64());
+        if(!b64)
+                {
+                ASN1err(ASN1_F_B64_WRITE_ASN1,ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        /* prepend the b64 BIO so all data is base64 encoded.
+         */
+        out = BIO_push(b64, out);
+        r = ASN1_item_i2d_bio(it, out, val);
+        (void)BIO_flush(out);
+        BIO_pop(out);
+        BIO_free(b64);
+        return r;
+        }
+
+static ASN1_VALUE *b64_read_asn1(BIO *bio, const ASN1_ITEM *it)
+{
+        BIO *b64;
+        ASN1_VALUE *val;
+        if(!(b64 = BIO_new(BIO_f_base64()))) {
+                ASN1err(ASN1_F_B64_READ_ASN1,ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        bio = BIO_push(b64, bio);
+        val = ASN1_item_d2i_bio(it, bio, NULL);
+        if(!val)
+                ASN1err(ASN1_F_B64_READ_ASN1,ASN1_R_DECODE_ERROR);
+        (void)BIO_flush(bio);
+        bio = BIO_pop(bio);
+        BIO_free(b64);
+        return val;
+}
+
+/* Generate the MIME "micalg" parameter from RFC3851, RFC4490 */
+
+static int asn1_write_micalg(BIO *out, STACK_OF(X509_ALGOR) *mdalgs)
+        {
+        const EVP_MD *md;
+        int i, have_unknown = 0, write_comma, md_nid;
+        have_unknown = 0;
+        write_comma = 0;
+        for (i = 0; i < sk_X509_ALGOR_num(mdalgs); i++)
+                {
+                if (write_comma)
+                        BIO_write(out, ",", 1);
+                write_comma = 1;
+                md_nid = OBJ_obj2nid(sk_X509_ALGOR_value(mdalgs, i)->algorithm);
+                md = EVP_get_digestbynid(md_nid);
+                switch(md_nid)
+                        {
+                        case NID_sha1:
+                        BIO_puts(out, "sha1");
+                        break;
+
+                        case NID_md5:
+                        BIO_puts(out, "md5");
+                        break;
+
+                        case NID_sha256:
+                        BIO_puts(out, "sha-256");
+                        break;
+
+                        case NID_sha384:
+                        BIO_puts(out, "sha-384");
+                        break;
+
+                        case NID_sha512:
+                        BIO_puts(out, "sha-512");
+                        break;
+
+                        default:
+                        if (have_unknown)
+                                write_comma = 0;
+                        else
+                                {
+                                BIO_puts(out, "unknown");
+                                have_unknown = 1;
+                                }
+                        break;
+
+                        }
+                }
+
+        return 1;
+
+        }
+
+/* SMIME sender */
+
+int int_smime_write_ASN1(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
+                                int ctype_nid, int econt_nid,
+                                STACK_OF(X509_ALGOR) *mdalgs,
+                                asn1_output_data_fn *data_fn,
+                                const ASN1_ITEM *it)
+{
+        char bound[33], c;
+        int i;
+        const char *mime_prefix, *mime_eol, *cname = "smime.p7m";
+        const char *msg_type=NULL;
+        if (flags & SMIME_OLDMIME)
+                mime_prefix = "application/x-pkcs7-";
+        else
+                mime_prefix = "application/pkcs7-";
+
+        if (flags & SMIME_CRLFEOL)
+                mime_eol = "\r\n";
+        else
+                mime_eol = "\n";
+        if((flags & SMIME_DETACHED) && data) {
+        /* We want multipart/signed */
+                /* Generate a random boundary */
+                RAND_pseudo_bytes((unsigned char *)bound, 32);
+                for(i = 0; i < 32; i++) {
+                        c = bound[i] & 0xf;
+                        if(c < 10) c += '0';
+                        else c += 'A' - 10;
+                        bound[i] = c;
+                }
+                bound[32] = 0;
+                BIO_printf(bio, "MIME-Version: 1.0%s", mime_eol);
+                BIO_printf(bio, "Content-Type: multipart/signed;");
+                BIO_printf(bio, " protocol=\"%ssignature\";", mime_prefix);
+                BIO_puts(bio, " micalg=\"");
+                asn1_write_micalg(bio, mdalgs);
+                BIO_printf(bio, "\"; boundary=\"----%s\"%s%s",
+                                                bound, mime_eol, mime_eol);
+                BIO_printf(bio, "This is an S/MIME signed message%s%s",
+                                                mime_eol, mime_eol);
+                /* Now write out the first part */
+                BIO_printf(bio, "------%s%s", bound, mime_eol);
+                if (!data_fn(bio, data, val, flags, it))
+                        return 0;
+                BIO_printf(bio, "%s------%s%s", mime_eol, bound, mime_eol);
+
+                /* Headers for signature */
+
+                BIO_printf(bio, "Content-Type: %ssignature;", mime_prefix); 
+                BIO_printf(bio, " name=\"smime.p7s\"%s", mime_eol);
+                BIO_printf(bio, "Content-Transfer-Encoding: base64%s",
+                                                                mime_eol);
+                BIO_printf(bio, "Content-Disposition: attachment;");
+                BIO_printf(bio, " filename=\"smime.p7s\"%s%s",
+                                                        mime_eol, mime_eol);
+                B64_write_ASN1(bio, val, NULL, 0, it);
+                BIO_printf(bio,"%s------%s--%s%s", mime_eol, bound,
+                                                        mime_eol, mime_eol);
+                return 1;
+        }
+
+        /* Determine smime-type header */
+
+        if (ctype_nid == NID_pkcs7_enveloped)
+                msg_type = "enveloped-data";
+        else if (ctype_nid == NID_pkcs7_signed)
+                {
+                if (econt_nid == NID_id_smime_ct_receipt)
+                        msg_type = "signed-receipt";
+                else if (sk_X509_ALGOR_num(mdalgs) >= 0)
+                        msg_type = "signed-data";
+                else
+                        msg_type = "certs-only";
+                }
+        else if (ctype_nid == NID_id_smime_ct_compressedData)
+                {
+                msg_type = "compressed-data";
+                cname = "smime.p7z";
+                }
+        /* MIME headers */
+        BIO_printf(bio, "MIME-Version: 1.0%s", mime_eol);
+        BIO_printf(bio, "Content-Disposition: attachment;");
+        BIO_printf(bio, " filename=\"%s\"%s", cname, mime_eol);
+        BIO_printf(bio, "Content-Type: %smime;", mime_prefix);
+        if (msg_type)
+                BIO_printf(bio, " smime-type=%s;", msg_type);
+        BIO_printf(bio, " name=\"%s\"%s", cname, mime_eol);
+        BIO_printf(bio, "Content-Transfer-Encoding: base64%s%s",
+                                                mime_eol, mime_eol);
+        if (!B64_write_ASN1(bio, val, data, flags, it))
+                return 0;
+        BIO_printf(bio, "%s", mime_eol);
+        return 1;
+}
+
+#if 0
+
+/* Handle output of ASN1 data */
+
+
+static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
+                                        const ASN1_ITEM *it)
+        {
+        BIO *tmpbio;
+        const ASN1_AUX *aux = it->funcs;
+        ASN1_STREAM_ARG sarg;
+
+        if (!(flags & SMIME_DETACHED))
+                {
+                SMIME_crlf_copy(data, out, flags);
+                return 1;
+                }
+
+        if (!aux || !aux->asn1_cb)
+                {
+                ASN1err(ASN1_F_ASN1_OUTPUT_DATA,
+                                        ASN1_R_STREAMING_NOT_SUPPORTED);
+                return 0;
+                }
+
+        sarg.out = out;
+        sarg.ndef_bio = NULL;
+        sarg.boundary = NULL;
+
+        /* Let ASN1 code prepend any needed BIOs */
+
+        if (aux->asn1_cb(ASN1_OP_DETACHED_PRE, &val, it, &sarg) <= 0)
+                return 0;
+
+        /* Copy data across, passing through filter BIOs for processing */
+        SMIME_crlf_copy(data, sarg.ndef_bio, flags);
+
+        /* Finalize structure */
+        if (aux->asn1_cb(ASN1_OP_DETACHED_POST, &val, it, &sarg) <= 0)
+                return 0;
+
+        /* Now remove any digests prepended to the BIO */
+
+        while (sarg.ndef_bio != out)
+                {
+                tmpbio = BIO_pop(sarg.ndef_bio);
+                BIO_free(sarg.ndef_bio);
+                sarg.ndef_bio = tmpbio;
+                }
+
+        return 1;
+
+        }
+
+#endif
+
+/* SMIME reader: handle multipart/signed and opaque signing.
+ * in multipart case the content is placed in a memory BIO
+ * pointed to by "bcont". In opaque this is set to NULL
+ */
+
+ASN1_VALUE *SMIME_read_ASN1(BIO *bio, BIO **bcont, const ASN1_ITEM *it)
+{
+        BIO *asnin;
+        STACK_OF(MIME_HEADER) *headers = NULL;
+        STACK_OF(BIO) *parts = NULL;
+        MIME_HEADER *hdr;
+        MIME_PARAM *prm;
+        ASN1_VALUE *val;
+        int ret;
+
+        if(bcont) *bcont = NULL;
+
+        if (!(headers = mime_parse_hdr(bio))) {
+                ASN1err(ASN1_F_SMIME_READ_ASN1,ASN1_R_MIME_PARSE_ERROR);
+                return NULL;
+        }
+
+        if(!(hdr = mime_hdr_find(headers, "content-type")) || !hdr->value) {
+                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
+                ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_NO_CONTENT_TYPE);
+                return NULL;
+        }
+
+        /* Handle multipart/signed */
+
+        if(!strcmp(hdr->value, "multipart/signed")) {
+                /* Split into two parts */
+                prm = mime_param_find(hdr, "boundary");
+                if(!prm || !prm->param_value) {
+                        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
+                        ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_NO_MULTIPART_BOUNDARY);
+                        return NULL;
+                }
+                ret = multi_split(bio, prm->param_value, &parts);
+                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
+                if(!ret || (sk_BIO_num(parts) != 2) ) {
+                        ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_NO_MULTIPART_BODY_FAILURE);
+                        sk_BIO_pop_free(parts, BIO_vfree);
+                        return NULL;
+                }
+
+                /* Parse the signature piece */
+                asnin = sk_BIO_value(parts, 1);
+
+                if (!(headers = mime_parse_hdr(asnin))) {
+                        ASN1err(ASN1_F_SMIME_READ_ASN1,ASN1_R_MIME_SIG_PARSE_ERROR);
+                        sk_BIO_pop_free(parts, BIO_vfree);
+                        return NULL;
+                }
+
+                /* Get content type */
+
+                if(!(hdr = mime_hdr_find(headers, "content-type")) ||
+                                                                 !hdr->value) {
+                        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
+                        ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_NO_SIG_CONTENT_TYPE);
+                        return NULL;
+                }
+
+                if(strcmp(hdr->value, "application/x-pkcs7-signature") &&
+                        strcmp(hdr->value, "application/pkcs7-signature")) {
+                        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
+                        ASN1err(ASN1_F_SMIME_READ_ASN1,ASN1_R_SIG_INVALID_MIME_TYPE);
+                        ERR_add_error_data(2, "type: ", hdr->value);
+                        sk_BIO_pop_free(parts, BIO_vfree);
+                        return NULL;
+                }
+                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
+                /* Read in ASN1 */
+                if(!(val = b64_read_asn1(asnin, it))) {
+                        ASN1err(ASN1_F_SMIME_READ_ASN1,ASN1_R_ASN1_SIG_PARSE_ERROR);
+                        sk_BIO_pop_free(parts, BIO_vfree);
+                        return NULL;
+                }
+
+                if(bcont) {
+                        *bcont = sk_BIO_value(parts, 0);
+                        BIO_free(asnin);
+                        sk_BIO_free(parts);
+                } else sk_BIO_pop_free(parts, BIO_vfree);
+                return val;
+        }
+                
+        /* OK, if not multipart/signed try opaque signature */
+
+        if (strcmp (hdr->value, "application/x-pkcs7-mime") &&
+            strcmp (hdr->value, "application/pkcs7-mime")) {
+                ASN1err(ASN1_F_SMIME_READ_ASN1,ASN1_R_INVALID_MIME_TYPE);
+                ERR_add_error_data(2, "type: ", hdr->value);
+                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
+                return NULL;
+        }
+
+        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
+        
+        if(!(val = b64_read_asn1(bio, it))) {
+                ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_ASN1_PARSE_ERROR);
+                return NULL;
+        }
+        return val;
+
+}
+
+/* Copy text from one BIO to another making the output CRLF at EOL */
+int SMIME_crlf_copy(BIO *in, BIO *out, int flags)
+{
+        BIO *bf;
+        char eol;
+        int len;
+        char linebuf[MAX_SMLEN];
+        /* Buffer output so we don't write one line at a time. This is
+         * useful when streaming as we don't end up with one OCTET STRING
+         * per line.
+         */
+        bf = BIO_new(BIO_f_buffer());
+        if (!bf)
+                return 0;
+        out = BIO_push(bf, out);
+        if(flags & SMIME_BINARY)
+                {
+                while((len = BIO_read(in, linebuf, MAX_SMLEN)) > 0)
+                                                BIO_write(out, linebuf, len);
+                }
+        else
+                {
+                if(flags & SMIME_TEXT)
+                        BIO_printf(out, "Content-Type: text/plain\r\n\r\n");
+                while ((len = BIO_gets(in, linebuf, MAX_SMLEN)) > 0)
+                        {
+                        eol = strip_eol(linebuf, &len);
+                        if (len)
+                                BIO_write(out, linebuf, len);
+                        if(eol) BIO_write(out, "\r\n", 2);
+                        }
+                }
+        (void)BIO_flush(out);
+        BIO_pop(out);
+        BIO_free(bf);
+        return 1;
+}
+
+/* Strip off headers if they are text/plain */
+int SMIME_text(BIO *in, BIO *out)
+{
+        char iobuf[4096];
+        int len;
+        STACK_OF(MIME_HEADER) *headers;
+        MIME_HEADER *hdr;
+
+        if (!(headers = mime_parse_hdr(in))) {
+                ASN1err(ASN1_F_SMIME_TEXT,ASN1_R_MIME_PARSE_ERROR);
+                return 0;
+        }
+        if(!(hdr = mime_hdr_find(headers, "content-type")) || !hdr->value) {
+                ASN1err(ASN1_F_SMIME_TEXT,ASN1_R_MIME_NO_CONTENT_TYPE);
+                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
+                return 0;
+        }
+        if (strcmp (hdr->value, "text/plain")) {
+                ASN1err(ASN1_F_SMIME_TEXT,ASN1_R_INVALID_MIME_TYPE);
+                ERR_add_error_data(2, "type: ", hdr->value);
+                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
+                return 0;
+        }
+        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
+        while ((len = BIO_read(in, iobuf, sizeof(iobuf))) > 0)
+                                                BIO_write(out, iobuf, len);
+        return 1;
+}
+
+/* Split a multipart/XXX message body into component parts: result is
+ * canonical parts in a STACK of bios
+ */
+
+static int multi_split(BIO *bio, char *bound, STACK_OF(BIO) **ret)
+{
+        char linebuf[MAX_SMLEN];
+        int len, blen;
+        int eol = 0, next_eol = 0;
+        BIO *bpart = NULL;
+        STACK_OF(BIO) *parts;
+        char state, part, first;
+
+        blen = strlen(bound);
+        part = 0;
+        state = 0;
+        first = 1;
+        parts = sk_BIO_new_null();
+        *ret = parts;
+        while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
+                state = mime_bound_check(linebuf, len, bound, blen);
+                if(state == 1) {
+                        first = 1;
+                        part++;
+                } else if(state == 2) {
+                        sk_BIO_push(parts, bpart);
+                        return 1;
+                } else if(part) {
+                        /* Strip CR+LF from linebuf */
+                        next_eol = strip_eol(linebuf, &len);
+                        if(first) {
+                                first = 0;
+                                if(bpart) sk_BIO_push(parts, bpart);
+                                bpart = BIO_new(BIO_s_mem());
+                                BIO_set_mem_eof_return(bpart, 0);
+                        } else if (eol)
+                                BIO_write(bpart, "\r\n", 2);
+                        eol = next_eol;
+                        if (len)
+                                BIO_write(bpart, linebuf, len);
+                }
+        }
+        return 0;
+}
+
+/* This is the big one: parse MIME header lines up to message body */
+
+#define MIME_INVALID    0
+#define MIME_START      1
+#define MIME_TYPE       2
+#define MIME_NAME       3
+#define MIME_VALUE      4
+#define MIME_QUOTE      5
+#define MIME_COMMENT    6
+
+
+static STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio)
+{
+        char *p, *q, c;
+        char *ntmp;
+        char linebuf[MAX_SMLEN];
+        MIME_HEADER *mhdr = NULL;
+        STACK_OF(MIME_HEADER) *headers;
+        int len, state, save_state = 0;
+
+        headers = sk_MIME_HEADER_new(mime_hdr_cmp);
+        while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
+        /* If whitespace at line start then continuation line */
+        if(mhdr && isspace((unsigned char)linebuf[0])) state = MIME_NAME;
+        else state = MIME_START;
+        ntmp = NULL;
+        /* Go through all characters */
+        for(p = linebuf, q = linebuf; (c = *p) && (c!='\r') && (c!='\n'); p++) {
+
+        /* State machine to handle MIME headers
+         * if this looks horrible that's because it *is*
+         */
+
+                switch(state) {
+                        case MIME_START:
+                        if(c == ':') {
+                                state = MIME_TYPE;
+                                *p = 0;
+                                ntmp = strip_ends(q);
+                                q = p + 1;
+                        }
+                        break;
+
+                        case MIME_TYPE:
+                        if(c == ';') {
+                                mime_debug("Found End Value\n");
+                                *p = 0;
+                                mhdr = mime_hdr_new(ntmp, strip_ends(q));
+                                sk_MIME_HEADER_push(headers, mhdr);
+                                ntmp = NULL;
+                                q = p + 1;
+                                state = MIME_NAME;
+                        } else if(c == '(') {
+                                save_state = state;
+                                state = MIME_COMMENT;
+                        }
+                        break;
+
+                        case MIME_COMMENT:
+                        if(c == ')') {
+                                state = save_state;
+                        }
+                        break;
+
+                        case MIME_NAME:
+                        if(c == '=') {
+                                state = MIME_VALUE;
+                                *p = 0;
+                                ntmp = strip_ends(q);
+                                q = p + 1;
+                        }
+                        break ;
+
+                        case MIME_VALUE:
+                        if(c == ';') {
+                                state = MIME_NAME;
+                                *p = 0;
+                                mime_hdr_addparam(mhdr, ntmp, strip_ends(q));
+                                ntmp = NULL;
+                                q = p + 1;
+                        } else if (c == '"') {
+                                mime_debug("Found Quote\n");
+                                state = MIME_QUOTE;
+                        } else if(c == '(') {
+                                save_state = state;
+                                state = MIME_COMMENT;
+                        }
+                        break;
+
+                        case MIME_QUOTE:
+                        if(c == '"') {
+                                mime_debug("Found Match Quote\n");
+                                state = MIME_VALUE;
+                        }
+                        break;
+                }
+        }
+
+        if(state == MIME_TYPE) {
+                mhdr = mime_hdr_new(ntmp, strip_ends(q));
+                sk_MIME_HEADER_push(headers, mhdr);
+        } else if(state == MIME_VALUE)
+                         mime_hdr_addparam(mhdr, ntmp, strip_ends(q));
+        if(p == linebuf) break; /* Blank line means end of headers */
+}
+
+return headers;
+
+}
+
+static char *strip_ends(char *name)
+{
+        return strip_end(strip_start(name));
+}
+
+/* Strip a parameter of whitespace from start of param */
+static char *strip_start(char *name)
+{
+        char *p, c;
+        /* Look for first non white space or quote */
+        for(p = name; (c = *p) ;p++) {
+                if(c == '"') {
+                        /* Next char is start of string if non null */
+                        if(p[1]) return p + 1;
+                        /* Else null string */
+                        return NULL;
+                }
+                if(!isspace((unsigned char)c)) return p;
+        }
+        return NULL;
+}
+
+/* As above but strip from end of string : maybe should handle brackets? */
+static char *strip_end(char *name)
+{
+        char *p, c;
+        if(!name) return NULL;
+        /* Look for first non white space or quote */
+        for(p = name + strlen(name) - 1; p >= name ;p--) {
+                c = *p;
+                if(c == '"') {
+                        if(p - 1 == name) return NULL;
+                        *p = 0;
+                        return name;
+                }
+                if(isspace((unsigned char)c)) *p = 0;   
+                else return name;
+        }
+        return NULL;
+}
+
+static MIME_HEADER *mime_hdr_new(char *name, char *value)
+{
+        MIME_HEADER *mhdr;
+        char *tmpname, *tmpval, *p;
+        int c;
+        if(name) {
+                if(!(tmpname = BUF_strdup(name))) return NULL;
+                for(p = tmpname ; *p; p++) {
+                        c = *p;
+                        if(isupper(c)) {
+                                c = tolower(c);
+                                *p = c;
+                        }
+                }
+        } else tmpname = NULL;
+        if(value) {
+                if(!(tmpval = BUF_strdup(value))) return NULL;
+                for(p = tmpval ; *p; p++) {
+                        c = *p;
+                        if(isupper(c)) {
+                                c = tolower(c);
+                                *p = c;
+                        }
+                }
+        } else tmpval = NULL;
+        mhdr = (MIME_HEADER *) OPENSSL_malloc(sizeof(MIME_HEADER));
+        if(!mhdr) return NULL;
+        mhdr->name = tmpname;
+        mhdr->value = tmpval;
+        if(!(mhdr->params = sk_MIME_PARAM_new(mime_param_cmp))) return NULL;
+        return mhdr;
+}
+                
+static int mime_hdr_addparam(MIME_HEADER *mhdr, char *name, char *value)
+{
+        char *tmpname, *tmpval, *p;
+        int c;
+        MIME_PARAM *mparam;
+        if(name) {
+                tmpname = BUF_strdup(name);
+                if(!tmpname) return 0;
+                for(p = tmpname ; *p; p++) {
+                        c = *p;
+                        if(isupper(c)) {
+                                c = tolower(c);
+                                *p = c;
+                        }
+                }
+        } else tmpname = NULL;
+        if(value) {
+                tmpval = BUF_strdup(value);
+                if(!tmpval) return 0;
+        } else tmpval = NULL;
+        /* Parameter values are case sensitive so leave as is */
+        mparam = (MIME_PARAM *) OPENSSL_malloc(sizeof(MIME_PARAM));
+        if(!mparam) return 0;
+        mparam->param_name = tmpname;
+        mparam->param_value = tmpval;
+        sk_MIME_PARAM_push(mhdr->params, mparam);
+        return 1;
+}
+
+static int mime_hdr_cmp(const MIME_HEADER * const *a,
+                        const MIME_HEADER * const *b)
+{
+        return(strcmp((*a)->name, (*b)->name));
+}
+
+static int mime_param_cmp(const MIME_PARAM * const *a,
+                        const MIME_PARAM * const *b)
+{
+        return(strcmp((*a)->param_name, (*b)->param_name));
+}
+
+/* Find a header with a given name (if possible) */
+
+static MIME_HEADER *mime_hdr_find(STACK_OF(MIME_HEADER) *hdrs, char *name)
+{
+        MIME_HEADER htmp;
+        int idx;
+        htmp.name = name;
+        idx = sk_MIME_HEADER_find(hdrs, &htmp);
+        if(idx < 0) return NULL;
+        return sk_MIME_HEADER_value(hdrs, idx);
+}
+
+static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, char *name)
+{
+        MIME_PARAM param;
+        int idx;
+        param.param_name = name;
+        idx = sk_MIME_PARAM_find(hdr->params, &param);
+        if(idx < 0) return NULL;
+        return sk_MIME_PARAM_value(hdr->params, idx);
+}
+
+static void mime_hdr_free(MIME_HEADER *hdr)
+{
+        if(hdr->name) OPENSSL_free(hdr->name);
+        if(hdr->value) OPENSSL_free(hdr->value);
+        if(hdr->params) sk_MIME_PARAM_pop_free(hdr->params, mime_param_free);
+        OPENSSL_free(hdr);
+}
+
+static void mime_param_free(MIME_PARAM *param)
+{
+        if(param->param_name) OPENSSL_free(param->param_name);
+        if(param->param_value) OPENSSL_free(param->param_value);
+        OPENSSL_free(param);
+}
+
+/* Check for a multipart boundary. Returns:
+ * 0 : no boundary
+ * 1 : part boundary
+ * 2 : final boundary
+ */
+static int mime_bound_check(char *line, int linelen, char *bound, int blen)
+{
+        if(linelen == -1) linelen = strlen(line);
+        if(blen == -1) blen = strlen(bound);
+        /* Quickly eliminate if line length too short */
+        if(blen + 2 > linelen) return 0;
+        /* Check for part boundary */
+        if(!strncmp(line, "--", 2) && !strncmp(line + 2, bound, blen)) {
+                if(!strncmp(line + blen + 2, "--", 2)) return 2;
+                else return 1;
+        }
+        return 0;
+}
+
+static int strip_eol(char *linebuf, int *plen)
+        {
+        int len = *plen;
+        char *p, c;
+        int is_eol = 0;
+        p = linebuf + len - 1;
+        for (p = linebuf + len - 1; len > 0; len--, p--)
+                {
+                c = *p;
+                if (c == '\n')
+                        is_eol = 1;
+                else if (c != '\r')
+                        break;
+                }
+        *plen = len;
+        return is_eol;
+        }
diff --git a/src/lib/libssl/src/crypto/bio/bio_lcl.h b/src/lib/libssl/src/crypto/bio/bio_lcl.h
new file mode 100644
index 0000000000..dba2919d43
--- /dev/null
+++ b/src/lib/libssl/src/crypto/bio/bio_lcl.h
@@ -0,0 +1,28 @@
+#include <openssl/bio.h>
+
+#if BIO_FLAGS_UPLINK==0
+/* Shortcut UPLINK calls on most platforms... */
+#define UP_stdin        stdin
+#define UP_stdout       stdout
+#define UP_stderr       stderr
+#define UP_fprintf      fprintf
+#define UP_fgets        fgets
+#define UP_fread        fread
+#define UP_fwrite       fwrite
+#undef  UP_fsetmod
+#define UP_feof         feof
+#define UP_fclose       fclose
+
+#define UP_fopen        fopen
+#define UP_fseek        fseek
+#define UP_ftell        ftell
+#define UP_fflush       fflush
+#define UP_ferror       ferror
+#define UP_fileno       fileno
+
+#define UP_open         open
+#define UP_read         read
+#define UP_write        write
+#define UP_lseek        lseek
+#define UP_close        close
+#endif
diff --git a/src/lib/libssl/src/crypto/bio/bss_dgram.c b/src/lib/libssl/src/crypto/bio/bss_dgram.c
new file mode 100644
index 0000000000..ea2c3fff63
--- /dev/null
+++ b/src/lib/libssl/src/crypto/bio/bss_dgram.c
@@ -0,0 +1,488 @@
+/* crypto/bio/bio_dgram.c */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef OPENSSL_NO_DGRAM
+
+#include <stdio.h>
+#include <errno.h>
+#define USE_SOCKETS
+#include "cryptlib.h"
+
+#include <openssl/bio.h>
+
+#define IP_MTU      14 /* linux is lame */
+
+#ifdef WATT32
+#define sock_write SockWrite  /* Watt-32 uses same names */
+#define sock_read  SockRead
+#define sock_puts  SockPuts
+#endif
+
+static int dgram_write(BIO *h, const char *buf, int num);
+static int dgram_read(BIO *h, char *buf, int size);
+static int dgram_puts(BIO *h, const char *str);
+static long dgram_ctrl(BIO *h, int cmd, long arg1, void *arg2);
+static int dgram_new(BIO *h);
+static int dgram_free(BIO *data);
+static int dgram_clear(BIO *bio);
+
+int BIO_dgram_should_retry(int s);
+
+static BIO_METHOD methods_dgramp=
+        {
+        BIO_TYPE_DGRAM,
+        "datagram socket",
+        dgram_write,
+        dgram_read,
+        dgram_puts,
+        NULL, /* dgram_gets, */
+        dgram_ctrl,
+        dgram_new,
+        dgram_free,
+        NULL,
+        };
+
+typedef struct bio_dgram_data_st
+        {
+        struct sockaddr peer;
+        unsigned int connected;
+        unsigned int _errno;
+        unsigned int mtu;
+        } bio_dgram_data;
+
+BIO_METHOD *BIO_s_datagram(void)
+        {
+        return(&methods_dgramp);
+        }
+
+BIO *BIO_new_dgram(int fd, int close_flag)
+        {
+        BIO *ret;
+
+        ret=BIO_new(BIO_s_datagram());
+        if (ret == NULL) return(NULL);
+        BIO_set_fd(ret,fd,close_flag);
+        return(ret);
+        }
+
+static int dgram_new(BIO *bi)
+        {
+        bio_dgram_data *data = NULL;
+
+        bi->init=0;
+        bi->num=0;
+        data = OPENSSL_malloc(sizeof(bio_dgram_data));
+        if (data == NULL)
+                return 0;
+        memset(data, 0x00, sizeof(bio_dgram_data));
+    bi->ptr = data;
+
+        bi->flags=0;
+        return(1);
+        }
+
+static int dgram_free(BIO *a)
+        {
+        bio_dgram_data *data;
+
+        if (a == NULL) return(0);
+        if ( ! dgram_clear(a))
+                return 0;
+
+        data = (bio_dgram_data *)a->ptr;
+        if(data != NULL) OPENSSL_free(data);
+
+        return(1);
+        }
+
+static int dgram_clear(BIO *a)
+        {
+        if (a == NULL) return(0);
+        if (a->shutdown)
+                {
+                if (a->init)
+                        {
+                        SHUTDOWN2(a->num);
+                        }
+                a->init=0;
+                a->flags=0;
+                }
+        return(1);
+        }
+        
+static int dgram_read(BIO *b, char *out, int outl)
+        {
+        int ret=0;
+        bio_dgram_data *data = (bio_dgram_data *)b->ptr;
+
+        struct sockaddr peer;
+        int peerlen = sizeof(peer);
+
+        if (out != NULL)
+                {
+                clear_socket_error();
+                memset(&peer, 0x00, peerlen);
+                /* Last arg in recvfrom is signed on some platforms and
+                 * unsigned on others. It is of type socklen_t on some
+                 * but this is not universal. Cast to (void *) to avoid
+                 * compiler warnings.
+                 */
+                ret=recvfrom(b->num,out,outl,0,&peer,(void *)&peerlen);
+
+                if ( ! data->connected  && ret > 0)
+                        BIO_ctrl(b, BIO_CTRL_DGRAM_CONNECT, 0, &peer);
+
+                BIO_clear_retry_flags(b);
+                if (ret <= 0)
+                        {
+                        if (BIO_dgram_should_retry(ret))
+                                {
+                                BIO_set_retry_read(b);
+                                data->_errno = get_last_socket_error();
+                                }
+                        }
+                }
+        return(ret);
+        }
+
+static int dgram_write(BIO *b, const char *in, int inl)
+        {
+        int ret;
+        bio_dgram_data *data = (bio_dgram_data *)b->ptr;
+        clear_socket_error();
+
+    if ( data->connected )
+        ret=writesocket(b->num,in,inl);
+    else
+#if defined(NETWARE_CLIB) && defined(NETWARE_BSDSOCK)
+        ret=sendto(b->num, (char *)in, inl, 0, &data->peer, sizeof(data->peer));
+#else
+        ret=sendto(b->num, in, inl, 0, &data->peer, sizeof(data->peer));
+#endif
+
+        BIO_clear_retry_flags(b);
+        if (ret <= 0)
+                {
+                if (BIO_sock_should_retry(ret))
+                        {
+                        BIO_set_retry_write(b);  
+                        data->_errno = get_last_socket_error();
+
+#if 0 /* higher layers are responsible for querying MTU, if necessary */
+                        if ( data->_errno == EMSGSIZE)
+                                /* retrieve the new MTU */
+                                BIO_ctrl(b, BIO_CTRL_DGRAM_QUERY_MTU, 0, NULL);
+#endif
+                        }
+                }
+        return(ret);
+        }
+
+static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
+        {
+        long ret=1;
+        int *ip;
+        struct sockaddr *to = NULL;
+        bio_dgram_data *data = NULL;
+        long sockopt_val = 0;
+        unsigned int sockopt_len = 0;
+
+        data = (bio_dgram_data *)b->ptr;
+
+        switch (cmd)
+                {
+        case BIO_CTRL_RESET:
+                num=0;
+        case BIO_C_FILE_SEEK:
+                ret=0;
+                break;
+        case BIO_C_FILE_TELL:
+        case BIO_CTRL_INFO:
+                ret=0;
+                break;
+        case BIO_C_SET_FD:
+                dgram_clear(b);
+                b->num= *((int *)ptr);
+                b->shutdown=(int)num;
+                b->init=1;
+                break;
+        case BIO_C_GET_FD:
+                if (b->init)
+                        {
+                        ip=(int *)ptr;
+                        if (ip != NULL) *ip=b->num;
+                        ret=b->num;
+                        }
+                else
+                        ret= -1;
+                break;
+        case BIO_CTRL_GET_CLOSE:
+                ret=b->shutdown;
+                break;
+        case BIO_CTRL_SET_CLOSE:
+                b->shutdown=(int)num;
+                break;
+        case BIO_CTRL_PENDING:
+        case BIO_CTRL_WPENDING:
+                ret=0;
+                break;
+        case BIO_CTRL_DUP:
+        case BIO_CTRL_FLUSH:
+                ret=1;
+                break;
+        case BIO_CTRL_DGRAM_CONNECT:
+                to = (struct sockaddr *)ptr;
+#if 0
+                if (connect(b->num, to, sizeof(struct sockaddr)) < 0)
+                        { perror("connect"); ret = 0; }
+                else
+                        {
+#endif
+                        memcpy(&(data->peer),to, sizeof(struct sockaddr));
+#if 0
+                        }
+#endif
+                break;
+                /* (Linux)kernel sets DF bit on outgoing IP packets */
+#ifdef IP_MTU_DISCOVER
+        case BIO_CTRL_DGRAM_MTU_DISCOVER:
+                sockopt_val = IP_PMTUDISC_DO;
+                if ((ret = setsockopt(b->num, IPPROTO_IP, IP_MTU_DISCOVER,
+                        &sockopt_val, sizeof(sockopt_val))) < 0)
+                        perror("setsockopt");
+                break;
+#endif
+        case BIO_CTRL_DGRAM_QUERY_MTU:
+         sockopt_len = sizeof(sockopt_val);
+                if ((ret = getsockopt(b->num, IPPROTO_IP, IP_MTU, (void *)&sockopt_val,
+                        &sockopt_len)) < 0 || sockopt_val < 0)
+                        { ret = 0; }
+                else
+                        {
+                        data->mtu = sockopt_val;
+                        ret = data->mtu;
+                        }
+                break;
+        case BIO_CTRL_DGRAM_GET_MTU:
+                return data->mtu;
+                break;
+        case BIO_CTRL_DGRAM_SET_MTU:
+                data->mtu = num;
+                ret = num;
+                break;
+        case BIO_CTRL_DGRAM_SET_CONNECTED:
+                to = (struct sockaddr *)ptr;
+
+                if ( to != NULL)
+                        {
+                        data->connected = 1;
+                        memcpy(&(data->peer),to, sizeof(struct sockaddr));
+                        }
+                else
+                        {
+                        data->connected = 0;
+                        memset(&(data->peer), 0x00, sizeof(struct sockaddr));
+                        }
+                break;
+    case BIO_CTRL_DGRAM_SET_PEER:
+        to = (struct sockaddr *) ptr;
+
+        memcpy(&(data->peer), to, sizeof(struct sockaddr));
+        break;
+        case BIO_CTRL_DGRAM_SET_RECV_TIMEOUT:
+                if ( setsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO, ptr,
+                        sizeof(struct timeval)) < 0)
+                        { perror("setsockopt"); ret = -1; }
+                break;
+        case BIO_CTRL_DGRAM_GET_RECV_TIMEOUT:
+                if ( getsockopt(b->num, SOL_SOCKET, SO_RCVTIMEO, 
+                        ptr, (void *)&ret) < 0)
+                        { perror("getsockopt"); ret = -1; }
+                break;
+        case BIO_CTRL_DGRAM_SET_SEND_TIMEOUT:
+                if ( setsockopt(b->num, SOL_SOCKET, SO_SNDTIMEO, ptr,
+                        sizeof(struct timeval)) < 0)
+                        { perror("setsockopt"); ret = -1; }
+                break;
+        case BIO_CTRL_DGRAM_GET_SEND_TIMEOUT:
+                if ( getsockopt(b->num, SOL_SOCKET, SO_SNDTIMEO, 
+                        ptr, (void *)&ret) < 0)
+                        { perror("getsockopt"); ret = -1; }
+                break;
+        case BIO_CTRL_DGRAM_GET_SEND_TIMER_EXP:
+                /* fall-through */
+        case BIO_CTRL_DGRAM_GET_RECV_TIMER_EXP:
+                if ( data->_errno == EAGAIN)
+                        {
+                        ret = 1;
+                        data->_errno = 0;
+                        }
+                else
+                        ret = 0;
+                break;
+#ifdef EMSGSIZE
+        case BIO_CTRL_DGRAM_MTU_EXCEEDED:
+                if ( data->_errno == EMSGSIZE)
+                        {
+                        ret = 1;
+                        data->_errno = 0;
+                        }
+                else
+                        ret = 0;
+                break;
+#endif
+        default:
+                ret=0;
+                break;
+                }
+        return(ret);
+        }
+
+static int dgram_puts(BIO *bp, const char *str)
+        {
+        int n,ret;
+
+        n=strlen(str);
+        ret=dgram_write(bp,str,n);
+        return(ret);
+        }
+
+int BIO_dgram_should_retry(int i)
+        {
+        int err;
+
+        if ((i == 0) || (i == -1))
+                {
+                err=get_last_socket_error();
+
+#if defined(OPENSSL_SYS_WINDOWS) && 0 /* more microsoft stupidity? perhaps not? Ben 4/1/99 */
+                if ((i == -1) && (err == 0))
+                        return(1);
+#endif
+
+                return(BIO_dgram_non_fatal_error(err));
+                }
+        return(0);
+        }
+
+int BIO_dgram_non_fatal_error(int err)
+        {
+        switch (err)
+                {
+#if defined(OPENSSL_SYS_WINDOWS)
+# if defined(WSAEWOULDBLOCK)
+        case WSAEWOULDBLOCK:
+# endif
+
+# if 0 /* This appears to always be an error */
+#  if defined(WSAENOTCONN)
+        case WSAENOTCONN:
+#  endif
+# endif
+#endif
+
+#ifdef EWOULDBLOCK
+# ifdef WSAEWOULDBLOCK
+#  if WSAEWOULDBLOCK != EWOULDBLOCK
+        case EWOULDBLOCK:
+#  endif
+# else
+        case EWOULDBLOCK:
+# endif
+#endif
+
+#if defined(ENOTCONN)
+        case ENOTCONN:
+#endif
+
+#ifdef EINTR
+        case EINTR:
+#endif
+
+#ifdef EAGAIN
+#if EWOULDBLOCK != EAGAIN
+        case EAGAIN:
+# endif
+#endif
+
+#ifdef EPROTO
+        case EPROTO:
+#endif
+
+#ifdef EINPROGRESS
+        case EINPROGRESS:
+#endif
+
+#ifdef EALREADY
+        case EALREADY:
+#endif
+
+/* DF bit set, and packet larger than MTU */
+#ifdef EMSGSIZE
+        case EMSGSIZE:
+#endif
+
+                return(1);
+                /* break; */
+        default:
+                break;
+                }
+        return(0);
+        }
+#endif
diff --git a/src/lib/libssl/src/crypto/bn/asm/x86_64-mont.pl b/src/lib/libssl/src/crypto/bn/asm/x86_64-mont.pl
new file mode 100755
index 0000000000..c43b69592a
--- /dev/null
+++ b/src/lib/libssl/src/crypto/bn/asm/x86_64-mont.pl
@@ -0,0 +1,214 @@
+#!/usr/bin/env perl
+
+# ====================================================================
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# project. The module is, however, dual licensed under OpenSSL and
+# CRYPTOGAMS licenses depending on where you obtain it. For further
+# details see http://www.openssl.org/~appro/cryptogams/.
+# ====================================================================
+
+# October 2005.
+#
+# Montgomery multiplication routine for x86_64. While it gives modest
+# 9% improvement of rsa4096 sign on Opteron, rsa512 sign runs more
+# than twice, >2x, as fast. Most common rsa1024 sign is improved by
+# respectful 50%. It remains to be seen if loop unrolling and
+# dedicated squaring routine can provide further improvement...
+
+$output=shift;
+
+$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
+( $xlate="${dir}x86_64-xlate.pl" and -f $xlate ) or
+( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or
+die "can't locate x86_64-xlate.pl";
+
+open STDOUT,"| $^X $xlate $output";
+
+# int bn_mul_mont(
+$rp="%rdi";     # BN_ULONG *rp,
+$ap="%rsi";     # const BN_ULONG *ap,
+$bp="%rdx";     # const BN_ULONG *bp,
+$np="%rcx";     # const BN_ULONG *np,
+$n0="%r8";      # const BN_ULONG *n0,
+$num="%r9";     # int num);
+$lo0="%r10";
+$hi0="%r11";
+$bp="%r12";     # reassign $bp
+$hi1="%r13";
+$i="%r14";
+$j="%r15";
+$m0="%rbx";
+$m1="%rbp";
+
+$code=<<___;
+.text
+
+.globl  bn_mul_mont
+.type   bn_mul_mont,\@function,6
+.align  16
+bn_mul_mont:
+        push    %rbx
+        push    %rbp
+        push    %r12
+        push    %r13
+        push    %r14
+        push    %r15
+
+        mov     ${num}d,${num}d
+        lea     2($num),%rax
+        mov     %rsp,%rbp
+        neg     %rax
+        lea     (%rsp,%rax,8),%rsp      # tp=alloca(8*(num+2))
+        and     \$-1024,%rsp            # minimize TLB usage
+
+        mov     %rbp,8(%rsp,$num,8)     # tp[num+1]=%rsp
+        mov     %rdx,$bp                # $bp reassigned, remember?
+
+        mov     ($n0),$n0               # pull n0[0] value
+
+        xor     $i,$i                   # i=0
+        xor     $j,$j                   # j=0
+
+        mov     ($bp),$m0               # m0=bp[0]
+        mov     ($ap),%rax
+        mulq    $m0                     # ap[0]*bp[0]
+        mov     %rax,$lo0
+        mov     %rdx,$hi0
+
+        imulq   $n0,%rax                # "tp[0]"*n0
+        mov     %rax,$m1
+
+        mulq    ($np)                   # np[0]*m1
+        add     $lo0,%rax               # discarded
+        adc     \$0,%rdx
+        mov     %rdx,$hi1
+
+        lea     1($j),$j                # j++
+.L1st:
+        mov     ($ap,$j,8),%rax
+        mulq    $m0                     # ap[j]*bp[0]
+        add     $hi0,%rax
+        adc     \$0,%rdx
+        mov     %rax,$lo0
+        mov     ($np,$j,8),%rax
+        mov     %rdx,$hi0
+
+        mulq    $m1                     # np[j]*m1
+        add     $hi1,%rax
+        lea     1($j),$j                # j++
+        adc     \$0,%rdx
+        add     $lo0,%rax               # np[j]*m1+ap[j]*bp[0]
+        adc     \$0,%rdx
+        mov     %rax,-16(%rsp,$j,8)     # tp[j-1]
+        cmp     $num,$j
+        mov     %rdx,$hi1
+        jl      .L1st
+
+        xor     %rdx,%rdx
+        add     $hi0,$hi1
+        adc     \$0,%rdx
+        mov     $hi1,-8(%rsp,$num,8)
+        mov     %rdx,(%rsp,$num,8)      # store upmost overflow bit
+
+        lea     1($i),$i                # i++
+.align  4
+.Louter:
+        xor     $j,$j                   # j=0
+
+        mov     ($bp,$i,8),$m0          # m0=bp[i]
+        mov     ($ap),%rax              # ap[0]
+        mulq    $m0                     # ap[0]*bp[i]
+        add     (%rsp),%rax             # ap[0]*bp[i]+tp[0]
+        adc     \$0,%rdx
+        mov     %rax,$lo0
+        mov     %rdx,$hi0
+
+        imulq   $n0,%rax                # tp[0]*n0
+        mov     %rax,$m1
+
+        mulq    ($np,$j,8)              # np[0]*m1
+        add     $lo0,%rax               # discarded
+        mov     8(%rsp),$lo0            # tp[1]
+        adc     \$0,%rdx
+        mov     %rdx,$hi1
+
+        lea     1($j),$j                # j++
+.align  4
+.Linner:
+        mov     ($ap,$j,8),%rax
+        mulq    $m0                     # ap[j]*bp[i]
+        add     $hi0,%rax
+        adc     \$0,%rdx
+        add     %rax,$lo0               # ap[j]*bp[i]+tp[j]
+        mov     ($np,$j,8),%rax
+        adc     \$0,%rdx
+        mov     %rdx,$hi0
+
+        mulq    $m1                     # np[j]*m1
+        add     $hi1,%rax
+        lea     1($j),$j                # j++
+        adc     \$0,%rdx
+        add     $lo0,%rax               # np[j]*m1+ap[j]*bp[i]+tp[j]
+        adc     \$0,%rdx
+        mov     (%rsp,$j,8),$lo0
+        cmp     $num,$j
+        mov     %rax,-16(%rsp,$j,8)     # tp[j-1]
+        mov     %rdx,$hi1
+        jl      .Linner
+
+        xor     %rdx,%rdx
+        add     $hi0,$hi1
+        adc     \$0,%rdx
+        add     $lo0,$hi1               # pull upmost overflow bit
+        adc     \$0,%rdx
+        mov     $hi1,-8(%rsp,$num,8)
+        mov     %rdx,(%rsp,$num,8)      # store upmost overflow bit
+
+        lea     1($i),$i                # i++
+        cmp     $num,$i
+        jl      .Louter
+
+        lea     (%rsp),$ap              # borrow ap for tp
+        lea     -1($num),$j             # j=num-1
+
+        mov     ($ap),%rax              # tp[0]
+        xor     $i,$i                   # i=0 and clear CF!
+        jmp     .Lsub
+.align  16
+.Lsub:  sbb     ($np,$i,8),%rax
+        mov     %rax,($rp,$i,8)         # rp[i]=tp[i]-np[i]
+        dec     $j                      # doesn't affect CF!
+        mov     8($ap,$i,8),%rax        # tp[i+1]
+        lea     1($i),$i                # i++
+        jge     .Lsub
+
+        sbb     \$0,%rax                # handle upmost overflow bit
+        and     %rax,$ap
+        not     %rax
+        mov     $rp,$np
+        and     %rax,$np
+        lea     -1($num),$j
+        or      $np,$ap                 # ap=borrow?tp:rp
+.align  16
+.Lcopy:                                 # copy or in-place refresh
+        mov     ($ap,$j,8),%rax
+        mov     %rax,($rp,$j,8)         # rp[i]=tp[i]
+        mov     $i,(%rsp,$j,8)          # zap temporary vector
+        dec     $j
+        jge     .Lcopy
+
+        mov     8(%rsp,$num,8),%rsp     # restore %rsp
+        mov     \$1,%rax
+        pop     %r15
+        pop     %r14
+        pop     %r13
+        pop     %r12
+        pop     %rbp
+        pop     %rbx
+        ret
+.size   bn_mul_mont,.-bn_mul_mont
+.asciz  "Montgomery Multiplication for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+___
+
+print $code;
+close STDOUT;
diff --git a/src/lib/libssl/src/crypto/bn/bn_const.c b/src/lib/libssl/src/crypto/bn/bn_const.c
new file mode 100644
index 0000000000..eb60a25b3c
--- /dev/null
+++ b/src/lib/libssl/src/crypto/bn/bn_const.c
@@ -0,0 +1,402 @@
+/* crypto/bn/knownprimes.c */
+/* Insert boilerplate */
+
+#include "bn.h"
+
+/* "First Oakley Default Group" from RFC2409, section 6.1.
+ *
+ * The prime is: 2^768 - 2 ^704 - 1 + 2^64 * { [2^638 pi] + 149686 }
+ *
+ * RFC2409 specifies a generator of 2.
+ * RFC2412 specifies a generator of of 22.
+ */
+
+BIGNUM *get_rfc2409_prime_768(BIGNUM *bn)
+        {
+        static const unsigned char RFC2409_PRIME_768[]={
+                0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,
+                0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,
+                0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6,
+                0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD,
+                0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,
+                0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,
+                0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9,
+                0xA6,0x3A,0x36,0x20,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
+                };
+        return BN_bin2bn(RFC2409_PRIME_768,sizeof(RFC2409_PRIME_768),bn);
+        }
+
+/* "Second Oakley Default Group" from RFC2409, section 6.2.
+ *
+ * The prime is: 2^1024 - 2^960 - 1 + 2^64 * { [2^894 pi] + 129093 }.
+ *
+ * RFC2409 specifies a generator of 2.
+ * RFC2412 specifies a generator of 22.
+ */
+
+BIGNUM *get_rfc2409_prime_1024(BIGNUM *bn)
+        {
+        static const unsigned char RFC2409_PRIME_1024[]={
+                0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,
+                0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,
+                0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6,
+                0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD,
+                0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,
+                0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,
+                0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9,
+                0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED,
+                0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,
+                0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE6,0x53,0x81,
+                0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
+                };
+        return BN_bin2bn(RFC2409_PRIME_1024,sizeof(RFC2409_PRIME_1024),bn);
+        }
+
+/* "1536-bit MODP Group" from RFC3526, Section 2.
+ *
+ * The prime is: 2^1536 - 2^1472 - 1 + 2^64 * { [2^1406 pi] + 741804 }
+ *
+ * RFC3526 specifies a generator of 2.
+ * RFC2312 specifies a generator of 22.
+ */
+
+BIGNUM *get_rfc3526_prime_1536(BIGNUM *bn)
+        {
+        static const unsigned char RFC3526_PRIME_1536[]={
+                0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,
+                0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,
+                0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6,
+                0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD,
+                0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,
+                0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,
+                0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9,
+                0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED,
+                0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,
+                0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,
+                0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36,
+                0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F,
+                0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,
+                0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,
+                0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08,
+                0xCA,0x23,0x73,0x27,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
+                };
+        return BN_bin2bn(RFC3526_PRIME_1536,sizeof(RFC3526_PRIME_1536),bn);
+        }
+
+/* "2048-bit MODP Group" from RFC3526, Section 3.
+ *
+ * The prime is: 2^2048 - 2^1984 - 1 + 2^64 * { [2^1918 pi] + 124476 }
+ *
+ * RFC3526 specifies a generator of 2.
+ */
+
+BIGNUM *get_rfc3526_prime_2048(BIGNUM *bn)
+        {
+        static const unsigned char RFC3526_PRIME_2048[]={
+                0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,
+                0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,
+                0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6,
+                0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD,
+                0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,
+                0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,
+                0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9,
+                0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED,
+                0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,
+                0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,
+                0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36,
+                0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F,
+                0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,
+                0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,
+                0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08,
+                0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B,
+                0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2,
+                0xEC,0x07,0xA2,0x8F,0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9,
+                0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18,0x39,0x95,0x49,0x7C,
+                0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10,
+                0x15,0x72,0x8E,0x5A,0x8A,0xAC,0xAA,0x68,0xFF,0xFF,0xFF,0xFF,
+                0xFF,0xFF,0xFF,0xFF,
+                };
+        return BN_bin2bn(RFC3526_PRIME_2048,sizeof(RFC3526_PRIME_2048),bn);
+        }
+
+/* "3072-bit MODP Group" from RFC3526, Section 4.
+ *
+ * The prime is: 2^3072 - 2^3008 - 1 + 2^64 * { [2^2942 pi] + 1690314 }
+ *
+ * RFC3526 specifies a generator of 2.
+ */
+
+BIGNUM *get_rfc3526_prime_3072(BIGNUM *bn)
+        {
+        static const unsigned char RFC3526_PRIME_3072[]={
+                0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,
+                0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,
+                0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6,
+                0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD,
+                0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,
+                0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,
+                0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9,
+                0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED,
+                0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,
+                0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,
+                0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36,
+                0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F,
+                0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,
+                0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,
+                0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08,
+                0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B,
+                0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2,
+                0xEC,0x07,0xA2,0x8F,0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9,
+                0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18,0x39,0x95,0x49,0x7C,
+                0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10,
+                0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D,
+                0x04,0x50,0x7A,0x33,0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64,
+                0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A,0x8A,0xEA,0x71,0x57,
+                0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7,
+                0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0,
+                0x4A,0x25,0x61,0x9D,0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B,
+                0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64,0xD8,0x76,0x02,0x73,
+                0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C,
+                0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0,
+                0xBA,0xD9,0x46,0xE2,0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31,
+                0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E,0x4B,0x82,0xD1,0x20,
+                0xA9,0x3A,0xD2,0xCA,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
+                };
+        return BN_bin2bn(RFC3526_PRIME_3072,sizeof(RFC3526_PRIME_3072),bn);
+        }
+
+/* "4096-bit MODP Group" from RFC3526, Section 5.
+ *
+ * The prime is: 2^4096 - 2^4032 - 1 + 2^64 * { [2^3966 pi] + 240904 }
+ *
+ * RFC3526 specifies a generator of 2.
+ */
+
+BIGNUM *get_rfc3526_prime_4096(BIGNUM *bn)
+        {
+        static const unsigned char RFC3526_PRIME_4096[]={
+                0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,
+                0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,
+                0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6,
+                0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD,
+                0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,
+                0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,
+                0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9,
+                0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED,
+                0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,
+                0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,
+                0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36,
+                0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F,
+                0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,
+                0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,
+                0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08,
+                0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B,
+                0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2,
+                0xEC,0x07,0xA2,0x8F,0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9,
+                0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18,0x39,0x95,0x49,0x7C,
+                0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10,
+                0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D,
+                0x04,0x50,0x7A,0x33,0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64,
+                0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A,0x8A,0xEA,0x71,0x57,
+                0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7,
+                0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0,
+                0x4A,0x25,0x61,0x9D,0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B,
+                0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64,0xD8,0x76,0x02,0x73,
+                0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C,
+                0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0,
+                0xBA,0xD9,0x46,0xE2,0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31,
+                0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E,0x4B,0x82,0xD1,0x20,
+                0xA9,0x21,0x08,0x01,0x1A,0x72,0x3C,0x12,0xA7,0x87,0xE6,0xD7,
+                0x88,0x71,0x9A,0x10,0xBD,0xBA,0x5B,0x26,0x99,0xC3,0x27,0x18,
+                0x6A,0xF4,0xE2,0x3C,0x1A,0x94,0x68,0x34,0xB6,0x15,0x0B,0xDA,
+                0x25,0x83,0xE9,0xCA,0x2A,0xD4,0x4C,0xE8,0xDB,0xBB,0xC2,0xDB,
+                0x04,0xDE,0x8E,0xF9,0x2E,0x8E,0xFC,0x14,0x1F,0xBE,0xCA,0xA6,
+                0x28,0x7C,0x59,0x47,0x4E,0x6B,0xC0,0x5D,0x99,0xB2,0x96,0x4F,
+                0xA0,0x90,0xC3,0xA2,0x23,0x3B,0xA1,0x86,0x51,0x5B,0xE7,0xED,
+                0x1F,0x61,0x29,0x70,0xCE,0xE2,0xD7,0xAF,0xB8,0x1B,0xDD,0x76,
+                0x21,0x70,0x48,0x1C,0xD0,0x06,0x91,0x27,0xD5,0xB0,0x5A,0xA9,
+                0x93,0xB4,0xEA,0x98,0x8D,0x8F,0xDD,0xC1,0x86,0xFF,0xB7,0xDC,
+                0x90,0xA6,0xC0,0x8F,0x4D,0xF4,0x35,0xC9,0x34,0x06,0x31,0x99,
+                0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
+                };
+        return BN_bin2bn(RFC3526_PRIME_4096,sizeof(RFC3526_PRIME_4096),bn);
+        }
+
+/* "6144-bit MODP Group" from RFC3526, Section 6.
+ *
+ * The prime is: 2^6144 - 2^6080 - 1 + 2^64 * { [2^6014 pi] + 929484 }
+ *
+ * RFC3526 specifies a generator of 2.
+ */
+
+BIGNUM *get_rfc3526_prime_6144(BIGNUM *bn)
+        {
+        static const unsigned char RFC3526_PRIME_6144[]={
+                0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,
+                0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,
+                0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6,
+                0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD,
+                0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,
+                0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,
+                0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9,
+                0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED,
+                0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,
+                0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,
+                0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36,
+                0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F,
+                0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,
+                0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,
+                0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08,
+                0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B,
+                0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2,
+                0xEC,0x07,0xA2,0x8F,0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9,
+                0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18,0x39,0x95,0x49,0x7C,
+                0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10,
+                0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D,
+                0x04,0x50,0x7A,0x33,0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64,
+                0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A,0x8A,0xEA,0x71,0x57,
+                0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7,
+                0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0,
+                0x4A,0x25,0x61,0x9D,0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B,
+                0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64,0xD8,0x76,0x02,0x73,
+                0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C,
+                0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0,
+                0xBA,0xD9,0x46,0xE2,0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31,
+                0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E,0x4B,0x82,0xD1,0x20,
+                0xA9,0x21,0x08,0x01,0x1A,0x72,0x3C,0x12,0xA7,0x87,0xE6,0xD7,
+                0x88,0x71,0x9A,0x10,0xBD,0xBA,0x5B,0x26,0x99,0xC3,0x27,0x18,
+                0x6A,0xF4,0xE2,0x3C,0x1A,0x94,0x68,0x34,0xB6,0x15,0x0B,0xDA,
+                0x25,0x83,0xE9,0xCA,0x2A,0xD4,0x4C,0xE8,0xDB,0xBB,0xC2,0xDB,
+                0x04,0xDE,0x8E,0xF9,0x2E,0x8E,0xFC,0x14,0x1F,0xBE,0xCA,0xA6,
+                0x28,0x7C,0x59,0x47,0x4E,0x6B,0xC0,0x5D,0x99,0xB2,0x96,0x4F,
+                0xA0,0x90,0xC3,0xA2,0x23,0x3B,0xA1,0x86,0x51,0x5B,0xE7,0xED,
+                0x1F,0x61,0x29,0x70,0xCE,0xE2,0xD7,0xAF,0xB8,0x1B,0xDD,0x76,
+                0x21,0x70,0x48,0x1C,0xD0,0x06,0x91,0x27,0xD5,0xB0,0x5A,0xA9,
+                0x93,0xB4,0xEA,0x98,0x8D,0x8F,0xDD,0xC1,0x86,0xFF,0xB7,0xDC,
+                0x90,0xA6,0xC0,0x8F,0x4D,0xF4,0x35,0xC9,0x34,0x02,0x84,0x92,
+                0x36,0xC3,0xFA,0xB4,0xD2,0x7C,0x70,0x26,0xC1,0xD4,0xDC,0xB2,
+                0x60,0x26,0x46,0xDE,0xC9,0x75,0x1E,0x76,0x3D,0xBA,0x37,0xBD,
+                0xF8,0xFF,0x94,0x06,0xAD,0x9E,0x53,0x0E,0xE5,0xDB,0x38,0x2F,
+                0x41,0x30,0x01,0xAE,0xB0,0x6A,0x53,0xED,0x90,0x27,0xD8,0x31,
+                0x17,0x97,0x27,0xB0,0x86,0x5A,0x89,0x18,0xDA,0x3E,0xDB,0xEB,
+                0xCF,0x9B,0x14,0xED,0x44,0xCE,0x6C,0xBA,0xCE,0xD4,0xBB,0x1B,
+                0xDB,0x7F,0x14,0x47,0xE6,0xCC,0x25,0x4B,0x33,0x20,0x51,0x51,
+                0x2B,0xD7,0xAF,0x42,0x6F,0xB8,0xF4,0x01,0x37,0x8C,0xD2,0xBF,
+                0x59,0x83,0xCA,0x01,0xC6,0x4B,0x92,0xEC,0xF0,0x32,0xEA,0x15,
+                0xD1,0x72,0x1D,0x03,0xF4,0x82,0xD7,0xCE,0x6E,0x74,0xFE,0xF6,
+                0xD5,0x5E,0x70,0x2F,0x46,0x98,0x0C,0x82,0xB5,0xA8,0x40,0x31,
+                0x90,0x0B,0x1C,0x9E,0x59,0xE7,0xC9,0x7F,0xBE,0xC7,0xE8,0xF3,
+                0x23,0xA9,0x7A,0x7E,0x36,0xCC,0x88,0xBE,0x0F,0x1D,0x45,0xB7,
+                0xFF,0x58,0x5A,0xC5,0x4B,0xD4,0x07,0xB2,0x2B,0x41,0x54,0xAA,
+                0xCC,0x8F,0x6D,0x7E,0xBF,0x48,0xE1,0xD8,0x14,0xCC,0x5E,0xD2,
+                0x0F,0x80,0x37,0xE0,0xA7,0x97,0x15,0xEE,0xF2,0x9B,0xE3,0x28,
+                0x06,0xA1,0xD5,0x8B,0xB7,0xC5,0xDA,0x76,0xF5,0x50,0xAA,0x3D,
+                0x8A,0x1F,0xBF,0xF0,0xEB,0x19,0xCC,0xB1,0xA3,0x13,0xD5,0x5C,
+                0xDA,0x56,0xC9,0xEC,0x2E,0xF2,0x96,0x32,0x38,0x7F,0xE8,0xD7,
+                0x6E,0x3C,0x04,0x68,0x04,0x3E,0x8F,0x66,0x3F,0x48,0x60,0xEE,
+                0x12,0xBF,0x2D,0x5B,0x0B,0x74,0x74,0xD6,0xE6,0x94,0xF9,0x1E,
+                0x6D,0xCC,0x40,0x24,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
+                };
+        return BN_bin2bn(RFC3526_PRIME_6144,sizeof(RFC3526_PRIME_6144),bn);
+        }
+
+/* "8192-bit MODP Group" from RFC3526, Section 7.
+ *
+ * The prime is: 2^8192 - 2^8128 - 1 + 2^64 * { [2^8062 pi] + 4743158 }
+ *
+ * RFC3526 specifies a generator of 2.
+ */
+
+BIGNUM *get_rfc3526_prime_8192(BIGNUM *bn)
+        {
+        static const unsigned char RFC3526_PRIME_8192[]={
+                0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,
+                0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,
+                0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6,
+                0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD,
+                0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,
+                0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,
+                0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9,
+                0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED,
+                0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,
+                0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,
+                0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36,
+                0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F,
+                0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,
+                0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,
+                0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08,
+                0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B,
+                0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2,
+                0xEC,0x07,0xA2,0x8F,0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9,
+                0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18,0x39,0x95,0x49,0x7C,
+                0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10,
+                0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D,
+                0x04,0x50,0x7A,0x33,0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64,
+                0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A,0x8A,0xEA,0x71,0x57,
+                0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7,
+                0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0,
+                0x4A,0x25,0x61,0x9D,0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B,
+                0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64,0xD8,0x76,0x02,0x73,
+                0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C,
+                0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0,
+                0xBA,0xD9,0x46,0xE2,0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31,
+                0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E,0x4B,0x82,0xD1,0x20,
+                0xA9,0x21,0x08,0x01,0x1A,0x72,0x3C,0x12,0xA7,0x87,0xE6,0xD7,
+                0x88,0x71,0x9A,0x10,0xBD,0xBA,0x5B,0x26,0x99,0xC3,0x27,0x18,
+                0x6A,0xF4,0xE2,0x3C,0x1A,0x94,0x68,0x34,0xB6,0x15,0x0B,0xDA,
+                0x25,0x83,0xE9,0xCA,0x2A,0xD4,0x4C,0xE8,0xDB,0xBB,0xC2,0xDB,
+                0x04,0xDE,0x8E,0xF9,0x2E,0x8E,0xFC,0x14,0x1F,0xBE,0xCA,0xA6,
+                0x28,0x7C,0x59,0x47,0x4E,0x6B,0xC0,0x5D,0x99,0xB2,0x96,0x4F,
+                0xA0,0x90,0xC3,0xA2,0x23,0x3B,0xA1,0x86,0x51,0x5B,0xE7,0xED,
+                0x1F,0x61,0x29,0x70,0xCE,0xE2,0xD7,0xAF,0xB8,0x1B,0xDD,0x76,
+                0x21,0x70,0x48,0x1C,0xD0,0x06,0x91,0x27,0xD5,0xB0,0x5A,0xA9,
+                0x93,0xB4,0xEA,0x98,0x8D,0x8F,0xDD,0xC1,0x86,0xFF,0xB7,0xDC,
+                0x90,0xA6,0xC0,0x8F,0x4D,0xF4,0x35,0xC9,0x34,0x02,0x84,0x92,
+                0x36,0xC3,0xFA,0xB4,0xD2,0x7C,0x70,0x26,0xC1,0xD4,0xDC,0xB2,
+                0x60,0x26,0x46,0xDE,0xC9,0x75,0x1E,0x76,0x3D,0xBA,0x37,0xBD,
+                0xF8,0xFF,0x94,0x06,0xAD,0x9E,0x53,0x0E,0xE5,0xDB,0x38,0x2F,
+                0x41,0x30,0x01,0xAE,0xB0,0x6A,0x53,0xED,0x90,0x27,0xD8,0x31,
+                0x17,0x97,0x27,0xB0,0x86,0x5A,0x89,0x18,0xDA,0x3E,0xDB,0xEB,
+                0xCF,0x9B,0x14,0xED,0x44,0xCE,0x6C,0xBA,0xCE,0xD4,0xBB,0x1B,
+                0xDB,0x7F,0x14,0x47,0xE6,0xCC,0x25,0x4B,0x33,0x20,0x51,0x51,
+                0x2B,0xD7,0xAF,0x42,0x6F,0xB8,0xF4,0x01,0x37,0x8C,0xD2,0xBF,
+                0x59,0x83,0xCA,0x01,0xC6,0x4B,0x92,0xEC,0xF0,0x32,0xEA,0x15,
+                0xD1,0x72,0x1D,0x03,0xF4,0x82,0xD7,0xCE,0x6E,0x74,0xFE,0xF6,
+                0xD5,0x5E,0x70,0x2F,0x46,0x98,0x0C,0x82,0xB5,0xA8,0x40,0x31,
+                0x90,0x0B,0x1C,0x9E,0x59,0xE7,0xC9,0x7F,0xBE,0xC7,0xE8,0xF3,
+                0x23,0xA9,0x7A,0x7E,0x36,0xCC,0x88,0xBE,0x0F,0x1D,0x45,0xB7,
+                0xFF,0x58,0x5A,0xC5,0x4B,0xD4,0x07,0xB2,0x2B,0x41,0x54,0xAA,
+                0xCC,0x8F,0x6D,0x7E,0xBF,0x48,0xE1,0xD8,0x14,0xCC,0x5E,0xD2,
+                0x0F,0x80,0x37,0xE0,0xA7,0x97,0x15,0xEE,0xF2,0x9B,0xE3,0x28,
+                0x06,0xA1,0xD5,0x8B,0xB7,0xC5,0xDA,0x76,0xF5,0x50,0xAA,0x3D,
+                0x8A,0x1F,0xBF,0xF0,0xEB,0x19,0xCC,0xB1,0xA3,0x13,0xD5,0x5C,
+                0xDA,0x56,0xC9,0xEC,0x2E,0xF2,0x96,0x32,0x38,0x7F,0xE8,0xD7,
+                0x6E,0x3C,0x04,0x68,0x04,0x3E,0x8F,0x66,0x3F,0x48,0x60,0xEE,
+                0x12,0xBF,0x2D,0x5B,0x0B,0x74,0x74,0xD6,0xE6,0x94,0xF9,0x1E,
+                0x6D,0xBE,0x11,0x59,0x74,0xA3,0x92,0x6F,0x12,0xFE,0xE5,0xE4,
+                0x38,0x77,0x7C,0xB6,0xA9,0x32,0xDF,0x8C,0xD8,0xBE,0xC4,0xD0,
+                0x73,0xB9,0x31,0xBA,0x3B,0xC8,0x32,0xB6,0x8D,0x9D,0xD3,0x00,
+                0x74,0x1F,0xA7,0xBF,0x8A,0xFC,0x47,0xED,0x25,0x76,0xF6,0x93,
+                0x6B,0xA4,0x24,0x66,0x3A,0xAB,0x63,0x9C,0x5A,0xE4,0xF5,0x68,
+                0x34,0x23,0xB4,0x74,0x2B,0xF1,0xC9,0x78,0x23,0x8F,0x16,0xCB,
+                0xE3,0x9D,0x65,0x2D,0xE3,0xFD,0xB8,0xBE,0xFC,0x84,0x8A,0xD9,
+                0x22,0x22,0x2E,0x04,0xA4,0x03,0x7C,0x07,0x13,0xEB,0x57,0xA8,
+                0x1A,0x23,0xF0,0xC7,0x34,0x73,0xFC,0x64,0x6C,0xEA,0x30,0x6B,
+                0x4B,0xCB,0xC8,0x86,0x2F,0x83,0x85,0xDD,0xFA,0x9D,0x4B,0x7F,
+                0xA2,0xC0,0x87,0xE8,0x79,0x68,0x33,0x03,0xED,0x5B,0xDD,0x3A,
+                0x06,0x2B,0x3C,0xF5,0xB3,0xA2,0x78,0xA6,0x6D,0x2A,0x13,0xF8,
+                0x3F,0x44,0xF8,0x2D,0xDF,0x31,0x0E,0xE0,0x74,0xAB,0x6A,0x36,
+                0x45,0x97,0xE8,0x99,0xA0,0x25,0x5D,0xC1,0x64,0xF3,0x1C,0xC5,
+                0x08,0x46,0x85,0x1D,0xF9,0xAB,0x48,0x19,0x5D,0xED,0x7E,0xA1,
+                0xB1,0xD5,0x10,0xBD,0x7E,0xE7,0x4D,0x73,0xFA,0xF3,0x6B,0xC3,
+                0x1E,0xCF,0xA2,0x68,0x35,0x90,0x46,0xF4,0xEB,0x87,0x9F,0x92,
+                0x40,0x09,0x43,0x8B,0x48,0x1C,0x6C,0xD7,0x88,0x9A,0x00,0x2E,
+                0xD5,0xEE,0x38,0x2B,0xC9,0x19,0x0D,0xA6,0xFC,0x02,0x6E,0x47,
+                0x95,0x58,0xE4,0x47,0x56,0x77,0xE9,0xAA,0x9E,0x30,0x50,0xE2,
+                0x76,0x56,0x94,0xDF,0xC8,0x1F,0x56,0xE8,0x80,0xB9,0x6E,0x71,
+                0x60,0xC9,0x80,0xDD,0x98,0xED,0xD3,0xDF,0xFF,0xFF,0xFF,0xFF,
+                0xFF,0xFF,0xFF,0xFF,
+                };
+        return BN_bin2bn(RFC3526_PRIME_8192,sizeof(RFC3526_PRIME_8192),bn);
+        }
+
diff --git a/src/lib/libssl/src/crypto/bn/bn_depr.c b/src/lib/libssl/src/crypto/bn/bn_depr.c
new file mode 100644
index 0000000000..27535e4fca
--- /dev/null
+++ b/src/lib/libssl/src/crypto/bn/bn_depr.c
@@ -0,0 +1,112 @@
+/* crypto/bn/bn_depr.c */
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* Support for deprecated functions goes here - static linkage will only slurp
+ * this code if applications are using them directly. */
+
+#include <stdio.h>
+#include <time.h>
+#include "cryptlib.h"
+#include "bn_lcl.h"
+#include <openssl/rand.h>
+
+static void *dummy=&dummy;
+
+#ifndef OPENSSL_NO_DEPRECATED
+BIGNUM *BN_generate_prime(BIGNUM *ret, int bits, int safe,
+        const BIGNUM *add, const BIGNUM *rem,
+        void (*callback)(int,int,void *), void *cb_arg)
+        {
+        BN_GENCB cb;
+        BIGNUM *rnd=NULL;
+        int found = 0;
+
+        BN_GENCB_set_old(&cb, callback, cb_arg);
+
+        if (ret == NULL)
+                {
+                if ((rnd=BN_new()) == NULL) goto err;
+                }
+        else
+                rnd=ret;
+        if(!BN_generate_prime_ex(rnd, bits, safe, add, rem, &cb))
+                goto err;
+
+        /* we have a prime :-) */
+        found = 1;
+err:
+        if (!found && (ret == NULL) && (rnd != NULL)) BN_free(rnd);
+        return(found ? rnd : NULL);
+        }
+
+int BN_is_prime(const BIGNUM *a, int checks, void (*callback)(int,int,void *),
+        BN_CTX *ctx_passed, void *cb_arg)
+        {
+        BN_GENCB cb;
+        BN_GENCB_set_old(&cb, callback, cb_arg);
+        return BN_is_prime_ex(a, checks, ctx_passed, &cb);
+        }
+
+int BN_is_prime_fasttest(const BIGNUM *a, int checks,
+                void (*callback)(int,int,void *),
+                BN_CTX *ctx_passed, void *cb_arg,
+                int do_trial_division)
+        {
+        BN_GENCB cb;
+        BN_GENCB_set_old(&cb, callback, cb_arg);
+        return BN_is_prime_fasttest_ex(a, checks, ctx_passed,
+                                do_trial_division, &cb);
+        }
+#endif
diff --git a/src/lib/libssl/src/crypto/bn/bn_gf2m.c b/src/lib/libssl/src/crypto/bn/bn_gf2m.c
new file mode 100644
index 0000000000..6a793857e1
--- /dev/null
+++ b/src/lib/libssl/src/crypto/bn/bn_gf2m.c
@@ -0,0 +1,1091 @@
+/* crypto/bn/bn_gf2m.c */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
+ * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
+ * to the OpenSSL project.
+ *
+ * The ECC Code is licensed pursuant to the OpenSSL open source
+ * license provided below.
+ *
+ * In addition, Sun covenants to all licensees who provide a reciprocal
+ * covenant with respect to their own patents if any, not to sue under
+ * current and future patent claims necessarily infringed by the making,
+ * using, practicing, selling, offering for sale and/or otherwise
+ * disposing of the ECC Code as delivered hereunder (or portions thereof),
+ * provided that such covenant shall not apply:
+ *  1) for code that a licensee deletes from the ECC Code;
+ *  2) separates from the ECC Code; or
+ *  3) for infringements caused by:
+ *       i) the modification of the ECC Code or
+ *      ii) the combination of the ECC Code with other software or
+ *          devices where such combination causes the infringement.
+ *
+ * The software is originally written by Sheueling Chang Shantz and
+ * Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
+
+/* NOTE: This file is licensed pursuant to the OpenSSL license below
+ * and may be modified; but after modifications, the above covenant
+ * may no longer apply!  In such cases, the corresponding paragraph
+ * ["In addition, Sun covenants ... causes the infringement."] and
+ * this note can be edited out; but please keep the Sun copyright
+ * notice and attribution. */
+
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <assert.h>
+#include <limits.h>
+#include <stdio.h>
+#include "cryptlib.h"
+#include "bn_lcl.h"
+
+/* Maximum number of iterations before BN_GF2m_mod_solve_quad_arr should fail. */
+#define MAX_ITERATIONS 50
+
+static const BN_ULONG SQR_tb[16] =
+  {     0,     1,     4,     5,    16,    17,    20,    21,
+       64,    65,    68,    69,    80,    81,    84,    85 };
+/* Platform-specific macros to accelerate squaring. */
+#if defined(SIXTY_FOUR_BIT) || defined(SIXTY_FOUR_BIT_LONG)
+#define SQR1(w) \
+    SQR_tb[(w) >> 60 & 0xF] << 56 | SQR_tb[(w) >> 56 & 0xF] << 48 | \
+    SQR_tb[(w) >> 52 & 0xF] << 40 | SQR_tb[(w) >> 48 & 0xF] << 32 | \
+    SQR_tb[(w) >> 44 & 0xF] << 24 | SQR_tb[(w) >> 40 & 0xF] << 16 | \
+    SQR_tb[(w) >> 36 & 0xF] <<  8 | SQR_tb[(w) >> 32 & 0xF]
+#define SQR0(w) \
+    SQR_tb[(w) >> 28 & 0xF] << 56 | SQR_tb[(w) >> 24 & 0xF] << 48 | \
+    SQR_tb[(w) >> 20 & 0xF] << 40 | SQR_tb[(w) >> 16 & 0xF] << 32 | \
+    SQR_tb[(w) >> 12 & 0xF] << 24 | SQR_tb[(w) >>  8 & 0xF] << 16 | \
+    SQR_tb[(w) >>  4 & 0xF] <<  8 | SQR_tb[(w)       & 0xF]
+#endif
+#ifdef THIRTY_TWO_BIT
+#define SQR1(w) \
+    SQR_tb[(w) >> 28 & 0xF] << 24 | SQR_tb[(w) >> 24 & 0xF] << 16 | \
+    SQR_tb[(w) >> 20 & 0xF] <<  8 | SQR_tb[(w) >> 16 & 0xF]
+#define SQR0(w) \
+    SQR_tb[(w) >> 12 & 0xF] << 24 | SQR_tb[(w) >>  8 & 0xF] << 16 | \
+    SQR_tb[(w) >>  4 & 0xF] <<  8 | SQR_tb[(w)       & 0xF]
+#endif
+#ifdef SIXTEEN_BIT
+#define SQR1(w) \
+    SQR_tb[(w) >> 12 & 0xF] <<  8 | SQR_tb[(w) >>  8 & 0xF]
+#define SQR0(w) \
+    SQR_tb[(w) >>  4 & 0xF] <<  8 | SQR_tb[(w)       & 0xF]
+#endif
+#ifdef EIGHT_BIT
+#define SQR1(w) \
+    SQR_tb[(w) >>  4 & 0xF]
+#define SQR0(w) \
+    SQR_tb[(w)       & 15]
+#endif
+
+/* Product of two polynomials a, b each with degree < BN_BITS2 - 1,
+ * result is a polynomial r with degree < 2 * BN_BITS - 1
+ * The caller MUST ensure that the variables have the right amount
+ * of space allocated.
+ */
+#ifdef EIGHT_BIT
+static void bn_GF2m_mul_1x1(BN_ULONG *r1, BN_ULONG *r0, const BN_ULONG a, const BN_ULONG b)
+        {
+        register BN_ULONG h, l, s;
+        BN_ULONG tab[4], top1b = a >> 7;
+        register BN_ULONG a1, a2;
+
+        a1 = a & (0x7F); a2 = a1 << 1;
+
+        tab[0] = 0; tab[1] = a1; tab[2] = a2; tab[3] = a1^a2;
+
+        s = tab[b      & 0x3]; l  = s;
+        s = tab[b >> 2 & 0x3]; l ^= s << 2; h  = s >> 6;
+        s = tab[b >> 4 & 0x3]; l ^= s << 4; h ^= s >> 4;
+        s = tab[b >> 6      ]; l ^= s << 6; h ^= s >> 2;
+        
+        /* compensate for the top bit of a */
+
+        if (top1b & 01) { l ^= b << 7; h ^= b >> 1; } 
+
+        *r1 = h; *r0 = l;
+        } 
+#endif
+#ifdef SIXTEEN_BIT
+static void bn_GF2m_mul_1x1(BN_ULONG *r1, BN_ULONG *r0, const BN_ULONG a, const BN_ULONG b)
+        {
+        register BN_ULONG h, l, s;
+        BN_ULONG tab[4], top1b = a >> 15; 
+        register BN_ULONG a1, a2;
+
+        a1 = a & (0x7FFF); a2 = a1 << 1;
+
+        tab[0] = 0; tab[1] = a1; tab[2] = a2; tab[3] = a1^a2;
+
+        s = tab[b      & 0x3]; l  = s;
+        s = tab[b >> 2 & 0x3]; l ^= s <<  2; h  = s >> 14;
+        s = tab[b >> 4 & 0x3]; l ^= s <<  4; h ^= s >> 12;
+        s = tab[b >> 6 & 0x3]; l ^= s <<  6; h ^= s >> 10;
+        s = tab[b >> 8 & 0x3]; l ^= s <<  8; h ^= s >>  8;
+        s = tab[b >>10 & 0x3]; l ^= s << 10; h ^= s >>  6;
+        s = tab[b >>12 & 0x3]; l ^= s << 12; h ^= s >>  4;
+        s = tab[b >>14      ]; l ^= s << 14; h ^= s >>  2;
+
+        /* compensate for the top bit of a */
+
+        if (top1b & 01) { l ^= b << 15; h ^= b >> 1; } 
+
+        *r1 = h; *r0 = l;
+        } 
+#endif
+#ifdef THIRTY_TWO_BIT
+static void bn_GF2m_mul_1x1(BN_ULONG *r1, BN_ULONG *r0, const BN_ULONG a, const BN_ULONG b)
+        {
+        register BN_ULONG h, l, s;
+        BN_ULONG tab[8], top2b = a >> 30; 
+        register BN_ULONG a1, a2, a4;
+
+        a1 = a & (0x3FFFFFFF); a2 = a1 << 1; a4 = a2 << 1;
+
+        tab[0] =  0; tab[1] = a1;    tab[2] = a2;    tab[3] = a1^a2;
+        tab[4] = a4; tab[5] = a1^a4; tab[6] = a2^a4; tab[7] = a1^a2^a4;
+
+        s = tab[b       & 0x7]; l  = s;
+        s = tab[b >>  3 & 0x7]; l ^= s <<  3; h  = s >> 29;
+        s = tab[b >>  6 & 0x7]; l ^= s <<  6; h ^= s >> 26;
+        s = tab[b >>  9 & 0x7]; l ^= s <<  9; h ^= s >> 23;
+        s = tab[b >> 12 & 0x7]; l ^= s << 12; h ^= s >> 20;
+        s = tab[b >> 15 & 0x7]; l ^= s << 15; h ^= s >> 17;
+        s = tab[b >> 18 & 0x7]; l ^= s << 18; h ^= s >> 14;
+        s = tab[b >> 21 & 0x7]; l ^= s << 21; h ^= s >> 11;
+        s = tab[b >> 24 & 0x7]; l ^= s << 24; h ^= s >>  8;
+        s = tab[b >> 27 & 0x7]; l ^= s << 27; h ^= s >>  5;
+        s = tab[b >> 30      ]; l ^= s << 30; h ^= s >>  2;
+
+        /* compensate for the top two bits of a */
+
+        if (top2b & 01) { l ^= b << 30; h ^= b >> 2; } 
+        if (top2b & 02) { l ^= b << 31; h ^= b >> 1; } 
+
+        *r1 = h; *r0 = l;
+        } 
+#endif
+#if defined(SIXTY_FOUR_BIT) || defined(SIXTY_FOUR_BIT_LONG)
+static void bn_GF2m_mul_1x1(BN_ULONG *r1, BN_ULONG *r0, const BN_ULONG a, const BN_ULONG b)
+        {
+        register BN_ULONG h, l, s;
+        BN_ULONG tab[16], top3b = a >> 61;
+        register BN_ULONG a1, a2, a4, a8;
+
+        a1 = a & (0x1FFFFFFFFFFFFFFFULL); a2 = a1 << 1; a4 = a2 << 1; a8 = a4 << 1;
+
+        tab[ 0] = 0;     tab[ 1] = a1;       tab[ 2] = a2;       tab[ 3] = a1^a2;
+        tab[ 4] = a4;    tab[ 5] = a1^a4;    tab[ 6] = a2^a4;    tab[ 7] = a1^a2^a4;
+        tab[ 8] = a8;    tab[ 9] = a1^a8;    tab[10] = a2^a8;    tab[11] = a1^a2^a8;
+        tab[12] = a4^a8; tab[13] = a1^a4^a8; tab[14] = a2^a4^a8; tab[15] = a1^a2^a4^a8;
+
+        s = tab[b       & 0xF]; l  = s;
+        s = tab[b >>  4 & 0xF]; l ^= s <<  4; h  = s >> 60;
+        s = tab[b >>  8 & 0xF]; l ^= s <<  8; h ^= s >> 56;
+        s = tab[b >> 12 & 0xF]; l ^= s << 12; h ^= s >> 52;
+        s = tab[b >> 16 & 0xF]; l ^= s << 16; h ^= s >> 48;
+        s = tab[b >> 20 & 0xF]; l ^= s << 20; h ^= s >> 44;
+        s = tab[b >> 24 & 0xF]; l ^= s << 24; h ^= s >> 40;
+        s = tab[b >> 28 & 0xF]; l ^= s << 28; h ^= s >> 36;
+        s = tab[b >> 32 & 0xF]; l ^= s << 32; h ^= s >> 32;
+        s = tab[b >> 36 & 0xF]; l ^= s << 36; h ^= s >> 28;
+        s = tab[b >> 40 & 0xF]; l ^= s << 40; h ^= s >> 24;
+        s = tab[b >> 44 & 0xF]; l ^= s << 44; h ^= s >> 20;
+        s = tab[b >> 48 & 0xF]; l ^= s << 48; h ^= s >> 16;
+        s = tab[b >> 52 & 0xF]; l ^= s << 52; h ^= s >> 12;
+        s = tab[b >> 56 & 0xF]; l ^= s << 56; h ^= s >>  8;
+        s = tab[b >> 60      ]; l ^= s << 60; h ^= s >>  4;
+
+        /* compensate for the top three bits of a */
+
+        if (top3b & 01) { l ^= b << 61; h ^= b >> 3; } 
+        if (top3b & 02) { l ^= b << 62; h ^= b >> 2; } 
+        if (top3b & 04) { l ^= b << 63; h ^= b >> 1; } 
+
+        *r1 = h; *r0 = l;
+        } 
+#endif
+
+/* Product of two polynomials a, b each with degree < 2 * BN_BITS2 - 1,
+ * result is a polynomial r with degree < 4 * BN_BITS2 - 1
+ * The caller MUST ensure that the variables have the right amount
+ * of space allocated.
+ */
+static void bn_GF2m_mul_2x2(BN_ULONG *r, const BN_ULONG a1, const BN_ULONG a0, const BN_ULONG b1, const BN_ULONG b0)
+        {
+        BN_ULONG m1, m0;
+        /* r[3] = h1, r[2] = h0; r[1] = l1; r[0] = l0 */
+        bn_GF2m_mul_1x1(r+3, r+2, a1, b1);
+        bn_GF2m_mul_1x1(r+1, r, a0, b0);
+        bn_GF2m_mul_1x1(&m1, &m0, a0 ^ a1, b0 ^ b1);
+        /* Correction on m1 ^= l1 ^ h1; m0 ^= l0 ^ h0; */
+        r[2] ^= m1 ^ r[1] ^ r[3];  /* h0 ^= m1 ^ l1 ^ h1; */
+        r[1] = r[3] ^ r[2] ^ r[0] ^ m1 ^ m0;  /* l1 ^= l0 ^ h0 ^ m0; */
+        }
+
+
+/* Add polynomials a and b and store result in r; r could be a or b, a and b 
+ * could be equal; r is the bitwise XOR of a and b.
+ */
+int     BN_GF2m_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
+        {
+        int i;
+        const BIGNUM *at, *bt;
+
+        bn_check_top(a);
+        bn_check_top(b);
+
+        if (a->top < b->top) { at = b; bt = a; }
+        else { at = a; bt = b; }
+
+        bn_wexpand(r, at->top);
+
+        for (i = 0; i < bt->top; i++)
+                {
+                r->d[i] = at->d[i] ^ bt->d[i];
+                }
+        for (; i < at->top; i++)
+                {
+                r->d[i] = at->d[i];
+                }
+        
+        r->top = at->top;
+        bn_correct_top(r);
+        
+        return 1;
+        }
+
+
+/* Some functions allow for representation of the irreducible polynomials
+ * as an int[], say p.  The irreducible f(t) is then of the form:
+ *     t^p[0] + t^p[1] + ... + t^p[k]
+ * where m = p[0] > p[1] > ... > p[k] = 0.
+ */
+
+
+/* Performs modular reduction of a and store result in r.  r could be a. */
+int BN_GF2m_mod_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[])
+        {
+        int j, k;
+        int n, dN, d0, d1;
+        BN_ULONG zz, *z;
+
+        bn_check_top(a);
+
+        if (!p[0])
+                {
+                /* reduction mod 1 => return 0 */
+                BN_zero(r);
+                return 1;
+                }
+
+        /* Since the algorithm does reduction in the r value, if a != r, copy
+         * the contents of a into r so we can do reduction in r. 
+         */
+        if (a != r)
+                {
+                if (!bn_wexpand(r, a->top)) return 0;
+                for (j = 0; j < a->top; j++)
+                        {
+                        r->d[j] = a->d[j];
+                        }
+                r->top = a->top;
+                }
+        z = r->d;
+
+        /* start reduction */
+        dN = p[0] / BN_BITS2;  
+        for (j = r->top - 1; j > dN;)
+                {
+                zz = z[j];
+                if (z[j] == 0) { j--; continue; }
+                z[j] = 0;
+
+                for (k = 1; p[k] != 0; k++)
+                        {
+                        /* reducing component t^p[k] */
+                        n = p[0] - p[k];
+                        d0 = n % BN_BITS2;  d1 = BN_BITS2 - d0;
+                        n /= BN_BITS2; 
+                        z[j-n] ^= (zz>>d0);
+                        if (d0) z[j-n-1] ^= (zz<<d1);
+                        }
+
+                /* reducing component t^0 */
+                n = dN;  
+                d0 = p[0] % BN_BITS2;
+                d1 = BN_BITS2 - d0;
+                z[j-n] ^= (zz >> d0);
+                if (d0) z[j-n-1] ^= (zz << d1);
+                }
+
+        /* final round of reduction */
+        while (j == dN)
+                {
+
+                d0 = p[0] % BN_BITS2;
+                zz = z[dN] >> d0;
+                if (zz == 0) break;
+                d1 = BN_BITS2 - d0;
+                
+                if (d0) z[dN] = (z[dN] << d1) >> d1; /* clear up the top d1 bits */
+                z[0] ^= zz; /* reduction t^0 component */
+
+                for (k = 1; p[k] != 0; k++)
+                        {
+                        BN_ULONG tmp_ulong;
+
+                        /* reducing component t^p[k]*/
+                        n = p[k] / BN_BITS2;   
+                        d0 = p[k] % BN_BITS2;
+                        d1 = BN_BITS2 - d0;
+                        z[n] ^= (zz << d0);
+                        tmp_ulong = zz >> d1;
+                        if (d0 && tmp_ulong)
+                                z[n+1] ^= tmp_ulong;
+                        }
+
+                
+                }
+
+        bn_correct_top(r);
+        return 1;
+        }
+
+/* Performs modular reduction of a by p and store result in r.  r could be a.
+ *
+ * This function calls down to the BN_GF2m_mod_arr implementation; this wrapper
+ * function is only provided for convenience; for best performance, use the 
+ * BN_GF2m_mod_arr function.
+ */
+int     BN_GF2m_mod(BIGNUM *r, const BIGNUM *a, const BIGNUM *p)
+        {
+        int ret = 0;
+        const int max = BN_num_bits(p);
+        unsigned int *arr=NULL;
+        bn_check_top(a);
+        bn_check_top(p);
+        if ((arr = (unsigned int *)OPENSSL_malloc(sizeof(unsigned int) * max)) == NULL) goto err;
+        ret = BN_GF2m_poly2arr(p, arr, max);
+        if (!ret || ret > max)
+                {
+                BNerr(BN_F_BN_GF2M_MOD,BN_R_INVALID_LENGTH);
+                goto err;
+                }
+        ret = BN_GF2m_mod_arr(r, a, arr);
+        bn_check_top(r);
+err:
+        if (arr) OPENSSL_free(arr);
+        return ret;
+        }
+
+
+/* Compute the product of two polynomials a and b, reduce modulo p, and store
+ * the result in r.  r could be a or b; a could be b.
+ */
+int     BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const unsigned int p[], BN_CTX *ctx)
+        {
+        int zlen, i, j, k, ret = 0;
+        BIGNUM *s;
+        BN_ULONG x1, x0, y1, y0, zz[4];
+
+        bn_check_top(a);
+        bn_check_top(b);
+
+        if (a == b)
+                {
+                return BN_GF2m_mod_sqr_arr(r, a, p, ctx);
+                }
+
+        BN_CTX_start(ctx);
+        if ((s = BN_CTX_get(ctx)) == NULL) goto err;
+        
+        zlen = a->top + b->top + 4;
+        if (!bn_wexpand(s, zlen)) goto err;
+        s->top = zlen;
+
+        for (i = 0; i < zlen; i++) s->d[i] = 0;
+
+        for (j = 0; j < b->top; j += 2)
+                {
+                y0 = b->d[j];
+                y1 = ((j+1) == b->top) ? 0 : b->d[j+1];
+                for (i = 0; i < a->top; i += 2)
+                        {
+                        x0 = a->d[i];
+                        x1 = ((i+1) == a->top) ? 0 : a->d[i+1];
+                        bn_GF2m_mul_2x2(zz, x1, x0, y1, y0);
+                        for (k = 0; k < 4; k++) s->d[i+j+k] ^= zz[k];
+                        }
+                }
+
+        bn_correct_top(s);
+        if (BN_GF2m_mod_arr(r, s, p))
+                ret = 1;
+        bn_check_top(r);
+
+err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+
+/* Compute the product of two polynomials a and b, reduce modulo p, and store
+ * the result in r.  r could be a or b; a could equal b.
+ *
+ * This function calls down to the BN_GF2m_mod_mul_arr implementation; this wrapper
+ * function is only provided for convenience; for best performance, use the 
+ * BN_GF2m_mod_mul_arr function.
+ */
+int     BN_GF2m_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *p, BN_CTX *ctx)
+        {
+        int ret = 0;
+        const int max = BN_num_bits(p);
+        unsigned int *arr=NULL;
+        bn_check_top(a);
+        bn_check_top(b);
+        bn_check_top(p);
+        if ((arr = (unsigned int *)OPENSSL_malloc(sizeof(unsigned int) * max)) == NULL) goto err;
+        ret = BN_GF2m_poly2arr(p, arr, max);
+        if (!ret || ret > max)
+                {
+                BNerr(BN_F_BN_GF2M_MOD_MUL,BN_R_INVALID_LENGTH);
+                goto err;
+                }
+        ret = BN_GF2m_mod_mul_arr(r, a, b, arr, ctx);
+        bn_check_top(r);
+err:
+        if (arr) OPENSSL_free(arr);
+        return ret;
+        }
+
+
+/* Square a, reduce the result mod p, and store it in a.  r could be a. */
+int     BN_GF2m_mod_sqr_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[], BN_CTX *ctx)
+        {
+        int i, ret = 0;
+        BIGNUM *s;
+
+        bn_check_top(a);
+        BN_CTX_start(ctx);
+        if ((s = BN_CTX_get(ctx)) == NULL) return 0;
+        if (!bn_wexpand(s, 2 * a->top)) goto err;
+
+        for (i = a->top - 1; i >= 0; i--)
+                {
+                s->d[2*i+1] = SQR1(a->d[i]);
+                s->d[2*i  ] = SQR0(a->d[i]);
+                }
+
+        s->top = 2 * a->top;
+        bn_correct_top(s);
+        if (!BN_GF2m_mod_arr(r, s, p)) goto err;
+        bn_check_top(r);
+        ret = 1;
+err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+
+/* Square a, reduce the result mod p, and store it in a.  r could be a.
+ *
+ * This function calls down to the BN_GF2m_mod_sqr_arr implementation; this wrapper
+ * function is only provided for convenience; for best performance, use the 
+ * BN_GF2m_mod_sqr_arr function.
+ */
+int     BN_GF2m_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
+        {
+        int ret = 0;
+        const int max = BN_num_bits(p);
+        unsigned int *arr=NULL;
+
+        bn_check_top(a);
+        bn_check_top(p);
+        if ((arr = (unsigned int *)OPENSSL_malloc(sizeof(unsigned int) * max)) == NULL) goto err;
+        ret = BN_GF2m_poly2arr(p, arr, max);
+        if (!ret || ret > max)
+                {
+                BNerr(BN_F_BN_GF2M_MOD_SQR,BN_R_INVALID_LENGTH);
+                goto err;
+                }
+        ret = BN_GF2m_mod_sqr_arr(r, a, arr, ctx);
+        bn_check_top(r);
+err:
+        if (arr) OPENSSL_free(arr);
+        return ret;
+        }
+
+
+/* Invert a, reduce modulo p, and store the result in r. r could be a. 
+ * Uses Modified Almost Inverse Algorithm (Algorithm 10) from
+ *     Hankerson, D., Hernandez, J.L., and Menezes, A.  "Software Implementation
+ *     of Elliptic Curve Cryptography Over Binary Fields".
+ */
+int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
+        {
+        BIGNUM *b, *c, *u, *v, *tmp;
+        int ret = 0;
+
+        bn_check_top(a);
+        bn_check_top(p);
+
+        BN_CTX_start(ctx);
+        
+        b = BN_CTX_get(ctx);
+        c = BN_CTX_get(ctx);
+        u = BN_CTX_get(ctx);
+        v = BN_CTX_get(ctx);
+        if (v == NULL) goto err;
+
+        if (!BN_one(b)) goto err;
+        if (!BN_GF2m_mod(u, a, p)) goto err;
+        if (!BN_copy(v, p)) goto err;
+
+        if (BN_is_zero(u)) goto err;
+
+        while (1)
+                {
+                while (!BN_is_odd(u))
+                        {
+                        if (!BN_rshift1(u, u)) goto err;
+                        if (BN_is_odd(b))
+                                {
+                                if (!BN_GF2m_add(b, b, p)) goto err;
+                                }
+                        if (!BN_rshift1(b, b)) goto err;
+                        }
+
+                if (BN_abs_is_word(u, 1)) break;
+
+                if (BN_num_bits(u) < BN_num_bits(v))
+                        {
+                        tmp = u; u = v; v = tmp;
+                        tmp = b; b = c; c = tmp;
+                        }
+                
+                if (!BN_GF2m_add(u, u, v)) goto err;
+                if (!BN_GF2m_add(b, b, c)) goto err;
+                }
+
+
+        if (!BN_copy(r, b)) goto err;
+        bn_check_top(r);
+        ret = 1;
+
+err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+
+/* Invert xx, reduce modulo p, and store the result in r. r could be xx. 
+ *
+ * This function calls down to the BN_GF2m_mod_inv implementation; this wrapper
+ * function is only provided for convenience; for best performance, use the 
+ * BN_GF2m_mod_inv function.
+ */
+int BN_GF2m_mod_inv_arr(BIGNUM *r, const BIGNUM *xx, const unsigned int p[], BN_CTX *ctx)
+        {
+        BIGNUM *field;
+        int ret = 0;
+
+        bn_check_top(xx);
+        BN_CTX_start(ctx);
+        if ((field = BN_CTX_get(ctx)) == NULL) goto err;
+        if (!BN_GF2m_arr2poly(p, field)) goto err;
+        
+        ret = BN_GF2m_mod_inv(r, xx, field, ctx);
+        bn_check_top(r);
+
+err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+
+
+#ifndef OPENSSL_SUN_GF2M_DIV
+/* Divide y by x, reduce modulo p, and store the result in r. r could be x 
+ * or y, x could equal y.
+ */
+int BN_GF2m_mod_div(BIGNUM *r, const BIGNUM *y, const BIGNUM *x, const BIGNUM *p, BN_CTX *ctx)
+        {
+        BIGNUM *xinv = NULL;
+        int ret = 0;
+
+        bn_check_top(y);
+        bn_check_top(x);
+        bn_check_top(p);
+
+        BN_CTX_start(ctx);
+        xinv = BN_CTX_get(ctx);
+        if (xinv == NULL) goto err;
+        
+        if (!BN_GF2m_mod_inv(xinv, x, p, ctx)) goto err;
+        if (!BN_GF2m_mod_mul(r, y, xinv, p, ctx)) goto err;
+        bn_check_top(r);
+        ret = 1;
+
+err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+#else
+/* Divide y by x, reduce modulo p, and store the result in r. r could be x 
+ * or y, x could equal y.
+ * Uses algorithm Modular_Division_GF(2^m) from 
+ *     Chang-Shantz, S.  "From Euclid's GCD to Montgomery Multiplication to 
+ *     the Great Divide".
+ */
+int BN_GF2m_mod_div(BIGNUM *r, const BIGNUM *y, const BIGNUM *x, const BIGNUM *p, BN_CTX *ctx)
+        {
+        BIGNUM *a, *b, *u, *v;
+        int ret = 0;
+
+        bn_check_top(y);
+        bn_check_top(x);
+        bn_check_top(p);
+
+        BN_CTX_start(ctx);
+        
+        a = BN_CTX_get(ctx);
+        b = BN_CTX_get(ctx);
+        u = BN_CTX_get(ctx);
+        v = BN_CTX_get(ctx);
+        if (v == NULL) goto err;
+
+        /* reduce x and y mod p */
+        if (!BN_GF2m_mod(u, y, p)) goto err;
+        if (!BN_GF2m_mod(a, x, p)) goto err;
+        if (!BN_copy(b, p)) goto err;
+        
+        while (!BN_is_odd(a))
+                {
+                if (!BN_rshift1(a, a)) goto err;
+                if (BN_is_odd(u)) if (!BN_GF2m_add(u, u, p)) goto err;
+                if (!BN_rshift1(u, u)) goto err;
+                }
+
+        do
+                {
+                if (BN_GF2m_cmp(b, a) > 0)
+                        {
+                        if (!BN_GF2m_add(b, b, a)) goto err;
+                        if (!BN_GF2m_add(v, v, u)) goto err;
+                        do
+                                {
+                                if (!BN_rshift1(b, b)) goto err;
+                                if (BN_is_odd(v)) if (!BN_GF2m_add(v, v, p)) goto err;
+                                if (!BN_rshift1(v, v)) goto err;
+                                } while (!BN_is_odd(b));
+                        }
+                else if (BN_abs_is_word(a, 1))
+                        break;
+                else
+                        {
+                        if (!BN_GF2m_add(a, a, b)) goto err;
+                        if (!BN_GF2m_add(u, u, v)) goto err;
+                        do
+                                {
+                                if (!BN_rshift1(a, a)) goto err;
+                                if (BN_is_odd(u)) if (!BN_GF2m_add(u, u, p)) goto err;
+                                if (!BN_rshift1(u, u)) goto err;
+                                } while (!BN_is_odd(a));
+                        }
+                } while (1);
+
+        if (!BN_copy(r, u)) goto err;
+        bn_check_top(r);
+        ret = 1;
+
+err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+#endif
+
+/* Divide yy by xx, reduce modulo p, and store the result in r. r could be xx 
+ * or yy, xx could equal yy.
+ *
+ * This function calls down to the BN_GF2m_mod_div implementation; this wrapper
+ * function is only provided for convenience; for best performance, use the 
+ * BN_GF2m_mod_div function.
+ */
+int BN_GF2m_mod_div_arr(BIGNUM *r, const BIGNUM *yy, const BIGNUM *xx, const unsigned int p[], BN_CTX *ctx)
+        {
+        BIGNUM *field;
+        int ret = 0;
+
+        bn_check_top(yy);
+        bn_check_top(xx);
+
+        BN_CTX_start(ctx);
+        if ((field = BN_CTX_get(ctx)) == NULL) goto err;
+        if (!BN_GF2m_arr2poly(p, field)) goto err;
+        
+        ret = BN_GF2m_mod_div(r, yy, xx, field, ctx);
+        bn_check_top(r);
+
+err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+
+
+/* Compute the bth power of a, reduce modulo p, and store
+ * the result in r.  r could be a.
+ * Uses simple square-and-multiply algorithm A.5.1 from IEEE P1363.
+ */
+int     BN_GF2m_mod_exp_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const unsigned int p[], BN_CTX *ctx)
+        {
+        int ret = 0, i, n;
+        BIGNUM *u;
+
+        bn_check_top(a);
+        bn_check_top(b);
+
+        if (BN_is_zero(b))
+                return(BN_one(r));
+
+        if (BN_abs_is_word(b, 1))
+                return (BN_copy(r, a) != NULL);
+
+        BN_CTX_start(ctx);
+        if ((u = BN_CTX_get(ctx)) == NULL) goto err;
+        
+        if (!BN_GF2m_mod_arr(u, a, p)) goto err;
+        
+        n = BN_num_bits(b) - 1;
+        for (i = n - 1; i >= 0; i--)
+                {
+                if (!BN_GF2m_mod_sqr_arr(u, u, p, ctx)) goto err;
+                if (BN_is_bit_set(b, i))
+                        {
+                        if (!BN_GF2m_mod_mul_arr(u, u, a, p, ctx)) goto err;
+                        }
+                }
+        if (!BN_copy(r, u)) goto err;
+        bn_check_top(r);
+        ret = 1;
+err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+
+/* Compute the bth power of a, reduce modulo p, and store
+ * the result in r.  r could be a.
+ *
+ * This function calls down to the BN_GF2m_mod_exp_arr implementation; this wrapper
+ * function is only provided for convenience; for best performance, use the 
+ * BN_GF2m_mod_exp_arr function.
+ */
+int BN_GF2m_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *p, BN_CTX *ctx)
+        {
+        int ret = 0;
+        const int max = BN_num_bits(p);
+        unsigned int *arr=NULL;
+        bn_check_top(a);
+        bn_check_top(b);
+        bn_check_top(p);
+        if ((arr = (unsigned int *)OPENSSL_malloc(sizeof(unsigned int) * max)) == NULL) goto err;
+        ret = BN_GF2m_poly2arr(p, arr, max);
+        if (!ret || ret > max)
+                {
+                BNerr(BN_F_BN_GF2M_MOD_EXP,BN_R_INVALID_LENGTH);
+                goto err;
+                }
+        ret = BN_GF2m_mod_exp_arr(r, a, b, arr, ctx);
+        bn_check_top(r);
+err:
+        if (arr) OPENSSL_free(arr);
+        return ret;
+        }
+
+/* Compute the square root of a, reduce modulo p, and store
+ * the result in r.  r could be a.
+ * Uses exponentiation as in algorithm A.4.1 from IEEE P1363.
+ */
+int     BN_GF2m_mod_sqrt_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[], BN_CTX *ctx)
+        {
+        int ret = 0;
+        BIGNUM *u;
+
+        bn_check_top(a);
+
+        if (!p[0])
+                {
+                /* reduction mod 1 => return 0 */
+                BN_zero(r);
+                return 1;
+                }
+
+        BN_CTX_start(ctx);
+        if ((u = BN_CTX_get(ctx)) == NULL) goto err;
+        
+        if (!BN_set_bit(u, p[0] - 1)) goto err;
+        ret = BN_GF2m_mod_exp_arr(r, a, u, p, ctx);
+        bn_check_top(r);
+
+err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+
+/* Compute the square root of a, reduce modulo p, and store
+ * the result in r.  r could be a.
+ *
+ * This function calls down to the BN_GF2m_mod_sqrt_arr implementation; this wrapper
+ * function is only provided for convenience; for best performance, use the 
+ * BN_GF2m_mod_sqrt_arr function.
+ */
+int BN_GF2m_mod_sqrt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
+        {
+        int ret = 0;
+        const int max = BN_num_bits(p);
+        unsigned int *arr=NULL;
+        bn_check_top(a);
+        bn_check_top(p);
+        if ((arr = (unsigned int *)OPENSSL_malloc(sizeof(unsigned int) * max)) == NULL) goto err;
+        ret = BN_GF2m_poly2arr(p, arr, max);
+        if (!ret || ret > max)
+                {
+                BNerr(BN_F_BN_GF2M_MOD_SQRT,BN_R_INVALID_LENGTH);
+                goto err;
+                }
+        ret = BN_GF2m_mod_sqrt_arr(r, a, arr, ctx);
+        bn_check_top(r);
+err:
+        if (arr) OPENSSL_free(arr);
+        return ret;
+        }
+
+/* Find r such that r^2 + r = a mod p.  r could be a. If no r exists returns 0.
+ * Uses algorithms A.4.7 and A.4.6 from IEEE P1363.
+ */
+int BN_GF2m_mod_solve_quad_arr(BIGNUM *r, const BIGNUM *a_, const unsigned int p[], BN_CTX *ctx)
+        {
+        int ret = 0, count = 0;
+        unsigned int j;
+        BIGNUM *a, *z, *rho, *w, *w2, *tmp;
+
+        bn_check_top(a_);
+
+        if (!p[0])
+                {
+                /* reduction mod 1 => return 0 */
+                BN_zero(r);
+                return 1;
+                }
+
+        BN_CTX_start(ctx);
+        a = BN_CTX_get(ctx);
+        z = BN_CTX_get(ctx);
+        w = BN_CTX_get(ctx);
+        if (w == NULL) goto err;
+
+        if (!BN_GF2m_mod_arr(a, a_, p)) goto err;
+        
+        if (BN_is_zero(a))
+                {
+                BN_zero(r);
+                ret = 1;
+                goto err;
+                }
+
+        if (p[0] & 0x1) /* m is odd */
+                {
+                /* compute half-trace of a */
+                if (!BN_copy(z, a)) goto err;
+                for (j = 1; j <= (p[0] - 1) / 2; j++)
+                        {
+                        if (!BN_GF2m_mod_sqr_arr(z, z, p, ctx)) goto err;
+                        if (!BN_GF2m_mod_sqr_arr(z, z, p, ctx)) goto err;
+                        if (!BN_GF2m_add(z, z, a)) goto err;
+                        }
+                
+                }
+        else /* m is even */
+                {
+                rho = BN_CTX_get(ctx);
+                w2 = BN_CTX_get(ctx);
+                tmp = BN_CTX_get(ctx);
+                if (tmp == NULL) goto err;
+                do
+                        {
+                        if (!BN_rand(rho, p[0], 0, 0)) goto err;
+                        if (!BN_GF2m_mod_arr(rho, rho, p)) goto err;
+                        BN_zero(z);
+                        if (!BN_copy(w, rho)) goto err;
+                        for (j = 1; j <= p[0] - 1; j++)
+                                {
+                                if (!BN_GF2m_mod_sqr_arr(z, z, p, ctx)) goto err;
+                                if (!BN_GF2m_mod_sqr_arr(w2, w, p, ctx)) goto err;
+                                if (!BN_GF2m_mod_mul_arr(tmp, w2, a, p, ctx)) goto err;
+                                if (!BN_GF2m_add(z, z, tmp)) goto err;
+                                if (!BN_GF2m_add(w, w2, rho)) goto err;
+                                }
+                        count++;
+                        } while (BN_is_zero(w) && (count < MAX_ITERATIONS));
+                if (BN_is_zero(w))
+                        {
+                        BNerr(BN_F_BN_GF2M_MOD_SOLVE_QUAD_ARR,BN_R_TOO_MANY_ITERATIONS);
+                        goto err;
+                        }
+                }
+        
+        if (!BN_GF2m_mod_sqr_arr(w, z, p, ctx)) goto err;
+        if (!BN_GF2m_add(w, z, w)) goto err;
+        if (BN_GF2m_cmp(w, a))
+                {
+                BNerr(BN_F_BN_GF2M_MOD_SOLVE_QUAD_ARR, BN_R_NO_SOLUTION);
+                goto err;
+                }
+
+        if (!BN_copy(r, z)) goto err;
+        bn_check_top(r);
+
+        ret = 1;
+
+err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+
+/* Find r such that r^2 + r = a mod p.  r could be a. If no r exists returns 0.
+ *
+ * This function calls down to the BN_GF2m_mod_solve_quad_arr implementation; this wrapper
+ * function is only provided for convenience; for best performance, use the 
+ * BN_GF2m_mod_solve_quad_arr function.
+ */
+int BN_GF2m_mod_solve_quad(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
+        {
+        int ret = 0;
+        const int max = BN_num_bits(p);
+        unsigned int *arr=NULL;
+        bn_check_top(a);
+        bn_check_top(p);
+        if ((arr = (unsigned int *)OPENSSL_malloc(sizeof(unsigned int) *
+                                                max)) == NULL) goto err;
+        ret = BN_GF2m_poly2arr(p, arr, max);
+        if (!ret || ret > max)
+                {
+                BNerr(BN_F_BN_GF2M_MOD_SOLVE_QUAD,BN_R_INVALID_LENGTH);
+                goto err;
+                }
+        ret = BN_GF2m_mod_solve_quad_arr(r, a, arr, ctx);
+        bn_check_top(r);
+err:
+        if (arr) OPENSSL_free(arr);
+        return ret;
+        }
+
+/* Convert the bit-string representation of a polynomial
+ * ( \sum_{i=0}^n a_i * x^i , where a_0 is *not* zero) into an array
+ * of integers corresponding to the bits with non-zero coefficient.
+ * Up to max elements of the array will be filled.  Return value is total
+ * number of coefficients that would be extracted if array was large enough.
+ */
+int BN_GF2m_poly2arr(const BIGNUM *a, unsigned int p[], int max)
+        {
+        int i, j, k = 0;
+        BN_ULONG mask;
+
+        if (BN_is_zero(a) || !BN_is_bit_set(a, 0))
+                /* a_0 == 0 => return error (the unsigned int array
+                 * must be terminated by 0)
+                 */
+                return 0;
+
+        for (i = a->top - 1; i >= 0; i--)
+                {
+                if (!a->d[i])
+                        /* skip word if a->d[i] == 0 */
+                        continue;
+                mask = BN_TBIT;
+                for (j = BN_BITS2 - 1; j >= 0; j--)
+                        {
+                        if (a->d[i] & mask) 
+                                {
+                                if (k < max) p[k] = BN_BITS2 * i + j;
+                                k++;
+                                }
+                        mask >>= 1;
+                        }
+                }
+
+        return k;
+        }
+
+/* Convert the coefficient array representation of a polynomial to a 
+ * bit-string.  The array must be terminated by 0.
+ */
+int BN_GF2m_arr2poly(const unsigned int p[], BIGNUM *a)
+        {
+        int i;
+
+        bn_check_top(a);
+        BN_zero(a);
+        for (i = 0; p[i] != 0; i++)
+                {
+                if (BN_set_bit(a, p[i]) == 0)
+                        return 0;
+                }
+        BN_set_bit(a, 0);
+        bn_check_top(a);
+
+        return 1;
+        }
+
diff --git a/src/lib/libssl/src/crypto/bn/bn_nist.c b/src/lib/libssl/src/crypto/bn/bn_nist.c
new file mode 100644
index 0000000000..e14232fdbb
--- /dev/null
+++ b/src/lib/libssl/src/crypto/bn/bn_nist.c
@@ -0,0 +1,692 @@
+/* crypto/bn/bn_nist.c */
+/*
+ * Written by Nils Larsch for the OpenSSL project
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "bn_lcl.h"
+#include "cryptlib.h"
+
+#define BN_NIST_192_TOP (192+BN_BITS2-1)/BN_BITS2
+#define BN_NIST_224_TOP (224+BN_BITS2-1)/BN_BITS2
+#define BN_NIST_256_TOP (256+BN_BITS2-1)/BN_BITS2
+#define BN_NIST_384_TOP (384+BN_BITS2-1)/BN_BITS2
+#define BN_NIST_521_TOP (521+BN_BITS2-1)/BN_BITS2
+
+#if BN_BITS2 == 64
+static const BN_ULONG _nist_p_192[] =
+        {0xFFFFFFFFFFFFFFFFULL,0xFFFFFFFFFFFFFFFEULL,
+        0xFFFFFFFFFFFFFFFFULL};
+static const BN_ULONG _nist_p_224[] =
+        {0x0000000000000001ULL,0xFFFFFFFF00000000ULL,
+        0xFFFFFFFFFFFFFFFFULL,0x00000000FFFFFFFFULL};
+static const BN_ULONG _nist_p_256[] =
+        {0xFFFFFFFFFFFFFFFFULL,0x00000000FFFFFFFFULL,
+        0x0000000000000000ULL,0xFFFFFFFF00000001ULL};
+static const BN_ULONG _nist_p_384[] =
+        {0x00000000FFFFFFFFULL,0xFFFFFFFF00000000ULL,
+        0xFFFFFFFFFFFFFFFEULL,0xFFFFFFFFFFFFFFFFULL,
+        0xFFFFFFFFFFFFFFFFULL,0xFFFFFFFFFFFFFFFFULL};
+static const BN_ULONG _nist_p_521[] =
+        {0xFFFFFFFFFFFFFFFFULL,0xFFFFFFFFFFFFFFFFULL,
+        0xFFFFFFFFFFFFFFFFULL,0xFFFFFFFFFFFFFFFFULL,
+        0xFFFFFFFFFFFFFFFFULL,0xFFFFFFFFFFFFFFFFULL,
+        0xFFFFFFFFFFFFFFFFULL,0xFFFFFFFFFFFFFFFFULL,
+        0x00000000000001FFULL};
+#elif BN_BITS2 == 32
+static const BN_ULONG _nist_p_192[] = {0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFE,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF};
+static const BN_ULONG _nist_p_224[] = {0x00000001,0x00000000,0x00000000,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF};
+static const BN_ULONG _nist_p_256[] = {0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0x00000000,0x00000000,0x00000000,0x00000001,0xFFFFFFFF};
+static const BN_ULONG _nist_p_384[] = {0xFFFFFFFF,0x00000000,0x00000000,
+        0xFFFFFFFF,0xFFFFFFFE,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF};
+static const BN_ULONG _nist_p_521[] = {0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0x000001FF};
+#endif
+
+const BIGNUM *BN_get0_nist_prime_192(void)
+        {
+        static BIGNUM const_nist_192 = { (BN_ULONG *)_nist_p_192,
+                BN_NIST_192_TOP, BN_NIST_192_TOP, 0, BN_FLG_STATIC_DATA };
+        return &const_nist_192;
+        }
+
+const BIGNUM *BN_get0_nist_prime_224(void)
+        {
+        static BIGNUM const_nist_224 = { (BN_ULONG *)_nist_p_224,
+                BN_NIST_224_TOP, BN_NIST_224_TOP, 0, BN_FLG_STATIC_DATA };
+        return &const_nist_224;
+        }
+
+const BIGNUM *BN_get0_nist_prime_256(void)
+        {
+        static BIGNUM const_nist_256 = { (BN_ULONG *)_nist_p_256,
+                BN_NIST_256_TOP, BN_NIST_256_TOP, 0, BN_FLG_STATIC_DATA };
+        return &const_nist_256;
+        }
+
+const BIGNUM *BN_get0_nist_prime_384(void)
+        {
+        static BIGNUM const_nist_384 = { (BN_ULONG *)_nist_p_384,
+                BN_NIST_384_TOP, BN_NIST_384_TOP, 0, BN_FLG_STATIC_DATA };
+        return &const_nist_384;
+        }
+
+const BIGNUM *BN_get0_nist_prime_521(void)
+        {
+        static BIGNUM const_nist_521 = { (BN_ULONG *)_nist_p_521,
+                BN_NIST_521_TOP, BN_NIST_521_TOP, 0, BN_FLG_STATIC_DATA };
+        return &const_nist_521;
+        }
+
+#define BN_NIST_ADD_ONE(a)      while (!(*(a)=(*(a)+1)&BN_MASK2)) ++(a);
+
+static void nist_cp_bn_0(BN_ULONG *buf, BN_ULONG *a, int top, int max)
+        {
+        int i;
+        BN_ULONG *_tmp1 = (buf), *_tmp2 = (a);
+        for (i = (top); i != 0; i--)
+                *_tmp1++ = *_tmp2++;
+        for (i = (max) - (top); i != 0; i--)
+                *_tmp1++ = (BN_ULONG) 0;
+        }
+
+static void nist_cp_bn(BN_ULONG *buf, BN_ULONG *a, int top)
+        { 
+        int i;
+        BN_ULONG *_tmp1 = (buf), *_tmp2 = (a);
+        for (i = (top); i != 0; i--)
+                *_tmp1++ = *_tmp2++;
+        }
+
+#if BN_BITS2 == 64
+#define bn_cp_64(to, n, from, m)        (to)[n] = (m>=0)?((from)[m]):0;
+#define bn_64_set_0(to, n)              (to)[n] = (BN_ULONG)0;
+/* TBD */
+#define bn_cp_32(to, n, from, m)        (to)[n] = (m>=0)?((from)[m]):0;
+#define bn_32_set_0(to, n)              (to)[n] = (BN_ULONG)0;
+#else
+#define bn_cp_64(to, n, from, m) \
+        { \
+        bn_cp_32(to, (n)*2, from, (m)*2); \
+        bn_cp_32(to, (n)*2+1, from, (m)*2+1); \
+        }
+#define bn_64_set_0(to, n) \
+        { \
+        bn_32_set_0(to, (n)*2); \
+        bn_32_set_0(to, (n)*2+1); \
+        }
+#if BN_BITS2 == 32
+#define bn_cp_32(to, n, from, m)        (to)[n] = (m>=0)?((from)[m]):0;
+#define bn_32_set_0(to, n)              (to)[n] = (BN_ULONG)0;
+#endif
+#endif /* BN_BITS2 != 64 */
+
+
+#define nist_set_192(to, from, a1, a2, a3) \
+        { \
+        if (a3 != 0) bn_cp_64(to, 0, from, (a3) - 3) else bn_64_set_0(to, 0)\
+        bn_cp_64(to, 1, from, (a2) - 3) \
+        if (a1 != 0) bn_cp_64(to, 2, from, (a1) - 3) else bn_64_set_0(to, 2)\
+        }
+
+int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
+        BN_CTX *ctx)
+        {
+        int      top = a->top, i;
+        int      carry;
+        register BN_ULONG *r_d, *a_d = a->d;
+        BN_ULONG t_d[BN_NIST_192_TOP],
+                 buf[BN_NIST_192_TOP],
+                 c_d[BN_NIST_192_TOP],
+                *res;
+        size_t   mask;
+
+        i = BN_ucmp(field, a);
+        if (i == 0)
+                {
+                BN_zero(r);
+                return 1;
+                }
+        else if (i > 0)
+                return (r == a) ? 1 : (BN_copy(r ,a) != NULL);
+
+        if (top == BN_NIST_192_TOP)
+                return BN_usub(r, a, field);
+
+        if (r != a)
+                {
+                if (!bn_wexpand(r, BN_NIST_192_TOP))
+                        return 0;
+                r_d = r->d;
+                nist_cp_bn(r_d, a_d, BN_NIST_192_TOP);
+                }
+        else
+                r_d = a_d;
+
+        nist_cp_bn_0(buf, a_d + BN_NIST_192_TOP, top - BN_NIST_192_TOP, BN_NIST_192_TOP);
+
+        nist_set_192(t_d, buf, 0, 3, 3);
+        carry = bn_add_words(r_d, r_d, t_d, BN_NIST_192_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_192,BN_NIST_192_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+        
+        nist_set_192(t_d, buf, 4, 4, 0);
+        carry = bn_add_words(r_d, res, t_d, BN_NIST_192_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_192,BN_NIST_192_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        nist_set_192(t_d, buf, 5, 5, 5)
+        carry = bn_add_words(r_d, res, t_d, BN_NIST_192_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_192,BN_NIST_192_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        nist_cp_bn(r_d, res, BN_NIST_192_TOP);
+        r->top = BN_NIST_192_TOP;
+        bn_correct_top(r);
+
+        return 1;
+        }
+
+#define nist_set_224(to, from, a1, a2, a3, a4, a5, a6, a7) \
+        { \
+        if (a7 != 0) bn_cp_32(to, 0, from, (a7) - 7) else bn_32_set_0(to, 0)\
+        if (a6 != 0) bn_cp_32(to, 1, from, (a6) - 7) else bn_32_set_0(to, 1)\
+        if (a5 != 0) bn_cp_32(to, 2, from, (a5) - 7) else bn_32_set_0(to, 2)\
+        if (a4 != 0) bn_cp_32(to, 3, from, (a4) - 7) else bn_32_set_0(to, 3)\
+        if (a3 != 0) bn_cp_32(to, 4, from, (a3) - 7) else bn_32_set_0(to, 4)\
+        if (a2 != 0) bn_cp_32(to, 5, from, (a2) - 7) else bn_32_set_0(to, 5)\
+        if (a1 != 0) bn_cp_32(to, 6, from, (a1) - 7) else bn_32_set_0(to, 6)\
+        }
+
+int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
+        BN_CTX *ctx)
+        {
+#if BN_BITS2 == 32
+        int     top = a->top, i;
+        int     carry;
+        BN_ULONG *r_d, *a_d = a->d;
+        BN_ULONG t_d[BN_NIST_224_TOP],
+                 buf[BN_NIST_224_TOP],
+                 c_d[BN_NIST_224_TOP],
+                *res;
+        size_t   mask;
+
+        i = BN_ucmp(field, a);
+        if (i == 0)
+                {
+                BN_zero(r);
+                return 1;
+                }
+        else if (i > 0)
+                return (r == a)? 1 : (BN_copy(r ,a) != NULL);
+
+        if (top == BN_NIST_224_TOP)
+                return BN_usub(r, a, field);
+
+        if (r != a)
+                {
+                if (!bn_wexpand(r, BN_NIST_224_TOP))
+                        return 0;
+                r_d = r->d;
+                nist_cp_bn(r_d, a_d, BN_NIST_224_TOP);
+                }
+        else
+                r_d = a_d;
+
+        nist_cp_bn_0(buf, a_d + BN_NIST_224_TOP, top - BN_NIST_224_TOP, BN_NIST_224_TOP);
+
+        nist_set_224(t_d, buf, 10, 9, 8, 7, 0, 0, 0);
+        carry = bn_add_words(r_d, r_d, t_d, BN_NIST_224_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_224,BN_NIST_224_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+        
+        nist_set_224(t_d, buf, 0, 13, 12, 11, 0, 0, 0);
+        carry = bn_add_words(r_d, res, t_d, BN_NIST_224_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_224,BN_NIST_224_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        nist_set_224(t_d, buf, 13, 12, 11, 10, 9, 8, 7);
+#if BRANCH_FREE
+        carry = bn_sub_words(r_d, res, t_d, BN_NIST_224_TOP);
+        bn_add_words(c_d,r_d,_nist_p_224,BN_NIST_224_TOP);
+        mask = 0-(size_t)carry;
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+#else
+        if (bn_sub_words(r_d, res, t_d, BN_NIST_224_TOP))
+                bn_add_words(r_d,r_d,_nist_p_224,BN_NIST_224_TOP);
+#endif
+        nist_set_224(t_d, buf, 0, 0, 0, 0, 13, 12, 11);
+#if BRANCH_FREE
+        carry = bn_sub_words(r_d, res, t_d, BN_NIST_224_TOP);
+        bn_add_words(c_d,r_d,_nist_p_224,BN_NIST_224_TOP);
+        mask = 0-(size_t)carry;
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        nist_cp_bn(r_d, res, BN_NIST_224_TOP);
+#else
+        if (bn_sub_words(r_d, r_d, t_d, BN_NIST_224_TOP))
+                bn_add_words(r_d,r_d,_nist_p_224,BN_NIST_224_TOP);
+#endif
+        r->top = BN_NIST_224_TOP;
+        bn_correct_top(r);
+
+        return 1;
+#else   /* BN_BITS!=32 */
+        return 0;
+#endif
+        }
+
+#define nist_set_256(to, from, a1, a2, a3, a4, a5, a6, a7, a8) \
+        { \
+        if (a8 != 0) bn_cp_32(to, 0, from, (a8) - 8) else bn_32_set_0(to, 0)\
+        if (a7 != 0) bn_cp_32(to, 1, from, (a7) - 8) else bn_32_set_0(to, 1)\
+        if (a6 != 0) bn_cp_32(to, 2, from, (a6) - 8) else bn_32_set_0(to, 2)\
+        if (a5 != 0) bn_cp_32(to, 3, from, (a5) - 8) else bn_32_set_0(to, 3)\
+        if (a4 != 0) bn_cp_32(to, 4, from, (a4) - 8) else bn_32_set_0(to, 4)\
+        if (a3 != 0) bn_cp_32(to, 5, from, (a3) - 8) else bn_32_set_0(to, 5)\
+        if (a2 != 0) bn_cp_32(to, 6, from, (a2) - 8) else bn_32_set_0(to, 6)\
+        if (a1 != 0) bn_cp_32(to, 7, from, (a1) - 8) else bn_32_set_0(to, 7)\
+        }
+
+int BN_nist_mod_256(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
+        BN_CTX *ctx)
+        {
+#if BN_BITS2 == 32
+        int     i, top = a->top;
+        int     carry = 0;
+        register BN_ULONG *a_d = a->d, *r_d;
+        BN_ULONG t_d[BN_NIST_256_TOP],
+                 buf[BN_NIST_256_TOP],
+                 c_d[BN_NIST_256_TOP],
+                *res;
+        size_t   mask;
+
+        i = BN_ucmp(field, a);
+        if (i == 0)
+                {
+                BN_zero(r);
+                return 1;
+                }
+        else if (i > 0)
+                return (r == a)? 1 : (BN_copy(r ,a) != NULL);
+
+        if (top == BN_NIST_256_TOP)
+                return BN_usub(r, a, field);
+
+        if (r != a)
+                {
+                if (!bn_wexpand(r, BN_NIST_256_TOP))
+                        return 0;
+                r_d = r->d;
+                nist_cp_bn(r_d, a_d, BN_NIST_256_TOP);
+                }
+        else
+                r_d = a_d;
+
+        nist_cp_bn_0(buf, a_d + BN_NIST_256_TOP, top - BN_NIST_256_TOP, BN_NIST_256_TOP);
+
+        /*S1*/
+        nist_set_256(t_d, buf, 15, 14, 13, 12, 11, 0, 0, 0);
+        /*S2*/
+        nist_set_256(c_d,buf, 0, 15, 14, 13, 12, 0, 0, 0);
+        carry = bn_add_words(t_d, t_d, c_d, BN_NIST_256_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,t_d,_nist_p_256,BN_NIST_256_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)t_d&~mask));
+
+        carry = bn_add_words(t_d, res, res, BN_NIST_256_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,t_d,_nist_p_256,BN_NIST_256_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)t_d&~mask));
+
+        carry = bn_add_words(r_d, r_d, res, BN_NIST_256_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_256,BN_NIST_256_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        /*S3*/
+        nist_set_256(t_d, buf, 15, 14, 0, 0, 0, 10, 9, 8);
+        carry = bn_add_words(r_d, res, t_d, BN_NIST_256_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_256,BN_NIST_256_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        /*S4*/
+        nist_set_256(t_d, buf, 8, 13, 15, 14, 13, 11, 10, 9);
+        carry = bn_add_words(r_d, res, t_d, BN_NIST_256_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_256,BN_NIST_256_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        /*D1*/
+        nist_set_256(t_d, buf, 10, 8, 0, 0, 0, 13, 12, 11);
+#if BRANCH_FREE
+        carry = bn_sub_words(r_d, res, t_d, BN_NIST_256_TOP);
+        bn_add_words(c_d,r_d,_nist_p_256,BN_NIST_256_TOP);
+        mask = 0-(size_t)carry;
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));   
+#else
+        if (bn_sub_words(r_d, res, t_d, BN_NIST_256_TOP))
+                bn_add_words(r_d,r_d,_nist_p_256,BN_NIST_256_TOP);
+#endif
+        /*D2*/
+        nist_set_256(t_d, buf, 11, 9, 0, 0, 15, 14, 13, 12);
+#if BRANCH_FREE
+        carry = bn_sub_words(r_d, res, t_d, BN_NIST_256_TOP);
+        bn_add_words(c_d,r_d,_nist_p_256,BN_NIST_256_TOP);
+        mask = 0-(size_t)carry;
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));   
+#else
+        if (bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP))
+                bn_add_words(r_d,r_d,_nist_p_256,BN_NIST_256_TOP);
+#endif
+        /*D3*/
+        nist_set_256(t_d, buf, 12, 0, 10, 9, 8, 15, 14, 13);
+#if BRANCH_FREE
+        carry = bn_sub_words(r_d, res, t_d, BN_NIST_256_TOP);
+        bn_add_words(c_d,r_d,_nist_p_256,BN_NIST_256_TOP);
+        mask = 0-(size_t)carry;
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));   
+#else
+        if (bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP))
+                bn_add_words(r_d,r_d,_nist_p_256,BN_NIST_256_TOP);
+#endif
+        /*D4*/
+        nist_set_256(t_d, buf, 13, 0, 11, 10, 9, 0, 15, 14);
+#if BRANCH_FREE
+        carry = bn_sub_words(r_d, res, t_d, BN_NIST_256_TOP);
+        bn_add_words(c_d,r_d,_nist_p_256,BN_NIST_256_TOP);
+        mask = 0-(size_t)carry;
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));   
+
+        nist_cp_bn(r_d, res, BN_NIST_384_TOP);
+#else
+        if (bn_sub_words(r_d, r_d, t_d, BN_NIST_256_TOP))
+                bn_add_words(r_d,r_d,_nist_p_256,BN_NIST_256_TOP);
+#endif
+        r->top = BN_NIST_256_TOP;
+        bn_correct_top(r);
+
+        return 1;
+#else   /* BN_BITS!=32 */
+        return 0;
+#endif
+        }
+
+#define nist_set_384(to,from,a1,a2,a3,a4,a5,a6,a7,a8,a9,a10,a11,a12) \
+        { \
+        if (a12 != 0) bn_cp_32(to, 0, from,  (a12) - 12) else bn_32_set_0(to, 0)\
+        if (a11 != 0) bn_cp_32(to, 1, from,  (a11) - 12) else bn_32_set_0(to, 1)\
+        if (a10 != 0) bn_cp_32(to, 2, from,  (a10) - 12) else bn_32_set_0(to, 2)\
+        if (a9 != 0)  bn_cp_32(to, 3, from,  (a9) - 12)  else bn_32_set_0(to, 3)\
+        if (a8 != 0)  bn_cp_32(to, 4, from,  (a8) - 12)  else bn_32_set_0(to, 4)\
+        if (a7 != 0)  bn_cp_32(to, 5, from,  (a7) - 12)  else bn_32_set_0(to, 5)\
+        if (a6 != 0)  bn_cp_32(to, 6, from,  (a6) - 12)  else bn_32_set_0(to, 6)\
+        if (a5 != 0)  bn_cp_32(to, 7, from,  (a5) - 12)  else bn_32_set_0(to, 7)\
+        if (a4 != 0)  bn_cp_32(to, 8, from,  (a4) - 12)  else bn_32_set_0(to, 8)\
+        if (a3 != 0)  bn_cp_32(to, 9, from,  (a3) - 12)  else bn_32_set_0(to, 9)\
+        if (a2 != 0)  bn_cp_32(to, 10, from, (a2) - 12)  else bn_32_set_0(to, 10)\
+        if (a1 != 0)  bn_cp_32(to, 11, from, (a1) - 12)  else bn_32_set_0(to, 11)\
+        }
+
+int BN_nist_mod_384(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
+        BN_CTX *ctx)
+        {
+#if BN_BITS2 == 32
+        int     i, top = a->top;
+        int     carry = 0;
+        register BN_ULONG *r_d, *a_d = a->d;
+        BN_ULONG t_d[BN_NIST_384_TOP],
+                 buf[BN_NIST_384_TOP],
+                 c_d[BN_NIST_384_TOP],
+                *res;
+        size_t   mask;
+
+        i = BN_ucmp(field, a);
+        if (i == 0)
+                {
+                BN_zero(r);
+                return 1;
+                }
+        else if (i > 0)
+                return (r == a)? 1 : (BN_copy(r ,a) != NULL);
+
+        if (top == BN_NIST_384_TOP)
+                return BN_usub(r, a, field);
+
+        if (r != a)
+                {
+                if (!bn_wexpand(r, BN_NIST_384_TOP))
+                        return 0;
+                r_d = r->d;
+                nist_cp_bn(r_d, a_d, BN_NIST_384_TOP);
+                }
+        else
+                r_d = a_d;
+
+        nist_cp_bn_0(buf, a_d + BN_NIST_384_TOP, top - BN_NIST_384_TOP, BN_NIST_384_TOP);
+
+        /*S1*/
+        nist_set_256(t_d, buf, 0, 0, 0, 0, 0, 23-4, 22-4, 21-4);
+                /* left shift */
+                {
+                register BN_ULONG *ap,t,c;
+                ap = t_d;
+                c=0;
+                for (i = 3; i != 0; --i)
+                        {
+                        t= *ap;
+                        *(ap++)=((t<<1)|c)&BN_MASK2;
+                        c=(t & BN_TBIT)?1:0;
+                        }
+                *ap=c;
+                }
+        carry = bn_add_words(r_d+(128/BN_BITS2), r_d+(128/BN_BITS2), 
+                t_d, BN_NIST_256_TOP);
+        /*
+         * we need if (result>=modulus) subtract(result,modulus);
+         * in n-bit space this can be expressed as
+         * if (carry || result>=modulus) subtract(result,modulus);
+         * the catch is that comparison implies subtraction and
+         * therefore one can write tmp=subtract(result,modulus);
+         * and then if(carry || !borrow) result=tmp; this's what
+         * happens below, but without explicit if:-) a.
+         */
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_384,BN_NIST_384_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        /*S2 */
+        carry = bn_add_words(r_d, res, buf, BN_NIST_384_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_384,BN_NIST_384_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        /*S3*/
+        nist_set_384(t_d,buf,20,19,18,17,16,15,14,13,12,23,22,21);
+        carry = bn_add_words(r_d, res, t_d, BN_NIST_384_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_384,BN_NIST_384_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        /*S4*/
+        nist_set_384(t_d,buf,19,18,17,16,15,14,13,12,20,0,23,0);
+        carry = bn_add_words(r_d, res, t_d, BN_NIST_384_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_384,BN_NIST_384_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        /*S5*/
+        nist_set_384(t_d, buf,0,0,0,0,23,22,21,20,0,0,0,0);
+        carry = bn_add_words(r_d, res, t_d, BN_NIST_384_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_384,BN_NIST_384_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        /*S6*/
+        nist_set_384(t_d,buf,0,0,0,0,0,0,23,22,21,0,0,20);
+        carry = bn_add_words(r_d, res, t_d, BN_NIST_384_TOP);
+        mask = 0-(size_t)bn_sub_words(c_d,r_d,_nist_p_384,BN_NIST_384_TOP);
+        mask = ~mask | (0-(size_t)carry);
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        /*D1*/
+        nist_set_384(t_d,buf,22,21,20,19,18,17,16,15,14,13,12,23);
+#if BRANCH_FREE
+        carry = bn_sub_words(r_d, res, t_d, BN_NIST_384_TOP);
+        bn_add_words(c_d,r_d,_nist_p_384,BN_NIST_384_TOP);
+        mask = 0-(size_t)carry;
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+#else
+        if (bn_sub_words(r_d, res, t_d, BN_NIST_384_TOP))
+                bn_add_words(r_d,r_d,_nist_p_384,BN_NIST_384_TOP);
+#endif
+        /*D2*/
+        nist_set_384(t_d,buf,0,0,0,0,0,0,0,23,22,21,20,0);
+#if BRANCH_FREE
+        carry = bn_sub_words(r_d, res, t_d, BN_NIST_384_TOP);
+        bn_add_words(c_d,r_d,_nist_p_384,BN_NIST_384_TOP);
+        mask = 0-(size_t)carry;
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+#else
+        if (bn_sub_words(r_d, r_d, t_d, BN_NIST_384_TOP))
+                bn_add_words(r_d,r_d,_nist_p_384,BN_NIST_384_TOP);
+#endif
+        /*D3*/
+        nist_set_384(t_d,buf,0,0,0,0,0,0,0,23,23,0,0,0);
+#if BRANCH_FREE
+        carry = bn_sub_words(r_d, res, t_d, BN_NIST_384_TOP);
+        bn_add_words(c_d,r_d,_nist_p_384,BN_NIST_384_TOP);
+        mask = 0-(size_t)carry;
+        res = (BN_ULONG *)(((size_t)c_d&mask) | ((size_t)r_d&~mask));
+
+        nist_cp_bn(r_d, res, BN_NIST_384_TOP);
+#else
+        if (bn_sub_words(r_d, r_d, t_d, BN_NIST_384_TOP))
+                bn_add_words(r_d,r_d,_nist_p_384,BN_NIST_384_TOP);
+#endif
+        r->top = BN_NIST_384_TOP;
+        bn_correct_top(r);
+
+        return 1;
+#else   /* BN_BITS!=32 */
+        return 0;
+#endif
+        }
+
+int BN_nist_mod_521(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
+        BN_CTX *ctx)
+        {
+#if BN_BITS2 == 64
+#define BN_NIST_521_TOP_MASK    (BN_ULONG)0x1FF
+#elif BN_BITS2 == 32
+#define BN_NIST_521_TOP_MASK    (BN_ULONG)0x1FF
+#endif
+        int     top, ret = 0;
+        BN_ULONG *r_d;
+        BIGNUM  *tmp;
+
+        /* check whether a reduction is necessary */
+        top = a->top;
+        if (top < BN_NIST_521_TOP  || ( top == BN_NIST_521_TOP &&
+           (!(a->d[BN_NIST_521_TOP-1] & ~(BN_NIST_521_TOP_MASK)))))
+                return (r == a)? 1 : (BN_copy(r ,a) != NULL);
+
+        BN_CTX_start(ctx);
+        tmp = BN_CTX_get(ctx);
+        if (!tmp)
+                goto err;
+
+        if (!bn_wexpand(tmp, BN_NIST_521_TOP))
+                goto err;
+        nist_cp_bn(tmp->d, a->d, BN_NIST_521_TOP);
+
+        tmp->top = BN_NIST_521_TOP;
+        tmp->d[BN_NIST_521_TOP-1]  &= BN_NIST_521_TOP_MASK;
+        bn_correct_top(tmp);
+
+        if (!BN_rshift(r, a, 521))
+                goto err;
+
+        if (!BN_uadd(r, tmp, r))
+                goto err;
+        top = r->top;
+        r_d = r->d;
+        if (top == BN_NIST_521_TOP  && 
+           (r_d[BN_NIST_521_TOP-1] & ~(BN_NIST_521_TOP_MASK)))
+                {
+                BN_NIST_ADD_ONE(r_d)
+                r->d[BN_NIST_521_TOP-1] &= BN_NIST_521_TOP_MASK; 
+                }
+        bn_correct_top(r);
+
+        ret = 1;
+err:
+        BN_CTX_end(ctx);
+
+        bn_check_top(r);
+        return ret;
+        }
diff --git a/src/lib/libssl/src/crypto/camellia/Makefile b/src/lib/libssl/src/crypto/camellia/Makefile
new file mode 100644
index 0000000000..1579de5ce5
--- /dev/null
+++ b/src/lib/libssl/src/crypto/camellia/Makefile
@@ -0,0 +1,103 @@
+#
+# crypto/camellia/Makefile
+#
+
+DIR= camellia
+TOP=    ../..
+CC=     cc
+CPP=    $(CC) -E
+INCLUDES=
+CFLAG=-g
+MAKEFILE=       Makefile
+AR=             ar r
+
+CAMELLIA_ASM_OBJ=
+
+CFLAGS= $(INCLUDES) $(CFLAG)
+ASFLAGS= $(INCLUDES) $(ASFLAG)
+AFLAGS= $(ASFLAGS)
+
+GENERAL=Makefile
+#TEST=camelliatest.c
+APPS=
+
+LIB=$(TOP)/libcrypto.a
+LIBSRC=camellia.c cmll_misc.c cmll_ecb.c cmll_cbc.c cmll_ofb.c \
+           cmll_cfb.c cmll_ctr.c 
+
+LIBOBJ= camellia.o cmll_misc.o cmll_ecb.o cmll_cbc.o cmll_ofb.o \
+                cmll_cfb.o cmll_ctr.o $(CAMELLIA_ASM_OBJ)
+
+SRC= $(LIBSRC)
+
+EXHEADER= camellia.h
+HEADER= cmll_locl.h $(EXHEADER)
+
+ALL=    $(GENERAL) $(SRC) $(HEADER)
+
+top:
+        (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
+
+all:    lib
+
+lib:    $(LIBOBJ)
+        $(AR) $(LIB) $(LIBOBJ)
+        $(RANLIB) $(LIB) || echo Never mind.
+        @touch lib
+
+$(LIBOBJ): $(LIBSRC)
+
+
+files:
+        $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
+
+links:
+        @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
+        @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
+        @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
+
+install:
+        @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
+        @headerlist="$(EXHEADER)"; for i in $$headerlist ; \
+        do  \
+        (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
+        chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
+        done;
+
+tags:
+        ctags $(SRC)
+
+tests:
+
+lint:
+        lint -DLINT $(INCLUDES) $(SRC)>fluff
+
+depend:
+        @[ -n "$(MAKEDEPEND)" ] # should be set by upper Makefile...
+        $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
+
+dclean:
+        $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
+        mv -f Makefile.new $(MAKEFILE)
+
+clean:
+        rm -f *.s *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+camellia.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
+camellia.o: camellia.c camellia.h cmll_locl.h
+cmll_cbc.o: ../../include/openssl/camellia.h ../../include/openssl/e_os2.h
+cmll_cbc.o: ../../include/openssl/opensslconf.h cmll_cbc.c cmll_locl.h
+cmll_cfb.o: ../../e_os.h ../../include/openssl/camellia.h
+cmll_cfb.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
+cmll_cfb.o: cmll_cfb.c cmll_locl.h
+cmll_ctr.o: ../../include/openssl/camellia.h ../../include/openssl/e_os2.h
+cmll_ctr.o: ../../include/openssl/opensslconf.h cmll_ctr.c cmll_locl.h
+cmll_ecb.o: ../../include/openssl/camellia.h ../../include/openssl/e_os2.h
+cmll_ecb.o: ../../include/openssl/opensslconf.h cmll_ecb.c cmll_locl.h
+cmll_misc.o: ../../include/openssl/camellia.h ../../include/openssl/e_os2.h
+cmll_misc.o: ../../include/openssl/opensslconf.h
+cmll_misc.o: ../../include/openssl/opensslv.h cmll_locl.h cmll_misc.c
+cmll_ofb.o: ../../include/openssl/camellia.h ../../include/openssl/e_os2.h
+cmll_ofb.o: ../../include/openssl/opensslconf.h cmll_locl.h cmll_ofb.c
diff --git a/src/lib/libssl/src/crypto/camellia/camellia.c b/src/lib/libssl/src/crypto/camellia/camellia.c
new file mode 100644
index 0000000000..491c26b39e
--- /dev/null
+++ b/src/lib/libssl/src/crypto/camellia/camellia.c
@@ -0,0 +1,1624 @@
+/* crypto/camellia/camellia.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright 2006 NTT (Nippon Telegraph and Telephone Corporation) . 
+ * ALL RIGHTS RESERVED.
+ *
+ * Intellectual Property information for Camellia:
+ *     http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html
+ *
+ * News Release for Announcement of Camellia open source:
+ *     http://www.ntt.co.jp/news/news06e/0604/060413a.html
+ *
+ * The Camellia Code included herein is developed by
+ * NTT (Nippon Telegraph and Telephone Corporation), and is contributed
+ * to the OpenSSL project.
+ *
+ * The Camellia Code is licensed pursuant to the OpenSSL open source
+ * license provided below.
+ */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+/* Algorithm Specification 
+   http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
+*/
+
+
+#include <string.h>
+#include <stdlib.h>
+
+#include "camellia.h"
+#include "cmll_locl.h"
+
+/* key constants */
+#define CAMELLIA_SIGMA1L (0xA09E667FL)
+#define CAMELLIA_SIGMA1R (0x3BCC908BL)
+#define CAMELLIA_SIGMA2L (0xB67AE858L)
+#define CAMELLIA_SIGMA2R (0x4CAA73B2L)
+#define CAMELLIA_SIGMA3L (0xC6EF372FL)
+#define CAMELLIA_SIGMA3R (0xE94F82BEL)
+#define CAMELLIA_SIGMA4L (0x54FF53A5L)
+#define CAMELLIA_SIGMA4R (0xF1D36F1CL)
+#define CAMELLIA_SIGMA5L (0x10E527FAL)
+#define CAMELLIA_SIGMA5R (0xDE682D1DL)
+#define CAMELLIA_SIGMA6L (0xB05688C2L)
+#define CAMELLIA_SIGMA6R (0xB3E6C1FDL)
+
+/*
+ *  macros
+ */
+
+/* e is pointer of subkey */
+#define CamelliaSubkeyL(INDEX) (subkey[(INDEX)*2])
+#define CamelliaSubkeyR(INDEX) (subkey[(INDEX)*2 + 1])
+
+/* rotation right shift 1byte */
+#define CAMELLIA_RR8(x) (((x) >> 8) + ((x) << 24))
+/* rotation left shift 1bit */
+#define CAMELLIA_RL1(x) (((x) << 1) + ((x) >> 31))
+/* rotation left shift 1byte */
+#define CAMELLIA_RL8(x) (((x) << 8) + ((x) >> 24))
+
+#define CAMELLIA_ROLDQ(ll, lr, rl, rr, w0, w1, bits)    \
+do                                                      \
+        {                                               \
+        w0 = ll;                                        \
+        ll = (ll << bits) + (lr >> (32 - bits));        \
+        lr = (lr << bits) + (rl >> (32 - bits));        \
+        rl = (rl << bits) + (rr >> (32 - bits));        \
+        rr = (rr << bits) + (w0 >> (32 - bits));        \
+        } while(0)
+
+#define CAMELLIA_ROLDQo32(ll, lr, rl, rr, w0, w1, bits) \
+do                                                      \
+        {                                               \
+        w0 = ll;                                        \
+        w1 = lr;                                        \
+        ll = (lr << (bits - 32)) + (rl >> (64 - bits)); \
+        lr = (rl << (bits - 32)) + (rr >> (64 - bits)); \
+        rl = (rr << (bits - 32)) + (w0 >> (64 - bits)); \
+        rr = (w0 << (bits - 32)) + (w1 >> (64 - bits)); \
+        } while(0)
+
+#define CAMELLIA_SP1110(INDEX) (camellia_sp1110[(INDEX)])
+#define CAMELLIA_SP0222(INDEX) (camellia_sp0222[(INDEX)])
+#define CAMELLIA_SP3033(INDEX) (camellia_sp3033[(INDEX)])
+#define CAMELLIA_SP4404(INDEX) (camellia_sp4404[(INDEX)])
+
+#define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)              \
+do                                                                      \
+        {                                                               \
+        il = xl ^ kl;                                                   \
+        ir = xr ^ kr;                                                   \
+        t0 = il >> 16;                                                  \
+        t1 = ir >> 16;                                                  \
+        yl = CAMELLIA_SP1110(ir & 0xff)                                 \
+                ^ CAMELLIA_SP0222((t1 >> 8) & 0xff)                     \
+                ^ CAMELLIA_SP3033(t1 & 0xff)                            \
+                ^ CAMELLIA_SP4404((ir >> 8) & 0xff);                    \
+        yr = CAMELLIA_SP1110((t0 >> 8) & 0xff)                          \
+                ^ CAMELLIA_SP0222(t0 & 0xff)                            \
+                ^ CAMELLIA_SP3033((il >> 8) & 0xff)                     \
+                ^ CAMELLIA_SP4404(il & 0xff);                           \
+        yl ^= yr;                                                       \
+        yr = CAMELLIA_RR8(yr);                                          \
+        yr ^= yl;                                                       \
+        } while(0)
+
+
+/*
+ * for speed up
+ *
+ */
+#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
+do                                                                      \
+        {                                                               \
+        t0 = kll;                                                       \
+        t0 &= ll;                                                       \
+        lr ^= CAMELLIA_RL1(t0);                                         \
+        t1 = klr;                                                       \
+        t1 |= lr;                                                       \
+        ll ^= t1;                                                       \
+                                                                        \
+        t2 = krr;                                                       \
+        t2 |= rr;                                                       \
+        rl ^= t2;                                                       \
+        t3 = krl;                                                       \
+        t3 &= rl;                                                       \
+        rr ^= CAMELLIA_RL1(t3);                                         \
+        } while(0)
+
+#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)        \
+do                                                                      \
+        {                                                               \
+        il = xl;                                                        \
+        ir = xr;                                                        \
+        t0 = il >> 16;                                                  \
+        t1 = ir >> 16;                                                  \
+        ir = CAMELLIA_SP1110(ir & 0xff)                                 \
+                ^ CAMELLIA_SP0222((t1 >> 8) & 0xff)                     \
+                ^ CAMELLIA_SP3033(t1 & 0xff)                            \
+                ^ CAMELLIA_SP4404((ir >> 8) & 0xff);                    \
+        il = CAMELLIA_SP1110((t0 >> 8) & 0xff)                          \
+                ^ CAMELLIA_SP0222(t0 & 0xff)                            \
+                ^ CAMELLIA_SP3033((il >> 8) & 0xff)                     \
+                ^ CAMELLIA_SP4404(il & 0xff);                           \
+        il ^= kl;                                                       \
+        ir ^= kr;                                                       \
+        ir ^= il;                                                       \
+        il = CAMELLIA_RR8(il);                                          \
+        il ^= ir;                                                       \
+        yl ^= ir;                                                       \
+        yr ^= il;                                                       \
+        } while(0)
+
+static const u32 camellia_sp1110[256] =
+        {
+        0x70707000,0x82828200,0x2c2c2c00,0xececec00,
+        0xb3b3b300,0x27272700,0xc0c0c000,0xe5e5e500,
+        0xe4e4e400,0x85858500,0x57575700,0x35353500,
+        0xeaeaea00,0x0c0c0c00,0xaeaeae00,0x41414100,
+        0x23232300,0xefefef00,0x6b6b6b00,0x93939300,
+        0x45454500,0x19191900,0xa5a5a500,0x21212100,
+        0xededed00,0x0e0e0e00,0x4f4f4f00,0x4e4e4e00,
+        0x1d1d1d00,0x65656500,0x92929200,0xbdbdbd00,
+        0x86868600,0xb8b8b800,0xafafaf00,0x8f8f8f00,
+        0x7c7c7c00,0xebebeb00,0x1f1f1f00,0xcecece00,
+        0x3e3e3e00,0x30303000,0xdcdcdc00,0x5f5f5f00,
+        0x5e5e5e00,0xc5c5c500,0x0b0b0b00,0x1a1a1a00,
+        0xa6a6a600,0xe1e1e100,0x39393900,0xcacaca00,
+        0xd5d5d500,0x47474700,0x5d5d5d00,0x3d3d3d00,
+        0xd9d9d900,0x01010100,0x5a5a5a00,0xd6d6d600,
+        0x51515100,0x56565600,0x6c6c6c00,0x4d4d4d00,
+        0x8b8b8b00,0x0d0d0d00,0x9a9a9a00,0x66666600,
+        0xfbfbfb00,0xcccccc00,0xb0b0b000,0x2d2d2d00,
+        0x74747400,0x12121200,0x2b2b2b00,0x20202000,
+        0xf0f0f000,0xb1b1b100,0x84848400,0x99999900,
+        0xdfdfdf00,0x4c4c4c00,0xcbcbcb00,0xc2c2c200,
+        0x34343400,0x7e7e7e00,0x76767600,0x05050500,
+        0x6d6d6d00,0xb7b7b700,0xa9a9a900,0x31313100,
+        0xd1d1d100,0x17171700,0x04040400,0xd7d7d700,
+        0x14141400,0x58585800,0x3a3a3a00,0x61616100,
+        0xdedede00,0x1b1b1b00,0x11111100,0x1c1c1c00,
+        0x32323200,0x0f0f0f00,0x9c9c9c00,0x16161600,
+        0x53535300,0x18181800,0xf2f2f200,0x22222200,
+        0xfefefe00,0x44444400,0xcfcfcf00,0xb2b2b200,
+        0xc3c3c300,0xb5b5b500,0x7a7a7a00,0x91919100,
+        0x24242400,0x08080800,0xe8e8e800,0xa8a8a800,
+        0x60606000,0xfcfcfc00,0x69696900,0x50505000,
+        0xaaaaaa00,0xd0d0d000,0xa0a0a000,0x7d7d7d00,
+        0xa1a1a100,0x89898900,0x62626200,0x97979700,
+        0x54545400,0x5b5b5b00,0x1e1e1e00,0x95959500,
+        0xe0e0e000,0xffffff00,0x64646400,0xd2d2d200,
+        0x10101000,0xc4c4c400,0x00000000,0x48484800,
+        0xa3a3a300,0xf7f7f700,0x75757500,0xdbdbdb00,
+        0x8a8a8a00,0x03030300,0xe6e6e600,0xdadada00,
+        0x09090900,0x3f3f3f00,0xdddddd00,0x94949400,
+        0x87878700,0x5c5c5c00,0x83838300,0x02020200,
+        0xcdcdcd00,0x4a4a4a00,0x90909000,0x33333300,
+        0x73737300,0x67676700,0xf6f6f600,0xf3f3f300,
+        0x9d9d9d00,0x7f7f7f00,0xbfbfbf00,0xe2e2e200,
+        0x52525200,0x9b9b9b00,0xd8d8d800,0x26262600,
+        0xc8c8c800,0x37373700,0xc6c6c600,0x3b3b3b00,
+        0x81818100,0x96969600,0x6f6f6f00,0x4b4b4b00,
+        0x13131300,0xbebebe00,0x63636300,0x2e2e2e00,
+        0xe9e9e900,0x79797900,0xa7a7a700,0x8c8c8c00,
+        0x9f9f9f00,0x6e6e6e00,0xbcbcbc00,0x8e8e8e00,
+        0x29292900,0xf5f5f500,0xf9f9f900,0xb6b6b600,
+        0x2f2f2f00,0xfdfdfd00,0xb4b4b400,0x59595900,
+        0x78787800,0x98989800,0x06060600,0x6a6a6a00,
+        0xe7e7e700,0x46464600,0x71717100,0xbababa00,
+        0xd4d4d400,0x25252500,0xababab00,0x42424200,
+        0x88888800,0xa2a2a200,0x8d8d8d00,0xfafafa00,
+        0x72727200,0x07070700,0xb9b9b900,0x55555500,
+        0xf8f8f800,0xeeeeee00,0xacacac00,0x0a0a0a00,
+        0x36363600,0x49494900,0x2a2a2a00,0x68686800,
+        0x3c3c3c00,0x38383800,0xf1f1f100,0xa4a4a400,
+        0x40404000,0x28282800,0xd3d3d300,0x7b7b7b00,
+        0xbbbbbb00,0xc9c9c900,0x43434300,0xc1c1c100,
+        0x15151500,0xe3e3e300,0xadadad00,0xf4f4f400,
+        0x77777700,0xc7c7c700,0x80808000,0x9e9e9e00,
+        };
+
+static const u32 camellia_sp0222[256] =
+        {
+        0x00e0e0e0,0x00050505,0x00585858,0x00d9d9d9,
+        0x00676767,0x004e4e4e,0x00818181,0x00cbcbcb,
+        0x00c9c9c9,0x000b0b0b,0x00aeaeae,0x006a6a6a,
+        0x00d5d5d5,0x00181818,0x005d5d5d,0x00828282,
+        0x00464646,0x00dfdfdf,0x00d6d6d6,0x00272727,
+        0x008a8a8a,0x00323232,0x004b4b4b,0x00424242,
+        0x00dbdbdb,0x001c1c1c,0x009e9e9e,0x009c9c9c,
+        0x003a3a3a,0x00cacaca,0x00252525,0x007b7b7b,
+        0x000d0d0d,0x00717171,0x005f5f5f,0x001f1f1f,
+        0x00f8f8f8,0x00d7d7d7,0x003e3e3e,0x009d9d9d,
+        0x007c7c7c,0x00606060,0x00b9b9b9,0x00bebebe,
+        0x00bcbcbc,0x008b8b8b,0x00161616,0x00343434,
+        0x004d4d4d,0x00c3c3c3,0x00727272,0x00959595,
+        0x00ababab,0x008e8e8e,0x00bababa,0x007a7a7a,
+        0x00b3b3b3,0x00020202,0x00b4b4b4,0x00adadad,
+        0x00a2a2a2,0x00acacac,0x00d8d8d8,0x009a9a9a,
+        0x00171717,0x001a1a1a,0x00353535,0x00cccccc,
+        0x00f7f7f7,0x00999999,0x00616161,0x005a5a5a,
+        0x00e8e8e8,0x00242424,0x00565656,0x00404040,
+        0x00e1e1e1,0x00636363,0x00090909,0x00333333,
+        0x00bfbfbf,0x00989898,0x00979797,0x00858585,
+        0x00686868,0x00fcfcfc,0x00ececec,0x000a0a0a,
+        0x00dadada,0x006f6f6f,0x00535353,0x00626262,
+        0x00a3a3a3,0x002e2e2e,0x00080808,0x00afafaf,
+        0x00282828,0x00b0b0b0,0x00747474,0x00c2c2c2,
+        0x00bdbdbd,0x00363636,0x00222222,0x00383838,
+        0x00646464,0x001e1e1e,0x00393939,0x002c2c2c,
+        0x00a6a6a6,0x00303030,0x00e5e5e5,0x00444444,
+        0x00fdfdfd,0x00888888,0x009f9f9f,0x00656565,
+        0x00878787,0x006b6b6b,0x00f4f4f4,0x00232323,
+        0x00484848,0x00101010,0x00d1d1d1,0x00515151,
+        0x00c0c0c0,0x00f9f9f9,0x00d2d2d2,0x00a0a0a0,
+        0x00555555,0x00a1a1a1,0x00414141,0x00fafafa,
+        0x00434343,0x00131313,0x00c4c4c4,0x002f2f2f,
+        0x00a8a8a8,0x00b6b6b6,0x003c3c3c,0x002b2b2b,
+        0x00c1c1c1,0x00ffffff,0x00c8c8c8,0x00a5a5a5,
+        0x00202020,0x00898989,0x00000000,0x00909090,
+        0x00474747,0x00efefef,0x00eaeaea,0x00b7b7b7,
+        0x00151515,0x00060606,0x00cdcdcd,0x00b5b5b5,
+        0x00121212,0x007e7e7e,0x00bbbbbb,0x00292929,
+        0x000f0f0f,0x00b8b8b8,0x00070707,0x00040404,
+        0x009b9b9b,0x00949494,0x00212121,0x00666666,
+        0x00e6e6e6,0x00cecece,0x00ededed,0x00e7e7e7,
+        0x003b3b3b,0x00fefefe,0x007f7f7f,0x00c5c5c5,
+        0x00a4a4a4,0x00373737,0x00b1b1b1,0x004c4c4c,
+        0x00919191,0x006e6e6e,0x008d8d8d,0x00767676,
+        0x00030303,0x002d2d2d,0x00dedede,0x00969696,
+        0x00262626,0x007d7d7d,0x00c6c6c6,0x005c5c5c,
+        0x00d3d3d3,0x00f2f2f2,0x004f4f4f,0x00191919,
+        0x003f3f3f,0x00dcdcdc,0x00797979,0x001d1d1d,
+        0x00525252,0x00ebebeb,0x00f3f3f3,0x006d6d6d,
+        0x005e5e5e,0x00fbfbfb,0x00696969,0x00b2b2b2,
+        0x00f0f0f0,0x00313131,0x000c0c0c,0x00d4d4d4,
+        0x00cfcfcf,0x008c8c8c,0x00e2e2e2,0x00757575,
+        0x00a9a9a9,0x004a4a4a,0x00575757,0x00848484,
+        0x00111111,0x00454545,0x001b1b1b,0x00f5f5f5,
+        0x00e4e4e4,0x000e0e0e,0x00737373,0x00aaaaaa,
+        0x00f1f1f1,0x00dddddd,0x00595959,0x00141414,
+        0x006c6c6c,0x00929292,0x00545454,0x00d0d0d0,
+        0x00787878,0x00707070,0x00e3e3e3,0x00494949,
+        0x00808080,0x00505050,0x00a7a7a7,0x00f6f6f6,
+        0x00777777,0x00939393,0x00868686,0x00838383,
+        0x002a2a2a,0x00c7c7c7,0x005b5b5b,0x00e9e9e9,
+        0x00eeeeee,0x008f8f8f,0x00010101,0x003d3d3d,
+        };
+
+static const u32 camellia_sp3033[256] =
+        {
+        0x38003838,0x41004141,0x16001616,0x76007676,
+        0xd900d9d9,0x93009393,0x60006060,0xf200f2f2,
+        0x72007272,0xc200c2c2,0xab00abab,0x9a009a9a,
+        0x75007575,0x06000606,0x57005757,0xa000a0a0,
+        0x91009191,0xf700f7f7,0xb500b5b5,0xc900c9c9,
+        0xa200a2a2,0x8c008c8c,0xd200d2d2,0x90009090,
+        0xf600f6f6,0x07000707,0xa700a7a7,0x27002727,
+        0x8e008e8e,0xb200b2b2,0x49004949,0xde00dede,
+        0x43004343,0x5c005c5c,0xd700d7d7,0xc700c7c7,
+        0x3e003e3e,0xf500f5f5,0x8f008f8f,0x67006767,
+        0x1f001f1f,0x18001818,0x6e006e6e,0xaf00afaf,
+        0x2f002f2f,0xe200e2e2,0x85008585,0x0d000d0d,
+        0x53005353,0xf000f0f0,0x9c009c9c,0x65006565,
+        0xea00eaea,0xa300a3a3,0xae00aeae,0x9e009e9e,
+        0xec00ecec,0x80008080,0x2d002d2d,0x6b006b6b,
+        0xa800a8a8,0x2b002b2b,0x36003636,0xa600a6a6,
+        0xc500c5c5,0x86008686,0x4d004d4d,0x33003333,
+        0xfd00fdfd,0x66006666,0x58005858,0x96009696,
+        0x3a003a3a,0x09000909,0x95009595,0x10001010,
+        0x78007878,0xd800d8d8,0x42004242,0xcc00cccc,
+        0xef00efef,0x26002626,0xe500e5e5,0x61006161,
+        0x1a001a1a,0x3f003f3f,0x3b003b3b,0x82008282,
+        0xb600b6b6,0xdb00dbdb,0xd400d4d4,0x98009898,
+        0xe800e8e8,0x8b008b8b,0x02000202,0xeb00ebeb,
+        0x0a000a0a,0x2c002c2c,0x1d001d1d,0xb000b0b0,
+        0x6f006f6f,0x8d008d8d,0x88008888,0x0e000e0e,
+        0x19001919,0x87008787,0x4e004e4e,0x0b000b0b,
+        0xa900a9a9,0x0c000c0c,0x79007979,0x11001111,
+        0x7f007f7f,0x22002222,0xe700e7e7,0x59005959,
+        0xe100e1e1,0xda00dada,0x3d003d3d,0xc800c8c8,
+        0x12001212,0x04000404,0x74007474,0x54005454,
+        0x30003030,0x7e007e7e,0xb400b4b4,0x28002828,
+        0x55005555,0x68006868,0x50005050,0xbe00bebe,
+        0xd000d0d0,0xc400c4c4,0x31003131,0xcb00cbcb,
+        0x2a002a2a,0xad00adad,0x0f000f0f,0xca00caca,
+        0x70007070,0xff00ffff,0x32003232,0x69006969,
+        0x08000808,0x62006262,0x00000000,0x24002424,
+        0xd100d1d1,0xfb00fbfb,0xba00baba,0xed00eded,
+        0x45004545,0x81008181,0x73007373,0x6d006d6d,
+        0x84008484,0x9f009f9f,0xee00eeee,0x4a004a4a,
+        0xc300c3c3,0x2e002e2e,0xc100c1c1,0x01000101,
+        0xe600e6e6,0x25002525,0x48004848,0x99009999,
+        0xb900b9b9,0xb300b3b3,0x7b007b7b,0xf900f9f9,
+        0xce00cece,0xbf00bfbf,0xdf00dfdf,0x71007171,
+        0x29002929,0xcd00cdcd,0x6c006c6c,0x13001313,
+        0x64006464,0x9b009b9b,0x63006363,0x9d009d9d,
+        0xc000c0c0,0x4b004b4b,0xb700b7b7,0xa500a5a5,
+        0x89008989,0x5f005f5f,0xb100b1b1,0x17001717,
+        0xf400f4f4,0xbc00bcbc,0xd300d3d3,0x46004646,
+        0xcf00cfcf,0x37003737,0x5e005e5e,0x47004747,
+        0x94009494,0xfa00fafa,0xfc00fcfc,0x5b005b5b,
+        0x97009797,0xfe00fefe,0x5a005a5a,0xac00acac,
+        0x3c003c3c,0x4c004c4c,0x03000303,0x35003535,
+        0xf300f3f3,0x23002323,0xb800b8b8,0x5d005d5d,
+        0x6a006a6a,0x92009292,0xd500d5d5,0x21002121,
+        0x44004444,0x51005151,0xc600c6c6,0x7d007d7d,
+        0x39003939,0x83008383,0xdc00dcdc,0xaa00aaaa,
+        0x7c007c7c,0x77007777,0x56005656,0x05000505,
+        0x1b001b1b,0xa400a4a4,0x15001515,0x34003434,
+        0x1e001e1e,0x1c001c1c,0xf800f8f8,0x52005252,
+        0x20002020,0x14001414,0xe900e9e9,0xbd00bdbd,
+        0xdd00dddd,0xe400e4e4,0xa100a1a1,0xe000e0e0,
+        0x8a008a8a,0xf100f1f1,0xd600d6d6,0x7a007a7a,
+        0xbb00bbbb,0xe300e3e3,0x40004040,0x4f004f4f,
+        };
+
+static const u32 camellia_sp4404[256] =
+        {
+        0x70700070,0x2c2c002c,0xb3b300b3,0xc0c000c0,
+        0xe4e400e4,0x57570057,0xeaea00ea,0xaeae00ae,
+        0x23230023,0x6b6b006b,0x45450045,0xa5a500a5,
+        0xeded00ed,0x4f4f004f,0x1d1d001d,0x92920092,
+        0x86860086,0xafaf00af,0x7c7c007c,0x1f1f001f,
+        0x3e3e003e,0xdcdc00dc,0x5e5e005e,0x0b0b000b,
+        0xa6a600a6,0x39390039,0xd5d500d5,0x5d5d005d,
+        0xd9d900d9,0x5a5a005a,0x51510051,0x6c6c006c,
+        0x8b8b008b,0x9a9a009a,0xfbfb00fb,0xb0b000b0,
+        0x74740074,0x2b2b002b,0xf0f000f0,0x84840084,
+        0xdfdf00df,0xcbcb00cb,0x34340034,0x76760076,
+        0x6d6d006d,0xa9a900a9,0xd1d100d1,0x04040004,
+        0x14140014,0x3a3a003a,0xdede00de,0x11110011,
+        0x32320032,0x9c9c009c,0x53530053,0xf2f200f2,
+        0xfefe00fe,0xcfcf00cf,0xc3c300c3,0x7a7a007a,
+        0x24240024,0xe8e800e8,0x60600060,0x69690069,
+        0xaaaa00aa,0xa0a000a0,0xa1a100a1,0x62620062,
+        0x54540054,0x1e1e001e,0xe0e000e0,0x64640064,
+        0x10100010,0x00000000,0xa3a300a3,0x75750075,
+        0x8a8a008a,0xe6e600e6,0x09090009,0xdddd00dd,
+        0x87870087,0x83830083,0xcdcd00cd,0x90900090,
+        0x73730073,0xf6f600f6,0x9d9d009d,0xbfbf00bf,
+        0x52520052,0xd8d800d8,0xc8c800c8,0xc6c600c6,
+        0x81810081,0x6f6f006f,0x13130013,0x63630063,
+        0xe9e900e9,0xa7a700a7,0x9f9f009f,0xbcbc00bc,
+        0x29290029,0xf9f900f9,0x2f2f002f,0xb4b400b4,
+        0x78780078,0x06060006,0xe7e700e7,0x71710071,
+        0xd4d400d4,0xabab00ab,0x88880088,0x8d8d008d,
+        0x72720072,0xb9b900b9,0xf8f800f8,0xacac00ac,
+        0x36360036,0x2a2a002a,0x3c3c003c,0xf1f100f1,
+        0x40400040,0xd3d300d3,0xbbbb00bb,0x43430043,
+        0x15150015,0xadad00ad,0x77770077,0x80800080,
+        0x82820082,0xecec00ec,0x27270027,0xe5e500e5,
+        0x85850085,0x35350035,0x0c0c000c,0x41410041,
+        0xefef00ef,0x93930093,0x19190019,0x21210021,
+        0x0e0e000e,0x4e4e004e,0x65650065,0xbdbd00bd,
+        0xb8b800b8,0x8f8f008f,0xebeb00eb,0xcece00ce,
+        0x30300030,0x5f5f005f,0xc5c500c5,0x1a1a001a,
+        0xe1e100e1,0xcaca00ca,0x47470047,0x3d3d003d,
+        0x01010001,0xd6d600d6,0x56560056,0x4d4d004d,
+        0x0d0d000d,0x66660066,0xcccc00cc,0x2d2d002d,
+        0x12120012,0x20200020,0xb1b100b1,0x99990099,
+        0x4c4c004c,0xc2c200c2,0x7e7e007e,0x05050005,
+        0xb7b700b7,0x31310031,0x17170017,0xd7d700d7,
+        0x58580058,0x61610061,0x1b1b001b,0x1c1c001c,
+        0x0f0f000f,0x16160016,0x18180018,0x22220022,
+        0x44440044,0xb2b200b2,0xb5b500b5,0x91910091,
+        0x08080008,0xa8a800a8,0xfcfc00fc,0x50500050,
+        0xd0d000d0,0x7d7d007d,0x89890089,0x97970097,
+        0x5b5b005b,0x95950095,0xffff00ff,0xd2d200d2,
+        0xc4c400c4,0x48480048,0xf7f700f7,0xdbdb00db,
+        0x03030003,0xdada00da,0x3f3f003f,0x94940094,
+        0x5c5c005c,0x02020002,0x4a4a004a,0x33330033,
+        0x67670067,0xf3f300f3,0x7f7f007f,0xe2e200e2,
+        0x9b9b009b,0x26260026,0x37370037,0x3b3b003b,
+        0x96960096,0x4b4b004b,0xbebe00be,0x2e2e002e,
+        0x79790079,0x8c8c008c,0x6e6e006e,0x8e8e008e,
+        0xf5f500f5,0xb6b600b6,0xfdfd00fd,0x59590059,
+        0x98980098,0x6a6a006a,0x46460046,0xbaba00ba,
+        0x25250025,0x42420042,0xa2a200a2,0xfafa00fa,
+        0x07070007,0x55550055,0xeeee00ee,0x0a0a000a,
+        0x49490049,0x68680068,0x38380038,0xa4a400a4,
+        0x28280028,0x7b7b007b,0xc9c900c9,0xc1c100c1,
+        0xe3e300e3,0xf4f400f4,0xc7c700c7,0x9e9e009e,
+        };
+
+/**
+ * Stuff related to the Camellia key schedule
+ */
+#define subl(x) subL[(x)]
+#define subr(x) subR[(x)]
+
+void camellia_setup128(const u8 *key, u32 *subkey)
+        {
+        u32 kll, klr, krl, krr;
+        u32 il, ir, t0, t1, w0, w1;
+        u32 kw4l, kw4r, dw, tl, tr;
+        u32 subL[26];
+        u32 subR[26];
+
+        /**
+         *  k == kll || klr || krl || krr (|| is concatination)
+         */
+        kll = GETU32(key     );
+        klr = GETU32(key +  4);
+        krl = GETU32(key +  8);
+        krr = GETU32(key + 12);
+        /**
+         * generate KL dependent subkeys
+         */
+        /* kw1 */
+        subl(0) = kll; subr(0) = klr;
+        /* kw2 */
+        subl(1) = krl; subr(1) = krr;
+        /* rotation left shift 15bit */
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+        /* k3 */
+        subl(4) = kll; subr(4) = klr;
+        /* k4 */
+        subl(5) = krl; subr(5) = krr;
+        /* rotation left shift 15+30bit */
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 30);
+        /* k7 */
+        subl(10) = kll; subr(10) = klr;
+        /* k8 */
+        subl(11) = krl; subr(11) = krr;
+        /* rotation left shift 15+30+15bit */
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+        /* k10 */
+        subl(13) = krl; subr(13) = krr;
+        /* rotation left shift 15+30+15+17 bit */
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
+        /* kl3 */
+        subl(16) = kll; subr(16) = klr;
+        /* kl4 */
+        subl(17) = krl; subr(17) = krr;
+        /* rotation left shift 15+30+15+17+17 bit */
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
+        /* k13 */
+        subl(18) = kll; subr(18) = klr;
+        /* k14 */
+        subl(19) = krl; subr(19) = krr;
+        /* rotation left shift 15+30+15+17+17+17 bit */
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
+        /* k17 */
+        subl(22) = kll; subr(22) = klr;
+        /* k18 */
+        subl(23) = krl; subr(23) = krr;
+
+        /* generate KA */
+        kll = subl(0); klr = subr(0);
+        krl = subl(1); krr = subr(1);
+        CAMELLIA_F(kll, klr,
+                CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
+                w0, w1, il, ir, t0, t1);
+        krl ^= w0; krr ^= w1;
+        CAMELLIA_F(krl, krr,
+                CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
+                kll, klr, il, ir, t0, t1);
+        /* current status == (kll, klr, w0, w1) */
+        CAMELLIA_F(kll, klr,
+                CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
+                krl, krr, il, ir, t0, t1);
+        krl ^= w0; krr ^= w1;
+        CAMELLIA_F(krl, krr,
+                CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
+                w0, w1, il, ir, t0, t1);
+        kll ^= w0; klr ^= w1;
+
+        /* generate KA dependent subkeys */
+        /* k1, k2 */
+        subl(2) = kll; subr(2) = klr;
+        subl(3) = krl; subr(3) = krr;
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+        /* k5,k6 */
+        subl(6) = kll; subr(6) = klr;
+        subl(7) = krl; subr(7) = krr;
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+        /* kl1, kl2 */
+        subl(8) = kll; subr(8) = klr;
+        subl(9) = krl; subr(9) = krr;
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+        /* k9 */
+        subl(12) = kll; subr(12) = klr;
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+        /* k11, k12 */
+        subl(14) = kll; subr(14) = klr;
+        subl(15) = krl; subr(15) = krr;
+        CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
+        /* k15, k16 */
+        subl(20) = kll; subr(20) = klr;
+        subl(21) = krl; subr(21) = krr;
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
+        /* kw3, kw4 */
+        subl(24) = kll; subr(24) = klr;
+        subl(25) = krl; subr(25) = krr;
+
+
+        /* absorb kw2 to other subkeys */
+/* round 2 */
+        subl(3) ^= subl(1); subr(3) ^= subr(1);
+/* round 4 */
+        subl(5) ^= subl(1); subr(5) ^= subr(1);
+/* round 6 */
+        subl(7) ^= subl(1); subr(7) ^= subr(1);
+        subl(1) ^= subr(1) & ~subr(9);
+        dw = subl(1) & subl(9),
+                subr(1) ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl2) */
+/* round 8 */
+        subl(11) ^= subl(1); subr(11) ^= subr(1);
+/* round 10 */
+        subl(13) ^= subl(1); subr(13) ^= subr(1);
+/* round 12 */
+        subl(15) ^= subl(1); subr(15) ^= subr(1);
+        subl(1) ^= subr(1) & ~subr(17);
+        dw = subl(1) & subl(17),
+                subr(1) ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl4) */
+/* round 14 */
+        subl(19) ^= subl(1); subr(19) ^= subr(1);
+/* round 16 */
+        subl(21) ^= subl(1); subr(21) ^= subr(1);
+/* round 18 */
+        subl(23) ^= subl(1); subr(23) ^= subr(1);
+/* kw3 */
+        subl(24) ^= subl(1); subr(24) ^= subr(1);
+
+        /* absorb kw4 to other subkeys */
+        kw4l = subl(25); kw4r = subr(25);
+/* round 17 */
+        subl(22) ^= kw4l; subr(22) ^= kw4r;
+/* round 15 */
+        subl(20) ^= kw4l; subr(20) ^= kw4r;
+/* round 13 */
+        subl(18) ^= kw4l; subr(18) ^= kw4r;
+        kw4l ^= kw4r & ~subr(16);
+        dw = kw4l & subl(16),
+                kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl3) */
+/* round 11 */
+        subl(14) ^= kw4l; subr(14) ^= kw4r;
+/* round 9 */
+        subl(12) ^= kw4l; subr(12) ^= kw4r;
+/* round 7 */
+        subl(10) ^= kw4l; subr(10) ^= kw4r;
+        kw4l ^= kw4r & ~subr(8);
+        dw = kw4l & subl(8),
+                kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl1) */
+/* round 5 */
+        subl(6) ^= kw4l; subr(6) ^= kw4r;
+/* round 3 */
+        subl(4) ^= kw4l; subr(4) ^= kw4r;
+/* round 1 */
+        subl(2) ^= kw4l; subr(2) ^= kw4r;
+/* kw1 */
+        subl(0) ^= kw4l; subr(0) ^= kw4r;
+
+
+        /* key XOR is end of F-function */
+        CamelliaSubkeyL(0) = subl(0) ^ subl(2);/* kw1 */
+        CamelliaSubkeyR(0) = subr(0) ^ subr(2);
+        CamelliaSubkeyL(2) = subl(3);       /* round 1 */
+        CamelliaSubkeyR(2) = subr(3);
+        CamelliaSubkeyL(3) = subl(2) ^ subl(4); /* round 2 */
+        CamelliaSubkeyR(3) = subr(2) ^ subr(4);
+        CamelliaSubkeyL(4) = subl(3) ^ subl(5); /* round 3 */
+        CamelliaSubkeyR(4) = subr(3) ^ subr(5);
+        CamelliaSubkeyL(5) = subl(4) ^ subl(6); /* round 4 */
+        CamelliaSubkeyR(5) = subr(4) ^ subr(6);
+        CamelliaSubkeyL(6) = subl(5) ^ subl(7); /* round 5 */
+        CamelliaSubkeyR(6) = subr(5) ^ subr(7);
+        tl = subl(10) ^ (subr(10) & ~subr(8));
+        dw = tl & subl(8),  /* FL(kl1) */
+                tr = subr(10) ^ CAMELLIA_RL1(dw);
+        CamelliaSubkeyL(7) = subl(6) ^ tl; /* round 6 */
+        CamelliaSubkeyR(7) = subr(6) ^ tr;
+        CamelliaSubkeyL(8) = subl(8);       /* FL(kl1) */
+        CamelliaSubkeyR(8) = subr(8);
+        CamelliaSubkeyL(9) = subl(9);       /* FLinv(kl2) */
+        CamelliaSubkeyR(9) = subr(9);
+        tl = subl(7) ^ (subr(7) & ~subr(9));
+        dw = tl & subl(9),  /* FLinv(kl2) */
+                tr = subr(7) ^ CAMELLIA_RL1(dw);
+        CamelliaSubkeyL(10) = tl ^ subl(11); /* round 7 */
+        CamelliaSubkeyR(10) = tr ^ subr(11);
+        CamelliaSubkeyL(11) = subl(10) ^ subl(12); /* round 8 */
+        CamelliaSubkeyR(11) = subr(10) ^ subr(12);
+        CamelliaSubkeyL(12) = subl(11) ^ subl(13); /* round 9 */
+        CamelliaSubkeyR(12) = subr(11) ^ subr(13);
+        CamelliaSubkeyL(13) = subl(12) ^ subl(14); /* round 10 */
+        CamelliaSubkeyR(13) = subr(12) ^ subr(14);
+        CamelliaSubkeyL(14) = subl(13) ^ subl(15); /* round 11 */
+        CamelliaSubkeyR(14) = subr(13) ^ subr(15);
+        tl = subl(18) ^ (subr(18) & ~subr(16));
+        dw = tl & subl(16), /* FL(kl3) */
+                tr = subr(18) ^ CAMELLIA_RL1(dw);
+        CamelliaSubkeyL(15) = subl(14) ^ tl; /* round 12 */
+        CamelliaSubkeyR(15) = subr(14) ^ tr;
+        CamelliaSubkeyL(16) = subl(16);     /* FL(kl3) */
+        CamelliaSubkeyR(16) = subr(16);
+        CamelliaSubkeyL(17) = subl(17);     /* FLinv(kl4) */
+        CamelliaSubkeyR(17) = subr(17);
+        tl = subl(15) ^ (subr(15) & ~subr(17));
+        dw = tl & subl(17), /* FLinv(kl4) */
+                tr = subr(15) ^ CAMELLIA_RL1(dw);
+        CamelliaSubkeyL(18) = tl ^ subl(19); /* round 13 */
+        CamelliaSubkeyR(18) = tr ^ subr(19);
+        CamelliaSubkeyL(19) = subl(18) ^ subl(20); /* round 14 */
+        CamelliaSubkeyR(19) = subr(18) ^ subr(20);
+        CamelliaSubkeyL(20) = subl(19) ^ subl(21); /* round 15 */
+        CamelliaSubkeyR(20) = subr(19) ^ subr(21);
+        CamelliaSubkeyL(21) = subl(20) ^ subl(22); /* round 16 */
+        CamelliaSubkeyR(21) = subr(20) ^ subr(22);
+        CamelliaSubkeyL(22) = subl(21) ^ subl(23); /* round 17 */
+        CamelliaSubkeyR(22) = subr(21) ^ subr(23);
+        CamelliaSubkeyL(23) = subl(22);     /* round 18 */
+        CamelliaSubkeyR(23) = subr(22);
+        CamelliaSubkeyL(24) = subl(24) ^ subl(23); /* kw3 */
+        CamelliaSubkeyR(24) = subr(24) ^ subr(23);
+
+        /* apply the inverse of the last half of P-function */
+        dw = CamelliaSubkeyL(2) ^ CamelliaSubkeyR(2),
+                dw = CAMELLIA_RL8(dw);/* round 1 */
+        CamelliaSubkeyR(2) = CamelliaSubkeyL(2) ^ dw,
+                CamelliaSubkeyL(2) = dw;
+        dw = CamelliaSubkeyL(3) ^ CamelliaSubkeyR(3),
+                dw = CAMELLIA_RL8(dw);/* round 2 */
+        CamelliaSubkeyR(3) = CamelliaSubkeyL(3) ^ dw,
+                CamelliaSubkeyL(3) = dw;
+        dw = CamelliaSubkeyL(4) ^ CamelliaSubkeyR(4),
+                dw = CAMELLIA_RL8(dw);/* round 3 */
+        CamelliaSubkeyR(4) = CamelliaSubkeyL(4) ^ dw,
+                CamelliaSubkeyL(4) = dw;
+        dw = CamelliaSubkeyL(5) ^ CamelliaSubkeyR(5),
+                dw = CAMELLIA_RL8(dw);/* round 4 */
+        CamelliaSubkeyR(5) = CamelliaSubkeyL(5) ^ dw,
+                CamelliaSubkeyL(5) = dw;
+        dw = CamelliaSubkeyL(6) ^ CamelliaSubkeyR(6),
+                dw = CAMELLIA_RL8(dw);/* round 5 */
+        CamelliaSubkeyR(6) = CamelliaSubkeyL(6) ^ dw,
+                CamelliaSubkeyL(6) = dw;
+        dw = CamelliaSubkeyL(7) ^ CamelliaSubkeyR(7),
+                dw = CAMELLIA_RL8(dw);/* round 6 */
+        CamelliaSubkeyR(7) = CamelliaSubkeyL(7) ^ dw,
+                CamelliaSubkeyL(7) = dw;
+        dw = CamelliaSubkeyL(10) ^ CamelliaSubkeyR(10),
+                dw = CAMELLIA_RL8(dw);/* round 7 */
+        CamelliaSubkeyR(10) = CamelliaSubkeyL(10) ^ dw,
+                CamelliaSubkeyL(10) = dw;
+        dw = CamelliaSubkeyL(11) ^ CamelliaSubkeyR(11),
+                dw = CAMELLIA_RL8(dw);/* round 8 */
+        CamelliaSubkeyR(11) = CamelliaSubkeyL(11) ^ dw,
+                CamelliaSubkeyL(11) = dw;
+        dw = CamelliaSubkeyL(12) ^ CamelliaSubkeyR(12),
+                dw = CAMELLIA_RL8(dw);/* round 9 */
+        CamelliaSubkeyR(12) = CamelliaSubkeyL(12) ^ dw,
+                CamelliaSubkeyL(12) = dw;
+        dw = CamelliaSubkeyL(13) ^ CamelliaSubkeyR(13),
+                dw = CAMELLIA_RL8(dw);/* round 10 */
+        CamelliaSubkeyR(13) = CamelliaSubkeyL(13) ^ dw,
+                CamelliaSubkeyL(13) = dw;
+        dw = CamelliaSubkeyL(14) ^ CamelliaSubkeyR(14),
+                dw = CAMELLIA_RL8(dw);/* round 11 */
+        CamelliaSubkeyR(14) = CamelliaSubkeyL(14) ^ dw,
+                CamelliaSubkeyL(14) = dw;
+        dw = CamelliaSubkeyL(15) ^ CamelliaSubkeyR(15),
+                dw = CAMELLIA_RL8(dw);/* round 12 */
+        CamelliaSubkeyR(15) = CamelliaSubkeyL(15) ^ dw,
+                CamelliaSubkeyL(15) = dw;
+        dw = CamelliaSubkeyL(18) ^ CamelliaSubkeyR(18),
+                dw = CAMELLIA_RL8(dw);/* round 13 */
+        CamelliaSubkeyR(18) = CamelliaSubkeyL(18) ^ dw,
+                CamelliaSubkeyL(18) = dw;
+        dw = CamelliaSubkeyL(19) ^ CamelliaSubkeyR(19),
+                dw = CAMELLIA_RL8(dw);/* round 14 */
+        CamelliaSubkeyR(19) = CamelliaSubkeyL(19) ^ dw,
+                CamelliaSubkeyL(19) = dw;
+        dw = CamelliaSubkeyL(20) ^ CamelliaSubkeyR(20),
+                dw = CAMELLIA_RL8(dw);/* round 15 */
+        CamelliaSubkeyR(20) = CamelliaSubkeyL(20) ^ dw,
+                CamelliaSubkeyL(20) = dw;
+        dw = CamelliaSubkeyL(21) ^ CamelliaSubkeyR(21),
+                dw = CAMELLIA_RL8(dw);/* round 16 */
+        CamelliaSubkeyR(21) = CamelliaSubkeyL(21) ^ dw,
+                CamelliaSubkeyL(21) = dw;
+        dw = CamelliaSubkeyL(22) ^ CamelliaSubkeyR(22),
+                dw = CAMELLIA_RL8(dw);/* round 17 */
+        CamelliaSubkeyR(22) = CamelliaSubkeyL(22) ^ dw,
+                CamelliaSubkeyL(22) = dw;
+        dw = CamelliaSubkeyL(23) ^ CamelliaSubkeyR(23),
+                dw = CAMELLIA_RL8(dw);/* round 18 */
+        CamelliaSubkeyR(23) = CamelliaSubkeyL(23) ^ dw,
+                CamelliaSubkeyL(23) = dw;
+
+        return;
+        }
+
+void camellia_setup256(const u8 *key, u32 *subkey)
+        {
+        u32 kll,klr,krl,krr;           /* left half of key */
+        u32 krll,krlr,krrl,krrr;       /* right half of key */
+        u32 il, ir, t0, t1, w0, w1;    /* temporary variables */
+        u32 kw4l, kw4r, dw, tl, tr;
+        u32 subL[34];
+        u32 subR[34];
+
+        /**
+         *  key = (kll || klr || krl || krr || krll || krlr || krrl || krrr)
+         *  (|| is concatination)
+         */
+
+        kll  = GETU32(key     );
+        klr  = GETU32(key +  4);
+        krl  = GETU32(key +  8);
+        krr  = GETU32(key + 12);
+        krll = GETU32(key + 16);
+        krlr = GETU32(key + 20);
+        krrl = GETU32(key + 24);
+        krrr = GETU32(key + 28);
+
+        /* generate KL dependent subkeys */
+        /* kw1 */
+        subl(0) = kll; subr(0) = klr;
+        /* kw2 */
+        subl(1) = krl; subr(1) = krr;
+        CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 45);
+        /* k9 */
+        subl(12) = kll; subr(12) = klr;
+        /* k10 */
+        subl(13) = krl; subr(13) = krr;
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+        /* kl3 */
+        subl(16) = kll; subr(16) = klr;
+        /* kl4 */
+        subl(17) = krl; subr(17) = krr;
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
+        /* k17 */
+        subl(22) = kll; subr(22) = klr;
+        /* k18 */
+        subl(23) = krl; subr(23) = krr;
+        CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
+        /* k23 */
+        subl(30) = kll; subr(30) = klr;
+        /* k24 */
+        subl(31) = krl; subr(31) = krr;
+
+        /* generate KR dependent subkeys */
+        CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
+        /* k3 */
+        subl(4) = krll; subr(4) = krlr;
+        /* k4 */
+        subl(5) = krrl; subr(5) = krrr;
+        CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
+        /* kl1 */
+        subl(8) = krll; subr(8) = krlr;
+        /* kl2 */
+        subl(9) = krrl; subr(9) = krrr;
+        CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
+        /* k13 */
+        subl(18) = krll; subr(18) = krlr;
+        /* k14 */
+        subl(19) = krrl; subr(19) = krrr;
+        CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
+        /* k19 */
+        subl(26) = krll; subr(26) = krlr;
+        /* k20 */
+        subl(27) = krrl; subr(27) = krrr;
+        CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
+
+        /* generate KA */
+        kll = subl(0) ^ krll; klr = subr(0) ^ krlr;
+        krl = subl(1) ^ krrl; krr = subr(1) ^ krrr;
+        CAMELLIA_F(kll, klr,
+                CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
+                w0, w1, il, ir, t0, t1);
+        krl ^= w0; krr ^= w1;
+        CAMELLIA_F(krl, krr,
+                CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
+                kll, klr, il, ir, t0, t1);
+        kll ^= krll; klr ^= krlr;
+        CAMELLIA_F(kll, klr,
+                CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
+                krl, krr, il, ir, t0, t1);
+        krl ^= w0 ^ krrl; krr ^= w1 ^ krrr;
+        CAMELLIA_F(krl, krr,
+                CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
+                w0, w1, il, ir, t0, t1);
+        kll ^= w0; klr ^= w1;
+
+        /* generate KB */
+        krll ^= kll; krlr ^= klr;
+        krrl ^= krl; krrr ^= krr;
+        CAMELLIA_F(krll, krlr,
+                CAMELLIA_SIGMA5L, CAMELLIA_SIGMA5R,
+                w0, w1, il, ir, t0, t1);
+        krrl ^= w0; krrr ^= w1;
+        CAMELLIA_F(krrl, krrr,
+                CAMELLIA_SIGMA6L, CAMELLIA_SIGMA6R,
+                w0, w1, il, ir, t0, t1);
+        krll ^= w0; krlr ^= w1;
+
+        /* generate KA dependent subkeys */
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+        /* k5 */
+        subl(6) = kll; subr(6) = klr;
+        /* k6 */
+        subl(7) = krl; subr(7) = krr;
+        CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 30);
+        /* k11 */
+        subl(14) = kll; subr(14) = klr;
+        /* k12 */
+        subl(15) = krl; subr(15) = krr;
+        /* rotation left shift 32bit */
+        /* kl5 */
+        subl(24) = klr; subr(24) = krl;
+        /* kl6 */
+        subl(25) = krr; subr(25) = kll;
+        /* rotation left shift 49 from k11,k12 -> k21,k22 */
+        CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 49);
+        /* k21 */
+        subl(28) = kll; subr(28) = klr;
+        /* k22 */
+        subl(29) = krl; subr(29) = krr;
+
+        /* generate KB dependent subkeys */
+        /* k1 */
+        subl(2) = krll; subr(2) = krlr;
+        /* k2 */
+        subl(3) = krrl; subr(3) = krrr;
+        CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
+        /* k7 */
+        subl(10) = krll; subr(10) = krlr;
+        /* k8 */
+        subl(11) = krrl; subr(11) = krrr;
+        CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
+        /* k15 */
+        subl(20) = krll; subr(20) = krlr;
+        /* k16 */
+        subl(21) = krrl; subr(21) = krrr;
+        CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 51);
+        /* kw3 */
+        subl(32) = krll; subr(32) = krlr;
+        /* kw4 */
+        subl(33) = krrl; subr(33) = krrr;
+
+        /* absorb kw2 to other subkeys */
+/* round 2 */
+        subl(3) ^= subl(1); subr(3) ^= subr(1);
+/* round 4 */
+        subl(5) ^= subl(1); subr(5) ^= subr(1);
+/* round 6 */
+        subl(7) ^= subl(1); subr(7) ^= subr(1);
+        subl(1) ^= subr(1) & ~subr(9);
+        dw = subl(1) & subl(9),
+                subr(1) ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl2) */
+/* round 8 */
+        subl(11) ^= subl(1); subr(11) ^= subr(1);
+/* round 10 */
+        subl(13) ^= subl(1); subr(13) ^= subr(1);
+/* round 12 */
+        subl(15) ^= subl(1); subr(15) ^= subr(1);
+        subl(1) ^= subr(1) & ~subr(17);
+        dw = subl(1) & subl(17),
+                subr(1) ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl4) */
+/* round 14 */
+        subl(19) ^= subl(1); subr(19) ^= subr(1);
+/* round 16 */
+        subl(21) ^= subl(1); subr(21) ^= subr(1);
+/* round 18 */
+        subl(23) ^= subl(1); subr(23) ^= subr(1);
+        subl(1) ^= subr(1) & ~subr(25);
+        dw = subl(1) & subl(25),
+                subr(1) ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl6) */
+/* round 20 */
+        subl(27) ^= subl(1); subr(27) ^= subr(1);
+/* round 22 */
+        subl(29) ^= subl(1); subr(29) ^= subr(1);
+/* round 24 */
+        subl(31) ^= subl(1); subr(31) ^= subr(1);
+/* kw3 */
+        subl(32) ^= subl(1); subr(32) ^= subr(1);
+
+
+        /* absorb kw4 to other subkeys */
+        kw4l = subl(33); kw4r = subr(33);
+/* round 23 */
+        subl(30) ^= kw4l; subr(30) ^= kw4r;
+/* round 21 */
+        subl(28) ^= kw4l; subr(28) ^= kw4r;
+/* round 19 */
+        subl(26) ^= kw4l; subr(26) ^= kw4r;
+        kw4l ^= kw4r & ~subr(24);
+        dw = kw4l & subl(24),
+                kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl5) */
+/* round 17 */
+        subl(22) ^= kw4l; subr(22) ^= kw4r;
+/* round 15 */
+        subl(20) ^= kw4l; subr(20) ^= kw4r;
+/* round 13 */
+        subl(18) ^= kw4l; subr(18) ^= kw4r;
+        kw4l ^= kw4r & ~subr(16);
+        dw = kw4l & subl(16),
+                kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl3) */
+/* round 11 */
+        subl(14) ^= kw4l; subr(14) ^= kw4r;
+/* round 9 */
+        subl(12) ^= kw4l; subr(12) ^= kw4r;
+/* round 7 */
+        subl(10) ^= kw4l; subr(10) ^= kw4r;
+        kw4l ^= kw4r & ~subr(8);
+        dw = kw4l & subl(8),
+                kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl1) */
+/* round 5 */
+        subl(6) ^= kw4l; subr(6) ^= kw4r;
+/* round 3 */
+        subl(4) ^= kw4l; subr(4) ^= kw4r;
+/* round 1 */
+        subl(2) ^= kw4l; subr(2) ^= kw4r;
+/* kw1 */
+        subl(0) ^= kw4l; subr(0) ^= kw4r;
+
+        /* key XOR is end of F-function */
+        CamelliaSubkeyL(0) = subl(0) ^ subl(2);/* kw1 */
+        CamelliaSubkeyR(0) = subr(0) ^ subr(2);
+        CamelliaSubkeyL(2) = subl(3);       /* round 1 */
+        CamelliaSubkeyR(2) = subr(3);
+        CamelliaSubkeyL(3) = subl(2) ^ subl(4); /* round 2 */
+        CamelliaSubkeyR(3) = subr(2) ^ subr(4);
+        CamelliaSubkeyL(4) = subl(3) ^ subl(5); /* round 3 */
+        CamelliaSubkeyR(4) = subr(3) ^ subr(5);
+        CamelliaSubkeyL(5) = subl(4) ^ subl(6); /* round 4 */
+        CamelliaSubkeyR(5) = subr(4) ^ subr(6);
+        CamelliaSubkeyL(6) = subl(5) ^ subl(7); /* round 5 */
+        CamelliaSubkeyR(6) = subr(5) ^ subr(7);
+        tl = subl(10) ^ (subr(10) & ~subr(8));
+        dw = tl & subl(8),  /* FL(kl1) */
+                tr = subr(10) ^ CAMELLIA_RL1(dw);
+        CamelliaSubkeyL(7) = subl(6) ^ tl; /* round 6 */
+        CamelliaSubkeyR(7) = subr(6) ^ tr;
+        CamelliaSubkeyL(8) = subl(8);       /* FL(kl1) */
+        CamelliaSubkeyR(8) = subr(8);
+        CamelliaSubkeyL(9) = subl(9);       /* FLinv(kl2) */
+        CamelliaSubkeyR(9) = subr(9);
+        tl = subl(7) ^ (subr(7) & ~subr(9));
+        dw = tl & subl(9),  /* FLinv(kl2) */
+                tr = subr(7) ^ CAMELLIA_RL1(dw);
+        CamelliaSubkeyL(10) = tl ^ subl(11); /* round 7 */
+        CamelliaSubkeyR(10) = tr ^ subr(11);
+        CamelliaSubkeyL(11) = subl(10) ^ subl(12); /* round 8 */
+        CamelliaSubkeyR(11) = subr(10) ^ subr(12);
+        CamelliaSubkeyL(12) = subl(11) ^ subl(13); /* round 9 */
+        CamelliaSubkeyR(12) = subr(11) ^ subr(13);
+        CamelliaSubkeyL(13) = subl(12) ^ subl(14); /* round 10 */
+        CamelliaSubkeyR(13) = subr(12) ^ subr(14);
+        CamelliaSubkeyL(14) = subl(13) ^ subl(15); /* round 11 */
+        CamelliaSubkeyR(14) = subr(13) ^ subr(15);
+        tl = subl(18) ^ (subr(18) & ~subr(16));
+        dw = tl & subl(16), /* FL(kl3) */
+                tr = subr(18) ^ CAMELLIA_RL1(dw);
+        CamelliaSubkeyL(15) = subl(14) ^ tl; /* round 12 */
+        CamelliaSubkeyR(15) = subr(14) ^ tr;
+        CamelliaSubkeyL(16) = subl(16);     /* FL(kl3) */
+        CamelliaSubkeyR(16) = subr(16);
+        CamelliaSubkeyL(17) = subl(17);     /* FLinv(kl4) */
+        CamelliaSubkeyR(17) = subr(17);
+        tl = subl(15) ^ (subr(15) & ~subr(17));
+        dw = tl & subl(17), /* FLinv(kl4) */
+                tr = subr(15) ^ CAMELLIA_RL1(dw);
+        CamelliaSubkeyL(18) = tl ^ subl(19); /* round 13 */
+        CamelliaSubkeyR(18) = tr ^ subr(19);
+        CamelliaSubkeyL(19) = subl(18) ^ subl(20); /* round 14 */
+        CamelliaSubkeyR(19) = subr(18) ^ subr(20);
+        CamelliaSubkeyL(20) = subl(19) ^ subl(21); /* round 15 */
+        CamelliaSubkeyR(20) = subr(19) ^ subr(21);
+        CamelliaSubkeyL(21) = subl(20) ^ subl(22); /* round 16 */
+        CamelliaSubkeyR(21) = subr(20) ^ subr(22);
+        CamelliaSubkeyL(22) = subl(21) ^ subl(23); /* round 17 */
+        CamelliaSubkeyR(22) = subr(21) ^ subr(23);
+        tl = subl(26) ^ (subr(26)
+                & ~subr(24));
+        dw = tl & subl(24), /* FL(kl5) */
+                tr = subr(26) ^ CAMELLIA_RL1(dw);
+        CamelliaSubkeyL(23) = subl(22) ^ tl; /* round 18 */
+        CamelliaSubkeyR(23) = subr(22) ^ tr;
+        CamelliaSubkeyL(24) = subl(24);     /* FL(kl5) */
+        CamelliaSubkeyR(24) = subr(24);
+        CamelliaSubkeyL(25) = subl(25);     /* FLinv(kl6) */
+        CamelliaSubkeyR(25) = subr(25);
+        tl = subl(23) ^ (subr(23) &
+                ~subr(25));
+        dw = tl & subl(25), /* FLinv(kl6) */
+                tr = subr(23) ^ CAMELLIA_RL1(dw);
+        CamelliaSubkeyL(26) = tl ^ subl(27); /* round 19 */
+        CamelliaSubkeyR(26) = tr ^ subr(27);
+        CamelliaSubkeyL(27) = subl(26) ^ subl(28); /* round 20 */
+        CamelliaSubkeyR(27) = subr(26) ^ subr(28);
+        CamelliaSubkeyL(28) = subl(27) ^ subl(29); /* round 21 */
+        CamelliaSubkeyR(28) = subr(27) ^ subr(29);
+        CamelliaSubkeyL(29) = subl(28) ^ subl(30); /* round 22 */
+        CamelliaSubkeyR(29) = subr(28) ^ subr(30);
+        CamelliaSubkeyL(30) = subl(29) ^ subl(31); /* round 23 */
+        CamelliaSubkeyR(30) = subr(29) ^ subr(31);
+        CamelliaSubkeyL(31) = subl(30);     /* round 24 */
+        CamelliaSubkeyR(31) = subr(30);
+        CamelliaSubkeyL(32) = subl(32) ^ subl(31); /* kw3 */
+        CamelliaSubkeyR(32) = subr(32) ^ subr(31);
+
+        /* apply the inverse of the last half of P-function */
+        dw = CamelliaSubkeyL(2) ^ CamelliaSubkeyR(2),
+                dw = CAMELLIA_RL8(dw);/* round 1 */
+        CamelliaSubkeyR(2) = CamelliaSubkeyL(2) ^ dw,
+                CamelliaSubkeyL(2) = dw;
+        dw = CamelliaSubkeyL(3) ^ CamelliaSubkeyR(3),
+                dw = CAMELLIA_RL8(dw);/* round 2 */
+        CamelliaSubkeyR(3) = CamelliaSubkeyL(3) ^ dw,
+                CamelliaSubkeyL(3) = dw;
+        dw = CamelliaSubkeyL(4) ^ CamelliaSubkeyR(4),
+                dw = CAMELLIA_RL8(dw);/* round 3 */
+        CamelliaSubkeyR(4) = CamelliaSubkeyL(4) ^ dw,
+                CamelliaSubkeyL(4) = dw;
+        dw = CamelliaSubkeyL(5) ^ CamelliaSubkeyR(5),
+                dw = CAMELLIA_RL8(dw);/* round 4 */
+        CamelliaSubkeyR(5) = CamelliaSubkeyL(5) ^ dw,
+                CamelliaSubkeyL(5) = dw;
+        dw = CamelliaSubkeyL(6) ^ CamelliaSubkeyR(6),
+                dw = CAMELLIA_RL8(dw);/* round 5 */
+        CamelliaSubkeyR(6) = CamelliaSubkeyL(6) ^ dw,
+                CamelliaSubkeyL(6) = dw;
+        dw = CamelliaSubkeyL(7) ^ CamelliaSubkeyR(7),
+                dw = CAMELLIA_RL8(dw);/* round 6 */
+        CamelliaSubkeyR(7) = CamelliaSubkeyL(7) ^ dw,
+                CamelliaSubkeyL(7) = dw;
+        dw = CamelliaSubkeyL(10) ^ CamelliaSubkeyR(10),
+                dw = CAMELLIA_RL8(dw);/* round 7 */
+        CamelliaSubkeyR(10) = CamelliaSubkeyL(10) ^ dw,
+                CamelliaSubkeyL(10) = dw;
+        dw = CamelliaSubkeyL(11) ^ CamelliaSubkeyR(11),
+                dw = CAMELLIA_RL8(dw);/* round 8 */
+        CamelliaSubkeyR(11) = CamelliaSubkeyL(11) ^ dw,
+                CamelliaSubkeyL(11) = dw;
+        dw = CamelliaSubkeyL(12) ^ CamelliaSubkeyR(12),
+                dw = CAMELLIA_RL8(dw);/* round 9 */
+        CamelliaSubkeyR(12) = CamelliaSubkeyL(12) ^ dw,
+                CamelliaSubkeyL(12) = dw;
+        dw = CamelliaSubkeyL(13) ^ CamelliaSubkeyR(13),
+                dw = CAMELLIA_RL8(dw);/* round 10 */
+        CamelliaSubkeyR(13) = CamelliaSubkeyL(13) ^ dw,
+                CamelliaSubkeyL(13) = dw;
+        dw = CamelliaSubkeyL(14) ^ CamelliaSubkeyR(14),
+                dw = CAMELLIA_RL8(dw);/* round 11 */
+        CamelliaSubkeyR(14) = CamelliaSubkeyL(14) ^ dw,
+                CamelliaSubkeyL(14) = dw;
+        dw = CamelliaSubkeyL(15) ^ CamelliaSubkeyR(15),
+                dw = CAMELLIA_RL8(dw);/* round 12 */
+        CamelliaSubkeyR(15) = CamelliaSubkeyL(15) ^ dw,
+                CamelliaSubkeyL(15) = dw;
+        dw = CamelliaSubkeyL(18) ^ CamelliaSubkeyR(18),
+                dw = CAMELLIA_RL8(dw);/* round 13 */
+        CamelliaSubkeyR(18) = CamelliaSubkeyL(18) ^ dw,
+                CamelliaSubkeyL(18) = dw;
+        dw = CamelliaSubkeyL(19) ^ CamelliaSubkeyR(19),
+                dw = CAMELLIA_RL8(dw);/* round 14 */
+        CamelliaSubkeyR(19) = CamelliaSubkeyL(19) ^ dw,
+                CamelliaSubkeyL(19) = dw;
+        dw = CamelliaSubkeyL(20) ^ CamelliaSubkeyR(20),
+                dw = CAMELLIA_RL8(dw);/* round 15 */
+        CamelliaSubkeyR(20) = CamelliaSubkeyL(20) ^ dw,
+                CamelliaSubkeyL(20) = dw;
+        dw = CamelliaSubkeyL(21) ^ CamelliaSubkeyR(21),
+                dw = CAMELLIA_RL8(dw);/* round 16 */
+        CamelliaSubkeyR(21) = CamelliaSubkeyL(21) ^ dw,
+                CamelliaSubkeyL(21) = dw;
+        dw = CamelliaSubkeyL(22) ^ CamelliaSubkeyR(22),
+                dw = CAMELLIA_RL8(dw);/* round 17 */
+        CamelliaSubkeyR(22) = CamelliaSubkeyL(22) ^ dw,
+                CamelliaSubkeyL(22) = dw;
+        dw = CamelliaSubkeyL(23) ^ CamelliaSubkeyR(23),
+                dw = CAMELLIA_RL8(dw);/* round 18 */
+        CamelliaSubkeyR(23) = CamelliaSubkeyL(23) ^ dw,
+                CamelliaSubkeyL(23) = dw;
+        dw = CamelliaSubkeyL(26) ^ CamelliaSubkeyR(26),
+                dw = CAMELLIA_RL8(dw);/* round 19 */
+        CamelliaSubkeyR(26) = CamelliaSubkeyL(26) ^ dw,
+                CamelliaSubkeyL(26) = dw;
+        dw = CamelliaSubkeyL(27) ^ CamelliaSubkeyR(27),
+                dw = CAMELLIA_RL8(dw);/* round 20 */
+        CamelliaSubkeyR(27) = CamelliaSubkeyL(27) ^ dw,
+                CamelliaSubkeyL(27) = dw;
+        dw = CamelliaSubkeyL(28) ^ CamelliaSubkeyR(28),
+                dw = CAMELLIA_RL8(dw);/* round 21 */
+        CamelliaSubkeyR(28) = CamelliaSubkeyL(28) ^ dw,
+                CamelliaSubkeyL(28) = dw;
+        dw = CamelliaSubkeyL(29) ^ CamelliaSubkeyR(29),
+                dw = CAMELLIA_RL8(dw);/* round 22 */
+        CamelliaSubkeyR(29) = CamelliaSubkeyL(29) ^ dw,
+                CamelliaSubkeyL(29) = dw;
+        dw = CamelliaSubkeyL(30) ^ CamelliaSubkeyR(30),
+                dw = CAMELLIA_RL8(dw);/* round 23 */
+        CamelliaSubkeyR(30) = CamelliaSubkeyL(30) ^ dw,
+                CamelliaSubkeyL(30) = dw;
+        dw = CamelliaSubkeyL(31) ^ CamelliaSubkeyR(31),
+                dw = CAMELLIA_RL8(dw);/* round 24 */
+        CamelliaSubkeyR(31) = CamelliaSubkeyL(31) ^ dw,
+                CamelliaSubkeyL(31) = dw;
+
+    
+        return;
+        }
+
+void camellia_setup192(const u8 *key, u32 *subkey)
+        {
+        u8 kk[32];
+        u32 krll, krlr, krrl,krrr;
+
+        memcpy(kk, key, 24);
+        memcpy((u8 *)&krll, key+16,4);
+        memcpy((u8 *)&krlr, key+20,4);
+        krrl = ~krll;
+        krrr = ~krlr;
+        memcpy(kk+24, (u8 *)&krrl, 4);
+        memcpy(kk+28, (u8 *)&krrr, 4);
+        camellia_setup256(kk, subkey);
+        return;
+        }
+
+
+/**
+ * Stuff related to camellia encryption/decryption
+ */
+void camellia_encrypt128(const u32 *subkey, u32 *io)
+        {
+        u32 il, ir, t0, t1;
+
+        /* pre whitening but absorb kw2*/
+        io[0] ^= CamelliaSubkeyL(0);
+        io[1] ^= CamelliaSubkeyR(0);
+        /* main iteration */
+
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(2),CamelliaSubkeyR(2),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(3),CamelliaSubkeyR(3),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(4),CamelliaSubkeyR(4),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(5),CamelliaSubkeyR(5),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(6),CamelliaSubkeyR(6),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(7),CamelliaSubkeyR(7),
+                io[0],io[1],il,ir,t0,t1);
+
+        CAMELLIA_FLS(io[0],io[1],io[2],io[3],
+                CamelliaSubkeyL(8),CamelliaSubkeyR(8),
+                CamelliaSubkeyL(9),CamelliaSubkeyR(9),
+                t0,t1,il,ir);
+
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(10),CamelliaSubkeyR(10),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(11),CamelliaSubkeyR(11),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(12),CamelliaSubkeyR(12),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(13),CamelliaSubkeyR(13),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(14),CamelliaSubkeyR(14),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(15),CamelliaSubkeyR(15),
+                io[0],io[1],il,ir,t0,t1);
+
+        CAMELLIA_FLS(io[0],io[1],io[2],io[3],
+                CamelliaSubkeyL(16),CamelliaSubkeyR(16),
+                CamelliaSubkeyL(17),CamelliaSubkeyR(17),
+                t0,t1,il,ir);
+
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(18),CamelliaSubkeyR(18),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(19),CamelliaSubkeyR(19),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(20),CamelliaSubkeyR(20),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(21),CamelliaSubkeyR(21),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(22),CamelliaSubkeyR(22),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(23),CamelliaSubkeyR(23),
+                io[0],io[1],il,ir,t0,t1);
+
+        /* post whitening but kw4 */
+        io[2] ^= CamelliaSubkeyL(24);
+        io[3] ^= CamelliaSubkeyR(24);
+
+        t0 = io[0];
+        t1 = io[1];
+        io[0] = io[2];
+        io[1] = io[3];
+        io[2] = t0;
+        io[3] = t1;
+
+        return;
+        }
+
+void camellia_decrypt128(const u32 *subkey, u32 *io)
+        {
+        u32 il,ir,t0,t1;               /* temporary valiables */
+
+        /* pre whitening but absorb kw2*/
+        io[0] ^= CamelliaSubkeyL(24);
+        io[1] ^= CamelliaSubkeyR(24);
+
+        /* main iteration */
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(23),CamelliaSubkeyR(23),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(22),CamelliaSubkeyR(22),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(21),CamelliaSubkeyR(21),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(20),CamelliaSubkeyR(20),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(19),CamelliaSubkeyR(19),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(18),CamelliaSubkeyR(18),
+                io[0],io[1],il,ir,t0,t1);
+
+        CAMELLIA_FLS(io[0],io[1],io[2],io[3],
+                CamelliaSubkeyL(17),CamelliaSubkeyR(17),
+                CamelliaSubkeyL(16),CamelliaSubkeyR(16),
+                t0,t1,il,ir);
+
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(15),CamelliaSubkeyR(15),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(14),CamelliaSubkeyR(14),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(13),CamelliaSubkeyR(13),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(12),CamelliaSubkeyR(12),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(11),CamelliaSubkeyR(11),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(10),CamelliaSubkeyR(10),
+                io[0],io[1],il,ir,t0,t1);
+
+        CAMELLIA_FLS(io[0],io[1],io[2],io[3],
+                CamelliaSubkeyL(9),CamelliaSubkeyR(9),
+                CamelliaSubkeyL(8),CamelliaSubkeyR(8),
+                t0,t1,il,ir);
+
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(7),CamelliaSubkeyR(7),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(6),CamelliaSubkeyR(6),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(5),CamelliaSubkeyR(5),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(4),CamelliaSubkeyR(4),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(3),CamelliaSubkeyR(3),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(2),CamelliaSubkeyR(2),
+                io[0],io[1],il,ir,t0,t1);
+
+        /* post whitening but kw4 */
+        io[2] ^= CamelliaSubkeyL(0);
+        io[3] ^= CamelliaSubkeyR(0);
+
+        t0 = io[0];
+        t1 = io[1];
+        io[0] = io[2];
+        io[1] = io[3];
+        io[2] = t0;
+        io[3] = t1;
+
+        return;
+        }
+
+/**
+ * stuff for 192 and 256bit encryption/decryption
+ */
+void camellia_encrypt256(const u32 *subkey, u32 *io)
+        {
+        u32 il,ir,t0,t1;           /* temporary valiables */
+
+        /* pre whitening but absorb kw2*/
+        io[0] ^= CamelliaSubkeyL(0);
+        io[1] ^= CamelliaSubkeyR(0);
+
+        /* main iteration */
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(2),CamelliaSubkeyR(2),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(3),CamelliaSubkeyR(3),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(4),CamelliaSubkeyR(4),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(5),CamelliaSubkeyR(5),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(6),CamelliaSubkeyR(6),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(7),CamelliaSubkeyR(7),
+                io[0],io[1],il,ir,t0,t1);
+
+        CAMELLIA_FLS(io[0],io[1],io[2],io[3],
+                CamelliaSubkeyL(8),CamelliaSubkeyR(8),
+                CamelliaSubkeyL(9),CamelliaSubkeyR(9),
+                t0,t1,il,ir);
+
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(10),CamelliaSubkeyR(10),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(11),CamelliaSubkeyR(11),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(12),CamelliaSubkeyR(12),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(13),CamelliaSubkeyR(13),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(14),CamelliaSubkeyR(14),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(15),CamelliaSubkeyR(15),
+                io[0],io[1],il,ir,t0,t1);
+
+        CAMELLIA_FLS(io[0],io[1],io[2],io[3],
+                CamelliaSubkeyL(16),CamelliaSubkeyR(16),
+                CamelliaSubkeyL(17),CamelliaSubkeyR(17),
+                t0,t1,il,ir);
+
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(18),CamelliaSubkeyR(18),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(19),CamelliaSubkeyR(19),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(20),CamelliaSubkeyR(20),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(21),CamelliaSubkeyR(21),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(22),CamelliaSubkeyR(22),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(23),CamelliaSubkeyR(23),
+                io[0],io[1],il,ir,t0,t1);
+
+        CAMELLIA_FLS(io[0],io[1],io[2],io[3],
+                CamelliaSubkeyL(24),CamelliaSubkeyR(24),
+                CamelliaSubkeyL(25),CamelliaSubkeyR(25),
+                t0,t1,il,ir);
+
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(26),CamelliaSubkeyR(26),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(27),CamelliaSubkeyR(27),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(28),CamelliaSubkeyR(28),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(29),CamelliaSubkeyR(29),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(30),CamelliaSubkeyR(30),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(31),CamelliaSubkeyR(31),
+                io[0],io[1],il,ir,t0,t1);
+
+        /* post whitening but kw4 */
+        io[2] ^= CamelliaSubkeyL(32);
+        io[3] ^= CamelliaSubkeyR(32);
+
+        t0 = io[0];
+        t1 = io[1];
+        io[0] = io[2];
+        io[1] = io[3];
+        io[2] = t0;
+        io[3] = t1;
+
+        return;
+        }
+
+void camellia_decrypt256(const u32 *subkey, u32 *io)
+        {
+        u32 il,ir,t0,t1;           /* temporary valiables */
+
+        /* pre whitening but absorb kw2*/
+        io[0] ^= CamelliaSubkeyL(32);
+        io[1] ^= CamelliaSubkeyR(32);
+        
+        /* main iteration */
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(31),CamelliaSubkeyR(31),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(30),CamelliaSubkeyR(30),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(29),CamelliaSubkeyR(29),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(28),CamelliaSubkeyR(28),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(27),CamelliaSubkeyR(27),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(26),CamelliaSubkeyR(26),
+                io[0],io[1],il,ir,t0,t1);
+
+        CAMELLIA_FLS(io[0],io[1],io[2],io[3],
+                CamelliaSubkeyL(25),CamelliaSubkeyR(25),
+                CamelliaSubkeyL(24),CamelliaSubkeyR(24),
+                t0,t1,il,ir);
+
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(23),CamelliaSubkeyR(23),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(22),CamelliaSubkeyR(22),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(21),CamelliaSubkeyR(21),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(20),CamelliaSubkeyR(20),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(19),CamelliaSubkeyR(19),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(18),CamelliaSubkeyR(18),
+                io[0],io[1],il,ir,t0,t1);
+
+        CAMELLIA_FLS(io[0],io[1],io[2],io[3],
+                CamelliaSubkeyL(17),CamelliaSubkeyR(17),
+                CamelliaSubkeyL(16),CamelliaSubkeyR(16),
+                t0,t1,il,ir);
+
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(15),CamelliaSubkeyR(15),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(14),CamelliaSubkeyR(14),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(13),CamelliaSubkeyR(13),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(12),CamelliaSubkeyR(12),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(11),CamelliaSubkeyR(11),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(10),CamelliaSubkeyR(10),
+                io[0],io[1],il,ir,t0,t1);
+
+        CAMELLIA_FLS(io[0],io[1],io[2],io[3],
+                CamelliaSubkeyL(9),CamelliaSubkeyR(9),
+                CamelliaSubkeyL(8),CamelliaSubkeyR(8),
+                t0,t1,il,ir);
+
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(7),CamelliaSubkeyR(7),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(6),CamelliaSubkeyR(6),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(5),CamelliaSubkeyR(5),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(4),CamelliaSubkeyR(4),
+                io[0],io[1],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[0],io[1],
+                CamelliaSubkeyL(3),CamelliaSubkeyR(3),
+                io[2],io[3],il,ir,t0,t1);
+        CAMELLIA_ROUNDSM(io[2],io[3],
+                CamelliaSubkeyL(2),CamelliaSubkeyR(2),
+                io[0],io[1],il,ir,t0,t1);
+
+        /* post whitening but kw4 */
+        io[2] ^= CamelliaSubkeyL(0);
+        io[3] ^= CamelliaSubkeyR(0);
+
+        t0 = io[0];
+        t1 = io[1];
+        io[0] = io[2];
+        io[1] = io[3];
+        io[2] = t0;
+        io[3] = t1;
+
+        return;
+        }
+
diff --git a/src/lib/libssl/src/crypto/camellia/camellia.h b/src/lib/libssl/src/crypto/camellia/camellia.h
new file mode 100644
index 0000000000..3c8a359543
--- /dev/null
+++ b/src/lib/libssl/src/crypto/camellia/camellia.h
@@ -0,0 +1,129 @@
+/* crypto/camellia/camellia.h -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+
+#ifndef HEADER_CAMELLIA_H
+#define HEADER_CAMELLIA_H
+
+#include <openssl/opensslconf.h>
+
+#ifdef OPENSSL_NO_CAMELLIA
+#error CAMELLIA is disabled.
+#endif
+
+#define CAMELLIA_ENCRYPT        1
+#define CAMELLIA_DECRYPT        0
+
+/* Because array size can't be a const in C, the following two are macros.
+   Both sizes are in bytes. */
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* This should be a hidden type, but EVP requires that the size be known */
+
+#define CAMELLIA_BLOCK_SIZE 16
+#define CAMELLIA_TABLE_BYTE_LEN 272
+#define CAMELLIA_TABLE_WORD_LEN (CAMELLIA_TABLE_BYTE_LEN / 4)
+
+ /* to match with WORD */
+typedef unsigned int KEY_TABLE_TYPE[CAMELLIA_TABLE_WORD_LEN];
+
+struct camellia_key_st 
+        {
+        KEY_TABLE_TYPE rd_key;
+        int bitLength;
+        void (*enc)(const unsigned int *subkey, unsigned int *io);
+        void (*dec)(const unsigned int *subkey, unsigned int *io);
+        };
+
+typedef struct camellia_key_st CAMELLIA_KEY;
+
+int Camellia_set_key(const unsigned char *userKey, const int bits,
+        CAMELLIA_KEY *key);
+
+void Camellia_encrypt(const unsigned char *in, unsigned char *out,
+        const CAMELLIA_KEY *key);
+void Camellia_decrypt(const unsigned char *in, unsigned char *out,
+        const CAMELLIA_KEY *key);
+
+void Camellia_ecb_encrypt(const unsigned char *in, unsigned char *out,
+        const CAMELLIA_KEY *key, const int enc);
+void Camellia_cbc_encrypt(const unsigned char *in, unsigned char *out,
+        const unsigned long length, const CAMELLIA_KEY *key,
+        unsigned char *ivec, const int enc);
+void Camellia_cfb128_encrypt(const unsigned char *in, unsigned char *out,
+        const unsigned long length, const CAMELLIA_KEY *key,
+        unsigned char *ivec, int *num, const int enc);
+void Camellia_cfb1_encrypt(const unsigned char *in, unsigned char *out,
+        const unsigned long length, const CAMELLIA_KEY *key,
+        unsigned char *ivec, int *num, const int enc);
+void Camellia_cfb8_encrypt(const unsigned char *in, unsigned char *out,
+        const unsigned long length, const CAMELLIA_KEY *key,
+        unsigned char *ivec, int *num, const int enc);
+void Camellia_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
+        const int nbits,const CAMELLIA_KEY *key,
+        unsigned char *ivec,const int enc);
+void Camellia_ofb128_encrypt(const unsigned char *in, unsigned char *out,
+        const unsigned long length, const CAMELLIA_KEY *key,
+        unsigned char *ivec, int *num);
+void Camellia_ctr128_encrypt(const unsigned char *in, unsigned char *out,
+        const unsigned long length, const CAMELLIA_KEY *key,
+        unsigned char ivec[CAMELLIA_BLOCK_SIZE],
+        unsigned char ecount_buf[CAMELLIA_BLOCK_SIZE],
+        unsigned int *num);
+
+#ifdef  __cplusplus
+}
+#endif
+
+#endif /* !HEADER_Camellia_H */
+
diff --git a/src/lib/libssl/src/crypto/camellia/cmll_cbc.c b/src/lib/libssl/src/crypto/camellia/cmll_cbc.c
new file mode 100644
index 0000000000..4141a7b59b
--- /dev/null
+++ b/src/lib/libssl/src/crypto/camellia/cmll_cbc.c
@@ -0,0 +1,273 @@
+/* crypto/camellia/camellia_cbc.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+
+#ifndef CAMELLIA_DEBUG
+# ifndef NDEBUG
+#  define NDEBUG
+# endif
+#endif
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <openssl/camellia.h>
+#include "cmll_locl.h"
+
+void Camellia_cbc_encrypt(const unsigned char *in, unsigned char *out,
+                     const unsigned long length, const CAMELLIA_KEY *key,
+                     unsigned char *ivec, const int enc) {
+
+        unsigned long n;
+        unsigned long len = length;
+        const unsigned char *iv = ivec;
+        union { u32 t32[CAMELLIA_BLOCK_SIZE/sizeof(u32)];
+                u8  t8 [CAMELLIA_BLOCK_SIZE]; } tmp;
+        const union { long one; char little; } camellia_endian = {1};
+
+
+        assert(in && out && key && ivec);
+        assert((CAMELLIA_ENCRYPT == enc)||(CAMELLIA_DECRYPT == enc));
+
+        if(((size_t)in|(size_t)out|(size_t)ivec) % sizeof(u32) == 0)
+                {
+                if (CAMELLIA_ENCRYPT == enc)
+                        {
+                        while (len >= CAMELLIA_BLOCK_SIZE)
+                                {
+                                XOR4WORD2((u32 *)out,
+                                        (u32 *)in, (u32 *)iv);
+                                if (camellia_endian.little)
+                                        SWAP4WORD((u32 *)out);
+                                key->enc(key->rd_key, (u32 *)out);
+                                if (camellia_endian.little)
+                                        SWAP4WORD((u32 *)out);
+                                iv = out;
+                                len -= CAMELLIA_BLOCK_SIZE;
+                                in += CAMELLIA_BLOCK_SIZE;
+                                out += CAMELLIA_BLOCK_SIZE;
+                                }
+                        if (len)
+                                {
+                                for(n=0; n < len; ++n)
+                                        out[n] = in[n] ^ iv[n];
+                                for(n=len; n < CAMELLIA_BLOCK_SIZE; ++n)
+                                        out[n] = iv[n];
+                                if (camellia_endian.little)
+                                        SWAP4WORD((u32 *)out);
+                                key->enc(key->rd_key, (u32 *)out);
+                                if (camellia_endian.little)
+                                        SWAP4WORD((u32 *)out);
+                                iv = out;
+                                }
+                        memcpy(ivec,iv,CAMELLIA_BLOCK_SIZE);
+                        }
+                else if (in != out)
+                        {
+                        while (len >= CAMELLIA_BLOCK_SIZE)
+                                {
+                                memcpy(out,in,CAMELLIA_BLOCK_SIZE);
+                                if (camellia_endian.little)
+                                        SWAP4WORD((u32 *)out);
+                                key->dec(key->rd_key,(u32 *)out);
+                                if (camellia_endian.little)
+                                        SWAP4WORD((u32 *)out);
+                                XOR4WORD((u32 *)out, (u32 *)iv);
+                                iv = in;
+                                len -= CAMELLIA_BLOCK_SIZE;
+                                in  += CAMELLIA_BLOCK_SIZE;
+                                out += CAMELLIA_BLOCK_SIZE;
+                                }
+                        if (len)
+                                {
+                                memcpy(tmp.t8, in, CAMELLIA_BLOCK_SIZE);
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                key->dec(key->rd_key, tmp.t32);
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                for(n=0; n < len; ++n)
+                                        out[n] = tmp.t8[n] ^ iv[n];
+                                iv = in;
+                                }
+                        memcpy(ivec,iv,CAMELLIA_BLOCK_SIZE);
+                        }
+                else /* in == out */
+                        {
+                        while (len >= CAMELLIA_BLOCK_SIZE)
+                                {
+                                memcpy(tmp.t8, in, CAMELLIA_BLOCK_SIZE);
+                                if (camellia_endian.little)
+                                        SWAP4WORD((u32 *)out);
+                                key->dec(key->rd_key, (u32 *)out);
+                                if (camellia_endian.little)
+                                        SWAP4WORD((u32 *)out);
+                                XOR4WORD((u32 *)out, (u32 *)ivec);
+                                memcpy(ivec, tmp.t8, CAMELLIA_BLOCK_SIZE);
+                                len -= CAMELLIA_BLOCK_SIZE;
+                                in += CAMELLIA_BLOCK_SIZE;
+                                out += CAMELLIA_BLOCK_SIZE;
+                                }
+                        if (len)
+                                {
+                                memcpy(tmp.t8, in, CAMELLIA_BLOCK_SIZE);
+                                if (camellia_endian.little)
+                                        SWAP4WORD((u32 *)out);
+                                key->dec(key->rd_key,(u32 *)out);
+                                if (camellia_endian.little)
+                                        SWAP4WORD((u32 *)out);
+                                for(n=0; n < len; ++n)
+                                        out[n] ^= ivec[n];
+                                for(n=len; n < CAMELLIA_BLOCK_SIZE; ++n)
+                                        out[n] = tmp.t8[n];
+                                memcpy(ivec, tmp.t8, CAMELLIA_BLOCK_SIZE);
+                                }
+                        }
+                }
+        else /* no aligned */
+                {
+                if (CAMELLIA_ENCRYPT == enc)
+                        {
+                        while (len >= CAMELLIA_BLOCK_SIZE)
+                                {
+                                for(n=0; n < CAMELLIA_BLOCK_SIZE; ++n)
+                                        tmp.t8[n] = in[n] ^ iv[n];
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                key->enc(key->rd_key, tmp.t32);
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                memcpy(out, tmp.t8, CAMELLIA_BLOCK_SIZE);
+                                iv = out;
+                                len -= CAMELLIA_BLOCK_SIZE;
+                                in += CAMELLIA_BLOCK_SIZE;
+                                out += CAMELLIA_BLOCK_SIZE;
+                                }
+                        if (len)
+                                {
+                                for(n=0; n < len; ++n)
+                                        tmp.t8[n] = in[n] ^ iv[n];
+                                for(n=len; n < CAMELLIA_BLOCK_SIZE; ++n)
+                                        tmp.t8[n] = iv[n];
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                key->enc(key->rd_key, tmp.t32);
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                memcpy(out, tmp.t8, CAMELLIA_BLOCK_SIZE);
+                                iv = out;
+                                }
+                        memcpy(ivec,iv,CAMELLIA_BLOCK_SIZE);
+                        }
+                else if (in != out)
+                        {
+                        while (len >= CAMELLIA_BLOCK_SIZE)
+                                {
+                                memcpy(tmp.t8,in,CAMELLIA_BLOCK_SIZE);
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                key->dec(key->rd_key,tmp.t32);
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                for(n=0; n < CAMELLIA_BLOCK_SIZE; ++n)
+                                        out[n] = tmp.t8[n] ^ iv[n];
+                                iv = in;
+                                len -= CAMELLIA_BLOCK_SIZE;
+                                in  += CAMELLIA_BLOCK_SIZE;
+                                out += CAMELLIA_BLOCK_SIZE;
+                                }
+                        if (len)
+                                {
+                                memcpy(tmp.t8, in, CAMELLIA_BLOCK_SIZE);
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                key->dec(key->rd_key, tmp.t32);
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                for(n=0; n < len; ++n)
+                                        out[n] = tmp.t8[n] ^ iv[n];
+                                iv = in;
+                                }
+                        memcpy(ivec,iv,CAMELLIA_BLOCK_SIZE);
+                        }
+                else
+                        {
+                        while (len >= CAMELLIA_BLOCK_SIZE)
+                                {
+                                memcpy(tmp.t8, in, CAMELLIA_BLOCK_SIZE);
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                key->dec(key->rd_key, tmp.t32);
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                for(n=0; n < CAMELLIA_BLOCK_SIZE; ++n)
+                                        tmp.t8[n] ^= ivec[n];
+                                memcpy(ivec, in, CAMELLIA_BLOCK_SIZE);
+                                memcpy(out, tmp.t8, CAMELLIA_BLOCK_SIZE);
+                                len -= CAMELLIA_BLOCK_SIZE;
+                                in += CAMELLIA_BLOCK_SIZE;
+                                out += CAMELLIA_BLOCK_SIZE;
+                                }
+                        if (len)
+                                {
+                                memcpy(tmp.t8, in, CAMELLIA_BLOCK_SIZE);
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                key->dec(key->rd_key,tmp.t32);
+                                if (camellia_endian.little)
+                                        SWAP4WORD(tmp.t32);
+                                for(n=0; n < len; ++n)
+                                        tmp.t8[n] ^= ivec[n];
+                                memcpy(ivec, in, CAMELLIA_BLOCK_SIZE);
+                                memcpy(out,tmp.t8,len);
+                                }
+                        }
+                }
+}
diff --git a/src/lib/libssl/src/crypto/camellia/cmll_cfb.c b/src/lib/libssl/src/crypto/camellia/cmll_cfb.c
new file mode 100644
index 0000000000..af0f9f49ad
--- /dev/null
+++ b/src/lib/libssl/src/crypto/camellia/cmll_cfb.c
@@ -0,0 +1,235 @@
+/* crypto/camellia/camellia_cfb.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#ifndef CAMELLIA_DEBUG
+# ifndef NDEBUG
+#  define NDEBUG
+# endif
+#endif
+#include <assert.h>
+#include <string.h>
+
+#include <openssl/camellia.h>
+#include "cmll_locl.h"
+#include "e_os.h"
+
+
+/* The input and output encrypted as though 128bit cfb mode is being
+ * used.  The extra state information to record how much of the
+ * 128bit block we have used is contained in *num;
+ */
+
+void Camellia_cfb128_encrypt(const unsigned char *in, unsigned char *out,
+        const unsigned long length, const CAMELLIA_KEY *key,
+        unsigned char *ivec, int *num, const int enc)
+        {
+
+        unsigned int n;
+        unsigned long l = length;
+        unsigned char c;
+
+        assert(in && out && key && ivec && num);
+
+        n = *num;
+
+        if (enc) 
+                {
+                while (l--) 
+                        {
+                        if (n == 0) 
+                                {
+                                Camellia_encrypt(ivec, ivec, key);
+                                }
+                        ivec[n] = *(out++) = *(in++) ^ ivec[n];
+                        n = (n+1) % CAMELLIA_BLOCK_SIZE;
+                        }
+                } 
+        else 
+                {
+                while (l--) 
+                        {
+                        if (n == 0) 
+                                {
+                                Camellia_encrypt(ivec, ivec, key);
+                                }
+                        c = *(in);
+                        *(out++) = *(in++) ^ ivec[n];
+                        ivec[n] = c;
+                        n = (n+1) % CAMELLIA_BLOCK_SIZE;
+                        }
+                }
+
+        *num=n;
+        }
+
+/* This expects a single block of size nbits for both in and out. Note that
+   it corrupts any extra bits in the last byte of out */
+void Camellia_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
+        const int nbits,const CAMELLIA_KEY *key,
+        unsigned char *ivec,const int enc)
+        {
+        int n,rem,num;
+        unsigned char ovec[CAMELLIA_BLOCK_SIZE*2];
+
+        if (nbits<=0 || nbits>128) return;
+
+        /* fill in the first half of the new IV with the current IV */
+        memcpy(ovec,ivec,CAMELLIA_BLOCK_SIZE);
+        /* construct the new IV */
+        Camellia_encrypt(ivec,ivec,key);
+        num = (nbits+7)/8;
+        if (enc)        /* encrypt the input */
+                for(n=0 ; n < num ; ++n)
+                        out[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n] ^ ivec[n]);
+        else            /* decrypt the input */
+                for(n=0 ; n < num ; ++n)
+                        out[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n]) ^ ivec[n];
+        /* shift ovec left... */
+        rem = nbits%8;
+        num = nbits/8;
+        if(rem==0)
+                memcpy(ivec,ovec+num,CAMELLIA_BLOCK_SIZE);
+        else
+                for(n=0 ; n < CAMELLIA_BLOCK_SIZE ; ++n)
+                        ivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);
+
+        /* it is not necessary to cleanse ovec, since the IV is not secret */
+        }
+
+/* N.B. This expects the input to be packed, MS bit first */
+void Camellia_cfb1_encrypt(const unsigned char *in, unsigned char *out,
+        const unsigned long length, const CAMELLIA_KEY *key,
+        unsigned char *ivec, int *num, const int enc)
+        {
+        unsigned int n;
+        unsigned char c[1],d[1];
+
+        assert(in && out && key && ivec && num);
+        assert(*num == 0);
+
+        memset(out,0,(length+7)/8);
+        for(n=0 ; n < length ; ++n)
+                {
+                c[0]=(in[n/8]&(1 << (7-n%8))) ? 0x80 : 0;
+                Camellia_cfbr_encrypt_block(c,d,1,key,ivec,enc);
+                out[n/8]=(out[n/8]&~(1 << (7-n%8)))|((d[0]&0x80) >> (n%8));
+                }
+        }
+
+void Camellia_cfb8_encrypt(const unsigned char *in, unsigned char *out,
+        const unsigned long length, const CAMELLIA_KEY *key,
+        unsigned char *ivec, int *num, const int enc)
+        {
+        unsigned int n;
+
+        assert(in && out && key && ivec && num);
+        assert(*num == 0);
+
+        for(n=0 ; n < length ; ++n)
+                Camellia_cfbr_encrypt_block(&in[n],&out[n],8,key,ivec,enc);
+        }
+
diff --git a/src/lib/libssl/src/crypto/camellia/cmll_ctr.c b/src/lib/libssl/src/crypto/camellia/cmll_ctr.c
new file mode 100644
index 0000000000..cc21b70890
--- /dev/null
+++ b/src/lib/libssl/src/crypto/camellia/cmll_ctr.c
@@ -0,0 +1,143 @@
+/* crypto/camellia/camellia_ctr.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+
+#ifndef CAMELLIA_DEBUG
+# ifndef NDEBUG
+#  define NDEBUG
+# endif
+#endif
+#include <assert.h>
+
+#include <openssl/camellia.h>
+#include "cmll_locl.h"
+
+/* NOTE: the IV/counter CTR mode is big-endian.  The rest of the Camellia code
+ * is endian-neutral. */
+/* increment counter (128-bit int) by 1 */
+static void Camellia_ctr128_inc(unsigned char *counter) 
+        {
+        unsigned long c;
+
+        /* Grab bottom dword of counter and increment */
+        c = GETU32(counter + 12);
+        c++;    c &= 0xFFFFFFFF;
+        PUTU32(counter + 12, c);
+
+        /* if no overflow, we're done */
+        if (c)
+                return;
+
+        /* Grab 1st dword of counter and increment */
+        c = GETU32(counter +  8);
+        c++;    c &= 0xFFFFFFFF;
+        PUTU32(counter +  8, c);
+
+        /* if no overflow, we're done */
+        if (c)
+                return;
+
+        /* Grab 2nd dword of counter and increment */
+        c = GETU32(counter +  4);
+        c++;    c &= 0xFFFFFFFF;
+        PUTU32(counter +  4, c);
+
+        /* if no overflow, we're done */
+        if (c)
+                return;
+
+        /* Grab top dword of counter and increment */
+        c = GETU32(counter +  0);
+        c++;    c &= 0xFFFFFFFF;
+        PUTU32(counter +  0, c);
+        }
+
+/* The input encrypted as though 128bit counter mode is being
+ * used.  The extra state information to record how much of the
+ * 128bit block we have used is contained in *num, and the
+ * encrypted counter is kept in ecount_buf.  Both *num and
+ * ecount_buf must be initialised with zeros before the first
+ * call to Camellia_ctr128_encrypt().
+ *
+ * This algorithm assumes that the counter is in the x lower bits
+ * of the IV (ivec), and that the application has full control over
+ * overflow and the rest of the IV.  This implementation takes NO
+ * responsability for checking that the counter doesn't overflow
+ * into the rest of the IV when incremented.
+ */
+void Camellia_ctr128_encrypt(const unsigned char *in, unsigned char *out,
+        const unsigned long length, const CAMELLIA_KEY *key,
+        unsigned char ivec[CAMELLIA_BLOCK_SIZE],
+        unsigned char ecount_buf[CAMELLIA_BLOCK_SIZE],
+        unsigned int *num) 
+        {
+
+        unsigned int n;
+        unsigned long l=length;
+
+        assert(in && out && key && counter && num);
+        assert(*num < CAMELLIA_BLOCK_SIZE);
+
+        n = *num;
+
+        while (l--) 
+                {
+                if (n == 0) 
+                        {
+                        Camellia_encrypt(ivec, ecount_buf, key);
+                        Camellia_ctr128_inc(ivec);
+                        }
+                *(out++) = *(in++) ^ ecount_buf[n];
+                n = (n+1) % CAMELLIA_BLOCK_SIZE;
+                }
+
+        *num=n;
+        }
+
diff --git a/src/lib/libssl/src/crypto/camellia/cmll_ecb.c b/src/lib/libssl/src/crypto/camellia/cmll_ecb.c
new file mode 100644
index 0000000000..70dc0e5632
--- /dev/null
+++ b/src/lib/libssl/src/crypto/camellia/cmll_ecb.c
@@ -0,0 +1,74 @@
+/* crypto/camellia/camellia_ecb.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+
+#ifndef CAMELLIA_DEBUG
+# ifndef NDEBUG
+#  define NDEBUG
+# endif
+#endif
+#include <assert.h>
+
+#include <openssl/camellia.h>
+#include "cmll_locl.h"
+
+void Camellia_ecb_encrypt(const unsigned char *in, unsigned char *out,
+        const CAMELLIA_KEY *key, const int enc) 
+        {
+
+        assert(in && out && key);
+        assert((CAMELLIA_ENCRYPT == enc)||(CAMELLIA_DECRYPT == enc));
+
+        if (CAMELLIA_ENCRYPT == enc)
+                Camellia_encrypt(in, out, key);
+        else
+                Camellia_decrypt(in, out, key);
+        }
+
diff --git a/src/lib/libssl/src/crypto/camellia/cmll_locl.h b/src/lib/libssl/src/crypto/camellia/cmll_locl.h
new file mode 100644
index 0000000000..2ac2e95435
--- /dev/null
+++ b/src/lib/libssl/src/crypto/camellia/cmll_locl.h
@@ -0,0 +1,165 @@
+/* crypto/camellia/camellia_locl.h -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright 2006 NTT (Nippon Telegraph and Telephone Corporation) . 
+ * ALL RIGHTS RESERVED.
+ *
+ * Intellectual Property information for Camellia:
+ *     http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html
+ *
+ * News Release for Announcement of Camellia open source:
+ *     http://www.ntt.co.jp/news/news06e/0604/060413a.html
+ *
+ * The Camellia Code included herein is developed by
+ * NTT (Nippon Telegraph and Telephone Corporation), and is contributed
+ * to the OpenSSL project.
+ *
+ * The Camellia Code is licensed pursuant to the OpenSSL open source
+ * license provided below.
+ */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#ifndef HEADER_CAMELLIA_LOCL_H
+#define HEADER_CAMELLIA_LOCL_H
+
+#include "openssl/e_os2.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+typedef unsigned char u8;
+typedef unsigned int u32;
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_AMD64) || defined(_M_X64))
+# define SWAP(x) ( _lrotl(x, 8) & 0x00ff00ff | _lrotr(x, 8) & 0xff00ff00 )
+# define GETU32(p) SWAP(*((u32 *)(p)))
+# define PUTU32(ct, st) { *((u32 *)(ct)) = SWAP((st)); }
+# define CAMELLIA_SWAP4(x) (x = ( _lrotl(x, 8) & 0x00ff00ff | _lrotr(x, 8) & 0xff00ff00) )
+
+#else /* not windows */
+# define GETU32(pt) (((u32)(pt)[0] << 24) \
+        ^ ((u32)(pt)[1] << 16) \
+        ^ ((u32)(pt)[2] <<  8) \
+        ^ ((u32)(pt)[3]))
+
+# define PUTU32(ct, st) { (ct)[0] = (u8)((st) >> 24); \
+        (ct)[1] = (u8)((st) >> 16); \
+        (ct)[2] = (u8)((st) >>  8); \
+        (ct)[3] = (u8)(st); }
+
+#if (defined (__GNUC__) && (defined(__x86_64__) || defined(__x86_64)))
+#define CAMELLIA_SWAP4(x) \
+  do{\
+    asm("bswap %1" : "+r" (x));\
+  }while(0)
+#else
+#define CAMELLIA_SWAP4(x) \
+   do{\
+     x = ((u32)x << 16) + ((u32)x >> 16);\
+     x = (((u32)x & 0xff00ff) << 8) + (((u32)x >> 8) & 0xff00ff);\
+   } while(0)
+#endif
+#endif
+
+#define COPY4WORD(dst, src)      \
+             do                  \
+                     {           \
+                     (dst)[0]=(src)[0];         \
+                     (dst)[1]=(src)[1];         \
+                     (dst)[2]=(src)[2];         \
+                     (dst)[3]=(src)[3];         \
+                     }while(0)
+
+#define SWAP4WORD(word)                         \
+   do                                           \
+           {                                    \
+           CAMELLIA_SWAP4((word)[0]);                   \
+           CAMELLIA_SWAP4((word)[1]);                   \
+           CAMELLIA_SWAP4((word)[2]);                   \
+           CAMELLIA_SWAP4((word)[3]);                   \
+           }while(0)
+
+#define XOR4WORD(a, b)/* a = a ^ b */           \
+   do                                           \
+        {                                       \
+        (a)[0]^=(b)[0];                         \
+        (a)[1]^=(b)[1];                         \
+        (a)[2]^=(b)[2];                         \
+        (a)[3]^=(b)[3];                         \
+        }while(0)
+
+#define XOR4WORD2(a, b, c)/* a = b ^ c */       \
+   do                                           \
+        {                                       \
+        (a)[0]=(b)[0]^(c)[0];                   \
+        (a)[1]=(b)[1]^(c)[1];                           \
+        (a)[2]=(b)[2]^(c)[2];                           \
+        (a)[3]=(b)[3]^(c)[3];                           \
+        }while(0)
+
+
+void camellia_setup128(const u8 *key, u32 *subkey);
+void camellia_setup192(const u8 *key, u32 *subkey);
+void camellia_setup256(const u8 *key, u32 *subkey);
+
+void camellia_encrypt128(const u32 *subkey, u32 *io);
+void camellia_decrypt128(const u32 *subkey, u32 *io);
+void camellia_encrypt256(const u32 *subkey, u32 *io);
+void camellia_decrypt256(const u32 *subkey, u32 *io);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* #ifndef HEADER_CAMELLIA_LOCL_H */
+
diff --git a/src/lib/libssl/src/crypto/camellia/cmll_misc.c b/src/lib/libssl/src/crypto/camellia/cmll_misc.c
new file mode 100644
index 0000000000..f1047b54e0
--- /dev/null
+++ b/src/lib/libssl/src/crypto/camellia/cmll_misc.c
@@ -0,0 +1,116 @@
+/* crypto/camellia/camellia_misc.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+ 
+#include <openssl/opensslv.h>
+#include <openssl/camellia.h>
+#include "cmll_locl.h"
+
+const char CAMELLIA_version[]="CAMELLIA" OPENSSL_VERSION_PTEXT;
+
+int Camellia_set_key(const unsigned char *userKey, const int bits,
+        CAMELLIA_KEY *key)
+        {
+        if (!userKey || !key)
+                {
+                return -1;
+                }
+        
+        switch(bits)
+                {
+        case 128:
+                camellia_setup128(userKey, (unsigned int *)key->rd_key);
+                key->enc = camellia_encrypt128;
+                key->dec = camellia_decrypt128;
+                break;
+        case 192:
+                camellia_setup192(userKey, (unsigned int *)key->rd_key);
+                key->enc = camellia_encrypt256;
+                key->dec = camellia_decrypt256;
+                break;
+        case 256:
+                camellia_setup256(userKey, (unsigned int *)key->rd_key);
+                key->enc = camellia_encrypt256;
+                key->dec = camellia_decrypt256;
+                break;
+        default:
+                return -2;
+                }
+        
+        key->bitLength = bits;
+        return 0;
+        }
+
+void Camellia_encrypt(const unsigned char *in, unsigned char *out,
+        const CAMELLIA_KEY *key)
+        {
+        u32 tmp[CAMELLIA_BLOCK_SIZE/sizeof(u32)];
+        const union { long one; char little; } camellia_endian = {1};
+
+        memcpy(tmp, in, CAMELLIA_BLOCK_SIZE);
+        if (camellia_endian.little) SWAP4WORD(tmp);
+        key->enc(key->rd_key, tmp);
+        if (camellia_endian.little) SWAP4WORD(tmp);
+        memcpy(out, tmp, CAMELLIA_BLOCK_SIZE);
+        }
+
+void Camellia_decrypt(const unsigned char *in, unsigned char *out,
+        const CAMELLIA_KEY *key)
+        {
+        u32 tmp[CAMELLIA_BLOCK_SIZE/sizeof(u32)];
+        const union { long one; char little; } camellia_endian = {1};
+
+        memcpy(tmp, in, CAMELLIA_BLOCK_SIZE);
+        if (camellia_endian.little) SWAP4WORD(tmp);
+        key->dec(key->rd_key, tmp);
+        if (camellia_endian.little) SWAP4WORD(tmp);
+        memcpy(out, tmp, CAMELLIA_BLOCK_SIZE);
+        }
+
diff --git a/src/lib/libssl/src/crypto/camellia/cmll_ofb.c b/src/lib/libssl/src/crypto/camellia/cmll_ofb.c
new file mode 100644
index 0000000000..d89cf9f3b3
--- /dev/null
+++ b/src/lib/libssl/src/crypto/camellia/cmll_ofb.c
@@ -0,0 +1,141 @@
+/* crypto/camellia/camellia_ofb.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#ifndef CAMELLIA_DEBUG
+# ifndef NDEBUG
+#  define NDEBUG
+# endif
+#endif
+#include <assert.h>
+#include <openssl/camellia.h>
+#include "cmll_locl.h"
+
+/* The input and output encrypted as though 128bit ofb mode is being
+ * used.  The extra state information to record how much of the
+ * 128bit block we have used is contained in *num;
+ */
+void Camellia_ofb128_encrypt(const unsigned char *in, unsigned char *out,
+        const unsigned long length, const CAMELLIA_KEY *key,
+        unsigned char *ivec, int *num) {
+
+        unsigned int n;
+        unsigned long l=length;
+
+        assert(in && out && key && ivec && num);
+
+        n = *num;
+
+        while (l--) {
+                if (n == 0) {
+                        Camellia_encrypt(ivec, ivec, key);
+                }
+                *(out++) = *(in++) ^ ivec[n];
+                n = (n+1) % CAMELLIA_BLOCK_SIZE;
+        }
+
+        *num=n;
+}
diff --git a/src/lib/libssl/src/crypto/cms/Makefile b/src/lib/libssl/src/crypto/cms/Makefile
new file mode 100644
index 0000000000..e39c310b6c
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/Makefile
@@ -0,0 +1,183 @@
+#
+# OpenSSL/crypto/cms/Makefile
+#
+
+DIR=    cms
+TOP=    ../..
+CC=     cc
+INCLUDES= -I.. -I$(TOP) -I../../include
+CFLAG=-g
+MAKEFILE=       Makefile
+AR=             ar r
+
+CFLAGS= $(INCLUDES) $(CFLAG)
+
+GENERAL=Makefile
+TEST=
+APPS=
+
+LIB=$(TOP)/libcrypto.a
+LIBSRC= cms_lib.c cms_asn1.c cms_att.c cms_io.c cms_smime.c cms_err.c \
+        cms_sd.c cms_dd.c cms_cd.c cms_env.c cms_enc.c cms_ess.c
+LIBOBJ= cms_lib.o cms_asn1.o cms_att.o cms_io.o cms_smime.o cms_err.o \
+        cms_sd.o cms_dd.o cms_cd.o cms_env.o cms_enc.o cms_ess.o
+
+SRC= $(LIBSRC)
+
+EXHEADER=  cms.h
+HEADER= cms_lcl.h $(EXHEADER)
+
+ALL=    $(GENERAL) $(SRC) $(HEADER)
+
+top:
+        (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
+
+test:
+
+all:    lib
+
+lib:    $(LIBOBJ)
+        $(AR) $(LIB) $(LIBOBJ)
+        $(RANLIB) $(LIB) || echo Never mind.
+        @touch lib
+
+files:
+        $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
+
+links:
+        @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
+        @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
+        @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
+
+install:
+        @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
+        @headerlist="$(EXHEADER)"; for i in $$headerlist ; \
+        do  \
+        (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
+        chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
+        done;
+
+tags:
+        ctags $(SRC)
+
+tests:
+
+lint:
+        lint -DLINT $(INCLUDES) $(SRC)>fluff
+
+depend:
+        @[ -n "$(MAKEDEPEND)" ] # should be set by upper Makefile...
+        $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
+
+dclean:
+        $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
+        mv -f Makefile.new $(MAKEFILE)
+
+clean:
+        rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+cms_asn1.o: ../../include/openssl/asn1.h ../../include/openssl/asn1t.h
+cms_asn1.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
+cms_asn1.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+cms_asn1.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+cms_asn1.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
+cms_asn1.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
+cms_asn1.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+cms_asn1.o: ../../include/openssl/opensslconf.h
+cms_asn1.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+cms_asn1.o: ../../include/openssl/pem.h ../../include/openssl/pem2.h
+cms_asn1.o: ../../include/openssl/pkcs7.h ../../include/openssl/safestack.h
+cms_asn1.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+cms_asn1.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
+cms_asn1.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+cms_asn1.o: cms.h cms_asn1.c cms_lcl.h
+cms_att.o: ../../include/openssl/asn1.h ../../include/openssl/asn1t.h
+cms_att.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
+cms_att.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+cms_att.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+cms_att.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
+cms_att.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+cms_att.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
+cms_att.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+cms_att.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+cms_att.o: ../../include/openssl/pem.h ../../include/openssl/pem2.h
+cms_att.o: ../../include/openssl/pkcs7.h ../../include/openssl/safestack.h
+cms_att.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+cms_att.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
+cms_att.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+cms_att.o: cms.h cms_att.c cms_lcl.h
+cms_err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+cms_err.o: ../../include/openssl/buffer.h ../../include/openssl/cms.h
+cms_err.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+cms_err.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
+cms_err.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
+cms_err.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
+cms_err.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+cms_err.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+cms_err.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
+cms_err.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+cms_err.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+cms_err.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+cms_err.o: cms_err.c
+cms_io.o: ../../include/openssl/asn1.h ../../include/openssl/asn1t.h
+cms_io.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
+cms_io.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+cms_io.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
+cms_io.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
+cms_io.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
+cms_io.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+cms_io.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+cms_io.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pem.h
+cms_io.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs7.h
+cms_io.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+cms_io.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+cms_io.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h cms.h
+cms_io.o: cms_io.c cms_lcl.h
+cms_lib.o: ../../include/openssl/asn1.h ../../include/openssl/asn1t.h
+cms_lib.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
+cms_lib.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+cms_lib.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
+cms_lib.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
+cms_lib.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
+cms_lib.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+cms_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+cms_lib.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pem.h
+cms_lib.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs7.h
+cms_lib.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+cms_lib.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+cms_lib.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h cms.h
+cms_lib.o: cms_lcl.h cms_lib.c
+cms_sd.o: ../../e_os.h ../../include/openssl/asn1.h
+cms_sd.o: ../../include/openssl/asn1t.h ../../include/openssl/bio.h
+cms_sd.o: ../../include/openssl/buffer.h ../../include/openssl/cms.h
+cms_sd.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+cms_sd.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+cms_sd.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
+cms_sd.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+cms_sd.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
+cms_sd.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+cms_sd.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+cms_sd.o: ../../include/openssl/pem.h ../../include/openssl/pem2.h
+cms_sd.o: ../../include/openssl/pkcs7.h ../../include/openssl/safestack.h
+cms_sd.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+cms_sd.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
+cms_sd.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+cms_sd.o: ../cryptlib.h cms_lcl.h cms_sd.c
+cms_smime.o: ../../e_os.h ../../include/openssl/asn1.h
+cms_smime.o: ../../include/openssl/asn1t.h ../../include/openssl/bio.h
+cms_smime.o: ../../include/openssl/buffer.h ../../include/openssl/cms.h
+cms_smime.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+cms_smime.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+cms_smime.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
+cms_smime.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+cms_smime.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
+cms_smime.o: ../../include/openssl/objects.h
+cms_smime.o: ../../include/openssl/opensslconf.h
+cms_smime.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+cms_smime.o: ../../include/openssl/pkcs7.h ../../include/openssl/safestack.h
+cms_smime.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+cms_smime.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
+cms_smime.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+cms_smime.o: ../cryptlib.h cms_lcl.h cms_smime.c
diff --git a/src/lib/libssl/src/crypto/cms/cms.h b/src/lib/libssl/src/crypto/cms/cms.h
new file mode 100644
index 0000000000..25f88745f2
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms.h
@@ -0,0 +1,473 @@
+/* crypto/cms/cms.h */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+
+#ifndef HEADER_CMS_H
+#define HEADER_CMS_H
+
+#include <openssl/x509.h>
+
+#ifdef OPENSSL_NO_CMS
+#error CMS is disabled.
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+typedef struct CMS_ContentInfo_st CMS_ContentInfo;
+typedef struct CMS_SignerInfo_st CMS_SignerInfo;
+typedef struct CMS_CertificateChoices CMS_CertificateChoices;
+typedef struct CMS_RevocationInfoChoice_st CMS_RevocationInfoChoice;
+typedef struct CMS_RecipientInfo_st CMS_RecipientInfo;
+typedef struct CMS_ReceiptRequest_st CMS_ReceiptRequest;
+typedef struct CMS_Receipt_st CMS_Receipt;
+
+DECLARE_STACK_OF(CMS_SignerInfo)
+DECLARE_STACK_OF(GENERAL_NAMES)
+DECLARE_ASN1_FUNCTIONS_const(CMS_ContentInfo)
+DECLARE_ASN1_FUNCTIONS_const(CMS_ReceiptRequest)
+
+#define CMS_SIGNERINFO_ISSUER_SERIAL    0
+#define CMS_SIGNERINFO_KEYIDENTIFIER    1
+
+#define CMS_RECIPINFO_TRANS             0
+#define CMS_RECIPINFO_AGREE             1
+#define CMS_RECIPINFO_KEK               2
+#define CMS_RECIPINFO_PASS              3
+#define CMS_RECIPINFO_OTHER             4
+
+/* S/MIME related flags */
+
+#define CMS_TEXT                        0x1
+#define CMS_NOCERTS                     0x2
+#define CMS_NO_CONTENT_VERIFY           0x4
+#define CMS_NO_ATTR_VERIFY              0x8
+#define CMS_NOSIGS                      \
+                        (CMS_NO_CONTENT_VERIFY|CMS_NO_ATTR_VERIFY)
+#define CMS_NOINTERN                    0x10
+#define CMS_NO_SIGNER_CERT_VERIFY       0x20
+#define CMS_NOVERIFY                    0x20
+#define CMS_DETACHED                    0x40
+#define CMS_BINARY                      0x80
+#define CMS_NOATTR                      0x100
+#define CMS_NOSMIMECAP                  0x200
+#define CMS_NOOLDMIMETYPE               0x400
+#define CMS_CRLFEOL                     0x800
+#define CMS_STREAM                      0x1000
+#define CMS_NOCRL                       0x2000
+#define CMS_PARTIAL                     0x4000
+#define CMS_REUSE_DIGEST                0x8000
+#define CMS_USE_KEYID                   0x10000
+
+const ASN1_OBJECT *CMS_get0_type(CMS_ContentInfo *cms);
+
+BIO *CMS_dataInit(CMS_ContentInfo *cms, BIO *icont);
+int CMS_dataFinal(CMS_ContentInfo *cms, BIO *bio);
+
+ASN1_OCTET_STRING **CMS_get0_content(CMS_ContentInfo *cms);
+int CMS_is_detached(CMS_ContentInfo *cms);
+int CMS_set_detached(CMS_ContentInfo *cms, int detached);
+
+#ifdef HEADER_PEM_H
+DECLARE_PEM_rw_const(CMS, CMS_ContentInfo)
+#endif
+
+CMS_ContentInfo *d2i_CMS_bio(BIO *bp, CMS_ContentInfo **cms);
+int i2d_CMS_bio(BIO *bp, CMS_ContentInfo *cms);
+
+CMS_ContentInfo *SMIME_read_CMS(BIO *bio, BIO **bcont);
+int SMIME_write_CMS(BIO *bio, CMS_ContentInfo *cms, BIO *data, int flags);
+
+int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, unsigned int flags);
+
+CMS_ContentInfo *CMS_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
+                                                BIO *data, unsigned int flags);
+
+CMS_ContentInfo *CMS_sign_receipt(CMS_SignerInfo *si,
+                                        X509 *signcert, EVP_PKEY *pkey,
+                                        STACK_OF(X509) *certs,
+                                        unsigned int flags);
+
+int CMS_data(CMS_ContentInfo *cms, BIO *out, unsigned int flags);
+CMS_ContentInfo *CMS_data_create(BIO *in, unsigned int flags);
+
+int CMS_digest_verify(CMS_ContentInfo *cms, BIO *dcont, BIO *out,
+                                                        unsigned int flags);
+CMS_ContentInfo *CMS_digest_create(BIO *in, const EVP_MD *md,
+                                                        unsigned int flags);
+
+int CMS_EncryptedData_decrypt(CMS_ContentInfo *cms,
+                                const unsigned char *key, size_t keylen,
+                                BIO *dcont, BIO *out, unsigned int flags);
+
+CMS_ContentInfo *CMS_EncryptedData_encrypt(BIO *in, const EVP_CIPHER *cipher,
+                                        const unsigned char *key, size_t keylen,
+                                        unsigned int flags);
+
+int CMS_EncryptedData_set1_key(CMS_ContentInfo *cms, const EVP_CIPHER *ciph,
+                                const unsigned char *key, size_t keylen);
+
+int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
+                 X509_STORE *store, BIO *dcont, BIO *out, unsigned int flags);
+
+int CMS_verify_receipt(CMS_ContentInfo *rcms, CMS_ContentInfo *ocms,
+                        STACK_OF(X509) *certs,
+                        X509_STORE *store, unsigned int flags);
+
+STACK_OF(X509) *CMS_get0_signers(CMS_ContentInfo *cms);
+
+CMS_ContentInfo *CMS_encrypt(STACK_OF(X509) *certs, BIO *in,
+                                const EVP_CIPHER *cipher, unsigned int flags);
+
+int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pkey, X509 *cert,
+                                BIO *dcont, BIO *out,
+                                unsigned int flags);
+        
+int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert);
+int CMS_decrypt_set1_key(CMS_ContentInfo *cms, 
+                                unsigned char *key, size_t keylen,
+                                unsigned char *id, size_t idlen);
+
+STACK_OF(CMS_RecipientInfo) *CMS_get0_RecipientInfos(CMS_ContentInfo *cms);
+int CMS_RecipientInfo_type(CMS_RecipientInfo *ri);
+CMS_ContentInfo *CMS_EnvelopedData_create(const EVP_CIPHER *cipher);
+CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms,
+                                        X509 *recip, unsigned int flags);
+int CMS_RecipientInfo_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pkey);
+int CMS_RecipientInfo_ktri_cert_cmp(CMS_RecipientInfo *ri, X509 *cert);
+int CMS_RecipientInfo_ktri_get0_algs(CMS_RecipientInfo *ri,
+                                        EVP_PKEY **pk, X509 **recip,
+                                        X509_ALGOR **palg);
+int CMS_RecipientInfo_ktri_get0_signer_id(CMS_RecipientInfo *ri,
+                                        ASN1_OCTET_STRING **keyid,
+                                        X509_NAME **issuer, ASN1_INTEGER **sno);
+
+CMS_RecipientInfo *CMS_add0_recipient_key(CMS_ContentInfo *cms, int nid,
+                                        unsigned char *key, size_t keylen,
+                                        unsigned char *id, size_t idlen,
+                                        ASN1_GENERALIZEDTIME *date,
+                                        ASN1_OBJECT *otherTypeId,
+                                        ASN1_TYPE *otherType);
+
+int CMS_RecipientInfo_kekri_get0_id(CMS_RecipientInfo *ri,
+                                        X509_ALGOR **palg,
+                                        ASN1_OCTET_STRING **pid,
+                                        ASN1_GENERALIZEDTIME **pdate,
+                                        ASN1_OBJECT **potherid,
+                                        ASN1_TYPE **pothertype);
+
+int CMS_RecipientInfo_set0_key(CMS_RecipientInfo *ri, 
+                                unsigned char *key, size_t keylen);
+
+int CMS_RecipientInfo_kekri_id_cmp(CMS_RecipientInfo *ri, 
+                                        const unsigned char *id, size_t idlen);
+
+int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri);
+        
+int CMS_uncompress(CMS_ContentInfo *cms, BIO *dcont, BIO *out,
+                                                        unsigned int flags);
+CMS_ContentInfo *CMS_compress(BIO *in, int comp_nid, unsigned int flags);
+
+int CMS_set1_eContentType(CMS_ContentInfo *cms, const ASN1_OBJECT *oid);
+const ASN1_OBJECT *CMS_get0_eContentType(CMS_ContentInfo *cms);
+
+CMS_CertificateChoices *CMS_add0_CertificateChoices(CMS_ContentInfo *cms);
+int CMS_add0_cert(CMS_ContentInfo *cms, X509 *cert);
+int CMS_add1_cert(CMS_ContentInfo *cms, X509 *cert);
+STACK_OF(X509) *CMS_get1_certs(CMS_ContentInfo *cms);
+
+CMS_RevocationInfoChoice *CMS_add0_RevocationInfoChoice(CMS_ContentInfo *cms);
+int CMS_add0_crl(CMS_ContentInfo *cms, X509_CRL *crl);
+STACK_OF(X509_CRL) *CMS_get1_crls(CMS_ContentInfo *cms);
+
+int CMS_SignedData_init(CMS_ContentInfo *cms);
+CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
+                        X509 *signer, EVP_PKEY *pk, const EVP_MD *md,
+                        unsigned int flags);
+STACK_OF(CMS_SignerInfo) *CMS_get0_SignerInfos(CMS_ContentInfo *cms);
+
+void CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer);
+int CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si,
+                                        ASN1_OCTET_STRING **keyid,
+                                        X509_NAME **issuer, ASN1_INTEGER **sno);
+int CMS_SignerInfo_cert_cmp(CMS_SignerInfo *si, X509 *cert);
+int CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
+                                        unsigned int flags);
+void CMS_SignerInfo_get0_algs(CMS_SignerInfo *si, EVP_PKEY **pk, X509 **signer,
+                                        X509_ALGOR **pdig, X509_ALGOR **psig);
+int CMS_SignerInfo_sign(CMS_SignerInfo *si);
+int CMS_SignerInfo_verify(CMS_SignerInfo *si);
+int CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain);
+
+int CMS_add_smimecap(CMS_SignerInfo *si, STACK_OF(X509_ALGOR) *algs);
+int CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs,
+                                int algnid, int keysize);
+int CMS_add_standard_smimecap(STACK_OF(X509_ALGOR) **smcap);
+
+int CMS_signed_get_attr_count(const CMS_SignerInfo *si);
+int CMS_signed_get_attr_by_NID(const CMS_SignerInfo *si, int nid,
+                          int lastpos);
+int CMS_signed_get_attr_by_OBJ(const CMS_SignerInfo *si, ASN1_OBJECT *obj,
+                          int lastpos);
+X509_ATTRIBUTE *CMS_signed_get_attr(const CMS_SignerInfo *si, int loc);
+X509_ATTRIBUTE *CMS_signed_delete_attr(CMS_SignerInfo *si, int loc);
+int CMS_signed_add1_attr(CMS_SignerInfo *si, X509_ATTRIBUTE *attr);
+int CMS_signed_add1_attr_by_OBJ(CMS_SignerInfo *si,
+                        const ASN1_OBJECT *obj, int type,
+                        const void *bytes, int len);
+int CMS_signed_add1_attr_by_NID(CMS_SignerInfo *si,
+                        int nid, int type,
+                        const void *bytes, int len);
+int CMS_signed_add1_attr_by_txt(CMS_SignerInfo *si,
+                        const char *attrname, int type,
+                        const void *bytes, int len);
+void *CMS_signed_get0_data_by_OBJ(CMS_SignerInfo *si, ASN1_OBJECT *oid,
+                                        int lastpos, int type);
+
+int CMS_unsigned_get_attr_count(const CMS_SignerInfo *si);
+int CMS_unsigned_get_attr_by_NID(const CMS_SignerInfo *si, int nid,
+                          int lastpos);
+int CMS_unsigned_get_attr_by_OBJ(const CMS_SignerInfo *si, ASN1_OBJECT *obj,
+                          int lastpos);
+X509_ATTRIBUTE *CMS_unsigned_get_attr(const CMS_SignerInfo *si, int loc);
+X509_ATTRIBUTE *CMS_unsigned_delete_attr(CMS_SignerInfo *si, int loc);
+int CMS_unsigned_add1_attr(CMS_SignerInfo *si, X509_ATTRIBUTE *attr);
+int CMS_unsigned_add1_attr_by_OBJ(CMS_SignerInfo *si,
+                        const ASN1_OBJECT *obj, int type,
+                        const void *bytes, int len);
+int CMS_unsigned_add1_attr_by_NID(CMS_SignerInfo *si,
+                        int nid, int type,
+                        const void *bytes, int len);
+int CMS_unsigned_add1_attr_by_txt(CMS_SignerInfo *si,
+                        const char *attrname, int type,
+                        const void *bytes, int len);
+void *CMS_unsigned_get0_data_by_OBJ(CMS_SignerInfo *si, ASN1_OBJECT *oid,
+                                        int lastpos, int type);
+
+#ifdef HEADER_X509V3_H
+
+int CMS_get1_ReceiptRequest(CMS_SignerInfo *si, CMS_ReceiptRequest **prr);
+CMS_ReceiptRequest *CMS_ReceiptRequest_create0(unsigned char *id, int idlen,
+                                int allorfirst,
+                                STACK_OF(GENERAL_NAMES) *receiptList,
+                                STACK_OF(GENERAL_NAMES) *receiptsTo);
+int CMS_add1_ReceiptRequest(CMS_SignerInfo *si, CMS_ReceiptRequest *rr);
+void CMS_ReceiptRequest_get0_values(CMS_ReceiptRequest *rr,
+                                        ASN1_STRING **pcid,
+                                        int *pallorfirst,
+                                        STACK_OF(GENERAL_NAMES) **plist,
+                                        STACK_OF(GENERAL_NAMES) **prto);
+
+#endif
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+void ERR_load_CMS_strings(void);
+
+/* Error codes for the CMS functions. */
+
+/* Function codes. */
+#define CMS_F_CHECK_CONTENT                              99
+#define CMS_F_CMS_ADD0_CERT                              164
+#define CMS_F_CMS_ADD0_RECIPIENT_KEY                     100
+#define CMS_F_CMS_ADD1_RECEIPTREQUEST                    158
+#define CMS_F_CMS_ADD1_RECIPIENT_CERT                    101
+#define CMS_F_CMS_ADD1_SIGNER                            102
+#define CMS_F_CMS_ADD1_SIGNINGTIME                       103
+#define CMS_F_CMS_COMPRESS                               104
+#define CMS_F_CMS_COMPRESSEDDATA_CREATE                  105
+#define CMS_F_CMS_COMPRESSEDDATA_INIT_BIO                106
+#define CMS_F_CMS_COPY_CONTENT                           107
+#define CMS_F_CMS_COPY_MESSAGEDIGEST                     108
+#define CMS_F_CMS_DATA                                   109
+#define CMS_F_CMS_DATAFINAL                              110
+#define CMS_F_CMS_DATAINIT                               111
+#define CMS_F_CMS_DECRYPT                                112
+#define CMS_F_CMS_DECRYPT_SET1_KEY                       113
+#define CMS_F_CMS_DECRYPT_SET1_PKEY                      114
+#define CMS_F_CMS_DIGESTALGORITHM_FIND_CTX               115
+#define CMS_F_CMS_DIGESTALGORITHM_INIT_BIO               116
+#define CMS_F_CMS_DIGESTEDDATA_DO_FINAL                  117
+#define CMS_F_CMS_DIGEST_VERIFY                          118
+#define CMS_F_CMS_ENCODE_RECEIPT                         161
+#define CMS_F_CMS_ENCRYPT                                119
+#define CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO              120
+#define CMS_F_CMS_ENCRYPTEDDATA_DECRYPT                  121
+#define CMS_F_CMS_ENCRYPTEDDATA_ENCRYPT                  122
+#define CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY                 123
+#define CMS_F_CMS_ENVELOPEDDATA_CREATE                   124
+#define CMS_F_CMS_ENVELOPEDDATA_INIT_BIO                 125
+#define CMS_F_CMS_ENVELOPED_DATA_INIT                    126
+#define CMS_F_CMS_FINAL                                  127
+#define CMS_F_CMS_GET0_CERTIFICATE_CHOICES               128
+#define CMS_F_CMS_GET0_CONTENT                           129
+#define CMS_F_CMS_GET0_ECONTENT_TYPE                     130
+#define CMS_F_CMS_GET0_ENVELOPED                         131
+#define CMS_F_CMS_GET0_REVOCATION_CHOICES                132
+#define CMS_F_CMS_GET0_SIGNED                            133
+#define CMS_F_CMS_MSGSIGDIGEST_ADD1                      162
+#define CMS_F_CMS_RECEIPTREQUEST_CREATE0                 159
+#define CMS_F_CMS_RECEIPT_VERIFY                         160
+#define CMS_F_CMS_RECIPIENTINFO_DECRYPT                  134
+#define CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT            135
+#define CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT            136
+#define CMS_F_CMS_RECIPIENTINFO_KEKRI_GET0_ID            137
+#define CMS_F_CMS_RECIPIENTINFO_KEKRI_ID_CMP             138
+#define CMS_F_CMS_RECIPIENTINFO_KTRI_CERT_CMP            139
+#define CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT             140
+#define CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT             141
+#define CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_ALGS           142
+#define CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_SIGNER_ID      143
+#define CMS_F_CMS_RECIPIENTINFO_SET0_KEY                 144
+#define CMS_F_CMS_RECIPIENTINFO_SET0_PKEY                145
+#define CMS_F_CMS_SET1_SIGNERIDENTIFIER                  146
+#define CMS_F_CMS_SET_DETACHED                           147
+#define CMS_F_CMS_SIGN                                   148
+#define CMS_F_CMS_SIGNED_DATA_INIT                       149
+#define CMS_F_CMS_SIGNERINFO_CONTENT_SIGN                150
+#define CMS_F_CMS_SIGNERINFO_SIGN                        151
+#define CMS_F_CMS_SIGNERINFO_VERIFY                      152
+#define CMS_F_CMS_SIGNERINFO_VERIFY_CERT                 153
+#define CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT              154
+#define CMS_F_CMS_SIGN_RECEIPT                           163
+#define CMS_F_CMS_STREAM                                 155
+#define CMS_F_CMS_UNCOMPRESS                             156
+#define CMS_F_CMS_VERIFY                                 157
+
+/* Reason codes. */
+#define CMS_R_ADD_SIGNER_ERROR                           99
+#define CMS_R_CERTIFICATE_ALREADY_PRESENT                175
+#define CMS_R_CERTIFICATE_HAS_NO_KEYID                   160
+#define CMS_R_CERTIFICATE_VERIFY_ERROR                   100
+#define CMS_R_CIPHER_INITIALISATION_ERROR                101
+#define CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR      102
+#define CMS_R_CMS_DATAFINAL_ERROR                        103
+#define CMS_R_CMS_LIB                                    104
+#define CMS_R_CONTENTIDENTIFIER_MISMATCH                 170
+#define CMS_R_CONTENT_NOT_FOUND                          105
+#define CMS_R_CONTENT_TYPE_MISMATCH                      171
+#define CMS_R_CONTENT_TYPE_NOT_COMPRESSED_DATA           106
+#define CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA            107
+#define CMS_R_CONTENT_TYPE_NOT_SIGNED_DATA               108
+#define CMS_R_CONTENT_VERIFY_ERROR                       109
+#define CMS_R_CTRL_ERROR                                 110
+#define CMS_R_CTRL_FAILURE                               111
+#define CMS_R_DECRYPT_ERROR                              112
+#define CMS_R_DIGEST_ERROR                               161
+#define CMS_R_ERROR_GETTING_PUBLIC_KEY                   113
+#define CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE      114
+#define CMS_R_ERROR_SETTING_KEY                          115
+#define CMS_R_ERROR_SETTING_RECIPIENTINFO                116
+#define CMS_R_INVALID_ENCRYPTED_KEY_LENGTH               117
+#define CMS_R_INVALID_KEY_LENGTH                         118
+#define CMS_R_MD_BIO_INIT_ERROR                          119
+#define CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH       120
+#define CMS_R_MESSAGEDIGEST_WRONG_LENGTH                 121
+#define CMS_R_MSGSIGDIGEST_ERROR                         172
+#define CMS_R_MSGSIGDIGEST_VERIFICATION_FAILURE          162
+#define CMS_R_MSGSIGDIGEST_WRONG_LENGTH                  163
+#define CMS_R_NEED_ONE_SIGNER                            164
+#define CMS_R_NOT_A_SIGNED_RECEIPT                       165
+#define CMS_R_NOT_ENCRYPTED_DATA                         122
+#define CMS_R_NOT_KEK                                    123
+#define CMS_R_NOT_KEY_TRANSPORT                          124
+#define CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE            125
+#define CMS_R_NO_CIPHER                                  126
+#define CMS_R_NO_CONTENT                                 127
+#define CMS_R_NO_CONTENT_TYPE                            173
+#define CMS_R_NO_DEFAULT_DIGEST                          128
+#define CMS_R_NO_DIGEST_SET                              129
+#define CMS_R_NO_KEY                                     130
+#define CMS_R_NO_KEY_OR_CERT                             174
+#define CMS_R_NO_MATCHING_DIGEST                         131
+#define CMS_R_NO_MATCHING_RECIPIENT                      132
+#define CMS_R_NO_MATCHING_SIGNATURE                      166
+#define CMS_R_NO_MSGSIGDIGEST                            167
+#define CMS_R_NO_PRIVATE_KEY                             133
+#define CMS_R_NO_PUBLIC_KEY                              134
+#define CMS_R_NO_RECEIPT_REQUEST                         168
+#define CMS_R_NO_SIGNERS                                 135
+#define CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE     136
+#define CMS_R_RECEIPT_DECODE_ERROR                       169
+#define CMS_R_RECIPIENT_ERROR                            137
+#define CMS_R_SIGNER_CERTIFICATE_NOT_FOUND               138
+#define CMS_R_SIGNFINAL_ERROR                            139
+#define CMS_R_SMIME_TEXT_ERROR                           140
+#define CMS_R_STORE_INIT_ERROR                           141
+#define CMS_R_TYPE_NOT_COMPRESSED_DATA                   142
+#define CMS_R_TYPE_NOT_DATA                              143
+#define CMS_R_TYPE_NOT_DIGESTED_DATA                     144
+#define CMS_R_TYPE_NOT_ENCRYPTED_DATA                    145
+#define CMS_R_TYPE_NOT_ENVELOPED_DATA                    146
+#define CMS_R_UNABLE_TO_FINALIZE_CONTEXT                 147
+#define CMS_R_UNKNOWN_CIPHER                             148
+#define CMS_R_UNKNOWN_DIGEST_ALGORIHM                    149
+#define CMS_R_UNKNOWN_ID                                 150
+#define CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM          151
+#define CMS_R_UNSUPPORTED_CONTENT_TYPE                   152
+#define CMS_R_UNSUPPORTED_KEK_ALGORITHM                  153
+#define CMS_R_UNSUPPORTED_RECIPIENT_TYPE                 154
+#define CMS_R_UNSUPPORTED_RECPIENTINFO_TYPE              155
+#define CMS_R_UNSUPPORTED_TYPE                           156
+#define CMS_R_UNWRAP_ERROR                               157
+#define CMS_R_VERIFICATION_FAILURE                       158
+#define CMS_R_WRAP_ERROR                                 159
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/crypto/cms/cms_asn1.c b/src/lib/libssl/src/crypto/cms/cms_asn1.c
new file mode 100644
index 0000000000..7664921861
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_asn1.c
@@ -0,0 +1,346 @@
+/* crypto/cms/cms_asn1.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include <openssl/asn1t.h>
+#include <openssl/pem.h>
+#include <openssl/x509v3.h>
+#include "cms.h"
+#include "cms_lcl.h"
+
+
+ASN1_SEQUENCE(CMS_IssuerAndSerialNumber) = {
+        ASN1_SIMPLE(CMS_IssuerAndSerialNumber, issuer, X509_NAME),
+        ASN1_SIMPLE(CMS_IssuerAndSerialNumber, serialNumber, ASN1_INTEGER)
+} ASN1_SEQUENCE_END(CMS_IssuerAndSerialNumber)
+
+ASN1_SEQUENCE(CMS_OtherCertificateFormat) = {
+        ASN1_SIMPLE(CMS_OtherCertificateFormat, otherCertFormat, ASN1_OBJECT),
+        ASN1_OPT(CMS_OtherCertificateFormat, otherCert, ASN1_ANY)
+} ASN1_SEQUENCE_END(CMS_OtherCertificateFormat)
+
+ASN1_CHOICE(CMS_CertificateChoices) = {
+        ASN1_SIMPLE(CMS_CertificateChoices, d.certificate, X509),
+        ASN1_IMP(CMS_CertificateChoices, d.extendedCertificate, ASN1_SEQUENCE, 0),
+        ASN1_IMP(CMS_CertificateChoices, d.v1AttrCert, ASN1_SEQUENCE, 1),
+        ASN1_IMP(CMS_CertificateChoices, d.v2AttrCert, ASN1_SEQUENCE, 2),
+        ASN1_IMP(CMS_CertificateChoices, d.other, CMS_OtherCertificateFormat, 3)
+} ASN1_CHOICE_END(CMS_CertificateChoices)
+
+ASN1_CHOICE(CMS_SignerIdentifier) = {
+        ASN1_SIMPLE(CMS_SignerIdentifier, d.issuerAndSerialNumber, CMS_IssuerAndSerialNumber),
+        ASN1_IMP(CMS_SignerIdentifier, d.subjectKeyIdentifier, ASN1_OCTET_STRING, 0)
+} ASN1_CHOICE_END(CMS_SignerIdentifier)
+
+ASN1_NDEF_SEQUENCE(CMS_EncapsulatedContentInfo) = {
+        ASN1_SIMPLE(CMS_EncapsulatedContentInfo, eContentType, ASN1_OBJECT),
+        ASN1_NDEF_EXP_OPT(CMS_EncapsulatedContentInfo, eContent, ASN1_OCTET_STRING_NDEF, 0)
+} ASN1_NDEF_SEQUENCE_END(CMS_EncapsulatedContentInfo)
+
+/* Minor tweak to operation: free up signer key, cert */
+static int cms_si_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it)
+        {
+        if(operation == ASN1_OP_FREE_POST)
+                {
+                CMS_SignerInfo *si = (CMS_SignerInfo *)*pval;
+                if (si->pkey)
+                        EVP_PKEY_free(si->pkey);
+                if (si->signer)
+                        X509_free(si->signer);
+                }
+        return 1;
+        }
+
+ASN1_SEQUENCE_cb(CMS_SignerInfo, cms_si_cb) = {
+        ASN1_SIMPLE(CMS_SignerInfo, version, LONG),
+        ASN1_SIMPLE(CMS_SignerInfo, sid, CMS_SignerIdentifier),
+        ASN1_SIMPLE(CMS_SignerInfo, digestAlgorithm, X509_ALGOR),
+        ASN1_IMP_SET_OF_OPT(CMS_SignerInfo, signedAttrs, X509_ATTRIBUTE, 0),
+        ASN1_SIMPLE(CMS_SignerInfo, signatureAlgorithm, X509_ALGOR),
+        ASN1_SIMPLE(CMS_SignerInfo, signature, ASN1_OCTET_STRING),
+        ASN1_IMP_SET_OF_OPT(CMS_SignerInfo, unsignedAttrs, X509_ATTRIBUTE, 1)
+} ASN1_SEQUENCE_END_cb(CMS_SignerInfo, CMS_SignerInfo)
+
+ASN1_SEQUENCE(CMS_OtherRevocationInfoFormat) = {
+        ASN1_SIMPLE(CMS_OtherRevocationInfoFormat, otherRevInfoFormat, ASN1_OBJECT),
+        ASN1_OPT(CMS_OtherRevocationInfoFormat, otherRevInfo, ASN1_ANY)
+} ASN1_SEQUENCE_END(CMS_OtherRevocationInfoFormat)
+
+ASN1_CHOICE(CMS_RevocationInfoChoice) = {
+        ASN1_SIMPLE(CMS_RevocationInfoChoice, d.crl, X509_CRL),
+        ASN1_IMP(CMS_RevocationInfoChoice, d.other, CMS_OtherRevocationInfoFormat, 1)
+} ASN1_CHOICE_END(CMS_RevocationInfoChoice)
+
+ASN1_NDEF_SEQUENCE(CMS_SignedData) = {
+        ASN1_SIMPLE(CMS_SignedData, version, LONG),
+        ASN1_SET_OF(CMS_SignedData, digestAlgorithms, X509_ALGOR),
+        ASN1_SIMPLE(CMS_SignedData, encapContentInfo, CMS_EncapsulatedContentInfo),
+        ASN1_IMP_SET_OF_OPT(CMS_SignedData, certificates, CMS_CertificateChoices, 0),
+        ASN1_IMP_SET_OF_OPT(CMS_SignedData, crls, CMS_RevocationInfoChoice, 1),
+        ASN1_SET_OF(CMS_SignedData, signerInfos, CMS_SignerInfo)
+} ASN1_NDEF_SEQUENCE_END(CMS_SignedData)
+
+ASN1_SEQUENCE(CMS_OriginatorInfo) = {
+        ASN1_IMP_SET_OF_OPT(CMS_SignedData, certificates, CMS_CertificateChoices, 0),
+        ASN1_IMP_SET_OF_OPT(CMS_SignedData, crls, CMS_RevocationInfoChoice, 1)
+} ASN1_SEQUENCE_END(CMS_OriginatorInfo)
+
+ASN1_NDEF_SEQUENCE(CMS_EncryptedContentInfo) = {
+        ASN1_SIMPLE(CMS_EncryptedContentInfo, contentType, ASN1_OBJECT),
+        ASN1_SIMPLE(CMS_EncryptedContentInfo, contentEncryptionAlgorithm, X509_ALGOR),
+        ASN1_IMP_OPT(CMS_EncryptedContentInfo, encryptedContent, ASN1_OCTET_STRING_NDEF, 0)
+} ASN1_NDEF_SEQUENCE_END(CMS_EncryptedContentInfo)
+
+ASN1_SEQUENCE(CMS_KeyTransRecipientInfo) = {
+        ASN1_SIMPLE(CMS_KeyTransRecipientInfo, version, LONG),
+        ASN1_SIMPLE(CMS_KeyTransRecipientInfo, rid, CMS_SignerIdentifier),
+        ASN1_SIMPLE(CMS_KeyTransRecipientInfo, keyEncryptionAlgorithm, X509_ALGOR),
+        ASN1_SIMPLE(CMS_KeyTransRecipientInfo, encryptedKey, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END(CMS_KeyTransRecipientInfo)
+
+ASN1_SEQUENCE(CMS_OtherKeyAttribute) = {
+        ASN1_SIMPLE(CMS_OtherKeyAttribute, keyAttrId, ASN1_OBJECT),
+        ASN1_OPT(CMS_OtherKeyAttribute, keyAttr, ASN1_ANY)
+} ASN1_SEQUENCE_END(CMS_OtherKeyAttribute)
+
+ASN1_SEQUENCE(CMS_RecipientKeyIdentifier) = {
+        ASN1_SIMPLE(CMS_RecipientKeyIdentifier, subjectKeyIdentifier, ASN1_OCTET_STRING),
+        ASN1_OPT(CMS_RecipientKeyIdentifier, date, ASN1_GENERALIZEDTIME),
+        ASN1_OPT(CMS_RecipientKeyIdentifier, other, CMS_OtherKeyAttribute)
+} ASN1_SEQUENCE_END(CMS_RecipientKeyIdentifier)
+
+ASN1_CHOICE(CMS_KeyAgreeRecipientIdentifier) = {
+  ASN1_SIMPLE(CMS_KeyAgreeRecipientIdentifier, d.issuerAndSerialNumber, CMS_IssuerAndSerialNumber),
+  ASN1_IMP(CMS_KeyAgreeRecipientIdentifier, d.rKeyId, CMS_RecipientKeyIdentifier, 0)
+} ASN1_CHOICE_END(CMS_KeyAgreeRecipientIdentifier)
+
+ASN1_SEQUENCE(CMS_RecipientEncryptedKey) = {
+        ASN1_SIMPLE(CMS_RecipientEncryptedKey, rid, CMS_KeyAgreeRecipientIdentifier),
+        ASN1_SIMPLE(CMS_RecipientEncryptedKey, encryptedKey, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END(CMS_RecipientEncryptedKey)
+
+ASN1_SEQUENCE(CMS_OriginatorPublicKey) = {
+  ASN1_SIMPLE(CMS_OriginatorPublicKey, algorithm, X509_ALGOR),
+  ASN1_SIMPLE(CMS_OriginatorPublicKey, publicKey, ASN1_BIT_STRING)
+} ASN1_SEQUENCE_END(CMS_OriginatorPublicKey)
+
+ASN1_CHOICE(CMS_OriginatorIdentifierOrKey) = {
+  ASN1_SIMPLE(CMS_OriginatorIdentifierOrKey, d.issuerAndSerialNumber, CMS_IssuerAndSerialNumber),
+  ASN1_IMP(CMS_OriginatorIdentifierOrKey, d.subjectKeyIdentifier, ASN1_OCTET_STRING, 0),
+  ASN1_IMP(CMS_OriginatorIdentifierOrKey, d.originatorKey, CMS_OriginatorPublicKey, 1)
+} ASN1_CHOICE_END(CMS_OriginatorIdentifierOrKey)
+
+ASN1_SEQUENCE(CMS_KeyAgreeRecipientInfo) = {
+        ASN1_SIMPLE(CMS_KeyAgreeRecipientInfo, version, LONG),
+        ASN1_EXP(CMS_KeyAgreeRecipientInfo, originator, CMS_OriginatorIdentifierOrKey, 0),
+        ASN1_EXP_OPT(CMS_KeyAgreeRecipientInfo, ukm, ASN1_OCTET_STRING, 1),
+        ASN1_SIMPLE(CMS_KeyAgreeRecipientInfo, keyEncryptionAlgorithm, X509_ALGOR),
+        ASN1_SEQUENCE_OF(CMS_KeyAgreeRecipientInfo, recipientEncryptedKeys, CMS_RecipientEncryptedKey)
+} ASN1_SEQUENCE_END(CMS_KeyAgreeRecipientInfo)
+
+ASN1_SEQUENCE(CMS_KEKIdentifier) = {
+        ASN1_SIMPLE(CMS_KEKIdentifier, keyIdentifier, ASN1_OCTET_STRING),
+        ASN1_OPT(CMS_KEKIdentifier, date, ASN1_GENERALIZEDTIME),
+        ASN1_OPT(CMS_KEKIdentifier, other, CMS_OtherKeyAttribute)
+} ASN1_SEQUENCE_END(CMS_KEKIdentifier)
+
+ASN1_SEQUENCE(CMS_KEKRecipientInfo) = {
+        ASN1_SIMPLE(CMS_KEKRecipientInfo, version, LONG),
+        ASN1_SIMPLE(CMS_KEKRecipientInfo, kekid, CMS_KEKIdentifier),
+        ASN1_SIMPLE(CMS_KEKRecipientInfo, keyEncryptionAlgorithm, X509_ALGOR),
+        ASN1_SIMPLE(CMS_KEKRecipientInfo, encryptedKey, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END(CMS_KEKRecipientInfo)
+
+ASN1_SEQUENCE(CMS_PasswordRecipientInfo) = {
+        ASN1_SIMPLE(CMS_PasswordRecipientInfo, version, LONG),
+        ASN1_IMP_OPT(CMS_PasswordRecipientInfo, keyDerivationAlgorithm, X509_ALGOR, 0),
+        ASN1_SIMPLE(CMS_PasswordRecipientInfo, keyEncryptionAlgorithm, X509_ALGOR),
+        ASN1_SIMPLE(CMS_PasswordRecipientInfo, encryptedKey, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END(CMS_PasswordRecipientInfo)
+
+ASN1_SEQUENCE(CMS_OtherRecipientInfo) = {
+  ASN1_SIMPLE(CMS_OtherRecipientInfo, oriType, ASN1_OBJECT),
+  ASN1_OPT(CMS_OtherRecipientInfo, oriValue, ASN1_ANY)
+} ASN1_SEQUENCE_END(CMS_OtherRecipientInfo)
+
+/* Free up RecipientInfo additional data */
+static int cms_ri_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it)
+        {
+        if(operation == ASN1_OP_FREE_PRE)
+                {
+                CMS_RecipientInfo *ri = (CMS_RecipientInfo *)*pval;
+                if (ri->type == CMS_RECIPINFO_TRANS)
+                        {
+                        CMS_KeyTransRecipientInfo *ktri = ri->d.ktri;
+                        if (ktri->pkey)
+                                EVP_PKEY_free(ktri->pkey);
+                        if (ktri->recip)
+                                X509_free(ktri->recip);
+                        }
+                else if (ri->type == CMS_RECIPINFO_KEK)
+                        {
+                        CMS_KEKRecipientInfo *kekri = ri->d.kekri;
+                        if (kekri->key)
+                                {
+                                OPENSSL_cleanse(kekri->key, kekri->keylen);
+                                OPENSSL_free(kekri->key);
+                                }
+                        }
+                }
+        return 1;
+        }
+
+ASN1_CHOICE_cb(CMS_RecipientInfo, cms_ri_cb) = {
+        ASN1_SIMPLE(CMS_RecipientInfo, d.ktri, CMS_KeyTransRecipientInfo),
+        ASN1_IMP(CMS_RecipientInfo, d.kari, CMS_KeyAgreeRecipientInfo, 1),
+        ASN1_IMP(CMS_RecipientInfo, d.kekri, CMS_KEKRecipientInfo, 2),
+        ASN1_IMP(CMS_RecipientInfo, d.pwri, CMS_PasswordRecipientInfo, 3),
+        ASN1_IMP(CMS_RecipientInfo, d.ori, CMS_OtherRecipientInfo, 4)
+} ASN1_CHOICE_END_cb(CMS_RecipientInfo, CMS_RecipientInfo, type)
+
+ASN1_NDEF_SEQUENCE(CMS_EnvelopedData) = {
+        ASN1_SIMPLE(CMS_EnvelopedData, version, LONG),
+        ASN1_IMP_OPT(CMS_EnvelopedData, originatorInfo, CMS_OriginatorInfo, 0),
+        ASN1_SET_OF(CMS_EnvelopedData, recipientInfos, CMS_RecipientInfo),
+        ASN1_SIMPLE(CMS_EnvelopedData, encryptedContentInfo, CMS_EncryptedContentInfo),
+        ASN1_IMP_SET_OF_OPT(CMS_EnvelopedData, unprotectedAttrs, X509_ATTRIBUTE, 1)
+} ASN1_NDEF_SEQUENCE_END(CMS_EnvelopedData)
+
+ASN1_NDEF_SEQUENCE(CMS_DigestedData) = {
+        ASN1_SIMPLE(CMS_DigestedData, version, LONG),
+        ASN1_SIMPLE(CMS_DigestedData, digestAlgorithm, X509_ALGOR),
+        ASN1_SIMPLE(CMS_DigestedData, encapContentInfo, CMS_EncapsulatedContentInfo),
+        ASN1_SIMPLE(CMS_DigestedData, digest, ASN1_OCTET_STRING)
+} ASN1_NDEF_SEQUENCE_END(CMS_DigestedData)
+
+ASN1_NDEF_SEQUENCE(CMS_EncryptedData) = {
+        ASN1_SIMPLE(CMS_EncryptedData, version, LONG),
+        ASN1_SIMPLE(CMS_EncryptedData, encryptedContentInfo, CMS_EncryptedContentInfo),
+        ASN1_IMP_SET_OF_OPT(CMS_EncryptedData, unprotectedAttrs, X509_ATTRIBUTE, 1)
+} ASN1_NDEF_SEQUENCE_END(CMS_EncryptedData)
+
+ASN1_NDEF_SEQUENCE(CMS_AuthenticatedData) = {
+        ASN1_SIMPLE(CMS_AuthenticatedData, version, LONG),
+        ASN1_IMP_OPT(CMS_AuthenticatedData, originatorInfo, CMS_OriginatorInfo, 0),
+        ASN1_SET_OF(CMS_AuthenticatedData, recipientInfos, CMS_RecipientInfo),
+        ASN1_SIMPLE(CMS_AuthenticatedData, macAlgorithm, X509_ALGOR),
+        ASN1_IMP(CMS_AuthenticatedData, digestAlgorithm, X509_ALGOR, 1),
+        ASN1_SIMPLE(CMS_AuthenticatedData, encapContentInfo, CMS_EncapsulatedContentInfo),
+        ASN1_IMP_SET_OF_OPT(CMS_AuthenticatedData, authAttrs, X509_ALGOR, 2),
+        ASN1_SIMPLE(CMS_AuthenticatedData, mac, ASN1_OCTET_STRING),
+        ASN1_IMP_SET_OF_OPT(CMS_AuthenticatedData, unauthAttrs, X509_ALGOR, 3)
+} ASN1_NDEF_SEQUENCE_END(CMS_AuthenticatedData)
+
+ASN1_NDEF_SEQUENCE(CMS_CompressedData) = {
+        ASN1_SIMPLE(CMS_CompressedData, version, LONG),
+        ASN1_SIMPLE(CMS_CompressedData, compressionAlgorithm, X509_ALGOR),
+        ASN1_SIMPLE(CMS_CompressedData, encapContentInfo, CMS_EncapsulatedContentInfo),
+} ASN1_NDEF_SEQUENCE_END(CMS_CompressedData)
+
+/* This is the ANY DEFINED BY table for the top level ContentInfo structure */
+
+ASN1_ADB_TEMPLATE(cms_default) = ASN1_EXP(CMS_ContentInfo, d.other, ASN1_ANY, 0);
+
+ASN1_ADB(CMS_ContentInfo) = {
+        ADB_ENTRY(NID_pkcs7_data, ASN1_NDEF_EXP(CMS_ContentInfo, d.data, ASN1_OCTET_STRING_NDEF, 0)),
+        ADB_ENTRY(NID_pkcs7_signed, ASN1_NDEF_EXP(CMS_ContentInfo, d.signedData, CMS_SignedData, 0)),
+        ADB_ENTRY(NID_pkcs7_enveloped, ASN1_NDEF_EXP(CMS_ContentInfo, d.envelopedData, CMS_EnvelopedData, 0)),
+        ADB_ENTRY(NID_pkcs7_digest, ASN1_NDEF_EXP(CMS_ContentInfo, d.digestedData, CMS_DigestedData, 0)),
+        ADB_ENTRY(NID_pkcs7_encrypted, ASN1_NDEF_EXP(CMS_ContentInfo, d.encryptedData, CMS_EncryptedData, 0)),
+        ADB_ENTRY(NID_id_smime_ct_authData, ASN1_NDEF_EXP(CMS_ContentInfo, d.authenticatedData, CMS_AuthenticatedData, 0)),
+        ADB_ENTRY(NID_id_smime_ct_compressedData, ASN1_NDEF_EXP(CMS_ContentInfo, d.compressedData, CMS_CompressedData, 0)),
+} ASN1_ADB_END(CMS_ContentInfo, 0, contentType, 0, &cms_default_tt, NULL);
+
+ASN1_NDEF_SEQUENCE(CMS_ContentInfo) = {
+        ASN1_SIMPLE(CMS_ContentInfo, contentType, ASN1_OBJECT),
+        ASN1_ADB_OBJECT(CMS_ContentInfo)
+} ASN1_NDEF_SEQUENCE_END(CMS_ContentInfo)
+
+/* Specials for signed attributes */
+
+/* When signing attributes we want to reorder them to match the sorted
+ * encoding.
+ */
+
+ASN1_ITEM_TEMPLATE(CMS_Attributes_Sign) = 
+        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SET_ORDER, 0, CMS_ATTRIBUTES, X509_ATTRIBUTE)
+ASN1_ITEM_TEMPLATE_END(CMS_Attributes_Sign)
+
+/* When verifying attributes we need to use the received order. So 
+ * we use SEQUENCE OF and tag it to SET OF
+ */
+
+ASN1_ITEM_TEMPLATE(CMS_Attributes_Verify) = 
+        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_IMPTAG | ASN1_TFLG_UNIVERSAL,
+                                V_ASN1_SET, CMS_ATTRIBUTES, X509_ATTRIBUTE)
+ASN1_ITEM_TEMPLATE_END(CMS_Attributes_Verify)
+
+
+
+ASN1_CHOICE(CMS_ReceiptsFrom) = {
+  ASN1_IMP(CMS_ReceiptsFrom, d.allOrFirstTier, LONG, 0),
+  ASN1_IMP_SEQUENCE_OF(CMS_ReceiptsFrom, d.receiptList, GENERAL_NAMES, 1)
+} ASN1_CHOICE_END(CMS_ReceiptsFrom)
+
+ASN1_SEQUENCE(CMS_ReceiptRequest) = {
+  ASN1_SIMPLE(CMS_ReceiptRequest, signedContentIdentifier, ASN1_OCTET_STRING),
+  ASN1_SIMPLE(CMS_ReceiptRequest, receiptsFrom, CMS_ReceiptsFrom),
+  ASN1_SEQUENCE_OF(CMS_ReceiptRequest, receiptsTo, GENERAL_NAMES)
+} ASN1_SEQUENCE_END(CMS_ReceiptRequest)
+
+ASN1_SEQUENCE(CMS_Receipt) = {
+  ASN1_SIMPLE(CMS_Receipt, version, LONG),
+  ASN1_SIMPLE(CMS_Receipt, contentType, ASN1_OBJECT),
+  ASN1_SIMPLE(CMS_Receipt, signedContentIdentifier, ASN1_OCTET_STRING),
+  ASN1_SIMPLE(CMS_Receipt, originatorSignatureValue, ASN1_OCTET_STRING)
+} ASN1_SEQUENCE_END(CMS_Receipt)
+
diff --git a/src/lib/libssl/src/crypto/cms/cms_att.c b/src/lib/libssl/src/crypto/cms/cms_att.c
new file mode 100644
index 0000000000..5b71722ebc
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_att.c
@@ -0,0 +1,195 @@
+/* crypto/cms/cms_att.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include <openssl/asn1t.h>
+#include <openssl/pem.h>
+#include <openssl/x509v3.h>
+#include <openssl/err.h>
+#include "cms.h"
+#include "cms_lcl.h"
+
+/* CMS SignedData Attribute utilities */
+
+int CMS_signed_get_attr_count(const CMS_SignerInfo *si)
+{
+        return X509at_get_attr_count(si->signedAttrs);
+}
+
+int CMS_signed_get_attr_by_NID(const CMS_SignerInfo *si, int nid,
+                          int lastpos)
+{
+        return X509at_get_attr_by_NID(si->signedAttrs, nid, lastpos);
+}
+
+int CMS_signed_get_attr_by_OBJ(const CMS_SignerInfo *si, ASN1_OBJECT *obj,
+                          int lastpos)
+{
+        return X509at_get_attr_by_OBJ(si->signedAttrs, obj, lastpos);
+}
+
+X509_ATTRIBUTE *CMS_signed_get_attr(const CMS_SignerInfo *si, int loc)
+{
+        return X509at_get_attr(si->signedAttrs, loc);
+}
+
+X509_ATTRIBUTE *CMS_signed_delete_attr(CMS_SignerInfo *si, int loc)
+{
+        return X509at_delete_attr(si->signedAttrs, loc);
+}
+
+int CMS_signed_add1_attr(CMS_SignerInfo *si, X509_ATTRIBUTE *attr)
+{
+        if(X509at_add1_attr(&si->signedAttrs, attr)) return 1;
+        return 0;
+}
+
+int CMS_signed_add1_attr_by_OBJ(CMS_SignerInfo *si,
+                        const ASN1_OBJECT *obj, int type,
+                        const void *bytes, int len)
+{
+        if(X509at_add1_attr_by_OBJ(&si->signedAttrs, obj,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+int CMS_signed_add1_attr_by_NID(CMS_SignerInfo *si,
+                        int nid, int type,
+                        const void *bytes, int len)
+{
+        if(X509at_add1_attr_by_NID(&si->signedAttrs, nid,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+int CMS_signed_add1_attr_by_txt(CMS_SignerInfo *si,
+                        const char *attrname, int type,
+                        const void *bytes, int len)
+{
+        if(X509at_add1_attr_by_txt(&si->signedAttrs, attrname,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+void *CMS_signed_get0_data_by_OBJ(CMS_SignerInfo *si, ASN1_OBJECT *oid,
+                                        int lastpos, int type)
+{
+        return X509at_get0_data_by_OBJ(si->signedAttrs, oid, lastpos, type);
+}
+
+int CMS_unsigned_get_attr_count(const CMS_SignerInfo *si)
+{
+        return X509at_get_attr_count(si->unsignedAttrs);
+}
+
+int CMS_unsigned_get_attr_by_NID(const CMS_SignerInfo *si, int nid,
+                          int lastpos)
+{
+        return X509at_get_attr_by_NID(si->unsignedAttrs, nid, lastpos);
+}
+
+int CMS_unsigned_get_attr_by_OBJ(const CMS_SignerInfo *si, ASN1_OBJECT *obj,
+                          int lastpos)
+{
+        return X509at_get_attr_by_OBJ(si->unsignedAttrs, obj, lastpos);
+}
+
+X509_ATTRIBUTE *CMS_unsigned_get_attr(const CMS_SignerInfo *si, int loc)
+{
+        return X509at_get_attr(si->unsignedAttrs, loc);
+}
+
+X509_ATTRIBUTE *CMS_unsigned_delete_attr(CMS_SignerInfo *si, int loc)
+{
+        return X509at_delete_attr(si->unsignedAttrs, loc);
+}
+
+int CMS_unsigned_add1_attr(CMS_SignerInfo *si, X509_ATTRIBUTE *attr)
+{
+        if(X509at_add1_attr(&si->unsignedAttrs, attr)) return 1;
+        return 0;
+}
+
+int CMS_unsigned_add1_attr_by_OBJ(CMS_SignerInfo *si,
+                        const ASN1_OBJECT *obj, int type,
+                        const void *bytes, int len)
+{
+        if(X509at_add1_attr_by_OBJ(&si->unsignedAttrs, obj,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+int CMS_unsigned_add1_attr_by_NID(CMS_SignerInfo *si,
+                        int nid, int type,
+                        const void *bytes, int len)
+{
+        if(X509at_add1_attr_by_NID(&si->unsignedAttrs, nid,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+int CMS_unsigned_add1_attr_by_txt(CMS_SignerInfo *si,
+                        const char *attrname, int type,
+                        const void *bytes, int len)
+{
+        if(X509at_add1_attr_by_txt(&si->unsignedAttrs, attrname,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+void *CMS_unsigned_get0_data_by_OBJ(CMS_SignerInfo *si, ASN1_OBJECT *oid,
+                                        int lastpos, int type)
+{
+        return X509at_get0_data_by_OBJ(si->unsignedAttrs, oid, lastpos, type);
+}
+
+/* Specific attribute cases */
diff --git a/src/lib/libssl/src/crypto/cms/cms_cd.c b/src/lib/libssl/src/crypto/cms/cms_cd.c
new file mode 100644
index 0000000000..a5fc2c4e2b
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_cd.c
@@ -0,0 +1,134 @@
+/* crypto/cms/cms_cd.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include "cryptlib.h"
+#include <openssl/asn1t.h>
+#include <openssl/pem.h>
+#include <openssl/x509v3.h>
+#include <openssl/err.h>
+#include <openssl/cms.h>
+#include <openssl/bio.h>
+#include <openssl/comp.h>
+#include "cms_lcl.h"
+
+DECLARE_ASN1_ITEM(CMS_CompressedData)
+
+#ifdef ZLIB
+
+/* CMS CompressedData Utilities */
+
+CMS_ContentInfo *cms_CompressedData_create(int comp_nid)
+        {
+        CMS_ContentInfo *cms;
+        CMS_CompressedData *cd;
+        /* Will need something cleverer if there is ever more than one
+         * compression algorithm or parameters have some meaning...
+         */
+        if (comp_nid != NID_zlib_compression)
+                {
+                CMSerr(CMS_F_CMS_COMPRESSEDDATA_CREATE,
+                                CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
+                return NULL;
+                }
+        cms = CMS_ContentInfo_new();
+        if (!cms)
+                return NULL;
+
+        cd = M_ASN1_new_of(CMS_CompressedData);
+
+        if (!cd)
+                goto err;
+
+        cms->contentType = OBJ_nid2obj(NID_id_smime_ct_compressedData);
+        cms->d.compressedData = cd;
+
+        cd->version = 0;
+
+        X509_ALGOR_set0(cd->compressionAlgorithm,
+                        OBJ_nid2obj(NID_zlib_compression),
+                        V_ASN1_UNDEF, NULL);
+
+        cd->encapContentInfo->eContentType = OBJ_nid2obj(NID_pkcs7_data);
+
+        return cms;
+
+        err:
+
+        if (cms)
+                CMS_ContentInfo_free(cms);
+
+        return NULL;
+        }
+
+BIO *cms_CompressedData_init_bio(CMS_ContentInfo *cms)
+        {
+        CMS_CompressedData *cd;
+        ASN1_OBJECT *compoid;
+        if (OBJ_obj2nid(cms->contentType) != NID_id_smime_ct_compressedData)
+                {
+                CMSerr(CMS_F_CMS_COMPRESSEDDATA_INIT_BIO,
+                                CMS_R_CONTENT_TYPE_NOT_COMPRESSED_DATA);
+                return NULL;
+                }
+        cd = cms->d.compressedData;
+        X509_ALGOR_get0(&compoid, NULL, NULL, cd->compressionAlgorithm);
+        if (OBJ_obj2nid(compoid) != NID_zlib_compression)
+                {
+                CMSerr(CMS_F_CMS_COMPRESSEDDATA_INIT_BIO,
+                                CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
+                return NULL;
+                }
+        return BIO_new(BIO_f_zlib());
+        }
+
+#endif
diff --git a/src/lib/libssl/src/crypto/cms/cms_dd.c b/src/lib/libssl/src/crypto/cms/cms_dd.c
new file mode 100644
index 0000000000..8919c15be1
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_dd.c
@@ -0,0 +1,148 @@
+/* crypto/cms/cms_dd.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include "cryptlib.h"
+#include <openssl/asn1t.h>
+#include <openssl/pem.h>
+#include <openssl/x509v3.h>
+#include <openssl/err.h>
+#include <openssl/cms.h>
+#include "cms_lcl.h"
+
+DECLARE_ASN1_ITEM(CMS_DigestedData)
+
+/* CMS DigestedData Utilities */
+
+CMS_ContentInfo *cms_DigestedData_create(const EVP_MD *md)
+        {
+        CMS_ContentInfo *cms;
+        CMS_DigestedData *dd;
+        cms = CMS_ContentInfo_new();
+        if (!cms)
+                return NULL;
+
+        dd = M_ASN1_new_of(CMS_DigestedData);
+
+        if (!dd)
+                goto err;
+
+        cms->contentType = OBJ_nid2obj(NID_pkcs7_digest);
+        cms->d.digestedData = dd;
+
+        dd->version = 0;
+        dd->encapContentInfo->eContentType = OBJ_nid2obj(NID_pkcs7_data);
+
+        cms_DigestAlgorithm_set(dd->digestAlgorithm, md);
+
+        return cms;
+
+        err:
+
+        if (cms)
+                CMS_ContentInfo_free(cms);
+
+        return NULL;
+        }
+
+BIO *cms_DigestedData_init_bio(CMS_ContentInfo *cms)
+        {
+        CMS_DigestedData *dd;
+        dd = cms->d.digestedData;
+        return cms_DigestAlgorithm_init_bio(dd->digestAlgorithm);
+        }
+
+int cms_DigestedData_do_final(CMS_ContentInfo *cms, BIO *chain, int verify)
+        {
+        EVP_MD_CTX mctx;
+        unsigned char md[EVP_MAX_MD_SIZE];
+        unsigned int mdlen;
+        int r = 0;
+        CMS_DigestedData *dd;
+        EVP_MD_CTX_init(&mctx);
+
+        dd = cms->d.digestedData;
+
+        if (!cms_DigestAlgorithm_find_ctx(&mctx, chain, dd->digestAlgorithm))
+                goto err;
+
+        if (EVP_DigestFinal_ex(&mctx, md, &mdlen) <= 0)
+                goto err;
+
+        if (verify)
+                {
+                if (mdlen != (unsigned int)dd->digest->length)
+                        {
+                        CMSerr(CMS_F_CMS_DIGESTEDDATA_DO_FINAL,
+                                CMS_R_MESSAGEDIGEST_WRONG_LENGTH);
+                        goto err;
+                        }
+
+                if (memcmp(md, dd->digest->data, mdlen))
+                        CMSerr(CMS_F_CMS_DIGESTEDDATA_DO_FINAL,
+                                CMS_R_VERIFICATION_FAILURE);
+                else
+                        r = 1;
+                }
+        else
+                {
+                if (!ASN1_STRING_set(dd->digest, md, mdlen))
+                        goto err;
+                r = 1;
+                }
+
+        err:
+        EVP_MD_CTX_cleanup(&mctx);
+
+        return r;
+
+        }
diff --git a/src/lib/libssl/src/crypto/cms/cms_enc.c b/src/lib/libssl/src/crypto/cms/cms_enc.c
new file mode 100644
index 0000000000..bab26235bd
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_enc.c
@@ -0,0 +1,262 @@
+/* crypto/cms/cms_enc.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include "cryptlib.h"
+#include <openssl/asn1t.h>
+#include <openssl/pem.h>
+#include <openssl/x509v3.h>
+#include <openssl/err.h>
+#include <openssl/cms.h>
+#include <openssl/rand.h>
+#include "cms_lcl.h"
+
+/* CMS EncryptedData Utilities */
+
+DECLARE_ASN1_ITEM(CMS_EncryptedData)
+
+/* Return BIO based on EncryptedContentInfo and key */
+
+BIO *cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec)
+        {
+        BIO *b;
+        EVP_CIPHER_CTX *ctx;
+        const EVP_CIPHER *ciph;
+        X509_ALGOR *calg = ec->contentEncryptionAlgorithm;
+        unsigned char iv[EVP_MAX_IV_LENGTH], *piv = NULL;
+
+        int ok = 0;
+
+        int enc, keep_key = 0;
+
+        enc = ec->cipher ? 1 : 0;
+
+        b = BIO_new(BIO_f_cipher());
+        if (!b)
+                {
+                CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
+                                                        ERR_R_MALLOC_FAILURE);
+                return NULL;
+                }
+
+        BIO_get_cipher_ctx(b, &ctx);
+
+        if (enc)
+                {
+                ciph = ec->cipher;
+                /* If not keeping key set cipher to NULL so subsequent calls
+                 * decrypt.
+                 */
+                if (ec->key)
+                        ec->cipher = NULL;
+                }
+        else
+                {
+                ciph = EVP_get_cipherbyobj(calg->algorithm);
+
+                if (!ciph)
+                        {
+                        CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
+                                                        CMS_R_UNKNOWN_CIPHER);
+                        goto err;
+                        }
+                }
+
+        if (EVP_CipherInit_ex(ctx, ciph, NULL, NULL, NULL, enc) <= 0)
+                {
+                CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
+                                CMS_R_CIPHER_INITIALISATION_ERROR);
+                goto err;
+                }
+
+        if (enc)
+                {
+                int ivlen;
+                calg->algorithm = OBJ_nid2obj(EVP_CIPHER_CTX_type(ctx));
+                /* Generate a random IV if we need one */
+                ivlen = EVP_CIPHER_CTX_iv_length(ctx);
+                if (ivlen > 0)
+                        {
+                        if (RAND_pseudo_bytes(iv, ivlen) <= 0)
+                                goto err;
+                        piv = iv;
+                        }
+                }
+        else if (EVP_CIPHER_asn1_to_param(ctx, calg->parameter) <= 0)
+                {
+                CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
+                                CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
+                goto err;
+                }
+
+
+        if (enc && !ec->key)
+                {
+                /* Generate random key */
+                if (!ec->keylen)
+                        ec->keylen = EVP_CIPHER_CTX_key_length(ctx);
+                ec->key = OPENSSL_malloc(ec->keylen);
+                if (!ec->key)
+                        {
+                        CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
+                                                        ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                if (EVP_CIPHER_CTX_rand_key(ctx, ec->key) <= 0)
+                        goto err;
+                keep_key = 1;
+                }
+        else if (ec->keylen != (unsigned int)EVP_CIPHER_CTX_key_length(ctx))
+                {
+                /* If necessary set key length */
+                if (EVP_CIPHER_CTX_set_key_length(ctx, ec->keylen) <= 0)
+                        {
+                        CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
+                                CMS_R_INVALID_KEY_LENGTH);
+                        goto err;
+                        }
+                }
+
+        if (EVP_CipherInit_ex(ctx, NULL, NULL, ec->key, piv, enc) <= 0)
+                {
+                CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
+                                CMS_R_CIPHER_INITIALISATION_ERROR);
+                goto err;
+                }
+
+        if (piv)
+                {
+                calg->parameter = ASN1_TYPE_new();
+                if (!calg->parameter)
+                        {
+                        CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
+                                                        ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                if (EVP_CIPHER_param_to_asn1(ctx, calg->parameter) <= 0)
+                        {
+                        CMSerr(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO,
+                                CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
+                        goto err;
+                        }
+                }
+        ok = 1;
+
+        err:
+        if (ec->key && !keep_key)
+                {
+                OPENSSL_cleanse(ec->key, ec->keylen);
+                OPENSSL_free(ec->key);
+                ec->key = NULL;
+                }
+        if (ok)
+                return b;
+        BIO_free(b);
+        return NULL;
+        }
+
+int cms_EncryptedContent_init(CMS_EncryptedContentInfo *ec, 
+                                const EVP_CIPHER *cipher,
+                                const unsigned char *key, size_t keylen)
+        {
+        ec->cipher = cipher;
+        if (key)
+                {
+                ec->key = OPENSSL_malloc(keylen);
+                if (!ec->key)
+                        return 0;
+                memcpy(ec->key, key, keylen);
+                }
+        ec->keylen = keylen;
+        if (cipher)
+                ec->contentType = OBJ_nid2obj(NID_pkcs7_data);
+        return 1;
+        }
+
+int CMS_EncryptedData_set1_key(CMS_ContentInfo *cms, const EVP_CIPHER *ciph,
+                                const unsigned char *key, size_t keylen)
+        {
+        CMS_EncryptedContentInfo *ec;
+        if (!key || !keylen)
+                {
+                CMSerr(CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY, CMS_R_NO_KEY);
+                return 0;
+                }
+        if (ciph)
+                {
+                cms->d.encryptedData = M_ASN1_new_of(CMS_EncryptedData);
+                if (!cms->d.encryptedData)
+                        {
+                        CMSerr(CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY,
+                                ERR_R_MALLOC_FAILURE);
+                        return 0;
+                        }
+                cms->contentType = OBJ_nid2obj(NID_pkcs7_encrypted);
+                cms->d.encryptedData->version = 0;
+                }
+        else if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_encrypted)
+                {
+                CMSerr(CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY,
+                                                CMS_R_NOT_ENCRYPTED_DATA);
+                return 0;
+                }
+        ec = cms->d.encryptedData->encryptedContentInfo;
+        return cms_EncryptedContent_init(ec, ciph, key, keylen);
+        }
+
+BIO *cms_EncryptedData_init_bio(CMS_ContentInfo *cms)
+        {
+        CMS_EncryptedData *enc = cms->d.encryptedData;
+        if (enc->encryptedContentInfo->cipher && enc->unprotectedAttrs)
+                enc->version = 2;
+        return cms_EncryptedContent_init_bio(enc->encryptedContentInfo);
+        }
diff --git a/src/lib/libssl/src/crypto/cms/cms_env.c b/src/lib/libssl/src/crypto/cms/cms_env.c
new file mode 100644
index 0000000000..d499ae85b4
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_env.c
@@ -0,0 +1,825 @@
+/* crypto/cms/cms_env.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include "cryptlib.h"
+#include <openssl/asn1t.h>
+#include <openssl/pem.h>
+#include <openssl/x509v3.h>
+#include <openssl/err.h>
+#include <openssl/cms.h>
+#include <openssl/rand.h>
+#include <openssl/aes.h>
+#include "cms_lcl.h"
+
+/* CMS EnvelopedData Utilities */
+
+DECLARE_ASN1_ITEM(CMS_EnvelopedData)
+DECLARE_ASN1_ITEM(CMS_RecipientInfo)
+DECLARE_ASN1_ITEM(CMS_KeyTransRecipientInfo)
+DECLARE_ASN1_ITEM(CMS_KEKRecipientInfo)
+DECLARE_ASN1_ITEM(CMS_OtherKeyAttribute)
+
+DECLARE_STACK_OF(CMS_RecipientInfo)
+
+static CMS_EnvelopedData *cms_get0_enveloped(CMS_ContentInfo *cms)
+        {
+        if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_enveloped)
+                {
+                CMSerr(CMS_F_CMS_GET0_ENVELOPED,
+                                CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA);
+                return NULL;
+                }
+        return cms->d.envelopedData;
+        }
+
+static CMS_EnvelopedData *cms_enveloped_data_init(CMS_ContentInfo *cms)
+        {
+        if (cms->d.other == NULL)
+                {
+                cms->d.envelopedData = M_ASN1_new_of(CMS_EnvelopedData);
+                if (!cms->d.envelopedData)
+                        {
+                        CMSerr(CMS_F_CMS_ENVELOPED_DATA_INIT,
+                                                        ERR_R_MALLOC_FAILURE);
+                        return NULL;
+                        }
+                cms->d.envelopedData->version = 0;
+                cms->d.envelopedData->encryptedContentInfo->contentType =
+                                                OBJ_nid2obj(NID_pkcs7_data);
+                ASN1_OBJECT_free(cms->contentType);
+                cms->contentType = OBJ_nid2obj(NID_pkcs7_enveloped);
+                return cms->d.envelopedData;
+                }
+        return cms_get0_enveloped(cms);
+        }
+
+STACK_OF(CMS_RecipientInfo) *CMS_get0_RecipientInfos(CMS_ContentInfo *cms)
+        {
+        CMS_EnvelopedData *env;
+        env = cms_get0_enveloped(cms);
+        if (!env)
+                return NULL;
+        return env->recipientInfos;
+        }
+
+int CMS_RecipientInfo_type(CMS_RecipientInfo *ri)
+        {
+        return ri->type;
+        }
+
+CMS_ContentInfo *CMS_EnvelopedData_create(const EVP_CIPHER *cipher)
+        {
+        CMS_ContentInfo *cms;
+        CMS_EnvelopedData *env;
+        cms = CMS_ContentInfo_new();
+        if (!cms)
+                goto merr;
+        env = cms_enveloped_data_init(cms);
+        if (!env)
+                goto merr;
+        if (!cms_EncryptedContent_init(env->encryptedContentInfo,
+                                        cipher, NULL, 0))
+                goto merr;
+        return cms;
+        merr:
+        if (cms)
+                CMS_ContentInfo_free(cms);
+        CMSerr(CMS_F_CMS_ENVELOPEDDATA_CREATE, ERR_R_MALLOC_FAILURE);
+        return NULL;
+        }
+
+/* Key Transport Recipient Info (KTRI) routines */
+
+/* Add a recipient certificate. For now only handle key transport.
+ * If we ever handle key agreement will need updating.
+ */
+
+CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms,
+                                        X509 *recip, unsigned int flags)
+        {
+        CMS_RecipientInfo *ri = NULL;
+        CMS_KeyTransRecipientInfo *ktri;
+        CMS_EnvelopedData *env;
+        EVP_PKEY *pk = NULL;
+        int type;
+        env = cms_get0_enveloped(cms);
+        if (!env)
+                goto err;
+
+        /* Initialize recipient info */
+        ri = M_ASN1_new_of(CMS_RecipientInfo);
+        if (!ri)
+                goto merr;
+
+        /* Initialize and add key transport recipient info */
+
+        ri->d.ktri = M_ASN1_new_of(CMS_KeyTransRecipientInfo);
+        if (!ri->d.ktri)
+                goto merr;
+        ri->type = CMS_RECIPINFO_TRANS;
+
+        ktri = ri->d.ktri;
+
+        X509_check_purpose(recip, -1, -1);
+        pk = X509_get_pubkey(recip);
+        if (!pk)
+                {
+                CMSerr(CMS_F_CMS_ADD1_RECIPIENT_CERT,
+                                CMS_R_ERROR_GETTING_PUBLIC_KEY);
+                goto err;
+                }
+        CRYPTO_add(&recip->references, 1, CRYPTO_LOCK_X509);
+        ktri->pkey = pk;
+        ktri->recip = recip;
+
+        if (flags & CMS_USE_KEYID)
+                {
+                ktri->version = 2;
+                type = CMS_RECIPINFO_KEYIDENTIFIER;
+                }
+        else
+                {
+                ktri->version = 0;
+                type = CMS_RECIPINFO_ISSUER_SERIAL;
+                }
+
+        /* Not a typo: RecipientIdentifier and SignerIdentifier are the
+         * same structure.
+         */
+
+        if (!cms_set1_SignerIdentifier(ktri->rid, recip, type))
+                goto err;
+
+        /* Since we have no EVP_PKEY_ASN1_METHOD in OpenSSL 0.9.8,
+         * hard code algorithm parameters.
+         */
+
+        if (pk->type == EVP_PKEY_RSA)
+                {
+                X509_ALGOR_set0(ktri->keyEncryptionAlgorithm,
+                                        OBJ_nid2obj(NID_rsaEncryption), 
+                                        V_ASN1_NULL, 0);
+                }
+        else
+                {
+                CMSerr(CMS_F_CMS_ADD1_RECIPIENT_CERT,
+                                CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
+                goto err;
+                }
+
+        if (!sk_CMS_RecipientInfo_push(env->recipientInfos, ri))
+                goto merr;
+
+        return ri;
+
+        merr:
+        CMSerr(CMS_F_CMS_ADD1_RECIPIENT_CERT, ERR_R_MALLOC_FAILURE);
+        err:
+        if (ri)
+                M_ASN1_free_of(ri, CMS_RecipientInfo);
+        return NULL;
+
+        }
+
+int CMS_RecipientInfo_ktri_get0_algs(CMS_RecipientInfo *ri,
+                                        EVP_PKEY **pk, X509 **recip,
+                                        X509_ALGOR **palg)
+        {
+        CMS_KeyTransRecipientInfo *ktri;
+        if (ri->type != CMS_RECIPINFO_TRANS)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_ALGS,
+                        CMS_R_NOT_KEY_TRANSPORT);
+                return 0;
+                }
+
+        ktri = ri->d.ktri;
+
+        if (pk)
+                *pk = ktri->pkey;
+        if (recip)
+                *recip = ktri->recip;
+        if (palg)
+                *palg = ktri->keyEncryptionAlgorithm;
+        return 1;
+        }
+
+int CMS_RecipientInfo_ktri_get0_signer_id(CMS_RecipientInfo *ri,
+                                        ASN1_OCTET_STRING **keyid,
+                                        X509_NAME **issuer, ASN1_INTEGER **sno)
+        {
+        CMS_KeyTransRecipientInfo *ktri;
+        if (ri->type != CMS_RECIPINFO_TRANS)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_SIGNER_ID,
+                        CMS_R_NOT_KEY_TRANSPORT);
+                return 0;
+                }
+        ktri = ri->d.ktri;
+
+        return cms_SignerIdentifier_get0_signer_id(ktri->rid,
+                                                        keyid, issuer, sno);
+        }
+
+int CMS_RecipientInfo_ktri_cert_cmp(CMS_RecipientInfo *ri, X509 *cert)
+        {
+        if (ri->type != CMS_RECIPINFO_TRANS)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_CERT_CMP,
+                        CMS_R_NOT_KEY_TRANSPORT);
+                return -2;
+                }
+        return cms_SignerIdentifier_cert_cmp(ri->d.ktri->rid, cert);
+        }
+
+int CMS_RecipientInfo_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pkey)
+        {
+        if (ri->type != CMS_RECIPINFO_TRANS)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_SET0_PKEY,
+                        CMS_R_NOT_KEY_TRANSPORT);
+                return 0;
+                }
+        ri->d.ktri->pkey = pkey;
+        return 1;
+        }
+
+/* Encrypt content key in key transport recipient info */
+
+static int cms_RecipientInfo_ktri_encrypt(CMS_ContentInfo *cms,
+                                        CMS_RecipientInfo *ri)
+        {
+        CMS_KeyTransRecipientInfo *ktri;
+        CMS_EncryptedContentInfo *ec;
+        unsigned char *ek = NULL;
+        int eklen;
+
+        int ret = 0;
+
+        if (ri->type != CMS_RECIPINFO_TRANS)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT,
+                        CMS_R_NOT_KEY_TRANSPORT);
+                return 0;
+                }
+        ktri = ri->d.ktri;
+        ec = cms->d.envelopedData->encryptedContentInfo;
+
+        eklen = EVP_PKEY_size(ktri->pkey);
+
+        ek = OPENSSL_malloc(eklen);
+
+        if (ek == NULL)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT,
+                                                        ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        eklen = EVP_PKEY_encrypt(ek, ec->key, ec->keylen, ktri->pkey);
+
+        if (eklen <= 0)
+                goto err;
+
+        ASN1_STRING_set0(ktri->encryptedKey, ek, eklen);
+        ek = NULL;
+
+        ret = 1;
+
+        err:
+        if (ek)
+                OPENSSL_free(ek);
+        return ret;
+
+        }
+
+/* Decrypt content key from KTRI */
+
+static int cms_RecipientInfo_ktri_decrypt(CMS_ContentInfo *cms,
+                                                        CMS_RecipientInfo *ri)
+        {
+        CMS_KeyTransRecipientInfo *ktri = ri->d.ktri;
+        unsigned char *ek = NULL;
+        int eklen;
+        int ret = 0;
+
+        if (ktri->pkey == NULL)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT,
+                        CMS_R_NO_PRIVATE_KEY);
+                return 0;
+                }
+
+        eklen = EVP_PKEY_size(ktri->pkey);
+
+        ek = OPENSSL_malloc(eklen);
+
+        if (ek == NULL)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT,
+                                                        ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        eklen = EVP_PKEY_decrypt(ek, 
+                                ktri->encryptedKey->data,
+                                ktri->encryptedKey->length, ktri->pkey);
+        if (eklen <= 0)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT, CMS_R_CMS_LIB);
+                goto err;
+                }
+
+        ret = 1;
+
+        cms->d.envelopedData->encryptedContentInfo->key = ek;
+        cms->d.envelopedData->encryptedContentInfo->keylen = eklen;
+
+        err:
+        if (!ret && ek)
+                OPENSSL_free(ek);
+
+        return ret;
+        }
+
+/* Key Encrypted Key (KEK) RecipientInfo routines */
+
+int CMS_RecipientInfo_kekri_id_cmp(CMS_RecipientInfo *ri, 
+                                        const unsigned char *id, size_t idlen)
+        {
+        ASN1_OCTET_STRING tmp_os;
+        CMS_KEKRecipientInfo *kekri;
+        if (ri->type != CMS_RECIPINFO_KEK)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ID_CMP, CMS_R_NOT_KEK);
+                return -2;
+                }
+        kekri = ri->d.kekri;
+        tmp_os.type = V_ASN1_OCTET_STRING;
+        tmp_os.flags = 0;
+        tmp_os.data = (unsigned char *)id;
+        tmp_os.length = (int)idlen;
+        return ASN1_OCTET_STRING_cmp(&tmp_os, kekri->kekid->keyIdentifier);
+        }
+
+/* For now hard code AES key wrap info */
+
+static size_t aes_wrap_keylen(int nid)
+        {
+        switch (nid)
+                {
+                case NID_id_aes128_wrap:
+                return 16;
+
+                case NID_id_aes192_wrap:
+                return  24;
+
+                case NID_id_aes256_wrap:
+                return  32;
+
+                default:
+                return 0;
+                }
+        }
+
+CMS_RecipientInfo *CMS_add0_recipient_key(CMS_ContentInfo *cms, int nid,
+                                        unsigned char *key, size_t keylen,
+                                        unsigned char *id, size_t idlen,
+                                        ASN1_GENERALIZEDTIME *date,
+                                        ASN1_OBJECT *otherTypeId,
+                                        ASN1_TYPE *otherType)
+        {
+        CMS_RecipientInfo *ri = NULL;
+        CMS_EnvelopedData *env;
+        CMS_KEKRecipientInfo *kekri;
+        env = cms_get0_enveloped(cms);
+        if (!env)
+                goto err;
+
+        if (nid == NID_undef)
+                {
+                switch (keylen)
+                        {
+                        case 16:
+                        nid = NID_id_aes128_wrap;
+                        break;
+
+                        case  24:
+                        nid = NID_id_aes192_wrap;
+                        break;
+
+                        case  32:
+                        nid = NID_id_aes256_wrap;
+                        break;
+
+                        default:
+                        CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY,
+                                                CMS_R_INVALID_KEY_LENGTH);
+                        goto err;
+                        }
+
+                }
+        else
+                {
+
+                size_t exp_keylen = aes_wrap_keylen(nid);
+
+                if (!exp_keylen)
+                        {
+                        CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY,
+                                        CMS_R_UNSUPPORTED_KEK_ALGORITHM);
+                        goto err;
+                        }
+
+                if (keylen != exp_keylen)
+                        {
+                        CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY,
+                                        CMS_R_INVALID_KEY_LENGTH);
+                        goto err;
+                        }
+
+                }
+
+        /* Initialize recipient info */
+        ri = M_ASN1_new_of(CMS_RecipientInfo);
+        if (!ri)
+                goto merr;
+
+        ri->d.kekri = M_ASN1_new_of(CMS_KEKRecipientInfo);
+        if (!ri->d.kekri)
+                goto merr;
+        ri->type = CMS_RECIPINFO_KEK;
+
+        kekri = ri->d.kekri;
+
+        if (otherTypeId)
+                {
+                kekri->kekid->other = M_ASN1_new_of(CMS_OtherKeyAttribute);
+                if (kekri->kekid->other == NULL)
+                        goto merr;
+                }
+
+        if (!sk_CMS_RecipientInfo_push(env->recipientInfos, ri))
+                goto merr;
+
+
+        /* After this point no calls can fail */
+
+        kekri->version = 4;
+
+        kekri->key = key;
+        kekri->keylen = keylen;
+
+        ASN1_STRING_set0(kekri->kekid->keyIdentifier, id, idlen);
+
+        kekri->kekid->date = date;
+
+        if (kekri->kekid->other)
+                {
+                kekri->kekid->other->keyAttrId = otherTypeId;
+                kekri->kekid->other->keyAttr = otherType;
+                }
+
+        X509_ALGOR_set0(kekri->keyEncryptionAlgorithm,
+                                OBJ_nid2obj(nid), V_ASN1_UNDEF, NULL);
+
+        return ri;
+
+        merr:
+        CMSerr(CMS_F_CMS_ADD0_RECIPIENT_KEY, ERR_R_MALLOC_FAILURE);
+        err:
+        if (ri)
+                M_ASN1_free_of(ri, CMS_RecipientInfo);
+        return NULL;
+
+        }
+
+int CMS_RecipientInfo_kekri_get0_id(CMS_RecipientInfo *ri,
+                                        X509_ALGOR **palg,
+                                        ASN1_OCTET_STRING **pid,
+                                        ASN1_GENERALIZEDTIME **pdate,
+                                        ASN1_OBJECT **potherid,
+                                        ASN1_TYPE **pothertype)
+        {
+        CMS_KEKIdentifier *rkid;
+        if (ri->type != CMS_RECIPINFO_KEK)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_GET0_ID, CMS_R_NOT_KEK);
+                return 0;
+                }
+        rkid =  ri->d.kekri->kekid;
+        if (palg)
+                *palg = ri->d.kekri->keyEncryptionAlgorithm;
+        if (pid)
+                *pid = rkid->keyIdentifier;
+        if (pdate)
+                *pdate = rkid->date;
+        if (potherid)
+                {
+                if (rkid->other)
+                        *potherid = rkid->other->keyAttrId;
+                else
+                        *potherid = NULL;
+                }
+        if (pothertype)
+                {
+                if (rkid->other)
+                        *pothertype = rkid->other->keyAttr;
+                else
+                        *pothertype = NULL;
+                }
+        return 1;
+        }
+
+int CMS_RecipientInfo_set0_key(CMS_RecipientInfo *ri, 
+                                unsigned char *key, size_t keylen)
+        {
+        CMS_KEKRecipientInfo *kekri;
+        if (ri->type != CMS_RECIPINFO_KEK)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_SET0_KEY, CMS_R_NOT_KEK);
+                return 0;
+                }
+
+        kekri = ri->d.kekri;
+        kekri->key = key;
+        kekri->keylen = keylen;
+        return 1;
+        }
+
+
+/* Encrypt content key in KEK recipient info */
+
+static int cms_RecipientInfo_kekri_encrypt(CMS_ContentInfo *cms,
+                                        CMS_RecipientInfo *ri)
+        {
+        CMS_EncryptedContentInfo *ec;
+        CMS_KEKRecipientInfo *kekri;
+        AES_KEY actx;
+        unsigned char *wkey = NULL;
+        int wkeylen;
+        int r = 0;
+
+        ec = cms->d.envelopedData->encryptedContentInfo;
+
+        kekri = ri->d.kekri;
+
+        if (!kekri->key)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT, CMS_R_NO_KEY);
+                return 0;
+                }
+
+        if (AES_set_encrypt_key(kekri->key, kekri->keylen << 3, &actx))
+                { 
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT,
+                                                CMS_R_ERROR_SETTING_KEY);
+                goto err;
+                }
+
+        wkey = OPENSSL_malloc(ec->keylen + 8);
+
+        if (!wkey)
+                { 
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT,
+                                                ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        wkeylen = AES_wrap_key(&actx, NULL, wkey, ec->key, ec->keylen);
+
+        if (wkeylen <= 0)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT, CMS_R_WRAP_ERROR);
+                goto err;
+                }
+
+        ASN1_STRING_set0(kekri->encryptedKey, wkey, wkeylen);
+
+        r = 1;
+
+        err:
+
+        if (!r && wkey)
+                OPENSSL_free(wkey);
+        OPENSSL_cleanse(&actx, sizeof(actx));
+
+        return r;
+
+        }
+
+/* Decrypt content key in KEK recipient info */
+
+static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo *cms,
+                                        CMS_RecipientInfo *ri)
+        {
+        CMS_EncryptedContentInfo *ec;
+        CMS_KEKRecipientInfo *kekri;
+        AES_KEY actx;
+        unsigned char *ukey = NULL;
+        int ukeylen;
+        int r = 0, wrap_nid;
+
+        ec = cms->d.envelopedData->encryptedContentInfo;
+
+        kekri = ri->d.kekri;
+
+        if (!kekri->key)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT, CMS_R_NO_KEY);
+                return 0;
+                }
+
+        wrap_nid = OBJ_obj2nid(kekri->keyEncryptionAlgorithm->algorithm);
+        if (aes_wrap_keylen(wrap_nid) != kekri->keylen)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT,
+                        CMS_R_INVALID_KEY_LENGTH);
+                return 0;
+                }
+
+        /* If encrypted key length is invalid don't bother */
+
+        if (kekri->encryptedKey->length < 16)
+                { 
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT,
+                                        CMS_R_INVALID_ENCRYPTED_KEY_LENGTH);
+                goto err;
+                }
+
+        if (AES_set_decrypt_key(kekri->key, kekri->keylen << 3, &actx))
+                { 
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT,
+                                                CMS_R_ERROR_SETTING_KEY);
+                goto err;
+                }
+
+        ukey = OPENSSL_malloc(kekri->encryptedKey->length - 8);
+
+        if (!ukey)
+                { 
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT,
+                                                ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        ukeylen = AES_unwrap_key(&actx, NULL, ukey,
+                                        kekri->encryptedKey->data,
+                                        kekri->encryptedKey->length);
+
+        if (ukeylen <= 0)
+                {
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT,
+                                                        CMS_R_UNWRAP_ERROR);
+                goto err;
+                }
+
+        ec->key = ukey;
+        ec->keylen = ukeylen;
+
+        r = 1;
+
+        err:
+
+        if (!r && ukey)
+                OPENSSL_free(ukey);
+        OPENSSL_cleanse(&actx, sizeof(actx));
+
+        return r;
+
+        }
+
+int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
+        {
+        switch(ri->type)
+                {
+                case CMS_RECIPINFO_TRANS:
+                return cms_RecipientInfo_ktri_decrypt(cms, ri);
+
+                case CMS_RECIPINFO_KEK:
+                return cms_RecipientInfo_kekri_decrypt(cms, ri);
+
+                default:
+                CMSerr(CMS_F_CMS_RECIPIENTINFO_DECRYPT,
+                        CMS_R_UNSUPPORTED_RECPIENTINFO_TYPE);
+                return 0;
+                }
+        }
+
+BIO *cms_EnvelopedData_init_bio(CMS_ContentInfo *cms)
+        {
+        CMS_EncryptedContentInfo *ec;
+        STACK_OF(CMS_RecipientInfo) *rinfos;
+        CMS_RecipientInfo *ri;
+        int i, r, ok = 0;
+        BIO *ret;
+
+        /* Get BIO first to set up key */
+
+        ec = cms->d.envelopedData->encryptedContentInfo;
+        ret = cms_EncryptedContent_init_bio(ec);
+
+        /* If error or no cipher end of processing */
+
+        if (!ret || !ec->cipher)
+                return ret;
+
+        /* Now encrypt content key according to each RecipientInfo type */
+
+        rinfos = cms->d.envelopedData->recipientInfos;
+
+        for (i = 0; i < sk_CMS_RecipientInfo_num(rinfos); i++)
+                {
+                ri = sk_CMS_RecipientInfo_value(rinfos, i);
+
+                switch (ri->type)
+                        {
+                        case CMS_RECIPINFO_TRANS:
+                        r = cms_RecipientInfo_ktri_encrypt(cms, ri);
+                        break;
+
+                        case CMS_RECIPINFO_KEK:
+                        r = cms_RecipientInfo_kekri_encrypt(cms, ri);
+                        break;
+
+                        default:
+                        CMSerr(CMS_F_CMS_ENVELOPEDDATA_INIT_BIO,
+                                CMS_R_UNSUPPORTED_RECIPIENT_TYPE);
+                        goto err;
+                        }
+
+                if (r <= 0)
+                        {
+                        CMSerr(CMS_F_CMS_ENVELOPEDDATA_INIT_BIO,
+                                CMS_R_ERROR_SETTING_RECIPIENTINFO);
+                        goto err;
+                        }
+                }
+
+        ok = 1;
+
+        err:
+        ec->cipher = NULL;
+        if (ec->key)
+                {
+                OPENSSL_cleanse(ec->key, ec->keylen);
+                OPENSSL_free(ec->key);
+                ec->key = NULL;
+                ec->keylen = 0;
+                }
+        if (ok)
+                return ret;
+        BIO_free(ret);
+        return NULL;
+
+        }
diff --git a/src/lib/libssl/src/crypto/cms/cms_err.c b/src/lib/libssl/src/crypto/cms/cms_err.c
new file mode 100644
index 0000000000..52fa53954f
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_err.c
@@ -0,0 +1,236 @@
+/* crypto/cms/cms_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include <openssl/cms.h>
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(ERR_LIB_CMS,func,0)
+#define ERR_REASON(reason) ERR_PACK(ERR_LIB_CMS,0,reason)
+
+static ERR_STRING_DATA CMS_str_functs[]=
+        {
+{ERR_FUNC(CMS_F_CHECK_CONTENT), "CHECK_CONTENT"},
+{ERR_FUNC(CMS_F_CMS_ADD0_CERT), "CMS_add0_cert"},
+{ERR_FUNC(CMS_F_CMS_ADD0_RECIPIENT_KEY),        "CMS_add0_recipient_key"},
+{ERR_FUNC(CMS_F_CMS_ADD1_RECEIPTREQUEST),       "CMS_add1_ReceiptRequest"},
+{ERR_FUNC(CMS_F_CMS_ADD1_RECIPIENT_CERT),       "CMS_add1_recipient_cert"},
+{ERR_FUNC(CMS_F_CMS_ADD1_SIGNER),       "CMS_add1_signer"},
+{ERR_FUNC(CMS_F_CMS_ADD1_SIGNINGTIME),  "CMS_ADD1_SIGNINGTIME"},
+{ERR_FUNC(CMS_F_CMS_COMPRESS),  "CMS_compress"},
+{ERR_FUNC(CMS_F_CMS_COMPRESSEDDATA_CREATE),     "cms_CompressedData_create"},
+{ERR_FUNC(CMS_F_CMS_COMPRESSEDDATA_INIT_BIO),   "cms_CompressedData_init_bio"},
+{ERR_FUNC(CMS_F_CMS_COPY_CONTENT),      "CMS_COPY_CONTENT"},
+{ERR_FUNC(CMS_F_CMS_COPY_MESSAGEDIGEST),        "CMS_COPY_MESSAGEDIGEST"},
+{ERR_FUNC(CMS_F_CMS_DATA),      "CMS_data"},
+{ERR_FUNC(CMS_F_CMS_DATAFINAL), "CMS_dataFinal"},
+{ERR_FUNC(CMS_F_CMS_DATAINIT),  "CMS_dataInit"},
+{ERR_FUNC(CMS_F_CMS_DECRYPT),   "CMS_decrypt"},
+{ERR_FUNC(CMS_F_CMS_DECRYPT_SET1_KEY),  "CMS_decrypt_set1_key"},
+{ERR_FUNC(CMS_F_CMS_DECRYPT_SET1_PKEY), "CMS_decrypt_set1_pkey"},
+{ERR_FUNC(CMS_F_CMS_DIGESTALGORITHM_FIND_CTX),  "cms_DigestAlgorithm_find_ctx"},
+{ERR_FUNC(CMS_F_CMS_DIGESTALGORITHM_INIT_BIO),  "cms_DigestAlgorithm_init_bio"},
+{ERR_FUNC(CMS_F_CMS_DIGESTEDDATA_DO_FINAL),     "cms_DigestedData_do_final"},
+{ERR_FUNC(CMS_F_CMS_DIGEST_VERIFY),     "CMS_digest_verify"},
+{ERR_FUNC(CMS_F_CMS_ENCODE_RECEIPT),    "cms_encode_Receipt"},
+{ERR_FUNC(CMS_F_CMS_ENCRYPT),   "CMS_encrypt"},
+{ERR_FUNC(CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO), "cms_EncryptedContent_init_bio"},
+{ERR_FUNC(CMS_F_CMS_ENCRYPTEDDATA_DECRYPT),     "CMS_EncryptedData_decrypt"},
+{ERR_FUNC(CMS_F_CMS_ENCRYPTEDDATA_ENCRYPT),     "CMS_EncryptedData_encrypt"},
+{ERR_FUNC(CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY),    "CMS_EncryptedData_set1_key"},
+{ERR_FUNC(CMS_F_CMS_ENVELOPEDDATA_CREATE),      "CMS_EnvelopedData_create"},
+{ERR_FUNC(CMS_F_CMS_ENVELOPEDDATA_INIT_BIO),    "cms_EnvelopedData_init_bio"},
+{ERR_FUNC(CMS_F_CMS_ENVELOPED_DATA_INIT),       "CMS_ENVELOPED_DATA_INIT"},
+{ERR_FUNC(CMS_F_CMS_FINAL),     "CMS_final"},
+{ERR_FUNC(CMS_F_CMS_GET0_CERTIFICATE_CHOICES),  "CMS_GET0_CERTIFICATE_CHOICES"},
+{ERR_FUNC(CMS_F_CMS_GET0_CONTENT),      "CMS_get0_content"},
+{ERR_FUNC(CMS_F_CMS_GET0_ECONTENT_TYPE),        "CMS_GET0_ECONTENT_TYPE"},
+{ERR_FUNC(CMS_F_CMS_GET0_ENVELOPED),    "CMS_GET0_ENVELOPED"},
+{ERR_FUNC(CMS_F_CMS_GET0_REVOCATION_CHOICES),   "CMS_GET0_REVOCATION_CHOICES"},
+{ERR_FUNC(CMS_F_CMS_GET0_SIGNED),       "CMS_GET0_SIGNED"},
+{ERR_FUNC(CMS_F_CMS_MSGSIGDIGEST_ADD1), "cms_msgSigDigest_add1"},
+{ERR_FUNC(CMS_F_CMS_RECEIPTREQUEST_CREATE0),    "CMS_ReceiptRequest_create0"},
+{ERR_FUNC(CMS_F_CMS_RECEIPT_VERIFY),    "cms_Receipt_verify"},
+{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_DECRYPT),     "CMS_RecipientInfo_decrypt"},
+{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT),       "CMS_RECIPIENTINFO_KEKRI_DECRYPT"},
+{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT),       "CMS_RECIPIENTINFO_KEKRI_ENCRYPT"},
+{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KEKRI_GET0_ID),       "CMS_RecipientInfo_kekri_get0_id"},
+{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KEKRI_ID_CMP),        "CMS_RecipientInfo_kekri_id_cmp"},
+{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KTRI_CERT_CMP),       "CMS_RecipientInfo_ktri_cert_cmp"},
+{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT),        "CMS_RECIPIENTINFO_KTRI_DECRYPT"},
+{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT),        "CMS_RECIPIENTINFO_KTRI_ENCRYPT"},
+{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_ALGS),      "CMS_RecipientInfo_ktri_get0_algs"},
+{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_SIGNER_ID), "CMS_RecipientInfo_ktri_get0_signer_id"},
+{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_SET0_KEY),    "CMS_RecipientInfo_set0_key"},
+{ERR_FUNC(CMS_F_CMS_RECIPIENTINFO_SET0_PKEY),   "CMS_RecipientInfo_set0_pkey"},
+{ERR_FUNC(CMS_F_CMS_SET1_SIGNERIDENTIFIER),     "cms_set1_SignerIdentifier"},
+{ERR_FUNC(CMS_F_CMS_SET_DETACHED),      "CMS_set_detached"},
+{ERR_FUNC(CMS_F_CMS_SIGN),      "CMS_sign"},
+{ERR_FUNC(CMS_F_CMS_SIGNED_DATA_INIT),  "CMS_SIGNED_DATA_INIT"},
+{ERR_FUNC(CMS_F_CMS_SIGNERINFO_CONTENT_SIGN),   "CMS_SIGNERINFO_CONTENT_SIGN"},
+{ERR_FUNC(CMS_F_CMS_SIGNERINFO_SIGN),   "CMS_SignerInfo_sign"},
+{ERR_FUNC(CMS_F_CMS_SIGNERINFO_VERIFY), "CMS_SignerInfo_verify"},
+{ERR_FUNC(CMS_F_CMS_SIGNERINFO_VERIFY_CERT),    "CMS_SIGNERINFO_VERIFY_CERT"},
+{ERR_FUNC(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT), "CMS_SignerInfo_verify_content"},
+{ERR_FUNC(CMS_F_CMS_SIGN_RECEIPT),      "CMS_sign_receipt"},
+{ERR_FUNC(CMS_F_CMS_STREAM),    "CMS_STREAM"},
+{ERR_FUNC(CMS_F_CMS_UNCOMPRESS),        "CMS_uncompress"},
+{ERR_FUNC(CMS_F_CMS_VERIFY),    "CMS_verify"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA CMS_str_reasons[]=
+        {
+{ERR_REASON(CMS_R_ADD_SIGNER_ERROR)      ,"add signer error"},
+{ERR_REASON(CMS_R_CERTIFICATE_ALREADY_PRESENT),"certificate already present"},
+{ERR_REASON(CMS_R_CERTIFICATE_HAS_NO_KEYID),"certificate has no keyid"},
+{ERR_REASON(CMS_R_CERTIFICATE_VERIFY_ERROR),"certificate verify error"},
+{ERR_REASON(CMS_R_CIPHER_INITIALISATION_ERROR),"cipher initialisation error"},
+{ERR_REASON(CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR),"cipher parameter initialisation error"},
+{ERR_REASON(CMS_R_CMS_DATAFINAL_ERROR)   ,"cms datafinal error"},
+{ERR_REASON(CMS_R_CMS_LIB)               ,"cms lib"},
+{ERR_REASON(CMS_R_CONTENTIDENTIFIER_MISMATCH),"contentidentifier mismatch"},
+{ERR_REASON(CMS_R_CONTENT_NOT_FOUND)     ,"content not found"},
+{ERR_REASON(CMS_R_CONTENT_TYPE_MISMATCH) ,"content type mismatch"},
+{ERR_REASON(CMS_R_CONTENT_TYPE_NOT_COMPRESSED_DATA),"content type not compressed data"},
+{ERR_REASON(CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA),"content type not enveloped data"},
+{ERR_REASON(CMS_R_CONTENT_TYPE_NOT_SIGNED_DATA),"content type not signed data"},
+{ERR_REASON(CMS_R_CONTENT_VERIFY_ERROR)  ,"content verify error"},
+{ERR_REASON(CMS_R_CTRL_ERROR)            ,"ctrl error"},
+{ERR_REASON(CMS_R_CTRL_FAILURE)          ,"ctrl failure"},
+{ERR_REASON(CMS_R_DECRYPT_ERROR)         ,"decrypt error"},
+{ERR_REASON(CMS_R_DIGEST_ERROR)          ,"digest error"},
+{ERR_REASON(CMS_R_ERROR_GETTING_PUBLIC_KEY),"error getting public key"},
+{ERR_REASON(CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE),"error reading messagedigest attribute"},
+{ERR_REASON(CMS_R_ERROR_SETTING_KEY)     ,"error setting key"},
+{ERR_REASON(CMS_R_ERROR_SETTING_RECIPIENTINFO),"error setting recipientinfo"},
+{ERR_REASON(CMS_R_INVALID_ENCRYPTED_KEY_LENGTH),"invalid encrypted key length"},
+{ERR_REASON(CMS_R_INVALID_KEY_LENGTH)    ,"invalid key length"},
+{ERR_REASON(CMS_R_MD_BIO_INIT_ERROR)     ,"md bio init error"},
+{ERR_REASON(CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH),"messagedigest attribute wrong length"},
+{ERR_REASON(CMS_R_MESSAGEDIGEST_WRONG_LENGTH),"messagedigest wrong length"},
+{ERR_REASON(CMS_R_MSGSIGDIGEST_ERROR)    ,"msgsigdigest error"},
+{ERR_REASON(CMS_R_MSGSIGDIGEST_VERIFICATION_FAILURE),"msgsigdigest verification failure"},
+{ERR_REASON(CMS_R_MSGSIGDIGEST_WRONG_LENGTH),"msgsigdigest wrong length"},
+{ERR_REASON(CMS_R_NEED_ONE_SIGNER)       ,"need one signer"},
+{ERR_REASON(CMS_R_NOT_A_SIGNED_RECEIPT)  ,"not a signed receipt"},
+{ERR_REASON(CMS_R_NOT_ENCRYPTED_DATA)    ,"not encrypted data"},
+{ERR_REASON(CMS_R_NOT_KEK)               ,"not kek"},
+{ERR_REASON(CMS_R_NOT_KEY_TRANSPORT)     ,"not key transport"},
+{ERR_REASON(CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE),"not supported for this key type"},
+{ERR_REASON(CMS_R_NO_CIPHER)             ,"no cipher"},
+{ERR_REASON(CMS_R_NO_CONTENT)            ,"no content"},
+{ERR_REASON(CMS_R_NO_CONTENT_TYPE)       ,"no content type"},
+{ERR_REASON(CMS_R_NO_DEFAULT_DIGEST)     ,"no default digest"},
+{ERR_REASON(CMS_R_NO_DIGEST_SET)         ,"no digest set"},
+{ERR_REASON(CMS_R_NO_KEY)                ,"no key"},
+{ERR_REASON(CMS_R_NO_KEY_OR_CERT)        ,"no key or cert"},
+{ERR_REASON(CMS_R_NO_MATCHING_DIGEST)    ,"no matching digest"},
+{ERR_REASON(CMS_R_NO_MATCHING_RECIPIENT) ,"no matching recipient"},
+{ERR_REASON(CMS_R_NO_MATCHING_SIGNATURE) ,"no matching signature"},
+{ERR_REASON(CMS_R_NO_MSGSIGDIGEST)       ,"no msgsigdigest"},
+{ERR_REASON(CMS_R_NO_PRIVATE_KEY)        ,"no private key"},
+{ERR_REASON(CMS_R_NO_PUBLIC_KEY)         ,"no public key"},
+{ERR_REASON(CMS_R_NO_RECEIPT_REQUEST)    ,"no receipt request"},
+{ERR_REASON(CMS_R_NO_SIGNERS)            ,"no signers"},
+{ERR_REASON(CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE),"private key does not match certificate"},
+{ERR_REASON(CMS_R_RECEIPT_DECODE_ERROR)  ,"receipt decode error"},
+{ERR_REASON(CMS_R_RECIPIENT_ERROR)       ,"recipient error"},
+{ERR_REASON(CMS_R_SIGNER_CERTIFICATE_NOT_FOUND),"signer certificate not found"},
+{ERR_REASON(CMS_R_SIGNFINAL_ERROR)       ,"signfinal error"},
+{ERR_REASON(CMS_R_SMIME_TEXT_ERROR)      ,"smime text error"},
+{ERR_REASON(CMS_R_STORE_INIT_ERROR)      ,"store init error"},
+{ERR_REASON(CMS_R_TYPE_NOT_COMPRESSED_DATA),"type not compressed data"},
+{ERR_REASON(CMS_R_TYPE_NOT_DATA)         ,"type not data"},
+{ERR_REASON(CMS_R_TYPE_NOT_DIGESTED_DATA),"type not digested data"},
+{ERR_REASON(CMS_R_TYPE_NOT_ENCRYPTED_DATA),"type not encrypted data"},
+{ERR_REASON(CMS_R_TYPE_NOT_ENVELOPED_DATA),"type not enveloped data"},
+{ERR_REASON(CMS_R_UNABLE_TO_FINALIZE_CONTEXT),"unable to finalize context"},
+{ERR_REASON(CMS_R_UNKNOWN_CIPHER)        ,"unknown cipher"},
+{ERR_REASON(CMS_R_UNKNOWN_DIGEST_ALGORIHM),"unknown digest algorihm"},
+{ERR_REASON(CMS_R_UNKNOWN_ID)            ,"unknown id"},
+{ERR_REASON(CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM),"unsupported compression algorithm"},
+{ERR_REASON(CMS_R_UNSUPPORTED_CONTENT_TYPE),"unsupported content type"},
+{ERR_REASON(CMS_R_UNSUPPORTED_KEK_ALGORITHM),"unsupported kek algorithm"},
+{ERR_REASON(CMS_R_UNSUPPORTED_RECIPIENT_TYPE),"unsupported recipient type"},
+{ERR_REASON(CMS_R_UNSUPPORTED_RECPIENTINFO_TYPE),"unsupported recpientinfo type"},
+{ERR_REASON(CMS_R_UNSUPPORTED_TYPE)      ,"unsupported type"},
+{ERR_REASON(CMS_R_UNWRAP_ERROR)          ,"unwrap error"},
+{ERR_REASON(CMS_R_VERIFICATION_FAILURE)  ,"verification failure"},
+{ERR_REASON(CMS_R_WRAP_ERROR)            ,"wrap error"},
+{0,NULL}
+        };
+
+#endif
+
+void ERR_load_CMS_strings(void)
+        {
+#ifndef OPENSSL_NO_ERR
+
+        if (ERR_func_error_string(CMS_str_functs[0].error) == NULL)
+                {
+                ERR_load_strings(0,CMS_str_functs);
+                ERR_load_strings(0,CMS_str_reasons);
+                }
+#endif
+        }
diff --git a/src/lib/libssl/src/crypto/cms/cms_ess.c b/src/lib/libssl/src/crypto/cms/cms_ess.c
new file mode 100644
index 0000000000..ed34ff3228
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_ess.c
@@ -0,0 +1,420 @@
+/* crypto/cms/cms_ess.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include "cryptlib.h"
+#include <openssl/asn1t.h>
+#include <openssl/pem.h>
+#include <openssl/rand.h>
+#include <openssl/x509v3.h>
+#include <openssl/err.h>
+#include <openssl/cms.h>
+#include "cms_lcl.h"
+
+DECLARE_ASN1_ITEM(CMS_ReceiptRequest)
+DECLARE_ASN1_ITEM(CMS_Receipt)
+
+IMPLEMENT_ASN1_FUNCTIONS_const(CMS_ReceiptRequest)
+
+/* ESS services: for now just Signed Receipt related */
+
+int CMS_get1_ReceiptRequest(CMS_SignerInfo *si, CMS_ReceiptRequest **prr)
+        {
+        ASN1_STRING *str;
+        CMS_ReceiptRequest *rr = NULL;
+        if (prr)
+                *prr = NULL;
+        str = CMS_signed_get0_data_by_OBJ(si,
+                                OBJ_nid2obj(NID_id_smime_aa_receiptRequest),
+                                        -3, V_ASN1_SEQUENCE);
+        if (!str)
+                return 0;
+
+        rr = ASN1_item_unpack(str, ASN1_ITEM_rptr(CMS_ReceiptRequest));
+        if (!rr)
+                return -1;
+        if (prr)
+                *prr = rr;
+        else
+                CMS_ReceiptRequest_free(rr);
+        return 1;
+        }
+
+CMS_ReceiptRequest *CMS_ReceiptRequest_create0(unsigned char *id, int idlen,
+                                int allorfirst,
+                                STACK_OF(GENERAL_NAMES) *receiptList,
+                                STACK_OF(GENERAL_NAMES) *receiptsTo)
+        {
+        CMS_ReceiptRequest *rr = NULL;
+
+        rr = CMS_ReceiptRequest_new();
+        if (!rr)
+                goto merr;
+        if (id)
+                ASN1_STRING_set0(rr->signedContentIdentifier, id, idlen);
+        else
+                {
+                if (!ASN1_STRING_set(rr->signedContentIdentifier, NULL, 32))
+                        goto merr;
+                if (RAND_pseudo_bytes(rr->signedContentIdentifier->data, 32) 
+                                        <= 0)
+                        goto err;
+                }
+
+        sk_GENERAL_NAMES_pop_free(rr->receiptsTo, GENERAL_NAMES_free);
+        rr->receiptsTo = receiptsTo;
+
+        if (receiptList)
+                {
+                rr->receiptsFrom->type = 1;
+                rr->receiptsFrom->d.receiptList = receiptList;
+                }
+        else
+                {
+                rr->receiptsFrom->type = 0;
+                rr->receiptsFrom->d.allOrFirstTier = allorfirst;
+                }
+
+        return rr;
+
+        merr:
+        CMSerr(CMS_F_CMS_RECEIPTREQUEST_CREATE0, ERR_R_MALLOC_FAILURE);
+
+        err:
+        if (rr)
+                CMS_ReceiptRequest_free(rr);
+
+        return NULL;
+        
+        }
+
+int CMS_add1_ReceiptRequest(CMS_SignerInfo *si, CMS_ReceiptRequest *rr)
+        {
+        unsigned char *rrder = NULL;
+        int rrderlen, r = 0;
+
+        rrderlen = i2d_CMS_ReceiptRequest(rr, &rrder);
+        if (rrderlen < 0)
+                goto merr;
+
+        if (!CMS_signed_add1_attr_by_NID(si, NID_id_smime_aa_receiptRequest,
+                                        V_ASN1_SEQUENCE, rrder, rrderlen))
+                goto merr;
+
+        r = 1;
+
+        merr:
+        if (!r)
+                CMSerr(CMS_F_CMS_ADD1_RECEIPTREQUEST, ERR_R_MALLOC_FAILURE);
+
+        if (rrder)
+                OPENSSL_free(rrder);
+
+        return r;
+        
+        }
+
+void CMS_ReceiptRequest_get0_values(CMS_ReceiptRequest *rr,
+                                        ASN1_STRING **pcid,
+                                        int *pallorfirst,
+                                        STACK_OF(GENERAL_NAMES) **plist,
+                                        STACK_OF(GENERAL_NAMES) **prto)
+        {
+        if (pcid)
+                *pcid = rr->signedContentIdentifier;
+        if (rr->receiptsFrom->type == 0)
+                {
+                if (pallorfirst)
+                        *pallorfirst = (int)rr->receiptsFrom->d.allOrFirstTier;
+                if (plist)
+                        *plist = NULL;
+                }
+        else
+                {
+                if (pallorfirst)
+                        *pallorfirst = -1;
+                if (plist)
+                        *plist = rr->receiptsFrom->d.receiptList;
+                }
+        if (prto)
+                *prto = rr->receiptsTo;
+        }
+
+/* Digest a SignerInfo structure for msgSigDigest attribute processing */
+
+static int cms_msgSigDigest(CMS_SignerInfo *si,
+                                unsigned char *dig, unsigned int *diglen)
+        {
+        const EVP_MD *md;
+        md = EVP_get_digestbyobj(si->digestAlgorithm->algorithm);
+        if (md == NULL)
+                return 0;
+        if (!ASN1_item_digest(ASN1_ITEM_rptr(CMS_Attributes_Verify), md,
+                                                si->signedAttrs, dig, diglen))
+                return 0;
+        return 1;
+        }
+
+/* Add a msgSigDigest attribute to a SignerInfo */
+
+int cms_msgSigDigest_add1(CMS_SignerInfo *dest, CMS_SignerInfo *src)
+        {
+        unsigned char dig[EVP_MAX_MD_SIZE];
+        unsigned int diglen;
+        if (!cms_msgSigDigest(src, dig, &diglen))
+                {
+                CMSerr(CMS_F_CMS_MSGSIGDIGEST_ADD1, CMS_R_MSGSIGDIGEST_ERROR);
+                return 0;
+                }
+        if (!CMS_signed_add1_attr_by_NID(dest, NID_id_smime_aa_msgSigDigest,
+                                        V_ASN1_OCTET_STRING, dig, diglen))
+                {
+                CMSerr(CMS_F_CMS_MSGSIGDIGEST_ADD1, ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        return 1;
+        }
+
+/* Verify signed receipt after it has already passed normal CMS verify */
+
+int cms_Receipt_verify(CMS_ContentInfo *cms, CMS_ContentInfo *req_cms)
+        {
+        int r = 0, i;
+        CMS_ReceiptRequest *rr = NULL;
+        CMS_Receipt *rct = NULL;
+        STACK_OF(CMS_SignerInfo) *sis, *osis;
+        CMS_SignerInfo *si, *osi = NULL;
+        ASN1_OCTET_STRING *msig, **pcont;
+        ASN1_OBJECT *octype;
+        unsigned char dig[EVP_MAX_MD_SIZE];
+        unsigned int diglen;
+
+        /* Get SignerInfos, also checks SignedData content type */
+        osis = CMS_get0_SignerInfos(req_cms);
+        sis = CMS_get0_SignerInfos(cms);
+        if (!osis || !sis)
+                goto err;
+
+        if (sk_CMS_SignerInfo_num(sis) != 1)
+                {
+                CMSerr(CMS_F_CMS_RECEIPT_VERIFY, CMS_R_NEED_ONE_SIGNER);
+                goto err;
+                }
+
+        /* Check receipt content type */
+        if (OBJ_obj2nid(CMS_get0_eContentType(cms)) != NID_id_smime_ct_receipt)
+                {
+                CMSerr(CMS_F_CMS_RECEIPT_VERIFY, CMS_R_NOT_A_SIGNED_RECEIPT);
+                goto err;
+                }
+
+        /* Extract and decode receipt content */
+        pcont = CMS_get0_content(cms);
+        if (!pcont || !*pcont)
+                {
+                CMSerr(CMS_F_CMS_RECEIPT_VERIFY, CMS_R_NO_CONTENT);
+                goto err;
+                }
+
+        rct = ASN1_item_unpack(*pcont, ASN1_ITEM_rptr(CMS_Receipt));
+
+        if (!rct)       
+                {
+                CMSerr(CMS_F_CMS_RECEIPT_VERIFY, CMS_R_RECEIPT_DECODE_ERROR);
+                goto err;
+                }
+
+        /* Locate original request */
+
+        for (i = 0; i < sk_CMS_SignerInfo_num(osis); i++)
+                {
+                osi = sk_CMS_SignerInfo_value(osis, i);
+                if (!ASN1_STRING_cmp(osi->signature,
+                                        rct->originatorSignatureValue))
+                        break;
+                }
+
+        if (i == sk_CMS_SignerInfo_num(osis))
+                {
+                CMSerr(CMS_F_CMS_RECEIPT_VERIFY, CMS_R_NO_MATCHING_SIGNATURE);
+                goto err;
+                }
+
+        si = sk_CMS_SignerInfo_value(sis, 0);
+
+        /* Get msgSigDigest value and compare */
+
+        msig = CMS_signed_get0_data_by_OBJ(si,
+                                OBJ_nid2obj(NID_id_smime_aa_msgSigDigest),
+                                        -3, V_ASN1_OCTET_STRING);
+
+        if (!msig)
+                {
+                CMSerr(CMS_F_CMS_RECEIPT_VERIFY, CMS_R_NO_MSGSIGDIGEST);
+                goto err;
+                }
+
+        if (!cms_msgSigDigest(osi, dig, &diglen))
+                {
+                CMSerr(CMS_F_CMS_RECEIPT_VERIFY, CMS_R_MSGSIGDIGEST_ERROR);
+                goto err;
+                }
+
+        if (diglen != (unsigned int)msig->length)
+                        {
+                        CMSerr(CMS_F_CMS_RECEIPT_VERIFY,
+                                CMS_R_MSGSIGDIGEST_WRONG_LENGTH);
+                        goto err;
+                        }
+
+        if (memcmp(dig, msig->data, diglen))
+                        {
+                        CMSerr(CMS_F_CMS_RECEIPT_VERIFY,
+                                CMS_R_MSGSIGDIGEST_VERIFICATION_FAILURE);
+                        goto err;
+                        }
+
+        /* Compare content types */
+
+        octype = CMS_signed_get0_data_by_OBJ(osi,
+                                OBJ_nid2obj(NID_pkcs9_contentType),
+                                        -3, V_ASN1_OBJECT);
+        if (!octype)
+                {
+                CMSerr(CMS_F_CMS_RECEIPT_VERIFY, CMS_R_NO_CONTENT_TYPE);
+                goto err;
+                }
+
+        /* Compare details in receipt request */
+
+        if (OBJ_cmp(octype, rct->contentType))
+                {
+                CMSerr(CMS_F_CMS_RECEIPT_VERIFY, CMS_R_CONTENT_TYPE_MISMATCH);
+                goto err;
+                }
+
+        /* Get original receipt request details */
+
+        if (!CMS_get1_ReceiptRequest(osi, &rr))
+                {
+                CMSerr(CMS_F_CMS_RECEIPT_VERIFY, CMS_R_NO_RECEIPT_REQUEST);
+                goto err;
+                }
+
+        if (ASN1_STRING_cmp(rr->signedContentIdentifier,
+                                        rct->signedContentIdentifier))
+                {
+                CMSerr(CMS_F_CMS_RECEIPT_VERIFY,
+                                        CMS_R_CONTENTIDENTIFIER_MISMATCH);
+                goto err;
+                }
+
+        r = 1;
+
+        err:
+        if (rr)
+                CMS_ReceiptRequest_free(rr);
+        if (rct)
+                M_ASN1_free_of(rct, CMS_Receipt);
+
+        return r;
+
+        }
+
+/* Encode a Receipt into an OCTET STRING read for including into content of
+ * a SignedData ContentInfo.
+ */
+
+ASN1_OCTET_STRING *cms_encode_Receipt(CMS_SignerInfo *si)
+        {
+        CMS_Receipt rct;
+        CMS_ReceiptRequest *rr = NULL;
+        ASN1_OBJECT *ctype;
+        ASN1_OCTET_STRING *os = NULL;
+
+        /* Get original receipt request */
+
+        /* Get original receipt request details */
+
+        if (!CMS_get1_ReceiptRequest(si, &rr))
+                {
+                CMSerr(CMS_F_CMS_ENCODE_RECEIPT, CMS_R_NO_RECEIPT_REQUEST);
+                goto err;
+                }
+
+        /* Get original content type */
+
+        ctype = CMS_signed_get0_data_by_OBJ(si,
+                                OBJ_nid2obj(NID_pkcs9_contentType),
+                                        -3, V_ASN1_OBJECT);
+        if (!ctype)
+                {
+                CMSerr(CMS_F_CMS_ENCODE_RECEIPT, CMS_R_NO_CONTENT_TYPE);
+                goto err;
+                }
+
+        rct.version = 1;
+        rct.contentType = ctype;
+        rct.signedContentIdentifier = rr->signedContentIdentifier;
+        rct.originatorSignatureValue = si->signature;
+
+        os = ASN1_item_pack(&rct, ASN1_ITEM_rptr(CMS_Receipt), NULL);
+
+        err:
+        if (rr)
+                CMS_ReceiptRequest_free(rr);
+
+        return os;
+
+        }
+
+
diff --git a/src/lib/libssl/src/crypto/cms/cms_io.c b/src/lib/libssl/src/crypto/cms/cms_io.c
new file mode 100644
index 0000000000..30f5ddfe6d
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_io.c
@@ -0,0 +1,140 @@
+/* crypto/cms/cms_io.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include <openssl/asn1t.h>
+#include <openssl/x509.h>
+#include <openssl/err.h>
+#include <openssl/pem.h>
+#include "cms.h"
+#include "cms_lcl.h"
+
+CMS_ContentInfo *d2i_CMS_bio(BIO *bp, CMS_ContentInfo **cms)
+        {
+        return ASN1_item_d2i_bio(ASN1_ITEM_rptr(CMS_ContentInfo), bp, cms);
+        }
+
+int i2d_CMS_bio(BIO *bp, CMS_ContentInfo *cms)
+        {
+        return ASN1_item_i2d_bio(ASN1_ITEM_rptr(CMS_ContentInfo), bp, cms);
+        }
+
+IMPLEMENT_PEM_rw_const(CMS, CMS_ContentInfo, PEM_STRING_CMS, CMS_ContentInfo)
+
+/* Callback for int_smime_write_ASN1 */
+
+static int cms_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
+                                        const ASN1_ITEM *it)
+        {
+        CMS_ContentInfo *cms = (CMS_ContentInfo *)val;
+        BIO *tmpbio, *cmsbio;
+        int r = 0;
+
+        if (!(flags & SMIME_DETACHED))
+                {
+                SMIME_crlf_copy(data, out, flags);
+                return 1;
+                }
+
+        /* Let CMS code prepend any needed BIOs */
+
+        cmsbio = CMS_dataInit(cms, out);
+
+        if (!cmsbio)
+                return 0;
+
+        /* Copy data across, passing through filter BIOs for processing */
+        SMIME_crlf_copy(data, cmsbio, flags);
+
+        /* Finalize structure */
+        if (CMS_dataFinal(cms, cmsbio) <= 0)
+                goto err;
+
+        r = 1;
+
+        err:
+
+        /* Now remove any digests prepended to the BIO */
+
+        while (cmsbio != out)
+                {
+                tmpbio = BIO_pop(cmsbio);
+                BIO_free(cmsbio);
+                cmsbio = tmpbio;
+                }
+
+        return 1;
+
+        }
+
+
+int SMIME_write_CMS(BIO *bio, CMS_ContentInfo *cms, BIO *data, int flags)
+        {
+        STACK_OF(X509_ALGOR) *mdalgs;
+        int ctype_nid = OBJ_obj2nid(cms->contentType);
+        int econt_nid = OBJ_obj2nid(CMS_get0_eContentType(cms));
+        if (ctype_nid == NID_pkcs7_signed)
+                mdalgs = cms->d.signedData->digestAlgorithms;
+        else
+                mdalgs = NULL;
+
+        return int_smime_write_ASN1(bio, (ASN1_VALUE *)cms, data, flags,
+                                        ctype_nid, econt_nid, mdalgs,
+                                        cms_output_data,
+                                        ASN1_ITEM_rptr(CMS_ContentInfo));       
+        }
+
+CMS_ContentInfo *SMIME_read_CMS(BIO *bio, BIO **bcont)
+        {
+        return (CMS_ContentInfo *)SMIME_read_ASN1(bio, bcont,
+                                        ASN1_ITEM_rptr(CMS_ContentInfo));
+        }
diff --git a/src/lib/libssl/src/crypto/cms/cms_lcl.h b/src/lib/libssl/src/crypto/cms/cms_lcl.h
new file mode 100644
index 0000000000..7d60fac67e
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_lcl.h
@@ -0,0 +1,460 @@
+/* crypto/cms/cms_lcl.h */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#ifndef HEADER_CMS_LCL_H
+#define HEADER_CMS_LCL_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <openssl/x509.h>
+
+/* Cryptographic message syntax (CMS) structures: taken
+ * from RFC3852
+ */
+
+/* Forward references */
+
+typedef struct CMS_IssuerAndSerialNumber_st CMS_IssuerAndSerialNumber;
+typedef struct CMS_EncapsulatedContentInfo_st CMS_EncapsulatedContentInfo;
+typedef struct CMS_SignerIdentifier_st CMS_SignerIdentifier;
+typedef struct CMS_SignedData_st CMS_SignedData;
+typedef struct CMS_OtherRevocationInfoFormat_st CMS_OtherRevocationInfoFormat;
+typedef struct CMS_OriginatorInfo_st CMS_OriginatorInfo;
+typedef struct CMS_EncryptedContentInfo_st CMS_EncryptedContentInfo;
+typedef struct CMS_EnvelopedData_st CMS_EnvelopedData;
+typedef struct CMS_DigestedData_st CMS_DigestedData;
+typedef struct CMS_EncryptedData_st CMS_EncryptedData;
+typedef struct CMS_AuthenticatedData_st CMS_AuthenticatedData;
+typedef struct CMS_CompressedData_st CMS_CompressedData;
+typedef struct CMS_OtherCertificateFormat_st CMS_OtherCertificateFormat;
+typedef struct CMS_KeyTransRecipientInfo_st CMS_KeyTransRecipientInfo;
+typedef struct CMS_OriginatorPublicKey_st CMS_OriginatorPublicKey;
+typedef struct CMS_OriginatorIdentifierOrKey_st CMS_OriginatorIdentifierOrKey;
+typedef struct CMS_KeyAgreeRecipientInfo_st CMS_KeyAgreeRecipientInfo;
+typedef struct CMS_OtherKeyAttribute_st CMS_OtherKeyAttribute;
+typedef struct CMS_RecipientKeyIdentifier_st CMS_RecipientKeyIdentifier;
+typedef struct CMS_KeyAgreeRecipientIdentifier_st CMS_KeyAgreeRecipientIdentifier;
+typedef struct CMS_RecipientEncryptedKey_st CMS_RecipientEncryptedKey;
+typedef struct CMS_KEKIdentifier_st CMS_KEKIdentifier;
+typedef struct CMS_KEKRecipientInfo_st CMS_KEKRecipientInfo;
+typedef struct CMS_PasswordRecipientInfo_st CMS_PasswordRecipientInfo;
+typedef struct CMS_OtherRecipientInfo_st CMS_OtherRecipientInfo;
+typedef struct CMS_ReceiptsFrom_st CMS_ReceiptsFrom;
+
+struct CMS_ContentInfo_st
+        {
+        ASN1_OBJECT *contentType;
+        union   {
+                ASN1_OCTET_STRING *data;
+                CMS_SignedData *signedData;
+                CMS_EnvelopedData *envelopedData;
+                CMS_DigestedData *digestedData;
+                CMS_EncryptedData *encryptedData;
+                CMS_AuthenticatedData *authenticatedData;
+                CMS_CompressedData *compressedData;
+                ASN1_TYPE *other;
+                /* Other types ... */
+                void *otherData;
+                } d;
+        };
+
+struct CMS_SignedData_st
+        {
+        long version;
+        STACK_OF(X509_ALGOR) *digestAlgorithms;
+        CMS_EncapsulatedContentInfo *encapContentInfo;
+        STACK_OF(CMS_CertificateChoices) *certificates;
+        STACK_OF(CMS_RevocationInfoChoice) *crls;
+        STACK_OF(CMS_SignerInfo) *signerInfos;
+        };
+ 
+struct CMS_EncapsulatedContentInfo_st
+        {
+        ASN1_OBJECT *eContentType;
+        ASN1_OCTET_STRING *eContent;
+        /* Set to 1 if incomplete structure only part set up */
+        int partial;
+        };
+
+struct CMS_SignerInfo_st
+        {
+        long version;
+        CMS_SignerIdentifier *sid;
+        X509_ALGOR *digestAlgorithm;
+        STACK_OF(X509_ATTRIBUTE) *signedAttrs;
+        X509_ALGOR *signatureAlgorithm;
+        ASN1_OCTET_STRING *signature;
+        STACK_OF(X509_ATTRIBUTE) *unsignedAttrs;
+        /* Signing certificate and key */
+        X509 *signer;
+        EVP_PKEY *pkey;
+        };
+
+struct CMS_SignerIdentifier_st
+        {
+        int type;
+        union   {
+                CMS_IssuerAndSerialNumber *issuerAndSerialNumber;
+                ASN1_OCTET_STRING *subjectKeyIdentifier;
+                } d;
+        };
+
+struct CMS_EnvelopedData_st
+        {
+        long version;
+        CMS_OriginatorInfo *originatorInfo;
+        STACK_OF(CMS_RecipientInfo) *recipientInfos;
+        CMS_EncryptedContentInfo *encryptedContentInfo;
+        STACK_OF(X509_ATTRIBUTE) *unprotectedAttrs;
+        };
+
+struct CMS_OriginatorInfo_st
+        {
+        STACK_OF(CMS_CertificateChoices) *certificates;
+        STACK_OF(CMS_RevocationInfoChoice) *crls;
+        };
+
+struct CMS_EncryptedContentInfo_st
+        {
+        ASN1_OBJECT *contentType;
+        X509_ALGOR *contentEncryptionAlgorithm;
+        ASN1_OCTET_STRING *encryptedContent;
+        /* Content encryption algorithm and key */
+        const EVP_CIPHER *cipher;
+        unsigned char *key;
+        size_t keylen;
+        };
+
+struct CMS_RecipientInfo_st
+        {
+        int type;
+        union   {
+                CMS_KeyTransRecipientInfo *ktri;
+                CMS_KeyAgreeRecipientInfo *kari;
+                CMS_KEKRecipientInfo *kekri;
+                CMS_PasswordRecipientInfo *pwri;
+                CMS_OtherRecipientInfo *ori;
+                } d;
+        };
+
+typedef CMS_SignerIdentifier CMS_RecipientIdentifier;
+
+struct CMS_KeyTransRecipientInfo_st
+        {
+        long version;
+        CMS_RecipientIdentifier *rid;
+        X509_ALGOR *keyEncryptionAlgorithm;
+        ASN1_OCTET_STRING *encryptedKey;
+        /* Recipient Key and cert */
+        X509 *recip;
+        EVP_PKEY *pkey;
+        };
+
+struct CMS_KeyAgreeRecipientInfo_st
+        {
+        long version;
+        CMS_OriginatorIdentifierOrKey *originator;
+        ASN1_OCTET_STRING *ukm;
+        X509_ALGOR *keyEncryptionAlgorithm;
+        STACK_OF(CMS_RecipientEncryptedKey) *recipientEncryptedKeys;
+        };
+
+struct CMS_OriginatorIdentifierOrKey_st
+        {
+        int type;
+        union   {
+                CMS_IssuerAndSerialNumber *issuerAndSerialNumber;
+                ASN1_OCTET_STRING *subjectKeyIdentifier;
+                CMS_OriginatorPublicKey *originatorKey;
+                } d;
+        };
+
+struct CMS_OriginatorPublicKey_st
+        {
+        X509_ALGOR *algorithm;
+        ASN1_BIT_STRING *publicKey;
+        };
+
+struct CMS_RecipientEncryptedKey_st
+        {
+        CMS_KeyAgreeRecipientIdentifier *rid;
+        ASN1_OCTET_STRING *encryptedKey;
+        };
+
+struct CMS_KeyAgreeRecipientIdentifier_st
+        {
+        int type;
+        union   {
+                CMS_IssuerAndSerialNumber *issuerAndSerialNumber;
+                CMS_RecipientKeyIdentifier *rKeyId;
+                } d;
+        };
+
+struct CMS_RecipientKeyIdentifier_st
+        {
+        ASN1_OCTET_STRING *subjectKeyIdentifier;
+        ASN1_GENERALIZEDTIME *date;
+        CMS_OtherKeyAttribute *other;
+        };
+
+struct CMS_KEKRecipientInfo_st
+        {
+        long version;
+        CMS_KEKIdentifier *kekid;
+        X509_ALGOR *keyEncryptionAlgorithm;
+        ASN1_OCTET_STRING *encryptedKey;
+        /* Extra info: symmetric key to use */
+        unsigned char *key;
+        size_t keylen;
+        };
+
+struct CMS_KEKIdentifier_st
+        {
+        ASN1_OCTET_STRING *keyIdentifier;
+        ASN1_GENERALIZEDTIME *date;
+        CMS_OtherKeyAttribute *other;
+        };
+
+struct CMS_PasswordRecipientInfo_st
+        {
+        long version;
+        X509_ALGOR *keyDerivationAlgorithm;
+        X509_ALGOR *keyEncryptionAlgorithm;
+        ASN1_OCTET_STRING *encryptedKey;
+        };
+
+struct CMS_OtherRecipientInfo_st
+        {
+        ASN1_OBJECT *oriType;
+        ASN1_TYPE *oriValue;
+        };
+
+struct CMS_DigestedData_st
+        {
+        long version;
+        X509_ALGOR *digestAlgorithm;
+        CMS_EncapsulatedContentInfo *encapContentInfo;
+        ASN1_OCTET_STRING *digest;
+        };
+
+struct CMS_EncryptedData_st
+        {
+        long version;
+        CMS_EncryptedContentInfo *encryptedContentInfo;
+        STACK_OF(X509_ATTRIBUTE) *unprotectedAttrs;
+        };
+
+struct CMS_AuthenticatedData_st
+        {
+        long version;
+        CMS_OriginatorInfo *originatorInfo;
+        STACK_OF(CMS_RecipientInfo) *recipientInfos;
+        X509_ALGOR *macAlgorithm;
+        X509_ALGOR *digestAlgorithm;
+        CMS_EncapsulatedContentInfo *encapContentInfo;
+        STACK_OF(X509_ATTRIBUTE) *authAttrs;
+        ASN1_OCTET_STRING *mac;
+        STACK_OF(X509_ATTRIBUTE) *unauthAttrs;
+        };
+
+struct CMS_CompressedData_st
+        {
+        long version;
+        X509_ALGOR *compressionAlgorithm;
+        STACK_OF(CMS_RecipientInfo) *recipientInfos;
+        CMS_EncapsulatedContentInfo *encapContentInfo;
+        };
+
+struct CMS_RevocationInfoChoice_st
+        {
+        int type;
+        union   {
+                X509_CRL *crl;
+                CMS_OtherRevocationInfoFormat *other;
+                } d;
+        };
+
+#define CMS_REVCHOICE_CRL               0
+#define CMS_REVCHOICE_OTHER             1
+
+struct CMS_OtherRevocationInfoFormat_st
+        {
+        ASN1_OBJECT *otherRevInfoFormat;
+        ASN1_TYPE *otherRevInfo;
+        };
+
+struct CMS_CertificateChoices
+        {
+        int type;
+                union {
+                X509 *certificate;
+                ASN1_STRING *extendedCertificate;       /* Obsolete */
+                ASN1_STRING *v1AttrCert;        /* Left encoded for now */
+                ASN1_STRING *v2AttrCert;        /* Left encoded for now */
+                CMS_OtherCertificateFormat *other;
+                } d;
+        };
+
+#define CMS_CERTCHOICE_CERT             0
+#define CMS_CERTCHOICE_EXCERT           1
+#define CMS_CERTCHOICE_V1ACERT          2
+#define CMS_CERTCHOICE_V2ACERT          3
+#define CMS_CERTCHOICE_OTHER            4
+
+struct CMS_OtherCertificateFormat_st
+        {
+        ASN1_OBJECT *otherCertFormat;
+        ASN1_TYPE *otherCert;
+        };
+
+/* This is also defined in pkcs7.h but we duplicate it
+ * to allow the CMS code to be independent of PKCS#7
+ */
+
+struct CMS_IssuerAndSerialNumber_st
+        {
+        X509_NAME *issuer;
+        ASN1_INTEGER *serialNumber;
+        };
+
+struct CMS_OtherKeyAttribute_st
+        {
+        ASN1_OBJECT *keyAttrId;
+        ASN1_TYPE *keyAttr;
+        };
+
+/* ESS structures */
+
+#ifdef HEADER_X509V3_H
+
+struct CMS_ReceiptRequest_st
+        {
+        ASN1_OCTET_STRING *signedContentIdentifier;
+        CMS_ReceiptsFrom *receiptsFrom;
+        STACK_OF(GENERAL_NAMES) *receiptsTo;
+        };
+
+
+struct CMS_ReceiptsFrom_st
+        {
+        int type;
+        union
+                {
+                long allOrFirstTier;
+                STACK_OF(GENERAL_NAMES) *receiptList;
+                } d;
+        };
+#endif
+
+struct CMS_Receipt_st
+        {
+        long version;
+        ASN1_OBJECT *contentType;
+        ASN1_OCTET_STRING *signedContentIdentifier;
+        ASN1_OCTET_STRING *originatorSignatureValue;
+        };
+
+DECLARE_ASN1_ITEM(CMS_SignerInfo)
+DECLARE_ASN1_ITEM(CMS_IssuerAndSerialNumber)
+DECLARE_ASN1_ITEM(CMS_Attributes_Sign)
+DECLARE_ASN1_ITEM(CMS_Attributes_Verify)
+DECLARE_ASN1_ALLOC_FUNCTIONS(CMS_IssuerAndSerialNumber)
+
+#define CMS_SIGNERINFO_ISSUER_SERIAL    0
+#define CMS_SIGNERINFO_KEYIDENTIFIER    1
+
+#define CMS_RECIPINFO_ISSUER_SERIAL     0
+#define CMS_RECIPINFO_KEYIDENTIFIER     1
+
+BIO *cms_content_bio(CMS_ContentInfo *cms);
+
+CMS_ContentInfo *cms_Data_create(void);
+
+CMS_ContentInfo *cms_DigestedData_create(const EVP_MD *md);
+BIO *cms_DigestedData_init_bio(CMS_ContentInfo *cms);
+int cms_DigestedData_do_final(CMS_ContentInfo *cms, BIO *chain, int verify);
+
+BIO *cms_SignedData_init_bio(CMS_ContentInfo *cms);
+int cms_SignedData_final(CMS_ContentInfo *cms, BIO *chain);
+int cms_set1_SignerIdentifier(CMS_SignerIdentifier *sid, X509 *cert, int type);
+int cms_SignerIdentifier_get0_signer_id(CMS_SignerIdentifier *sid,
+                                        ASN1_OCTET_STRING **keyid,
+                                        X509_NAME **issuer, ASN1_INTEGER **sno);
+int cms_SignerIdentifier_cert_cmp(CMS_SignerIdentifier *sid, X509 *cert);
+
+CMS_ContentInfo *cms_CompressedData_create(int comp_nid);
+BIO *cms_CompressedData_init_bio(CMS_ContentInfo *cms);
+
+void cms_DigestAlgorithm_set(X509_ALGOR *alg, const EVP_MD *md);
+BIO *cms_DigestAlgorithm_init_bio(X509_ALGOR *digestAlgorithm);
+int cms_DigestAlgorithm_find_ctx(EVP_MD_CTX *mctx, BIO *chain,
+                                        X509_ALGOR *mdalg);
+
+BIO *cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec);
+BIO *cms_EncryptedData_init_bio(CMS_ContentInfo *cms);
+int cms_EncryptedContent_init(CMS_EncryptedContentInfo *ec, 
+                                const EVP_CIPHER *cipher,
+                                const unsigned char *key, size_t keylen);
+
+int cms_Receipt_verify(CMS_ContentInfo *cms, CMS_ContentInfo *req_cms);
+int cms_msgSigDigest_add1(CMS_SignerInfo *dest, CMS_SignerInfo *src);
+ASN1_OCTET_STRING *cms_encode_Receipt(CMS_SignerInfo *si);
+
+BIO *cms_EnvelopedData_init_bio(CMS_ContentInfo *cms);
+        
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/crypto/cms/cms_lib.c b/src/lib/libssl/src/crypto/cms/cms_lib.c
new file mode 100644
index 0000000000..8e6c1d29a5
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_lib.c
@@ -0,0 +1,623 @@
+/* crypto/cms/cms_lib.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include <openssl/asn1t.h>
+#include <openssl/x509.h>
+#include <openssl/err.h>
+#include <openssl/pem.h>
+#include <openssl/bio.h>
+#include <openssl/asn1.h>
+#include "cms.h"
+#include "cms_lcl.h"
+
+IMPLEMENT_ASN1_FUNCTIONS_const(CMS_ContentInfo)
+
+DECLARE_ASN1_ITEM(CMS_CertificateChoices)
+DECLARE_ASN1_ITEM(CMS_RevocationInfoChoice)
+DECLARE_STACK_OF(CMS_CertificateChoices)
+DECLARE_STACK_OF(CMS_RevocationInfoChoice)
+
+const ASN1_OBJECT *CMS_get0_type(CMS_ContentInfo *cms)
+        {
+        return cms->contentType;
+        }
+
+CMS_ContentInfo *cms_Data_create(void)
+        {
+        CMS_ContentInfo *cms;
+        cms = CMS_ContentInfo_new();
+        if (cms)
+                {
+                cms->contentType = OBJ_nid2obj(NID_pkcs7_data);
+                /* Never detached */
+                CMS_set_detached(cms, 0);
+                }
+        return cms;
+        }
+
+BIO *cms_content_bio(CMS_ContentInfo *cms)
+        {
+        ASN1_OCTET_STRING **pos = CMS_get0_content(cms);
+        if (!pos)
+                return NULL;
+        /* If content detached data goes nowhere: create NULL BIO */
+        if (!*pos)
+                return BIO_new(BIO_s_null());
+        /* If content not detached and created return memory BIO
+         */
+        if (!*pos || ((*pos)->flags == ASN1_STRING_FLAG_CONT))
+                return BIO_new(BIO_s_mem());
+        /* Else content was read in: return read only BIO for it */
+        return BIO_new_mem_buf((*pos)->data, (*pos)->length);
+        }
+
+BIO *CMS_dataInit(CMS_ContentInfo *cms, BIO *icont)
+        {
+        BIO *cmsbio, *cont;
+        if (icont)
+                cont = icont;
+        else
+                cont = cms_content_bio(cms);
+        if (!cont)
+                {
+                CMSerr(CMS_F_CMS_DATAINIT, CMS_R_NO_CONTENT);
+                return NULL;
+                }
+        switch (OBJ_obj2nid(cms->contentType))
+                {
+
+                case NID_pkcs7_data:
+                return cont;
+
+                case NID_pkcs7_signed:
+                cmsbio = cms_SignedData_init_bio(cms);
+                break;
+
+                case NID_pkcs7_digest:
+                cmsbio = cms_DigestedData_init_bio(cms);
+                break;
+#ifdef ZLIB
+                case NID_id_smime_ct_compressedData:
+                cmsbio = cms_CompressedData_init_bio(cms);
+                break;
+#endif
+
+                case NID_pkcs7_encrypted:
+                cmsbio = cms_EncryptedData_init_bio(cms);
+                break;
+
+                case NID_pkcs7_enveloped:
+                cmsbio = cms_EnvelopedData_init_bio(cms);
+                break;
+
+                default:
+                CMSerr(CMS_F_CMS_DATAINIT, CMS_R_UNSUPPORTED_TYPE);
+                return NULL;
+                }
+
+        if (cmsbio)
+                return BIO_push(cmsbio, cont);
+
+        if (!icont)
+                BIO_free(cont);
+        return NULL;
+
+        }
+
+int CMS_dataFinal(CMS_ContentInfo *cms, BIO *cmsbio)
+        {
+        ASN1_OCTET_STRING **pos = CMS_get0_content(cms);
+        if (!pos)
+                return 0;
+        /* If ebmedded content find memory BIO and set content */
+        if (*pos && ((*pos)->flags & ASN1_STRING_FLAG_CONT))
+                {
+                BIO *mbio;
+                unsigned char *cont;
+                long contlen;
+                mbio = BIO_find_type(cmsbio, BIO_TYPE_MEM);
+                if (!mbio)
+                        {
+                        CMSerr(CMS_F_CMS_DATAFINAL, CMS_R_CONTENT_NOT_FOUND);
+                        return 0;
+                        }
+                contlen = BIO_get_mem_data(mbio, &cont);
+                /* Set bio as read only so its content can't be clobbered */
+                BIO_set_flags(mbio, BIO_FLAGS_MEM_RDONLY);
+                BIO_set_mem_eof_return(mbio, 0);
+                ASN1_STRING_set0(*pos, cont, contlen);
+                (*pos)->flags &= ~ASN1_STRING_FLAG_CONT;
+                }
+
+        switch (OBJ_obj2nid(cms->contentType))
+                {
+
+                case NID_pkcs7_data:
+                case NID_pkcs7_enveloped:
+                case NID_pkcs7_encrypted:
+                case NID_id_smime_ct_compressedData:
+                /* Nothing to do */
+                return 1;
+
+                case NID_pkcs7_signed:
+                return cms_SignedData_final(cms, cmsbio);
+
+                case NID_pkcs7_digest:
+                return cms_DigestedData_do_final(cms, cmsbio, 0);
+
+                default:
+                CMSerr(CMS_F_CMS_DATAFINAL, CMS_R_UNSUPPORTED_TYPE);
+                return 0;
+                }
+        }
+
+/* Return an OCTET STRING pointer to content. This allows it to
+ * be accessed or set later.
+ */
+
+ASN1_OCTET_STRING **CMS_get0_content(CMS_ContentInfo *cms)
+        {
+        switch (OBJ_obj2nid(cms->contentType))
+                {
+
+                case NID_pkcs7_data:
+                return &cms->d.data;
+
+                case NID_pkcs7_signed:
+                return &cms->d.signedData->encapContentInfo->eContent;
+
+                case NID_pkcs7_enveloped:
+                return &cms->d.envelopedData->encryptedContentInfo->encryptedContent;
+
+                case NID_pkcs7_digest:
+                return &cms->d.digestedData->encapContentInfo->eContent;
+
+                case NID_pkcs7_encrypted:
+                return &cms->d.encryptedData->encryptedContentInfo->encryptedContent;
+
+                case NID_id_smime_ct_authData:
+                return &cms->d.authenticatedData->encapContentInfo->eContent;
+
+                case NID_id_smime_ct_compressedData:
+                return &cms->d.compressedData->encapContentInfo->eContent;
+
+                default:
+                if (cms->d.other->type == V_ASN1_OCTET_STRING)
+                        return &cms->d.other->value.octet_string;
+                CMSerr(CMS_F_CMS_GET0_CONTENT, CMS_R_UNSUPPORTED_CONTENT_TYPE);
+                return NULL;
+
+                }
+        }
+
+/* Return an ASN1_OBJECT pointer to content type. This allows it to
+ * be accessed or set later.
+ */
+
+static ASN1_OBJECT **cms_get0_econtent_type(CMS_ContentInfo *cms)
+        {
+        switch (OBJ_obj2nid(cms->contentType))
+                {
+
+                case NID_pkcs7_signed:
+                return &cms->d.signedData->encapContentInfo->eContentType;
+
+                case NID_pkcs7_enveloped:
+                return &cms->d.envelopedData->encryptedContentInfo->contentType;
+
+                case NID_pkcs7_digest:
+                return &cms->d.digestedData->encapContentInfo->eContentType;
+
+                case NID_pkcs7_encrypted:
+                return &cms->d.encryptedData->encryptedContentInfo->contentType;
+
+                case NID_id_smime_ct_authData:
+                return &cms->d.authenticatedData->encapContentInfo->eContentType;
+
+                case NID_id_smime_ct_compressedData:
+                return &cms->d.compressedData->encapContentInfo->eContentType;
+
+                default:
+                CMSerr(CMS_F_CMS_GET0_ECONTENT_TYPE,
+                                        CMS_R_UNSUPPORTED_CONTENT_TYPE);
+                return NULL;
+
+                }
+        }
+
+const ASN1_OBJECT *CMS_get0_eContentType(CMS_ContentInfo *cms)
+        {
+        ASN1_OBJECT **petype;
+        petype = cms_get0_econtent_type(cms);
+        if (petype)
+                return *petype;
+        return NULL;
+        }
+
+int CMS_set1_eContentType(CMS_ContentInfo *cms, const ASN1_OBJECT *oid)
+        {
+        ASN1_OBJECT **petype, *etype;
+        petype = cms_get0_econtent_type(cms);
+        if (!petype)
+                return 0;
+        if (!oid)
+                return 1;
+        etype = OBJ_dup(oid);
+        if (!etype)
+                return 0;
+        ASN1_OBJECT_free(*petype);
+        *petype = etype;
+        return 1;
+        }
+
+int CMS_is_detached(CMS_ContentInfo *cms)
+        {
+        ASN1_OCTET_STRING **pos;
+        pos = CMS_get0_content(cms);
+        if (!pos)
+                return -1;
+        if (*pos)
+                return 0;
+        return 1;
+        }
+
+int CMS_set_detached(CMS_ContentInfo *cms, int detached)
+        {
+        ASN1_OCTET_STRING **pos;
+        pos = CMS_get0_content(cms);
+        if (!pos)
+                return 0;
+        if (detached)
+                {
+                if (*pos)
+                        {
+                        ASN1_OCTET_STRING_free(*pos);
+                        *pos = NULL;
+                        }
+                return 1;
+                }
+        if (!*pos)
+                *pos = ASN1_OCTET_STRING_new();
+        if (*pos)
+                {
+                /* NB: special flag to show content is created and not
+                 * read in.
+                 */
+                (*pos)->flags |= ASN1_STRING_FLAG_CONT;
+                return 1;
+                }
+        CMSerr(CMS_F_CMS_SET_DETACHED, ERR_R_MALLOC_FAILURE);
+        return 0;
+        }
+
+/* Set up an X509_ALGOR DigestAlgorithmIdentifier from an EVP_MD */
+
+void cms_DigestAlgorithm_set(X509_ALGOR *alg, const EVP_MD *md)
+        {
+        int param_type;
+
+        switch (EVP_MD_type(md))
+                {
+                case NID_sha1:
+                case NID_sha224:
+                case NID_sha256:
+                case NID_sha384:
+                case NID_sha512:
+                param_type = V_ASN1_UNDEF;
+                break;
+        
+                default:
+                param_type = V_ASN1_NULL;
+                break;
+                }
+
+        X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_MD_type(md)), param_type, NULL);
+
+        }
+
+/* Create a digest BIO from an X509_ALGOR structure */
+
+BIO *cms_DigestAlgorithm_init_bio(X509_ALGOR *digestAlgorithm)
+        {
+        BIO *mdbio = NULL;
+        ASN1_OBJECT *digestoid;
+        const EVP_MD *digest;
+        X509_ALGOR_get0(&digestoid, NULL, NULL, digestAlgorithm);
+        digest = EVP_get_digestbyobj(digestoid);
+        if (!digest)
+                {
+                CMSerr(CMS_F_CMS_DIGESTALGORITHM_INIT_BIO,
+                                CMS_R_UNKNOWN_DIGEST_ALGORIHM);
+                goto err;       
+                }
+        mdbio = BIO_new(BIO_f_md());
+        if (!mdbio || !BIO_set_md(mdbio, digest))
+                {
+                CMSerr(CMS_F_CMS_DIGESTALGORITHM_INIT_BIO,
+                                CMS_R_MD_BIO_INIT_ERROR);
+                goto err;       
+                }
+        return mdbio;
+        err:
+        if (mdbio)
+                BIO_free(mdbio);
+        return NULL;
+        }
+
+/* Locate a message digest content from a BIO chain based on SignerInfo */
+
+int cms_DigestAlgorithm_find_ctx(EVP_MD_CTX *mctx, BIO *chain,
+                                        X509_ALGOR *mdalg)
+        {
+        int nid;
+        ASN1_OBJECT *mdoid;
+        X509_ALGOR_get0(&mdoid, NULL, NULL, mdalg);
+        nid = OBJ_obj2nid(mdoid);
+        /* Look for digest type to match signature */
+        for (;;)
+                {
+                EVP_MD_CTX *mtmp;
+                chain = BIO_find_type(chain, BIO_TYPE_MD);
+                if (chain == NULL)
+                        {
+                        CMSerr(CMS_F_CMS_DIGESTALGORITHM_FIND_CTX,
+                                                CMS_R_NO_MATCHING_DIGEST);
+                        return 0;
+                        }
+                BIO_get_md_ctx(chain, &mtmp);
+                if (EVP_MD_CTX_type(mtmp) == nid)
+                        {
+                        EVP_MD_CTX_copy_ex(mctx, mtmp);
+                        return 1;
+                        }
+                chain = BIO_next(chain);
+                }
+        }
+
+static STACK_OF(CMS_CertificateChoices) **cms_get0_certificate_choices(CMS_ContentInfo *cms)
+        {
+        switch (OBJ_obj2nid(cms->contentType))
+                {
+
+                case NID_pkcs7_signed:
+                return &cms->d.signedData->certificates;
+
+                case NID_pkcs7_enveloped:
+                return &cms->d.envelopedData->originatorInfo->certificates;
+
+                default:
+                CMSerr(CMS_F_CMS_GET0_CERTIFICATE_CHOICES,
+                                        CMS_R_UNSUPPORTED_CONTENT_TYPE);
+                return NULL;
+
+                }
+        }
+
+CMS_CertificateChoices *CMS_add0_CertificateChoices(CMS_ContentInfo *cms)
+        {
+        STACK_OF(CMS_CertificateChoices) **pcerts;
+        CMS_CertificateChoices *cch;
+        pcerts = cms_get0_certificate_choices(cms);
+        if (!pcerts)
+                return NULL;
+        if (!*pcerts)
+                *pcerts = sk_CMS_CertificateChoices_new_null();
+        if (!*pcerts)
+                return NULL;
+        cch = M_ASN1_new_of(CMS_CertificateChoices);
+        if (!cch)
+                return NULL;
+        if (!sk_CMS_CertificateChoices_push(*pcerts, cch))
+                {
+                M_ASN1_free_of(cch, CMS_CertificateChoices);
+                return NULL;
+                }
+        return cch;
+        }
+
+int CMS_add0_cert(CMS_ContentInfo *cms, X509 *cert)
+        {
+        CMS_CertificateChoices *cch;
+        STACK_OF(CMS_CertificateChoices) **pcerts;
+        int i;
+        pcerts = cms_get0_certificate_choices(cms);
+        if (!pcerts)
+                return 0;
+        if (!pcerts)
+                return 0;
+        for (i = 0; i < sk_CMS_CertificateChoices_num(*pcerts); i++)
+                {
+                cch = sk_CMS_CertificateChoices_value(*pcerts, i);
+                if (cch->type == CMS_CERTCHOICE_CERT)
+                        {
+                        if (!X509_cmp(cch->d.certificate, cert))
+                                {
+                                CMSerr(CMS_F_CMS_ADD0_CERT, 
+                                        CMS_R_CERTIFICATE_ALREADY_PRESENT);
+                                return 0;
+                                }
+                        }
+                }
+        cch = CMS_add0_CertificateChoices(cms);
+        if (!cch)
+                return 0;
+        cch->type = CMS_CERTCHOICE_CERT;
+        cch->d.certificate = cert;
+        return 1;
+        }
+
+int CMS_add1_cert(CMS_ContentInfo *cms, X509 *cert)
+        {
+        int r;
+        r = CMS_add0_cert(cms, cert);
+        if (r > 0)
+                CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509);
+        return r;
+        }
+
+static STACK_OF(CMS_RevocationInfoChoice) **cms_get0_revocation_choices(CMS_ContentInfo *cms)
+        {
+        switch (OBJ_obj2nid(cms->contentType))
+                {
+
+                case NID_pkcs7_signed:
+                return &cms->d.signedData->crls;
+
+                case NID_pkcs7_enveloped:
+                return &cms->d.envelopedData->originatorInfo->crls;
+
+                default:
+                CMSerr(CMS_F_CMS_GET0_REVOCATION_CHOICES,
+                                        CMS_R_UNSUPPORTED_CONTENT_TYPE);
+                return NULL;
+
+                }
+        }
+
+CMS_RevocationInfoChoice *CMS_add0_RevocationInfoChoice(CMS_ContentInfo *cms)
+        {
+        STACK_OF(CMS_RevocationInfoChoice) **pcrls;
+        CMS_RevocationInfoChoice *rch;
+        pcrls = cms_get0_revocation_choices(cms);
+        if (!pcrls)
+                return NULL;
+        if (!*pcrls)
+                *pcrls = sk_CMS_RevocationInfoChoice_new_null();
+        if (!*pcrls)
+                return NULL;
+        rch = M_ASN1_new_of(CMS_RevocationInfoChoice);
+        if (!rch)
+                return NULL;
+        if (!sk_CMS_RevocationInfoChoice_push(*pcrls, rch))
+                {
+                M_ASN1_free_of(rch, CMS_RevocationInfoChoice);
+                return NULL;
+                }
+        return rch;
+        }
+
+int CMS_add0_crl(CMS_ContentInfo *cms, X509_CRL *crl)
+        {
+        CMS_RevocationInfoChoice *rch;
+        rch = CMS_add0_RevocationInfoChoice(cms);
+        if (!rch)
+                return 0;
+        rch->type = CMS_REVCHOICE_CRL;
+        rch->d.crl = crl;
+        return 1;
+        }
+
+STACK_OF(X509) *CMS_get1_certs(CMS_ContentInfo *cms)
+        {
+        STACK_OF(X509) *certs = NULL;
+        CMS_CertificateChoices *cch;
+        STACK_OF(CMS_CertificateChoices) **pcerts;
+        int i;
+        pcerts = cms_get0_certificate_choices(cms);
+        if (!pcerts)
+                return NULL;
+        for (i = 0; i < sk_CMS_CertificateChoices_num(*pcerts); i++)
+                {
+                cch = sk_CMS_CertificateChoices_value(*pcerts, i);
+                if (cch->type == 0)
+                        {
+                        if (!certs)
+                                {
+                                certs = sk_X509_new_null();
+                                if (!certs)
+                                        return NULL;
+                                }
+                        if (!sk_X509_push(certs, cch->d.certificate))
+                                {
+                                sk_X509_pop_free(certs, X509_free);
+                                return NULL;
+                                }
+                        CRYPTO_add(&cch->d.certificate->references,
+                                                1, CRYPTO_LOCK_X509);
+                        }
+                }
+        return certs;
+
+        }
+
+STACK_OF(X509_CRL) *CMS_get1_crls(CMS_ContentInfo *cms)
+        {
+        STACK_OF(X509_CRL) *crls = NULL;
+        STACK_OF(CMS_RevocationInfoChoice) **pcrls;
+        CMS_RevocationInfoChoice *rch;
+        int i;
+        pcrls = cms_get0_revocation_choices(cms);
+        if (!pcrls)
+                return NULL;
+        for (i = 0; i < sk_CMS_RevocationInfoChoice_num(*pcrls); i++)
+                {
+                rch = sk_CMS_RevocationInfoChoice_value(*pcrls, i);
+                if (rch->type == 0)
+                        {
+                        if (!crls)
+                                {
+                                crls = sk_X509_CRL_new_null();
+                                if (!crls)
+                                        return NULL;
+                                }
+                        if (!sk_X509_CRL_push(crls, rch->d.crl))
+                                {
+                                sk_X509_CRL_pop_free(crls, X509_CRL_free);
+                                return NULL;
+                                }
+                        CRYPTO_add(&rch->d.crl->references,
+                                                1, CRYPTO_LOCK_X509_CRL);
+                        }
+                }
+        return crls;
+        }
diff --git a/src/lib/libssl/src/crypto/cms/cms_sd.c b/src/lib/libssl/src/crypto/cms/cms_sd.c
new file mode 100644
index 0000000000..591bfbec33
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_sd.c
@@ -0,0 +1,1014 @@
+/* crypto/cms/cms_sd.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include "cryptlib.h"
+#include <openssl/asn1t.h>
+#include <openssl/pem.h>
+#include <openssl/x509v3.h>
+#include <openssl/err.h>
+#include <openssl/cms.h>
+#include "cms_lcl.h"
+
+/* CMS SignedData Utilities */
+
+DECLARE_ASN1_ITEM(CMS_SignedData)
+
+static CMS_SignedData *cms_get0_signed(CMS_ContentInfo *cms)
+        {
+        if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_signed)
+                {
+                CMSerr(CMS_F_CMS_GET0_SIGNED, CMS_R_CONTENT_TYPE_NOT_SIGNED_DATA);
+                return NULL;
+                }
+        return cms->d.signedData;
+        }
+
+static CMS_SignedData *cms_signed_data_init(CMS_ContentInfo *cms)
+        {
+        if (cms->d.other == NULL)
+                {
+                cms->d.signedData = M_ASN1_new_of(CMS_SignedData);
+                if (!cms->d.signedData)
+                        {
+                        CMSerr(CMS_F_CMS_SIGNED_DATA_INIT, ERR_R_MALLOC_FAILURE);
+                        return NULL;
+                        }
+                cms->d.signedData->version = 1;
+                cms->d.signedData->encapContentInfo->eContentType =
+                                                OBJ_nid2obj(NID_pkcs7_data);
+                cms->d.signedData->encapContentInfo->partial = 1;
+                ASN1_OBJECT_free(cms->contentType);
+                cms->contentType = OBJ_nid2obj(NID_pkcs7_signed);
+                return cms->d.signedData;
+                }
+        return cms_get0_signed(cms);
+        }
+
+/* Just initialize SignedData e.g. for certs only structure */
+
+int CMS_SignedData_init(CMS_ContentInfo *cms)
+        {
+        if (cms_signed_data_init(cms))
+                return 1;
+        else
+                return 0;
+        }
+
+/* Check structures and fixup version numbers (if necessary) */
+
+static void cms_sd_set_version(CMS_SignedData *sd)
+        {
+        int i;
+        CMS_CertificateChoices *cch;
+        CMS_RevocationInfoChoice *rch;
+        CMS_SignerInfo *si;
+
+        for (i = 0; i < sk_CMS_CertificateChoices_num(sd->certificates); i++)
+                {
+                cch = sk_CMS_CertificateChoices_value(sd->certificates, i);
+                if (cch->type == CMS_CERTCHOICE_OTHER)
+                        {
+                        if (sd->version < 5)
+                                sd->version = 5;
+                        }
+                else if (cch->type == CMS_CERTCHOICE_V2ACERT)
+                        {
+                        if (sd->version < 4)
+                                sd->version = 4;
+                        }
+                else if (cch->type == CMS_CERTCHOICE_V1ACERT)
+                        {
+                        if (sd->version < 3)
+                                sd->version = 3;
+                        }
+                }
+
+        for (i = 0; i < sk_CMS_RevocationInfoChoice_num(sd->crls); i++)
+                {
+                rch = sk_CMS_RevocationInfoChoice_value(sd->crls, i);
+                if (rch->type == CMS_REVCHOICE_OTHER)
+                        {
+                        if (sd->version < 5)
+                                sd->version = 5;
+                        }
+                }
+
+        if ((OBJ_obj2nid(sd->encapContentInfo->eContentType) != NID_pkcs7_data)
+                        && (sd->version < 3))
+                sd->version = 3;
+
+        for (i = 0; i < sk_CMS_SignerInfo_num(sd->signerInfos); i++)
+                {
+                si = sk_CMS_SignerInfo_value(sd->signerInfos, i);
+                if (si->sid->type == CMS_SIGNERINFO_KEYIDENTIFIER)
+                        {
+                        if (si->version < 3)
+                                si->version = 3;
+                        if (sd->version < 3)
+                                sd->version = 3;
+                        }
+                else
+                        sd->version = 1;
+                }
+
+        if (sd->version < 1)
+                sd->version = 1;
+
+        }
+        
+/* Copy an existing messageDigest value */
+
+static int cms_copy_messageDigest(CMS_ContentInfo *cms, CMS_SignerInfo *si)
+        {
+        STACK_OF(CMS_SignerInfo) *sinfos;
+        CMS_SignerInfo *sitmp;
+        int i;
+        sinfos = CMS_get0_SignerInfos(cms);
+        for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
+                {
+                ASN1_OCTET_STRING *messageDigest;
+                sitmp = sk_CMS_SignerInfo_value(sinfos, i);
+                if (sitmp == si)
+                        continue;
+                if (CMS_signed_get_attr_count(sitmp) < 0)
+                        continue;
+                if (OBJ_cmp(si->digestAlgorithm->algorithm,
+                                sitmp->digestAlgorithm->algorithm))
+                        continue;
+                messageDigest = CMS_signed_get0_data_by_OBJ(sitmp,
+                                        OBJ_nid2obj(NID_pkcs9_messageDigest),
+                                        -3, V_ASN1_OCTET_STRING);
+                if (!messageDigest)
+                        {
+                        CMSerr(CMS_F_CMS_COPY_MESSAGEDIGEST,
+                                CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE);
+                        return 0;
+                        }
+
+                if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_messageDigest,
+                                                V_ASN1_OCTET_STRING,
+                                                messageDigest, -1))
+                        return 1;
+                else
+                        return 0;
+                }
+                CMSerr(CMS_F_CMS_COPY_MESSAGEDIGEST, CMS_R_NO_MATCHING_DIGEST);
+                return 0;
+        }
+
+int cms_set1_SignerIdentifier(CMS_SignerIdentifier *sid, X509 *cert, int type)
+        {
+        switch(type)
+                {
+                case CMS_SIGNERINFO_ISSUER_SERIAL:
+                sid->d.issuerAndSerialNumber =
+                        M_ASN1_new_of(CMS_IssuerAndSerialNumber);
+                if (!sid->d.issuerAndSerialNumber)
+                        goto merr;
+                if (!X509_NAME_set(&sid->d.issuerAndSerialNumber->issuer,
+                                        X509_get_issuer_name(cert)))
+                        goto merr;
+                ASN1_STRING_free(sid->d.issuerAndSerialNumber->serialNumber);
+                sid->d.issuerAndSerialNumber->serialNumber =
+                                ASN1_STRING_dup(X509_get_serialNumber(cert));
+                if(!sid->d.issuerAndSerialNumber->serialNumber)
+                        goto merr;
+                break;
+
+                case CMS_SIGNERINFO_KEYIDENTIFIER:
+                if (!cert->skid)
+                        {
+                        CMSerr(CMS_F_CMS_SET1_SIGNERIDENTIFIER,
+                                        CMS_R_CERTIFICATE_HAS_NO_KEYID);
+                        return 0;
+                        }
+                sid->d.subjectKeyIdentifier = ASN1_STRING_dup(cert->skid);
+                if (!sid->d.subjectKeyIdentifier)
+                        goto merr;
+                break;
+
+                default:
+                CMSerr(CMS_F_CMS_SET1_SIGNERIDENTIFIER, CMS_R_UNKNOWN_ID);
+                return 0;
+                }
+
+        sid->type = type;
+
+        return 1;
+
+        merr:
+        CMSerr(CMS_F_CMS_SET1_SIGNERIDENTIFIER, ERR_R_MALLOC_FAILURE);
+        return 0;
+
+        }
+
+int cms_SignerIdentifier_get0_signer_id(CMS_SignerIdentifier *sid,
+                                        ASN1_OCTET_STRING **keyid,
+                                        X509_NAME **issuer, ASN1_INTEGER **sno)
+        {
+        if (sid->type == CMS_SIGNERINFO_ISSUER_SERIAL)
+                {
+                if (issuer)
+                        *issuer = sid->d.issuerAndSerialNumber->issuer;
+                if (sno)
+                        *sno = sid->d.issuerAndSerialNumber->serialNumber;
+                }
+        else if (sid->type == CMS_SIGNERINFO_KEYIDENTIFIER)
+                {
+                if (keyid)
+                        *keyid = sid->d.subjectKeyIdentifier;
+                }
+        else
+                return 0;
+        return 1;
+        }
+
+int cms_SignerIdentifier_cert_cmp(CMS_SignerIdentifier *sid, X509 *cert)
+        {
+        int ret;
+        if (sid->type == CMS_SIGNERINFO_ISSUER_SERIAL)
+                {
+                ret = X509_NAME_cmp(sid->d.issuerAndSerialNumber->issuer,
+                                        X509_get_issuer_name(cert));
+                if (ret)
+                        return ret;
+                return ASN1_INTEGER_cmp(sid->d.issuerAndSerialNumber->serialNumber,
+                                        X509_get_serialNumber(cert));
+                }
+        else if (sid->type == CMS_SIGNERINFO_KEYIDENTIFIER)
+                {
+                X509_check_purpose(cert, -1, -1);
+                if (!cert->skid)
+                        return -1;
+                return ASN1_OCTET_STRING_cmp(sid->d.subjectKeyIdentifier,
+                                                        cert->skid);
+                }
+        else
+                return -1;
+        }
+
+CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
+                        X509 *signer, EVP_PKEY *pk, const EVP_MD *md,
+                        unsigned int flags)
+        {
+        CMS_SignedData *sd;
+        CMS_SignerInfo *si = NULL;
+        X509_ALGOR *alg;
+        int i, type;
+        if(!X509_check_private_key(signer, pk))
+                {
+                CMSerr(CMS_F_CMS_ADD1_SIGNER,
+                        CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
+                return NULL;
+                }
+        sd = cms_signed_data_init(cms);
+        if (!sd)
+                goto err;
+        si = M_ASN1_new_of(CMS_SignerInfo);
+        if (!si)
+                goto merr;
+        X509_check_purpose(signer, -1, -1);
+
+        CRYPTO_add(&pk->references, 1, CRYPTO_LOCK_EVP_PKEY);
+        CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509);
+
+        si->pkey = pk;
+        si->signer = signer;
+
+        if (flags & CMS_USE_KEYID)
+                {
+                si->version = 3;
+                if (sd->version < 3)
+                        sd->version = 3;
+                type = CMS_SIGNERINFO_KEYIDENTIFIER;
+                }
+        else
+                {
+                type = CMS_SIGNERINFO_ISSUER_SERIAL;
+                si->version = 1;
+                }
+
+        if (!cms_set1_SignerIdentifier(si->sid, signer, type))
+                goto err;
+
+        /* Since no EVP_PKEY_METHOD in 0.9.8 hard code SHA1 as default */
+        if (md == NULL)
+                md = EVP_sha1();
+
+        /* OpenSSL 0.9.8 only supports SHA1 with non-RSA keys */
+
+        if ((pk->type != EVP_PKEY_RSA) && (EVP_MD_type(md) != NID_sha1))
+                {
+                CMSerr(CMS_F_CMS_ADD1_SIGNER,
+                                CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
+                goto err;
+                }
+
+        cms_DigestAlgorithm_set(si->digestAlgorithm, md);
+
+        /* See if digest is present in digestAlgorithms */
+        for (i = 0; i < sk_X509_ALGOR_num(sd->digestAlgorithms); i++)
+                {
+                ASN1_OBJECT *aoid;
+                alg = sk_X509_ALGOR_value(sd->digestAlgorithms, i);
+                X509_ALGOR_get0(&aoid, NULL, NULL, alg);
+                if (OBJ_obj2nid(aoid) == EVP_MD_type(md))
+                        break;
+                }
+
+        if (i == sk_X509_ALGOR_num(sd->digestAlgorithms))
+                {
+                alg = X509_ALGOR_new();
+                if (!alg)
+                        goto merr;
+                cms_DigestAlgorithm_set(alg, md);
+                if (!sk_X509_ALGOR_push(sd->digestAlgorithms, alg))
+                        {
+                        X509_ALGOR_free(alg);
+                        goto merr;
+                        }
+                }
+
+        /* Since we have no EVP_PKEY_ASN1_METHOD in OpenSSL 0.9.8,
+         * hard code algorithm parameters.
+         */
+
+        switch (pk->type)
+                {
+
+                case EVP_PKEY_RSA:
+                X509_ALGOR_set0(si->signatureAlgorithm,
+                                        OBJ_nid2obj(NID_rsaEncryption),
+                                        V_ASN1_NULL, 0);
+                break;
+
+                case EVP_PKEY_DSA:
+                X509_ALGOR_set0(si->signatureAlgorithm,
+                                        OBJ_nid2obj(NID_dsaWithSHA1),
+                                        V_ASN1_UNDEF, 0);
+                break;
+
+
+                case EVP_PKEY_EC:
+                X509_ALGOR_set0(si->signatureAlgorithm,
+                                        OBJ_nid2obj(NID_ecdsa_with_SHA1),
+                                        V_ASN1_UNDEF, 0);
+                break;
+
+                default:
+                CMSerr(CMS_F_CMS_ADD1_SIGNER,
+                                CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
+                goto err;
+
+                }
+
+        if (!(flags & CMS_NOATTR))
+                {
+                /* Initialialize signed attributes strutucture so other
+                 * attributes such as signing time etc are added later
+                 * even if we add none here.
+                 */
+                if (!si->signedAttrs)
+                        {
+                        si->signedAttrs = sk_X509_ATTRIBUTE_new_null();
+                        if (!si->signedAttrs)
+                                goto merr;
+                        }
+
+                if (!(flags & CMS_NOSMIMECAP))
+                        {
+                        STACK_OF(X509_ALGOR) *smcap = NULL;
+                        i = CMS_add_standard_smimecap(&smcap);
+                        if (i)
+                                i = CMS_add_smimecap(si, smcap);
+                        sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
+                        if (!i)
+                                goto merr;
+                        }
+                if (flags & CMS_REUSE_DIGEST)
+                        {
+                        if (!cms_copy_messageDigest(cms, si))
+                                goto err;
+                        if (!(flags & CMS_PARTIAL) &&
+                                        !CMS_SignerInfo_sign(si))
+                                goto err;
+                        }
+                }
+
+        if (!(flags & CMS_NOCERTS))
+                {
+                /* NB ignore -1 return for duplicate cert */
+                if (!CMS_add1_cert(cms, signer))
+                        goto merr;
+                }
+
+        if (!sd->signerInfos)
+                sd->signerInfos = sk_CMS_SignerInfo_new_null();
+        if (!sd->signerInfos ||
+                !sk_CMS_SignerInfo_push(sd->signerInfos, si))
+                goto merr;
+
+        return si;
+
+        merr:
+        CMSerr(CMS_F_CMS_ADD1_SIGNER, ERR_R_MALLOC_FAILURE);
+        err:
+        if (si)
+                M_ASN1_free_of(si, CMS_SignerInfo);
+        return NULL;
+
+        }
+
+static int cms_add1_signingTime(CMS_SignerInfo *si, ASN1_TIME *t)
+        {
+        ASN1_TIME *tt;
+        int r = 0;
+        if (t)
+                tt = t;
+        else
+                tt = X509_gmtime_adj(NULL, 0);
+
+        if (!tt)
+                goto merr;
+
+        if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_signingTime,
+                                                tt->type, tt, -1) <= 0)
+                goto merr;
+
+        r = 1;
+
+        merr:
+
+        if (!t)
+                ASN1_TIME_free(tt);
+
+        if (!r)
+                CMSerr(CMS_F_CMS_ADD1_SIGNINGTIME, ERR_R_MALLOC_FAILURE);
+
+        return r;
+
+        }
+
+STACK_OF(CMS_SignerInfo) *CMS_get0_SignerInfos(CMS_ContentInfo *cms)
+        {
+        CMS_SignedData *sd;
+        sd = cms_get0_signed(cms);
+        if (!sd)
+                return NULL;
+        return sd->signerInfos;
+        }
+
+STACK_OF(X509) *CMS_get0_signers(CMS_ContentInfo *cms)
+        {
+        STACK_OF(X509) *signers = NULL;
+        STACK_OF(CMS_SignerInfo) *sinfos;
+        CMS_SignerInfo *si;
+        int i;
+        sinfos = CMS_get0_SignerInfos(cms);
+        for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
+                {
+                si = sk_CMS_SignerInfo_value(sinfos, i);
+                if (si->signer)
+                        {
+                        if (!signers)
+                                {
+                                signers = sk_X509_new_null();
+                                if (!signers)
+                                        return NULL;
+                                }
+                        if (!sk_X509_push(signers, si->signer))
+                                {
+                                sk_X509_free(signers);
+                                return NULL;
+                                }
+                        }
+                }
+        return signers;
+        }
+
+void CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer)
+        {
+        if (signer)
+                {
+                CRYPTO_add(&signer->references, 1, CRYPTO_LOCK_X509);
+                if (si->pkey)
+                        EVP_PKEY_free(si->pkey);
+                si->pkey = X509_get_pubkey(signer);
+                }
+        if (si->signer)
+                X509_free(si->signer);
+        si->signer = signer;
+        }
+
+int CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si,
+                                        ASN1_OCTET_STRING **keyid,
+                                        X509_NAME **issuer, ASN1_INTEGER **sno)
+        {
+        return cms_SignerIdentifier_get0_signer_id(si->sid, keyid, issuer, sno);
+        }
+
+int CMS_SignerInfo_cert_cmp(CMS_SignerInfo *si, X509 *cert)
+        {
+        return cms_SignerIdentifier_cert_cmp(si->sid, cert);
+        }
+
+int CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *scerts,
+                                unsigned int flags)
+        {
+        CMS_SignedData *sd;
+        CMS_SignerInfo *si;
+        CMS_CertificateChoices *cch;
+        STACK_OF(CMS_CertificateChoices) *certs;
+        X509 *x;
+        int i, j;
+        int ret = 0;
+        sd = cms_get0_signed(cms);
+        if (!sd)
+                return -1;
+        certs = sd->certificates;
+        for (i = 0; i < sk_CMS_SignerInfo_num(sd->signerInfos); i++)
+                {
+                si = sk_CMS_SignerInfo_value(sd->signerInfos, i);
+                if (si->signer)
+                        continue;
+
+                for (j = 0; j < sk_X509_num(scerts); j++)
+                        {
+                        x = sk_X509_value(scerts, j);
+                        if (CMS_SignerInfo_cert_cmp(si, x) == 0)
+                                {
+                                CMS_SignerInfo_set1_signer_cert(si, x);
+                                ret++;
+                                break;
+                                }
+                        }
+
+                if (si->signer || (flags & CMS_NOINTERN))
+                        continue;
+
+                for (j = 0; j < sk_CMS_CertificateChoices_num(certs); j++)
+                        {
+                        cch = sk_CMS_CertificateChoices_value(certs, j);
+                        if (cch->type != 0)
+                                continue;
+                        x = cch->d.certificate;
+                        if (CMS_SignerInfo_cert_cmp(si, x) == 0)
+                                {
+                                CMS_SignerInfo_set1_signer_cert(si, x);
+                                ret++;
+                                break;
+                                }
+                        }
+                }
+        return ret;
+        }
+
+void CMS_SignerInfo_get0_algs(CMS_SignerInfo *si, EVP_PKEY **pk, X509 **signer,
+                                        X509_ALGOR **pdig, X509_ALGOR **psig)
+        {
+        if (pk)
+                *pk = si->pkey;
+        if (signer)
+                *signer = si->signer;
+        if (pdig)
+                *pdig = si->digestAlgorithm;
+        if (psig)
+                *psig = si->signatureAlgorithm;
+        }
+
+/* In OpenSSL 0.9.8 we have the link between digest types and public
+ * key types so we need to fixup the digest type if the public key
+ * type is not appropriate.
+ */
+
+static void cms_fixup_mctx(EVP_MD_CTX *mctx, EVP_PKEY *pkey)
+        {
+        if (EVP_MD_CTX_type(mctx) != NID_sha1)
+                return;
+#ifndef OPENSSL_NO_DSA
+        if (pkey->type == EVP_PKEY_DSA)
+                mctx->digest = EVP_dss1();      
+#endif
+#ifndef OPENSSL_NO_ECDSA
+        if (pkey->type == EVP_PKEY_EC)
+                mctx->digest = EVP_ecdsa();     
+#endif
+        }
+
+static int cms_SignerInfo_content_sign(CMS_ContentInfo *cms,
+                                        CMS_SignerInfo *si, BIO *chain)
+        {
+        EVP_MD_CTX mctx;
+        int r = 0;
+        EVP_MD_CTX_init(&mctx);
+
+
+        if (!si->pkey)
+                {
+                CMSerr(CMS_F_CMS_SIGNERINFO_CONTENT_SIGN, CMS_R_NO_PRIVATE_KEY);
+                return 0;
+                }
+
+        if (!cms_DigestAlgorithm_find_ctx(&mctx, chain, si->digestAlgorithm))
+                goto err;
+
+        /* If any signed attributes calculate and add messageDigest attribute */
+
+        if (CMS_signed_get_attr_count(si) >= 0)
+                {
+                ASN1_OBJECT *ctype =
+                        cms->d.signedData->encapContentInfo->eContentType; 
+                unsigned char md[EVP_MAX_MD_SIZE];
+                unsigned int mdlen;
+                EVP_DigestFinal_ex(&mctx, md, &mdlen);
+                if (!CMS_signed_add1_attr_by_NID(si, NID_pkcs9_messageDigest,
+                                                V_ASN1_OCTET_STRING,
+                                                md, mdlen))
+                        goto err;
+                /* Copy content type across */
+                if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_contentType,
+                                        V_ASN1_OBJECT, ctype, -1) <= 0)
+                        goto err;
+                if (!CMS_SignerInfo_sign(si))
+                        goto err;
+                }
+        else
+                {
+                unsigned char *sig;
+                unsigned int siglen;
+                sig = OPENSSL_malloc(EVP_PKEY_size(si->pkey));
+                if (!sig)
+                        {
+                        CMSerr(CMS_F_CMS_SIGNERINFO_CONTENT_SIGN,
+                                        ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                cms_fixup_mctx(&mctx, si->pkey);
+                if (!EVP_SignFinal(&mctx, sig, &siglen, si->pkey))
+                        {
+                        CMSerr(CMS_F_CMS_SIGNERINFO_CONTENT_SIGN,
+                                        CMS_R_SIGNFINAL_ERROR);
+                        OPENSSL_free(sig);
+                        goto err;
+                        }
+                ASN1_STRING_set0(si->signature, sig, siglen);
+                }
+
+        r = 1;
+
+        err:
+        EVP_MD_CTX_cleanup(&mctx);
+        return r;
+
+        }
+
+int cms_SignedData_final(CMS_ContentInfo *cms, BIO *chain)
+        {
+        STACK_OF(CMS_SignerInfo) *sinfos;
+        CMS_SignerInfo *si;
+        int i;
+        sinfos = CMS_get0_SignerInfos(cms);
+        for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
+                {
+                si = sk_CMS_SignerInfo_value(sinfos, i);
+                if (!cms_SignerInfo_content_sign(cms, si, chain))
+                        return 0;
+                }
+        cms->d.signedData->encapContentInfo->partial = 0;
+        return 1;
+        }
+
+int CMS_SignerInfo_sign(CMS_SignerInfo *si)
+        {
+        EVP_MD_CTX mctx;
+        unsigned char *abuf = NULL;
+        int alen;
+        unsigned int siglen;
+        const EVP_MD *md = NULL;
+
+        md = EVP_get_digestbyobj(si->digestAlgorithm->algorithm);
+        if (md == NULL)
+                return 0;
+
+        EVP_MD_CTX_init(&mctx);
+
+        if (CMS_signed_get_attr_by_NID(si, NID_pkcs9_signingTime, -1) < 0)
+                {
+                if (!cms_add1_signingTime(si, NULL))
+                        goto err;
+                }
+
+        if (EVP_SignInit_ex(&mctx, md, NULL) <= 0)
+                goto err;
+
+#if 0
+        if (EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_SIGN,
+                                EVP_PKEY_CTRL_CMS_SIGN, 0, si) <= 0)
+                {
+                CMSerr(CMS_F_CMS_SIGNERINFO_SIGN, CMS_R_CTRL_ERROR);
+                goto err;
+                }
+#endif
+
+        alen = ASN1_item_i2d((ASN1_VALUE *)si->signedAttrs,&abuf,
+                                ASN1_ITEM_rptr(CMS_Attributes_Sign));
+        if(!abuf)
+                goto err;
+        if (EVP_SignUpdate(&mctx, abuf, alen) <= 0)
+                goto err;
+        siglen = EVP_PKEY_size(si->pkey);
+        OPENSSL_free(abuf);
+        abuf = OPENSSL_malloc(siglen);
+        if(!abuf)
+                goto err;
+        cms_fixup_mctx(&mctx, si->pkey);
+        if (EVP_SignFinal(&mctx, abuf, &siglen, si->pkey) <= 0)
+                goto err;
+#if 0
+        if (EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_SIGN,
+                                EVP_PKEY_CTRL_CMS_SIGN, 1, si) <= 0)
+                {
+                CMSerr(CMS_F_CMS_SIGNERINFO_SIGN, CMS_R_CTRL_ERROR);
+                goto err;
+                }
+#endif
+        EVP_MD_CTX_cleanup(&mctx);
+
+        ASN1_STRING_set0(si->signature, abuf, siglen);
+
+        return 1;
+
+        err:
+        if (abuf)
+                OPENSSL_free(abuf);
+        EVP_MD_CTX_cleanup(&mctx);
+        return 0;
+
+        }
+
+int CMS_SignerInfo_verify(CMS_SignerInfo *si)
+        {
+        EVP_MD_CTX mctx;
+        unsigned char *abuf = NULL;
+        int alen, r = -1;
+        const EVP_MD *md = NULL;
+
+        if (!si->pkey)
+                {
+                CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_NO_PUBLIC_KEY);
+                return -1;
+                }
+
+        md = EVP_get_digestbyobj(si->digestAlgorithm->algorithm);
+        if (md == NULL)
+                return -1;
+        EVP_MD_CTX_init(&mctx);
+        if (EVP_VerifyInit_ex(&mctx, md, NULL) <= 0)
+                goto err;
+
+        alen = ASN1_item_i2d((ASN1_VALUE *)si->signedAttrs,&abuf,
+                                ASN1_ITEM_rptr(CMS_Attributes_Verify));
+        if(!abuf)
+                goto err;
+        r = EVP_VerifyUpdate(&mctx, abuf, alen);
+        OPENSSL_free(abuf);
+        if (r <= 0)
+                {
+                r = -1;
+                goto err;
+                }
+        cms_fixup_mctx(&mctx, si->pkey);
+        r = EVP_VerifyFinal(&mctx,
+                        si->signature->data, si->signature->length, si->pkey);
+        if (!r)
+                CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_VERIFICATION_FAILURE);
+        err:
+        EVP_MD_CTX_cleanup(&mctx);
+        return r;
+        }
+
+/* Create a chain of digest BIOs from a CMS ContentInfo */
+
+BIO *cms_SignedData_init_bio(CMS_ContentInfo *cms)
+        {
+        int i;
+        CMS_SignedData *sd;
+        BIO *chain = NULL;
+        sd = cms_get0_signed(cms);
+        if (!sd)
+                return NULL;
+        if (cms->d.signedData->encapContentInfo->partial)
+                cms_sd_set_version(sd);
+        for (i = 0; i < sk_X509_ALGOR_num(sd->digestAlgorithms); i++)
+                {
+                X509_ALGOR *digestAlgorithm;
+                BIO *mdbio;
+                digestAlgorithm = sk_X509_ALGOR_value(sd->digestAlgorithms, i);
+                mdbio = cms_DigestAlgorithm_init_bio(digestAlgorithm);
+                if (!mdbio)
+                        goto err;       
+                if (chain)
+                         BIO_push(chain, mdbio);
+                else
+                        chain = mdbio;
+                }
+        return chain;
+        err:
+        if (chain)
+                BIO_free_all(chain);
+        return NULL;
+        }
+
+int CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain)
+        {
+        ASN1_OCTET_STRING *os = NULL;
+        EVP_MD_CTX mctx;
+        int r = -1;
+        EVP_MD_CTX_init(&mctx);
+        /* If we have any signed attributes look for messageDigest value */
+        if (CMS_signed_get_attr_count(si) >= 0)
+                {
+                os = CMS_signed_get0_data_by_OBJ(si,
+                                        OBJ_nid2obj(NID_pkcs9_messageDigest),
+                                        -3, V_ASN1_OCTET_STRING);
+                if (!os)
+                        {
+                        CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
+                                CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE);
+                        goto err;
+                        }
+                }
+
+        if (!cms_DigestAlgorithm_find_ctx(&mctx, chain, si->digestAlgorithm))
+                goto err;
+
+        /* If messageDigest found compare it */
+
+        if (os)
+                {
+                unsigned char mval[EVP_MAX_MD_SIZE];
+                unsigned int mlen;
+                if (EVP_DigestFinal_ex(&mctx, mval, &mlen) <= 0)
+                        {
+                        CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
+                                CMS_R_UNABLE_TO_FINALIZE_CONTEXT);
+                        goto err;
+                        }
+                if (mlen != (unsigned int)os->length)
+                        {
+                        CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
+                                CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH);
+                        goto err;
+                        }
+
+                if (memcmp(mval, os->data, mlen))
+                        {
+                        CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
+                                CMS_R_VERIFICATION_FAILURE);
+                        r = 0;
+                        }
+                else
+                        r = 1;
+                }
+        else
+                {
+                cms_fixup_mctx(&mctx, si->pkey);
+                r = EVP_VerifyFinal(&mctx, si->signature->data,
+                                        si->signature->length, si->pkey);
+                if (r <= 0)
+                        {
+                        CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT,
+                                CMS_R_VERIFICATION_FAILURE);
+                        r = 0;
+                        }
+                }
+
+        err:
+        EVP_MD_CTX_cleanup(&mctx);
+        return r;
+
+        }
+
+int CMS_add_smimecap(CMS_SignerInfo *si, STACK_OF(X509_ALGOR) *algs)
+        {
+        unsigned char *smder = NULL;
+        int smderlen, r;
+        smderlen = i2d_X509_ALGORS(algs, &smder);
+        if (smderlen <= 0)
+                return 0;
+        r = CMS_signed_add1_attr_by_NID(si, NID_SMIMECapabilities,
+                                        V_ASN1_SEQUENCE, smder, smderlen);
+        OPENSSL_free(smder);
+        return r;
+        }
+
+int CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs,
+                                int algnid, int keysize)
+        {
+        X509_ALGOR *alg;
+        ASN1_INTEGER *key = NULL;
+        if (keysize > 0)
+                {
+                key = ASN1_INTEGER_new();
+                if (!key || !ASN1_INTEGER_set(key, keysize))
+                        return 0;
+                }
+        alg = X509_ALGOR_new();
+        if (!alg)
+                {
+                if (key)
+                        ASN1_INTEGER_free(key);
+                return 0;
+                }
+                
+        X509_ALGOR_set0(alg, OBJ_nid2obj(algnid),
+                                key ? V_ASN1_INTEGER : V_ASN1_UNDEF, key);
+        if (!*algs)
+                *algs = sk_X509_ALGOR_new_null();
+        if (!*algs || !sk_X509_ALGOR_push(*algs, alg))
+                {
+                X509_ALGOR_free(alg);
+                return 0;
+                }
+        return 1;
+        }
+
+/* Check to see if a cipher exists and if so add S/MIME capabilities */
+
+static int cms_add_cipher_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg)
+        {
+        if (EVP_get_cipherbynid(nid))
+                return CMS_add_simple_smimecap(sk, nid, arg);
+        return 1;
+        }
+#if 0
+static int cms_add_digest_smcap(STACK_OF(X509_ALGOR) **sk, int nid, int arg)
+        {
+        if (EVP_get_digestbynid(nid))
+                return CMS_add_simple_smimecap(sk, nid, arg);
+        return 1;
+        }
+#endif
+int CMS_add_standard_smimecap(STACK_OF(X509_ALGOR) **smcap)
+        {
+        if (!cms_add_cipher_smcap(smcap, NID_aes_256_cbc, -1)
+                || !cms_add_cipher_smcap(smcap, NID_aes_192_cbc, -1)
+                || !cms_add_cipher_smcap(smcap, NID_aes_128_cbc, -1)
+                || !cms_add_cipher_smcap(smcap, NID_des_ede3_cbc, -1)
+                || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 128)
+                || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 64)
+                || !cms_add_cipher_smcap(smcap, NID_des_cbc, -1)
+                || !cms_add_cipher_smcap(smcap, NID_rc2_cbc, 40))
+                return 0;
+        return 1;
+        }
diff --git a/src/lib/libssl/src/crypto/cms/cms_smime.c b/src/lib/libssl/src/crypto/cms/cms_smime.c
new file mode 100644
index 0000000000..f79c504e91
--- /dev/null
+++ b/src/lib/libssl/src/crypto/cms/cms_smime.c
@@ -0,0 +1,806 @@
+/* crypto/cms/cms_smime.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include "cryptlib.h"
+#include <openssl/asn1t.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+#include <openssl/err.h>
+#include <openssl/cms.h>
+#include "cms_lcl.h"
+
+static int cms_copy_content(BIO *out, BIO *in, unsigned int flags)
+        {
+        unsigned char buf[4096];
+        int r = 0, i;
+        BIO *tmpout = NULL;
+
+        if (out == NULL)
+                tmpout = BIO_new(BIO_s_null());
+        else if (flags & CMS_TEXT)
+                tmpout = BIO_new(BIO_s_mem());
+        else
+                tmpout = out;
+
+        if(!tmpout)
+                {
+                CMSerr(CMS_F_CMS_COPY_CONTENT,ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        /* Read all content through chain to process digest, decrypt etc */
+        for (;;)
+        {
+                i=BIO_read(in,buf,sizeof(buf));
+                if (i <= 0)
+                        {
+                        if (BIO_method_type(in) == BIO_TYPE_CIPHER)
+                                {
+                                if (!BIO_get_cipher_status(in))
+                                        goto err;
+                                }
+                        break;
+                        }
+                                
+                if (tmpout)
+                        BIO_write(tmpout, buf, i);
+        }
+
+        if(flags & CMS_TEXT)
+                {
+                if(!SMIME_text(tmpout, out))
+                        {
+                        CMSerr(CMS_F_CMS_COPY_CONTENT,CMS_R_SMIME_TEXT_ERROR);
+                        goto err;
+                        }
+                }
+
+        r = 1;
+
+        err:
+        if (tmpout && (tmpout != out))
+                BIO_free(tmpout);
+        return r;
+
+        }
+
+static int check_content(CMS_ContentInfo *cms)
+        {
+        ASN1_OCTET_STRING **pos = CMS_get0_content(cms);
+        if (!pos || !*pos)
+                {
+                CMSerr(CMS_F_CHECK_CONTENT, CMS_R_NO_CONTENT);
+                return 0;
+                }
+        return 1;
+        }
+
+static void do_free_upto(BIO *f, BIO *upto)
+        {
+        if (upto)
+                {
+                BIO *tbio;
+                do 
+                        {
+                        tbio = BIO_pop(f);
+                        BIO_free(f);
+                        f = tbio;
+                        }
+                while (f != upto);
+                }
+        else
+                BIO_free_all(f);
+        }
+
+int CMS_data(CMS_ContentInfo *cms, BIO *out, unsigned int flags)
+        {
+        BIO *cont;
+        int r;
+        if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_pkcs7_data)
+                {
+                CMSerr(CMS_F_CMS_DATA, CMS_R_TYPE_NOT_DATA);
+                return 0;
+                }
+        cont = CMS_dataInit(cms, NULL);
+        if (!cont)
+                return 0;
+        r = cms_copy_content(out, cont, flags);
+        BIO_free_all(cont);
+        return r;
+        }
+
+CMS_ContentInfo *CMS_data_create(BIO *in, unsigned int flags)
+        {
+        CMS_ContentInfo *cms;
+        cms = cms_Data_create();
+        if (!cms)
+                return NULL;
+
+        if (CMS_final(cms, in, NULL, flags))
+                return cms;
+
+        CMS_ContentInfo_free(cms);
+
+        return NULL;
+        }
+
+int CMS_digest_verify(CMS_ContentInfo *cms, BIO *dcont, BIO *out,
+                                                        unsigned int flags)
+        {
+        BIO *cont;
+        int r;
+        if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_pkcs7_digest)
+                {
+                CMSerr(CMS_F_CMS_DIGEST_VERIFY, CMS_R_TYPE_NOT_DIGESTED_DATA);
+                return 0;
+                }
+
+        if (!dcont && !check_content(cms))
+                return 0;
+
+        cont = CMS_dataInit(cms, dcont);
+        if (!cont)
+                return 0;
+        r = cms_copy_content(out, cont, flags);
+        if (r)
+                r = cms_DigestedData_do_final(cms, cont, 1);
+        do_free_upto(cont, dcont);
+        return r;
+        }
+
+CMS_ContentInfo *CMS_digest_create(BIO *in, const EVP_MD *md,
+                                        unsigned int flags)
+        {
+        CMS_ContentInfo *cms;
+        if (!md)
+                md = EVP_sha1();
+        cms = cms_DigestedData_create(md);
+        if (!cms)
+                return NULL;
+
+        if(!(flags & CMS_DETACHED))
+                {
+                flags &= ~CMS_STREAM;
+                CMS_set_detached(cms, 0);
+                }
+
+        if ((flags & CMS_STREAM) || CMS_final(cms, in, NULL, flags))
+                return cms;
+
+        CMS_ContentInfo_free(cms);
+        return NULL;
+        }
+
+int CMS_EncryptedData_decrypt(CMS_ContentInfo *cms,
+                                const unsigned char *key, size_t keylen,
+                                BIO *dcont, BIO *out, unsigned int flags)
+        {
+        BIO *cont;
+        int r;
+        if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_pkcs7_encrypted)
+                {
+                CMSerr(CMS_F_CMS_ENCRYPTEDDATA_DECRYPT,
+                                        CMS_R_TYPE_NOT_ENCRYPTED_DATA);
+                return 0;
+                }
+
+        if (!dcont && !check_content(cms))
+                return 0;
+
+        if (CMS_EncryptedData_set1_key(cms, NULL, key, keylen) <= 0)
+                return 0;
+        cont = CMS_dataInit(cms, dcont);
+        if (!cont)
+                return 0;
+        r = cms_copy_content(out, cont, flags);
+        do_free_upto(cont, dcont);
+        return r;
+        }
+
+CMS_ContentInfo *CMS_EncryptedData_encrypt(BIO *in, const EVP_CIPHER *cipher,
+                                        const unsigned char *key, size_t keylen,
+                                        unsigned int flags)
+        {
+        CMS_ContentInfo *cms;
+        if (!cipher)
+                {
+                CMSerr(CMS_F_CMS_ENCRYPTEDDATA_ENCRYPT, CMS_R_NO_CIPHER);
+                return NULL;
+                }
+        cms = CMS_ContentInfo_new();
+        if (!cms)
+                return NULL;
+        if (!CMS_EncryptedData_set1_key(cms, cipher, key, keylen))
+                return NULL;
+
+        if(!(flags & CMS_DETACHED))
+                {
+                flags &= ~CMS_STREAM;
+                CMS_set_detached(cms, 0);
+                }
+
+        if ((flags & (CMS_STREAM|CMS_PARTIAL))
+                || CMS_final(cms, in, NULL, flags))
+                return cms;
+
+        CMS_ContentInfo_free(cms);
+        return NULL;
+        }
+
+static int cms_signerinfo_verify_cert(CMS_SignerInfo *si,
+                                        X509_STORE *store,
+                                        STACK_OF(X509) *certs,
+                                        STACK_OF(X509_CRL) *crls,
+                                        unsigned int flags)
+        {
+        X509_STORE_CTX ctx;
+        X509 *signer;
+        int i, j, r = 0;
+        CMS_SignerInfo_get0_algs(si, NULL, &signer, NULL, NULL);
+        if (!X509_STORE_CTX_init(&ctx, store, signer, certs))
+                {
+                CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CERT,
+                                                CMS_R_STORE_INIT_ERROR);
+                goto err;
+                }
+        X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_SMIME_SIGN);
+        if (crls)
+                X509_STORE_CTX_set0_crls(&ctx, crls);
+
+        i = X509_verify_cert(&ctx);
+        if (i <= 0)
+                {
+                j = X509_STORE_CTX_get_error(&ctx);
+                CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CERT,
+                                                CMS_R_CERTIFICATE_VERIFY_ERROR);
+                ERR_add_error_data(2, "Verify error:",
+                                         X509_verify_cert_error_string(j));
+                goto err;
+                }
+        r = 1;
+        err:
+        X509_STORE_CTX_cleanup(&ctx);
+        return r;
+
+        }
+
+int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs,
+                 X509_STORE *store, BIO *dcont, BIO *out, unsigned int flags)
+        {
+        CMS_SignerInfo *si;
+        STACK_OF(CMS_SignerInfo) *sinfos;
+        STACK_OF(X509) *cms_certs = NULL;
+        STACK_OF(X509_CRL) *crls = NULL;
+        X509 *signer;
+        int i, scount = 0, ret = 0;
+        BIO *cmsbio = NULL, *tmpin = NULL;
+
+        if (!dcont && !check_content(cms))
+                return 0;
+
+        /* Attempt to find all signer certificates */
+
+        sinfos = CMS_get0_SignerInfos(cms);
+
+        if (sk_CMS_SignerInfo_num(sinfos) <= 0)
+                {
+                CMSerr(CMS_F_CMS_VERIFY, CMS_R_NO_SIGNERS);
+                goto err;
+                }
+
+        for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
+                {
+                si = sk_CMS_SignerInfo_value(sinfos, i);
+                CMS_SignerInfo_get0_algs(si, NULL, &signer, NULL, NULL);
+                if (signer)
+                        scount++;
+                }
+
+        if (scount != sk_CMS_SignerInfo_num(sinfos))
+                scount += CMS_set1_signers_certs(cms, certs, flags);
+
+        if (scount != sk_CMS_SignerInfo_num(sinfos))
+                {
+                CMSerr(CMS_F_CMS_VERIFY, CMS_R_SIGNER_CERTIFICATE_NOT_FOUND);
+                goto err;
+                }
+
+        /* Attempt to verify all signers certs */
+
+        if (!(flags & CMS_NO_SIGNER_CERT_VERIFY))
+                {
+                cms_certs = CMS_get1_certs(cms);
+                if (!(flags & CMS_NOCRL))
+                        crls = CMS_get1_crls(cms);
+                for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
+                        {
+                        si = sk_CMS_SignerInfo_value(sinfos, i);
+                        if (!cms_signerinfo_verify_cert(si, store,
+                                                        cms_certs, crls, flags))
+                                goto err;
+                        }
+                }
+
+        /* Attempt to verify all SignerInfo signed attribute signatures */
+
+        if (!(flags & CMS_NO_ATTR_VERIFY))
+                {
+                for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
+                        {
+                        si = sk_CMS_SignerInfo_value(sinfos, i);
+                        if (CMS_signed_get_attr_count(si) < 0)
+                                continue;
+                        if (CMS_SignerInfo_verify(si) <= 0)
+                                goto err;
+                        }
+                }
+
+        /* Performance optimization: if the content is a memory BIO then
+         * store its contents in a temporary read only memory BIO. This
+         * avoids potentially large numbers of slow copies of data which will
+         * occur when reading from a read write memory BIO when signatures
+         * are calculated.
+         */
+
+        if (dcont && (BIO_method_type(dcont) == BIO_TYPE_MEM))
+                {
+                char *ptr;
+                long len;
+                len = BIO_get_mem_data(dcont, &ptr);
+                tmpin = BIO_new_mem_buf(ptr, len);
+                if (tmpin == NULL)
+                        {
+                        CMSerr(CMS_F_CMS_VERIFY,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                        }
+                }
+        else
+                tmpin = dcont;
+                
+
+        cmsbio=CMS_dataInit(cms, tmpin);
+        if (!cmsbio)
+                goto err;
+
+        if (!cms_copy_content(out, cmsbio, flags))
+                goto err;
+
+        if (!(flags & CMS_NO_CONTENT_VERIFY))
+                {
+                for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
+                        {
+                        si = sk_CMS_SignerInfo_value(sinfos, i);
+                        if (!CMS_SignerInfo_verify_content(si, cmsbio))
+                                {
+                                CMSerr(CMS_F_CMS_VERIFY,
+                                        CMS_R_CONTENT_VERIFY_ERROR);
+                                goto err;
+                                }
+                        }
+                }
+
+        ret = 1;
+
+        err:
+        
+        if (dcont && (tmpin == dcont))
+                do_free_upto(cmsbio, dcont);
+        else
+                BIO_free_all(cmsbio);
+
+        if (cms_certs)
+                sk_X509_pop_free(cms_certs, X509_free);
+        if (crls)
+                sk_X509_CRL_pop_free(crls, X509_CRL_free);
+
+        return ret;
+        }
+
+int CMS_verify_receipt(CMS_ContentInfo *rcms, CMS_ContentInfo *ocms,
+                        STACK_OF(X509) *certs,
+                        X509_STORE *store, unsigned int flags)
+        {
+        int r;
+        r = CMS_verify(rcms, certs, store, NULL, NULL, flags);
+        if (r <= 0)
+                return r;
+        return cms_Receipt_verify(rcms, ocms);
+        }
+
+CMS_ContentInfo *CMS_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
+                                                BIO *data, unsigned int flags)
+        {
+        CMS_ContentInfo *cms;
+        int i;
+
+        cms = CMS_ContentInfo_new();
+        if (!cms || !CMS_SignedData_init(cms))
+                goto merr;
+
+        if (pkey && !CMS_add1_signer(cms, signcert, pkey, NULL, flags))
+                {
+                CMSerr(CMS_F_CMS_SIGN, CMS_R_ADD_SIGNER_ERROR);
+                goto err;
+                }
+
+        for (i = 0; i < sk_X509_num(certs); i++)
+                {
+                X509 *x = sk_X509_value(certs, i);
+                if (!CMS_add1_cert(cms, x))
+                        goto merr;
+                }
+
+        if(!(flags & CMS_DETACHED))
+                {
+                flags &= ~CMS_STREAM;
+                CMS_set_detached(cms, 0);
+                }
+
+        if ((flags & (CMS_STREAM|CMS_PARTIAL))
+                || CMS_final(cms, data, NULL, flags))
+                return cms;
+        else
+                goto err;
+
+        merr:
+        CMSerr(CMS_F_CMS_SIGN, ERR_R_MALLOC_FAILURE);
+
+        err:
+        if (cms)
+                CMS_ContentInfo_free(cms);
+        return NULL;
+        }
+
+CMS_ContentInfo *CMS_sign_receipt(CMS_SignerInfo *si,
+                                        X509 *signcert, EVP_PKEY *pkey,
+                                        STACK_OF(X509) *certs,
+                                        unsigned int flags)
+        {
+        CMS_SignerInfo *rct_si;
+        CMS_ContentInfo *cms = NULL;
+        ASN1_OCTET_STRING **pos, *os;
+        BIO *rct_cont = NULL;
+        int r = 0;
+
+        flags &= ~CMS_STREAM;
+        /* Not really detached but avoids content being allocated */
+        flags |= CMS_PARTIAL|CMS_BINARY|CMS_DETACHED;
+        if (!pkey || !signcert)
+                {
+                CMSerr(CMS_F_CMS_SIGN_RECEIPT, CMS_R_NO_KEY_OR_CERT);
+                return NULL;
+                }
+
+        /* Initialize signed data */
+
+        cms = CMS_sign(NULL, NULL, certs, NULL, flags);
+        if (!cms)
+                goto err;
+
+        /* Set inner content type to signed receipt */
+        if (!CMS_set1_eContentType(cms, OBJ_nid2obj(NID_id_smime_ct_receipt)))
+                goto err;
+
+        rct_si = CMS_add1_signer(cms, signcert, pkey, NULL, flags);
+        if (!rct_si)
+                {
+                CMSerr(CMS_F_CMS_SIGN_RECEIPT, CMS_R_ADD_SIGNER_ERROR);
+                goto err;
+                }
+
+        os = cms_encode_Receipt(si);
+
+        if (!os)
+                goto err;
+
+        /* Set content to digest */
+        rct_cont = BIO_new_mem_buf(os->data, os->length);
+        if (!rct_cont)
+                goto err;
+
+        /* Add msgSigDigest attribute */
+
+        if (!cms_msgSigDigest_add1(rct_si, si))
+                goto err;
+
+        /* Finalize structure */
+        if (!CMS_final(cms, rct_cont, NULL, flags))
+                goto err;
+
+        /* Set embedded content */
+        pos = CMS_get0_content(cms);
+        *pos = os;
+
+        r = 1;
+
+        err:
+        if (rct_cont)
+                BIO_free(rct_cont);
+        if (r)
+                return cms;
+        CMS_ContentInfo_free(cms);
+        return NULL;
+
+        }
+
+CMS_ContentInfo *CMS_encrypt(STACK_OF(X509) *certs, BIO *data,
+                                const EVP_CIPHER *cipher, unsigned int flags)
+        {
+        CMS_ContentInfo *cms;
+        int i;
+        X509 *recip;
+        cms = CMS_EnvelopedData_create(cipher);
+        if (!cms)
+                goto merr;
+        for (i = 0; i < sk_X509_num(certs); i++)
+                {
+                recip = sk_X509_value(certs, i);
+                if (!CMS_add1_recipient_cert(cms, recip, flags))
+                        {
+                        CMSerr(CMS_F_CMS_ENCRYPT, CMS_R_RECIPIENT_ERROR);
+                        goto err;
+                        }
+                }
+
+        if(!(flags & CMS_DETACHED))
+                {
+                flags &= ~CMS_STREAM;
+                CMS_set_detached(cms, 0);
+                }
+
+        if ((flags & (CMS_STREAM|CMS_PARTIAL))
+                || CMS_final(cms, data, NULL, flags))
+                return cms;
+        else
+                goto err;
+
+        merr:
+        CMSerr(CMS_F_CMS_ENCRYPT, ERR_R_MALLOC_FAILURE);
+        err:
+        if (cms)
+                CMS_ContentInfo_free(cms);
+        return NULL;
+        }
+
+int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert)
+        {
+        STACK_OF(CMS_RecipientInfo) *ris;
+        CMS_RecipientInfo *ri;
+        int i, r;
+        ris = CMS_get0_RecipientInfos(cms);
+        for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++)
+                {
+                ri = sk_CMS_RecipientInfo_value(ris, i);
+                if (CMS_RecipientInfo_type(ri) != CMS_RECIPINFO_TRANS)
+                                continue;
+                /* If we have a cert try matching RecipientInfo
+                 * otherwise try them all.
+                 */
+                if (!cert || (CMS_RecipientInfo_ktri_cert_cmp(ri, cert) == 0))
+                        {
+                        CMS_RecipientInfo_set0_pkey(ri, pk);
+                        r = CMS_RecipientInfo_decrypt(cms, ri);
+                        CMS_RecipientInfo_set0_pkey(ri, NULL);
+                        if (r > 0)
+                                return 1;
+                        if (cert)
+                                {
+                                CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY,
+                                                CMS_R_DECRYPT_ERROR);
+                                return 0;
+                                }
+                        ERR_clear_error();
+                        }
+                }
+
+        CMSerr(CMS_F_CMS_DECRYPT_SET1_PKEY, CMS_R_NO_MATCHING_RECIPIENT);
+        return 0;
+
+        }
+
+int CMS_decrypt_set1_key(CMS_ContentInfo *cms, 
+                                unsigned char *key, size_t keylen,
+                                unsigned char *id, size_t idlen)
+        {
+        STACK_OF(CMS_RecipientInfo) *ris;
+        CMS_RecipientInfo *ri;
+        int i, r;
+        ris = CMS_get0_RecipientInfos(cms);
+        for (i = 0; i < sk_CMS_RecipientInfo_num(ris); i++)
+                {
+                ri = sk_CMS_RecipientInfo_value(ris, i);
+                if (CMS_RecipientInfo_type(ri) != CMS_RECIPINFO_KEK)
+                                continue;
+
+                /* If we have an id try matching RecipientInfo
+                 * otherwise try them all.
+                 */
+                if (!id || (CMS_RecipientInfo_kekri_id_cmp(ri, id, idlen) == 0))
+                        {
+                        CMS_RecipientInfo_set0_key(ri, key, keylen);
+                        r = CMS_RecipientInfo_decrypt(cms, ri);
+                        CMS_RecipientInfo_set0_key(ri, NULL, 0);
+                        if (r > 0)
+                                return 1;
+                        if (id)
+                                {
+                                CMSerr(CMS_F_CMS_DECRYPT_SET1_KEY,
+                                                CMS_R_DECRYPT_ERROR);
+                                return 0;
+                                }
+                        ERR_clear_error();
+                        }
+                }
+
+        CMSerr(CMS_F_CMS_DECRYPT_SET1_KEY, CMS_R_NO_MATCHING_RECIPIENT);
+        return 0;
+
+        }
+        
+int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert,
+                                BIO *dcont, BIO *out,
+                                unsigned int flags)
+        {
+        int r;
+        BIO *cont;
+        if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_pkcs7_enveloped)
+                {
+                CMSerr(CMS_F_CMS_DECRYPT, CMS_R_TYPE_NOT_ENVELOPED_DATA);
+                return 0;
+                }
+        if (!dcont && !check_content(cms))
+                return 0;
+        if (pk && !CMS_decrypt_set1_pkey(cms, pk, cert))
+                return 0;
+
+        cont = CMS_dataInit(cms, dcont);
+        if (!cont)
+                return 0;
+        r = cms_copy_content(out, cont, flags);
+        do_free_upto(cont, dcont);
+        return r;
+        }
+
+int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, unsigned int flags)
+        {
+        BIO *cmsbio;
+        int ret = 0;
+        if (!(cmsbio = CMS_dataInit(cms, dcont)))
+                {
+                CMSerr(CMS_F_CMS_FINAL,ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+
+        SMIME_crlf_copy(data, cmsbio, flags);
+
+        (void)BIO_flush(cmsbio);
+
+
+        if (!CMS_dataFinal(cms, cmsbio))
+                {
+                CMSerr(CMS_F_CMS_FINAL,CMS_R_CMS_DATAFINAL_ERROR);
+                goto err;
+                }
+
+        ret = 1;
+
+        err:
+        do_free_upto(cmsbio, dcont);
+
+        return ret;
+
+        }
+
+#ifdef ZLIB
+
+int CMS_uncompress(CMS_ContentInfo *cms, BIO *dcont, BIO *out,
+                                                        unsigned int flags)
+        {
+        BIO *cont;
+        int r;
+        if (OBJ_obj2nid(CMS_get0_type(cms)) != NID_id_smime_ct_compressedData)
+                {
+                CMSerr(CMS_F_CMS_UNCOMPRESS,
+                                        CMS_R_TYPE_NOT_COMPRESSED_DATA);
+                return 0;
+                }
+
+        if (!dcont && !check_content(cms))
+                return 0;
+
+        cont = CMS_dataInit(cms, dcont);
+        if (!cont)
+                return 0;
+        r = cms_copy_content(out, cont, flags);
+        do_free_upto(cont, dcont);
+        return r;
+        }
+
+CMS_ContentInfo *CMS_compress(BIO *in, int comp_nid, unsigned int flags)
+        {
+        CMS_ContentInfo *cms;
+        if (comp_nid <= 0)
+                comp_nid = NID_zlib_compression;
+        cms = cms_CompressedData_create(comp_nid);
+        if (!cms)
+                return NULL;
+
+        if(!(flags & CMS_DETACHED))
+                {
+                flags &= ~CMS_STREAM;
+                CMS_set_detached(cms, 0);
+                }
+
+        if (CMS_final(cms, in, NULL, flags))
+                return cms;
+
+        CMS_ContentInfo_free(cms);
+        return NULL;
+        }
+
+#else
+
+int CMS_uncompress(CMS_ContentInfo *cms, BIO *dcont, BIO *out,
+                                                        unsigned int flags)
+        {
+        CMSerr(CMS_F_CMS_UNCOMPRESS, CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
+        return 0;
+        }
+
+CMS_ContentInfo *CMS_compress(BIO *in, int comp_nid, unsigned int flags)
+        {
+        CMSerr(CMS_F_CMS_COMPRESS, CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
+        return NULL;
+        }
+
+#endif
diff --git a/src/lib/libssl/src/crypto/des/asm/des_enc.m4 b/src/lib/libssl/src/crypto/des/asm/des_enc.m4
new file mode 100644
index 0000000000..f5b1928f99
--- /dev/null
+++ b/src/lib/libssl/src/crypto/des/asm/des_enc.m4
@@ -0,0 +1,1980 @@
+!  des_enc.m4
+!  des_enc.S  (generated from des_enc.m4)
+!
+!  UltraSPARC assembler version of the LibDES/SSLeay/OpenSSL des_enc.c file.
+!
+!  Version 1.0. 32-bit version.
+!
+!  June 8, 2000.
+!
+!  Version 2.0. 32/64-bit, PIC-ification, blended CPU adaptation
+!               by Andy Polyakov.
+!
+!  January 1, 2003.
+!
+!  Assembler version: Copyright Svend Olaf Mikkelsen.
+!
+!  Original C code: Copyright Eric A. Young.
+!
+!  This code can be freely used by LibDES/SSLeay/OpenSSL users.
+!
+!  The LibDES/SSLeay/OpenSSL copyright notices must be respected.
+!
+!  This version can be redistributed.
+!
+!  To expand the m4 macros: m4 -B 8192 des_enc.m4 > des_enc.S
+!
+!  Global registers 1 to 5 are used. This is the same as done by the
+!  cc compiler. The UltraSPARC load/store little endian feature is used.
+!
+!  Instruction grouping often refers to one CPU cycle.
+!
+!  Assemble through gcc: gcc -c -mcpu=ultrasparc -o des_enc.o des_enc.S
+!
+!  Assemble through cc:  cc -c -xarch=v8plusa -o des_enc.o des_enc.S
+!
+!  Performance improvement according to './apps/openssl speed des'
+!
+!       32-bit build:
+!               23%  faster than cc-5.2 -xarch=v8plus -xO5
+!               115% faster than gcc-3.2.1 -m32 -mcpu=ultrasparc -O5
+!       64-bit build:
+!               50%  faster than cc-5.2 -xarch=v9 -xO5
+!               100% faster than gcc-3.2.1 -m64 -mcpu=ultrasparc -O5
+!
+
+.ident "des_enc.m4 2.1"
+
+#if defined(__SUNPRO_C) && defined(__sparcv9)
+# define ABI64  /* They've said -xarch=v9 at command line */
+#elif defined(__GNUC__) && defined(__arch64__)
+# define ABI64  /* They've said -m64 at command line */
+#endif
+
+#ifdef ABI64
+  .register     %g2,#scratch
+  .register     %g3,#scratch
+# define        FRAME   -192
+# define        BIAS    2047
+# define        LDPTR   ldx
+# define        STPTR   stx
+# define        ARG0    128
+# define        ARGSZ   8
+# ifndef OPENSSL_SYSNAME_ULTRASPARC
+# define OPENSSL_SYSNAME_ULTRASPARC
+# endif
+#else
+# define        FRAME   -96
+# define        BIAS    0
+# define        LDPTR   ld
+# define        STPTR   st
+# define        ARG0    68
+# define        ARGSZ   4
+#endif
+
+#define LOOPS 7
+
+#define global0 %g0
+#define global1 %g1
+#define global2 %g2
+#define global3 %g3
+#define global4 %g4
+#define global5 %g5
+
+#define local0 %l0
+#define local1 %l1
+#define local2 %l2
+#define local3 %l3
+#define local4 %l4
+#define local5 %l5
+#define local7 %l6
+#define local6 %l7
+
+#define in0 %i0
+#define in1 %i1
+#define in2 %i2
+#define in3 %i3
+#define in4 %i4
+#define in5 %i5
+#define in6 %i6
+#define in7 %i7
+
+#define out0 %o0
+#define out1 %o1
+#define out2 %o2
+#define out3 %o3
+#define out4 %o4
+#define out5 %o5
+#define out6 %o6
+#define out7 %o7
+
+#define stub stb
+
+changequote({,})
+
+
+! Macro definitions:
+
+
+! {ip_macro}
+!
+! The logic used in initial and final permutations is the same as in
+! the C code. The permutations are done with a clever shift, xor, and
+! technique.
+!
+! The macro also loads address sbox 1 to 5 to global 1 to 5, address
+! sbox 6 to local6, and addres sbox 8 to out3.
+!
+! Rotates the halfs 3 left to bring the sbox bits in convenient positions.
+!
+! Loads key first round from address in parameter 5 to out0, out1.
+!
+! After the the original LibDES initial permutation, the resulting left
+! is in the variable initially used for right and vice versa. The macro
+! implements the possibility to keep the halfs in the original registers.
+!
+! parameter 1  left
+! parameter 2  right
+! parameter 3  result left (modify in first round)
+! parameter 4  result right (use in first round)
+! parameter 5  key address
+! parameter 6  1/2 for include encryption/decryption
+! parameter 7  1 for move in1 to in3
+! parameter 8  1 for move in3 to in4, 2 for move in4 to in3
+! parameter 9  1 for load ks3 and ks2 to in4 and in3
+
+define(ip_macro, {
+
+! {ip_macro}
+! $1 $2 $4 $3 $5 $6 $7 $8 $9
+
+        ld      [out2+256], local1
+        srl     $2, 4, local4
+
+        xor     local4, $1, local4
+        ifelse($7,1,{mov in1, in3},{nop})
+
+        ld      [out2+260], local2
+        and     local4, local1, local4
+        ifelse($8,1,{mov in3, in4},{})
+        ifelse($8,2,{mov in4, in3},{})
+
+        ld      [out2+280], out4          ! loop counter
+        sll     local4, 4, local1
+        xor     $1, local4, $1
+
+        ld      [out2+264], local3
+        srl     $1, 16, local4
+        xor     $2, local1, $2
+
+        ifelse($9,1,{LDPTR      KS3, in4},{})
+        xor     local4, $2, local4
+        nop     !sethi  %hi(DES_SPtrans), global1 ! sbox addr
+
+        ifelse($9,1,{LDPTR      KS2, in3},{})
+        and     local4, local2, local4
+        nop     !or     global1, %lo(DES_SPtrans), global1   ! sbox addr
+
+        sll     local4, 16, local1
+        xor     $2, local4, $2
+
+        srl     $2, 2, local4
+        xor     $1, local1, $1
+
+        sethi   %hi(16711680), local5
+        xor     local4, $1, local4
+
+        and     local4, local3, local4
+        or      local5, 255, local5
+
+        sll     local4, 2, local2
+        xor     $1, local4, $1
+
+        srl     $1, 8, local4
+        xor     $2, local2, $2
+
+        xor     local4, $2, local4
+        add     global1, 768, global4
+
+        and     local4, local5, local4
+        add     global1, 1024, global5
+
+        ld      [out2+272], local7
+        sll     local4, 8, local1
+        xor     $2, local4, $2
+
+        srl     $2, 1, local4
+        xor     $1, local1, $1
+
+        ld      [$5], out0                ! key 7531
+        xor     local4, $1, local4
+        add     global1, 256, global2
+
+        ld      [$5+4], out1              ! key 8642
+        and     local4, local7, local4
+        add     global1, 512, global3
+
+        sll     local4, 1, local1
+        xor     $1, local4, $1
+
+        sll     $1, 3, local3
+        xor     $2, local1, $2
+
+        sll     $2, 3, local2
+        add     global1, 1280, local6     ! address sbox 8
+
+        srl     $1, 29, local4
+        add     global1, 1792, out3       ! address sbox 8
+
+        srl     $2, 29, local1
+        or      local4, local3, $4
+
+        or      local2, local1, $3
+
+        ifelse($6, 1, {
+
+                ld      [out2+284], local5     ! 0x0000FC00 used in the rounds
+                or      local2, local1, $3
+                xor     $4, out0, local1
+
+                call .des_enc.1
+                and     local1, 252, local1
+
+        },{})
+
+        ifelse($6, 2, {
+
+                ld      [out2+284], local5     ! 0x0000FC00 used in the rounds
+                or      local2, local1, $3
+                xor     $4, out0, local1
+
+                call .des_dec.1
+                and     local1, 252, local1
+
+        },{})
+})
+
+
+! {rounds_macro}
+!
+! The logic used in the DES rounds is the same as in the C code,
+! except that calculations for sbox 1 and sbox 5 begin before
+! the previous round is finished.
+!
+! In each round one half (work) is modified based on key and the
+! other half (use).
+!
+! In this version we do two rounds in a loop repeated 7 times
+! and two rounds seperately.
+!
+! One half has the bits for the sboxes in the following positions:
+!
+!       777777xx555555xx333333xx111111xx
+!
+!       88xx666666xx444444xx222222xx8888
+!
+! The bits for each sbox are xor-ed with the key bits for that box.
+! The above xx bits are cleared, and the result used for lookup in
+! the sbox table. Each sbox entry contains the 4 output bits permuted
+! into 32 bits according to the P permutation.
+!
+! In the description of DES, left and right are switched after
+! each round, except after last round. In this code the original
+! left and right are kept in the same register in all rounds, meaning
+! that after the 16 rounds the result for right is in the register
+! originally used for left.
+!
+! parameter 1  first work (left in first round)
+! parameter 2  first use (right in first round)
+! parameter 3  enc/dec  1/-1
+! parameter 4  loop label
+! parameter 5  key address register
+! parameter 6  optional address for key next encryption/decryption
+! parameter 7  not empty for include retl
+!
+! also compares in2 to 8
+
+define(rounds_macro, {
+
+! {rounds_macro}
+! $1 $2 $3 $4 $5 $6 $7 $8 $9
+
+        xor     $2, out0, local1
+
+        ld      [out2+284], local5        ! 0x0000FC00
+        ba      $4
+        and     local1, 252, local1
+
+        .align 32
+
+$4:
+        ! local6 is address sbox 6
+        ! out3   is address sbox 8
+        ! out4   is loop counter
+
+        ld      [global1+local1], local1
+        xor     $2, out1, out1            ! 8642
+        xor     $2, out0, out0            ! 7531
+        fmovs   %f0, %f0                  ! fxor used for alignment
+
+        srl     out1, 4, local0           ! rotate 4 right
+        and     out0, local5, local3      ! 3
+        fmovs   %f0, %f0
+
+        ld      [$5+$3*8], local7         ! key 7531 next round
+        srl     local3, 8, local3         ! 3
+        and     local0, 252, local2       ! 2
+        fmovs   %f0, %f0
+
+        ld      [global3+local3],local3   ! 3
+        sll     out1, 28, out1            ! rotate
+        xor     $1, local1, $1            ! 1 finished, local1 now sbox 7
+
+        ld      [global2+local2], local2  ! 2 
+        srl     out0, 24, local1          ! 7
+        or      out1, local0, out1        ! rotate
+
+        ldub    [out2+local1], local1     ! 7 (and 0xFC)
+        srl     out1, 24, local0          ! 8
+        and     out1, local5, local4      ! 4
+
+        ldub    [out2+local0], local0     ! 8 (and 0xFC)
+        srl     local4, 8, local4         ! 4
+        xor     $1, local2, $1            ! 2 finished local2 now sbox 6
+
+        ld      [global4+local4],local4   ! 4
+        srl     out1, 16, local2          ! 6
+        xor     $1, local3, $1            ! 3 finished local3 now sbox 5
+
+        ld      [out3+local0],local0      ! 8
+        and     local2, 252, local2       ! 6
+        add     global1, 1536, local5     ! address sbox 7
+
+        ld      [local6+local2], local2   ! 6
+        srl     out0, 16, local3          ! 5
+        xor     $1, local4, $1            ! 4 finished
+
+        ld      [local5+local1],local1    ! 7
+        and     local3, 252, local3       ! 5
+        xor     $1, local0, $1            ! 8 finished
+
+        ld      [global5+local3],local3   ! 5
+        xor     $1, local2, $1            ! 6 finished
+        subcc   out4, 1, out4
+
+        ld      [$5+$3*8+4], out0         ! key 8642 next round
+        xor     $1, local7, local2        ! sbox 5 next round
+        xor     $1, local1, $1            ! 7 finished
+
+        srl     local2, 16, local2        ! sbox 5 next round
+        xor     $1, local3, $1            ! 5 finished
+
+        ld      [$5+$3*16+4], out1        ! key 8642 next round again
+        and     local2, 252, local2       ! sbox5 next round
+! next round
+        xor     $1, local7, local7        ! 7531
+
+        ld      [global5+local2], local2  ! 5
+        srl     local7, 24, local3        ! 7
+        xor     $1, out0, out0            ! 8642
+
+        ldub    [out2+local3], local3     ! 7 (and 0xFC)
+        srl     out0, 4, local0           ! rotate 4 right
+        and     local7, 252, local1       ! 1
+
+        sll     out0, 28, out0            ! rotate
+        xor     $2, local2, $2            ! 5 finished local2 used
+
+        srl     local0, 8, local4         ! 4
+        and     local0, 252, local2       ! 2
+        ld      [local5+local3], local3   ! 7
+
+        srl     local0, 16, local5        ! 6
+        or      out0, local0, out0        ! rotate
+        ld      [global2+local2], local2  ! 2
+
+        srl     out0, 24, local0
+        ld      [$5+$3*16], out0          ! key 7531 next round
+        and     local4, 252, local4       ! 4
+
+        and     local5, 252, local5       ! 6
+        ld      [global4+local4], local4  ! 4
+        xor     $2, local3, $2            ! 7 finished local3 used
+
+        and     local0, 252, local0       ! 8
+        ld      [local6+local5], local5   ! 6
+        xor     $2, local2, $2            ! 2 finished local2 now sbox 3
+
+        srl     local7, 8, local2         ! 3 start
+        ld      [out3+local0], local0     ! 8
+        xor     $2, local4, $2            ! 4 finished
+
+        and     local2, 252, local2       ! 3
+        ld      [global1+local1], local1  ! 1
+        xor     $2, local5, $2            ! 6 finished local5 used
+
+        ld      [global3+local2], local2  ! 3
+        xor     $2, local0, $2            ! 8 finished
+        add     $5, $3*16, $5             ! enc add 8, dec add -8 to key pointer
+
+        ld      [out2+284], local5        ! 0x0000FC00
+        xor     $2, out0, local4          ! sbox 1 next round
+        xor     $2, local1, $2            ! 1 finished
+
+        xor     $2, local2, $2            ! 3 finished
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        bne,pt  %icc, $4
+#else
+        bne     $4
+#endif
+        and     local4, 252, local1       ! sbox 1 next round
+
+! two rounds more:
+
+        ld      [global1+local1], local1
+        xor     $2, out1, out1
+        xor     $2, out0, out0
+
+        srl     out1, 4, local0           ! rotate
+        and     out0, local5, local3
+
+        ld      [$5+$3*8], local7         ! key 7531
+        srl     local3, 8, local3
+        and     local0, 252, local2
+
+        ld      [global3+local3],local3
+        sll     out1, 28, out1            ! rotate
+        xor     $1, local1, $1            ! 1 finished, local1 now sbox 7
+
+        ld      [global2+local2], local2
+        srl     out0, 24, local1
+        or      out1, local0, out1        ! rotate
+
+        ldub    [out2+local1], local1
+        srl     out1, 24, local0
+        and     out1, local5, local4
+
+        ldub    [out2+local0], local0
+        srl     local4, 8, local4
+        xor     $1, local2, $1            ! 2 finished local2 now sbox 6
+
+        ld      [global4+local4],local4
+        srl     out1, 16, local2
+        xor     $1, local3, $1            ! 3 finished local3 now sbox 5
+
+        ld      [out3+local0],local0
+        and     local2, 252, local2
+        add     global1, 1536, local5     ! address sbox 7
+
+        ld      [local6+local2], local2
+        srl     out0, 16, local3
+        xor     $1, local4, $1            ! 4 finished
+
+        ld      [local5+local1],local1
+        and     local3, 252, local3
+        xor     $1, local0, $1
+
+        ld      [global5+local3],local3
+        xor     $1, local2, $1            ! 6 finished
+        cmp     in2, 8
+
+        ifelse($6,{}, {}, {ld   [out2+280], out4})  ! loop counter
+        xor     $1, local7, local2        ! sbox 5 next round
+        xor     $1, local1, $1            ! 7 finished
+
+        ld      [$5+$3*8+4], out0
+        srl     local2, 16, local2        ! sbox 5 next round
+        xor     $1, local3, $1            ! 5 finished
+
+        and     local2, 252, local2
+! next round (two rounds more)
+        xor     $1, local7, local7        ! 7531
+
+        ld      [global5+local2], local2
+        srl     local7, 24, local3
+        xor     $1, out0, out0            ! 8642
+
+        ldub    [out2+local3], local3
+        srl     out0, 4, local0           ! rotate
+        and     local7, 252, local1
+
+        sll     out0, 28, out0            ! rotate
+        xor     $2, local2, $2            ! 5 finished local2 used
+
+        srl     local0, 8, local4
+        and     local0, 252, local2
+        ld      [local5+local3], local3
+
+        srl     local0, 16, local5
+        or      out0, local0, out0        ! rotate
+        ld      [global2+local2], local2
+
+        srl     out0, 24, local0
+        ifelse($6,{}, {}, {ld   [$6], out0})   ! key next encryption/decryption
+        and     local4, 252, local4
+
+        and     local5, 252, local5
+        ld      [global4+local4], local4
+        xor     $2, local3, $2            ! 7 finished local3 used
+
+        and     local0, 252, local0
+        ld      [local6+local5], local5
+        xor     $2, local2, $2            ! 2 finished local2 now sbox 3
+
+        srl     local7, 8, local2         ! 3 start
+        ld      [out3+local0], local0
+        xor     $2, local4, $2
+
+        and     local2, 252, local2
+        ld      [global1+local1], local1
+        xor     $2, local5, $2            ! 6 finished local5 used
+
+        ld      [global3+local2], local2
+        srl     $1, 3, local3
+        xor     $2, local0, $2
+
+        ifelse($6,{}, {}, {ld   [$6+4], out1}) ! key next encryption/decryption
+        sll     $1, 29, local4
+        xor     $2, local1, $2
+
+        ifelse($7,{}, {}, {retl})
+        xor     $2, local2, $2
+})
+
+
+! {fp_macro}
+!
+!  parameter 1   right (original left)
+!  parameter 2   left (original right)
+!  parameter 3   1 for optional store to [in0]
+!  parameter 4   1 for load input/output address to local5/7
+!
+!  The final permutation logic switches the halfes, meaning that
+!  left and right ends up the the registers originally used.
+
+define(fp_macro, {
+
+! {fp_macro}
+! $1 $2 $3 $4 $5 $6 $7 $8 $9
+
+        ! initially undo the rotate 3 left done after initial permutation
+        ! original left is received shifted 3 right and 29 left in local3/4
+
+        sll     $2, 29, local1
+        or      local3, local4, $1
+
+        srl     $2, 3, $2
+        sethi   %hi(0x55555555), local2
+
+        or      $2, local1, $2
+        or      local2, %lo(0x55555555), local2
+
+        srl     $2, 1, local3
+        sethi   %hi(0x00ff00ff), local1
+        xor     local3, $1, local3
+        or      local1, %lo(0x00ff00ff), local1
+        and     local3, local2, local3
+        sethi   %hi(0x33333333), local4
+        sll     local3, 1, local2
+
+        xor     $1, local3, $1
+
+        srl     $1, 8, local3
+        xor     $2, local2, $2
+        xor     local3, $2, local3
+        or      local4, %lo(0x33333333), local4
+        and     local3, local1, local3
+        sethi   %hi(0x0000ffff), local1
+        sll     local3, 8, local2
+
+        xor     $2, local3, $2
+
+        srl     $2, 2, local3
+        xor     $1, local2, $1
+        xor     local3, $1, local3
+        or      local1, %lo(0x0000ffff), local1
+        and     local3, local4, local3
+        sethi   %hi(0x0f0f0f0f), local4
+        sll     local3, 2, local2
+
+        ifelse($4,1, {LDPTR INPUT, local5})
+        xor     $1, local3, $1
+
+        ifelse($4,1, {LDPTR OUTPUT, local7})
+        srl     $1, 16, local3
+        xor     $2, local2, $2
+        xor     local3, $2, local3
+        or      local4, %lo(0x0f0f0f0f), local4
+        and     local3, local1, local3
+        sll     local3, 16, local2
+
+        xor     $2, local3, local1
+
+        srl     local1, 4, local3
+        xor     $1, local2, $1
+        xor     local3, $1, local3
+        and     local3, local4, local3
+        sll     local3, 4, local2
+
+        xor     $1, local3, $1
+
+        ! optional store:
+
+        ifelse($3,1, {st $1, [in0]})
+
+        xor     local1, local2, $2
+
+        ifelse($3,1, {st $2, [in0+4]})
+
+})
+
+
+! {fp_ip_macro}
+!
+! Does initial permutation for next block mixed with
+! final permutation for current block.
+!
+! parameter 1   original left
+! parameter 2   original right
+! parameter 3   left ip
+! parameter 4   right ip
+! parameter 5   1: load ks1/ks2 to in3/in4, add 120 to in4
+!                2: mov in4 to in3
+!
+! also adds -8 to length in2 and loads loop counter to out4
+
+define(fp_ip_macro, {
+
+! {fp_ip_macro}
+! $1 $2 $3 $4 $5 $6 $7 $8 $9
+
+        define({temp1},{out4})
+        define({temp2},{local3})
+
+        define({ip1},{local1})
+        define({ip2},{local2})
+        define({ip4},{local4})
+        define({ip5},{local5})
+
+        ! $1 in local3, local4
+
+        ld      [out2+256], ip1
+        sll     out5, 29, temp1
+        or      local3, local4, $1
+
+        srl     out5, 3, $2
+        ifelse($5,2,{mov in4, in3})
+
+        ld      [out2+272], ip5
+        srl     $4, 4, local0
+        or      $2, temp1, $2
+
+        srl     $2, 1, temp1
+        xor     temp1, $1, temp1
+
+        and     temp1, ip5, temp1
+        xor     local0, $3, local0
+
+        sll     temp1, 1, temp2
+        xor     $1, temp1, $1
+
+        and     local0, ip1, local0
+        add     in2, -8, in2
+
+        sll     local0, 4, local7
+        xor     $3, local0, $3
+
+        ld      [out2+268], ip4
+        srl     $1, 8, temp1
+        xor     $2, temp2, $2
+        ld      [out2+260], ip2
+        srl     $3, 16, local0
+        xor     $4, local7, $4
+        xor     temp1, $2, temp1
+        xor     local0, $4, local0
+        and     temp1, ip4, temp1
+        and     local0, ip2, local0
+        sll     temp1, 8, temp2
+        xor     $2, temp1, $2
+        sll     local0, 16, local7
+        xor     $4, local0, $4
+
+        srl     $2, 2, temp1
+        xor     $1, temp2, $1
+
+        ld      [out2+264], temp2         ! ip3
+        srl     $4, 2, local0
+        xor     $3, local7, $3
+        xor     temp1, $1, temp1
+        xor     local0, $3, local0
+        and     temp1, temp2, temp1
+        and     local0, temp2, local0
+        sll     temp1, 2, temp2
+        xor     $1, temp1, $1
+        sll     local0, 2, local7
+        xor     $3, local0, $3
+
+        srl     $1, 16, temp1
+        xor     $2, temp2, $2
+        srl     $3, 8, local0
+        xor     $4, local7, $4
+        xor     temp1, $2, temp1
+        xor     local0, $4, local0
+        and     temp1, ip2, temp1
+        and     local0, ip4, local0
+        sll     temp1, 16, temp2
+        xor     $2, temp1, local4
+        sll     local0, 8, local7
+        xor     $4, local0, $4
+
+        srl     $4, 1, local0
+        xor     $3, local7, $3
+
+        srl     local4, 4, temp1
+        xor     local0, $3, local0
+
+        xor     $1, temp2, $1
+        and     local0, ip5, local0
+
+        sll     local0, 1, local7
+        xor     temp1, $1, temp1
+
+        xor     $3, local0, $3
+        xor     $4, local7, $4
+
+        sll     $3, 3, local5
+        and     temp1, ip1, temp1
+
+        sll     temp1, 4, temp2
+        xor     $1, temp1, $1
+
+        ifelse($5,1,{LDPTR      KS2, in4})
+        sll     $4, 3, local2
+        xor     local4, temp2, $2
+
+        ! reload since used as temporar:
+
+        ld      [out2+280], out4          ! loop counter
+
+        srl     $3, 29, local0
+        ifelse($5,1,{add in4, 120, in4})
+
+        ifelse($5,1,{LDPTR      KS1, in3})
+        srl     $4, 29, local7
+
+        or      local0, local5, $4
+        or      local2, local7, $3
+
+})
+
+
+
+! {load_little_endian}
+!
+! parameter 1  address
+! parameter 2  destination left
+! parameter 3  destination right
+! parameter 4  temporar
+! parameter 5  label
+
+define(load_little_endian, {
+
+! {load_little_endian}
+! $1 $2 $3 $4 $5 $6 $7 $8 $9
+
+        ! first in memory to rightmost in register
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        andcc   $1, 3, global0
+        bne,pn  %icc, $5
+        nop
+
+        lda     [$1] 0x88, $2
+        add     $1, 4, $4
+
+        ba,pt   %icc, $5a
+        lda     [$4] 0x88, $3
+#endif
+
+$5:
+        ldub    [$1+3], $2
+
+        ldub    [$1+2], $4
+        sll     $2, 8, $2
+        or      $2, $4, $2
+
+        ldub    [$1+1], $4
+        sll     $2, 8, $2
+        or      $2, $4, $2
+
+        ldub    [$1+0], $4
+        sll     $2, 8, $2
+        or      $2, $4, $2
+
+
+        ldub    [$1+3+4], $3
+
+        ldub    [$1+2+4], $4
+        sll     $3, 8, $3
+        or      $3, $4, $3
+
+        ldub    [$1+1+4], $4
+        sll     $3, 8, $3
+        or      $3, $4, $3
+
+        ldub    [$1+0+4], $4
+        sll     $3, 8, $3
+        or      $3, $4, $3
+$5a:
+
+})
+
+
+! {load_little_endian_inc}
+!
+! parameter 1  address
+! parameter 2  destination left
+! parameter 3  destination right
+! parameter 4  temporar
+! parameter 4  label
+!
+! adds 8 to address
+
+define(load_little_endian_inc, {
+
+! {load_little_endian_inc}
+! $1 $2 $3 $4 $5 $6 $7 $8 $9
+
+        ! first in memory to rightmost in register
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        andcc   $1, 3, global0
+        bne,pn  %icc, $5
+        nop
+
+        lda     [$1] 0x88, $2
+        add     $1, 4, $1
+
+        lda     [$1] 0x88, $3
+        ba,pt   %icc, $5a
+        add     $1, 4, $1
+#endif
+
+$5:
+        ldub    [$1+3], $2
+
+        ldub    [$1+2], $4
+        sll     $2, 8, $2
+        or      $2, $4, $2
+
+        ldub    [$1+1], $4
+        sll     $2, 8, $2
+        or      $2, $4, $2
+
+        ldub    [$1+0], $4
+        sll     $2, 8, $2
+        or      $2, $4, $2
+
+        ldub    [$1+3+4], $3
+        add     $1, 8, $1
+
+        ldub    [$1+2+4-8], $4
+        sll     $3, 8, $3
+        or      $3, $4, $3
+
+        ldub    [$1+1+4-8], $4
+        sll     $3, 8, $3
+        or      $3, $4, $3
+
+        ldub    [$1+0+4-8], $4
+        sll     $3, 8, $3
+        or      $3, $4, $3
+$5a:
+
+})
+
+
+! {load_n_bytes}
+!
+! Loads 1 to 7 bytes little endian
+! Remaining bytes are zeroed.
+!
+! parameter 1  address
+! parameter 2  length
+! parameter 3  destination register left
+! parameter 4  destination register right
+! parameter 5  temp
+! parameter 6  temp2
+! parameter 7  label
+! parameter 8  return label
+
+define(load_n_bytes, {
+
+! {load_n_bytes}
+! $1 $2 $5 $6 $7 $8 $7 $8 $9
+
+$7.0:   call    .+8
+        sll     $2, 2, $6
+
+        add     %o7,$7.jmp.table-$7.0,$5
+
+        add     $5, $6, $5
+        mov     0, $4
+
+        ld      [$5], $5
+
+        jmp     %o7+$5
+        mov     0, $3
+
+$7.7:
+        ldub    [$1+6], $5
+        sll     $5, 16, $5
+        or      $3, $5, $3
+$7.6:
+        ldub    [$1+5], $5
+        sll     $5, 8, $5
+        or      $3, $5, $3
+$7.5:
+        ldub    [$1+4], $5
+        or      $3, $5, $3
+$7.4:
+        ldub    [$1+3], $5
+        sll     $5, 24, $5
+        or      $4, $5, $4
+$7.3:
+        ldub    [$1+2], $5
+        sll     $5, 16, $5
+        or      $4, $5, $4
+$7.2:
+        ldub    [$1+1], $5
+        sll     $5, 8, $5
+        or      $4, $5, $4
+$7.1:
+        ldub    [$1+0], $5
+        ba      $8
+        or      $4, $5, $4
+
+        .align 4
+
+$7.jmp.table:
+        .word   0
+        .word   $7.1-$7.0
+        .word   $7.2-$7.0
+        .word   $7.3-$7.0
+        .word   $7.4-$7.0
+        .word   $7.5-$7.0
+        .word   $7.6-$7.0
+        .word   $7.7-$7.0
+})
+
+
+! {store_little_endian}
+!
+! parameter 1  address
+! parameter 2  source left
+! parameter 3  source right
+! parameter 4  temporar
+
+define(store_little_endian, {
+
+! {store_little_endian}
+! $1 $2 $3 $4 $5 $6 $7 $8 $9
+
+        ! rightmost in register to first in memory
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        andcc   $1, 3, global0
+        bne,pn  %icc, $5
+        nop
+
+        sta     $2, [$1] 0x88
+        add     $1, 4, $4
+
+        ba,pt   %icc, $5a
+        sta     $3, [$4] 0x88
+#endif
+
+$5:
+        and     $2, 255, $4
+        stub    $4, [$1+0]
+
+        srl     $2, 8, $4
+        and     $4, 255, $4
+        stub    $4, [$1+1]
+
+        srl     $2, 16, $4
+        and     $4, 255, $4
+        stub    $4, [$1+2]
+
+        srl     $2, 24, $4
+        stub    $4, [$1+3]
+
+
+        and     $3, 255, $4
+        stub    $4, [$1+0+4]
+
+        srl     $3, 8, $4
+        and     $4, 255, $4
+        stub    $4, [$1+1+4]
+
+        srl     $3, 16, $4
+        and     $4, 255, $4
+        stub    $4, [$1+2+4]
+
+        srl     $3, 24, $4
+        stub    $4, [$1+3+4]
+
+$5a:
+
+})
+
+
+! {store_n_bytes}
+!
+! Stores 1 to 7 bytes little endian
+!
+! parameter 1  address
+! parameter 2  length
+! parameter 3  source register left
+! parameter 4  source register right
+! parameter 5  temp
+! parameter 6  temp2
+! parameter 7  label
+! parameter 8  return label
+
+define(store_n_bytes, {
+
+! {store_n_bytes}
+! $1 $2 $5 $6 $7 $8 $7 $8 $9
+
+$7.0:   call    .+8
+        sll     $2, 2, $6
+
+        add     %o7,$7.jmp.table-$7.0,$5
+
+        add     $5, $6, $5
+
+        ld      [$5], $5
+
+        jmp     %o7+$5
+        nop
+
+$7.7:
+        srl     $3, 16, $5
+        and     $5, 0xff, $5
+        stub    $5, [$1+6]
+$7.6:
+        srl     $3, 8, $5
+        and     $5, 0xff, $5
+        stub    $5, [$1+5]
+$7.5:
+        and     $3, 0xff, $5
+        stub    $5, [$1+4]
+$7.4:
+        srl     $4, 24, $5
+        stub    $5, [$1+3]
+$7.3:
+        srl     $4, 16, $5
+        and     $5, 0xff, $5
+        stub    $5, [$1+2]
+$7.2:
+        srl     $4, 8, $5
+        and     $5, 0xff, $5
+        stub    $5, [$1+1]
+$7.1:
+        and     $4, 0xff, $5
+
+
+        ba      $8
+        stub    $5, [$1]
+
+        .align 4
+
+$7.jmp.table:
+
+        .word   0
+        .word   $7.1-$7.0
+        .word   $7.2-$7.0
+        .word   $7.3-$7.0
+        .word   $7.4-$7.0
+        .word   $7.5-$7.0
+        .word   $7.6-$7.0
+        .word   $7.7-$7.0
+})
+
+
+define(testvalue,{1})
+
+define(register_init, {
+
+! For test purposes:
+
+        sethi   %hi(testvalue), local0
+        or      local0, %lo(testvalue), local0
+
+        ifelse($1,{},{}, {mov   local0, $1})
+        ifelse($2,{},{}, {mov   local0, $2})
+        ifelse($3,{},{}, {mov   local0, $3})
+        ifelse($4,{},{}, {mov   local0, $4})
+        ifelse($5,{},{}, {mov   local0, $5})
+        ifelse($6,{},{}, {mov   local0, $6})
+        ifelse($7,{},{}, {mov   local0, $7})
+        ifelse($8,{},{}, {mov   local0, $8})
+
+        mov     local0, local1
+        mov     local0, local2
+        mov     local0, local3
+        mov     local0, local4
+        mov     local0, local5
+        mov     local0, local7
+        mov     local0, local6
+        mov     local0, out0
+        mov     local0, out1
+        mov     local0, out2
+        mov     local0, out3
+        mov     local0, out4
+        mov     local0, out5
+        mov     local0, global1
+        mov     local0, global2
+        mov     local0, global3
+        mov     local0, global4
+        mov     local0, global5
+
+})
+
+.section        ".text"
+
+        .align 32
+
+.des_enc:
+
+        ! key address in3
+        ! loads key next encryption/decryption first round from [in4]
+
+        rounds_macro(in5, out5, 1, .des_enc.1, in3, in4, retl)
+
+
+        .align 32
+
+.des_dec:
+
+        ! implemented with out5 as first parameter to avoid
+        ! register exchange in ede modes
+
+        ! key address in4
+        ! loads key next encryption/decryption first round from [in3]
+
+        rounds_macro(out5, in5, -1, .des_dec.1, in4, in3, retl)
+
+
+
+! void DES_encrypt1(data, ks, enc)
+! *******************************
+
+        .align 32
+        .global DES_encrypt1
+        .type    DES_encrypt1,#function
+
+DES_encrypt1:
+
+        save    %sp, FRAME, %sp
+
+        call    .PIC.me.up
+        mov     .PIC.me.up-(.-4),out0
+
+        ld      [in0], in5                ! left
+        cmp     in2, 0                    ! enc
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        be,pn   %icc, .encrypt.dec        ! enc/dec
+#else
+        be      .encrypt.dec
+#endif
+        ld      [in0+4], out5             ! right
+
+        ! parameter 6  1/2 for include encryption/decryption
+        ! parameter 7  1 for move in1 to in3
+        ! parameter 8  1 for move in3 to in4, 2 for move in4 to in3
+
+        ip_macro(in5, out5, in5, out5, in3, 0, 1, 1)
+
+        rounds_macro(in5, out5, 1, .des_encrypt1.1, in3, in4) ! in4 not used
+
+        fp_macro(in5, out5, 1)            ! 1 for store to [in0]
+
+        ret
+        restore
+
+.encrypt.dec:
+
+        add     in1, 120, in3             ! use last subkey for first round
+
+        ! parameter 6  1/2 for include encryption/decryption
+        ! parameter 7  1 for move in1 to in3
+        ! parameter 8  1 for move in3 to in4, 2 for move in4 to in3
+
+        ip_macro(in5, out5, out5, in5, in4, 2, 0, 1) ! include dec,  ks in4
+
+        fp_macro(out5, in5, 1)            ! 1 for store to [in0]
+
+        ret
+        restore
+
+.DES_encrypt1.end:
+        .size    DES_encrypt1,.DES_encrypt1.end-DES_encrypt1
+
+
+! void DES_encrypt2(data, ks, enc)
+!*********************************
+
+        ! encrypts/decrypts without initial/final permutation
+
+        .align 32
+        .global DES_encrypt2
+        .type    DES_encrypt2,#function
+
+DES_encrypt2:
+
+        save    %sp, FRAME, %sp
+
+        call    .PIC.me.up
+        mov     .PIC.me.up-(.-4),out0
+
+        ! Set sbox address 1 to 6 and rotate halfs 3 left
+        ! Errors caught by destest? Yes. Still? *NO*
+
+        !sethi  %hi(DES_SPtrans), global1 ! address sbox 1
+
+        !or     global1, %lo(DES_SPtrans), global1  ! sbox 1
+
+        add     global1, 256, global2     ! sbox 2
+        add     global1, 512, global3     ! sbox 3
+
+        ld      [in0], out5               ! right
+        add     global1, 768, global4     ! sbox 4
+        add     global1, 1024, global5    ! sbox 5
+
+        ld      [in0+4], in5              ! left
+        add     global1, 1280, local6     ! sbox 6
+        add     global1, 1792, out3       ! sbox 8
+
+        ! rotate
+
+        sll     in5, 3, local5
+        mov     in1, in3                  ! key address to in3
+
+        sll     out5, 3, local7
+        srl     in5, 29, in5
+
+        srl     out5, 29, out5
+        add     in5, local5, in5
+
+        add     out5, local7, out5
+        cmp     in2, 0
+
+        ! we use our own stackframe
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        be,pn   %icc, .encrypt2.dec       ! decryption
+#else
+        be      .encrypt2.dec
+#endif
+        STPTR   in0, [%sp+BIAS+ARG0+0*ARGSZ]
+
+        ld      [in3], out0               ! key 7531 first round
+        mov     LOOPS, out4               ! loop counter
+
+        ld      [in3+4], out1             ! key 8642 first round
+        sethi   %hi(0x0000FC00), local5
+
+        call .des_enc
+        mov     in3, in4
+
+        ! rotate
+        sll     in5, 29, in0
+        srl     in5, 3, in5
+        sll     out5, 29, in1
+        add     in5, in0, in5
+        srl     out5, 3, out5
+        LDPTR   [%sp+BIAS+ARG0+0*ARGSZ], in0
+        add     out5, in1, out5
+        st      in5, [in0]
+        st      out5, [in0+4]
+
+        ret
+        restore
+
+
+.encrypt2.dec:
+
+        add in3, 120, in4
+
+        ld      [in4], out0               ! key 7531 first round
+        mov     LOOPS, out4               ! loop counter
+
+        ld      [in4+4], out1             ! key 8642 first round
+        sethi   %hi(0x0000FC00), local5
+
+        mov     in5, local1               ! left expected in out5
+        mov     out5, in5
+
+        call .des_dec
+        mov     local1, out5
+
+.encrypt2.finish:
+
+        ! rotate
+        sll     in5, 29, in0
+        srl     in5, 3, in5
+        sll     out5, 29, in1
+        add     in5, in0, in5
+        srl     out5, 3, out5
+        LDPTR   [%sp+BIAS+ARG0+0*ARGSZ], in0
+        add     out5, in1, out5
+        st      out5, [in0]
+        st      in5, [in0+4]
+
+        ret
+        restore
+
+.DES_encrypt2.end:
+        .size    DES_encrypt2, .DES_encrypt2.end-DES_encrypt2
+
+
+! void DES_encrypt3(data, ks1, ks2, ks3)
+! **************************************
+
+        .align 32
+        .global DES_encrypt3
+        .type    DES_encrypt3,#function
+
+DES_encrypt3:
+
+        save    %sp, FRAME, %sp
+        
+        call    .PIC.me.up
+        mov     .PIC.me.up-(.-4),out0
+
+        ld      [in0], in5                ! left
+        add     in2, 120, in4             ! ks2
+
+        ld      [in0+4], out5             ! right
+        mov     in3, in2                  ! save ks3
+
+        ! parameter 6  1/2 for include encryption/decryption
+        ! parameter 7  1 for mov in1 to in3
+        ! parameter 8  1 for mov in3 to in4
+        ! parameter 9  1 for load ks3 and ks2 to in4 and in3
+
+        ip_macro(in5, out5, in5, out5, in3, 1, 1, 0, 0)
+
+        call    .des_dec
+        mov     in2, in3                  ! preload ks3
+
+        call    .des_enc
+        nop
+
+        fp_macro(in5, out5, 1)
+
+        ret
+        restore
+
+.DES_encrypt3.end:
+        .size    DES_encrypt3,.DES_encrypt3.end-DES_encrypt3
+
+
+! void DES_decrypt3(data, ks1, ks2, ks3)
+! **************************************
+
+        .align 32
+        .global DES_decrypt3
+        .type    DES_decrypt3,#function
+
+DES_decrypt3:
+
+        save    %sp, FRAME, %sp
+        
+        call    .PIC.me.up
+        mov     .PIC.me.up-(.-4),out0
+
+        ld      [in0], in5                ! left
+        add     in3, 120, in4             ! ks3
+
+        ld      [in0+4], out5             ! right
+        mov     in2, in3                  ! ks2
+
+        ! parameter 6  1/2 for include encryption/decryption
+        ! parameter 7  1 for mov in1 to in3
+        ! parameter 8  1 for mov in3 to in4
+        ! parameter 9  1 for load ks3 and ks2 to in4 and in3
+
+        ip_macro(in5, out5, out5, in5, in4, 2, 0, 0, 0)
+
+        call    .des_enc
+        add     in1, 120, in4             ! preload ks1
+
+        call    .des_dec
+        nop
+
+        fp_macro(out5, in5, 1)
+
+        ret
+        restore
+
+.DES_decrypt3.end:
+        .size    DES_decrypt3,.DES_decrypt3.end-DES_decrypt3
+
+        .align  256
+        .type    .des_and,#object
+        .size    .des_and,284
+
+.des_and:
+
+! This table is used for AND 0xFC when it is known that register
+! bits 8-31 are zero. Makes it possible to do three arithmetic
+! operations in one cycle.
+
+        .byte  0, 0, 0, 0, 4, 4, 4, 4
+        .byte  8, 8, 8, 8, 12, 12, 12, 12
+        .byte  16, 16, 16, 16, 20, 20, 20, 20
+        .byte  24, 24, 24, 24, 28, 28, 28, 28
+        .byte  32, 32, 32, 32, 36, 36, 36, 36
+        .byte  40, 40, 40, 40, 44, 44, 44, 44
+        .byte  48, 48, 48, 48, 52, 52, 52, 52
+        .byte  56, 56, 56, 56, 60, 60, 60, 60
+        .byte  64, 64, 64, 64, 68, 68, 68, 68
+        .byte  72, 72, 72, 72, 76, 76, 76, 76
+        .byte  80, 80, 80, 80, 84, 84, 84, 84
+        .byte  88, 88, 88, 88, 92, 92, 92, 92
+        .byte  96, 96, 96, 96, 100, 100, 100, 100
+        .byte  104, 104, 104, 104, 108, 108, 108, 108
+        .byte  112, 112, 112, 112, 116, 116, 116, 116
+        .byte  120, 120, 120, 120, 124, 124, 124, 124
+        .byte  128, 128, 128, 128, 132, 132, 132, 132
+        .byte  136, 136, 136, 136, 140, 140, 140, 140
+        .byte  144, 144, 144, 144, 148, 148, 148, 148
+        .byte  152, 152, 152, 152, 156, 156, 156, 156
+        .byte  160, 160, 160, 160, 164, 164, 164, 164
+        .byte  168, 168, 168, 168, 172, 172, 172, 172
+        .byte  176, 176, 176, 176, 180, 180, 180, 180
+        .byte  184, 184, 184, 184, 188, 188, 188, 188
+        .byte  192, 192, 192, 192, 196, 196, 196, 196
+        .byte  200, 200, 200, 200, 204, 204, 204, 204
+        .byte  208, 208, 208, 208, 212, 212, 212, 212
+        .byte  216, 216, 216, 216, 220, 220, 220, 220
+        .byte  224, 224, 224, 224, 228, 228, 228, 228
+        .byte  232, 232, 232, 232, 236, 236, 236, 236
+        .byte  240, 240, 240, 240, 244, 244, 244, 244
+        .byte  248, 248, 248, 248, 252, 252, 252, 252
+
+        ! 5 numbers for initil/final permutation
+
+        .word   0x0f0f0f0f                ! offset 256
+        .word   0x0000ffff                ! 260
+        .word   0x33333333                ! 264
+        .word   0x00ff00ff                ! 268
+        .word   0x55555555                ! 272
+
+        .word   0                         ! 276
+        .word   LOOPS                     ! 280
+        .word   0x0000FC00                ! 284
+.PIC.DES_SPtrans:
+        .word   %r_disp32(DES_SPtrans)
+
+! input:        out0    offset between .PIC.me.up and caller
+! output:       out0    pointer to .PIC.me.up
+!               out2    pointer to .des_and
+!               global1 pointer to DES_SPtrans
+        .align  32
+.PIC.me.up:
+        add     out0,%o7,out0                   ! pointer to .PIC.me.up
+#if 1
+        ld      [out0+(.PIC.DES_SPtrans-.PIC.me.up)],global1
+        add     global1,(.PIC.DES_SPtrans-.PIC.me.up),global1
+        add     global1,out0,global1
+#else
+# ifdef OPENSSL_PIC
+        ! In case anybody wonders why this code is same for both ABI.
+        ! To start with it is not. Do note LDPTR below. But of course
+        ! you must be wondering why the rest of it does not contain
+        ! things like %hh, %hm and %lm. Well, those are needed only
+        ! if OpenSSL library *itself* will become larger than 4GB,
+        ! which is not going to happen any time soon. 
+        sethi   %hi(DES_SPtrans),global1
+        or      global1,%lo(DES_SPtrans),global1
+        sethi   %hi(_GLOBAL_OFFSET_TABLE_-(.PIC.me.up-.)),out2
+        add     global1,out0,global1
+        add     out2,%lo(_GLOBAL_OFFSET_TABLE_-(.PIC.me.up-.)),out2
+        LDPTR   [out2+global1],global1
+# elif 0
+        setn    DES_SPtrans,out2,global1        ! synthetic instruction !
+# elif defined(ABI64)
+        sethi   %hh(DES_SPtrans),out2
+        or      out2,%hm(DES_SPtrans),out2
+        sethi   %lm(DES_SPtrans),global1
+        or      global1,%lo(DES_SPtrans),global1
+        sllx    out2,32,out2
+        or      out2,global1,global1
+# else
+        sethi   %hi(DES_SPtrans),global1
+        or      global1,%lo(DES_SPtrans),global1
+# endif
+#endif
+        retl
+        add     out0,.des_and-.PIC.me.up,out2
+
+! void DES_ncbc_encrypt(input, output, length, schedule, ivec, enc)
+! *****************************************************************
+
+
+        .align 32
+        .global DES_ncbc_encrypt
+        .type    DES_ncbc_encrypt,#function
+
+DES_ncbc_encrypt:
+
+        save    %sp, FRAME, %sp
+        
+        define({INPUT},  { [%sp+BIAS+ARG0+0*ARGSZ] })
+        define({OUTPUT}, { [%sp+BIAS+ARG0+1*ARGSZ] })
+        define({IVEC},   { [%sp+BIAS+ARG0+4*ARGSZ] })
+
+        call    .PIC.me.up
+        mov     .PIC.me.up-(.-4),out0
+
+        cmp     in5, 0                    ! enc   
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        be,pn   %icc, .ncbc.dec
+#else
+        be      .ncbc.dec
+#endif
+        STPTR   in4, IVEC
+
+        ! addr  left  right  temp  label
+        load_little_endian(in4, in5, out5, local3, .LLE1)  ! iv
+
+        addcc   in2, -8, in2              ! bytes missing when first block done
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        bl,pn   %icc, .ncbc.enc.seven.or.less
+#else
+        bl      .ncbc.enc.seven.or.less
+#endif
+        mov     in3, in4                  ! schedule
+
+.ncbc.enc.next.block:
+
+        load_little_endian(in0, out4, global4, local3, .LLE2)  ! block
+
+.ncbc.enc.next.block_1:
+
+        xor     in5, out4, in5            ! iv xor
+        xor     out5, global4, out5       ! iv xor
+
+        ! parameter 8  1 for move in3 to in4, 2 for move in4 to in3
+        ip_macro(in5, out5, in5, out5, in3, 0, 0, 2)
+
+.ncbc.enc.next.block_2:
+
+!//     call .des_enc                     ! compares in2 to 8
+!       rounds inlined for alignment purposes
+
+        add     global1, 768, global4     ! address sbox 4 since register used below
+
+        rounds_macro(in5, out5, 1, .ncbc.enc.1, in3, in4) ! include encryption  ks in3
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        bl,pn   %icc, .ncbc.enc.next.block_fp
+#else
+        bl      .ncbc.enc.next.block_fp
+#endif
+        add     in0, 8, in0               ! input address
+
+        ! If 8 or more bytes are to be encrypted after this block,
+        ! we combine final permutation for this block with initial
+        ! permutation for next block. Load next block:
+
+        load_little_endian(in0, global3, global4, local5, .LLE12)
+
+        !  parameter 1   original left
+        !  parameter 2   original right
+        !  parameter 3   left ip
+        !  parameter 4   right ip
+        !  parameter 5   1: load ks1/ks2 to in3/in4, add 120 to in4
+        !                2: mov in4 to in3
+        !
+        ! also adds -8 to length in2 and loads loop counter to out4
+
+        fp_ip_macro(out0, out1, global3, global4, 2)
+
+        store_little_endian(in1, out0, out1, local3, .SLE10)  ! block
+
+        ld      [in3], out0               ! key 7531 first round next block
+        mov     in5, local1
+        xor     global3, out5, in5        ! iv xor next block
+
+        ld      [in3+4], out1             ! key 8642
+        add     global1, 512, global3     ! address sbox 3 since register used
+        xor     global4, local1, out5     ! iv xor next block
+
+        ba      .ncbc.enc.next.block_2
+        add     in1, 8, in1               ! output adress
+
+.ncbc.enc.next.block_fp:
+
+        fp_macro(in5, out5)
+
+        store_little_endian(in1, in5, out5, local3, .SLE1)  ! block
+
+        addcc   in2, -8, in2              ! bytes missing when next block done
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        bpos,pt %icc, .ncbc.enc.next.block  ! also jumps if 0
+#else
+        bpos    .ncbc.enc.next.block
+#endif
+        add     in1, 8, in1
+
+.ncbc.enc.seven.or.less:
+
+        cmp     in2, -8
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        ble,pt  %icc, .ncbc.enc.finish
+#else
+        ble     .ncbc.enc.finish
+#endif
+        nop
+
+        add     in2, 8, local1            ! bytes to load
+
+        ! addr, length, dest left, dest right, temp, temp2, label, ret label
+        load_n_bytes(in0, local1, global4, out4, local2, local3, .LNB1, .ncbc.enc.next.block_1)
+
+        ! Loads 1 to 7 bytes little endian to global4, out4
+
+
+.ncbc.enc.finish:
+
+        LDPTR   IVEC, local4
+        store_little_endian(local4, in5, out5, local5, .SLE2)  ! ivec
+
+        ret
+        restore
+
+
+.ncbc.dec:
+
+        STPTR   in0, INPUT
+        cmp     in2, 0                    ! length
+        add     in3, 120, in3
+
+        LDPTR   IVEC, local7              ! ivec
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        ble,pn  %icc, .ncbc.dec.finish
+#else
+        ble     .ncbc.dec.finish
+#endif
+        mov     in3, in4                  ! schedule
+
+        STPTR   in1, OUTPUT
+        mov     in0, local5               ! input
+
+        load_little_endian(local7, in0, in1, local3, .LLE3)   ! ivec
+
+.ncbc.dec.next.block:
+
+        load_little_endian(local5, in5, out5, local3, .LLE4)  ! block
+
+        ! parameter 6  1/2 for include encryption/decryption
+        ! parameter 7  1 for mov in1 to in3
+        ! parameter 8  1 for mov in3 to in4
+
+        ip_macro(in5, out5, out5, in5, in4, 2, 0, 1) ! include decryprion  ks in4
+
+        fp_macro(out5, in5, 0, 1) ! 1 for input and output address to local5/7
+
+        ! in2 is bytes left to be stored
+        ! in2 is compared to 8 in the rounds
+
+        xor     out5, in0, out4           ! iv xor
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        bl,pn   %icc, .ncbc.dec.seven.or.less
+#else
+        bl      .ncbc.dec.seven.or.less
+#endif
+        xor     in5, in1, global4         ! iv xor
+
+        ! Load ivec next block now, since input and output address might be the same.
+
+        load_little_endian_inc(local5, in0, in1, local3, .LLE5)  ! iv
+
+        store_little_endian(local7, out4, global4, local3, .SLE3)
+
+        STPTR   local5, INPUT
+        add     local7, 8, local7
+        addcc   in2, -8, in2
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        bg,pt   %icc, .ncbc.dec.next.block
+#else
+        bg      .ncbc.dec.next.block
+#endif
+        STPTR   local7, OUTPUT
+
+
+.ncbc.dec.store.iv:
+
+        LDPTR   IVEC, local4              ! ivec
+        store_little_endian(local4, in0, in1, local5, .SLE4)
+
+.ncbc.dec.finish:
+
+        ret
+        restore
+
+.ncbc.dec.seven.or.less:
+
+        load_little_endian_inc(local5, in0, in1, local3, .LLE13)     ! ivec
+
+        store_n_bytes(local7, in2, global4, out4, local3, local4, .SNB1, .ncbc.dec.store.iv)
+
+
+.DES_ncbc_encrypt.end:
+        .size    DES_ncbc_encrypt, .DES_ncbc_encrypt.end-DES_ncbc_encrypt
+
+
+! void DES_ede3_cbc_encrypt(input, output, lenght, ks1, ks2, ks3, ivec, enc)
+! **************************************************************************
+
+
+        .align 32
+        .global DES_ede3_cbc_encrypt
+        .type    DES_ede3_cbc_encrypt,#function
+
+DES_ede3_cbc_encrypt:
+
+        save    %sp, FRAME, %sp
+
+        define({KS1}, { [%sp+BIAS+ARG0+3*ARGSZ] })
+        define({KS2}, { [%sp+BIAS+ARG0+4*ARGSZ] })
+        define({KS3}, { [%sp+BIAS+ARG0+5*ARGSZ] })
+
+        call    .PIC.me.up
+        mov     .PIC.me.up-(.-4),out0
+
+        LDPTR   [%fp+BIAS+ARG0+7*ARGSZ], local3          ! enc
+        LDPTR   [%fp+BIAS+ARG0+6*ARGSZ], local4          ! ivec
+        cmp     local3, 0                 ! enc
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        be,pn   %icc, .ede3.dec
+#else
+        be      .ede3.dec
+#endif
+        STPTR   in4, KS2
+
+        STPTR   in5, KS3
+
+        load_little_endian(local4, in5, out5, local3, .LLE6)  ! ivec
+
+        addcc   in2, -8, in2              ! bytes missing after next block
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        bl,pn   %icc,  .ede3.enc.seven.or.less
+#else
+        bl      .ede3.enc.seven.or.less
+#endif
+        STPTR   in3, KS1
+
+.ede3.enc.next.block:
+
+        load_little_endian(in0, out4, global4, local3, .LLE7)
+
+.ede3.enc.next.block_1:
+
+        LDPTR   KS2, in4
+        xor     in5, out4, in5            ! iv xor
+        xor     out5, global4, out5       ! iv xor
+
+        LDPTR   KS1, in3
+        add     in4, 120, in4             ! for decryption we use last subkey first
+        nop
+
+        ip_macro(in5, out5, in5, out5, in3)
+
+.ede3.enc.next.block_2:
+
+        call .des_enc                     ! ks1 in3
+        nop
+
+        call .des_dec                     ! ks2 in4
+        LDPTR   KS3, in3
+
+        call .des_enc                     ! ks3 in3  compares in2 to 8
+        nop
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        bl,pn   %icc, .ede3.enc.next.block_fp
+#else
+        bl      .ede3.enc.next.block_fp
+#endif
+        add     in0, 8, in0
+
+        ! If 8 or more bytes are to be encrypted after this block,
+        ! we combine final permutation for this block with initial
+        ! permutation for next block. Load next block:
+
+        load_little_endian(in0, global3, global4, local5, .LLE11)
+
+        !  parameter 1   original left
+        !  parameter 2   original right
+        !  parameter 3   left ip
+        !  parameter 4   right ip
+        !  parameter 5   1: load ks1/ks2 to in3/in4, add 120 to in4
+        !                2: mov in4 to in3
+        !
+        ! also adds -8 to length in2 and loads loop counter to out4
+
+        fp_ip_macro(out0, out1, global3, global4, 1)
+
+        store_little_endian(in1, out0, out1, local3, .SLE9)  ! block
+
+        mov     in5, local1
+        xor     global3, out5, in5        ! iv xor next block
+
+        ld      [in3], out0               ! key 7531
+        add     global1, 512, global3     ! address sbox 3
+        xor     global4, local1, out5     ! iv xor next block
+
+        ld      [in3+4], out1             ! key 8642
+        add     global1, 768, global4     ! address sbox 4
+        ba      .ede3.enc.next.block_2
+        add     in1, 8, in1
+
+.ede3.enc.next.block_fp:
+
+        fp_macro(in5, out5)
+
+        store_little_endian(in1, in5, out5, local3, .SLE5)  ! block
+
+        addcc   in2, -8, in2              ! bytes missing when next block done
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        bpos,pt %icc, .ede3.enc.next.block
+#else
+        bpos    .ede3.enc.next.block
+#endif
+        add     in1, 8, in1
+
+.ede3.enc.seven.or.less:
+
+        cmp     in2, -8
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        ble,pt  %icc, .ede3.enc.finish
+#else
+        ble     .ede3.enc.finish
+#endif
+        nop
+
+        add     in2, 8, local1            ! bytes to load
+
+        ! addr, length, dest left, dest right, temp, temp2, label, ret label
+        load_n_bytes(in0, local1, global4, out4, local2, local3, .LNB2, .ede3.enc.next.block_1)
+
+.ede3.enc.finish:
+
+        LDPTR   [%fp+BIAS+ARG0+6*ARGSZ], local4          ! ivec
+        store_little_endian(local4, in5, out5, local5, .SLE6)  ! ivec
+
+        ret
+        restore
+
+.ede3.dec:
+
+        STPTR   in0, INPUT
+        add     in5, 120, in5
+
+        STPTR   in1, OUTPUT
+        mov     in0, local5
+        add     in3, 120, in3
+
+        STPTR   in3, KS1
+        cmp     in2, 0
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        ble     %icc, .ede3.dec.finish
+#else
+        ble     .ede3.dec.finish
+#endif
+        STPTR   in5, KS3
+
+        LDPTR   [%fp+BIAS+ARG0+6*ARGSZ], local7          ! iv
+        load_little_endian(local7, in0, in1, local3, .LLE8)
+
+.ede3.dec.next.block:
+
+        load_little_endian(local5, in5, out5, local3, .LLE9)
+
+        ! parameter 6  1/2 for include encryption/decryption
+        ! parameter 7  1 for mov in1 to in3
+        ! parameter 8  1 for mov in3 to in4
+        ! parameter 9  1 for load ks3 and ks2 to in4 and in3
+
+        ip_macro(in5, out5, out5, in5, in4, 2, 0, 0, 1) ! inc .des_dec ks3 in4
+
+        call .des_enc                     ! ks2 in3
+        LDPTR   KS1, in4
+
+        call .des_dec                     ! ks1 in4
+        nop
+
+        fp_macro(out5, in5, 0, 1)   ! 1 for input and output address local5/7
+
+        ! in2 is bytes left to be stored
+        ! in2 is compared to 8 in the rounds
+
+        xor     out5, in0, out4
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        bl,pn   %icc, .ede3.dec.seven.or.less
+#else
+        bl      .ede3.dec.seven.or.less
+#endif
+        xor     in5, in1, global4
+
+        load_little_endian_inc(local5, in0, in1, local3, .LLE10)   ! iv next block
+
+        store_little_endian(local7, out4, global4, local3, .SLE7)  ! block
+
+        STPTR   local5, INPUT
+        addcc   in2, -8, in2
+        add     local7, 8, local7
+
+#ifdef OPENSSL_SYSNAME_ULTRASPARC
+        bg,pt   %icc, .ede3.dec.next.block
+#else
+        bg      .ede3.dec.next.block
+#endif
+        STPTR   local7, OUTPUT
+
+.ede3.dec.store.iv:
+
+        LDPTR   [%fp+BIAS+ARG0+6*ARGSZ], local4          ! ivec
+        store_little_endian(local4, in0, in1, local5, .SLE8)  ! ivec
+
+.ede3.dec.finish:
+
+        ret
+        restore
+
+.ede3.dec.seven.or.less:
+
+        load_little_endian_inc(local5, in0, in1, local3, .LLE14)     ! iv
+
+        store_n_bytes(local7, in2, global4, out4, local3, local4, .SNB2, .ede3.dec.store.iv)
+
+
+.DES_ede3_cbc_encrypt.end:
+        .size    DES_ede3_cbc_encrypt,.DES_ede3_cbc_encrypt.end-DES_ede3_cbc_encrypt
diff --git a/src/lib/libssl/src/crypto/dh/dh_depr.c b/src/lib/libssl/src/crypto/dh/dh_depr.c
new file mode 100644
index 0000000000..acc05f252c
--- /dev/null
+++ b/src/lib/libssl/src/crypto/dh/dh_depr.c
@@ -0,0 +1,83 @@
+/* crypto/dh/dh_depr.c */
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+/* This file contains deprecated functions as wrappers to the new ones */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/bn.h>
+#include <openssl/dh.h>
+
+static void *dummy=&dummy;
+
+#ifndef OPENSSL_NO_DEPRECATED
+DH *DH_generate_parameters(int prime_len, int generator,
+             void (*callback)(int,int,void *), void *cb_arg)
+        {
+        BN_GENCB cb;
+        DH *ret=NULL;
+
+        if((ret=DH_new()) == NULL)
+                return NULL;
+
+        BN_GENCB_set_old(&cb, callback, cb_arg);
+
+        if(DH_generate_parameters_ex(ret, prime_len, generator, &cb))
+                return ret;
+        DH_free(ret);
+        return NULL;
+        }
+#endif
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_depr.c b/src/lib/libssl/src/crypto/dsa/dsa_depr.c
new file mode 100644
index 0000000000..f2da680eb4
--- /dev/null
+++ b/src/lib/libssl/src/crypto/dsa/dsa_depr.c
@@ -0,0 +1,106 @@
+/* crypto/dsa/dsa_depr.c */
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* This file contains deprecated function(s) that are now wrappers to the new
+ * version(s). */
+
+#undef GENUINE_DSA
+
+#ifdef GENUINE_DSA
+/* Parameter generation follows the original release of FIPS PUB 186,
+ * Appendix 2.2 (i.e. use SHA as defined in FIPS PUB 180) */
+#define HASH    EVP_sha()
+#else
+/* Parameter generation follows the updated Appendix 2.2 for FIPS PUB 186,
+ * also Appendix 2.2 of FIPS PUB 186-1 (i.e. use SHA as defined in
+ * FIPS PUB 180-1) */
+#define HASH    EVP_sha1()
+#endif 
+
+static void *dummy=&dummy;
+
+#ifndef OPENSSL_NO_SHA
+
+#include <stdio.h>
+#include <time.h>
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/bn.h>
+#include <openssl/dsa.h>
+#include <openssl/rand.h>
+#include <openssl/sha.h>
+
+#ifndef OPENSSL_NO_DEPRECATED
+DSA *DSA_generate_parameters(int bits,
+                unsigned char *seed_in, int seed_len,
+                int *counter_ret, unsigned long *h_ret,
+                void (*callback)(int, int, void *),
+                void *cb_arg)
+        {
+        BN_GENCB cb;
+        DSA *ret;
+
+        if ((ret=DSA_new()) == NULL) return NULL;
+
+        BN_GENCB_set_old(&cb, callback, cb_arg);
+
+        if(DSA_generate_parameters_ex(ret, bits, seed_in, seed_len,
+                                counter_ret, h_ret, &cb))
+                return ret;
+        DSA_free(ret);
+        return NULL;
+        }
+#endif
+#endif
diff --git a/src/lib/libssl/src/crypto/ec/ec2_mult.c b/src/lib/libssl/src/crypto/ec/ec2_mult.c
new file mode 100644
index 0000000000..ff368fd7d7
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ec/ec2_mult.c
@@ -0,0 +1,380 @@
+/* crypto/ec/ec2_mult.c */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
+ * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
+ * to the OpenSSL project.
+ *
+ * The ECC Code is licensed pursuant to the OpenSSL open source
+ * license provided below.
+ *
+ * The software is originally written by Sheueling Chang Shantz and
+ * Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <openssl/err.h>
+
+#include "ec_lcl.h"
+
+
+/* Compute the x-coordinate x/z for the point 2*(x/z) in Montgomery projective 
+ * coordinates.
+ * Uses algorithm Mdouble in appendix of 
+ *     Lopez, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
+ *     GF(2^m) without precomputation".
+ * modified to not require precomputation of c=b^{2^{m-1}}.
+ */
+static int gf2m_Mdouble(const EC_GROUP *group, BIGNUM *x, BIGNUM *z, BN_CTX *ctx)
+        {
+        BIGNUM *t1;
+        int ret = 0;
+        
+        /* Since Mdouble is static we can guarantee that ctx != NULL. */
+        BN_CTX_start(ctx);
+        t1 = BN_CTX_get(ctx);
+        if (t1 == NULL) goto err;
+
+        if (!group->meth->field_sqr(group, x, x, ctx)) goto err;
+        if (!group->meth->field_sqr(group, t1, z, ctx)) goto err;
+        if (!group->meth->field_mul(group, z, x, t1, ctx)) goto err;
+        if (!group->meth->field_sqr(group, x, x, ctx)) goto err;
+        if (!group->meth->field_sqr(group, t1, t1, ctx)) goto err;
+        if (!group->meth->field_mul(group, t1, &group->b, t1, ctx)) goto err;
+        if (!BN_GF2m_add(x, x, t1)) goto err;
+
+        ret = 1;
+
+ err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+
+/* Compute the x-coordinate x1/z1 for the point (x1/z1)+(x2/x2) in Montgomery 
+ * projective coordinates.
+ * Uses algorithm Madd in appendix of 
+ *     Lopex, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
+ *     GF(2^m) without precomputation".
+ */
+static int gf2m_Madd(const EC_GROUP *group, const BIGNUM *x, BIGNUM *x1, BIGNUM *z1, 
+        const BIGNUM *x2, const BIGNUM *z2, BN_CTX *ctx)
+        {
+        BIGNUM *t1, *t2;
+        int ret = 0;
+        
+        /* Since Madd is static we can guarantee that ctx != NULL. */
+        BN_CTX_start(ctx);
+        t1 = BN_CTX_get(ctx);
+        t2 = BN_CTX_get(ctx);
+        if (t2 == NULL) goto err;
+
+        if (!BN_copy(t1, x)) goto err;
+        if (!group->meth->field_mul(group, x1, x1, z2, ctx)) goto err;
+        if (!group->meth->field_mul(group, z1, z1, x2, ctx)) goto err;
+        if (!group->meth->field_mul(group, t2, x1, z1, ctx)) goto err;
+        if (!BN_GF2m_add(z1, z1, x1)) goto err;
+        if (!group->meth->field_sqr(group, z1, z1, ctx)) goto err;
+        if (!group->meth->field_mul(group, x1, z1, t1, ctx)) goto err;
+        if (!BN_GF2m_add(x1, x1, t2)) goto err;
+
+        ret = 1;
+
+ err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+
+/* Compute the x, y affine coordinates from the point (x1, z1) (x2, z2) 
+ * using Montgomery point multiplication algorithm Mxy() in appendix of 
+ *     Lopex, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
+ *     GF(2^m) without precomputation".
+ * Returns:
+ *     0 on error
+ *     1 if return value should be the point at infinity
+ *     2 otherwise
+ */
+static int gf2m_Mxy(const EC_GROUP *group, const BIGNUM *x, const BIGNUM *y, BIGNUM *x1, 
+        BIGNUM *z1, BIGNUM *x2, BIGNUM *z2, BN_CTX *ctx)
+        {
+        BIGNUM *t3, *t4, *t5;
+        int ret = 0;
+        
+        if (BN_is_zero(z1))
+                {
+                BN_zero(x2);
+                BN_zero(z2);
+                return 1;
+                }
+        
+        if (BN_is_zero(z2))
+                {
+                if (!BN_copy(x2, x)) return 0;
+                if (!BN_GF2m_add(z2, x, y)) return 0;
+                return 2;
+                }
+                
+        /* Since Mxy is static we can guarantee that ctx != NULL. */
+        BN_CTX_start(ctx);
+        t3 = BN_CTX_get(ctx);
+        t4 = BN_CTX_get(ctx);
+        t5 = BN_CTX_get(ctx);
+        if (t5 == NULL) goto err;
+
+        if (!BN_one(t5)) goto err;
+
+        if (!group->meth->field_mul(group, t3, z1, z2, ctx)) goto err;
+
+        if (!group->meth->field_mul(group, z1, z1, x, ctx)) goto err;
+        if (!BN_GF2m_add(z1, z1, x1)) goto err;
+        if (!group->meth->field_mul(group, z2, z2, x, ctx)) goto err;
+        if (!group->meth->field_mul(group, x1, z2, x1, ctx)) goto err;
+        if (!BN_GF2m_add(z2, z2, x2)) goto err;
+
+        if (!group->meth->field_mul(group, z2, z2, z1, ctx)) goto err;
+        if (!group->meth->field_sqr(group, t4, x, ctx)) goto err;
+        if (!BN_GF2m_add(t4, t4, y)) goto err;
+        if (!group->meth->field_mul(group, t4, t4, t3, ctx)) goto err;
+        if (!BN_GF2m_add(t4, t4, z2)) goto err;
+
+        if (!group->meth->field_mul(group, t3, t3, x, ctx)) goto err;
+        if (!group->meth->field_div(group, t3, t5, t3, ctx)) goto err;
+        if (!group->meth->field_mul(group, t4, t3, t4, ctx)) goto err;
+        if (!group->meth->field_mul(group, x2, x1, t3, ctx)) goto err;
+        if (!BN_GF2m_add(z2, x2, x)) goto err;
+
+        if (!group->meth->field_mul(group, z2, z2, t4, ctx)) goto err;
+        if (!BN_GF2m_add(z2, z2, y)) goto err;
+
+        ret = 2;
+
+ err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+
+/* Computes scalar*point and stores the result in r.
+ * point can not equal r.
+ * Uses algorithm 2P of
+ *     Lopex, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
+ *     GF(2^m) without precomputation".
+ */
+static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
+        const EC_POINT *point, BN_CTX *ctx)
+        {
+        BIGNUM *x1, *x2, *z1, *z2;
+        int ret = 0, i, j;
+        BN_ULONG mask;
+
+        if (r == point)
+                {
+                ECerr(EC_F_EC_GF2M_MONTGOMERY_POINT_MULTIPLY, EC_R_INVALID_ARGUMENT);
+                return 0;
+                }
+        
+        /* if result should be point at infinity */
+        if ((scalar == NULL) || BN_is_zero(scalar) || (point == NULL) || 
+                EC_POINT_is_at_infinity(group, point))
+                {
+                return EC_POINT_set_to_infinity(group, r);
+                }
+
+        /* only support affine coordinates */
+        if (!point->Z_is_one) return 0;
+
+        /* Since point_multiply is static we can guarantee that ctx != NULL. */
+        BN_CTX_start(ctx);
+        x1 = BN_CTX_get(ctx);
+        z1 = BN_CTX_get(ctx);
+        if (z1 == NULL) goto err;
+
+        x2 = &r->X;
+        z2 = &r->Y;
+
+        if (!BN_GF2m_mod_arr(x1, &point->X, group->poly)) goto err; /* x1 = x */
+        if (!BN_one(z1)) goto err; /* z1 = 1 */
+        if (!group->meth->field_sqr(group, z2, x1, ctx)) goto err; /* z2 = x1^2 = x^2 */
+        if (!group->meth->field_sqr(group, x2, z2, ctx)) goto err;
+        if (!BN_GF2m_add(x2, x2, &group->b)) goto err; /* x2 = x^4 + b */
+
+        /* find top most bit and go one past it */
+        i = scalar->top - 1; j = BN_BITS2 - 1;
+        mask = BN_TBIT;
+        while (!(scalar->d[i] & mask)) { mask >>= 1; j--; }
+        mask >>= 1; j--;
+        /* if top most bit was at word break, go to next word */
+        if (!mask) 
+                {
+                i--; j = BN_BITS2 - 1;
+                mask = BN_TBIT;
+                }
+
+        for (; i >= 0; i--)
+                {
+                for (; j >= 0; j--)
+                        {
+                        if (scalar->d[i] & mask)
+                                {
+                                if (!gf2m_Madd(group, &point->X, x1, z1, x2, z2, ctx)) goto err;
+                                if (!gf2m_Mdouble(group, x2, z2, ctx)) goto err;
+                                }
+                        else
+                                {
+                                if (!gf2m_Madd(group, &point->X, x2, z2, x1, z1, ctx)) goto err;
+                                if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;
+                                }
+                        mask >>= 1;
+                        }
+                j = BN_BITS2 - 1;
+                mask = BN_TBIT;
+                }
+
+        /* convert out of "projective" coordinates */
+        i = gf2m_Mxy(group, &point->X, &point->Y, x1, z1, x2, z2, ctx);
+        if (i == 0) goto err;
+        else if (i == 1) 
+                {
+                if (!EC_POINT_set_to_infinity(group, r)) goto err;
+                }
+        else
+                {
+                if (!BN_one(&r->Z)) goto err;
+                r->Z_is_one = 1;
+                }
+
+        /* GF(2^m) field elements should always have BIGNUM::neg = 0 */
+        BN_set_negative(&r->X, 0);
+        BN_set_negative(&r->Y, 0);
+
+        ret = 1;
+
+ err:
+        BN_CTX_end(ctx);
+        return ret;
+        }
+
+
+/* Computes the sum
+ *     scalar*group->generator + scalars[0]*points[0] + ... + scalars[num-1]*points[num-1]
+ * gracefully ignoring NULL scalar values.
+ */
+int ec_GF2m_simple_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
+        size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx)
+        {
+        BN_CTX *new_ctx = NULL;
+        int ret = 0;
+        size_t i;
+        EC_POINT *p=NULL;
+
+        if (ctx == NULL)
+                {
+                ctx = new_ctx = BN_CTX_new();
+                if (ctx == NULL)
+                        return 0;
+                }
+
+        /* This implementation is more efficient than the wNAF implementation for 2
+         * or fewer points.  Use the ec_wNAF_mul implementation for 3 or more points,
+         * or if we can perform a fast multiplication based on precomputation.
+         */
+        if ((scalar && (num > 1)) || (num > 2) || (num == 0 && EC_GROUP_have_precompute_mult(group)))
+                {
+                ret = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
+                goto err;
+                }
+
+        if ((p = EC_POINT_new(group)) == NULL) goto err;
+
+        if (!EC_POINT_set_to_infinity(group, r)) goto err;
+
+        if (scalar)
+                {
+                if (!ec_GF2m_montgomery_point_multiply(group, p, scalar, group->generator, ctx)) goto err;
+                if (BN_is_negative(scalar)) 
+                        if (!group->meth->invert(group, p, ctx)) goto err;
+                if (!group->meth->add(group, r, r, p, ctx)) goto err;
+                }
+
+        for (i = 0; i < num; i++)
+                {
+                if (!ec_GF2m_montgomery_point_multiply(group, p, scalars[i], points[i], ctx)) goto err;
+                if (BN_is_negative(scalars[i]))
+                        if (!group->meth->invert(group, p, ctx)) goto err;
+                if (!group->meth->add(group, r, r, p, ctx)) goto err;
+                }
+
+        ret = 1;
+
+  err:
+        if (p) EC_POINT_free(p);
+        if (new_ctx != NULL)
+                BN_CTX_free(new_ctx);
+        return ret;
+        }
+
+
+/* Precomputation for point multiplication: fall back to wNAF methods
+ * because ec_GF2m_simple_mul() uses ec_wNAF_mul() if appropriate */
+
+int ec_GF2m_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
+        {
+        return ec_wNAF_precompute_mult(group, ctx);
+        }
+
+int ec_GF2m_have_precompute_mult(const EC_GROUP *group)
+        {
+        return ec_wNAF_have_precompute_mult(group);
+        }
diff --git a/src/lib/libssl/src/crypto/ec/ec2_smpl.c b/src/lib/libssl/src/crypto/ec/ec2_smpl.c
new file mode 100644
index 0000000000..5cd1eac41f
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ec/ec2_smpl.c
@@ -0,0 +1,971 @@
+/* crypto/ec/ec2_smpl.c */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
+ * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
+ * to the OpenSSL project.
+ *
+ * The ECC Code is licensed pursuant to the OpenSSL open source
+ * license provided below.
+ *
+ * The software is originally written by Sheueling Chang Shantz and
+ * Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <openssl/err.h>
+
+#include "ec_lcl.h"
+
+
+const EC_METHOD *EC_GF2m_simple_method(void)
+        {
+        static const EC_METHOD ret = {
+                NID_X9_62_characteristic_two_field,
+                ec_GF2m_simple_group_init,
+                ec_GF2m_simple_group_finish,
+                ec_GF2m_simple_group_clear_finish,
+                ec_GF2m_simple_group_copy,
+                ec_GF2m_simple_group_set_curve,
+                ec_GF2m_simple_group_get_curve,
+                ec_GF2m_simple_group_get_degree,
+                ec_GF2m_simple_group_check_discriminant,
+                ec_GF2m_simple_point_init,
+                ec_GF2m_simple_point_finish,
+                ec_GF2m_simple_point_clear_finish,
+                ec_GF2m_simple_point_copy,
+                ec_GF2m_simple_point_set_to_infinity,
+                0 /* set_Jprojective_coordinates_GFp */,
+                0 /* get_Jprojective_coordinates_GFp */,
+                ec_GF2m_simple_point_set_affine_coordinates,
+                ec_GF2m_simple_point_get_affine_coordinates,
+                ec_GF2m_simple_set_compressed_coordinates,
+                ec_GF2m_simple_point2oct,
+                ec_GF2m_simple_oct2point,
+                ec_GF2m_simple_add,
+                ec_GF2m_simple_dbl,
+                ec_GF2m_simple_invert,
+                ec_GF2m_simple_is_at_infinity,
+                ec_GF2m_simple_is_on_curve,
+                ec_GF2m_simple_cmp,
+                ec_GF2m_simple_make_affine,
+                ec_GF2m_simple_points_make_affine,
+
+                /* the following three method functions are defined in ec2_mult.c */
+                ec_GF2m_simple_mul,
+                ec_GF2m_precompute_mult,
+                ec_GF2m_have_precompute_mult,
+
+                ec_GF2m_simple_field_mul,
+                ec_GF2m_simple_field_sqr,
+                ec_GF2m_simple_field_div,
+                0 /* field_encode */,
+                0 /* field_decode */,
+                0 /* field_set_to_one */ };
+
+        return &ret;
+        }
+
+
+/* Initialize a GF(2^m)-based EC_GROUP structure.
+ * Note that all other members are handled by EC_GROUP_new.
+ */
+int ec_GF2m_simple_group_init(EC_GROUP *group)
+        {
+        BN_init(&group->field);
+        BN_init(&group->a);
+        BN_init(&group->b);
+        return 1;
+        }
+
+
+/* Free a GF(2^m)-based EC_GROUP structure.
+ * Note that all other members are handled by EC_GROUP_free.
+ */
+void ec_GF2m_simple_group_finish(EC_GROUP *group)
+        {
+        BN_free(&group->field);
+        BN_free(&group->a);
+        BN_free(&group->b);
+        }
+
+
+/* Clear and free a GF(2^m)-based EC_GROUP structure.
+ * Note that all other members are handled by EC_GROUP_clear_free.
+ */
+void ec_GF2m_simple_group_clear_finish(EC_GROUP *group)
+        {
+        BN_clear_free(&group->field);
+        BN_clear_free(&group->a);
+        BN_clear_free(&group->b);
+        group->poly[0] = 0;
+        group->poly[1] = 0;
+        group->poly[2] = 0;
+        group->poly[3] = 0;
+        group->poly[4] = 0;
+        }
+
+
+/* Copy a GF(2^m)-based EC_GROUP structure.
+ * Note that all other members are handled by EC_GROUP_copy.
+ */
+int ec_GF2m_simple_group_copy(EC_GROUP *dest, const EC_GROUP *src)
+        {
+        int i;
+        if (!BN_copy(&dest->field, &src->field)) return 0;
+        if (!BN_copy(&dest->a, &src->a)) return 0;
+        if (!BN_copy(&dest->b, &src->b)) return 0;
+        dest->poly[0] = src->poly[0];
+        dest->poly[1] = src->poly[1];
+        dest->poly[2] = src->poly[2];
+        dest->poly[3] = src->poly[3];
+        dest->poly[4] = src->poly[4];
+        bn_wexpand(&dest->a, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2);
+        bn_wexpand(&dest->b, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2);
+        for (i = dest->a.top; i < dest->a.dmax; i++) dest->a.d[i] = 0;
+        for (i = dest->b.top; i < dest->b.dmax; i++) dest->b.d[i] = 0;
+        return 1;
+        }
+
+
+/* Set the curve parameters of an EC_GROUP structure. */
+int ec_GF2m_simple_group_set_curve(EC_GROUP *group,
+        const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
+        {
+        int ret = 0, i;
+
+        /* group->field */
+        if (!BN_copy(&group->field, p)) goto err;
+        i = BN_GF2m_poly2arr(&group->field, group->poly, 5);
+        if ((i != 5) && (i != 3))
+                {
+                ECerr(EC_F_EC_GF2M_SIMPLE_GROUP_SET_CURVE, EC_R_UNSUPPORTED_FIELD);
+                goto err;
+                }
+
+        /* group->a */
+        if (!BN_GF2m_mod_arr(&group->a, a, group->poly)) goto err;
+        bn_wexpand(&group->a, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2);
+        for (i = group->a.top; i < group->a.dmax; i++) group->a.d[i] = 0;
+        
+        /* group->b */
+        if (!BN_GF2m_mod_arr(&group->b, b, group->poly)) goto err;
+        bn_wexpand(&group->b, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2);
+        for (i = group->b.top; i < group->b.dmax; i++) group->b.d[i] = 0;
+                
+        ret = 1;
+  err:
+        return ret;
+        }
+
+
+/* Get the curve parameters of an EC_GROUP structure.
+ * If p, a, or b are NULL then there values will not be set but the method will return with success.
+ */
+int ec_GF2m_simple_group_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
+        {
+        int ret = 0;
+        
+        if (p != NULL)
+                {
+                if (!BN_copy(p, &group->field)) return 0;
+                }
+
+        if (a != NULL)
+                {
+                if (!BN_copy(a, &group->a)) goto err;
+                }
+
+        if (b != NULL)
+                {
+                if (!BN_copy(b, &group->b)) goto err;
+                }
+        
+        ret = 1;
+        
+  err:
+        return ret;
+        }
+
+
+/* Gets the degree of the field.  For a curve over GF(2^m) this is the value m. */
+int ec_GF2m_simple_group_get_degree(const EC_GROUP *group)
+        {
+        return BN_num_bits(&group->field)-1;
+        }
+
+
+/* Checks the discriminant of the curve.
+ * y^2 + x*y = x^3 + a*x^2 + b is an elliptic curve <=> b != 0 (mod p) 
+ */
+int ec_GF2m_simple_group_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
+        {
+        int ret = 0;
+        BIGNUM *b;
+        BN_CTX *new_ctx = NULL;
+
+        if (ctx == NULL)
+                {
+                ctx = new_ctx = BN_CTX_new();
+                if (ctx == NULL)
+                        {
+                        ECerr(EC_F_EC_GF2M_SIMPLE_GROUP_CHECK_DISCRIMINANT, ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                }
+        BN_CTX_start(ctx);
+        b = BN_CTX_get(ctx);
+        if (b == NULL) goto err;
+
+        if (!BN_GF2m_mod_arr(b, &group->b, group->poly)) goto err;
+        
+        /* check the discriminant:
+         * y^2 + x*y = x^3 + a*x^2 + b is an elliptic curve <=> b != 0 (mod p) 
+         */
+        if (BN_is_zero(b)) goto err;
+
+        ret = 1;
+
+err:
+        if (ctx != NULL)
+                BN_CTX_end(ctx);
+        if (new_ctx != NULL)
+                BN_CTX_free(new_ctx);
+        return ret;
+        }
+
+
+/* Initializes an EC_POINT. */
+int ec_GF2m_simple_point_init(EC_POINT *point)
+        {
+        BN_init(&point->X);
+        BN_init(&point->Y);
+        BN_init(&point->Z);
+        return 1;
+        }
+
+
+/* Frees an EC_POINT. */
+void ec_GF2m_simple_point_finish(EC_POINT *point)
+        {
+        BN_free(&point->X);
+        BN_free(&point->Y);
+        BN_free(&point->Z);
+        }
+
+
+/* Clears and frees an EC_POINT. */
+void ec_GF2m_simple_point_clear_finish(EC_POINT *point)
+        {
+        BN_clear_free(&point->X);
+        BN_clear_free(&point->Y);
+        BN_clear_free(&point->Z);
+        point->Z_is_one = 0;
+        }
+
+
+/* Copy the contents of one EC_POINT into another.  Assumes dest is initialized. */
+int ec_GF2m_simple_point_copy(EC_POINT *dest, const EC_POINT *src)
+        {
+        if (!BN_copy(&dest->X, &src->X)) return 0;
+        if (!BN_copy(&dest->Y, &src->Y)) return 0;
+        if (!BN_copy(&dest->Z, &src->Z)) return 0;
+        dest->Z_is_one = src->Z_is_one;
+
+        return 1;
+        }
+
+
+/* Set an EC_POINT to the point at infinity.  
+ * A point at infinity is represented by having Z=0.
+ */
+int ec_GF2m_simple_point_set_to_infinity(const EC_GROUP *group, EC_POINT *point)
+        {
+        point->Z_is_one = 0;
+        BN_zero(&point->Z);
+        return 1;
+        }
+
+
+/* Set the coordinates of an EC_POINT using affine coordinates. 
+ * Note that the simple implementation only uses affine coordinates.
+ */
+int ec_GF2m_simple_point_set_affine_coordinates(const EC_GROUP *group, EC_POINT *point,
+        const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx)
+        {
+        int ret = 0;    
+        if (x == NULL || y == NULL)
+                {
+                ECerr(EC_F_EC_GF2M_SIMPLE_POINT_SET_AFFINE_COORDINATES, ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+
+        if (!BN_copy(&point->X, x)) goto err;
+        BN_set_negative(&point->X, 0);
+        if (!BN_copy(&point->Y, y)) goto err;
+        BN_set_negative(&point->Y, 0);
+        if (!BN_copy(&point->Z, BN_value_one())) goto err;
+        BN_set_negative(&point->Z, 0);
+        point->Z_is_one = 1;
+        ret = 1;
+
+  err:
+        return ret;
+        }
+
+
+/* Gets the affine coordinates of an EC_POINT. 
+ * Note that the simple implementation only uses affine coordinates.
+ */
+int ec_GF2m_simple_point_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *point,
+        BIGNUM *x, BIGNUM *y, BN_CTX *ctx)
+        {
+        int ret = 0;
+
+        if (EC_POINT_is_at_infinity(group, point))
+                {
+                ECerr(EC_F_EC_GF2M_SIMPLE_POINT_GET_AFFINE_COORDINATES, EC_R_POINT_AT_INFINITY);
+                return 0;
+                }
+
+        if (BN_cmp(&point->Z, BN_value_one())) 
+                {
+                ECerr(EC_F_EC_GF2M_SIMPLE_POINT_GET_AFFINE_COORDINATES, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return 0;
+                }
+        if (x != NULL)
+                {
+                if (!BN_copy(x, &point->X)) goto err;
+                BN_set_negative(x, 0);
+                }
+        if (y != NULL)
+                {
+                if (!BN_copy(y, &point->Y)) goto err;
+                BN_set_negative(y, 0);
+                }
+        ret = 1;
+                
+ err:
+        return ret;
+        }
+
+
+/* Include patented algorithms. */
+#include "ec2_smpt.c"
+
+
+/* Converts an EC_POINT to an octet string.  
+ * If buf is NULL, the encoded length will be returned.
+ * If the length len of buf is smaller than required an error will be returned.
+ *
+ * The point compression section of this function is patented by Certicom Corp. 
+ * under US Patent 6,141,420.  Point compression is disabled by default and can 
+ * be enabled by defining the preprocessor macro OPENSSL_EC_BIN_PT_COMP at 
+ * Configure-time.
+ */
+size_t ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point, point_conversion_form_t form,
+        unsigned char *buf, size_t len, BN_CTX *ctx)
+        {
+        size_t ret;
+        BN_CTX *new_ctx = NULL;
+        int used_ctx = 0;
+        BIGNUM *x, *y, *yxi;
+        size_t field_len, i, skip;
+
+#ifndef OPENSSL_EC_BIN_PT_COMP
+        if ((form == POINT_CONVERSION_COMPRESSED) || (form == POINT_CONVERSION_HYBRID)) 
+                {
+                ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_DISABLED);
+                goto err;
+                }
+#endif
+
+        if ((form != POINT_CONVERSION_COMPRESSED)
+                && (form != POINT_CONVERSION_UNCOMPRESSED)
+                && (form != POINT_CONVERSION_HYBRID))
+                {
+                ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_INVALID_FORM);
+                goto err;
+                }
+
+        if (EC_POINT_is_at_infinity(group, point))
+                {
+                /* encodes to a single 0 octet */
+                if (buf != NULL)
+                        {
+                        if (len < 1)
+                                {
+                                ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
+                                return 0;
+                                }
+                        buf[0] = 0;
+                        }
+                return 1;
+                }
+
+
+        /* ret := required output buffer length */
+        field_len = (EC_GROUP_get_degree(group) + 7) / 8;
+        ret = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2*field_len;
+
+        /* if 'buf' is NULL, just return required length */
+        if (buf != NULL)
+                {
+                if (len < ret)
+                        {
+                        ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
+                        goto err;
+                        }
+
+                if (ctx == NULL)
+                        {
+                        ctx = new_ctx = BN_CTX_new();
+                        if (ctx == NULL)
+                                return 0;
+                        }
+
+                BN_CTX_start(ctx);
+                used_ctx = 1;
+                x = BN_CTX_get(ctx);
+                y = BN_CTX_get(ctx);
+                yxi = BN_CTX_get(ctx);
+                if (yxi == NULL) goto err;
+
+                if (!EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
+
+                buf[0] = form;
+#ifdef OPENSSL_EC_BIN_PT_COMP
+                if ((form != POINT_CONVERSION_UNCOMPRESSED) && !BN_is_zero(x))
+                        {
+                        if (!group->meth->field_div(group, yxi, y, x, ctx)) goto err;
+                        if (BN_is_odd(yxi)) buf[0]++;
+                        }
+#endif
+
+                i = 1;
+                
+                skip = field_len - BN_num_bytes(x);
+                if (skip > field_len)
+                        {
+                        ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
+                        goto err;
+                        }
+                while (skip > 0)
+                        {
+                        buf[i++] = 0;
+                        skip--;
+                        }
+                skip = BN_bn2bin(x, buf + i);
+                i += skip;
+                if (i != 1 + field_len)
+                        {
+                        ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
+                        goto err;
+                        }
+
+                if (form == POINT_CONVERSION_UNCOMPRESSED || form == POINT_CONVERSION_HYBRID)
+                        {
+                        skip = field_len - BN_num_bytes(y);
+                        if (skip > field_len)
+                                {
+                                ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+                        while (skip > 0)
+                                {
+                                buf[i++] = 0;
+                                skip--;
+                                }
+                        skip = BN_bn2bin(y, buf + i);
+                        i += skip;
+                        }
+
+                if (i != ret)
+                        {
+                        ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
+                        goto err;
+                        }
+                }
+        
+        if (used_ctx)
+                BN_CTX_end(ctx);
+        if (new_ctx != NULL)
+                BN_CTX_free(new_ctx);
+        return ret;
+
+ err:
+        if (used_ctx)
+                BN_CTX_end(ctx);
+        if (new_ctx != NULL)
+                BN_CTX_free(new_ctx);
+        return 0;
+        }
+
+
+/* Converts an octet string representation to an EC_POINT. 
+ * Note that the simple implementation only uses affine coordinates.
+ */
+int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
+        const unsigned char *buf, size_t len, BN_CTX *ctx)
+        {
+        point_conversion_form_t form;
+        int y_bit;
+        BN_CTX *new_ctx = NULL;
+        BIGNUM *x, *y, *yxi;
+        size_t field_len, enc_len;
+        int ret = 0;
+
+        if (len == 0)
+                {
+                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_BUFFER_TOO_SMALL);
+                return 0;
+                }
+        form = buf[0];
+        y_bit = form & 1;
+        form = form & ~1U;
+        if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED)
+                && (form != POINT_CONVERSION_UNCOMPRESSED)
+                && (form != POINT_CONVERSION_HYBRID))
+                {
+                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
+                return 0;
+                }
+        if ((form == 0 || form == POINT_CONVERSION_UNCOMPRESSED) && y_bit)
+                {
+                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
+                return 0;
+                }
+
+        if (form == 0)
+                {
+                if (len != 1)
+                        {
+                        ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
+                        return 0;
+                        }
+
+                return EC_POINT_set_to_infinity(group, point);
+                }
+        
+        field_len = (EC_GROUP_get_degree(group) + 7) / 8;
+        enc_len = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2*field_len;
+
+        if (len != enc_len)
+                {
+                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
+                return 0;
+                }
+
+        if (ctx == NULL)
+                {
+                ctx = new_ctx = BN_CTX_new();
+                if (ctx == NULL)
+                        return 0;
+                }
+
+        BN_CTX_start(ctx);
+        x = BN_CTX_get(ctx);
+        y = BN_CTX_get(ctx);
+        yxi = BN_CTX_get(ctx);
+        if (yxi == NULL) goto err;
+
+        if (!BN_bin2bn(buf + 1, field_len, x)) goto err;
+        if (BN_ucmp(x, &group->field) >= 0)
+                {
+                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
+                goto err;
+                }
+
+        if (form == POINT_CONVERSION_COMPRESSED)
+                {
+                if (!EC_POINT_set_compressed_coordinates_GF2m(group, point, x, y_bit, ctx)) goto err;
+                }
+        else
+                {
+                if (!BN_bin2bn(buf + 1 + field_len, field_len, y)) goto err;
+                if (BN_ucmp(y, &group->field) >= 0)
+                        {
+                        ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
+                        goto err;
+                        }
+                if (form == POINT_CONVERSION_HYBRID)
+                        {
+                        if (!group->meth->field_div(group, yxi, y, x, ctx)) goto err;
+                        if (y_bit != BN_is_odd(yxi))
+                                {
+                                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
+                                goto err;
+                                }
+                        }
+
+                if (!EC_POINT_set_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
+                }
+        
+        if (!EC_POINT_is_on_curve(group, point, ctx)) /* test required by X9.62 */
+                {
+                ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
+                goto err;
+                }
+
+        ret = 1;
+        
+ err:
+        BN_CTX_end(ctx);
+        if (new_ctx != NULL)
+                BN_CTX_free(new_ctx);
+        return ret;
+        }
+
+
+/* Computes a + b and stores the result in r.  r could be a or b, a could be b.
+ * Uses algorithm A.10.2 of IEEE P1363.
+ */
+int ec_GF2m_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx)
+        {
+        BN_CTX *new_ctx = NULL;
+        BIGNUM *x0, *y0, *x1, *y1, *x2, *y2, *s, *t;
+        int ret = 0;
+        
+        if (EC_POINT_is_at_infinity(group, a))
+                {
+                if (!EC_POINT_copy(r, b)) return 0;
+                return 1;
+                }
+
+        if (EC_POINT_is_at_infinity(group, b))
+                {
+                if (!EC_POINT_copy(r, a)) return 0;
+                return 1;
+                }
+
+        if (ctx == NULL)
+                {
+                ctx = new_ctx = BN_CTX_new();
+                if (ctx == NULL)
+                        return 0;
+                }
+
+        BN_CTX_start(ctx);
+        x0 = BN_CTX_get(ctx);
+        y0 = BN_CTX_get(ctx);
+        x1 = BN_CTX_get(ctx);
+        y1 = BN_CTX_get(ctx);
+        x2 = BN_CTX_get(ctx);
+        y2 = BN_CTX_get(ctx);
+        s = BN_CTX_get(ctx);
+        t = BN_CTX_get(ctx);
+        if (t == NULL) goto err;
+
+        if (a->Z_is_one) 
+                {
+                if (!BN_copy(x0, &a->X)) goto err;
+                if (!BN_copy(y0, &a->Y)) goto err;
+                }
+        else
+                {
+                if (!EC_POINT_get_affine_coordinates_GF2m(group, a, x0, y0, ctx)) goto err;
+                }
+        if (b->Z_is_one) 
+                {
+                if (!BN_copy(x1, &b->X)) goto err;
+                if (!BN_copy(y1, &b->Y)) goto err;
+                }
+        else
+                {
+                if (!EC_POINT_get_affine_coordinates_GF2m(group, b, x1, y1, ctx)) goto err;
+                }
+
+
+        if (BN_GF2m_cmp(x0, x1))
+                {
+                if (!BN_GF2m_add(t, x0, x1)) goto err;
+                if (!BN_GF2m_add(s, y0, y1)) goto err;
+                if (!group->meth->field_div(group, s, s, t, ctx)) goto err;
+                if (!group->meth->field_sqr(group, x2, s, ctx)) goto err;
+                if (!BN_GF2m_add(x2, x2, &group->a)) goto err;
+                if (!BN_GF2m_add(x2, x2, s)) goto err;
+                if (!BN_GF2m_add(x2, x2, t)) goto err;
+                }
+        else
+                {
+                if (BN_GF2m_cmp(y0, y1) || BN_is_zero(x1))
+                        {
+                        if (!EC_POINT_set_to_infinity(group, r)) goto err;
+                        ret = 1;
+                        goto err;
+                        }
+                if (!group->meth->field_div(group, s, y1, x1, ctx)) goto err;
+                if (!BN_GF2m_add(s, s, x1)) goto err;
+                
+                if (!group->meth->field_sqr(group, x2, s, ctx)) goto err;
+                if (!BN_GF2m_add(x2, x2, s)) goto err;
+                if (!BN_GF2m_add(x2, x2, &group->a)) goto err;
+                }
+
+        if (!BN_GF2m_add(y2, x1, x2)) goto err;
+        if (!group->meth->field_mul(group, y2, y2, s, ctx)) goto err;
+        if (!BN_GF2m_add(y2, y2, x2)) goto err;
+        if (!BN_GF2m_add(y2, y2, y1)) goto err;
+
+        if (!EC_POINT_set_affine_coordinates_GF2m(group, r, x2, y2, ctx)) goto err;
+
+        ret = 1;
+
+ err:
+        BN_CTX_end(ctx);
+        if (new_ctx != NULL)
+                BN_CTX_free(new_ctx);
+        return ret;
+        }
+
+
+/* Computes 2 * a and stores the result in r.  r could be a.
+ * Uses algorithm A.10.2 of IEEE P1363.
+ */
+int ec_GF2m_simple_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, BN_CTX *ctx)
+        {
+        return ec_GF2m_simple_add(group, r, a, a, ctx);
+        }
+
+
+int ec_GF2m_simple_invert(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx)
+        {
+        if (EC_POINT_is_at_infinity(group, point) || BN_is_zero(&point->Y))
+                /* point is its own inverse */
+                return 1;
+        
+        if (!EC_POINT_make_affine(group, point, ctx)) return 0;
+        return BN_GF2m_add(&point->Y, &point->X, &point->Y);
+        }
+
+
+/* Indicates whether the given point is the point at infinity. */
+int ec_GF2m_simple_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
+        {
+        return BN_is_zero(&point->Z);
+        }
+
+
+/* Determines whether the given EC_POINT is an actual point on the curve defined
+ * in the EC_GROUP.  A point is valid if it satisfies the Weierstrass equation:
+ *      y^2 + x*y = x^3 + a*x^2 + b.
+ */
+int ec_GF2m_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point, BN_CTX *ctx)
+        {
+        int ret = -1;
+        BN_CTX *new_ctx = NULL;
+        BIGNUM *lh, *y2;
+        int (*field_mul)(const EC_GROUP *, BIGNUM *, const BIGNUM *, const BIGNUM *, BN_CTX *);
+        int (*field_sqr)(const EC_GROUP *, BIGNUM *, const BIGNUM *, BN_CTX *);
+
+        if (EC_POINT_is_at_infinity(group, point))
+                return 1;
+
+        field_mul = group->meth->field_mul;
+        field_sqr = group->meth->field_sqr;     
+
+        /* only support affine coordinates */
+        if (!point->Z_is_one) goto err;
+
+        if (ctx == NULL)
+                {
+                ctx = new_ctx = BN_CTX_new();
+                if (ctx == NULL)
+                        return -1;
+                }
+
+        BN_CTX_start(ctx);
+        y2 = BN_CTX_get(ctx);
+        lh = BN_CTX_get(ctx);
+        if (lh == NULL) goto err;
+
+        /* We have a curve defined by a Weierstrass equation
+         *      y^2 + x*y = x^3 + a*x^2 + b.
+         *  <=> x^3 + a*x^2 + x*y + b + y^2 = 0
+         *  <=> ((x + a) * x + y ) * x + b + y^2 = 0
+         */
+        if (!BN_GF2m_add(lh, &point->X, &group->a)) goto err;
+        if (!field_mul(group, lh, lh, &point->X, ctx)) goto err;
+        if (!BN_GF2m_add(lh, lh, &point->Y)) goto err;
+        if (!field_mul(group, lh, lh, &point->X, ctx)) goto err;
+        if (!BN_GF2m_add(lh, lh, &group->b)) goto err;
+        if (!field_sqr(group, y2, &point->Y, ctx)) goto err;
+        if (!BN_GF2m_add(lh, lh, y2)) goto err;
+        ret = BN_is_zero(lh);
+ err:
+        if (ctx) BN_CTX_end(ctx);
+        if (new_ctx) BN_CTX_free(new_ctx);
+        return ret;
+        }
+
+
+/* Indicates whether two points are equal.
+ * Return values:
+ *  -1   error
+ *   0   equal (in affine coordinates)
+ *   1   not equal
+ */
+int ec_GF2m_simple_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx)
+        {
+        BIGNUM *aX, *aY, *bX, *bY;
+        BN_CTX *new_ctx = NULL;
+        int ret = -1;
+
+        if (EC_POINT_is_at_infinity(group, a))
+                {
+                return EC_POINT_is_at_infinity(group, b) ? 0 : 1;
+                }
+        
+        if (a->Z_is_one && b->Z_is_one)
+                {
+                return ((BN_cmp(&a->X, &b->X) == 0) && BN_cmp(&a->Y, &b->Y) == 0) ? 0 : 1;
+                }
+
+        if (ctx == NULL)
+                {
+                ctx = new_ctx = BN_CTX_new();
+                if (ctx == NULL)
+                        return -1;
+                }
+
+        BN_CTX_start(ctx);
+        aX = BN_CTX_get(ctx);
+        aY = BN_CTX_get(ctx);
+        bX = BN_CTX_get(ctx);
+        bY = BN_CTX_get(ctx);
+        if (bY == NULL) goto err;
+
+        if (!EC_POINT_get_affine_coordinates_GF2m(group, a, aX, aY, ctx)) goto err;
+        if (!EC_POINT_get_affine_coordinates_GF2m(group, b, bX, bY, ctx)) goto err;
+        ret = ((BN_cmp(aX, bX) == 0) && BN_cmp(aY, bY) == 0) ? 0 : 1;
+
+  err:  
+        if (ctx) BN_CTX_end(ctx);
+        if (new_ctx) BN_CTX_free(new_ctx);
+        return ret;
+        }
+
+
+/* Forces the given EC_POINT to internally use affine coordinates. */
+int ec_GF2m_simple_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx)
+        {
+        BN_CTX *new_ctx = NULL;
+        BIGNUM *x, *y;
+        int ret = 0;
+
+        if (point->Z_is_one || EC_POINT_is_at_infinity(group, point))
+                return 1;
+        
+        if (ctx == NULL)
+                {
+                ctx = new_ctx = BN_CTX_new();
+                if (ctx == NULL)
+                        return 0;
+                }
+
+        BN_CTX_start(ctx);
+        x = BN_CTX_get(ctx);
+        y = BN_CTX_get(ctx);
+        if (y == NULL) goto err;
+        
+        if (!EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
+        if (!BN_copy(&point->X, x)) goto err;
+        if (!BN_copy(&point->Y, y)) goto err;
+        if (!BN_one(&point->Z)) goto err;
+        
+        ret = 1;                
+
+  err:
+        if (ctx) BN_CTX_end(ctx);
+        if (new_ctx) BN_CTX_free(new_ctx);
+        return ret;
+        }
+
+
+/* Forces each of the EC_POINTs in the given array to use affine coordinates. */
+int ec_GF2m_simple_points_make_affine(const EC_GROUP *group, size_t num, EC_POINT *points[], BN_CTX *ctx)
+        {
+        size_t i;
+
+        for (i = 0; i < num; i++)
+                {
+                if (!group->meth->make_affine(group, points[i], ctx)) return 0;
+                }
+
+        return 1;
+        }
+
+
+/* Wrapper to simple binary polynomial field multiplication implementation. */
+int ec_GF2m_simple_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
+        {
+        return BN_GF2m_mod_mul_arr(r, a, b, group->poly, ctx);
+        }
+
+
+/* Wrapper to simple binary polynomial field squaring implementation. */
+int ec_GF2m_simple_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
+        {
+        return BN_GF2m_mod_sqr_arr(r, a, group->poly, ctx);
+        }
+
+
+/* Wrapper to simple binary polynomial field division implementation. */
+int ec_GF2m_simple_field_div(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
+        {
+        return BN_GF2m_mod_div(r, a, b, &group->field, ctx);
+        }
diff --git a/src/lib/libssl/src/crypto/ec/ec_asn1.c b/src/lib/libssl/src/crypto/ec/ec_asn1.c
new file mode 100644
index 0000000000..ae55539859
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ec/ec_asn1.c
@@ -0,0 +1,1429 @@
+/* crypto/ec/ec_asn1.c */
+/*
+ * Written by Nils Larsch for the OpenSSL project.
+ */
+/* ====================================================================
+ * Copyright (c) 2000-2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <string.h>
+#include "ec_lcl.h"
+#include <openssl/err.h>
+#include <openssl/asn1t.h>
+#include <openssl/objects.h>
+
+
+int EC_GROUP_get_basis_type(const EC_GROUP *group)
+        {
+        int i=0;
+
+        if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) !=
+                NID_X9_62_characteristic_two_field)
+                /* everything else is currently not supported */
+                return 0;
+
+        while (group->poly[i] != 0)
+                i++;
+
+        if (i == 4)
+                return NID_X9_62_ppBasis;
+        else if (i == 2)
+                return NID_X9_62_tpBasis;
+        else
+                /* everything else is currently not supported */
+                return 0;
+        }
+
+int EC_GROUP_get_trinomial_basis(const EC_GROUP *group, unsigned int *k)
+        {
+        if (group == NULL)
+                return 0;
+
+        if (EC_GROUP_method_of(group)->group_set_curve != ec_GF2m_simple_group_set_curve
+            || !((group->poly[0] != 0) && (group->poly[1] != 0) && (group->poly[2] == 0)))
+                {
+                ECerr(EC_F_EC_GROUP_GET_TRINOMIAL_BASIS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return 0;
+                }
+
+        if (k)
+                *k = group->poly[1];
+
+        return 1;
+        }
+
+int EC_GROUP_get_pentanomial_basis(const EC_GROUP *group, unsigned int *k1,
+        unsigned int *k2, unsigned int *k3)
+        {
+        if (group == NULL)
+                return 0;
+
+        if (EC_GROUP_method_of(group)->group_set_curve != ec_GF2m_simple_group_set_curve
+            || !((group->poly[0] != 0) && (group->poly[1] != 0) && (group->poly[2] != 0) && (group->poly[3] != 0) && (group->poly[4] == 0)))
+                {
+                ECerr(EC_F_EC_GROUP_GET_PENTANOMIAL_BASIS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return 0;
+                }
+
+        if (k1)
+                *k1 = group->poly[3];
+        if (k2)
+                *k2 = group->poly[2];
+        if (k3)
+                *k3 = group->poly[1];
+
+        return 1;
+        }
+
+
+
+/* some structures needed for the asn1 encoding */
+typedef struct x9_62_pentanomial_st {
+        long k1;
+        long k2;
+        long k3;
+        } X9_62_PENTANOMIAL;
+
+typedef struct x9_62_characteristic_two_st {
+        long m;
+        ASN1_OBJECT  *type;
+        union   {
+                char *ptr;
+                /* NID_X9_62_onBasis */
+                ASN1_NULL    *onBasis;
+                /* NID_X9_62_tpBasis */
+                ASN1_INTEGER *tpBasis;
+                /* NID_X9_62_ppBasis */
+                X9_62_PENTANOMIAL *ppBasis;
+                /* anything else */
+                ASN1_TYPE *other;
+                } p;
+        } X9_62_CHARACTERISTIC_TWO;
+
+typedef struct x9_62_fieldid_st {
+        ASN1_OBJECT *fieldType;
+        union   {
+                char *ptr;
+                /* NID_X9_62_prime_field */
+                ASN1_INTEGER *prime;
+                /* NID_X9_62_characteristic_two_field */
+                X9_62_CHARACTERISTIC_TWO *char_two;
+                /* anything else */
+                ASN1_TYPE *other;
+                } p;
+        } X9_62_FIELDID;
+
+typedef struct x9_62_curve_st {
+        ASN1_OCTET_STRING *a;
+        ASN1_OCTET_STRING *b;
+        ASN1_BIT_STRING   *seed;
+        } X9_62_CURVE;
+
+typedef struct ec_parameters_st {
+        long              version;
+        X9_62_FIELDID     *fieldID;
+        X9_62_CURVE       *curve;
+        ASN1_OCTET_STRING *base;
+        ASN1_INTEGER      *order;
+        ASN1_INTEGER      *cofactor;
+        } ECPARAMETERS;
+
+struct ecpk_parameters_st {
+        int     type;
+        union {
+                ASN1_OBJECT  *named_curve;
+                ECPARAMETERS *parameters;
+                ASN1_NULL    *implicitlyCA;
+        } value;
+        }/* ECPKPARAMETERS */;
+
+/* SEC1 ECPrivateKey */
+typedef struct ec_privatekey_st {
+        long              version;
+        ASN1_OCTET_STRING *privateKey;
+        ECPKPARAMETERS    *parameters;
+        ASN1_BIT_STRING   *publicKey;
+        } EC_PRIVATEKEY;
+
+/* the OpenSSL ASN.1 definitions */
+ASN1_SEQUENCE(X9_62_PENTANOMIAL) = {
+        ASN1_SIMPLE(X9_62_PENTANOMIAL, k1, LONG),
+        ASN1_SIMPLE(X9_62_PENTANOMIAL, k2, LONG),
+        ASN1_SIMPLE(X9_62_PENTANOMIAL, k3, LONG)
+} ASN1_SEQUENCE_END(X9_62_PENTANOMIAL)
+
+DECLARE_ASN1_ALLOC_FUNCTIONS(X9_62_PENTANOMIAL)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(X9_62_PENTANOMIAL)
+
+ASN1_ADB_TEMPLATE(char_two_def) = ASN1_SIMPLE(X9_62_CHARACTERISTIC_TWO, p.other, ASN1_ANY);
+
+ASN1_ADB(X9_62_CHARACTERISTIC_TWO) = {
+        ADB_ENTRY(NID_X9_62_onBasis, ASN1_SIMPLE(X9_62_CHARACTERISTIC_TWO, p.onBasis, ASN1_NULL)),
+        ADB_ENTRY(NID_X9_62_tpBasis, ASN1_SIMPLE(X9_62_CHARACTERISTIC_TWO, p.tpBasis, ASN1_INTEGER)),
+        ADB_ENTRY(NID_X9_62_ppBasis, ASN1_SIMPLE(X9_62_CHARACTERISTIC_TWO, p.ppBasis, X9_62_PENTANOMIAL))
+} ASN1_ADB_END(X9_62_CHARACTERISTIC_TWO, 0, type, 0, &char_two_def_tt, NULL);
+
+ASN1_SEQUENCE(X9_62_CHARACTERISTIC_TWO) = {
+        ASN1_SIMPLE(X9_62_CHARACTERISTIC_TWO, m, LONG),
+        ASN1_SIMPLE(X9_62_CHARACTERISTIC_TWO, type, ASN1_OBJECT),
+        ASN1_ADB_OBJECT(X9_62_CHARACTERISTIC_TWO)
+} ASN1_SEQUENCE_END(X9_62_CHARACTERISTIC_TWO)
+
+DECLARE_ASN1_ALLOC_FUNCTIONS(X9_62_CHARACTERISTIC_TWO)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(X9_62_CHARACTERISTIC_TWO)
+
+ASN1_ADB_TEMPLATE(fieldID_def) = ASN1_SIMPLE(X9_62_FIELDID, p.other, ASN1_ANY);
+
+ASN1_ADB(X9_62_FIELDID) = {
+        ADB_ENTRY(NID_X9_62_prime_field, ASN1_SIMPLE(X9_62_FIELDID, p.prime, ASN1_INTEGER)),
+        ADB_ENTRY(NID_X9_62_characteristic_two_field, ASN1_SIMPLE(X9_62_FIELDID, p.char_two, X9_62_CHARACTERISTIC_TWO))
+} ASN1_ADB_END(X9_62_FIELDID, 0, fieldType, 0, &fieldID_def_tt, NULL);
+
+ASN1_SEQUENCE(X9_62_FIELDID) = {
+        ASN1_SIMPLE(X9_62_FIELDID, fieldType, ASN1_OBJECT),
+        ASN1_ADB_OBJECT(X9_62_FIELDID)
+} ASN1_SEQUENCE_END(X9_62_FIELDID)
+
+ASN1_SEQUENCE(X9_62_CURVE) = {
+        ASN1_SIMPLE(X9_62_CURVE, a, ASN1_OCTET_STRING),
+        ASN1_SIMPLE(X9_62_CURVE, b, ASN1_OCTET_STRING),
+        ASN1_OPT(X9_62_CURVE, seed, ASN1_BIT_STRING)
+} ASN1_SEQUENCE_END(X9_62_CURVE)
+
+ASN1_SEQUENCE(ECPARAMETERS) = {
+        ASN1_SIMPLE(ECPARAMETERS, version, LONG),
+        ASN1_SIMPLE(ECPARAMETERS, fieldID, X9_62_FIELDID),
+        ASN1_SIMPLE(ECPARAMETERS, curve, X9_62_CURVE),
+        ASN1_SIMPLE(ECPARAMETERS, base, ASN1_OCTET_STRING),
+        ASN1_SIMPLE(ECPARAMETERS, order, ASN1_INTEGER),
+        ASN1_OPT(ECPARAMETERS, cofactor, ASN1_INTEGER)
+} ASN1_SEQUENCE_END(ECPARAMETERS)
+
+DECLARE_ASN1_ALLOC_FUNCTIONS(ECPARAMETERS)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(ECPARAMETERS)
+
+ASN1_CHOICE(ECPKPARAMETERS) = {
+        ASN1_SIMPLE(ECPKPARAMETERS, value.named_curve, ASN1_OBJECT),
+        ASN1_SIMPLE(ECPKPARAMETERS, value.parameters, ECPARAMETERS),
+        ASN1_SIMPLE(ECPKPARAMETERS, value.implicitlyCA, ASN1_NULL)
+} ASN1_CHOICE_END(ECPKPARAMETERS)
+
+DECLARE_ASN1_FUNCTIONS_const(ECPKPARAMETERS)
+DECLARE_ASN1_ENCODE_FUNCTIONS_const(ECPKPARAMETERS, ECPKPARAMETERS)
+IMPLEMENT_ASN1_FUNCTIONS_const(ECPKPARAMETERS)
+
+ASN1_SEQUENCE(EC_PRIVATEKEY) = {
+        ASN1_SIMPLE(EC_PRIVATEKEY, version, LONG),
+        ASN1_SIMPLE(EC_PRIVATEKEY, privateKey, ASN1_OCTET_STRING),
+        ASN1_EXP_OPT(EC_PRIVATEKEY, parameters, ECPKPARAMETERS, 0),
+        ASN1_EXP_OPT(EC_PRIVATEKEY, publicKey, ASN1_BIT_STRING, 1)
+} ASN1_SEQUENCE_END(EC_PRIVATEKEY)
+
+DECLARE_ASN1_FUNCTIONS_const(EC_PRIVATEKEY)
+DECLARE_ASN1_ENCODE_FUNCTIONS_const(EC_PRIVATEKEY, EC_PRIVATEKEY)
+IMPLEMENT_ASN1_FUNCTIONS_const(EC_PRIVATEKEY)
+
+/* some declarations of internal function */
+
+/* ec_asn1_group2field() sets the values in a X9_62_FIELDID object */ 
+static int ec_asn1_group2fieldid(const EC_GROUP *, X9_62_FIELDID *);
+/* ec_asn1_group2curve() sets the values in a X9_62_CURVE object */ 
+static int ec_asn1_group2curve(const EC_GROUP *, X9_62_CURVE *);
+/* ec_asn1_parameters2group() creates a EC_GROUP object from a
+ * ECPARAMETERS object */
+static EC_GROUP *ec_asn1_parameters2group(const ECPARAMETERS *); 
+/* ec_asn1_group2parameters() creates a ECPARAMETERS object from a 
+ * EC_GROUP object */
+static ECPARAMETERS *ec_asn1_group2parameters(const EC_GROUP *,ECPARAMETERS *);
+/* ec_asn1_pkparameters2group() creates a EC_GROUP object from a
+ * ECPKPARAMETERS object */
+static EC_GROUP *ec_asn1_pkparameters2group(const ECPKPARAMETERS *); 
+/* ec_asn1_group2pkparameters() creates a ECPKPARAMETERS object from a 
+ * EC_GROUP object */
+static ECPKPARAMETERS *ec_asn1_group2pkparameters(const EC_GROUP *, 
+        ECPKPARAMETERS *);
+
+
+/* the function definitions */
+
+static int ec_asn1_group2fieldid(const EC_GROUP *group, X9_62_FIELDID *field)
+        {
+        int                     ok=0, nid;
+        BIGNUM                  *tmp = NULL;
+        
+        if (group == NULL || field == NULL)
+                return 0;
+
+        /* clear the old values (if necessary) */
+        if (field->fieldType != NULL)
+                ASN1_OBJECT_free(field->fieldType);
+        if (field->p.other != NULL)
+                ASN1_TYPE_free(field->p.other);
+
+        nid = EC_METHOD_get_field_type(EC_GROUP_method_of(group));
+        /* set OID for the field */
+        if ((field->fieldType = OBJ_nid2obj(nid)) == NULL)
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2FIELDID, ERR_R_OBJ_LIB);
+                goto err;
+                }
+
+        if (nid == NID_X9_62_prime_field)
+                {
+                if ((tmp = BN_new()) == NULL) 
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2FIELDID, ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                /* the parameters are specified by the prime number p */
+                if (!EC_GROUP_get_curve_GFp(group, tmp, NULL, NULL, NULL))
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2FIELDID, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                /* set the prime number */
+                field->p.prime = BN_to_ASN1_INTEGER(tmp,NULL);
+                if (field->p.prime == NULL)
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2FIELDID, ERR_R_ASN1_LIB);
+                        goto err;
+                        }
+                }
+        else    /* nid == NID_X9_62_characteristic_two_field */
+                {
+                int             field_type;
+                X9_62_CHARACTERISTIC_TWO *char_two;
+
+                field->p.char_two = X9_62_CHARACTERISTIC_TWO_new();
+                char_two = field->p.char_two;
+
+                if (char_two == NULL)
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2FIELDID, ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+        
+                char_two->m = (long)EC_GROUP_get_degree(group);
+
+                field_type = EC_GROUP_get_basis_type(group);
+
+                if (field_type == 0)
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2FIELDID, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                /* set base type OID */
+                if ((char_two->type = OBJ_nid2obj(field_type)) == NULL)
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2FIELDID, ERR_R_OBJ_LIB);
+                        goto err;
+                        }
+
+                if (field_type == NID_X9_62_tpBasis)
+                        {
+                        unsigned int k;
+
+                        if (!EC_GROUP_get_trinomial_basis(group, &k))
+                                goto err;
+
+                        char_two->p.tpBasis = ASN1_INTEGER_new();
+                        if (!char_two->p.tpBasis)
+                                {
+                                ECerr(EC_F_EC_ASN1_GROUP2FIELDID, ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+                        if (!ASN1_INTEGER_set(char_two->p.tpBasis, (long)k))
+                                {
+                                ECerr(EC_F_EC_ASN1_GROUP2FIELDID,
+                                        ERR_R_ASN1_LIB);
+                                goto err;
+                                }
+                        }
+                else if (field_type == NID_X9_62_ppBasis)
+                        {
+                        unsigned int k1, k2, k3;
+
+                        if (!EC_GROUP_get_pentanomial_basis(group, &k1, &k2, &k3))
+                                goto err;
+
+                        char_two->p.ppBasis = X9_62_PENTANOMIAL_new();
+                        if (!char_two->p.ppBasis)
+                                {
+                                ECerr(EC_F_EC_ASN1_GROUP2FIELDID, ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+
+                        /* set k? values */
+                        char_two->p.ppBasis->k1 = (long)k1;
+                        char_two->p.ppBasis->k2 = (long)k2;
+                        char_two->p.ppBasis->k3 = (long)k3;
+                        }
+                else /* field_type == NID_X9_62_onBasis */
+                        {
+                        /* for ONB the parameters are (asn1) NULL */
+                        char_two->p.onBasis = ASN1_NULL_new();
+                        if (!char_two->p.onBasis)
+                                {
+                                ECerr(EC_F_EC_ASN1_GROUP2FIELDID, ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+                        }
+                }
+
+        ok = 1;
+
+err :   if (tmp)
+                BN_free(tmp);
+        return(ok);
+}
+
+static int ec_asn1_group2curve(const EC_GROUP *group, X9_62_CURVE *curve)
+        {
+        int           ok=0, nid;
+        BIGNUM        *tmp_1=NULL, *tmp_2=NULL;
+        unsigned char *buffer_1=NULL, *buffer_2=NULL,
+                      *a_buf=NULL, *b_buf=NULL;
+        size_t        len_1, len_2;
+        unsigned char char_zero = 0;
+
+        if (!group || !curve || !curve->a || !curve->b)
+                return 0;
+
+        if ((tmp_1 = BN_new()) == NULL || (tmp_2 = BN_new()) == NULL)
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2CURVE, ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        nid = EC_METHOD_get_field_type(EC_GROUP_method_of(group));
+
+        /* get a and b */
+        if (nid == NID_X9_62_prime_field)
+                {
+                if (!EC_GROUP_get_curve_GFp(group, NULL, tmp_1, tmp_2, NULL))
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2CURVE, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                }
+        else    /* nid == NID_X9_62_characteristic_two_field */
+                {
+                if (!EC_GROUP_get_curve_GF2m(group, NULL, tmp_1, tmp_2, NULL))
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2CURVE, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                }
+
+        len_1 = (size_t)BN_num_bytes(tmp_1);
+        len_2 = (size_t)BN_num_bytes(tmp_2);
+
+        if (len_1 == 0)
+                {
+                /* len_1 == 0 => a == 0 */
+                a_buf = &char_zero;
+                len_1 = 1;
+                }
+        else
+                {
+                if ((buffer_1 = OPENSSL_malloc(len_1)) == NULL)
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2CURVE,
+                              ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                if ( (len_1 = BN_bn2bin(tmp_1, buffer_1)) == 0)
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2CURVE, ERR_R_BN_LIB);
+                        goto err;
+                        }
+                a_buf = buffer_1;
+                }
+
+        if (len_2 == 0)
+                {
+                /* len_2 == 0 => b == 0 */
+                b_buf = &char_zero;
+                len_2 = 1;
+                }
+        else
+                {
+                if ((buffer_2 = OPENSSL_malloc(len_2)) == NULL)
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2CURVE,
+                              ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                if ( (len_2 = BN_bn2bin(tmp_2, buffer_2)) == 0)
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2CURVE, ERR_R_BN_LIB);
+                        goto err;
+                        }
+                b_buf = buffer_2;
+                }
+        
+        /* set a and b */
+        if (!M_ASN1_OCTET_STRING_set(curve->a, a_buf, len_1) ||
+            !M_ASN1_OCTET_STRING_set(curve->b, b_buf, len_2))
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2CURVE, ERR_R_ASN1_LIB);
+                goto err;
+                }
+        
+        /* set the seed (optional) */
+        if (group->seed)
+                {       
+                if (!curve->seed)
+                        if ((curve->seed = ASN1_BIT_STRING_new()) == NULL)
+                                {
+                                ECerr(EC_F_EC_ASN1_GROUP2CURVE, ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+                curve->seed->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
+                curve->seed->flags |= ASN1_STRING_FLAG_BITS_LEFT;
+                if (!ASN1_BIT_STRING_set(curve->seed, group->seed, 
+                                         (int)group->seed_len))
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2CURVE, ERR_R_ASN1_LIB);
+                        goto err;
+                        }
+                }
+        else
+                {
+                if (curve->seed)
+                        {
+                        ASN1_BIT_STRING_free(curve->seed);
+                        curve->seed = NULL;
+                        }
+                }
+
+        ok = 1;
+
+err:    if (buffer_1)
+                OPENSSL_free(buffer_1);
+        if (buffer_2)
+                OPENSSL_free(buffer_2);
+        if (tmp_1)
+                BN_free(tmp_1);
+        if (tmp_2)
+                BN_free(tmp_2);
+        return(ok);
+        }
+
+static ECPARAMETERS *ec_asn1_group2parameters(const EC_GROUP *group,
+                                              ECPARAMETERS *param)
+        {
+        int     ok=0;
+        size_t  len=0;
+        ECPARAMETERS   *ret=NULL;
+        BIGNUM         *tmp=NULL;
+        unsigned char  *buffer=NULL;
+        const EC_POINT *point=NULL;
+        point_conversion_form_t form;
+
+        if ((tmp = BN_new()) == NULL)
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        if (param == NULL)
+        {
+                if ((ret = ECPARAMETERS_new()) == NULL)
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, 
+                              ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+        }
+        else
+                ret = param;
+
+        /* set the version (always one) */
+        ret->version = (long)0x1;
+
+        /* set the fieldID */
+        if (!ec_asn1_group2fieldid(group, ret->fieldID))
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, ERR_R_EC_LIB);
+                goto err;
+                }
+
+        /* set the curve */
+        if (!ec_asn1_group2curve(group, ret->curve))
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, ERR_R_EC_LIB);
+                goto err;
+                }
+
+        /* set the base point */
+        if ((point = EC_GROUP_get0_generator(group)) == NULL)
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, EC_R_UNDEFINED_GENERATOR);
+                goto err;
+                }
+
+        form = EC_GROUP_get_point_conversion_form(group);
+
+        len = EC_POINT_point2oct(group, point, form, NULL, len, NULL);
+        if (len == 0)
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, ERR_R_EC_LIB);
+                goto err;
+                }
+        if ((buffer = OPENSSL_malloc(len)) == NULL)
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+        if (!EC_POINT_point2oct(group, point, form, buffer, len, NULL))
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, ERR_R_EC_LIB);
+                goto err;
+                }
+        if (ret->base == NULL && (ret->base = ASN1_OCTET_STRING_new()) == NULL)
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+        if (!ASN1_OCTET_STRING_set(ret->base, buffer, len))
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, ERR_R_ASN1_LIB);
+                goto err;
+                }
+
+        /* set the order */
+        if (!EC_GROUP_get_order(group, tmp, NULL))
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, ERR_R_EC_LIB);
+                goto err;
+                }
+        ret->order = BN_to_ASN1_INTEGER(tmp, ret->order);
+        if (ret->order == NULL)
+                {
+                ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, ERR_R_ASN1_LIB);
+                goto err;
+                }
+
+        /* set the cofactor (optional) */
+        if (EC_GROUP_get_cofactor(group, tmp, NULL))
+                {
+                ret->cofactor = BN_to_ASN1_INTEGER(tmp, ret->cofactor);
+                if (ret->cofactor == NULL)
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2PARAMETERS, ERR_R_ASN1_LIB);
+                        goto err;
+                        }
+                }
+
+        ok = 1;
+
+err :   if(!ok)
+                {
+                if (ret && !param)
+                        ECPARAMETERS_free(ret);
+                ret = NULL;
+                }
+        if (tmp)
+                BN_free(tmp);
+        if (buffer)
+                OPENSSL_free(buffer);
+        return(ret);
+        }
+
+ECPKPARAMETERS *ec_asn1_group2pkparameters(const EC_GROUP *group, 
+                                           ECPKPARAMETERS *params)
+        {
+        int            ok = 1, tmp;
+        ECPKPARAMETERS *ret = params;
+
+        if (ret == NULL)
+                {
+                if ((ret = ECPKPARAMETERS_new()) == NULL)
+                        {
+                        ECerr(EC_F_EC_ASN1_GROUP2PKPARAMETERS, 
+                              ERR_R_MALLOC_FAILURE);
+                        return NULL;
+                        }
+                }
+        else
+                {
+                if (ret->type == 0 && ret->value.named_curve)
+                        ASN1_OBJECT_free(ret->value.named_curve);
+                else if (ret->type == 1 && ret->value.parameters)
+                        ECPARAMETERS_free(ret->value.parameters);
+                }
+
+        if (EC_GROUP_get_asn1_flag(group))
+                {
+                /* use the asn1 OID to describe the
+                 * the elliptic curve parameters
+                 */
+                tmp = EC_GROUP_get_curve_name(group);
+                if (tmp)
+                        {
+                        ret->type = 0;
+                        if ((ret->value.named_curve = OBJ_nid2obj(tmp)) == NULL)
+                                ok = 0;
+                        }
+                else
+                        /* we don't kmow the nid => ERROR */
+                        ok = 0;
+                }
+        else
+                {       
+                /* use the ECPARAMETERS structure */
+                ret->type = 1;
+                if ((ret->value.parameters = ec_asn1_group2parameters(
+                     group, NULL)) == NULL)
+                        ok = 0;
+                }
+
+        if (!ok)
+                {
+                ECPKPARAMETERS_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+static EC_GROUP *ec_asn1_parameters2group(const ECPARAMETERS *params)
+        {
+        int                     ok = 0, tmp;
+        EC_GROUP                *ret = NULL;
+        BIGNUM                  *p = NULL, *a = NULL, *b = NULL;
+        EC_POINT                *point=NULL;
+        long                    field_bits;
+
+        if (!params->fieldID || !params->fieldID->fieldType || 
+            !params->fieldID->p.ptr)
+                {
+                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_ASN1_ERROR);
+                goto err;
+                }
+
+        /* now extract the curve parameters a and b */
+        if (!params->curve || !params->curve->a || 
+            !params->curve->a->data || !params->curve->b ||
+            !params->curve->b->data)
+                {
+                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_ASN1_ERROR);
+                goto err;
+                }
+        a = BN_bin2bn(params->curve->a->data, params->curve->a->length, NULL);
+        if (a == NULL)
+                {
+                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, ERR_R_BN_LIB);
+                goto err;
+                }
+        b = BN_bin2bn(params->curve->b->data, params->curve->b->length, NULL);
+        if (b == NULL)
+                {
+                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, ERR_R_BN_LIB);
+                goto err;
+                }
+
+        /* get the field parameters */
+        tmp = OBJ_obj2nid(params->fieldID->fieldType);
+
+        if (tmp == NID_X9_62_characteristic_two_field)
+                {
+                X9_62_CHARACTERISTIC_TWO *char_two;
+
+                char_two = params->fieldID->p.char_two;
+
+                field_bits = char_two->m;
+                if (field_bits > OPENSSL_ECC_MAX_FIELD_BITS)
+                        {
+                        ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_FIELD_TOO_LARGE);
+                        goto err;
+                        }
+
+                if ((p = BN_new()) == NULL)
+                        {
+                        ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+
+                /* get the base type */
+                tmp = OBJ_obj2nid(char_two->type);
+
+                if (tmp ==  NID_X9_62_tpBasis)
+                        {
+                        long tmp_long;
+
+                        if (!char_two->p.tpBasis)
+                                {
+                                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_ASN1_ERROR);
+                                goto err;
+                                }
+
+                        tmp_long = ASN1_INTEGER_get(char_two->p.tpBasis);
+
+                        if (!(char_two->m > tmp_long && tmp_long > 0))
+                                {
+                                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_INVALID_TRINOMIAL_BASIS);
+                                goto err;
+                                }
+                        
+                        /* create the polynomial */
+                        if (!BN_set_bit(p, (int)char_two->m))
+                                goto err;
+                        if (!BN_set_bit(p, (int)tmp_long))
+                                goto err;
+                        if (!BN_set_bit(p, 0))
+                                goto err;
+                        }
+                else if (tmp == NID_X9_62_ppBasis)
+                        {
+                        X9_62_PENTANOMIAL *penta;
+
+                        penta = char_two->p.ppBasis;
+                        if (!penta)
+                                {
+                                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_ASN1_ERROR);
+                                goto err;
+                                }
+
+                        if (!(char_two->m > penta->k3 && penta->k3 > penta->k2 && penta->k2 > penta->k1 && penta->k1 > 0))
+                                {
+                                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_INVALID_PENTANOMIAL_BASIS);
+                                goto err;
+                                }
+                        
+                        /* create the polynomial */
+                        if (!BN_set_bit(p, (int)char_two->m)) goto err;
+                        if (!BN_set_bit(p, (int)penta->k1)) goto err;
+                        if (!BN_set_bit(p, (int)penta->k2)) goto err;
+                        if (!BN_set_bit(p, (int)penta->k3)) goto err;
+                        if (!BN_set_bit(p, 0)) goto err;
+                        }
+                else if (tmp == NID_X9_62_onBasis)
+                        {
+                        ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_NOT_IMPLEMENTED);
+                        goto err;
+                        }
+                else /* error */
+                        {
+                        ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_ASN1_ERROR);
+                        goto err;
+                        }
+
+                /* create the EC_GROUP structure */
+                ret = EC_GROUP_new_curve_GF2m(p, a, b, NULL);
+                }
+        else if (tmp == NID_X9_62_prime_field)
+                {
+                /* we have a curve over a prime field */
+                /* extract the prime number */
+                if (!params->fieldID->p.prime)
+                        {
+                        ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_ASN1_ERROR);
+                        goto err;
+                        }
+                p = ASN1_INTEGER_to_BN(params->fieldID->p.prime, NULL);
+                if (p == NULL)
+                        {
+                        ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, ERR_R_ASN1_LIB);
+                        goto err;
+                        }
+
+                if (BN_is_negative(p) || BN_is_zero(p))
+                        {
+                        ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_INVALID_FIELD);
+                        goto err;
+                        }
+
+                field_bits = BN_num_bits(p);
+                if (field_bits > OPENSSL_ECC_MAX_FIELD_BITS)
+                        {
+                        ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_FIELD_TOO_LARGE);
+                        goto err;
+                        }
+
+                /* create the EC_GROUP structure */
+                ret = EC_GROUP_new_curve_GFp(p, a, b, NULL);
+                }
+        else
+                {
+                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_INVALID_FIELD);
+                goto err;
+                }
+
+        if (ret == NULL)
+                {
+                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, ERR_R_EC_LIB);
+                goto err;
+                }
+
+        /* extract seed (optional) */
+        if (params->curve->seed != NULL)
+                {
+                if (ret->seed != NULL)
+                        OPENSSL_free(ret->seed);
+                if (!(ret->seed = OPENSSL_malloc(params->curve->seed->length)))
+                        {
+                        ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, 
+                              ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                memcpy(ret->seed, params->curve->seed->data, 
+                       params->curve->seed->length);
+                ret->seed_len = params->curve->seed->length;
+                }
+
+        if (!params->order || !params->base || !params->base->data)
+                {
+                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_ASN1_ERROR);
+                goto err;
+                }
+
+        if ((point = EC_POINT_new(ret)) == NULL) goto err;
+
+        /* set the point conversion form */
+        EC_GROUP_set_point_conversion_form(ret, (point_conversion_form_t)
+                                (params->base->data[0] & ~0x01));
+
+        /* extract the ec point */
+        if (!EC_POINT_oct2point(ret, point, params->base->data, 
+                                params->base->length, NULL))
+                {
+                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, ERR_R_EC_LIB);
+                goto err;
+                }
+
+        /* extract the order */
+        if ((a = ASN1_INTEGER_to_BN(params->order, a)) == NULL)
+                {
+                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, ERR_R_ASN1_LIB);
+                goto err;
+                }
+        if (BN_is_negative(a) || BN_is_zero(a))
+                {
+                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_INVALID_GROUP_ORDER);
+                goto err;
+                }
+        if (BN_num_bits(a) > (int)field_bits + 1) /* Hasse bound */
+                {
+                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, EC_R_INVALID_GROUP_ORDER);
+                goto err;
+                }
+        
+        /* extract the cofactor (optional) */
+        if (params->cofactor == NULL)
+                {
+                if (b)
+                        {
+                        BN_free(b);
+                        b = NULL;
+                        }
+                }
+        else
+                if ((b = ASN1_INTEGER_to_BN(params->cofactor, b)) == NULL)
+                        {
+                        ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, ERR_R_ASN1_LIB);
+                        goto err;
+                        }
+        /* set the generator, order and cofactor (if present) */
+        if (!EC_GROUP_set_generator(ret, point, a, b))
+                {
+                ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, ERR_R_EC_LIB);
+                goto err;
+                }
+
+        ok = 1;
+
+err:    if (!ok)
+                {
+                if (ret) 
+                        EC_GROUP_clear_free(ret);
+                ret = NULL;
+                }
+
+        if (p)  
+                BN_free(p);
+        if (a)  
+                BN_free(a);
+        if (b)  
+                BN_free(b);
+        if (point)      
+                EC_POINT_free(point);
+        return(ret);
+}
+
+EC_GROUP *ec_asn1_pkparameters2group(const ECPKPARAMETERS *params)
+        {
+        EC_GROUP *ret=NULL;
+        int      tmp=0;
+
+        if (params == NULL)
+                {
+                ECerr(EC_F_EC_ASN1_PKPARAMETERS2GROUP, 
+                      EC_R_MISSING_PARAMETERS);
+                return NULL;
+                }
+
+        if (params->type == 0)
+                { /* the curve is given by an OID */
+                tmp = OBJ_obj2nid(params->value.named_curve);
+                if ((ret = EC_GROUP_new_by_curve_name(tmp)) == NULL)
+                        {
+                        ECerr(EC_F_EC_ASN1_PKPARAMETERS2GROUP, 
+                              EC_R_EC_GROUP_NEW_BY_NAME_FAILURE);
+                        return NULL;
+                        }
+                EC_GROUP_set_asn1_flag(ret, OPENSSL_EC_NAMED_CURVE);
+                }
+        else if (params->type == 1)
+                { /* the parameters are given by a ECPARAMETERS
+                   * structure */
+                ret = ec_asn1_parameters2group(params->value.parameters);
+                if (!ret)
+                        {
+                        ECerr(EC_F_EC_ASN1_PKPARAMETERS2GROUP, ERR_R_EC_LIB);
+                        return NULL;
+                        }
+                EC_GROUP_set_asn1_flag(ret, 0x0);
+                }
+        else if (params->type == 2)
+                { /* implicitlyCA */
+                return NULL;
+                }
+        else
+                {
+                ECerr(EC_F_EC_ASN1_PKPARAMETERS2GROUP, EC_R_ASN1_ERROR);
+                return NULL;
+                }
+
+        return ret;
+        }
+
+/* EC_GROUP <-> DER encoding of ECPKPARAMETERS */
+
+EC_GROUP *d2i_ECPKParameters(EC_GROUP **a, const unsigned char **in, long len)
+        {
+        EC_GROUP        *group  = NULL;
+        ECPKPARAMETERS  *params = NULL;
+
+        if ((params = d2i_ECPKPARAMETERS(NULL, in, len)) == NULL)
+                {
+                ECerr(EC_F_D2I_ECPKPARAMETERS, EC_R_D2I_ECPKPARAMETERS_FAILURE);
+                ECPKPARAMETERS_free(params);
+                return NULL;
+                }
+        
+        if ((group = ec_asn1_pkparameters2group(params)) == NULL)
+                {
+                ECerr(EC_F_D2I_ECPKPARAMETERS, EC_R_PKPARAMETERS2GROUP_FAILURE);
+                return NULL; 
+                }
+
+        
+        if (a && *a)
+                EC_GROUP_clear_free(*a);
+        if (a)
+                *a = group;
+
+        ECPKPARAMETERS_free(params);
+        return(group);
+        }
+
+int i2d_ECPKParameters(const EC_GROUP *a, unsigned char **out)
+        {
+        int             ret=0;
+        ECPKPARAMETERS  *tmp = ec_asn1_group2pkparameters(a, NULL);
+        if (tmp == NULL)
+                {
+                ECerr(EC_F_I2D_ECPKPARAMETERS, EC_R_GROUP2PKPARAMETERS_FAILURE);
+                return 0;
+                }
+        if ((ret = i2d_ECPKPARAMETERS(tmp, out)) == 0)
+                {
+                ECerr(EC_F_I2D_ECPKPARAMETERS, EC_R_I2D_ECPKPARAMETERS_FAILURE);
+                ECPKPARAMETERS_free(tmp);
+                return 0;
+                }       
+        ECPKPARAMETERS_free(tmp);
+        return(ret);
+        }
+
+/* some EC_KEY functions */
+
+EC_KEY *d2i_ECPrivateKey(EC_KEY **a, const unsigned char **in, long len)
+        {
+        int             ok=0;
+        EC_KEY          *ret=NULL;
+        EC_PRIVATEKEY   *priv_key=NULL;
+
+        if ((priv_key = EC_PRIVATEKEY_new()) == NULL)
+                {
+                ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_MALLOC_FAILURE);
+                return NULL;
+                }
+
+        if ((priv_key = d2i_EC_PRIVATEKEY(&priv_key, in, len)) == NULL)
+                {
+                ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB);
+                EC_PRIVATEKEY_free(priv_key);
+                return NULL;
+                }
+
+        if (a == NULL || *a == NULL)
+                {
+                if ((ret = EC_KEY_new()) == NULL)       
+                        {
+                        ECerr(EC_F_D2I_ECPRIVATEKEY,
+                                 ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                if (a)
+                        *a = ret;
+                }
+        else
+                ret = *a;
+
+        if (priv_key->parameters)
+                {
+                if (ret->group)
+                        EC_GROUP_clear_free(ret->group);
+                ret->group = ec_asn1_pkparameters2group(priv_key->parameters);
+                }
+
+        if (ret->group == NULL)
+                {
+                ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB);
+                goto err;
+                }
+
+        ret->version = priv_key->version;
+
+        if (priv_key->privateKey)
+                {
+                ret->priv_key = BN_bin2bn(
+                        M_ASN1_STRING_data(priv_key->privateKey),
+                        M_ASN1_STRING_length(priv_key->privateKey),
+                        ret->priv_key);
+                if (ret->priv_key == NULL)
+                        {
+                        ECerr(EC_F_D2I_ECPRIVATEKEY,
+                              ERR_R_BN_LIB);
+                        goto err;
+                        }
+                }
+        else
+                {
+                ECerr(EC_F_D2I_ECPRIVATEKEY, 
+                      EC_R_MISSING_PRIVATE_KEY);
+                goto err;
+                }
+
+        if (priv_key->publicKey)
+                {
+                const unsigned char *pub_oct;
+                size_t pub_oct_len;
+
+                if (ret->pub_key)
+                        EC_POINT_clear_free(ret->pub_key);
+                ret->pub_key = EC_POINT_new(ret->group);
+                if (ret->pub_key == NULL)
+                        {
+                        ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                pub_oct     = M_ASN1_STRING_data(priv_key->publicKey);
+                pub_oct_len = M_ASN1_STRING_length(priv_key->publicKey);
+                /* save the point conversion form */
+                ret->conv_form = (point_conversion_form_t)(pub_oct[0] & ~0x01);
+                if (!EC_POINT_oct2point(ret->group, ret->pub_key,
+                        pub_oct, pub_oct_len, NULL))
+                        {
+                        ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                }
+
+        ok = 1;
+err:
+        if (!ok)
+                {
+                if (ret)
+                        EC_KEY_free(ret);
+                ret = NULL;
+                }
+
+        if (priv_key)
+                EC_PRIVATEKEY_free(priv_key);
+
+        return(ret);
+        }
+
+int     i2d_ECPrivateKey(EC_KEY *a, unsigned char **out)
+        {
+        int             ret=0, ok=0;
+        unsigned char   *buffer=NULL;
+        size_t          buf_len=0, tmp_len;
+        EC_PRIVATEKEY   *priv_key=NULL;
+
+        if (a == NULL || a->group == NULL || a->priv_key == NULL)
+                {
+                ECerr(EC_F_I2D_ECPRIVATEKEY,
+                      ERR_R_PASSED_NULL_PARAMETER);
+                goto err;
+                }
+
+        if ((priv_key = EC_PRIVATEKEY_new()) == NULL)
+                {
+                ECerr(EC_F_I2D_ECPRIVATEKEY,
+                      ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        priv_key->version = a->version;
+
+        buf_len = (size_t)BN_num_bytes(a->priv_key);
+        buffer = OPENSSL_malloc(buf_len);
+        if (buffer == NULL)
+                {
+                ECerr(EC_F_I2D_ECPRIVATEKEY,
+                      ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+        
+        if (!BN_bn2bin(a->priv_key, buffer))
+                {
+                ECerr(EC_F_I2D_ECPRIVATEKEY, ERR_R_BN_LIB);
+                goto err;
+                }
+
+        if (!M_ASN1_OCTET_STRING_set(priv_key->privateKey, buffer, buf_len))
+                {
+                ECerr(EC_F_I2D_ECPRIVATEKEY, ERR_R_ASN1_LIB);
+                goto err;
+                }       
+
+        if (!(a->enc_flag & EC_PKEY_NO_PARAMETERS))
+                {
+                if ((priv_key->parameters = ec_asn1_group2pkparameters(
+                        a->group, priv_key->parameters)) == NULL)
+                        {
+                        ECerr(EC_F_I2D_ECPRIVATEKEY, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                }
+
+        if (!(a->enc_flag & EC_PKEY_NO_PUBKEY))
+                {
+                priv_key->publicKey = M_ASN1_BIT_STRING_new();
+                if (priv_key->publicKey == NULL)
+                        {
+                        ECerr(EC_F_I2D_ECPRIVATEKEY,
+                                ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+
+                tmp_len = EC_POINT_point2oct(a->group, a->pub_key, 
+                                a->conv_form, NULL, 0, NULL);
+
+                if (tmp_len > buf_len)
+                        {
+                        unsigned char *tmp_buffer = OPENSSL_realloc(buffer, tmp_len);
+                        if (!tmp_buffer)
+                                {
+                                ECerr(EC_F_I2D_ECPRIVATEKEY, ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+                        buffer = tmp_buffer;
+                        buf_len = tmp_len;
+                        }
+
+                if (!EC_POINT_point2oct(a->group, a->pub_key, 
+                        a->conv_form, buffer, buf_len, NULL))
+                        {
+                        ECerr(EC_F_I2D_ECPRIVATEKEY, ERR_R_EC_LIB);
+                        goto err;
+                        }
+
+                priv_key->publicKey->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
+                priv_key->publicKey->flags |= ASN1_STRING_FLAG_BITS_LEFT;
+                if (!M_ASN1_BIT_STRING_set(priv_key->publicKey, buffer, 
+                                buf_len))
+                        {
+                        ECerr(EC_F_I2D_ECPRIVATEKEY, ERR_R_ASN1_LIB);
+                        goto err;
+                        }
+                }
+
+        if ((ret = i2d_EC_PRIVATEKEY(priv_key, out)) == 0)
+                {
+                ECerr(EC_F_I2D_ECPRIVATEKEY, ERR_R_EC_LIB);
+                goto err;
+                }
+        ok=1;
+err:
+        if (buffer)
+                OPENSSL_free(buffer);
+        if (priv_key)
+                EC_PRIVATEKEY_free(priv_key);
+        return(ok?ret:0);
+        }
+
+int i2d_ECParameters(EC_KEY *a, unsigned char **out)
+        {
+        if (a == NULL)
+                {
+                ECerr(EC_F_I2D_ECPARAMETERS, ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        return i2d_ECPKParameters(a->group, out);
+        }
+
+EC_KEY *d2i_ECParameters(EC_KEY **a, const unsigned char **in, long len)
+        {
+        EC_KEY   *ret;
+
+        if (in == NULL || *in == NULL)
+                {
+                ECerr(EC_F_D2I_ECPARAMETERS, ERR_R_PASSED_NULL_PARAMETER);
+                return NULL;
+                }
+
+        if (a == NULL || *a == NULL)
+                {
+                if ((ret = EC_KEY_new()) == NULL)
+                        {
+                        ECerr(EC_F_D2I_ECPARAMETERS, ERR_R_MALLOC_FAILURE);
+                        return NULL;
+                        }
+                if (a)
+                        *a = ret;
+                }
+        else
+                ret = *a;
+
+        if (!d2i_ECPKParameters(&ret->group, in, len))
+                {
+                ECerr(EC_F_D2I_ECPARAMETERS, ERR_R_EC_LIB);
+                return NULL;
+                }
+
+        return ret;
+        }
+
+EC_KEY *o2i_ECPublicKey(EC_KEY **a, const unsigned char **in, long len)
+        {
+        EC_KEY *ret=NULL;
+
+        if (a == NULL || (*a) == NULL || (*a)->group == NULL)
+                {
+                /* sorry, but a EC_GROUP-structur is necessary
+                 * to set the public key */
+                ECerr(EC_F_O2I_ECPUBLICKEY, ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        ret = *a;
+        if (ret->pub_key == NULL && 
+                (ret->pub_key = EC_POINT_new(ret->group)) == NULL)
+                {
+                ECerr(EC_F_O2I_ECPUBLICKEY, ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        if (!EC_POINT_oct2point(ret->group, ret->pub_key, *in, len, NULL))
+                {
+                ECerr(EC_F_O2I_ECPUBLICKEY, ERR_R_EC_LIB);
+                return 0;
+                }
+        /* save the point conversion form */
+        ret->conv_form = (point_conversion_form_t)(*in[0] & ~0x01);
+        *in += len;
+        return ret;
+        }
+
+int i2o_ECPublicKey(EC_KEY *a, unsigned char **out)
+        {
+        size_t buf_len=0;
+        int new_buffer = 0;
+
+        if (a == NULL) 
+                {
+                ECerr(EC_F_I2O_ECPUBLICKEY, ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+
+        buf_len = EC_POINT_point2oct(a->group, a->pub_key, 
+                              a->conv_form, NULL, 0, NULL);
+
+        if (out == NULL || buf_len == 0)
+        /* out == NULL => just return the length of the octet string */
+                return buf_len;
+
+        if (*out == NULL)
+                {
+                if ((*out = OPENSSL_malloc(buf_len)) == NULL)
+                        {
+                        ECerr(EC_F_I2O_ECPUBLICKEY, ERR_R_MALLOC_FAILURE);
+                        return 0;
+                        }
+                new_buffer = 1;
+                }
+        if (!EC_POINT_point2oct(a->group, a->pub_key, a->conv_form,
+                                *out, buf_len, NULL))
+                {
+                ECerr(EC_F_I2O_ECPUBLICKEY, ERR_R_EC_LIB);
+                OPENSSL_free(*out);
+                *out = NULL;
+                return 0;
+                }
+        if (!new_buffer)
+                *out += buf_len;
+        return buf_len;
+        }
diff --git a/src/lib/libssl/src/crypto/ec/ec_check.c b/src/lib/libssl/src/crypto/ec/ec_check.c
new file mode 100644
index 0000000000..0e316b4b3f
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ec/ec_check.c
@@ -0,0 +1,123 @@
+/* crypto/ec/ec_check.c */
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "ec_lcl.h"
+#include <openssl/err.h>
+
+int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
+        {
+        int ret = 0;
+        BIGNUM *order;
+        BN_CTX *new_ctx = NULL;
+        EC_POINT *point = NULL;
+
+        if (ctx == NULL)
+                {
+                ctx = new_ctx = BN_CTX_new();
+                if (ctx == NULL)
+                        {
+                        ECerr(EC_F_EC_GROUP_CHECK, ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                }
+        BN_CTX_start(ctx);
+        if ((order = BN_CTX_get(ctx)) == NULL) goto err;
+
+        /* check the discriminant */
+        if (!EC_GROUP_check_discriminant(group, ctx))
+                {
+                ECerr(EC_F_EC_GROUP_CHECK, EC_R_DISCRIMINANT_IS_ZERO);
+                goto err;
+                }
+
+        /* check the generator */
+        if (group->generator == NULL)
+                {
+                ECerr(EC_F_EC_GROUP_CHECK, EC_R_UNDEFINED_GENERATOR);
+                goto err;
+                }
+        if (!EC_POINT_is_on_curve(group, group->generator, ctx))
+                {
+                ECerr(EC_F_EC_GROUP_CHECK, EC_R_POINT_IS_NOT_ON_CURVE);
+                goto err;
+                }
+
+        /* check the order of the generator */
+        if ((point = EC_POINT_new(group)) == NULL) goto err;
+        if (!EC_GROUP_get_order(group, order, ctx)) goto err; 
+        if (BN_is_zero(order))
+                {
+                ECerr(EC_F_EC_GROUP_CHECK, EC_R_UNDEFINED_ORDER);
+                goto err;
+                }
+        
+        if (!EC_POINT_mul(group, point, order, NULL, NULL, ctx)) goto err;
+        if (!EC_POINT_is_at_infinity(group, point))
+                {
+                ECerr(EC_F_EC_GROUP_CHECK, EC_R_INVALID_GROUP_ORDER);
+                goto err;
+                }
+
+        ret = 1;
+
+err:
+        if (ctx != NULL)
+                BN_CTX_end(ctx);
+        if (new_ctx != NULL)
+                BN_CTX_free(new_ctx);
+        if (point)
+                EC_POINT_free(point);
+        return ret;
+        }
diff --git a/src/lib/libssl/src/crypto/ec/ec_curve.c b/src/lib/libssl/src/crypto/ec/ec_curve.c
new file mode 100644
index 0000000000..beac20969b
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ec/ec_curve.c
@@ -0,0 +1,1270 @@
+/* crypto/ec/ec_curve.c */
+/*
+ * Written by Nils Larsch for the OpenSSL project.
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * The elliptic curve binary polynomial software is originally written by 
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
+
+#include "ec_lcl.h"
+#include <openssl/err.h>
+#include <openssl/obj_mac.h>
+
+typedef struct ec_curve_data_st {
+        int     field_type;     /* either NID_X9_62_prime_field or
+                                 * NID_X9_62_characteristic_two_field */
+        const char *p;          /* either a prime number or a polynomial */
+        const char *a;
+        const char *b;
+        const char *x;          /* the x coordinate of the generator */
+        const char *y;          /* the y coordinate of the generator */
+        const char *order;      /* the order of the group generated by the
+                                 * generator */
+        const BN_ULONG cofactor;/* the cofactor */
+        const unsigned char *seed;/* the seed (optional) */
+        size_t  seed_len;
+        const char *comment;    /* a short description of the curve */
+} EC_CURVE_DATA;
+
+/* the nist prime curves */
+static const unsigned char _EC_NIST_PRIME_192_SEED[] = {
+        0x30,0x45,0xAE,0x6F,0xC8,0x42,0x2F,0x64,0xED,0x57,
+        0x95,0x28,0xD3,0x81,0x20,0xEA,0xE1,0x21,0x96,0xD5};
+static const EC_CURVE_DATA _EC_NIST_PRIME_192 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
+        "64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1",
+        "188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012",
+        "07192b95ffc8da78631011ed6b24cdd573f977a11e794811",
+        "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831",1,
+        _EC_NIST_PRIME_192_SEED, 20,
+        "NIST/X9.62/SECG curve over a 192 bit prime field"
+        };
+
+static const unsigned char _EC_NIST_PRIME_224_SEED[] = {
+        0xBD,0x71,0x34,0x47,0x99,0xD5,0xC7,0xFC,0xDC,0x45,
+        0xB5,0x9F,0xA3,0xB9,0xAB,0x8F,0x6A,0x94,0x8B,0xC5};
+static const EC_CURVE_DATA _EC_NIST_PRIME_224 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001",
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE",
+        "B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4",
+        "B70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21",
+        "bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34",
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",1,
+        _EC_NIST_PRIME_224_SEED, 20,
+        "NIST/SECG curve over a 224 bit prime field"
+        };
+
+static const unsigned char _EC_NIST_PRIME_384_SEED[] = {
+        0xA3,0x35,0x92,0x6A,0xA3,0x19,0xA2,0x7A,0x1D,0x00,
+        0x89,0x6A,0x67,0x73,0xA4,0x82,0x7A,0xCD,0xAC,0x73};
+static const EC_CURVE_DATA _EC_NIST_PRIME_384 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFF"
+        "FFF0000000000000000FFFFFFFF",
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFF"
+        "FFF0000000000000000FFFFFFFC",
+        "B3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC6563"
+        "98D8A2ED19D2A85C8EDD3EC2AEF",
+        "AA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F"
+        "25DBF55296C3A545E3872760AB7",
+        "3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b"
+        "1ce1d7e819d7a431d7c90ea0e5f",
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0"
+        "DB248B0A77AECEC196ACCC52973",1,
+        _EC_NIST_PRIME_384_SEED, 20,
+        "NIST/SECG curve over a 384 bit prime field"
+        };
+
+static const unsigned char _EC_NIST_PRIME_521_SEED[] = {
+        0xD0,0x9E,0x88,0x00,0x29,0x1C,0xB8,0x53,0x96,0xCC,
+        0x67,0x17,0x39,0x32,0x84,0xAA,0xA0,0xDA,0x64,0xBA};
+static const EC_CURVE_DATA _EC_NIST_PRIME_521 = {
+        NID_X9_62_prime_field,
+        "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
+        "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC",
+        "051953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156"
+        "193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00",
+        "C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14"
+        "B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66",
+        "011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c9"
+        "7ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650",
+        "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51"
+        "868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409",1,
+        _EC_NIST_PRIME_521_SEED, 20,
+        "NIST/SECG curve over a 521 bit prime field"
+        };
+/* the x9.62 prime curves (minus the nist prime curves) */
+static const unsigned char _EC_X9_62_PRIME_192V2_SEED[] = {
+        0x31,0xA9,0x2E,0xE2,0x02,0x9F,0xD1,0x0D,0x90,0x1B,
+        0x11,0x3E,0x99,0x07,0x10,0xF0,0xD2,0x1A,0xC6,0xB6};
+static const EC_CURVE_DATA _EC_X9_62_PRIME_192V2 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
+        "CC22D6DFB95C6B25E49C0D6364A4E5980C393AA21668D953",
+        "EEA2BAE7E1497842F2DE7769CFE9C989C072AD696F48034A",
+        "6574d11d69b6ec7a672bb82a083df2f2b0847de970b2de15",
+        "FFFFFFFFFFFFFFFFFFFFFFFE5FB1A724DC80418648D8DD31",1,
+        _EC_X9_62_PRIME_192V2_SEED, 20,
+        "X9.62 curve over a 192 bit prime field"
+        };
+
+static const unsigned char _EC_X9_62_PRIME_192V3_SEED[] = {
+        0xC4,0x69,0x68,0x44,0x35,0xDE,0xB3,0x78,0xC4,0xB6,
+        0x5C,0xA9,0x59,0x1E,0x2A,0x57,0x63,0x05,0x9A,0x2E};
+static const EC_CURVE_DATA _EC_X9_62_PRIME_192V3 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
+        "22123DC2395A05CAA7423DAECCC94760A7D462256BD56916",
+        "7D29778100C65A1DA1783716588DCE2B8B4AEE8E228F1896",
+        "38a90f22637337334b49dcb66a6dc8f9978aca7648a943b0",
+        "FFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13",1,
+        _EC_X9_62_PRIME_192V3_SEED, 20,
+        "X9.62 curve over a 192 bit prime field"
+        };
+
+static const unsigned char _EC_X9_62_PRIME_239V1_SEED[] = {
+        0xE4,0x3B,0xB4,0x60,0xF0,0xB8,0x0C,0xC0,0xC0,0xB0,
+        0x75,0x79,0x8E,0x94,0x80,0x60,0xF8,0x32,0x1B,0x7D};
+static const EC_CURVE_DATA _EC_X9_62_PRIME_239V1 = {
+        NID_X9_62_prime_field,
+        "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
+        "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
+        "6B016C3BDCF18941D0D654921475CA71A9DB2FB27D1D37796185C2942C0A",
+        "0FFA963CDCA8816CCC33B8642BEDF905C3D358573D3F27FBBD3B3CB9AAAF",
+        "7debe8e4e90a5dae6e4054ca530ba04654b36818ce226b39fccb7b02f1ae",
+        "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B",1,
+        _EC_X9_62_PRIME_239V1_SEED, 20,
+        "X9.62 curve over a 239 bit prime field"
+        };
+
+static const unsigned char _EC_X9_62_PRIME_239V2_SEED[] = {
+        0xE8,0xB4,0x01,0x16,0x04,0x09,0x53,0x03,0xCA,0x3B,
+        0x80,0x99,0x98,0x2B,0xE0,0x9F,0xCB,0x9A,0xE6,0x16};
+static const EC_CURVE_DATA _EC_X9_62_PRIME_239V2 = {
+        NID_X9_62_prime_field,
+        "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
+        "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
+        "617FAB6832576CBBFED50D99F0249C3FEE58B94BA0038C7AE84C8C832F2C",
+        "38AF09D98727705120C921BB5E9E26296A3CDCF2F35757A0EAFD87B830E7",
+        "5b0125e4dbea0ec7206da0fc01d9b081329fb555de6ef460237dff8be4ba",
+        "7FFFFFFFFFFFFFFFFFFFFFFF800000CFA7E8594377D414C03821BC582063",1,
+        _EC_X9_62_PRIME_239V2_SEED, 20,
+        "X9.62 curve over a 239 bit prime field"
+        };
+
+static const unsigned char _EC_X9_62_PRIME_239V3_SEED[] = {
+        0x7D,0x73,0x74,0x16,0x8F,0xFE,0x34,0x71,0xB6,0x0A,
+        0x85,0x76,0x86,0xA1,0x94,0x75,0xD3,0xBF,0xA2,0xFF};
+static const EC_CURVE_DATA _EC_X9_62_PRIME_239V3 = {
+        NID_X9_62_prime_field,
+        "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
+        "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
+        "255705FA2A306654B1F4CB03D6A750A30C250102D4988717D9BA15AB6D3E",
+        "6768AE8E18BB92CFCF005C949AA2C6D94853D0E660BBF854B1C9505FE95A",
+        "1607e6898f390c06bc1d552bad226f3b6fcfe48b6e818499af18e3ed6cf3",
+        "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF975DEB41B3A6057C3C432146526551",1,
+        _EC_X9_62_PRIME_239V3_SEED, 20,
+        "X9.62 curve over a 239 bit prime field"
+        };
+
+static const unsigned char _EC_X9_62_PRIME_256V1_SEED[] = {
+        0xC4,0x9D,0x36,0x08,0x86,0xE7,0x04,0x93,0x6A,0x66,
+        0x78,0xE1,0x13,0x9D,0x26,0xB7,0x81,0x9F,0x7E,0x90};
+static const EC_CURVE_DATA _EC_X9_62_PRIME_256V1 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF",
+        "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC",
+        "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B",
+        "6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296",
+        "4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
+        "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551",1,
+        _EC_X9_62_PRIME_256V1_SEED, 20,
+        "X9.62/SECG curve over a 256 bit prime field"
+        };
+/* the secg prime curves (minus the nist and x9.62 prime curves) */
+static const unsigned char _EC_SECG_PRIME_112R1_SEED[] = {
+        0x00,0xF5,0x0B,0x02,0x8E,0x4D,0x69,0x6E,0x67,0x68,
+        0x75,0x61,0x51,0x75,0x29,0x04,0x72,0x78,0x3F,0xB1};
+static const EC_CURVE_DATA _EC_SECG_PRIME_112R1 = {
+        NID_X9_62_prime_field,
+        "DB7C2ABF62E35E668076BEAD208B",
+        "DB7C2ABF62E35E668076BEAD2088",
+        "659EF8BA043916EEDE8911702B22",
+        "09487239995A5EE76B55F9C2F098",
+        "a89ce5af8724c0a23e0e0ff77500",
+        "DB7C2ABF62E35E7628DFAC6561C5",1,
+        _EC_SECG_PRIME_112R1_SEED, 20,
+        "SECG/WTLS curve over a 112 bit prime field"
+        };
+
+static const unsigned char _EC_SECG_PRIME_112R2_SEED[] = {
+        0x00,0x27,0x57,0xA1,0x11,0x4D,0x69,0x6E,0x67,0x68,
+        0x75,0x61,0x51,0x75,0x53,0x16,0xC0,0x5E,0x0B,0xD4};
+static const EC_CURVE_DATA _EC_SECG_PRIME_112R2 = {
+        NID_X9_62_prime_field,
+        "DB7C2ABF62E35E668076BEAD208B",
+        "6127C24C05F38A0AAAF65C0EF02C",
+        "51DEF1815DB5ED74FCC34C85D709",
+        "4BA30AB5E892B4E1649DD0928643",
+        "adcd46f5882e3747def36e956e97",
+        "36DF0AAFD8B8D7597CA10520D04B",4, 
+        _EC_SECG_PRIME_112R2_SEED, 20,
+        "SECG curve over a 112 bit prime field"
+        };
+
+static const unsigned char _EC_SECG_PRIME_128R1_SEED[] = {
+        0x00,0x0E,0x0D,0x4D,0x69,0x6E,0x67,0x68,0x75,0x61,
+        0x51,0x75,0x0C,0xC0,0x3A,0x44,0x73,0xD0,0x36,0x79};
+static const EC_CURVE_DATA _EC_SECG_PRIME_128R1 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF",
+        "FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFC",
+        "E87579C11079F43DD824993C2CEE5ED3",
+        "161FF7528B899B2D0C28607CA52C5B86",
+        "cf5ac8395bafeb13c02da292dded7a83",
+        "FFFFFFFE0000000075A30D1B9038A115",1,
+        _EC_SECG_PRIME_128R1_SEED, 20,
+        "SECG curve over a 128 bit prime field"
+        };
+
+static const unsigned char _EC_SECG_PRIME_128R2_SEED[] = {
+        0x00,0x4D,0x69,0x6E,0x67,0x68,0x75,0x61,0x51,0x75,
+        0x12,0xD8,0xF0,0x34,0x31,0xFC,0xE6,0x3B,0x88,0xF4};
+static const EC_CURVE_DATA _EC_SECG_PRIME_128R2 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF",
+        "D6031998D1B3BBFEBF59CC9BBFF9AEE1",
+        "5EEEFCA380D02919DC2C6558BB6D8A5D",
+        "7B6AA5D85E572983E6FB32A7CDEBC140",
+        "27b6916a894d3aee7106fe805fc34b44",
+        "3FFFFFFF7FFFFFFFBE0024720613B5A3",4,
+        _EC_SECG_PRIME_128R2_SEED, 20,
+        "SECG curve over a 128 bit prime field"
+        };
+
+static const EC_CURVE_DATA _EC_SECG_PRIME_160K1 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
+        "0",
+        "7",
+        "3B4C382CE37AA192A4019E763036F4F5DD4D7EBB",
+        "938cf935318fdced6bc28286531733c3f03c4fee",
+        "0100000000000000000001B8FA16DFAB9ACA16B6B3",1,
+        NULL, 0,
+        "SECG curve over a 160 bit prime field"
+        };
+
+static const unsigned char _EC_SECG_PRIME_160R1_SEED[] = {
+        0x10,0x53,0xCD,0xE4,0x2C,0x14,0xD6,0x96,0xE6,0x76,
+        0x87,0x56,0x15,0x17,0x53,0x3B,0xF3,0xF8,0x33,0x45};
+static const EC_CURVE_DATA _EC_SECG_PRIME_160R1 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF",
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC",
+        "1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45",
+        "4A96B5688EF573284664698968C38BB913CBFC82",
+        "23a628553168947d59dcc912042351377ac5fb32",
+        "0100000000000000000001F4C8F927AED3CA752257",1,
+        _EC_SECG_PRIME_160R1_SEED, 20,
+        "SECG curve over a 160 bit prime field"
+        };
+
+static const unsigned char _EC_SECG_PRIME_160R2_SEED[] = {
+        0xB9,0x9B,0x99,0xB0,0x99,0xB3,0x23,0xE0,0x27,0x09,
+        0xA4,0xD6,0x96,0xE6,0x76,0x87,0x56,0x15,0x17,0x51};
+static const EC_CURVE_DATA _EC_SECG_PRIME_160R2 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC70",
+        "B4E134D3FB59EB8BAB57274904664D5AF50388BA",
+        "52DCB034293A117E1F4FF11B30F7199D3144CE6D",
+        "feaffef2e331f296e071fa0df9982cfea7d43f2e",
+        "0100000000000000000000351EE786A818F3A1A16B",1,
+        _EC_SECG_PRIME_160R2_SEED, 20,
+        "SECG/WTLS curve over a 160 bit prime field"
+        };
+
+static const EC_CURVE_DATA _EC_SECG_PRIME_192K1 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37",
+        "0",
+        "3",
+        "DB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D",
+        "9b2f2f6d9c5628a7844163d015be86344082aa88d95e2f9d",
+        "FFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D",1,
+        NULL, 20,
+        "SECG curve over a 192 bit prime field"
+        };
+
+static const EC_CURVE_DATA _EC_SECG_PRIME_224K1 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D",
+        "0",
+        "5",
+        "A1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C",
+        "7e089fed7fba344282cafbd6f7e319f7c0b0bd59e2ca4bdb556d61a5",
+        "010000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7",1,
+        NULL, 20,
+        "SECG curve over a 224 bit prime field"
+        };
+
+static const EC_CURVE_DATA _EC_SECG_PRIME_256K1 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F",
+        "0",
+        "7",
+        "79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798",
+        "483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8",
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141",1,
+        NULL, 20,
+        "SECG curve over a 256 bit prime field"
+        };
+
+/* some wap/wtls curves */
+static const EC_CURVE_DATA _EC_WTLS_8 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFDE7",
+        "0",
+        "3",
+        "1",
+        "2",
+        "0100000000000001ECEA551AD837E9",1,
+        NULL, 20,
+        "WTLS curve over a 112 bit prime field"
+        };
+
+static const EC_CURVE_DATA _EC_WTLS_9 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC808F",
+        "0",
+        "3",
+        "1",
+        "2",
+        "0100000000000000000001CDC98AE0E2DE574ABF33",1,
+        NULL, 20,
+        "WTLS curve over a 160 bit prime field"
+        };
+
+static const EC_CURVE_DATA _EC_WTLS_12 = {
+        NID_X9_62_prime_field,
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001",
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE",
+        "B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4",
+        "B70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21",
+        "bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34",
+        "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D", 1,
+        NULL, 0,
+        "WTLS curvs over a 224 bit prime field"
+        };
+
+/* characteristic two curves */
+static const unsigned char _EC_SECG_CHAR2_113R1_SEED[] = {
+        0x10,0xE7,0x23,0xAB,0x14,0xD6,0x96,0xE6,0x76,0x87,
+        0x56,0x15,0x17,0x56,0xFE,0xBF,0x8F,0xCB,0x49,0xA9};
+static const EC_CURVE_DATA _EC_SECG_CHAR2_113R1 = {
+        NID_X9_62_characteristic_two_field,
+        "020000000000000000000000000201",
+        "003088250CA6E7C7FE649CE85820F7",
+        "00E8BEE4D3E2260744188BE0E9C723",
+        "009D73616F35F4AB1407D73562C10F",
+        "00A52830277958EE84D1315ED31886",
+        "0100000000000000D9CCEC8A39E56F", 2,
+        _EC_SECG_CHAR2_113R1_SEED, 20,
+        "SECG curve over a 113 bit binary field"
+        };
+
+static const unsigned char _EC_SECG_CHAR2_113R2_SEED[] = {
+        0x10,0xC0,0xFB,0x15,0x76,0x08,0x60,0xDE,0xF1,0xEE,
+        0xF4,0xD6,0x96,0xE6,0x76,0x87,0x56,0x15,0x17,0x5D};
+static const EC_CURVE_DATA _EC_SECG_CHAR2_113R2 = {
+        NID_X9_62_characteristic_two_field,
+        "020000000000000000000000000201",
+        "00689918DBEC7E5A0DD6DFC0AA55C7",
+        "0095E9A9EC9B297BD4BF36E059184F",
+        "01A57A6A7B26CA5EF52FCDB8164797",
+        "00B3ADC94ED1FE674C06E695BABA1D",
+        "010000000000000108789B2496AF93", 2,
+        _EC_SECG_CHAR2_113R2_SEED, 20,
+        "SECG curve over a 113 bit binary field"
+        };
+
+static const unsigned char _EC_SECG_CHAR2_131R1_SEED[] = {
+        0x4D,0x69,0x6E,0x67,0x68,0x75,0x61,0x51,0x75,0x98,
+        0x5B,0xD3,0xAD,0xBA,0xDA,0x21,0xB4,0x3A,0x97,0xE2};
+static const EC_CURVE_DATA _EC_SECG_CHAR2_131R1 = {
+        NID_X9_62_characteristic_two_field,
+        "080000000000000000000000000000010D",
+        "07A11B09A76B562144418FF3FF8C2570B8",
+        "0217C05610884B63B9C6C7291678F9D341",
+        "0081BAF91FDF9833C40F9C181343638399",
+        "078C6E7EA38C001F73C8134B1B4EF9E150",
+        "0400000000000000023123953A9464B54D", 2,
+        _EC_SECG_CHAR2_131R1_SEED, 20,
+        "SECG/WTLS curve over a 131 bit binary field"
+        };
+
+static const unsigned char _EC_SECG_CHAR2_131R2_SEED[] = {
+        0x98,0x5B,0xD3,0xAD,0xBA,0xD4,0xD6,0x96,0xE6,0x76,
+        0x87,0x56,0x15,0x17,0x5A,0x21,0xB4,0x3A,0x97,0xE3};
+static const EC_CURVE_DATA _EC_SECG_CHAR2_131R2 = {
+        NID_X9_62_characteristic_two_field,
+        "080000000000000000000000000000010D",
+        "03E5A88919D7CAFCBF415F07C2176573B2",
+        "04B8266A46C55657AC734CE38F018F2192",
+        "0356DCD8F2F95031AD652D23951BB366A8",
+        "0648F06D867940A5366D9E265DE9EB240F",
+        "0400000000000000016954A233049BA98F", 2,
+        _EC_SECG_CHAR2_131R2_SEED, 20,
+        "SECG curve over a 131 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_NIST_CHAR2_163K = {
+        NID_X9_62_characteristic_two_field,
+        "0800000000000000000000000000000000000000C9",
+        "1",
+        "1",
+        "02FE13C0537BBC11ACAA07D793DE4E6D5E5C94EEE8",
+        "0289070FB05D38FF58321F2E800536D538CCDAA3D9",
+        "04000000000000000000020108A2E0CC0D99F8A5EF", 2,
+        NULL, 0,
+        "NIST/SECG/WTLS curve over a 163 bit binary field"
+        };
+
+static const unsigned char _EC_SECG_CHAR2_163R1_SEED[] = {
+        0x24,0xB7,0xB1,0x37,0xC8,0xA1,0x4D,0x69,0x6E,0x67,
+        0x68,0x75,0x61,0x51,0x75,0x6F,0xD0,0xDA,0x2E,0x5C};
+static const EC_CURVE_DATA _EC_SECG_CHAR2_163R1 = {
+        NID_X9_62_characteristic_two_field,
+        "0800000000000000000000000000000000000000C9",
+        "07B6882CAAEFA84F9554FF8428BD88E246D2782AE2",
+        "0713612DCDDCB40AAB946BDA29CA91F73AF958AFD9",
+        "0369979697AB43897789566789567F787A7876A654",
+        "00435EDB42EFAFB2989D51FEFCE3C80988F41FF883",
+        "03FFFFFFFFFFFFFFFFFFFF48AAB689C29CA710279B", 2,
+/* The algorithm used to derive the curve parameters from
+ * the seed used here is slightly different than the
+ * algorithm described in X9.62 .
+ */
+#if 0
+        _EC_SECG_CHAR2_163R1_SEED, 20,
+#else
+        NULL, 0,
+#endif
+        "SECG curve over a 163 bit binary field"
+        };
+
+static const unsigned char _EC_NIST_CHAR2_163B_SEED[] = {
+        0x85,0xE2,0x5B,0xFE,0x5C,0x86,0x22,0x6C,0xDB,0x12,
+        0x01,0x6F,0x75,0x53,0xF9,0xD0,0xE6,0x93,0xA2,0x68};
+static const EC_CURVE_DATA _EC_NIST_CHAR2_163B ={
+        NID_X9_62_characteristic_two_field,
+        "0800000000000000000000000000000000000000C9",
+        "1",
+        "020A601907B8C953CA1481EB10512F78744A3205FD",
+        "03F0EBA16286A2D57EA0991168D4994637E8343E36",
+        "00D51FBC6C71A0094FA2CDD545B11C5C0C797324F1",
+        "040000000000000000000292FE77E70C12A4234C33", 2,
+/* The seed here was used to created the curve parameters in normal
+ * basis representation (and not the polynomial representation used here) 
+ */
+#if 0
+        _EC_NIST_CHAR2_163B_SEED, 20,
+#else
+        NULL, 0,
+#endif
+        "NIST/SECG curve over a 163 bit binary field"
+        };
+
+static const unsigned char _EC_SECG_CHAR2_193R1_SEED[] = {
+        0x10,0x3F,0xAE,0xC7,0x4D,0x69,0x6E,0x67,0x68,0x75,
+        0x61,0x51,0x75,0x77,0x7F,0xC5,0xB1,0x91,0xEF,0x30};
+static const EC_CURVE_DATA _EC_SECG_CHAR2_193R1 = {
+        NID_X9_62_characteristic_two_field,
+        "02000000000000000000000000000000000000000000008001",
+        "0017858FEB7A98975169E171F77B4087DE098AC8A911DF7B01",
+        "00FDFB49BFE6C3A89FACADAA7A1E5BBC7CC1C2E5D831478814",
+        "01F481BC5F0FF84A74AD6CDF6FDEF4BF6179625372D8C0C5E1",
+        "0025E399F2903712CCF3EA9E3A1AD17FB0B3201B6AF7CE1B05",
+        "01000000000000000000000000C7F34A778F443ACC920EBA49", 2,
+        _EC_SECG_CHAR2_193R1_SEED, 20,
+        "SECG curve over a 193 bit binary field"
+        };
+
+static const unsigned char _EC_SECG_CHAR2_193R2_SEED[] = {
+        0x10,0xB7,0xB4,0xD6,0x96,0xE6,0x76,0x87,0x56,0x15,
+        0x17,0x51,0x37,0xC8,0xA1,0x6F,0xD0,0xDA,0x22,0x11};
+static const EC_CURVE_DATA _EC_SECG_CHAR2_193R2 = {
+        NID_X9_62_characteristic_two_field,
+        "02000000000000000000000000000000000000000000008001",
+        "0163F35A5137C2CE3EA6ED8667190B0BC43ECD69977702709B",
+        "00C9BB9E8927D4D64C377E2AB2856A5B16E3EFB7F61D4316AE",
+        "00D9B67D192E0367C803F39E1A7E82CA14A651350AAE617E8F",
+        "01CE94335607C304AC29E7DEFBD9CA01F596F927224CDECF6C",
+        "010000000000000000000000015AAB561B005413CCD4EE99D5", 2,
+        _EC_SECG_CHAR2_193R2_SEED, 20,
+        "SECG curve over a 193 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_NIST_CHAR2_233K = {
+        NID_X9_62_characteristic_two_field,
+        "020000000000000000000000000000000000000004000000000000000001",
+        "0",
+        "1",
+        "017232BA853A7E731AF129F22FF4149563A419C26BF50A4C9D6EEFAD6126",
+        "01DB537DECE819B7F70F555A67C427A8CD9BF18AEB9B56E0C11056FAE6A3",
+        "008000000000000000000000000000069D5BB915BCD46EFB1AD5F173ABDF", 4,
+        NULL, 0,
+        "NIST/SECG/WTLS curve over a 233 bit binary field"
+        };
+
+static const unsigned char _EC_NIST_CHAR2_233B_SEED[] = {
+        0x74,0xD5,0x9F,0xF0,0x7F,0x6B,0x41,0x3D,0x0E,0xA1,
+        0x4B,0x34,0x4B,0x20,0xA2,0xDB,0x04,0x9B,0x50,0xC3};
+static const EC_CURVE_DATA _EC_NIST_CHAR2_233B = {
+        NID_X9_62_characteristic_two_field,
+        "020000000000000000000000000000000000000004000000000000000001",
+        "000000000000000000000000000000000000000000000000000000000001",
+        "0066647EDE6C332C7F8C0923BB58213B333B20E9CE4281FE115F7D8F90AD",
+        "00FAC9DFCBAC8313BB2139F1BB755FEF65BC391F8B36F8F8EB7371FD558B",
+        "01006A08A41903350678E58528BEBF8A0BEFF867A7CA36716F7E01F81052",
+        "01000000000000000000000000000013E974E72F8A6922031D2603CFE0D7", 2,
+        _EC_NIST_CHAR2_233B_SEED, 20,
+        "NIST/SECG/WTLS curve over a 233 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_SECG_CHAR2_239K1 = {
+        NID_X9_62_characteristic_two_field,
+        "800000000000000000004000000000000000000000000000000000000001",
+        "0",
+        "1",
+        "29A0B6A887A983E9730988A68727A8B2D126C44CC2CC7B2A6555193035DC",
+        "76310804F12E549BDB011C103089E73510ACB275FC312A5DC6B76553F0CA",
+        "2000000000000000000000000000005A79FEC67CB6E91F1C1DA800E478A5", 4,
+        NULL, 0,
+        "SECG curve over a 239 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_NIST_CHAR2_283K = {
+        NID_X9_62_characteristic_two_field,
+        "080000000000000000000000000000000000000000000000000000000000000000001"
+        "0A1",
+        "0",
+        "1",
+        "0503213F78CA44883F1A3B8162F188E553CD265F23C1567A16876913B0C2AC2458492"
+        "836",
+        "01CCDA380F1C9E318D90F95D07E5426FE87E45C0E8184698E45962364E34116177DD2"
+        "259",
+        "01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE9AE2ED07577265DFF7F94451E061E163"
+        "C61", 4,
+        NULL, 20,
+        "NIST/SECG curve over a 283 bit binary field"
+        };
+
+static const unsigned char _EC_NIST_CHAR2_283B_SEED[] = {
+        0x77,0xE2,0xB0,0x73,0x70,0xEB,0x0F,0x83,0x2A,0x6D,
+        0xD5,0xB6,0x2D,0xFC,0x88,0xCD,0x06,0xBB,0x84,0xBE};
+static const EC_CURVE_DATA _EC_NIST_CHAR2_283B = {
+        NID_X9_62_characteristic_two_field,
+        "080000000000000000000000000000000000000000000000000000000000000000001"
+        "0A1",
+        "000000000000000000000000000000000000000000000000000000000000000000000"
+        "001",
+        "027B680AC8B8596DA5A4AF8A19A0303FCA97FD7645309FA2A581485AF6263E313B79A"
+        "2F5",
+        "05F939258DB7DD90E1934F8C70B0DFEC2EED25B8557EAC9C80E2E198F8CDBECD86B12"
+        "053",
+        "03676854FE24141CB98FE6D4B20D02B4516FF702350EDDB0826779C813F0DF45BE811"
+        "2F4",
+        "03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEF90399660FC938A90165B042A7CEFADB"
+        "307", 2,
+        _EC_NIST_CHAR2_283B_SEED, 20,
+        "NIST/SECG curve over a 283 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_NIST_CHAR2_409K = {
+        NID_X9_62_characteristic_two_field,
+        "020000000000000000000000000000000000000000000000000000000000000000000"
+        "00000000000008000000000000000000001",
+        "0",
+        "1",
+        "0060F05F658F49C1AD3AB1890F7184210EFD0987E307C84C27ACCFB8F9F67CC2C4601"
+        "89EB5AAAA62EE222EB1B35540CFE9023746",
+        "01E369050B7C4E42ACBA1DACBF04299C3460782F918EA427E6325165E9EA10E3DA5F6"
+        "C42E9C55215AA9CA27A5863EC48D8E0286B",
+        "007FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE5F83B2D4EA20400"
+        "EC4557D5ED3E3E7CA5B4B5C83B8E01E5FCF", 4,
+        NULL, 0,
+        "NIST/SECG curve over a 409 bit binary field"
+        };
+
+static const unsigned char _EC_NIST_CHAR2_409B_SEED[] = {
+        0x40,0x99,0xB5,0xA4,0x57,0xF9,0xD6,0x9F,0x79,0x21,
+        0x3D,0x09,0x4C,0x4B,0xCD,0x4D,0x42,0x62,0x21,0x0B};
+static const EC_CURVE_DATA _EC_NIST_CHAR2_409B = {
+        NID_X9_62_characteristic_two_field,
+        "020000000000000000000000000000000000000000000000000000000000000000000"
+        "00000000000008000000000000000000001",
+        "000000000000000000000000000000000000000000000000000000000000000000000"
+        "00000000000000000000000000000000001",
+        "0021A5C2C8EE9FEB5C4B9A753B7B476B7FD6422EF1F3DD674761FA99D6AC27C8A9A19"
+        "7B272822F6CD57A55AA4F50AE317B13545F",
+        "015D4860D088DDB3496B0C6064756260441CDE4AF1771D4DB01FFE5B34E59703DC255"
+        "A868A1180515603AEAB60794E54BB7996A7",
+        "0061B1CFAB6BE5F32BBFA78324ED106A7636B9C5A7BD198D0158AA4F5488D08F38514"
+        "F1FDF4B4F40D2181B3681C364BA0273C706",
+        "010000000000000000000000000000000000000000000000000001E2AAD6A612F3330"
+        "7BE5FA47C3C9E052F838164CD37D9A21173", 2,
+        _EC_NIST_CHAR2_409B_SEED, 20,
+        "NIST/SECG curve over a 409 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_NIST_CHAR2_571K = {
+        NID_X9_62_characteristic_two_field,
+        "800000000000000000000000000000000000000000000000000000000000000000000"
+        "000000000000000000000000000000000000000000000000000000000000000000000"
+        "00425",
+        "0",
+        "1",
+        "026EB7A859923FBC82189631F8103FE4AC9CA2970012D5D46024804801841CA443709"
+        "58493B205E647DA304DB4CEB08CBBD1BA39494776FB988B47174DCA88C7E2945283A0"
+        "1C8972",
+        "0349DC807F4FBF374F4AEADE3BCA95314DD58CEC9F307A54FFC61EFC006D8A2C9D497"
+        "9C0AC44AEA74FBEBBB9F772AEDCB620B01A7BA7AF1B320430C8591984F601CD4C143E"
+        "F1C7A3",
+        "020000000000000000000000000000000000000000000000000000000000000000000"
+        "000131850E1F19A63E4B391A8DB917F4138B630D84BE5D639381E91DEB45CFE778F63"
+        "7C1001", 4,
+        NULL, 0,
+        "NIST/SECG curve over a 571 bit binary field"
+        };
+
+static const unsigned char _EC_NIST_CHAR2_571B_SEED[] = {
+        0x2A,0xA0,0x58,0xF7,0x3A,0x0E,0x33,0xAB,0x48,0x6B,
+        0x0F,0x61,0x04,0x10,0xC5,0x3A,0x7F,0x13,0x23,0x10};
+static const EC_CURVE_DATA _EC_NIST_CHAR2_571B = {
+        NID_X9_62_characteristic_two_field,
+        "800000000000000000000000000000000000000000000000000000000000000000000"
+        "000000000000000000000000000000000000000000000000000000000000000000000"
+        "00425",
+        "000000000000000000000000000000000000000000000000000000000000000000000"
+        "000000000000000000000000000000000000000000000000000000000000000000000"
+        "000001",
+        "02F40E7E2221F295DE297117B7F3D62F5C6A97FFCB8CEFF1CD6BA8CE4A9A18AD84FFA"
+        "BBD8EFA59332BE7AD6756A66E294AFD185A78FF12AA520E4DE739BACA0C7FFEFF7F29"
+        "55727A",
+        "0303001D34B856296C16C0D40D3CD7750A93D1D2955FA80AA5F40FC8DB7B2ABDBDE53"
+        "950F4C0D293CDD711A35B67FB1499AE60038614F1394ABFA3B4C850D927E1E7769C8E"
+        "EC2D19",
+        "037BF27342DA639B6DCCFFFEB73D69D78C6C27A6009CBBCA1980F8533921E8A684423"
+        "E43BAB08A576291AF8F461BB2A8B3531D2F0485C19B16E2F1516E23DD3C1A4827AF1B"
+        "8AC15B",
+        "03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+        "FFFE661CE18FF55987308059B186823851EC7DD9CA1161DE93D5174D66E8382E9BB2F"
+        "E84E47", 2,
+        _EC_NIST_CHAR2_571B_SEED, 20,
+        "NIST/SECG curve over a 571 bit binary field"
+        };
+
+static const unsigned char _EC_X9_62_CHAR2_163V1_SEED[] = {
+        0xD2,0xC0,0xFB,0x15,0x76,0x08,0x60,0xDE,0xF1,0xEE,
+        0xF4,0xD6,0x96,0xE6,0x76,0x87,0x56,0x15,0x17,0x54};
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_163V1 = {
+        NID_X9_62_characteristic_two_field,
+        "080000000000000000000000000000000000000107",
+        "072546B5435234A422E0789675F432C89435DE5242",
+        "00C9517D06D5240D3CFF38C74B20B6CD4D6F9DD4D9",
+        "07AF69989546103D79329FCC3D74880F33BBE803CB",
+        "01EC23211B5966ADEA1D3F87F7EA5848AEF0B7CA9F",
+        "0400000000000000000001E60FC8821CC74DAEAFC1", 2,
+        _EC_X9_62_CHAR2_163V1_SEED, 20,
+        "X9.62 curve over a 163 bit binary field"
+        };
+
+static const unsigned char _EC_X9_62_CHAR2_163V2_SEED[] = {
+        0x53,0x81,0x4C,0x05,0x0D,0x44,0xD6,0x96,0xE6,0x76,
+        0x87,0x56,0x15,0x17,0x58,0x0C,0xA4,0xE2,0x9F,0xFD};
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_163V2 = {
+        NID_X9_62_characteristic_two_field,
+        "080000000000000000000000000000000000000107",
+        "0108B39E77C4B108BED981ED0E890E117C511CF072",
+        "0667ACEB38AF4E488C407433FFAE4F1C811638DF20",
+        "0024266E4EB5106D0A964D92C4860E2671DB9B6CC5",
+        "079F684DDF6684C5CD258B3890021B2386DFD19FC5",
+        "03FFFFFFFFFFFFFFFFFFFDF64DE1151ADBB78F10A7", 2,
+        _EC_X9_62_CHAR2_163V2_SEED, 20,
+        "X9.62 curve over a 163 bit binary field"
+        };
+
+static const unsigned char _EC_X9_62_CHAR2_163V3_SEED[] = {
+        0x50,0xCB,0xF1,0xD9,0x5C,0xA9,0x4D,0x69,0x6E,0x67,
+        0x68,0x75,0x61,0x51,0x75,0xF1,0x6A,0x36,0xA3,0xB8};
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_163V3 = {
+        NID_X9_62_characteristic_two_field,
+        "080000000000000000000000000000000000000107",
+        "07A526C63D3E25A256A007699F5447E32AE456B50E",
+        "03F7061798EB99E238FD6F1BF95B48FEEB4854252B",
+        "02F9F87B7C574D0BDECF8A22E6524775F98CDEBDCB",
+        "05B935590C155E17EA48EB3FF3718B893DF59A05D0",
+        "03FFFFFFFFFFFFFFFFFFFE1AEE140F110AFF961309", 2,
+        _EC_X9_62_CHAR2_163V3_SEED, 20,
+        "X9.62 curve over a 163 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_176V1 = {
+        NID_X9_62_characteristic_two_field,
+        "0100000000000000000000000000000000080000000007",
+        "E4E6DB2995065C407D9D39B8D0967B96704BA8E9C90B",
+        "5DDA470ABE6414DE8EC133AE28E9BBD7FCEC0AE0FFF2",
+        "8D16C2866798B600F9F08BB4A8E860F3298CE04A5798",
+        "6FA4539C2DADDDD6BAB5167D61B436E1D92BB16A562C",
+        "00010092537397ECA4F6145799D62B0A19CE06FE26AD", 0xFF6E,
+        NULL, 0,
+        "X9.62 curve over a 176 bit binary field"
+        };
+
+static const unsigned char _EC_X9_62_CHAR2_191V1_SEED[] = {
+        0x4E,0x13,0xCA,0x54,0x27,0x44,0xD6,0x96,0xE6,0x76,
+        0x87,0x56,0x15,0x17,0x55,0x2F,0x27,0x9A,0x8C,0x84};
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_191V1 = {
+        NID_X9_62_characteristic_two_field,
+        "800000000000000000000000000000000000000000000201",
+        "2866537B676752636A68F56554E12640276B649EF7526267",
+        "2E45EF571F00786F67B0081B9495A3D95462F5DE0AA185EC",
+        "36B3DAF8A23206F9C4F299D7B21A9C369137F2C84AE1AA0D",
+        "765BE73433B3F95E332932E70EA245CA2418EA0EF98018FB",
+        "40000000000000000000000004A20E90C39067C893BBB9A5", 2,
+        _EC_X9_62_CHAR2_191V1_SEED, 20,
+        "X9.62 curve over a 191 bit binary field"
+        };
+
+static const unsigned char _EC_X9_62_CHAR2_191V2_SEED[] = {
+        0x08,0x71,0xEF,0x2F,0xEF,0x24,0xD6,0x96,0xE6,0x76,
+        0x87,0x56,0x15,0x17,0x58,0xBE,0xE0,0xD9,0x5C,0x15};
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_191V2 = {
+        NID_X9_62_characteristic_two_field,
+        "800000000000000000000000000000000000000000000201",
+        "401028774D7777C7B7666D1366EA432071274F89FF01E718",
+        "0620048D28BCBD03B6249C99182B7C8CD19700C362C46A01",
+        "3809B2B7CC1B28CC5A87926AAD83FD28789E81E2C9E3BF10",
+        "17434386626D14F3DBF01760D9213A3E1CF37AEC437D668A",
+        "20000000000000000000000050508CB89F652824E06B8173", 4,
+        _EC_X9_62_CHAR2_191V2_SEED, 20,
+        "X9.62 curve over a 191 bit binary field"
+        };
+
+static const unsigned char _EC_X9_62_CHAR2_191V3_SEED[] = {
+        0xE0,0x53,0x51,0x2D,0xC6,0x84,0xD6,0x96,0xE6,0x76,
+        0x87,0x56,0x15,0x17,0x50,0x67,0xAE,0x78,0x6D,0x1F};
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_191V3 = {
+        NID_X9_62_characteristic_two_field,
+        "800000000000000000000000000000000000000000000201",
+        "6C01074756099122221056911C77D77E77A777E7E7E77FCB",
+        "71FE1AF926CF847989EFEF8DB459F66394D90F32AD3F15E8",
+        "375D4CE24FDE434489DE8746E71786015009E66E38A926DD",
+        "545A39176196575D985999366E6AD34CE0A77CD7127B06BE",
+        "155555555555555555555555610C0B196812BFB6288A3EA3", 6,
+        _EC_X9_62_CHAR2_191V3_SEED, 20,
+        "X9.62 curve over a 191 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_208W1 = {
+        NID_X9_62_characteristic_two_field,
+        "010000000000000000000000000000000800000000000000000007",
+        "0000000000000000000000000000000000000000000000000000",
+        "C8619ED45A62E6212E1160349E2BFA844439FAFC2A3FD1638F9E",
+        "89FDFBE4ABE193DF9559ECF07AC0CE78554E2784EB8C1ED1A57A",
+        "0F55B51A06E78E9AC38A035FF520D8B01781BEB1A6BB08617DE3",
+        "000101BAF95C9723C57B6C21DA2EFF2D5ED588BDD5717E212F9D", 0xFE48,
+        NULL, 0,
+        "X9.62 curve over a 208 bit binary field"
+        };
+
+static const unsigned char _EC_X9_62_CHAR2_239V1_SEED[] = {
+        0xD3,0x4B,0x9A,0x4D,0x69,0x6E,0x67,0x68,0x75,0x61,
+        0x51,0x75,0xCA,0x71,0xB9,0x20,0xBF,0xEF,0xB0,0x5D};
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_239V1 = {
+        NID_X9_62_characteristic_two_field,
+        "800000000000000000000000000000000000000000000000001000000001",
+        "32010857077C5431123A46B808906756F543423E8D27877578125778AC76",
+        "790408F2EEDAF392B012EDEFB3392F30F4327C0CA3F31FC383C422AA8C16",
+        "57927098FA932E7C0A96D3FD5B706EF7E5F5C156E16B7E7C86038552E91D",
+        "61D8EE5077C33FECF6F1A16B268DE469C3C7744EA9A971649FC7A9616305",
+        "2000000000000000000000000000000F4D42FFE1492A4993F1CAD666E447", 4,
+        _EC_X9_62_CHAR2_239V1_SEED, 20,
+        "X9.62 curve over a 239 bit binary field"
+        };
+
+static const unsigned char _EC_X9_62_CHAR2_239V2_SEED[] = {
+        0x2A,0xA6,0x98,0x2F,0xDF,0xA4,0xD6,0x96,0xE6,0x76,
+        0x87,0x56,0x15,0x17,0x5D,0x26,0x67,0x27,0x27,0x7D};
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_239V2 = {
+        NID_X9_62_characteristic_two_field,
+        "800000000000000000000000000000000000000000000000001000000001",
+        "4230017757A767FAE42398569B746325D45313AF0766266479B75654E65F",
+        "5037EA654196CFF0CD82B2C14A2FCF2E3FF8775285B545722F03EACDB74B",
+        "28F9D04E900069C8DC47A08534FE76D2B900B7D7EF31F5709F200C4CA205",
+        "5667334C45AFF3B5A03BAD9DD75E2C71A99362567D5453F7FA6E227EC833",
+        "1555555555555555555555555555553C6F2885259C31E3FCDF154624522D", 6,
+        _EC_X9_62_CHAR2_239V2_SEED, 20,
+        "X9.62 curve over a 239 bit binary field"
+        };
+
+static const unsigned char _EC_X9_62_CHAR2_239V3_SEED[] = {
+        0x9E,0x07,0x6F,0x4D,0x69,0x6E,0x67,0x68,0x75,0x61,
+        0x51,0x75,0xE1,0x1E,0x9F,0xDD,0x77,0xF9,0x20,0x41};
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_239V3 = {
+        NID_X9_62_characteristic_two_field,
+        "800000000000000000000000000000000000000000000000001000000001",
+        "01238774666A67766D6676F778E676B66999176666E687666D8766C66A9F",
+        "6A941977BA9F6A435199ACFC51067ED587F519C5ECB541B8E44111DE1D40",
+        "70F6E9D04D289C4E89913CE3530BFDE903977D42B146D539BF1BDE4E9C92",
+        "2E5A0EAF6E5E1305B9004DCE5C0ED7FE59A35608F33837C816D80B79F461",
+        "0CCCCCCCCCCCCCCCCCCCCCCCCCCCCCAC4912D2D9DF903EF9888B8A0E4CFF", 0xA,
+        _EC_X9_62_CHAR2_239V3_SEED, 20,
+        "X9.62 curve over a 239 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_272W1 = {
+        NID_X9_62_characteristic_two_field,
+        "010000000000000000000000000000000000000000000000000000010000000000000"
+        "B",
+        "91A091F03B5FBA4AB2CCF49C4EDD220FB028712D42BE752B2C40094DBACDB586FB20",
+        "7167EFC92BB2E3CE7C8AAAFF34E12A9C557003D7C73A6FAF003F99F6CC8482E540F7",
+        "6108BABB2CEEBCF787058A056CBE0CFE622D7723A289E08A07AE13EF0D10D171DD8D",
+        "10C7695716851EEF6BA7F6872E6142FBD241B830FF5EFCACECCAB05E02005DDE9D23",
+        "000100FAF51354E0E39E4892DF6E319C72C8161603FA45AA7B998A167B8F1E629521",
+        0xFF06,
+        NULL, 0,
+        "X9.62 curve over a 272 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_304W1 = {
+        NID_X9_62_characteristic_two_field,
+        "010000000000000000000000000000000000000000000000000000000000000000000"
+        "000000807",
+        "FD0D693149A118F651E6DCE6802085377E5F882D1B510B44160074C1288078365A039"
+        "6C8E681",
+        "BDDB97E555A50A908E43B01C798EA5DAA6788F1EA2794EFCF57166B8C14039601E558"
+        "27340BE",
+        "197B07845E9BE2D96ADB0F5F3C7F2CFFBD7A3EB8B6FEC35C7FD67F26DDF6285A644F7"
+        "40A2614",
+        "E19FBEB76E0DA171517ECF401B50289BF014103288527A9B416A105E80260B549FDC1"
+        "B92C03B",
+        "000101D556572AABAC800101D556572AABAC8001022D5C91DD173F8FB561DA6899164"
+        "443051D", 0xFE2E,
+        NULL, 0,
+        "X9.62 curve over a 304 bit binary field"
+        };
+
+static const unsigned char _EC_X9_62_CHAR2_359V1_SEED[] = {
+        0x2B,0x35,0x49,0x20,0xB7,0x24,0xD6,0x96,0xE6,0x76,
+        0x87,0x56,0x15,0x17,0x58,0x5B,0xA1,0x33,0x2D,0xC6};
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_359V1 = {
+        NID_X9_62_characteristic_two_field,
+        "800000000000000000000000000000000000000000000000000000000000000000000"
+        "000100000000000000001",
+        "5667676A654B20754F356EA92017D946567C46675556F19556A04616B567D223A5E05"
+        "656FB549016A96656A557",
+        "2472E2D0197C49363F1FE7F5B6DB075D52B6947D135D8CA445805D39BC34562608968"
+        "7742B6329E70680231988",
+        "3C258EF3047767E7EDE0F1FDAA79DAEE3841366A132E163ACED4ED2401DF9C6BDCDE9"
+        "8E8E707C07A2239B1B097",
+        "53D7E08529547048121E9C95F3791DD804963948F34FAE7BF44EA82365DC7868FE57E"
+        "4AE2DE211305A407104BD",
+        "01AF286BCA1AF286BCA1AF286BCA1AF286BCA1AF286BC9FB8F6B85C556892C20A7EB9"
+        "64FE7719E74F490758D3B", 0x4C,
+        _EC_X9_62_CHAR2_359V1_SEED, 20,
+        "X9.62 curve over a 359 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_368W1 = {
+        NID_X9_62_characteristic_two_field,
+        "010000000000000000000000000000000000000000000000000000000000000000000"
+        "0002000000000000000000007",
+        "E0D2EE25095206F5E2A4F9ED229F1F256E79A0E2B455970D8D0D865BD94778C576D62"
+        "F0AB7519CCD2A1A906AE30D",
+        "FC1217D4320A90452C760A58EDCD30C8DD069B3C34453837A34ED50CB54917E1C2112"
+        "D84D164F444F8F74786046A",
+        "1085E2755381DCCCE3C1557AFA10C2F0C0C2825646C5B34A394CBCFA8BC16B22E7E78"
+        "9E927BE216F02E1FB136A5F",
+        "7B3EB1BDDCBA62D5D8B2059B525797FC73822C59059C623A45FF3843CEE8F87CD1855"
+        "ADAA81E2A0750B80FDA2310",
+        "00010090512DA9AF72B08349D98A5DD4C7B0532ECA51CE03E2D10F3B7AC579BD87E90"
+        "9AE40A6F131E9CFCE5BD967", 0xFF70,
+        NULL, 0,
+        "X9.62 curve over a 368 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_X9_62_CHAR2_431R1 = {
+        NID_X9_62_characteristic_two_field,
+        "800000000000000000000000000000000000000000000000000000000000000000000"
+        "000000001000000000000000000000000000001",
+        "1A827EF00DD6FC0E234CAF046C6A5D8A85395B236CC4AD2CF32A0CADBDC9DDF620B0E"
+        "B9906D0957F6C6FEACD615468DF104DE296CD8F",
+        "10D9B4A3D9047D8B154359ABFB1B7F5485B04CEB868237DDC9DEDA982A679A5A919B6"
+        "26D4E50A8DD731B107A9962381FB5D807BF2618",
+        "120FC05D3C67A99DE161D2F4092622FECA701BE4F50F4758714E8A87BBF2A658EF8C2"
+        "1E7C5EFE965361F6C2999C0C247B0DBD70CE6B7",
+        "20D0AF8903A96F8D5FA2C255745D3C451B302C9346D9B7E485E7BCE41F6B591F3E8F6"
+        "ADDCBB0BC4C2F947A7DE1A89B625D6A598B3760",
+        "0340340340340340340340340340340340340340340340340340340323C313FAB5058"
+        "9703B5EC68D3587FEC60D161CC149C1AD4A91", 0x2760,
+        NULL, 0,
+        "X9.62 curve over a 431 bit binary field"
+        };
+
+static const EC_CURVE_DATA _EC_WTLS_1 = {
+        NID_X9_62_characteristic_two_field,
+        "020000000000000000000000000201",
+        "1",
+        "1",
+        "01667979A40BA497E5D5C270780617",
+        "00F44B4AF1ECC2630E08785CEBCC15",
+        "00FFFFFFFFFFFFFFFDBF91AF6DEA73", 2,
+        NULL, 0,
+        "WTLS curve over a 113 bit binary field"
+        };
+
+/* IPSec curves */
+/* NOTE: The of curves over a extension field of non prime degree
+ * is not recommended (Weil-descent).
+ * As the group order is not a prime this curve is not suitable
+ * for ECDSA.
+ */
+static const EC_CURVE_DATA _EC_IPSEC_155_ID3 = {
+        NID_X9_62_characteristic_two_field,
+        "0800000000000000000000004000000000000001",
+        "0",
+        "07338f",
+        "7b",
+        "1c8",
+        "2AAAAAAAAAAAAAAAAAAC7F3C7881BD0868FA86C",3,
+        NULL, 0,
+        "\n\tIPSec/IKE/Oakley curve #3 over a 155 bit binary field.\n"
+        "\tNot suitable for ECDSA.\n\tQuestionable extension field!"
+        };
+
+/* NOTE: The of curves over a extension field of non prime degree
+ * is not recommended (Weil-descent).
+ * As the group order is not a prime this curve is not suitable
+ * for ECDSA.
+ */
+static const EC_CURVE_DATA _EC_IPSEC_185_ID4 = {
+        NID_X9_62_characteristic_two_field,
+        "020000000000000000000000000000200000000000000001",
+        "0",
+        "1ee9",
+        "18",
+        "0d",
+        "FFFFFFFFFFFFFFFFFFFFFFEDF97C44DB9F2420BAFCA75E",2,
+        NULL, 0,
+        "\n\tIPSec/IKE/Oakley curve #4 over a 185 bit binary field.\n"
+        "\tNot suitable for ECDSA.\n\tQuestionable extension field!"
+        };
+
+typedef struct _ec_list_element_st {
+        int     nid;
+        const EC_CURVE_DATA *data;
+        } ec_list_element;
+
+static const ec_list_element curve_list[] = {
+        /* prime field curves */        
+        /* secg curves */
+        { NID_secp112r1, &_EC_SECG_PRIME_112R1},
+        { NID_secp112r2, &_EC_SECG_PRIME_112R2},
+        { NID_secp128r1, &_EC_SECG_PRIME_128R1},
+        { NID_secp128r2, &_EC_SECG_PRIME_128R2},
+        { NID_secp160k1, &_EC_SECG_PRIME_160K1},
+        { NID_secp160r1, &_EC_SECG_PRIME_160R1},
+        { NID_secp160r2, &_EC_SECG_PRIME_160R2},
+        /* SECG secp192r1 is the same as X9.62 prime192v1 and hence omitted */
+        { NID_secp192k1, &_EC_SECG_PRIME_192K1},
+        { NID_secp224k1, &_EC_SECG_PRIME_224K1},
+        { NID_secp224r1, &_EC_NIST_PRIME_224},
+        { NID_secp256k1, &_EC_SECG_PRIME_256K1},
+        /* SECG secp256r1 is the same as X9.62 prime256v1 and hence omitted */
+        { NID_secp384r1, &_EC_NIST_PRIME_384},
+        { NID_secp521r1, &_EC_NIST_PRIME_521},
+        /* X9.62 curves */
+        { NID_X9_62_prime192v1, &_EC_NIST_PRIME_192},
+        { NID_X9_62_prime192v2, &_EC_X9_62_PRIME_192V2},
+        { NID_X9_62_prime192v3, &_EC_X9_62_PRIME_192V3},
+        { NID_X9_62_prime239v1, &_EC_X9_62_PRIME_239V1},
+        { NID_X9_62_prime239v2, &_EC_X9_62_PRIME_239V2},
+        { NID_X9_62_prime239v3, &_EC_X9_62_PRIME_239V3},
+        { NID_X9_62_prime256v1, &_EC_X9_62_PRIME_256V1},
+        /* characteristic two field curves */
+        /* NIST/SECG curves */
+        { NID_sect113r1, &_EC_SECG_CHAR2_113R1},
+        { NID_sect113r2, &_EC_SECG_CHAR2_113R2},
+        { NID_sect131r1, &_EC_SECG_CHAR2_131R1},
+        { NID_sect131r2, &_EC_SECG_CHAR2_131R2},
+        { NID_sect163k1, &_EC_NIST_CHAR2_163K },
+        { NID_sect163r1, &_EC_SECG_CHAR2_163R1},
+        { NID_sect163r2, &_EC_NIST_CHAR2_163B },
+        { NID_sect193r1, &_EC_SECG_CHAR2_193R1},
+        { NID_sect193r2, &_EC_SECG_CHAR2_193R2},
+        { NID_sect233k1, &_EC_NIST_CHAR2_233K },
+        { NID_sect233r1, &_EC_NIST_CHAR2_233B },
+        { NID_sect239k1, &_EC_SECG_CHAR2_239K1},
+        { NID_sect283k1, &_EC_NIST_CHAR2_283K },
+        { NID_sect283r1, &_EC_NIST_CHAR2_283B },
+        { NID_sect409k1, &_EC_NIST_CHAR2_409K },
+        { NID_sect409r1, &_EC_NIST_CHAR2_409B },
+        { NID_sect571k1, &_EC_NIST_CHAR2_571K },
+        { NID_sect571r1, &_EC_NIST_CHAR2_571B },
+        /* X9.62 curves */
+        { NID_X9_62_c2pnb163v1, &_EC_X9_62_CHAR2_163V1},
+        { NID_X9_62_c2pnb163v2, &_EC_X9_62_CHAR2_163V2},
+        { NID_X9_62_c2pnb163v3, &_EC_X9_62_CHAR2_163V3},
+        { NID_X9_62_c2pnb176v1, &_EC_X9_62_CHAR2_176V1},
+        { NID_X9_62_c2tnb191v1, &_EC_X9_62_CHAR2_191V1},
+        { NID_X9_62_c2tnb191v2, &_EC_X9_62_CHAR2_191V2},
+        { NID_X9_62_c2tnb191v3, &_EC_X9_62_CHAR2_191V3},
+        { NID_X9_62_c2pnb208w1, &_EC_X9_62_CHAR2_208W1},
+        { NID_X9_62_c2tnb239v1, &_EC_X9_62_CHAR2_239V1},
+        { NID_X9_62_c2tnb239v2, &_EC_X9_62_CHAR2_239V2},
+        { NID_X9_62_c2tnb239v3, &_EC_X9_62_CHAR2_239V3},
+        { NID_X9_62_c2pnb272w1, &_EC_X9_62_CHAR2_272W1},
+        { NID_X9_62_c2pnb304w1, &_EC_X9_62_CHAR2_304W1},
+        { NID_X9_62_c2tnb359v1, &_EC_X9_62_CHAR2_359V1},
+        { NID_X9_62_c2pnb368w1, &_EC_X9_62_CHAR2_368W1},
+        { NID_X9_62_c2tnb431r1, &_EC_X9_62_CHAR2_431R1},
+        /* the WAP/WTLS curves
+         * [unlike SECG, spec has its own OIDs for curves from X9.62] */
+        { NID_wap_wsg_idm_ecid_wtls1, &_EC_WTLS_1},
+        { NID_wap_wsg_idm_ecid_wtls3, &_EC_NIST_CHAR2_163K},
+        { NID_wap_wsg_idm_ecid_wtls4, &_EC_SECG_CHAR2_113R1},
+        { NID_wap_wsg_idm_ecid_wtls5, &_EC_X9_62_CHAR2_163V1},
+        { NID_wap_wsg_idm_ecid_wtls6, &_EC_SECG_PRIME_112R1},
+        { NID_wap_wsg_idm_ecid_wtls7, &_EC_SECG_PRIME_160R2},
+        { NID_wap_wsg_idm_ecid_wtls8, &_EC_WTLS_8},
+        { NID_wap_wsg_idm_ecid_wtls9, &_EC_WTLS_9 },
+        { NID_wap_wsg_idm_ecid_wtls10, &_EC_NIST_CHAR2_233K},
+        { NID_wap_wsg_idm_ecid_wtls11, &_EC_NIST_CHAR2_233B},
+        { NID_wap_wsg_idm_ecid_wtls12, &_EC_WTLS_12},
+        /* IPSec curves */
+        { NID_ipsec3, &_EC_IPSEC_155_ID3},
+        { NID_ipsec4, &_EC_IPSEC_185_ID4},
+};
+
+static size_t curve_list_length = sizeof(curve_list)/sizeof(ec_list_element);
+
+static EC_GROUP *ec_group_new_from_data(const EC_CURVE_DATA *data)
+        {
+        EC_GROUP *group=NULL;
+        EC_POINT *P=NULL;
+        BN_CTX   *ctx=NULL;
+        BIGNUM   *p=NULL, *a=NULL, *b=NULL, *x=NULL, *y=NULL, *order=NULL;
+        int      ok=0;
+
+        if ((ctx = BN_CTX_new()) == NULL)
+                {
+                ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+        if ((p = BN_new()) == NULL || (a = BN_new()) == NULL || 
+                (b = BN_new()) == NULL || (x = BN_new()) == NULL ||
+                (y = BN_new()) == NULL || (order = BN_new()) == NULL)
+                {
+                ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+        
+        if (!BN_hex2bn(&p, data->p) || !BN_hex2bn(&a, data->a)
+                || !BN_hex2bn(&b, data->b))
+                {
+                ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
+                goto err;
+                }
+
+        if (data->field_type == NID_X9_62_prime_field)
+                {
+                if ((group = EC_GROUP_new_curve_GFp(p, a, b, ctx)) == NULL)
+                        {
+                        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                }
+                else
+                { /* field_type == NID_X9_62_characteristic_two_field */
+                if ((group = EC_GROUP_new_curve_GF2m(p, a, b, ctx)) == NULL)
+                        {
+                        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                }
+
+        if ((P = EC_POINT_new(group)) == NULL)
+                {
+                ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+                goto err;
+                }
+        
+        if (!BN_hex2bn(&x, data->x) || !BN_hex2bn(&y, data->y))
+                {
+                ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
+                goto err;
+                }
+        if (!EC_POINT_set_affine_coordinates_GF2m(group, P, x, y, ctx))
+                {
+                ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+                goto err;
+                }
+        if (!BN_hex2bn(&order, data->order) || !BN_set_word(x, data->cofactor))
+                {
+                ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
+                goto err;
+                }
+        if (!EC_GROUP_set_generator(group, P, order, x))
+                {
+                ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+                goto err;
+                }
+        if (data->seed)
+                {
+                if (!EC_GROUP_set_seed(group, data->seed, data->seed_len))
+                        {
+                        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                }
+        ok=1;
+err:
+        if (!ok)
+                {
+                EC_GROUP_free(group);
+                group = NULL;
+                }
+        if (P)
+                EC_POINT_free(P);
+        if (ctx)
+                BN_CTX_free(ctx);
+        if (p)
+                BN_free(p);
+        if (a)
+                BN_free(a);
+        if (b)
+                BN_free(b);
+        if (order)
+                BN_free(order);
+        if (x)
+                BN_free(x);
+        if (y)
+                BN_free(y);
+        return group;
+        }
+
+EC_GROUP *EC_GROUP_new_by_curve_name(int nid)
+        {
+        size_t i;
+        EC_GROUP *ret = NULL;
+
+        if (nid <= 0)
+                return NULL;
+
+        for (i=0; i<curve_list_length; i++)
+                if (curve_list[i].nid == nid)
+                        {
+                        ret = ec_group_new_from_data(curve_list[i].data);
+                        break;
+                        }
+
+        if (ret == NULL)
+                {
+                ECerr(EC_F_EC_GROUP_NEW_BY_CURVE_NAME, EC_R_UNKNOWN_GROUP);
+                return NULL;
+                }
+
+        EC_GROUP_set_curve_name(ret, nid);
+
+        return ret;
+        }
+
+size_t EC_get_builtin_curves(EC_builtin_curve *r, size_t nitems)
+        {
+        size_t  i, min;
+
+        if (r == NULL || nitems == 0)
+                return curve_list_length;
+
+        min = nitems < curve_list_length ? nitems : curve_list_length;
+
+        for (i = 0; i < min; i++)
+                {
+                r[i].nid = curve_list[i].nid;
+                r[i].comment = curve_list[i].data->comment;
+                }
+
+        return curve_list_length;
+        }
diff --git a/src/lib/libssl/src/crypto/ec/ec_key.c b/src/lib/libssl/src/crypto/ec/ec_key.c
new file mode 100644
index 0000000000..3d6c900b95
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ec/ec_key.c
@@ -0,0 +1,465 @@
+/* crypto/ec/ec_key.c */
+/*
+ * Written by Nils Larsch for the OpenSSL project.
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * Portions originally developed by SUN MICROSYSTEMS, INC., and 
+ * contributed to the OpenSSL project.
+ */
+
+#include <string.h>
+#include "ec_lcl.h"
+#include <openssl/err.h>
+#include <string.h>
+
+EC_KEY *EC_KEY_new(void)
+        {
+        EC_KEY *ret;
+
+        ret=(EC_KEY *)OPENSSL_malloc(sizeof(EC_KEY));
+        if (ret == NULL)
+                {
+                ECerr(EC_F_EC_KEY_NEW, ERR_R_MALLOC_FAILURE);
+                return(NULL);
+                }
+
+        ret->version = 1;       
+        ret->group   = NULL;
+        ret->pub_key = NULL;
+        ret->priv_key= NULL;
+        ret->enc_flag= 0; 
+        ret->conv_form = POINT_CONVERSION_UNCOMPRESSED;
+        ret->references= 1;
+        ret->method_data = NULL;
+        return(ret);
+        }
+
+EC_KEY *EC_KEY_new_by_curve_name(int nid)
+        {
+        EC_KEY *ret = EC_KEY_new();
+        if (ret == NULL)
+                return NULL;
+        ret->group = EC_GROUP_new_by_curve_name(nid);
+        if (ret->group == NULL)
+                {
+                EC_KEY_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void EC_KEY_free(EC_KEY *r)
+        {
+        int i;
+
+        if (r == NULL) return;
+
+        i=CRYPTO_add(&r->references,-1,CRYPTO_LOCK_EC);
+#ifdef REF_PRINT
+        REF_PRINT("EC_KEY",r);
+#endif
+        if (i > 0) return;
+#ifdef REF_CHECK
+        if (i < 0)
+                {
+                fprintf(stderr,"EC_KEY_free, bad reference count\n");
+                abort();
+                }
+#endif
+
+        if (r->group    != NULL) 
+                EC_GROUP_free(r->group);
+        if (r->pub_key  != NULL)
+                EC_POINT_free(r->pub_key);
+        if (r->priv_key != NULL)
+                BN_clear_free(r->priv_key);
+
+        EC_EX_DATA_free_all_data(&r->method_data);
+
+        OPENSSL_cleanse((void *)r, sizeof(EC_KEY));
+
+        OPENSSL_free(r);
+        }
+
+EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)
+        {
+        EC_EXTRA_DATA *d;
+
+        if (dest == NULL || src == NULL)
+                {
+                ECerr(EC_F_EC_KEY_COPY, ERR_R_PASSED_NULL_PARAMETER);
+                return NULL;
+                }
+        /* copy the parameters */
+        if (src->group)
+                {
+                const EC_METHOD *meth = EC_GROUP_method_of(src->group);
+                /* clear the old group */
+                if (dest->group)
+                        EC_GROUP_free(dest->group);
+                dest->group = EC_GROUP_new(meth);
+                if (dest->group == NULL)
+                        return NULL;
+                if (!EC_GROUP_copy(dest->group, src->group))
+                        return NULL;
+                }
+        /*  copy the public key */
+        if (src->pub_key && src->group)
+                {
+                if (dest->pub_key)
+                        EC_POINT_free(dest->pub_key);
+                dest->pub_key = EC_POINT_new(src->group);
+                if (dest->pub_key == NULL)
+                        return NULL;
+                if (!EC_POINT_copy(dest->pub_key, src->pub_key))
+                        return NULL;
+                }
+        /* copy the private key */
+        if (src->priv_key)
+                {
+                if (dest->priv_key == NULL)
+                        {
+                        dest->priv_key = BN_new();
+                        if (dest->priv_key == NULL)
+                                return NULL;
+                        }
+                if (!BN_copy(dest->priv_key, src->priv_key))
+                        return NULL;
+                }
+        /* copy method/extra data */
+        EC_EX_DATA_free_all_data(&dest->method_data);
+
+        for (d = src->method_data; d != NULL; d = d->next)
+                {
+                void *t = d->dup_func(d->data);
+                
+                if (t == NULL)
+                        return 0;
+                if (!EC_EX_DATA_set_data(&dest->method_data, t, d->dup_func, d->free_func, d->clear_free_func))
+                        return 0;
+                }
+
+        /* copy the rest */
+        dest->enc_flag  = src->enc_flag;
+        dest->conv_form = src->conv_form;
+        dest->version   = src->version;
+
+        return dest;
+        }
+
+EC_KEY *EC_KEY_dup(const EC_KEY *ec_key)
+        {
+        EC_KEY *ret = EC_KEY_new();
+        if (ret == NULL)
+                return NULL;
+        if (EC_KEY_copy(ret, ec_key) == NULL)
+                {
+                EC_KEY_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+int EC_KEY_up_ref(EC_KEY *r)
+        {
+        int i = CRYPTO_add(&r->references, 1, CRYPTO_LOCK_EC);
+#ifdef REF_PRINT
+        REF_PRINT("EC_KEY",r);
+#endif
+#ifdef REF_CHECK
+        if (i < 2)
+                {
+                fprintf(stderr, "EC_KEY_up, bad reference count\n");
+                abort();
+                }
+#endif
+        return ((i > 1) ? 1 : 0);
+        }
+
+int EC_KEY_generate_key(EC_KEY *eckey)
+        {       
+        int     ok = 0;
+        BN_CTX  *ctx = NULL;
+        BIGNUM  *priv_key = NULL, *order = NULL;
+        EC_POINT *pub_key = NULL;
+
+        if (!eckey || !eckey->group)
+                {
+                ECerr(EC_F_EC_KEY_GENERATE_KEY, ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+
+        if ((order = BN_new()) == NULL) goto err;
+        if ((ctx = BN_CTX_new()) == NULL) goto err;
+
+        if (eckey->priv_key == NULL)
+                {
+                priv_key = BN_new();
+                if (priv_key == NULL)
+                        goto err;
+                }
+        else
+                priv_key = eckey->priv_key;
+
+        if (!EC_GROUP_get_order(eckey->group, order, ctx))
+                goto err;
+
+        do
+                if (!BN_rand_range(priv_key, order))
+                        goto err;
+        while (BN_is_zero(priv_key));
+
+        if (eckey->pub_key == NULL)
+                {
+                pub_key = EC_POINT_new(eckey->group);
+                if (pub_key == NULL)
+                        goto err;
+                }
+        else
+                pub_key = eckey->pub_key;
+
+        if (!EC_POINT_mul(eckey->group, pub_key, priv_key, NULL, NULL, ctx))
+                goto err;
+
+        eckey->priv_key = priv_key;
+        eckey->pub_key  = pub_key;
+
+        ok=1;
+
+err:    
+        if (order)
+                BN_free(order);
+        if (pub_key  != NULL && eckey->pub_key  == NULL)
+                EC_POINT_free(pub_key);
+        if (priv_key != NULL && eckey->priv_key == NULL)
+                BN_free(priv_key);
+        if (ctx != NULL)
+                BN_CTX_free(ctx);
+        return(ok);
+        }
+
+int EC_KEY_check_key(const EC_KEY *eckey)
+        {
+        int     ok   = 0;
+        BN_CTX  *ctx = NULL;
+        BIGNUM  *order  = NULL;
+        EC_POINT *point = NULL;
+
+        if (!eckey || !eckey->group || !eckey->pub_key)
+                {
+                ECerr(EC_F_EC_KEY_CHECK_KEY, ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        
+        if ((ctx = BN_CTX_new()) == NULL)
+                goto err;
+        if ((order = BN_new()) == NULL)
+                goto err;
+        if ((point = EC_POINT_new(eckey->group)) == NULL)
+                goto err;
+
+        /* testing whether the pub_key is on the elliptic curve */
+        if (!EC_POINT_is_on_curve(eckey->group, eckey->pub_key, ctx))
+                {
+                ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_POINT_IS_NOT_ON_CURVE);
+                goto err;
+                }
+        /* testing whether pub_key * order is the point at infinity */
+        if (!EC_GROUP_get_order(eckey->group, order, ctx))
+                {
+                ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_INVALID_GROUP_ORDER);
+                goto err;
+                }
+        if (!EC_POINT_copy(point, eckey->pub_key))
+                {
+                ECerr(EC_F_EC_KEY_CHECK_KEY, ERR_R_EC_LIB);
+                goto err;
+                }
+        if (!EC_POINT_mul(eckey->group, point, order, NULL, NULL, ctx))
+                {
+                ECerr(EC_F_EC_KEY_CHECK_KEY, ERR_R_EC_LIB);
+                goto err;
+                }
+        if (!EC_POINT_is_at_infinity(eckey->group, point))
+                {
+                ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_WRONG_ORDER);
+                goto err;
+                }
+        /* in case the priv_key is present : 
+         * check if generator * priv_key == pub_key 
+         */
+        if (eckey->priv_key)
+                {
+                if (BN_cmp(eckey->priv_key, order) >= 0)
+                        {
+                        ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_WRONG_ORDER);
+                        goto err;
+                        }
+                if (!EC_POINT_mul(eckey->group, point, eckey->priv_key,
+                        NULL, NULL, ctx))
+                        {
+                        ECerr(EC_F_EC_KEY_CHECK_KEY, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                if (EC_POINT_cmp(eckey->group, point, eckey->pub_key, 
+                        ctx) != 0)
+                        {
+                        ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_INVALID_PRIVATE_KEY);
+                        goto err;
+                        }
+                }
+        ok = 1;
+err:
+        if (ctx   != NULL)
+                BN_CTX_free(ctx);
+        if (order != NULL)
+                BN_free(order);
+        if (point != NULL)
+                EC_POINT_free(point);
+        return(ok);
+        }
+
+const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key)
+        {
+        return key->group;
+        }
+
+int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group)
+        {
+        if (key->group != NULL)
+                EC_GROUP_free(key->group);
+        key->group = EC_GROUP_dup(group);
+        return (key->group == NULL) ? 0 : 1;
+        }
+
+const BIGNUM *EC_KEY_get0_private_key(const EC_KEY *key)
+        {
+        return key->priv_key;
+        }
+
+int EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *priv_key)
+        {
+        if (key->priv_key)
+                BN_clear_free(key->priv_key);
+        key->priv_key = BN_dup(priv_key);
+        return (key->priv_key == NULL) ? 0 : 1;
+        }
+
+const EC_POINT *EC_KEY_get0_public_key(const EC_KEY *key)
+        {
+        return key->pub_key;
+        }
+
+int EC_KEY_set_public_key(EC_KEY *key, const EC_POINT *pub_key)
+        {
+        if (key->pub_key != NULL)
+                EC_POINT_free(key->pub_key);
+        key->pub_key = EC_POINT_dup(pub_key, key->group);
+        return (key->pub_key == NULL) ? 0 : 1;
+        }
+
+unsigned int EC_KEY_get_enc_flags(const EC_KEY *key)
+        {
+        return key->enc_flag;
+        }
+
+void EC_KEY_set_enc_flags(EC_KEY *key, unsigned int flags)
+        {
+        key->enc_flag = flags;
+        }
+
+point_conversion_form_t EC_KEY_get_conv_form(const EC_KEY *key)
+        {
+        return key->conv_form;
+        }
+
+void EC_KEY_set_conv_form(EC_KEY *key, point_conversion_form_t cform)
+        {
+        key->conv_form = cform;
+        if (key->group != NULL)
+                EC_GROUP_set_point_conversion_form(key->group, cform);
+        }
+
+void *EC_KEY_get_key_method_data(EC_KEY *key,
+        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *))
+        {
+        return EC_EX_DATA_get_data(key->method_data, dup_func, free_func, clear_free_func);
+        }
+
+void EC_KEY_insert_key_method_data(EC_KEY *key, void *data,
+        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *))
+        {
+        EC_EXTRA_DATA *ex_data;
+        CRYPTO_w_lock(CRYPTO_LOCK_EC);
+        ex_data = EC_EX_DATA_get_data(key->method_data, dup_func, free_func, clear_free_func);
+        if (ex_data == NULL)
+                EC_EX_DATA_set_data(&key->method_data, data, dup_func, free_func, clear_free_func);
+        CRYPTO_w_unlock(CRYPTO_LOCK_EC);
+        }
+
+void EC_KEY_set_asn1_flag(EC_KEY *key, int flag)
+        {
+        if (key->group != NULL)
+                EC_GROUP_set_asn1_flag(key->group, flag);
+        }
+
+int EC_KEY_precompute_mult(EC_KEY *key, BN_CTX *ctx)
+        {
+        if (key->group == NULL)
+                return 0;
+        return EC_GROUP_precompute_mult(key->group, ctx);
+        }
diff --git a/src/lib/libssl/src/crypto/ec/ec_print.c b/src/lib/libssl/src/crypto/ec/ec_print.c
new file mode 100644
index 0000000000..f7c8a303ac
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ec/ec_print.c
@@ -0,0 +1,195 @@
+/* crypto/ec/ec_print.c */
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <openssl/crypto.h>
+#include "ec_lcl.h"
+
+BIGNUM *EC_POINT_point2bn(const EC_GROUP *group, 
+                          const EC_POINT *point, 
+                          point_conversion_form_t form,
+                          BIGNUM *ret,
+                          BN_CTX *ctx)
+        {
+        size_t        buf_len=0;
+        unsigned char *buf;
+
+        buf_len = EC_POINT_point2oct(group, point, form,
+                                     NULL, 0, ctx);
+        if (buf_len == 0)
+                return NULL;
+
+        if ((buf = OPENSSL_malloc(buf_len)) == NULL)
+                return NULL;
+
+        if (!EC_POINT_point2oct(group, point, form, buf, buf_len, ctx))
+                {
+                OPENSSL_free(buf);
+                return NULL;
+                }
+
+        ret = BN_bin2bn(buf, buf_len, ret);
+
+        OPENSSL_free(buf);
+
+        return ret;
+}
+
+EC_POINT *EC_POINT_bn2point(const EC_GROUP *group,
+                            const BIGNUM *bn,
+                            EC_POINT *point, 
+                            BN_CTX *ctx)
+        {
+        size_t        buf_len=0;
+        unsigned char *buf;
+        EC_POINT      *ret;
+
+        if ((buf_len = BN_num_bytes(bn)) == 0) return NULL;
+        buf = OPENSSL_malloc(buf_len);
+        if (buf == NULL)
+                return NULL;
+
+        if (!BN_bn2bin(bn, buf)) 
+                {
+                OPENSSL_free(buf);
+                return NULL;
+                }
+
+        if (point == NULL)
+                {
+                if ((ret = EC_POINT_new(group)) == NULL)
+                        {
+                        OPENSSL_free(buf);
+                        return NULL;
+                        }
+                }
+        else
+                ret = point;
+
+        if (!EC_POINT_oct2point(group, ret, buf, buf_len, ctx))
+                {
+                if (point == NULL)
+                        EC_POINT_clear_free(ret);
+                OPENSSL_free(buf);
+                return NULL;
+                }
+
+        OPENSSL_free(buf);
+        return ret;
+        }
+
+static const char *HEX_DIGITS = "0123456789ABCDEF";
+
+/* the return value must be freed (using OPENSSL_free()) */
+char *EC_POINT_point2hex(const EC_GROUP *group,
+                         const EC_POINT *point,
+                         point_conversion_form_t form,
+                         BN_CTX *ctx)
+        {
+        char          *ret, *p;
+        size_t        buf_len=0,i;
+        unsigned char *buf, *pbuf;
+
+        buf_len = EC_POINT_point2oct(group, point, form,
+                                     NULL, 0, ctx);
+        if (buf_len == 0)
+                return NULL;
+
+        if ((buf = OPENSSL_malloc(buf_len)) == NULL)
+                return NULL;
+
+        if (!EC_POINT_point2oct(group, point, form, buf, buf_len, ctx))
+                {
+                OPENSSL_free(buf);
+                return NULL;
+                }
+
+        ret = (char *)OPENSSL_malloc(buf_len*2+2);
+        if (ret == NULL)
+                {
+                OPENSSL_free(buf);
+                return NULL;
+                }
+        p = ret;
+        pbuf = buf;
+        for (i=buf_len; i > 0; i--)
+                {
+                        int v = (int) *(pbuf++);
+                        *(p++)=HEX_DIGITS[v>>4];
+                        *(p++)=HEX_DIGITS[v&0x0F];
+                }
+        *p='\0';
+
+        OPENSSL_free(buf);
+
+        return ret;
+        }
+
+EC_POINT *EC_POINT_hex2point(const EC_GROUP *group,
+                             const char *buf,
+                             EC_POINT *point,
+                             BN_CTX *ctx)
+        {
+        EC_POINT *ret=NULL;
+        BIGNUM   *tmp_bn=NULL;
+
+        if (!BN_hex2bn(&tmp_bn, buf))
+                return NULL;
+
+        ret = EC_POINT_bn2point(group, tmp_bn, point, ctx);
+
+        BN_clear_free(tmp_bn);
+
+        return ret;
+        }
diff --git a/src/lib/libssl/src/crypto/ecdh/Makefile b/src/lib/libssl/src/crypto/ecdh/Makefile
new file mode 100644
index 0000000000..95aa69fea5
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdh/Makefile
@@ -0,0 +1,111 @@
+#
+# crypto/ecdh/Makefile
+#
+
+DIR=    ecdh
+TOP=    ../..
+CC=     cc
+INCLUDES= -I.. -I$(TOP) -I../../include
+CFLAG=-g -Wall
+MAKEFILE=       Makefile
+AR=             ar r
+
+CFLAGS= $(INCLUDES) $(CFLAG)
+
+GENERAL=Makefile
+TEST=ecdhtest.c
+APPS=
+
+LIB=$(TOP)/libcrypto.a
+LIBSRC= ech_lib.c ech_ossl.c ech_key.c ech_err.c
+
+LIBOBJ= ech_lib.o ech_ossl.o ech_key.o ech_err.o
+
+SRC= $(LIBSRC)
+
+EXHEADER= ecdh.h
+HEADER= ech_locl.h $(EXHEADER)
+
+ALL=    $(GENERAL) $(SRC) $(HEADER)
+
+top:
+        (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
+
+all:    lib
+
+lib:    $(LIBOBJ)
+        $(AR) $(LIB) $(LIBOBJ)
+        $(RANLIB) $(LIB) || echo Never mind.
+        @touch lib
+
+files:
+        $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
+
+links:
+        @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
+        @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
+        @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
+
+install:
+        @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
+        @headerlist="$(EXHEADER)"; for i in $$headerlist; \
+        do  \
+        (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
+        chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
+        done;
+
+tags:
+        ctags $(SRC)
+
+tests:
+
+lint:
+        lint -DLINT $(INCLUDES) $(SRC)>fluff
+
+depend:
+        @[ -n "$(MAKEDEPEND)" ] # should be set by upper Makefile...
+        $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
+
+dclean:
+        $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
+        mv -f Makefile.new $(MAKEFILE)
+
+clean:
+        rm -f *.o */*.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+ech_err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ech_err.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+ech_err.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
+ech_err.o: ../../include/openssl/err.h ../../include/openssl/lhash.h
+ech_err.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+ech_err.o: ../../include/openssl/ossl_typ.h ../../include/openssl/safestack.h
+ech_err.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+ech_err.o: ech_err.c
+ech_key.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ech_key.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+ech_key.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
+ech_key.o: ../../include/openssl/engine.h ../../include/openssl/opensslconf.h
+ech_key.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+ech_key.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+ech_key.o: ../../include/openssl/symhacks.h ech_key.c ech_locl.h
+ech_lib.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ech_lib.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+ech_lib.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
+ech_lib.o: ../../include/openssl/engine.h ../../include/openssl/err.h
+ech_lib.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
+ech_lib.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+ech_lib.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+ech_lib.o: ../../include/openssl/symhacks.h ech_lib.c ech_locl.h
+ech_ossl.o: ../../e_os.h ../../include/openssl/asn1.h
+ech_ossl.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
+ech_ossl.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
+ech_ossl.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+ech_ossl.o: ../../include/openssl/ecdh.h ../../include/openssl/err.h
+ech_ossl.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
+ech_ossl.o: ../../include/openssl/opensslconf.h
+ech_ossl.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+ech_ossl.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+ech_ossl.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+ech_ossl.o: ../cryptlib.h ech_locl.h ech_ossl.c
diff --git a/src/lib/libssl/src/crypto/ecdh/ecdh.h b/src/lib/libssl/src/crypto/ecdh/ecdh.h
new file mode 100644
index 0000000000..b4b58ee65b
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdh/ecdh.h
@@ -0,0 +1,123 @@
+/* crypto/ecdh/ecdh.h */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
+ * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
+ * to the OpenSSL project.
+ *
+ * The ECC Code is licensed pursuant to the OpenSSL open source
+ * license provided below.
+ *
+ * The ECDH software is originally written by Douglas Stebila of
+ * Sun Microsystems Laboratories.
+ *
+ */
+/* ====================================================================
+ * Copyright (c) 2000-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#ifndef HEADER_ECDH_H
+#define HEADER_ECDH_H
+
+#include <openssl/opensslconf.h>
+
+#ifdef OPENSSL_NO_ECDH
+#error ECDH is disabled.
+#endif
+
+#include <openssl/ec.h>
+#include <openssl/ossl_typ.h>
+#ifndef OPENSSL_NO_DEPRECATED
+#include <openssl/bn.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+const ECDH_METHOD *ECDH_OpenSSL(void);
+
+void      ECDH_set_default_method(const ECDH_METHOD *);
+const ECDH_METHOD *ECDH_get_default_method(void);
+int       ECDH_set_method(EC_KEY *, const ECDH_METHOD *);
+
+int ECDH_compute_key(void *out, size_t outlen, const EC_POINT *pub_key, EC_KEY *ecdh,
+                     void *(*KDF)(const void *in, size_t inlen, void *out, size_t *outlen));
+
+int       ECDH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new 
+                *new_func, CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int       ECDH_set_ex_data(EC_KEY *d, int idx, void *arg);
+void      *ECDH_get_ex_data(EC_KEY *d, int idx);
+
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+void ERR_load_ECDH_strings(void);
+
+/* Error codes for the ECDH functions. */
+
+/* Function codes. */
+#define ECDH_F_ECDH_COMPUTE_KEY                          100
+#define ECDH_F_ECDH_DATA_NEW_METHOD                      101
+
+/* Reason codes. */
+#define ECDH_R_KDF_FAILED                                102
+#define ECDH_R_NO_PRIVATE_VALUE                          100
+#define ECDH_R_POINT_ARITHMETIC_FAILURE                  101
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/crypto/ecdh/ecdhtest.c b/src/lib/libssl/src/crypto/ecdh/ecdhtest.c
new file mode 100644
index 0000000000..1575006b51
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdh/ecdhtest.c
@@ -0,0 +1,368 @@
+/* crypto/ecdh/ecdhtest.c */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
+ * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
+ * to the OpenSSL project.
+ *
+ * The ECC Code is licensed pursuant to the OpenSSL open source
+ * license provided below.
+ *
+ * The ECDH software is originally written by Douglas Stebila of
+ * Sun Microsystems Laboratories.
+ *
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "../e_os.h"
+
+#include <openssl/opensslconf.h>        /* for OPENSSL_NO_ECDH */
+#include <openssl/crypto.h>
+#include <openssl/bio.h>
+#include <openssl/bn.h>
+#include <openssl/objects.h>
+#include <openssl/rand.h>
+#include <openssl/sha.h>
+#include <openssl/err.h>
+
+#ifdef OPENSSL_NO_ECDH
+int main(int argc, char *argv[])
+{
+    printf("No ECDH support\n");
+    return(0);
+}
+#else
+#include <openssl/ec.h>
+#include <openssl/ecdh.h>
+
+#ifdef OPENSSL_SYS_WIN16
+#define MS_CALLBACK     _far _loadds
+#else
+#define MS_CALLBACK
+#endif
+
+#if 0
+static void MS_CALLBACK cb(int p, int n, void *arg);
+#endif
+
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
+
+static const int KDF1_SHA1_len = 20;
+static void *KDF1_SHA1(const void *in, size_t inlen, void *out, size_t *outlen)
+        {
+#ifndef OPENSSL_NO_SHA
+        if (*outlen < SHA_DIGEST_LENGTH)
+                return NULL;
+        else
+                *outlen = SHA_DIGEST_LENGTH;
+        return SHA1(in, inlen, out);
+#else
+        return NULL;
+#endif
+        }
+
+
+static int test_ecdh_curve(int nid, const char *text, BN_CTX *ctx, BIO *out)
+        {
+        EC_KEY *a=NULL;
+        EC_KEY *b=NULL;
+        BIGNUM *x_a=NULL, *y_a=NULL,
+               *x_b=NULL, *y_b=NULL;
+        char buf[12];
+        unsigned char *abuf=NULL,*bbuf=NULL;
+        int i,alen,blen,aout,bout,ret=0;
+        const EC_GROUP *group;
+
+        a = EC_KEY_new_by_curve_name(nid);
+        b = EC_KEY_new_by_curve_name(nid);
+        if (a == NULL || b == NULL)
+                goto err;
+
+        group = EC_KEY_get0_group(a);
+
+        if ((x_a=BN_new()) == NULL) goto err;
+        if ((y_a=BN_new()) == NULL) goto err;
+        if ((x_b=BN_new()) == NULL) goto err;
+        if ((y_b=BN_new()) == NULL) goto err;
+
+        BIO_puts(out,"Testing key generation with ");
+        BIO_puts(out,text);
+#ifdef NOISY
+        BIO_puts(out,"\n");
+#else
+        (void)BIO_flush(out);
+#endif
+
+        if (!EC_KEY_generate_key(a)) goto err;
+        
+        if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == NID_X9_62_prime_field) 
+                {
+                if (!EC_POINT_get_affine_coordinates_GFp(group,
+                        EC_KEY_get0_public_key(a), x_a, y_a, ctx)) goto err;
+                }
+        else
+                {
+                if (!EC_POINT_get_affine_coordinates_GF2m(group,
+                        EC_KEY_get0_public_key(a), x_a, y_a, ctx)) goto err;
+                }
+#ifdef NOISY
+        BIO_puts(out,"  pri 1=");
+        BN_print(out,a->priv_key);
+        BIO_puts(out,"\n  pub 1=");
+        BN_print(out,x_a);
+        BIO_puts(out,",");
+        BN_print(out,y_a);
+        BIO_puts(out,"\n");
+#else
+        BIO_printf(out," .");
+        (void)BIO_flush(out);
+#endif
+
+        if (!EC_KEY_generate_key(b)) goto err;
+
+        if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == NID_X9_62_prime_field) 
+                {
+                if (!EC_POINT_get_affine_coordinates_GFp(group, 
+                        EC_KEY_get0_public_key(b), x_b, y_b, ctx)) goto err;
+                }
+        else
+                {
+                if (!EC_POINT_get_affine_coordinates_GF2m(group, 
+                        EC_KEY_get0_public_key(b), x_b, y_b, ctx)) goto err;
+                }
+
+#ifdef NOISY
+        BIO_puts(out,"  pri 2=");
+        BN_print(out,b->priv_key);
+        BIO_puts(out,"\n  pub 2=");
+        BN_print(out,x_b);
+        BIO_puts(out,",");
+        BN_print(out,y_b);
+        BIO_puts(out,"\n");
+#else
+        BIO_printf(out,".");
+        (void)BIO_flush(out);
+#endif
+
+        alen=KDF1_SHA1_len;
+        abuf=(unsigned char *)OPENSSL_malloc(alen);
+        aout=ECDH_compute_key(abuf,alen,EC_KEY_get0_public_key(b),a,KDF1_SHA1);
+
+#ifdef NOISY
+        BIO_puts(out,"  key1 =");
+        for (i=0; i<aout; i++)
+                {
+                sprintf(buf,"%02X",abuf[i]);
+                BIO_puts(out,buf);
+                }
+        BIO_puts(out,"\n");
+#else
+        BIO_printf(out,".");
+        (void)BIO_flush(out);
+#endif
+
+        blen=KDF1_SHA1_len;
+        bbuf=(unsigned char *)OPENSSL_malloc(blen);
+        bout=ECDH_compute_key(bbuf,blen,EC_KEY_get0_public_key(a),b,KDF1_SHA1);
+
+#ifdef NOISY
+        BIO_puts(out,"  key2 =");
+        for (i=0; i<bout; i++)
+                {
+                sprintf(buf,"%02X",bbuf[i]);
+                BIO_puts(out,buf);
+                }
+        BIO_puts(out,"\n");
+#else
+        BIO_printf(out,".");
+        (void)BIO_flush(out);
+#endif
+
+        if ((aout < 4) || (bout != aout) || (memcmp(abuf,bbuf,aout) != 0))
+                {
+#ifndef NOISY
+                BIO_printf(out, " failed\n\n");
+                BIO_printf(out, "key a:\n");
+                BIO_printf(out, "private key: ");
+                BN_print(out, EC_KEY_get0_private_key(a));
+                BIO_printf(out, "\n");
+                BIO_printf(out, "public key (x,y): ");
+                BN_print(out, x_a);
+                BIO_printf(out, ",");
+                BN_print(out, y_a);
+                BIO_printf(out, "\nkey b:\n");
+                BIO_printf(out, "private key: ");
+                BN_print(out, EC_KEY_get0_private_key(b));
+                BIO_printf(out, "\n");
+                BIO_printf(out, "public key (x,y): ");
+                BN_print(out, x_b);
+                BIO_printf(out, ",");
+                BN_print(out, y_b);
+                BIO_printf(out, "\n");
+                BIO_printf(out, "generated key a: ");
+                for (i=0; i<bout; i++)
+                        {
+                        sprintf(buf, "%02X", bbuf[i]);
+                        BIO_puts(out, buf);
+                        }
+                BIO_printf(out, "\n");
+                BIO_printf(out, "generated key b: ");
+                for (i=0; i<aout; i++)
+                        {
+                        sprintf(buf, "%02X", abuf[i]);
+                        BIO_puts(out,buf);
+                        }
+                BIO_printf(out, "\n");
+#endif
+                fprintf(stderr,"Error in ECDH routines\n");
+                ret=0;
+                }
+        else
+                {
+#ifndef NOISY
+                BIO_printf(out, " ok\n");
+#endif
+                ret=1;
+                }
+err:
+        ERR_print_errors_fp(stderr);
+
+        if (abuf != NULL) OPENSSL_free(abuf);
+        if (bbuf != NULL) OPENSSL_free(bbuf);
+        if (x_a) BN_free(x_a);
+        if (y_a) BN_free(y_a);
+        if (x_b) BN_free(x_b);
+        if (y_b) BN_free(y_b);
+        if (b) EC_KEY_free(b);
+        if (a) EC_KEY_free(a);
+        return(ret);
+        }
+
+int main(int argc, char *argv[])
+        {
+        BN_CTX *ctx=NULL;
+        int ret=1;
+        BIO *out;
+
+        CRYPTO_malloc_debug_init();
+        CRYPTO_dbg_set_options(V_CRYPTO_MDEBUG_ALL);
+        CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+
+#ifdef OPENSSL_SYS_WIN32
+        CRYPTO_malloc_init();
+#endif
+
+        RAND_seed(rnd_seed, sizeof rnd_seed);
+
+        out=BIO_new(BIO_s_file());
+        if (out == NULL) EXIT(1);
+        BIO_set_fp(out,stdout,BIO_NOCLOSE);
+
+        if ((ctx=BN_CTX_new()) == NULL) goto err;
+
+        /* NIST PRIME CURVES TESTS */
+        if (!test_ecdh_curve(NID_X9_62_prime192v1, "NIST Prime-Curve P-192", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_secp224r1, "NIST Prime-Curve P-224", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_X9_62_prime256v1, "NIST Prime-Curve P-256", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_secp384r1, "NIST Prime-Curve P-384", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_secp521r1, "NIST Prime-Curve P-521", ctx, out)) goto err;
+        /* NIST BINARY CURVES TESTS */
+        if (!test_ecdh_curve(NID_sect163k1, "NIST Binary-Curve K-163", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_sect163r2, "NIST Binary-Curve B-163", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_sect233k1, "NIST Binary-Curve K-233", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_sect233r1, "NIST Binary-Curve B-233", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_sect283k1, "NIST Binary-Curve K-283", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_sect283r1, "NIST Binary-Curve B-283", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_sect409k1, "NIST Binary-Curve K-409", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_sect409r1, "NIST Binary-Curve B-409", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_sect571k1, "NIST Binary-Curve K-571", ctx, out)) goto err;
+        if (!test_ecdh_curve(NID_sect571r1, "NIST Binary-Curve B-571", ctx, out)) goto err;
+
+        ret = 0;
+
+err:
+        ERR_print_errors_fp(stderr);
+        if (ctx) BN_CTX_free(ctx);
+        BIO_free(out);
+        CRYPTO_cleanup_all_ex_data();
+        ERR_remove_state(0);
+        CRYPTO_mem_leaks_fp(stderr);
+        EXIT(ret);
+        return(ret);
+        }
+
+#if 0
+static void MS_CALLBACK cb(int p, int n, void *arg)
+        {
+        char c='*';
+
+        if (p == 0) c='.';
+        if (p == 1) c='+';
+        if (p == 2) c='*';
+        if (p == 3) c='\n';
+        BIO_write((BIO *)arg,&c,1);
+        (void)BIO_flush((BIO *)arg);
+#ifdef LINT
+        p=n;
+#endif
+        }
+#endif
+#endif
diff --git a/src/lib/libssl/src/crypto/ecdh/ech_err.c b/src/lib/libssl/src/crypto/ecdh/ech_err.c
new file mode 100644
index 0000000000..4d2ede75bd
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdh/ech_err.c
@@ -0,0 +1,98 @@
+/* crypto/ecdh/ech_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include <openssl/ecdh.h>
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(ERR_LIB_ECDH,func,0)
+#define ERR_REASON(reason) ERR_PACK(ERR_LIB_ECDH,0,reason)
+
+static ERR_STRING_DATA ECDH_str_functs[]=
+        {
+{ERR_FUNC(ECDH_F_ECDH_COMPUTE_KEY),     "ECDH_compute_key"},
+{ERR_FUNC(ECDH_F_ECDH_DATA_NEW_METHOD), "ECDH_DATA_NEW_METHOD"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA ECDH_str_reasons[]=
+        {
+{ERR_REASON(ECDH_R_KDF_FAILED)           ,"KDF failed"},
+{ERR_REASON(ECDH_R_NO_PRIVATE_VALUE)     ,"no private value"},
+{ERR_REASON(ECDH_R_POINT_ARITHMETIC_FAILURE),"point arithmetic failure"},
+{0,NULL}
+        };
+
+#endif
+
+void ERR_load_ECDH_strings(void)
+        {
+#ifndef OPENSSL_NO_ERR
+
+        if (ERR_func_error_string(ECDH_str_functs[0].error) == NULL)
+                {
+                ERR_load_strings(0,ECDH_str_functs);
+                ERR_load_strings(0,ECDH_str_reasons);
+                }
+#endif
+        }
diff --git a/src/lib/libssl/src/crypto/ecdh/ech_key.c b/src/lib/libssl/src/crypto/ecdh/ech_key.c
new file mode 100644
index 0000000000..f44da9298b
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdh/ech_key.c
@@ -0,0 +1,83 @@
+/* crypto/ecdh/ecdh_key.c */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
+ * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
+ * to the OpenSSL project.
+ *
+ * The ECC Code is licensed pursuant to the OpenSSL open source
+ * license provided below.
+ *
+ * The ECDH software is originally written by Douglas Stebila of
+ * Sun Microsystems Laboratories.
+ *
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "ech_locl.h"
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
+
+int ECDH_compute_key(void *out, size_t outlen, const EC_POINT *pub_key,
+        EC_KEY *eckey,
+        void *(*KDF)(const void *in, size_t inlen, void *out, size_t *outlen))
+{
+        ECDH_DATA *ecdh = ecdh_check(eckey);
+        if (ecdh == NULL)
+                return 0;
+        return ecdh->meth->compute_key(out, outlen, pub_key, eckey, KDF);
+}
diff --git a/src/lib/libssl/src/crypto/ecdh/ech_lib.c b/src/lib/libssl/src/crypto/ecdh/ech_lib.c
new file mode 100644
index 0000000000..e89b1d4772
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdh/ech_lib.c
@@ -0,0 +1,247 @@
+/* crypto/ecdh/ech_lib.c */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
+ * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
+ * to the OpenSSL project.
+ *
+ * The ECC Code is licensed pursuant to the OpenSSL open source
+ * license provided below.
+ *
+ * The ECDH software is originally written by Douglas Stebila of
+ * Sun Microsystems Laboratories.
+ *
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "ech_locl.h"
+#include <string.h>
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
+#include <openssl/err.h>
+
+const char ECDH_version[]="ECDH" OPENSSL_VERSION_PTEXT;
+
+static const ECDH_METHOD *default_ECDH_method = NULL;
+
+static void *ecdh_data_new(void);
+static void *ecdh_data_dup(void *);
+static void  ecdh_data_free(void *);
+
+void ECDH_set_default_method(const ECDH_METHOD *meth)
+        {
+        default_ECDH_method = meth;
+        }
+
+const ECDH_METHOD *ECDH_get_default_method(void)
+        {
+        if(!default_ECDH_method) 
+                default_ECDH_method = ECDH_OpenSSL();
+        return default_ECDH_method;
+        }
+
+int ECDH_set_method(EC_KEY *eckey, const ECDH_METHOD *meth)
+        {
+        const ECDH_METHOD *mtmp;
+        ECDH_DATA *ecdh;
+
+        ecdh = ecdh_check(eckey);
+
+        if (ecdh == NULL)
+                return 0;
+
+        mtmp = ecdh->meth;
+#if 0
+        if (mtmp->finish)
+                mtmp->finish(eckey);
+#endif
+#ifndef OPENSSL_NO_ENGINE
+        if (ecdh->engine)
+                {
+                ENGINE_finish(ecdh->engine);
+                ecdh->engine = NULL;
+                }
+#endif
+        ecdh->meth = meth;
+#if 0
+        if (meth->init) 
+                meth->init(eckey);
+#endif
+        return 1;
+        }
+
+static ECDH_DATA *ECDH_DATA_new_method(ENGINE *engine)
+        {
+        ECDH_DATA *ret;
+
+        ret=(ECDH_DATA *)OPENSSL_malloc(sizeof(ECDH_DATA));
+        if (ret == NULL)
+                {
+                ECDHerr(ECDH_F_ECDH_DATA_NEW_METHOD, ERR_R_MALLOC_FAILURE);
+                return(NULL);
+                }
+
+        ret->init = NULL;
+
+        ret->meth = ECDH_get_default_method();
+        ret->engine = engine;
+#ifndef OPENSSL_NO_ENGINE
+        if (!ret->engine)
+                ret->engine = ENGINE_get_default_ECDH();
+        if (ret->engine)
+                {
+                ret->meth = ENGINE_get_ECDH(ret->engine);
+                if (!ret->meth)
+                        {
+                        ECDHerr(ECDH_F_ECDH_DATA_NEW_METHOD, ERR_R_ENGINE_LIB);
+                        ENGINE_finish(ret->engine);
+                        OPENSSL_free(ret);
+                        return NULL;
+                        }
+                }
+#endif
+
+        ret->flags = ret->meth->flags;
+        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_ECDH, ret, &ret->ex_data);
+#if 0
+        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
+                {
+                CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDH, ret, &ret->ex_data);
+                OPENSSL_free(ret);
+                ret=NULL;
+                }
+#endif  
+        return(ret);
+        }
+
+static void *ecdh_data_new(void)
+        {
+        return (void *)ECDH_DATA_new_method(NULL);
+        }
+
+static void *ecdh_data_dup(void *data)
+{
+        ECDH_DATA *r = (ECDH_DATA *)data;
+
+        /* XXX: dummy operation */
+        if (r == NULL)
+                return NULL;
+
+        return (void *)ecdh_data_new();
+}
+
+void ecdh_data_free(void *data)
+        {
+        ECDH_DATA *r = (ECDH_DATA *)data;
+
+#ifndef OPENSSL_NO_ENGINE
+        if (r->engine)
+                ENGINE_finish(r->engine);
+#endif
+
+        CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDH, r, &r->ex_data);
+
+        OPENSSL_cleanse((void *)r, sizeof(ECDH_DATA));
+
+        OPENSSL_free(r);
+        }
+
+ECDH_DATA *ecdh_check(EC_KEY *key)
+        {
+        ECDH_DATA *ecdh_data;
+ 
+        void *data = EC_KEY_get_key_method_data(key, ecdh_data_dup,
+                                        ecdh_data_free, ecdh_data_free);
+        if (data == NULL)
+        {
+                ecdh_data = (ECDH_DATA *)ecdh_data_new();
+                if (ecdh_data == NULL)
+                        return NULL;
+                EC_KEY_insert_key_method_data(key, (void *)ecdh_data,
+                        ecdh_data_dup, ecdh_data_free, ecdh_data_free);
+        }
+        else
+                ecdh_data = (ECDH_DATA *)data;
+        
+
+        return ecdh_data;
+        }
+
+int ECDH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+        {
+        return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_ECDH, argl, argp,
+                                new_func, dup_func, free_func);
+        }
+
+int ECDH_set_ex_data(EC_KEY *d, int idx, void *arg)
+        {
+        ECDH_DATA *ecdh;
+        ecdh = ecdh_check(d);
+        if (ecdh == NULL)
+                return 0;
+        return(CRYPTO_set_ex_data(&ecdh->ex_data,idx,arg));
+        }
+
+void *ECDH_get_ex_data(EC_KEY *d, int idx)
+        {
+        ECDH_DATA *ecdh;
+        ecdh = ecdh_check(d);
+        if (ecdh == NULL)
+                return NULL;
+        return(CRYPTO_get_ex_data(&ecdh->ex_data,idx));
+        }
diff --git a/src/lib/libssl/src/crypto/ecdh/ech_locl.h b/src/lib/libssl/src/crypto/ecdh/ech_locl.h
new file mode 100644
index 0000000000..f658526a7e
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdh/ech_locl.h
@@ -0,0 +1,94 @@
+/* crypto/ecdh/ech_locl.h */
+/* ====================================================================
+ * Copyright (c) 2000-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_ECH_LOCL_H
+#define HEADER_ECH_LOCL_H
+
+#include <openssl/ecdh.h>
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+struct ecdh_method 
+        {
+        const char *name;
+        int (*compute_key)(void *key, size_t outlen, const EC_POINT *pub_key, EC_KEY *ecdh,
+                           void *(*KDF)(const void *in, size_t inlen, void *out, size_t *outlen));
+#if 0
+        int (*init)(EC_KEY *eckey);
+        int (*finish)(EC_KEY *eckey);
+#endif
+        int flags;
+        char *app_data;
+        };
+
+typedef struct ecdh_data_st {
+        /* EC_KEY_METH_DATA part */
+        int (*init)(EC_KEY *);
+        /* method specific part */
+        ENGINE  *engine;
+        int     flags;
+        const ECDH_METHOD *meth;
+        CRYPTO_EX_DATA ex_data;
+} ECDH_DATA;
+
+ECDH_DATA *ecdh_check(EC_KEY *);
+
+#ifdef  __cplusplus
+}
+#endif
+
+#endif /* HEADER_ECH_LOCL_H */
diff --git a/src/lib/libssl/src/crypto/ecdh/ech_ossl.c b/src/lib/libssl/src/crypto/ecdh/ech_ossl.c
new file mode 100644
index 0000000000..2a40ff12df
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdh/ech_ossl.c
@@ -0,0 +1,213 @@
+/* crypto/ecdh/ech_ossl.c */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
+ * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
+ * to the OpenSSL project.
+ *
+ * The ECC Code is licensed pursuant to the OpenSSL open source
+ * license provided below.
+ *
+ * The ECDH software is originally written by Douglas Stebila of
+ * Sun Microsystems Laboratories.
+ *
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+#include <string.h>
+#include <limits.h>
+
+#include "cryptlib.h"
+
+#include "ech_locl.h"
+#include <openssl/err.h>
+#include <openssl/sha.h>
+#include <openssl/obj_mac.h>
+#include <openssl/bn.h>
+
+static int ecdh_compute_key(void *out, size_t len, const EC_POINT *pub_key,
+        EC_KEY *ecdh, 
+        void *(*KDF)(const void *in, size_t inlen, void *out, size_t *outlen));
+
+static ECDH_METHOD openssl_ecdh_meth = {
+        "OpenSSL ECDH method",
+        ecdh_compute_key,
+#if 0
+        NULL, /* init     */
+        NULL, /* finish   */
+#endif
+        0,    /* flags    */
+        NULL  /* app_data */
+};
+
+const ECDH_METHOD *ECDH_OpenSSL(void)
+        {
+        return &openssl_ecdh_meth;
+        }
+
+
+/* This implementation is based on the following primitives in the IEEE 1363 standard:
+ *  - ECKAS-DH1
+ *  - ECSVDP-DH
+ * Finally an optional KDF is applied.
+ */
+static int ecdh_compute_key(void *out, size_t outlen, const EC_POINT *pub_key,
+        EC_KEY *ecdh,
+        void *(*KDF)(const void *in, size_t inlen, void *out, size_t *outlen))
+        {
+        BN_CTX *ctx;
+        EC_POINT *tmp=NULL;
+        BIGNUM *x=NULL, *y=NULL;
+        const BIGNUM *priv_key;
+        const EC_GROUP* group;
+        int ret= -1;
+        size_t buflen, len;
+        unsigned char *buf=NULL;
+
+        if (outlen > INT_MAX)
+                {
+                ECDHerr(ECDH_F_ECDH_COMPUTE_KEY,ERR_R_MALLOC_FAILURE); /* sort of, anyway */
+                return -1;
+                }
+
+        if ((ctx = BN_CTX_new()) == NULL) goto err;
+        BN_CTX_start(ctx);
+        x = BN_CTX_get(ctx);
+        y = BN_CTX_get(ctx);
+        
+        priv_key = EC_KEY_get0_private_key(ecdh);
+        if (priv_key == NULL)
+                {
+                ECDHerr(ECDH_F_ECDH_COMPUTE_KEY,ECDH_R_NO_PRIVATE_VALUE);
+                goto err;
+                }
+
+        group = EC_KEY_get0_group(ecdh);
+        if ((tmp=EC_POINT_new(group)) == NULL)
+                {
+                ECDHerr(ECDH_F_ECDH_COMPUTE_KEY,ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        if (!EC_POINT_mul(group, tmp, NULL, pub_key, priv_key, ctx)) 
+                {
+                ECDHerr(ECDH_F_ECDH_COMPUTE_KEY,ECDH_R_POINT_ARITHMETIC_FAILURE);
+                goto err;
+                }
+                
+        if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == NID_X9_62_prime_field) 
+                {
+                if (!EC_POINT_get_affine_coordinates_GFp(group, tmp, x, y, ctx)) 
+                        {
+                        ECDHerr(ECDH_F_ECDH_COMPUTE_KEY,ECDH_R_POINT_ARITHMETIC_FAILURE);
+                        goto err;
+                        }
+                }
+        else
+                {
+                if (!EC_POINT_get_affine_coordinates_GF2m(group, tmp, x, y, ctx)) 
+                        {
+                        ECDHerr(ECDH_F_ECDH_COMPUTE_KEY,ECDH_R_POINT_ARITHMETIC_FAILURE);
+                        goto err;
+                        }
+                }
+
+        buflen = (EC_GROUP_get_degree(group) + 7)/8;
+        len = BN_num_bytes(x);
+        if (len > buflen)
+                {
+                ECDHerr(ECDH_F_ECDH_COMPUTE_KEY,ERR_R_INTERNAL_ERROR);
+                goto err;
+                }
+        if ((buf = OPENSSL_malloc(buflen)) == NULL)
+                {
+                ECDHerr(ECDH_F_ECDH_COMPUTE_KEY,ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+        
+        memset(buf, 0, buflen - len);
+        if (len != (size_t)BN_bn2bin(x, buf + buflen - len))
+                {
+                ECDHerr(ECDH_F_ECDH_COMPUTE_KEY,ERR_R_BN_LIB);
+                goto err;
+                }
+
+        if (KDF != 0)
+                {
+                if (KDF(buf, buflen, out, &outlen) == NULL)
+                        {
+                        ECDHerr(ECDH_F_ECDH_COMPUTE_KEY,ECDH_R_KDF_FAILED);
+                        goto err;
+                        }
+                ret = outlen;
+                }
+        else
+                {
+                /* no KDF, just copy as much as we can */
+                if (outlen > buflen)
+                        outlen = buflen;
+                memcpy(out, buf, outlen);
+                ret = outlen;
+                }
+        
+err:
+        if (tmp) EC_POINT_free(tmp);
+        if (ctx) BN_CTX_end(ctx);
+        if (ctx) BN_CTX_free(ctx);
+        if (buf) OPENSSL_free(buf);
+        return(ret);
+        }
diff --git a/src/lib/libssl/src/crypto/ecdsa/Makefile b/src/lib/libssl/src/crypto/ecdsa/Makefile
new file mode 100644
index 0000000000..16a93cd3ae
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdsa/Makefile
@@ -0,0 +1,125 @@
+#
+# crypto/ecdsa/Makefile
+#
+
+DIR=    ecdsa
+TOP=    ../..
+CC=     cc
+INCLUDES= -I.. -I$(TOP) -I../../include
+CFLAG=-g -Wall
+MAKEFILE=       Makefile
+AR=             ar r
+
+CFLAGS= $(INCLUDES) $(CFLAG)
+
+GENERAL=Makefile
+TEST=ecdsatest.c
+APPS=
+
+LIB=$(TOP)/libcrypto.a
+LIBSRC= ecs_lib.c ecs_asn1.c ecs_ossl.c ecs_sign.c ecs_vrf.c ecs_err.c
+
+LIBOBJ= ecs_lib.o ecs_asn1.o ecs_ossl.o ecs_sign.o ecs_vrf.o ecs_err.o
+
+SRC= $(LIBSRC)
+
+EXHEADER= ecdsa.h
+HEADER= ecs_locl.h $(EXHEADER)
+
+ALL=    $(GENERAL) $(SRC) $(HEADER)
+
+top:
+        (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
+
+all:    lib
+
+lib:    $(LIBOBJ)
+        $(AR) $(LIB) $(LIBOBJ)
+        $(RANLIB) $(LIB) || echo Never mind.
+        @touch lib
+
+files:
+        $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
+
+links:
+        @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
+        @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
+        @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
+
+install:
+        @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
+        @headerlist="$(EXHEADER)"; for i in $$headerlist; \
+        do  \
+        (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
+        chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
+        done;
+
+tags:
+        ctags $(SRC)
+
+tests:
+
+lint:
+        lint -DLINT $(INCLUDES) $(SRC)>fluff
+
+depend:
+        @[ -n "$(MAKEDEPEND)" ] # should be set by upper Makefile...
+        $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
+
+dclean:
+        $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
+        mv -f Makefile.new $(MAKEFILE)
+
+clean:
+        rm -f *.o */*.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+ecs_asn1.o: ../../include/openssl/asn1.h ../../include/openssl/asn1t.h
+ecs_asn1.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
+ecs_asn1.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+ecs_asn1.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
+ecs_asn1.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
+ecs_asn1.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+ecs_asn1.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+ecs_asn1.o: ../../include/openssl/symhacks.h ecs_asn1.c ecs_locl.h
+ecs_err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ecs_err.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+ecs_err.o: ../../include/openssl/ec.h ../../include/openssl/ecdsa.h
+ecs_err.o: ../../include/openssl/err.h ../../include/openssl/lhash.h
+ecs_err.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+ecs_err.o: ../../include/openssl/ossl_typ.h ../../include/openssl/safestack.h
+ecs_err.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+ecs_err.o: ecs_err.c
+ecs_lib.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ecs_lib.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
+ecs_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+ecs_lib.o: ../../include/openssl/ecdsa.h ../../include/openssl/engine.h
+ecs_lib.o: ../../include/openssl/err.h ../../include/openssl/lhash.h
+ecs_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+ecs_lib.o: ../../include/openssl/ossl_typ.h ../../include/openssl/safestack.h
+ecs_lib.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+ecs_lib.o: ecs_lib.c ecs_locl.h
+ecs_ossl.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ecs_ossl.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
+ecs_ossl.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+ecs_ossl.o: ../../include/openssl/ecdsa.h ../../include/openssl/err.h
+ecs_ossl.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
+ecs_ossl.o: ../../include/openssl/opensslconf.h
+ecs_ossl.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+ecs_ossl.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+ecs_ossl.o: ../../include/openssl/symhacks.h ecs_locl.h ecs_ossl.c
+ecs_sign.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ecs_sign.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+ecs_sign.o: ../../include/openssl/ec.h ../../include/openssl/ecdsa.h
+ecs_sign.o: ../../include/openssl/engine.h ../../include/openssl/opensslconf.h
+ecs_sign.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+ecs_sign.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+ecs_sign.o: ../../include/openssl/symhacks.h ecs_locl.h ecs_sign.c
+ecs_vrf.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ecs_vrf.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+ecs_vrf.o: ../../include/openssl/ec.h ../../include/openssl/ecdsa.h
+ecs_vrf.o: ../../include/openssl/engine.h ../../include/openssl/opensslconf.h
+ecs_vrf.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+ecs_vrf.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+ecs_vrf.o: ../../include/openssl/symhacks.h ecs_locl.h ecs_vrf.c
diff --git a/src/lib/libssl/src/crypto/ecdsa/ecdsa.h b/src/lib/libssl/src/crypto/ecdsa/ecdsa.h
new file mode 100644
index 0000000000..f20c8ee738
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdsa/ecdsa.h
@@ -0,0 +1,271 @@
+/* crypto/ecdsa/ecdsa.h */
+/**
+ * \file   crypto/ecdsa/ecdsa.h Include file for the OpenSSL ECDSA functions
+ * \author Written by Nils Larsch for the OpenSSL project
+ */
+/* ====================================================================
+ * Copyright (c) 2000-2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#ifndef HEADER_ECDSA_H
+#define HEADER_ECDSA_H
+
+#include <openssl/opensslconf.h>
+
+#ifdef OPENSSL_NO_ECDSA
+#error ECDSA is disabled.
+#endif
+
+#include <openssl/ec.h>
+#include <openssl/ossl_typ.h>
+#ifndef OPENSSL_NO_DEPRECATED
+#include <openssl/bn.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct ECDSA_SIG_st
+        {
+        BIGNUM *r;
+        BIGNUM *s;
+        } ECDSA_SIG;
+
+/** ECDSA_SIG *ECDSA_SIG_new(void)
+ * allocates and initialize a ECDSA_SIG structure
+ * \return pointer to a ECDSA_SIG structure or NULL if an error occurred
+ */
+ECDSA_SIG *ECDSA_SIG_new(void);
+
+/** ECDSA_SIG_free
+ * frees a ECDSA_SIG structure
+ * \param a pointer to the ECDSA_SIG structure
+ */
+void      ECDSA_SIG_free(ECDSA_SIG *a);
+
+/** i2d_ECDSA_SIG
+ * DER encode content of ECDSA_SIG object (note: this function modifies *pp
+ * (*pp += length of the DER encoded signature)).
+ * \param a  pointer to the ECDSA_SIG object
+ * \param pp pointer to a unsigned char pointer for the output or NULL
+ * \return the length of the DER encoded ECDSA_SIG object or 0 
+ */
+int       i2d_ECDSA_SIG(const ECDSA_SIG *a, unsigned char **pp);
+
+/** d2i_ECDSA_SIG
+ * decodes a DER encoded ECDSA signature (note: this function changes *pp
+ * (*pp += len)). 
+ * \param v pointer to ECDSA_SIG pointer (may be NULL)
+ * \param pp buffer with the DER encoded signature
+ * \param len bufferlength
+ * \return pointer to the decoded ECDSA_SIG structure (or NULL)
+ */
+ECDSA_SIG *d2i_ECDSA_SIG(ECDSA_SIG **v, const unsigned char **pp, long len);
+
+/** ECDSA_do_sign
+ * computes the ECDSA signature of the given hash value using
+ * the supplied private key and returns the created signature.
+ * \param dgst pointer to the hash value
+ * \param dgst_len length of the hash value
+ * \param eckey pointer to the EC_KEY object containing a private EC key
+ * \return pointer to a ECDSA_SIG structure or NULL
+ */
+ECDSA_SIG *ECDSA_do_sign(const unsigned char *dgst,int dgst_len,EC_KEY *eckey);
+
+/** ECDSA_do_sign_ex
+ * computes ECDSA signature of a given hash value using the supplied
+ * private key (note: sig must point to ECDSA_size(eckey) bytes of memory).
+ * \param dgst pointer to the hash value to sign
+ * \param dgstlen length of the hash value
+ * \param kinv optional pointer to a pre-computed inverse k
+ * \param rp optional pointer to the pre-computed rp value (see 
+ *        ECDSA_sign_setup
+ * \param eckey pointer to the EC_KEY object containing a private EC key
+ * \return pointer to a ECDSA_SIG structure or NULL
+ */
+ECDSA_SIG *ECDSA_do_sign_ex(const unsigned char *dgst, int dgstlen, 
+                const BIGNUM *kinv, const BIGNUM *rp, EC_KEY *eckey);
+
+/** ECDSA_do_verify
+ * verifies that the supplied signature is a valid ECDSA
+ * signature of the supplied hash value using the supplied public key.
+ * \param dgst pointer to the hash value
+ * \param dgst_len length of the hash value
+ * \param sig  pointer to the ECDSA_SIG structure
+ * \param eckey pointer to the EC_KEY object containing a public EC key
+ * \return 1 if the signature is valid, 0 if the signature is invalid and -1 on error
+ */
+int       ECDSA_do_verify(const unsigned char *dgst, int dgst_len,
+                const ECDSA_SIG *sig, EC_KEY* eckey);
+
+const ECDSA_METHOD *ECDSA_OpenSSL(void);
+
+/** ECDSA_set_default_method
+ * sets the default ECDSA method
+ * \param meth the new default ECDSA_METHOD
+ */
+void      ECDSA_set_default_method(const ECDSA_METHOD *meth);
+
+/** ECDSA_get_default_method
+ * returns the default ECDSA method
+ * \return pointer to ECDSA_METHOD structure containing the default method
+ */
+const ECDSA_METHOD *ECDSA_get_default_method(void);
+
+/** ECDSA_set_method
+ * sets method to be used for the ECDSA operations
+ * \param eckey pointer to the EC_KEY object
+ * \param meth  pointer to the new method
+ * \return 1 on success and 0 otherwise 
+ */
+int       ECDSA_set_method(EC_KEY *eckey, const ECDSA_METHOD *meth);
+
+/** ECDSA_size
+ * returns the maximum length of the DER encoded signature
+ * \param  eckey pointer to a EC_KEY object
+ * \return numbers of bytes required for the DER encoded signature
+ */
+int       ECDSA_size(const EC_KEY *eckey);
+
+/** ECDSA_sign_setup
+ * precompute parts of the signing operation. 
+ * \param eckey pointer to the EC_KEY object containing a private EC key
+ * \param ctx  pointer to a BN_CTX object (may be NULL)
+ * \param kinv pointer to a BIGNUM pointer for the inverse of k
+ * \param rp   pointer to a BIGNUM pointer for x coordinate of k * generator
+ * \return 1 on success and 0 otherwise
+ */
+int       ECDSA_sign_setup(EC_KEY *eckey, BN_CTX *ctx, BIGNUM **kinv, 
+                BIGNUM **rp);
+
+/** ECDSA_sign
+ * computes ECDSA signature of a given hash value using the supplied
+ * private key (note: sig must point to ECDSA_size(eckey) bytes of memory).
+ * \param type this parameter is ignored
+ * \param dgst pointer to the hash value to sign
+ * \param dgstlen length of the hash value
+ * \param sig buffer to hold the DER encoded signature
+ * \param siglen pointer to the length of the returned signature
+ * \param eckey pointer to the EC_KEY object containing a private EC key
+ * \return 1 on success and 0 otherwise
+ */
+int       ECDSA_sign(int type, const unsigned char *dgst, int dgstlen, 
+                unsigned char *sig, unsigned int *siglen, EC_KEY *eckey);
+
+
+/** ECDSA_sign_ex
+ * computes ECDSA signature of a given hash value using the supplied
+ * private key (note: sig must point to ECDSA_size(eckey) bytes of memory).
+ * \param type this parameter is ignored
+ * \param dgst pointer to the hash value to sign
+ * \param dgstlen length of the hash value
+ * \param sig buffer to hold the DER encoded signature
+ * \param siglen pointer to the length of the returned signature
+ * \param kinv optional pointer to a pre-computed inverse k
+ * \param rp optional pointer to the pre-computed rp value (see 
+ *        ECDSA_sign_setup
+ * \param eckey pointer to the EC_KEY object containing a private EC key
+ * \return 1 on success and 0 otherwise
+ */
+int       ECDSA_sign_ex(int type, const unsigned char *dgst, int dgstlen, 
+                unsigned char *sig, unsigned int *siglen, const BIGNUM *kinv,
+                const BIGNUM *rp, EC_KEY *eckey);
+
+/** ECDSA_verify
+ * verifies that the given signature is valid ECDSA signature
+ * of the supplied hash value using the specified public key.
+ * \param type this parameter is ignored
+ * \param dgst pointer to the hash value 
+ * \param dgstlen length of the hash value
+ * \param sig  pointer to the DER encoded signature
+ * \param siglen length of the DER encoded signature
+ * \param eckey pointer to the EC_KEY object containing a public EC key
+ * \return 1 if the signature is valid, 0 if the signature is invalid and -1 on error
+ */
+int       ECDSA_verify(int type, const unsigned char *dgst, int dgstlen, 
+                const unsigned char *sig, int siglen, EC_KEY *eckey);
+
+/* the standard ex_data functions */
+int       ECDSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new 
+                *new_func, CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int       ECDSA_set_ex_data(EC_KEY *d, int idx, void *arg);
+void      *ECDSA_get_ex_data(EC_KEY *d, int idx);
+
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+void ERR_load_ECDSA_strings(void);
+
+/* Error codes for the ECDSA functions. */
+
+/* Function codes. */
+#define ECDSA_F_ECDSA_DATA_NEW_METHOD                    100
+#define ECDSA_F_ECDSA_DO_SIGN                            101
+#define ECDSA_F_ECDSA_DO_VERIFY                          102
+#define ECDSA_F_ECDSA_SIGN_SETUP                         103
+
+/* Reason codes. */
+#define ECDSA_R_BAD_SIGNATURE                            100
+#define ECDSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE              101
+#define ECDSA_R_ERR_EC_LIB                               102
+#define ECDSA_R_MISSING_PARAMETERS                       103
+#define ECDSA_R_NEED_NEW_SETUP_VALUES                    106
+#define ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED          104
+#define ECDSA_R_SIGNATURE_MALLOC_FAILED                  105
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/crypto/ecdsa/ecdsatest.c b/src/lib/libssl/src/crypto/ecdsa/ecdsatest.c
new file mode 100644
index 0000000000..b07e31252b
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdsa/ecdsatest.c
@@ -0,0 +1,500 @@
+/* crypto/ecdsa/ecdsatest.c */
+/*
+ * Written by Nils Larsch for the OpenSSL project.
+ */
+/* ====================================================================
+ * Copyright (c) 2000-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * The elliptic curve binary polynomial software is originally written by 
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/opensslconf.h> /* To see if OPENSSL_NO_ECDSA is defined */
+
+#ifdef OPENSSL_NO_ECDSA
+int main(int argc, char * argv[])
+        {
+        puts("Elliptic curves are disabled.");
+        return 0;
+        }
+#else
+
+#include <openssl/crypto.h>
+#include <openssl/bio.h>
+#include <openssl/evp.h>
+#include <openssl/bn.h>
+#include <openssl/ecdsa.h>
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
+#include <openssl/err.h>
+#include <openssl/rand.h>
+
+static const char rnd_seed[] = "string to make the random number generator "
+        "think it has entropy";
+
+/* declaration of the test functions */
+int x9_62_tests(BIO *);
+int x9_62_test_internal(BIO *out, int nid, const char *r, const char *s);
+int test_builtin(BIO *);
+
+/* functions to change the RAND_METHOD */
+int change_rand(void);
+int restore_rand(void);
+int fbytes(unsigned char *buf, int num);
+
+RAND_METHOD     fake_rand;
+const RAND_METHOD *old_rand;
+
+int change_rand(void)
+        {
+        /* save old rand method */
+        if ((old_rand = RAND_get_rand_method()) == NULL)
+                return 0;
+
+        fake_rand.seed    = old_rand->seed;
+        fake_rand.cleanup = old_rand->cleanup;
+        fake_rand.add     = old_rand->add;
+        fake_rand.status  = old_rand->status;
+        /* use own random function */
+        fake_rand.bytes      = fbytes;
+        fake_rand.pseudorand = old_rand->bytes;
+        /* set new RAND_METHOD */
+        if (!RAND_set_rand_method(&fake_rand))
+                return 0;
+        return 1;
+        }
+
+int restore_rand(void)
+        {
+        if (!RAND_set_rand_method(old_rand))
+                return 0;
+        else
+                return 1;
+        }
+
+static int fbytes_counter = 0;
+static const char *numbers[8] = {
+        "651056770906015076056810763456358567190100156695615665659",
+        "6140507067065001063065065565667405560006161556565665656654",
+        "8763001015071075675010661307616710783570106710677817767166"
+        "71676178726717",
+        "7000000175690566466555057817571571075705015757757057795755"
+        "55657156756655",
+        "1275552191113212300012030439187146164646146646466749494799",
+        "1542725565216523985789236956265265265235675811949404040041",
+        "1456427555219115346513212300075341203043918714616464614664"
+        "64667494947990",
+        "1712787255652165239672857892369562652652652356758119494040"
+        "40041670216363"};
+
+int fbytes(unsigned char *buf, int num)
+        {
+        int     ret;
+        BIGNUM  *tmp = NULL;
+
+        if (fbytes_counter >= 8)
+                return 0;
+        tmp = BN_new();
+        if (!tmp)
+                return 0;
+        if (!BN_dec2bn(&tmp, numbers[fbytes_counter]))
+                {
+                BN_free(tmp);
+                return 0;
+                }
+        fbytes_counter ++;
+        ret = BN_bn2bin(tmp, buf);      
+        if (ret == 0 || ret != num)
+                ret = 0;
+        else
+                ret = 1;
+        if (tmp)
+                BN_free(tmp);
+        return ret;
+        }
+
+/* some tests from the X9.62 draft */
+int x9_62_test_internal(BIO *out, int nid, const char *r_in, const char *s_in)
+        {
+        int     ret = 0;
+        const char message[] = "abc";
+        unsigned char digest[20];
+        unsigned int  dgst_len = 0;
+        EVP_MD_CTX md_ctx;
+        EC_KEY    *key = NULL;
+        ECDSA_SIG *signature = NULL;
+        BIGNUM    *r = NULL, *s = NULL;
+
+        EVP_MD_CTX_init(&md_ctx);
+        /* get the message digest */
+        EVP_DigestInit(&md_ctx, EVP_ecdsa());
+        EVP_DigestUpdate(&md_ctx, (const void*)message, 3);
+        EVP_DigestFinal(&md_ctx, digest, &dgst_len);
+
+        BIO_printf(out, "testing %s: ", OBJ_nid2sn(nid));
+        /* create the key */
+        if ((key = EC_KEY_new_by_curve_name(nid)) == NULL)
+                goto x962_int_err;
+        if (!EC_KEY_generate_key(key))
+                goto x962_int_err;
+        BIO_printf(out, ".");
+        (void)BIO_flush(out);
+        /* create the signature */
+        signature = ECDSA_do_sign(digest, 20, key);
+        if (signature == NULL)
+                goto x962_int_err;
+        BIO_printf(out, ".");
+        (void)BIO_flush(out);
+        /* compare the created signature with the expected signature */
+        if ((r = BN_new()) == NULL || (s = BN_new()) == NULL)
+                goto x962_int_err;
+        if (!BN_dec2bn(&r, r_in) ||
+            !BN_dec2bn(&s, s_in))
+                goto x962_int_err;
+        if (BN_cmp(signature->r ,r) || BN_cmp(signature->s, s))
+                goto x962_int_err;
+        BIO_printf(out, ".");
+        (void)BIO_flush(out);
+        /* verify the signature */
+        if (ECDSA_do_verify(digest, 20, signature, key) != 1)
+                goto x962_int_err;
+        BIO_printf(out, ".");
+        (void)BIO_flush(out);
+
+        BIO_printf(out, " ok\n");
+        ret = 1;
+x962_int_err:
+        if (!ret)
+                BIO_printf(out, " failed\n");
+        if (key)
+                EC_KEY_free(key);
+        if (signature)
+                ECDSA_SIG_free(signature);
+        if (r)
+                BN_free(r);
+        if (s)
+                BN_free(s);
+        EVP_MD_CTX_cleanup(&md_ctx);
+        return ret;
+        }
+
+int x9_62_tests(BIO *out)
+        {
+        int ret = 0;
+
+        BIO_printf(out, "some tests from X9.62:\n");
+
+        /* set own rand method */
+        if (!change_rand())
+                goto x962_err;
+
+        if (!x9_62_test_internal(out, NID_X9_62_prime192v1,
+                "3342403536405981729393488334694600415596881826869351677613",
+                "5735822328888155254683894997897571951568553642892029982342"))
+                goto x962_err;
+        if (!x9_62_test_internal(out, NID_X9_62_prime239v1,
+                "3086361431751678114926225473006680188549593787585317781474"
+                "62058306432176",
+                "3238135532097973577080787768312505059318910517550078427819"
+                "78505179448783"))
+                goto x962_err;
+        if (!x9_62_test_internal(out, NID_X9_62_c2tnb191v1,
+                "87194383164871543355722284926904419997237591535066528048",
+                "308992691965804947361541664549085895292153777025772063598"))
+                goto x962_err;
+        if (!x9_62_test_internal(out, NID_X9_62_c2tnb239v1,
+                "2159633321041961198501834003903461262881815148684178964245"
+                "5876922391552",
+                "1970303740007316867383349976549972270528498040721988191026"
+                "49413465737174"))
+                goto x962_err;
+
+        ret = 1;
+x962_err:
+        if (!restore_rand())
+                ret = 0;
+        return ret;
+        }
+
+int test_builtin(BIO *out)
+        {
+        EC_builtin_curve *curves = NULL;
+        size_t          crv_len = 0, n = 0;
+        EC_KEY          *eckey = NULL, *wrong_eckey = NULL;
+        EC_GROUP        *group;
+        unsigned char   digest[20], wrong_digest[20];
+        unsigned char   *signature = NULL; 
+        unsigned int    sig_len;
+        int             nid, ret =  0;
+        
+        /* fill digest values with some random data */
+        if (!RAND_pseudo_bytes(digest, 20) ||
+            !RAND_pseudo_bytes(wrong_digest, 20))
+                {
+                BIO_printf(out, "ERROR: unable to get random data\n");
+                goto builtin_err;
+                }
+
+        /* create and verify a ecdsa signature with every availble curve
+         * (with ) */
+        BIO_printf(out, "\ntesting ECDSA_sign() and ECDSA_verify() "
+                "with some internal curves:\n");
+
+        /* get a list of all internal curves */
+        crv_len = EC_get_builtin_curves(NULL, 0);
+
+        curves = OPENSSL_malloc(sizeof(EC_builtin_curve) * crv_len);
+
+        if (curves == NULL)
+                {
+                BIO_printf(out, "malloc error\n");
+                goto builtin_err;
+                }
+        
+        if (!EC_get_builtin_curves(curves, crv_len))
+                {
+                BIO_printf(out, "unable to get internal curves\n");
+                goto builtin_err;
+                }
+
+        /* now create and verify a signature for every curve */
+        for (n = 0; n < crv_len; n++)
+                {
+                unsigned char dirt, offset;
+
+                nid = curves[n].nid;
+                if (nid == NID_ipsec4)
+                        continue;
+                /* create new ecdsa key (== EC_KEY) */
+                if ((eckey = EC_KEY_new()) == NULL)
+                        goto builtin_err;
+                group = EC_GROUP_new_by_curve_name(nid);
+                if (group == NULL)
+                        goto builtin_err;
+                if (EC_KEY_set_group(eckey, group) == 0)
+                        goto builtin_err;
+                EC_GROUP_free(group);
+                if (EC_GROUP_get_degree(EC_KEY_get0_group(eckey)) < 160)
+                        /* drop the curve */ 
+                        {
+                        EC_KEY_free(eckey);
+                        eckey = NULL;
+                        continue;
+                        }
+                BIO_printf(out, "%s: ", OBJ_nid2sn(nid));
+                /* create key */
+                if (!EC_KEY_generate_key(eckey))
+                        {
+                        BIO_printf(out, " failed\n");
+                        goto builtin_err;
+                        }
+                /* create second key */
+                if ((wrong_eckey = EC_KEY_new()) == NULL)
+                        goto builtin_err;
+                group = EC_GROUP_new_by_curve_name(nid);
+                if (group == NULL)
+                        goto builtin_err;
+                if (EC_KEY_set_group(wrong_eckey, group) == 0)
+                        goto builtin_err;
+                EC_GROUP_free(group);
+                if (!EC_KEY_generate_key(wrong_eckey))
+                        {
+                        BIO_printf(out, " failed\n");
+                        goto builtin_err;
+                        }
+
+                BIO_printf(out, ".");
+                (void)BIO_flush(out);
+                /* check key */
+                if (!EC_KEY_check_key(eckey))
+                        {
+                        BIO_printf(out, " failed\n");
+                        goto builtin_err;
+                        }
+                BIO_printf(out, ".");
+                (void)BIO_flush(out);
+                /* create signature */
+                sig_len = ECDSA_size(eckey);
+                if ((signature = OPENSSL_malloc(sig_len)) == NULL)
+                        goto builtin_err;
+                if (!ECDSA_sign(0, digest, 20, signature, &sig_len, eckey))
+                        {
+                        BIO_printf(out, " failed\n");
+                        goto builtin_err;
+                        }
+                BIO_printf(out, ".");
+                (void)BIO_flush(out);
+                /* verify signature */
+                if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) != 1)
+                        {
+                        BIO_printf(out, " failed\n");
+                        goto builtin_err;
+                        }
+                BIO_printf(out, ".");
+                (void)BIO_flush(out);
+                /* verify signature with the wrong key */
+                if (ECDSA_verify(0, digest, 20, signature, sig_len, 
+                        wrong_eckey) == 1)
+                        {
+                        BIO_printf(out, " failed\n");
+                        goto builtin_err;
+                        }
+                BIO_printf(out, ".");
+                (void)BIO_flush(out);
+                /* wrong digest */
+                if (ECDSA_verify(0, wrong_digest, 20, signature, sig_len,
+                        eckey) == 1)
+                        {
+                        BIO_printf(out, " failed\n");
+                        goto builtin_err;
+                        }
+                BIO_printf(out, ".");
+                (void)BIO_flush(out);
+                /* modify a single byte of the signature */
+                offset = signature[10] % sig_len;
+                dirt   = signature[11];
+                signature[offset] ^= dirt ? dirt : 1; 
+                if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) == 1)
+                        {
+                        BIO_printf(out, " failed\n");
+                        goto builtin_err;
+                        }
+                BIO_printf(out, ".");
+                (void)BIO_flush(out);
+                
+                BIO_printf(out, " ok\n");
+                /* cleanup */
+                OPENSSL_free(signature);
+                signature = NULL;
+                EC_KEY_free(eckey);
+                eckey = NULL;
+                EC_KEY_free(wrong_eckey);
+                wrong_eckey = NULL;
+                }
+
+        ret = 1;        
+builtin_err:
+        if (eckey)
+                EC_KEY_free(eckey);
+        if (wrong_eckey)
+                EC_KEY_free(wrong_eckey);
+        if (signature)
+                OPENSSL_free(signature);
+        if (curves)
+                OPENSSL_free(curves);
+
+        return ret;
+        }
+
+int main(void)
+        {
+        int     ret = 1;
+        BIO     *out;
+
+        out = BIO_new_fp(stdout, BIO_NOCLOSE);
+        
+        /* enable memory leak checking unless explicitly disabled */
+        if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && 
+                (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
+                {
+                CRYPTO_malloc_debug_init();
+                CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
+                }
+        else
+                {
+                /* OPENSSL_DEBUG_MEMORY=off */
+                CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
+                }
+        CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+
+        ERR_load_crypto_strings();
+
+        /* initialize the prng */
+        RAND_seed(rnd_seed, sizeof(rnd_seed));
+
+        /* the tests */
+        if (!x9_62_tests(out))  goto err;
+        if (!test_builtin(out)) goto err;
+        
+        ret = 0;
+err:    
+        if (ret)        
+                BIO_printf(out, "\nECDSA test failed\n");
+        else 
+                BIO_printf(out, "\nECDSA test passed\n");
+        if (ret)
+                ERR_print_errors(out);
+        CRYPTO_cleanup_all_ex_data();
+        ERR_remove_state(0);
+        ERR_free_strings();
+        CRYPTO_mem_leaks(out);
+        if (out != NULL)
+                BIO_free(out);
+        return ret;
+        }       
+#endif
diff --git a/src/lib/libssl/src/crypto/ecdsa/ecs_asn1.c b/src/lib/libssl/src/crypto/ecdsa/ecs_asn1.c
new file mode 100644
index 0000000000..b295489400
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdsa/ecs_asn1.c
@@ -0,0 +1,67 @@
+/* crypto/ecdsa/ecs_asn1.c */
+/* ====================================================================
+ * Copyright (c) 2000-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "ecs_locl.h"
+#include <openssl/err.h>
+#include <openssl/asn1t.h>
+
+ASN1_SEQUENCE(ECDSA_SIG) = {
+        ASN1_SIMPLE(ECDSA_SIG, r, CBIGNUM),
+        ASN1_SIMPLE(ECDSA_SIG, s, CBIGNUM)
+} ASN1_SEQUENCE_END(ECDSA_SIG)
+
+DECLARE_ASN1_FUNCTIONS_const(ECDSA_SIG)
+DECLARE_ASN1_ENCODE_FUNCTIONS_const(ECDSA_SIG, ECDSA_SIG)
+IMPLEMENT_ASN1_FUNCTIONS_const(ECDSA_SIG)
diff --git a/src/lib/libssl/src/crypto/ecdsa/ecs_err.c b/src/lib/libssl/src/crypto/ecdsa/ecs_err.c
new file mode 100644
index 0000000000..d2a53730ea
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdsa/ecs_err.c
@@ -0,0 +1,104 @@
+/* crypto/ecdsa/ecs_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include <openssl/ecdsa.h>
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(ERR_LIB_ECDSA,func,0)
+#define ERR_REASON(reason) ERR_PACK(ERR_LIB_ECDSA,0,reason)
+
+static ERR_STRING_DATA ECDSA_str_functs[]=
+        {
+{ERR_FUNC(ECDSA_F_ECDSA_DATA_NEW_METHOD),       "ECDSA_DATA_NEW_METHOD"},
+{ERR_FUNC(ECDSA_F_ECDSA_DO_SIGN),       "ECDSA_do_sign"},
+{ERR_FUNC(ECDSA_F_ECDSA_DO_VERIFY),     "ECDSA_do_verify"},
+{ERR_FUNC(ECDSA_F_ECDSA_SIGN_SETUP),    "ECDSA_sign_setup"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA ECDSA_str_reasons[]=
+        {
+{ERR_REASON(ECDSA_R_BAD_SIGNATURE)       ,"bad signature"},
+{ERR_REASON(ECDSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE),"data too large for key size"},
+{ERR_REASON(ECDSA_R_ERR_EC_LIB)          ,"err ec lib"},
+{ERR_REASON(ECDSA_R_MISSING_PARAMETERS)  ,"missing parameters"},
+{ERR_REASON(ECDSA_R_NEED_NEW_SETUP_VALUES),"need new setup values"},
+{ERR_REASON(ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED),"random number generation failed"},
+{ERR_REASON(ECDSA_R_SIGNATURE_MALLOC_FAILED),"signature malloc failed"},
+{0,NULL}
+        };
+
+#endif
+
+void ERR_load_ECDSA_strings(void)
+        {
+#ifndef OPENSSL_NO_ERR
+
+        if (ERR_func_error_string(ECDSA_str_functs[0].error) == NULL)
+                {
+                ERR_load_strings(0,ECDSA_str_functs);
+                ERR_load_strings(0,ECDSA_str_reasons);
+                }
+#endif
+        }
diff --git a/src/lib/libssl/src/crypto/ecdsa/ecs_lib.c b/src/lib/libssl/src/crypto/ecdsa/ecs_lib.c
new file mode 100644
index 0000000000..85e8a3a7ed
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdsa/ecs_lib.c
@@ -0,0 +1,261 @@
+/* crypto/ecdsa/ecs_lib.c */
+/* ====================================================================
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <string.h>
+#include "ecs_locl.h"
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
+#include <openssl/err.h>
+#include <openssl/bn.h>
+
+const char ECDSA_version[]="ECDSA" OPENSSL_VERSION_PTEXT;
+
+static const ECDSA_METHOD *default_ECDSA_method = NULL;
+
+static void *ecdsa_data_new(void);
+static void *ecdsa_data_dup(void *);
+static void  ecdsa_data_free(void *);
+
+void ECDSA_set_default_method(const ECDSA_METHOD *meth)
+{
+        default_ECDSA_method = meth;
+}
+
+const ECDSA_METHOD *ECDSA_get_default_method(void)
+{
+        if(!default_ECDSA_method) 
+                default_ECDSA_method = ECDSA_OpenSSL();
+        return default_ECDSA_method;
+}
+
+int ECDSA_set_method(EC_KEY *eckey, const ECDSA_METHOD *meth)
+{
+        const ECDSA_METHOD *mtmp;
+        ECDSA_DATA *ecdsa;
+
+        ecdsa = ecdsa_check(eckey);
+
+        if (ecdsa == NULL)
+                return 0;
+
+        mtmp = ecdsa->meth;
+#ifndef OPENSSL_NO_ENGINE
+        if (ecdsa->engine)
+        {
+                ENGINE_finish(ecdsa->engine);
+                ecdsa->engine = NULL;
+        }
+#endif
+        ecdsa->meth = meth;
+
+        return 1;
+}
+
+static ECDSA_DATA *ECDSA_DATA_new_method(ENGINE *engine)
+{
+        ECDSA_DATA *ret;
+
+        ret=(ECDSA_DATA *)OPENSSL_malloc(sizeof(ECDSA_DATA));
+        if (ret == NULL)
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DATA_NEW_METHOD, ERR_R_MALLOC_FAILURE);
+                return(NULL);
+        }
+
+        ret->init = NULL;
+
+        ret->meth = ECDSA_get_default_method();
+        ret->engine = engine;
+#ifndef OPENSSL_NO_ENGINE
+        if (!ret->engine)
+                ret->engine = ENGINE_get_default_ECDSA();
+        if (ret->engine)
+        {
+                ret->meth = ENGINE_get_ECDSA(ret->engine);
+                if (!ret->meth)
+                {
+                        ECDSAerr(ECDSA_F_ECDSA_DATA_NEW_METHOD, ERR_R_ENGINE_LIB);
+                        ENGINE_finish(ret->engine);
+                        OPENSSL_free(ret);
+                        return NULL;
+                }
+        }
+#endif
+
+        ret->flags = ret->meth->flags;
+        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_ECDSA, ret, &ret->ex_data);
+#if 0
+        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
+        {
+                CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDSA, ret, &ret->ex_data);
+                OPENSSL_free(ret);
+                ret=NULL;
+        }
+#endif  
+        return(ret);
+}
+
+static void *ecdsa_data_new(void)
+{
+        return (void *)ECDSA_DATA_new_method(NULL);
+}
+
+static void *ecdsa_data_dup(void *data)
+{
+        ECDSA_DATA *r = (ECDSA_DATA *)data;
+
+        /* XXX: dummy operation */
+        if (r == NULL)
+                return NULL;
+
+        return ecdsa_data_new();
+}
+
+static void ecdsa_data_free(void *data)
+{
+        ECDSA_DATA *r = (ECDSA_DATA *)data;
+
+#ifndef OPENSSL_NO_ENGINE
+        if (r->engine)
+                ENGINE_finish(r->engine);
+#endif
+        CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDSA, r, &r->ex_data);
+
+        OPENSSL_cleanse((void *)r, sizeof(ECDSA_DATA));
+
+        OPENSSL_free(r);
+}
+
+ECDSA_DATA *ecdsa_check(EC_KEY *key)
+{
+        ECDSA_DATA *ecdsa_data;
+ 
+        void *data = EC_KEY_get_key_method_data(key, ecdsa_data_dup,
+                                        ecdsa_data_free, ecdsa_data_free);
+        if (data == NULL)
+        {
+                ecdsa_data = (ECDSA_DATA *)ecdsa_data_new();
+                if (ecdsa_data == NULL)
+                        return NULL;
+                EC_KEY_insert_key_method_data(key, (void *)ecdsa_data,
+                        ecdsa_data_dup, ecdsa_data_free, ecdsa_data_free);
+        }
+        else
+                ecdsa_data = (ECDSA_DATA *)data;
+        
+
+        return ecdsa_data;
+}
+
+int ECDSA_size(const EC_KEY *r)
+{
+        int ret,i;
+        ASN1_INTEGER bs;
+        BIGNUM  *order=NULL;
+        unsigned char buf[4];
+        const EC_GROUP *group;
+
+        if (r == NULL)
+                return 0;
+        group = EC_KEY_get0_group(r);
+        if (group == NULL)
+                return 0;
+
+        if ((order = BN_new()) == NULL) return 0;
+        if (!EC_GROUP_get_order(group,order,NULL))
+        {
+                BN_clear_free(order);
+                return 0;
+        } 
+        i=BN_num_bits(order);
+        bs.length=(i+7)/8;
+        bs.data=buf;
+        bs.type=V_ASN1_INTEGER;
+        /* If the top bit is set the asn1 encoding is 1 larger. */
+        buf[0]=0xff;    
+
+        i=i2d_ASN1_INTEGER(&bs,NULL);
+        i+=i; /* r and s */
+        ret=ASN1_object_size(1,i,V_ASN1_SEQUENCE);
+        BN_clear_free(order);
+        return(ret);
+}
+
+
+int ECDSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+{
+        return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_ECDSA, argl, argp,
+                                new_func, dup_func, free_func);
+}
+
+int ECDSA_set_ex_data(EC_KEY *d, int idx, void *arg)
+{
+        ECDSA_DATA *ecdsa;
+        ecdsa = ecdsa_check(d);
+        if (ecdsa == NULL)
+                return 0;
+        return(CRYPTO_set_ex_data(&ecdsa->ex_data,idx,arg));
+}
+
+void *ECDSA_get_ex_data(EC_KEY *d, int idx)
+{
+        ECDSA_DATA *ecdsa;
+        ecdsa = ecdsa_check(d);
+        if (ecdsa == NULL)
+                return NULL;
+        return(CRYPTO_get_ex_data(&ecdsa->ex_data,idx));
+}
diff --git a/src/lib/libssl/src/crypto/ecdsa/ecs_locl.h b/src/lib/libssl/src/crypto/ecdsa/ecs_locl.h
new file mode 100644
index 0000000000..3a69a840e2
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdsa/ecs_locl.h
@@ -0,0 +1,107 @@
+/* crypto/ecdsa/ecs_locl.h */
+/*
+ * Written by Nils Larsch for the OpenSSL project
+ */
+/* ====================================================================
+ * Copyright (c) 2000-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_ECS_LOCL_H
+#define HEADER_ECS_LOCL_H
+
+#include <openssl/ecdsa.h>
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+struct ecdsa_method 
+        {
+        const char *name;
+        ECDSA_SIG *(*ecdsa_do_sign)(const unsigned char *dgst, int dgst_len, 
+                        const BIGNUM *inv, const BIGNUM *rp, EC_KEY *eckey);
+        int (*ecdsa_sign_setup)(EC_KEY *eckey, BN_CTX *ctx, BIGNUM **kinv, 
+                        BIGNUM **r);
+        int (*ecdsa_do_verify)(const unsigned char *dgst, int dgst_len, 
+                        const ECDSA_SIG *sig, EC_KEY *eckey);
+#if 0
+        int (*init)(EC_KEY *eckey);
+        int (*finish)(EC_KEY *eckey);
+#endif
+        int flags;
+        char *app_data;
+        };
+
+typedef struct ecdsa_data_st {
+        /* EC_KEY_METH_DATA part */
+        int (*init)(EC_KEY *);
+        /* method (ECDSA) specific part */
+        ENGINE  *engine;
+        int     flags;
+        const ECDSA_METHOD *meth;
+        CRYPTO_EX_DATA ex_data;
+} ECDSA_DATA;
+
+/** ecdsa_check
+ * checks whether ECKEY->meth_data is a pointer to a ECDSA_DATA structure
+ * and if not it removes the old meth_data and creates a ECDSA_DATA structure.
+ * \param  eckey pointer to a EC_KEY object
+ * \return pointer to a ECDSA_DATA structure
+ */
+ECDSA_DATA *ecdsa_check(EC_KEY *eckey);
+
+#ifdef  __cplusplus
+}
+#endif
+
+#endif /* HEADER_ECS_LOCL_H */
diff --git a/src/lib/libssl/src/crypto/ecdsa/ecs_ossl.c b/src/lib/libssl/src/crypto/ecdsa/ecs_ossl.c
new file mode 100644
index 0000000000..3ead1af94e
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdsa/ecs_ossl.c
@@ -0,0 +1,478 @@
+/* crypto/ecdsa/ecs_ossl.c */
+/*
+ * Written by Nils Larsch for the OpenSSL project
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "ecs_locl.h"
+#include <openssl/err.h>
+#include <openssl/obj_mac.h>
+#include <openssl/bn.h>
+
+static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dlen, 
+                const BIGNUM *, const BIGNUM *, EC_KEY *eckey);
+static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, 
+                BIGNUM **rp);
+static int ecdsa_do_verify(const unsigned char *dgst, int dgst_len, 
+                const ECDSA_SIG *sig, EC_KEY *eckey);
+
+static ECDSA_METHOD openssl_ecdsa_meth = {
+        "OpenSSL ECDSA method",
+        ecdsa_do_sign,
+        ecdsa_sign_setup,
+        ecdsa_do_verify,
+#if 0
+        NULL, /* init     */
+        NULL, /* finish   */
+#endif
+        0,    /* flags    */
+        NULL  /* app_data */
+};
+
+const ECDSA_METHOD *ECDSA_OpenSSL(void)
+{
+        return &openssl_ecdsa_meth;
+}
+
+static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp,
+                BIGNUM **rp)
+{
+        BN_CTX   *ctx = NULL;
+        BIGNUM   *k = NULL, *r = NULL, *order = NULL, *X = NULL;
+        EC_POINT *tmp_point=NULL;
+        const EC_GROUP *group;
+        int      ret = 0;
+
+        if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL)
+        {
+                ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+        }
+
+        if (ctx_in == NULL) 
+        {
+                if ((ctx = BN_CTX_new()) == NULL)
+                {
+                        ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+        }
+        else
+                ctx = ctx_in;
+
+        k     = BN_new();       /* this value is later returned in *kinvp */
+        r     = BN_new();       /* this value is later returned in *rp    */
+        order = BN_new();
+        X     = BN_new();
+        if (!k || !r || !order || !X)
+        {
+                ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE);
+                goto err;
+        }
+        if ((tmp_point = EC_POINT_new(group)) == NULL)
+        {
+                ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
+                goto err;
+        }
+        if (!EC_GROUP_get_order(group, order, ctx))
+        {
+                ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
+                goto err;
+        }
+        
+        do
+        {
+                /* get random k */      
+                do
+                        if (!BN_rand_range(k, order))
+                        {
+                                ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP,
+                                 ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED);      
+                                goto err;
+                        }
+                while (BN_is_zero(k));
+
+                /* compute r the x-coordinate of generator * k */
+                if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx))
+                {
+                        ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
+                        goto err;
+                }
+                if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == NID_X9_62_prime_field)
+                {
+                        if (!EC_POINT_get_affine_coordinates_GFp(group,
+                                tmp_point, X, NULL, ctx))
+                        {
+                                ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP,ERR_R_EC_LIB);
+                                goto err;
+                        }
+                }
+                else /* NID_X9_62_characteristic_two_field */
+                {
+                        if (!EC_POINT_get_affine_coordinates_GF2m(group,
+                                tmp_point, X, NULL, ctx))
+                        {
+                                ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP,ERR_R_EC_LIB);
+                                goto err;
+                        }
+                }
+                if (!BN_nnmod(r, X, order, ctx))
+                {
+                        ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
+                        goto err;
+                }
+        }
+        while (BN_is_zero(r));
+
+        /* compute the inverse of k */
+        if (!BN_mod_inverse(k, k, order, ctx))
+        {
+                ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
+                goto err;       
+        }
+        /* clear old values if necessary */
+        if (*rp != NULL)
+                BN_clear_free(*rp);
+        if (*kinvp != NULL) 
+                BN_clear_free(*kinvp);
+        /* save the pre-computed values  */
+        *rp    = r;
+        *kinvp = k;
+        ret = 1;
+err:
+        if (!ret)
+        {
+                if (k != NULL) BN_clear_free(k);
+                if (r != NULL) BN_clear_free(r);
+        }
+        if (ctx_in == NULL) 
+                BN_CTX_free(ctx);
+        if (order != NULL)
+                BN_free(order);
+        if (tmp_point != NULL) 
+                EC_POINT_free(tmp_point);
+        if (X)
+                BN_clear_free(X);
+        return(ret);
+}
+
+
+static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dgst_len, 
+                const BIGNUM *in_kinv, const BIGNUM *in_r, EC_KEY *eckey)
+{
+        int     ok = 0;
+        BIGNUM *kinv=NULL, *s, *m=NULL,*tmp=NULL,*order=NULL;
+        const BIGNUM *ckinv;
+        BN_CTX     *ctx = NULL;
+        const EC_GROUP   *group;
+        ECDSA_SIG  *ret;
+        ECDSA_DATA *ecdsa;
+        const BIGNUM *priv_key;
+
+        ecdsa    = ecdsa_check(eckey);
+        group    = EC_KEY_get0_group(eckey);
+        priv_key = EC_KEY_get0_private_key(eckey);
+        
+        if (group == NULL || priv_key == NULL || ecdsa == NULL)
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_PASSED_NULL_PARAMETER);
+                return NULL;
+        }
+
+        ret = ECDSA_SIG_new();
+        if (!ret)
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+        s = ret->s;
+
+        if ((ctx = BN_CTX_new()) == NULL || (order = BN_new()) == NULL ||
+                (tmp = BN_new()) == NULL || (m = BN_new()) == NULL)
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_MALLOC_FAILURE);
+                goto err;
+        }
+
+        if (!EC_GROUP_get_order(group, order, ctx))
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_EC_LIB);
+                goto err;
+        }
+        if (8 * dgst_len > BN_num_bits(order))
+        {
+                /* XXX
+                 * 
+                 * Should provide for optional hash truncation:
+                 * Keep the BN_num_bits(order) leftmost bits of dgst
+                 * (see March 2006 FIPS 186-3 draft, which has a few
+                 * confusing errors in this part though)
+                 */
+
+                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN,
+                        ECDSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
+                goto err;
+        }
+
+        if (!BN_bin2bn(dgst, dgst_len, m))
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
+                goto err;
+        }
+        do
+        {
+                if (in_kinv == NULL || in_r == NULL)
+                {
+                        if (!ECDSA_sign_setup(eckey, ctx, &kinv, &ret->r))
+                        {
+                                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN,ERR_R_ECDSA_LIB);
+                                goto err;
+                        }
+                        ckinv = kinv;
+                }
+                else
+                {
+                        ckinv  = in_kinv;
+                        if (BN_copy(ret->r, in_r) == NULL)
+                        {
+                                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_MALLOC_FAILURE);
+                                goto err;
+                        }
+                }
+
+                if (!BN_mod_mul(tmp, priv_key, ret->r, order, ctx))
+                {
+                        ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
+                        goto err;
+                }
+                if (!BN_mod_add_quick(s, tmp, m, order))
+                {
+                        ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
+                        goto err;
+                }
+                if (!BN_mod_mul(s, s, ckinv, order, ctx))
+                {
+                        ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
+                        goto err;
+                }
+                if (BN_is_zero(s))
+                {
+                        /* if kinv and r have been supplied by the caller
+                         * don't to generate new kinv and r values */
+                        if (in_kinv != NULL && in_r != NULL)
+                        {
+                                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ECDSA_R_NEED_NEW_SETUP_VALUES);
+                                goto err;
+                        }
+                }
+                else
+                        /* s != 0 => we have a valid signature */
+                        break;
+        }
+        while (1);
+
+        ok = 1;
+err:
+        if (!ok)
+        {
+                ECDSA_SIG_free(ret);
+                ret = NULL;
+        }
+        if (ctx)
+                BN_CTX_free(ctx);
+        if (m)
+                BN_clear_free(m);
+        if (tmp)
+                BN_clear_free(tmp);
+        if (order)
+                BN_free(order);
+        if (kinv)
+                BN_clear_free(kinv);
+        return ret;
+}
+
+static int ecdsa_do_verify(const unsigned char *dgst, int dgst_len,
+                const ECDSA_SIG *sig, EC_KEY *eckey)
+{
+        int ret = -1;
+        BN_CTX   *ctx;
+        BIGNUM   *order, *u1, *u2, *m, *X;
+        EC_POINT *point = NULL;
+        const EC_GROUP *group;
+        const EC_POINT *pub_key;
+
+        /* check input values */
+        if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL ||
+            (pub_key = EC_KEY_get0_public_key(eckey)) == NULL || sig == NULL)
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ECDSA_R_MISSING_PARAMETERS);
+                return -1;
+        }
+
+        ctx = BN_CTX_new();
+        if (!ctx)
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_MALLOC_FAILURE);
+                return -1;
+        }
+        BN_CTX_start(ctx);
+        order = BN_CTX_get(ctx);        
+        u1    = BN_CTX_get(ctx);
+        u2    = BN_CTX_get(ctx);
+        m     = BN_CTX_get(ctx);
+        X     = BN_CTX_get(ctx);
+        if (!X)
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
+                goto err;
+        }
+        
+        if (!EC_GROUP_get_order(group, order, ctx))
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_EC_LIB);
+                goto err;
+        }
+        if (8 * dgst_len > BN_num_bits(order))
+        {
+                /* XXX
+                 * 
+                 * Should provide for optional hash truncation:
+                 * Keep the BN_num_bits(order) leftmost bits of dgst
+                 * (see March 2006 FIPS 186-3 draft, which has a few
+                 * confusing errors in this part though)
+                 */
+
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY,
+                        ECDSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
+                ret = 0;
+                goto err;
+        }
+
+        if (BN_is_zero(sig->r)          || BN_is_negative(sig->r) || 
+            BN_ucmp(sig->r, order) >= 0 || BN_is_zero(sig->s)  ||
+            BN_is_negative(sig->s)      || BN_ucmp(sig->s, order) >= 0)
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ECDSA_R_BAD_SIGNATURE);
+                ret = 0;        /* signature is invalid */
+                goto err;
+        }
+        /* calculate tmp1 = inv(S) mod order */
+        if (!BN_mod_inverse(u2, sig->s, order, ctx))
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
+                goto err;
+        }
+        /* digest -> m */
+        if (!BN_bin2bn(dgst, dgst_len, m))
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
+                goto err;
+        }
+        /* u1 = m * tmp mod order */
+        if (!BN_mod_mul(u1, m, u2, order, ctx))
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
+                goto err;
+        }
+        /* u2 = r * w mod q */
+        if (!BN_mod_mul(u2, sig->r, u2, order, ctx))
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
+                goto err;
+        }
+
+        if ((point = EC_POINT_new(group)) == NULL)
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_MALLOC_FAILURE);
+                goto err;
+        }
+        if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx))
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_EC_LIB);
+                goto err;
+        }
+        if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == NID_X9_62_prime_field)
+        {
+                if (!EC_POINT_get_affine_coordinates_GFp(group,
+                        point, X, NULL, ctx))
+                {
+                        ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_EC_LIB);
+                        goto err;
+                }
+        }
+        else /* NID_X9_62_characteristic_two_field */
+        {
+                if (!EC_POINT_get_affine_coordinates_GF2m(group,
+                        point, X, NULL, ctx))
+                {
+                        ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_EC_LIB);
+                        goto err;
+                }
+        }
+        
+        if (!BN_nnmod(u1, X, order, ctx))
+        {
+                ECDSAerr(ECDSA_F_ECDSA_DO_VERIFY, ERR_R_BN_LIB);
+                goto err;
+        }
+        /*  if the signature is correct u1 is equal to sig->r */
+        ret = (BN_ucmp(u1, sig->r) == 0);
+err:
+        BN_CTX_end(ctx);
+        BN_CTX_free(ctx);
+        if (point)
+                EC_POINT_free(point);
+        return ret;
+}
diff --git a/src/lib/libssl/src/crypto/ecdsa/ecs_sign.c b/src/lib/libssl/src/crypto/ecdsa/ecs_sign.c
new file mode 100644
index 0000000000..74b1fe8caf
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdsa/ecs_sign.c
@@ -0,0 +1,104 @@
+/* crypto/ecdsa/ecdsa_sign.c */
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "ecs_locl.h"
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
+
+ECDSA_SIG *ECDSA_do_sign(const unsigned char *dgst, int dlen, EC_KEY *eckey)
+{
+        return ECDSA_do_sign_ex(dgst, dlen, NULL, NULL, eckey);
+}
+
+ECDSA_SIG *ECDSA_do_sign_ex(const unsigned char *dgst, int dlen,
+        const BIGNUM *kinv, const BIGNUM *rp, EC_KEY *eckey)
+{
+        ECDSA_DATA *ecdsa = ecdsa_check(eckey);
+        if (ecdsa == NULL)
+                return NULL;
+        return ecdsa->meth->ecdsa_do_sign(dgst, dlen, kinv, rp, eckey);
+}
+
+int ECDSA_sign(int type, const unsigned char *dgst, int dlen, unsigned char 
+                *sig, unsigned int *siglen, EC_KEY *eckey)
+{
+        return ECDSA_sign_ex(type, dgst, dlen, sig, siglen, NULL, NULL, eckey);
+}
+
+int ECDSA_sign_ex(int type, const unsigned char *dgst, int dlen, unsigned char 
+        *sig, unsigned int *siglen, const BIGNUM *kinv, const BIGNUM *r, 
+        EC_KEY *eckey)
+{
+        ECDSA_SIG *s;
+        s = ECDSA_do_sign_ex(dgst, dlen, kinv, r, eckey);
+        if (s == NULL)
+        {
+                *siglen=0;
+                return 0;
+        }
+        *siglen = i2d_ECDSA_SIG(s, &sig);
+        ECDSA_SIG_free(s);
+        return 1;
+}
+
+int ECDSA_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, 
+                BIGNUM **rp)
+{
+        ECDSA_DATA *ecdsa = ecdsa_check(eckey);
+        if (ecdsa == NULL)
+                return 0;
+        return ecdsa->meth->ecdsa_sign_setup(eckey, ctx_in, kinvp, rp); 
+}
diff --git a/src/lib/libssl/src/crypto/ecdsa/ecs_vrf.c b/src/lib/libssl/src/crypto/ecdsa/ecs_vrf.c
new file mode 100644
index 0000000000..ef9acf7b61
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ecdsa/ecs_vrf.c
@@ -0,0 +1,96 @@
+/* crypto/ecdsa/ecdsa_vrf.c */
+/*
+ * Written by Nils Larsch for the OpenSSL project
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "ecs_locl.h"
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
+
+/* returns
+ *      1: correct signature
+ *      0: incorrect signature
+ *     -1: error
+ */
+int ECDSA_do_verify(const unsigned char *dgst, int dgst_len, 
+                const ECDSA_SIG *sig, EC_KEY *eckey)
+        {
+        ECDSA_DATA *ecdsa = ecdsa_check(eckey);
+        if (ecdsa == NULL)
+                return 0;
+        return ecdsa->meth->ecdsa_do_verify(dgst, dgst_len, sig, eckey);
+        }
+
+/* returns
+ *      1: correct signature
+ *      0: incorrect signature
+ *     -1: error
+ */
+int ECDSA_verify(int type, const unsigned char *dgst, int dgst_len,
+                const unsigned char *sigbuf, int sig_len, EC_KEY *eckey)
+        {
+        ECDSA_SIG *s;
+        int ret=-1;
+
+        s = ECDSA_SIG_new();
+        if (s == NULL) return(ret);
+        if (d2i_ECDSA_SIG(&s, &sigbuf, sig_len) == NULL) goto err;
+        ret=ECDSA_do_verify(dgst, dgst_len, s, eckey);
+err:
+        ECDSA_SIG_free(s);
+        return(ret);
+        }
diff --git a/src/lib/libssl/src/crypto/engine/tb_ecdh.c b/src/lib/libssl/src/crypto/engine/tb_ecdh.c
new file mode 100644
index 0000000000..c8ec7812c5
--- /dev/null
+++ b/src/lib/libssl/src/crypto/engine/tb_ecdh.c
@@ -0,0 +1,133 @@
+/* crypto/engine/tb_ecdh.c */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
+ * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
+ * to the OpenSSL project.
+ *
+ * The ECC Code is licensed pursuant to the OpenSSL open source
+ * license provided below.
+ *
+ * The ECDH engine software is originally written by Nils Gura and
+ * Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
+/* ====================================================================
+ * Copyright (c) 2000-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+
+/* If this symbol is defined then ENGINE_get_default_ECDH(), the function that is
+ * used by ECDH to hook in implementation code and cache defaults (etc), will
+ * display brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_ECDH_DEBUG */
+
+static ENGINE_TABLE *ecdh_table = NULL;
+static const int dummy_nid = 1;
+
+void ENGINE_unregister_ECDH(ENGINE *e)
+        {
+        engine_table_unregister(&ecdh_table, e);
+        }
+
+static void engine_unregister_all_ECDH(void)
+        {
+        engine_table_cleanup(&ecdh_table);
+        }
+
+int ENGINE_register_ECDH(ENGINE *e)
+        {
+        if(e->ecdh_meth)
+                return engine_table_register(&ecdh_table,
+                                engine_unregister_all_ECDH, e, &dummy_nid, 1, 0);
+        return 1;
+        }
+
+void ENGINE_register_all_ECDH()
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_ECDH(e);
+        }
+
+int ENGINE_set_default_ECDH(ENGINE *e)
+        {
+        if(e->ecdh_meth)
+                return engine_table_register(&ecdh_table,
+                                engine_unregister_all_ECDH, e, &dummy_nid, 1, 1);
+        return 1;
+        }
+
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references). */
+ENGINE *ENGINE_get_default_ECDH(void)
+        {
+        return engine_table_select(&ecdh_table, dummy_nid);
+        }
+
+/* Obtains an ECDH implementation from an ENGINE functional reference */
+const ECDH_METHOD *ENGINE_get_ECDH(const ENGINE *e)
+        {
+        return e->ecdh_meth;
+        }
+
+/* Sets an ECDH implementation in an ENGINE structure */
+int ENGINE_set_ECDH(ENGINE *e, const ECDH_METHOD *ecdh_meth)
+        {
+        e->ecdh_meth = ecdh_meth;
+        return 1;
+        }
diff --git a/src/lib/libssl/src/crypto/engine/tb_ecdsa.c b/src/lib/libssl/src/crypto/engine/tb_ecdsa.c
new file mode 100644
index 0000000000..005ecb622c
--- /dev/null
+++ b/src/lib/libssl/src/crypto/engine/tb_ecdsa.c
@@ -0,0 +1,118 @@
+/* ====================================================================
+ * Copyright (c) 2000-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+
+/* If this symbol is defined then ENGINE_get_default_ECDSA(), the function that is
+ * used by ECDSA to hook in implementation code and cache defaults (etc), will
+ * display brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_ECDSA_DEBUG */
+
+static ENGINE_TABLE *ecdsa_table = NULL;
+static const int dummy_nid = 1;
+
+void ENGINE_unregister_ECDSA(ENGINE *e)
+        {
+        engine_table_unregister(&ecdsa_table, e);
+        }
+
+static void engine_unregister_all_ECDSA(void)
+        {
+        engine_table_cleanup(&ecdsa_table);
+        }
+
+int ENGINE_register_ECDSA(ENGINE *e)
+        {
+        if(e->ecdsa_meth)
+                return engine_table_register(&ecdsa_table,
+                                engine_unregister_all_ECDSA, e, &dummy_nid, 1, 0);
+        return 1;
+        }
+
+void ENGINE_register_all_ECDSA()
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_ECDSA(e);
+        }
+
+int ENGINE_set_default_ECDSA(ENGINE *e)
+        {
+        if(e->ecdsa_meth)
+                return engine_table_register(&ecdsa_table,
+                                engine_unregister_all_ECDSA, e, &dummy_nid, 1, 1);
+        return 1;
+        }
+
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references). */
+ENGINE *ENGINE_get_default_ECDSA(void)
+        {
+        return engine_table_select(&ecdsa_table, dummy_nid);
+        }
+
+/* Obtains an ECDSA implementation from an ENGINE functional reference */
+const ECDSA_METHOD *ENGINE_get_ECDSA(const ENGINE *e)
+        {
+        return e->ecdsa_meth;
+        }
+
+/* Sets an ECDSA implementation in an ENGINE structure */
+int ENGINE_set_ECDSA(ENGINE *e, const ECDSA_METHOD *ecdsa_meth)
+        {
+        e->ecdsa_meth = ecdsa_meth;
+        return 1;
+        }
diff --git a/src/lib/libssl/src/crypto/engine/tb_store.c b/src/lib/libssl/src/crypto/engine/tb_store.c
new file mode 100644
index 0000000000..8cc435c935
--- /dev/null
+++ b/src/lib/libssl/src/crypto/engine/tb_store.c
@@ -0,0 +1,123 @@
+/* ====================================================================
+ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "eng_int.h"
+
+/* If this symbol is defined then ENGINE_get_default_STORE(), the function that is
+ * used by STORE to hook in implementation code and cache defaults (etc), will
+ * display brief debugging summaries to stderr with the 'nid'. */
+/* #define ENGINE_STORE_DEBUG */
+
+static ENGINE_TABLE *store_table = NULL;
+static const int dummy_nid = 1;
+
+void ENGINE_unregister_STORE(ENGINE *e)
+        {
+        engine_table_unregister(&store_table, e);
+        }
+
+static void engine_unregister_all_STORE(void)
+        {
+        engine_table_cleanup(&store_table);
+        }
+
+int ENGINE_register_STORE(ENGINE *e)
+        {
+        if(e->store_meth)
+                return engine_table_register(&store_table,
+                                engine_unregister_all_STORE, e, &dummy_nid, 1, 0);
+        return 1;
+        }
+
+void ENGINE_register_all_STORE()
+        {
+        ENGINE *e;
+
+        for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
+                ENGINE_register_STORE(e);
+        }
+
+/* The following two functions are removed because they're useless. */
+#if 0
+int ENGINE_set_default_STORE(ENGINE *e)
+        {
+        if(e->store_meth)
+                return engine_table_register(&store_table,
+                                engine_unregister_all_STORE, e, &dummy_nid, 1, 1);
+        return 1;
+        }
+#endif
+
+#if 0
+/* Exposed API function to get a functional reference from the implementation
+ * table (ie. try to get a functional reference from the tabled structural
+ * references). */
+ENGINE *ENGINE_get_default_STORE(void)
+        {
+        return engine_table_select(&store_table, dummy_nid);
+        }
+#endif
+
+/* Obtains an STORE implementation from an ENGINE functional reference */
+const STORE_METHOD *ENGINE_get_STORE(const ENGINE *e)
+        {
+        return e->store_meth;
+        }
+
+/* Sets an STORE implementation in an ENGINE structure */
+int ENGINE_set_STORE(ENGINE *e, const STORE_METHOD *store_meth)
+        {
+        e->store_meth = store_meth;
+        return 1;
+        }
diff --git a/src/lib/libssl/src/crypto/evp/e_camellia.c b/src/lib/libssl/src/crypto/evp/e_camellia.c
new file mode 100644
index 0000000000..a7b40d1c60
--- /dev/null
+++ b/src/lib/libssl/src/crypto/evp/e_camellia.c
@@ -0,0 +1,131 @@
+/* crypto/evp/e_camellia.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <openssl/opensslconf.h>
+#ifndef OPENSSL_NO_CAMELLIA
+#include <openssl/evp.h>
+#include <openssl/err.h>
+#include <string.h>
+#include <assert.h>
+#include <openssl/camellia.h>
+#include "evp_locl.h"
+
+static int camellia_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+        const unsigned char *iv, int enc);
+
+/* Camellia subkey Structure */
+typedef struct
+        {
+        CAMELLIA_KEY ks;
+        } EVP_CAMELLIA_KEY;
+
+/* Attribute operation for Camellia */
+#define data(ctx)       EVP_C_DATA(EVP_CAMELLIA_KEY,ctx)
+
+IMPLEMENT_BLOCK_CIPHER(camellia_128, ks, Camellia, EVP_CAMELLIA_KEY,
+        NID_camellia_128, 16, 16, 16, 128,
+        0, camellia_init_key, NULL, 
+        EVP_CIPHER_set_asn1_iv,
+        EVP_CIPHER_get_asn1_iv,
+        NULL)
+IMPLEMENT_BLOCK_CIPHER(camellia_192, ks, Camellia, EVP_CAMELLIA_KEY,
+        NID_camellia_192, 16, 24, 16, 128,
+        0, camellia_init_key, NULL, 
+        EVP_CIPHER_set_asn1_iv,
+        EVP_CIPHER_get_asn1_iv,
+        NULL)
+IMPLEMENT_BLOCK_CIPHER(camellia_256, ks, Camellia, EVP_CAMELLIA_KEY,
+        NID_camellia_256, 16, 32, 16, 128,
+        0, camellia_init_key, NULL, 
+        EVP_CIPHER_set_asn1_iv,
+        EVP_CIPHER_get_asn1_iv,
+        NULL)
+
+#define IMPLEMENT_CAMELLIA_CFBR(ksize,cbits)    IMPLEMENT_CFBR(camellia,Camellia,EVP_CAMELLIA_KEY,ks,ksize,cbits,16)
+
+IMPLEMENT_CAMELLIA_CFBR(128,1)
+IMPLEMENT_CAMELLIA_CFBR(192,1)
+IMPLEMENT_CAMELLIA_CFBR(256,1)
+
+IMPLEMENT_CAMELLIA_CFBR(128,8)
+IMPLEMENT_CAMELLIA_CFBR(192,8)
+IMPLEMENT_CAMELLIA_CFBR(256,8)
+
+
+
+/* The subkey for Camellia is generated. */ 
+static int camellia_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+        const unsigned char *iv, int enc)
+        {
+        int ret;
+
+        ret=Camellia_set_key(key, ctx->key_len * 8, ctx->cipher_data);
+
+        if(ret < 0)
+                {
+                EVPerr(EVP_F_CAMELLIA_INIT_KEY,EVP_R_CAMELLIA_KEY_SETUP_FAILED);
+                return 0;
+                }
+
+        return 1;
+        }
+
+#else
+
+# ifdef PEDANTIC
+static void *dummy=&dummy;
+# endif
+
+#endif
diff --git a/src/lib/libssl/src/crypto/evp/e_seed.c b/src/lib/libssl/src/crypto/evp/e_seed.c
new file mode 100644
index 0000000000..8c1ec0d43a
--- /dev/null
+++ b/src/lib/libssl/src/crypto/evp/e_seed.c
@@ -0,0 +1,83 @@
+/* crypto/evp/e_seed.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2007 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <openssl/opensslconf.h>
+#include <openssl/evp.h>
+#include <openssl/err.h>
+#include <string.h>
+#include <assert.h>
+#ifndef OPENSSL_NO_SEED
+#include <openssl/seed.h>
+#include "evp_locl.h"
+
+static int seed_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc);
+
+typedef struct
+        {
+        SEED_KEY_SCHEDULE ks;
+        } EVP_SEED_KEY;
+
+IMPLEMENT_BLOCK_CIPHER(seed, ks, SEED, EVP_SEED_KEY, NID_seed,
+                       16, 16, 16, 128,
+                       0, seed_init_key, 0, 0, 0, 0)
+
+static int seed_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                         const unsigned char *iv, int enc)
+        {
+        SEED_set_key(key, ctx->cipher_data);
+        return 1;
+        }
+
+#endif
diff --git a/src/lib/libssl/src/crypto/evp/m_ecdsa.c b/src/lib/libssl/src/crypto/evp/m_ecdsa.c
new file mode 100644
index 0000000000..fad270faca
--- /dev/null
+++ b/src/lib/libssl/src/crypto/evp/m_ecdsa.c
@@ -0,0 +1,148 @@
+/* crypto/evp/m_ecdsa.c */
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/objects.h>
+#include <openssl/x509.h>
+
+#ifndef OPENSSL_NO_SHA
+static int init(EVP_MD_CTX *ctx)
+        { return SHA1_Init(ctx->md_data); }
+
+static int update(EVP_MD_CTX *ctx,const void *data,size_t count)
+        { return SHA1_Update(ctx->md_data,data,count); }
+
+static int final(EVP_MD_CTX *ctx,unsigned char *md)
+        { return SHA1_Final(md,ctx->md_data); }
+
+static const EVP_MD ecdsa_md=
+        {
+        NID_ecdsa_with_SHA1,
+        NID_ecdsa_with_SHA1,
+        SHA_DIGEST_LENGTH,
+        0,
+        init,
+        update,
+        final,
+        NULL,
+        NULL,
+        EVP_PKEY_ECDSA_method,
+        SHA_CBLOCK,
+        sizeof(EVP_MD *)+sizeof(SHA_CTX),
+        };
+
+const EVP_MD *EVP_ecdsa(void)
+        {
+        return(&ecdsa_md);
+        }
+#endif
diff --git a/src/lib/libssl/src/crypto/ia64cpuid.S b/src/lib/libssl/src/crypto/ia64cpuid.S
new file mode 100644
index 0000000000..04fbb3439e
--- /dev/null
+++ b/src/lib/libssl/src/crypto/ia64cpuid.S
@@ -0,0 +1,121 @@
+// Works on all IA-64 platforms: Linux, HP-UX, Win64i...
+// On Win64i compile with ias.exe.
+.text
+.global OPENSSL_rdtsc#
+.proc   OPENSSL_rdtsc#
+OPENSSL_rdtsc:
+{ .mib; mov                     r8=ar.itc
+        br.ret.sptk.many        b0              };;
+.endp   OPENSSL_rdtsc#
+
+.global OPENSSL_atomic_add#
+.proc   OPENSSL_atomic_add#
+.align  32
+OPENSSL_atomic_add:
+{ .mii; ld4             r2=[r32]
+        nop.i           0
+        nop.i           0               };;
+.Lspin:
+{ .mii; mov             ar.ccv=r2
+        add             r8=r2,r33
+        mov             r3=r2           };;
+{ .mmi; mf
+        cmpxchg4.acq    r2=[r32],r8,ar.ccv
+        nop.i           0               };;
+{ .mib; cmp.ne          p6,p0=r2,r3
+        nop.i           0
+(p6)    br.dpnt         .Lspin          };;
+{ .mib; nop.m           0
+        sxt4            r8=r8
+        br.ret.sptk.many        b0      };;
+.endp   OPENSSL_atomic_add#
+
+// Returns a structure comprising pointer to the top of stack of
+// the caller and pointer beyond backing storage for the current
+// register frame. The latter is required, because it might be
+// insufficient to wipe backing storage for the current frame
+// (as this procedure does), one might have to go further, toward
+// higher addresses to reach for whole "retroactively" saved
+// context...
+.global OPENSSL_wipe_cpu#
+.proc   OPENSSL_wipe_cpu#
+.align  32
+OPENSSL_wipe_cpu:
+        .prologue
+        .fframe 0
+        .save   ar.pfs,r2
+        .save   ar.lc,r3
+{ .mib; alloc           r2=ar.pfs,0,96,0,96
+        mov             r3=ar.lc
+        brp.loop.imp    .L_wipe_top,.L_wipe_end-16
+                                        };;
+{ .mii; mov             r9=ar.bsp
+        mov             r8=pr
+        mov             ar.lc=96        };;
+        .body
+{ .mii; add             r9=96*8-8,r9
+        mov             ar.ec=1         };;
+
+// One can sweep double as fast, but then we can't quarantee
+// that backing storage is wiped...
+.L_wipe_top:
+{ .mfi; st8             [r9]=r0,-8
+        mov             f127=f0
+        mov             r127=r0         }
+{ .mfb; nop.m           0
+        nop.f           0
+        br.ctop.sptk    .L_wipe_top     };;
+.L_wipe_end:
+
+{ .mfi; mov             r11=r0
+        mov             f6=f0
+        mov             r14=r0          }
+{ .mfi; mov             r15=r0
+        mov             f7=f0
+        mov             r16=r0          }
+{ .mfi; mov             r17=r0
+        mov             f8=f0
+        mov             r18=r0          }
+{ .mfi; mov             r19=r0
+        mov             f9=f0
+        mov             r20=r0          }
+{ .mfi; mov             r21=r0
+        mov             f10=f0
+        mov             r22=r0          }
+{ .mfi; mov             r23=r0
+        mov             f11=f0
+        mov             r24=r0          }
+{ .mfi; mov             r25=r0
+        mov             f12=f0
+        mov             r26=r0          }
+{ .mfi; mov             r27=r0
+        mov             f13=f0
+        mov             r28=r0          }
+{ .mfi; mov             r29=r0
+        mov             f14=f0
+        mov             r30=r0          }
+{ .mfi; mov             r31=r0
+        mov             f15=f0
+        nop.i           0               }
+{ .mfi; mov             f16=f0          }
+{ .mfi; mov             f17=f0          }
+{ .mfi; mov             f18=f0          }
+{ .mfi; mov             f19=f0          }
+{ .mfi; mov             f20=f0          }
+{ .mfi; mov             f21=f0          }
+{ .mfi; mov             f22=f0          }
+{ .mfi; mov             f23=f0          }
+{ .mfi; mov             f24=f0          }
+{ .mfi; mov             f25=f0          }
+{ .mfi; mov             f26=f0          }
+{ .mfi; mov             f27=f0          }
+{ .mfi; mov             f28=f0          }
+{ .mfi; mov             f29=f0          }
+{ .mfi; mov             f30=f0          }
+{ .mfi; add             r9=96*8+8,r9
+        mov             f31=f0
+        mov             pr=r8,0x1ffff   }
+{ .mib; mov             r8=sp
+        mov             ar.lc=r3
+        br.ret.sptk     b0              };;
+.endp   OPENSSL_wipe_cpu#
diff --git a/src/lib/libssl/src/crypto/md5/asm/md5-x86_64.pl b/src/lib/libssl/src/crypto/md5/asm/md5-x86_64.pl
new file mode 100755
index 0000000000..9a6fa67224
--- /dev/null
+++ b/src/lib/libssl/src/crypto/md5/asm/md5-x86_64.pl
@@ -0,0 +1,245 @@
+#!/usr/bin/perl -w
+#
+# MD5 optimized for AMD64.
+#
+# Author: Marc Bevand <bevand_m (at) epita.fr>
+# Licence: I hereby disclaim the copyright on this code and place it
+# in the public domain.
+#
+
+use strict;
+
+my $code;
+
+# round1_step() does:
+#   dst = x + ((dst + F(x,y,z) + X[k] + T_i) <<< s)
+#   %r10d = X[k_next]
+#   %r11d = z' (copy of z for the next step)
+# Each round1_step() takes about 5.71 clocks (9 instructions, 1.58 IPC)
+sub round1_step
+{
+    my ($pos, $dst, $x, $y, $z, $k_next, $T_i, $s) = @_;
+    $code .= " mov      0*4(%rsi),      %r10d           /* (NEXT STEP) X[0] */\n" if ($pos == -1);
+    $code .= " mov      %edx,           %r11d           /* (NEXT STEP) z' = %edx */\n" if ($pos == -1);
+    $code .= <<EOF;
+        xor     $y,             %r11d           /* y ^ ... */
+        lea     $T_i($dst,%r10d),$dst           /* Const + dst + ... */
+        and     $x,             %r11d           /* x & ... */
+        xor     $z,             %r11d           /* z ^ ... */
+        mov     $k_next*4(%rsi),%r10d           /* (NEXT STEP) X[$k_next] */
+        add     %r11d,          $dst            /* dst += ... */
+        rol     \$$s,           $dst            /* dst <<< s */
+        mov     $y,             %r11d           /* (NEXT STEP) z' = $y */
+        add     $x,             $dst            /* dst += x */
+EOF
+}
+
+# round2_step() does:
+#   dst = x + ((dst + G(x,y,z) + X[k] + T_i) <<< s)
+#   %r10d = X[k_next]
+#   %r11d = y' (copy of y for the next step)
+# Each round2_step() takes about 6.22 clocks (9 instructions, 1.45 IPC)
+sub round2_step
+{
+    my ($pos, $dst, $x, $y, $z, $k_next, $T_i, $s) = @_;
+    $code .= " mov      1*4(%rsi),      %r10d           /* (NEXT STEP) X[1] */\n" if ($pos == -1);
+    $code .= " mov      %ecx,           %r11d           /* (NEXT STEP) y' = %ecx */\n" if ($pos == -1);
+    $code .= <<EOF;
+        xor     $x,             %r11d           /* x ^ ... */
+        lea     $T_i($dst,%r10d),$dst           /* Const + dst + ... */
+        and     $z,             %r11d           /* z & ... */
+        xor     $y,             %r11d           /* y ^ ... */
+        mov     $k_next*4(%rsi),%r10d           /* (NEXT STEP) X[$k_next] */
+        add     %r11d,          $dst            /* dst += ... */
+        rol     \$$s,           $dst            /* dst <<< s */
+        mov     $x,             %r11d           /* (NEXT STEP) y' = $x */
+        add     $x,             $dst            /* dst += x */
+EOF
+}
+
+# round3_step() does:
+#   dst = x + ((dst + H(x,y,z) + X[k] + T_i) <<< s)
+#   %r10d = X[k_next]
+#   %r11d = y' (copy of y for the next step)
+# Each round3_step() takes about 4.26 clocks (8 instructions, 1.88 IPC)
+sub round3_step
+{
+    my ($pos, $dst, $x, $y, $z, $k_next, $T_i, $s) = @_;
+    $code .= " mov      5*4(%rsi),      %r10d           /* (NEXT STEP) X[5] */\n" if ($pos == -1);
+    $code .= " mov      %ecx,           %r11d           /* (NEXT STEP) y' = %ecx */\n" if ($pos == -1);
+    $code .= <<EOF;
+        lea     $T_i($dst,%r10d),$dst           /* Const + dst + ... */
+        mov     $k_next*4(%rsi),%r10d           /* (NEXT STEP) X[$k_next] */
+        xor     $z,             %r11d           /* z ^ ... */
+        xor     $x,             %r11d           /* x ^ ... */
+        add     %r11d,          $dst            /* dst += ... */
+        rol     \$$s,           $dst            /* dst <<< s */
+        mov     $x,             %r11d           /* (NEXT STEP) y' = $x */
+        add     $x,             $dst            /* dst += x */
+EOF
+}
+
+# round4_step() does:
+#   dst = x + ((dst + I(x,y,z) + X[k] + T_i) <<< s)
+#   %r10d = X[k_next]
+#   %r11d = not z' (copy of not z for the next step)
+# Each round4_step() takes about 5.27 clocks (9 instructions, 1.71 IPC)
+sub round4_step
+{
+    my ($pos, $dst, $x, $y, $z, $k_next, $T_i, $s) = @_;
+    $code .= " mov      0*4(%rsi),      %r10d           /* (NEXT STEP) X[0] */\n" if ($pos == -1);
+    $code .= " mov      \$0xffffffff,   %r11d\n" if ($pos == -1);
+    $code .= " xor      %edx,           %r11d           /* (NEXT STEP) not z' = not %edx*/\n"
+    if ($pos == -1);
+    $code .= <<EOF;
+        lea     $T_i($dst,%r10d),$dst           /* Const + dst + ... */
+        or      $x,             %r11d           /* x | ... */
+        xor     $y,             %r11d           /* y ^ ... */
+        add     %r11d,          $dst            /* dst += ... */
+        mov     $k_next*4(%rsi),%r10d           /* (NEXT STEP) X[$k_next] */
+        mov     \$0xffffffff,   %r11d
+        rol     \$$s,           $dst            /* dst <<< s */
+        xor     $y,             %r11d           /* (NEXT STEP) not z' = not $y */
+        add     $x,             $dst            /* dst += x */
+EOF
+}
+
+my $output = shift;
+open STDOUT,"| $^X ../perlasm/x86_64-xlate.pl $output";
+
+$code .= <<EOF;
+.text
+.align 16
+
+.globl md5_block_asm_data_order
+.type md5_block_asm_data_order,\@function,3
+md5_block_asm_data_order:
+        push    %rbp
+        push    %rbx
+        push    %r14
+        push    %r15
+
+        # rdi = arg #1 (ctx, MD5_CTX pointer)
+        # rsi = arg #2 (ptr, data pointer)
+        # rdx = arg #3 (nbr, number of 16-word blocks to process)
+        mov     %rdi,           %rbp    # rbp = ctx
+        shl     \$6,            %rdx    # rdx = nbr in bytes
+        lea     (%rsi,%rdx),    %rdi    # rdi = end
+        mov     0*4(%rbp),      %eax    # eax = ctx->A
+        mov     1*4(%rbp),      %ebx    # ebx = ctx->B
+        mov     2*4(%rbp),      %ecx    # ecx = ctx->C
+        mov     3*4(%rbp),      %edx    # edx = ctx->D
+        # end is 'rdi'
+        # ptr is 'rsi'
+        # A is 'eax'
+        # B is 'ebx'
+        # C is 'ecx'
+        # D is 'edx'
+
+        cmp     %rdi,           %rsi            # cmp end with ptr
+        je      .Lend                           # jmp if ptr == end
+
+        # BEGIN of loop over 16-word blocks
+.Lloop: # save old values of A, B, C, D
+        mov     %eax,           %r8d
+        mov     %ebx,           %r9d
+        mov     %ecx,           %r14d
+        mov     %edx,           %r15d
+EOF
+round1_step(-1,'%eax','%ebx','%ecx','%edx', '1','0xd76aa478', '7');
+round1_step( 0,'%edx','%eax','%ebx','%ecx', '2','0xe8c7b756','12');
+round1_step( 0,'%ecx','%edx','%eax','%ebx', '3','0x242070db','17');
+round1_step( 0,'%ebx','%ecx','%edx','%eax', '4','0xc1bdceee','22');
+round1_step( 0,'%eax','%ebx','%ecx','%edx', '5','0xf57c0faf', '7');
+round1_step( 0,'%edx','%eax','%ebx','%ecx', '6','0x4787c62a','12');
+round1_step( 0,'%ecx','%edx','%eax','%ebx', '7','0xa8304613','17');
+round1_step( 0,'%ebx','%ecx','%edx','%eax', '8','0xfd469501','22');
+round1_step( 0,'%eax','%ebx','%ecx','%edx', '9','0x698098d8', '7');
+round1_step( 0,'%edx','%eax','%ebx','%ecx','10','0x8b44f7af','12');
+round1_step( 0,'%ecx','%edx','%eax','%ebx','11','0xffff5bb1','17');
+round1_step( 0,'%ebx','%ecx','%edx','%eax','12','0x895cd7be','22');
+round1_step( 0,'%eax','%ebx','%ecx','%edx','13','0x6b901122', '7');
+round1_step( 0,'%edx','%eax','%ebx','%ecx','14','0xfd987193','12');
+round1_step( 0,'%ecx','%edx','%eax','%ebx','15','0xa679438e','17');
+round1_step( 1,'%ebx','%ecx','%edx','%eax', '0','0x49b40821','22');
+
+round2_step(-1,'%eax','%ebx','%ecx','%edx', '6','0xf61e2562', '5');
+round2_step( 0,'%edx','%eax','%ebx','%ecx','11','0xc040b340', '9');
+round2_step( 0,'%ecx','%edx','%eax','%ebx', '0','0x265e5a51','14');
+round2_step( 0,'%ebx','%ecx','%edx','%eax', '5','0xe9b6c7aa','20');
+round2_step( 0,'%eax','%ebx','%ecx','%edx','10','0xd62f105d', '5');
+round2_step( 0,'%edx','%eax','%ebx','%ecx','15', '0x2441453', '9');
+round2_step( 0,'%ecx','%edx','%eax','%ebx', '4','0xd8a1e681','14');
+round2_step( 0,'%ebx','%ecx','%edx','%eax', '9','0xe7d3fbc8','20');
+round2_step( 0,'%eax','%ebx','%ecx','%edx','14','0x21e1cde6', '5');
+round2_step( 0,'%edx','%eax','%ebx','%ecx', '3','0xc33707d6', '9');
+round2_step( 0,'%ecx','%edx','%eax','%ebx', '8','0xf4d50d87','14');
+round2_step( 0,'%ebx','%ecx','%edx','%eax','13','0x455a14ed','20');
+round2_step( 0,'%eax','%ebx','%ecx','%edx', '2','0xa9e3e905', '5');
+round2_step( 0,'%edx','%eax','%ebx','%ecx', '7','0xfcefa3f8', '9');
+round2_step( 0,'%ecx','%edx','%eax','%ebx','12','0x676f02d9','14');
+round2_step( 1,'%ebx','%ecx','%edx','%eax', '0','0x8d2a4c8a','20');
+
+round3_step(-1,'%eax','%ebx','%ecx','%edx', '8','0xfffa3942', '4');
+round3_step( 0,'%edx','%eax','%ebx','%ecx','11','0x8771f681','11');
+round3_step( 0,'%ecx','%edx','%eax','%ebx','14','0x6d9d6122','16');
+round3_step( 0,'%ebx','%ecx','%edx','%eax', '1','0xfde5380c','23');
+round3_step( 0,'%eax','%ebx','%ecx','%edx', '4','0xa4beea44', '4');
+round3_step( 0,'%edx','%eax','%ebx','%ecx', '7','0x4bdecfa9','11');
+round3_step( 0,'%ecx','%edx','%eax','%ebx','10','0xf6bb4b60','16');
+round3_step( 0,'%ebx','%ecx','%edx','%eax','13','0xbebfbc70','23');
+round3_step( 0,'%eax','%ebx','%ecx','%edx', '0','0x289b7ec6', '4');
+round3_step( 0,'%edx','%eax','%ebx','%ecx', '3','0xeaa127fa','11');
+round3_step( 0,'%ecx','%edx','%eax','%ebx', '6','0xd4ef3085','16');
+round3_step( 0,'%ebx','%ecx','%edx','%eax', '9', '0x4881d05','23');
+round3_step( 0,'%eax','%ebx','%ecx','%edx','12','0xd9d4d039', '4');
+round3_step( 0,'%edx','%eax','%ebx','%ecx','15','0xe6db99e5','11');
+round3_step( 0,'%ecx','%edx','%eax','%ebx', '2','0x1fa27cf8','16');
+round3_step( 1,'%ebx','%ecx','%edx','%eax', '0','0xc4ac5665','23');
+
+round4_step(-1,'%eax','%ebx','%ecx','%edx', '7','0xf4292244', '6');
+round4_step( 0,'%edx','%eax','%ebx','%ecx','14','0x432aff97','10');
+round4_step( 0,'%ecx','%edx','%eax','%ebx', '5','0xab9423a7','15');
+round4_step( 0,'%ebx','%ecx','%edx','%eax','12','0xfc93a039','21');
+round4_step( 0,'%eax','%ebx','%ecx','%edx', '3','0x655b59c3', '6');
+round4_step( 0,'%edx','%eax','%ebx','%ecx','10','0x8f0ccc92','10');
+round4_step( 0,'%ecx','%edx','%eax','%ebx', '1','0xffeff47d','15');
+round4_step( 0,'%ebx','%ecx','%edx','%eax', '8','0x85845dd1','21');
+round4_step( 0,'%eax','%ebx','%ecx','%edx','15','0x6fa87e4f', '6');
+round4_step( 0,'%edx','%eax','%ebx','%ecx', '6','0xfe2ce6e0','10');
+round4_step( 0,'%ecx','%edx','%eax','%ebx','13','0xa3014314','15');
+round4_step( 0,'%ebx','%ecx','%edx','%eax', '4','0x4e0811a1','21');
+round4_step( 0,'%eax','%ebx','%ecx','%edx','11','0xf7537e82', '6');
+round4_step( 0,'%edx','%eax','%ebx','%ecx', '2','0xbd3af235','10');
+round4_step( 0,'%ecx','%edx','%eax','%ebx', '9','0x2ad7d2bb','15');
+round4_step( 1,'%ebx','%ecx','%edx','%eax', '0','0xeb86d391','21');
+$code .= <<EOF;
+        # add old values of A, B, C, D
+        add     %r8d,   %eax
+        add     %r9d,   %ebx
+        add     %r14d,  %ecx
+        add     %r15d,  %edx
+
+        # loop control
+        add     \$64,           %rsi            # ptr += 64
+        cmp     %rdi,           %rsi            # cmp end with ptr
+        jb      .Lloop                          # jmp if ptr < end
+        # END of loop over 16-word blocks
+
+.Lend:
+        mov     %eax,           0*4(%rbp)       # ctx->A = A
+        mov     %ebx,           1*4(%rbp)       # ctx->B = B
+        mov     %ecx,           2*4(%rbp)       # ctx->C = C
+        mov     %edx,           3*4(%rbp)       # ctx->D = D
+
+        pop     %r15
+        pop     %r14
+        pop     %rbx
+        pop     %rbp
+        ret
+.size md5_block_asm_data_order,.-md5_block_asm_data_order
+EOF
+
+print $code;
+
+close STDOUT;
diff --git a/src/lib/libssl/src/crypto/o_dir.c b/src/lib/libssl/src/crypto/o_dir.c
new file mode 100644
index 0000000000..42891ea459
--- /dev/null
+++ b/src/lib/libssl/src/crypto/o_dir.c
@@ -0,0 +1,83 @@
+/* crypto/o_dir.c -*- mode:C; c-file-style: "eay" -*- */
+/* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
+ * project 2004.
+ */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <errno.h>
+#include <e_os.h>
+
+/* The routines really come from the Levitte Programming, so to make
+   life simple, let's just use the raw files and hack the symbols to
+   fit our namespace.  */
+#define LP_DIR_CTX OPENSSL_DIR_CTX
+#define LP_dir_context_st OPENSSL_dir_context_st
+#define LP_find_file OPENSSL_DIR_read
+#define LP_find_file_end OPENSSL_DIR_end
+
+#include "o_dir.h"
+
+#define LPDIR_H
+#if defined OPENSSL_SYS_UNIX || defined DJGPP
+#include "LPdir_unix.c"
+#elif defined OPENSSL_SYS_VMS
+#include "LPdir_vms.c"
+#elif defined OPENSSL_SYS_WIN32
+#include "LPdir_win32.c"
+#elif defined OPENSSL_SYS_WINCE
+#include "LPdir_wince.c"
+#else
+#include "LPdir_nyi.c"
+#endif
diff --git a/src/lib/libssl/src/crypto/o_dir.h b/src/lib/libssl/src/crypto/o_dir.h
new file mode 100644
index 0000000000..4b725c0312
--- /dev/null
+++ b/src/lib/libssl/src/crypto/o_dir.h
@@ -0,0 +1,53 @@
+/* crypto/o_dir.h -*- mode:C; c-file-style: "eay" -*- */
+/* Copied from Richard Levitte's (richard@levitte.org) LP library.  All
+ * symbol names have been changed, with permission from the author.
+ */
+
+/* $LP: LPlib/source/LPdir.h,v 1.1 2004/06/14 08:56:04 _cvs_levitte Exp $ */
+/*
+ * Copyright (c) 2004, Richard Levitte <richard@levitte.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+
+#ifndef O_DIR_H
+#define O_DIR_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+  typedef struct OPENSSL_dir_context_st OPENSSL_DIR_CTX;
+
+  /* returns NULL on error or end-of-directory.
+     If it is end-of-directory, errno will be zero */
+  const char *OPENSSL_DIR_read(OPENSSL_DIR_CTX **ctx, const char *directory);
+  /* returns 1 on success, 0 on error */
+  int OPENSSL_DIR_end(OPENSSL_DIR_CTX **ctx);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* LPDIR_H */
diff --git a/src/lib/libssl/src/crypto/o_dir_test.c b/src/lib/libssl/src/crypto/o_dir_test.c
new file mode 100644
index 0000000000..3d75ecb005
--- /dev/null
+++ b/src/lib/libssl/src/crypto/o_dir_test.c
@@ -0,0 +1,70 @@
+/* crypto/o_dir.h -*- mode:C; c-file-style: "eay" -*- */
+/* Copied from Richard Levitte's (richard@levitte.org) LP library.  All
+ * symbol names have been changed, with permission from the author.
+ */
+
+/* $LP: LPlib/test/test_dir.c,v 1.1 2004/06/16 22:59:47 _cvs_levitte Exp $ */
+/*
+ * Copyright (c) 2004, Richard Levitte <richard@levitte.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <stddef.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include "e_os2.h"
+#include "o_dir.h"
+
+#if defined OPENSSL_SYS_UNIX || defined OPENSSL_SYS_WIN32 || defined OPENSSL_SYS_WINCE
+#define CURRDIR "."
+#elif defined OPENSSL_SYS_VMS
+#define CURRDIR "SYS$DISK:[]"
+#else
+#error "No supported platform defined!"
+#endif
+
+int main()
+{
+  OPENSSL_DIR_CTX *ctx = NULL;
+  const char *result;
+
+  while((result = OPENSSL_DIR_read(&ctx, CURRDIR)) != NULL)
+    {
+      printf("%s\n", result);
+    }
+
+  if (errno)
+    {
+      perror("test_dir");
+      exit(1);
+    }
+
+  if (!OPENSSL_DIR_end(&ctx))
+    {
+      perror("test_dir");
+      exit(2);
+    }
+  exit(0);
+}
diff --git a/src/lib/libssl/src/crypto/perlasm/x86_64-xlate.pl b/src/lib/libssl/src/crypto/perlasm/x86_64-xlate.pl
new file mode 100755
index 0000000000..a4af769b4a
--- /dev/null
+++ b/src/lib/libssl/src/crypto/perlasm/x86_64-xlate.pl
@@ -0,0 +1,554 @@
+#!/usr/bin/env perl
+
+# Ascetic x86_64 AT&T to MASM assembler translator by <appro>.
+#
+# Why AT&T to MASM and not vice versa? Several reasons. Because AT&T
+# format is way easier to parse. Because it's simpler to "gear" from
+# Unix ABI to Windows one [see cross-reference "card" at the end of
+# file]. Because Linux targets were available first...
+#
+# In addition the script also "distills" code suitable for GNU
+# assembler, so that it can be compiled with more rigid assemblers,
+# such as Solaris /usr/ccs/bin/as.
+#
+# This translator is not designed to convert *arbitrary* assembler
+# code from AT&T format to MASM one. It's designed to convert just
+# enough to provide for dual-ABI OpenSSL modules development...
+# There *are* limitations and you might have to modify your assembler
+# code or this script to achieve the desired result...
+#
+# Currently recognized limitations:
+#
+# - can't use multiple ops per line;
+# - indirect calls and jumps are not supported;
+#
+# Dual-ABI styling rules.
+#
+# 1. Adhere to Unix register and stack layout [see the end for
+#    explanation].
+# 2. Forget about "red zone," stick to more traditional blended
+#    stack frame allocation. If volatile storage is actually required
+#    that is. If not, just leave the stack as is.
+# 3. Functions tagged with ".type name,@function" get crafted with
+#    unified Win64 prologue and epilogue automatically. If you want
+#    to take care of ABI differences yourself, tag functions as
+#    ".type name,@abi-omnipotent" instead.
+# 4. To optimize the Win64 prologue you can specify number of input
+#    arguments as ".type name,@function,N." Keep in mind that if N is
+#    larger than 6, then you *have to* write "abi-omnipotent" code,
+#    because >6 cases can't be addressed with unified prologue.
+# 5. Name local labels as .L*, do *not* use dynamic labels such as 1:
+#    (sorry about latter).
+# 6. Don't use [or hand-code with .byte] "rep ret." "ret" mnemonic is
+#    required to identify the spots, where to inject Win64 epilogue!
+#    But on the pros, it's then prefixed with rep automatically:-)
+# 7. Due to MASM limitations [and certain general counter-intuitivity
+#    of ip-relative addressing] generation of position-independent
+#    code is assisted by synthetic directive, .picmeup, which puts
+#    address of the *next* instruction into target register.
+#
+#    Example 1:
+#               .picmeup        %rax
+#               lea             .Label-.(%rax),%rax
+#    Example 2:
+#               .picmeup        %rcx
+#       .Lpic_point:
+#               ...
+#               lea             .Label-.Lpic_point(%rcx),%rbp
+
+my $output = shift;
+
+{ my ($stddev,$stdino,@junk)=stat(STDOUT);
+  my ($outdev,$outino,@junk)=stat($output);
+
+    open STDOUT,">$output" || die "can't open $output: $!"
+        if ($stddev!=$outdev || $stdino!=$outino);
+}
+
+my $masmref=8 + 50727*2**-32;   # 8.00.50727 shipped with VS2005
+my $masm=$masmref if ($output =~ /\.asm/);
+if ($masm && `ml64 2>&1` =~ m/Version ([0-9]+)\.([0-9]+)(\.([0-9]+))?/)
+{   $masm=$1 + $2*2**-16 + $4*2**-32;   }
+
+my $current_segment;
+my $current_function;
+
+{ package opcode;       # pick up opcodes
+    sub re {
+        my      $self = shift;  # single instance in enough...
+        local   *line = shift;
+        undef   $ret;
+
+        if ($line =~ /^([a-z][a-z0-9]*)/i) {
+            $self->{op} = $1;
+            $ret = $self;
+            $line = substr($line,@+[0]); $line =~ s/^\s+//;
+
+            undef $self->{sz};
+            if ($self->{op} =~ /^(movz)b.*/) {  # movz is pain...
+                $self->{op} = $1;
+                $self->{sz} = "b";
+            } elsif ($self->{op} =~ /call/) {
+                $self->{sz} = ""
+            } elsif ($self->{op} =~ /([a-z]{3,})([qlwb])$/) {
+                $self->{op} = $1;
+                $self->{sz} = $2;
+            }
+        }
+        $ret;
+    }
+    sub size {
+        my $self = shift;
+        my $sz   = shift;
+        $self->{sz} = $sz if (defined($sz) && !defined($self->{sz}));
+        $self->{sz};
+    }
+    sub out {
+        my $self = shift;
+        if (!$masm) {
+            if ($self->{op} eq "movz") {        # movz is pain...
+                sprintf "%s%s%s",$self->{op},$self->{sz},shift;
+            } elsif ($self->{op} =~ /^set/) { 
+                "$self->{op}";
+            } elsif ($self->{op} eq "ret") {
+                ".byte  0xf3,0xc3";
+            } else {
+                "$self->{op}$self->{sz}";
+            }
+        } else {
+            $self->{op} =~ s/^movz/movzx/;
+            if ($self->{op} eq "ret") {
+                $self->{op} = "";
+                if ($current_function->{abi} eq "svr4") {
+                    $self->{op} = "mov  rdi,QWORD PTR 8[rsp]\t;WIN64 epilogue\n\t".
+                                  "mov  rsi,QWORD PTR 16[rsp]\n\t";
+                }
+                $self->{op} .= "DB\t0F3h,0C3h\t\t;repret";
+            }
+            $self->{op};
+        }
+    }
+}
+{ package const;        # pick up constants, which start with $
+    sub re {
+        my      $self = shift;  # single instance in enough...
+        local   *line = shift;
+        undef   $ret;
+
+        if ($line =~ /^\$([^,]+)/) {
+            $self->{value} = $1;
+            $ret = $self;
+            $line = substr($line,@+[0]); $line =~ s/^\s+//;
+        }
+        $ret;
+    }
+    sub out {
+        my $self = shift;
+
+        if (!$masm) {
+            # Solaris /usr/ccs/bin/as can't handle multiplications
+            # in $self->{value}
+            $self->{value} =~ s/(?<![0-9a-f])(0[x0-9a-f]+)/oct($1)/egi;
+            $self->{value} =~ s/([0-9]+\s*[\*\/\%]\s*[0-9]+)/eval($1)/eg;
+            sprintf "\$%s",$self->{value};
+        } else {
+            $self->{value} =~ s/0x([0-9a-f]+)/0$1h/ig;
+            sprintf "%s",$self->{value};
+        }
+    }
+}
+{ package ea;           # pick up effective addresses: expr(%reg,%reg,scale)
+    sub re {
+        my      $self = shift;  # single instance in enough...
+        local   *line = shift;
+        undef   $ret;
+
+        if ($line =~ /^([^\(,]*)\(([%\w,]+)\)/) {
+            $self->{label} = $1;
+            ($self->{base},$self->{index},$self->{scale})=split(/,/,$2);
+            $self->{scale} = 1 if (!defined($self->{scale}));
+            $ret = $self;
+            $line = substr($line,@+[0]); $line =~ s/^\s+//;
+
+            $self->{base}  =~ s/^%//;
+            $self->{index} =~ s/^%// if (defined($self->{index}));
+        }
+        $ret;
+    }
+    sub size {}
+    sub out {
+        my $self = shift;
+        my $sz = shift;
+
+        # Silently convert all EAs to 64-bit. This is required for
+        # elder GNU assembler and results in more compact code,
+        # *but* most importantly AES module depends on this feature!
+        $self->{index} =~ s/^[er](.?[0-9xpi])[d]?$/r\1/;
+        $self->{base}  =~ s/^[er](.?[0-9xpi])[d]?$/r\1/;
+
+        if (!$masm) {
+            # Solaris /usr/ccs/bin/as can't handle multiplications
+            # in $self->{label}
+            $self->{label} =~ s/(?<![0-9a-f])(0[x0-9a-f]+)/oct($1)/egi;
+            $self->{label} =~ s/([0-9]+\s*[\*\/\%]\s*[0-9]+)/eval($1)/eg;
+
+            if (defined($self->{index})) {
+                sprintf "%s(%%%s,%%%s,%d)",
+                                        $self->{label},$self->{base},
+                                        $self->{index},$self->{scale};
+            } else {
+                sprintf "%s(%%%s)",     $self->{label},$self->{base};
+            }
+        } else {
+            %szmap = ( b=>"BYTE", w=>"WORD", l=>"DWORD", q=>"QWORD" );
+
+            $self->{label} =~ s/\./\$/g;
+            $self->{label} =~ s/0x([0-9a-f]+)/0$1h/ig;
+            $self->{label} = "($self->{label})" if ($self->{label} =~ /[\*\+\-\/]/);
+
+            if (defined($self->{index})) {
+                sprintf "%s PTR %s[%s*%d+%s]",$szmap{$sz},
+                                        $self->{label},
+                                        $self->{index},$self->{scale},
+                                        $self->{base};
+            } elsif ($self->{base} eq "rip") {
+                sprintf "%s PTR %s",$szmap{$sz},$self->{label};
+            } else {
+                sprintf "%s PTR %s[%s]",$szmap{$sz},
+                                        $self->{label},$self->{base};
+            }
+        }
+    }
+}
+{ package register;     # pick up registers, which start with %.
+    sub re {
+        my      $class = shift; # muliple instances...
+        my      $self = {};
+        local   *line = shift;
+        undef   $ret;
+
+        if ($line =~ /^%(\w+)/) {
+            bless $self,$class;
+            $self->{value} = $1;
+            $ret = $self;
+            $line = substr($line,@+[0]); $line =~ s/^\s+//;
+        }
+        $ret;
+    }
+    sub size {
+        my      $self = shift;
+        undef   $ret;
+
+        if    ($self->{value} =~ /^r[\d]+b$/i)  { $ret="b"; }
+        elsif ($self->{value} =~ /^r[\d]+w$/i)  { $ret="w"; }
+        elsif ($self->{value} =~ /^r[\d]+d$/i)  { $ret="l"; }
+        elsif ($self->{value} =~ /^r[\w]+$/i)   { $ret="q"; }
+        elsif ($self->{value} =~ /^[a-d][hl]$/i){ $ret="b"; }
+        elsif ($self->{value} =~ /^[\w]{2}l$/i) { $ret="b"; }
+        elsif ($self->{value} =~ /^[\w]{2}$/i)  { $ret="w"; }
+        elsif ($self->{value} =~ /^e[a-z]{2}$/i){ $ret="l"; }
+
+        $ret;
+    }
+    sub out {
+        my $self = shift;
+        sprintf $masm?"%s":"%%%s",$self->{value};
+    }
+}
+{ package label;        # pick up labels, which end with :
+    sub re {
+        my      $self = shift;  # single instance is enough...
+        local   *line = shift;
+        undef   $ret;
+
+        if ($line =~ /(^[\.\w]+\:)/) {
+            $self->{value} = $1;
+            $ret = $self;
+            $line = substr($line,@+[0]); $line =~ s/^\s+//;
+
+            $self->{value} =~ s/\.L/\$L/ if ($masm);
+        }
+        $ret;
+    }
+    sub out {
+        my $self = shift;
+
+        if (!$masm) {
+            $self->{value};
+        } elsif ($self->{value} ne "$current_function->{name}:") {
+            $self->{value};
+        } elsif ($current_function->{abi} eq "svr4") {
+            my $func =  "$current_function->{name}      PROC\n".
+                        "       mov     QWORD PTR 8[rsp],rdi\t;WIN64 prologue\n".
+                        "       mov     QWORD PTR 16[rsp],rsi\n";
+            my $narg = $current_function->{narg};
+            $narg=6 if (!defined($narg));
+            $func .= "  mov     rdi,rcx\n" if ($narg>0);
+            $func .= "  mov     rsi,rdx\n" if ($narg>1);
+            $func .= "  mov     rdx,r8\n"  if ($narg>2);
+            $func .= "  mov     rcx,r9\n"  if ($narg>3);
+            $func .= "  mov     r8,QWORD PTR 40[rsp]\n" if ($narg>4);
+            $func .= "  mov     r9,QWORD PTR 48[rsp]\n" if ($narg>5);
+            $func .= "\n";
+        } else {
+           "$current_function->{name}   PROC";
+        }
+    }
+}
+{ package expr;         # pick up expressioins
+    sub re {
+        my      $self = shift;  # single instance is enough...
+        local   *line = shift;
+        undef   $ret;
+
+        if ($line =~ /(^[^,]+)/) {
+            $self->{value} = $1;
+            $ret = $self;
+            $line = substr($line,@+[0]); $line =~ s/^\s+//;
+
+            $self->{value} =~ s/\.L/\$L/g if ($masm);
+        }
+        $ret;
+    }
+    sub out {
+        my $self = shift;
+        $self->{value};
+    }
+}
+{ package directive;    # pick up directives, which start with .
+    sub re {
+        my      $self = shift;  # single instance is enough...
+        local   *line = shift;
+        undef   $ret;
+        my      $dir;
+        my      %opcode =       # lea 2f-1f(%rip),%dst; 1: nop; 2:
+                (       "%rax"=>0x01058d48,     "%rcx"=>0x010d8d48,
+                        "%rdx"=>0x01158d48,     "%rbx"=>0x011d8d48,
+                        "%rsp"=>0x01258d48,     "%rbp"=>0x012d8d48,
+                        "%rsi"=>0x01358d48,     "%rdi"=>0x013d8d48,
+                        "%r8" =>0x01058d4c,     "%r9" =>0x010d8d4c,
+                        "%r10"=>0x01158d4c,     "%r11"=>0x011d8d4c,
+                        "%r12"=>0x01258d4c,     "%r13"=>0x012d8d4c,
+                        "%r14"=>0x01358d4c,     "%r15"=>0x013d8d4c      );
+
+        if ($line =~ /^\s*(\.\w+)/) {
+            if (!$masm) {
+                $self->{value} = $1;
+                $line =~ s/\@abi\-omnipotent/\@function/;
+                $line =~ s/\@function.*/\@function/;
+                if ($line =~ /\.picmeup\s+(%r[\w]+)/i) {
+                    $self->{value} = sprintf "\t.long\t0x%x,0x90000000",$opcode{$1};
+                } elsif ($line =~ /\.asciz\s+"(.*)"$/) {
+                    $self->{value} = ".byte\t".join(",",unpack("C*",$1),0);
+                } elsif ($line =~ /\.extern/) {
+                    $self->{value} = ""; # swallow extern
+                } else {
+                    $self->{value} = $line;
+                }
+                $line = "";
+                return $self;
+            }
+
+            $dir = $1;
+            $ret = $self;
+            undef $self->{value};
+            $line = substr($line,@+[0]); $line =~ s/^\s+//;
+            SWITCH: for ($dir) {
+                /\.(text)/
+                            && do { my $v=undef;
+                                    $v="$current_segment\tENDS\n" if ($current_segment);
+                                    $current_segment = "_$1\$";
+                                    $current_segment =~ tr/[a-z]/[A-Z]/;
+                                    $v.="$current_segment\tSEGMENT ";
+                                    $v.=$masm>=$masmref ? "ALIGN(64)" : "PAGE";
+                                    $v.=" 'CODE'";
+                                    $self->{value} = $v;
+                                    last;
+                                  };
+                /\.extern/  && do { $self->{value} = "EXTRN\t".$line.":BYTE"; last;  };
+                /\.globl/   && do { $self->{value} = "PUBLIC\t".$line; last; };
+                /\.type/    && do { ($sym,$type,$narg) = split(',',$line);
+                                    if ($type eq "\@function") {
+                                        undef $current_function;
+                                        $current_function->{name} = $sym;
+                                        $current_function->{abi}  = "svr4";
+                                        $current_function->{narg} = $narg;
+                                    } elsif ($type eq "\@abi-omnipotent") {
+                                        undef $current_function;
+                                        $current_function->{name} = $sym;
+                                    }
+                                    last;
+                                  };
+                /\.size/    && do { if (defined($current_function)) {
+                                        $self->{value}="$current_function->{name}\tENDP";
+                                        undef $current_function;
+                                    }
+                                    last;
+                                  };
+                /\.align/   && do { $self->{value} = "ALIGN\t".$line; last; };
+                /\.(byte|value|long|quad)/
+                            && do { my @arr = split(',',$line);
+                                    my $sz  = substr($1,0,1);
+                                    my $last = pop(@arr);
+                                    my $conv = sub  {   my $var=shift;
+                                                        if ($var=~s/0x([0-9a-f]+)/0$1h/i) { $var; }
+                                                        else { sprintf"0%Xh",$var; }
+                                                    };  
+
+                                    $sz =~ tr/bvlq/BWDQ/;
+                                    $self->{value} = "\tD$sz\t";
+                                    for (@arr) { $self->{value} .= &$conv($_).","; }
+                                    $self->{value} .= &$conv($last);
+                                    last;
+                                  };
+                /\.picmeup/ && do { $self->{value} = sprintf"\tDD\t 0%Xh,090000000h",$opcode{$line};
+                                    last;
+                                  };
+                /\.asciz/   && do { if ($line =~ /^"(.*)"$/) {
+                                        my @str=unpack("C*",$1);
+                                        push @str,0;
+                                        while ($#str>15) {
+                                            $self->{value}.="DB\t"
+                                                .join(",",@str[0..15])."\n";
+                                            foreach (0..15) { shift @str; }
+                                        }
+                                        $self->{value}.="DB\t"
+                                                .join(",",@str) if (@str);
+                                    }
+                                    last;
+                                  };
+            }
+            $line = "";
+        }
+
+        $ret;
+    }
+    sub out {
+        my $self = shift;
+        $self->{value};
+    }
+}
+
+while($line=<>) {
+
+    chomp($line);
+
+    $line =~ s|[#!].*$||;       # get rid of asm-style comments...
+    $line =~ s|/\*.*\*/||;      # ... and C-style comments...
+    $line =~ s|^\s+||;          # ... and skip white spaces in beginning
+
+    undef $label;
+    undef $opcode;
+    undef $dst;
+    undef $src;
+    undef $sz;
+
+    if ($label=label->re(\$line))       { print $label->out(); }
+
+    if (directive->re(\$line)) {
+        printf "%s",directive->out();
+    } elsif ($opcode=opcode->re(\$line)) { ARGUMENT: {
+
+        if ($src=register->re(\$line))  { opcode->size($src->size()); }
+        elsif ($src=const->re(\$line))  { }
+        elsif ($src=ea->re(\$line))     { }
+        elsif ($src=expr->re(\$line))   { }
+
+        last ARGUMENT if ($line !~ /^,/);
+
+        $line = substr($line,1); $line =~ s/^\s+//;
+
+        if ($dst=register->re(\$line))  { opcode->size($dst->size()); }
+        elsif ($dst=const->re(\$line))  { }
+        elsif ($dst=ea->re(\$line))     { }
+
+        } # ARGUMENT:
+
+        $sz=opcode->size();
+
+        if (defined($dst)) {
+            if (!$masm) {
+                printf "\t%s\t%s,%s",   $opcode->out($dst->size()),
+                                        $src->out($sz),$dst->out($sz);
+            } else {
+                printf "\t%s\t%s,%s",   $opcode->out(),
+                                        $dst->out($sz),$src->out($sz);
+            }
+        } elsif (defined($src)) {
+            printf "\t%s\t%s",$opcode->out(),$src->out($sz);
+        } else {
+            printf "\t%s",$opcode->out();
+        }
+    }
+
+    print $line,"\n";
+}
+
+print "\n$current_segment\tENDS\nEND\n" if ($masm);
+
+close STDOUT;
+
+#################################################
+# Cross-reference x86_64 ABI "card"
+#
+#               Unix            Win64
+# %rax          *               *
+# %rbx          -               -
+# %rcx          #4              #1
+# %rdx          #3              #2
+# %rsi          #2              -
+# %rdi          #1              -
+# %rbp          -               -
+# %rsp          -               -
+# %r8           #5              #3
+# %r9           #6              #4
+# %r10          *               *
+# %r11          *               *
+# %r12          -               -
+# %r13          -               -
+# %r14          -               -
+# %r15          -               -
+# 
+# (*)   volatile register
+# (-)   preserved by callee
+# (#)   Nth argument, volatile
+#
+# In Unix terms top of stack is argument transfer area for arguments
+# which could not be accomodated in registers. Or in other words 7th
+# [integer] argument resides at 8(%rsp) upon function entry point.
+# 128 bytes above %rsp constitute a "red zone" which is not touched
+# by signal handlers and can be used as temporal storage without
+# allocating a frame.
+#
+# In Win64 terms N*8 bytes on top of stack is argument transfer area,
+# which belongs to/can be overwritten by callee. N is the number of
+# arguments passed to callee, *but* not less than 4! This means that
+# upon function entry point 5th argument resides at 40(%rsp), as well
+# as that 32 bytes from 8(%rsp) can always be used as temporal
+# storage [without allocating a frame]. One can actually argue that
+# one can assume a "red zone" above stack pointer under Win64 as well.
+# Point is that at apparently no occasion Windows kernel would alter
+# the area above user stack pointer in true asynchronous manner...
+#
+# All the above means that if assembler programmer adheres to Unix
+# register and stack layout, but disregards the "red zone" existense,
+# it's possible to use following prologue and epilogue to "gear" from
+# Unix to Win64 ABI in leaf functions with not more than 6 arguments.
+#
+# omnipotent_function:
+# ifdef WIN64
+#       movq    %rdi,8(%rsp)
+#       movq    %rsi,16(%rsp)
+#       movq    %rcx,%rdi       ; if 1st argument is actually present
+#       movq    %rdx,%rsi       ; if 2nd argument is actually ...
+#       movq    %r8,%rdx        ; if 3rd argument is ...
+#       movq    %r9,%rcx        ; if 4th argument ...
+#       movq    40(%rsp),%r8    ; if 5th ...
+#       movq    48(%rsp),%r9    ; if 6th ...
+# endif
+#       ...
+# ifdef WIN64
+#       movq    8(%rsp),%rdi
+#       movq    16(%rsp),%rsi
+# endif
+#       ret
diff --git a/src/lib/libssl/src/crypto/pqueue/Makefile b/src/lib/libssl/src/crypto/pqueue/Makefile
new file mode 100644
index 0000000000..d0c39d25ce
--- /dev/null
+++ b/src/lib/libssl/src/crypto/pqueue/Makefile
@@ -0,0 +1,84 @@
+#
+# OpenSSL/crypto/pqueue/Makefile
+#
+
+DIR=    pqueue
+TOP=    ../..
+CC=     cc
+INCLUDES=
+CFLAG=-g
+MAKEFILE=       Makefile
+AR=             ar r
+
+CFLAGS= $(INCLUDES) $(CFLAG)
+
+GENERAL=Makefile
+TEST=
+APPS=
+
+LIB=$(TOP)/libcrypto.a
+LIBSRC=pqueue.c
+LIBOBJ=pqueue.o
+
+SRC= $(LIBSRC)
+
+EXHEADER= pqueue.h pq_compat.h
+HEADER= $(EXHEADER)
+
+ALL=    $(GENERAL) $(SRC) $(HEADER)
+
+top:
+        (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
+
+all:    lib
+
+lib:    $(LIBOBJ)
+        $(AR) $(LIB) $(LIBOBJ)
+        $(RANLIB) $(LIB) || echo Never mind.
+        @touch lib
+
+files:
+        $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
+
+links:
+        @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
+        @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
+        @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
+
+install:
+        @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
+        @headerlist="$(EXHEADER)"; for i in $$headerlist ; \
+        do  \
+        (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
+        chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
+        done;
+
+tags:
+        ctags $(SRC)
+
+tests:
+
+lint:
+        lint -DLINT $(INCLUDES) $(SRC)>fluff
+
+depend:
+        @[ -n "$(MAKEDEPEND)" ] # should be set by upper Makefile...
+        $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
+
+dclean:
+        $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
+        mv -f Makefile.new $(MAKEFILE)
+
+clean:
+        rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+pqueue.o: ../../e_os.h ../../include/openssl/bio.h ../../include/openssl/bn.h
+pqueue.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
+pqueue.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+pqueue.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
+pqueue.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+pqueue.o: ../../include/openssl/pq_compat.h ../../include/openssl/safestack.h
+pqueue.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+pqueue.o: ../cryptlib.h pqueue.c pqueue.h
diff --git a/src/lib/libssl/src/crypto/pqueue/pq_test.c b/src/lib/libssl/src/crypto/pqueue/pq_test.c
new file mode 100644
index 0000000000..8d496dfc65
--- /dev/null
+++ b/src/lib/libssl/src/crypto/pqueue/pq_test.c
@@ -0,0 +1,95 @@
+/* crypto/pqueue/pq_test.c */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "pqueue.h"
+
+int
+main(void)
+        {
+        pitem *item;
+        pqueue pq;
+
+        pq = pqueue_new();
+
+        item = pitem_new(3, NULL);
+        pqueue_insert(pq, item);
+
+        item = pitem_new(1, NULL);
+        pqueue_insert(pq, item);
+
+        item = pitem_new(2, NULL);
+        pqueue_insert(pq, item);
+
+        item = pqueue_find(pq, 1);
+        fprintf(stderr, "found %ld\n", item->priority);
+
+        item = pqueue_find(pq, 2);
+        fprintf(stderr, "found %ld\n", item->priority);
+
+        item = pqueue_find(pq, 3);
+        fprintf(stderr, "found %ld\n", item ? item->priority: 0);
+
+        pqueue_print(pq);
+
+        for(item = pqueue_pop(pq); item != NULL; item = pqueue_pop(pq))
+                pitem_free(item);
+
+        pqueue_free(pq);
+        return 0;
+        }
diff --git a/src/lib/libssl/src/crypto/pqueue/pqueue.c b/src/lib/libssl/src/crypto/pqueue/pqueue.c
new file mode 100644
index 0000000000..5cc18527f8
--- /dev/null
+++ b/src/lib/libssl/src/crypto/pqueue/pqueue.c
@@ -0,0 +1,236 @@
+/* crypto/pqueue/pqueue.c */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "cryptlib.h"
+#include <openssl/bn.h>
+#include "pqueue.h"
+
+typedef struct _pqueue
+        {
+        pitem *items;
+        int count;
+        } pqueue_s;
+
+pitem *
+pitem_new(PQ_64BIT priority, void *data)
+        {
+        pitem *item = (pitem *) OPENSSL_malloc(sizeof(pitem));
+        if (item == NULL) return NULL;
+
+        pq_64bit_init(&(item->priority));
+        pq_64bit_assign(&item->priority, &priority);
+
+        item->data = data;
+        item->next = NULL;
+
+        return item;
+        }
+
+void
+pitem_free(pitem *item)
+        {
+        if (item == NULL) return;
+
+        pq_64bit_free(&(item->priority));
+        OPENSSL_free(item);
+        }
+
+pqueue_s *
+pqueue_new()
+        {
+        pqueue_s *pq = (pqueue_s *) OPENSSL_malloc(sizeof(pqueue_s));
+        if (pq == NULL) return NULL;
+
+        memset(pq, 0x00, sizeof(pqueue_s));
+        return pq;
+        }
+
+void
+pqueue_free(pqueue_s *pq)
+        {
+        if (pq == NULL) return;
+
+        OPENSSL_free(pq);
+        }
+
+pitem *
+pqueue_insert(pqueue_s *pq, pitem *item)
+        {
+        pitem *curr, *next;
+
+        if (pq->items == NULL)
+                {
+                pq->items = item;
+                return item;
+                }
+
+        for(curr = NULL, next = pq->items; 
+                next != NULL;
+                curr = next, next = next->next)
+                {
+                if (pq_64bit_gt(&(next->priority), &(item->priority)))
+                        {
+                        item->next = next;
+
+                        if (curr == NULL) 
+                                pq->items = item;
+                        else  
+                                curr->next = item;
+
+                        return item;
+                        }
+                /* duplicates not allowed */
+                if (pq_64bit_eq(&(item->priority), &(next->priority)))
+                        return NULL;
+                }
+
+        item->next = NULL;
+        curr->next = item;
+
+        return item;
+        }
+
+pitem *
+pqueue_peek(pqueue_s *pq)
+        {
+        return pq->items;
+        }
+
+pitem *
+pqueue_pop(pqueue_s *pq)
+        {
+        pitem *item = pq->items;
+
+        if (pq->items != NULL)
+                pq->items = pq->items->next;
+
+        return item;
+        }
+
+pitem *
+pqueue_find(pqueue_s *pq, PQ_64BIT priority)
+        {
+        pitem *next, *prev = NULL;
+        pitem *found = NULL;
+
+        if ( pq->items == NULL)
+                return NULL;
+
+        for ( next = pq->items; next->next != NULL; 
+                  prev = next, next = next->next)
+                {
+                if ( pq_64bit_eq(&(next->priority), &priority))
+                        {
+                        found = next;
+                        break;
+                        }
+                }
+        
+        /* check the one last node */
+        if ( pq_64bit_eq(&(next->priority), &priority))
+                found = next;
+
+        if ( ! found)
+                return NULL;
+
+#if 0 /* find works in peek mode */
+        if ( prev == NULL)
+                pq->items = next->next;
+        else
+                prev->next = next->next;
+#endif
+
+        return found;
+        }
+
+#if PQ_64BIT_IS_INTEGER
+void
+pqueue_print(pqueue_s *pq)
+        {
+        pitem *item = pq->items;
+
+        while(item != NULL)
+                {
+                printf("item\t" PQ_64BIT_PRINT "\n", item->priority);
+                item = item->next;
+                }
+        }
+#endif
+
+pitem *
+pqueue_iterator(pqueue_s *pq)
+        {
+        return pqueue_peek(pq);
+        }
+
+pitem *
+pqueue_next(pitem **item)
+        {
+        pitem *ret;
+
+        if ( item == NULL || *item == NULL)
+                return NULL;
+
+
+        /* *item != NULL */
+        ret = *item;
+        *item = (*item)->next;
+
+        return ret;
+        }
diff --git a/src/lib/libssl/src/crypto/pqueue/pqueue.h b/src/lib/libssl/src/crypto/pqueue/pqueue.h
new file mode 100644
index 0000000000..02386d130e
--- /dev/null
+++ b/src/lib/libssl/src/crypto/pqueue/pqueue.h
@@ -0,0 +1,95 @@
+/* crypto/pqueue/pqueue.h */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_PQUEUE_H
+#define HEADER_PQUEUE_H
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/pq_compat.h>
+
+typedef struct _pqueue *pqueue;
+
+typedef struct _pitem
+        {
+        PQ_64BIT priority;
+        void *data;
+        struct _pitem *next;
+        } pitem;
+
+typedef struct _pitem *piterator;
+
+pitem *pitem_new(PQ_64BIT priority, void *data);
+void   pitem_free(pitem *item);
+
+pqueue pqueue_new(void);
+void   pqueue_free(pqueue pq);
+
+pitem *pqueue_insert(pqueue pq, pitem *item);
+pitem *pqueue_peek(pqueue pq);
+pitem *pqueue_pop(pqueue pq);
+pitem *pqueue_find(pqueue pq, PQ_64BIT priority);
+pitem *pqueue_iterator(pqueue pq);
+pitem *pqueue_next(piterator *iter);
+
+void   pqueue_print(pqueue pq);
+
+#endif /* ! HEADER_PQUEUE_H */
diff --git a/src/lib/libssl/src/crypto/rand/rand_nw.c b/src/lib/libssl/src/crypto/rand/rand_nw.c
new file mode 100644
index 0000000000..f177ffbe82
--- /dev/null
+++ b/src/lib/libssl/src/crypto/rand/rand_nw.c
@@ -0,0 +1,183 @@
+/* crypto/rand/rand_nw.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "cryptlib.h"
+#include <openssl/rand.h>
+#include "rand_lcl.h"
+
+#if defined (OPENSSL_SYS_NETWARE)
+
+#if defined(NETWARE_LIBC)
+#include <nks/thread.h>
+#else
+#include <nwthread.h>
+#endif
+
+extern int GetProcessSwitchCount(void);
+#if !defined(NETWARE_LIBC) || (CURRENT_NDK_THRESHOLD < 509220000)
+extern void *RunningProcess; /* declare here same as found in newer NDKs */
+extern unsigned long GetSuperHighResolutionTimer(void);
+#endif
+
+   /* the FAQ indicates we need to provide at least 20 bytes (160 bits) of seed
+   */
+int RAND_poll(void)
+{
+   unsigned long l;
+   unsigned long tsc;
+   int i; 
+
+      /* There are several options to gather miscellaneous data
+       * but for now we will loop checking the time stamp counter (rdtsc) and
+       * the SuperHighResolutionTimer.  Each iteration will collect 8 bytes
+       * of data but it is treated as only 1 byte of entropy.  The call to
+       * ThreadSwitchWithDelay() will introduce additional variability into
+       * the data returned by rdtsc.
+       *
+       * Applications can agument the seed material by adding additional
+       * stuff with RAND_add() and should probably do so.
+      */
+   l = GetProcessSwitchCount();
+   RAND_add(&l,sizeof(l),1);
+   
+   /* need to cast the void* to unsigned long here */
+   l = (unsigned long)RunningProcess;
+   RAND_add(&l,sizeof(l),1);
+
+   for( i=2; i<ENTROPY_NEEDED; i++)
+   {
+#ifdef __MWERKS__
+      asm 
+      {
+         rdtsc
+         mov tsc, eax        
+      }
+#else
+      asm volatile("rdtsc":"=A" (tsc));
+#endif
+
+      RAND_add(&tsc, sizeof(tsc), 1);
+
+      l = GetSuperHighResolutionTimer();
+      RAND_add(&l, sizeof(l), 0);
+
+# if defined(NETWARE_LIBC)
+      NXThreadYield();
+# else /* NETWARE_CLIB */
+      ThreadSwitchWithDelay();
+# endif
+   }
+
+   return 1;
+}
+
+#endif 
+
diff --git a/src/lib/libssl/src/crypto/rc4/asm/rc4-x86_64.pl b/src/lib/libssl/src/crypto/rc4/asm/rc4-x86_64.pl
index b628daca70..2d47320485 100755
--- a/src/lib/libssl/src/crypto/rc4/asm/rc4-x86_64.pl
+++ b/src/lib/libssl/src/crypto/rc4/asm/rc4-x86_64.pl
@@ -2,29 +2,70 @@
 #
 # ====================================================================
 # Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
-# project. Rights for redistribution and usage in source and binary
-# forms are granted according to the OpenSSL license.
+# project. The module is, however, dual licensed under OpenSSL and
+# CRYPTOGAMS licenses depending on where you obtain it. For further
+# details see http://www.openssl.org/~appro/cryptogams/.
 # ====================================================================
 #
-# Unlike 0.9.7f this code expects RC4_CHAR back in config line! See
-# commentary section in corresponding script in development branch
-# for background information about this option carousel. For those
-# who don't have energy to figure out these gory details, here is
-# basis in form of performance matrix relative to the original
-# 0.9.7e C code-base:
-#
-#               0.9.7e  0.9.7f  this
-# AMD64         1x      3.3x    2.4x
-# EM64T         1x      0.8x    1.5x
-#
-# In other words idea is to trade -25% AMD64 performance to compensate
-# for deterioration and gain +90% on EM64T core. Development branch
-# maintains best performance for either target, i.e. 3.3x for AMD64
-# and 1.5x for EM64T.
+# 2.22x RC4 tune-up:-) It should be noted though that my hand [as in
+# "hand-coded assembler"] doesn't stand for the whole improvement
+# coefficient. It turned out that eliminating RC4_CHAR from config
+# line results in ~40% improvement (yes, even for C implementation).
+# Presumably it has everything to do with AMD cache architecture and
+# RAW or whatever penalties. Once again! The module *requires* config
+# line *without* RC4_CHAR! As for coding "secret," I bet on partial
+# register arithmetics. For example instead of 'inc %r8; and $255,%r8'
+# I simply 'inc %r8b'. Even though optimization manual discourages
+# to operate on partial registers, it turned out to be the best bet.
+# At least for AMD... How IA32E would perform remains to be seen...
+
+# As was shown by Marc Bevand reordering of couple of load operations
+# results in even higher performance gain of 3.3x:-) At least on
+# Opteron... For reference, 1x in this case is RC4_CHAR C-code
+# compiled with gcc 3.3.2, which performs at ~54MBps per 1GHz clock.
+# Latter means that if you want to *estimate* what to expect from
+# *your* Opteron, then multiply 54 by 3.3 and clock frequency in GHz.
+
+# Intel P4 EM64T core was found to run the AMD64 code really slow...
+# The only way to achieve comparable performance on P4 was to keep
+# RC4_CHAR. Kind of ironic, huh? As it's apparently impossible to
+# compose blended code, which would perform even within 30% marginal
+# on either AMD and Intel platforms, I implement both cases. See
+# rc4_skey.c for further details...
+
+# P4 EM64T core appears to be "allergic" to 64-bit inc/dec. Replacing 
+# those with add/sub results in 50% performance improvement of folded
+# loop...
+
+# As was shown by Zou Nanhai loop unrolling can improve Intel EM64T
+# performance by >30% [unlike P4 32-bit case that is]. But this is
+# provided that loads are reordered even more aggressively! Both code
+# pathes, AMD64 and EM64T, reorder loads in essentially same manner
+# as my IA-64 implementation. On Opteron this resulted in modest 5%
+# improvement [I had to test it], while final Intel P4 performance
+# achieves respectful 432MBps on 2.8GHz processor now. For reference.
+# If executed on Xeon, current RC4_CHAR code-path is 2.7x faster than
+# RC4_INT code-path. While if executed on Opteron, it's only 25%
+# slower than the RC4_INT one [meaning that if CPU µ-arch detection
+# is not implemented, then this final RC4_CHAR code-path should be
+# preferred, as it provides better *all-round* performance].
+
+# Intel Core2 was observed to perform poorly on both code paths:-( It
+# apparently suffers from some kind of partial register stall, which
+# occurs in 64-bit mode only [as virtually identical 32-bit loop was
+# observed to outperform 64-bit one by almost 50%]. Adding two movzb to
+# cloop1 boosts its performance by 80%! This loop appears to be optimal
+# fit for Core2 and therefore the code was modified to skip cloop8 on
+# this CPU.
 
 $output=shift;
 
-open STDOUT,">$output" || die "can't open $output: $!";
+$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
+( $xlate="${dir}x86_64-xlate.pl" and -f $xlate ) or
+( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or
+die "can't locate x86_64-xlate.pl";
+
+open STDOUT,"| $^X $xlate $output";
 
 $dat="%rdi";        # arg1
 $len="%rsi";        # arg2
@@ -36,29 +77,101 @@ $out="%rcx";	    # arg4
 $YY="%r12";
 $TY="%r13";
 
-$code=<<___;;
+$code=<<___;
 .text
 
 .globl  RC4
-.type   RC4,\@function
+.type   RC4,\@function,4
 .align  16
 RC4:    or      $len,$len
         jne     .Lentry
-        repret
+        ret
 .Lentry:
         push    %r12
         push    %r13
 
-        add     \$2,$dat
-        movzb   -2($dat),$XX[0]#d
-        movzb   -1($dat),$YY#d
+        add     \$8,$dat
+        movl    -8($dat),$XX[0]#d
+        movl    -4($dat),$YY#d
+        cmpl    \$-1,256($dat)
+        je      .LRC4_CHAR
+        inc     $XX[0]#b
+        movl    ($dat,$XX[0],4),$TX[0]#d
+        test    \$-8,$len
+        jz      .Lloop1
+        jmp     .Lloop8
+.align  16
+.Lloop8:
+___
+for ($i=0;$i<8;$i++) {
+$code.=<<___;
+        add     $TX[0]#b,$YY#b
+        mov     $XX[0],$XX[1]
+        movl    ($dat,$YY,4),$TY#d
+        ror     \$8,%rax                        # ror is redundant when $i=0
+        inc     $XX[1]#b
+        movl    ($dat,$XX[1],4),$TX[1]#d
+        cmp     $XX[1],$YY
+        movl    $TX[0]#d,($dat,$YY,4)
+        cmove   $TX[0],$TX[1]
+        movl    $TY#d,($dat,$XX[0],4)
+        add     $TX[0]#b,$TY#b
+        movb    ($dat,$TY,4),%al
+___
+push(@TX,shift(@TX)); push(@XX,shift(@XX));     # "rotate" registers
+}
+$code.=<<___;
+        ror     \$8,%rax
+        sub     \$8,$len
+
+        xor     ($inp),%rax
+        add     \$8,$inp
+        mov     %rax,($out)
+        add     \$8,$out
 
+        test    \$-8,$len
+        jnz     .Lloop8
+        cmp     \$0,$len
+        jne     .Lloop1
+___
+$code.=<<___;
+.Lexit:
+        sub     \$1,$XX[0]#b
+        movl    $XX[0]#d,-8($dat)
+        movl    $YY#d,-4($dat)
+
+        pop     %r13
+        pop     %r12
+        ret
+.align  16
+.Lloop1:
+        add     $TX[0]#b,$YY#b
+        movl    ($dat,$YY,4),$TY#d
+        movl    $TX[0]#d,($dat,$YY,4)
+        movl    $TY#d,($dat,$XX[0],4)
+        add     $TY#b,$TX[0]#b
+        inc     $XX[0]#b
+        movl    ($dat,$TX[0],4),$TY#d
+        movl    ($dat,$XX[0],4),$TX[0]#d
+        xorb    ($inp),$TY#b
+        inc     $inp
+        movb    $TY#b,($out)
+        inc     $out
+        dec     $len
+        jnz     .Lloop1
+        jmp     .Lexit
+
+.align  16
+.LRC4_CHAR:
         add     \$1,$XX[0]#b
         movzb   ($dat,$XX[0]),$TX[0]#d
         test    \$-8,$len
         jz      .Lcloop1
+        cmp     \$0,260($dat)
+        jnz     .Lcloop1
         push    %rbx
-.align  16      # incidentally aligned already
+        jmp     .Lcloop8
+.align  16
 .Lcloop8:
         mov     ($inp),%eax
         mov     4($inp),%ebx
@@ -114,15 +227,9 @@ $code.=<<___;
         pop     %rbx
         cmp     \$0,$len
         jne     .Lcloop1
-.Lexit:
-        sub     \$1,$XX[0]#b
-        movb    $XX[0]#b,-2($dat)
-        movb    $YY#b,-1($dat)
-
-        pop     %r13
-        pop     %r12
-        repret
-
+        jmp     .Lexit
+___
+$code.=<<___;
 .align  16
 .Lcloop1:
         add     $TX[0]#b,$YY#b
@@ -131,6 +238,8 @@ $code.=<<___;
         movb    $TY#b,($dat,$XX[0])
         add     $TX[0]#b,$TY#b
         add     \$1,$XX[0]#b
+        movzb   $TY#b,$TY#d
+        movzb   $XX[0]#b,$XX[0]#d
         movzb   ($dat,$TY),$TY#d
         movzb   ($dat,$XX[0]),$TX[0]#d
         xorb    ($inp),$TY#b
@@ -143,8 +252,113 @@ $code.=<<___;
 .size   RC4,.-RC4
 ___
 
-$code =~ s/#([bwd])/$1/gm;
+$idx="%r8";
+$ido="%r9";
+
+$code.=<<___;
+.extern OPENSSL_ia32cap_P
+.globl  RC4_set_key
+.type   RC4_set_key,\@function,3
+.align  16
+RC4_set_key:
+        lea     8($dat),$dat
+        lea     ($inp,$len),$inp
+        neg     $len
+        mov     $len,%rcx
+        xor     %eax,%eax
+        xor     $ido,$ido
+        xor     %r10,%r10
+        xor     %r11,%r11
 
-$code =~ s/repret/.byte\t0xF3,0xC3/gm;
+        mov     OPENSSL_ia32cap_P(%rip),$idx#d
+        bt      \$20,$idx#d
+        jnc     .Lw1stloop
+        bt      \$30,$idx#d
+        setc    $ido#b
+        mov     $ido#d,260($dat)
+        jmp     .Lc1stloop
+
+.align  16
+.Lw1stloop:
+        mov     %eax,($dat,%rax,4)
+        add     \$1,%al
+        jnc     .Lw1stloop
+
+        xor     $ido,$ido
+        xor     $idx,$idx
+.align  16
+.Lw2ndloop:
+        mov     ($dat,$ido,4),%r10d
+        add     ($inp,$len,1),$idx#b
+        add     %r10b,$idx#b
+        add     \$1,$len
+        mov     ($dat,$idx,4),%r11d
+        cmovz   %rcx,$len
+        mov     %r10d,($dat,$idx,4)
+        mov     %r11d,($dat,$ido,4)
+        add     \$1,$ido#b
+        jnc     .Lw2ndloop
+        jmp     .Lexit_key
+
+.align  16
+.Lc1stloop:
+        mov     %al,($dat,%rax)
+        add     \$1,%al
+        jnc     .Lc1stloop
+
+        xor     $ido,$ido
+        xor     $idx,$idx
+.align  16
+.Lc2ndloop:
+        mov     ($dat,$ido),%r10b
+        add     ($inp,$len),$idx#b
+        add     %r10b,$idx#b
+        add     \$1,$len
+        mov     ($dat,$idx),%r11b
+        jnz     .Lcnowrap
+        mov     %rcx,$len
+.Lcnowrap:
+        mov     %r10b,($dat,$idx)
+        mov     %r11b,($dat,$ido)
+        add     \$1,$ido#b
+        jnc     .Lc2ndloop
+        movl    \$-1,256($dat)
+
+.align  16
+.Lexit_key:
+        xor     %eax,%eax
+        mov     %eax,-8($dat)
+        mov     %eax,-4($dat)
+        ret
+.size   RC4_set_key,.-RC4_set_key
+
+.globl  RC4_options
+.type   RC4_options,\@function,0
+.align  16
+RC4_options:
+        .picmeup %rax
+        lea     .Lopts-.(%rax),%rax
+        mov     OPENSSL_ia32cap_P(%rip),%edx
+        bt      \$20,%edx
+        jnc     .Ldone
+        add     \$12,%rax
+        bt      \$30,%edx
+        jnc     .Ldone
+        add     \$13,%rax
+.Ldone:
+        ret
+.align  64
+.Lopts:
+.asciz  "rc4(8x,int)"
+.asciz  "rc4(8x,char)"
+.asciz  "rc4(1x,char)"
+.asciz  "RC4 for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+.align  64
+.size   RC4_options,.-RC4_options
+___
+
+$code =~ s/#([bwd])/$1/gm;
 
 print $code;
+
+close STDOUT;
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_depr.c b/src/lib/libssl/src/crypto/rsa/rsa_depr.c
new file mode 100644
index 0000000000..a859ded987
--- /dev/null
+++ b/src/lib/libssl/src/crypto/rsa/rsa_depr.c
@@ -0,0 +1,101 @@
+/* crypto/rsa/rsa_depr.c */
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NB: This file contains deprecated functions (compatibility wrappers to the
+ * "new" versions). */
+
+#include <stdio.h>
+#include <time.h>
+#include "cryptlib.h"
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+
+#ifdef OPENSSL_NO_DEPRECATED
+
+static void *dummy=&dummy;
+
+#else
+
+RSA *RSA_generate_key(int bits, unsigned long e_value,
+             void (*callback)(int,int,void *), void *cb_arg)
+        {
+        BN_GENCB cb;
+        int i;
+        RSA *rsa = RSA_new();
+        BIGNUM *e = BN_new();
+
+        if(!rsa || !e) goto err;
+
+        /* The problem is when building with 8, 16, or 32 BN_ULONG,
+         * unsigned long can be larger */
+        for (i=0; i<(int)sizeof(unsigned long)*8; i++)
+                {
+                if (e_value & (1UL<<i))
+                        if (BN_set_bit(e,i) == 0)
+                                goto err;
+                }
+
+        BN_GENCB_set_old(&cb, callback, cb_arg);
+
+        if(RSA_generate_key_ex(rsa, bits, e, &cb)) {
+                BN_free(e);
+                return rsa;
+        }
+err:
+        if(e) BN_free(e);
+        if(rsa) RSA_free(rsa);
+        return 0;
+        }
+#endif
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_pss.c b/src/lib/libssl/src/crypto/rsa/rsa_pss.c
index 2815628f5f..e19d18c5b9 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_pss.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_pss.c
@@ -64,7 +64,11 @@
 #include <openssl/rand.h>
 #include <openssl/sha.h>
 
-const static unsigned char zeroes[] = {0,0,0,0,0,0,0,0};
+static const unsigned char zeroes[] = {0,0,0,0,0,0,0,0};
+
+#if defined(_MSC_VER) && defined(_ARM_)
+#pragma optimize("g", off)
+#endif
 
 int RSA_verify_PKCS1_PSS(RSA *rsa, const unsigned char *mHash,
                         const EVP_MD *Hash, const unsigned char *EM, int sLen)
@@ -259,3 +263,7 @@ int RSA_padding_add_PKCS1_PSS(RSA *rsa, unsigned char *EM,
         return ret;
 
         }
+
+#if defined(_MSC_VER)
+#pragma optimize("",on)
+#endif
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_x931.c b/src/lib/libssl/src/crypto/rsa/rsa_x931.c
index df3c45f802..e918654176 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_x931.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_x931.c
@@ -105,7 +105,7 @@ int RSA_padding_add_X931(unsigned char *to, int tlen,
 int RSA_padding_check_X931(unsigned char *to, int tlen,
              const unsigned char *from, int flen, int num)
         {
-        int i,j;
+        int i = 0,j;
         const unsigned char *p;
 
         p=from;
diff --git a/src/lib/libssl/src/crypto/seed/Makefile b/src/lib/libssl/src/crypto/seed/Makefile
new file mode 100644
index 0000000000..f9de27b288
--- /dev/null
+++ b/src/lib/libssl/src/crypto/seed/Makefile
@@ -0,0 +1,87 @@
+#
+# crypto/seed/Makefile
+#
+
+DIR=    seed
+TOP=    ../..
+CC=     cc
+CPP=    $(CC) -E
+INCLUDES=
+CFLAG=-g
+MAKEFILE=       Makefile
+AR=             ar r
+
+CFLAGS= $(INCLUDES) $(CFLAG)
+
+GENERAL=Makefile
+TEST=
+APPS=
+
+LIB=$(TOP)/libcrypto.a
+LIBSRC=seed.c seed_ecb.c seed_cbc.c seed_cfb.c seed_ofb.c
+LIBOBJ=seed.o seed_ecb.o seed_cbc.o seed_cfb.o seed_ofb.o
+
+SRC= $(LIBSRC)
+
+EXHEADER= seed.h
+HEADER= seed_locl.h $(EXHEADER)
+
+ALL=    $(GENERAL) $(SRC) $(HEADER)
+
+top:
+        (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
+
+all:    lib
+
+lib:    $(LIBOBJ)
+        $(AR) $(LIB) $(LIBOBJ)
+        $(RANLIB) $(LIB) || echo Never mind.
+        @touch lib
+
+files:
+        $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
+
+links:
+        @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
+        @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
+        @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
+
+install:
+        @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
+        @headerlist="$(EXHEADER)"; for i in $$headerlist ; \
+        do  \
+        (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
+        chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
+        done;
+
+tags:
+        ctags $(SRC)
+
+tests:
+
+lint:
+        lint -DLINT $(INCLUDES) $(SRC)>fluff
+
+depend:
+        @[ -n "$(MAKEDEPEND)" ] # should be set by upper Makefile...
+        $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
+
+dclean:
+        $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
+        mv -f Makefile.new $(MAKEFILE)
+
+clean:
+        rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+seed.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
+seed.o: ../../include/openssl/seed.h seed.c seed_locl.h
+seed_cbc.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
+seed_cbc.o: ../../include/openssl/seed.h seed_cbc.c seed_locl.h
+seed_cfb.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
+seed_cfb.o: ../../include/openssl/seed.h seed_cfb.c seed_locl.h
+seed_ecb.o: ../../include/openssl/opensslconf.h ../../include/openssl/seed.h
+seed_ecb.o: seed_ecb.c
+seed_ofb.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
+seed_ofb.o: ../../include/openssl/seed.h seed_locl.h seed_ofb.c
diff --git a/src/lib/libssl/src/crypto/seed/seed.c b/src/lib/libssl/src/crypto/seed/seed.c
new file mode 100644
index 0000000000..125dd7d66f
--- /dev/null
+++ b/src/lib/libssl/src/crypto/seed/seed.c
@@ -0,0 +1,286 @@
+/*
+ * Copyright (c) 2007 KISA(Korea Information Security Agency). All rights reserved.  
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Neither the name of author nor the names of its contributors may
+ *    be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+#ifndef OPENSSL_NO_SEED
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#ifdef WIN32
+#include <memory.h>
+#endif
+
+#include <openssl/seed.h>
+#include "seed_locl.h"
+
+static seed_word SS[4][256] = { {
+        0x2989a1a8, 0x05858184, 0x16c6d2d4, 0x13c3d3d0, 0x14445054, 0x1d0d111c, 0x2c8ca0ac, 0x25052124,
+        0x1d4d515c, 0x03434340, 0x18081018, 0x1e0e121c, 0x11415150, 0x3cccf0fc, 0x0acac2c8, 0x23436360,
+        0x28082028, 0x04444044, 0x20002020, 0x1d8d919c, 0x20c0e0e0, 0x22c2e2e0, 0x08c8c0c8, 0x17071314,
+        0x2585a1a4, 0x0f8f838c, 0x03030300, 0x3b4b7378, 0x3b8bb3b8, 0x13031310, 0x12c2d2d0, 0x2ecee2ec,
+        0x30407070, 0x0c8c808c, 0x3f0f333c, 0x2888a0a8, 0x32023230, 0x1dcdd1dc, 0x36c6f2f4, 0x34447074,
+        0x2ccce0ec, 0x15859194, 0x0b0b0308, 0x17475354, 0x1c4c505c, 0x1b4b5358, 0x3d8db1bc, 0x01010100,
+        0x24042024, 0x1c0c101c, 0x33437370, 0x18889098, 0x10001010, 0x0cccc0cc, 0x32c2f2f0, 0x19c9d1d8,
+        0x2c0c202c, 0x27c7e3e4, 0x32427270, 0x03838380, 0x1b8b9398, 0x11c1d1d0, 0x06868284, 0x09c9c1c8,
+        0x20406060, 0x10405050, 0x2383a3a0, 0x2bcbe3e8, 0x0d0d010c, 0x3686b2b4, 0x1e8e929c, 0x0f4f434c,
+        0x3787b3b4, 0x1a4a5258, 0x06c6c2c4, 0x38487078, 0x2686a2a4, 0x12021210, 0x2f8fa3ac, 0x15c5d1d4,
+        0x21416160, 0x03c3c3c0, 0x3484b0b4, 0x01414140, 0x12425250, 0x3d4d717c, 0x0d8d818c, 0x08080008,
+        0x1f0f131c, 0x19899198, 0x00000000, 0x19091118, 0x04040004, 0x13435350, 0x37c7f3f4, 0x21c1e1e0,
+        0x3dcdf1fc, 0x36467274, 0x2f0f232c, 0x27072324, 0x3080b0b0, 0x0b8b8388, 0x0e0e020c, 0x2b8ba3a8,
+        0x2282a2a0, 0x2e4e626c, 0x13839390, 0x0d4d414c, 0x29496168, 0x3c4c707c, 0x09090108, 0x0a0a0208,
+        0x3f8fb3bc, 0x2fcfe3ec, 0x33c3f3f0, 0x05c5c1c4, 0x07878384, 0x14041014, 0x3ecef2fc, 0x24446064,
+        0x1eced2dc, 0x2e0e222c, 0x0b4b4348, 0x1a0a1218, 0x06060204, 0x21012120, 0x2b4b6368, 0x26466264,
+        0x02020200, 0x35c5f1f4, 0x12829290, 0x0a8a8288, 0x0c0c000c, 0x3383b3b0, 0x3e4e727c, 0x10c0d0d0,
+        0x3a4a7278, 0x07474344, 0x16869294, 0x25c5e1e4, 0x26062224, 0x00808080, 0x2d8da1ac, 0x1fcfd3dc,
+        0x2181a1a0, 0x30003030, 0x37073334, 0x2e8ea2ac, 0x36063234, 0x15051114, 0x22022220, 0x38083038,
+        0x34c4f0f4, 0x2787a3a4, 0x05454144, 0x0c4c404c, 0x01818180, 0x29c9e1e8, 0x04848084, 0x17879394,
+        0x35053134, 0x0bcbc3c8, 0x0ecec2cc, 0x3c0c303c, 0x31417170, 0x11011110, 0x07c7c3c4, 0x09898188,
+        0x35457174, 0x3bcbf3f8, 0x1acad2d8, 0x38c8f0f8, 0x14849094, 0x19495158, 0x02828280, 0x04c4c0c4,
+        0x3fcff3fc, 0x09494148, 0x39093138, 0x27476364, 0x00c0c0c0, 0x0fcfc3cc, 0x17c7d3d4, 0x3888b0b8,
+        0x0f0f030c, 0x0e8e828c, 0x02424240, 0x23032320, 0x11819190, 0x2c4c606c, 0x1bcbd3d8, 0x2484a0a4,
+        0x34043034, 0x31c1f1f0, 0x08484048, 0x02c2c2c0, 0x2f4f636c, 0x3d0d313c, 0x2d0d212c, 0x00404040,
+        0x3e8eb2bc, 0x3e0e323c, 0x3c8cb0bc, 0x01c1c1c0, 0x2a8aa2a8, 0x3a8ab2b8, 0x0e4e424c, 0x15455154,
+        0x3b0b3338, 0x1cccd0dc, 0x28486068, 0x3f4f737c, 0x1c8c909c, 0x18c8d0d8, 0x0a4a4248, 0x16465254,
+        0x37477374, 0x2080a0a0, 0x2dcde1ec, 0x06464244, 0x3585b1b4, 0x2b0b2328, 0x25456164, 0x3acaf2f8,
+        0x23c3e3e0, 0x3989b1b8, 0x3181b1b0, 0x1f8f939c, 0x1e4e525c, 0x39c9f1f8, 0x26c6e2e4, 0x3282b2b0,
+        0x31013130, 0x2acae2e8, 0x2d4d616c, 0x1f4f535c, 0x24c4e0e4, 0x30c0f0f0, 0x0dcdc1cc, 0x08888088,
+        0x16061214, 0x3a0a3238, 0x18485058, 0x14c4d0d4, 0x22426260, 0x29092128, 0x07070304, 0x33033330,
+        0x28c8e0e8, 0x1b0b1318, 0x05050104, 0x39497178, 0x10809090, 0x2a4a6268, 0x2a0a2228, 0x1a8a9298
+},      {
+        0x38380830, 0xe828c8e0, 0x2c2d0d21, 0xa42686a2, 0xcc0fcfc3, 0xdc1eced2, 0xb03383b3, 0xb83888b0,
+        0xac2f8fa3, 0x60204060, 0x54154551, 0xc407c7c3, 0x44044440, 0x6c2f4f63, 0x682b4b63, 0x581b4b53,
+        0xc003c3c3, 0x60224262, 0x30330333, 0xb43585b1, 0x28290921, 0xa02080a0, 0xe022c2e2, 0xa42787a3,
+        0xd013c3d3, 0x90118191, 0x10110111, 0x04060602, 0x1c1c0c10, 0xbc3c8cb0, 0x34360632, 0x480b4b43,
+        0xec2fcfe3, 0x88088880, 0x6c2c4c60, 0xa82888a0, 0x14170713, 0xc404c4c0, 0x14160612, 0xf434c4f0,
+        0xc002c2c2, 0x44054541, 0xe021c1e1, 0xd416c6d2, 0x3c3f0f33, 0x3c3d0d31, 0x8c0e8e82, 0x98188890,
+        0x28280820, 0x4c0e4e42, 0xf436c6f2, 0x3c3e0e32, 0xa42585a1, 0xf839c9f1, 0x0c0d0d01, 0xdc1fcfd3,
+        0xd818c8d0, 0x282b0b23, 0x64264662, 0x783a4a72, 0x24270723, 0x2c2f0f23, 0xf031c1f1, 0x70324272,
+        0x40024242, 0xd414c4d0, 0x40014141, 0xc000c0c0, 0x70334373, 0x64274763, 0xac2c8ca0, 0x880b8b83,
+        0xf437c7f3, 0xac2d8da1, 0x80008080, 0x1c1f0f13, 0xc80acac2, 0x2c2c0c20, 0xa82a8aa2, 0x34340430,
+        0xd012c2d2, 0x080b0b03, 0xec2ecee2, 0xe829c9e1, 0x5c1d4d51, 0x94148490, 0x18180810, 0xf838c8f0,
+        0x54174753, 0xac2e8ea2, 0x08080800, 0xc405c5c1, 0x10130313, 0xcc0dcdc1, 0x84068682, 0xb83989b1,
+        0xfc3fcff3, 0x7c3d4d71, 0xc001c1c1, 0x30310131, 0xf435c5f1, 0x880a8a82, 0x682a4a62, 0xb03181b1,
+        0xd011c1d1, 0x20200020, 0xd417c7d3, 0x00020202, 0x20220222, 0x04040400, 0x68284860, 0x70314171,
+        0x04070703, 0xd81bcbd3, 0x9c1d8d91, 0x98198991, 0x60214161, 0xbc3e8eb2, 0xe426c6e2, 0x58194951,
+        0xdc1dcdd1, 0x50114151, 0x90108090, 0xdc1cccd0, 0x981a8a92, 0xa02383a3, 0xa82b8ba3, 0xd010c0d0,
+        0x80018181, 0x0c0f0f03, 0x44074743, 0x181a0a12, 0xe023c3e3, 0xec2ccce0, 0x8c0d8d81, 0xbc3f8fb3,
+        0x94168692, 0x783b4b73, 0x5c1c4c50, 0xa02282a2, 0xa02181a1, 0x60234363, 0x20230323, 0x4c0d4d41,
+        0xc808c8c0, 0x9c1e8e92, 0x9c1c8c90, 0x383a0a32, 0x0c0c0c00, 0x2c2e0e22, 0xb83a8ab2, 0x6c2e4e62,
+        0x9c1f8f93, 0x581a4a52, 0xf032c2f2, 0x90128292, 0xf033c3f3, 0x48094941, 0x78384870, 0xcc0cccc0,
+        0x14150511, 0xf83bcbf3, 0x70304070, 0x74354571, 0x7c3f4f73, 0x34350531, 0x10100010, 0x00030303,
+        0x64244460, 0x6c2d4d61, 0xc406c6c2, 0x74344470, 0xd415c5d1, 0xb43484b0, 0xe82acae2, 0x08090901,
+        0x74364672, 0x18190911, 0xfc3ecef2, 0x40004040, 0x10120212, 0xe020c0e0, 0xbc3d8db1, 0x04050501,
+        0xf83acaf2, 0x00010101, 0xf030c0f0, 0x282a0a22, 0x5c1e4e52, 0xa82989a1, 0x54164652, 0x40034343,
+        0x84058581, 0x14140410, 0x88098981, 0x981b8b93, 0xb03080b0, 0xe425c5e1, 0x48084840, 0x78394971,
+        0x94178793, 0xfc3cccf0, 0x1c1e0e12, 0x80028282, 0x20210121, 0x8c0c8c80, 0x181b0b13, 0x5c1f4f53,
+        0x74374773, 0x54144450, 0xb03282b2, 0x1c1d0d11, 0x24250521, 0x4c0f4f43, 0x00000000, 0x44064642,
+        0xec2dcde1, 0x58184850, 0x50124252, 0xe82bcbe3, 0x7c3e4e72, 0xd81acad2, 0xc809c9c1, 0xfc3dcdf1,
+        0x30300030, 0x94158591, 0x64254561, 0x3c3c0c30, 0xb43686b2, 0xe424c4e0, 0xb83b8bb3, 0x7c3c4c70,
+        0x0c0e0e02, 0x50104050, 0x38390931, 0x24260622, 0x30320232, 0x84048480, 0x68294961, 0x90138393,
+        0x34370733, 0xe427c7e3, 0x24240420, 0xa42484a0, 0xc80bcbc3, 0x50134353, 0x080a0a02, 0x84078783,
+        0xd819c9d1, 0x4c0c4c40, 0x80038383, 0x8c0f8f83, 0xcc0ecec2, 0x383b0b33, 0x480a4a42, 0xb43787b3
+},      {
+        0xa1a82989, 0x81840585, 0xd2d416c6, 0xd3d013c3, 0x50541444, 0x111c1d0d, 0xa0ac2c8c, 0x21242505,
+        0x515c1d4d, 0x43400343, 0x10181808, 0x121c1e0e, 0x51501141, 0xf0fc3ccc, 0xc2c80aca, 0x63602343,
+        0x20282808, 0x40440444, 0x20202000, 0x919c1d8d, 0xe0e020c0, 0xe2e022c2, 0xc0c808c8, 0x13141707,
+        0xa1a42585, 0x838c0f8f, 0x03000303, 0x73783b4b, 0xb3b83b8b, 0x13101303, 0xd2d012c2, 0xe2ec2ece,
+        0x70703040, 0x808c0c8c, 0x333c3f0f, 0xa0a82888, 0x32303202, 0xd1dc1dcd, 0xf2f436c6, 0x70743444,
+        0xe0ec2ccc, 0x91941585, 0x03080b0b, 0x53541747, 0x505c1c4c, 0x53581b4b, 0xb1bc3d8d, 0x01000101,
+        0x20242404, 0x101c1c0c, 0x73703343, 0x90981888, 0x10101000, 0xc0cc0ccc, 0xf2f032c2, 0xd1d819c9,
+        0x202c2c0c, 0xe3e427c7, 0x72703242, 0x83800383, 0x93981b8b, 0xd1d011c1, 0x82840686, 0xc1c809c9,
+        0x60602040, 0x50501040, 0xa3a02383, 0xe3e82bcb, 0x010c0d0d, 0xb2b43686, 0x929c1e8e, 0x434c0f4f,
+        0xb3b43787, 0x52581a4a, 0xc2c406c6, 0x70783848, 0xa2a42686, 0x12101202, 0xa3ac2f8f, 0xd1d415c5,
+        0x61602141, 0xc3c003c3, 0xb0b43484, 0x41400141, 0x52501242, 0x717c3d4d, 0x818c0d8d, 0x00080808,
+        0x131c1f0f, 0x91981989, 0x00000000, 0x11181909, 0x00040404, 0x53501343, 0xf3f437c7, 0xe1e021c1,
+        0xf1fc3dcd, 0x72743646, 0x232c2f0f, 0x23242707, 0xb0b03080, 0x83880b8b, 0x020c0e0e, 0xa3a82b8b,
+        0xa2a02282, 0x626c2e4e, 0x93901383, 0x414c0d4d, 0x61682949, 0x707c3c4c, 0x01080909, 0x02080a0a,
+        0xb3bc3f8f, 0xe3ec2fcf, 0xf3f033c3, 0xc1c405c5, 0x83840787, 0x10141404, 0xf2fc3ece, 0x60642444,
+        0xd2dc1ece, 0x222c2e0e, 0x43480b4b, 0x12181a0a, 0x02040606, 0x21202101, 0x63682b4b, 0x62642646,
+        0x02000202, 0xf1f435c5, 0x92901282, 0x82880a8a, 0x000c0c0c, 0xb3b03383, 0x727c3e4e, 0xd0d010c0,
+        0x72783a4a, 0x43440747, 0x92941686, 0xe1e425c5, 0x22242606, 0x80800080, 0xa1ac2d8d, 0xd3dc1fcf,
+        0xa1a02181, 0x30303000, 0x33343707, 0xa2ac2e8e, 0x32343606, 0x11141505, 0x22202202, 0x30383808,
+        0xf0f434c4, 0xa3a42787, 0x41440545, 0x404c0c4c, 0x81800181, 0xe1e829c9, 0x80840484, 0x93941787,
+        0x31343505, 0xc3c80bcb, 0xc2cc0ece, 0x303c3c0c, 0x71703141, 0x11101101, 0xc3c407c7, 0x81880989,
+        0x71743545, 0xf3f83bcb, 0xd2d81aca, 0xf0f838c8, 0x90941484, 0x51581949, 0x82800282, 0xc0c404c4,
+        0xf3fc3fcf, 0x41480949, 0x31383909, 0x63642747, 0xc0c000c0, 0xc3cc0fcf, 0xd3d417c7, 0xb0b83888,
+        0x030c0f0f, 0x828c0e8e, 0x42400242, 0x23202303, 0x91901181, 0x606c2c4c, 0xd3d81bcb, 0xa0a42484,
+        0x30343404, 0xf1f031c1, 0x40480848, 0xc2c002c2, 0x636c2f4f, 0x313c3d0d, 0x212c2d0d, 0x40400040,
+        0xb2bc3e8e, 0x323c3e0e, 0xb0bc3c8c, 0xc1c001c1, 0xa2a82a8a, 0xb2b83a8a, 0x424c0e4e, 0x51541545,
+        0x33383b0b, 0xd0dc1ccc, 0x60682848, 0x737c3f4f, 0x909c1c8c, 0xd0d818c8, 0x42480a4a, 0x52541646,
+        0x73743747, 0xa0a02080, 0xe1ec2dcd, 0x42440646, 0xb1b43585, 0x23282b0b, 0x61642545, 0xf2f83aca,
+        0xe3e023c3, 0xb1b83989, 0xb1b03181, 0x939c1f8f, 0x525c1e4e, 0xf1f839c9, 0xe2e426c6, 0xb2b03282,
+        0x31303101, 0xe2e82aca, 0x616c2d4d, 0x535c1f4f, 0xe0e424c4, 0xf0f030c0, 0xc1cc0dcd, 0x80880888,
+        0x12141606, 0x32383a0a, 0x50581848, 0xd0d414c4, 0x62602242, 0x21282909, 0x03040707, 0x33303303,
+        0xe0e828c8, 0x13181b0b, 0x01040505, 0x71783949, 0x90901080, 0x62682a4a, 0x22282a0a, 0x92981a8a
+},      {
+        0x08303838, 0xc8e0e828, 0x0d212c2d, 0x86a2a426, 0xcfc3cc0f, 0xced2dc1e, 0x83b3b033, 0x88b0b838,
+        0x8fa3ac2f, 0x40606020, 0x45515415, 0xc7c3c407, 0x44404404, 0x4f636c2f, 0x4b63682b, 0x4b53581b,
+        0xc3c3c003, 0x42626022, 0x03333033, 0x85b1b435, 0x09212829, 0x80a0a020, 0xc2e2e022, 0x87a3a427,
+        0xc3d3d013, 0x81919011, 0x01111011, 0x06020406, 0x0c101c1c, 0x8cb0bc3c, 0x06323436, 0x4b43480b,
+        0xcfe3ec2f, 0x88808808, 0x4c606c2c, 0x88a0a828, 0x07131417, 0xc4c0c404, 0x06121416, 0xc4f0f434,
+        0xc2c2c002, 0x45414405, 0xc1e1e021, 0xc6d2d416, 0x0f333c3f, 0x0d313c3d, 0x8e828c0e, 0x88909818,
+        0x08202828, 0x4e424c0e, 0xc6f2f436, 0x0e323c3e, 0x85a1a425, 0xc9f1f839, 0x0d010c0d, 0xcfd3dc1f,
+        0xc8d0d818, 0x0b23282b, 0x46626426, 0x4a72783a, 0x07232427, 0x0f232c2f, 0xc1f1f031, 0x42727032,
+        0x42424002, 0xc4d0d414, 0x41414001, 0xc0c0c000, 0x43737033, 0x47636427, 0x8ca0ac2c, 0x8b83880b,
+        0xc7f3f437, 0x8da1ac2d, 0x80808000, 0x0f131c1f, 0xcac2c80a, 0x0c202c2c, 0x8aa2a82a, 0x04303434,
+        0xc2d2d012, 0x0b03080b, 0xcee2ec2e, 0xc9e1e829, 0x4d515c1d, 0x84909414, 0x08101818, 0xc8f0f838,
+        0x47535417, 0x8ea2ac2e, 0x08000808, 0xc5c1c405, 0x03131013, 0xcdc1cc0d, 0x86828406, 0x89b1b839,
+        0xcff3fc3f, 0x4d717c3d, 0xc1c1c001, 0x01313031, 0xc5f1f435, 0x8a82880a, 0x4a62682a, 0x81b1b031,
+        0xc1d1d011, 0x00202020, 0xc7d3d417, 0x02020002, 0x02222022, 0x04000404, 0x48606828, 0x41717031,
+        0x07030407, 0xcbd3d81b, 0x8d919c1d, 0x89919819, 0x41616021, 0x8eb2bc3e, 0xc6e2e426, 0x49515819,
+        0xcdd1dc1d, 0x41515011, 0x80909010, 0xccd0dc1c, 0x8a92981a, 0x83a3a023, 0x8ba3a82b, 0xc0d0d010,
+        0x81818001, 0x0f030c0f, 0x47434407, 0x0a12181a, 0xc3e3e023, 0xcce0ec2c, 0x8d818c0d, 0x8fb3bc3f,
+        0x86929416, 0x4b73783b, 0x4c505c1c, 0x82a2a022, 0x81a1a021, 0x43636023, 0x03232023, 0x4d414c0d,
+        0xc8c0c808, 0x8e929c1e, 0x8c909c1c, 0x0a32383a, 0x0c000c0c, 0x0e222c2e, 0x8ab2b83a, 0x4e626c2e,
+        0x8f939c1f, 0x4a52581a, 0xc2f2f032, 0x82929012, 0xc3f3f033, 0x49414809, 0x48707838, 0xccc0cc0c,
+        0x05111415, 0xcbf3f83b, 0x40707030, 0x45717435, 0x4f737c3f, 0x05313435, 0x00101010, 0x03030003,
+        0x44606424, 0x4d616c2d, 0xc6c2c406, 0x44707434, 0xc5d1d415, 0x84b0b434, 0xcae2e82a, 0x09010809,
+        0x46727436, 0x09111819, 0xcef2fc3e, 0x40404000, 0x02121012, 0xc0e0e020, 0x8db1bc3d, 0x05010405,
+        0xcaf2f83a, 0x01010001, 0xc0f0f030, 0x0a22282a, 0x4e525c1e, 0x89a1a829, 0x46525416, 0x43434003,
+        0x85818405, 0x04101414, 0x89818809, 0x8b93981b, 0x80b0b030, 0xc5e1e425, 0x48404808, 0x49717839,
+        0x87939417, 0xccf0fc3c, 0x0e121c1e, 0x82828002, 0x01212021, 0x8c808c0c, 0x0b13181b, 0x4f535c1f,
+        0x47737437, 0x44505414, 0x82b2b032, 0x0d111c1d, 0x05212425, 0x4f434c0f, 0x00000000, 0x46424406,
+        0xcde1ec2d, 0x48505818, 0x42525012, 0xcbe3e82b, 0x4e727c3e, 0xcad2d81a, 0xc9c1c809, 0xcdf1fc3d,
+        0x00303030, 0x85919415, 0x45616425, 0x0c303c3c, 0x86b2b436, 0xc4e0e424, 0x8bb3b83b, 0x4c707c3c,
+        0x0e020c0e, 0x40505010, 0x09313839, 0x06222426, 0x02323032, 0x84808404, 0x49616829, 0x83939013,
+        0x07333437, 0xc7e3e427, 0x04202424, 0x84a0a424, 0xcbc3c80b, 0x43535013, 0x0a02080a, 0x87838407,
+        0xc9d1d819, 0x4c404c0c, 0x83838003, 0x8f838c0f, 0xcec2cc0e, 0x0b33383b, 0x4a42480a, 0x87b3b437
+}       };
+
+/* key schedule constants - golden ratio */
+#define KC0     0x9e3779b9
+#define KC1     0x3c6ef373
+#define KC2     0x78dde6e6
+#define KC3     0xf1bbcdcc
+#define KC4     0xe3779b99
+#define KC5     0xc6ef3733
+#define KC6     0x8dde6e67
+#define KC7     0x1bbcdccf
+#define KC8     0x3779b99e
+#define KC9     0x6ef3733c
+#define KC10    0xdde6e678
+#define KC11    0xbbcdccf1
+#define KC12    0x779b99e3
+#define KC13    0xef3733c6
+#define KC14    0xde6e678d
+#define KC15    0xbcdccf1b
+
+
+void SEED_set_key(const unsigned char rawkey[SEED_KEY_LENGTH], SEED_KEY_SCHEDULE *ks)
+{
+        seed_word x1, x2, x3, x4;
+        seed_word t0, t1;
+
+        char2word(rawkey   , x1);
+        char2word(rawkey+4 , x2);
+        char2word(rawkey+8 , x3);
+        char2word(rawkey+12, x4);
+
+        t0 = (x1 + x3 - KC0) & 0xffffffff;
+        t1 = (x2 - x4 + KC0) & 0xffffffff;                     KEYUPDATE_TEMP(t0, t1, &ks->data[0]);
+        KEYSCHEDULE_UPDATE1(t0, t1, x1, x2, x3, x4, KC1);      KEYUPDATE_TEMP(t0, t1, &ks->data[2]);
+        KEYSCHEDULE_UPDATE0(t0, t1, x1, x2, x3, x4, KC2);      KEYUPDATE_TEMP(t0, t1, &ks->data[4]);
+        KEYSCHEDULE_UPDATE1(t0, t1, x1, x2, x3, x4, KC3);      KEYUPDATE_TEMP(t0, t1, &ks->data[6]);
+        KEYSCHEDULE_UPDATE0(t0, t1, x1, x2, x3, x4, KC4);      KEYUPDATE_TEMP(t0, t1, &ks->data[8]);
+        KEYSCHEDULE_UPDATE1(t0, t1, x1, x2, x3, x4, KC5);      KEYUPDATE_TEMP(t0, t1, &ks->data[10]);
+        KEYSCHEDULE_UPDATE0(t0, t1, x1, x2, x3, x4, KC6);      KEYUPDATE_TEMP(t0, t1, &ks->data[12]);
+        KEYSCHEDULE_UPDATE1(t0, t1, x1, x2, x3, x4, KC7);      KEYUPDATE_TEMP(t0, t1, &ks->data[14]);
+        KEYSCHEDULE_UPDATE0(t0, t1, x1, x2, x3, x4, KC8);      KEYUPDATE_TEMP(t0, t1, &ks->data[16]);
+        KEYSCHEDULE_UPDATE1(t0, t1, x1, x2, x3, x4, KC9);      KEYUPDATE_TEMP(t0, t1, &ks->data[18]);
+        KEYSCHEDULE_UPDATE0(t0, t1, x1, x2, x3, x4, KC10);     KEYUPDATE_TEMP(t0, t1, &ks->data[20]);
+        KEYSCHEDULE_UPDATE1(t0, t1, x1, x2, x3, x4, KC11);     KEYUPDATE_TEMP(t0, t1, &ks->data[22]);
+        KEYSCHEDULE_UPDATE0(t0, t1, x1, x2, x3, x4, KC12);     KEYUPDATE_TEMP(t0, t1, &ks->data[24]);
+        KEYSCHEDULE_UPDATE1(t0, t1, x1, x2, x3, x4, KC13);     KEYUPDATE_TEMP(t0, t1, &ks->data[26]);
+        KEYSCHEDULE_UPDATE0(t0, t1, x1, x2, x3, x4, KC14);     KEYUPDATE_TEMP(t0, t1, &ks->data[28]);
+        KEYSCHEDULE_UPDATE1(t0, t1, x1, x2, x3, x4, KC15);     KEYUPDATE_TEMP(t0, t1, &ks->data[30]);
+}
+
+void SEED_encrypt(const unsigned char s[SEED_BLOCK_SIZE], unsigned char d[SEED_BLOCK_SIZE], const SEED_KEY_SCHEDULE *ks)
+{
+        seed_word x1, x2, x3, x4;
+        seed_word t0, t1;
+
+        char2word(s,    x1);
+        char2word(s+4,  x2);
+        char2word(s+8,  x3);
+        char2word(s+12, x4);
+        
+        E_SEED(t0, t1, x1, x2, x3, x4, 0);
+        E_SEED(t0, t1, x3, x4, x1, x2, 2);
+        E_SEED(t0, t1, x1, x2, x3, x4, 4);
+        E_SEED(t0, t1, x3, x4, x1, x2, 6);
+        E_SEED(t0, t1, x1, x2, x3, x4, 8);
+        E_SEED(t0, t1, x3, x4, x1, x2, 10);
+        E_SEED(t0, t1, x1, x2, x3, x4, 12);
+        E_SEED(t0, t1, x3, x4, x1, x2, 14);
+        E_SEED(t0, t1, x1, x2, x3, x4, 16);
+        E_SEED(t0, t1, x3, x4, x1, x2, 18);
+        E_SEED(t0, t1, x1, x2, x3, x4, 20);
+        E_SEED(t0, t1, x3, x4, x1, x2, 22);
+        E_SEED(t0, t1, x1, x2, x3, x4, 24);
+        E_SEED(t0, t1, x3, x4, x1, x2, 26);
+        E_SEED(t0, t1, x1, x2, x3, x4, 28);
+        E_SEED(t0, t1, x3, x4, x1, x2, 30);
+
+        word2char(x3, d);
+        word2char(x4, d+4);
+        word2char(x1, d+8);
+        word2char(x2, d+12);
+}
+
+void SEED_decrypt(const unsigned char s[SEED_BLOCK_SIZE], unsigned char d[SEED_BLOCK_SIZE], const SEED_KEY_SCHEDULE *ks)
+{
+        seed_word x1, x2, x3, x4;
+        seed_word t0, t1;
+
+        char2word(s,    x1);
+        char2word(s+4,  x2);
+        char2word(s+8,  x3);
+        char2word(s+12, x4);
+        
+        E_SEED(t0, t1, x1, x2, x3, x4, 30);
+        E_SEED(t0, t1, x3, x4, x1, x2, 28);
+        E_SEED(t0, t1, x1, x2, x3, x4, 26);
+        E_SEED(t0, t1, x3, x4, x1, x2, 24);
+        E_SEED(t0, t1, x1, x2, x3, x4, 22);
+        E_SEED(t0, t1, x3, x4, x1, x2, 20);
+        E_SEED(t0, t1, x1, x2, x3, x4, 18);
+        E_SEED(t0, t1, x3, x4, x1, x2, 16);
+        E_SEED(t0, t1, x1, x2, x3, x4, 14);
+        E_SEED(t0, t1, x3, x4, x1, x2, 12);
+        E_SEED(t0, t1, x1, x2, x3, x4, 10);
+        E_SEED(t0, t1, x3, x4, x1, x2, 8);
+        E_SEED(t0, t1, x1, x2, x3, x4, 6);
+        E_SEED(t0, t1, x3, x4, x1, x2, 4);
+        E_SEED(t0, t1, x1, x2, x3, x4, 2);
+        E_SEED(t0, t1, x3, x4, x1, x2, 0);
+
+        word2char(x3, d);
+        word2char(x4, d+4);
+        word2char(x1, d+8);
+        word2char(x2, d+12);
+}
+
+#endif /* OPENSSL_NO_SEED */
diff --git a/src/lib/libssl/src/crypto/seed/seed.h b/src/lib/libssl/src/crypto/seed/seed.h
new file mode 100644
index 0000000000..427915ed9a
--- /dev/null
+++ b/src/lib/libssl/src/crypto/seed/seed.h
@@ -0,0 +1,135 @@
+/*
+ * Copyright (c) 2007 KISA(Korea Information Security Agency). All rights reserved.  
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Neither the name of author nor the names of its contributors may
+ *    be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+#ifndef HEADER_SEED_H
+#define HEADER_SEED_H
+
+#include <openssl/opensslconf.h>
+
+#ifdef OPENSSL_NO_SEED
+#error SEED is disabled.
+#endif
+
+#ifdef AES_LONG /* look whether we need 'long' to get 32 bits */
+# ifndef SEED_LONG
+#  define SEED_LONG 1
+# endif
+#endif
+
+#if !defined(NO_SYS_TYPES_H)
+# include <sys/types.h>
+#endif
+
+#define SEED_BLOCK_SIZE 16
+#define SEED_KEY_LENGTH 16
+
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+
+typedef struct seed_key_st {
+#ifdef SEED_LONG
+    unsigned long data[32];
+#else
+    unsigned int data[32];
+#endif
+} SEED_KEY_SCHEDULE;
+
+
+void SEED_set_key(const unsigned char rawkey[SEED_KEY_LENGTH], SEED_KEY_SCHEDULE *ks);
+
+void SEED_encrypt(const unsigned char s[SEED_BLOCK_SIZE], unsigned char d[SEED_BLOCK_SIZE], const SEED_KEY_SCHEDULE *ks);
+void SEED_decrypt(const unsigned char s[SEED_BLOCK_SIZE], unsigned char d[SEED_BLOCK_SIZE], const SEED_KEY_SCHEDULE *ks);
+
+void SEED_ecb_encrypt(const unsigned char *in, unsigned char *out, const SEED_KEY_SCHEDULE *ks, int enc);
+void SEED_cbc_encrypt(const unsigned char *in, unsigned char *out,
+        size_t len, const SEED_KEY_SCHEDULE *ks, unsigned char ivec[SEED_BLOCK_SIZE], int enc);
+void SEED_cfb128_encrypt(const unsigned char *in, unsigned char *out,
+        size_t len, const SEED_KEY_SCHEDULE *ks, unsigned char ivec[SEED_BLOCK_SIZE], int *num, int enc);
+void SEED_ofb128_encrypt(const unsigned char *in, unsigned char *out,
+        size_t len, const SEED_KEY_SCHEDULE *ks, unsigned char ivec[SEED_BLOCK_SIZE], int *num);
+
+#ifdef  __cplusplus
+}
+#endif
+
+#endif /* HEADER_SEED_H */
diff --git a/src/lib/libssl/src/crypto/seed/seed_cbc.c b/src/lib/libssl/src/crypto/seed/seed_cbc.c
new file mode 100644
index 0000000000..4f718ccb44
--- /dev/null
+++ b/src/lib/libssl/src/crypto/seed/seed_cbc.c
@@ -0,0 +1,129 @@
+/* crypto/seed/seed_cbc.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+
+#include "seed_locl.h"
+#include <string.h>
+
+void SEED_cbc_encrypt(const unsigned char *in, unsigned char *out,
+                      size_t len, const SEED_KEY_SCHEDULE *ks,
+                      unsigned char ivec[SEED_BLOCK_SIZE], int enc)
+        {
+        size_t n;
+        unsigned char tmp[SEED_BLOCK_SIZE];
+        const unsigned char *iv = ivec;
+
+        if (enc)
+                {
+                while (len >= SEED_BLOCK_SIZE)
+                        {
+                        for (n = 0; n < SEED_BLOCK_SIZE; ++n)
+                                out[n] = in[n] ^ iv[n];
+                        SEED_encrypt(out, out, ks);
+                        iv = out;
+                        len -= SEED_BLOCK_SIZE;
+                        in  += SEED_BLOCK_SIZE;
+                        out += SEED_BLOCK_SIZE;
+                        }
+                if (len)
+                        {
+                        for (n = 0; n < len; ++n)
+                                out[n] = in[n] ^ iv[n];
+                        for (n = len; n < SEED_BLOCK_SIZE; ++n)
+                                out[n] = iv[n];
+                        SEED_encrypt(out, out, ks);
+                        iv = out;
+                        }
+                memcpy(ivec, iv, SEED_BLOCK_SIZE);
+                }
+        else if (in != out) /* decrypt */
+                {
+                while (len >= SEED_BLOCK_SIZE)
+                        {
+                        SEED_decrypt(in, out, ks);
+                        for (n = 0; n < SEED_BLOCK_SIZE; ++n)
+                                out[n] ^= iv[n];
+                        iv = in;
+                        len -= SEED_BLOCK_SIZE;
+                        in  += SEED_BLOCK_SIZE;
+                        out += SEED_BLOCK_SIZE;
+                        }
+                if (len)
+                        {
+                        SEED_decrypt(in, tmp, ks);
+                        for (n = 0; n < len; ++n)
+                                out[n] = tmp[n] ^ iv[n];
+                        iv = in;
+                        }
+                memcpy(ivec, iv, SEED_BLOCK_SIZE);
+                }
+        else /* decrypt, overlap */
+                {
+                while (len >= SEED_BLOCK_SIZE)
+                        {
+                        memcpy(tmp, in, SEED_BLOCK_SIZE);
+                        SEED_decrypt(in, out, ks);
+                        for (n = 0; n < SEED_BLOCK_SIZE; ++n)
+                                out[n] ^= ivec[n];
+                        memcpy(ivec, tmp, SEED_BLOCK_SIZE);
+                        len -= SEED_BLOCK_SIZE;
+                        in  += SEED_BLOCK_SIZE;
+                        out += SEED_BLOCK_SIZE;
+                        }
+                if (len)
+                        {
+                        memcpy(tmp, in, SEED_BLOCK_SIZE);
+                        SEED_decrypt(tmp, tmp, ks);
+                        for (n = 0; n < len; ++n)
+                                out[n] = tmp[n] ^ ivec[n];
+                        memcpy(ivec, tmp, SEED_BLOCK_SIZE);
+                        }
+                }
+        }
diff --git a/src/lib/libssl/src/crypto/seed/seed_cfb.c b/src/lib/libssl/src/crypto/seed/seed_cfb.c
new file mode 100644
index 0000000000..07d878a788
--- /dev/null
+++ b/src/lib/libssl/src/crypto/seed/seed_cfb.c
@@ -0,0 +1,144 @@
+/* crypto/seed/seed_cfb.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include "seed_locl.h"
+#include <string.h>
+
+void SEED_cfb128_encrypt(const unsigned char *in, unsigned char *out,
+                         size_t len, const SEED_KEY_SCHEDULE *ks,
+                         unsigned char ivec[SEED_BLOCK_SIZE], int *num, int enc)
+        {
+        int n;
+        unsigned char c;
+
+        n = *num;
+
+        if (enc)
+                {
+                while (len--)
+                        {
+                        if (n == 0)
+                                SEED_encrypt(ivec, ivec, ks);
+                        ivec[n] = *(out++) = *(in++) ^ ivec[n];
+                        n = (n+1) % SEED_BLOCK_SIZE;
+                        }
+                }
+        else
+                {
+                while (len--)
+                        {
+                        if (n == 0)
+                                SEED_encrypt(ivec, ivec, ks);
+                        c = *(in);
+                        *(out++) = *(in++) ^ ivec[n];
+                        ivec[n] = c;
+                        n = (n+1) % SEED_BLOCK_SIZE;
+                        }
+                }
+
+        *num = n;
+        }
diff --git a/src/lib/libssl/src/crypto/seed/seed_ecb.c b/src/lib/libssl/src/crypto/seed/seed_ecb.c
new file mode 100644
index 0000000000..e63f5ae14e
--- /dev/null
+++ b/src/lib/libssl/src/crypto/seed/seed_ecb.c
@@ -0,0 +1,60 @@
+/* crypto/seed/seed_ecb.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2007 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+
+#include <openssl/seed.h>
+
+void SEED_ecb_encrypt(const unsigned char *in, unsigned char *out, const SEED_KEY_SCHEDULE *ks, int enc) 
+        {
+        if (enc)
+                SEED_encrypt(in, out, ks);
+        else
+                SEED_decrypt(in, out, ks);
+        }
diff --git a/src/lib/libssl/src/crypto/seed/seed_locl.h b/src/lib/libssl/src/crypto/seed/seed_locl.h
new file mode 100644
index 0000000000..fd456b6422
--- /dev/null
+++ b/src/lib/libssl/src/crypto/seed/seed_locl.h
@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2007 KISA(Korea Information Security Agency). All rights reserved.  
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Neither the name of author nor the names of its contributors may
+ *    be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+#ifndef HEADER_SEED_LOCL_H
+#define HEADER_SEED_LOCL_H
+
+#include "openssl/e_os2.h"
+#include <openssl/seed.h>
+
+
+#ifdef SEED_LONG /* need 32-bit type */
+typedef unsigned long seed_word;
+#else
+typedef unsigned int seed_word;
+#endif
+
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+#define G_FUNC(v)       \
+        SS[0][(unsigned char)      (v) & 0xff] ^ SS[1][(unsigned char) ((v)>>8) & 0xff] ^ \
+        SS[2][(unsigned char)((v)>>16) & 0xff] ^ SS[3][(unsigned char)((v)>>24) & 0xff]
+
+#define char2word(c, i)  \
+        (i) = ((((seed_word)(c)[0]) << 24) | (((seed_word)(c)[1]) << 16) | (((seed_word)(c)[2]) << 8) | ((seed_word)(c)[3]))
+
+#define word2char(l, c)  \
+        *((c)+0) = (unsigned char)((l)>>24) & 0xff; \
+        *((c)+1) = (unsigned char)((l)>>16) & 0xff; \
+        *((c)+2) = (unsigned char)((l)>> 8) & 0xff; \
+        *((c)+3) = (unsigned char)((l))     & 0xff
+
+#define KEYSCHEDULE_UPDATE0(T0, T1, X1, X2, X3, X4, KC)  \
+        (T0) = (X3);                                     \
+        (X3) = (((X3)<<8) ^ ((X4)>>24)) & 0xffffffff;    \
+        (X4) = (((X4)<<8) ^ ((T0)>>24)) & 0xffffffff;    \
+        (T0) = ((X1) + (X3) - (KC))     & 0xffffffff;    \
+        (T1) = ((X2) + (KC) - (X4))     & 0xffffffff
+
+#define KEYSCHEDULE_UPDATE1(T0, T1, X1, X2, X3, X4, KC)  \
+        (T0) = (X1);                                     \
+        (X1) = (((X1)>>8) ^ ((X2)<<24)) & 0xffffffff;    \
+        (X2) = (((X2)>>8) ^ ((T0)<<24)) & 0xffffffff;    \
+        (T0) = ((X1) + (X3) - (KC))     & 0xffffffff;     \
+        (T1) = ((X2) + (KC) - (X4))     & 0xffffffff
+
+#define KEYUPDATE_TEMP(T0, T1, K)   \
+        (K)[0] = G_FUNC((T0));      \
+        (K)[1] = G_FUNC((T1))
+
+#define XOR_SEEDBLOCK(DST, SRC)      \
+        ((DST))[0] ^= ((SRC))[0];    \
+        ((DST))[1] ^= ((SRC))[1];    \
+        ((DST))[2] ^= ((SRC))[2];    \
+        ((DST))[3] ^= ((SRC))[3]
+
+#define MOV_SEEDBLOCK(DST, SRC)      \
+        ((DST))[0] = ((SRC))[0];     \
+        ((DST))[1] = ((SRC))[1];     \
+        ((DST))[2] = ((SRC))[2];     \
+        ((DST))[3] = ((SRC))[3]
+
+# define CHAR2WORD(C, I)              \
+        char2word((C),    (I)[0]);    \
+        char2word((C+4),  (I)[1]);    \
+        char2word((C+8),  (I)[2]);    \
+        char2word((C+12), (I)[3])
+
+# define WORD2CHAR(I, C)              \
+        word2char((I)[0], (C));       \
+        word2char((I)[1], (C+4));     \
+        word2char((I)[2], (C+8));     \
+        word2char((I)[3], (C+12))
+
+# define E_SEED(T0, T1, X1, X2, X3, X4, rbase)   \
+        (T0) = (X3) ^ (ks->data)[(rbase)];       \
+        (T1) = (X4) ^ (ks->data)[(rbase)+1];     \
+        (T1) ^= (T0);                            \
+        (T1) = G_FUNC((T1));                     \
+        (T0) = ((T0) + (T1)) & 0xffffffff;       \
+        (T0) = G_FUNC((T0));                     \
+        (T1) = ((T1) + (T0)) & 0xffffffff;       \
+        (T1) = G_FUNC((T1));                     \
+        (T0) = ((T0) + (T1)) & 0xffffffff;       \
+        (X1) ^= (T0);                            \
+        (X2) ^= (T1)
+
+#ifdef  __cplusplus
+}
+#endif
+
+#endif /* HEADER_SEED_LOCL_H */
diff --git a/src/lib/libssl/src/crypto/seed/seed_ofb.c b/src/lib/libssl/src/crypto/seed/seed_ofb.c
new file mode 100644
index 0000000000..e2f3f57a38
--- /dev/null
+++ b/src/lib/libssl/src/crypto/seed/seed_ofb.c
@@ -0,0 +1,128 @@
+/* crypto/seed/seed_ofb.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include "seed_locl.h"
+#include <string.h>
+
+void SEED_ofb128_encrypt(const unsigned char *in, unsigned char *out,
+                         size_t len, const SEED_KEY_SCHEDULE *ks,
+                         unsigned char ivec[SEED_BLOCK_SIZE], int *num)
+        {
+        int n;
+
+        n = *num;
+        
+        while (len--)
+                {
+                if (n == 0)
+                        SEED_encrypt(ivec, ivec, ks);
+                *(out++) = *(in++) ^ ivec[n];
+                n = (n+1) % SEED_BLOCK_SIZE;
+                }
+
+        *num = n;
+        }
diff --git a/src/lib/libssl/src/crypto/sha/asm/sha1-x86_64.pl b/src/lib/libssl/src/crypto/sha/asm/sha1-x86_64.pl
new file mode 100755
index 0000000000..f7ed67a726
--- /dev/null
+++ b/src/lib/libssl/src/crypto/sha/asm/sha1-x86_64.pl
@@ -0,0 +1,242 @@
+#!/usr/bin/env perl
+#
+# ====================================================================
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# project. The module is, however, dual licensed under OpenSSL and
+# CRYPTOGAMS licenses depending on where you obtain it. For further
+# details see http://www.openssl.org/~appro/cryptogams/.
+# ====================================================================
+#
+# sha1_block procedure for x86_64.
+#
+# It was brought to my attention that on EM64T compiler-generated code
+# was far behind 32-bit assembler implementation. This is unlike on
+# Opteron where compiler-generated code was only 15% behind 32-bit
+# assembler, which originally made it hard to motivate the effort.
+# There was suggestion to mechanically translate 32-bit code, but I
+# dismissed it, reasoning that x86_64 offers enough register bank
+# capacity to fully utilize SHA-1 parallelism. Therefore this fresh
+# implementation:-) However! While 64-bit code does performs better
+# on Opteron, I failed to beat 32-bit assembler on EM64T core. Well,
+# x86_64 does offer larger *addressable* bank, but out-of-order core
+# reaches for even more registers through dynamic aliasing, and EM64T
+# core must have managed to run-time optimize even 32-bit code just as
+# good as 64-bit one. Performance improvement is summarized in the
+# following table:
+#
+#               gcc 3.4         32-bit asm      cycles/byte
+# Opteron       +45%            +20%            6.8
+# Xeon P4       +65%            +0%             9.9
+# Core2         +60%            +10%            7.0
+
+$output=shift;
+
+$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
+( $xlate="${dir}x86_64-xlate.pl" and -f $xlate ) or
+( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or
+die "can't locate x86_64-xlate.pl";
+
+open STDOUT,"| $^X $xlate $output";
+
+$ctx="%rdi";    # 1st arg
+$inp="%rsi";    # 2nd arg
+$num="%rdx";    # 3rd arg
+
+# reassign arguments in order to produce more compact code
+$ctx="%r8";
+$inp="%r9";
+$num="%r10";
+
+$xi="%eax";
+$t0="%ebx";
+$t1="%ecx";
+$A="%edx";
+$B="%esi";
+$C="%edi";
+$D="%ebp";
+$E="%r11d";
+$T="%r12d";
+
+@V=($A,$B,$C,$D,$E,$T);
+
+sub PROLOGUE {
+my $func=shift;
+$code.=<<___;
+.globl  $func
+.type   $func,\@function,3
+.align  16
+$func:
+        push    %rbx
+        push    %rbp
+        push    %r12
+        mov     %rsp,%rax
+        mov     %rdi,$ctx       # reassigned argument
+        sub     \$`8+16*4`,%rsp
+        mov     %rsi,$inp       # reassigned argument
+        and     \$-64,%rsp
+        mov     %rdx,$num       # reassigned argument
+        mov     %rax,`16*4`(%rsp)
+
+        mov     0($ctx),$A
+        mov     4($ctx),$B
+        mov     8($ctx),$C
+        mov     12($ctx),$D
+        mov     16($ctx),$E
+___
+}
+
+sub EPILOGUE {
+my $func=shift;
+$code.=<<___;
+        mov     `16*4`(%rsp),%rsp
+        pop     %r12
+        pop     %rbp
+        pop     %rbx
+        ret
+.size   $func,.-$func
+___
+}
+
+sub BODY_00_19 {
+my ($i,$a,$b,$c,$d,$e,$f,$host)=@_;
+my $j=$i+1;
+$code.=<<___ if ($i==0);
+        mov     `4*$i`($inp),$xi        
+        `"bswap $xi"    if(!defined($host))`
+        mov     $xi,`4*$i`(%rsp)
+___
+$code.=<<___ if ($i<15);
+        lea     0x5a827999($xi,$e),$f
+        mov     $c,$t0
+        mov     `4*$j`($inp),$xi
+        mov     $a,$e
+        xor     $d,$t0
+        `"bswap $xi"    if(!defined($host))`    
+        rol     \$5,$e
+        and     $b,$t0
+        mov     $xi,`4*$j`(%rsp)
+        add     $e,$f
+        xor     $d,$t0
+        rol     \$30,$b
+        add     $t0,$f
+___
+$code.=<<___ if ($i>=15);
+        lea     0x5a827999($xi,$e),$f
+        mov     `4*($j%16)`(%rsp),$xi
+        mov     $c,$t0
+        mov     $a,$e
+        xor     `4*(($j+2)%16)`(%rsp),$xi
+        xor     $d,$t0
+        rol     \$5,$e
+        xor     `4*(($j+8)%16)`(%rsp),$xi
+        and     $b,$t0
+        add     $e,$f
+        xor     `4*(($j+13)%16)`(%rsp),$xi
+        xor     $d,$t0
+        rol     \$30,$b
+        add     $t0,$f
+        rol     \$1,$xi
+        mov     $xi,`4*($j%16)`(%rsp)
+___
+}
+
+sub BODY_20_39 {
+my ($i,$a,$b,$c,$d,$e,$f)=@_;
+my $j=$i+1;
+my $K=($i<40)?0x6ed9eba1:0xca62c1d6;
+$code.=<<___ if ($i<79);
+        lea     $K($xi,$e),$f
+        mov     `4*($j%16)`(%rsp),$xi
+        mov     $c,$t0
+        mov     $a,$e
+        xor     `4*(($j+2)%16)`(%rsp),$xi
+        xor     $b,$t0
+        rol     \$5,$e
+        xor     `4*(($j+8)%16)`(%rsp),$xi
+        xor     $d,$t0
+        add     $e,$f
+        xor     `4*(($j+13)%16)`(%rsp),$xi
+        rol     \$30,$b
+        add     $t0,$f
+        rol     \$1,$xi
+___
+$code.=<<___ if ($i<76);
+        mov     $xi,`4*($j%16)`(%rsp)
+___
+$code.=<<___ if ($i==79);
+        lea     $K($xi,$e),$f
+        mov     $c,$t0
+        mov     $a,$e
+        xor     $b,$t0
+        rol     \$5,$e
+        xor     $d,$t0
+        add     $e,$f
+        rol     \$30,$b
+        add     $t0,$f
+___
+}
+
+sub BODY_40_59 {
+my ($i,$a,$b,$c,$d,$e,$f)=@_;
+my $j=$i+1;
+$code.=<<___;
+        lea     0x8f1bbcdc($xi,$e),$f
+        mov     `4*($j%16)`(%rsp),$xi
+        mov     $b,$t0
+        mov     $b,$t1
+        xor     `4*(($j+2)%16)`(%rsp),$xi
+        mov     $a,$e
+        and     $c,$t0
+        xor     `4*(($j+8)%16)`(%rsp),$xi
+        or      $c,$t1
+        rol     \$5,$e
+        xor     `4*(($j+13)%16)`(%rsp),$xi
+        and     $d,$t1
+        add     $e,$f
+        rol     \$1,$xi
+        or      $t1,$t0
+        rol     \$30,$b
+        mov     $xi,`4*($j%16)`(%rsp)
+        add     $t0,$f
+___
+}
+
+$code=".text\n";
+
+&PROLOGUE("sha1_block_data_order");
+$code.=".align  4\n.Lloop:\n";
+for($i=0;$i<20;$i++)    { &BODY_00_19($i,@V); unshift(@V,pop(@V)); }
+for(;$i<40;$i++)        { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
+for(;$i<60;$i++)        { &BODY_40_59($i,@V); unshift(@V,pop(@V)); }
+for(;$i<80;$i++)        { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
+$code.=<<___;
+        add     0($ctx),$E
+        add     4($ctx),$T
+        add     8($ctx),$A
+        add     12($ctx),$B
+        add     16($ctx),$C
+        mov     $E,0($ctx)
+        mov     $T,4($ctx)
+        mov     $A,8($ctx)
+        mov     $B,12($ctx)
+        mov     $C,16($ctx)
+
+        xchg    $E,$A   # mov   $E,$A
+        xchg    $T,$B   # mov   $T,$B
+        xchg    $E,$C   # mov   $A,$C
+        xchg    $T,$D   # mov   $B,$D
+                        # mov   $C,$E
+        lea     `16*4`($inp),$inp
+        sub     \$1,$num
+        jnz     .Lloop
+___
+&EPILOGUE("sha1_block_data_order");
+$code.=<<___;
+.asciz  "SHA1 block transform for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+___
+
+####################################################################
+
+$code =~ s/\`([^\`]*)\`/eval $1/gem;
+print $code;
+close STDOUT;
diff --git a/src/lib/libssl/src/crypto/sha/asm/sha512-ia64.pl b/src/lib/libssl/src/crypto/sha/asm/sha512-ia64.pl
new file mode 100755
index 0000000000..1c6ce56522
--- /dev/null
+++ b/src/lib/libssl/src/crypto/sha/asm/sha512-ia64.pl
@@ -0,0 +1,672 @@
+#!/usr/bin/env perl
+#
+# ====================================================================
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# project. The module is, however, dual licensed under OpenSSL and
+# CRYPTOGAMS licenses depending on where you obtain it. For further
+# details see http://www.openssl.org/~appro/cryptogams/.
+# ====================================================================
+#
+# SHA256/512_Transform for Itanium.
+#
+# sha512_block runs in 1003 cycles on Itanium 2, which is almost 50%
+# faster than gcc and >60%(!) faster than code generated by HP-UX
+# compiler (yes, HP-UX is generating slower code, because unlike gcc,
+# it failed to deploy "shift right pair," 'shrp' instruction, which
+# substitutes for 64-bit rotate).
+#
+# 924 cycles long sha256_block outperforms gcc by over factor of 2(!)
+# and HP-UX compiler - by >40% (yes, gcc won sha512_block, but lost
+# this one big time). Note that "formally" 924 is about 100 cycles
+# too much. I mean it's 64 32-bit rounds vs. 80 virtually identical
+# 64-bit ones and 1003*64/80 gives 802. Extra cycles, 2 per round,
+# are spent on extra work to provide for 32-bit rotations. 32-bit
+# rotations are still handled by 'shrp' instruction and for this
+# reason lower 32 bits are deposited to upper half of 64-bit register
+# prior 'shrp' issue. And in order to minimize the amount of such
+# operations, X[16] values are *maintained* with copies of lower
+# halves in upper halves, which is why you'll spot such instructions
+# as custom 'mux2', "parallel 32-bit add," 'padd4' and "parallel
+# 32-bit unsigned right shift," 'pshr4.u' instructions here.
+#
+# Rules of engagement.
+#
+# There is only one integer shifter meaning that if I have two rotate,
+# deposit or extract instructions in adjacent bundles, they shall
+# split [at run-time if they have to]. But note that variable and
+# parallel shifts are performed by multi-media ALU and *are* pairable
+# with rotates [and alike]. On the backside MMALU is rather slow: it
+# takes 2 extra cycles before the result of integer operation is
+# available *to* MMALU and 2(*) extra cycles before the result of MM
+# operation is available "back" *to* integer ALU, not to mention that
+# MMALU itself has 2 cycles latency. However! I explicitly scheduled
+# these MM instructions to avoid MM stalls, so that all these extra
+# latencies get "hidden" in instruction-level parallelism.
+#
+# (*) 2 cycles on Itanium 1 and 1 cycle on Itanium 2. But I schedule
+#     for 2 in order to provide for best *overall* performance,
+#     because on Itanium 1 stall on MM result is accompanied by
+#     pipeline flush, which takes 6 cycles:-(
+#
+# Resulting performance numbers for 900MHz Itanium 2 system:
+#
+# The 'numbers' are in 1000s of bytes per second processed.
+# type     16 bytes    64 bytes   256 bytes  1024 bytes  8192 bytes
+# sha1(*)   6210.14k   20376.30k   52447.83k   85870.05k  105478.12k
+# sha256    7476.45k   20572.05k   41538.34k   56062.29k   62093.18k
+# sha512    4996.56k   20026.28k   47597.20k   85278.79k  111501.31k
+#
+# (*) SHA1 numbers are for HP-UX compiler and are presented purely
+#     for reference purposes. I bet it can improved too...
+#
+# To generate code, pass the file name with either 256 or 512 in its
+# name and compiler flags.
+
+$output=shift;
+
+if ($output =~ /512.*\.[s|asm]/) {
+        $SZ=8;
+        $BITS=8*$SZ;
+        $LDW="ld8";
+        $STW="st8";
+        $ADD="add";
+        $SHRU="shr.u";
+        $TABLE="K512";
+        $func="sha512_block_data_order";
+        @Sigma0=(28,34,39);
+        @Sigma1=(14,18,41);
+        @sigma0=(1,  8, 7);
+        @sigma1=(19,61, 6);
+        $rounds=80;
+} elsif ($output =~ /256.*\.[s|asm]/) {
+        $SZ=4;
+        $BITS=8*$SZ;
+        $LDW="ld4";
+        $STW="st4";
+        $ADD="padd4";
+        $SHRU="pshr4.u";
+        $TABLE="K256";
+        $func="sha256_block_data_order";
+        @Sigma0=( 2,13,22);
+        @Sigma1=( 6,11,25);
+        @sigma0=( 7,18, 3);
+        @sigma1=(17,19,10);
+        $rounds=64;
+} else { die "nonsense $output"; }
+
+open STDOUT,">$output" || die "can't open $output: $!";
+
+if ($^O eq "hpux") {
+    $ADDP="addp4";
+    for (@ARGV) { $ADDP="add" if (/[\+DD|\-mlp]64/); }
+} else { $ADDP="add"; }
+for (@ARGV)  {  $big_endian=1 if (/\-DB_ENDIAN/);
+                $big_endian=0 if (/\-DL_ENDIAN/);  }
+if (!defined($big_endian))
+             {  $big_endian=(unpack('L',pack('N',1))==1);  }
+
+$code=<<___;
+.ident  \"$output, version 1.1\"
+.ident  \"IA-64 ISA artwork by Andy Polyakov <appro\@fy.chalmers.se>\"
+.explicit
+.text
+
+pfssave=r2;
+lcsave=r3;
+prsave=r14;
+K=r15;
+A=r16;  B=r17;  C=r18;  D=r19;
+E=r20;  F=r21;  G=r22;  H=r23;
+T1=r24; T2=r25;
+s0=r26; s1=r27; t0=r28; t1=r29;
+Ktbl=r30;
+ctx=r31;        // 1st arg
+input=r48;      // 2nd arg
+num=r49;        // 3rd arg
+sgm0=r50;       sgm1=r51;       // small constants
+A_=r54; B_=r55; C_=r56; D_=r57;
+E_=r58; F_=r59; G_=r60; H_=r61;
+
+// void $func (SHA_CTX *ctx, const void *in,size_t num[,int host])
+.global $func#
+.proc   $func#
+.align  32
+$func:
+        .prologue
+        .save   ar.pfs,pfssave
+{ .mmi; alloc   pfssave=ar.pfs,3,27,0,16
+        $ADDP   ctx=0,r32               // 1st arg
+        .save   ar.lc,lcsave
+        mov     lcsave=ar.lc    }
+{ .mmi; $ADDP   input=0,r33             // 2nd arg
+        mov     num=r34                 // 3rd arg
+        .save   pr,prsave
+        mov     prsave=pr       };;
+
+        .body
+{ .mib; add     r8=0*$SZ,ctx
+        add     r9=1*$SZ,ctx
+        brp.loop.imp    .L_first16,.L_first16_end-16    }
+{ .mib; add     r10=2*$SZ,ctx
+        add     r11=3*$SZ,ctx
+        brp.loop.imp    .L_rest,.L_rest_end-16          };;
+
+// load A-H
+.Lpic_point:
+{ .mmi; $LDW    A_=[r8],4*$SZ
+        $LDW    B_=[r9],4*$SZ
+        mov     Ktbl=ip         }
+{ .mmi; $LDW    C_=[r10],4*$SZ
+        $LDW    D_=[r11],4*$SZ
+        mov     sgm0=$sigma0[2] };;
+{ .mmi; $LDW    E_=[r8]
+        $LDW    F_=[r9]
+        add     Ktbl=($TABLE#-.Lpic_point),Ktbl         }
+{ .mmi; $LDW    G_=[r10]
+        $LDW    H_=[r11]
+        cmp.ne  p0,p16=0,r0     };;     // used in sha256_block
+___
+$code.=<<___ if ($BITS==64);
+{ .mii; and     r8=7,input
+        and     input=~7,input;;
+        cmp.eq  p9,p0=1,r8      }
+{ .mmi; cmp.eq  p10,p0=2,r8
+        cmp.eq  p11,p0=3,r8
+        cmp.eq  p12,p0=4,r8     }
+{ .mmi; cmp.eq  p13,p0=5,r8
+        cmp.eq  p14,p0=6,r8
+        cmp.eq  p15,p0=7,r8     };;
+___
+$code.=<<___;
+.L_outer:
+.rotr   X[16]
+{ .mmi; mov     A=A_
+        mov     B=B_
+        mov     ar.lc=14        }
+{ .mmi; mov     C=C_
+        mov     D=D_
+        mov     E=E_            }
+{ .mmi; mov     F=F_
+        mov     G=G_
+        mov     ar.ec=2         }
+{ .mmi; ld1     X[15]=[input],$SZ               // eliminated in 64-bit
+        mov     H=H_
+        mov     sgm1=$sigma1[2] };;
+
+___
+$t0="t0", $t1="t1", $code.=<<___ if ($BITS==32);
+.align  32
+.L_first16:
+{ .mmi;         add     r9=1-$SZ,input
+                add     r10=2-$SZ,input
+                add     r11=3-$SZ,input };;
+{ .mmi;         ld1     r9=[r9]
+                ld1     r10=[r10]
+                dep.z   $t1=E,32,32     }
+{ .mmi;         $LDW    K=[Ktbl],$SZ
+                ld1     r11=[r11]
+                zxt4    E=E             };;
+{ .mii;         or      $t1=$t1,E
+                dep     X[15]=X[15],r9,8,8
+                dep     r11=r10,r11,8,8 };;
+{ .mmi;         and     T1=F,E
+                and     T2=A,B
+                dep     X[15]=X[15],r11,16,16   }
+{ .mmi;         andcm   r8=G,E
+                and     r9=A,C
+                mux2    $t0=A,0x44      };;     // copy lower half to upper
+{ .mmi; (p16)   ld1     X[15-1]=[input],$SZ     // prefetch
+                xor     T1=T1,r8                // T1=((e & f) ^ (~e & g))
+                _rotr   r11=$t1,$Sigma1[0] }    // ROTR(e,14)
+{ .mib;         and     r10=B,C
+                xor     T2=T2,r9        };;
+___
+$t0="A", $t1="E", $code.=<<___ if ($BITS==64);
+// in 64-bit mode I load whole X[16] at once and take care of alignment...
+{ .mmi; add     r8=1*$SZ,input
+        add     r9=2*$SZ,input
+        add     r10=3*$SZ,input         };;
+{ .mmb; $LDW    X[15]=[input],4*$SZ
+        $LDW    X[14]=[r8],4*$SZ
+(p9)    br.cond.dpnt.many       .L1byte };;
+{ .mmb; $LDW    X[13]=[r9],4*$SZ
+        $LDW    X[12]=[r10],4*$SZ
+(p10)   br.cond.dpnt.many       .L2byte };;
+{ .mmb; $LDW    X[11]=[input],4*$SZ
+        $LDW    X[10]=[r8],4*$SZ
+(p11)   br.cond.dpnt.many       .L3byte };;
+{ .mmb; $LDW    X[ 9]=[r9],4*$SZ
+        $LDW    X[ 8]=[r10],4*$SZ
+(p12)   br.cond.dpnt.many       .L4byte };;
+{ .mmb; $LDW    X[ 7]=[input],4*$SZ
+        $LDW    X[ 6]=[r8],4*$SZ
+(p13)   br.cond.dpnt.many       .L5byte };;
+{ .mmb; $LDW    X[ 5]=[r9],4*$SZ
+        $LDW    X[ 4]=[r10],4*$SZ
+(p14)   br.cond.dpnt.many       .L6byte };;
+{ .mmb; $LDW    X[ 3]=[input],4*$SZ
+        $LDW    X[ 2]=[r8],4*$SZ
+(p15)   br.cond.dpnt.many       .L7byte };;
+{ .mmb; $LDW    X[ 1]=[r9],4*$SZ
+        $LDW    X[ 0]=[r10],4*$SZ
+        br.many .L_first16              };;
+.L1byte:
+{ .mmi; $LDW    X[13]=[r9],4*$SZ
+        $LDW    X[12]=[r10],4*$SZ
+        shrp    X[15]=X[15],X[14],56    };;
+{ .mmi; $LDW    X[11]=[input],4*$SZ
+        $LDW    X[10]=[r8],4*$SZ
+        shrp    X[14]=X[14],X[13],56    }
+{ .mmi; $LDW    X[ 9]=[r9],4*$SZ
+        $LDW    X[ 8]=[r10],4*$SZ
+        shrp    X[13]=X[13],X[12],56    };;
+{ .mmi; $LDW    X[ 7]=[input],4*$SZ
+        $LDW    X[ 6]=[r8],4*$SZ
+        shrp    X[12]=X[12],X[11],56    }
+{ .mmi; $LDW    X[ 5]=[r9],4*$SZ
+        $LDW    X[ 4]=[r10],4*$SZ
+        shrp    X[11]=X[11],X[10],56    };;
+{ .mmi; $LDW    X[ 3]=[input],4*$SZ
+        $LDW    X[ 2]=[r8],4*$SZ
+        shrp    X[10]=X[10],X[ 9],56    }
+{ .mmi; $LDW    X[ 1]=[r9],4*$SZ
+        $LDW    X[ 0]=[r10],4*$SZ
+        shrp    X[ 9]=X[ 9],X[ 8],56    };;
+{ .mii; $LDW    T1=[input]
+        shrp    X[ 8]=X[ 8],X[ 7],56
+        shrp    X[ 7]=X[ 7],X[ 6],56    }
+{ .mii; shrp    X[ 6]=X[ 6],X[ 5],56
+        shrp    X[ 5]=X[ 5],X[ 4],56    };;
+{ .mii; shrp    X[ 4]=X[ 4],X[ 3],56
+        shrp    X[ 3]=X[ 3],X[ 2],56    }
+{ .mii; shrp    X[ 2]=X[ 2],X[ 1],56
+        shrp    X[ 1]=X[ 1],X[ 0],56    }
+{ .mib; shrp    X[ 0]=X[ 0],T1,56
+        br.many .L_first16              };;
+.L2byte:
+{ .mmi; $LDW    X[11]=[input],4*$SZ
+        $LDW    X[10]=[r8],4*$SZ
+        shrp    X[15]=X[15],X[14],48    }
+{ .mmi; $LDW    X[ 9]=[r9],4*$SZ
+        $LDW    X[ 8]=[r10],4*$SZ
+        shrp    X[14]=X[14],X[13],48    };;
+{ .mmi; $LDW    X[ 7]=[input],4*$SZ
+        $LDW    X[ 6]=[r8],4*$SZ
+        shrp    X[13]=X[13],X[12],48    }
+{ .mmi; $LDW    X[ 5]=[r9],4*$SZ
+        $LDW    X[ 4]=[r10],4*$SZ
+        shrp    X[12]=X[12],X[11],48    };;
+{ .mmi; $LDW    X[ 3]=[input],4*$SZ
+        $LDW    X[ 2]=[r8],4*$SZ
+        shrp    X[11]=X[11],X[10],48    }
+{ .mmi; $LDW    X[ 1]=[r9],4*$SZ
+        $LDW    X[ 0]=[r10],4*$SZ
+        shrp    X[10]=X[10],X[ 9],48    };;
+{ .mii; $LDW    T1=[input]
+        shrp    X[ 9]=X[ 9],X[ 8],48
+        shrp    X[ 8]=X[ 8],X[ 7],48    }
+{ .mii; shrp    X[ 7]=X[ 7],X[ 6],48
+        shrp    X[ 6]=X[ 6],X[ 5],48    };;
+{ .mii; shrp    X[ 5]=X[ 5],X[ 4],48
+        shrp    X[ 4]=X[ 4],X[ 3],48    }
+{ .mii; shrp    X[ 3]=X[ 3],X[ 2],48
+        shrp    X[ 2]=X[ 2],X[ 1],48    }
+{ .mii; shrp    X[ 1]=X[ 1],X[ 0],48
+        shrp    X[ 0]=X[ 0],T1,48       }
+{ .mfb; br.many .L_first16              };;
+.L3byte:
+{ .mmi; $LDW    X[ 9]=[r9],4*$SZ
+        $LDW    X[ 8]=[r10],4*$SZ
+        shrp    X[15]=X[15],X[14],40    };;
+{ .mmi; $LDW    X[ 7]=[input],4*$SZ
+        $LDW    X[ 6]=[r8],4*$SZ
+        shrp    X[14]=X[14],X[13],40    }
+{ .mmi; $LDW    X[ 5]=[r9],4*$SZ
+        $LDW    X[ 4]=[r10],4*$SZ
+        shrp    X[13]=X[13],X[12],40    };;
+{ .mmi; $LDW    X[ 3]=[input],4*$SZ
+        $LDW    X[ 2]=[r8],4*$SZ
+        shrp    X[12]=X[12],X[11],40    }
+{ .mmi; $LDW    X[ 1]=[r9],4*$SZ
+        $LDW    X[ 0]=[r10],4*$SZ
+        shrp    X[11]=X[11],X[10],40    };;
+{ .mii; $LDW    T1=[input]
+        shrp    X[10]=X[10],X[ 9],40
+        shrp    X[ 9]=X[ 9],X[ 8],40    }
+{ .mii; shrp    X[ 8]=X[ 8],X[ 7],40
+        shrp    X[ 7]=X[ 7],X[ 6],40    };;
+{ .mii; shrp    X[ 6]=X[ 6],X[ 5],40
+        shrp    X[ 5]=X[ 5],X[ 4],40    }
+{ .mii; shrp    X[ 4]=X[ 4],X[ 3],40
+        shrp    X[ 3]=X[ 3],X[ 2],40    }
+{ .mii; shrp    X[ 2]=X[ 2],X[ 1],40
+        shrp    X[ 1]=X[ 1],X[ 0],40    }
+{ .mib; shrp    X[ 0]=X[ 0],T1,40
+        br.many .L_first16              };;
+.L4byte:
+{ .mmi; $LDW    X[ 7]=[input],4*$SZ
+        $LDW    X[ 6]=[r8],4*$SZ
+        shrp    X[15]=X[15],X[14],32    }
+{ .mmi; $LDW    X[ 5]=[r9],4*$SZ
+        $LDW    X[ 4]=[r10],4*$SZ
+        shrp    X[14]=X[14],X[13],32    };;
+{ .mmi; $LDW    X[ 3]=[input],4*$SZ
+        $LDW    X[ 2]=[r8],4*$SZ
+        shrp    X[13]=X[13],X[12],32    }
+{ .mmi; $LDW    X[ 1]=[r9],4*$SZ
+        $LDW    X[ 0]=[r10],4*$SZ
+        shrp    X[12]=X[12],X[11],32    };;
+{ .mii; $LDW    T1=[input]
+        shrp    X[11]=X[11],X[10],32
+        shrp    X[10]=X[10],X[ 9],32    }
+{ .mii; shrp    X[ 9]=X[ 9],X[ 8],32
+        shrp    X[ 8]=X[ 8],X[ 7],32    };;
+{ .mii; shrp    X[ 7]=X[ 7],X[ 6],32
+        shrp    X[ 6]=X[ 6],X[ 5],32    }
+{ .mii; shrp    X[ 5]=X[ 5],X[ 4],32
+        shrp    X[ 4]=X[ 4],X[ 3],32    }
+{ .mii; shrp    X[ 3]=X[ 3],X[ 2],32
+        shrp    X[ 2]=X[ 2],X[ 1],32    }
+{ .mii; shrp    X[ 1]=X[ 1],X[ 0],32
+        shrp    X[ 0]=X[ 0],T1,32       }
+{ .mfb; br.many .L_first16              };;
+.L5byte:
+{ .mmi; $LDW    X[ 5]=[r9],4*$SZ
+        $LDW    X[ 4]=[r10],4*$SZ
+        shrp    X[15]=X[15],X[14],24    };;
+{ .mmi; $LDW    X[ 3]=[input],4*$SZ
+        $LDW    X[ 2]=[r8],4*$SZ
+        shrp    X[14]=X[14],X[13],24    }
+{ .mmi; $LDW    X[ 1]=[r9],4*$SZ
+        $LDW    X[ 0]=[r10],4*$SZ
+        shrp    X[13]=X[13],X[12],24    };;
+{ .mii; $LDW    T1=[input]
+        shrp    X[12]=X[12],X[11],24
+        shrp    X[11]=X[11],X[10],24    }
+{ .mii; shrp    X[10]=X[10],X[ 9],24
+        shrp    X[ 9]=X[ 9],X[ 8],24    };;
+{ .mii; shrp    X[ 8]=X[ 8],X[ 7],24
+        shrp    X[ 7]=X[ 7],X[ 6],24    }
+{ .mii; shrp    X[ 6]=X[ 6],X[ 5],24
+        shrp    X[ 5]=X[ 5],X[ 4],24    }
+{ .mii; shrp    X[ 4]=X[ 4],X[ 3],24
+        shrp    X[ 3]=X[ 3],X[ 2],24    }
+{ .mii; shrp    X[ 2]=X[ 2],X[ 1],24
+        shrp    X[ 1]=X[ 1],X[ 0],24    }
+{ .mib; shrp    X[ 0]=X[ 0],T1,24
+        br.many .L_first16              };;
+.L6byte:
+{ .mmi; $LDW    X[ 3]=[input],4*$SZ
+        $LDW    X[ 2]=[r8],4*$SZ
+        shrp    X[15]=X[15],X[14],16    }
+{ .mmi; $LDW    X[ 1]=[r9],4*$SZ
+        $LDW    X[ 0]=[r10],4*$SZ
+        shrp    X[14]=X[14],X[13],16    };;
+{ .mii; $LDW    T1=[input]
+        shrp    X[13]=X[13],X[12],16
+        shrp    X[12]=X[12],X[11],16    }
+{ .mii; shrp    X[11]=X[11],X[10],16
+        shrp    X[10]=X[10],X[ 9],16    };;
+{ .mii; shrp    X[ 9]=X[ 9],X[ 8],16
+        shrp    X[ 8]=X[ 8],X[ 7],16    }
+{ .mii; shrp    X[ 7]=X[ 7],X[ 6],16
+        shrp    X[ 6]=X[ 6],X[ 5],16    }
+{ .mii; shrp    X[ 5]=X[ 5],X[ 4],16
+        shrp    X[ 4]=X[ 4],X[ 3],16    }
+{ .mii; shrp    X[ 3]=X[ 3],X[ 2],16
+        shrp    X[ 2]=X[ 2],X[ 1],16    }
+{ .mii; shrp    X[ 1]=X[ 1],X[ 0],16
+        shrp    X[ 0]=X[ 0],T1,16       }
+{ .mfb; br.many .L_first16              };;
+.L7byte:
+{ .mmi; $LDW    X[ 1]=[r9],4*$SZ
+        $LDW    X[ 0]=[r10],4*$SZ
+        shrp    X[15]=X[15],X[14],8     };;
+{ .mii; $LDW    T1=[input]
+        shrp    X[14]=X[14],X[13],8
+        shrp    X[13]=X[13],X[12],8     }
+{ .mii; shrp    X[12]=X[12],X[11],8
+        shrp    X[11]=X[11],X[10],8     };;
+{ .mii; shrp    X[10]=X[10],X[ 9],8
+        shrp    X[ 9]=X[ 9],X[ 8],8     }
+{ .mii; shrp    X[ 8]=X[ 8],X[ 7],8
+        shrp    X[ 7]=X[ 7],X[ 6],8     }
+{ .mii; shrp    X[ 6]=X[ 6],X[ 5],8
+        shrp    X[ 5]=X[ 5],X[ 4],8     }
+{ .mii; shrp    X[ 4]=X[ 4],X[ 3],8
+        shrp    X[ 3]=X[ 3],X[ 2],8     }
+{ .mii; shrp    X[ 2]=X[ 2],X[ 1],8
+        shrp    X[ 1]=X[ 1],X[ 0],8     }
+{ .mib; shrp    X[ 0]=X[ 0],T1,8
+        br.many .L_first16              };;
+
+.align  32
+.L_first16:
+{ .mmi;         $LDW    K=[Ktbl],$SZ
+                and     T1=F,E
+                and     T2=A,B          }
+{ .mmi;         //$LDW  X[15]=[input],$SZ       // X[i]=*input++
+                andcm   r8=G,E
+                and     r9=A,C          };;
+{ .mmi;         xor     T1=T1,r8                //T1=((e & f) ^ (~e & g))
+                and     r10=B,C
+                _rotr   r11=$t1,$Sigma1[0] }    // ROTR(e,14)
+{ .mmi;         xor     T2=T2,r9
+                mux1    X[15]=X[15],\@rev };;   // eliminated in big-endian
+___
+$code.=<<___;
+{ .mib;         add     T1=T1,H                 // T1=Ch(e,f,g)+h
+                _rotr   r8=$t1,$Sigma1[1] }     // ROTR(e,18)
+{ .mib;         xor     T2=T2,r10               // T2=((a & b) ^ (a & c) ^ (b & c))
+                mov     H=G             };;
+{ .mib;         xor     r11=r8,r11
+                _rotr   r9=$t1,$Sigma1[2] }     // ROTR(e,41)
+{ .mib;         mov     G=F
+                mov     F=E             };;
+{ .mib;         xor     r9=r9,r11               // r9=Sigma1(e)
+                _rotr   r10=$t0,$Sigma0[0] }    // ROTR(a,28)
+{ .mib;         add     T1=T1,K                 // T1=Ch(e,f,g)+h+K512[i]
+                mov     E=D             };;
+{ .mib;         add     T1=T1,r9                // T1+=Sigma1(e)
+                _rotr   r11=$t0,$Sigma0[1] }    // ROTR(a,34)
+{ .mib;         mov     D=C
+                mov     C=B             };;
+{ .mib;         add     T1=T1,X[15]             // T1+=X[i]
+                _rotr   r8=$t0,$Sigma0[2] }     // ROTR(a,39)
+{ .mib;         xor     r10=r10,r11
+                mux2    X[15]=X[15],0x44 };;    // eliminated in 64-bit
+{ .mmi;         xor     r10=r8,r10              // r10=Sigma0(a)
+                mov     B=A
+                add     A=T1,T2         };;
+{ .mib;         add     E=E,T1
+                add     A=A,r10                 // T2=Maj(a,b,c)+Sigma0(a)
+        br.ctop.sptk    .L_first16      };;
+.L_first16_end:
+
+{ .mii; mov     ar.lc=$rounds-17
+        mov     ar.ec=1                 };;
+
+.align  32
+.L_rest:
+.rotr   X[16]
+{ .mib;         $LDW    K=[Ktbl],$SZ
+                _rotr   r8=X[15-1],$sigma0[0] } // ROTR(s0,1)
+{ .mib;         $ADD    X[15]=X[15],X[15-9]     // X[i&0xF]+=X[(i+9)&0xF]
+                $SHRU   s0=X[15-1],sgm0 };;     // s0=X[(i+1)&0xF]>>7
+{ .mib;         and     T1=F,E
+                _rotr   r9=X[15-1],$sigma0[1] } // ROTR(s0,8)
+{ .mib;         andcm   r10=G,E
+                $SHRU   s1=X[15-14],sgm1 };;    // s1=X[(i+14)&0xF]>>6
+{ .mmi;         xor     T1=T1,r10               // T1=((e & f) ^ (~e & g))
+                xor     r9=r8,r9
+                _rotr   r10=X[15-14],$sigma1[0] };;// ROTR(s1,19)
+{ .mib;         and     T2=A,B          
+                _rotr   r11=X[15-14],$sigma1[1] }// ROTR(s1,61)
+{ .mib;         and     r8=A,C          };;
+___
+$t0="t0", $t1="t1", $code.=<<___ if ($BITS==32);
+// I adhere to mmi; in order to hold Itanium 1 back and avoid 6 cycle
+// pipeline flush in last bundle. Note that even on Itanium2 the
+// latter stalls for one clock cycle...
+{ .mmi;         xor     s0=s0,r9                // s0=sigma0(X[(i+1)&0xF])
+                dep.z   $t1=E,32,32     }
+{ .mmi;         xor     r10=r11,r10
+                zxt4    E=E             };;
+{ .mmi;         or      $t1=$t1,E
+                xor     s1=s1,r10               // s1=sigma1(X[(i+14)&0xF])
+                mux2    $t0=A,0x44      };;     // copy lower half to upper
+{ .mmi;         xor     T2=T2,r8
+                _rotr   r9=$t1,$Sigma1[0] }     // ROTR(e,14)
+{ .mmi;         and     r10=B,C
+                add     T1=T1,H                 // T1=Ch(e,f,g)+h
+                $ADD    X[15]=X[15],s0  };;     // X[i&0xF]+=sigma0(X[(i+1)&0xF])
+___
+$t0="A", $t1="E", $code.=<<___ if ($BITS==64);
+{ .mib;         xor     s0=s0,r9                // s0=sigma0(X[(i+1)&0xF])
+                _rotr   r9=$t1,$Sigma1[0] }     // ROTR(e,14)
+{ .mib;         xor     r10=r11,r10
+                xor     T2=T2,r8        };;
+{ .mib;         xor     s1=s1,r10               // s1=sigma1(X[(i+14)&0xF])
+                add     T1=T1,H         }
+{ .mib;         and     r10=B,C
+                $ADD    X[15]=X[15],s0  };;     // X[i&0xF]+=sigma0(X[(i+1)&0xF])
+___
+$code.=<<___;
+{ .mmi;         xor     T2=T2,r10               // T2=((a & b) ^ (a & c) ^ (b & c))
+                mov     H=G
+                _rotr   r8=$t1,$Sigma1[1] };;   // ROTR(e,18)
+{ .mmi;         xor     r11=r8,r9
+                $ADD    X[15]=X[15],s1          // X[i&0xF]+=sigma1(X[(i+14)&0xF])
+                _rotr   r9=$t1,$Sigma1[2] }     // ROTR(e,41)
+{ .mmi;         mov     G=F
+                mov     F=E             };;
+{ .mib;         xor     r9=r9,r11               // r9=Sigma1(e)
+                _rotr   r10=$t0,$Sigma0[0] }    // ROTR(a,28)
+{ .mib;         add     T1=T1,K                 // T1=Ch(e,f,g)+h+K512[i]
+                mov     E=D             };;
+{ .mib;         add     T1=T1,r9                // T1+=Sigma1(e)
+                _rotr   r11=$t0,$Sigma0[1] }    // ROTR(a,34)
+{ .mib;         mov     D=C
+                mov     C=B             };;
+{ .mmi;         add     T1=T1,X[15]             // T1+=X[i]
+                xor     r10=r10,r11
+                _rotr   r8=$t0,$Sigma0[2] };;   // ROTR(a,39)
+{ .mmi;         xor     r10=r8,r10              // r10=Sigma0(a)
+                mov     B=A
+                add     A=T1,T2         };;
+{ .mib;         add     E=E,T1
+                add     A=A,r10                 // T2=Maj(a,b,c)+Sigma0(a)
+        br.ctop.sptk    .L_rest };;
+.L_rest_end:
+
+{ .mmi; add     A_=A_,A
+        add     B_=B_,B
+        add     C_=C_,C                 }
+{ .mmi; add     D_=D_,D
+        add     E_=E_,E
+        cmp.ltu p16,p0=1,num            };;
+{ .mmi; add     F_=F_,F
+        add     G_=G_,G
+        add     H_=H_,H                 }
+{ .mmb; add     Ktbl=-$SZ*$rounds,Ktbl
+(p16)   add     num=-1,num
+(p16)   br.dptk.many    .L_outer        };;
+
+{ .mib; add     r8=0*$SZ,ctx
+        add     r9=1*$SZ,ctx            }
+{ .mib; add     r10=2*$SZ,ctx
+        add     r11=3*$SZ,ctx           };;
+{ .mmi; $STW    [r8]=A_,4*$SZ
+        $STW    [r9]=B_,4*$SZ
+        mov     ar.lc=lcsave            }
+{ .mmi; $STW    [r10]=C_,4*$SZ
+        $STW    [r11]=D_,4*$SZ
+        mov     pr=prsave,0x1ffff       };;
+{ .mmb; $STW    [r8]=E_
+        $STW    [r9]=F_                 }
+{ .mmb; $STW    [r10]=G_
+        $STW    [r11]=H_
+        br.ret.sptk.many        b0      };;
+.endp   $func#
+___
+
+$code =~ s/\`([^\`]*)\`/eval $1/gem;
+$code =~ s/_rotr(\s+)([^=]+)=([^,]+),([0-9]+)/shrp$1$2=$3,$3,$4/gm;
+if ($BITS==64) {
+    $code =~ s/mux2(\s+)\S+/nop.i$1 0x0/gm;
+    $code =~ s/mux1(\s+)\S+/nop.i$1 0x0/gm      if ($big_endian);
+    $code =~ s/(shrp\s+X\[[^=]+)=([^,]+),([^,]+),([1-9]+)/$1=$3,$2,64-$4/gm
+                                                if (!$big_endian);
+    $code =~ s/ld1(\s+)X\[\S+/nop.m$1 0x0/gm;
+}
+
+print $code;
+
+print<<___ if ($BITS==32);
+.align  64
+.type   K256#,\@object
+K256:   data4   0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5
+        data4   0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5
+        data4   0xd807aa98,0x12835b01,0x243185be,0x550c7dc3
+        data4   0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174
+        data4   0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc
+        data4   0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da
+        data4   0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7
+        data4   0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967
+        data4   0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13
+        data4   0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85
+        data4   0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3
+        data4   0xd192e819,0xd6990624,0xf40e3585,0x106aa070
+        data4   0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5
+        data4   0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3
+        data4   0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208
+        data4   0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
+.size   K256#,$SZ*$rounds
+stringz "SHA256 block transform for IA64, CRYPTOGAMS by <appro\@openssl.org>"
+___
+print<<___ if ($BITS==64);
+.align  64
+.type   K512#,\@object
+K512:   data8   0x428a2f98d728ae22,0x7137449123ef65cd
+        data8   0xb5c0fbcfec4d3b2f,0xe9b5dba58189dbbc
+        data8   0x3956c25bf348b538,0x59f111f1b605d019
+        data8   0x923f82a4af194f9b,0xab1c5ed5da6d8118
+        data8   0xd807aa98a3030242,0x12835b0145706fbe
+        data8   0x243185be4ee4b28c,0x550c7dc3d5ffb4e2
+        data8   0x72be5d74f27b896f,0x80deb1fe3b1696b1
+        data8   0x9bdc06a725c71235,0xc19bf174cf692694
+        data8   0xe49b69c19ef14ad2,0xefbe4786384f25e3
+        data8   0x0fc19dc68b8cd5b5,0x240ca1cc77ac9c65
+        data8   0x2de92c6f592b0275,0x4a7484aa6ea6e483
+        data8   0x5cb0a9dcbd41fbd4,0x76f988da831153b5
+        data8   0x983e5152ee66dfab,0xa831c66d2db43210
+        data8   0xb00327c898fb213f,0xbf597fc7beef0ee4
+        data8   0xc6e00bf33da88fc2,0xd5a79147930aa725
+        data8   0x06ca6351e003826f,0x142929670a0e6e70
+        data8   0x27b70a8546d22ffc,0x2e1b21385c26c926
+        data8   0x4d2c6dfc5ac42aed,0x53380d139d95b3df
+        data8   0x650a73548baf63de,0x766a0abb3c77b2a8
+        data8   0x81c2c92e47edaee6,0x92722c851482353b
+        data8   0xa2bfe8a14cf10364,0xa81a664bbc423001
+        data8   0xc24b8b70d0f89791,0xc76c51a30654be30
+        data8   0xd192e819d6ef5218,0xd69906245565a910
+        data8   0xf40e35855771202a,0x106aa07032bbd1b8
+        data8   0x19a4c116b8d2d0c8,0x1e376c085141ab53
+        data8   0x2748774cdf8eeb99,0x34b0bcb5e19b48a8
+        data8   0x391c0cb3c5c95a63,0x4ed8aa4ae3418acb
+        data8   0x5b9cca4f7763e373,0x682e6ff3d6b2b8a3
+        data8   0x748f82ee5defb2fc,0x78a5636f43172f60
+        data8   0x84c87814a1f0ab72,0x8cc702081a6439ec
+        data8   0x90befffa23631e28,0xa4506cebde82bde9
+        data8   0xbef9a3f7b2c67915,0xc67178f2e372532b
+        data8   0xca273eceea26619c,0xd186b8c721c0c207
+        data8   0xeada7dd6cde0eb1e,0xf57d4f7fee6ed178
+        data8   0x06f067aa72176fba,0x0a637dc5a2c898a6
+        data8   0x113f9804bef90dae,0x1b710b35131c471b
+        data8   0x28db77f523047d84,0x32caab7b40c72493
+        data8   0x3c9ebe0a15c9bebc,0x431d67c49c100d4c
+        data8   0x4cc5d4becb3e42b6,0x597f299cfc657e2a
+        data8   0x5fcb6fab3ad6faec,0x6c44198c4a475817
+.size   K512#,$SZ*$rounds
+stringz "SHA512 block transform for IA64, CRYPTOGAMS by <appro\@openssl.org>"
+___
diff --git a/src/lib/libssl/src/crypto/sha/asm/sha512-x86_64.pl b/src/lib/libssl/src/crypto/sha/asm/sha512-x86_64.pl
new file mode 100755
index 0000000000..b6252d31ec
--- /dev/null
+++ b/src/lib/libssl/src/crypto/sha/asm/sha512-x86_64.pl
@@ -0,0 +1,344 @@
+#!/usr/bin/env perl
+#
+# ====================================================================
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# project. Rights for redistribution and usage in source and binary
+# forms are granted according to the OpenSSL license.
+# ====================================================================
+#
+# sha256/512_block procedure for x86_64.
+#
+# 40% improvement over compiler-generated code on Opteron. On EM64T
+# sha256 was observed to run >80% faster and sha512 - >40%. No magical
+# tricks, just straight implementation... I really wonder why gcc
+# [being armed with inline assembler] fails to generate as fast code.
+# The only thing which is cool about this module is that it's very
+# same instruction sequence used for both SHA-256 and SHA-512. In
+# former case the instructions operate on 32-bit operands, while in
+# latter - on 64-bit ones. All I had to do is to get one flavor right,
+# the other one passed the test right away:-)
+#
+# sha256_block runs in ~1005 cycles on Opteron, which gives you
+# asymptotic performance of 64*1000/1005=63.7MBps times CPU clock
+# frequency in GHz. sha512_block runs in ~1275 cycles, which results
+# in 128*1000/1275=100MBps per GHz. Is there room for improvement?
+# Well, if you compare it to IA-64 implementation, which maintains
+# X[16] in register bank[!], tends to 4 instructions per CPU clock
+# cycle and runs in 1003 cycles, 1275 is very good result for 3-way
+# issue Opteron pipeline and X[16] maintained in memory. So that *if*
+# there is a way to improve it, *then* the only way would be to try to
+# offload X[16] updates to SSE unit, but that would require "deeper"
+# loop unroll, which in turn would naturally cause size blow-up, not
+# to mention increased complexity! And once again, only *if* it's
+# actually possible to noticeably improve overall ILP, instruction
+# level parallelism, on a given CPU implementation in this case.
+#
+# Special note on Intel EM64T. While Opteron CPU exhibits perfect
+# perfromance ratio of 1.5 between 64- and 32-bit flavors [see above],
+# [currently available] EM64T CPUs apparently are far from it. On the
+# contrary, 64-bit version, sha512_block, is ~30% *slower* than 32-bit
+# sha256_block:-( This is presumably because 64-bit shifts/rotates
+# apparently are not atomic instructions, but implemented in microcode.
+
+$output=shift;
+
+$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
+( $xlate="${dir}x86_64-xlate.pl" and -f $xlate ) or
+( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or
+die "can't locate x86_64-xlate.pl";
+
+open STDOUT,"| $^X $xlate $output";
+
+if ($output =~ /512/) {
+        $func="sha512_block_data_order";
+        $TABLE="K512";
+        $SZ=8;
+        @ROT=($A,$B,$C,$D,$E,$F,$G,$H)=("%rax","%rbx","%rcx","%rdx",
+                                        "%r8", "%r9", "%r10","%r11");
+        ($T1,$a0,$a1,$a2)=("%r12","%r13","%r14","%r15");
+        @Sigma0=(28,34,39);
+        @Sigma1=(14,18,41);
+        @sigma0=(1,  8, 7);
+        @sigma1=(19,61, 6);
+        $rounds=80;
+} else {
+        $func="sha256_block_data_order";
+        $TABLE="K256";
+        $SZ=4;
+        @ROT=($A,$B,$C,$D,$E,$F,$G,$H)=("%eax","%ebx","%ecx","%edx",
+                                        "%r8d","%r9d","%r10d","%r11d");
+        ($T1,$a0,$a1,$a2)=("%r12d","%r13d","%r14d","%r15d");
+        @Sigma0=( 2,13,22);
+        @Sigma1=( 6,11,25);
+        @sigma0=( 7,18, 3);
+        @sigma1=(17,19,10);
+        $rounds=64;
+}
+
+$ctx="%rdi";    # 1st arg
+$round="%rdi";  # zaps $ctx
+$inp="%rsi";    # 2nd arg
+$Tbl="%rbp";
+
+$_ctx="16*$SZ+0*8(%rsp)";
+$_inp="16*$SZ+1*8(%rsp)";
+$_end="16*$SZ+2*8(%rsp)";
+$_rsp="16*$SZ+3*8(%rsp)";
+$framesz="16*$SZ+4*8";
+
+
+sub ROUND_00_15()
+{ my ($i,$a,$b,$c,$d,$e,$f,$g,$h) = @_;
+
+$code.=<<___;
+        mov     $e,$a0
+        mov     $e,$a1
+        mov     $f,$a2
+
+        ror     \$$Sigma1[0],$a0
+        ror     \$$Sigma1[1],$a1
+        xor     $g,$a2                  # f^g
+
+        xor     $a1,$a0
+        ror     \$`$Sigma1[2]-$Sigma1[1]`,$a1
+        and     $e,$a2                  # (f^g)&e
+        mov     $T1,`$SZ*($i&0xf)`(%rsp)
+
+        xor     $a1,$a0                 # Sigma1(e)
+        xor     $g,$a2                  # Ch(e,f,g)=((f^g)&e)^g
+        add     $h,$T1                  # T1+=h
+
+        mov     $a,$h
+        add     $a0,$T1                 # T1+=Sigma1(e)
+
+        add     $a2,$T1                 # T1+=Ch(e,f,g)
+        mov     $a,$a0
+        mov     $a,$a1
+
+        ror     \$$Sigma0[0],$h
+        ror     \$$Sigma0[1],$a0
+        mov     $a,$a2
+        add     ($Tbl,$round,$SZ),$T1   # T1+=K[round]
+
+        xor     $a0,$h
+        ror     \$`$Sigma0[2]-$Sigma0[1]`,$a0
+        or      $c,$a1                  # a|c
+
+        xor     $a0,$h                  # h=Sigma0(a)
+        and     $c,$a2                  # a&c
+        add     $T1,$d                  # d+=T1
+
+        and     $b,$a1                  # (a|c)&b
+        add     $T1,$h                  # h+=T1
+
+        or      $a2,$a1                 # Maj(a,b,c)=((a|c)&b)|(a&c)
+        lea     1($round),$round        # round++
+
+        add     $a1,$h                  # h+=Maj(a,b,c)
+___
+}
+
+sub ROUND_16_XX()
+{ my ($i,$a,$b,$c,$d,$e,$f,$g,$h) = @_;
+
+$code.=<<___;
+        mov     `$SZ*(($i+1)&0xf)`(%rsp),$a0
+        mov     `$SZ*(($i+14)&0xf)`(%rsp),$T1
+
+        mov     $a0,$a2
+
+        shr     \$$sigma0[2],$a0
+        ror     \$$sigma0[0],$a2
+
+        xor     $a2,$a0
+        ror     \$`$sigma0[1]-$sigma0[0]`,$a2
+
+        xor     $a2,$a0                 # sigma0(X[(i+1)&0xf])
+        mov     $T1,$a1
+
+        shr     \$$sigma1[2],$T1
+        ror     \$$sigma1[0],$a1
+
+        xor     $a1,$T1
+        ror     \$`$sigma1[1]-$sigma1[0]`,$a1
+
+        xor     $a1,$T1                 # sigma1(X[(i+14)&0xf])
+
+        add     $a0,$T1
+
+        add     `$SZ*(($i+9)&0xf)`(%rsp),$T1
+
+        add     `$SZ*($i&0xf)`(%rsp),$T1
+___
+        &ROUND_00_15(@_);
+}
+
+$code=<<___;
+.text
+
+.globl  $func
+.type   $func,\@function,4
+.align  16
+$func:
+        push    %rbx
+        push    %rbp
+        push    %r12
+        push    %r13
+        push    %r14
+        push    %r15
+        mov     %rsp,%rbp               # copy %rsp
+        shl     \$4,%rdx                # num*16
+        sub     \$$framesz,%rsp
+        lea     ($inp,%rdx,$SZ),%rdx    # inp+num*16*$SZ
+        and     \$-64,%rsp              # align stack frame
+        mov     $ctx,$_ctx              # save ctx, 1st arg
+        mov     $inp,$_inp              # save inp, 2nd arh
+        mov     %rdx,$_end              # save end pointer, "3rd" arg
+        mov     %rbp,$_rsp              # save copy of %rsp
+
+        .picmeup $Tbl
+        lea     $TABLE-.($Tbl),$Tbl
+
+        mov     $SZ*0($ctx),$A
+        mov     $SZ*1($ctx),$B
+        mov     $SZ*2($ctx),$C
+        mov     $SZ*3($ctx),$D
+        mov     $SZ*4($ctx),$E
+        mov     $SZ*5($ctx),$F
+        mov     $SZ*6($ctx),$G
+        mov     $SZ*7($ctx),$H
+        jmp     .Lloop
+
+.align  16
+.Lloop:
+        xor     $round,$round
+___
+        for($i=0;$i<16;$i++) {
+                $code.="        mov     $SZ*$i($inp),$T1\n";
+                $code.="        bswap   $T1\n";
+                &ROUND_00_15($i,@ROT);
+                unshift(@ROT,pop(@ROT));
+        }
+$code.=<<___;
+        jmp     .Lrounds_16_xx
+.align  16
+.Lrounds_16_xx:
+___
+        for(;$i<32;$i++) {
+                &ROUND_16_XX($i,@ROT);
+                unshift(@ROT,pop(@ROT));
+        }
+
+$code.=<<___;
+        cmp     \$$rounds,$round
+        jb      .Lrounds_16_xx
+
+        mov     $_ctx,$ctx
+        lea     16*$SZ($inp),$inp
+
+        add     $SZ*0($ctx),$A
+        add     $SZ*1($ctx),$B
+        add     $SZ*2($ctx),$C
+        add     $SZ*3($ctx),$D
+        add     $SZ*4($ctx),$E
+        add     $SZ*5($ctx),$F
+        add     $SZ*6($ctx),$G
+        add     $SZ*7($ctx),$H
+
+        cmp     $_end,$inp
+
+        mov     $A,$SZ*0($ctx)
+        mov     $B,$SZ*1($ctx)
+        mov     $C,$SZ*2($ctx)
+        mov     $D,$SZ*3($ctx)
+        mov     $E,$SZ*4($ctx)
+        mov     $F,$SZ*5($ctx)
+        mov     $G,$SZ*6($ctx)
+        mov     $H,$SZ*7($ctx)
+        jb      .Lloop
+
+        mov     $_rsp,%rsp
+        pop     %r15
+        pop     %r14
+        pop     %r13
+        pop     %r12
+        pop     %rbp
+        pop     %rbx
+
+        ret
+.size   $func,.-$func
+___
+
+if ($SZ==4) {
+$code.=<<___;
+.align  64
+.type   $TABLE,\@object
+$TABLE:
+        .long   0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5
+        .long   0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5
+        .long   0xd807aa98,0x12835b01,0x243185be,0x550c7dc3
+        .long   0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174
+        .long   0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc
+        .long   0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da
+        .long   0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7
+        .long   0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967
+        .long   0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13
+        .long   0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85
+        .long   0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3
+        .long   0xd192e819,0xd6990624,0xf40e3585,0x106aa070
+        .long   0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5
+        .long   0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3
+        .long   0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208
+        .long   0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
+___
+} else {
+$code.=<<___;
+.align  64
+.type   $TABLE,\@object
+$TABLE:
+        .quad   0x428a2f98d728ae22,0x7137449123ef65cd
+        .quad   0xb5c0fbcfec4d3b2f,0xe9b5dba58189dbbc
+        .quad   0x3956c25bf348b538,0x59f111f1b605d019
+        .quad   0x923f82a4af194f9b,0xab1c5ed5da6d8118
+        .quad   0xd807aa98a3030242,0x12835b0145706fbe
+        .quad   0x243185be4ee4b28c,0x550c7dc3d5ffb4e2
+        .quad   0x72be5d74f27b896f,0x80deb1fe3b1696b1
+        .quad   0x9bdc06a725c71235,0xc19bf174cf692694
+        .quad   0xe49b69c19ef14ad2,0xefbe4786384f25e3
+        .quad   0x0fc19dc68b8cd5b5,0x240ca1cc77ac9c65
+        .quad   0x2de92c6f592b0275,0x4a7484aa6ea6e483
+        .quad   0x5cb0a9dcbd41fbd4,0x76f988da831153b5
+        .quad   0x983e5152ee66dfab,0xa831c66d2db43210
+        .quad   0xb00327c898fb213f,0xbf597fc7beef0ee4
+        .quad   0xc6e00bf33da88fc2,0xd5a79147930aa725
+        .quad   0x06ca6351e003826f,0x142929670a0e6e70
+        .quad   0x27b70a8546d22ffc,0x2e1b21385c26c926
+        .quad   0x4d2c6dfc5ac42aed,0x53380d139d95b3df
+        .quad   0x650a73548baf63de,0x766a0abb3c77b2a8
+        .quad   0x81c2c92e47edaee6,0x92722c851482353b
+        .quad   0xa2bfe8a14cf10364,0xa81a664bbc423001
+        .quad   0xc24b8b70d0f89791,0xc76c51a30654be30
+        .quad   0xd192e819d6ef5218,0xd69906245565a910
+        .quad   0xf40e35855771202a,0x106aa07032bbd1b8
+        .quad   0x19a4c116b8d2d0c8,0x1e376c085141ab53
+        .quad   0x2748774cdf8eeb99,0x34b0bcb5e19b48a8
+        .quad   0x391c0cb3c5c95a63,0x4ed8aa4ae3418acb
+        .quad   0x5b9cca4f7763e373,0x682e6ff3d6b2b8a3
+        .quad   0x748f82ee5defb2fc,0x78a5636f43172f60
+        .quad   0x84c87814a1f0ab72,0x8cc702081a6439ec
+        .quad   0x90befffa23631e28,0xa4506cebde82bde9
+        .quad   0xbef9a3f7b2c67915,0xc67178f2e372532b
+        .quad   0xca273eceea26619c,0xd186b8c721c0c207
+        .quad   0xeada7dd6cde0eb1e,0xf57d4f7fee6ed178
+        .quad   0x06f067aa72176fba,0x0a637dc5a2c898a6
+        .quad   0x113f9804bef90dae,0x1b710b35131c471b
+        .quad   0x28db77f523047d84,0x32caab7b40c72493
+        .quad   0x3c9ebe0a15c9bebc,0x431d67c49c100d4c
+        .quad   0x4cc5d4becb3e42b6,0x597f299cfc657e2a
+        .quad   0x5fcb6fab3ad6faec,0x6c44198c4a475817
+___
+}
+
+$code =~ s/\`([^\`]*)\`/eval $1/gem;
+print $code;
+close STDOUT;
diff --git a/src/lib/libssl/src/crypto/sha/sha256.c b/src/lib/libssl/src/crypto/sha/sha256.c
new file mode 100644
index 0000000000..867f90cc97
--- /dev/null
+++ b/src/lib/libssl/src/crypto/sha/sha256.c
@@ -0,0 +1,282 @@
+/* crypto/sha/sha256.c */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved
+ * according to the OpenSSL license [found in ../../LICENSE].
+ * ====================================================================
+ */
+#include <openssl/opensslconf.h>
+#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA256)
+
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/crypto.h>
+#include <openssl/sha.h>
+#include <openssl/opensslv.h>
+
+const char SHA256_version[]="SHA-256" OPENSSL_VERSION_PTEXT;
+
+int SHA224_Init (SHA256_CTX *c)
+        {
+        c->h[0]=0xc1059ed8UL;   c->h[1]=0x367cd507UL;
+        c->h[2]=0x3070dd17UL;   c->h[3]=0xf70e5939UL;
+        c->h[4]=0xffc00b31UL;   c->h[5]=0x68581511UL;
+        c->h[6]=0x64f98fa7UL;   c->h[7]=0xbefa4fa4UL;
+        c->Nl=0;        c->Nh=0;
+        c->num=0;       c->md_len=SHA224_DIGEST_LENGTH;
+        return 1;
+        }
+
+int SHA256_Init (SHA256_CTX *c)
+        {
+        c->h[0]=0x6a09e667UL;   c->h[1]=0xbb67ae85UL;
+        c->h[2]=0x3c6ef372UL;   c->h[3]=0xa54ff53aUL;
+        c->h[4]=0x510e527fUL;   c->h[5]=0x9b05688cUL;
+        c->h[6]=0x1f83d9abUL;   c->h[7]=0x5be0cd19UL;
+        c->Nl=0;        c->Nh=0;
+        c->num=0;       c->md_len=SHA256_DIGEST_LENGTH;
+        return 1;
+        }
+
+unsigned char *SHA224(const unsigned char *d, size_t n, unsigned char *md)
+        {
+        SHA256_CTX c;
+        static unsigned char m[SHA224_DIGEST_LENGTH];
+
+        if (md == NULL) md=m;
+        SHA224_Init(&c);
+        SHA256_Update(&c,d,n);
+        SHA256_Final(md,&c);
+        OPENSSL_cleanse(&c,sizeof(c));
+        return(md);
+        }
+
+unsigned char *SHA256(const unsigned char *d, size_t n, unsigned char *md)
+        {
+        SHA256_CTX c;
+        static unsigned char m[SHA256_DIGEST_LENGTH];
+
+        if (md == NULL) md=m;
+        SHA256_Init(&c);
+        SHA256_Update(&c,d,n);
+        SHA256_Final(md,&c);
+        OPENSSL_cleanse(&c,sizeof(c));
+        return(md);
+        }
+
+int SHA224_Update(SHA256_CTX *c, const void *data, size_t len)
+{   return SHA256_Update (c,data,len);   }
+int SHA224_Final (unsigned char *md, SHA256_CTX *c)
+{   return SHA256_Final (md,c);   }
+
+#define DATA_ORDER_IS_BIG_ENDIAN
+
+#define HASH_LONG               SHA_LONG
+#define HASH_CTX                SHA256_CTX
+#define HASH_CBLOCK             SHA_CBLOCK
+/*
+ * Note that FIPS180-2 discusses "Truncation of the Hash Function Output."
+ * default: case below covers for it. It's not clear however if it's
+ * permitted to truncate to amount of bytes not divisible by 4. I bet not,
+ * but if it is, then default: case shall be extended. For reference.
+ * Idea behind separate cases for pre-defined lenghts is to let the
+ * compiler decide if it's appropriate to unroll small loops.
+ */
+#define HASH_MAKE_STRING(c,s)   do {    \
+        unsigned long ll;               \
+        unsigned int  xn;               \
+        switch ((c)->md_len)            \
+        {   case SHA224_DIGEST_LENGTH:  \
+                for (xn=0;xn<SHA224_DIGEST_LENGTH/4;xn++)       \
+                {   ll=(c)->h[xn]; HOST_l2c(ll,(s));   }        \
+                break;                  \
+            case SHA256_DIGEST_LENGTH:  \
+                for (xn=0;xn<SHA256_DIGEST_LENGTH/4;xn++)       \
+                {   ll=(c)->h[xn]; HOST_l2c(ll,(s));   }        \
+                break;                  \
+            default:                    \
+                if ((c)->md_len > SHA256_DIGEST_LENGTH) \
+                    return 0;                           \
+                for (xn=0;xn<(c)->md_len/4;xn++)                \
+                {   ll=(c)->h[xn]; HOST_l2c(ll,(s));   }        \
+                break;                  \
+        }                               \
+        } while (0)
+
+#define HASH_UPDATE             SHA256_Update
+#define HASH_TRANSFORM          SHA256_Transform
+#define HASH_FINAL              SHA256_Final
+#define HASH_BLOCK_DATA_ORDER   sha256_block_data_order
+#ifndef SHA256_ASM
+static
+#endif
+void sha256_block_data_order (SHA256_CTX *ctx, const void *in, size_t num);
+
+#include "md32_common.h"
+
+#ifndef SHA256_ASM
+static const SHA_LONG K256[64] = {
+        0x428a2f98UL,0x71374491UL,0xb5c0fbcfUL,0xe9b5dba5UL,
+        0x3956c25bUL,0x59f111f1UL,0x923f82a4UL,0xab1c5ed5UL,
+        0xd807aa98UL,0x12835b01UL,0x243185beUL,0x550c7dc3UL,
+        0x72be5d74UL,0x80deb1feUL,0x9bdc06a7UL,0xc19bf174UL,
+        0xe49b69c1UL,0xefbe4786UL,0x0fc19dc6UL,0x240ca1ccUL,
+        0x2de92c6fUL,0x4a7484aaUL,0x5cb0a9dcUL,0x76f988daUL,
+        0x983e5152UL,0xa831c66dUL,0xb00327c8UL,0xbf597fc7UL,
+        0xc6e00bf3UL,0xd5a79147UL,0x06ca6351UL,0x14292967UL,
+        0x27b70a85UL,0x2e1b2138UL,0x4d2c6dfcUL,0x53380d13UL,
+        0x650a7354UL,0x766a0abbUL,0x81c2c92eUL,0x92722c85UL,
+        0xa2bfe8a1UL,0xa81a664bUL,0xc24b8b70UL,0xc76c51a3UL,
+        0xd192e819UL,0xd6990624UL,0xf40e3585UL,0x106aa070UL,
+        0x19a4c116UL,0x1e376c08UL,0x2748774cUL,0x34b0bcb5UL,
+        0x391c0cb3UL,0x4ed8aa4aUL,0x5b9cca4fUL,0x682e6ff3UL,
+        0x748f82eeUL,0x78a5636fUL,0x84c87814UL,0x8cc70208UL,
+        0x90befffaUL,0xa4506cebUL,0xbef9a3f7UL,0xc67178f2UL };
+
+/*
+ * FIPS specification refers to right rotations, while our ROTATE macro
+ * is left one. This is why you might notice that rotation coefficients
+ * differ from those observed in FIPS document by 32-N...
+ */
+#define Sigma0(x)       (ROTATE((x),30) ^ ROTATE((x),19) ^ ROTATE((x),10))
+#define Sigma1(x)       (ROTATE((x),26) ^ ROTATE((x),21) ^ ROTATE((x),7))
+#define sigma0(x)       (ROTATE((x),25) ^ ROTATE((x),14) ^ ((x)>>3))
+#define sigma1(x)       (ROTATE((x),15) ^ ROTATE((x),13) ^ ((x)>>10))
+
+#define Ch(x,y,z)       (((x) & (y)) ^ ((~(x)) & (z)))
+#define Maj(x,y,z)      (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
+
+#ifdef OPENSSL_SMALL_FOOTPRINT
+
+static void sha256_block_data_order (SHA256_CTX *ctx, const void *in, size_t num)
+        {
+        unsigned MD32_REG_T a,b,c,d,e,f,g,h,s0,s1,T1,T2;
+        SHA_LONG        X[16],l;
+        int i;
+        const unsigned char *data=in;
+
+                        while (num--) {
+
+        a = ctx->h[0];  b = ctx->h[1];  c = ctx->h[2];  d = ctx->h[3];
+        e = ctx->h[4];  f = ctx->h[5];  g = ctx->h[6];  h = ctx->h[7];
+
+        for (i=0;i<16;i++)
+                {
+                HOST_c2l(data,l); T1 = X[i] = l;
+                T1 += h + Sigma1(e) + Ch(e,f,g) + K256[i];
+                T2 = Sigma0(a) + Maj(a,b,c);
+                h = g;  g = f;  f = e;  e = d + T1;
+                d = c;  c = b;  b = a;  a = T1 + T2;
+                }
+
+        for (;i<64;i++)
+                {
+                s0 = X[(i+1)&0x0f];     s0 = sigma0(s0);
+                s1 = X[(i+14)&0x0f];    s1 = sigma1(s1);
+
+                T1 = X[i&0xf] += s0 + s1 + X[(i+9)&0xf];
+                T1 += h + Sigma1(e) + Ch(e,f,g) + K256[i];
+                T2 = Sigma0(a) + Maj(a,b,c);
+                h = g;  g = f;  f = e;  e = d + T1;
+                d = c;  c = b;  b = a;  a = T1 + T2;
+                }
+
+        ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
+        ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;
+
+                        }
+}
+
+#else
+
+#define ROUND_00_15(i,a,b,c,d,e,f,g,h)          do {    \
+        T1 += h + Sigma1(e) + Ch(e,f,g) + K256[i];      \
+        h = Sigma0(a) + Maj(a,b,c);                     \
+        d += T1;        h += T1;                } while (0)
+
+#define ROUND_16_63(i,a,b,c,d,e,f,g,h,X)        do {    \
+        s0 = X[(i+1)&0x0f];     s0 = sigma0(s0);        \
+        s1 = X[(i+14)&0x0f];    s1 = sigma1(s1);        \
+        T1 = X[(i)&0x0f] += s0 + s1 + X[(i+9)&0x0f];    \
+        ROUND_00_15(i,a,b,c,d,e,f,g,h);         } while (0)
+
+static void sha256_block_data_order (SHA256_CTX *ctx, const void *in, size_t num)
+        {
+        unsigned MD32_REG_T a,b,c,d,e,f,g,h,s0,s1,T1;
+        SHA_LONG        X[16];
+        int i;
+        const unsigned char *data=in;
+        const union { long one; char little; } is_endian = {1};
+
+                        while (num--) {
+
+        a = ctx->h[0];  b = ctx->h[1];  c = ctx->h[2];  d = ctx->h[3];
+        e = ctx->h[4];  f = ctx->h[5];  g = ctx->h[6];  h = ctx->h[7];
+
+        if (!is_endian.little && sizeof(SHA_LONG)==4 && ((size_t)in%4)==0)
+                {
+                const SHA_LONG *W=(const SHA_LONG *)data;
+
+                T1 = X[0] = W[0];       ROUND_00_15(0,a,b,c,d,e,f,g,h);
+                T1 = X[1] = W[1];       ROUND_00_15(1,h,a,b,c,d,e,f,g);
+                T1 = X[2] = W[2];       ROUND_00_15(2,g,h,a,b,c,d,e,f);
+                T1 = X[3] = W[3];       ROUND_00_15(3,f,g,h,a,b,c,d,e);
+                T1 = X[4] = W[4];       ROUND_00_15(4,e,f,g,h,a,b,c,d);
+                T1 = X[5] = W[5];       ROUND_00_15(5,d,e,f,g,h,a,b,c);
+                T1 = X[6] = W[6];       ROUND_00_15(6,c,d,e,f,g,h,a,b);
+                T1 = X[7] = W[7];       ROUND_00_15(7,b,c,d,e,f,g,h,a);
+                T1 = X[8] = W[8];       ROUND_00_15(8,a,b,c,d,e,f,g,h);
+                T1 = X[9] = W[9];       ROUND_00_15(9,h,a,b,c,d,e,f,g);
+                T1 = X[10] = W[10];     ROUND_00_15(10,g,h,a,b,c,d,e,f);
+                T1 = X[11] = W[11];     ROUND_00_15(11,f,g,h,a,b,c,d,e);
+                T1 = X[12] = W[12];     ROUND_00_15(12,e,f,g,h,a,b,c,d);
+                T1 = X[13] = W[13];     ROUND_00_15(13,d,e,f,g,h,a,b,c);
+                T1 = X[14] = W[14];     ROUND_00_15(14,c,d,e,f,g,h,a,b);
+                T1 = X[15] = W[15];     ROUND_00_15(15,b,c,d,e,f,g,h,a);
+
+                data += SHA256_CBLOCK;
+                }
+        else
+                {
+                SHA_LONG l;
+
+                HOST_c2l(data,l); T1 = X[0] = l;  ROUND_00_15(0,a,b,c,d,e,f,g,h);
+                HOST_c2l(data,l); T1 = X[1] = l;  ROUND_00_15(1,h,a,b,c,d,e,f,g);
+                HOST_c2l(data,l); T1 = X[2] = l;  ROUND_00_15(2,g,h,a,b,c,d,e,f);
+                HOST_c2l(data,l); T1 = X[3] = l;  ROUND_00_15(3,f,g,h,a,b,c,d,e);
+                HOST_c2l(data,l); T1 = X[4] = l;  ROUND_00_15(4,e,f,g,h,a,b,c,d);
+                HOST_c2l(data,l); T1 = X[5] = l;  ROUND_00_15(5,d,e,f,g,h,a,b,c);
+                HOST_c2l(data,l); T1 = X[6] = l;  ROUND_00_15(6,c,d,e,f,g,h,a,b);
+                HOST_c2l(data,l); T1 = X[7] = l;  ROUND_00_15(7,b,c,d,e,f,g,h,a);
+                HOST_c2l(data,l); T1 = X[8] = l;  ROUND_00_15(8,a,b,c,d,e,f,g,h);
+                HOST_c2l(data,l); T1 = X[9] = l;  ROUND_00_15(9,h,a,b,c,d,e,f,g);
+                HOST_c2l(data,l); T1 = X[10] = l; ROUND_00_15(10,g,h,a,b,c,d,e,f);
+                HOST_c2l(data,l); T1 = X[11] = l; ROUND_00_15(11,f,g,h,a,b,c,d,e);
+                HOST_c2l(data,l); T1 = X[12] = l; ROUND_00_15(12,e,f,g,h,a,b,c,d);
+                HOST_c2l(data,l); T1 = X[13] = l; ROUND_00_15(13,d,e,f,g,h,a,b,c);
+                HOST_c2l(data,l); T1 = X[14] = l; ROUND_00_15(14,c,d,e,f,g,h,a,b);
+                HOST_c2l(data,l); T1 = X[15] = l; ROUND_00_15(15,b,c,d,e,f,g,h,a);
+                }
+
+        for (i=16;i<64;i+=8)
+                {
+                ROUND_16_63(i+0,a,b,c,d,e,f,g,h,X);
+                ROUND_16_63(i+1,h,a,b,c,d,e,f,g,X);
+                ROUND_16_63(i+2,g,h,a,b,c,d,e,f,X);
+                ROUND_16_63(i+3,f,g,h,a,b,c,d,e,X);
+                ROUND_16_63(i+4,e,f,g,h,a,b,c,d,X);
+                ROUND_16_63(i+5,d,e,f,g,h,a,b,c,X);
+                ROUND_16_63(i+6,c,d,e,f,g,h,a,b,X);
+                ROUND_16_63(i+7,b,c,d,e,f,g,h,a,X);
+                }
+
+        ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
+        ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;
+
+                        }
+        }
+
+#endif
+#endif /* SHA256_ASM */
+
+#endif /* OPENSSL_NO_SHA256 */
diff --git a/src/lib/libssl/src/crypto/sha/sha256t.c b/src/lib/libssl/src/crypto/sha/sha256t.c
new file mode 100644
index 0000000000..6b4a3bd001
--- /dev/null
+++ b/src/lib/libssl/src/crypto/sha/sha256t.c
@@ -0,0 +1,147 @@
+/* crypto/sha/sha256t.c */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
+ * ====================================================================
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <openssl/sha.h>
+#include <openssl/evp.h>
+
+#if defined(OPENSSL_NO_SHA) || defined(OPENSSL_NO_SHA256)
+int main(int argc, char *argv[])
+{
+    printf("No SHA256 support\n");
+    return(0);
+}
+#else
+
+unsigned char app_b1[SHA256_DIGEST_LENGTH] = {
+        0xba,0x78,0x16,0xbf,0x8f,0x01,0xcf,0xea,
+        0x41,0x41,0x40,0xde,0x5d,0xae,0x22,0x23,
+        0xb0,0x03,0x61,0xa3,0x96,0x17,0x7a,0x9c,
+        0xb4,0x10,0xff,0x61,0xf2,0x00,0x15,0xad };
+
+unsigned char app_b2[SHA256_DIGEST_LENGTH] = {
+        0x24,0x8d,0x6a,0x61,0xd2,0x06,0x38,0xb8,
+        0xe5,0xc0,0x26,0x93,0x0c,0x3e,0x60,0x39,
+        0xa3,0x3c,0xe4,0x59,0x64,0xff,0x21,0x67,
+        0xf6,0xec,0xed,0xd4,0x19,0xdb,0x06,0xc1 };
+
+unsigned char app_b3[SHA256_DIGEST_LENGTH] = {
+        0xcd,0xc7,0x6e,0x5c,0x99,0x14,0xfb,0x92,
+        0x81,0xa1,0xc7,0xe2,0x84,0xd7,0x3e,0x67,
+        0xf1,0x80,0x9a,0x48,0xa4,0x97,0x20,0x0e,
+        0x04,0x6d,0x39,0xcc,0xc7,0x11,0x2c,0xd0 };
+
+unsigned char addenum_1[SHA224_DIGEST_LENGTH] = {
+        0x23,0x09,0x7d,0x22,0x34,0x05,0xd8,0x22,
+        0x86,0x42,0xa4,0x77,0xbd,0xa2,0x55,0xb3,
+        0x2a,0xad,0xbc,0xe4,0xbd,0xa0,0xb3,0xf7,
+        0xe3,0x6c,0x9d,0xa7 };
+
+unsigned char addenum_2[SHA224_DIGEST_LENGTH] = {
+        0x75,0x38,0x8b,0x16,0x51,0x27,0x76,0xcc,
+        0x5d,0xba,0x5d,0xa1,0xfd,0x89,0x01,0x50,
+        0xb0,0xc6,0x45,0x5c,0xb4,0xf5,0x8b,0x19,
+        0x52,0x52,0x25,0x25 };
+
+unsigned char addenum_3[SHA224_DIGEST_LENGTH] = {
+        0x20,0x79,0x46,0x55,0x98,0x0c,0x91,0xd8,
+        0xbb,0xb4,0xc1,0xea,0x97,0x61,0x8a,0x4b,
+        0xf0,0x3f,0x42,0x58,0x19,0x48,0xb2,0xee,
+        0x4e,0xe7,0xad,0x67 };
+
+int main (int argc,char **argv)
+{ unsigned char md[SHA256_DIGEST_LENGTH];
+  int           i;
+  EVP_MD_CTX    evp;
+
+    fprintf(stdout,"Testing SHA-256 ");
+
+    EVP_Digest ("abc",3,md,NULL,EVP_sha256(),NULL);
+    if (memcmp(md,app_b1,sizeof(app_b1)))
+    {   fflush(stdout);
+        fprintf(stderr,"\nTEST 1 of 3 failed.\n");
+        return 1;
+    }
+    else
+        fprintf(stdout,"."); fflush(stdout);
+
+    EVP_Digest ("abcdbcde""cdefdefg""efghfghi""ghijhijk"
+                "ijkljklm""klmnlmno""mnopnopq",56,md,NULL,EVP_sha256(),NULL);
+    if (memcmp(md,app_b2,sizeof(app_b2)))
+    {   fflush(stdout);
+        fprintf(stderr,"\nTEST 2 of 3 failed.\n");
+        return 1;
+    }
+    else
+        fprintf(stdout,"."); fflush(stdout);
+
+    EVP_MD_CTX_init (&evp);
+    EVP_DigestInit_ex (&evp,EVP_sha256(),NULL);
+    for (i=0;i<1000000;i+=160)
+        EVP_DigestUpdate (&evp, "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa",
+                                (1000000-i)<160?1000000-i:160);
+    EVP_DigestFinal_ex (&evp,md,NULL);
+    EVP_MD_CTX_cleanup (&evp);
+
+    if (memcmp(md,app_b3,sizeof(app_b3)))
+    {   fflush(stdout);
+        fprintf(stderr,"\nTEST 3 of 3 failed.\n");
+        return 1;
+    }
+    else
+        fprintf(stdout,"."); fflush(stdout);
+
+    fprintf(stdout," passed.\n"); fflush(stdout);
+
+    fprintf(stdout,"Testing SHA-224 ");
+
+    EVP_Digest ("abc",3,md,NULL,EVP_sha224(),NULL);
+    if (memcmp(md,addenum_1,sizeof(addenum_1)))
+    {   fflush(stdout);
+        fprintf(stderr,"\nTEST 1 of 3 failed.\n");
+        return 1;
+    }
+    else
+        fprintf(stdout,"."); fflush(stdout);
+
+    EVP_Digest ("abcdbcde""cdefdefg""efghfghi""ghijhijk"
+                "ijkljklm""klmnlmno""mnopnopq",56,md,NULL,EVP_sha224(),NULL);
+    if (memcmp(md,addenum_2,sizeof(addenum_2)))
+    {   fflush(stdout);
+        fprintf(stderr,"\nTEST 2 of 3 failed.\n");
+        return 1;
+    }
+    else
+        fprintf(stdout,"."); fflush(stdout);
+
+    EVP_MD_CTX_init (&evp);
+    EVP_DigestInit_ex (&evp,EVP_sha224(),NULL);
+    for (i=0;i<1000000;i+=64)
+        EVP_DigestUpdate (&evp, "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa",
+                                (1000000-i)<64?1000000-i:64);
+    EVP_DigestFinal_ex (&evp,md,NULL);
+    EVP_MD_CTX_cleanup (&evp);
+
+    if (memcmp(md,addenum_3,sizeof(addenum_3)))
+    {   fflush(stdout);
+        fprintf(stderr,"\nTEST 3 of 3 failed.\n");
+        return 1;
+    }
+    else
+        fprintf(stdout,"."); fflush(stdout);
+
+    fprintf(stdout," passed.\n"); fflush(stdout);
+
+  return 0;
+}
+#endif
diff --git a/src/lib/libssl/src/crypto/sha/sha512.c b/src/lib/libssl/src/crypto/sha/sha512.c
new file mode 100644
index 0000000000..987fc07c99
--- /dev/null
+++ b/src/lib/libssl/src/crypto/sha/sha512.c
@@ -0,0 +1,537 @@
+/* crypto/sha/sha512.c */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved
+ * according to the OpenSSL license [found in ../../LICENSE].
+ * ====================================================================
+ */
+#include <openssl/opensslconf.h>
+#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA512)
+/*
+ * IMPLEMENTATION NOTES.
+ *
+ * As you might have noticed 32-bit hash algorithms:
+ *
+ * - permit SHA_LONG to be wider than 32-bit (case on CRAY);
+ * - optimized versions implement two transform functions: one operating
+ *   on [aligned] data in host byte order and one - on data in input
+ *   stream byte order;
+ * - share common byte-order neutral collector and padding function
+ *   implementations, ../md32_common.h;
+ *
+ * Neither of the above applies to this SHA-512 implementations. Reasons
+ * [in reverse order] are:
+ *
+ * - it's the only 64-bit hash algorithm for the moment of this writing,
+ *   there is no need for common collector/padding implementation [yet];
+ * - by supporting only one transform function [which operates on
+ *   *aligned* data in input stream byte order, big-endian in this case]
+ *   we minimize burden of maintenance in two ways: a) collector/padding
+ *   function is simpler; b) only one transform function to stare at;
+ * - SHA_LONG64 is required to be exactly 64-bit in order to be able to
+ *   apply a number of optimizations to mitigate potential performance
+ *   penalties caused by previous design decision;
+ *
+ * Caveat lector.
+ *
+ * Implementation relies on the fact that "long long" is 64-bit on
+ * both 32- and 64-bit platforms. If some compiler vendor comes up
+ * with 128-bit long long, adjustment to sha.h would be required.
+ * As this implementation relies on 64-bit integer type, it's totally
+ * inappropriate for platforms which don't support it, most notably
+ * 16-bit platforms.
+ *                                      <appro@fy.chalmers.se>
+ */
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/crypto.h>
+#include <openssl/sha.h>
+#include <openssl/opensslv.h>
+
+#include "cryptlib.h"
+
+const char SHA512_version[]="SHA-512" OPENSSL_VERSION_PTEXT;
+
+#if defined(__i386) || defined(__i386__) || defined(_M_IX86) || \
+    defined(__x86_64) || defined(_M_AMD64) || defined(_M_X64) || \
+    defined(__s390__) || defined(__s390x__) || \
+    defined(SHA512_ASM)
+#define SHA512_BLOCK_CAN_MANAGE_UNALIGNED_DATA
+#endif
+
+int SHA384_Init (SHA512_CTX *c)
+        {
+        c->h[0]=U64(0xcbbb9d5dc1059ed8);
+        c->h[1]=U64(0x629a292a367cd507);
+        c->h[2]=U64(0x9159015a3070dd17);
+        c->h[3]=U64(0x152fecd8f70e5939);
+        c->h[4]=U64(0x67332667ffc00b31);
+        c->h[5]=U64(0x8eb44a8768581511);
+        c->h[6]=U64(0xdb0c2e0d64f98fa7);
+        c->h[7]=U64(0x47b5481dbefa4fa4);
+        c->Nl=0;        c->Nh=0;
+        c->num=0;       c->md_len=SHA384_DIGEST_LENGTH;
+        return 1;
+        }
+
+int SHA512_Init (SHA512_CTX *c)
+        {
+        c->h[0]=U64(0x6a09e667f3bcc908);
+        c->h[1]=U64(0xbb67ae8584caa73b);
+        c->h[2]=U64(0x3c6ef372fe94f82b);
+        c->h[3]=U64(0xa54ff53a5f1d36f1);
+        c->h[4]=U64(0x510e527fade682d1);
+        c->h[5]=U64(0x9b05688c2b3e6c1f);
+        c->h[6]=U64(0x1f83d9abfb41bd6b);
+        c->h[7]=U64(0x5be0cd19137e2179);
+        c->Nl=0;        c->Nh=0;
+        c->num=0;       c->md_len=SHA512_DIGEST_LENGTH;
+        return 1;
+        }
+
+#ifndef SHA512_ASM
+static
+#endif
+void sha512_block_data_order (SHA512_CTX *ctx, const void *in, size_t num);
+
+int SHA512_Final (unsigned char *md, SHA512_CTX *c)
+        {
+        unsigned char *p=(unsigned char *)c->u.p;
+        size_t n=c->num;
+
+        p[n]=0x80;      /* There always is a room for one */
+        n++;
+        if (n > (sizeof(c->u)-16))
+                memset (p+n,0,sizeof(c->u)-n), n=0,
+                sha512_block_data_order (c,p,1);
+
+        memset (p+n,0,sizeof(c->u)-16-n);
+#ifdef  B_ENDIAN
+        c->u.d[SHA_LBLOCK-2] = c->Nh;
+        c->u.d[SHA_LBLOCK-1] = c->Nl;
+#else
+        p[sizeof(c->u)-1]  = (unsigned char)(c->Nl);
+        p[sizeof(c->u)-2]  = (unsigned char)(c->Nl>>8);
+        p[sizeof(c->u)-3]  = (unsigned char)(c->Nl>>16);
+        p[sizeof(c->u)-4]  = (unsigned char)(c->Nl>>24);
+        p[sizeof(c->u)-5]  = (unsigned char)(c->Nl>>32);
+        p[sizeof(c->u)-6]  = (unsigned char)(c->Nl>>40);
+        p[sizeof(c->u)-7]  = (unsigned char)(c->Nl>>48);
+        p[sizeof(c->u)-8]  = (unsigned char)(c->Nl>>56);
+        p[sizeof(c->u)-9]  = (unsigned char)(c->Nh);
+        p[sizeof(c->u)-10] = (unsigned char)(c->Nh>>8);
+        p[sizeof(c->u)-11] = (unsigned char)(c->Nh>>16);
+        p[sizeof(c->u)-12] = (unsigned char)(c->Nh>>24);
+        p[sizeof(c->u)-13] = (unsigned char)(c->Nh>>32);
+        p[sizeof(c->u)-14] = (unsigned char)(c->Nh>>40);
+        p[sizeof(c->u)-15] = (unsigned char)(c->Nh>>48);
+        p[sizeof(c->u)-16] = (unsigned char)(c->Nh>>56);
+#endif
+
+        sha512_block_data_order (c,p,1);
+
+        if (md==0) return 0;
+
+        switch (c->md_len)
+                {
+                /* Let compiler decide if it's appropriate to unroll... */
+                case SHA384_DIGEST_LENGTH:
+                        for (n=0;n<SHA384_DIGEST_LENGTH/8;n++)
+                                {
+                                SHA_LONG64 t = c->h[n];
+
+                                *(md++) = (unsigned char)(t>>56);
+                                *(md++) = (unsigned char)(t>>48);
+                                *(md++) = (unsigned char)(t>>40);
+                                *(md++) = (unsigned char)(t>>32);
+                                *(md++) = (unsigned char)(t>>24);
+                                *(md++) = (unsigned char)(t>>16);
+                                *(md++) = (unsigned char)(t>>8);
+                                *(md++) = (unsigned char)(t);
+                                }
+                        break;
+                case SHA512_DIGEST_LENGTH:
+                        for (n=0;n<SHA512_DIGEST_LENGTH/8;n++)
+                                {
+                                SHA_LONG64 t = c->h[n];
+
+                                *(md++) = (unsigned char)(t>>56);
+                                *(md++) = (unsigned char)(t>>48);
+                                *(md++) = (unsigned char)(t>>40);
+                                *(md++) = (unsigned char)(t>>32);
+                                *(md++) = (unsigned char)(t>>24);
+                                *(md++) = (unsigned char)(t>>16);
+                                *(md++) = (unsigned char)(t>>8);
+                                *(md++) = (unsigned char)(t);
+                                }
+                        break;
+                /* ... as well as make sure md_len is not abused. */
+                default:        return 0;
+                }
+
+        return 1;
+        }
+
+int SHA384_Final (unsigned char *md,SHA512_CTX *c)
+{   return SHA512_Final (md,c);   }
+
+int SHA512_Update (SHA512_CTX *c, const void *_data, size_t len)
+        {
+        SHA_LONG64      l;
+        unsigned char  *p=c->u.p;
+        const unsigned char *data=(const unsigned char *)_data;
+
+        if (len==0) return  1;
+
+        l = (c->Nl+(((SHA_LONG64)len)<<3))&U64(0xffffffffffffffff);
+        if (l < c->Nl)          c->Nh++;
+        if (sizeof(len)>=8)     c->Nh+=(((SHA_LONG64)len)>>61);
+        c->Nl=l;
+
+        if (c->num != 0)
+                {
+                size_t n = sizeof(c->u) - c->num;
+
+                if (len < n)
+                        {
+                        memcpy (p+c->num,data,len), c->num += len;
+                        return 1;
+                        }
+                else    {
+                        memcpy (p+c->num,data,n), c->num = 0;
+                        len-=n, data+=n;
+                        sha512_block_data_order (c,p,1);
+                        }
+                }
+
+        if (len >= sizeof(c->u))
+                {
+#ifndef SHA512_BLOCK_CAN_MANAGE_UNALIGNED_DATA
+                if ((size_t)data%sizeof(c->u.d[0]) != 0)
+                        while (len >= sizeof(c->u))
+                                memcpy (p,data,sizeof(c->u)),
+                                sha512_block_data_order (c,p,1),
+                                len  -= sizeof(c->u),
+                                data += sizeof(c->u);
+                else
+#endif
+                        sha512_block_data_order (c,data,len/sizeof(c->u)),
+                        data += len,
+                        len  %= sizeof(c->u),
+                        data -= len;
+                }
+
+        if (len != 0)   memcpy (p,data,len), c->num = (int)len;
+
+        return 1;
+        }
+
+int SHA384_Update (SHA512_CTX *c, const void *data, size_t len)
+{   return SHA512_Update (c,data,len);   }
+
+void SHA512_Transform (SHA512_CTX *c, const unsigned char *data)
+{   sha512_block_data_order (c,data,1);  }
+
+unsigned char *SHA384(const unsigned char *d, size_t n, unsigned char *md)
+        {
+        SHA512_CTX c;
+        static unsigned char m[SHA384_DIGEST_LENGTH];
+
+        if (md == NULL) md=m;
+        SHA384_Init(&c);
+        SHA512_Update(&c,d,n);
+        SHA512_Final(md,&c);
+        OPENSSL_cleanse(&c,sizeof(c));
+        return(md);
+        }
+
+unsigned char *SHA512(const unsigned char *d, size_t n, unsigned char *md)
+        {
+        SHA512_CTX c;
+        static unsigned char m[SHA512_DIGEST_LENGTH];
+
+        if (md == NULL) md=m;
+        SHA512_Init(&c);
+        SHA512_Update(&c,d,n);
+        SHA512_Final(md,&c);
+        OPENSSL_cleanse(&c,sizeof(c));
+        return(md);
+        }
+
+#ifndef SHA512_ASM
+static const SHA_LONG64 K512[80] = {
+        U64(0x428a2f98d728ae22),U64(0x7137449123ef65cd),
+        U64(0xb5c0fbcfec4d3b2f),U64(0xe9b5dba58189dbbc),
+        U64(0x3956c25bf348b538),U64(0x59f111f1b605d019),
+        U64(0x923f82a4af194f9b),U64(0xab1c5ed5da6d8118),
+        U64(0xd807aa98a3030242),U64(0x12835b0145706fbe),
+        U64(0x243185be4ee4b28c),U64(0x550c7dc3d5ffb4e2),
+        U64(0x72be5d74f27b896f),U64(0x80deb1fe3b1696b1),
+        U64(0x9bdc06a725c71235),U64(0xc19bf174cf692694),
+        U64(0xe49b69c19ef14ad2),U64(0xefbe4786384f25e3),
+        U64(0x0fc19dc68b8cd5b5),U64(0x240ca1cc77ac9c65),
+        U64(0x2de92c6f592b0275),U64(0x4a7484aa6ea6e483),
+        U64(0x5cb0a9dcbd41fbd4),U64(0x76f988da831153b5),
+        U64(0x983e5152ee66dfab),U64(0xa831c66d2db43210),
+        U64(0xb00327c898fb213f),U64(0xbf597fc7beef0ee4),
+        U64(0xc6e00bf33da88fc2),U64(0xd5a79147930aa725),
+        U64(0x06ca6351e003826f),U64(0x142929670a0e6e70),
+        U64(0x27b70a8546d22ffc),U64(0x2e1b21385c26c926),
+        U64(0x4d2c6dfc5ac42aed),U64(0x53380d139d95b3df),
+        U64(0x650a73548baf63de),U64(0x766a0abb3c77b2a8),
+        U64(0x81c2c92e47edaee6),U64(0x92722c851482353b),
+        U64(0xa2bfe8a14cf10364),U64(0xa81a664bbc423001),
+        U64(0xc24b8b70d0f89791),U64(0xc76c51a30654be30),
+        U64(0xd192e819d6ef5218),U64(0xd69906245565a910),
+        U64(0xf40e35855771202a),U64(0x106aa07032bbd1b8),
+        U64(0x19a4c116b8d2d0c8),U64(0x1e376c085141ab53),
+        U64(0x2748774cdf8eeb99),U64(0x34b0bcb5e19b48a8),
+        U64(0x391c0cb3c5c95a63),U64(0x4ed8aa4ae3418acb),
+        U64(0x5b9cca4f7763e373),U64(0x682e6ff3d6b2b8a3),
+        U64(0x748f82ee5defb2fc),U64(0x78a5636f43172f60),
+        U64(0x84c87814a1f0ab72),U64(0x8cc702081a6439ec),
+        U64(0x90befffa23631e28),U64(0xa4506cebde82bde9),
+        U64(0xbef9a3f7b2c67915),U64(0xc67178f2e372532b),
+        U64(0xca273eceea26619c),U64(0xd186b8c721c0c207),
+        U64(0xeada7dd6cde0eb1e),U64(0xf57d4f7fee6ed178),
+        U64(0x06f067aa72176fba),U64(0x0a637dc5a2c898a6),
+        U64(0x113f9804bef90dae),U64(0x1b710b35131c471b),
+        U64(0x28db77f523047d84),U64(0x32caab7b40c72493),
+        U64(0x3c9ebe0a15c9bebc),U64(0x431d67c49c100d4c),
+        U64(0x4cc5d4becb3e42b6),U64(0x597f299cfc657e2a),
+        U64(0x5fcb6fab3ad6faec),U64(0x6c44198c4a475817) };
+
+#ifndef PEDANTIC
+# if defined(__GNUC__) && __GNUC__>=2 && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM)
+#  if defined(__x86_64) || defined(__x86_64__)
+#   define ROTR(a,n)    ({ unsigned long ret;           \
+                                asm ("rorq %1,%0"       \
+                                : "=r"(ret)             \
+                                : "J"(n),"0"(a)         \
+                                : "cc"); ret;           })
+#   if !defined(B_ENDIAN)
+#    define PULL64(x) ({ SHA_LONG64 ret=*((const SHA_LONG64 *)(&(x)));  \
+                                asm ("bswapq    %0"             \
+                                : "=r"(ret)                     \
+                                : "0"(ret)); ret;               })
+#   endif
+#  elif (defined(__i386) || defined(__i386__)) && !defined(B_ENDIAN)
+#   if defined(I386_ONLY)
+#    define PULL64(x) ({ const unsigned int *p=(const unsigned int *)(&(x));\
+                         unsigned int hi=p[0],lo=p[1];          \
+                                asm("xchgb %%ah,%%al;xchgb %%dh,%%dl;"\
+                                    "roll $16,%%eax; roll $16,%%edx; "\
+                                    "xchgb %%ah,%%al;xchgb %%dh,%%dl;" \
+                                : "=a"(lo),"=d"(hi)             \
+                                : "0"(lo),"1"(hi) : "cc");      \
+                                ((SHA_LONG64)hi)<<32|lo;        })
+#   else
+#    define PULL64(x) ({ const unsigned int *p=(const unsigned int *)(&(x));\
+                         unsigned int hi=p[0],lo=p[1];          \
+                                asm ("bswapl %0; bswapl %1;"    \
+                                : "=r"(lo),"=r"(hi)             \
+                                : "0"(lo),"1"(hi));             \
+                                ((SHA_LONG64)hi)<<32|lo;        })
+#   endif
+#  elif (defined(_ARCH_PPC) && defined(__64BIT__)) || defined(_ARCH_PPC64)
+#   define ROTR(a,n)    ({ unsigned long ret;           \
+                                asm ("rotrdi %0,%1,%2"  \
+                                : "=r"(ret)             \
+                                : "r"(a),"K"(n)); ret;  })
+#  endif
+# elif defined(_MSC_VER)
+#  if defined(_WIN64)   /* applies to both IA-64 and AMD64 */
+#   define ROTR(a,n)    _rotr64((a),n)
+#  endif
+#  if defined(_M_IX86) && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM)
+#   if defined(I386_ONLY)
+    static SHA_LONG64 __fastcall __pull64be(const void *x)
+    {   _asm    mov     edx, [ecx + 0]
+        _asm    mov     eax, [ecx + 4]
+        _asm    xchg    dh,dl
+        _asm    xchg    ah,al
+        _asm    rol     edx,16
+        _asm    rol     eax,16
+        _asm    xchg    dh,dl
+        _asm    xchg    ah,al
+    }
+#   else
+    static SHA_LONG64 __fastcall __pull64be(const void *x)
+    {   _asm    mov     edx, [ecx + 0]
+        _asm    mov     eax, [ecx + 4]
+        _asm    bswap   edx
+        _asm    bswap   eax
+    }
+#   endif
+#   define PULL64(x) __pull64be(&(x))
+#   if _MSC_VER<=1200
+#    pragma inline_depth(0)
+#   endif
+#  endif
+# endif
+#endif
+
+#ifndef PULL64
+#define B(x,j)    (((SHA_LONG64)(*(((const unsigned char *)(&x))+j)))<<((7-j)*8))
+#define PULL64(x) (B(x,0)|B(x,1)|B(x,2)|B(x,3)|B(x,4)|B(x,5)|B(x,6)|B(x,7))
+#endif
+
+#ifndef ROTR
+#define ROTR(x,s)       (((x)>>s) | (x)<<(64-s))
+#endif
+
+#define Sigma0(x)       (ROTR((x),28) ^ ROTR((x),34) ^ ROTR((x),39))
+#define Sigma1(x)       (ROTR((x),14) ^ ROTR((x),18) ^ ROTR((x),41))
+#define sigma0(x)       (ROTR((x),1)  ^ ROTR((x),8)  ^ ((x)>>7))
+#define sigma1(x)       (ROTR((x),19) ^ ROTR((x),61) ^ ((x)>>6))
+
+#define Ch(x,y,z)       (((x) & (y)) ^ ((~(x)) & (z)))
+#define Maj(x,y,z)      (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
+
+#if defined(OPENSSL_IA32_SSE2) && !defined(OPENSSL_NO_ASM) && !defined(I386_ONLY)
+#define GO_FOR_SSE2(ctx,in,num)         do {            \
+        void    sha512_block_sse2(void *,const void *,size_t);  \
+        if (!(OPENSSL_ia32cap_P & (1<<26))) break;      \
+        sha512_block_sse2(ctx->h,in,num); return;       \
+                                        } while (0)
+#endif
+
+#ifdef OPENSSL_SMALL_FOOTPRINT
+
+static void sha512_block_data_order (SHA512_CTX *ctx, const void *in, size_t num)
+        {
+        const SHA_LONG64 *W=in;
+        SHA_LONG64      a,b,c,d,e,f,g,h,s0,s1,T1,T2;
+        SHA_LONG64      X[16];
+        int i;
+
+#ifdef GO_FOR_SSE2
+        GO_FOR_SSE2(ctx,in,num);
+#endif
+
+                        while (num--) {
+
+        a = ctx->h[0];  b = ctx->h[1];  c = ctx->h[2];  d = ctx->h[3];
+        e = ctx->h[4];  f = ctx->h[5];  g = ctx->h[6];  h = ctx->h[7];
+
+        for (i=0;i<16;i++)
+                {
+#ifdef B_ENDIAN
+                T1 = X[i] = W[i];
+#else
+                T1 = X[i] = PULL64(W[i]);
+#endif
+                T1 += h + Sigma1(e) + Ch(e,f,g) + K512[i];
+                T2 = Sigma0(a) + Maj(a,b,c);
+                h = g;  g = f;  f = e;  e = d + T1;
+                d = c;  c = b;  b = a;  a = T1 + T2;
+                }
+
+        for (;i<80;i++)
+                {
+                s0 = X[(i+1)&0x0f];     s0 = sigma0(s0);
+                s1 = X[(i+14)&0x0f];    s1 = sigma1(s1);
+
+                T1 = X[i&0xf] += s0 + s1 + X[(i+9)&0xf];
+                T1 += h + Sigma1(e) + Ch(e,f,g) + K512[i];
+                T2 = Sigma0(a) + Maj(a,b,c);
+                h = g;  g = f;  f = e;  e = d + T1;
+                d = c;  c = b;  b = a;  a = T1 + T2;
+                }
+
+        ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
+        ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;
+
+                        W+=SHA_LBLOCK;
+                        }
+        }
+
+#else
+
+#define ROUND_00_15(i,a,b,c,d,e,f,g,h)          do {    \
+        T1 += h + Sigma1(e) + Ch(e,f,g) + K512[i];      \
+        h = Sigma0(a) + Maj(a,b,c);                     \
+        d += T1;        h += T1;                } while (0)
+
+#define ROUND_16_80(i,a,b,c,d,e,f,g,h,X)        do {    \
+        s0 = X[(i+1)&0x0f];     s0 = sigma0(s0);        \
+        s1 = X[(i+14)&0x0f];    s1 = sigma1(s1);        \
+        T1 = X[(i)&0x0f] += s0 + s1 + X[(i+9)&0x0f];    \
+        ROUND_00_15(i,a,b,c,d,e,f,g,h);         } while (0)
+
+static void sha512_block_data_order (SHA512_CTX *ctx, const void *in, size_t num)
+        {
+        const SHA_LONG64 *W=in;
+        SHA_LONG64      a,b,c,d,e,f,g,h,s0,s1,T1;
+        SHA_LONG64      X[16];
+        int i;
+
+#ifdef GO_FOR_SSE2
+        GO_FOR_SSE2(ctx,in,num);
+#endif
+
+                        while (num--) {
+
+        a = ctx->h[0];  b = ctx->h[1];  c = ctx->h[2];  d = ctx->h[3];
+        e = ctx->h[4];  f = ctx->h[5];  g = ctx->h[6];  h = ctx->h[7];
+
+#ifdef B_ENDIAN
+        T1 = X[0] = W[0];       ROUND_00_15(0,a,b,c,d,e,f,g,h);
+        T1 = X[1] = W[1];       ROUND_00_15(1,h,a,b,c,d,e,f,g);
+        T1 = X[2] = W[2];       ROUND_00_15(2,g,h,a,b,c,d,e,f);
+        T1 = X[3] = W[3];       ROUND_00_15(3,f,g,h,a,b,c,d,e);
+        T1 = X[4] = W[4];       ROUND_00_15(4,e,f,g,h,a,b,c,d);
+        T1 = X[5] = W[5];       ROUND_00_15(5,d,e,f,g,h,a,b,c);
+        T1 = X[6] = W[6];       ROUND_00_15(6,c,d,e,f,g,h,a,b);
+        T1 = X[7] = W[7];       ROUND_00_15(7,b,c,d,e,f,g,h,a);
+        T1 = X[8] = W[8];       ROUND_00_15(8,a,b,c,d,e,f,g,h);
+        T1 = X[9] = W[9];       ROUND_00_15(9,h,a,b,c,d,e,f,g);
+        T1 = X[10] = W[10];     ROUND_00_15(10,g,h,a,b,c,d,e,f);
+        T1 = X[11] = W[11];     ROUND_00_15(11,f,g,h,a,b,c,d,e);
+        T1 = X[12] = W[12];     ROUND_00_15(12,e,f,g,h,a,b,c,d);
+        T1 = X[13] = W[13];     ROUND_00_15(13,d,e,f,g,h,a,b,c);
+        T1 = X[14] = W[14];     ROUND_00_15(14,c,d,e,f,g,h,a,b);
+        T1 = X[15] = W[15];     ROUND_00_15(15,b,c,d,e,f,g,h,a);
+#else
+        T1 = X[0]  = PULL64(W[0]);      ROUND_00_15(0,a,b,c,d,e,f,g,h);
+        T1 = X[1]  = PULL64(W[1]);      ROUND_00_15(1,h,a,b,c,d,e,f,g);
+        T1 = X[2]  = PULL64(W[2]);      ROUND_00_15(2,g,h,a,b,c,d,e,f);
+        T1 = X[3]  = PULL64(W[3]);      ROUND_00_15(3,f,g,h,a,b,c,d,e);
+        T1 = X[4]  = PULL64(W[4]);      ROUND_00_15(4,e,f,g,h,a,b,c,d);
+        T1 = X[5]  = PULL64(W[5]);      ROUND_00_15(5,d,e,f,g,h,a,b,c);
+        T1 = X[6]  = PULL64(W[6]);      ROUND_00_15(6,c,d,e,f,g,h,a,b);
+        T1 = X[7]  = PULL64(W[7]);      ROUND_00_15(7,b,c,d,e,f,g,h,a);
+        T1 = X[8]  = PULL64(W[8]);      ROUND_00_15(8,a,b,c,d,e,f,g,h);
+        T1 = X[9]  = PULL64(W[9]);      ROUND_00_15(9,h,a,b,c,d,e,f,g);
+        T1 = X[10] = PULL64(W[10]);     ROUND_00_15(10,g,h,a,b,c,d,e,f);
+        T1 = X[11] = PULL64(W[11]);     ROUND_00_15(11,f,g,h,a,b,c,d,e);
+        T1 = X[12] = PULL64(W[12]);     ROUND_00_15(12,e,f,g,h,a,b,c,d);
+        T1 = X[13] = PULL64(W[13]);     ROUND_00_15(13,d,e,f,g,h,a,b,c);
+        T1 = X[14] = PULL64(W[14]);     ROUND_00_15(14,c,d,e,f,g,h,a,b);
+        T1 = X[15] = PULL64(W[15]);     ROUND_00_15(15,b,c,d,e,f,g,h,a);
+#endif
+
+        for (i=16;i<80;i+=8)
+                {
+                ROUND_16_80(i+0,a,b,c,d,e,f,g,h,X);
+                ROUND_16_80(i+1,h,a,b,c,d,e,f,g,X);
+                ROUND_16_80(i+2,g,h,a,b,c,d,e,f,X);
+                ROUND_16_80(i+3,f,g,h,a,b,c,d,e,X);
+                ROUND_16_80(i+4,e,f,g,h,a,b,c,d,X);
+                ROUND_16_80(i+5,d,e,f,g,h,a,b,c,X);
+                ROUND_16_80(i+6,c,d,e,f,g,h,a,b,X);
+                ROUND_16_80(i+7,b,c,d,e,f,g,h,a,X);
+                }
+
+        ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
+        ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;
+
+                        W+=SHA_LBLOCK;
+                        }
+        }
+
+#endif
+
+#endif /* SHA512_ASM */
+
+#endif /* OPENSSL_NO_SHA512 */
diff --git a/src/lib/libssl/src/crypto/sha/sha512t.c b/src/lib/libssl/src/crypto/sha/sha512t.c
new file mode 100644
index 0000000000..210041d435
--- /dev/null
+++ b/src/lib/libssl/src/crypto/sha/sha512t.c
@@ -0,0 +1,184 @@
+/* crypto/sha/sha512t.c */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
+ * ====================================================================
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <openssl/sha.h>
+#include <openssl/evp.h>
+#include <openssl/crypto.h>
+
+#if defined(OPENSSL_NO_SHA) || defined(OPENSSL_NO_SHA512)
+int main(int argc, char *argv[])
+{
+    printf("No SHA512 support\n");
+    return(0);
+}
+#else
+
+unsigned char app_c1[SHA512_DIGEST_LENGTH] = {
+        0xdd,0xaf,0x35,0xa1,0x93,0x61,0x7a,0xba,
+        0xcc,0x41,0x73,0x49,0xae,0x20,0x41,0x31,
+        0x12,0xe6,0xfa,0x4e,0x89,0xa9,0x7e,0xa2,
+        0x0a,0x9e,0xee,0xe6,0x4b,0x55,0xd3,0x9a,
+        0x21,0x92,0x99,0x2a,0x27,0x4f,0xc1,0xa8,
+        0x36,0xba,0x3c,0x23,0xa3,0xfe,0xeb,0xbd,
+        0x45,0x4d,0x44,0x23,0x64,0x3c,0xe8,0x0e,
+        0x2a,0x9a,0xc9,0x4f,0xa5,0x4c,0xa4,0x9f };
+
+unsigned char app_c2[SHA512_DIGEST_LENGTH] = {
+        0x8e,0x95,0x9b,0x75,0xda,0xe3,0x13,0xda,
+        0x8c,0xf4,0xf7,0x28,0x14,0xfc,0x14,0x3f,
+        0x8f,0x77,0x79,0xc6,0xeb,0x9f,0x7f,0xa1,
+        0x72,0x99,0xae,0xad,0xb6,0x88,0x90,0x18,
+        0x50,0x1d,0x28,0x9e,0x49,0x00,0xf7,0xe4,
+        0x33,0x1b,0x99,0xde,0xc4,0xb5,0x43,0x3a,
+        0xc7,0xd3,0x29,0xee,0xb6,0xdd,0x26,0x54,
+        0x5e,0x96,0xe5,0x5b,0x87,0x4b,0xe9,0x09 };
+
+unsigned char app_c3[SHA512_DIGEST_LENGTH] = {
+        0xe7,0x18,0x48,0x3d,0x0c,0xe7,0x69,0x64,
+        0x4e,0x2e,0x42,0xc7,0xbc,0x15,0xb4,0x63,
+        0x8e,0x1f,0x98,0xb1,0x3b,0x20,0x44,0x28,
+        0x56,0x32,0xa8,0x03,0xaf,0xa9,0x73,0xeb,
+        0xde,0x0f,0xf2,0x44,0x87,0x7e,0xa6,0x0a,
+        0x4c,0xb0,0x43,0x2c,0xe5,0x77,0xc3,0x1b,
+        0xeb,0x00,0x9c,0x5c,0x2c,0x49,0xaa,0x2e,
+        0x4e,0xad,0xb2,0x17,0xad,0x8c,0xc0,0x9b };
+
+unsigned char app_d1[SHA384_DIGEST_LENGTH] = {
+        0xcb,0x00,0x75,0x3f,0x45,0xa3,0x5e,0x8b,
+        0xb5,0xa0,0x3d,0x69,0x9a,0xc6,0x50,0x07,
+        0x27,0x2c,0x32,0xab,0x0e,0xde,0xd1,0x63,
+        0x1a,0x8b,0x60,0x5a,0x43,0xff,0x5b,0xed,
+        0x80,0x86,0x07,0x2b,0xa1,0xe7,0xcc,0x23,
+        0x58,0xba,0xec,0xa1,0x34,0xc8,0x25,0xa7 };
+
+unsigned char app_d2[SHA384_DIGEST_LENGTH] = {
+        0x09,0x33,0x0c,0x33,0xf7,0x11,0x47,0xe8,
+        0x3d,0x19,0x2f,0xc7,0x82,0xcd,0x1b,0x47,
+        0x53,0x11,0x1b,0x17,0x3b,0x3b,0x05,0xd2,
+        0x2f,0xa0,0x80,0x86,0xe3,0xb0,0xf7,0x12,
+        0xfc,0xc7,0xc7,0x1a,0x55,0x7e,0x2d,0xb9,
+        0x66,0xc3,0xe9,0xfa,0x91,0x74,0x60,0x39 };
+
+unsigned char app_d3[SHA384_DIGEST_LENGTH] = {
+        0x9d,0x0e,0x18,0x09,0x71,0x64,0x74,0xcb,
+        0x08,0x6e,0x83,0x4e,0x31,0x0a,0x4a,0x1c,
+        0xed,0x14,0x9e,0x9c,0x00,0xf2,0x48,0x52,
+        0x79,0x72,0xce,0xc5,0x70,0x4c,0x2a,0x5b,
+        0x07,0xb8,0xb3,0xdc,0x38,0xec,0xc4,0xeb,
+        0xae,0x97,0xdd,0xd8,0x7f,0x3d,0x89,0x85 };
+
+int main (int argc,char **argv)
+{ unsigned char md[SHA512_DIGEST_LENGTH];
+  int           i;
+  EVP_MD_CTX    evp;
+
+#ifdef OPENSSL_IA32_SSE2
+    /* Alternative to this is to call OpenSSL_add_all_algorithms...
+     * The below code is retained exclusively for debugging purposes. */
+    { char      *env;
+
+        if ((env=getenv("OPENSSL_ia32cap")))
+            OPENSSL_ia32cap = strtoul (env,NULL,0);
+    }
+#endif
+
+    fprintf(stdout,"Testing SHA-512 ");
+
+    EVP_Digest ("abc",3,md,NULL,EVP_sha512(),NULL);
+    if (memcmp(md,app_c1,sizeof(app_c1)))
+    {   fflush(stdout);
+        fprintf(stderr,"\nTEST 1 of 3 failed.\n");
+        return 1;
+    }
+    else
+        fprintf(stdout,"."); fflush(stdout);
+
+    EVP_Digest ("abcdefgh""bcdefghi""cdefghij""defghijk"
+                "efghijkl""fghijklm""ghijklmn""hijklmno"
+                "ijklmnop""jklmnopq""klmnopqr""lmnopqrs"
+                "mnopqrst""nopqrstu",112,md,NULL,EVP_sha512(),NULL);
+    if (memcmp(md,app_c2,sizeof(app_c2)))
+    {   fflush(stdout);
+        fprintf(stderr,"\nTEST 2 of 3 failed.\n");
+        return 1;
+    }
+    else
+        fprintf(stdout,"."); fflush(stdout);
+
+    EVP_MD_CTX_init (&evp);
+    EVP_DigestInit_ex (&evp,EVP_sha512(),NULL);
+    for (i=0;i<1000000;i+=288)
+        EVP_DigestUpdate (&evp, "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa",
+                                (1000000-i)<288?1000000-i:288);
+    EVP_DigestFinal_ex (&evp,md,NULL);
+    EVP_MD_CTX_cleanup (&evp);
+
+    if (memcmp(md,app_c3,sizeof(app_c3)))
+    {   fflush(stdout);
+        fprintf(stderr,"\nTEST 3 of 3 failed.\n");
+        return 1;
+    }
+    else
+        fprintf(stdout,"."); fflush(stdout);
+
+    fprintf(stdout," passed.\n"); fflush(stdout);
+
+    fprintf(stdout,"Testing SHA-384 ");
+
+    EVP_Digest ("abc",3,md,NULL,EVP_sha384(),NULL);
+    if (memcmp(md,app_d1,sizeof(app_d1)))
+    {   fflush(stdout);
+        fprintf(stderr,"\nTEST 1 of 3 failed.\n");
+        return 1;
+    }
+    else
+        fprintf(stdout,"."); fflush(stdout);
+
+    EVP_Digest ("abcdefgh""bcdefghi""cdefghij""defghijk"
+                "efghijkl""fghijklm""ghijklmn""hijklmno"
+                "ijklmnop""jklmnopq""klmnopqr""lmnopqrs"
+                "mnopqrst""nopqrstu",112,md,NULL,EVP_sha384(),NULL);
+    if (memcmp(md,app_d2,sizeof(app_d2)))
+    {   fflush(stdout);
+        fprintf(stderr,"\nTEST 2 of 3 failed.\n");
+        return 1;
+    }
+    else
+        fprintf(stdout,"."); fflush(stdout);
+
+    EVP_MD_CTX_init (&evp);
+    EVP_DigestInit_ex (&evp,EVP_sha384(),NULL);
+    for (i=0;i<1000000;i+=64)
+        EVP_DigestUpdate (&evp, "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa"
+                                "aaaaaaaa""aaaaaaaa""aaaaaaaa""aaaaaaaa",
+                                (1000000-i)<64?1000000-i:64);
+    EVP_DigestFinal_ex (&evp,md,NULL);
+    EVP_MD_CTX_cleanup (&evp);
+
+    if (memcmp(md,app_d3,sizeof(app_d3)))
+    {   fflush(stdout);
+        fprintf(stderr,"\nTEST 3 of 3 failed.\n");
+        return 1;
+    }
+    else
+        fprintf(stdout,"."); fflush(stdout);
+
+    fprintf(stdout," passed.\n"); fflush(stdout);
+
+  return 0;
+}
+#endif
diff --git a/src/lib/libssl/src/crypto/sparccpuid.S b/src/lib/libssl/src/crypto/sparccpuid.S
new file mode 100644
index 0000000000..c17350fc89
--- /dev/null
+++ b/src/lib/libssl/src/crypto/sparccpuid.S
@@ -0,0 +1,239 @@
+#if defined(__SUNPRO_C) && defined(__sparcv9)
+# define ABI64  /* They've said -xarch=v9 at command line */
+#elif defined(__GNUC__) && defined(__arch64__)
+# define ABI64  /* They've said -m64 at command line */
+#endif
+
+#ifdef ABI64
+  .register     %g2,#scratch
+  .register     %g3,#scratch
+# define        FRAME   -192
+# define        BIAS    2047
+#else
+# define        FRAME   -96
+# define        BIAS    0
+#endif
+
+.text
+.align  32
+.global OPENSSL_wipe_cpu
+.type   OPENSSL_wipe_cpu,#function
+! Keep in mind that this does not excuse us from wiping the stack!
+! This routine wipes registers, but not the backing store [which
+! resides on the stack, toward lower addresses]. To facilitate for
+! stack wiping I return pointer to the top of stack of the *caller*.
+OPENSSL_wipe_cpu:
+        save    %sp,FRAME,%sp
+        nop
+#ifdef __sun
+#include <sys/trap.h>
+        ta      ST_CLEAN_WINDOWS
+#else
+        call    .walk.reg.wins
+#endif
+        nop
+        call    .PIC.zero.up
+        mov     .zero-(.-4),%o0
+        ldd     [%o0],%f0
+
+        subcc   %g0,1,%o0
+        ! Following is V9 "rd %ccr,%o0" instruction. However! V8
+        ! specification says that it ("rd %asr2,%o0" in V8 terms) does
+        ! not cause illegal_instruction trap. It therefore can be used
+        ! to determine if the CPU the code is executing on is V8- or
+        ! V9-compliant, as V9 returns a distinct value of 0x99,
+        ! "negative" and "borrow" bits set in both %icc and %xcc.
+        .word   0x91408000      !rd     %ccr,%o0
+        cmp     %o0,0x99
+        bne     .v8
+        nop
+                        ! Even though we do not use %fp register bank,
+                        ! we wipe it as memcpy might have used it...
+                        .word   0xbfa00040      !fmovd  %f0,%f62
+                        .word   0xbba00040      !...
+                        .word   0xb7a00040
+                        .word   0xb3a00040
+                        .word   0xafa00040
+                        .word   0xaba00040
+                        .word   0xa7a00040
+                        .word   0xa3a00040
+                        .word   0x9fa00040
+                        .word   0x9ba00040
+                        .word   0x97a00040
+                        .word   0x93a00040
+                        .word   0x8fa00040
+                        .word   0x8ba00040
+                        .word   0x87a00040
+                        .word   0x83a00040      !fmovd  %f0,%f32
+.v8:                    fmovs   %f1,%f31
+        clr     %o0
+                        fmovs   %f0,%f30
+        clr     %o1
+                        fmovs   %f1,%f29
+        clr     %o2
+                        fmovs   %f0,%f28
+        clr     %o3
+                        fmovs   %f1,%f27
+        clr     %o4
+                        fmovs   %f0,%f26
+        clr     %o5
+                        fmovs   %f1,%f25
+        clr     %o7
+                        fmovs   %f0,%f24
+        clr     %l0
+                        fmovs   %f1,%f23
+        clr     %l1
+                        fmovs   %f0,%f22
+        clr     %l2
+                        fmovs   %f1,%f21
+        clr     %l3
+                        fmovs   %f0,%f20
+        clr     %l4
+                        fmovs   %f1,%f19
+        clr     %l5
+                        fmovs   %f0,%f18
+        clr     %l6
+                        fmovs   %f1,%f17
+        clr     %l7
+                        fmovs   %f0,%f16
+        clr     %i0
+                        fmovs   %f1,%f15
+        clr     %i1
+                        fmovs   %f0,%f14
+        clr     %i2
+                        fmovs   %f1,%f13
+        clr     %i3
+                        fmovs   %f0,%f12
+        clr     %i4
+                        fmovs   %f1,%f11
+        clr     %i5
+                        fmovs   %f0,%f10
+        clr     %g1
+                        fmovs   %f1,%f9
+        clr     %g2
+                        fmovs   %f0,%f8
+        clr     %g3
+                        fmovs   %f1,%f7
+        clr     %g4
+                        fmovs   %f0,%f6
+        clr     %g5
+                        fmovs   %f1,%f5
+                        fmovs   %f0,%f4
+                        fmovs   %f1,%f3
+                        fmovs   %f0,%f2
+
+        add     %fp,BIAS,%i0    ! return pointer to caller´s top of stack
+
+        ret
+        restore
+
+.zero:  .long   0x0,0x0
+.PIC.zero.up:
+        retl
+        add     %o0,%o7,%o0
+#ifdef DEBUG
+.global walk_reg_wins
+.type   walk_reg_wins,#function
+walk_reg_wins:
+#endif
+.walk.reg.wins:
+        save    %sp,FRAME,%sp
+        cmp     %i7,%o7
+        be      2f
+        clr     %o0
+        cmp     %o7,0   ! compiler never cleans %o7...
+        be      1f      ! could have been a leaf function...
+        clr     %o1
+        call    .walk.reg.wins
+        nop
+1:      clr     %o2
+        clr     %o3
+        clr     %o4
+        clr     %o5
+        clr     %o7
+        clr     %l0
+        clr     %l1
+        clr     %l2
+        clr     %l3
+        clr     %l4
+        clr     %l5
+        clr     %l6
+        clr     %l7
+        add     %o0,1,%i0       ! used for debugging
+2:      ret
+        restore
+.size   OPENSSL_wipe_cpu,.-OPENSSL_wipe_cpu
+
+.global OPENSSL_atomic_add
+.type   OPENSSL_atomic_add,#function
+OPENSSL_atomic_add:
+#ifndef ABI64
+        subcc   %g0,1,%o2
+        .word   0x95408000      !rd     %ccr,%o2, see comment above
+        cmp     %o2,0x99
+        be      .v9
+        nop
+        save    %sp,FRAME,%sp
+        ba      .enter
+        nop
+#ifdef __sun
+! Note that you don't have to link with libthread to call thr_yield,
+! as libc provides a stub, which is overloaded the moment you link
+! with *either* libpthread or libthread...
+#define YIELD_CPU       thr_yield
+#else
+! applies at least to Linux and FreeBSD... Feedback expected...
+#define YIELD_CPU       sched_yield
+#endif
+.spin:  call    YIELD_CPU
+        nop
+.enter: ld      [%i0],%i2
+        cmp     %i2,-4096
+        be      .spin
+        mov     -1,%i2
+        swap    [%i0],%i2
+        cmp     %i2,-1
+        be      .spin
+        add     %i2,%i1,%i2
+        stbar
+        st      %i2,[%i0]
+        sra     %i2,%g0,%i0
+        ret
+        restore
+.v9:
+#endif
+        ld      [%o0],%o2
+1:      add     %o1,%o2,%o3
+        .word   0xd7e2100a      !cas [%o0],%o2,%o3, compare [%o0] with %o2 and swap %o3
+        cmp     %o2,%o3
+        bne     1b
+        mov     %o3,%o2         ! cas is always fetching to dest. register
+        add     %o1,%o2,%o0     ! OpenSSL expects the new value
+        retl
+        sra     %o0,%g0,%o0     ! we return signed int, remember?
+.size   OPENSSL_atomic_add,.-OPENSSL_atomic_add
+
+.global OPENSSL_rdtsc
+        subcc   %g0,1,%o0
+        .word   0x91408000      !rd     %ccr,%o0
+        cmp     %o0,0x99
+        bne     .notsc
+        xor     %o0,%o0,%o0
+        save    %sp,FRAME-16,%sp
+        mov     513,%o0         !SI_PLATFORM
+        add     %sp,BIAS+16,%o1
+        call    sysinfo
+        mov     256,%o2
+
+        add     %sp,BIAS-16,%o1
+        ld      [%o1],%l0
+        ld      [%o1+4],%l1
+        ld      [%o1+8],%l2
+        mov     %lo('SUNW'),%l3
+        ret
+        restore
+.notsc:
+        retl
+        nop
+.type   OPENSSL_rdtsc,#function
+.size   OPENSSL_rdtsc,.-OPENSSL_atomic_add
diff --git a/src/lib/libssl/src/crypto/store/Makefile b/src/lib/libssl/src/crypto/store/Makefile
new file mode 100644
index 0000000000..0dcfd7857a
--- /dev/null
+++ b/src/lib/libssl/src/crypto/store/Makefile
@@ -0,0 +1,112 @@
+#
+# OpenSSL/crypto/store/Makefile
+#
+
+DIR=    store
+TOP=    ../..
+CC=     cc
+INCLUDES= -I.. -I$(TOP) -I../../include
+CFLAG=-g
+MAKEFILE=       Makefile
+AR=             ar r
+
+CFLAGS= $(INCLUDES) $(CFLAG)
+
+GENERAL=Makefile
+#TEST= storetest.c
+TEST=
+APPS=
+
+LIB=$(TOP)/libcrypto.a
+LIBSRC= str_err.c str_lib.c str_meth.c str_mem.c
+LIBOBJ= str_err.o str_lib.o str_meth.o str_mem.o
+
+SRC= $(LIBSRC)
+
+#EXHEADER= store.h str_compat.h
+EXHEADER= store.h
+HEADER= $(EXHEADER) str_locl.h
+
+ALL=    $(GENERAL) $(SRC) $(HEADER)
+
+top:
+        (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
+
+all:    lib
+
+lib:    $(LIBOBJ)
+        $(AR) $(LIB) $(LIBOBJ)
+        $(RANLIB) $(LIB) || echo Never mind.
+        @touch lib
+
+files:
+        $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
+
+links:
+        @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
+        @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
+        @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
+
+install:
+        @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
+        @headerlist="$(EXHEADER)"; for i in $$headerlist; \
+        do  \
+        (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
+        chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
+        done;
+
+tags:
+        ctags $(SRC)
+
+tests:
+
+lint:
+        lint -DLINT $(INCLUDES) $(SRC)>fluff
+
+depend:
+        @[ -n "$(MAKEDEPEND)" ] # should be set by upper Makefile...
+        $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
+
+dclean:
+        $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
+        mv -f Makefile.new $(MAKEFILE)
+
+clean:
+        rm -f *.o */*.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+str_err.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
+str_err.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+str_err.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
+str_err.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+str_err.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+str_err.o: ../../include/openssl/store.h ../../include/openssl/symhacks.h
+str_err.o: str_err.c
+str_lib.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+str_lib.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+str_lib.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+str_lib.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
+str_lib.o: ../../include/openssl/ecdsa.h ../../include/openssl/engine.h
+str_lib.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+str_lib.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
+str_lib.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+str_lib.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+str_lib.o: ../../include/openssl/pkcs7.h ../../include/openssl/safestack.h
+str_lib.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+str_lib.o: ../../include/openssl/store.h ../../include/openssl/symhacks.h
+str_lib.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+str_lib.o: str_lib.c str_locl.h
+str_mem.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
+str_mem.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+str_mem.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
+str_mem.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+str_mem.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+str_mem.o: ../../include/openssl/store.h ../../include/openssl/symhacks.h
+str_mem.o: str_locl.h str_mem.c
+str_meth.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
+str_meth.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
+str_meth.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+str_meth.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+str_meth.o: ../../include/openssl/store.h ../../include/openssl/symhacks.h
+str_meth.o: str_locl.h str_meth.c
diff --git a/src/lib/libssl/src/crypto/store/README b/src/lib/libssl/src/crypto/store/README
new file mode 100644
index 0000000000..966168f6a5
--- /dev/null
+++ b/src/lib/libssl/src/crypto/store/README
@@ -0,0 +1,95 @@
+The STORE type
+==============
+
+A STORE, as defined in this code section, is really a rather simple
+thing which stores objects and per-object associations to a number
+of attributes.  What attributes are supported entirely depends on
+the particular implementation of a STORE.  It has some support for
+generation of certain objects (for example, keys and CRLs).
+
+
+Supported object types
+----------------------
+
+For now, the objects that are supported are the following:
+
+X.509 certificate
+X.509 CRL
+private key
+public key
+number
+arbitrary (application) data
+
+The intention is that a STORE should be able to store everything
+needed by an application that wants a cert/key store, as well as
+the data a CA might need to store (this includes the serial number
+counter, which explains the support for numbers).
+
+
+Supported attribute types
+-------------------------
+
+For now, the following attributes are supported:
+
+Friendly Name           - the value is a normal C string
+Key ID                  - the value is a 160 bit SHA1 hash
+Issuer Key ID           - the value is a 160 bit SHA1 hash
+Subject Key ID          - the value is a 160 bit SHA1 hash
+Issuer/Serial Hash      - the value is a 160 bit SHA1 hash
+Issuer                  - the value is a X509_NAME
+Serial                  - the value is a BIGNUM
+Subject                 - the value is a X509_NAME
+Certificate Hash        - the value is a 160 bit SHA1 hash
+Email                   - the value is a normal C string
+Filename                - the value is a normal C string
+
+It is expected that these attributes should be enough to support
+the need from most, if not all, current applications.  Applications
+that need to do certificate verification would typically use Subject
+Key ID, Issuer/Serial Hash or Subject to look up issuer certificates.
+S/MIME applications would typically use Email to look up recipient
+and signer certificates.
+
+There's added support for combined sets of attributes to search for,
+with the special OR attribute.
+
+
+Supported basic functionality
+-----------------------------
+
+The functions that are supported through the STORE type are these:
+
+generate_object         - for example to generate keys and CRLs
+get_object              - to look up one object
+                          NOTE: this function is really rather
+                          redundant and probably of lesser usage
+                          than the list functions
+store_object            - store an object and the attributes
+                          associated with it
+modify_object           - modify the attributes associated with
+                          a specific object
+revoke_object           - revoke an object
+                          NOTE: this only marks an object as
+                          invalid, it doesn't remove the object
+                          from the database
+delete_object           - remove an object from the database
+list_object             - list objects associated with a given
+                          set of attributes
+                          NOTE: this is really four functions:
+                          list_start, list_next, list_end and
+                          list_endp
+update_store            - update the internal data of the store
+lock_store              - lock the store
+unlock_store            - unlock the store
+
+The list functions need some extra explanation: list_start is
+used to set up a lookup.  That's where the attributes to use in
+the search are set up.  It returns a search context.  list_next
+returns the next object searched for.  list_end closes the search.
+list_endp is used to check if we have reached the end.
+
+A few words on the store functions as well: update_store is
+typically used by a CA application to update the internal
+structure of a database.  This may for example involve automatic
+removal of expired certificates.  lock_store and unlock_store
+are used for locking a store to allow exclusive writes.
diff --git a/src/lib/libssl/src/crypto/store/store.h b/src/lib/libssl/src/crypto/store/store.h
new file mode 100644
index 0000000000..64583377a9
--- /dev/null
+++ b/src/lib/libssl/src/crypto/store/store.h
@@ -0,0 +1,554 @@
+/* crypto/store/store.h -*- mode:C; c-file-style: "eay" -*- */
+/* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
+ * project 2003.
+ */
+/* ====================================================================
+ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_STORE_H
+#define HEADER_STORE_H
+
+#include <openssl/ossl_typ.h>
+#ifndef OPENSSL_NO_DEPRECATED
+#include <openssl/evp.h>
+#include <openssl/bn.h>
+#include <openssl/x509.h>
+#endif
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* Already defined in ossl_typ.h */
+/* typedef struct store_st STORE; */
+/* typedef struct store_method_st STORE_METHOD; */
+
+
+/* All the following functions return 0, a negative number or NULL on error.
+   When everything is fine, they return a positive value or a non-NULL
+   pointer, all depending on their purpose. */
+
+/* Creators and destructor.   */
+STORE *STORE_new_method(const STORE_METHOD *method);
+STORE *STORE_new_engine(ENGINE *engine);
+void STORE_free(STORE *ui);
+
+
+/* Give a user interface parametrised control commands.  This can be used to
+   send down an integer, a data pointer or a function pointer, as well as
+   be used to get information from a STORE. */
+int STORE_ctrl(STORE *store, int cmd, long i, void *p, void (*f)(void));
+
+/* A control to set the directory with keys and certificates.  Used by the
+   built-in directory level method. */
+#define STORE_CTRL_SET_DIRECTORY        0x0001
+/* A control to set a file to load.  Used by the built-in file level method. */
+#define STORE_CTRL_SET_FILE             0x0002
+/* A control to set a configuration file to load.  Can be used by any method
+   that wishes to load a configuration file. */
+#define STORE_CTRL_SET_CONF_FILE        0x0003
+/* A control to set a the section of the loaded configuration file.  Can be
+   used by any method that wishes to load a configuration file. */
+#define STORE_CTRL_SET_CONF_SECTION     0x0004
+
+
+/* Some methods may use extra data */
+#define STORE_set_app_data(s,arg)       STORE_set_ex_data(s,0,arg)
+#define STORE_get_app_data(s)           STORE_get_ex_data(s,0)
+int STORE_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+int STORE_set_ex_data(STORE *r,int idx,void *arg);
+void *STORE_get_ex_data(STORE *r, int idx);
+
+/* Use specific methods instead of the built-in one */
+const STORE_METHOD *STORE_get_method(STORE *store);
+const STORE_METHOD *STORE_set_method(STORE *store, const STORE_METHOD *meth);
+
+/* The standard OpenSSL methods. */
+/* This is the in-memory method.  It does everything except revoking and updating,
+   and is of course volatile.  It's used by other methods that have an in-memory
+   cache. */
+const STORE_METHOD *STORE_Memory(void);
+#if 0 /* Not yet implemented */
+/* This is the directory store.  It does everything except revoking and updating,
+   and uses STORE_Memory() to cache things in memory. */
+const STORE_METHOD *STORE_Directory(void);
+/* This is the file store.  It does everything except revoking and updating,
+   and uses STORE_Memory() to cache things in memory.  Certificates are added
+   to it with the store operation, and it will only get cached certificates. */
+const STORE_METHOD *STORE_File(void);
+#endif
+
+/* Store functions take a type code for the type of data they should store
+   or fetch */
+typedef enum STORE_object_types
+        {
+        STORE_OBJECT_TYPE_X509_CERTIFICATE=     0x01, /* X509 * */
+        STORE_OBJECT_TYPE_X509_CRL=             0x02, /* X509_CRL * */
+        STORE_OBJECT_TYPE_PRIVATE_KEY=          0x03, /* EVP_PKEY * */
+        STORE_OBJECT_TYPE_PUBLIC_KEY=           0x04, /* EVP_PKEY * */
+        STORE_OBJECT_TYPE_NUMBER=               0x05, /* BIGNUM * */
+        STORE_OBJECT_TYPE_ARBITRARY=            0x06, /* BUF_MEM * */
+        STORE_OBJECT_TYPE_NUM=                  0x06  /* The amount of known
+                                                         object types */
+        } STORE_OBJECT_TYPES;
+/* List of text strings corresponding to the object types. */
+extern const char * const STORE_object_type_string[STORE_OBJECT_TYPE_NUM+1];
+
+/* Some store functions take a parameter list.  Those parameters come with
+   one of the following codes. The comments following the codes below indicate
+   what type the value should be a pointer to. */
+typedef enum STORE_params
+        {
+        STORE_PARAM_EVP_TYPE=                   0x01, /* int */
+        STORE_PARAM_BITS=                       0x02, /* size_t */
+        STORE_PARAM_KEY_PARAMETERS=             0x03, /* ??? */
+        STORE_PARAM_KEY_NO_PARAMETERS=          0x04, /* N/A */
+        STORE_PARAM_AUTH_PASSPHRASE=            0x05, /* char * */
+        STORE_PARAM_AUTH_KRB5_TICKET=           0x06, /* void * */
+        STORE_PARAM_TYPE_NUM=                   0x06  /* The amount of known
+                                                         parameter types */
+        } STORE_PARAM_TYPES;
+/* Parameter value sizes.  -1 means unknown, anything else is the required size. */
+extern const int STORE_param_sizes[STORE_PARAM_TYPE_NUM+1];
+
+/* Store functions take attribute lists.  Those attributes come with codes.
+   The comments following the codes below indicate what type the value should
+   be a pointer to. */
+typedef enum STORE_attribs
+        {
+        STORE_ATTR_END=                         0x00,
+        STORE_ATTR_FRIENDLYNAME=                0x01, /* C string */
+        STORE_ATTR_KEYID=                       0x02, /* 160 bit string (SHA1) */
+        STORE_ATTR_ISSUERKEYID=                 0x03, /* 160 bit string (SHA1) */
+        STORE_ATTR_SUBJECTKEYID=                0x04, /* 160 bit string (SHA1) */
+        STORE_ATTR_ISSUERSERIALHASH=            0x05, /* 160 bit string (SHA1) */
+        STORE_ATTR_ISSUER=                      0x06, /* X509_NAME * */
+        STORE_ATTR_SERIAL=                      0x07, /* BIGNUM * */
+        STORE_ATTR_SUBJECT=                     0x08, /* X509_NAME * */
+        STORE_ATTR_CERTHASH=                    0x09, /* 160 bit string (SHA1) */
+        STORE_ATTR_EMAIL=                       0x0a, /* C string */
+        STORE_ATTR_FILENAME=                    0x0b, /* C string */
+        STORE_ATTR_TYPE_NUM=                    0x0b, /* The amount of known
+                                                         attribute types */
+        STORE_ATTR_OR=                          0xff  /* This is a special
+                                                         separator, which
+                                                         expresses the OR
+                                                         operation.  */
+        } STORE_ATTR_TYPES;
+/* Attribute value sizes.  -1 means unknown, anything else is the required size. */
+extern const int STORE_attr_sizes[STORE_ATTR_TYPE_NUM+1];
+
+typedef enum STORE_certificate_status
+        {
+        STORE_X509_VALID=                       0x00,
+        STORE_X509_EXPIRED=                     0x01,
+        STORE_X509_SUSPENDED=                   0x02,
+        STORE_X509_REVOKED=                     0x03
+        } STORE_CERTIFICATE_STATUS;
+
+/* Engine store functions will return a structure that contains all the necessary
+ * information, including revokation status for certificates.  This is really not
+ * needed for application authors, as the ENGINE framework functions will extract
+ * the OpenSSL-specific information when at all possible.  However, for engine
+ * authors, it's crucial to know this structure.  */
+typedef struct STORE_OBJECT_st
+        {
+        STORE_OBJECT_TYPES type;
+        union
+                {
+                struct
+                        {
+                        STORE_CERTIFICATE_STATUS status;
+                        X509 *certificate;
+                        } x509;
+                X509_CRL *crl;
+                EVP_PKEY *key;
+                BIGNUM *number;
+                BUF_MEM *arbitrary;
+                } data;
+        } STORE_OBJECT;
+DECLARE_STACK_OF(STORE_OBJECT)
+STORE_OBJECT *STORE_OBJECT_new(void);
+void STORE_OBJECT_free(STORE_OBJECT *data);
+
+
+
+/* The following functions handle the storage. They return 0, a negative number
+   or NULL on error, anything else on success. */
+X509 *STORE_get_certificate(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_store_certificate(STORE *e, X509 *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_modify_certificate(STORE *e, OPENSSL_ITEM search_attributes[],
+        OPENSSL_ITEM add_attributes[], OPENSSL_ITEM modify_attributes[],
+        OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[]);
+int STORE_revoke_certificate(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_delete_certificate(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+void *STORE_list_certificate_start(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+X509 *STORE_list_certificate_next(STORE *e, void *handle);
+int STORE_list_certificate_end(STORE *e, void *handle);
+int STORE_list_certificate_endp(STORE *e, void *handle);
+EVP_PKEY *STORE_generate_key(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+EVP_PKEY *STORE_get_private_key(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_store_private_key(STORE *e, EVP_PKEY *data,
+        OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[]);
+int STORE_modify_private_key(STORE *e, OPENSSL_ITEM search_attributes[],
+        OPENSSL_ITEM add_sttributes[], OPENSSL_ITEM modify_attributes[],
+        OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[]);
+int STORE_revoke_private_key(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_delete_private_key(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+void *STORE_list_private_key_start(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+EVP_PKEY *STORE_list_private_key_next(STORE *e, void *handle);
+int STORE_list_private_key_end(STORE *e, void *handle);
+int STORE_list_private_key_endp(STORE *e, void *handle);
+EVP_PKEY *STORE_get_public_key(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_store_public_key(STORE *e, EVP_PKEY *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_modify_public_key(STORE *e, OPENSSL_ITEM search_attributes[],
+        OPENSSL_ITEM add_sttributes[], OPENSSL_ITEM modify_attributes[],
+        OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[]);
+int STORE_revoke_public_key(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_delete_public_key(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+void *STORE_list_public_key_start(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+EVP_PKEY *STORE_list_public_key_next(STORE *e, void *handle);
+int STORE_list_public_key_end(STORE *e, void *handle);
+int STORE_list_public_key_endp(STORE *e, void *handle);
+X509_CRL *STORE_generate_crl(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+X509_CRL *STORE_get_crl(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_store_crl(STORE *e, X509_CRL *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_modify_crl(STORE *e, OPENSSL_ITEM search_attributes[],
+        OPENSSL_ITEM add_sttributes[], OPENSSL_ITEM modify_attributes[],
+        OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[]);
+int STORE_delete_crl(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+void *STORE_list_crl_start(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+X509_CRL *STORE_list_crl_next(STORE *e, void *handle);
+int STORE_list_crl_end(STORE *e, void *handle);
+int STORE_list_crl_endp(STORE *e, void *handle);
+int STORE_store_number(STORE *e, BIGNUM *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_modify_number(STORE *e, OPENSSL_ITEM search_attributes[],
+        OPENSSL_ITEM add_sttributes[], OPENSSL_ITEM modify_attributes[],
+        OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[]);
+BIGNUM *STORE_get_number(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_delete_number(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_store_arbitrary(STORE *e, BUF_MEM *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_modify_arbitrary(STORE *e, OPENSSL_ITEM search_attributes[],
+        OPENSSL_ITEM add_sttributes[], OPENSSL_ITEM modify_attributes[],
+        OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[]);
+BUF_MEM *STORE_get_arbitrary(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+int STORE_delete_arbitrary(STORE *e, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+
+
+/* Create and manipulate methods */
+STORE_METHOD *STORE_create_method(char *name);
+void STORE_destroy_method(STORE_METHOD *store_method);
+
+/* These callback types are use for store handlers */
+typedef int (*STORE_INITIALISE_FUNC_PTR)(STORE *);
+typedef void (*STORE_CLEANUP_FUNC_PTR)(STORE *);
+typedef STORE_OBJECT *(*STORE_GENERATE_OBJECT_FUNC_PTR)(STORE *, STORE_OBJECT_TYPES type, OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[]);
+typedef STORE_OBJECT *(*STORE_GET_OBJECT_FUNC_PTR)(STORE *, STORE_OBJECT_TYPES type, OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[]);
+typedef void *(*STORE_START_OBJECT_FUNC_PTR)(STORE *, STORE_OBJECT_TYPES type, OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[]);
+typedef STORE_OBJECT *(*STORE_NEXT_OBJECT_FUNC_PTR)(STORE *, void *handle);
+typedef int (*STORE_END_OBJECT_FUNC_PTR)(STORE *, void *handle);
+typedef int (*STORE_HANDLE_OBJECT_FUNC_PTR)(STORE *, STORE_OBJECT_TYPES type, OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[]);
+typedef int (*STORE_STORE_OBJECT_FUNC_PTR)(STORE *, STORE_OBJECT_TYPES type, STORE_OBJECT *data, OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[]);
+typedef int (*STORE_MODIFY_OBJECT_FUNC_PTR)(STORE *, STORE_OBJECT_TYPES type, OPENSSL_ITEM search_attributes[], OPENSSL_ITEM add_attributes[], OPENSSL_ITEM modify_attributes[], OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[]);
+typedef int (*STORE_GENERIC_FUNC_PTR)(STORE *, OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[]);
+typedef int (*STORE_CTRL_FUNC_PTR)(STORE *, int cmd, long l, void *p, void (*f)(void));
+
+int STORE_method_set_initialise_function(STORE_METHOD *sm, STORE_INITIALISE_FUNC_PTR init_f);
+int STORE_method_set_cleanup_function(STORE_METHOD *sm, STORE_CLEANUP_FUNC_PTR clean_f);
+int STORE_method_set_generate_function(STORE_METHOD *sm, STORE_GENERATE_OBJECT_FUNC_PTR generate_f);
+int STORE_method_set_get_function(STORE_METHOD *sm, STORE_GET_OBJECT_FUNC_PTR get_f);
+int STORE_method_set_store_function(STORE_METHOD *sm, STORE_STORE_OBJECT_FUNC_PTR store_f);
+int STORE_method_set_modify_function(STORE_METHOD *sm, STORE_MODIFY_OBJECT_FUNC_PTR store_f);
+int STORE_method_set_revoke_function(STORE_METHOD *sm, STORE_HANDLE_OBJECT_FUNC_PTR revoke_f);
+int STORE_method_set_delete_function(STORE_METHOD *sm, STORE_HANDLE_OBJECT_FUNC_PTR delete_f);
+int STORE_method_set_list_start_function(STORE_METHOD *sm, STORE_START_OBJECT_FUNC_PTR list_start_f);
+int STORE_method_set_list_next_function(STORE_METHOD *sm, STORE_NEXT_OBJECT_FUNC_PTR list_next_f);
+int STORE_method_set_list_end_function(STORE_METHOD *sm, STORE_END_OBJECT_FUNC_PTR list_end_f);
+int STORE_method_set_update_store_function(STORE_METHOD *sm, STORE_GENERIC_FUNC_PTR);
+int STORE_method_set_lock_store_function(STORE_METHOD *sm, STORE_GENERIC_FUNC_PTR);
+int STORE_method_set_unlock_store_function(STORE_METHOD *sm, STORE_GENERIC_FUNC_PTR);
+int STORE_method_set_ctrl_function(STORE_METHOD *sm, STORE_CTRL_FUNC_PTR ctrl_f);
+
+STORE_INITIALISE_FUNC_PTR STORE_method_get_initialise_function(STORE_METHOD *sm);
+STORE_CLEANUP_FUNC_PTR STORE_method_get_cleanup_function(STORE_METHOD *sm);
+STORE_GENERATE_OBJECT_FUNC_PTR STORE_method_get_generate_function(STORE_METHOD *sm);
+STORE_GET_OBJECT_FUNC_PTR STORE_method_get_get_function(STORE_METHOD *sm);
+STORE_STORE_OBJECT_FUNC_PTR STORE_method_get_store_function(STORE_METHOD *sm);
+STORE_MODIFY_OBJECT_FUNC_PTR STORE_method_get_modify_function(STORE_METHOD *sm);
+STORE_HANDLE_OBJECT_FUNC_PTR STORE_method_get_revoke_function(STORE_METHOD *sm);
+STORE_HANDLE_OBJECT_FUNC_PTR STORE_method_get_delete_function(STORE_METHOD *sm);
+STORE_START_OBJECT_FUNC_PTR STORE_method_get_list_start_function(STORE_METHOD *sm);
+STORE_NEXT_OBJECT_FUNC_PTR STORE_method_get_list_next_function(STORE_METHOD *sm);
+STORE_END_OBJECT_FUNC_PTR STORE_method_get_list_end_function(STORE_METHOD *sm);
+STORE_GENERIC_FUNC_PTR STORE_method_get_update_store_function(STORE_METHOD *sm);
+STORE_GENERIC_FUNC_PTR STORE_method_get_lock_store_function(STORE_METHOD *sm);
+STORE_GENERIC_FUNC_PTR STORE_method_get_unlock_store_function(STORE_METHOD *sm);
+STORE_CTRL_FUNC_PTR STORE_method_get_ctrl_function(STORE_METHOD *sm);
+
+/* Method helper structures and functions. */
+
+/* This structure is the result of parsing through the information in a list
+   of OPENSSL_ITEMs.  It stores all the necessary information in a structured
+   way.*/
+typedef struct STORE_attr_info_st STORE_ATTR_INFO;
+
+/* Parse a list of OPENSSL_ITEMs and return a pointer to a STORE_ATTR_INFO.
+   Note that we do this in the list form, since the list of OPENSSL_ITEMs can
+   come in blocks separated with STORE_ATTR_OR.  Note that the value returned
+   by STORE_parse_attrs_next() must be freed with STORE_ATTR_INFO_free(). */
+void *STORE_parse_attrs_start(OPENSSL_ITEM *attributes);
+STORE_ATTR_INFO *STORE_parse_attrs_next(void *handle);
+int STORE_parse_attrs_end(void *handle);
+int STORE_parse_attrs_endp(void *handle);
+
+/* Creator and destructor */
+STORE_ATTR_INFO *STORE_ATTR_INFO_new(void);
+int STORE_ATTR_INFO_free(STORE_ATTR_INFO *attrs);
+
+/* Manipulators */
+char *STORE_ATTR_INFO_get0_cstr(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code);
+unsigned char *STORE_ATTR_INFO_get0_sha1str(STORE_ATTR_INFO *attrs,
+        STORE_ATTR_TYPES code);
+X509_NAME *STORE_ATTR_INFO_get0_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code);
+BIGNUM *STORE_ATTR_INFO_get0_number(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code);
+int STORE_ATTR_INFO_set_cstr(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        char *cstr, size_t cstr_size);
+int STORE_ATTR_INFO_set_sha1str(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        unsigned char *sha1str, size_t sha1str_size);
+int STORE_ATTR_INFO_set_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        X509_NAME *dn);
+int STORE_ATTR_INFO_set_number(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        BIGNUM *number);
+int STORE_ATTR_INFO_modify_cstr(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        char *cstr, size_t cstr_size);
+int STORE_ATTR_INFO_modify_sha1str(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        unsigned char *sha1str, size_t sha1str_size);
+int STORE_ATTR_INFO_modify_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        X509_NAME *dn);
+int STORE_ATTR_INFO_modify_number(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        BIGNUM *number);
+
+/* Compare on basis of a bit pattern formed by the STORE_ATTR_TYPES values
+   in each contained attribute. */
+int STORE_ATTR_INFO_compare(STORE_ATTR_INFO *a, STORE_ATTR_INFO *b);
+/* Check if the set of attributes in a is within the range of attributes
+   set in b. */
+int STORE_ATTR_INFO_in_range(STORE_ATTR_INFO *a, STORE_ATTR_INFO *b);
+/* Check if the set of attributes in a are also set in b. */
+int STORE_ATTR_INFO_in(STORE_ATTR_INFO *a, STORE_ATTR_INFO *b);
+/* Same as STORE_ATTR_INFO_in(), but also checks the attribute values. */
+int STORE_ATTR_INFO_in_ex(STORE_ATTR_INFO *a, STORE_ATTR_INFO *b);
+
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+void ERR_load_STORE_strings(void);
+
+/* Error codes for the STORE functions. */
+
+/* Function codes. */
+#define STORE_F_MEM_DELETE                               134
+#define STORE_F_MEM_GENERATE                             135
+#define STORE_F_MEM_LIST_END                             168
+#define STORE_F_MEM_LIST_NEXT                            136
+#define STORE_F_MEM_LIST_START                           137
+#define STORE_F_MEM_MODIFY                               169
+#define STORE_F_MEM_STORE                                138
+#define STORE_F_STORE_ATTR_INFO_GET0_CSTR                139
+#define STORE_F_STORE_ATTR_INFO_GET0_DN                  140
+#define STORE_F_STORE_ATTR_INFO_GET0_NUMBER              141
+#define STORE_F_STORE_ATTR_INFO_GET0_SHA1STR             142
+#define STORE_F_STORE_ATTR_INFO_MODIFY_CSTR              143
+#define STORE_F_STORE_ATTR_INFO_MODIFY_DN                144
+#define STORE_F_STORE_ATTR_INFO_MODIFY_NUMBER            145
+#define STORE_F_STORE_ATTR_INFO_MODIFY_SHA1STR           146
+#define STORE_F_STORE_ATTR_INFO_SET_CSTR                 147
+#define STORE_F_STORE_ATTR_INFO_SET_DN                   148
+#define STORE_F_STORE_ATTR_INFO_SET_NUMBER               149
+#define STORE_F_STORE_ATTR_INFO_SET_SHA1STR              150
+#define STORE_F_STORE_CERTIFICATE                        170
+#define STORE_F_STORE_CTRL                               161
+#define STORE_F_STORE_DELETE_ARBITRARY                   158
+#define STORE_F_STORE_DELETE_CERTIFICATE                 102
+#define STORE_F_STORE_DELETE_CRL                         103
+#define STORE_F_STORE_DELETE_NUMBER                      104
+#define STORE_F_STORE_DELETE_PRIVATE_KEY                 105
+#define STORE_F_STORE_DELETE_PUBLIC_KEY                  106
+#define STORE_F_STORE_GENERATE_CRL                       107
+#define STORE_F_STORE_GENERATE_KEY                       108
+#define STORE_F_STORE_GET_ARBITRARY                      159
+#define STORE_F_STORE_GET_CERTIFICATE                    109
+#define STORE_F_STORE_GET_CRL                            110
+#define STORE_F_STORE_GET_NUMBER                         111
+#define STORE_F_STORE_GET_PRIVATE_KEY                    112
+#define STORE_F_STORE_GET_PUBLIC_KEY                     113
+#define STORE_F_STORE_LIST_CERTIFICATE_END               114
+#define STORE_F_STORE_LIST_CERTIFICATE_ENDP              153
+#define STORE_F_STORE_LIST_CERTIFICATE_NEXT              115
+#define STORE_F_STORE_LIST_CERTIFICATE_START             116
+#define STORE_F_STORE_LIST_CRL_END                       117
+#define STORE_F_STORE_LIST_CRL_ENDP                      154
+#define STORE_F_STORE_LIST_CRL_NEXT                      118
+#define STORE_F_STORE_LIST_CRL_START                     119
+#define STORE_F_STORE_LIST_PRIVATE_KEY_END               120
+#define STORE_F_STORE_LIST_PRIVATE_KEY_ENDP              155
+#define STORE_F_STORE_LIST_PRIVATE_KEY_NEXT              121
+#define STORE_F_STORE_LIST_PRIVATE_KEY_START             122
+#define STORE_F_STORE_LIST_PUBLIC_KEY_END                123
+#define STORE_F_STORE_LIST_PUBLIC_KEY_ENDP               156
+#define STORE_F_STORE_LIST_PUBLIC_KEY_NEXT               124
+#define STORE_F_STORE_LIST_PUBLIC_KEY_START              125
+#define STORE_F_STORE_MODIFY_ARBITRARY                   162
+#define STORE_F_STORE_MODIFY_CERTIFICATE                 163
+#define STORE_F_STORE_MODIFY_CRL                         164
+#define STORE_F_STORE_MODIFY_NUMBER                      165
+#define STORE_F_STORE_MODIFY_PRIVATE_KEY                 166
+#define STORE_F_STORE_MODIFY_PUBLIC_KEY                  167
+#define STORE_F_STORE_NEW_ENGINE                         133
+#define STORE_F_STORE_NEW_METHOD                         132
+#define STORE_F_STORE_PARSE_ATTRS_END                    151
+#define STORE_F_STORE_PARSE_ATTRS_ENDP                   172
+#define STORE_F_STORE_PARSE_ATTRS_NEXT                   152
+#define STORE_F_STORE_PARSE_ATTRS_START                  171
+#define STORE_F_STORE_REVOKE_CERTIFICATE                 129
+#define STORE_F_STORE_REVOKE_PRIVATE_KEY                 130
+#define STORE_F_STORE_REVOKE_PUBLIC_KEY                  131
+#define STORE_F_STORE_STORE_ARBITRARY                    157
+#define STORE_F_STORE_STORE_CERTIFICATE                  100
+#define STORE_F_STORE_STORE_CRL                          101
+#define STORE_F_STORE_STORE_NUMBER                       126
+#define STORE_F_STORE_STORE_PRIVATE_KEY                  127
+#define STORE_F_STORE_STORE_PUBLIC_KEY                   128
+
+/* Reason codes. */
+#define STORE_R_ALREADY_HAS_A_VALUE                      127
+#define STORE_R_FAILED_DELETING_ARBITRARY                132
+#define STORE_R_FAILED_DELETING_CERTIFICATE              100
+#define STORE_R_FAILED_DELETING_KEY                      101
+#define STORE_R_FAILED_DELETING_NUMBER                   102
+#define STORE_R_FAILED_GENERATING_CRL                    103
+#define STORE_R_FAILED_GENERATING_KEY                    104
+#define STORE_R_FAILED_GETTING_ARBITRARY                 133
+#define STORE_R_FAILED_GETTING_CERTIFICATE               105
+#define STORE_R_FAILED_GETTING_KEY                       106
+#define STORE_R_FAILED_GETTING_NUMBER                    107
+#define STORE_R_FAILED_LISTING_CERTIFICATES              108
+#define STORE_R_FAILED_LISTING_KEYS                      109
+#define STORE_R_FAILED_MODIFYING_ARBITRARY               138
+#define STORE_R_FAILED_MODIFYING_CERTIFICATE             139
+#define STORE_R_FAILED_MODIFYING_CRL                     140
+#define STORE_R_FAILED_MODIFYING_NUMBER                  141
+#define STORE_R_FAILED_MODIFYING_PRIVATE_KEY             142
+#define STORE_R_FAILED_MODIFYING_PUBLIC_KEY              143
+#define STORE_R_FAILED_REVOKING_CERTIFICATE              110
+#define STORE_R_FAILED_REVOKING_KEY                      111
+#define STORE_R_FAILED_STORING_ARBITRARY                 134
+#define STORE_R_FAILED_STORING_CERTIFICATE               112
+#define STORE_R_FAILED_STORING_KEY                       113
+#define STORE_R_FAILED_STORING_NUMBER                    114
+#define STORE_R_NOT_IMPLEMENTED                          128
+#define STORE_R_NO_CONTROL_FUNCTION                      144
+#define STORE_R_NO_DELETE_ARBITRARY_FUNCTION             135
+#define STORE_R_NO_DELETE_NUMBER_FUNCTION                115
+#define STORE_R_NO_DELETE_OBJECT_FUNCTION                116
+#define STORE_R_NO_GENERATE_CRL_FUNCTION                 117
+#define STORE_R_NO_GENERATE_OBJECT_FUNCTION              118
+#define STORE_R_NO_GET_OBJECT_ARBITRARY_FUNCTION         136
+#define STORE_R_NO_GET_OBJECT_FUNCTION                   119
+#define STORE_R_NO_GET_OBJECT_NUMBER_FUNCTION            120
+#define STORE_R_NO_LIST_OBJECT_ENDP_FUNCTION             131
+#define STORE_R_NO_LIST_OBJECT_END_FUNCTION              121
+#define STORE_R_NO_LIST_OBJECT_NEXT_FUNCTION             122
+#define STORE_R_NO_LIST_OBJECT_START_FUNCTION            123
+#define STORE_R_NO_MODIFY_OBJECT_FUNCTION                145
+#define STORE_R_NO_REVOKE_OBJECT_FUNCTION                124
+#define STORE_R_NO_STORE                                 129
+#define STORE_R_NO_STORE_OBJECT_ARBITRARY_FUNCTION       137
+#define STORE_R_NO_STORE_OBJECT_FUNCTION                 125
+#define STORE_R_NO_STORE_OBJECT_NUMBER_FUNCTION          126
+#define STORE_R_NO_VALUE                                 130
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/crypto/store/str_err.c b/src/lib/libssl/src/crypto/store/str_err.c
new file mode 100644
index 0000000000..6fee649822
--- /dev/null
+++ b/src/lib/libssl/src/crypto/store/str_err.c
@@ -0,0 +1,211 @@
+/* crypto/store/str_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include <openssl/store.h>
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(ERR_LIB_STORE,func,0)
+#define ERR_REASON(reason) ERR_PACK(ERR_LIB_STORE,0,reason)
+
+static ERR_STRING_DATA STORE_str_functs[]=
+        {
+{ERR_FUNC(STORE_F_MEM_DELETE),  "MEM_DELETE"},
+{ERR_FUNC(STORE_F_MEM_GENERATE),        "MEM_GENERATE"},
+{ERR_FUNC(STORE_F_MEM_LIST_END),        "MEM_LIST_END"},
+{ERR_FUNC(STORE_F_MEM_LIST_NEXT),       "MEM_LIST_NEXT"},
+{ERR_FUNC(STORE_F_MEM_LIST_START),      "MEM_LIST_START"},
+{ERR_FUNC(STORE_F_MEM_MODIFY),  "MEM_MODIFY"},
+{ERR_FUNC(STORE_F_MEM_STORE),   "MEM_STORE"},
+{ERR_FUNC(STORE_F_STORE_ATTR_INFO_GET0_CSTR),   "STORE_ATTR_INFO_get0_cstr"},
+{ERR_FUNC(STORE_F_STORE_ATTR_INFO_GET0_DN),     "STORE_ATTR_INFO_get0_dn"},
+{ERR_FUNC(STORE_F_STORE_ATTR_INFO_GET0_NUMBER), "STORE_ATTR_INFO_get0_number"},
+{ERR_FUNC(STORE_F_STORE_ATTR_INFO_GET0_SHA1STR),        "STORE_ATTR_INFO_get0_sha1str"},
+{ERR_FUNC(STORE_F_STORE_ATTR_INFO_MODIFY_CSTR), "STORE_ATTR_INFO_modify_cstr"},
+{ERR_FUNC(STORE_F_STORE_ATTR_INFO_MODIFY_DN),   "STORE_ATTR_INFO_modify_dn"},
+{ERR_FUNC(STORE_F_STORE_ATTR_INFO_MODIFY_NUMBER),       "STORE_ATTR_INFO_modify_number"},
+{ERR_FUNC(STORE_F_STORE_ATTR_INFO_MODIFY_SHA1STR),      "STORE_ATTR_INFO_modify_sha1str"},
+{ERR_FUNC(STORE_F_STORE_ATTR_INFO_SET_CSTR),    "STORE_ATTR_INFO_set_cstr"},
+{ERR_FUNC(STORE_F_STORE_ATTR_INFO_SET_DN),      "STORE_ATTR_INFO_set_dn"},
+{ERR_FUNC(STORE_F_STORE_ATTR_INFO_SET_NUMBER),  "STORE_ATTR_INFO_set_number"},
+{ERR_FUNC(STORE_F_STORE_ATTR_INFO_SET_SHA1STR), "STORE_ATTR_INFO_set_sha1str"},
+{ERR_FUNC(STORE_F_STORE_CERTIFICATE),   "STORE_CERTIFICATE"},
+{ERR_FUNC(STORE_F_STORE_CTRL),  "STORE_ctrl"},
+{ERR_FUNC(STORE_F_STORE_DELETE_ARBITRARY),      "STORE_delete_arbitrary"},
+{ERR_FUNC(STORE_F_STORE_DELETE_CERTIFICATE),    "STORE_delete_certificate"},
+{ERR_FUNC(STORE_F_STORE_DELETE_CRL),    "STORE_delete_crl"},
+{ERR_FUNC(STORE_F_STORE_DELETE_NUMBER), "STORE_delete_number"},
+{ERR_FUNC(STORE_F_STORE_DELETE_PRIVATE_KEY),    "STORE_delete_private_key"},
+{ERR_FUNC(STORE_F_STORE_DELETE_PUBLIC_KEY),     "STORE_delete_public_key"},
+{ERR_FUNC(STORE_F_STORE_GENERATE_CRL),  "STORE_generate_crl"},
+{ERR_FUNC(STORE_F_STORE_GENERATE_KEY),  "STORE_generate_key"},
+{ERR_FUNC(STORE_F_STORE_GET_ARBITRARY), "STORE_get_arbitrary"},
+{ERR_FUNC(STORE_F_STORE_GET_CERTIFICATE),       "STORE_get_certificate"},
+{ERR_FUNC(STORE_F_STORE_GET_CRL),       "STORE_get_crl"},
+{ERR_FUNC(STORE_F_STORE_GET_NUMBER),    "STORE_get_number"},
+{ERR_FUNC(STORE_F_STORE_GET_PRIVATE_KEY),       "STORE_get_private_key"},
+{ERR_FUNC(STORE_F_STORE_GET_PUBLIC_KEY),        "STORE_get_public_key"},
+{ERR_FUNC(STORE_F_STORE_LIST_CERTIFICATE_END),  "STORE_list_certificate_end"},
+{ERR_FUNC(STORE_F_STORE_LIST_CERTIFICATE_ENDP), "STORE_list_certificate_endp"},
+{ERR_FUNC(STORE_F_STORE_LIST_CERTIFICATE_NEXT), "STORE_list_certificate_next"},
+{ERR_FUNC(STORE_F_STORE_LIST_CERTIFICATE_START),        "STORE_list_certificate_start"},
+{ERR_FUNC(STORE_F_STORE_LIST_CRL_END),  "STORE_list_crl_end"},
+{ERR_FUNC(STORE_F_STORE_LIST_CRL_ENDP), "STORE_list_crl_endp"},
+{ERR_FUNC(STORE_F_STORE_LIST_CRL_NEXT), "STORE_list_crl_next"},
+{ERR_FUNC(STORE_F_STORE_LIST_CRL_START),        "STORE_list_crl_start"},
+{ERR_FUNC(STORE_F_STORE_LIST_PRIVATE_KEY_END),  "STORE_list_private_key_end"},
+{ERR_FUNC(STORE_F_STORE_LIST_PRIVATE_KEY_ENDP), "STORE_list_private_key_endp"},
+{ERR_FUNC(STORE_F_STORE_LIST_PRIVATE_KEY_NEXT), "STORE_list_private_key_next"},
+{ERR_FUNC(STORE_F_STORE_LIST_PRIVATE_KEY_START),        "STORE_list_private_key_start"},
+{ERR_FUNC(STORE_F_STORE_LIST_PUBLIC_KEY_END),   "STORE_list_public_key_end"},
+{ERR_FUNC(STORE_F_STORE_LIST_PUBLIC_KEY_ENDP),  "STORE_list_public_key_endp"},
+{ERR_FUNC(STORE_F_STORE_LIST_PUBLIC_KEY_NEXT),  "STORE_list_public_key_next"},
+{ERR_FUNC(STORE_F_STORE_LIST_PUBLIC_KEY_START), "STORE_list_public_key_start"},
+{ERR_FUNC(STORE_F_STORE_MODIFY_ARBITRARY),      "STORE_modify_arbitrary"},
+{ERR_FUNC(STORE_F_STORE_MODIFY_CERTIFICATE),    "STORE_modify_certificate"},
+{ERR_FUNC(STORE_F_STORE_MODIFY_CRL),    "STORE_modify_crl"},
+{ERR_FUNC(STORE_F_STORE_MODIFY_NUMBER), "STORE_modify_number"},
+{ERR_FUNC(STORE_F_STORE_MODIFY_PRIVATE_KEY),    "STORE_modify_private_key"},
+{ERR_FUNC(STORE_F_STORE_MODIFY_PUBLIC_KEY),     "STORE_modify_public_key"},
+{ERR_FUNC(STORE_F_STORE_NEW_ENGINE),    "STORE_new_engine"},
+{ERR_FUNC(STORE_F_STORE_NEW_METHOD),    "STORE_new_method"},
+{ERR_FUNC(STORE_F_STORE_PARSE_ATTRS_END),       "STORE_parse_attrs_end"},
+{ERR_FUNC(STORE_F_STORE_PARSE_ATTRS_ENDP),      "STORE_parse_attrs_endp"},
+{ERR_FUNC(STORE_F_STORE_PARSE_ATTRS_NEXT),      "STORE_parse_attrs_next"},
+{ERR_FUNC(STORE_F_STORE_PARSE_ATTRS_START),     "STORE_parse_attrs_start"},
+{ERR_FUNC(STORE_F_STORE_REVOKE_CERTIFICATE),    "STORE_revoke_certificate"},
+{ERR_FUNC(STORE_F_STORE_REVOKE_PRIVATE_KEY),    "STORE_revoke_private_key"},
+{ERR_FUNC(STORE_F_STORE_REVOKE_PUBLIC_KEY),     "STORE_revoke_public_key"},
+{ERR_FUNC(STORE_F_STORE_STORE_ARBITRARY),       "STORE_store_arbitrary"},
+{ERR_FUNC(STORE_F_STORE_STORE_CERTIFICATE),     "STORE_store_certificate"},
+{ERR_FUNC(STORE_F_STORE_STORE_CRL),     "STORE_store_crl"},
+{ERR_FUNC(STORE_F_STORE_STORE_NUMBER),  "STORE_store_number"},
+{ERR_FUNC(STORE_F_STORE_STORE_PRIVATE_KEY),     "STORE_store_private_key"},
+{ERR_FUNC(STORE_F_STORE_STORE_PUBLIC_KEY),      "STORE_store_public_key"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA STORE_str_reasons[]=
+        {
+{ERR_REASON(STORE_R_ALREADY_HAS_A_VALUE) ,"already has a value"},
+{ERR_REASON(STORE_R_FAILED_DELETING_ARBITRARY),"failed deleting arbitrary"},
+{ERR_REASON(STORE_R_FAILED_DELETING_CERTIFICATE),"failed deleting certificate"},
+{ERR_REASON(STORE_R_FAILED_DELETING_KEY) ,"failed deleting key"},
+{ERR_REASON(STORE_R_FAILED_DELETING_NUMBER),"failed deleting number"},
+{ERR_REASON(STORE_R_FAILED_GENERATING_CRL),"failed generating crl"},
+{ERR_REASON(STORE_R_FAILED_GENERATING_KEY),"failed generating key"},
+{ERR_REASON(STORE_R_FAILED_GETTING_ARBITRARY),"failed getting arbitrary"},
+{ERR_REASON(STORE_R_FAILED_GETTING_CERTIFICATE),"failed getting certificate"},
+{ERR_REASON(STORE_R_FAILED_GETTING_KEY)  ,"failed getting key"},
+{ERR_REASON(STORE_R_FAILED_GETTING_NUMBER),"failed getting number"},
+{ERR_REASON(STORE_R_FAILED_LISTING_CERTIFICATES),"failed listing certificates"},
+{ERR_REASON(STORE_R_FAILED_LISTING_KEYS) ,"failed listing keys"},
+{ERR_REASON(STORE_R_FAILED_MODIFYING_ARBITRARY),"failed modifying arbitrary"},
+{ERR_REASON(STORE_R_FAILED_MODIFYING_CERTIFICATE),"failed modifying certificate"},
+{ERR_REASON(STORE_R_FAILED_MODIFYING_CRL),"failed modifying crl"},
+{ERR_REASON(STORE_R_FAILED_MODIFYING_NUMBER),"failed modifying number"},
+{ERR_REASON(STORE_R_FAILED_MODIFYING_PRIVATE_KEY),"failed modifying private key"},
+{ERR_REASON(STORE_R_FAILED_MODIFYING_PUBLIC_KEY),"failed modifying public key"},
+{ERR_REASON(STORE_R_FAILED_REVOKING_CERTIFICATE),"failed revoking certificate"},
+{ERR_REASON(STORE_R_FAILED_REVOKING_KEY) ,"failed revoking key"},
+{ERR_REASON(STORE_R_FAILED_STORING_ARBITRARY),"failed storing arbitrary"},
+{ERR_REASON(STORE_R_FAILED_STORING_CERTIFICATE),"failed storing certificate"},
+{ERR_REASON(STORE_R_FAILED_STORING_KEY)  ,"failed storing key"},
+{ERR_REASON(STORE_R_FAILED_STORING_NUMBER),"failed storing number"},
+{ERR_REASON(STORE_R_NOT_IMPLEMENTED)     ,"not implemented"},
+{ERR_REASON(STORE_R_NO_CONTROL_FUNCTION) ,"no control function"},
+{ERR_REASON(STORE_R_NO_DELETE_ARBITRARY_FUNCTION),"no delete arbitrary function"},
+{ERR_REASON(STORE_R_NO_DELETE_NUMBER_FUNCTION),"no delete number function"},
+{ERR_REASON(STORE_R_NO_DELETE_OBJECT_FUNCTION),"no delete object function"},
+{ERR_REASON(STORE_R_NO_GENERATE_CRL_FUNCTION),"no generate crl function"},
+{ERR_REASON(STORE_R_NO_GENERATE_OBJECT_FUNCTION),"no generate object function"},
+{ERR_REASON(STORE_R_NO_GET_OBJECT_ARBITRARY_FUNCTION),"no get object arbitrary function"},
+{ERR_REASON(STORE_R_NO_GET_OBJECT_FUNCTION),"no get object function"},
+{ERR_REASON(STORE_R_NO_GET_OBJECT_NUMBER_FUNCTION),"no get object number function"},
+{ERR_REASON(STORE_R_NO_LIST_OBJECT_ENDP_FUNCTION),"no list object endp function"},
+{ERR_REASON(STORE_R_NO_LIST_OBJECT_END_FUNCTION),"no list object end function"},
+{ERR_REASON(STORE_R_NO_LIST_OBJECT_NEXT_FUNCTION),"no list object next function"},
+{ERR_REASON(STORE_R_NO_LIST_OBJECT_START_FUNCTION),"no list object start function"},
+{ERR_REASON(STORE_R_NO_MODIFY_OBJECT_FUNCTION),"no modify object function"},
+{ERR_REASON(STORE_R_NO_REVOKE_OBJECT_FUNCTION),"no revoke object function"},
+{ERR_REASON(STORE_R_NO_STORE)            ,"no store"},
+{ERR_REASON(STORE_R_NO_STORE_OBJECT_ARBITRARY_FUNCTION),"no store object arbitrary function"},
+{ERR_REASON(STORE_R_NO_STORE_OBJECT_FUNCTION),"no store object function"},
+{ERR_REASON(STORE_R_NO_STORE_OBJECT_NUMBER_FUNCTION),"no store object number function"},
+{ERR_REASON(STORE_R_NO_VALUE)            ,"no value"},
+{0,NULL}
+        };
+
+#endif
+
+void ERR_load_STORE_strings(void)
+        {
+#ifndef OPENSSL_NO_ERR
+
+        if (ERR_func_error_string(STORE_str_functs[0].error) == NULL)
+                {
+                ERR_load_strings(0,STORE_str_functs);
+                ERR_load_strings(0,STORE_str_reasons);
+                }
+#endif
+        }
diff --git a/src/lib/libssl/src/crypto/store/str_lib.c b/src/lib/libssl/src/crypto/store/str_lib.c
new file mode 100644
index 0000000000..32ae5bd395
--- /dev/null
+++ b/src/lib/libssl/src/crypto/store/str_lib.c
@@ -0,0 +1,1824 @@
+/* crypto/store/str_lib.c -*- mode:C; c-file-style: "eay" -*- */
+/* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
+ * project 2003.
+ */
+/* ====================================================================
+ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <string.h>
+#include <openssl/bn.h>
+#include <openssl/err.h>
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
+#include <openssl/sha.h>
+#include <openssl/x509.h>
+#include "str_locl.h"
+
+const char * const STORE_object_type_string[STORE_OBJECT_TYPE_NUM+1] =
+        {
+        0,
+        "X.509 Certificate",
+        "X.509 CRL",
+        "Private Key",
+        "Public Key",
+        "Number",
+        "Arbitrary Data"
+        };
+
+const int STORE_param_sizes[STORE_PARAM_TYPE_NUM+1] =
+        {
+        0,
+        sizeof(int),            /* EVP_TYPE */
+        sizeof(size_t),         /* BITS */
+        -1,                     /* KEY_PARAMETERS */
+        0                       /* KEY_NO_PARAMETERS */
+        };      
+
+const int STORE_attr_sizes[STORE_ATTR_TYPE_NUM+1] =
+        {
+        0,
+        -1,                     /* FRIENDLYNAME:        C string */
+        SHA_DIGEST_LENGTH,      /* KEYID:               SHA1 digest, 160 bits */
+        SHA_DIGEST_LENGTH,      /* ISSUERKEYID:         SHA1 digest, 160 bits */
+        SHA_DIGEST_LENGTH,      /* SUBJECTKEYID:        SHA1 digest, 160 bits */
+        SHA_DIGEST_LENGTH,      /* ISSUERSERIALHASH:    SHA1 digest, 160 bits */
+        sizeof(X509_NAME *),    /* ISSUER:              X509_NAME * */
+        sizeof(BIGNUM *),       /* SERIAL:              BIGNUM * */
+        sizeof(X509_NAME *),    /* SUBJECT:             X509_NAME * */
+        SHA_DIGEST_LENGTH,      /* CERTHASH:            SHA1 digest, 160 bits */
+        -1,                     /* EMAIL:               C string */
+        -1,                     /* FILENAME:            C string */
+        };      
+
+STORE *STORE_new_method(const STORE_METHOD *method)
+        {
+        STORE *ret;
+
+        if (method == NULL)
+                {
+                STOREerr(STORE_F_STORE_NEW_METHOD,ERR_R_PASSED_NULL_PARAMETER);
+                return NULL;
+                }
+
+        ret=(STORE *)OPENSSL_malloc(sizeof(STORE));
+        if (ret == NULL)
+                {
+                STOREerr(STORE_F_STORE_NEW_METHOD,ERR_R_MALLOC_FAILURE);
+                return NULL;
+                }
+
+        ret->meth=method;
+
+        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_STORE, ret, &ret->ex_data);
+        if (ret->meth->init && !ret->meth->init(ret))
+                {
+                STORE_free(ret);
+                ret = NULL;
+                }
+        return ret;
+        }
+
+STORE *STORE_new_engine(ENGINE *engine)
+        {
+        STORE *ret = NULL;
+        ENGINE *e = engine;
+        const STORE_METHOD *meth = 0;
+
+#ifdef OPENSSL_NO_ENGINE
+        e = NULL;
+#else
+        if (engine)
+                {
+                if (!ENGINE_init(engine))
+                        {
+                        STOREerr(STORE_F_STORE_NEW_ENGINE, ERR_R_ENGINE_LIB);
+                        return NULL;
+                        }
+                e = engine;
+                }
+        else
+                {
+                STOREerr(STORE_F_STORE_NEW_ENGINE,ERR_R_PASSED_NULL_PARAMETER);
+                return NULL;
+                }
+        if(e)
+                {
+                meth = ENGINE_get_STORE(e);
+                if(!meth)
+                        {
+                        STOREerr(STORE_F_STORE_NEW_ENGINE,
+                                ERR_R_ENGINE_LIB);
+                        ENGINE_finish(e);
+                        return NULL;
+                        }
+                }
+#endif
+
+        ret = STORE_new_method(meth);
+        if (ret == NULL)
+                {
+                STOREerr(STORE_F_STORE_NEW_ENGINE,ERR_R_STORE_LIB);
+                return NULL;
+                }
+
+        ret->engine = e;
+
+        return(ret);
+        }
+
+void STORE_free(STORE *store)
+        {
+        if (store == NULL)
+                return;
+        if (store->meth->clean)
+                store->meth->clean(store);
+        CRYPTO_free_ex_data(CRYPTO_EX_INDEX_STORE, store, &store->ex_data);
+        OPENSSL_free(store);
+        }
+
+int STORE_ctrl(STORE *store, int cmd, long i, void *p, void (*f)(void))
+        {
+        if (store == NULL)
+                {
+                STOREerr(STORE_F_STORE_CTRL,ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if (store->meth->ctrl)
+                return store->meth->ctrl(store, cmd, i, p, f);
+        STOREerr(STORE_F_STORE_CTRL,STORE_R_NO_CONTROL_FUNCTION);
+        return 0;
+        }
+
+
+int STORE_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+        {
+        return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_STORE, argl, argp,
+                                new_func, dup_func, free_func);
+        }
+
+int STORE_set_ex_data(STORE *r, int idx, void *arg)
+        {
+        return(CRYPTO_set_ex_data(&r->ex_data,idx,arg));
+        }
+
+void *STORE_get_ex_data(STORE *r, int idx)
+        {
+        return(CRYPTO_get_ex_data(&r->ex_data,idx));
+        }
+
+const STORE_METHOD *STORE_get_method(STORE *store)
+        {
+        return store->meth;
+        }
+
+const STORE_METHOD *STORE_set_method(STORE *store, const STORE_METHOD *meth)
+        {
+        store->meth=meth;
+        return store->meth;
+        }
+
+
+/* API helpers */
+
+#define check_store(s,fncode,fnname,fnerrcode) \
+        do \
+                { \
+                if ((s) == NULL || (s)->meth == NULL) \
+                        { \
+                        STOREerr((fncode), ERR_R_PASSED_NULL_PARAMETER); \
+                        return 0; \
+                        } \
+                if ((s)->meth->fnname == NULL) \
+                        { \
+                        STOREerr((fncode), (fnerrcode)); \
+                        return 0; \
+                        } \
+                } \
+        while(0)
+
+/* API functions */
+
+X509 *STORE_get_certificate(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        X509 *x;
+
+        check_store(s,STORE_F_STORE_GET_CERTIFICATE,
+                get_object,STORE_R_NO_GET_OBJECT_FUNCTION);
+
+        object = s->meth->get_object(s, STORE_OBJECT_TYPE_X509_CERTIFICATE,
+                attributes, parameters);
+        if (!object || !object->data.x509.certificate)
+                {
+                STOREerr(STORE_F_STORE_GET_CERTIFICATE,
+                        STORE_R_FAILED_GETTING_CERTIFICATE);
+                return 0;
+                }
+        CRYPTO_add(&object->data.x509.certificate->references,1,CRYPTO_LOCK_X509);
+#ifdef REF_PRINT
+        REF_PRINT("X509",data);
+#endif
+        x = object->data.x509.certificate;
+        STORE_OBJECT_free(object);
+        return x;
+        }
+
+int STORE_store_certificate(STORE *s, X509 *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        int i;
+
+        check_store(s,STORE_F_STORE_CERTIFICATE,
+                store_object,STORE_R_NO_STORE_OBJECT_FUNCTION);
+
+        object = STORE_OBJECT_new();
+        if (!object)
+                {
+                STOREerr(STORE_F_STORE_STORE_CERTIFICATE,
+                        ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        
+        CRYPTO_add(&data->references,1,CRYPTO_LOCK_X509);
+#ifdef REF_PRINT
+        REF_PRINT("X509",data);
+#endif
+        object->data.x509.certificate = data;
+
+        i = s->meth->store_object(s, STORE_OBJECT_TYPE_X509_CERTIFICATE,
+                object, attributes, parameters);
+
+        STORE_OBJECT_free(object);
+
+        if (!i)
+                {
+                STOREerr(STORE_F_STORE_STORE_CERTIFICATE,
+                        STORE_R_FAILED_STORING_CERTIFICATE);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_modify_certificate(STORE *s, OPENSSL_ITEM search_attributes[],
+        OPENSSL_ITEM add_attributes[], OPENSSL_ITEM modify_attributes[],
+        OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_MODIFY_CERTIFICATE,
+                modify_object,STORE_R_NO_MODIFY_OBJECT_FUNCTION);
+
+        if (!s->meth->modify_object(s, STORE_OBJECT_TYPE_X509_CERTIFICATE,
+                    search_attributes, add_attributes, modify_attributes,
+                    delete_attributes, parameters))
+                {
+                STOREerr(STORE_F_STORE_MODIFY_CERTIFICATE,
+                        STORE_R_FAILED_MODIFYING_CERTIFICATE);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_revoke_certificate(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_REVOKE_CERTIFICATE,
+                revoke_object,STORE_R_NO_REVOKE_OBJECT_FUNCTION);
+
+        if (!s->meth->revoke_object(s, STORE_OBJECT_TYPE_X509_CERTIFICATE,
+                    attributes, parameters))
+                {
+                STOREerr(STORE_F_STORE_REVOKE_CERTIFICATE,
+                        STORE_R_FAILED_REVOKING_CERTIFICATE);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_delete_certificate(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_DELETE_CERTIFICATE,
+                delete_object,STORE_R_NO_DELETE_OBJECT_FUNCTION);
+
+        if (!s->meth->delete_object(s, STORE_OBJECT_TYPE_X509_CERTIFICATE,
+                    attributes, parameters))
+                {
+                STOREerr(STORE_F_STORE_DELETE_CERTIFICATE,
+                        STORE_R_FAILED_DELETING_CERTIFICATE);
+                return 0;
+                }
+        return 1;
+        }
+
+void *STORE_list_certificate_start(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        void *handle;
+
+        check_store(s,STORE_F_STORE_LIST_CERTIFICATE_START,
+                list_object_start,STORE_R_NO_LIST_OBJECT_START_FUNCTION);
+
+        handle = s->meth->list_object_start(s,
+                STORE_OBJECT_TYPE_X509_CERTIFICATE, attributes, parameters);
+        if (!handle)
+                {
+                STOREerr(STORE_F_STORE_LIST_CERTIFICATE_START,
+                        STORE_R_FAILED_LISTING_CERTIFICATES);
+                return 0;
+                }
+        return handle;
+        }
+
+X509 *STORE_list_certificate_next(STORE *s, void *handle)
+        {
+        STORE_OBJECT *object;
+        X509 *x;
+
+        check_store(s,STORE_F_STORE_LIST_CERTIFICATE_NEXT,
+                list_object_next,STORE_R_NO_LIST_OBJECT_NEXT_FUNCTION);
+
+        object = s->meth->list_object_next(s, handle);
+        if (!object || !object->data.x509.certificate)
+                {
+                STOREerr(STORE_F_STORE_LIST_CERTIFICATE_NEXT,
+                        STORE_R_FAILED_LISTING_CERTIFICATES);
+                return 0;
+                }
+        CRYPTO_add(&object->data.x509.certificate->references,1,CRYPTO_LOCK_X509);
+#ifdef REF_PRINT
+        REF_PRINT("X509",data);
+#endif
+        x = object->data.x509.certificate;
+        STORE_OBJECT_free(object);
+        return x;
+        }
+
+int STORE_list_certificate_end(STORE *s, void *handle)
+        {
+        check_store(s,STORE_F_STORE_LIST_CERTIFICATE_END,
+                list_object_end,STORE_R_NO_LIST_OBJECT_END_FUNCTION);
+
+        if (!s->meth->list_object_end(s, handle))
+                {
+                STOREerr(STORE_F_STORE_LIST_CERTIFICATE_END,
+                        STORE_R_FAILED_LISTING_CERTIFICATES);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_list_certificate_endp(STORE *s, void *handle)
+        {
+        check_store(s,STORE_F_STORE_LIST_CERTIFICATE_ENDP,
+                list_object_endp,STORE_R_NO_LIST_OBJECT_ENDP_FUNCTION);
+
+        if (!s->meth->list_object_endp(s, handle))
+                {
+                STOREerr(STORE_F_STORE_LIST_CERTIFICATE_ENDP,
+                        STORE_R_FAILED_LISTING_CERTIFICATES);
+                return 0;
+                }
+        return 1;
+        }
+
+EVP_PKEY *STORE_generate_key(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        EVP_PKEY *pkey;
+
+        check_store(s,STORE_F_STORE_GENERATE_KEY,
+                generate_object,STORE_R_NO_GENERATE_OBJECT_FUNCTION);
+
+        object = s->meth->generate_object(s, STORE_OBJECT_TYPE_PRIVATE_KEY,
+                attributes, parameters);
+        if (!object || !object->data.key)
+                {
+                STOREerr(STORE_F_STORE_GENERATE_KEY,
+                        STORE_R_FAILED_GENERATING_KEY);
+                return 0;
+                }
+        CRYPTO_add(&object->data.key->references,1,CRYPTO_LOCK_EVP_PKEY);
+#ifdef REF_PRINT
+        REF_PRINT("EVP_PKEY",data);
+#endif
+        pkey = object->data.key;
+        STORE_OBJECT_free(object);
+        return pkey;
+        }
+
+EVP_PKEY *STORE_get_private_key(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        EVP_PKEY *pkey;
+
+        check_store(s,STORE_F_STORE_GET_PRIVATE_KEY,
+                get_object,STORE_R_NO_GET_OBJECT_FUNCTION);
+
+        object = s->meth->get_object(s, STORE_OBJECT_TYPE_PRIVATE_KEY,
+                attributes, parameters);
+        if (!object || !object->data.key || !object->data.key)
+                {
+                STOREerr(STORE_F_STORE_GET_PRIVATE_KEY,
+                        STORE_R_FAILED_GETTING_KEY);
+                return 0;
+                }
+        CRYPTO_add(&object->data.key->references,1,CRYPTO_LOCK_EVP_PKEY);
+#ifdef REF_PRINT
+        REF_PRINT("EVP_PKEY",data);
+#endif
+        pkey = object->data.key;
+        STORE_OBJECT_free(object);
+        return pkey;
+        }
+
+int STORE_store_private_key(STORE *s, EVP_PKEY *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        int i;
+
+        check_store(s,STORE_F_STORE_STORE_PRIVATE_KEY,
+                store_object,STORE_R_NO_STORE_OBJECT_FUNCTION);
+
+        object = STORE_OBJECT_new();
+        if (!object)
+                {
+                STOREerr(STORE_F_STORE_STORE_PRIVATE_KEY,
+                        ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        object->data.key = EVP_PKEY_new();
+        if (!object->data.key)
+                {
+                STOREerr(STORE_F_STORE_STORE_PRIVATE_KEY,
+                        ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        
+        CRYPTO_add(&data->references,1,CRYPTO_LOCK_EVP_PKEY);
+#ifdef REF_PRINT
+        REF_PRINT("EVP_PKEY",data);
+#endif
+        object->data.key = data;
+
+        i = s->meth->store_object(s, STORE_OBJECT_TYPE_PRIVATE_KEY, object,
+                attributes, parameters);
+
+        STORE_OBJECT_free(object);
+
+        if (!i)
+                {
+                STOREerr(STORE_F_STORE_STORE_PRIVATE_KEY,
+                        STORE_R_FAILED_STORING_KEY);
+                return 0;
+                }
+        return i;
+        }
+
+int STORE_modify_private_key(STORE *s, OPENSSL_ITEM search_attributes[],
+        OPENSSL_ITEM add_attributes[], OPENSSL_ITEM modify_attributes[],
+        OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_MODIFY_PRIVATE_KEY,
+                modify_object,STORE_R_NO_MODIFY_OBJECT_FUNCTION);
+
+        if (!s->meth->modify_object(s, STORE_OBJECT_TYPE_PRIVATE_KEY,
+                    search_attributes, add_attributes, modify_attributes,
+                    delete_attributes, parameters))
+                {
+                STOREerr(STORE_F_STORE_MODIFY_PRIVATE_KEY,
+                        STORE_R_FAILED_MODIFYING_PRIVATE_KEY);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_revoke_private_key(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        int i;
+
+        check_store(s,STORE_F_STORE_REVOKE_PRIVATE_KEY,
+                revoke_object,STORE_R_NO_REVOKE_OBJECT_FUNCTION);
+
+        i = s->meth->revoke_object(s, STORE_OBJECT_TYPE_PRIVATE_KEY,
+                attributes, parameters);
+
+        if (!i)
+                {
+                STOREerr(STORE_F_STORE_REVOKE_PRIVATE_KEY,
+                        STORE_R_FAILED_REVOKING_KEY);
+                return 0;
+                }
+        return i;
+        }
+
+int STORE_delete_private_key(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_DELETE_PRIVATE_KEY,
+                delete_object,STORE_R_NO_DELETE_OBJECT_FUNCTION);
+        
+        if (!s->meth->delete_object(s, STORE_OBJECT_TYPE_PRIVATE_KEY,
+                    attributes, parameters))
+                {
+                STOREerr(STORE_F_STORE_DELETE_PRIVATE_KEY,
+                        STORE_R_FAILED_DELETING_KEY);
+                return 0;
+                }
+        return 1;
+        }
+
+void *STORE_list_private_key_start(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        void *handle;
+
+        check_store(s,STORE_F_STORE_LIST_PRIVATE_KEY_START,
+                list_object_start,STORE_R_NO_LIST_OBJECT_START_FUNCTION);
+
+        handle = s->meth->list_object_start(s, STORE_OBJECT_TYPE_PRIVATE_KEY,
+                attributes, parameters);
+        if (!handle)
+                {
+                STOREerr(STORE_F_STORE_LIST_PRIVATE_KEY_START,
+                        STORE_R_FAILED_LISTING_KEYS);
+                return 0;
+                }
+        return handle;
+        }
+
+EVP_PKEY *STORE_list_private_key_next(STORE *s, void *handle)
+        {
+        STORE_OBJECT *object;
+        EVP_PKEY *pkey;
+
+        check_store(s,STORE_F_STORE_LIST_PRIVATE_KEY_NEXT,
+                list_object_next,STORE_R_NO_LIST_OBJECT_NEXT_FUNCTION);
+
+        object = s->meth->list_object_next(s, handle);
+        if (!object || !object->data.key || !object->data.key)
+                {
+                STOREerr(STORE_F_STORE_LIST_PRIVATE_KEY_NEXT,
+                        STORE_R_FAILED_LISTING_KEYS);
+                return 0;
+                }
+        CRYPTO_add(&object->data.key->references,1,CRYPTO_LOCK_EVP_PKEY);
+#ifdef REF_PRINT
+        REF_PRINT("EVP_PKEY",data);
+#endif
+        pkey = object->data.key;
+        STORE_OBJECT_free(object);
+        return pkey;
+        }
+
+int STORE_list_private_key_end(STORE *s, void *handle)
+        {
+        check_store(s,STORE_F_STORE_LIST_PRIVATE_KEY_END,
+                list_object_end,STORE_R_NO_LIST_OBJECT_END_FUNCTION);
+
+        if (!s->meth->list_object_end(s, handle))
+                {
+                STOREerr(STORE_F_STORE_LIST_PRIVATE_KEY_END,
+                        STORE_R_FAILED_LISTING_KEYS);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_list_private_key_endp(STORE *s, void *handle)
+        {
+        check_store(s,STORE_F_STORE_LIST_PRIVATE_KEY_ENDP,
+                list_object_endp,STORE_R_NO_LIST_OBJECT_ENDP_FUNCTION);
+
+        if (!s->meth->list_object_endp(s, handle))
+                {
+                STOREerr(STORE_F_STORE_LIST_PRIVATE_KEY_ENDP,
+                        STORE_R_FAILED_LISTING_KEYS);
+                return 0;
+                }
+        return 1;
+        }
+
+EVP_PKEY *STORE_get_public_key(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        EVP_PKEY *pkey;
+
+        check_store(s,STORE_F_STORE_GET_PUBLIC_KEY,
+                get_object,STORE_R_NO_GET_OBJECT_FUNCTION);
+
+        object = s->meth->get_object(s, STORE_OBJECT_TYPE_PUBLIC_KEY,
+                attributes, parameters);
+        if (!object || !object->data.key || !object->data.key)
+                {
+                STOREerr(STORE_F_STORE_GET_PUBLIC_KEY,
+                        STORE_R_FAILED_GETTING_KEY);
+                return 0;
+                }
+        CRYPTO_add(&object->data.key->references,1,CRYPTO_LOCK_EVP_PKEY);
+#ifdef REF_PRINT
+        REF_PRINT("EVP_PKEY",data);
+#endif
+        pkey = object->data.key;
+        STORE_OBJECT_free(object);
+        return pkey;
+        }
+
+int STORE_store_public_key(STORE *s, EVP_PKEY *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        int i;
+
+        check_store(s,STORE_F_STORE_STORE_PUBLIC_KEY,
+                store_object,STORE_R_NO_STORE_OBJECT_FUNCTION);
+
+        object = STORE_OBJECT_new();
+        if (!object)
+                {
+                STOREerr(STORE_F_STORE_STORE_PUBLIC_KEY,
+                        ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        object->data.key = EVP_PKEY_new();
+        if (!object->data.key)
+                {
+                STOREerr(STORE_F_STORE_STORE_PUBLIC_KEY,
+                        ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        
+        CRYPTO_add(&data->references,1,CRYPTO_LOCK_EVP_PKEY);
+#ifdef REF_PRINT
+        REF_PRINT("EVP_PKEY",data);
+#endif
+        object->data.key = data;
+
+        i = s->meth->store_object(s, STORE_OBJECT_TYPE_PUBLIC_KEY, object,
+                attributes, parameters);
+
+        STORE_OBJECT_free(object);
+
+        if (!i)
+                {
+                STOREerr(STORE_F_STORE_STORE_PUBLIC_KEY,
+                        STORE_R_FAILED_STORING_KEY);
+                return 0;
+                }
+        return i;
+        }
+
+int STORE_modify_public_key(STORE *s, OPENSSL_ITEM search_attributes[],
+        OPENSSL_ITEM add_attributes[], OPENSSL_ITEM modify_attributes[],
+        OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_MODIFY_PUBLIC_KEY,
+                modify_object,STORE_R_NO_MODIFY_OBJECT_FUNCTION);
+
+        if (!s->meth->modify_object(s, STORE_OBJECT_TYPE_PUBLIC_KEY,
+                    search_attributes, add_attributes, modify_attributes,
+                    delete_attributes, parameters))
+                {
+                STOREerr(STORE_F_STORE_MODIFY_PUBLIC_KEY,
+                        STORE_R_FAILED_MODIFYING_PUBLIC_KEY);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_revoke_public_key(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        int i;
+
+        check_store(s,STORE_F_STORE_REVOKE_PUBLIC_KEY,
+                revoke_object,STORE_R_NO_REVOKE_OBJECT_FUNCTION);
+
+        i = s->meth->revoke_object(s, STORE_OBJECT_TYPE_PUBLIC_KEY,
+                attributes, parameters);
+
+        if (!i)
+                {
+                STOREerr(STORE_F_STORE_REVOKE_PUBLIC_KEY,
+                        STORE_R_FAILED_REVOKING_KEY);
+                return 0;
+                }
+        return i;
+        }
+
+int STORE_delete_public_key(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_DELETE_PUBLIC_KEY,
+                delete_object,STORE_R_NO_DELETE_OBJECT_FUNCTION);
+        
+        if (!s->meth->delete_object(s, STORE_OBJECT_TYPE_PUBLIC_KEY,
+                    attributes, parameters))
+                {
+                STOREerr(STORE_F_STORE_DELETE_PUBLIC_KEY,
+                        STORE_R_FAILED_DELETING_KEY);
+                return 0;
+                }
+        return 1;
+        }
+
+void *STORE_list_public_key_start(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        void *handle;
+
+        check_store(s,STORE_F_STORE_LIST_PUBLIC_KEY_START,
+                list_object_start,STORE_R_NO_LIST_OBJECT_START_FUNCTION);
+
+        handle = s->meth->list_object_start(s, STORE_OBJECT_TYPE_PUBLIC_KEY,
+                attributes, parameters);
+        if (!handle)
+                {
+                STOREerr(STORE_F_STORE_LIST_PUBLIC_KEY_START,
+                        STORE_R_FAILED_LISTING_KEYS);
+                return 0;
+                }
+        return handle;
+        }
+
+EVP_PKEY *STORE_list_public_key_next(STORE *s, void *handle)
+        {
+        STORE_OBJECT *object;
+        EVP_PKEY *pkey;
+
+        check_store(s,STORE_F_STORE_LIST_PUBLIC_KEY_NEXT,
+                list_object_next,STORE_R_NO_LIST_OBJECT_NEXT_FUNCTION);
+
+        object = s->meth->list_object_next(s, handle);
+        if (!object || !object->data.key || !object->data.key)
+                {
+                STOREerr(STORE_F_STORE_LIST_PUBLIC_KEY_NEXT,
+                        STORE_R_FAILED_LISTING_KEYS);
+                return 0;
+                }
+        CRYPTO_add(&object->data.key->references,1,CRYPTO_LOCK_EVP_PKEY);
+#ifdef REF_PRINT
+        REF_PRINT("EVP_PKEY",data);
+#endif
+        pkey = object->data.key;
+        STORE_OBJECT_free(object);
+        return pkey;
+        }
+
+int STORE_list_public_key_end(STORE *s, void *handle)
+        {
+        check_store(s,STORE_F_STORE_LIST_PUBLIC_KEY_END,
+                list_object_end,STORE_R_NO_LIST_OBJECT_END_FUNCTION);
+
+        if (!s->meth->list_object_end(s, handle))
+                {
+                STOREerr(STORE_F_STORE_LIST_PUBLIC_KEY_END,
+                        STORE_R_FAILED_LISTING_KEYS);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_list_public_key_endp(STORE *s, void *handle)
+        {
+        check_store(s,STORE_F_STORE_LIST_PUBLIC_KEY_ENDP,
+                list_object_endp,STORE_R_NO_LIST_OBJECT_ENDP_FUNCTION);
+
+        if (!s->meth->list_object_endp(s, handle))
+                {
+                STOREerr(STORE_F_STORE_LIST_PUBLIC_KEY_ENDP,
+                        STORE_R_FAILED_LISTING_KEYS);
+                return 0;
+                }
+        return 1;
+        }
+
+X509_CRL *STORE_generate_crl(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        X509_CRL *crl;
+
+        check_store(s,STORE_F_STORE_GENERATE_CRL,
+                generate_object,STORE_R_NO_GENERATE_CRL_FUNCTION);
+
+        object = s->meth->generate_object(s, STORE_OBJECT_TYPE_X509_CRL,
+                attributes, parameters);
+        if (!object || !object->data.crl)
+                {
+                STOREerr(STORE_F_STORE_GENERATE_CRL,
+                        STORE_R_FAILED_GENERATING_CRL);
+                return 0;
+                }
+        CRYPTO_add(&object->data.crl->references,1,CRYPTO_LOCK_X509_CRL);
+#ifdef REF_PRINT
+        REF_PRINT("X509_CRL",data);
+#endif
+        crl = object->data.crl;
+        STORE_OBJECT_free(object);
+        return crl;
+        }
+
+X509_CRL *STORE_get_crl(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        X509_CRL *crl;
+
+        check_store(s,STORE_F_STORE_GET_CRL,
+                get_object,STORE_R_NO_GET_OBJECT_FUNCTION);
+
+        object = s->meth->get_object(s, STORE_OBJECT_TYPE_X509_CRL,
+                attributes, parameters);
+        if (!object || !object->data.crl)
+                {
+                STOREerr(STORE_F_STORE_GET_CRL,
+                        STORE_R_FAILED_GETTING_KEY);
+                return 0;
+                }
+        CRYPTO_add(&object->data.crl->references,1,CRYPTO_LOCK_X509_CRL);
+#ifdef REF_PRINT
+        REF_PRINT("X509_CRL",data);
+#endif
+        crl = object->data.crl;
+        STORE_OBJECT_free(object);
+        return crl;
+        }
+
+int STORE_store_crl(STORE *s, X509_CRL *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        int i;
+
+        check_store(s,STORE_F_STORE_STORE_CRL,
+                store_object,STORE_R_NO_STORE_OBJECT_FUNCTION);
+
+        object = STORE_OBJECT_new();
+        if (!object)
+                {
+                STOREerr(STORE_F_STORE_STORE_CRL,
+                        ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        
+        CRYPTO_add(&data->references,1,CRYPTO_LOCK_X509_CRL);
+#ifdef REF_PRINT
+        REF_PRINT("X509_CRL",data);
+#endif
+        object->data.crl = data;
+
+        i = s->meth->store_object(s, STORE_OBJECT_TYPE_X509_CRL, object,
+                attributes, parameters);
+
+        STORE_OBJECT_free(object);
+
+        if (!i)
+                {
+                STOREerr(STORE_F_STORE_STORE_CRL,
+                        STORE_R_FAILED_STORING_KEY);
+                return 0;
+                }
+        return i;
+        }
+
+int STORE_modify_crl(STORE *s, OPENSSL_ITEM search_attributes[],
+        OPENSSL_ITEM add_attributes[], OPENSSL_ITEM modify_attributes[],
+        OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_MODIFY_CRL,
+                modify_object,STORE_R_NO_MODIFY_OBJECT_FUNCTION);
+
+        if (!s->meth->modify_object(s, STORE_OBJECT_TYPE_X509_CRL,
+                    search_attributes, add_attributes, modify_attributes,
+                    delete_attributes, parameters))
+                {
+                STOREerr(STORE_F_STORE_MODIFY_CRL,
+                        STORE_R_FAILED_MODIFYING_CRL);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_delete_crl(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_DELETE_CRL,
+                delete_object,STORE_R_NO_DELETE_OBJECT_FUNCTION);
+        
+        if (!s->meth->delete_object(s, STORE_OBJECT_TYPE_X509_CRL,
+                    attributes, parameters))
+                {
+                STOREerr(STORE_F_STORE_DELETE_CRL,
+                        STORE_R_FAILED_DELETING_KEY);
+                return 0;
+                }
+        return 1;
+        }
+
+void *STORE_list_crl_start(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        void *handle;
+
+        check_store(s,STORE_F_STORE_LIST_CRL_START,
+                list_object_start,STORE_R_NO_LIST_OBJECT_START_FUNCTION);
+
+        handle = s->meth->list_object_start(s, STORE_OBJECT_TYPE_X509_CRL,
+                attributes, parameters);
+        if (!handle)
+                {
+                STOREerr(STORE_F_STORE_LIST_CRL_START,
+                        STORE_R_FAILED_LISTING_KEYS);
+                return 0;
+                }
+        return handle;
+        }
+
+X509_CRL *STORE_list_crl_next(STORE *s, void *handle)
+        {
+        STORE_OBJECT *object;
+        X509_CRL *crl;
+
+        check_store(s,STORE_F_STORE_LIST_CRL_NEXT,
+                list_object_next,STORE_R_NO_LIST_OBJECT_NEXT_FUNCTION);
+
+        object = s->meth->list_object_next(s, handle);
+        if (!object || !object->data.crl)
+                {
+                STOREerr(STORE_F_STORE_LIST_CRL_NEXT,
+                        STORE_R_FAILED_LISTING_KEYS);
+                return 0;
+                }
+        CRYPTO_add(&object->data.crl->references,1,CRYPTO_LOCK_X509_CRL);
+#ifdef REF_PRINT
+        REF_PRINT("X509_CRL",data);
+#endif
+        crl = object->data.crl;
+        STORE_OBJECT_free(object);
+        return crl;
+        }
+
+int STORE_list_crl_end(STORE *s, void *handle)
+        {
+        check_store(s,STORE_F_STORE_LIST_CRL_END,
+                list_object_end,STORE_R_NO_LIST_OBJECT_END_FUNCTION);
+
+        if (!s->meth->list_object_end(s, handle))
+                {
+                STOREerr(STORE_F_STORE_LIST_CRL_END,
+                        STORE_R_FAILED_LISTING_KEYS);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_list_crl_endp(STORE *s, void *handle)
+        {
+        check_store(s,STORE_F_STORE_LIST_CRL_ENDP,
+                list_object_endp,STORE_R_NO_LIST_OBJECT_ENDP_FUNCTION);
+
+        if (!s->meth->list_object_endp(s, handle))
+                {
+                STOREerr(STORE_F_STORE_LIST_CRL_ENDP,
+                        STORE_R_FAILED_LISTING_KEYS);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_store_number(STORE *s, BIGNUM *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        int i;
+
+        check_store(s,STORE_F_STORE_STORE_NUMBER,
+                store_object,STORE_R_NO_STORE_OBJECT_NUMBER_FUNCTION);
+
+        object = STORE_OBJECT_new();
+        if (!object)
+                {
+                STOREerr(STORE_F_STORE_STORE_NUMBER,
+                        ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        
+        object->data.number = data;
+
+        i = s->meth->store_object(s, STORE_OBJECT_TYPE_NUMBER, object,
+                attributes, parameters);
+
+        STORE_OBJECT_free(object);
+
+        if (!i)
+                {
+                STOREerr(STORE_F_STORE_STORE_NUMBER,
+                        STORE_R_FAILED_STORING_NUMBER);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_modify_number(STORE *s, OPENSSL_ITEM search_attributes[],
+        OPENSSL_ITEM add_attributes[], OPENSSL_ITEM modify_attributes[],
+        OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_MODIFY_NUMBER,
+                modify_object,STORE_R_NO_MODIFY_OBJECT_FUNCTION);
+
+        if (!s->meth->modify_object(s, STORE_OBJECT_TYPE_NUMBER,
+                    search_attributes, add_attributes, modify_attributes,
+                    delete_attributes, parameters))
+                {
+                STOREerr(STORE_F_STORE_MODIFY_NUMBER,
+                        STORE_R_FAILED_MODIFYING_NUMBER);
+                return 0;
+                }
+        return 1;
+        }
+
+BIGNUM *STORE_get_number(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        BIGNUM *n;
+
+        check_store(s,STORE_F_STORE_GET_NUMBER,
+                get_object,STORE_R_NO_GET_OBJECT_NUMBER_FUNCTION);
+
+        object = s->meth->get_object(s, STORE_OBJECT_TYPE_NUMBER, attributes,
+                parameters);
+        if (!object || !object->data.number)
+                {
+                STOREerr(STORE_F_STORE_GET_NUMBER,
+                        STORE_R_FAILED_GETTING_NUMBER);
+                return 0;
+                }
+        n = object->data.number;
+        object->data.number = NULL;
+        STORE_OBJECT_free(object);
+        return n;
+        }
+
+int STORE_delete_number(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_DELETE_NUMBER,
+                delete_object,STORE_R_NO_DELETE_NUMBER_FUNCTION);
+
+        if (!s->meth->delete_object(s, STORE_OBJECT_TYPE_NUMBER, attributes,
+                    parameters))
+                {
+                STOREerr(STORE_F_STORE_DELETE_NUMBER,
+                        STORE_R_FAILED_DELETING_NUMBER);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_store_arbitrary(STORE *s, BUF_MEM *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        int i;
+
+        check_store(s,STORE_F_STORE_STORE_ARBITRARY,
+                store_object,STORE_R_NO_STORE_OBJECT_ARBITRARY_FUNCTION);
+
+        object = STORE_OBJECT_new();
+        if (!object)
+                {
+                STOREerr(STORE_F_STORE_STORE_ARBITRARY,
+                        ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        
+        object->data.arbitrary = data;
+
+        i = s->meth->store_object(s, STORE_OBJECT_TYPE_ARBITRARY, object,
+                attributes, parameters);
+
+        STORE_OBJECT_free(object);
+
+        if (!i)
+                {
+                STOREerr(STORE_F_STORE_STORE_ARBITRARY,
+                        STORE_R_FAILED_STORING_ARBITRARY);
+                return 0;
+                }
+        return 1;
+        }
+
+int STORE_modify_arbitrary(STORE *s, OPENSSL_ITEM search_attributes[],
+        OPENSSL_ITEM add_attributes[], OPENSSL_ITEM modify_attributes[],
+        OPENSSL_ITEM delete_attributes[], OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_MODIFY_ARBITRARY,
+                modify_object,STORE_R_NO_MODIFY_OBJECT_FUNCTION);
+
+        if (!s->meth->modify_object(s, STORE_OBJECT_TYPE_ARBITRARY,
+                    search_attributes, add_attributes, modify_attributes,
+                    delete_attributes, parameters))
+                {
+                STOREerr(STORE_F_STORE_MODIFY_ARBITRARY,
+                        STORE_R_FAILED_MODIFYING_ARBITRARY);
+                return 0;
+                }
+        return 1;
+        }
+
+BUF_MEM *STORE_get_arbitrary(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STORE_OBJECT *object;
+        BUF_MEM *b;
+
+        check_store(s,STORE_F_STORE_GET_ARBITRARY,
+                get_object,STORE_R_NO_GET_OBJECT_ARBITRARY_FUNCTION);
+
+        object = s->meth->get_object(s, STORE_OBJECT_TYPE_ARBITRARY,
+                attributes, parameters);
+        if (!object || !object->data.arbitrary)
+                {
+                STOREerr(STORE_F_STORE_GET_ARBITRARY,
+                        STORE_R_FAILED_GETTING_ARBITRARY);
+                return 0;
+                }
+        b = object->data.arbitrary;
+        object->data.arbitrary = NULL;
+        STORE_OBJECT_free(object);
+        return b;
+        }
+
+int STORE_delete_arbitrary(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        check_store(s,STORE_F_STORE_DELETE_ARBITRARY,
+                delete_object,STORE_R_NO_DELETE_ARBITRARY_FUNCTION);
+
+        if (!s->meth->delete_object(s, STORE_OBJECT_TYPE_ARBITRARY, attributes,
+                    parameters))
+                {
+                STOREerr(STORE_F_STORE_DELETE_ARBITRARY,
+                        STORE_R_FAILED_DELETING_ARBITRARY);
+                return 0;
+                }
+        return 1;
+        }
+
+STORE_OBJECT *STORE_OBJECT_new(void)
+        {
+        STORE_OBJECT *object = OPENSSL_malloc(sizeof(STORE_OBJECT));
+        if (object) memset(object, 0, sizeof(STORE_OBJECT));
+        return object;
+        }
+void STORE_OBJECT_free(STORE_OBJECT *data)
+        {
+        if (!data) return;
+        switch (data->type)
+                {
+        case STORE_OBJECT_TYPE_X509_CERTIFICATE:
+                X509_free(data->data.x509.certificate);
+                break;
+        case STORE_OBJECT_TYPE_X509_CRL:
+                X509_CRL_free(data->data.crl);
+                break;
+        case STORE_OBJECT_TYPE_PRIVATE_KEY:
+        case STORE_OBJECT_TYPE_PUBLIC_KEY:
+                EVP_PKEY_free(data->data.key);
+                break;
+        case STORE_OBJECT_TYPE_NUMBER:
+                BN_free(data->data.number);
+                break;
+        case STORE_OBJECT_TYPE_ARBITRARY:
+                BUF_MEM_free(data->data.arbitrary);
+                break;
+                }
+        OPENSSL_free(data);
+        }
+
+IMPLEMENT_STACK_OF(STORE_OBJECT*)
+
+
+struct STORE_attr_info_st
+        {
+        unsigned char set[(STORE_ATTR_TYPE_NUM + 8) / 8];
+        union
+                {
+                char *cstring;
+                unsigned char *sha1string;
+                X509_NAME *dn;
+                BIGNUM *number;
+                void *any;
+                } values[STORE_ATTR_TYPE_NUM+1];
+        size_t value_sizes[STORE_ATTR_TYPE_NUM+1];
+        };
+
+#define ATTR_IS_SET(a,i)        ((i) > 0 && (i) < STORE_ATTR_TYPE_NUM \
+                                && ((a)->set[(i) / 8] & (1 << ((i) % 8))))
+#define SET_ATTRBIT(a,i)        ((a)->set[(i) / 8] |= (1 << ((i) % 8)))
+#define CLEAR_ATTRBIT(a,i)      ((a)->set[(i) / 8] &= ~(1 << ((i) % 8)))
+
+STORE_ATTR_INFO *STORE_ATTR_INFO_new(void)
+        {
+        return (STORE_ATTR_INFO *)OPENSSL_malloc(sizeof(STORE_ATTR_INFO));
+        }
+static void STORE_ATTR_INFO_attr_free(STORE_ATTR_INFO *attrs,
+        STORE_ATTR_TYPES code)
+        {
+        if (ATTR_IS_SET(attrs,code))
+                {
+                switch(code)
+                        {
+                case STORE_ATTR_FRIENDLYNAME:
+                case STORE_ATTR_EMAIL:
+                case STORE_ATTR_FILENAME:
+                        STORE_ATTR_INFO_modify_cstr(attrs, code, NULL, 0);
+                        break;
+                case STORE_ATTR_KEYID:
+                case STORE_ATTR_ISSUERKEYID:
+                case STORE_ATTR_SUBJECTKEYID:
+                case STORE_ATTR_ISSUERSERIALHASH:
+                case STORE_ATTR_CERTHASH:
+                        STORE_ATTR_INFO_modify_sha1str(attrs, code, NULL, 0);
+                        break;
+                case STORE_ATTR_ISSUER:
+                case STORE_ATTR_SUBJECT:
+                        STORE_ATTR_INFO_modify_dn(attrs, code, NULL);
+                        break;
+                case STORE_ATTR_SERIAL:
+                        STORE_ATTR_INFO_modify_number(attrs, code, NULL);
+                        break;
+                default:
+                        break;
+                        }
+                }
+        }
+int STORE_ATTR_INFO_free(STORE_ATTR_INFO *attrs)
+        {
+        if (attrs)
+                {
+                STORE_ATTR_TYPES i;
+                for(i = 0; i++ < STORE_ATTR_TYPE_NUM;)
+                        STORE_ATTR_INFO_attr_free(attrs, i);
+                OPENSSL_free(attrs);
+                }
+        return 1;
+        }
+char *STORE_ATTR_INFO_get0_cstr(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code)
+        {
+        if (!attrs)
+                {
+                STOREerr(STORE_F_STORE_ATTR_INFO_GET0_CSTR,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return NULL;
+                }
+        if (ATTR_IS_SET(attrs,code))
+                return attrs->values[code].cstring;
+        STOREerr(STORE_F_STORE_ATTR_INFO_GET0_CSTR,
+                STORE_R_NO_VALUE);
+        return NULL;
+        }
+unsigned char *STORE_ATTR_INFO_get0_sha1str(STORE_ATTR_INFO *attrs,
+        STORE_ATTR_TYPES code)
+        {
+        if (!attrs)
+                {
+                STOREerr(STORE_F_STORE_ATTR_INFO_GET0_SHA1STR,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return NULL;
+                }
+        if (ATTR_IS_SET(attrs,code))
+                return attrs->values[code].sha1string;
+        STOREerr(STORE_F_STORE_ATTR_INFO_GET0_SHA1STR,
+                STORE_R_NO_VALUE);
+        return NULL;
+        }
+X509_NAME *STORE_ATTR_INFO_get0_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code)
+        {
+        if (!attrs)
+                {
+                STOREerr(STORE_F_STORE_ATTR_INFO_GET0_DN,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return NULL;
+                }
+        if (ATTR_IS_SET(attrs,code))
+                return attrs->values[code].dn;
+        STOREerr(STORE_F_STORE_ATTR_INFO_GET0_DN,
+                STORE_R_NO_VALUE);
+        return NULL;
+        }
+BIGNUM *STORE_ATTR_INFO_get0_number(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code)
+        {
+        if (!attrs)
+                {
+                STOREerr(STORE_F_STORE_ATTR_INFO_GET0_NUMBER,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return NULL;
+                }
+        if (ATTR_IS_SET(attrs,code))
+                return attrs->values[code].number;
+        STOREerr(STORE_F_STORE_ATTR_INFO_GET0_NUMBER,
+                STORE_R_NO_VALUE);
+        return NULL;
+        }
+int STORE_ATTR_INFO_set_cstr(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        char *cstr, size_t cstr_size)
+        {
+        if (!attrs)
+                {
+                STOREerr(STORE_F_STORE_ATTR_INFO_SET_CSTR,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if (!ATTR_IS_SET(attrs,code))
+                {
+                if ((attrs->values[code].cstring = BUF_strndup(cstr, cstr_size)))
+                        return 1;
+                STOREerr(STORE_F_STORE_ATTR_INFO_SET_CSTR,
+                        ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        STOREerr(STORE_F_STORE_ATTR_INFO_SET_CSTR, STORE_R_ALREADY_HAS_A_VALUE);
+        return 0;
+        }
+int STORE_ATTR_INFO_set_sha1str(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        unsigned char *sha1str, size_t sha1str_size)
+        {
+        if (!attrs)
+                {
+                STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if (!ATTR_IS_SET(attrs,code))
+                {
+                if ((attrs->values[code].sha1string =
+                            (unsigned char *)BUF_memdup(sha1str,
+                                    sha1str_size)))
+                        return 1;
+                STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR,
+                        ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        STOREerr(STORE_F_STORE_ATTR_INFO_SET_SHA1STR, STORE_R_ALREADY_HAS_A_VALUE);
+        return 0;
+        }
+int STORE_ATTR_INFO_set_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        X509_NAME *dn)
+        {
+        if (!attrs)
+                {
+                STOREerr(STORE_F_STORE_ATTR_INFO_SET_DN,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if (!ATTR_IS_SET(attrs,code))
+                {
+                if ((attrs->values[code].dn = X509_NAME_dup(dn)))
+                        return 1;
+                STOREerr(STORE_F_STORE_ATTR_INFO_SET_DN,
+                        ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        STOREerr(STORE_F_STORE_ATTR_INFO_SET_DN, STORE_R_ALREADY_HAS_A_VALUE);
+        return 0;
+        }
+int STORE_ATTR_INFO_set_number(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        BIGNUM *number)
+        {
+        if (!attrs)
+                {
+                STOREerr(STORE_F_STORE_ATTR_INFO_SET_NUMBER,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if (!ATTR_IS_SET(attrs,code))
+                {
+                if ((attrs->values[code].number = BN_dup(number)))
+                        return 1;
+                STOREerr(STORE_F_STORE_ATTR_INFO_SET_NUMBER,
+                        ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        STOREerr(STORE_F_STORE_ATTR_INFO_SET_NUMBER, STORE_R_ALREADY_HAS_A_VALUE);
+        return 0;
+        }
+int STORE_ATTR_INFO_modify_cstr(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        char *cstr, size_t cstr_size)
+        {
+        if (!attrs)
+                {
+                STOREerr(STORE_F_STORE_ATTR_INFO_MODIFY_CSTR,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if (ATTR_IS_SET(attrs,code))
+                {
+                OPENSSL_free(attrs->values[code].cstring);
+                attrs->values[code].cstring = NULL;
+                CLEAR_ATTRBIT(attrs, code);
+                }
+        return STORE_ATTR_INFO_set_cstr(attrs, code, cstr, cstr_size);
+        }
+int STORE_ATTR_INFO_modify_sha1str(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        unsigned char *sha1str, size_t sha1str_size)
+        {
+        if (!attrs)
+                {
+                STOREerr(STORE_F_STORE_ATTR_INFO_MODIFY_SHA1STR,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if (ATTR_IS_SET(attrs,code))
+                {
+                OPENSSL_free(attrs->values[code].sha1string);
+                attrs->values[code].sha1string = NULL;
+                CLEAR_ATTRBIT(attrs, code);
+                }
+        return STORE_ATTR_INFO_set_sha1str(attrs, code, sha1str, sha1str_size);
+        }
+int STORE_ATTR_INFO_modify_dn(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        X509_NAME *dn)
+        {
+        if (!attrs)
+                {
+                STOREerr(STORE_F_STORE_ATTR_INFO_MODIFY_DN,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if (ATTR_IS_SET(attrs,code))
+                {
+                OPENSSL_free(attrs->values[code].dn);
+                attrs->values[code].dn = NULL;
+                CLEAR_ATTRBIT(attrs, code);
+                }
+        return STORE_ATTR_INFO_set_dn(attrs, code, dn);
+        }
+int STORE_ATTR_INFO_modify_number(STORE_ATTR_INFO *attrs, STORE_ATTR_TYPES code,
+        BIGNUM *number)
+        {
+        if (!attrs)
+                {
+                STOREerr(STORE_F_STORE_ATTR_INFO_MODIFY_NUMBER,
+                        ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if (ATTR_IS_SET(attrs,code))
+                {
+                OPENSSL_free(attrs->values[code].number);
+                attrs->values[code].number = NULL;
+                CLEAR_ATTRBIT(attrs, code);
+                }
+        return STORE_ATTR_INFO_set_number(attrs, code, number);
+        }
+
+struct attr_list_ctx_st
+        {
+        OPENSSL_ITEM *attributes;
+        };
+void *STORE_parse_attrs_start(OPENSSL_ITEM *attributes)
+        {
+        if (attributes)
+                {
+                struct attr_list_ctx_st *context =
+                        (struct attr_list_ctx_st *)OPENSSL_malloc(sizeof(struct attr_list_ctx_st));
+                if (context)
+                        context->attributes = attributes;
+                else
+                        STOREerr(STORE_F_STORE_PARSE_ATTRS_START,
+                                ERR_R_MALLOC_FAILURE);
+                return context;
+                }
+        STOREerr(STORE_F_STORE_PARSE_ATTRS_START, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+        }
+STORE_ATTR_INFO *STORE_parse_attrs_next(void *handle)
+        {
+        struct attr_list_ctx_st *context = (struct attr_list_ctx_st *)handle;
+
+        if (context && context->attributes)
+                {
+                STORE_ATTR_INFO *attrs = NULL;
+
+                while(context->attributes
+                        && context->attributes->code != STORE_ATTR_OR
+                        && context->attributes->code != STORE_ATTR_END)
+                        {
+                        switch(context->attributes->code)
+                                {
+                        case STORE_ATTR_FRIENDLYNAME:
+                        case STORE_ATTR_EMAIL:
+                        case STORE_ATTR_FILENAME:
+                                if (!attrs) attrs = STORE_ATTR_INFO_new();
+                                if (attrs == NULL)
+                                        {
+                                        STOREerr(STORE_F_STORE_PARSE_ATTRS_NEXT,
+                                                ERR_R_MALLOC_FAILURE);
+                                        goto err;
+                                        }
+                                STORE_ATTR_INFO_set_cstr(attrs,
+                                        context->attributes->code,
+                                        context->attributes->value,
+                                        context->attributes->value_size);
+                                break;
+                        case STORE_ATTR_KEYID:
+                        case STORE_ATTR_ISSUERKEYID:
+                        case STORE_ATTR_SUBJECTKEYID:
+                        case STORE_ATTR_ISSUERSERIALHASH:
+                        case STORE_ATTR_CERTHASH:
+                                if (!attrs) attrs = STORE_ATTR_INFO_new();
+                                if (attrs == NULL)
+                                        {
+                                        STOREerr(STORE_F_STORE_PARSE_ATTRS_NEXT,
+                                                ERR_R_MALLOC_FAILURE);
+                                        goto err;
+                                        }
+                                STORE_ATTR_INFO_set_sha1str(attrs,
+                                        context->attributes->code,
+                                        context->attributes->value,
+                                        context->attributes->value_size);
+                                break;
+                        case STORE_ATTR_ISSUER:
+                        case STORE_ATTR_SUBJECT:
+                                if (!attrs) attrs = STORE_ATTR_INFO_new();
+                                if (attrs == NULL)
+                                        {
+                                        STOREerr(STORE_F_STORE_PARSE_ATTRS_NEXT,
+                                                ERR_R_MALLOC_FAILURE);
+                                        goto err;
+                                        }
+                                STORE_ATTR_INFO_modify_dn(attrs,
+                                        context->attributes->code,
+                                        context->attributes->value);
+                                break;
+                        case STORE_ATTR_SERIAL:
+                                if (!attrs) attrs = STORE_ATTR_INFO_new();
+                                if (attrs == NULL)
+                                        {
+                                        STOREerr(STORE_F_STORE_PARSE_ATTRS_NEXT,
+                                                ERR_R_MALLOC_FAILURE);
+                                        goto err;
+                                        }
+                                STORE_ATTR_INFO_modify_number(attrs,
+                                        context->attributes->code,
+                                        context->attributes->value);
+                                break;
+                                }
+                        context->attributes++;
+                        }
+                if (context->attributes->code == STORE_ATTR_OR)
+                        context->attributes++;
+                return attrs;
+        err:
+                while(context->attributes
+                        && context->attributes->code != STORE_ATTR_OR
+                        && context->attributes->code != STORE_ATTR_END)
+                        context->attributes++;
+                if (context->attributes->code == STORE_ATTR_OR)
+                        context->attributes++;
+                return NULL;
+                }
+        STOREerr(STORE_F_STORE_PARSE_ATTRS_NEXT, ERR_R_PASSED_NULL_PARAMETER);
+        return NULL;
+        }
+int STORE_parse_attrs_end(void *handle)
+        {
+        struct attr_list_ctx_st *context = (struct attr_list_ctx_st *)handle;
+
+        if (context && context->attributes)
+                {
+#if 0
+                OPENSSL_ITEM *attributes = context->attributes;
+#endif
+                OPENSSL_free(context);
+                return 1;
+                }
+        STOREerr(STORE_F_STORE_PARSE_ATTRS_END, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+        }
+
+int STORE_parse_attrs_endp(void *handle)
+        {
+        struct attr_list_ctx_st *context = (struct attr_list_ctx_st *)handle;
+
+        if (context && context->attributes)
+                {
+                return context->attributes->code == STORE_ATTR_END;
+                }
+        STOREerr(STORE_F_STORE_PARSE_ATTRS_ENDP, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+        }
+
+static int attr_info_compare_compute_range(
+        unsigned char *abits, unsigned char *bbits,
+        unsigned int *alowp, unsigned int *ahighp,
+        unsigned int *blowp, unsigned int *bhighp)
+        {
+        unsigned int alow = (unsigned int)-1, ahigh = 0;
+        unsigned int blow = (unsigned int)-1, bhigh = 0;
+        int i, res = 0;
+
+        for (i = 0; i < (STORE_ATTR_TYPE_NUM + 8) / 8; i++, abits++, bbits++)
+                {
+                if (res == 0)
+                        {
+                        if (*abits < *bbits) res = -1;
+                        if (*abits > *bbits) res = 1;
+                        }
+                if (*abits)
+                        {
+                        if (alow == (unsigned int)-1)
+                                {
+                                alow = i * 8;
+                                if (!(*abits & 0x01)) alow++;
+                                if (!(*abits & 0x02)) alow++;
+                                if (!(*abits & 0x04)) alow++;
+                                if (!(*abits & 0x08)) alow++;
+                                if (!(*abits & 0x10)) alow++;
+                                if (!(*abits & 0x20)) alow++;
+                                if (!(*abits & 0x40)) alow++;
+                                }
+                        ahigh = i * 8 + 7;
+                        if (!(*abits & 0x80)) ahigh++;
+                        if (!(*abits & 0x40)) ahigh++;
+                        if (!(*abits & 0x20)) ahigh++;
+                        if (!(*abits & 0x10)) ahigh++;
+                        if (!(*abits & 0x08)) ahigh++;
+                        if (!(*abits & 0x04)) ahigh++;
+                        if (!(*abits & 0x02)) ahigh++;
+                        }
+                if (*bbits)
+                        {
+                        if (blow == (unsigned int)-1)
+                                {
+                                blow = i * 8;
+                                if (!(*bbits & 0x01)) blow++;
+                                if (!(*bbits & 0x02)) blow++;
+                                if (!(*bbits & 0x04)) blow++;
+                                if (!(*bbits & 0x08)) blow++;
+                                if (!(*bbits & 0x10)) blow++;
+                                if (!(*bbits & 0x20)) blow++;
+                                if (!(*bbits & 0x40)) blow++;
+                                }
+                        bhigh = i * 8 + 7;
+                        if (!(*bbits & 0x80)) bhigh++;
+                        if (!(*bbits & 0x40)) bhigh++;
+                        if (!(*bbits & 0x20)) bhigh++;
+                        if (!(*bbits & 0x10)) bhigh++;
+                        if (!(*bbits & 0x08)) bhigh++;
+                        if (!(*bbits & 0x04)) bhigh++;
+                        if (!(*bbits & 0x02)) bhigh++;
+                        }
+                }
+        if (ahigh + alow < bhigh + blow) res = -1;
+        if (ahigh + alow > bhigh + blow) res = 1;
+        if (alowp) *alowp = alow;
+        if (ahighp) *ahighp = ahigh;
+        if (blowp) *blowp = blow;
+        if (bhighp) *bhighp = bhigh;
+        return res;
+        }
+
+int STORE_ATTR_INFO_compare(STORE_ATTR_INFO *a, STORE_ATTR_INFO *b)
+        {
+        if (a == b) return 0;
+        if (!a) return -1;
+        if (!b) return 1;
+        return attr_info_compare_compute_range(a->set, b->set, 0, 0, 0, 0);
+        }
+int STORE_ATTR_INFO_in_range(STORE_ATTR_INFO *a, STORE_ATTR_INFO *b)
+        {
+        unsigned int alow, ahigh, blow, bhigh;
+
+        if (a == b) return 1;
+        if (!a) return 0;
+        if (!b) return 0;
+        attr_info_compare_compute_range(a->set, b->set,
+                &alow, &ahigh, &blow, &bhigh);
+        if (alow >= blow && ahigh <= bhigh)
+                return 1;
+        return 0;
+        }
+int STORE_ATTR_INFO_in(STORE_ATTR_INFO *a, STORE_ATTR_INFO *b)
+        {
+        unsigned char *abits, *bbits;
+        int i;
+
+        if (a == b) return 1;
+        if (!a) return 0;
+        if (!b) return 0;
+        abits = a->set;
+        bbits = b->set;
+        for (i = 0; i < (STORE_ATTR_TYPE_NUM + 8) / 8; i++, abits++, bbits++)
+                {
+                if (*abits && (*bbits & *abits) != *abits)
+                        return 0;
+                }
+        return 1;
+        }
+int STORE_ATTR_INFO_in_ex(STORE_ATTR_INFO *a, STORE_ATTR_INFO *b)
+        {
+        STORE_ATTR_TYPES i;
+
+        if (a == b) return 1;
+        if (!STORE_ATTR_INFO_in(a, b)) return 0;
+        for (i = 1; i < STORE_ATTR_TYPE_NUM; i++)
+                if (ATTR_IS_SET(a, i))
+                        {
+                        switch(i)
+                                {
+                        case STORE_ATTR_FRIENDLYNAME:
+                        case STORE_ATTR_EMAIL:
+                        case STORE_ATTR_FILENAME:
+                                if (strcmp(a->values[i].cstring,
+                                            b->values[i].cstring))
+                                        return 0;
+                                break;
+                        case STORE_ATTR_KEYID:
+                        case STORE_ATTR_ISSUERKEYID:
+                        case STORE_ATTR_SUBJECTKEYID:
+                        case STORE_ATTR_ISSUERSERIALHASH:
+                        case STORE_ATTR_CERTHASH:
+                                if (memcmp(a->values[i].sha1string,
+                                            b->values[i].sha1string,
+                                            a->value_sizes[i]))
+                                        return 0;
+                                break;
+                        case STORE_ATTR_ISSUER:
+                        case STORE_ATTR_SUBJECT:
+                                if (X509_NAME_cmp(a->values[i].dn,
+                                            b->values[i].dn))
+                                        return 0;
+                                break;
+                        case STORE_ATTR_SERIAL:
+                                if (BN_cmp(a->values[i].number,
+                                            b->values[i].number))
+                                        return 0;
+                                break;
+                        default:
+                                break;
+                                }
+                        }
+
+        return 1;
+        }
diff --git a/src/lib/libssl/src/crypto/store/str_locl.h b/src/lib/libssl/src/crypto/store/str_locl.h
new file mode 100644
index 0000000000..3f8cb75619
--- /dev/null
+++ b/src/lib/libssl/src/crypto/store/str_locl.h
@@ -0,0 +1,124 @@
+/* crypto/store/str_locl.h -*- mode:C; c-file-style: "eay" -*- */
+/* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
+ * project 2003.
+ */
+/* ====================================================================
+ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_STORE_LOCL_H
+#define HEADER_STORE_LOCL_H
+
+#include <openssl/crypto.h>
+#include <openssl/store.h>
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+struct store_method_st
+        {
+        char *name;
+
+        /* All the functions return a positive integer or non-NULL for success
+           and 0, a negative integer or NULL for failure */
+
+        /* Initialise the STORE with private data */
+        STORE_INITIALISE_FUNC_PTR init;
+        /* Initialise the STORE with private data */
+        STORE_CLEANUP_FUNC_PTR clean;
+        /* Generate an object of a given type */
+        STORE_GENERATE_OBJECT_FUNC_PTR generate_object;
+        /* Get an object of a given type.  This function isn't really very
+           useful since the listing functions (below) can be used for the
+           same purpose and are much more general. */
+        STORE_GET_OBJECT_FUNC_PTR get_object;
+        /* Store an object of a given type. */
+        STORE_STORE_OBJECT_FUNC_PTR store_object;
+        /* Modify the attributes bound to an object of a given type. */
+        STORE_MODIFY_OBJECT_FUNC_PTR modify_object;
+        /* Revoke an object of a given type. */
+        STORE_HANDLE_OBJECT_FUNC_PTR revoke_object;
+        /* Delete an object of a given type. */
+        STORE_HANDLE_OBJECT_FUNC_PTR delete_object;
+        /* List a bunch of objects of a given type and with the associated
+           attributes. */
+        STORE_START_OBJECT_FUNC_PTR list_object_start;
+        STORE_NEXT_OBJECT_FUNC_PTR list_object_next;
+        STORE_END_OBJECT_FUNC_PTR list_object_end;
+        STORE_END_OBJECT_FUNC_PTR list_object_endp;
+        /* Store-level function to make any necessary update operations. */
+        STORE_GENERIC_FUNC_PTR update_store;
+        /* Store-level function to get exclusive access to the store. */
+        STORE_GENERIC_FUNC_PTR lock_store;
+        /* Store-level function to release exclusive access to the store. */
+        STORE_GENERIC_FUNC_PTR unlock_store;
+
+        /* Generic control function */
+        STORE_CTRL_FUNC_PTR ctrl;
+        };
+
+struct store_st
+        {
+        const STORE_METHOD *meth;
+        /* functional reference if 'meth' is ENGINE-provided */
+        ENGINE *engine;
+
+        CRYPTO_EX_DATA ex_data;
+        int references;
+        };
+#ifdef  __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/lib/libssl/src/crypto/store/str_mem.c b/src/lib/libssl/src/crypto/store/str_mem.c
new file mode 100644
index 0000000000..527757ae09
--- /dev/null
+++ b/src/lib/libssl/src/crypto/store/str_mem.c
@@ -0,0 +1,357 @@
+/* crypto/store/str_mem.c -*- mode:C; c-file-style: "eay" -*- */
+/* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
+ * project 2003.
+ */
+/* ====================================================================
+ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <string.h>
+#include <openssl/err.h>
+#include "str_locl.h"
+
+/* The memory store is currently highly experimental.  It's meant to become
+   a base store used by other stores for internal caching (for full caching
+   support, aging needs to be added).
+
+   The database use is meant to support as much attribute association as
+   possible, while providing for as small search ranges as possible.
+   This is currently provided for by sorting the entries by numbers that
+   are composed of bits set at the positions indicated by attribute type
+   codes.  This provides for ranges determined by the highest attribute
+   type code value.  A better idea might be to sort by values computed
+   from the range of attributes associated with the object (basically,
+   the difference between the highest and lowest attribute type code)
+   and it's distance from a base (basically, the lowest associated
+   attribute type code).
+*/
+
+struct mem_object_data_st
+        {
+        STORE_OBJECT *object;
+        STORE_ATTR_INFO *attr_info;
+        int references;
+        };
+
+struct mem_data_st
+        {
+        STACK *data;            /* A stack of mem_object_data_st,
+                                   sorted with STORE_ATTR_INFO_compare(). */
+        unsigned int compute_components : 1; /* Currently unused, but can
+                                                be used to add attributes
+                                                from parts of the data. */
+        };
+
+struct mem_ctx_st
+        {
+        int type;               /* The type we're searching for */
+        STACK *search_attributes; /* Sets of attributes to search for.
+                                     Each element is a STORE_ATTR_INFO. */
+        int search_index;       /* which of the search attributes we found a match
+                                   for, -1 when we still haven't found any */
+        int index;              /* -1 as long as we're searching for the first */
+        };
+
+static int mem_init(STORE *s);
+static void mem_clean(STORE *s);
+static STORE_OBJECT *mem_generate(STORE *s, STORE_OBJECT_TYPES type,
+        OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[]);
+static STORE_OBJECT *mem_get(STORE *s, STORE_OBJECT_TYPES type,
+        OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[]);
+static int mem_store(STORE *s, STORE_OBJECT_TYPES type,
+        STORE_OBJECT *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+static int mem_modify(STORE *s, STORE_OBJECT_TYPES type,
+        OPENSSL_ITEM search_attributes[], OPENSSL_ITEM add_attributes[],
+        OPENSSL_ITEM modify_attributes[], OPENSSL_ITEM delete_attributes[],
+        OPENSSL_ITEM parameters[]);
+static int mem_delete(STORE *s, STORE_OBJECT_TYPES type,
+        OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[]);
+static void *mem_list_start(STORE *s, STORE_OBJECT_TYPES type,
+        OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[]);
+static STORE_OBJECT *mem_list_next(STORE *s, void *handle);
+static int mem_list_end(STORE *s, void *handle);
+static int mem_list_endp(STORE *s, void *handle);
+static int mem_lock(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+static int mem_unlock(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[]);
+static int mem_ctrl(STORE *s, int cmd, long l, void *p, void (*f)(void));
+
+static STORE_METHOD store_memory =
+        {
+        "OpenSSL memory store interface",
+        mem_init,
+        mem_clean,
+        mem_generate,
+        mem_get,
+        mem_store,
+        mem_modify,
+        NULL, /* revoke */
+        mem_delete,
+        mem_list_start,
+        mem_list_next,
+        mem_list_end,
+        mem_list_endp,
+        NULL, /* update */
+        mem_lock,
+        mem_unlock,
+        mem_ctrl
+        };
+
+const STORE_METHOD *STORE_Memory(void)
+        {
+        return &store_memory;
+        }
+
+static int mem_init(STORE *s)
+        {
+        return 1;
+        }
+
+static void mem_clean(STORE *s)
+        {
+        return;
+        }
+
+static STORE_OBJECT *mem_generate(STORE *s, STORE_OBJECT_TYPES type,
+        OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[])
+        {
+        STOREerr(STORE_F_MEM_GENERATE, STORE_R_NOT_IMPLEMENTED);
+        return 0;
+        }
+static STORE_OBJECT *mem_get(STORE *s, STORE_OBJECT_TYPES type,
+        OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[])
+        {
+        void *context = mem_list_start(s, type, attributes, parameters);
+        
+        if (context)
+                {
+                STORE_OBJECT *object = mem_list_next(s, context);
+
+                if (mem_list_end(s, context))
+                        return object;
+                }
+        return NULL;
+        }
+static int mem_store(STORE *s, STORE_OBJECT_TYPES type,
+        STORE_OBJECT *data, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STOREerr(STORE_F_MEM_STORE, STORE_R_NOT_IMPLEMENTED);
+        return 0;
+        }
+static int mem_modify(STORE *s, STORE_OBJECT_TYPES type,
+        OPENSSL_ITEM search_attributes[], OPENSSL_ITEM add_attributes[],
+        OPENSSL_ITEM modify_attributes[], OPENSSL_ITEM delete_attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        STOREerr(STORE_F_MEM_MODIFY, STORE_R_NOT_IMPLEMENTED);
+        return 0;
+        }
+static int mem_delete(STORE *s, STORE_OBJECT_TYPES type,
+        OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[])
+        {
+        STOREerr(STORE_F_MEM_DELETE, STORE_R_NOT_IMPLEMENTED);
+        return 0;
+        }
+
+/* The list functions may be the hardest to understand.  Basically,
+   mem_list_start compiles a stack of attribute info elements, and
+   puts that stack into the context to be returned.  mem_list_next
+   will then find the first matching element in the store, and then
+   walk all the way to the end of the store (since any combination
+   of attribute bits above the starting point may match the searched
+   for bit pattern...). */
+static void *mem_list_start(STORE *s, STORE_OBJECT_TYPES type,
+        OPENSSL_ITEM attributes[], OPENSSL_ITEM parameters[])
+        {
+        struct mem_ctx_st *context =
+                (struct mem_ctx_st *)OPENSSL_malloc(sizeof(struct mem_ctx_st));
+        void *attribute_context = NULL;
+        STORE_ATTR_INFO *attrs = NULL;
+
+        if (!context)
+                {
+                STOREerr(STORE_F_MEM_LIST_START, ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        memset(context, 0, sizeof(struct mem_ctx_st));
+
+        attribute_context = STORE_parse_attrs_start(attributes);
+        if (!attribute_context)
+                {
+                STOREerr(STORE_F_MEM_LIST_START, ERR_R_STORE_LIB);
+                goto err;
+                }
+
+        while((attrs = STORE_parse_attrs_next(attribute_context)))
+                {
+                if (context->search_attributes == NULL)
+                        {
+                        context->search_attributes =
+                                sk_new((int (*)(const char * const *, const char * const *))STORE_ATTR_INFO_compare);
+                        if (!context->search_attributes)
+                                {
+                                STOREerr(STORE_F_MEM_LIST_START,
+                                        ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+                        }
+                sk_push(context->search_attributes,(char *)attrs);
+                }
+        if (!STORE_parse_attrs_endp(attribute_context))
+                goto err;
+        STORE_parse_attrs_end(attribute_context);
+        context->search_index = -1;
+        context->index = -1;
+        return context;
+ err:
+        if (attribute_context) STORE_parse_attrs_end(attribute_context);
+        mem_list_end(s, context);
+        return NULL;
+        }
+static STORE_OBJECT *mem_list_next(STORE *s, void *handle)
+        {
+        int i;
+        struct mem_ctx_st *context = (struct mem_ctx_st *)handle;
+        struct mem_object_data_st key = { 0, 0, 1 };
+        struct mem_data_st *store =
+                (struct mem_data_st *)STORE_get_ex_data(s, 1);
+        int srch;
+        int cres = 0;
+
+        if (!context)
+                {
+                STOREerr(STORE_F_MEM_LIST_NEXT, ERR_R_PASSED_NULL_PARAMETER);
+                return NULL;
+                }
+        if (!store)
+                {
+                STOREerr(STORE_F_MEM_LIST_NEXT, STORE_R_NO_STORE);
+                return NULL;
+                }
+
+        if (context->search_index == -1)
+                {
+                for (i = 0; i < sk_num(context->search_attributes); i++)
+                        {
+                        key.attr_info =
+                                (STORE_ATTR_INFO *)sk_value(context->search_attributes, i);
+                        srch = sk_find_ex(store->data, (char *)&key);
+
+                        if (srch >= 0)
+                                {
+                                context->search_index = srch;
+                                break;
+                                }
+                        }
+                }
+        if (context->search_index < 0)
+                return NULL;
+        
+        key.attr_info =
+                (STORE_ATTR_INFO *)sk_value(context->search_attributes,
+                        context->search_index);
+        for(srch = context->search_index;
+            srch < sk_num(store->data)
+                    && STORE_ATTR_INFO_in_range(key.attr_info,
+                            (STORE_ATTR_INFO *)sk_value(store->data, srch))
+                    && !(cres = STORE_ATTR_INFO_in_ex(key.attr_info,
+                                 (STORE_ATTR_INFO *)sk_value(store->data, srch)));
+            srch++)
+                ;
+
+        context->search_index = srch;
+        if (cres)
+                return ((struct mem_object_data_st *)sk_value(store->data,
+                                srch))->object;
+        return NULL;
+        }
+static int mem_list_end(STORE *s, void *handle)
+        {
+        struct mem_ctx_st *context = (struct mem_ctx_st *)handle;
+
+        if (!context)
+                {
+                STOREerr(STORE_F_MEM_LIST_END, ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+                }
+        if (context && context->search_attributes)
+                sk_free(context->search_attributes);
+        if (context) OPENSSL_free(context);
+        return 1;
+        }
+static int mem_list_endp(STORE *s, void *handle)
+        {
+        struct mem_ctx_st *context = (struct mem_ctx_st *)handle;
+
+        if (!context
+                || context->search_index == sk_num(context->search_attributes))
+                return 1;
+        return 0;
+        }
+static int mem_lock(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        return 1;
+        }
+static int mem_unlock(STORE *s, OPENSSL_ITEM attributes[],
+        OPENSSL_ITEM parameters[])
+        {
+        return 1;
+        }
+static int mem_ctrl(STORE *s, int cmd, long l, void *p, void (*f)(void))
+        {
+        return 1;
+        }
diff --git a/src/lib/libssl/src/crypto/store/str_meth.c b/src/lib/libssl/src/crypto/store/str_meth.c
new file mode 100644
index 0000000000..a46de03a26
--- /dev/null
+++ b/src/lib/libssl/src/crypto/store/str_meth.c
@@ -0,0 +1,250 @@
+/* crypto/store/str_meth.c -*- mode:C; c-file-style: "eay" -*- */
+/* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
+ * project 2003.
+ */
+/* ====================================================================
+ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <string.h>
+#include <openssl/buffer.h>
+#include "str_locl.h"
+
+STORE_METHOD *STORE_create_method(char *name)
+        {
+        STORE_METHOD *store_method = (STORE_METHOD *)OPENSSL_malloc(sizeof(STORE_METHOD));
+
+        if (store_method)
+                {
+                memset(store_method, 0, sizeof(*store_method));
+                store_method->name = BUF_strdup(name);
+                }
+        return store_method;
+        }
+
+/* BIG FSCKING WARNING!!!!  If you use this on a statically allocated method
+   (that is, it hasn't been allocated using STORE_create_method(), you deserve
+   anything Murphy can throw at you and more!  You have been warned. */
+void STORE_destroy_method(STORE_METHOD *store_method)
+        {
+        if (!store_method) return;
+        OPENSSL_free(store_method->name);
+        store_method->name = NULL;
+        OPENSSL_free(store_method);
+        }
+
+int STORE_method_set_initialise_function(STORE_METHOD *sm, STORE_INITIALISE_FUNC_PTR init_f)
+        {
+        sm->init = init_f;
+        return 1;
+        }
+
+int STORE_method_set_cleanup_function(STORE_METHOD *sm, STORE_CLEANUP_FUNC_PTR clean_f)
+        {
+        sm->clean = clean_f;
+        return 1;
+        }
+
+int STORE_method_set_generate_function(STORE_METHOD *sm, STORE_GENERATE_OBJECT_FUNC_PTR generate_f)
+        {
+        sm->generate_object = generate_f;
+        return 1;
+        }
+
+int STORE_method_set_get_function(STORE_METHOD *sm, STORE_GET_OBJECT_FUNC_PTR get_f)
+        {
+        sm->get_object = get_f;
+        return 1;
+        }
+
+int STORE_method_set_store_function(STORE_METHOD *sm, STORE_STORE_OBJECT_FUNC_PTR store_f)
+        {
+        sm->store_object = store_f;
+        return 1;
+        }
+
+int STORE_method_set_modify_function(STORE_METHOD *sm, STORE_MODIFY_OBJECT_FUNC_PTR modify_f)
+        {
+        sm->modify_object = modify_f;
+        return 1;
+        }
+
+int STORE_method_set_revoke_function(STORE_METHOD *sm, STORE_HANDLE_OBJECT_FUNC_PTR revoke_f)
+        {
+        sm->revoke_object = revoke_f;
+        return 1;
+        }
+
+int STORE_method_set_delete_function(STORE_METHOD *sm, STORE_HANDLE_OBJECT_FUNC_PTR delete_f)
+        {
+        sm->delete_object = delete_f;
+        return 1;
+        }
+
+int STORE_method_set_list_start_function(STORE_METHOD *sm, STORE_START_OBJECT_FUNC_PTR list_start_f)
+        {
+        sm->list_object_start = list_start_f;
+        return 1;
+        }
+
+int STORE_method_set_list_next_function(STORE_METHOD *sm, STORE_NEXT_OBJECT_FUNC_PTR list_next_f)
+        {
+        sm->list_object_next = list_next_f;
+        return 1;
+        }
+
+int STORE_method_set_list_end_function(STORE_METHOD *sm, STORE_END_OBJECT_FUNC_PTR list_end_f)
+        {
+        sm->list_object_end = list_end_f;
+        return 1;
+        }
+
+int STORE_method_set_update_store_function(STORE_METHOD *sm, STORE_GENERIC_FUNC_PTR update_f)
+        {
+        sm->update_store = update_f;
+        return 1;
+        }
+
+int STORE_method_set_lock_store_function(STORE_METHOD *sm, STORE_GENERIC_FUNC_PTR lock_f)
+        {
+        sm->lock_store = lock_f;
+        return 1;
+        }
+
+int STORE_method_set_unlock_store_function(STORE_METHOD *sm, STORE_GENERIC_FUNC_PTR unlock_f)
+        {
+        sm->unlock_store = unlock_f;
+        return 1;
+        }
+
+int STORE_method_set_ctrl_function(STORE_METHOD *sm, STORE_CTRL_FUNC_PTR ctrl_f)
+        {
+        sm->ctrl = ctrl_f;
+        return 1;
+        }
+
+STORE_INITIALISE_FUNC_PTR STORE_method_get_initialise_function(STORE_METHOD *sm)
+        {
+        return sm->init;
+        }
+
+STORE_CLEANUP_FUNC_PTR STORE_method_get_cleanup_function(STORE_METHOD *sm)
+        {
+        return sm->clean;
+        }
+
+STORE_GENERATE_OBJECT_FUNC_PTR STORE_method_get_generate_function(STORE_METHOD *sm)
+        {
+        return sm->generate_object;
+        }
+
+STORE_GET_OBJECT_FUNC_PTR STORE_method_get_get_function(STORE_METHOD *sm)
+        {
+        return sm->get_object;
+        }
+
+STORE_STORE_OBJECT_FUNC_PTR STORE_method_get_store_function(STORE_METHOD *sm)
+        {
+        return sm->store_object;
+        }
+
+STORE_MODIFY_OBJECT_FUNC_PTR STORE_method_get_modify_function(STORE_METHOD *sm)
+        {
+        return sm->modify_object;
+        }
+
+STORE_HANDLE_OBJECT_FUNC_PTR STORE_method_get_revoke_function(STORE_METHOD *sm)
+        {
+        return sm->revoke_object;
+        }
+
+STORE_HANDLE_OBJECT_FUNC_PTR STORE_method_get_delete_function(STORE_METHOD *sm)
+        {
+        return sm->delete_object;
+        }
+
+STORE_START_OBJECT_FUNC_PTR STORE_method_get_list_start_function(STORE_METHOD *sm)
+        {
+        return sm->list_object_start;
+        }
+
+STORE_NEXT_OBJECT_FUNC_PTR STORE_method_get_list_next_function(STORE_METHOD *sm)
+        {
+        return sm->list_object_next;
+        }
+
+STORE_END_OBJECT_FUNC_PTR STORE_method_get_list_end_function(STORE_METHOD *sm)
+        {
+        return sm->list_object_end;
+        }
+
+STORE_GENERIC_FUNC_PTR STORE_method_get_update_store_function(STORE_METHOD *sm)
+        {
+        return sm->update_store;
+        }
+
+STORE_GENERIC_FUNC_PTR STORE_method_get_lock_store_function(STORE_METHOD *sm)
+        {
+        return sm->lock_store;
+        }
+
+STORE_GENERIC_FUNC_PTR STORE_method_get_unlock_store_function(STORE_METHOD *sm)
+        {
+        return sm->unlock_store;
+        }
+
+STORE_CTRL_FUNC_PTR STORE_method_get_ctrl_function(STORE_METHOD *sm)
+        {
+        return sm->ctrl;
+        }
+
diff --git a/src/lib/libssl/src/crypto/threads/netware.bat b/src/lib/libssl/src/crypto/threads/netware.bat
new file mode 100644
index 0000000000..0b3eca3caf
--- /dev/null
+++ b/src/lib/libssl/src/crypto/threads/netware.bat
@@ -0,0 +1,79 @@
+@echo off
+rem batch file to build multi-thread test ( mttest.nlm )
+
+rem command line arguments:
+rem      debug => build using debug settings
+
+rem
+rem After building, copy mttest.nlm to the server and run it, you'll probably
+rem want to redirect stdout and stderr.  An example command line would be
+rem "mttest.nlm -thread 20 -loops 10 -CAfile \openssl\apps\server.pem >mttest.out 2>mttest.err"
+rem 
+
+del mttest.nlm
+
+set BLD_DEBUG=
+set CFLAGS=
+set LFLAGS=
+set LIBS=
+
+if "%1" == "DEBUG" set BLD_DEBUG=YES
+if "%1" == "debug" set BLD_DEBUG=YES
+
+if "%MWCIncludes%" == "" goto inc_error
+if "%PRELUDE%" == "" goto prelude_error
+if "%IMPORTS%" == "" goto imports_error
+
+set CFLAGS=-c -I..\..\outinc_nw -nosyspath -DOPENSSL_SYS_NETWARE -opt off -g -sym internal -maxerrors 20
+
+if "%BLD_DEBUG%" == "YES" set LIBS=..\..\out_nw.dbg\ssl.lib ..\..\out_nw.dbg\crypto.lib
+if "%BLD_DEBUG%" == ""  set LIBS=..\..\out_nw\ssl.lib ..\..\out_nw\crypto.lib
+
+set LFLAGS=-msgstyle gcc -zerobss -stacksize 32768 -nostdlib -sym internal 
+  
+rem generate command file for metrowerks
+echo.
+echo Generating Metrowerks command file: mttest.def
+echo # dynamically generated command file for metrowerks build > mttest.def
+echo IMPORT @%IMPORTS%\clib.imp              >> mttest.def 
+echo IMPORT @%IMPORTS%\threads.imp           >> mttest.def 
+echo IMPORT @%IMPORTS%\ws2nlm.imp            >> mttest.def 
+echo IMPORT GetProcessSwitchCount            >> mttest.def
+echo MODULE clib                             >> mttest.def 
+
+rem compile
+echo.
+echo Compiling mttest.c
+mwccnlm.exe mttest.c %CFLAGS% 
+if errorlevel 1 goto end
+
+rem link               
+echo.
+echo Linking mttest.nlm
+mwldnlm.exe %LFLAGS% -screenname mttest -commandfile mttest.def mttest.o "%PRELUDE%" %LIBS% -o mttest.nlm
+if errorlevel 1 goto end
+
+goto end
+
+:inc_error
+echo.
+echo Environment variable MWCIncludes is not set - see install.nw
+goto end
+
+:prelude_error
+echo.
+echo Environment variable PRELUDE is not set - see install.nw
+goto end
+
+:imports_error
+echo.
+echo Environment variable IMPORTS is not set - see install.nw
+goto end
+    
+    
+:end
+set BLD_DEBUG=
+set CFLAGS=
+set LFLAGS=
+set LIBS=
+
diff --git a/src/lib/libssl/src/crypto/x509/x509_vpm.c b/src/lib/libssl/src/crypto/x509/x509_vpm.c
new file mode 100644
index 0000000000..e9db6d62a7
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509/x509_vpm.c
@@ -0,0 +1,420 @@
+/* x509_vpm.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 2004.
+ */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+
+#include "cryptlib.h"
+#include <openssl/crypto.h>
+#include <openssl/lhash.h>
+#include <openssl/buffer.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+/* X509_VERIFY_PARAM functions */
+
+static void x509_verify_param_zero(X509_VERIFY_PARAM *param)
+        {
+        if (!param)
+                return;
+        param->name = NULL;
+        param->purpose = 0;
+        param->trust = 0;
+        param->inh_flags = X509_VP_FLAG_DEFAULT;
+        param->flags = 0;
+        param->depth = -1;
+        if (param->policies)
+                {
+                sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
+                param->policies = NULL;
+                }
+        }
+
+X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void)
+        {
+        X509_VERIFY_PARAM *param;
+        param = OPENSSL_malloc(sizeof(X509_VERIFY_PARAM));
+        memset(param, 0, sizeof(X509_VERIFY_PARAM));
+        x509_verify_param_zero(param);
+        return param;
+        }
+
+void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param)
+        {
+        x509_verify_param_zero(param);
+        OPENSSL_free(param);
+        }
+
+/* This function determines how parameters are "inherited" from one structure
+ * to another. There are several different ways this can happen.
+ *
+ * 1. If a child structure needs to have its values initialized from a parent
+ *    they are simply copied across. For example SSL_CTX copied to SSL.
+ * 2. If the structure should take on values only if they are currently unset.
+ *    For example the values in an SSL structure will take appropriate value
+ *    for SSL servers or clients but only if the application has not set new
+ *    ones.
+ *
+ * The "inh_flags" field determines how this function behaves. 
+ *
+ * Normally any values which are set in the default are not copied from the
+ * destination and verify flags are ORed together.
+ *
+ * If X509_VP_FLAG_DEFAULT is set then anything set in the source is copied
+ * to the destination. Effectively the values in "to" become default values
+ * which will be used only if nothing new is set in "from".
+ *
+ * If X509_VP_FLAG_OVERWRITE is set then all value are copied across whether
+ * they are set or not. Flags is still Ored though.
+ *
+ * If X509_VP_FLAG_RESET_FLAGS is set then the flags value is copied instead
+ * of ORed.
+ *
+ * If X509_VP_FLAG_LOCKED is set then no values are copied.
+ *
+ * If X509_VP_FLAG_ONCE is set then the current inh_flags setting is zeroed
+ * after the next call.
+ */
+
+/* Macro to test if a field should be copied from src to dest */
+
+#define test_x509_verify_param_copy(field, def) \
+        (to_overwrite || \
+                ((src->field != def) && (to_default || (dest->field == def))))
+
+/* Macro to test and copy a field if necessary */
+
+#define x509_verify_param_copy(field, def) \
+        if (test_x509_verify_param_copy(field, def)) \
+                dest->field = src->field
+                
+
+int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest,
+                                                const X509_VERIFY_PARAM *src)
+        {
+        unsigned long inh_flags;
+        int to_default, to_overwrite;
+        if (!src)
+                return 1;
+        inh_flags = dest->inh_flags | src->inh_flags;
+
+        if (inh_flags & X509_VP_FLAG_ONCE)
+                dest->inh_flags = 0;
+
+        if (inh_flags & X509_VP_FLAG_LOCKED)
+                return 1;
+
+        if (inh_flags & X509_VP_FLAG_DEFAULT)
+                to_default = 1;
+        else
+                to_default = 0;
+
+        if (inh_flags & X509_VP_FLAG_OVERWRITE)
+                to_overwrite = 1;
+        else
+                to_overwrite = 0;
+
+        x509_verify_param_copy(purpose, 0);
+        x509_verify_param_copy(trust, 0);
+        x509_verify_param_copy(depth, -1);
+
+        /* If overwrite or check time not set, copy across */
+
+        if (to_overwrite || !(dest->flags & X509_V_FLAG_USE_CHECK_TIME))
+                {
+                dest->check_time = src->check_time;
+                dest->flags &= ~X509_V_FLAG_USE_CHECK_TIME;
+                /* Don't need to copy flag: that is done below */
+                }
+
+        if (inh_flags & X509_VP_FLAG_RESET_FLAGS)
+                dest->flags = 0;
+
+        dest->flags |= src->flags;
+
+        if (test_x509_verify_param_copy(policies, NULL))
+                {
+                if (!X509_VERIFY_PARAM_set1_policies(dest, src->policies))
+                        return 0;
+                }
+
+        return 1;
+        }
+
+int X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to,
+                                                const X509_VERIFY_PARAM *from)
+        {
+        to->inh_flags |= X509_VP_FLAG_DEFAULT;
+        return X509_VERIFY_PARAM_inherit(to, from);
+        }
+
+int X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name)
+        {
+        if (param->name)
+                OPENSSL_free(param->name);
+        param->name = BUF_strdup(name);
+        if (param->name)
+                return 1;
+        return 0;
+        }
+
+int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags)
+        {
+        param->flags |= flags;
+        if (flags & X509_V_FLAG_POLICY_MASK)
+                param->flags |= X509_V_FLAG_POLICY_CHECK;
+        return 1;
+        }
+
+int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param, unsigned long flags)
+        {
+        param->flags &= ~flags;
+        return 1;
+        }
+
+unsigned long X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param)
+        {
+        return param->flags;
+        }
+
+int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose)
+        {
+        return X509_PURPOSE_set(&param->purpose, purpose);
+        }
+
+int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust)
+        {
+        return X509_TRUST_set(&param->trust, trust);
+        }
+
+void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth)
+        {
+        param->depth = depth;
+        }
+
+void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t)
+        {
+        param->check_time = t;
+        param->flags |= X509_V_FLAG_USE_CHECK_TIME;
+        }
+
+int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param, ASN1_OBJECT *policy)
+        {
+        if (!param->policies)
+                {
+                param->policies = sk_ASN1_OBJECT_new_null();
+                if (!param->policies)
+                        return 0;
+                }
+        if (!sk_ASN1_OBJECT_push(param->policies, policy))
+                return 0;
+        return 1;
+        }
+
+int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param, 
+                                        STACK_OF(ASN1_OBJECT) *policies)
+        {
+        int i;
+        ASN1_OBJECT *oid, *doid;
+        if (!param)
+                return 0;
+        if (param->policies)
+                sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
+
+        if (!policies)
+                {
+                param->policies = NULL;
+                return 1;
+                }
+
+        param->policies = sk_ASN1_OBJECT_new_null();
+        if (!param->policies)
+                return 0;
+
+        for (i = 0; i < sk_ASN1_OBJECT_num(policies); i++)
+                {
+                oid = sk_ASN1_OBJECT_value(policies, i);
+                doid = OBJ_dup(oid);
+                if (!doid)
+                        return 0;
+                if (!sk_ASN1_OBJECT_push(param->policies, doid))
+                        {
+                        ASN1_OBJECT_free(doid);
+                        return 0;
+                        }
+                }
+        param->flags |= X509_V_FLAG_POLICY_CHECK;
+        return 1;
+        }
+
+int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param)
+        {
+        return param->depth;
+        }
+
+/* Default verify parameters: these are used for various
+ * applications and can be overridden by the user specified table.
+ * NB: the 'name' field *must* be in alphabetical order because it
+ * will be searched using OBJ_search.
+ */
+
+static const X509_VERIFY_PARAM default_table[] = {
+        {
+        "default",      /* X509 default parameters */
+        0,              /* Check time */
+        0,              /* internal flags */
+        0,              /* flags */
+        0,              /* purpose */
+        0,              /* trust */
+        9,              /* depth */
+        NULL            /* policies */
+        },
+        {
+        "pkcs7",                        /* SSL/TLS client parameters */
+        0,                              /* Check time */
+        0,                              /* internal flags */
+        0,                              /* flags */
+        X509_PURPOSE_SMIME_SIGN,        /* purpose */
+        X509_TRUST_EMAIL,               /* trust */
+        -1,                             /* depth */
+        NULL                            /* policies */
+        },
+        {
+        "ssl_client",                   /* SSL/TLS client parameters */
+        0,                              /* Check time */
+        0,                              /* internal flags */
+        0,                              /* flags */
+        X509_PURPOSE_SSL_CLIENT,        /* purpose */
+        X509_TRUST_SSL_CLIENT,          /* trust */
+        -1,                             /* depth */
+        NULL                            /* policies */
+        },
+        {
+        "ssl_server",                   /* SSL/TLS server parameters */
+        0,                              /* Check time */
+        0,                              /* internal flags */
+        0,                              /* flags */
+        X509_PURPOSE_SSL_SERVER,        /* purpose */
+        X509_TRUST_SSL_SERVER,          /* trust */
+        -1,                             /* depth */
+        NULL                            /* policies */
+        }};
+
+static STACK_OF(X509_VERIFY_PARAM) *param_table = NULL;
+
+static int table_cmp(const void *pa, const void *pb)
+        {
+        const X509_VERIFY_PARAM *a = pa, *b = pb;
+        return strcmp(a->name, b->name);
+        }
+
+static int param_cmp(const X509_VERIFY_PARAM * const *a,
+                        const X509_VERIFY_PARAM * const *b)
+        {
+        return strcmp((*a)->name, (*b)->name);
+        }
+
+int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)
+        {
+        int idx;
+        X509_VERIFY_PARAM *ptmp;
+        if (!param_table)
+                {
+                param_table = sk_X509_VERIFY_PARAM_new(param_cmp);
+                if (!param_table)
+                        return 0;
+                }
+        else
+                {
+                idx = sk_X509_VERIFY_PARAM_find(param_table, param);
+                if (idx != -1)
+                        {
+                        ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
+                        X509_VERIFY_PARAM_free(ptmp);
+                        (void)sk_X509_VERIFY_PARAM_delete(param_table, idx);
+                        }
+                }
+        if (!sk_X509_VERIFY_PARAM_push(param_table, param))
+                return 0;
+        return 1;
+        }
+
+const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name)
+        {
+        int idx;
+        X509_VERIFY_PARAM pm;
+        pm.name = (char *)name;
+        if (param_table)
+                {
+                idx = sk_X509_VERIFY_PARAM_find(param_table, &pm);
+                if (idx != -1)
+                        return sk_X509_VERIFY_PARAM_value(param_table, idx);
+                }
+        return (const X509_VERIFY_PARAM *) OBJ_bsearch((char *)&pm,
+                                (char *)&default_table,
+                                sizeof(default_table)/sizeof(X509_VERIFY_PARAM),
+                                sizeof(X509_VERIFY_PARAM),
+                                table_cmp);
+        }
+
+void X509_VERIFY_PARAM_table_cleanup(void)
+        {
+        if (param_table)
+                sk_X509_VERIFY_PARAM_pop_free(param_table,
+                                                X509_VERIFY_PARAM_free);
+        param_table = NULL;
+        }
diff --git a/src/lib/libssl/src/crypto/x509v3/pcy_cache.c b/src/lib/libssl/src/crypto/x509v3/pcy_cache.c
new file mode 100644
index 0000000000..c18beb89f5
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/pcy_cache.c
@@ -0,0 +1,287 @@
+/* pcy_cache.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 2004.
+ */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "cryptlib.h"
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+#include "pcy_int.h"
+
+static int policy_data_cmp(const X509_POLICY_DATA * const *a,
+                                const X509_POLICY_DATA * const *b);
+static int policy_cache_set_int(long *out, ASN1_INTEGER *value);
+
+/* Set cache entry according to CertificatePolicies extension.
+ * Note: this destroys the passed CERTIFICATEPOLICIES structure.
+ */
+
+static int policy_cache_create(X509 *x,
+                        CERTIFICATEPOLICIES *policies, int crit)
+        {
+        int i;
+        int ret = 0;
+        X509_POLICY_CACHE *cache = x->policy_cache;
+        X509_POLICY_DATA *data = NULL;
+        POLICYINFO *policy;
+        if (sk_POLICYINFO_num(policies) == 0)
+                goto bad_policy;
+        cache->data = sk_X509_POLICY_DATA_new(policy_data_cmp);
+        if (!cache->data)
+                goto bad_policy;
+        for (i = 0; i < sk_POLICYINFO_num(policies); i++)
+                {
+                policy = sk_POLICYINFO_value(policies, i);
+                data = policy_data_new(policy, NULL, crit);
+                if (!data)
+                        goto bad_policy;
+                /* Duplicate policy OIDs are illegal: reject if matches
+                 * found.
+                 */
+                if (OBJ_obj2nid(data->valid_policy) == NID_any_policy)
+                        {
+                        if (cache->anyPolicy)
+                                {
+                                ret = -1;
+                                goto bad_policy;
+                                }
+                        cache->anyPolicy = data;
+                        }
+                else if (sk_X509_POLICY_DATA_find(cache->data, data) != -1)
+                        {
+                        ret = -1;
+                        goto bad_policy;
+                        }
+                else if (!sk_X509_POLICY_DATA_push(cache->data, data))
+                        goto bad_policy;
+                data = NULL;
+                }
+        ret = 1;
+        bad_policy:
+        if (ret == -1)
+                x->ex_flags |= EXFLAG_INVALID_POLICY;
+        if (data)
+                policy_data_free(data);
+        sk_POLICYINFO_pop_free(policies, POLICYINFO_free);
+        if (ret <= 0)
+                {
+                sk_X509_POLICY_DATA_pop_free(cache->data, policy_data_free);
+                cache->data = NULL;
+                }
+        return ret;
+        }
+
+        
+static int policy_cache_new(X509 *x)
+        {
+        X509_POLICY_CACHE *cache;
+        ASN1_INTEGER *ext_any = NULL;
+        POLICY_CONSTRAINTS *ext_pcons = NULL;
+        CERTIFICATEPOLICIES *ext_cpols = NULL;
+        POLICY_MAPPINGS *ext_pmaps = NULL;
+        int i;
+        cache = OPENSSL_malloc(sizeof(X509_POLICY_CACHE));
+        if (!cache)
+                return 0;
+        cache->anyPolicy = NULL;
+        cache->data = NULL;
+        cache->maps = NULL;
+        cache->any_skip = -1;
+        cache->explicit_skip = -1;
+        cache->map_skip = -1;
+
+        x->policy_cache = cache;
+
+        /* Handle requireExplicitPolicy *first*. Need to process this
+         * even if we don't have any policies.
+         */
+        ext_pcons = X509_get_ext_d2i(x, NID_policy_constraints, &i, NULL);
+
+        if (!ext_pcons)
+                {
+                if (i != -1)
+                        goto bad_cache;
+                }
+        else
+                {
+                if (!ext_pcons->requireExplicitPolicy
+                        && !ext_pcons->inhibitPolicyMapping)
+                        goto bad_cache;
+                if (!policy_cache_set_int(&cache->explicit_skip,
+                        ext_pcons->requireExplicitPolicy))
+                        goto bad_cache;
+                if (!policy_cache_set_int(&cache->map_skip,
+                        ext_pcons->inhibitPolicyMapping))
+                        goto bad_cache;
+                }
+
+        /* Process CertificatePolicies */
+
+        ext_cpols = X509_get_ext_d2i(x, NID_certificate_policies, &i, NULL);
+        /* If no CertificatePolicies extension or problem decoding then
+         * there is no point continuing because the valid policies will be
+         * NULL.
+         */
+        if (!ext_cpols)
+                {
+                /* If not absent some problem with extension */
+                if (i != -1)
+                        goto bad_cache;
+                return 1;
+                }
+
+        i = policy_cache_create(x, ext_cpols, i);
+
+        /* NB: ext_cpols freed by policy_cache_set_policies */
+
+        if (i <= 0)
+                return i;
+
+        ext_pmaps = X509_get_ext_d2i(x, NID_policy_mappings, &i, NULL);
+
+        if (!ext_pmaps)
+                {
+                /* If not absent some problem with extension */
+                if (i != -1)
+                        goto bad_cache;
+                }
+        else
+                {
+                i = policy_cache_set_mapping(x, ext_pmaps);
+                if (i <= 0)
+                        goto bad_cache;
+                }
+
+        ext_any = X509_get_ext_d2i(x, NID_inhibit_any_policy, &i, NULL);
+
+        if (!ext_any)
+                {
+                if (i != -1)
+                        goto bad_cache;
+                }
+        else if (!policy_cache_set_int(&cache->any_skip, ext_any))
+                        goto bad_cache;
+
+        if (0)
+                {
+                bad_cache:
+                x->ex_flags |= EXFLAG_INVALID_POLICY;
+                }
+
+        if(ext_pcons)
+                POLICY_CONSTRAINTS_free(ext_pcons);
+
+        if (ext_any)
+                ASN1_INTEGER_free(ext_any);
+
+        return 1;
+
+        
+}
+
+void policy_cache_free(X509_POLICY_CACHE *cache)
+        {
+        if (!cache)
+                return;
+        if (cache->anyPolicy)
+                policy_data_free(cache->anyPolicy);
+        if (cache->data)
+                sk_X509_POLICY_DATA_pop_free(cache->data, policy_data_free);
+        OPENSSL_free(cache);
+        }
+
+const X509_POLICY_CACHE *policy_cache_set(X509 *x)
+        {
+
+        if (x->policy_cache == NULL)
+                {
+                CRYPTO_w_lock(CRYPTO_LOCK_X509);
+                        policy_cache_new(x);
+                CRYPTO_w_unlock(CRYPTO_LOCK_X509);
+                }
+
+        return x->policy_cache;
+
+        }
+
+X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,
+                                                const ASN1_OBJECT *id)
+        {
+        int idx;
+        X509_POLICY_DATA tmp;
+        tmp.valid_policy = (ASN1_OBJECT *)id;
+        idx = sk_X509_POLICY_DATA_find(cache->data, &tmp);
+        if (idx == -1)
+                return NULL;
+        return sk_X509_POLICY_DATA_value(cache->data, idx);
+        }
+
+static int policy_data_cmp(const X509_POLICY_DATA * const *a,
+                                const X509_POLICY_DATA * const *b)
+        {
+        return OBJ_cmp((*a)->valid_policy, (*b)->valid_policy);
+        }
+
+static int policy_cache_set_int(long *out, ASN1_INTEGER *value)
+        {
+        if (value == NULL)
+                return 1;
+        if (value->type == V_ASN1_NEG_INTEGER)
+                return 0;
+        *out = ASN1_INTEGER_get(value);
+        return 1;
+        }
diff --git a/src/lib/libssl/src/crypto/x509v3/pcy_data.c b/src/lib/libssl/src/crypto/x509v3/pcy_data.c
new file mode 100644
index 0000000000..614d2b4935
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/pcy_data.c
@@ -0,0 +1,123 @@
+/* pcy_data.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 2004.
+ */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "cryptlib.h"
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+#include "pcy_int.h"
+
+/* Policy Node routines */
+
+void policy_data_free(X509_POLICY_DATA *data)
+        {
+        ASN1_OBJECT_free(data->valid_policy);
+        /* Don't free qualifiers if shared */
+        if (!(data->flags & POLICY_DATA_FLAG_SHARED_QUALIFIERS))
+                sk_POLICYQUALINFO_pop_free(data->qualifier_set,
+                                        POLICYQUALINFO_free);
+        sk_ASN1_OBJECT_pop_free(data->expected_policy_set, ASN1_OBJECT_free);
+        OPENSSL_free(data);
+        }
+
+/* Create a data based on an existing policy. If 'id' is NULL use the
+ * oid in the policy, otherwise use 'id'. This behaviour covers the two
+ * types of data in RFC3280: data with from a CertificatePolcies extension
+ * and additional data with just the qualifiers of anyPolicy and ID from
+ * another source.
+ */
+
+X509_POLICY_DATA *policy_data_new(POLICYINFO *policy, ASN1_OBJECT *id, int crit)
+        {
+        X509_POLICY_DATA *ret;
+        if (!policy && !id)
+                return NULL;
+        ret = OPENSSL_malloc(sizeof(X509_POLICY_DATA));
+        if (!ret)
+                return NULL;
+        ret->expected_policy_set = sk_ASN1_OBJECT_new_null();
+        if (!ret->expected_policy_set)
+                {
+                OPENSSL_free(ret);
+                return NULL;
+                }
+
+        if (crit)
+                ret->flags = POLICY_DATA_FLAG_CRITICAL;
+        else
+                ret->flags = 0;
+
+        if (id)
+                ret->valid_policy = id;
+        else
+                {
+                ret->valid_policy = policy->policyid;
+                policy->policyid = NULL;
+                }
+
+        if (policy)
+                {
+                ret->qualifier_set = policy->qualifiers;
+                policy->qualifiers = NULL;
+                }
+        else
+                ret->qualifier_set = NULL;
+
+        return ret;
+        }
+
diff --git a/src/lib/libssl/src/crypto/x509v3/pcy_int.h b/src/lib/libssl/src/crypto/x509v3/pcy_int.h
new file mode 100644
index 0000000000..ba62a209da
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/pcy_int.h
@@ -0,0 +1,223 @@
+/* pcy_int.h */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 2004.
+ */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+DECLARE_STACK_OF(X509_POLICY_DATA)
+DECLARE_STACK_OF(X509_POLICY_REF)
+DECLARE_STACK_OF(X509_POLICY_NODE)
+
+typedef struct X509_POLICY_DATA_st X509_POLICY_DATA;
+typedef struct X509_POLICY_REF_st X509_POLICY_REF;
+
+/* Internal structures */
+
+/* This structure and the field names correspond to the Policy 'node' of
+ * RFC3280. NB this structure contains no pointers to parent or child
+ * data: X509_POLICY_NODE contains that. This means that the main policy data
+ * can be kept static and cached with the certificate.
+ */
+
+struct X509_POLICY_DATA_st
+        {
+        unsigned int flags;
+        /* Policy OID and qualifiers for this data */
+        ASN1_OBJECT *valid_policy;
+        STACK_OF(POLICYQUALINFO) *qualifier_set;
+        STACK_OF(ASN1_OBJECT) *expected_policy_set;
+        };
+
+/* X509_POLICY_DATA flags values */
+
+/* This flag indicates the structure has been mapped using a policy mapping
+ * extension. If policy mapping is not active its references get deleted. 
+ */
+
+#define POLICY_DATA_FLAG_MAPPED                 0x1
+
+/* This flag indicates the data doesn't correspond to a policy in Certificate
+ * Policies: it has been mapped to any policy.
+ */
+
+#define POLICY_DATA_FLAG_MAPPED_ANY             0x2
+
+/* AND with flags to see if any mapping has occurred */
+
+#define POLICY_DATA_FLAG_MAP_MASK               0x3
+
+/* qualifiers are shared and shouldn't be freed */
+
+#define POLICY_DATA_FLAG_SHARED_QUALIFIERS      0x4
+
+/* Parent node is an extra node and should be freed */
+
+#define POLICY_DATA_FLAG_EXTRA_NODE             0x8
+
+/* Corresponding CertificatePolicies is critical */
+
+#define POLICY_DATA_FLAG_CRITICAL               0x10
+
+/* This structure is an entry from a table of mapped policies which
+ * cross reference the policy it refers to.
+ */
+
+struct X509_POLICY_REF_st
+        {
+        ASN1_OBJECT *subjectDomainPolicy;
+        const X509_POLICY_DATA *data;
+        };
+
+/* This structure is cached with a certificate */
+
+struct X509_POLICY_CACHE_st {
+        /* anyPolicy data or NULL if no anyPolicy */
+        X509_POLICY_DATA *anyPolicy;
+        /* other policy data */
+        STACK_OF(X509_POLICY_DATA) *data;
+        /* If policyMappings extension present a table of mapped policies */
+        STACK_OF(X509_POLICY_REF) *maps;
+        /* If InhibitAnyPolicy present this is its value or -1 if absent. */
+        long any_skip;
+        /* If policyConstraints and requireExplicitPolicy present this is its
+         * value or -1 if absent.
+         */
+        long explicit_skip;
+        /* If policyConstraints and policyMapping present this is its
+         * value or -1 if absent.
+         */
+        long map_skip;
+        };
+
+/*#define POLICY_CACHE_FLAG_CRITICAL            POLICY_DATA_FLAG_CRITICAL*/
+
+/* This structure represents the relationship between nodes */
+
+struct X509_POLICY_NODE_st
+        {
+        /* node data this refers to */
+        const X509_POLICY_DATA *data;
+        /* Parent node */
+        X509_POLICY_NODE *parent;
+        /* Number of child nodes */
+        int nchild;
+        };
+
+struct X509_POLICY_LEVEL_st
+        {
+        /* Cert for this level */
+        X509 *cert;
+        /* nodes at this level */
+        STACK_OF(X509_POLICY_NODE) *nodes;
+        /* anyPolicy node */
+        X509_POLICY_NODE *anyPolicy;
+        /* Extra data */
+        /*STACK_OF(X509_POLICY_DATA) *extra_data;*/
+        unsigned int flags;
+        };
+
+struct X509_POLICY_TREE_st
+        {
+        /* This is the tree 'level' data */
+        X509_POLICY_LEVEL *levels;
+        int nlevel;
+        /* Extra policy data when additional nodes (not from the certificate)
+         * are required.
+         */
+        STACK_OF(X509_POLICY_DATA) *extra_data;
+        /* This is the authority constained policy set */
+        STACK_OF(X509_POLICY_NODE) *auth_policies;
+        STACK_OF(X509_POLICY_NODE) *user_policies;
+        unsigned int flags;
+        };
+
+/* Set if anyPolicy present in user policies */
+#define POLICY_FLAG_ANY_POLICY          0x2
+
+/* Useful macros */
+
+#define node_data_critical(data) (data->flags & POLICY_DATA_FLAG_CRITICAL)
+#define node_critical(node) node_data_critical(node->data)
+
+/* Internal functions */
+
+X509_POLICY_DATA *policy_data_new(POLICYINFO *policy, ASN1_OBJECT *id,
+                                                                int crit);
+void policy_data_free(X509_POLICY_DATA *data);
+
+X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,
+                                                        const ASN1_OBJECT *id);
+int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps);
+
+
+STACK_OF(X509_POLICY_NODE) *policy_node_cmp_new(void);
+
+void policy_cache_init(void);
+
+void policy_cache_free(X509_POLICY_CACHE *cache);
+
+X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level,
+                                        const ASN1_OBJECT *id);
+
+X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *sk,
+                                                const ASN1_OBJECT *id);
+
+X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
+                        X509_POLICY_DATA *data,
+                        X509_POLICY_NODE *parent,
+                        X509_POLICY_TREE *tree);
+void policy_node_free(X509_POLICY_NODE *node);
+
+const X509_POLICY_CACHE *policy_cache_set(X509 *x);
diff --git a/src/lib/libssl/src/crypto/x509v3/pcy_lib.c b/src/lib/libssl/src/crypto/x509v3/pcy_lib.c
new file mode 100644
index 0000000000..dae4840bc5
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/pcy_lib.c
@@ -0,0 +1,167 @@
+/* pcy_lib.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 2004.
+ */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+#include "cryptlib.h"
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+#include "pcy_int.h"
+
+/* accessor functions */
+
+/* X509_POLICY_TREE stuff */
+
+int X509_policy_tree_level_count(const X509_POLICY_TREE *tree)
+        {
+        if (!tree)
+                return 0;
+        return tree->nlevel;
+        }
+
+X509_POLICY_LEVEL *
+        X509_policy_tree_get0_level(const X509_POLICY_TREE *tree, int i)
+        {
+        if (!tree || (i < 0) || (i >= tree->nlevel))
+                return NULL;
+        return tree->levels + i;
+        }
+
+STACK_OF(X509_POLICY_NODE) *
+                X509_policy_tree_get0_policies(const X509_POLICY_TREE *tree)
+        {
+        if (!tree)
+                return NULL;
+        return tree->auth_policies;
+        }
+
+STACK_OF(X509_POLICY_NODE) *
+        X509_policy_tree_get0_user_policies(const X509_POLICY_TREE *tree)
+        {
+        if (!tree)
+                return NULL;
+        if (tree->flags & POLICY_FLAG_ANY_POLICY)
+                return tree->auth_policies;
+        else
+                return tree->user_policies;
+        }
+
+/* X509_POLICY_LEVEL stuff */
+
+int X509_policy_level_node_count(X509_POLICY_LEVEL *level)
+        {
+        int n;
+        if (!level)
+                return 0;
+        if (level->anyPolicy)
+                n = 1;
+        else
+                n = 0;
+        if (level->nodes)
+                n += sk_X509_POLICY_NODE_num(level->nodes);
+        return n;
+        }
+
+X509_POLICY_NODE *X509_policy_level_get0_node(X509_POLICY_LEVEL *level, int i)
+        {
+        if (!level)
+                return NULL;
+        if (level->anyPolicy)
+                {
+                if (i == 0)
+                        return level->anyPolicy;
+                i--;
+                }
+        return sk_X509_POLICY_NODE_value(level->nodes, i);
+        }
+
+/* X509_POLICY_NODE stuff */
+
+const ASN1_OBJECT *X509_policy_node_get0_policy(const X509_POLICY_NODE *node)
+        {
+        if (!node)
+                return NULL;
+        return node->data->valid_policy;
+        }
+
+#if 0
+int X509_policy_node_get_critical(const X509_POLICY_NODE *node)
+        {
+        if (node_critical(node))
+                return 1;
+        return 0;
+        }
+#endif
+
+STACK_OF(POLICYQUALINFO) *
+                X509_policy_node_get0_qualifiers(const X509_POLICY_NODE *node)
+        {
+        if (!node)
+                return NULL;
+        return node->data->qualifier_set;
+        }
+
+const X509_POLICY_NODE *
+                X509_policy_node_get0_parent(const X509_POLICY_NODE *node)
+        {
+        if (!node)
+                return NULL;
+        return node->parent;
+        }
+
+
diff --git a/src/lib/libssl/src/crypto/x509v3/pcy_map.c b/src/lib/libssl/src/crypto/x509v3/pcy_map.c
new file mode 100644
index 0000000000..35221e8ba8
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/pcy_map.c
@@ -0,0 +1,186 @@
+/* pcy_map.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 2004.
+ */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "cryptlib.h"
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+#include "pcy_int.h"
+
+static int ref_cmp(const X509_POLICY_REF * const *a,
+                        const X509_POLICY_REF * const *b)
+        {
+        return OBJ_cmp((*a)->subjectDomainPolicy, (*b)->subjectDomainPolicy);
+        }
+
+static void policy_map_free(X509_POLICY_REF *map)
+        {
+        if (map->subjectDomainPolicy)
+                ASN1_OBJECT_free(map->subjectDomainPolicy);
+        OPENSSL_free(map);
+        }
+
+static X509_POLICY_REF *policy_map_find(X509_POLICY_CACHE *cache, ASN1_OBJECT *id)
+        {
+        X509_POLICY_REF tmp;
+        int idx;
+        tmp.subjectDomainPolicy = id;
+
+        idx = sk_X509_POLICY_REF_find(cache->maps, &tmp);
+        if (idx == -1)
+                return NULL;
+        return sk_X509_POLICY_REF_value(cache->maps, idx);
+        }
+
+/* Set policy mapping entries in cache.
+ * Note: this modifies the passed POLICY_MAPPINGS structure
+ */
+
+int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
+        {
+        POLICY_MAPPING *map;
+        X509_POLICY_REF *ref = NULL;
+        X509_POLICY_DATA *data;
+        X509_POLICY_CACHE *cache = x->policy_cache;
+        int i;
+        int ret = 0;
+        if (sk_POLICY_MAPPING_num(maps) == 0)
+                {
+                ret = -1;
+                goto bad_mapping;
+                }
+        cache->maps = sk_X509_POLICY_REF_new(ref_cmp);
+        for (i = 0; i < sk_POLICY_MAPPING_num(maps); i++)
+                {
+                map = sk_POLICY_MAPPING_value(maps, i);
+                /* Reject if map to or from anyPolicy */
+                if ((OBJ_obj2nid(map->subjectDomainPolicy) == NID_any_policy)
+                   || (OBJ_obj2nid(map->issuerDomainPolicy) == NID_any_policy))
+                        {
+                        ret = -1;
+                        goto bad_mapping;
+                        }
+
+                /* If we've already mapped from this OID bad mapping */
+                if (policy_map_find(cache, map->subjectDomainPolicy) != NULL)
+                        {
+                        ret = -1;
+                        goto bad_mapping;
+                        }
+
+                /* Attempt to find matching policy data */
+                data = policy_cache_find_data(cache, map->issuerDomainPolicy);
+                /* If we don't have anyPolicy can't map */
+                if (!data && !cache->anyPolicy)
+                        continue;
+
+                /* Create a NODE from anyPolicy */
+                if (!data)
+                        {
+                        data = policy_data_new(NULL, map->issuerDomainPolicy,
+                                        cache->anyPolicy->flags
+                                                & POLICY_DATA_FLAG_CRITICAL);
+                        if (!data)
+                                goto bad_mapping;
+                        data->qualifier_set = cache->anyPolicy->qualifier_set;
+                        map->issuerDomainPolicy = NULL;
+                        data->flags |= POLICY_DATA_FLAG_MAPPED_ANY;
+                        data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS;
+                        if (!sk_X509_POLICY_DATA_push(cache->data, data))
+                                {
+                                policy_data_free(data);
+                                goto bad_mapping;
+                                }
+                        }
+                else
+                        data->flags |= POLICY_DATA_FLAG_MAPPED;
+
+                if (!sk_ASN1_OBJECT_push(data->expected_policy_set, 
+                                                map->subjectDomainPolicy))
+                        goto bad_mapping;
+                
+                ref = OPENSSL_malloc(sizeof(X509_POLICY_REF));
+                if (!ref)
+                        goto bad_mapping;
+
+                ref->subjectDomainPolicy = map->subjectDomainPolicy;
+                map->subjectDomainPolicy = NULL;
+                ref->data = data;
+
+                if (!sk_X509_POLICY_REF_push(cache->maps, ref))
+                        goto bad_mapping;
+
+                ref = NULL;
+
+                }
+
+        ret = 1;
+        bad_mapping:
+        if (ret == -1)
+                x->ex_flags |= EXFLAG_INVALID_POLICY;
+        if (ref)
+                policy_map_free(ref);
+        if (ret <= 0)
+                {
+                sk_X509_POLICY_REF_pop_free(cache->maps, policy_map_free);
+                cache->maps = NULL;
+                }
+        sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free);
+        return ret;
+
+        }
diff --git a/src/lib/libssl/src/crypto/x509v3/pcy_node.c b/src/lib/libssl/src/crypto/x509v3/pcy_node.c
new file mode 100644
index 0000000000..dcc1554e29
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/pcy_node.c
@@ -0,0 +1,158 @@
+/* pcy_node.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 2004.
+ */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <openssl/asn1.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+#include "pcy_int.h"
+
+static int node_cmp(const X509_POLICY_NODE * const *a,
+                        const X509_POLICY_NODE * const *b)
+        {
+        return OBJ_cmp((*a)->data->valid_policy, (*b)->data->valid_policy);
+        }
+
+STACK_OF(X509_POLICY_NODE) *policy_node_cmp_new(void)
+        {
+        return sk_X509_POLICY_NODE_new(node_cmp);
+        }
+
+X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *nodes,
+                                        const ASN1_OBJECT *id)
+        {
+        X509_POLICY_DATA n;
+        X509_POLICY_NODE l;
+        int idx;
+
+        n.valid_policy = (ASN1_OBJECT *)id;
+        l.data = &n;
+
+        idx = sk_X509_POLICY_NODE_find(nodes, &l);
+        if (idx == -1)
+                return NULL;
+
+        return sk_X509_POLICY_NODE_value(nodes, idx);
+
+        }
+
+X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level,
+                                        const ASN1_OBJECT *id)
+        {
+        return tree_find_sk(level->nodes, id);
+        }
+
+X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
+                        X509_POLICY_DATA *data,
+                        X509_POLICY_NODE *parent,
+                        X509_POLICY_TREE *tree)
+        {
+        X509_POLICY_NODE *node;
+        node = OPENSSL_malloc(sizeof(X509_POLICY_NODE));
+        if (!node)
+                return NULL;
+        node->data = data;
+        node->parent = parent;
+        node->nchild = 0;
+        if (level)
+                {
+                if (OBJ_obj2nid(data->valid_policy) == NID_any_policy)
+                        {
+                        if (level->anyPolicy)
+                                goto node_error;
+                        level->anyPolicy = node;
+                        }
+                else
+                        {
+
+                        if (!level->nodes)
+                                level->nodes = policy_node_cmp_new();
+                        if (!level->nodes)
+                                goto node_error;
+                        if (!sk_X509_POLICY_NODE_push(level->nodes, node))
+                                goto node_error;
+                        }
+                }
+
+        if (tree)
+                {
+                if (!tree->extra_data)
+                         tree->extra_data = sk_X509_POLICY_DATA_new_null();
+                if (!tree->extra_data)
+                        goto node_error;
+                if (!sk_X509_POLICY_DATA_push(tree->extra_data, data))
+                        goto node_error;
+                }
+
+        if (parent)
+                parent->nchild++;
+
+        return node;
+
+        node_error:
+        policy_node_free(node);
+        return 0;
+
+        }
+
+void policy_node_free(X509_POLICY_NODE *node)
+        {
+        OPENSSL_free(node);
+        }
+
+
diff --git a/src/lib/libssl/src/crypto/x509v3/pcy_tree.c b/src/lib/libssl/src/crypto/x509v3/pcy_tree.c
new file mode 100644
index 0000000000..4fda1d419a
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/pcy_tree.c
@@ -0,0 +1,692 @@
+/* pcy_tree.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 2004.
+ */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "cryptlib.h"
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+#include "pcy_int.h"
+
+/* Initialize policy tree. Return values:
+ *  0 Some internal error occured.
+ * -1 Inconsistent or invalid extensions in certificates.
+ *  1 Tree initialized OK.
+ *  2 Policy tree is empty.
+ *  5 Tree OK and requireExplicitPolicy true.
+ *  6 Tree empty and requireExplicitPolicy true.
+ */
+
+static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
+                        unsigned int flags)
+        {
+        X509_POLICY_TREE *tree;
+        X509_POLICY_LEVEL *level;
+        const X509_POLICY_CACHE *cache;
+        X509_POLICY_DATA *data = NULL;
+        X509 *x;
+        int ret = 1;
+        int i, n;
+        int explicit_policy;
+        int any_skip;
+        int map_skip;
+        *ptree = NULL;
+        n = sk_X509_num(certs);
+
+        /* Disable policy mapping for now... */
+        flags |= X509_V_FLAG_INHIBIT_MAP;
+
+        if (flags & X509_V_FLAG_EXPLICIT_POLICY)
+                explicit_policy = 0;
+        else
+                explicit_policy = n + 1;
+
+        if (flags & X509_V_FLAG_INHIBIT_ANY)
+                any_skip = 0;
+        else
+                any_skip = n + 1;
+
+        if (flags & X509_V_FLAG_INHIBIT_MAP)
+                map_skip = 0;
+        else
+                map_skip = n + 1;
+
+        /* Can't do anything with just a trust anchor */
+        if (n == 1)
+                return 1;
+        /* First setup policy cache in all certificates apart from the
+         * trust anchor. Note any bad cache results on the way. Also can
+         * calculate explicit_policy value at this point.
+         */
+        for (i = n - 2; i >= 0; i--)
+                {
+                x = sk_X509_value(certs, i);
+                X509_check_purpose(x, -1, -1);
+                cache = policy_cache_set(x);
+                /* If cache NULL something bad happened: return immediately */
+                if (cache == NULL)
+                        return 0;
+                /* If inconsistent extensions keep a note of it but continue */
+                if (x->ex_flags & EXFLAG_INVALID_POLICY)
+                        ret = -1;
+                /* Otherwise if we have no data (hence no CertificatePolicies)
+                 * and haven't already set an inconsistent code note it.
+                 */
+                else if ((ret == 1) && !cache->data)
+                        ret = 2;
+                if (explicit_policy > 0)
+                        {
+                        explicit_policy--;
+                        if (!(x->ex_flags & EXFLAG_SS)
+                                && (cache->explicit_skip != -1)
+                                && (cache->explicit_skip < explicit_policy))
+                                explicit_policy = cache->explicit_skip;
+                        }
+                }
+
+        if (ret != 1)
+                {
+                if (ret == 2 && !explicit_policy)
+                        return 6;
+                return ret;
+                }
+
+
+        /* If we get this far initialize the tree */
+
+        tree = OPENSSL_malloc(sizeof(X509_POLICY_TREE));
+
+        if (!tree)
+                return 0;
+
+        tree->flags = 0;
+        tree->levels = OPENSSL_malloc(sizeof(X509_POLICY_LEVEL) * n);
+        tree->nlevel = 0;
+        tree->extra_data = NULL;
+        tree->auth_policies = NULL;
+        tree->user_policies = NULL;
+
+        if (!tree)
+                {
+                OPENSSL_free(tree);
+                return 0;
+                }
+
+        memset(tree->levels, 0, n * sizeof(X509_POLICY_LEVEL));
+
+        tree->nlevel = n;
+
+        level = tree->levels;
+
+        /* Root data: initialize to anyPolicy */
+
+        data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0);
+
+        if (!data || !level_add_node(level, data, NULL, tree))
+                goto bad_tree;
+
+        for (i = n - 2; i >= 0; i--)
+                {
+                level++;
+                x = sk_X509_value(certs, i);
+                cache = policy_cache_set(x);
+
+                CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
+                level->cert = x;
+
+                if (!cache->anyPolicy)
+                                level->flags |= X509_V_FLAG_INHIBIT_ANY;
+
+                /* Determine inhibit any and inhibit map flags */
+                if (any_skip == 0)
+                        {
+                        /* Any matching allowed if certificate is self
+                         * issued and not the last in the chain.
+                         */
+                        if (!(x->ex_flags & EXFLAG_SS) || (i == 0))
+                                level->flags |= X509_V_FLAG_INHIBIT_ANY;
+                        }
+                else
+                        {
+                        any_skip--;
+                        if ((cache->any_skip > 0)
+                                && (cache->any_skip < any_skip))
+                                any_skip = cache->any_skip;
+                        }
+
+                if (map_skip == 0)
+                        level->flags |= X509_V_FLAG_INHIBIT_MAP;
+                else
+                        {
+                        map_skip--;
+                        if ((cache->map_skip > 0)
+                                && (cache->map_skip < map_skip))
+                                map_skip = cache->map_skip;
+                        }
+
+
+                }
+
+        *ptree = tree;
+
+        if (explicit_policy)
+                return 1;
+        else
+                return 5;
+
+        bad_tree:
+
+        X509_policy_tree_free(tree);
+
+        return 0;
+
+        }
+
+/* This corresponds to RFC3280 XXXX XXXXX:
+ * link any data from CertificatePolicies onto matching parent
+ * or anyPolicy if no match.
+ */
+
+static int tree_link_nodes(X509_POLICY_LEVEL *curr,
+                                const X509_POLICY_CACHE *cache)
+        {
+        int i;
+        X509_POLICY_LEVEL *last;
+        X509_POLICY_DATA *data;
+        X509_POLICY_NODE *parent;
+        last = curr - 1;
+        for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++)
+                {
+                data = sk_X509_POLICY_DATA_value(cache->data, i);
+                /* If a node is mapped any it doesn't have a corresponding
+                 * CertificatePolicies entry. 
+                 * However such an identical node would be created
+                 * if anyPolicy matching is enabled because there would be
+                 * no match with the parent valid_policy_set. So we create
+                 * link because then it will have the mapping flags
+                 * right and we can prune it later.
+                 */
+                if ((data->flags & POLICY_DATA_FLAG_MAPPED_ANY)
+                        && !(curr->flags & X509_V_FLAG_INHIBIT_ANY))
+                        continue;
+                /* Look for matching node in parent */
+                parent = level_find_node(last, data->valid_policy);
+                /* If no match link to anyPolicy */
+                if (!parent)
+                        parent = last->anyPolicy;
+                if (parent && !level_add_node(curr, data, parent, NULL))
+                                return 0;
+                }
+        return 1;
+        }
+
+/* This corresponds to RFC3280 XXXX XXXXX:
+ * Create new data for any unmatched policies in the parent and link
+ * to anyPolicy.
+ */
+
+static int tree_link_any(X509_POLICY_LEVEL *curr,
+                        const X509_POLICY_CACHE *cache,
+                        X509_POLICY_TREE *tree)
+        {
+        int i;
+        X509_POLICY_DATA *data;
+        X509_POLICY_NODE *node;
+        X509_POLICY_LEVEL *last;
+
+        last = curr - 1;
+
+        for (i = 0; i < sk_X509_POLICY_NODE_num(last->nodes); i++)
+                {
+                node = sk_X509_POLICY_NODE_value(last->nodes, i);
+
+                /* Skip any node with any children: we only want unmathced
+                 * nodes.
+                 *
+                 * Note: need something better for policy mapping
+                 * because each node may have multiple children 
+                 */
+                if (node->nchild)
+                        continue;
+                /* Create a new node with qualifiers from anyPolicy and
+                 * id from unmatched node.
+                 */
+                data = policy_data_new(NULL, node->data->valid_policy, 
+                                                node_critical(node));
+
+                if (data == NULL)
+                        return 0;
+                data->qualifier_set = curr->anyPolicy->data->qualifier_set;
+                data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS;
+                if (!level_add_node(curr, data, node, tree))
+                        {
+                        policy_data_free(data);
+                        return 0;
+                        }
+                }
+        /* Finally add link to anyPolicy */
+        if (last->anyPolicy)
+                {
+                if (!level_add_node(curr, cache->anyPolicy,
+                                                last->anyPolicy, NULL))
+                        return 0;
+                }
+        return 1;
+        }
+
+/* Prune the tree: delete any child mapped child data on the current level
+ * then proceed up the tree deleting any data with no children. If we ever
+ * have no data on a level we can halt because the tree will be empty.
+ */
+
+static int tree_prune(X509_POLICY_TREE *tree, X509_POLICY_LEVEL *curr)
+        {
+        X509_POLICY_NODE *node;
+        int i;
+        for (i = sk_X509_POLICY_NODE_num(curr->nodes) - 1; i >= 0; i--)
+                {
+                node = sk_X509_POLICY_NODE_value(curr->nodes, i);
+                /* Delete any mapped data: see RFC3280 XXXX */
+                if (node->data->flags & POLICY_DATA_FLAG_MAP_MASK)
+                        {
+                        node->parent->nchild--;
+                        OPENSSL_free(node);
+                        (void)sk_X509_POLICY_NODE_delete(curr->nodes, i);
+                        }
+                }
+
+        for(;;) {
+                --curr;
+                for (i = sk_X509_POLICY_NODE_num(curr->nodes) - 1; i >= 0; i--)
+                        {
+                        node = sk_X509_POLICY_NODE_value(curr->nodes, i);
+                        if (node->nchild == 0)
+                                {
+                                node->parent->nchild--;
+                                OPENSSL_free(node);
+                                (void)sk_X509_POLICY_NODE_delete(curr->nodes, i);
+                                }
+                        }
+                if (curr->anyPolicy && !curr->anyPolicy->nchild)
+                        {
+                        if (curr->anyPolicy->parent)
+                                curr->anyPolicy->parent->nchild--;
+                        OPENSSL_free(curr->anyPolicy);
+                        curr->anyPolicy = NULL;
+                        }
+                if (curr == tree->levels)
+                        {
+                        /* If we zapped anyPolicy at top then tree is empty */
+                        if (!curr->anyPolicy)
+                                        return 2;
+                        return 1;
+                        }
+                }
+
+        return 1;
+
+        }
+
+static int tree_add_auth_node(STACK_OF(X509_POLICY_NODE) **pnodes,
+                                                 X509_POLICY_NODE *pcy)
+        {
+        if (!*pnodes)
+                {
+                *pnodes = policy_node_cmp_new();
+                if (!*pnodes)
+                        return 0;
+                }
+        else if (sk_X509_POLICY_NODE_find(*pnodes, pcy) != -1)
+                return 1;
+
+        if (!sk_X509_POLICY_NODE_push(*pnodes, pcy))
+                return 0;
+
+        return 1;
+
+        }
+
+/* Calculate the authority set based on policy tree.
+ * The 'pnodes' parameter is used as a store for the set of policy nodes
+ * used to calculate the user set. If the authority set is not anyPolicy
+ * then pnodes will just point to the authority set. If however the authority
+ * set is anyPolicy then the set of valid policies (other than anyPolicy)
+ * is store in pnodes. The return value of '2' is used in this case to indicate
+ * that pnodes should be freed.
+ */
+
+static int tree_calculate_authority_set(X509_POLICY_TREE *tree,
+                                        STACK_OF(X509_POLICY_NODE) **pnodes)
+        {
+        X509_POLICY_LEVEL *curr;
+        X509_POLICY_NODE *node, *anyptr;
+        STACK_OF(X509_POLICY_NODE) **addnodes;
+        int i, j;
+        curr = tree->levels + tree->nlevel - 1;
+
+        /* If last level contains anyPolicy set is anyPolicy */
+        if (curr->anyPolicy)
+                {
+                if (!tree_add_auth_node(&tree->auth_policies, curr->anyPolicy))
+                        return 0;
+                addnodes = pnodes;
+                }
+        else
+                /* Add policies to authority set */
+                addnodes = &tree->auth_policies;
+
+        curr = tree->levels;
+        for (i = 1; i < tree->nlevel; i++)
+                {
+                /* If no anyPolicy node on this this level it can't
+                 * appear on lower levels so end search.
+                 */
+                if (!(anyptr = curr->anyPolicy))
+                        break;
+                curr++;
+                for (j = 0; j < sk_X509_POLICY_NODE_num(curr->nodes); j++)
+                        {
+                        node = sk_X509_POLICY_NODE_value(curr->nodes, j);
+                        if ((node->parent == anyptr)
+                                && !tree_add_auth_node(addnodes, node))
+                                        return 0;
+                        }
+                }
+
+        if (addnodes == pnodes)
+                return 2;
+
+        *pnodes = tree->auth_policies;
+
+        return 1;
+        }
+
+static int tree_calculate_user_set(X509_POLICY_TREE *tree,
+                                STACK_OF(ASN1_OBJECT) *policy_oids,
+                                STACK_OF(X509_POLICY_NODE) *auth_nodes)
+        {
+        int i;
+        X509_POLICY_NODE *node;
+        ASN1_OBJECT *oid;
+
+        X509_POLICY_NODE *anyPolicy;
+        X509_POLICY_DATA *extra;
+
+        /* Check if anyPolicy present in authority constrained policy set:
+         * this will happen if it is a leaf node.
+         */
+
+        if (sk_ASN1_OBJECT_num(policy_oids) <= 0)
+                return 1;
+
+        anyPolicy = tree->levels[tree->nlevel - 1].anyPolicy;
+
+        for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++)
+                {
+                oid = sk_ASN1_OBJECT_value(policy_oids, i);
+                if (OBJ_obj2nid(oid) == NID_any_policy)
+                        {
+                        tree->flags |= POLICY_FLAG_ANY_POLICY;
+                        return 1;
+                        }
+                }
+
+        for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++)
+                {
+                oid = sk_ASN1_OBJECT_value(policy_oids, i);
+                node = tree_find_sk(auth_nodes, oid);
+                if (!node)
+                        {
+                        if (!anyPolicy)
+                                continue;
+                        /* Create a new node with policy ID from user set
+                         * and qualifiers from anyPolicy.
+                         */
+                        extra = policy_data_new(NULL, oid,
+                                                node_critical(anyPolicy));
+                        if (!extra)
+                                return 0;
+                        extra->qualifier_set = anyPolicy->data->qualifier_set;
+                        extra->flags = POLICY_DATA_FLAG_SHARED_QUALIFIERS
+                                                | POLICY_DATA_FLAG_EXTRA_NODE;
+                        node = level_add_node(NULL, extra, anyPolicy->parent,
+                                                tree);
+                        }
+                if (!tree->user_policies)
+                        {
+                        tree->user_policies = sk_X509_POLICY_NODE_new_null();
+                        if (!tree->user_policies)
+                                return 1;
+                        }
+                if (!sk_X509_POLICY_NODE_push(tree->user_policies, node))
+                        return 0;
+                }
+        return 1;
+
+        }
+
+static int tree_evaluate(X509_POLICY_TREE *tree)
+        {
+        int ret, i;
+        X509_POLICY_LEVEL *curr = tree->levels + 1;
+        const X509_POLICY_CACHE *cache;
+
+        for(i = 1; i < tree->nlevel; i++, curr++)
+                {
+                cache = policy_cache_set(curr->cert);
+                if (!tree_link_nodes(curr, cache))
+                        return 0;
+
+                if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY)
+                        && !tree_link_any(curr, cache, tree))
+                        return 0;
+                ret = tree_prune(tree, curr);
+                if (ret != 1)
+                        return ret;
+                }
+
+        return 1;
+
+        }
+
+static void exnode_free(X509_POLICY_NODE *node)
+        {
+        if (node->data && (node->data->flags & POLICY_DATA_FLAG_EXTRA_NODE))
+                OPENSSL_free(node);
+        }
+
+
+void X509_policy_tree_free(X509_POLICY_TREE *tree)
+        {
+        X509_POLICY_LEVEL *curr;
+        int i;
+
+        if (!tree)
+                return;
+
+        sk_X509_POLICY_NODE_free(tree->auth_policies);
+        sk_X509_POLICY_NODE_pop_free(tree->user_policies, exnode_free);
+
+        for(i = 0, curr = tree->levels; i < tree->nlevel; i++, curr++)
+                {
+                if (curr->cert)
+                        X509_free(curr->cert);
+                if (curr->nodes)
+                        sk_X509_POLICY_NODE_pop_free(curr->nodes,
+                                                policy_node_free);
+                if (curr->anyPolicy)
+                        policy_node_free(curr->anyPolicy);
+                }
+
+        if (tree->extra_data)
+                sk_X509_POLICY_DATA_pop_free(tree->extra_data,
+                                                policy_data_free);
+
+        OPENSSL_free(tree->levels);
+        OPENSSL_free(tree);
+
+        }
+
+/* Application policy checking function.
+ * Return codes:
+ *  0   Internal Error.
+ *  1   Successful.
+ * -1   One or more certificates contain invalid or inconsistent extensions
+ * -2   User constrained policy set empty and requireExplicit true.
+ */
+
+int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy,
+                        STACK_OF(X509) *certs,
+                        STACK_OF(ASN1_OBJECT) *policy_oids,
+                        unsigned int flags)
+        {
+        int ret;
+        X509_POLICY_TREE *tree = NULL;
+        STACK_OF(X509_POLICY_NODE) *nodes, *auth_nodes = NULL;
+        *ptree = NULL;
+
+        *pexplicit_policy = 0;
+        ret = tree_init(&tree, certs, flags);
+
+
+        switch (ret)
+                {
+
+                /* Tree empty requireExplicit False: OK */
+                case 2:
+                return 1;
+
+                /* Some internal error */
+                case 0:
+                return 0;
+
+                /* Tree empty requireExplicit True: Error */
+
+                case 6:
+                *pexplicit_policy = 1;
+                return -2;
+
+                /* Tree OK requireExplicit True: OK and continue */
+                case 5:
+                *pexplicit_policy = 1;
+                break;
+
+                /* Tree OK: continue */
+
+                case 1:
+                if (!tree)
+                        /*
+                         * tree_init() returns success and a null tree
+                         * if it's just looking at a trust anchor.
+                         * I'm not sure that returning success here is
+                         * correct, but I'm sure that reporting this
+                         * as an internal error which our caller
+                         * interprets as a malloc failure is wrong.
+                         */
+                        return 1;
+                break;
+                }
+
+        if (!tree) goto error;
+        ret = tree_evaluate(tree);
+
+        if (ret <= 0)
+                goto error;
+
+        /* Return value 2 means tree empty */
+        if (ret == 2)
+                {
+                X509_policy_tree_free(tree);
+                if (*pexplicit_policy)
+                        return -2;
+                else
+                        return 1;
+                }
+
+        /* Tree is not empty: continue */
+
+        ret = tree_calculate_authority_set(tree, &auth_nodes);
+
+        if (!ret)
+                goto error;
+
+        if (!tree_calculate_user_set(tree, policy_oids, auth_nodes))
+                goto error;
+        
+        if (ret == 2)
+                sk_X509_POLICY_NODE_free(auth_nodes);
+
+        if (tree)
+                *ptree = tree;
+
+        if (*pexplicit_policy)
+                {
+                nodes = X509_policy_tree_get0_user_policies(tree);
+                if (sk_X509_POLICY_NODE_num(nodes) <= 0)
+                        return -2;
+                }
+
+        return 1;
+
+        error:
+
+        X509_policy_tree_free(tree);
+
+        return 0;
+
+        }
+
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_addr.c b/src/lib/libssl/src/crypto/x509v3/v3_addr.c
new file mode 100644
index 0000000000..ed9847b307
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/v3_addr.c
@@ -0,0 +1,1280 @@
+/*
+ * Contributed to the OpenSSL Project by the American Registry for
+ * Internet Numbers ("ARIN").
+ */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ */
+
+/*
+ * Implementation of RFC 3779 section 2.2.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <assert.h>
+#include "cryptlib.h"
+#include <openssl/conf.h>
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
+#include <openssl/buffer.h>
+#include <openssl/x509v3.h>
+
+#ifndef OPENSSL_NO_RFC3779
+
+/*
+ * OpenSSL ASN.1 template translation of RFC 3779 2.2.3.
+ */
+
+ASN1_SEQUENCE(IPAddressRange) = {
+  ASN1_SIMPLE(IPAddressRange, min, ASN1_BIT_STRING),
+  ASN1_SIMPLE(IPAddressRange, max, ASN1_BIT_STRING)
+} ASN1_SEQUENCE_END(IPAddressRange)
+
+ASN1_CHOICE(IPAddressOrRange) = {
+  ASN1_SIMPLE(IPAddressOrRange, u.addressPrefix, ASN1_BIT_STRING),
+  ASN1_SIMPLE(IPAddressOrRange, u.addressRange,  IPAddressRange)
+} ASN1_CHOICE_END(IPAddressOrRange)
+
+ASN1_CHOICE(IPAddressChoice) = {
+  ASN1_SIMPLE(IPAddressChoice,      u.inherit,           ASN1_NULL),
+  ASN1_SEQUENCE_OF(IPAddressChoice, u.addressesOrRanges, IPAddressOrRange)
+} ASN1_CHOICE_END(IPAddressChoice)
+
+ASN1_SEQUENCE(IPAddressFamily) = {
+  ASN1_SIMPLE(IPAddressFamily, addressFamily,   ASN1_OCTET_STRING),
+  ASN1_SIMPLE(IPAddressFamily, ipAddressChoice, IPAddressChoice)
+} ASN1_SEQUENCE_END(IPAddressFamily)
+
+ASN1_ITEM_TEMPLATE(IPAddrBlocks) = 
+  ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
+                        IPAddrBlocks, IPAddressFamily)
+ASN1_ITEM_TEMPLATE_END(IPAddrBlocks)
+
+IMPLEMENT_ASN1_FUNCTIONS(IPAddressRange)
+IMPLEMENT_ASN1_FUNCTIONS(IPAddressOrRange)
+IMPLEMENT_ASN1_FUNCTIONS(IPAddressChoice)
+IMPLEMENT_ASN1_FUNCTIONS(IPAddressFamily)
+
+/*
+ * How much buffer space do we need for a raw address?
+ */
+#define ADDR_RAW_BUF_LEN        16
+
+/*
+ * What's the address length associated with this AFI?
+ */
+static int length_from_afi(const unsigned afi)
+{
+  switch (afi) {
+  case IANA_AFI_IPV4:
+    return 4;
+  case IANA_AFI_IPV6:
+    return 16;
+  default:
+    return 0;
+  }
+}
+
+/*
+ * Extract the AFI from an IPAddressFamily.
+ */
+unsigned v3_addr_get_afi(const IPAddressFamily *f)
+{
+  return ((f != NULL &&
+           f->addressFamily != NULL &&
+           f->addressFamily->data != NULL)
+          ? ((f->addressFamily->data[0] << 8) |
+             (f->addressFamily->data[1]))
+          : 0);
+}
+
+/*
+ * Expand the bitstring form of an address into a raw byte array.
+ * At the moment this is coded for simplicity, not speed.
+ */
+static void addr_expand(unsigned char *addr,
+                        const ASN1_BIT_STRING *bs,
+                        const int length,
+                        const unsigned char fill)
+{
+  assert(bs->length >= 0 && bs->length <= length);
+  if (bs->length > 0) {
+    memcpy(addr, bs->data, bs->length);
+    if ((bs->flags & 7) != 0) {
+      unsigned char mask = 0xFF >> (8 - (bs->flags & 7));
+      if (fill == 0)
+        addr[bs->length - 1] &= ~mask;
+      else
+        addr[bs->length - 1] |= mask;
+    }
+  }
+  memset(addr + bs->length, fill, length - bs->length);
+}
+
+/*
+ * Extract the prefix length from a bitstring.
+ */
+#define addr_prefixlen(bs) ((int) ((bs)->length * 8 - ((bs)->flags & 7)))
+
+/*
+ * i2r handler for one address bitstring.
+ */
+static int i2r_address(BIO *out,
+                       const unsigned afi,
+                       const unsigned char fill,
+                       const ASN1_BIT_STRING *bs)
+{
+  unsigned char addr[ADDR_RAW_BUF_LEN];
+  int i, n;
+
+  switch (afi) {
+  case IANA_AFI_IPV4:
+    addr_expand(addr, bs, 4, fill);
+    BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3]);
+    break;
+  case IANA_AFI_IPV6:
+    addr_expand(addr, bs, 16, fill);
+    for (n = 16; n > 1 && addr[n-1] == 0x00 && addr[n-2] == 0x00; n -= 2)
+      ;
+    for (i = 0; i < n; i += 2)
+      BIO_printf(out, "%x%s", (addr[i] << 8) | addr[i+1], (i < 14 ? ":" : ""));
+    if (i < 16)
+      BIO_puts(out, ":");
+    break;
+  default:
+    for (i = 0; i < bs->length; i++)
+      BIO_printf(out, "%s%02x", (i > 0 ? ":" : ""), bs->data[i]);
+    BIO_printf(out, "[%d]", (int) (bs->flags & 7));
+    break;
+  }
+  return 1;
+}
+
+/*
+ * i2r handler for a sequence of addresses and ranges.
+ */
+static int i2r_IPAddressOrRanges(BIO *out,
+                                 const int indent,
+                                 const IPAddressOrRanges *aors,
+                                 const unsigned afi)
+{
+  int i;
+  for (i = 0; i < sk_IPAddressOrRange_num(aors); i++) {
+    const IPAddressOrRange *aor = sk_IPAddressOrRange_value(aors, i);
+    BIO_printf(out, "%*s", indent, "");
+    switch (aor->type) {
+    case IPAddressOrRange_addressPrefix:
+      if (!i2r_address(out, afi, 0x00, aor->u.addressPrefix))
+        return 0;
+      BIO_printf(out, "/%d\n", addr_prefixlen(aor->u.addressPrefix));
+      continue;
+    case IPAddressOrRange_addressRange:
+      if (!i2r_address(out, afi, 0x00, aor->u.addressRange->min))
+        return 0;
+      BIO_puts(out, "-");
+      if (!i2r_address(out, afi, 0xFF, aor->u.addressRange->max))
+        return 0;
+      BIO_puts(out, "\n");
+      continue;
+    }
+  }
+  return 1;
+}
+
+/*
+ * i2r handler for an IPAddrBlocks extension.
+ */
+static int i2r_IPAddrBlocks(X509V3_EXT_METHOD *method,
+                            void *ext,
+                            BIO *out,
+                            int indent)
+{
+  const IPAddrBlocks *addr = ext;
+  int i;
+  for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
+    IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
+    const unsigned afi = v3_addr_get_afi(f);
+    switch (afi) {
+    case IANA_AFI_IPV4:
+      BIO_printf(out, "%*sIPv4", indent, "");
+      break;
+    case IANA_AFI_IPV6:
+      BIO_printf(out, "%*sIPv6", indent, "");
+      break;
+    default:
+      BIO_printf(out, "%*sUnknown AFI %u", indent, "", afi);
+      break;
+    }
+    if (f->addressFamily->length > 2) {
+      switch (f->addressFamily->data[2]) {
+      case   1:
+        BIO_puts(out, " (Unicast)");
+        break;
+      case   2:
+        BIO_puts(out, " (Multicast)");
+        break;
+      case   3:
+        BIO_puts(out, " (Unicast/Multicast)");
+        break;
+      case   4:
+        BIO_puts(out, " (MPLS)");
+        break;
+      case  64:
+        BIO_puts(out, " (Tunnel)");
+        break;
+      case  65:
+        BIO_puts(out, " (VPLS)");
+        break;
+      case  66:
+        BIO_puts(out, " (BGP MDT)");
+        break;
+      case 128:
+        BIO_puts(out, " (MPLS-labeled VPN)");
+        break;
+      default:  
+        BIO_printf(out, " (Unknown SAFI %u)",
+                   (unsigned) f->addressFamily->data[2]);
+        break;
+      }
+    }
+    switch (f->ipAddressChoice->type) {
+    case IPAddressChoice_inherit:
+      BIO_puts(out, ": inherit\n");
+      break;
+    case IPAddressChoice_addressesOrRanges:
+      BIO_puts(out, ":\n");
+      if (!i2r_IPAddressOrRanges(out,
+                                 indent + 2,
+                                 f->ipAddressChoice->u.addressesOrRanges,
+                                 afi))
+        return 0;
+      break;
+    }
+  }
+  return 1;
+}
+
+/*
+ * Sort comparison function for a sequence of IPAddressOrRange
+ * elements.
+ */
+static int IPAddressOrRange_cmp(const IPAddressOrRange *a,
+                                const IPAddressOrRange *b,
+                                const int length)
+{
+  unsigned char addr_a[ADDR_RAW_BUF_LEN], addr_b[ADDR_RAW_BUF_LEN];
+  int prefixlen_a = 0;
+  int prefixlen_b = 0;
+  int r;
+
+  switch (a->type) {
+  case IPAddressOrRange_addressPrefix:
+    addr_expand(addr_a, a->u.addressPrefix, length, 0x00);
+    prefixlen_a = addr_prefixlen(a->u.addressPrefix);
+    break;
+  case IPAddressOrRange_addressRange:
+    addr_expand(addr_a, a->u.addressRange->min, length, 0x00);
+    prefixlen_a = length * 8;
+    break;
+  }
+
+  switch (b->type) {
+  case IPAddressOrRange_addressPrefix:
+    addr_expand(addr_b, b->u.addressPrefix, length, 0x00);
+    prefixlen_b = addr_prefixlen(b->u.addressPrefix);
+    break;
+  case IPAddressOrRange_addressRange:
+    addr_expand(addr_b, b->u.addressRange->min, length, 0x00);
+    prefixlen_b = length * 8;
+    break;
+  }
+
+  if ((r = memcmp(addr_a, addr_b, length)) != 0)
+    return r;
+  else
+    return prefixlen_a - prefixlen_b;
+}
+
+/*
+ * IPv4-specific closure over IPAddressOrRange_cmp, since sk_sort()
+ * comparision routines are only allowed two arguments.
+ */
+static int v4IPAddressOrRange_cmp(const IPAddressOrRange * const *a,
+                                  const IPAddressOrRange * const *b)
+{
+  return IPAddressOrRange_cmp(*a, *b, 4);
+}
+
+/*
+ * IPv6-specific closure over IPAddressOrRange_cmp, since sk_sort()
+ * comparision routines are only allowed two arguments.
+ */
+static int v6IPAddressOrRange_cmp(const IPAddressOrRange * const *a,
+                                  const IPAddressOrRange * const *b)
+{
+  return IPAddressOrRange_cmp(*a, *b, 16);
+}
+
+/*
+ * Calculate whether a range collapses to a prefix.
+ * See last paragraph of RFC 3779 2.2.3.7.
+ */
+static int range_should_be_prefix(const unsigned char *min,
+                                  const unsigned char *max,
+                                  const int length)
+{
+  unsigned char mask;
+  int i, j;
+
+  for (i = 0; i < length && min[i] == max[i]; i++)
+    ;
+  for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xFF; j--)
+    ;
+  if (i < j)
+    return -1;
+  if (i > j)
+    return i * 8;
+  mask = min[i] ^ max[i];
+  switch (mask) {
+  case 0x01: j = 7; break;
+  case 0x03: j = 6; break;
+  case 0x07: j = 5; break;
+  case 0x0F: j = 4; break;
+  case 0x1F: j = 3; break;
+  case 0x3F: j = 2; break;
+  case 0x7F: j = 1; break;
+  default:   return -1;
+  }
+  if ((min[i] & mask) != 0 || (max[i] & mask) != mask)
+    return -1;
+  else
+    return i * 8 + j;
+}
+
+/*
+ * Construct a prefix.
+ */
+static int make_addressPrefix(IPAddressOrRange **result,
+                              unsigned char *addr,
+                              const int prefixlen)
+{
+  int bytelen = (prefixlen + 7) / 8, bitlen = prefixlen % 8;
+  IPAddressOrRange *aor = IPAddressOrRange_new();
+
+  if (aor == NULL)
+    return 0;
+  aor->type = IPAddressOrRange_addressPrefix;
+  if (aor->u.addressPrefix == NULL &&
+      (aor->u.addressPrefix = ASN1_BIT_STRING_new()) == NULL)
+    goto err;
+  if (!ASN1_BIT_STRING_set(aor->u.addressPrefix, addr, bytelen))
+    goto err;
+  aor->u.addressPrefix->flags &= ~7;
+  aor->u.addressPrefix->flags |= ASN1_STRING_FLAG_BITS_LEFT;
+  if (bitlen > 0) {
+    aor->u.addressPrefix->data[bytelen - 1] &= ~(0xFF >> bitlen);
+    aor->u.addressPrefix->flags |= 8 - bitlen;
+  }
+  
+  *result = aor;
+  return 1;
+
+ err:
+  IPAddressOrRange_free(aor);
+  return 0;
+}
+
+/*
+ * Construct a range.  If it can be expressed as a prefix,
+ * return a prefix instead.  Doing this here simplifies
+ * the rest of the code considerably.
+ */
+static int make_addressRange(IPAddressOrRange **result,
+                             unsigned char *min,
+                             unsigned char *max,
+                             const int length)
+{
+  IPAddressOrRange *aor;
+  int i, prefixlen;
+
+  if ((prefixlen = range_should_be_prefix(min, max, length)) >= 0)
+    return make_addressPrefix(result, min, prefixlen);
+
+  if ((aor = IPAddressOrRange_new()) == NULL)
+    return 0;
+  aor->type = IPAddressOrRange_addressRange;
+  assert(aor->u.addressRange == NULL);
+  if ((aor->u.addressRange = IPAddressRange_new()) == NULL)
+    goto err;
+  if (aor->u.addressRange->min == NULL &&
+      (aor->u.addressRange->min = ASN1_BIT_STRING_new()) == NULL)
+    goto err;
+  if (aor->u.addressRange->max == NULL &&
+      (aor->u.addressRange->max = ASN1_BIT_STRING_new()) == NULL)
+    goto err;
+
+  for (i = length; i > 0 && min[i - 1] == 0x00; --i)
+    ;
+  if (!ASN1_BIT_STRING_set(aor->u.addressRange->min, min, i))
+    goto err;
+  aor->u.addressRange->min->flags &= ~7;
+  aor->u.addressRange->min->flags |= ASN1_STRING_FLAG_BITS_LEFT;
+  if (i > 0) {
+    unsigned char b = min[i - 1];
+    int j = 1;
+    while ((b & (0xFFU >> j)) != 0) 
+      ++j;
+    aor->u.addressRange->min->flags |= 8 - j;
+  }
+
+  for (i = length; i > 0 && max[i - 1] == 0xFF; --i)
+    ;
+  if (!ASN1_BIT_STRING_set(aor->u.addressRange->max, max, i))
+    goto err;
+  aor->u.addressRange->max->flags &= ~7;
+  aor->u.addressRange->max->flags |= ASN1_STRING_FLAG_BITS_LEFT;
+  if (i > 0) {
+    unsigned char b = max[i - 1];
+    int j = 1;
+    while ((b & (0xFFU >> j)) != (0xFFU >> j))
+      ++j;
+    aor->u.addressRange->max->flags |= 8 - j;
+  }
+
+  *result = aor;
+  return 1;
+
+ err:
+  IPAddressOrRange_free(aor);
+  return 0;
+}
+
+/*
+ * Construct a new address family or find an existing one.
+ */
+static IPAddressFamily *make_IPAddressFamily(IPAddrBlocks *addr,
+                                             const unsigned afi,
+                                             const unsigned *safi)
+{
+  IPAddressFamily *f;
+  unsigned char key[3];
+  unsigned keylen;
+  int i;
+
+  key[0] = (afi >> 8) & 0xFF;
+  key[1] = afi & 0xFF;
+  if (safi != NULL) {
+    key[2] = *safi & 0xFF;
+    keylen = 3;
+  } else {
+    keylen = 2;
+  }
+
+  for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
+    f = sk_IPAddressFamily_value(addr, i);
+    assert(f->addressFamily->data != NULL);
+    if (f->addressFamily->length == keylen &&
+        !memcmp(f->addressFamily->data, key, keylen))
+      return f;
+  }
+
+  if ((f = IPAddressFamily_new()) == NULL)
+    goto err;
+  if (f->ipAddressChoice == NULL &&
+      (f->ipAddressChoice = IPAddressChoice_new()) == NULL)
+    goto err;
+  if (f->addressFamily == NULL && 
+      (f->addressFamily = ASN1_OCTET_STRING_new()) == NULL)
+    goto err;
+  if (!ASN1_OCTET_STRING_set(f->addressFamily, key, keylen))
+    goto err;
+  if (!sk_IPAddressFamily_push(addr, f))
+    goto err;
+
+  return f;
+
+ err:
+  IPAddressFamily_free(f);
+  return NULL;
+}
+
+/*
+ * Add an inheritance element.
+ */
+int v3_addr_add_inherit(IPAddrBlocks *addr,
+                        const unsigned afi,
+                        const unsigned *safi)
+{
+  IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
+  if (f == NULL ||
+      f->ipAddressChoice == NULL ||
+      (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
+       f->ipAddressChoice->u.addressesOrRanges != NULL))
+    return 0;
+  if (f->ipAddressChoice->type == IPAddressChoice_inherit &&
+      f->ipAddressChoice->u.inherit != NULL)
+    return 1;
+  if (f->ipAddressChoice->u.inherit == NULL &&
+      (f->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL)
+    return 0;
+  f->ipAddressChoice->type = IPAddressChoice_inherit;
+  return 1;
+}
+
+/*
+ * Construct an IPAddressOrRange sequence, or return an existing one.
+ */
+static IPAddressOrRanges *make_prefix_or_range(IPAddrBlocks *addr,
+                                               const unsigned afi,
+                                               const unsigned *safi)
+{
+  IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
+  IPAddressOrRanges *aors = NULL;
+
+  if (f == NULL ||
+      f->ipAddressChoice == NULL ||
+      (f->ipAddressChoice->type == IPAddressChoice_inherit &&
+       f->ipAddressChoice->u.inherit != NULL))
+    return NULL;
+  if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges)
+    aors = f->ipAddressChoice->u.addressesOrRanges;
+  if (aors != NULL)
+    return aors;
+  if ((aors = sk_IPAddressOrRange_new_null()) == NULL)
+    return NULL;
+  switch (afi) {
+  case IANA_AFI_IPV4:
+    sk_IPAddressOrRange_set_cmp_func(aors, v4IPAddressOrRange_cmp);
+    break;
+  case IANA_AFI_IPV6:
+    sk_IPAddressOrRange_set_cmp_func(aors, v6IPAddressOrRange_cmp);
+    break;
+  }
+  f->ipAddressChoice->type = IPAddressChoice_addressesOrRanges;
+  f->ipAddressChoice->u.addressesOrRanges = aors;
+  return aors;
+}
+
+/*
+ * Add a prefix.
+ */
+int v3_addr_add_prefix(IPAddrBlocks *addr,
+                       const unsigned afi,
+                       const unsigned *safi,
+                       unsigned char *a,
+                       const int prefixlen)
+{
+  IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
+  IPAddressOrRange *aor;
+  if (aors == NULL || !make_addressPrefix(&aor, a, prefixlen))
+    return 0;
+  if (sk_IPAddressOrRange_push(aors, aor))
+    return 1;
+  IPAddressOrRange_free(aor);
+  return 0;
+}
+
+/*
+ * Add a range.
+ */
+int v3_addr_add_range(IPAddrBlocks *addr,
+                      const unsigned afi,
+                      const unsigned *safi,
+                      unsigned char *min,
+                      unsigned char *max)
+{
+  IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
+  IPAddressOrRange *aor;
+  int length = length_from_afi(afi);
+  if (aors == NULL)
+    return 0;
+  if (!make_addressRange(&aor, min, max, length))
+    return 0;
+  if (sk_IPAddressOrRange_push(aors, aor))
+    return 1;
+  IPAddressOrRange_free(aor);
+  return 0;
+}
+
+/*
+ * Extract min and max values from an IPAddressOrRange.
+ */
+static void extract_min_max(IPAddressOrRange *aor,
+                            unsigned char *min,
+                            unsigned char *max,
+                            int length)
+{
+  assert(aor != NULL && min != NULL && max != NULL);
+  switch (aor->type) {
+  case IPAddressOrRange_addressPrefix:
+    addr_expand(min, aor->u.addressPrefix, length, 0x00);
+    addr_expand(max, aor->u.addressPrefix, length, 0xFF);
+    return;
+  case IPAddressOrRange_addressRange:
+    addr_expand(min, aor->u.addressRange->min, length, 0x00);
+    addr_expand(max, aor->u.addressRange->max, length, 0xFF);
+    return;
+  }
+}
+
+/*
+ * Public wrapper for extract_min_max().
+ */
+int v3_addr_get_range(IPAddressOrRange *aor,
+                      const unsigned afi,
+                      unsigned char *min,
+                      unsigned char *max,
+                      const int length)
+{
+  int afi_length = length_from_afi(afi);
+  if (aor == NULL || min == NULL || max == NULL ||
+      afi_length == 0 || length < afi_length ||
+      (aor->type != IPAddressOrRange_addressPrefix &&
+       aor->type != IPAddressOrRange_addressRange))
+    return 0;
+  extract_min_max(aor, min, max, afi_length);
+  return afi_length;
+}
+
+/*
+ * Sort comparision function for a sequence of IPAddressFamily.
+ *
+ * The last paragraph of RFC 3779 2.2.3.3 is slightly ambiguous about
+ * the ordering: I can read it as meaning that IPv6 without a SAFI
+ * comes before IPv4 with a SAFI, which seems pretty weird.  The
+ * examples in appendix B suggest that the author intended the
+ * null-SAFI rule to apply only within a single AFI, which is what I
+ * would have expected and is what the following code implements.
+ */
+static int IPAddressFamily_cmp(const IPAddressFamily * const *a_,
+                               const IPAddressFamily * const *b_)
+{
+  const ASN1_OCTET_STRING *a = (*a_)->addressFamily;
+  const ASN1_OCTET_STRING *b = (*b_)->addressFamily;
+  int len = ((a->length <= b->length) ? a->length : b->length);
+  int cmp = memcmp(a->data, b->data, len);
+  return cmp ? cmp : a->length - b->length;
+}
+
+/*
+ * Check whether an IPAddrBLocks is in canonical form.
+ */
+int v3_addr_is_canonical(IPAddrBlocks *addr)
+{
+  unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
+  unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
+  IPAddressOrRanges *aors;
+  int i, j, k;
+
+  /*
+   * Empty extension is cannonical.
+   */
+  if (addr == NULL)
+    return 1;
+
+  /*
+   * Check whether the top-level list is in order.
+   */
+  for (i = 0; i < sk_IPAddressFamily_num(addr) - 1; i++) {
+    const IPAddressFamily *a = sk_IPAddressFamily_value(addr, i);
+    const IPAddressFamily *b = sk_IPAddressFamily_value(addr, i + 1);
+    if (IPAddressFamily_cmp(&a, &b) >= 0)
+      return 0;
+  }
+
+  /*
+   * Top level's ok, now check each address family.
+   */
+  for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
+    IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
+    int length = length_from_afi(v3_addr_get_afi(f));
+
+    /*
+     * Inheritance is canonical.  Anything other than inheritance or
+     * a SEQUENCE OF IPAddressOrRange is an ASN.1 error or something.
+     */
+    if (f == NULL || f->ipAddressChoice == NULL)
+      return 0;
+    switch (f->ipAddressChoice->type) {
+    case IPAddressChoice_inherit:
+      continue;
+    case IPAddressChoice_addressesOrRanges:
+      break;
+    default:
+      return 0;
+    }
+
+    /*
+     * It's an IPAddressOrRanges sequence, check it.
+     */
+    aors = f->ipAddressChoice->u.addressesOrRanges;
+    if (sk_IPAddressOrRange_num(aors) == 0)
+      return 0;
+    for (j = 0; j < sk_IPAddressOrRange_num(aors) - 1; j++) {
+      IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
+      IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, j + 1);
+
+      extract_min_max(a, a_min, a_max, length);
+      extract_min_max(b, b_min, b_max, length);
+
+      /*
+       * Punt misordered list, overlapping start, or inverted range.
+       */
+      if (memcmp(a_min, b_min, length) >= 0 ||
+          memcmp(a_min, a_max, length) > 0 ||
+          memcmp(b_min, b_max, length) > 0)
+        return 0;
+
+      /*
+       * Punt if adjacent or overlapping.  Check for adjacency by
+       * subtracting one from b_min first.
+       */
+      for (k = length - 1; k >= 0 && b_min[k]-- == 0x00; k--)
+        ;
+      if (memcmp(a_max, b_min, length) >= 0)
+        return 0;
+
+      /*
+       * Check for range that should be expressed as a prefix.
+       */
+      if (a->type == IPAddressOrRange_addressRange &&
+          range_should_be_prefix(a_min, a_max, length) >= 0)
+        return 0;
+    }
+
+    /*
+     * Check final range to see if it should be a prefix.
+     */
+    j = sk_IPAddressOrRange_num(aors) - 1;
+    {
+      IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
+      if (a->type == IPAddressOrRange_addressRange) {
+        extract_min_max(a, a_min, a_max, length);
+        if (range_should_be_prefix(a_min, a_max, length) >= 0)
+          return 0;
+      }
+    }
+  }
+
+  /*
+   * If we made it through all that, we're happy.
+   */
+  return 1;
+}
+
+/*
+ * Whack an IPAddressOrRanges into canonical form.
+ */
+static int IPAddressOrRanges_canonize(IPAddressOrRanges *aors,
+                                      const unsigned afi)
+{
+  int i, j, length = length_from_afi(afi);
+
+  /*
+   * Sort the IPAddressOrRanges sequence.
+   */
+  sk_IPAddressOrRange_sort(aors);
+
+  /*
+   * Clean up representation issues, punt on duplicates or overlaps.
+   */
+  for (i = 0; i < sk_IPAddressOrRange_num(aors) - 1; i++) {
+    IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, i);
+    IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, i + 1);
+    unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
+    unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
+
+    extract_min_max(a, a_min, a_max, length);
+    extract_min_max(b, b_min, b_max, length);
+
+    /*
+     * Punt overlaps.
+     */
+    if (memcmp(a_max, b_min, length) >= 0)
+      return 0;
+
+    /*
+     * Merge if a and b are adjacent.  We check for
+     * adjacency by subtracting one from b_min first.
+     */
+    for (j = length - 1; j >= 0 && b_min[j]-- == 0x00; j--)
+      ;
+    if (memcmp(a_max, b_min, length) == 0) {
+      IPAddressOrRange *merged;
+      if (!make_addressRange(&merged, a_min, b_max, length))
+        return 0;
+      sk_IPAddressOrRange_set(aors, i, merged);
+      sk_IPAddressOrRange_delete(aors, i + 1);
+      IPAddressOrRange_free(a);
+      IPAddressOrRange_free(b);
+      --i;
+      continue;
+    }
+  }
+
+  return 1;
+}
+
+/*
+ * Whack an IPAddrBlocks extension into canonical form.
+ */
+int v3_addr_canonize(IPAddrBlocks *addr)
+{
+  int i;
+  for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
+    IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
+    if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
+        !IPAddressOrRanges_canonize(f->ipAddressChoice->u.addressesOrRanges,
+                                    v3_addr_get_afi(f)))
+      return 0;
+  }
+  sk_IPAddressFamily_sort(addr);
+  assert(v3_addr_is_canonical(addr));
+  return 1;
+}
+
+/*
+ * v2i handler for the IPAddrBlocks extension.
+ */
+static void *v2i_IPAddrBlocks(struct v3_ext_method *method,
+                              struct v3_ext_ctx *ctx,
+                              STACK_OF(CONF_VALUE) *values)
+{
+  static const char v4addr_chars[] = "0123456789.";
+  static const char v6addr_chars[] = "0123456789.:abcdefABCDEF";
+  IPAddrBlocks *addr = NULL;
+  char *s = NULL, *t;
+  int i;
+  
+  if ((addr = sk_IPAddressFamily_new(IPAddressFamily_cmp)) == NULL) {
+    X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
+    return NULL;
+  }
+
+  for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
+    CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
+    unsigned char min[ADDR_RAW_BUF_LEN], max[ADDR_RAW_BUF_LEN];
+    unsigned afi, *safi = NULL, safi_;
+    const char *addr_chars;
+    int prefixlen, i1, i2, delim, length;
+
+    if (       !name_cmp(val->name, "IPv4")) {
+      afi = IANA_AFI_IPV4;
+    } else if (!name_cmp(val->name, "IPv6")) {
+      afi = IANA_AFI_IPV6;
+    } else if (!name_cmp(val->name, "IPv4-SAFI")) {
+      afi = IANA_AFI_IPV4;
+      safi = &safi_;
+    } else if (!name_cmp(val->name, "IPv6-SAFI")) {
+      afi = IANA_AFI_IPV6;
+      safi = &safi_;
+    } else {
+      X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_NAME_ERROR);
+      X509V3_conf_err(val);
+      goto err;
+    }
+
+    switch (afi) {
+    case IANA_AFI_IPV4:
+      addr_chars = v4addr_chars;
+      break;
+    case IANA_AFI_IPV6:
+      addr_chars = v6addr_chars;
+      break;
+    }
+
+    length = length_from_afi(afi);
+
+    /*
+     * Handle SAFI, if any, and BUF_strdup() so we can null-terminate
+     * the other input values.
+     */
+    if (safi != NULL) {
+      *safi = strtoul(val->value, &t, 0);
+      t += strspn(t, " \t");
+      if (*safi > 0xFF || *t++ != ':') {
+        X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_SAFI);
+        X509V3_conf_err(val);
+        goto err;
+      }
+      t += strspn(t, " \t");
+      s = BUF_strdup(t);
+    } else {
+      s = BUF_strdup(val->value);
+    }
+    if (s == NULL) {
+      X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
+      goto err;
+    }
+
+    /*
+     * Check for inheritance.  Not worth additional complexity to
+     * optimize this (seldom-used) case.
+     */
+    if (!strcmp(s, "inherit")) {
+      if (!v3_addr_add_inherit(addr, afi, safi)) {
+        X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_INHERITANCE);
+        X509V3_conf_err(val);
+        goto err;
+      }
+      OPENSSL_free(s);
+      s = NULL;
+      continue;
+    }
+
+    i1 = strspn(s, addr_chars);
+    i2 = i1 + strspn(s + i1, " \t");
+    delim = s[i2++];
+    s[i1] = '\0';
+
+    if (a2i_ipadd(min, s) != length) {
+      X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_IPADDRESS);
+      X509V3_conf_err(val);
+      goto err;
+    }
+
+    switch (delim) {
+    case '/':
+      prefixlen = (int) strtoul(s + i2, &t, 10);
+      if (t == s + i2 || *t != '\0') {
+        X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR);
+        X509V3_conf_err(val);
+        goto err;
+      }
+      if (!v3_addr_add_prefix(addr, afi, safi, min, prefixlen)) {
+        X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
+        goto err;
+      }
+      break;
+    case '-':
+      i1 = i2 + strspn(s + i2, " \t");
+      i2 = i1 + strspn(s + i1, addr_chars);
+      if (i1 == i2 || s[i2] != '\0') {
+        X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR);
+        X509V3_conf_err(val);
+        goto err;
+      }
+      if (a2i_ipadd(max, s + i1) != length) {
+        X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_IPADDRESS);
+        X509V3_conf_err(val);
+        goto err;
+      }
+      if (!v3_addr_add_range(addr, afi, safi, min, max)) {
+        X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
+        goto err;
+      }
+      break;
+    case '\0':
+      if (!v3_addr_add_prefix(addr, afi, safi, min, length * 8)) {
+        X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
+        goto err;
+      }
+      break;
+    default:
+      X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR);
+      X509V3_conf_err(val);
+      goto err;
+    }
+
+    OPENSSL_free(s);
+    s = NULL;
+  }
+
+  /*
+   * Canonize the result, then we're done.
+   */
+  if (!v3_addr_canonize(addr))
+    goto err;    
+  return addr;
+
+ err:
+  OPENSSL_free(s);
+  sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free);
+  return NULL;
+}
+
+/*
+ * OpenSSL dispatch
+ */
+const X509V3_EXT_METHOD v3_addr = {
+  NID_sbgp_ipAddrBlock,         /* nid */
+  0,                            /* flags */
+  ASN1_ITEM_ref(IPAddrBlocks),  /* template */
+  0, 0, 0, 0,                   /* old functions, ignored */
+  0,                            /* i2s */
+  0,                            /* s2i */
+  0,                            /* i2v */
+  v2i_IPAddrBlocks,             /* v2i */
+  i2r_IPAddrBlocks,             /* i2r */
+  0,                            /* r2i */
+  NULL                          /* extension-specific data */
+};
+
+/*
+ * Figure out whether extension sues inheritance.
+ */
+int v3_addr_inherits(IPAddrBlocks *addr)
+{
+  int i;
+  if (addr == NULL)
+    return 0;
+  for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
+    IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
+    if (f->ipAddressChoice->type == IPAddressChoice_inherit)
+      return 1;
+  }
+  return 0;
+}
+
+/*
+ * Figure out whether parent contains child.
+ */
+static int addr_contains(IPAddressOrRanges *parent,
+                         IPAddressOrRanges *child,
+                         int length)
+{
+  unsigned char p_min[ADDR_RAW_BUF_LEN], p_max[ADDR_RAW_BUF_LEN];
+  unsigned char c_min[ADDR_RAW_BUF_LEN], c_max[ADDR_RAW_BUF_LEN];
+  int p, c;
+
+  if (child == NULL || parent == child)
+    return 1;
+  if (parent == NULL)
+    return 0;
+
+  p = 0;
+  for (c = 0; c < sk_IPAddressOrRange_num(child); c++) {
+    extract_min_max(sk_IPAddressOrRange_value(child, c),
+                    c_min, c_max, length);
+    for (;; p++) {
+      if (p >= sk_IPAddressOrRange_num(parent))
+        return 0;
+      extract_min_max(sk_IPAddressOrRange_value(parent, p),
+                      p_min, p_max, length);
+      if (memcmp(p_max, c_max, length) < 0)
+        continue;
+      if (memcmp(p_min, c_min, length) > 0)
+        return 0;
+      break;
+    }
+  }
+
+  return 1;
+}
+
+/*
+ * Test whether a is a subset of b.
+ */
+int v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b)
+{
+  int i;
+  if (a == NULL || a == b)
+    return 1;
+  if (b == NULL || v3_addr_inherits(a) || v3_addr_inherits(b))
+    return 0;
+  sk_IPAddressFamily_set_cmp_func(b, IPAddressFamily_cmp);
+  for (i = 0; i < sk_IPAddressFamily_num(a); i++) {
+    IPAddressFamily *fa = sk_IPAddressFamily_value(a, i);
+    int j = sk_IPAddressFamily_find(b, fa);
+    IPAddressFamily *fb = sk_IPAddressFamily_value(b, j);
+    if (!addr_contains(fb->ipAddressChoice->u.addressesOrRanges, 
+                       fa->ipAddressChoice->u.addressesOrRanges,
+                       length_from_afi(v3_addr_get_afi(fb))))
+      return 0;
+  }
+  return 1;
+}
+
+/*
+ * Validation error handling via callback.
+ */
+#define validation_err(_err_)           \
+  do {                                  \
+    if (ctx != NULL) {                  \
+      ctx->error = _err_;               \
+      ctx->error_depth = i;             \
+      ctx->current_cert = x;            \
+      ret = ctx->verify_cb(0, ctx);     \
+    } else {                            \
+      ret = 0;                          \
+    }                                   \
+    if (!ret)                           \
+      goto done;                        \
+  } while (0)
+
+/*
+ * Core code for RFC 3779 2.3 path validation.
+ */
+static int v3_addr_validate_path_internal(X509_STORE_CTX *ctx,
+                                          STACK_OF(X509) *chain,
+                                          IPAddrBlocks *ext)
+{
+  IPAddrBlocks *child = NULL;
+  int i, j, ret = 1;
+  X509 *x = NULL;
+
+  assert(chain != NULL && sk_X509_num(chain) > 0);
+  assert(ctx != NULL || ext != NULL);
+  assert(ctx == NULL || ctx->verify_cb != NULL);
+
+  /*
+   * Figure out where to start.  If we don't have an extension to
+   * check, we're done.  Otherwise, check canonical form and
+   * set up for walking up the chain.
+   */
+  if (ext != NULL) {
+    i = -1;
+  } else {
+    i = 0;
+    x = sk_X509_value(chain, i);
+    assert(x != NULL);
+    if ((ext = x->rfc3779_addr) == NULL)
+      goto done;
+  }
+  if (!v3_addr_is_canonical(ext))
+    validation_err(X509_V_ERR_INVALID_EXTENSION);
+  sk_IPAddressFamily_set_cmp_func(ext, IPAddressFamily_cmp);
+  if ((child = sk_IPAddressFamily_dup(ext)) == NULL) {
+    X509V3err(X509V3_F_V3_ADDR_VALIDATE_PATH_INTERNAL, ERR_R_MALLOC_FAILURE);
+    ret = 0;
+    goto done;
+  }
+
+  /*
+   * Now walk up the chain.  No cert may list resources that its
+   * parent doesn't list.
+   */
+  for (i++; i < sk_X509_num(chain); i++) {
+    x = sk_X509_value(chain, i);
+    assert(x != NULL);
+    if (!v3_addr_is_canonical(x->rfc3779_addr))
+      validation_err(X509_V_ERR_INVALID_EXTENSION);
+    if (x->rfc3779_addr == NULL) {
+      for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
+        IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
+        if (fc->ipAddressChoice->type != IPAddressChoice_inherit) {
+          validation_err(X509_V_ERR_UNNESTED_RESOURCE);
+          break;
+        }
+      }
+      continue;
+    }
+    sk_IPAddressFamily_set_cmp_func(x->rfc3779_addr, IPAddressFamily_cmp);
+    for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
+      IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
+      int k = sk_IPAddressFamily_find(x->rfc3779_addr, fc);
+      IPAddressFamily *fp = sk_IPAddressFamily_value(x->rfc3779_addr, k);
+      if (fp == NULL) {
+        if (fc->ipAddressChoice->type == IPAddressChoice_addressesOrRanges) {
+          validation_err(X509_V_ERR_UNNESTED_RESOURCE);
+          break;
+        }
+        continue;
+      }
+      if (fp->ipAddressChoice->type == IPAddressChoice_addressesOrRanges) {
+        if (fc->ipAddressChoice->type == IPAddressChoice_inherit ||
+            addr_contains(fp->ipAddressChoice->u.addressesOrRanges, 
+                          fc->ipAddressChoice->u.addressesOrRanges,
+                          length_from_afi(v3_addr_get_afi(fc))))
+          sk_IPAddressFamily_set(child, j, fp);
+        else
+          validation_err(X509_V_ERR_UNNESTED_RESOURCE);
+      }
+    }
+  }
+
+  /*
+   * Trust anchor can't inherit.
+   */
+  if (x->rfc3779_addr != NULL) {
+    for (j = 0; j < sk_IPAddressFamily_num(x->rfc3779_addr); j++) {
+      IPAddressFamily *fp = sk_IPAddressFamily_value(x->rfc3779_addr, j);
+      if (fp->ipAddressChoice->type == IPAddressChoice_inherit &&
+          sk_IPAddressFamily_find(child, fp) >= 0)
+        validation_err(X509_V_ERR_UNNESTED_RESOURCE);
+    }
+  }
+
+ done:
+  sk_IPAddressFamily_free(child);
+  return ret;
+}
+
+#undef validation_err
+
+/*
+ * RFC 3779 2.3 path validation -- called from X509_verify_cert().
+ */
+int v3_addr_validate_path(X509_STORE_CTX *ctx)
+{
+  return v3_addr_validate_path_internal(ctx, ctx->chain, NULL);
+}
+
+/*
+ * RFC 3779 2.3 path validation of an extension.
+ * Test whether chain covers extension.
+ */
+int v3_addr_validate_resource_set(STACK_OF(X509) *chain,
+                                  IPAddrBlocks *ext,
+                                  int allow_inheritance)
+{
+  if (ext == NULL)
+    return 1;
+  if (chain == NULL || sk_X509_num(chain) == 0)
+    return 0;
+  if (!allow_inheritance && v3_addr_inherits(ext))
+    return 0;
+  return v3_addr_validate_path_internal(NULL, chain, ext);
+}
+
+#endif /* OPENSSL_NO_RFC3779 */
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_asid.c b/src/lib/libssl/src/crypto/x509v3/v3_asid.c
new file mode 100644
index 0000000000..271930f967
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/v3_asid.c
@@ -0,0 +1,842 @@
+/*
+ * Contributed to the OpenSSL Project by the American Registry for
+ * Internet Numbers ("ARIN").
+ */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ */
+
+/*
+ * Implementation of RFC 3779 section 3.2.
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+#include "cryptlib.h"
+#include <openssl/conf.h>
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
+#include <openssl/x509v3.h>
+#include <openssl/x509.h>
+#include <openssl/bn.h>
+
+#ifndef OPENSSL_NO_RFC3779
+
+/*
+ * OpenSSL ASN.1 template translation of RFC 3779 3.2.3.
+ */
+
+ASN1_SEQUENCE(ASRange) = {
+  ASN1_SIMPLE(ASRange, min, ASN1_INTEGER),
+  ASN1_SIMPLE(ASRange, max, ASN1_INTEGER)
+} ASN1_SEQUENCE_END(ASRange)
+
+ASN1_CHOICE(ASIdOrRange) = {
+  ASN1_SIMPLE(ASIdOrRange, u.id,    ASN1_INTEGER),
+  ASN1_SIMPLE(ASIdOrRange, u.range, ASRange)
+} ASN1_CHOICE_END(ASIdOrRange)
+
+ASN1_CHOICE(ASIdentifierChoice) = {
+  ASN1_SIMPLE(ASIdentifierChoice,      u.inherit,       ASN1_NULL),
+  ASN1_SEQUENCE_OF(ASIdentifierChoice, u.asIdsOrRanges, ASIdOrRange)
+} ASN1_CHOICE_END(ASIdentifierChoice)
+
+ASN1_SEQUENCE(ASIdentifiers) = {
+  ASN1_EXP_OPT(ASIdentifiers, asnum, ASIdentifierChoice, 0),
+  ASN1_EXP_OPT(ASIdentifiers, rdi,   ASIdentifierChoice, 1)
+} ASN1_SEQUENCE_END(ASIdentifiers)
+
+IMPLEMENT_ASN1_FUNCTIONS(ASRange)
+IMPLEMENT_ASN1_FUNCTIONS(ASIdOrRange)
+IMPLEMENT_ASN1_FUNCTIONS(ASIdentifierChoice)
+IMPLEMENT_ASN1_FUNCTIONS(ASIdentifiers)
+
+/*
+ * i2r method for an ASIdentifierChoice.
+ */
+static int i2r_ASIdentifierChoice(BIO *out,
+                                  ASIdentifierChoice *choice,
+                                  int indent,
+                                  const char *msg)
+{
+  int i;
+  char *s;
+  if (choice == NULL)
+    return 1;
+  BIO_printf(out, "%*s%s:\n", indent, "", msg);
+  switch (choice->type) {
+  case ASIdentifierChoice_inherit:
+    BIO_printf(out, "%*sinherit\n", indent + 2, "");
+    break;
+  case ASIdentifierChoice_asIdsOrRanges:
+    for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges); i++) {
+      ASIdOrRange *aor = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
+      switch (aor->type) {
+      case ASIdOrRange_id:
+        if ((s = i2s_ASN1_INTEGER(NULL, aor->u.id)) == NULL)
+          return 0;
+        BIO_printf(out, "%*s%s\n", indent + 2, "", s);
+        OPENSSL_free(s);
+        break;
+      case ASIdOrRange_range:
+        if ((s = i2s_ASN1_INTEGER(NULL, aor->u.range->min)) == NULL)
+          return 0;
+        BIO_printf(out, "%*s%s-", indent + 2, "", s);
+        OPENSSL_free(s);
+        if ((s = i2s_ASN1_INTEGER(NULL, aor->u.range->max)) == NULL)
+          return 0;
+        BIO_printf(out, "%s\n", s);
+        OPENSSL_free(s);
+        break;
+      default:
+        return 0;
+      }
+    }
+    break;
+  default:
+    return 0;
+  }
+  return 1;
+}
+
+/*
+ * i2r method for an ASIdentifier extension.
+ */
+static int i2r_ASIdentifiers(X509V3_EXT_METHOD *method,
+                             void *ext,
+                             BIO *out,
+                             int indent)
+{
+  ASIdentifiers *asid = ext;
+  return (i2r_ASIdentifierChoice(out, asid->asnum, indent,
+                                 "Autonomous System Numbers") &&
+          i2r_ASIdentifierChoice(out, asid->rdi, indent,
+                                 "Routing Domain Identifiers"));
+}
+
+/*
+ * Sort comparision function for a sequence of ASIdOrRange elements.
+ */
+static int ASIdOrRange_cmp(const ASIdOrRange * const *a_,
+                           const ASIdOrRange * const *b_)
+{
+  const ASIdOrRange *a = *a_, *b = *b_;
+
+  assert((a->type == ASIdOrRange_id && a->u.id != NULL) ||
+         (a->type == ASIdOrRange_range && a->u.range != NULL &&
+          a->u.range->min != NULL && a->u.range->max != NULL));
+
+  assert((b->type == ASIdOrRange_id && b->u.id != NULL) ||
+         (b->type == ASIdOrRange_range && b->u.range != NULL &&
+          b->u.range->min != NULL && b->u.range->max != NULL));
+
+  if (a->type == ASIdOrRange_id && b->type == ASIdOrRange_id)
+    return ASN1_INTEGER_cmp(a->u.id, b->u.id);
+
+  if (a->type == ASIdOrRange_range && b->type == ASIdOrRange_range) {
+    int r = ASN1_INTEGER_cmp(a->u.range->min, b->u.range->min);
+    return r != 0 ? r : ASN1_INTEGER_cmp(a->u.range->max, b->u.range->max);
+  }
+
+  if (a->type == ASIdOrRange_id)
+    return ASN1_INTEGER_cmp(a->u.id, b->u.range->min);
+  else
+    return ASN1_INTEGER_cmp(a->u.range->min, b->u.id);
+}
+
+/*
+ * Add an inherit element.
+ */
+int v3_asid_add_inherit(ASIdentifiers *asid, int which)
+{
+  ASIdentifierChoice **choice;
+  if (asid == NULL)
+    return 0;
+  switch (which) {
+  case V3_ASID_ASNUM:
+    choice = &asid->asnum;
+    break;
+  case V3_ASID_RDI:
+    choice = &asid->rdi;
+    break;
+  default:
+    return 0;
+  }
+  if (*choice == NULL) {
+    if ((*choice = ASIdentifierChoice_new()) == NULL)
+      return 0;
+    assert((*choice)->u.inherit == NULL);
+    if (((*choice)->u.inherit = ASN1_NULL_new()) == NULL)
+      return 0;
+    (*choice)->type = ASIdentifierChoice_inherit;
+  }
+  return (*choice)->type == ASIdentifierChoice_inherit;
+}
+
+/*
+ * Add an ID or range to an ASIdentifierChoice.
+ */
+int v3_asid_add_id_or_range(ASIdentifiers *asid,
+                            int which,
+                            ASN1_INTEGER *min,
+                            ASN1_INTEGER *max)
+{
+  ASIdentifierChoice **choice;
+  ASIdOrRange *aor;
+  if (asid == NULL)
+    return 0;
+  switch (which) {
+  case V3_ASID_ASNUM:
+    choice = &asid->asnum;
+    break;
+  case V3_ASID_RDI:
+    choice = &asid->rdi;
+    break;
+  default:
+    return 0;
+  }
+  if (*choice != NULL && (*choice)->type == ASIdentifierChoice_inherit)
+    return 0;
+  if (*choice == NULL) {
+    if ((*choice = ASIdentifierChoice_new()) == NULL)
+      return 0;
+    assert((*choice)->u.asIdsOrRanges == NULL);
+    (*choice)->u.asIdsOrRanges = sk_ASIdOrRange_new(ASIdOrRange_cmp);
+    if ((*choice)->u.asIdsOrRanges == NULL)
+      return 0;
+    (*choice)->type = ASIdentifierChoice_asIdsOrRanges;
+  }
+  if ((aor = ASIdOrRange_new()) == NULL)
+    return 0;
+  if (max == NULL) {
+    aor->type = ASIdOrRange_id;
+    aor->u.id = min;
+  } else {
+    aor->type = ASIdOrRange_range;
+    if ((aor->u.range = ASRange_new()) == NULL)
+      goto err;
+    ASN1_INTEGER_free(aor->u.range->min);
+    aor->u.range->min = min;
+    ASN1_INTEGER_free(aor->u.range->max);
+    aor->u.range->max = max;
+  }
+  if (!(sk_ASIdOrRange_push((*choice)->u.asIdsOrRanges, aor)))
+    goto err;
+  return 1;
+
+ err:
+  ASIdOrRange_free(aor);
+  return 0;
+}
+
+/*
+ * Extract min and max values from an ASIdOrRange.
+ */
+static void extract_min_max(ASIdOrRange *aor,
+                            ASN1_INTEGER **min,
+                            ASN1_INTEGER **max)
+{
+  assert(aor != NULL && min != NULL && max != NULL);
+  switch (aor->type) {
+  case ASIdOrRange_id:
+    *min = aor->u.id;
+    *max = aor->u.id;
+    return;
+  case ASIdOrRange_range:
+    *min = aor->u.range->min;
+    *max = aor->u.range->max;
+    return;
+  }
+}
+
+/*
+ * Check whether an ASIdentifierChoice is in canonical form.
+ */
+static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
+{
+  ASN1_INTEGER *a_max_plus_one = NULL;
+  BIGNUM *bn = NULL;
+  int i, ret = 0;
+
+  /*
+   * Empty element or inheritance is canonical.
+   */
+  if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
+    return 1;
+
+  /*
+   * If not a list, or if empty list, it's broken.
+   */
+  if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
+      sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
+    return 0;
+
+  /*
+   * It's a list, check it.
+   */
+  for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
+    ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
+    ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
+    ASN1_INTEGER *a_min, *a_max, *b_min, *b_max;
+
+    extract_min_max(a, &a_min, &a_max);
+    extract_min_max(b, &b_min, &b_max);
+
+    /*
+     * Punt misordered list, overlapping start, or inverted range.
+     */
+    if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 ||
+        ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
+        ASN1_INTEGER_cmp(b_min, b_max) > 0)
+      goto done;
+
+    /*
+     * Calculate a_max + 1 to check for adjacency.
+     */
+    if ((bn == NULL && (bn = BN_new()) == NULL) ||
+        ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
+        !BN_add_word(bn, 1) ||
+        (a_max_plus_one = BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) {
+      X509V3err(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL,
+                ERR_R_MALLOC_FAILURE);
+      goto done;
+    }
+    
+    /*
+     * Punt if adjacent or overlapping.
+     */
+    if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) >= 0)
+      goto done;
+  }
+
+  ret = 1;
+
+ done:
+  ASN1_INTEGER_free(a_max_plus_one);
+  BN_free(bn);
+  return ret;
+}
+
+/*
+ * Check whether an ASIdentifier extension is in canonical form.
+ */
+int v3_asid_is_canonical(ASIdentifiers *asid)
+{
+  return (asid == NULL ||
+          (ASIdentifierChoice_is_canonical(asid->asnum) ||
+           ASIdentifierChoice_is_canonical(asid->rdi)));
+}
+
+/*
+ * Whack an ASIdentifierChoice into canonical form.
+ */
+static int ASIdentifierChoice_canonize(ASIdentifierChoice *choice)
+{
+  ASN1_INTEGER *a_max_plus_one = NULL;
+  BIGNUM *bn = NULL;
+  int i, ret = 0;
+
+  /*
+   * Nothing to do for empty element or inheritance.
+   */
+  if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
+    return 1;
+
+  /*
+   * We have a list.  Sort it.
+   */
+  assert(choice->type == ASIdentifierChoice_asIdsOrRanges);
+  sk_ASIdOrRange_sort(choice->u.asIdsOrRanges);
+
+  /*
+   * Now check for errors and suboptimal encoding, rejecting the
+   * former and fixing the latter.
+   */
+  for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
+    ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
+    ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
+    ASN1_INTEGER *a_min, *a_max, *b_min, *b_max;
+
+    extract_min_max(a, &a_min, &a_max);
+    extract_min_max(b, &b_min, &b_max);
+
+    /*
+     * Make sure we're properly sorted (paranoia).
+     */
+    assert(ASN1_INTEGER_cmp(a_min, b_min) <= 0);
+
+    /*
+     * Check for overlaps.
+     */
+    if (ASN1_INTEGER_cmp(a_max, b_min) >= 0) {
+      X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
+                X509V3_R_EXTENSION_VALUE_ERROR);
+      goto done;
+    }
+
+    /*
+     * Calculate a_max + 1 to check for adjacency.
+     */
+    if ((bn == NULL && (bn = BN_new()) == NULL) ||
+        ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
+        !BN_add_word(bn, 1) ||
+        (a_max_plus_one = BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) {
+      X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE, ERR_R_MALLOC_FAILURE);
+      goto done;
+    }
+    
+    /*
+     * If a and b are adjacent, merge them.
+     */
+    if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) == 0) {
+      ASRange *r;
+      switch (a->type) {
+      case ASIdOrRange_id:
+        if ((r = OPENSSL_malloc(sizeof(ASRange))) == NULL) {
+          X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
+                    ERR_R_MALLOC_FAILURE);
+          goto done;
+        }
+        r->min = a_min;
+        r->max = b_max;
+        a->type = ASIdOrRange_range;
+        a->u.range = r;
+        break;
+      case ASIdOrRange_range:
+        ASN1_INTEGER_free(a->u.range->max);
+        a->u.range->max = b_max;
+        break;
+      }
+      switch (b->type) {
+      case ASIdOrRange_id:
+        b->u.id = NULL;
+        break;
+      case ASIdOrRange_range:
+        b->u.range->max = NULL;
+        break;
+      }
+      ASIdOrRange_free(b);
+      sk_ASIdOrRange_delete(choice->u.asIdsOrRanges, i + 1);
+      i--;
+      continue;
+    }
+  }
+
+  assert(ASIdentifierChoice_is_canonical(choice)); /* Paranoia */
+
+  ret = 1;
+
+ done:
+  ASN1_INTEGER_free(a_max_plus_one);
+  BN_free(bn);
+  return ret;
+}
+
+/*
+ * Whack an ASIdentifier extension into canonical form.
+ */
+int v3_asid_canonize(ASIdentifiers *asid)
+{
+  return (asid == NULL ||
+          (ASIdentifierChoice_canonize(asid->asnum) &&
+           ASIdentifierChoice_canonize(asid->rdi)));
+}
+
+/*
+ * v2i method for an ASIdentifier extension.
+ */
+static void *v2i_ASIdentifiers(struct v3_ext_method *method,
+                               struct v3_ext_ctx *ctx,
+                               STACK_OF(CONF_VALUE) *values)
+{
+  ASIdentifiers *asid = NULL;
+  int i;
+
+  if ((asid = ASIdentifiers_new()) == NULL) {
+    X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
+    return NULL;
+  }
+
+  for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
+    CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
+    ASN1_INTEGER *min = NULL, *max = NULL;
+    int i1, i2, i3, is_range, which;
+
+    /*
+     * Figure out whether this is an AS or an RDI.
+     */
+    if (       !name_cmp(val->name, "AS")) {
+      which = V3_ASID_ASNUM;
+    } else if (!name_cmp(val->name, "RDI")) {
+      which = V3_ASID_RDI;
+    } else {
+      X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_EXTENSION_NAME_ERROR);
+      X509V3_conf_err(val);
+      goto err;
+    }
+
+    /*
+     * Handle inheritance.
+     */
+    if (!strcmp(val->value, "inherit")) {
+      if (v3_asid_add_inherit(asid, which))
+        continue;
+      X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_INVALID_INHERITANCE);
+      X509V3_conf_err(val);
+      goto err;
+    }
+
+    /*
+     * Number, range, or mistake, pick it apart and figure out which.
+     */
+    i1 = strspn(val->value, "0123456789");
+    if (val->value[i1] == '\0') {
+      is_range = 0;
+    } else {
+      is_range = 1;
+      i2 = i1 + strspn(val->value + i1, " \t");
+      if (val->value[i2] != '-') {
+        X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_INVALID_ASNUMBER);
+        X509V3_conf_err(val);
+        goto err;
+      }
+      i2++;
+      i2 = i2 + strspn(val->value + i2, " \t");
+      i3 = i2 + strspn(val->value + i2, "0123456789");
+      if (val->value[i3] != '\0') {
+        X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_INVALID_ASRANGE);
+        X509V3_conf_err(val);
+        goto err;
+      }
+    }
+
+    /*
+     * Syntax is ok, read and add it.
+     */
+    if (!is_range) {
+      if (!X509V3_get_value_int(val, &min)) {
+        X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
+        goto err;
+      }
+    } else {
+      char *s = BUF_strdup(val->value);
+      if (s == NULL) {
+        X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
+        goto err;
+      }
+      s[i1] = '\0';
+      min = s2i_ASN1_INTEGER(NULL, s);
+      max = s2i_ASN1_INTEGER(NULL, s + i2);
+      OPENSSL_free(s);
+      if (min == NULL || max == NULL) {
+        ASN1_INTEGER_free(min);
+        ASN1_INTEGER_free(max);
+        X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
+        goto err;
+      }
+    }
+    if (!v3_asid_add_id_or_range(asid, which, min, max)) {
+      ASN1_INTEGER_free(min);
+      ASN1_INTEGER_free(max);
+      X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
+      goto err;
+    }
+  }
+
+  /*
+   * Canonize the result, then we're done.
+   */
+  if (!v3_asid_canonize(asid))
+    goto err;
+  return asid;
+
+ err:
+  ASIdentifiers_free(asid);
+  return NULL;
+}
+
+/*
+ * OpenSSL dispatch.
+ */
+const X509V3_EXT_METHOD v3_asid = {
+  NID_sbgp_autonomousSysNum,    /* nid */
+  0,                            /* flags */
+  ASN1_ITEM_ref(ASIdentifiers), /* template */
+  0, 0, 0, 0,                   /* old functions, ignored */
+  0,                            /* i2s */
+  0,                            /* s2i */
+  0,                            /* i2v */
+  v2i_ASIdentifiers,            /* v2i */
+  i2r_ASIdentifiers,            /* i2r */
+  0,                            /* r2i */
+  NULL                          /* extension-specific data */
+};
+
+/*
+ * Figure out whether extension uses inheritance.
+ */
+int v3_asid_inherits(ASIdentifiers *asid)
+{
+  return (asid != NULL &&
+          ((asid->asnum != NULL &&
+            asid->asnum->type == ASIdentifierChoice_inherit) ||
+           (asid->rdi != NULL &&
+            asid->rdi->type == ASIdentifierChoice_inherit)));
+}
+
+/*
+ * Figure out whether parent contains child.
+ */
+static int asid_contains(ASIdOrRanges *parent, ASIdOrRanges *child)
+{
+  ASN1_INTEGER *p_min, *p_max, *c_min, *c_max;
+  int p, c;
+
+  if (child == NULL || parent == child)
+    return 1;
+  if (parent == NULL)
+    return 0;
+
+  p = 0;
+  for (c = 0; c < sk_ASIdOrRange_num(child); c++) {
+    extract_min_max(sk_ASIdOrRange_value(child, c), &c_min, &c_max);
+    for (;; p++) {
+      if (p >= sk_ASIdOrRange_num(parent))
+        return 0;
+      extract_min_max(sk_ASIdOrRange_value(parent, p), &p_min, &p_max);
+      if (ASN1_INTEGER_cmp(p_max, c_max) < 0)
+        continue;
+      if (ASN1_INTEGER_cmp(p_min, c_min) > 0)
+        return 0;
+      break;
+    }
+  }
+
+  return 1;
+}
+
+/*
+ * Test whether a is a subet of b.
+ */
+int v3_asid_subset(ASIdentifiers *a, ASIdentifiers *b)
+{
+  return (a == NULL ||
+          a == b ||
+          (b != NULL &&
+           !v3_asid_inherits(a) &&
+           !v3_asid_inherits(b) &&
+           asid_contains(b->asnum->u.asIdsOrRanges,
+                         a->asnum->u.asIdsOrRanges) &&
+           asid_contains(b->rdi->u.asIdsOrRanges,
+                         a->rdi->u.asIdsOrRanges)));
+}
+
+/*
+ * Validation error handling via callback.
+ */
+#define validation_err(_err_)           \
+  do {                                  \
+    if (ctx != NULL) {                  \
+      ctx->error = _err_;               \
+      ctx->error_depth = i;             \
+      ctx->current_cert = x;            \
+      ret = ctx->verify_cb(0, ctx);     \
+    } else {                            \
+      ret = 0;                          \
+    }                                   \
+    if (!ret)                           \
+      goto done;                        \
+  } while (0)
+
+/*
+ * Core code for RFC 3779 3.3 path validation.
+ */
+static int v3_asid_validate_path_internal(X509_STORE_CTX *ctx,
+                                          STACK_OF(X509) *chain,
+                                          ASIdentifiers *ext)
+{
+  ASIdOrRanges *child_as = NULL, *child_rdi = NULL;
+  int i, ret = 1, inherit_as = 0, inherit_rdi = 0;
+  X509 *x = NULL;
+
+  assert(chain != NULL && sk_X509_num(chain) > 0);
+  assert(ctx != NULL || ext != NULL);
+  assert(ctx == NULL || ctx->verify_cb != NULL);
+
+  /*
+   * Figure out where to start.  If we don't have an extension to
+   * check, we're done.  Otherwise, check canonical form and
+   * set up for walking up the chain.
+   */
+  if (ext != NULL) {
+    i = -1;
+  } else {
+    i = 0;
+    x = sk_X509_value(chain, i);
+    assert(x != NULL);
+    if ((ext = x->rfc3779_asid) == NULL)
+      goto done;
+  }
+  if (!v3_asid_is_canonical(ext))
+    validation_err(X509_V_ERR_INVALID_EXTENSION);
+  if (ext->asnum != NULL)  {
+    switch (ext->asnum->type) {
+    case ASIdentifierChoice_inherit:
+      inherit_as = 1;
+      break;
+    case ASIdentifierChoice_asIdsOrRanges:
+      child_as = ext->asnum->u.asIdsOrRanges;
+      break;
+    }
+  }
+  if (ext->rdi != NULL) {
+    switch (ext->rdi->type) {
+    case ASIdentifierChoice_inherit:
+      inherit_rdi = 1;
+      break;
+    case ASIdentifierChoice_asIdsOrRanges:
+      child_rdi = ext->rdi->u.asIdsOrRanges;
+      break;
+    }
+  }
+
+  /*
+   * Now walk up the chain.  Extensions must be in canonical form, no
+   * cert may list resources that its parent doesn't list.
+   */
+  for (i++; i < sk_X509_num(chain); i++) {
+    x = sk_X509_value(chain, i);
+    assert(x != NULL);
+    if (x->rfc3779_asid == NULL) {
+      if (child_as != NULL || child_rdi != NULL)
+        validation_err(X509_V_ERR_UNNESTED_RESOURCE);
+      continue;
+    }
+    if (!v3_asid_is_canonical(x->rfc3779_asid))
+      validation_err(X509_V_ERR_INVALID_EXTENSION);
+    if (x->rfc3779_asid->asnum == NULL && child_as != NULL) {
+      validation_err(X509_V_ERR_UNNESTED_RESOURCE);
+      child_as = NULL;
+      inherit_as = 0;
+    }
+    if (x->rfc3779_asid->asnum != NULL &&
+        x->rfc3779_asid->asnum->type == ASIdentifierChoice_asIdsOrRanges) {
+      if (inherit_as ||
+          asid_contains(x->rfc3779_asid->asnum->u.asIdsOrRanges, child_as)) {
+        child_as = x->rfc3779_asid->asnum->u.asIdsOrRanges;
+        inherit_as = 0;
+      } else {
+        validation_err(X509_V_ERR_UNNESTED_RESOURCE);
+      }
+    }
+    if (x->rfc3779_asid->rdi == NULL && child_rdi != NULL) {
+      validation_err(X509_V_ERR_UNNESTED_RESOURCE);
+      child_rdi = NULL;
+      inherit_rdi = 0;
+    }
+    if (x->rfc3779_asid->rdi != NULL &&
+        x->rfc3779_asid->rdi->type == ASIdentifierChoice_asIdsOrRanges) {
+      if (inherit_rdi ||
+          asid_contains(x->rfc3779_asid->rdi->u.asIdsOrRanges, child_rdi)) {
+        child_rdi = x->rfc3779_asid->rdi->u.asIdsOrRanges;
+        inherit_rdi = 0;
+      } else {
+        validation_err(X509_V_ERR_UNNESTED_RESOURCE);
+      }
+    }
+  }
+
+  /*
+   * Trust anchor can't inherit.
+   */
+  if (x->rfc3779_asid != NULL) {
+    if (x->rfc3779_asid->asnum != NULL &&
+        x->rfc3779_asid->asnum->type == ASIdentifierChoice_inherit)
+      validation_err(X509_V_ERR_UNNESTED_RESOURCE);
+    if (x->rfc3779_asid->rdi != NULL &&
+        x->rfc3779_asid->rdi->type == ASIdentifierChoice_inherit)
+      validation_err(X509_V_ERR_UNNESTED_RESOURCE);
+  }
+
+ done:
+  return ret;
+}
+
+#undef validation_err
+
+/*
+ * RFC 3779 3.3 path validation -- called from X509_verify_cert().
+ */
+int v3_asid_validate_path(X509_STORE_CTX *ctx)
+{
+  return v3_asid_validate_path_internal(ctx, ctx->chain, NULL);
+}
+
+/*
+ * RFC 3779 3.3 path validation of an extension.
+ * Test whether chain covers extension.
+ */
+int v3_asid_validate_resource_set(STACK_OF(X509) *chain,
+                                  ASIdentifiers *ext,
+                                  int allow_inheritance)
+{
+  if (ext == NULL)
+    return 1;
+  if (chain == NULL || sk_X509_num(chain) == 0)
+    return 0;
+  if (!allow_inheritance && v3_asid_inherits(ext))
+    return 0;
+  return v3_asid_validate_path_internal(NULL, chain, ext);
+}
+
+#endif /* OPENSSL_NO_RFC3779 */
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_ncons.c b/src/lib/libssl/src/crypto/x509v3/v3_ncons.c
new file mode 100644
index 0000000000..42e7f5a879
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/v3_ncons.c
@@ -0,0 +1,220 @@
+/* v3_ncons.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/asn1t.h>
+#include <openssl/conf.h>
+#include <openssl/x509v3.h>
+
+static void *v2i_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method,
+                                X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
+static int i2r_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method, 
+                                void *a, BIO *bp, int ind);
+static int do_i2r_name_constraints(X509V3_EXT_METHOD *method,
+                                STACK_OF(GENERAL_SUBTREE) *trees,
+                                        BIO *bp, int ind, char *name);
+static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip);
+
+const X509V3_EXT_METHOD v3_name_constraints = {
+        NID_name_constraints, 0,
+        ASN1_ITEM_ref(NAME_CONSTRAINTS),
+        0,0,0,0,
+        0,0,
+        0, v2i_NAME_CONSTRAINTS,
+        i2r_NAME_CONSTRAINTS,0,
+        NULL
+};
+
+ASN1_SEQUENCE(GENERAL_SUBTREE) = {
+        ASN1_SIMPLE(GENERAL_SUBTREE, base, GENERAL_NAME),
+        ASN1_IMP_OPT(GENERAL_SUBTREE, minimum, ASN1_INTEGER, 0),
+        ASN1_IMP_OPT(GENERAL_SUBTREE, maximum, ASN1_INTEGER, 1)
+} ASN1_SEQUENCE_END(GENERAL_SUBTREE)
+
+ASN1_SEQUENCE(NAME_CONSTRAINTS) = {
+        ASN1_IMP_SEQUENCE_OF_OPT(NAME_CONSTRAINTS, permittedSubtrees,
+                                                        GENERAL_SUBTREE, 0),
+        ASN1_IMP_SEQUENCE_OF_OPT(NAME_CONSTRAINTS, excludedSubtrees,
+                                                        GENERAL_SUBTREE, 1),
+} ASN1_SEQUENCE_END(NAME_CONSTRAINTS)
+        
+
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(GENERAL_SUBTREE)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(NAME_CONSTRAINTS)
+
+static void *v2i_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method,
+                                X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
+        {
+        int i;
+        CONF_VALUE tval, *val;
+        STACK_OF(GENERAL_SUBTREE) **ptree = NULL;
+        NAME_CONSTRAINTS *ncons = NULL;
+        GENERAL_SUBTREE *sub = NULL;
+        ncons = NAME_CONSTRAINTS_new();
+        if (!ncons)
+                goto memerr;
+        for(i = 0; i < sk_CONF_VALUE_num(nval); i++)
+                {
+                val = sk_CONF_VALUE_value(nval, i);
+                if (!strncmp(val->name, "permitted", 9) && val->name[9])
+                        {
+                        ptree = &ncons->permittedSubtrees;
+                        tval.name = val->name + 10;
+                        }
+                else if (!strncmp(val->name, "excluded", 8) && val->name[8])
+                        {
+                        ptree = &ncons->excludedSubtrees;
+                        tval.name = val->name + 9;
+                        }
+                else
+                        {
+                        X509V3err(X509V3_F_V2I_NAME_CONSTRAINTS, X509V3_R_INVALID_SYNTAX);
+                        goto err;
+                        }
+                tval.value = val->value;
+                sub = GENERAL_SUBTREE_new();
+                if (!v2i_GENERAL_NAME_ex(sub->base, method, ctx, &tval, 1))
+                        goto err;
+                if (!*ptree)
+                        *ptree = sk_GENERAL_SUBTREE_new_null();
+                if (!*ptree || !sk_GENERAL_SUBTREE_push(*ptree, sub))
+                        goto memerr;
+                sub = NULL;
+                }
+
+        return ncons;
+
+        memerr:
+        X509V3err(X509V3_F_V2I_NAME_CONSTRAINTS, ERR_R_MALLOC_FAILURE);
+        err:
+        if (ncons)
+                NAME_CONSTRAINTS_free(ncons);
+        if (sub)
+                GENERAL_SUBTREE_free(sub);
+
+        return NULL;
+        }
+                        
+
+        
+
+static int i2r_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method,
+                                void *a, BIO *bp, int ind)
+        {
+        NAME_CONSTRAINTS *ncons = a;
+        do_i2r_name_constraints(method, ncons->permittedSubtrees,
+                                        bp, ind, "Permitted");
+        do_i2r_name_constraints(method, ncons->excludedSubtrees,
+                                        bp, ind, "Excluded");
+        return 1;
+        }
+
+static int do_i2r_name_constraints(X509V3_EXT_METHOD *method,
+                                STACK_OF(GENERAL_SUBTREE) *trees,
+                                        BIO *bp, int ind, char *name)
+        {
+        GENERAL_SUBTREE *tree;
+        int i;
+        if (sk_GENERAL_SUBTREE_num(trees) > 0)
+                BIO_printf(bp, "%*s%s:\n", ind, "", name);
+        for(i = 0; i < sk_GENERAL_SUBTREE_num(trees); i++)
+                {
+                tree = sk_GENERAL_SUBTREE_value(trees, i);
+                BIO_printf(bp, "%*s", ind + 2, "");
+                if (tree->base->type == GEN_IPADD)
+                        print_nc_ipadd(bp, tree->base->d.ip);
+                else
+                        GENERAL_NAME_print(bp, tree->base);
+                tree = sk_GENERAL_SUBTREE_value(trees, i);
+                BIO_puts(bp, "\n");
+                }
+        return 1;
+        }
+
+static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip)
+        {
+        int i, len;
+        unsigned char *p;
+        p = ip->data;
+        len = ip->length;
+        BIO_puts(bp, "IP:");
+        if(len == 8)
+                {
+                BIO_printf(bp, "%d.%d.%d.%d/%d.%d.%d.%d",
+                                p[0], p[1], p[2], p[3],
+                                p[4], p[5], p[6], p[7]);
+                }
+        else if(len == 32)
+                {
+                for (i = 0; i < 16; i++)
+                        {
+                        BIO_printf(bp, "%X", p[0] << 8 | p[1]);
+                        p += 2;
+                        if (i == 7)
+                                BIO_puts(bp, "/");
+                        else if (i != 15)
+                                BIO_puts(bp, ":");
+                        }
+                }
+        else
+                BIO_printf(bp, "IP Address:<invalid>");
+        return 1;
+        }
+
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_pcons.c b/src/lib/libssl/src/crypto/x509v3/v3_pcons.c
new file mode 100644
index 0000000000..13248c2ada
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/v3_pcons.c
@@ -0,0 +1,136 @@
+/* v3_pcons.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
+#include <openssl/conf.h>
+#include <openssl/x509v3.h>
+
+static STACK_OF(CONF_VALUE) *i2v_POLICY_CONSTRAINTS(X509V3_EXT_METHOD *method,
+                                void *bcons, STACK_OF(CONF_VALUE) *extlist);
+static void *v2i_POLICY_CONSTRAINTS(X509V3_EXT_METHOD *method,
+                                X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
+
+const X509V3_EXT_METHOD v3_policy_constraints = {
+NID_policy_constraints, 0,
+ASN1_ITEM_ref(POLICY_CONSTRAINTS),
+0,0,0,0,
+0,0,
+i2v_POLICY_CONSTRAINTS,
+v2i_POLICY_CONSTRAINTS,
+NULL,NULL,
+NULL
+};
+
+ASN1_SEQUENCE(POLICY_CONSTRAINTS) = {
+        ASN1_IMP_OPT(POLICY_CONSTRAINTS, requireExplicitPolicy, ASN1_INTEGER,0),
+        ASN1_IMP_OPT(POLICY_CONSTRAINTS, inhibitPolicyMapping, ASN1_INTEGER,1)
+} ASN1_SEQUENCE_END(POLICY_CONSTRAINTS)
+
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(POLICY_CONSTRAINTS)
+
+
+static STACK_OF(CONF_VALUE) *i2v_POLICY_CONSTRAINTS(X509V3_EXT_METHOD *method,
+             void *a, STACK_OF(CONF_VALUE) *extlist)
+{
+        POLICY_CONSTRAINTS *pcons = a;
+        X509V3_add_value_int("Require Explicit Policy",
+                        pcons->requireExplicitPolicy, &extlist);
+        X509V3_add_value_int("Inhibit Policy Mapping",
+                        pcons->inhibitPolicyMapping, &extlist);
+        return extlist;
+}
+
+static void *v2i_POLICY_CONSTRAINTS(X509V3_EXT_METHOD *method,
+             X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values)
+{
+        POLICY_CONSTRAINTS *pcons=NULL;
+        CONF_VALUE *val;
+        int i;
+        if(!(pcons = POLICY_CONSTRAINTS_new())) {
+                X509V3err(X509V3_F_V2I_POLICY_CONSTRAINTS, ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+        for(i = 0; i < sk_CONF_VALUE_num(values); i++) {
+                val = sk_CONF_VALUE_value(values, i);
+                if(!strcmp(val->name, "requireExplicitPolicy")) {
+                        if(!X509V3_get_value_int(val,
+                                &pcons->requireExplicitPolicy)) goto err;
+                } else if(!strcmp(val->name, "inhibitPolicyMapping")) {
+                        if(!X509V3_get_value_int(val,
+                                &pcons->inhibitPolicyMapping)) goto err;
+                } else {
+                        X509V3err(X509V3_F_V2I_POLICY_CONSTRAINTS, X509V3_R_INVALID_NAME);
+                        X509V3_conf_err(val);
+                        goto err;
+                }
+        }
+        if (!pcons->inhibitPolicyMapping && !pcons->requireExplicitPolicy) {
+                X509V3err(X509V3_F_V2I_POLICY_CONSTRAINTS, X509V3_R_ILLEGAL_EMPTY_EXTENSION);
+                goto err;
+        }
+
+        return pcons;
+        err:
+        POLICY_CONSTRAINTS_free(pcons);
+        return NULL;
+}
+
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_pmaps.c b/src/lib/libssl/src/crypto/x509v3/v3_pmaps.c
new file mode 100644
index 0000000000..626303264f
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x509v3/v3_pmaps.c
@@ -0,0 +1,153 @@
+/* v3_pmaps.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/asn1t.h>
+#include <openssl/conf.h>
+#include <openssl/x509v3.h>
+
+static void *v2i_POLICY_MAPPINGS(X509V3_EXT_METHOD *method,
+                                X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
+static STACK_OF(CONF_VALUE) *i2v_POLICY_MAPPINGS(X509V3_EXT_METHOD *method,
+                                void *pmps, STACK_OF(CONF_VALUE) *extlist);
+
+const X509V3_EXT_METHOD v3_policy_mappings = {
+        NID_policy_mappings, 0,
+        ASN1_ITEM_ref(POLICY_MAPPINGS),
+        0,0,0,0,
+        0,0,
+        i2v_POLICY_MAPPINGS,
+        v2i_POLICY_MAPPINGS,
+        0,0,
+        NULL
+};
+
+ASN1_SEQUENCE(POLICY_MAPPING) = {
+        ASN1_SIMPLE(POLICY_MAPPING, issuerDomainPolicy, ASN1_OBJECT),
+        ASN1_SIMPLE(POLICY_MAPPING, subjectDomainPolicy, ASN1_OBJECT)
+} ASN1_SEQUENCE_END(POLICY_MAPPING)
+
+ASN1_ITEM_TEMPLATE(POLICY_MAPPINGS) = 
+        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, POLICY_MAPPINGS,
+                                                                POLICY_MAPPING)
+ASN1_ITEM_TEMPLATE_END(POLICY_MAPPINGS)
+
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(POLICY_MAPPING)
+
+
+static STACK_OF(CONF_VALUE) *i2v_POLICY_MAPPINGS(X509V3_EXT_METHOD *method,
+                void *a, STACK_OF(CONF_VALUE) *ext_list)
+{
+        POLICY_MAPPINGS *pmaps = a;
+        POLICY_MAPPING *pmap;
+        int i;
+        char obj_tmp1[80];
+        char obj_tmp2[80];
+        for(i = 0; i < sk_POLICY_MAPPING_num(pmaps); i++) {
+                pmap = sk_POLICY_MAPPING_value(pmaps, i);
+                i2t_ASN1_OBJECT(obj_tmp1, 80, pmap->issuerDomainPolicy);
+                i2t_ASN1_OBJECT(obj_tmp2, 80, pmap->subjectDomainPolicy);
+                X509V3_add_value(obj_tmp1, obj_tmp2, &ext_list);
+        }
+        return ext_list;
+}
+
+static void *v2i_POLICY_MAPPINGS(X509V3_EXT_METHOD *method,
+                                X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
+{
+        POLICY_MAPPINGS *pmaps;
+        POLICY_MAPPING *pmap;
+        ASN1_OBJECT *obj1, *obj2;
+        CONF_VALUE *val;
+        int i;
+
+        if(!(pmaps = sk_POLICY_MAPPING_new_null())) {
+                X509V3err(X509V3_F_V2I_POLICY_MAPPINGS,ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
+
+        for(i = 0; i < sk_CONF_VALUE_num(nval); i++) {
+                val = sk_CONF_VALUE_value(nval, i);
+                if(!val->value || !val->name) {
+                        sk_POLICY_MAPPING_pop_free(pmaps, POLICY_MAPPING_free);
+                        X509V3err(X509V3_F_V2I_POLICY_MAPPINGS,X509V3_R_INVALID_OBJECT_IDENTIFIER);
+                        X509V3_conf_err(val);
+                        return NULL;
+                }
+                obj1 = OBJ_txt2obj(val->name, 0);
+                obj2 = OBJ_txt2obj(val->value, 0);
+                if(!obj1 || !obj2) {
+                        sk_POLICY_MAPPING_pop_free(pmaps, POLICY_MAPPING_free);
+                        X509V3err(X509V3_F_V2I_POLICY_MAPPINGS,X509V3_R_INVALID_OBJECT_IDENTIFIER);
+                        X509V3_conf_err(val);
+                        return NULL;
+                }
+                pmap = POLICY_MAPPING_new();
+                if (!pmap) {
+                        sk_POLICY_MAPPING_pop_free(pmaps, POLICY_MAPPING_free);
+                        X509V3err(X509V3_F_V2I_POLICY_MAPPINGS,ERR_R_MALLOC_FAILURE);
+                        return NULL;
+                }
+                pmap->issuerDomainPolicy = obj1;
+                pmap->subjectDomainPolicy = obj2;
+                sk_POLICY_MAPPING_push(pmaps, pmap);
+        }
+        return pmaps;
+}
diff --git a/src/lib/libssl/src/crypto/x86_64cpuid.pl b/src/lib/libssl/src/crypto/x86_64cpuid.pl
new file mode 100644
index 0000000000..2616a03da6
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x86_64cpuid.pl
@@ -0,0 +1,159 @@
+#!/usr/bin/env perl
+
+$output=shift;
+$masm=1 if ($output =~ /\.asm/);
+open STDOUT,">$output" || die "can't open $output: $!";
+
+print<<___ if(defined($masm));
+_TEXT   SEGMENT
+PUBLIC  OPENSSL_rdtsc
+
+PUBLIC  OPENSSL_atomic_add
+ALIGN   16
+OPENSSL_atomic_add      PROC
+        mov     eax,DWORD PTR[rcx]
+\$Lspin:        lea     r8,DWORD PTR[rdx+rax]
+lock    cmpxchg DWORD PTR[rcx],r8d
+        jne     \$Lspin
+        mov     eax,r8d
+        cdqe    
+        ret
+OPENSSL_atomic_add      ENDP
+
+PUBLIC  OPENSSL_wipe_cpu
+ALIGN   16
+OPENSSL_wipe_cpu        PROC
+        pxor    xmm0,xmm0
+        pxor    xmm1,xmm1
+        pxor    xmm2,xmm2
+        pxor    xmm3,xmm3
+        pxor    xmm4,xmm4
+        pxor    xmm5,xmm5
+        xor     rcx,rcx
+        xor     rdx,rdx
+        xor     r8,r8
+        xor     r9,r9
+        xor     r10,r10
+        xor     r11,r11
+        lea     rax,QWORD PTR[rsp+8]
+        ret
+OPENSSL_wipe_cpu        ENDP
+_TEXT   ENDS
+
+CRT\$XIU        SEGMENT
+EXTRN   OPENSSL_cpuid_setup:PROC
+DQ      OPENSSL_cpuid_setup
+CRT\$XIU        ENDS
+
+___
+print<<___ if(!defined($masm));
+.text
+
+.globl  OPENSSL_atomic_add
+.type   OPENSSL_atomic_add,\@function
+.align  16
+OPENSSL_atomic_add:
+        movl    (%rdi),%eax
+.Lspin: leaq    (%rsi,%rax),%r8
+lock;   cmpxchgl        %r8d,(%rdi)
+        jne     .Lspin
+        movl    %r8d,%eax
+        .byte   0x48,0x98
+        ret
+.size   OPENSSL_atomic_add,.-OPENSSL_atomic_add
+
+.globl  OPENSSL_wipe_cpu
+.type   OPENSSL_wipe_cpu,\@function
+.align  16
+OPENSSL_wipe_cpu:
+        pxor    %xmm0,%xmm0
+        pxor    %xmm1,%xmm1
+        pxor    %xmm2,%xmm2
+        pxor    %xmm3,%xmm3
+        pxor    %xmm4,%xmm4
+        pxor    %xmm5,%xmm5
+        pxor    %xmm6,%xmm6
+        pxor    %xmm7,%xmm7
+        pxor    %xmm8,%xmm8
+        pxor    %xmm9,%xmm9
+        pxor    %xmm10,%xmm10
+        pxor    %xmm11,%xmm11
+        pxor    %xmm12,%xmm12
+        pxor    %xmm13,%xmm13
+        pxor    %xmm14,%xmm14
+        pxor    %xmm15,%xmm15
+        xorq    %rcx,%rcx
+        xorq    %rdx,%rdx
+        xorq    %rsi,%rsi
+        xorq    %rdi,%rdi
+        xorq    %r8,%r8
+        xorq    %r9,%r9
+        xorq    %r10,%r10
+        xorq    %r11,%r11
+        leaq    8(%rsp),%rax
+        ret
+.size   OPENSSL_wipe_cpu,.-OPENSSL_wipe_cpu
+
+.section        .init
+        call    OPENSSL_cpuid_setup
+
+___
+
+open STDOUT,"| $^X perlasm/x86_64-xlate.pl $output";
+print<<___;
+.text
+
+.globl  OPENSSL_rdtsc
+.type   OPENSSL_rdtsc,\@abi-omnipotent
+.align  16
+OPENSSL_rdtsc:
+        rdtsc
+        shl     \$32,%rdx
+        or      %rdx,%rax
+        ret
+.size   OPENSSL_rdtsc,.-OPENSSL_rdtsc
+
+.globl  OPENSSL_ia32_cpuid
+.type   OPENSSL_ia32_cpuid,\@abi-omnipotent
+.align  16
+OPENSSL_ia32_cpuid:
+        mov     %rbx,%r8
+
+        xor     %eax,%eax
+        cpuid
+        xor     %eax,%eax
+        cmp     \$0x756e6547,%ebx       # "Genu"
+        setne   %al
+        mov     %eax,%r9d
+        cmp     \$0x49656e69,%edx       # "ineI"
+        setne   %al
+        or      %eax,%r9d
+        cmp     \$0x6c65746e,%ecx       # "ntel"
+        setne   %al
+        or      %eax,%r9d
+
+        mov     \$1,%eax
+        cpuid
+        cmp     \$0,%r9d
+        jne     .Lnotintel
+        or      \$0x00100000,%edx       # use reserved 20th bit to engage RC4_CHAR
+        and     \$15,%ah
+        cmp     \$15,%ah                # examine Family ID
+        je      .Lnotintel
+        or      \$0x40000000,%edx       # use reserved bit to skip unrolled loop
+.Lnotintel:
+        bt      \$28,%edx               # test hyper-threading bit
+        jnc     .Ldone
+        shr     \$16,%ebx
+        cmp     \$1,%bl                 # see if cache is shared
+        ja      .Ldone
+        and     \$0xefffffff,%edx       # ~(1<<28)
+.Ldone:
+        shl     \$32,%rcx
+        mov     %edx,%eax
+        mov     %r8,%rbx
+        or      %rcx,%rax
+        ret
+.size   OPENSSL_ia32_cpuid,.-OPENSSL_ia32_cpuid
+___
+close STDOUT;   # flush
diff --git a/src/lib/libssl/src/crypto/x86cpuid.pl b/src/lib/libssl/src/crypto/x86cpuid.pl
new file mode 100644
index 0000000000..4408ef2936
--- /dev/null
+++ b/src/lib/libssl/src/crypto/x86cpuid.pl
@@ -0,0 +1,225 @@
+#!/usr/bin/env perl
+
+push(@INC,"perlasm");
+require "x86asm.pl";
+
+&asm_init($ARGV[0],"x86cpuid");
+
+for (@ARGV) { $sse2=1 if (/-DOPENSSL_IA32_SSE2/); }
+
+&function_begin("OPENSSL_ia32_cpuid");
+        &xor    ("edx","edx");
+        &pushf  ();
+        &pop    ("eax");
+        &mov    ("ecx","eax");
+        &xor    ("eax",1<<21);
+        &push   ("eax");
+        &popf   ();
+        &pushf  ();
+        &pop    ("eax");
+        &xor    ("ecx","eax");
+        &bt     ("ecx",21);
+        &jnc    (&label("done"));
+        &xor    ("eax","eax");
+        &cpuid  ();
+        &xor    ("eax","eax");
+        &cmp    ("ebx",0x756e6547);     # "Genu"
+        &data_byte(0x0f,0x95,0xc0);     #&setne (&LB("eax"));
+        &mov    ("ebp","eax");
+        &cmp    ("edx",0x49656e69);     # "ineI"
+        &data_byte(0x0f,0x95,0xc0);     #&setne (&LB("eax"));
+        &or     ("ebp","eax");
+        &cmp    ("ecx",0x6c65746e);     # "ntel"
+        &data_byte(0x0f,0x95,0xc0);     #&setne (&LB("eax"));
+        &or     ("ebp","eax");
+        &mov    ("eax",1);
+        &cpuid  ();
+        &cmp    ("ebp",0);
+        &jne    (&label("notP4"));
+        &and    ("eax",15<<8);          # familiy ID
+        &cmp    ("eax",15<<8);          # P4?
+        &jne    (&label("notP4"));
+        &or     ("edx",1<<20);          # use reserved bit to engage RC4_CHAR
+&set_label("notP4");
+        &bt     ("edx",28);             # test hyper-threading bit
+        &jnc    (&label("done"));
+        &shr    ("ebx",16);
+        &and    ("ebx",0xff);
+        &cmp    ("ebx",1);              # see if cache is shared(*)
+        &ja     (&label("done"));
+        &and    ("edx",0xefffffff);     # clear hyper-threading bit if not
+&set_label("done");
+        &mov    ("eax","edx");
+        &mov    ("edx","ecx");
+&function_end("OPENSSL_ia32_cpuid");
+# (*)   on Core2 this value is set to 2 denoting the fact that L2
+#       cache is shared between cores.
+
+&external_label("OPENSSL_ia32cap_P");
+
+&function_begin_B("OPENSSL_rdtsc","EXTRN\t_OPENSSL_ia32cap_P:DWORD");
+        &xor    ("eax","eax");
+        &xor    ("edx","edx");
+        &picmeup("ecx","OPENSSL_ia32cap_P");
+        &bt     (&DWP(0,"ecx"),4);
+        &jnc    (&label("notsc"));
+        &rdtsc  ();
+&set_label("notsc");
+        &ret    ();
+&function_end_B("OPENSSL_rdtsc");
+
+# This works in Ring 0 only [read DJGPP+MS-DOS+privileged DPMI host],
+# but it's safe to call it on any [supported] 32-bit platform...
+# Just check for [non-]zero return value...
+&function_begin_B("OPENSSL_instrument_halt","EXTRN\t_OPENSSL_ia32cap_P:DWORD");
+        &picmeup("ecx","OPENSSL_ia32cap_P");
+        &bt     (&DWP(0,"ecx"),4);
+        &jnc    (&label("nohalt"));     # no TSC
+
+        &data_word(0x9058900e);         # push %cs; pop %eax
+        &and    ("eax",3);
+        &jnz    (&label("nohalt"));     # not enough privileges
+
+        &pushf  ();
+        &pop    ("eax")
+        &bt     ("eax",9);
+        &jnc    (&label("nohalt"));     # interrupts are disabled
+
+        &rdtsc  ();
+        &push   ("edx");
+        &push   ("eax");
+        &halt   ();
+        &rdtsc  ();
+
+        &sub    ("eax",&DWP(0,"esp"));
+        &sbb    ("edx",&DWP(4,"esp"));
+        &add    ("esp",8);
+        &ret    ();
+
+&set_label("nohalt");
+        &xor    ("eax","eax");
+        &xor    ("edx","edx");
+        &ret    ();
+&function_end_B("OPENSSL_instrument_halt");
+
+# Essentially there is only one use for this function. Under DJGPP:
+#
+#       #include <go32.h>
+#       ...
+#       i=OPENSSL_far_spin(_dos_ds,0x46c);
+#       ...
+# to obtain the number of spins till closest timer interrupt.
+
+&function_begin_B("OPENSSL_far_spin");
+        &pushf  ();
+        &pop    ("eax")
+        &bt     ("eax",9);
+        &jnc    (&label("nospin"));     # interrupts are disabled
+
+        &mov    ("eax",&DWP(4,"esp"));
+        &mov    ("ecx",&DWP(8,"esp"));
+        &data_word (0x90d88e1e);        # push %ds, mov %eax,%ds
+        &xor    ("eax","eax");
+        &mov    ("edx",&DWP(0,"ecx"));
+        &jmp    (&label("spin"));
+
+        &align  (16);
+&set_label("spin");
+        &inc    ("eax");
+        &cmp    ("edx",&DWP(0,"ecx"));
+        &je     (&label("spin"));
+
+        &data_word (0x1f909090);        # pop   %ds
+        &ret    ();
+
+&set_label("nospin");
+        &xor    ("eax","eax");
+        &xor    ("edx","edx");
+        &ret    ();
+&function_end_B("OPENSSL_far_spin");
+
+&function_begin_B("OPENSSL_wipe_cpu","EXTRN\t_OPENSSL_ia32cap_P:DWORD");
+        &xor    ("eax","eax");
+        &xor    ("edx","edx");
+        &picmeup("ecx","OPENSSL_ia32cap_P");
+        &mov    ("ecx",&DWP(0,"ecx"));
+        &bt     (&DWP(0,"ecx"),1);
+        &jnc    (&label("no_x87"));
+        if ($sse2) {
+                &bt     (&DWP(0,"ecx"),26);
+                &jnc    (&label("no_sse2"));
+                &pxor   ("xmm0","xmm0");
+                &pxor   ("xmm1","xmm1");
+                &pxor   ("xmm2","xmm2");
+                &pxor   ("xmm3","xmm3");
+                &pxor   ("xmm4","xmm4");
+                &pxor   ("xmm5","xmm5");
+                &pxor   ("xmm6","xmm6");
+                &pxor   ("xmm7","xmm7");
+        &set_label("no_sse2");
+        }
+        # just a bunch of fldz to zap the fp/mm bank followed by finit...
+        &data_word(0xeed9eed9,0xeed9eed9,0xeed9eed9,0xeed9eed9,0x90e3db9b);
+&set_label("no_x87");
+        &lea    ("eax",&DWP(4,"esp"));
+        &ret    ();
+&function_end_B("OPENSSL_wipe_cpu");
+
+&function_begin_B("OPENSSL_atomic_add");
+        &mov    ("edx",&DWP(4,"esp"));  # fetch the pointer, 1st arg
+        &mov    ("ecx",&DWP(8,"esp"));  # fetch the increment, 2nd arg
+        &push   ("ebx");
+        &nop    ();
+        &mov    ("eax",&DWP(0,"edx"));
+&set_label("spin");
+        &lea    ("ebx",&DWP(0,"eax","ecx"));
+        &nop    ();
+        &data_word(0x1ab10ff0); # lock; cmpxchg %ebx,(%edx)     # %eax is envolved and is always reloaded
+        &jne    (&label("spin"));
+        &mov    ("eax","ebx");  # OpenSSL expects the new value
+        &pop    ("ebx");
+        &ret    ();
+&function_end_B("OPENSSL_atomic_add");
+
+# This function can become handy under Win32 in situations when
+# we don't know which calling convention, __stdcall or __cdecl(*),
+# indirect callee is using. In C it can be deployed as
+#
+#ifdef OPENSSL_CPUID_OBJ
+#       type OPENSSL_indirect_call(void *f,...);
+#       ...
+#       OPENSSL_indirect_call(func,[up to $max arguments]);
+#endif
+#
+# (*)   it's designed to work even for __fastcall if number of
+#       arguments is 1 or 2!
+&function_begin_B("OPENSSL_indirect_call");
+        {
+        my $i,$max=7;           # $max has to be chosen as 4*n-1
+                                # in order to preserve eventual
+                                # stack alignment
+        &push   ("ebp");
+        &mov    ("ebp","esp");
+        &sub    ("esp",$max*4);
+        &mov    ("ecx",&DWP(12,"ebp"));
+        &mov    (&DWP(0,"esp"),"ecx");
+        &mov    ("edx",&DWP(16,"ebp"));
+        &mov    (&DWP(4,"esp"),"edx");
+        for($i=2;$i<$max;$i++)
+                {
+                # Some copies will be redundant/bogus...
+                &mov    ("eax",&DWP(12+$i*4,"ebp"));
+                &mov    (&DWP(0+$i*4,"esp"),"eax");
+                }
+        &call_ptr       (&DWP(8,"ebp"));# make the call...
+        &mov    ("esp","ebp");  # ... and just restore the stack pointer
+                                # without paying attention to what we called,
+                                # (__cdecl *func) or (__stdcall *one).
+        &pop    ("ebp");
+        &ret    ();
+        }
+&function_end_B("OPENSSL_indirect_call");
+
+&initseg("OPENSSL_cpuid_setup");
+
+&asm_finish();
diff --git a/src/lib/libssl/src/demos/ssltest-ecc/ECC-RSAcertgen.sh b/src/lib/libssl/src/demos/ssltest-ecc/ECC-RSAcertgen.sh
new file mode 100755
index 0000000000..b31a4f1ee0
--- /dev/null
+++ b/src/lib/libssl/src/demos/ssltest-ecc/ECC-RSAcertgen.sh
@@ -0,0 +1,98 @@
+#!/bin/sh
+
+# For a list of supported curves, use "apps/openssl ecparam -list_curves".
+
+# Path to the openssl distribution
+OPENSSL_DIR=../..
+# Path to the openssl program
+OPENSSL_CMD=$OPENSSL_DIR/apps/openssl
+# Option to find configuration file
+OPENSSL_CNF="-config $OPENSSL_DIR/apps/openssl.cnf"
+# Directory where certificates are stored
+CERTS_DIR=./Certs
+# Directory where private key files are stored
+KEYS_DIR=$CERTS_DIR
+# Directory where combo files (containing a certificate and corresponding
+# private key together) are stored
+COMBO_DIR=$CERTS_DIR
+# cat command
+CAT=/bin/cat
+# rm command
+RM=/bin/rm
+# mkdir command
+MKDIR=/bin/mkdir
+# The certificate will expire these many days after the issue date.
+DAYS=1500
+TEST_CA_FILE=rsa1024TestCA
+
+TEST_SERVER_CURVE=sect163r1
+TEST_SERVER_FILE=sect163r1-rsaTestServer
+TEST_SERVER_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Server (sect163r1 key signed with RSA)"
+
+TEST_CLIENT_CURVE=sect163r1
+TEST_CLIENT_FILE=sect163r1-rsaTestClient
+TEST_CLIENT_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Client (sect163r1 key signed with RSA)"
+
+# Generating an EC certificate involves the following main steps
+# 1. Generating curve parameters (if needed)
+# 2. Generating a certificate request
+# 3. Signing the certificate request 
+# 4. [Optional] One can combine the cert and private key into a single
+#    file and also delete the certificate request
+
+$MKDIR -p $CERTS_DIR
+$MKDIR -p $KEYS_DIR
+$MKDIR -p $COMBO_DIR
+
+echo "GENERATING A TEST SERVER CERTIFICATE (ECC key signed with RSA)"
+echo "=============================================================="
+$OPENSSL_CMD ecparam -name $TEST_SERVER_CURVE -out $TEST_SERVER_CURVE.pem
+
+$OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_SERVER_DN" \
+    -keyout $KEYS_DIR/$TEST_SERVER_FILE.key.pem \
+    -newkey ec:$TEST_SERVER_CURVE.pem -new \
+    -out $CERTS_DIR/$TEST_SERVER_FILE.req.pem
+
+$OPENSSL_CMD x509 -req -days $DAYS \
+    -in $CERTS_DIR/$TEST_SERVER_FILE.req.pem \
+    -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
+    -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
+    -out $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -CAcreateserial
+
+# Display the certificate 
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -text
+
+# Place the certificate and key in a common file
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -issuer -subject \
+         > $COMBO_DIR/$TEST_SERVER_FILE.pem
+$CAT $KEYS_DIR/$TEST_SERVER_FILE.key.pem >> $COMBO_DIR/$TEST_SERVER_FILE.pem
+
+# Remove the cert request file (no longer needed)
+$RM $CERTS_DIR/$TEST_SERVER_FILE.req.pem
+
+echo "GENERATING A TEST CLIENT CERTIFICATE (ECC key signed with RSA)"
+echo "=============================================================="
+$OPENSSL_CMD ecparam -name $TEST_CLIENT_CURVE -out $TEST_CLIENT_CURVE.pem
+
+$OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CLIENT_DN" \
+             -keyout $KEYS_DIR/$TEST_CLIENT_FILE.key.pem \
+             -newkey ec:$TEST_CLIENT_CURVE.pem -new \
+             -out $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
+
+$OPENSSL_CMD x509 -req -days $DAYS \
+    -in $CERTS_DIR/$TEST_CLIENT_FILE.req.pem \
+    -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
+    -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
+    -out $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -CAcreateserial
+
+# Display the certificate 
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -text
+
+# Place the certificate and key in a common file
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -issuer -subject \
+         > $COMBO_DIR/$TEST_CLIENT_FILE.pem
+$CAT $KEYS_DIR/$TEST_CLIENT_FILE.key.pem >> $COMBO_DIR/$TEST_CLIENT_FILE.pem
+
+# Remove the cert request file (no longer needed)
+$RM $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
+
diff --git a/src/lib/libssl/src/demos/ssltest-ecc/ECCcertgen.sh b/src/lib/libssl/src/demos/ssltest-ecc/ECCcertgen.sh
new file mode 100755
index 0000000000..a47b8bb0b5
--- /dev/null
+++ b/src/lib/libssl/src/demos/ssltest-ecc/ECCcertgen.sh
@@ -0,0 +1,164 @@
+#!/bin/sh
+
+# For a list of supported curves, use "apps/openssl ecparam -list_curves".
+
+# Path to the openssl distribution
+OPENSSL_DIR=../..
+# Path to the openssl program
+OPENSSL_CMD=$OPENSSL_DIR/apps/openssl
+# Option to find configuration file
+OPENSSL_CNF="-config $OPENSSL_DIR/apps/openssl.cnf"
+# Directory where certificates are stored
+CERTS_DIR=./Certs
+# Directory where private key files are stored
+KEYS_DIR=$CERTS_DIR
+# Directory where combo files (containing a certificate and corresponding
+# private key together) are stored
+COMBO_DIR=$CERTS_DIR
+# cat command
+CAT=/bin/cat
+# rm command
+RM=/bin/rm
+# mkdir command
+MKDIR=/bin/mkdir
+# The certificate will expire these many days after the issue date.
+DAYS=1500
+TEST_CA_CURVE=secp160r1
+TEST_CA_FILE=secp160r1TestCA
+TEST_CA_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test CA (Elliptic curve secp160r1)"
+
+TEST_SERVER_CURVE=secp160r2
+TEST_SERVER_FILE=secp160r2TestServer
+TEST_SERVER_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Server (Elliptic curve secp160r2)"
+
+TEST_CLIENT_CURVE=secp160r2
+TEST_CLIENT_FILE=secp160r2TestClient
+TEST_CLIENT_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Client (Elliptic curve secp160r2)"
+
+# Generating an EC certificate involves the following main steps
+# 1. Generating curve parameters (if needed)
+# 2. Generating a certificate request
+# 3. Signing the certificate request 
+# 4. [Optional] One can combine the cert and private key into a single
+#    file and also delete the certificate request
+
+$MKDIR -p $CERTS_DIR
+$MKDIR -p $KEYS_DIR
+$MKDIR -p $COMBO_DIR
+
+echo "Generating self-signed CA certificate (on curve $TEST_CA_CURVE)"
+echo "==============================================================="
+$OPENSSL_CMD ecparam -name $TEST_CA_CURVE -out $TEST_CA_CURVE.pem
+
+# Generate a new certificate request in $TEST_CA_FILE.req.pem. A 
+# new ecdsa (actually ECC) key pair is generated on the parameters in
+# $TEST_CA_CURVE.pem and the private key is saved in $TEST_CA_FILE.key.pem
+# WARNING: By using the -nodes option, we force the private key to be 
+# stored in the clear (rather than encrypted with a password).
+$OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CA_DN" \
+    -keyout $KEYS_DIR/$TEST_CA_FILE.key.pem \
+    -newkey ec:$TEST_CA_CURVE.pem -new \
+    -out $CERTS_DIR/$TEST_CA_FILE.req.pem
+
+# Sign the certificate request in $TEST_CA_FILE.req.pem using the
+# private key in $TEST_CA_FILE.key.pem and include the CA extension.
+# Make the certificate valid for 1500 days from the time of signing.
+# The certificate is written into $TEST_CA_FILE.cert.pem
+$OPENSSL_CMD x509 -req -days $DAYS \
+    -in $CERTS_DIR/$TEST_CA_FILE.req.pem \
+    -extfile $OPENSSL_DIR/apps/openssl.cnf \
+    -extensions v3_ca \
+    -signkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
+    -out $CERTS_DIR/$TEST_CA_FILE.cert.pem
+
+# Display the certificate
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CA_FILE.cert.pem -text
+
+# Place the certificate and key in a common file
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CA_FILE.cert.pem -issuer -subject \
+         > $COMBO_DIR/$TEST_CA_FILE.pem
+$CAT $KEYS_DIR/$TEST_CA_FILE.key.pem >> $COMBO_DIR/$TEST_CA_FILE.pem
+
+# Remove the cert request file (no longer needed)
+$RM $CERTS_DIR/$TEST_CA_FILE.req.pem
+
+echo "GENERATING A TEST SERVER CERTIFICATE (on elliptic curve $TEST_SERVER_CURVE)"
+echo "=========================================================================="
+# Generate parameters for curve $TEST_SERVER_CURVE, if needed
+$OPENSSL_CMD ecparam -name $TEST_SERVER_CURVE -out $TEST_SERVER_CURVE.pem
+
+# Generate a new certificate request in $TEST_SERVER_FILE.req.pem. A 
+# new ecdsa (actually ECC) key pair is generated on the parameters in
+# $TEST_SERVER_CURVE.pem and the private key is saved in 
+# $TEST_SERVER_FILE.key.pem
+# WARNING: By using the -nodes option, we force the private key to be 
+# stored in the clear (rather than encrypted with a password).
+$OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_SERVER_DN" \
+    -keyout $KEYS_DIR/$TEST_SERVER_FILE.key.pem \
+    -newkey ec:$TEST_SERVER_CURVE.pem -new \
+    -out $CERTS_DIR/$TEST_SERVER_FILE.req.pem
+
+# Sign the certificate request in $TEST_SERVER_FILE.req.pem using the
+# CA certificate in $TEST_CA_FILE.cert.pem and the CA private key in
+# $TEST_CA_FILE.key.pem. Since we do not have an existing serial number
+# file for this CA, create one. Make the certificate valid for $DAYS days
+# from the time of signing. The certificate is written into 
+# $TEST_SERVER_FILE.cert.pem
+$OPENSSL_CMD x509 -req -days $DAYS \
+    -in $CERTS_DIR/$TEST_SERVER_FILE.req.pem \
+    -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
+    -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
+    -out $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -CAcreateserial
+
+# Display the certificate 
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -text
+
+# Place the certificate and key in a common file
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -issuer -subject \
+         > $COMBO_DIR/$TEST_SERVER_FILE.pem
+$CAT $KEYS_DIR/$TEST_SERVER_FILE.key.pem >> $COMBO_DIR/$TEST_SERVER_FILE.pem
+
+# Remove the cert request file (no longer needed)
+$RM $CERTS_DIR/$TEST_SERVER_FILE.req.pem
+
+echo "GENERATING A TEST CLIENT CERTIFICATE (on elliptic curve $TEST_CLIENT_CURVE)"
+echo "=========================================================================="
+# Generate parameters for curve $TEST_CLIENT_CURVE, if needed
+$OPENSSL_CMD ecparam -name $TEST_CLIENT_CURVE -out $TEST_CLIENT_CURVE.pem
+
+# Generate a new certificate request in $TEST_CLIENT_FILE.req.pem. A 
+# new ecdsa (actually ECC) key pair is generated on the parameters in
+# $TEST_CLIENT_CURVE.pem and the private key is saved in 
+# $TEST_CLIENT_FILE.key.pem
+# WARNING: By using the -nodes option, we force the private key to be 
+# stored in the clear (rather than encrypted with a password).
+$OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CLIENT_DN" \
+             -keyout $KEYS_DIR/$TEST_CLIENT_FILE.key.pem \
+             -newkey ec:$TEST_CLIENT_CURVE.pem -new \
+             -out $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
+
+# Sign the certificate request in $TEST_CLIENT_FILE.req.pem using the
+# CA certificate in $TEST_CA_FILE.cert.pem and the CA private key in
+# $TEST_CA_FILE.key.pem. Since we do not have an existing serial number
+# file for this CA, create one. Make the certificate valid for $DAYS days
+# from the time of signing. The certificate is written into 
+# $TEST_CLIENT_FILE.cert.pem
+$OPENSSL_CMD x509 -req -days $DAYS \
+    -in $CERTS_DIR/$TEST_CLIENT_FILE.req.pem \
+    -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
+    -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
+    -out $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -CAcreateserial
+
+# Display the certificate 
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -text
+
+# Place the certificate and key in a common file
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -issuer -subject \
+         > $COMBO_DIR/$TEST_CLIENT_FILE.pem
+$CAT $KEYS_DIR/$TEST_CLIENT_FILE.key.pem >> $COMBO_DIR/$TEST_CLIENT_FILE.pem
+
+# Remove the cert request file (no longer needed)
+$RM $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
+
+
+
diff --git a/src/lib/libssl/src/demos/ssltest-ecc/README b/src/lib/libssl/src/demos/ssltest-ecc/README
new file mode 100644
index 0000000000..71c070af16
--- /dev/null
+++ b/src/lib/libssl/src/demos/ssltest-ecc/README
@@ -0,0 +1,15 @@
+Scripts for using ECC ciphersuites with test/testssl
+(these ciphersuites are described in the Internet Draft available at
+http://www.ietf.org/internet-drafts/draft-ietf-tls-ecc-03.txt).
+
+Use ECCcertgen.sh, RSAcertgen.sh, ECC-RSAcertgen.sh to generate
+root, client and server certs of the following types:
+
+     ECC certs signed with ECDSA
+     RSA certs signed with RSA
+     ECC certs signed with RSA
+
+Afterwards, you can use ssltest.sh to run the various tests;
+specify one of the following options:
+
+     aecdh, ecdh-ecdsa, ecdhe-ecdsa, ecdh-rsa, ecdhe-rsa
diff --git a/src/lib/libssl/src/demos/ssltest-ecc/RSAcertgen.sh b/src/lib/libssl/src/demos/ssltest-ecc/RSAcertgen.sh
new file mode 100755
index 0000000000..0cb0153596
--- /dev/null
+++ b/src/lib/libssl/src/demos/ssltest-ecc/RSAcertgen.sh
@@ -0,0 +1,121 @@
+#!/bin/sh
+
+# For a list of supported curves, use "apps/openssl ecparam -list_curves".
+
+# Path to the openssl distribution
+OPENSSL_DIR=../..
+# Path to the openssl program
+OPENSSL_CMD=$OPENSSL_DIR/apps/openssl
+# Option to find configuration file
+OPENSSL_CNF="-config $OPENSSL_DIR/apps/openssl.cnf"
+# Directory where certificates are stored
+CERTS_DIR=./Certs
+# Directory where private key files are stored
+KEYS_DIR=$CERTS_DIR
+# Directory where combo files (containing a certificate and corresponding
+# private key together) are stored
+COMBO_DIR=$CERTS_DIR
+# cat command
+CAT=/bin/cat
+# rm command
+RM=/bin/rm
+# mkdir command
+MKDIR=/bin/mkdir
+# The certificate will expire these many days after the issue date.
+DAYS=1500
+TEST_CA_FILE=rsa1024TestCA
+TEST_CA_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test CA (1024 bit RSA)"
+
+TEST_SERVER_FILE=rsa1024TestServer
+TEST_SERVER_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Server (1024 bit RSA)"
+
+TEST_CLIENT_FILE=rsa1024TestClient
+TEST_CLIENT_DN="/C=US/ST=CA/L=Mountain View/O=Sun Microsystems, Inc./OU=Sun Microsystems Laboratories/CN=Test Client (1024 bit RSA)"
+
+# Generating an EC certificate involves the following main steps
+# 1. Generating curve parameters (if needed)
+# 2. Generating a certificate request
+# 3. Signing the certificate request 
+# 4. [Optional] One can combine the cert and private key into a single
+#    file and also delete the certificate request
+
+$MKDIR -p $CERTS_DIR
+$MKDIR -p $KEYS_DIR
+$MKDIR -p $COMBO_DIR
+
+echo "Generating self-signed CA certificate (RSA)"
+echo "==========================================="
+
+$OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CA_DN" \
+    -keyout $KEYS_DIR/$TEST_CA_FILE.key.pem \
+    -newkey rsa:1024 -new \
+    -out $CERTS_DIR/$TEST_CA_FILE.req.pem
+
+$OPENSSL_CMD x509 -req -days $DAYS \
+    -in $CERTS_DIR/$TEST_CA_FILE.req.pem \
+    -extfile $OPENSSL_DIR/apps/openssl.cnf \
+    -extensions v3_ca \
+    -signkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
+    -out $CERTS_DIR/$TEST_CA_FILE.cert.pem
+
+# Display the certificate
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CA_FILE.cert.pem -text
+
+# Place the certificate and key in a common file
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CA_FILE.cert.pem -issuer -subject \
+         > $COMBO_DIR/$TEST_CA_FILE.pem
+$CAT $KEYS_DIR/$TEST_CA_FILE.key.pem >> $COMBO_DIR/$TEST_CA_FILE.pem
+
+# Remove the cert request file (no longer needed)
+$RM $CERTS_DIR/$TEST_CA_FILE.req.pem
+
+echo "GENERATING A TEST SERVER CERTIFICATE (RSA)"
+echo "=========================================="
+
+$OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_SERVER_DN" \
+    -keyout $KEYS_DIR/$TEST_SERVER_FILE.key.pem \
+    -newkey rsa:1024 -new \
+    -out $CERTS_DIR/$TEST_SERVER_FILE.req.pem
+
+$OPENSSL_CMD x509 -req -days $DAYS \
+    -in $CERTS_DIR/$TEST_SERVER_FILE.req.pem \
+    -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
+    -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
+    -out $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -CAcreateserial
+
+# Display the certificate 
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -text
+
+# Place the certificate and key in a common file
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_SERVER_FILE.cert.pem -issuer -subject \
+         > $COMBO_DIR/$TEST_SERVER_FILE.pem
+$CAT $KEYS_DIR/$TEST_SERVER_FILE.key.pem >> $COMBO_DIR/$TEST_SERVER_FILE.pem
+
+# Remove the cert request file (no longer needed)
+$RM $CERTS_DIR/$TEST_SERVER_FILE.req.pem
+
+echo "GENERATING A TEST CLIENT CERTIFICATE (RSA)"
+echo "=========================================="
+
+$OPENSSL_CMD req $OPENSSL_CNF -nodes -subj "$TEST_CLIENT_DN" \
+             -keyout $KEYS_DIR/$TEST_CLIENT_FILE.key.pem \
+             -newkey rsa:1024 -new \
+             -out $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
+
+$OPENSSL_CMD x509 -req -days $DAYS \
+    -in $CERTS_DIR/$TEST_CLIENT_FILE.req.pem \
+    -CA $CERTS_DIR/$TEST_CA_FILE.cert.pem \
+    -CAkey $KEYS_DIR/$TEST_CA_FILE.key.pem \
+    -out $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -CAcreateserial
+
+# Display the certificate 
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -text
+
+# Place the certificate and key in a common file
+$OPENSSL_CMD x509 -in $CERTS_DIR/$TEST_CLIENT_FILE.cert.pem -issuer -subject \
+         > $COMBO_DIR/$TEST_CLIENT_FILE.pem
+$CAT $KEYS_DIR/$TEST_CLIENT_FILE.key.pem >> $COMBO_DIR/$TEST_CLIENT_FILE.pem
+
+# Remove the cert request file (no longer needed)
+$RM $CERTS_DIR/$TEST_CLIENT_FILE.req.pem
+
diff --git a/src/lib/libssl/src/demos/ssltest-ecc/ssltest.sh b/src/lib/libssl/src/demos/ssltest-ecc/ssltest.sh
new file mode 100755
index 0000000000..923ca43824
--- /dev/null
+++ b/src/lib/libssl/src/demos/ssltest-ecc/ssltest.sh
@@ -0,0 +1,188 @@
+#! /bin/sh
+# Tests ECC cipher suites using ssltest. Requires one argument which could
+# be aecdh or ecdh-ecdsa or ecdhe-ecdsa or ecdh-rsa or ecdhe-rsa.
+# A second optional argument can be one of ssl2 ssl3 or tls1
+
+if [ "$1" = "" ]; then
+  (echo "Usage: $0 test [ protocol ]"
+   echo "   where test is one of aecdh, ecdh-ecdsa, ecdhe-ecdsa, ecdh-rsa, ecdhe-rsa"
+   echo "   and protocol (optional) is one of ssl2, ssl3, tls1"
+   echo "Run RSAcertgen.sh, ECC-RSAcertgen.sh, ECCcertgen.sh first."
+  ) >&2
+  exit 1
+fi
+
+
+OPENSSL_DIR=../..
+CERTS_DIR=./Certs
+SSLTEST=$OPENSSL_DIR/test/ssltest
+# SSL protocol version to test (one of ssl2 ssl3 or tls1)"
+SSLVERSION=
+
+# These don't really require any certificates
+AECDH_CIPHER_LIST="AECDH-AES256-SHA AECDH-AES128-SHA AECDH-DES-CBC3-SHA AECDH-RC4-SHA AECDH-NULL-SHA"
+
+# These require ECC certificates signed with ECDSA
+# The EC public key must be authorized for key agreement.
+ECDH_ECDSA_CIPHER_LIST="ECDH-ECDSA-AES256-SHA ECDH-ECDSA-AES128-SHA ECDH-ECDSA-DES-CBC3-SHA ECDH-ECDSA-RC4-SHA ECDH-ECDSA-NULL-SHA"
+
+# These require ECC certificates.
+# The EC public key must be authorized for digital signature.
+ECDHE_ECDSA_CIPHER_LIST="ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-DES-CBC3-SHA ECDHE-ECDSA-RC4-SHA ECDHE-ECDSA-NULL-SHA"
+
+# These require ECC certificates signed with RSA.
+# The EC public key must be authorized for key agreement.
+ECDH_RSA_CIPHER_LIST="ECDH-RSA-AES256-SHA ECDH-RSA-AES128-SHA ECDH-RSA-DES-CBC3-SHA ECDH-RSA-RC4-SHA ECDH-RSA-NULL-SHA"
+
+# These require RSA certificates.
+# The RSA public key must be authorized for digital signature.
+ECDHE_RSA_CIPHER_LIST="ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-RSA-DES-CBC3-SHA ECDHE-RSA-RC4-SHA ECDHE-RSA-NULL-SHA"
+
+# List of Elliptic curves over which we wish to test generation of
+# ephemeral ECDH keys when using AECDH or ECDHE ciphers
+# NOTE: secp192r1 = prime192v1 and secp256r1 = prime256v1
+#ELLIPTIC_CURVE_LIST="secp112r1 sect113r2 secp128r1 sect131r1 secp160k1 sect163r2 wap-wsg-idm-ecid-wtls7 c2pnb163v3 c2pnb176v3 c2tnb191v3 secp192r1 prime192v3 sect193r2 secp224r1 wap-wsg-idm-ecid-wtls10 sect239k1 prime239v2 secp256r1 prime256v1 sect283k1 secp384r1 sect409r1 secp521r1 sect571r1"
+ELLIPTIC_CURVE_LIST="sect163k1 sect163r1 sect163r2 sect193r1 sect193r2 sect233k1 sect233r1 sect239k1 sect283k1 sect283r1 sect409k1 sect409r1 sect571k1 sect571r1 secp160k1 secp160r1 secp160r2 secp192k1 prime192v1 secp224k1 secp224r1 secp256k1 prime256v1 secp384r1 secp521r1"
+
+DEFAULT_CURVE="sect163r2"
+
+if [ "$2" = "" ]; then
+    if [ "$SSL_VERSION" = "" ]; then
+        SSL_VERSION=""
+    else
+        SSL_VERSION="-$SSL_VERSION"
+    fi
+else
+    SSL_VERSION="-$2"
+fi
+
+#==============================================================
+# Anonymous cipher suites do not require key or certificate files
+# but ssltest expects a cert file and complains if it can't
+# open the default one.
+SERVER_PEM=$OPENSSL_DIR/apps/server.pem
+
+if [ "$1" = "aecdh" ]; then
+for cipher in $AECDH_CIPHER_LIST
+do
+    echo "Testing $cipher"
+    $SSLTEST $SSL_VERSION -cert $SERVER_PEM -cipher $cipher 
+done
+#--------------------------------------------------------------
+for curve in $ELLIPTIC_CURVE_LIST
+do
+    echo "Testing AECDH-NULL-SHA (with $curve)"
+    $SSLTEST $SSL_VERSION -cert $SERVER_PEM \
+        -named_curve $curve -cipher AECDH-NULL-SHA
+done
+
+for curve in $ELLIPTIC_CURVE_LIST
+do
+    echo "Testing AECDH-RC4-SHA (with $curve)"
+    $SSLTEST $SSL_VERSION -cert $SERVER_PEM \
+        -named_curve $curve -cipher AECDH-RC4-SHA
+done
+fi
+
+#==============================================================
+# Both ECDH-ECDSA and ECDHE-ECDSA cipher suites require 
+# the server to have an ECC certificate signed with ECDSA.
+CA_PEM=$CERTS_DIR/secp160r1TestCA.pem
+SERVER_PEM=$CERTS_DIR/secp160r2TestServer.pem
+CLIENT_PEM=$CERTS_DIR/secp160r2TestClient.pem
+
+if [ "$1" = "ecdh-ecdsa" ]; then
+for cipher in $ECDH_ECDSA_CIPHER_LIST
+do
+    echo "Testing $cipher (with server authentication)"
+    $SSLTEST $SSL_VERSION -CAfile $CA_PEM \
+        -cert $SERVER_PEM -server_auth \
+        -cipher $cipher
+
+    echo "Testing $cipher (with server and client authentication)"
+    $SSLTEST $SSL_VERSION -CAfile $CA_PEM \
+        -cert $SERVER_PEM -server_auth \
+        -c_cert $CLIENT_PEM -client_auth \
+        -cipher $cipher
+done
+fi
+
+#==============================================================
+if [ "$1" = "ecdhe-ecdsa" ]; then
+for cipher in $ECDHE_ECDSA_CIPHER_LIST
+do
+    echo "Testing $cipher (with server authentication)"
+    $SSLTEST $SSL_VERSION -CAfile $CA_PEM \
+        -cert $SERVER_PEM -server_auth \
+        -cipher $cipher -named_curve $DEFAULT_CURVE
+
+    echo "Testing $cipher (with server and client authentication)"
+    $SSLTEST $SSL_VERSION -CAfile $CA_PEM \
+        -cert $SERVER_PEM -server_auth \
+        -c_cert $CLIENT_PEM -client_auth \
+        -cipher $cipher -named_curve $DEFAULT_CURVE
+done
+
+#--------------------------------------------------------------
+for curve in $ELLIPTIC_CURVE_LIST
+do
+    echo "Testing ECDHE-ECDSA-AES128-SHA (2-way auth with $curve)"
+    $SSLTEST $SSL_VERSION -CAfile $CA_PEM \
+        -cert $SERVER_PEM -server_auth \
+        -c_cert $CLIENT_PEM -client_auth \
+        -cipher ECDHE-ECDSA-AES128-SHA -named_curve $curve 
+done
+fi
+
+#==============================================================
+# ECDH-RSA cipher suites require the server to have an ECC
+# certificate signed with RSA.
+CA_PEM=$CERTS_DIR/rsa1024TestCA.pem
+SERVER_PEM=$CERTS_DIR/sect163r1-rsaTestServer.pem
+CLIENT_PEM=$CERTS_DIR/sect163r1-rsaTestClient.pem
+
+if [ "$1" = "ecdh-rsa" ]; then
+for cipher in $ECDH_RSA_CIPHER_LIST
+do
+    echo "Testing $cipher (with server authentication)"
+    $SSLTEST $SSL_VERSION -CAfile $CA_PEM \
+        -cert $SERVER_PEM -server_auth \
+        -cipher $cipher
+
+    echo "Testing $cipher (with server and client authentication)"
+    $SSLTEST $SSL_VERSION -CAfile $CA_PEM \
+        -cert $SERVER_PEM -server_auth \
+        -c_cert $CLIENT_PEM -client_auth \
+        -cipher $cipher
+done
+fi
+
+#==============================================================
+# ECDHE-RSA cipher suites require the server to have an RSA cert.
+CA_PEM=$CERTS_DIR/rsa1024TestCA.pem
+SERVER_PEM=$CERTS_DIR/rsa1024TestServer.pem
+CLIENT_PEM=$CERTS_DIR/rsa1024TestClient.pem
+
+if [ "$1" = "ecdhe-rsa" ]; then
+for cipher in $ECDHE_RSA_CIPHER_LIST
+do
+    echo "Testing $cipher (with server authentication)"
+    echo $SSLTEST $SSL_VERSION -CAfile $CA_PEM \
+        -cert $SERVER_PEM -server_auth \
+        -cipher $cipher -named_curve $DEFAULT_CURVE
+    $SSLTEST $SSL_VERSION -CAfile $CA_PEM \
+        -cert $SERVER_PEM -server_auth \
+        -cipher $cipher -named_curve $DEFAULT_CURVE
+
+    echo "Testing $cipher (with server and client authentication)"
+    $SSLTEST $SSL_VERSION -CAfile $CA_PEM \
+        -cert $SERVER_PEM -server_auth \
+        -c_cert $CLIENT_PEM -client_auth \
+        -cipher $cipher -named_curve $DEFAULT_CURVE
+done
+fi
+#==============================================================
+
+
+
+
diff --git a/src/lib/libssl/src/demos/tunala/test.sh b/src/lib/libssl/src/demos/tunala/test.sh
new file mode 100755
index 0000000000..105b447333
--- /dev/null
+++ b/src/lib/libssl/src/demos/tunala/test.sh
@@ -0,0 +1,107 @@
+#!/bin/sh
+
+HTTP="localhost:8080"
+CLIENT_PORT="9020"
+SERVER_PORT="9021"
+
+sub_test ()
+{
+        echo "STARTING - $VER $CIPHER"
+        ./tunala -listen localhost:$CLIENT_PORT -proxy localhost:$SERVER_PORT \
+                -cacert CA.pem -cert A-client.pem -server 0 \
+                -dh_special standard -v_peer -v_strict \
+                $VER -cipher $CIPHER 1> tc1.txt 2> tc2.txt &
+        ./tunala -listen localhost:$SERVER_PORT -proxy $HTTP \
+                -cacert CA.pem -cert A-server.pem -server 1 \
+                -dh_special standard -v_peer -v_strict \
+                $VER -cipher $CIPHER 1> ts1.txt 2> ts2.txt &
+        # Wait for the servers to be listening before starting the wget test
+        DONE="no"
+        while [ "$DONE" != "yes" ]; do
+                L1=`netstat -a | egrep "LISTEN[\t ]*$" | grep ":$CLIENT_PORT"`
+                L2=`netstat -a | egrep "LISTEN[\t ]*$" | grep ":$SERVER_PORT"`
+                if [ "x$L1" != "x" ]; then
+                        DONE="yes"
+                elif [ "x$L2" != "x" ]; then
+                        DONE="yes"
+                else
+                        sleep 1
+                fi
+        done
+        HTML=`wget -O - -T 1 http://localhost:$CLIENT_PORT 2> /dev/null | grep "<HTML>"`
+        if [ "x$HTML" != "x" ]; then
+                echo "OK - $CIPHER ($VER)"
+        else
+                echo "FAIL - $CIPHER ($VER)"
+                killall tunala
+                exit 1
+        fi
+        killall tunala
+        # Wait for the servers to stop before returning - otherwise the next
+        # test my fail to start ... (fscking race conditions)
+        DONE="yes"
+        while [ "$DONE" != "no" ]; do
+                L1=`netstat -a | egrep "LISTEN[\t ]*$" | grep ":$CLIENT_PORT"`
+                L2=`netstat -a | egrep "LISTEN[\t ]*$" | grep ":$SERVER_PORT"`
+                if [ "x$L1" != "x" ]; then
+                        DONE="yes"
+                elif [ "x$L2" != "x" ]; then
+                        DONE="yes"
+                else
+                        DONE="no"
+                fi
+        done
+        exit 0
+}
+
+run_test ()
+{
+        (sub_test 1> /dev/null) || exit 1
+}
+
+run_ssl_test ()
+{
+killall tunala 1> /dev/null 2> /dev/null
+echo ""
+echo "Starting all $PRETTY tests"
+if [ "$PRETTY" != "SSLv2" ]; then
+        if [ "$PRETTY" != "SSLv3" ]; then
+                export VER="-no_ssl2 -no_ssl3"
+                export OSSL="-tls1"
+        else
+                export VER="-no_ssl2 -no_tls1"
+                export OSSL="-ssl3"
+        fi
+else
+        export VER="-no_ssl3 -no_tls1"
+        export OSSL="-ssl2"
+fi
+LIST="`../../apps/openssl ciphers $OSSL | sed -e 's/:/ /g'`"
+#echo "$LIST"
+for i in $LIST; do \
+        DSS=`echo "$i" | grep "DSS"`
+        if [ "x$DSS" != "x" ]; then
+                echo "---- skipping $i (no DSA cert/keys) ----"
+        else
+                export CIPHER=$i
+                run_test
+                echo "SUCCESS: $i"
+        fi
+done;
+}
+
+# Welcome the user
+echo "Tests will assume an http server running at $HTTP"
+
+# TLSv1 test
+export PRETTY="TLSv1"
+run_ssl_test
+
+# SSLv3 test
+export PRETTY="SSLv3"
+run_ssl_test
+
+# SSLv2 test
+export PRETTY="SSLv2"
+run_ssl_test
+
diff --git a/src/lib/libssl/src/doc/apps/ec.pod b/src/lib/libssl/src/doc/apps/ec.pod
new file mode 100644
index 0000000000..1d4a36dbf4
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/ec.pod
@@ -0,0 +1,190 @@
+=pod
+
+=head1 NAME
+
+ec - EC key processing
+
+=head1 SYNOPSIS
+
+B<openssl> B<ec>
+[B<-inform PEM|DER>]
+[B<-outform PEM|DER>]
+[B<-in filename>]
+[B<-passin arg>]
+[B<-out filename>]
+[B<-passout arg>]
+[B<-des>]
+[B<-des3>]
+[B<-idea>]
+[B<-text>]
+[B<-noout>]
+[B<-param_out>]
+[B<-pubin>]
+[B<-pubout>]
+[B<-conv_form arg>]
+[B<-param_enc arg>]
+[B<-engine id>]
+
+=head1 DESCRIPTION
+
+The B<ec> command processes EC keys. They can be converted between various
+forms and their components printed out. B<Note> OpenSSL uses the 
+private key format specified in 'SEC 1: Elliptic Curve Cryptography'
+(http://www.secg.org/). To convert a OpenSSL EC private key into the
+PKCS#8 private key format use the B<pkcs8> command.
+
+=head1 COMMAND OPTIONS
+
+=over 4
+
+=item B<-inform DER|PEM>
+
+This specifies the input format. The B<DER> option with a private key uses
+an ASN.1 DER encoded SEC1 private key. When used with a public key it
+uses the SubjectPublicKeyInfo structur as specified in RFC 3280.
+The B<PEM> form is the default format: it consists of the B<DER> format base64
+encoded with additional header and footer lines. In the case of a private key
+PKCS#8 format is also accepted.
+
+=item B<-outform DER|PEM>
+
+This specifies the output format, the options have the same meaning as the 
+B<-inform> option.
+
+=item B<-in filename>
+
+This specifies the input filename to read a key from or standard input if this
+option is not specified. If the key is encrypted a pass phrase will be
+prompted for.
+
+=item B<-passin arg>
+
+the input file password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-out filename>
+
+This specifies the output filename to write a key to or standard output by
+is not specified. If any encryption options are set then a pass phrase will be
+prompted for. The output filename should B<not> be the same as the input
+filename.
+
+=item B<-passout arg>
+
+the output file password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
+=item B<-des|-des3|-idea>
+
+These options encrypt the private key with the DES, triple DES, IDEA or 
+any other cipher supported by OpenSSL before outputting it. A pass phrase is
+prompted for.
+If none of these options is specified the key is written in plain text. This
+means that using the B<ec> utility to read in an encrypted key with no
+encryption option can be used to remove the pass phrase from a key, or by
+setting the encryption options it can be use to add or change the pass phrase.
+These options can only be used with PEM format output files.
+
+=item B<-text>
+
+prints out the public, private key components and parameters.
+
+=item B<-noout>
+
+this option prevents output of the encoded version of the key.
+
+=item B<-modulus>
+
+this option prints out the value of the public key component of the key.
+
+=item B<-pubin>
+
+by default a private key is read from the input file: with this option a
+public key is read instead.
+
+=item B<-pubout>
+
+by default a private key is output. With this option a public
+key will be output instead. This option is automatically set if the input is
+a public key.
+
+=item B<-conv_form>
+
+This specifies how the points on the elliptic curve are converted
+into octet strings. Possible values are: B<compressed> (the default
+value), B<uncompressed> and B<hybrid>. For more information regarding
+the point conversion forms please read the X9.62 standard.
+B<Note> Due to patent issues the B<compressed> option is disabled
+by default for binary curves and can be enabled by defining
+the preprocessor macro B<OPENSSL_EC_BIN_PT_COMP> at compile time.
+
+=item B<-param_enc arg>
+
+This specifies how the elliptic curve parameters are encoded.
+Possible value are: B<named_curve>, i.e. the ec parameters are
+specified by a OID, or B<explicit> where the ec parameters are
+explicitly given (see RFC 3279 for the definition of the 
+EC parameters structures). The default value is B<named_curve>.
+B<Note> the B<implicitlyCA> alternative ,as specified in RFC 3279,
+is currently not implemented in OpenSSL.
+
+=item B<-engine id>
+
+specifying an engine (by it's unique B<id> string) will cause B<req>
+to attempt to obtain a functional reference to the specified engine,
+thus initialising it if needed. The engine will then be set as the default
+for all available algorithms.
+
+=back
+
+=head1 NOTES
+
+The PEM private key format uses the header and footer lines:
+
+ -----BEGIN EC PRIVATE KEY-----
+ -----END EC PRIVATE KEY-----
+
+The PEM public key format uses the header and footer lines:
+
+ -----BEGIN PUBLIC KEY-----
+ -----END PUBLIC KEY-----
+
+=head1 EXAMPLES
+
+To encrypt a private key using triple DES:
+
+ openssl ec -in key.pem -des3 -out keyout.pem
+
+To convert a private key from PEM to DER format: 
+
+ openssl ec -in key.pem -outform DER -out keyout.der
+
+To print out the components of a private key to standard output:
+
+ openssl ec -in key.pem -text -noout
+
+To just output the public part of a private key:
+
+ openssl ec -in key.pem -pubout -out pubkey.pem
+
+To change the parameters encoding to B<explicit>:
+
+ openssl ec -in key.pem -param_enc explicit -out keyout.pem
+
+To change the point conversion form to B<compressed>:
+
+ openssl ec -in key.pem -conv_form compressed -out keyout.pem
+
+=head1 SEE ALSO
+
+L<ecparam(1)|ecparam(1)>, L<dsa(1)|dsa(1)>, L<rsa(1)|rsa(1)>
+
+=head1 HISTORY
+
+The ec command was first introduced in OpenSSL 0.9.8.
+
+=head1 AUTHOR
+
+Nils Larsch for the OpenSSL project (http://www.openssl.org).
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/ecparam.pod b/src/lib/libssl/src/doc/apps/ecparam.pod
new file mode 100644
index 0000000000..1a12105da7
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/ecparam.pod
@@ -0,0 +1,179 @@
+=pod
+
+=head1 NAME
+
+ecparam - EC parameter manipulation and generation
+
+=head1 SYNOPSIS
+
+B<openssl ecparam>
+[B<-inform DER|PEM>]
+[B<-outform DER|PEM>]
+[B<-in filename>]
+[B<-out filename>]
+[B<-noout>]
+[B<-text>]
+[B<-C>]
+[B<-check>]
+[B<-name arg>]
+[B<-list_curve>]
+[B<-conv_form arg>]
+[B<-param_enc arg>]
+[B<-no_seed>]
+[B<-rand file(s)>]
+[B<-genkey>]
+[B<-engine id>]
+
+=head1 DESCRIPTION
+
+This command is used to manipulate or generate EC parameter files.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-inform DER|PEM>
+
+This specifies the input format. The B<DER> option uses an ASN.1 DER encoded
+form compatible with RFC 3279 EcpkParameters. The PEM form is the default
+format: it consists of the B<DER> format base64 encoded with additional 
+header and footer lines.
+
+=item B<-outform DER|PEM>
+
+This specifies the output format, the options have the same meaning as the 
+B<-inform> option.
+
+=item B<-in filename>
+
+This specifies the input filename to read parameters from or standard input if
+this option is not specified.
+
+=item B<-out filename>
+
+This specifies the output filename parameters to. Standard output is used
+if this option is not present. The output filename should B<not> be the same
+as the input filename.
+
+=item B<-noout>
+
+This option inhibits the output of the encoded version of the parameters.
+
+=item B<-text>
+
+This option prints out the EC parameters in human readable form.
+
+=item B<-C>
+
+This option converts the EC parameters into C code. The parameters can then
+be loaded by calling the B<get_ec_group_XXX()> function.
+
+=item B<-check>
+
+Validate the elliptic curve parameters.
+
+=item B<-name arg>
+
+Use the EC parameters with the specified 'short' name. Use B<-list_curves>
+to get a list of all currently implemented EC parameters.
+
+=item B<-list_curves>
+
+If this options is specified B<ecparam> will print out a list of all
+currently implemented EC parameters names and exit.
+
+=item B<-conv_form>
+
+This specifies how the points on the elliptic curve are converted
+into octet strings. Possible values are: B<compressed> (the default
+value), B<uncompressed> and B<hybrid>. For more information regarding
+the point conversion forms please read the X9.62 standard.
+B<Note> Due to patent issues the B<compressed> option is disabled
+by default for binary curves and can be enabled by defining
+the preprocessor macro B<OPENSSL_EC_BIN_PT_COMP> at compile time.
+
+=item B<-param_enc arg>
+
+This specifies how the elliptic curve parameters are encoded.
+Possible value are: B<named_curve>, i.e. the ec parameters are
+specified by a OID, or B<explicit> where the ec parameters are
+explicitly given (see RFC 3279 for the definition of the 
+EC parameters structures). The default value is B<named_curve>.
+B<Note> the B<implicitlyCA> alternative ,as specified in RFC 3279,
+is currently not implemented in OpenSSL.
+
+=item B<-no_seed>
+
+This option inhibits that the 'seed' for the parameter generation
+is included in the ECParameters structure (see RFC 3279).
+
+=item B<-genkey>
+
+This option will generate a EC private key using the specified parameters.
+
+=item B<-rand file(s)>
+
+a file or files containing random data used to seed the random number
+generator, or an EGD socket (see L<RAND_egd(3)|RAND_egd(3)>).
+Multiple files can be specified separated by a OS-dependent character.
+The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
+all others.
+
+=item B<-engine id>
+
+specifying an engine (by it's unique B<id> string) will cause B<req>
+to attempt to obtain a functional reference to the specified engine,
+thus initialising it if needed. The engine will then be set as the default
+for all available algorithms.
+
+=back
+
+=head1 NOTES
+
+PEM format EC parameters use the header and footer lines:
+
+ -----BEGIN EC PARAMETERS-----
+ -----END EC PARAMETERS-----
+
+OpenSSL is currently not able to generate new groups and therefore
+B<ecparam> can only create EC parameters from known (named) curves. 
+
+=head1 EXAMPLES
+
+To create EC parameters with the group 'prime192v1':
+
+  openssl ecparam -out ec_param.pem -name prime192v1
+
+To create EC parameters with explicit parameters:
+
+  openssl ecparam -out ec_param.pem -name prime192v1 -param_enc explicit
+
+To validate given EC parameters:
+
+  openssl ecparam -in ec_param.pem -check
+
+To create EC parameters and a private key:
+
+  openssl ecparam -out ec_key.pem -name prime192v1 -genkey
+
+To change the point encoding to 'compressed':
+
+  openssl ecparam -in ec_in.pem -out ec_out.pem -conv_form compressed
+
+To print out the EC parameters to standard output:
+
+  openssl ecparam -in ec_param.pem -noout -text
+
+=head1 SEE ALSO
+
+L<ec(1)|ec(1)>, L<dsaparam(1)|dsaparam(1)>
+
+=head1 HISTORY
+
+The ecparam command was first introduced in OpenSSL 0.9.8.
+
+=head1 AUTHOR
+
+Nils Larsch for the OpenSSL project (http://www.openssl.org)
+
+=cut
diff --git a/src/lib/libssl/src/doc/apps/x509v3_config.pod b/src/lib/libssl/src/doc/apps/x509v3_config.pod
new file mode 100644
index 0000000000..38c46e85c4
--- /dev/null
+++ b/src/lib/libssl/src/doc/apps/x509v3_config.pod
@@ -0,0 +1,456 @@
+=pod
+
+=for comment openssl_manual_section:5
+
+=head1 NAME
+
+x509v3_config - X509 V3 certificate extension configuration format
+
+=head1 DESCRIPTION
+
+Several of the OpenSSL utilities can add extensions to a certificate or
+certificate request based on the contents of a configuration file.
+
+Typically the application will contain an option to point to an extension
+section. Each line of the extension section takes the form:
+
+ extension_name=[critical,] extension_options
+
+If B<critical> is present then the extension will be critical.
+
+The format of B<extension_options> depends on the value of B<extension_name>.
+
+There are four main types of extension: I<string> extensions, I<multi-valued>
+extensions, I<raw> and I<arbitrary> extensions.
+
+String extensions simply have a string which contains either the value itself
+or how it is obtained.
+
+For example:
+
+ nsComment="This is a Comment"
+
+Multi-valued extensions have a short form and a long form. The short form
+is a list of names and values:
+
+ basicConstraints=critical,CA:true,pathlen:1
+
+The long form allows the values to be placed in a separate section:
+
+ basicConstraints=critical,@bs_section
+
+ [bs_section]
+
+ CA=true
+ pathlen=1
+
+Both forms are equivalent.
+
+The syntax of raw extensions is governed by the extension code: it can
+for example contain data in multiple sections. The correct syntax to
+use is defined by the extension code itself: check out the certificate
+policies extension for an example.
+
+If an extension type is unsupported then the I<arbitrary> extension syntax
+must be used, see the L<ARBITRART EXTENSIONS|/"ARBITRARY EXTENSIONS"> section for more details.
+
+=head1 STANDARD EXTENSIONS
+
+The following sections describe each supported extension in detail.
+
+=head2 Basic Constraints.
+
+This is a multi valued extension which indicates whether a certificate is
+a CA certificate. The first (mandatory) name is B<CA> followed by B<TRUE> or
+B<FALSE>. If B<CA> is B<TRUE> then an optional B<pathlen> name followed by an
+non-negative value can be included.
+
+For example:
+
+ basicConstraints=CA:TRUE
+
+ basicConstraints=CA:FALSE
+
+ basicConstraints=critical,CA:TRUE, pathlen:0
+
+A CA certificate B<must> include the basicConstraints value with the CA field
+set to TRUE. An end user certificate must either set CA to FALSE or exclude the
+extension entirely. Some software may require the inclusion of basicConstraints
+with CA set to FALSE for end entity certificates.
+
+The pathlen parameter indicates the maximum number of CAs that can appear
+below this one in a chain. So if you have a CA with a pathlen of zero it can
+only be used to sign end user certificates and not further CAs.
+
+
+=head2 Key Usage.
+
+Key usage is a multi valued extension consisting of a list of names of the
+permitted key usages.
+
+The supporte names are: digitalSignature, nonRepudiation, keyEncipherment,
+dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly
+and decipherOnly.
+
+Examples:
+
+ keyUsage=digitalSignature, nonRepudiation
+
+ keyUsage=critical, keyCertSign
+
+
+=head2 Extended Key Usage.
+
+This extensions consists of a list of usages indicating purposes for which
+the certificate public key can be used for,
+
+These can either be object short names of the dotted numerical form of OIDs.
+While any OID can be used only certain values make sense. In particular the
+following PKIX, NS and MS values are meaningful:
+
+ Value                  Meaning
+ -----                  -------
+ serverAuth             SSL/TLS Web Server Authentication.
+ clientAuth             SSL/TLS Web Client Authentication.
+ codeSigning            Code signing.
+ emailProtection        E-mail Protection (S/MIME).
+ timeStamping           Trusted Timestamping
+ msCodeInd              Microsoft Individual Code Signing (authenticode)
+ msCodeCom              Microsoft Commercial Code Signing (authenticode)
+ msCTLSign              Microsoft Trust List Signing
+ msSGC                  Microsoft Server Gated Crypto
+ msEFS                  Microsoft Encrypted File System
+ nsSGC                  Netscape Server Gated Crypto
+
+Examples:
+
+ extendedKeyUsage=critical,codeSigning,1.2.3.4
+ extendedKeyUsage=nsSGC,msSGC
+
+
+=head2 Subject Key Identifier.
+
+This is really a string extension and can take two possible values. Either
+the word B<hash> which will automatically follow the guidelines in RFC3280
+or a hex string giving the extension value to include. The use of the hex
+string is strongly discouraged.
+
+Example:
+
+ subjectKeyIdentifier=hash
+
+
+=head2 Authority Key Identifier.
+
+The authority key identifier extension permits two options. keyid and issuer:
+both can take the optional value "always".
+
+If the keyid option is present an attempt is made to copy the subject key
+identifier from the parent certificate. If the value "always" is present
+then an error is returned if the option fails.
+
+The issuer option copies the issuer and serial number from the issuer
+certificate. This will only be done if the keyid option fails or
+is not included unless the "always" flag will always include the value.
+
+Example:
+
+ authorityKeyIdentifier=keyid,issuer
+
+
+=head2 Subject Alternative Name.
+
+The subject alternative name extension allows various literal values to be
+included in the configuration file. These include B<email> (an email address)
+B<URI> a uniform resource indicator, B<DNS> (a DNS domain name), B<RID> (a
+registered ID: OBJECT IDENTIFIER), B<IP> (an IP address), B<dirName>
+(a distinguished name) and otherName.
+
+The email option include a special 'copy' value. This will automatically
+include and email addresses contained in the certificate subject name in
+the extension.
+
+The IP address used in the B<IP> options can be in either IPv4 or IPv6 format.
+
+The value of B<dirName> should point to a section containing the distinguished
+name to use as a set of name value pairs. Multi values AVAs can be formed by
+preceeding the name with a B<+> character.
+
+otherName can include arbitrary data associated with an OID: the value
+should be the OID followed by a semicolon and the content in standard
+ASN1_generate_nconf() format.
+
+Examples:
+
+ subjectAltName=email:copy,email:my@other.address,URI:http://my.url.here/
+ subjectAltName=IP:192.168.7.1
+ subjectAltName=IP:13::17
+ subjectAltName=email:my@other.address,RID:1.2.3.4
+ subjectAltName=otherName:1.2.3.4;UTF8:some other identifier
+
+ subjectAltName=dirName:dir_sect
+
+ [dir_sect]
+ C=UK
+ O=My Organization
+ OU=My Unit
+ CN=My Name
+
+
+=head2 Issuer Alternative Name.
+
+The issuer alternative name option supports all the literal options of
+subject alternative name. It does B<not> support the email:copy option because
+that would not make sense. It does support an additional issuer:copy option
+that will copy all the subject alternative name values from the issuer 
+certificate (if possible).
+
+Example:
+
+ issuserAltName = issuer:copy
+
+
+=head2 Authority Info Access.
+
+The authority information access extension gives details about how to access
+certain information relating to the CA. Its syntax is accessOID;location
+where I<location> has the same syntax as subject alternative name (except
+that email:copy is not supported). accessOID can be any valid OID but only
+certain values are meaningful, for example OCSP and caIssuers.
+
+Example:
+
+ authorityInfoAccess = OCSP;URI:http://ocsp.my.host/
+ authorityInfoAccess = caIssuers;URI:http://my.ca/ca.html
+
+
+=head2 CRL distribution points.
+
+This is a multi-valued extension that supports all the literal options of
+subject alternative name. Of the few software packages that currently interpret
+this extension most only interpret the URI option.
+
+Currently each option will set a new DistributionPoint with the fullName
+field set to the given value.
+
+Other fields like cRLissuer and reasons cannot currently be set or displayed:
+at this time no examples were available that used these fields.
+
+Examples:
+
+ crlDistributionPoints=URI:http://myhost.com/myca.crl
+ crlDistributionPoints=URI:http://my.com/my.crl,URI:http://oth.com/my.crl
+
+=head2 Certificate Policies.
+
+This is a I<raw> extension. All the fields of this extension can be set by
+using the appropriate syntax.
+
+If you follow the PKIX recommendations and just using one OID then you just
+include the value of that OID. Multiple OIDs can be set separated by commas,
+for example:
+
+ certificatePolicies= 1.2.4.5, 1.1.3.4
+
+If you wish to include qualifiers then the policy OID and qualifiers need to
+be specified in a separate section: this is done by using the @section syntax
+instead of a literal OID value.
+
+The section referred to must include the policy OID using the name
+policyIdentifier, cPSuri qualifiers can be included using the syntax:
+
+ CPS.nnn=value
+
+userNotice qualifiers can be set using the syntax:
+
+ userNotice.nnn=@notice
+
+The value of the userNotice qualifier is specified in the relevant section.
+This section can include explicitText, organization and noticeNumbers
+options. explicitText and organization are text strings, noticeNumbers is a
+comma separated list of numbers. The organization and noticeNumbers options
+(if included) must BOTH be present. If you use the userNotice option with IE5
+then you need the 'ia5org' option at the top level to modify the encoding:
+otherwise it will not be interpreted properly.
+
+Example:
+
+ certificatePolicies=ia5org,1.2.3.4,1.5.6.7.8,@polsect
+
+ [polsect]
+
+ policyIdentifier = 1.3.5.8
+ CPS.1="http://my.host.name/"
+ CPS.2="http://my.your.name/"
+ userNotice.1=@notice
+
+ [notice]
+
+ explicitText="Explicit Text Here"
+ organization="Organisation Name"
+ noticeNumbers=1,2,3,4
+
+The B<ia5org> option changes the type of the I<organization> field. In RFC2459
+it can only be of type DisplayText. In RFC3280 IA5Strring is also permissible.
+Some software (for example some versions of MSIE) may require ia5org.
+
+=head2 Policy Constraints
+
+This is a multi-valued extension which consisting of the names
+B<requireExplicitPolicy> or B<inhibitPolicyMapping> and a non negative intger
+value. At least one component must be present.
+
+Example:
+
+ policyConstraints = requireExplicitPolicy:3
+
+
+=head2 Inhibit Any Policy
+
+This is a string extension whose value must be a non negative integer.
+
+Example:
+
+ inhibitAnyPolicy = 2
+
+
+=head2 Name Constraints
+
+The name constraints extension is a multi-valued extension. The name should
+begin with the word B<permitted> or B<excluded> followed by a B<;>. The rest of
+the name and the value follows the syntax of subjectAltName except email:copy
+is not supported and the B<IP> form should consist of an IP addresses and 
+subnet mask separated by a B</>.
+
+Examples:
+
+ nameConstraints=permitted;IP:192.168.0.0/255.255.0.0
+
+ nameConstraints=permitted;email:.somedomain.com
+
+ nameConstraints=excluded;email:.com
+
+=head1 DEPRECATED EXTENSIONS
+
+The following extensions are non standard, Netscape specific and largely
+obsolete. Their use in new applications is discouraged.
+
+=head2 Netscape String extensions.
+
+Netscape Comment (B<nsComment>) is a string extension containing a comment
+which will be displayed when the certificate is viewed in some browsers.
+
+Example:
+
+ nsComment = "Some Random Comment"
+
+Other supported extensions in this category are: B<nsBaseUrl>,
+B<nsRevocationUrl>, B<nsCaRevocationUrl>, B<nsRenewalUrl>, B<nsCaPolicyUrl>
+and B<nsSslServerName>.
+
+
+=head2 Netscape Certificate Type
+
+This is a multi-valued extensions which consists of a list of flags to be
+included. It was used to indicate the purposes for which a certificate could
+be used. The basicConstraints, keyUsage and extended key usage extensions are
+now used instead.
+
+Acceptable values for nsCertType are: B<client>, B<server>, B<email>,
+B<objsign>, B<reserved>, B<sslCA>, B<emailCA>, B<objCA>.
+
+
+=head1 ARBITRARY EXTENSIONS
+
+If an extension is not supported by the OpenSSL code then it must be encoded
+using the arbitrary extension format. It is also possible to use the arbitrary
+format for supported extensions. Extreme care should be taken to ensure that
+the data is formatted correctly for the given extension type.
+
+There are two ways to encode arbitrary extensions.
+
+The first way is to use the word ASN1 followed by the extension content
+using the same syntax as ASN1_generate_nconf(). For example:
+
+ 1.2.3.4=critical,ASN1:UTF8String:Some random data
+
+ 1.2.3.4=ASN1:SEQUENCE:seq_sect
+
+ [seq_sect]
+
+ field1 = UTF8:field1
+ field2 = UTF8:field2
+
+It is also possible to use the word DER to include the raw encoded data in any
+extension.
+
+ 1.2.3.4=critical,DER:01:02:03:04
+ 1.2.3.4=DER:01020304
+
+The value following DER is a hex dump of the DER encoding of the extension
+Any extension can be placed in this form to override the default behaviour.
+For example:
+
+ basicConstraints=critical,DER:00:01:02:03
+
+=head1 WARNING
+
+There is no guarantee that a specific implementation will process a given
+extension. It may therefore be sometimes possible to use certificates for
+purposes prohibited by their extensions because a specific application does
+not recognize or honour the values of the relevant extensions.
+
+The DER and ASN1 options should be used with caution. It is possible to create
+totally invalid extensions if they are not used carefully.
+
+
+=head1 NOTES
+
+If an extension is multi-value and a field value must contain a comma the long
+form must be used otherwise the comma would be misinterpreted as a field
+separator. For example:
+
+ subjectAltName=URI:ldap://somehost.com/CN=foo,OU=bar
+
+will produce an error but the equivalent form:
+
+ subjectAltName=@subject_alt_section
+
+ [subject_alt_section]
+ subjectAltName=URI:ldap://somehost.com/CN=foo,OU=bar
+
+is valid. 
+
+Due to the behaviour of the OpenSSL B<conf> library the same field name
+can only occur once in a section. This means that:
+
+ subjectAltName=@alt_section
+
+ [alt_section]
+
+ email=steve@here
+ email=steve@there
+
+will only recognize the last value. This can be worked around by using the form:
+
+ [alt_section]
+
+ email.1=steve@here
+ email.2=steve@there
+
+=head1 HISTORY
+
+The X509v3 extension code was first added to OpenSSL 0.9.2.
+
+Policy mappings, inhibit any policy and name constraints support was added in
+OpenSSL 0.9.8
+
+The B<directoryName> and B<otherName> option as well as the B<ASN1> option
+for arbitrary extensions was added in OpenSSL 0.9.8
+
+=head1 SEE ALSO
+
+L<req(1)|req(1)>, L<ca(1)|ca(1)>, L<x509(1)|x509(1)>
+
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ASN1_generate_nconf.pod b/src/lib/libssl/src/doc/crypto/ASN1_generate_nconf.pod
new file mode 100644
index 0000000000..1157cff510
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ASN1_generate_nconf.pod
@@ -0,0 +1,262 @@
+=pod
+
+=head1 NAME
+
+ASN1_generate_nconf, ASN1_generate_v3 - ASN1 generation functions
+
+=head1 SYNOPSIS
+
+ ASN1_TYPE *ASN1_generate_nconf(char *str, CONF *nconf);
+ ASN1_TYPE *ASN1_generate_v3(char *str, X509V3_CTX *cnf);
+
+=head1 DESCRIPTION
+
+These functions generate the ASN1 encoding of a string
+in an B<ASN1_TYPE> structure.
+
+B<str> contains the string to encode B<nconf> or B<cnf> contains
+the optional configuration information where additional strings
+will be read from. B<nconf> will typically come from a config
+file wherease B<cnf> is obtained from an B<X509V3_CTX> structure
+which will typically be used by X509 v3 certificate extension
+functions. B<cnf> or B<nconf> can be set to B<NULL> if no additional
+configuration will be used.
+
+=head1 GENERATION STRING FORMAT
+
+The actual data encoded is determined by the string B<str> and
+the configuration information. The general format of the string
+is:
+
+=over 2
+
+=item B<[modifier,]type[:value]>
+
+=back
+
+That is zero or more comma separated modifiers followed by a type
+followed by an optional colon and a value. The formats of B<type>,
+B<value> and B<modifier> are explained below.
+
+=head2 SUPPORTED TYPES
+
+The supported types are listed below. Unless otherwise specified
+only the B<ASCII> format is permissible.
+
+=over 2
+
+=item B<BOOLEAN>, B<BOOL>
+
+This encodes a boolean type. The B<value> string is mandatory and
+should be B<TRUE> or B<FALSE>. Additionally B<TRUE>, B<true>, B<Y>,
+B<y>, B<YES>, B<yes>, B<FALSE>, B<false>, B<N>, B<n>, B<NO> and B<no>
+are acceptable. 
+
+=item B<NULL>
+
+Encode the B<NULL> type, the B<value> string must not be present.
+
+=item B<INTEGER>, B<INT>
+
+Encodes an ASN1 B<INTEGER> type. The B<value> string represents
+the value of the integer, it can be preceeded by a minus sign and
+is normally interpreted as a decimal value unless the prefix B<0x>
+is included.
+
+=item B<ENUMERATED>, B<ENUM>
+
+Encodes the ASN1 B<ENUMERATED> type, it is otherwise identical to
+B<INTEGER>.
+
+=item B<OBJECT>, B<OID>
+
+Encodes an ASN1 B<OBJECT IDENTIFIER>, the B<value> string can be
+a short name, a long name or numerical format.
+
+=item B<UTCTIME>, B<UTC>
+
+Encodes an ASN1 B<UTCTime> structure, the value should be in
+the format B<YYMMDDHHMMSSZ>. 
+
+=item B<GENERALIZEDTIME>, B<GENTIME>
+
+Encodes an ASN1 B<GeneralizedTime> structure, the value should be in
+the format B<YYYYMMDDHHMMSSZ>. 
+
+=item B<OCTETSTRING>, B<OCT>
+
+Encodes an ASN1 B<OCTET STRING>. B<value> represents the contents
+of this structure, the format strings B<ASCII> and B<HEX> can be
+used to specify the format of B<value>.
+
+=item B<BITSTRING>, B<BITSTR>
+
+Encodes an ASN1 B<BIT STRING>. B<value> represents the contents
+of this structure, the format strings B<ASCII>, B<HEX> and B<BITLIST>
+can be used to specify the format of B<value>.
+
+If the format is anything other than B<BITLIST> the number of unused
+bits is set to zero.
+
+=item B<UNIVERSALSTRING>, B<UNIV>, B<IA5>, B<IA5STRING>, B<UTF8>,
+B<UTF8String>, B<BMP>, B<BMPSTRING>, B<VISIBLESTRING>,
+B<VISIBLE>, B<PRINTABLESTRING>, B<PRINTABLE>, B<T61>,
+B<T61STRING>, B<TELETEXSTRING>, B<GeneralString>
+
+These encode the corresponding string types. B<value> represents the
+contents of this structure. The format can be B<ASCII> or B<UTF8>.
+
+=item B<SEQUENCE>, B<SEQ>, B<SET>
+
+Formats the result as an ASN1 B<SEQUENCE> or B<SET> type. B<value>
+should be a section name which will contain the contents. The
+field names in the section are ignored and the values are in the
+generated string format. If B<value> is absent then an empty SEQUENCE
+will be encoded.
+
+=back
+
+=head2 MODIFIERS
+
+Modifiers affect the following structure, they can be used to
+add EXPLICIT or IMPLICIT tagging, add wrappers or to change
+the string format of the final type and value. The supported
+formats are documented below.
+
+=over 2
+
+=item B<EXPLICIT>, B<EXP>
+
+Add an explicit tag to the following structure. This string
+should be followed by a colon and the tag value to use as a
+decimal value.
+
+By following the number with B<U>, B<A>, B<P> or B<C> UNIVERSAL,
+APPLICATION, PRIVATE or CONTEXT SPECIFIC tagging can be used,
+the default is CONTEXT SPECIFIC.
+
+=item B<IMPLICIT>, B<IMP>
+
+This is the same as B<EXPLICIT> except IMPLICIT tagging is used
+instead.
+
+=item B<OCTWRAP>, B<SEQWRAP>, B<SETWRAP>, B<BITWRAP>
+
+The following structure is surrounded by an OCTET STRING, a SEQUENCE,
+a SET or a BIT STRING respectively. For a BIT STRING the number of unused
+bits is set to zero.
+
+=item B<FORMAT>
+
+This specifies the format of the ultimate value. It should be followed
+by a colon and one of the strings B<ASCII>, B<UTF8>, B<HEX> or B<BITLIST>.
+
+If no format specifier is included then B<ASCII> is used. If B<UTF8> is
+specified then the value string must be a valid B<UTF8> string. For B<HEX> the
+output must be a set of hex digits. B<BITLIST> (which is only valid for a BIT
+STRING) is a comma separated list of the indices of the set bits, all other
+bits are zero.
+
+=back
+
+=head1 EXAMPLES
+
+A simple IA5String:
+
+ IA5STRING:Hello World
+
+An IA5String explicitly tagged:
+
+ EXPLICIT:0,IA5STRING:Hello World
+
+An IA5String explicitly tagged using APPLICATION tagging:
+
+ EXPLICIT:0A,IA5STRING:Hello World
+
+A BITSTRING with bits 1 and 5 set and all others zero:
+
+ FORMAT=BITLIST,BITSTRING:1,5
+
+A more complex example using a config file to produce a
+SEQUENCE consiting of a BOOL an OID and a UTF8String:
+
+ asn1 = SEQUENCE:seq_section
+
+ [seq_section]
+
+ field1 = BOOLEAN:TRUE
+ field2 = OID:commonName
+ field3 = UTF8:Third field
+
+This example produces an RSAPrivateKey structure, this is the
+key contained in the file client.pem in all OpenSSL distributions
+(note: the field names such as 'coeff' are ignored and are present just
+for clarity):
+
+ asn1=SEQUENCE:private_key
+ [private_key]
+ version=INTEGER:0
+
+ n=INTEGER:0xBB6FE79432CC6EA2D8F970675A5A87BFBE1AFF0BE63E879F2AFFB93644\
+ D4D2C6D000430DEC66ABF47829E74B8C5108623A1C0EE8BE217B3AD8D36D5EB4FCA1D9
+
+ e=INTEGER:0x010001
+
+ d=INTEGER:0x6F05EAD2F27FFAEC84BEC360C4B928FD5F3A9865D0FCAAD291E2A52F4A\
+ F810DC6373278C006A0ABBA27DC8C63BF97F7E666E27C5284D7D3B1FFFE16B7A87B51D
+
+ p=INTEGER:0xF3929B9435608F8A22C208D86795271D54EBDFB09DDEF539AB083DA912\
+ D4BD57
+
+ q=INTEGER:0xC50016F89DFF2561347ED1186A46E150E28BF2D0F539A1594BBD7FE467\
+ 46EC4F
+
+ exp1=INTEGER:0x9E7D4326C924AFC1DEA40B45650134966D6F9DFA3A7F9D698CD4ABEA\
+ 9C0A39B9
+
+ exp2=INTEGER:0xBA84003BB95355AFB7C50DF140C60513D0BA51D637272E355E397779\
+ E7B2458F
+
+ coeff=INTEGER:0x30B9E4F2AFA5AC679F920FC83F1F2DF1BAF1779CF989447FABC2F5\
+ 628657053A
+
+This example is the corresponding public key in a SubjectPublicKeyInfo
+structure:
+
+ # Start with a SEQUENCE
+ asn1=SEQUENCE:pubkeyinfo
+
+ # pubkeyinfo contains an algorithm identifier and the public key wrapped
+ # in a BIT STRING
+ [pubkeyinfo]
+ algorithm=SEQUENCE:rsa_alg
+ pubkey=BITWRAP,SEQUENCE:rsapubkey
+
+ # algorithm ID for RSA is just an OID and a NULL
+ [rsa_alg]
+ algorithm=OID:rsaEncryption
+ parameter=NULL
+
+ # Actual public key: modulus and exponent
+ [rsapubkey]
+ n=INTEGER:0xBB6FE79432CC6EA2D8F970675A5A87BFBE1AFF0BE63E879F2AFFB93644\
+ D4D2C6D000430DEC66ABF47829E74B8C5108623A1C0EE8BE217B3AD8D36D5EB4FCA1D9
+
+ e=INTEGER:0x010001
+
+=head1 RETURN VALUES
+
+ASN1_generate_nconf() and ASN1_generate_v3() return the encoded
+data as an B<ASN1_TYPE> structure or B<NULL> if an error occurred.
+
+The error codes that can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 SEE ALSO
+
+L<ERR_get_error(3)|ERR_get_error(3)>
+
+=head1 HISTORY
+
+ASN1_generate_nconf() and ASN1_generate_v3() were added to OpenSSL 0.9.8
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_BLINDING_new.pod b/src/lib/libssl/src/doc/crypto/BN_BLINDING_new.pod
new file mode 100644
index 0000000000..7b087f7288
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/BN_BLINDING_new.pod
@@ -0,0 +1,109 @@
+=pod
+
+=head1 NAME
+
+BN_BLINDING_new, BN_BLINDING_free, BN_BLINDING_update, BN_BLINDING_convert, 
+BN_BLINDING_invert, BN_BLINDING_convert_ex, BN_BLINDING_invert_ex, 
+BN_BLINDING_get_thread_id, BN_BLINDING_set_thread_id, BN_BLINDING_get_flags,
+BN_BLINDING_set_flags, BN_BLINDING_create_param - blinding related BIGNUM
+functions.
+
+=head1 SYNOPSIS
+
+ #include <openssl/bn.h>
+
+ BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai,
+        BIGNUM *mod);
+ void BN_BLINDING_free(BN_BLINDING *b);
+ int BN_BLINDING_update(BN_BLINDING *b,BN_CTX *ctx);
+ int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx);
+ int BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx);
+ int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b,
+        BN_CTX *ctx);
+ int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b,
+        BN_CTX *ctx);
+ unsigned long BN_BLINDING_get_thread_id(const BN_BLINDING *);
+ void BN_BLINDING_set_thread_id(BN_BLINDING *, unsigned long);
+ unsigned long BN_BLINDING_get_flags(const BN_BLINDING *);
+ void BN_BLINDING_set_flags(BN_BLINDING *, unsigned long);
+ BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b,
+        const BIGNUM *e, BIGNUM *m, BN_CTX *ctx,
+        int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                          const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx),
+        BN_MONT_CTX *m_ctx);
+
+=head1 DESCRIPTION
+
+BN_BLINDING_new() allocates a new B<BN_BLINDING> structure and copies
+the B<A> and B<Ai> values into the newly created B<BN_BLINDING> object.
+
+BN_BLINDING_free() frees the B<BN_BLINDING> structure.
+
+BN_BLINDING_update() updates the B<BN_BLINDING> parameters by squaring
+the B<A> and B<Ai> or, after specific number of uses and if the
+necessary parameters are set, by re-creating the blinding parameters.
+
+BN_BLINDING_convert_ex() multiplies B<n> with the blinding factor B<A>.
+If B<r> is not NULL a copy the inverse blinding factor B<Ai> will be
+returned in B<r> (this is useful if a B<RSA> object is shared amoung
+several threads). BN_BLINDING_invert_ex() multiplies B<n> with the
+inverse blinding factor B<Ai>. If B<r> is not NULL it will be used as
+the inverse blinding.
+
+BN_BLINDING_convert() and BN_BLINDING_invert() are wrapper
+functions for BN_BLINDING_convert_ex() and BN_BLINDING_invert_ex()
+with B<r> set to NULL.
+
+BN_BLINDING_set_thread_id() and BN_BLINDING_get_thread_id()
+set and get the "thread id" value of the B<BN_BLINDING> structure,
+a field provided to users of B<BN_BLINDING> structure to help them
+provide proper locking if needed for multi-threaded use. The 
+"thread id" of a newly allocated B<BN_BLINDING> structure is zero.
+
+BN_BLINDING_get_flags() returns the BN_BLINDING flags. Currently
+there are two supported flags: B<BN_BLINDING_NO_UPDATE> and
+B<BN_BLINDING_NO_RECREATE>. B<BN_BLINDING_NO_UPDATE> inhibits the
+automatic update of the B<BN_BLINDING> parameters after each use
+and B<BN_BLINDING_NO_RECREATE> inhibits the automatic re-creation
+of the B<BN_BLINDING> parameters after a fixed number of uses (currently
+32). In newly allocated B<BN_BLINDING> objects no flags are set.
+BN_BLINDING_set_flags() sets the B<BN_BLINDING> parameters flags.
+
+BN_BLINDING_create_param() creates new B<BN_BLINDING> parameters
+using the exponent B<e> and the modulus B<m>. B<bn_mod_exp> and
+B<m_ctx> can be used to pass special functions for exponentiation
+(normally BN_mod_exp_mont() and B<BN_MONT_CTX>).
+
+=head1 RETURN VALUES
+
+BN_BLINDING_new() returns the newly allocated B<BN_BLINDING> structure
+or NULL in case of an error.
+
+BN_BLINDING_update(), BN_BLINDING_convert(), BN_BLINDING_invert(),
+BN_BLINDING_convert_ex() and BN_BLINDING_invert_ex() return 1 on
+success and 0 if an error occured.
+
+BN_BLINDING_get_thread_id() returns the thread id (a B<unsigned long>
+value) or 0 if not set.
+
+BN_BLINDING_get_flags() returns the currently set B<BN_BLINDING> flags
+(a B<unsigned long> value).
+
+BN_BLINDING_create_param() returns the newly created B<BN_BLINDING> 
+parameters or NULL on error.
+
+=head1 SEE ALSO
+
+L<bn(3)|bn(3)>
+
+=head1 HISTORY
+
+BN_BLINDING_convert_ex, BN_BLINDIND_invert_ex, BN_BLINDING_get_thread_id,
+BN_BLINDING_set_thread_id, BN_BLINDING_set_flags, BN_BLINDING_get_flags
+and BN_BLINDING_create_param were first introduced in OpenSSL 0.9.8
+
+=head1 AUTHOR
+
+Nils Larsch for the OpenSSL project (http://www.openssl.org).
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ERR_set_mark.pod b/src/lib/libssl/src/doc/crypto/ERR_set_mark.pod
new file mode 100644
index 0000000000..d3ca4f2e77
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ERR_set_mark.pod
@@ -0,0 +1,38 @@
+=pod
+
+=head1 NAME
+
+ERR_set_mark, ERR_pop_to_mark - set marks and pop errors until mark
+
+=head1 SYNOPSIS
+
+ #include <openssl/err.h>
+
+ int ERR_set_mark(void);
+
+ int ERR_pop_to_mark(void);
+
+=head1 DESCRIPTION
+
+ERR_set_mark() sets a mark on the current topmost error record if there
+is one.
+
+ERR_pop_to_mark() will pop the top of the error stack until a mark is found.
+The mark is then removed.  If there is no mark, the whole stack is removed.
+
+=head1 RETURN VALUES
+
+ERR_set_mark() returns 0 if the error stack is empty, otherwise 1.
+
+ERR_pop_to_mark() returns 0 if there was no mark in the error stack, which
+implies that the stack became empty, otherwise 1.
+
+=head1 SEE ALSO
+
+L<err(3)|err(3)>
+
+=head1 HISTORY
+
+ERR_set_mark() and ERR_pop_to_mark() were added in OpenSSL 0.9.8.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/OPENSSL_Applink.pod b/src/lib/libssl/src/doc/crypto/OPENSSL_Applink.pod
new file mode 100644
index 0000000000..e54de12cc8
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/OPENSSL_Applink.pod
@@ -0,0 +1,21 @@
+=pod
+
+=head1 NAME
+
+OPENSSL_Applink - glue between OpenSSL BIO and Win32 compiler run-time
+
+=head1 SYNOPSIS
+
+ __declspec(dllexport) void **OPENSSL_Applink();
+
+=head1 DESCRIPTION
+
+OPENSSL_Applink is application-side interface which provides a glue
+between OpenSSL BIO layer and Win32 compiler run-time environment.
+Even though it appears at application side, it's essentially OpenSSL
+private interface. For this reason application developers are not
+expected to implement it, but to compile provided module with
+compiler of their choice and link it into the target application.
+The referred module is available as <openssl>/ms/applink.c.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/OPENSSL_ia32cap.pod b/src/lib/libssl/src/doc/crypto/OPENSSL_ia32cap.pod
new file mode 100644
index 0000000000..2e659d34a5
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/OPENSSL_ia32cap.pod
@@ -0,0 +1,43 @@
+=pod
+
+=head1 NAME
+
+OPENSSL_ia32cap - finding the IA-32 processor capabilities
+
+=head1 SYNOPSIS
+
+ unsigned long *OPENSSL_ia32cap_loc(void);
+ #define OPENSSL_ia32cap (*(OPENSSL_ia32cap_loc()))
+
+=head1 DESCRIPTION
+
+Value returned by OPENSSL_ia32cap_loc() is address of a variable
+containing IA-32 processor capabilities bit vector as it appears in EDX
+register after executing CPUID instruction with EAX=1 input value (see
+Intel Application Note #241618). Naturally it's meaningful on IA-32[E]
+platforms only. The variable is normally set up automatically upon
+toolkit initialization, but can be manipulated afterwards to modify
+crypto library behaviour. For the moment of this writing six bits are
+significant, namely:
+
+1. bit #28 denoting Hyperthreading, which is used to distiguish
+   cores with shared cache;
+2. bit #26 denoting SSE2 support;
+3. bit #25 denoting SSE support;
+4. bit #23 denoting MMX support;
+5. bit #20, reserved by Intel, is used to choose between RC4 code
+   pathes;
+6. bit #4 denoting presence of Time-Stamp Counter.
+
+For example, clearing bit #26 at run-time disables high-performance
+SSE2 code present in the crypto library. You might have to do this if
+target OpenSSL application is executed on SSE2 capable CPU, but under
+control of OS which does not support SSE2 extentions. Even though you
+can manipulate the value programmatically, you most likely will find it
+more appropriate to set up an environment variable with the same name
+prior starting target application, e.g. on Intel P4 processor 'env
+OPENSSL_ia32cap=0x12900010 apps/openssl', to achieve same effect
+without modifying the application source code. Alternatively you can
+reconfigure the toolkit with no-sse2 option and recompile.
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/ecdsa.pod b/src/lib/libssl/src/doc/crypto/ecdsa.pod
new file mode 100644
index 0000000000..49b10f2249
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/ecdsa.pod
@@ -0,0 +1,210 @@
+=pod
+
+=head1 NAME
+
+ecdsa - Elliptic Curve Digital Signature Algorithm
+
+=head1 SYNOPSIS
+
+ #include <openssl/ecdsa.h>
+
+ ECDSA_SIG*     ECDSA_SIG_new(void);
+ void           ECDSA_SIG_free(ECDSA_SIG *sig);
+ int            i2d_ECDSA_SIG(const ECDSA_SIG *sig, unsigned char **pp);
+ ECDSA_SIG*     d2i_ECDSA_SIG(ECDSA_SIG **sig, const unsigned char **pp, 
+                long len);
+
+ ECDSA_SIG*     ECDSA_do_sign(const unsigned char *dgst, int dgst_len,
+                        EC_KEY *eckey);
+ ECDSA_SIG*     ECDSA_do_sign_ex(const unsigned char *dgst, int dgstlen, 
+                        const BIGNUM *kinv, const BIGNUM *rp,
+                        EC_KEY *eckey);
+ int            ECDSA_do_verify(const unsigned char *dgst, int dgst_len,
+                        const ECDSA_SIG *sig, EC_KEY* eckey);
+ int            ECDSA_sign_setup(EC_KEY *eckey, BN_CTX *ctx,
+                        BIGNUM **kinv, BIGNUM **rp);
+ int            ECDSA_sign(int type, const unsigned char *dgst,
+                        int dgstlen, unsigned char *sig,
+                        unsigned int *siglen, EC_KEY *eckey);
+ int            ECDSA_sign_ex(int type, const unsigned char *dgst,
+                        int dgstlen, unsigned char *sig,
+                        unsigned int *siglen, const BIGNUM *kinv, 
+                        const BIGNUM *rp, EC_KEY *eckey);
+ int            ECDSA_verify(int type, const unsigned char *dgst,
+                        int dgstlen, const unsigned char *sig,
+                        int siglen, EC_KEY *eckey);
+ int            ECDSA_size(const EC_KEY *eckey);
+
+ const ECDSA_METHOD*    ECDSA_OpenSSL(void);
+ void           ECDSA_set_default_method(const ECDSA_METHOD *meth);
+ const ECDSA_METHOD*    ECDSA_get_default_method(void);
+ int            ECDSA_set_method(EC_KEY *eckey,const ECDSA_METHOD *meth);
+
+ int            ECDSA_get_ex_new_index(long argl, void *argp,
+                        CRYPTO_EX_new *new_func,
+                        CRYPTO_EX_dup *dup_func,
+                        CRYPTO_EX_free *free_func);
+ int            ECDSA_set_ex_data(EC_KEY *d, int idx, void *arg);
+ void*          ECDSA_get_ex_data(EC_KEY *d, int idx);
+
+=head1 DESCRIPTION
+
+The B<ECDSA_SIG> structure consists of two BIGNUMs for the
+r and s value of a ECDSA signature (see X9.62 or FIPS 186-2).
+
+ struct
+        {
+        BIGNUM *r;
+        BIGNUM *s;
+ } ECDSA_SIG;
+
+ECDSA_SIG_new() allocates a new B<ECDSA_SIG> structure (note: this
+function also allocates the BIGNUMs) and initialize it.
+
+ECDSA_SIG_free() frees the B<ECDSA_SIG> structure B<sig>.
+
+i2d_ECDSA_SIG() creates the DER encoding of the ECDSA signature
+B<sig> and writes the encoded signature to B<*pp> (note: if B<pp>
+is NULL B<i2d_ECDSA_SIG> returns the expected length in bytes of 
+the DER encoded signature). B<i2d_ECDSA_SIG> returns the length
+of the DER encoded signature (or 0 on error).
+
+d2i_ECDSA_SIG() decodes a DER encoded ECDSA signature and returns
+the decoded signature in a newly allocated B<ECDSA_SIG> structure.
+B<*sig> points to the buffer containing the DER encoded signature
+of size B<len>.
+
+ECDSA_size() returns the maximum length of a DER encoded
+ECDSA signature created with the private EC key B<eckey>.
+
+ECDSA_sign_setup() may be used to precompute parts of the
+signing operation. B<eckey> is the private EC key and B<ctx>
+is a pointer to B<BN_CTX> structure (or NULL). The precomputed
+values or returned in B<kinv> and B<rp> and can be used in a
+later call to B<ECDSA_sign_ex> or B<ECDSA_do_sign_ex>.
+
+ECDSA_sign() is wrapper function for ECDSA_sign_ex with B<kinv>
+and B<rp> set to NULL.
+
+ECDSA_sign_ex() computes a digital signature of the B<dgstlen> bytes
+hash value B<dgst> using the private EC key B<eckey> and the optional
+pre-computed values B<kinv> and B<rp>. The DER encoded signatures is
+stored in B<sig> and it's length is returned in B<sig_len>. Note: B<sig>
+must point to B<ECDSA_size> bytes of memory. The parameter B<type>
+is ignored.
+
+ECDSA_verify() verifies that the signature in B<sig> of size
+B<siglen> is a valid ECDSA signature of the hash value
+value B<dgst> of size B<dgstlen> using the public key B<eckey>.
+The parameter B<type> is ignored.
+
+ECDSA_do_sign() is wrapper function for ECDSA_do_sign_ex with B<kinv>
+and B<rp> set to NULL.
+
+ECDSA_do_sign_ex() computes a digital signature of the B<dgst_len>
+bytes hash value B<dgst> using the private key B<eckey> and the
+optional pre-computed values B<kinv> and B<rp>. The signature is
+returned in a newly allocated B<ECDSA_SIG> structure (or NULL on error).
+
+ECDSA_do_verify() verifies that the signature B<sig> is a valid
+ECDSA signature of the hash value B<dgst> of size B<dgst_len>
+using the public key B<eckey>.
+
+=head1 RETURN VALUES
+
+ECDSA_size() returns the maximum length signature or 0 on error.
+
+ECDSA_sign_setup() and ECDSA_sign() return 1 if successful or -1
+on error.
+
+ECDSA_verify() and ECDSA_do_verify() return 1 for a valid
+signature, 0 for an invalid signature and -1 on error.
+The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+
+=head1 EXAMPLES
+
+Creating a ECDSA signature of given SHA-1 hash value using the
+named curve secp192k1.
+
+First step: create a EC_KEY object (note: this part is B<not> ECDSA
+specific)
+
+ int        ret;
+ ECDSA_SIG *sig;
+ EC_KEY    *eckey = EC_KEY_new();
+ if (eckey == NULL)
+        {
+        /* error */
+        }
+ key->group = EC_GROUP_new_by_nid(NID_secp192k1);
+ if (key->group == NULL)
+        {
+        /* error */
+        }
+ if (!EC_KEY_generate_key(eckey))
+        {
+        /* error */
+        }
+
+Second step: compute the ECDSA signature of a SHA-1 hash value 
+using B<ECDSA_do_sign> 
+
+ sig = ECDSA_do_sign(digest, 20, eckey);
+ if (sig == NULL)
+        {
+        /* error */
+        }
+
+or using B<ECDSA_sign>
+
+ unsigned char *buffer, *pp;
+ int            buf_len;
+ buf_len = ECDSA_size(eckey);
+ buffer  = OPENSSL_malloc(buf_len);
+ pp = buffer;
+ if (!ECDSA_sign(0, dgst, dgstlen, pp, &buf_len, eckey);
+        {
+        /* error */
+        }
+
+Third step: verify the created ECDSA signature using B<ECDSA_do_verify>
+
+ ret = ECDSA_do_verify(digest, 20, sig, eckey);
+
+or using B<ECDSA_verify>
+
+ ret = ECDSA_verify(0, digest, 20, buffer, buf_len, eckey);
+
+and finally evaluate the return value:
+
+ if (ret == -1)
+        {
+        /* error */
+        }
+ else if (ret == 0)
+        {
+        /* incorrect signature */
+        }
+ else   /* ret == 1 */
+        {
+        /* signature ok */
+        }
+
+=head1 CONFORMING TO
+
+ANSI X9.62, US Federal Information Processing Standard FIPS 186-2
+(Digital Signature Standard, DSS)
+
+=head1 SEE ALSO
+
+L<dsa(3)|dsa(3)>, L<rsa(3)|rsa(3)>
+
+=head1 HISTORY
+
+The ecdsa implementation was first introduced in OpenSSL 0.9.8
+
+=head1 AUTHOR
+
+Nils Larsch for the OpenSSL project (http://www.openssl.org).
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/x509.pod b/src/lib/libssl/src/doc/crypto/x509.pod
new file mode 100644
index 0000000000..f9e58e0e41
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/x509.pod
@@ -0,0 +1,64 @@
+=pod
+
+=head1 NAME
+
+x509 - X.509 certificate handling
+
+=head1 SYNOPSIS
+
+ #include <openssl/x509.h>
+
+=head1 DESCRIPTION
+
+A X.509 certificate is a structured grouping of information about
+an individual, a device, or anything one can imagine.  A X.509 CRL
+(certificate revocation list) is a tool to help determine if a
+certificate is still valid.  The exact definition of those can be
+found in the X.509 document from ITU-T, or in RFC3280 from PKIX.
+In OpenSSL, the type X509 is used to express such a certificate, and
+the type X509_CRL is used to express a CRL.
+
+A related structure is a certificate request, defined in PKCS#10 from
+RSA Security, Inc, also reflected in RFC2896.  In OpenSSL, the type
+X509_REQ is used to express such a certificate request.
+
+To handle some complex parts of a certificate, there are the types
+X509_NAME (to express a certificate name), X509_ATTRIBUTE (to express
+a certificate attributes), X509_EXTENSION (to express a certificate
+extension) and a few more.
+
+Finally, there's the supertype X509_INFO, which can contain a CRL, a
+certificate and a corresponding private key.
+
+B<X509_>I<...>, B<d2i_X509_>I<...> and B<i2d_X509_>I<...> handle X.509
+certificates, with some exceptions, shown below.
+
+B<X509_CRL_>I<...>, B<d2i_X509_CRL_>I<...> and B<i2d_X509_CRL_>I<...>
+handle X.509 CRLs.
+
+B<X509_REQ_>I<...>, B<d2i_X509_REQ_>I<...> and B<i2d_X509_REQ_>I<...>
+handle PKCS#10 certificate requests.
+
+B<X509_NAME_>I<...> handle certificate names.
+
+B<X509_ATTRIBUTE_>I<...> handle certificate attributes.
+
+B<X509_EXTENSION_>I<...> handle certificate extensions.
+
+=head1 SEE ALSO
+
+L<X509_NAME_ENTRY_get_object(3)|X509_NAME_ENTRY_get_object(3)>,
+L<X509_NAME_add_entry_by_txt(3)|X509_NAME_add_entry_by_txt(3)>,
+L<X509_NAME_add_entry_by_NID(3)|X509_NAME_add_entry_by_NID(3)>,
+L<X509_NAME_print_ex(3)|X509_NAME_print_ex(3)>,
+L<X509_NAME_new(3)|X509_NAME_new(3)>,
+L<d2i_X509(3)|d2i_X509(3)>,
+L<d2i_X509_ALGOR(3)|d2i_X509_ALGOR(3)>,
+L<d2i_X509_CRL(3)|d2i_X509_CRL(3)>,
+L<d2i_X509_NAME(3)|d2i_X509_NAME(3)>,
+L<d2i_X509_REQ(3)|d2i_X509_REQ(3)>,
+L<d2i_X509_SIG(3)|d2i_X509_SIG(3)>,
+L<crypto(3)|crypto(3)>,
+L<x509v3(3)|x509v3(3)>
+
+=cut
diff --git a/src/lib/libssl/src/engines/Makefile b/src/lib/libssl/src/engines/Makefile
new file mode 100644
index 0000000000..88f8390d0e
--- /dev/null
+++ b/src/lib/libssl/src/engines/Makefile
@@ -0,0 +1,249 @@
+#
+# OpenSSL/engines/Makefile
+#
+
+DIR=    engines
+TOP=    ..
+CC=     cc
+INCLUDES= -I../include
+CFLAG=-g
+MAKEFILE=       Makefile
+AR=             ar r
+
+PEX_LIBS=
+EX_LIBS=
+
+CFLAGS= $(INCLUDES) $(CFLAG)
+
+GENERAL=Makefile engines.com install.com engine_vector.mar
+TEST=
+APPS=
+
+LIB=$(TOP)/libcrypto.a
+LIBNAMES= 4758cca aep atalla cswift gmp chil nuron sureware ubsec
+
+LIBSRC= e_4758cca.c \
+        e_aep.c \
+        e_atalla.c \
+        e_cswift.c \
+        e_gmp.c \
+        e_chil.c \
+        e_nuron.c \
+        e_sureware.c \
+        e_ubsec.c
+LIBOBJ= e_4758cca.o \
+        e_aep.o \
+        e_atalla.o \
+        e_cswift.o \
+        e_gmp.o \
+        e_chil.o \
+        e_nuron.o \
+        e_sureware.o \
+        e_ubsec.o
+
+SRC= $(LIBSRC)
+
+EXHEADER= 
+HEADER= e_4758cca_err.c e_4758cca_err.h \
+        e_aep_err.c e_aep_err.h \
+        e_atalla_err.c e_atalla_err.h \
+        e_cswift_err.c e_cswift_err.h \
+        e_gmp_err.c e_gmp_err.h \
+        e_chil_err.c e_chil_err.h \
+        e_nuron_err.c e_nuron_err.h \
+        e_sureware_err.c e_sureware_err.h \
+        e_ubsec_err.c e_ubsec_err.h
+
+ALL=    $(GENERAL) $(SRC) $(HEADER)
+
+top:
+        (cd ..; $(MAKE) DIRS=$(DIR) all)
+
+all:    lib
+
+lib:    $(LIBOBJ)
+        @if [ -n "$(SHARED_LIBS)" ]; then \
+                set -e; \
+                for l in $(LIBNAMES); do \
+                        $(MAKE) -f ../Makefile.shared -e \
+                                LIBNAME=$$l LIBEXTRAS=e_$$l.o \
+                                LIBDEPS='-L.. -lcrypto $(EX_LIBS)' \
+                                link_o.$(SHLIB_TARGET); \
+                done; \
+        else \
+                $(AR) $(LIB) $(LIBOBJ); \
+                $(RANLIB) $(LIB) || echo Never mind.; \
+        fi; \
+        touch lib
+
+files:
+        $(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
+
+links:
+
+# XXXXX This currently only works on systems that use .so as suffix
+# for shared libraries as well as for Cygwin which uses the
+# dlfcn_name_converter and therefore stores the engines with .so suffix, too.
+# XXXXX This was extended to HP-UX dl targets, which use .sl suffix.
+install:
+        @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
+        @if [ -n "$(SHARED_LIBS)" ]; then \
+                set -e; \
+                for l in $(LIBNAMES); do \
+                        ( echo installing $$l; \
+                          if [ "$(PLATFORM)" != "Cygwin" ]; then \
+                                case "$(CFLAGS)" in \
+                                *DSO_DLFCN*)    sfx="so";;      \
+                                *DSO_DL*)       sfx="sl";;      \
+                                *)              sfx="bad";;     \
+                                esac; \
+                                cp lib$$l.$$sfx $(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines/lib$$l.$$sfx.new; \
+                          else \
+                                sfx="so"; \
+                                cp cyg$$l.dll $(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines/lib$$l.$$sfx.new; \
+                          fi; \
+                          chmod 555 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines/lib$$l.$$sfx.new; \
+                          mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines/lib$$l.$$sfx.new $(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines/lib$$l.$$sfx ); \
+                done; \
+        fi
+
+tags:
+        ctags $(SRC)
+
+errors:
+        set -e; for l in $(LIBNAMES); do \
+                $(PERL) ../util/mkerr.pl -conf e_$$l.ec \
+                        -nostatic -staticloader -write e_$$l.c; \
+        done
+
+tests:
+
+lint:
+        lint -DLINT $(INCLUDES) $(SRC)>fluff
+
+depend:
+        @if [ -z "$(THIS)" ]; then \
+            $(MAKE) -f $(TOP)/Makefile reflect THIS=$@; \
+        else \
+            $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC); \
+        fi
+
+dclean:
+        $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
+        mv -f Makefile.new $(MAKEFILE)
+
+clean:
+        rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+e_4758cca.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+e_4758cca.o: ../include/openssl/bn.h ../include/openssl/buffer.h
+e_4758cca.o: ../include/openssl/crypto.h ../include/openssl/dso.h
+e_4758cca.o: ../include/openssl/e_os2.h ../include/openssl/ec.h
+e_4758cca.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h
+e_4758cca.o: ../include/openssl/engine.h ../include/openssl/err.h
+e_4758cca.o: ../include/openssl/evp.h ../include/openssl/lhash.h
+e_4758cca.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+e_4758cca.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+e_4758cca.o: ../include/openssl/ossl_typ.h ../include/openssl/pkcs7.h
+e_4758cca.o: ../include/openssl/rand.h ../include/openssl/rsa.h
+e_4758cca.o: ../include/openssl/safestack.h ../include/openssl/sha.h
+e_4758cca.o: ../include/openssl/stack.h ../include/openssl/symhacks.h
+e_4758cca.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+e_4758cca.o: e_4758cca.c e_4758cca_err.c e_4758cca_err.h
+e_4758cca.o: vendor_defns/hw_4758_cca.h
+e_aep.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+e_aep.o: ../include/openssl/bn.h ../include/openssl/buffer.h
+e_aep.o: ../include/openssl/crypto.h ../include/openssl/dh.h
+e_aep.o: ../include/openssl/dsa.h ../include/openssl/dso.h
+e_aep.o: ../include/openssl/e_os2.h ../include/openssl/engine.h
+e_aep.o: ../include/openssl/err.h ../include/openssl/lhash.h
+e_aep.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+e_aep.o: ../include/openssl/ossl_typ.h ../include/openssl/rsa.h
+e_aep.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+e_aep.o: ../include/openssl/symhacks.h e_aep.c e_aep_err.c e_aep_err.h
+e_aep.o: vendor_defns/aep.h
+e_atalla.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+e_atalla.o: ../include/openssl/bn.h ../include/openssl/buffer.h
+e_atalla.o: ../include/openssl/crypto.h ../include/openssl/dh.h
+e_atalla.o: ../include/openssl/dsa.h ../include/openssl/dso.h
+e_atalla.o: ../include/openssl/e_os2.h ../include/openssl/engine.h
+e_atalla.o: ../include/openssl/err.h ../include/openssl/lhash.h
+e_atalla.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+e_atalla.o: ../include/openssl/ossl_typ.h ../include/openssl/rsa.h
+e_atalla.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+e_atalla.o: ../include/openssl/symhacks.h e_atalla.c e_atalla_err.c
+e_atalla.o: e_atalla_err.h vendor_defns/atalla.h
+e_chil.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+e_chil.o: ../include/openssl/bn.h ../include/openssl/buffer.h
+e_chil.o: ../include/openssl/crypto.h ../include/openssl/dh.h
+e_chil.o: ../include/openssl/dso.h ../include/openssl/e_os2.h
+e_chil.o: ../include/openssl/ec.h ../include/openssl/ecdh.h
+e_chil.o: ../include/openssl/ecdsa.h ../include/openssl/engine.h
+e_chil.o: ../include/openssl/err.h ../include/openssl/evp.h
+e_chil.o: ../include/openssl/lhash.h ../include/openssl/obj_mac.h
+e_chil.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+e_chil.o: ../include/openssl/opensslv.h ../include/openssl/ossl_typ.h
+e_chil.o: ../include/openssl/pem.h ../include/openssl/pem2.h
+e_chil.o: ../include/openssl/pkcs7.h ../include/openssl/rand.h
+e_chil.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+e_chil.o: ../include/openssl/sha.h ../include/openssl/stack.h
+e_chil.o: ../include/openssl/symhacks.h ../include/openssl/ui.h
+e_chil.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h e_chil.c
+e_chil.o: e_chil_err.c e_chil_err.h vendor_defns/hwcryptohook.h
+e_cswift.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+e_cswift.o: ../include/openssl/bn.h ../include/openssl/buffer.h
+e_cswift.o: ../include/openssl/crypto.h ../include/openssl/dh.h
+e_cswift.o: ../include/openssl/dsa.h ../include/openssl/dso.h
+e_cswift.o: ../include/openssl/e_os2.h ../include/openssl/engine.h
+e_cswift.o: ../include/openssl/err.h ../include/openssl/lhash.h
+e_cswift.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+e_cswift.o: ../include/openssl/ossl_typ.h ../include/openssl/rand.h
+e_cswift.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+e_cswift.o: ../include/openssl/stack.h ../include/openssl/symhacks.h e_cswift.c
+e_cswift.o: e_cswift_err.c e_cswift_err.h vendor_defns/cswift.h
+e_gmp.o: ../include/openssl/buffer.h ../include/openssl/crypto.h
+e_gmp.o: ../include/openssl/e_os2.h ../include/openssl/engine.h
+e_gmp.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+e_gmp.o: ../include/openssl/ossl_typ.h ../include/openssl/safestack.h
+e_gmp.o: ../include/openssl/stack.h ../include/openssl/symhacks.h e_gmp.c
+e_nuron.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+e_nuron.o: ../include/openssl/bn.h ../include/openssl/buffer.h
+e_nuron.o: ../include/openssl/crypto.h ../include/openssl/dh.h
+e_nuron.o: ../include/openssl/dsa.h ../include/openssl/dso.h
+e_nuron.o: ../include/openssl/e_os2.h ../include/openssl/engine.h
+e_nuron.o: ../include/openssl/err.h ../include/openssl/lhash.h
+e_nuron.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+e_nuron.o: ../include/openssl/ossl_typ.h ../include/openssl/rsa.h
+e_nuron.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+e_nuron.o: ../include/openssl/symhacks.h e_nuron.c e_nuron_err.c e_nuron_err.h
+e_sureware.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+e_sureware.o: ../include/openssl/bn.h ../include/openssl/buffer.h
+e_sureware.o: ../include/openssl/crypto.h ../include/openssl/dh.h
+e_sureware.o: ../include/openssl/dsa.h ../include/openssl/dso.h
+e_sureware.o: ../include/openssl/e_os2.h ../include/openssl/ec.h
+e_sureware.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h
+e_sureware.o: ../include/openssl/engine.h ../include/openssl/err.h
+e_sureware.o: ../include/openssl/evp.h ../include/openssl/lhash.h
+e_sureware.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+e_sureware.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+e_sureware.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h
+e_sureware.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
+e_sureware.o: ../include/openssl/rand.h ../include/openssl/rsa.h
+e_sureware.o: ../include/openssl/safestack.h ../include/openssl/sha.h
+e_sureware.o: ../include/openssl/stack.h ../include/openssl/symhacks.h
+e_sureware.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+e_sureware.o: e_sureware.c e_sureware_err.c e_sureware_err.h
+e_sureware.o: vendor_defns/sureware.h
+e_ubsec.o: ../include/openssl/asn1.h ../include/openssl/bio.h
+e_ubsec.o: ../include/openssl/bn.h ../include/openssl/buffer.h
+e_ubsec.o: ../include/openssl/crypto.h ../include/openssl/dh.h
+e_ubsec.o: ../include/openssl/dsa.h ../include/openssl/dso.h
+e_ubsec.o: ../include/openssl/e_os2.h ../include/openssl/engine.h
+e_ubsec.o: ../include/openssl/err.h ../include/openssl/lhash.h
+e_ubsec.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+e_ubsec.o: ../include/openssl/ossl_typ.h ../include/openssl/rsa.h
+e_ubsec.o: ../include/openssl/safestack.h ../include/openssl/stack.h
+e_ubsec.o: ../include/openssl/symhacks.h e_ubsec.c e_ubsec_err.c e_ubsec_err.h
+e_ubsec.o: vendor_defns/hw_ubsec.h
diff --git a/src/lib/libssl/src/engines/axp.opt b/src/lib/libssl/src/engines/axp.opt
new file mode 100644
index 0000000000..1dc71bf4b7
--- /dev/null
+++ b/src/lib/libssl/src/engines/axp.opt
@@ -0,0 +1 @@
+SYMBOL_VECTOR=(bind_engine=PROCEDURE,v_check=PROCEDURE)
diff --git a/src/lib/libssl/src/engines/e_4758cca.c b/src/lib/libssl/src/engines/e_4758cca.c
new file mode 100644
index 0000000000..0f1dae7567
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_4758cca.c
@@ -0,0 +1,994 @@
+/* Author: Maurice Gittens <maurice@gittens.nl>                       */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/crypto.h>
+#include <openssl/dso.h>
+#include <openssl/x509.h>
+#include <openssl/objects.h>
+#include <openssl/engine.h>
+#include <openssl/rand.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#include <openssl/bn.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_4758_CCA
+
+#ifdef FLAT_INC
+#include "hw_4758_cca.h"
+#else
+#include "vendor_defns/hw_4758_cca.h"
+#endif
+
+#include "e_4758cca_err.c"
+
+static int ibm_4758_cca_destroy(ENGINE *e);
+static int ibm_4758_cca_init(ENGINE *e);
+static int ibm_4758_cca_finish(ENGINE *e);
+static int ibm_4758_cca_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void));
+
+/* rsa functions */
+/*---------------*/
+#ifndef OPENSSL_NO_RSA
+static int cca_rsa_pub_enc(int flen, const unsigned char *from,
+                unsigned char *to, RSA *rsa,int padding);
+static int cca_rsa_priv_dec(int flen, const unsigned char *from,
+                unsigned char *to, RSA *rsa,int padding);
+static int cca_rsa_sign(int type, const unsigned char *m, unsigned int m_len,
+                unsigned char *sigret, unsigned int *siglen, const RSA *rsa);
+static int cca_rsa_verify(int dtype, const unsigned char *m, unsigned int m_len,
+                unsigned char *sigbuf, unsigned int siglen, const RSA *rsa);
+
+/* utility functions */
+/*-----------------------*/
+static EVP_PKEY *ibm_4758_load_privkey(ENGINE*, const char*,
+                UI_METHOD *ui_method, void *callback_data);
+static EVP_PKEY *ibm_4758_load_pubkey(ENGINE*, const char*,
+                UI_METHOD *ui_method, void *callback_data);
+
+static int getModulusAndExponent(const unsigned char *token, long *exponentLength,
+                unsigned char *exponent, long *modulusLength,
+                long *modulusFieldLength, unsigned char *modulus);
+#endif
+
+/* RAND number functions */
+/*-----------------------*/
+static int cca_get_random_bytes(unsigned char*, int );
+static int cca_random_status(void);
+
+#ifndef OPENSSL_NO_RSA
+static void cca_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
+                int idx,long argl, void *argp);
+#endif
+
+/* Function pointers for CCA verbs */
+/*---------------------------------*/
+#ifndef OPENSSL_NO_RSA
+static F_KEYRECORDREAD keyRecordRead;
+static F_DIGITALSIGNATUREGENERATE digitalSignatureGenerate;
+static F_DIGITALSIGNATUREVERIFY digitalSignatureVerify;
+static F_PUBLICKEYEXTRACT publicKeyExtract;
+static F_PKAENCRYPT pkaEncrypt;
+static F_PKADECRYPT pkaDecrypt;
+#endif
+static F_RANDOMNUMBERGENERATE randomNumberGenerate;
+
+/* static variables */
+/*------------------*/
+static const char *CCA4758_LIB_NAME = NULL;
+static const char *get_CCA4758_LIB_NAME(void)
+        {
+        if(CCA4758_LIB_NAME)
+                return CCA4758_LIB_NAME;
+        return CCA_LIB_NAME;
+        }
+static void free_CCA4758_LIB_NAME(void)
+        {
+        if(CCA4758_LIB_NAME)
+                OPENSSL_free((void*)CCA4758_LIB_NAME);
+        CCA4758_LIB_NAME = NULL;
+        }
+static long set_CCA4758_LIB_NAME(const char *name)
+        {
+        free_CCA4758_LIB_NAME();
+        return (((CCA4758_LIB_NAME = BUF_strdup(name)) != NULL) ? 1 : 0);
+        }
+#ifndef OPENSSL_NO_RSA
+static const char* n_keyRecordRead = CSNDKRR;
+static const char* n_digitalSignatureGenerate = CSNDDSG;
+static const char* n_digitalSignatureVerify = CSNDDSV;
+static const char* n_publicKeyExtract = CSNDPKX;
+static const char* n_pkaEncrypt = CSNDPKE;
+static const char* n_pkaDecrypt = CSNDPKD;
+#endif
+static const char* n_randomNumberGenerate = CSNBRNG;
+
+#ifndef OPENSSL_NO_RSA
+static int hndidx = -1;
+#endif
+static DSO *dso = NULL;
+
+/* openssl engine initialization structures */
+/*------------------------------------------*/
+
+#define CCA4758_CMD_SO_PATH             ENGINE_CMD_BASE
+static const ENGINE_CMD_DEFN    cca4758_cmd_defns[] = {
+        {CCA4758_CMD_SO_PATH,
+                "SO_PATH",
+                "Specifies the path to the '4758cca' shared library",
+                ENGINE_CMD_FLAG_STRING},
+        {0, NULL, NULL, 0}
+        };
+
+#ifndef OPENSSL_NO_RSA
+static RSA_METHOD ibm_4758_cca_rsa =
+        {
+        "IBM 4758 CCA RSA method",
+        cca_rsa_pub_enc,
+        NULL,
+        NULL,
+        cca_rsa_priv_dec,
+        NULL, /*rsa_mod_exp,*/
+        NULL, /*mod_exp_mont,*/
+        NULL, /* init */
+        NULL, /* finish */
+        RSA_FLAG_SIGN_VER,        /* flags */
+        NULL, /* app_data */
+        cca_rsa_sign, /* rsa_sign */
+        cca_rsa_verify, /* rsa_verify */
+        NULL /* rsa_keygen */
+        };
+#endif
+
+static RAND_METHOD ibm_4758_cca_rand =
+        {
+        /* "IBM 4758 RAND method", */
+        NULL, /* seed */
+        cca_get_random_bytes, /* get random bytes from the card */
+        NULL, /* cleanup */
+        NULL, /* add */
+        cca_get_random_bytes, /* pseudo rand */
+        cca_random_status, /* status */
+        };
+
+static const char *engine_4758_cca_id = "4758cca";
+static const char *engine_4758_cca_name = "IBM 4758 CCA hardware engine support";
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE 
+/* Compatibility hack, the dynamic library uses this form in the path */
+static const char *engine_4758_cca_id_alt = "4758_cca";
+#endif
+
+/* engine implementation */
+/*-----------------------*/
+static int bind_helper(ENGINE *e)
+        {
+        if(!ENGINE_set_id(e, engine_4758_cca_id) ||
+                        !ENGINE_set_name(e, engine_4758_cca_name) ||
+#ifndef OPENSSL_NO_RSA
+                        !ENGINE_set_RSA(e, &ibm_4758_cca_rsa) ||
+#endif
+                        !ENGINE_set_RAND(e, &ibm_4758_cca_rand) ||
+                        !ENGINE_set_destroy_function(e, ibm_4758_cca_destroy) ||
+                        !ENGINE_set_init_function(e, ibm_4758_cca_init) ||
+                        !ENGINE_set_finish_function(e, ibm_4758_cca_finish) ||
+                        !ENGINE_set_ctrl_function(e, ibm_4758_cca_ctrl) ||
+#ifndef OPENSSL_NO_RSA
+                        !ENGINE_set_load_privkey_function(e, ibm_4758_load_privkey) ||
+                        !ENGINE_set_load_pubkey_function(e, ibm_4758_load_pubkey) ||
+#endif
+                        !ENGINE_set_cmd_defns(e, cca4758_cmd_defns))
+                return 0;
+        /* Ensure the error handling is set up */
+        ERR_load_CCA4758_strings();
+        return 1;
+        }
+
+#ifdef OPENSSL_NO_DYNAMIC_ENGINE
+static ENGINE *engine_4758_cca(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!bind_helper(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_4758cca(void)
+        {
+        ENGINE *e_4758 = engine_4758_cca();
+        if (!e_4758) return;
+        ENGINE_add(e_4758);
+        ENGINE_free(e_4758);
+        ERR_clear_error();   
+        }
+#endif
+
+static int ibm_4758_cca_destroy(ENGINE *e)
+        {
+        ERR_unload_CCA4758_strings();
+        free_CCA4758_LIB_NAME();
+        return 1;
+        }
+
+static int ibm_4758_cca_init(ENGINE *e)
+        {
+        if(dso)
+                {
+                CCA4758err(CCA4758_F_IBM_4758_CCA_INIT,CCA4758_R_ALREADY_LOADED);
+                goto err;
+                }
+
+        dso = DSO_load(NULL, get_CCA4758_LIB_NAME(), NULL, 0);
+        if(!dso)
+                {
+                CCA4758err(CCA4758_F_IBM_4758_CCA_INIT,CCA4758_R_DSO_FAILURE);
+                goto err;
+                }
+
+#ifndef OPENSSL_NO_RSA
+        if(!(keyRecordRead = (F_KEYRECORDREAD)
+                                DSO_bind_func(dso, n_keyRecordRead)) ||
+                        !(randomNumberGenerate = (F_RANDOMNUMBERGENERATE)
+                                DSO_bind_func(dso, n_randomNumberGenerate)) ||
+                        !(digitalSignatureGenerate = (F_DIGITALSIGNATUREGENERATE)
+                                DSO_bind_func(dso, n_digitalSignatureGenerate)) ||
+                        !(digitalSignatureVerify = (F_DIGITALSIGNATUREVERIFY)
+                                DSO_bind_func(dso, n_digitalSignatureVerify)) ||
+                        !(publicKeyExtract = (F_PUBLICKEYEXTRACT)
+                                DSO_bind_func(dso, n_publicKeyExtract)) ||
+                        !(pkaEncrypt = (F_PKAENCRYPT)
+                                DSO_bind_func(dso, n_pkaEncrypt)) ||
+                        !(pkaDecrypt = (F_PKADECRYPT)
+                                DSO_bind_func(dso, n_pkaDecrypt)))
+                {
+                CCA4758err(CCA4758_F_IBM_4758_CCA_INIT,CCA4758_R_DSO_FAILURE);
+                goto err;
+                }
+#else
+        if(!(randomNumberGenerate = (F_RANDOMNUMBERGENERATE)
+                                DSO_bind_func(dso, n_randomNumberGenerate)))
+                {
+                CCA4758err(CCA4758_F_IBM_4758_CCA_INIT,CCA4758_R_DSO_FAILURE);
+                goto err;
+                }
+#endif
+
+#ifndef OPENSSL_NO_RSA
+        hndidx = RSA_get_ex_new_index(0, "IBM 4758 CCA RSA key handle",
+                NULL, NULL, cca_ex_free);
+#endif
+
+        return 1;
+err:
+        if(dso)
+                DSO_free(dso);
+        dso = NULL;
+
+#ifndef OPENSSL_NO_RSA
+        keyRecordRead = (F_KEYRECORDREAD)0;
+        digitalSignatureGenerate = (F_DIGITALSIGNATUREGENERATE)0;
+        digitalSignatureVerify = (F_DIGITALSIGNATUREVERIFY)0;
+        publicKeyExtract = (F_PUBLICKEYEXTRACT)0;
+        pkaEncrypt = (F_PKAENCRYPT)0;
+        pkaDecrypt = (F_PKADECRYPT)0;
+#endif
+        randomNumberGenerate = (F_RANDOMNUMBERGENERATE)0;
+        return 0;
+        }
+
+static int ibm_4758_cca_finish(ENGINE *e)
+        {
+        free_CCA4758_LIB_NAME();
+        if(!dso)
+                {
+                CCA4758err(CCA4758_F_IBM_4758_CCA_FINISH,
+                                CCA4758_R_NOT_LOADED);
+                return 0;
+                }
+        if(!DSO_free(dso))
+                {
+                CCA4758err(CCA4758_F_IBM_4758_CCA_FINISH,
+                                CCA4758_R_UNIT_FAILURE);
+                return 0;
+                }
+        dso = NULL;
+#ifndef OPENSSL_NO_RSA
+        keyRecordRead = (F_KEYRECORDREAD)0;
+        randomNumberGenerate = (F_RANDOMNUMBERGENERATE)0;
+        digitalSignatureGenerate = (F_DIGITALSIGNATUREGENERATE)0;
+        digitalSignatureVerify = (F_DIGITALSIGNATUREVERIFY)0;
+        publicKeyExtract = (F_PUBLICKEYEXTRACT)0;
+        pkaEncrypt = (F_PKAENCRYPT)0;
+        pkaDecrypt = (F_PKADECRYPT)0;
+#endif
+        randomNumberGenerate = (F_RANDOMNUMBERGENERATE)0;
+        return 1;
+        }
+
+static int ibm_4758_cca_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+        {
+        int initialised = ((dso == NULL) ? 0 : 1);
+        switch(cmd)
+                {
+        case CCA4758_CMD_SO_PATH:
+                if(p == NULL)
+                        {
+                        CCA4758err(CCA4758_F_IBM_4758_CCA_CTRL,
+                                        ERR_R_PASSED_NULL_PARAMETER);
+                        return 0;
+                        }
+                if(initialised)
+                        {
+                        CCA4758err(CCA4758_F_IBM_4758_CCA_CTRL,
+                                        CCA4758_R_ALREADY_LOADED);
+                        return 0;
+                        }
+                return set_CCA4758_LIB_NAME((const char *)p);
+        default:
+                break;
+                }
+        CCA4758err(CCA4758_F_IBM_4758_CCA_CTRL,
+                        CCA4758_R_COMMAND_NOT_IMPLEMENTED);
+        return 0;
+        }
+
+#ifndef OPENSSL_NO_RSA
+
+#define MAX_CCA_PKA_TOKEN_SIZE 2500
+
+static EVP_PKEY *ibm_4758_load_privkey(ENGINE* e, const char* key_id,
+                        UI_METHOD *ui_method, void *callback_data)
+        {
+        RSA *rtmp = NULL;
+        EVP_PKEY *res = NULL;
+        unsigned char* keyToken = NULL;
+        unsigned char pubKeyToken[MAX_CCA_PKA_TOKEN_SIZE];
+        long pubKeyTokenLength = MAX_CCA_PKA_TOKEN_SIZE;
+        long keyTokenLength = MAX_CCA_PKA_TOKEN_SIZE;
+        long returnCode;
+        long reasonCode;
+        long exitDataLength = 0;
+        long ruleArrayLength = 0;
+        unsigned char exitData[8];
+        unsigned char ruleArray[8];
+        unsigned char keyLabel[64];
+        unsigned long keyLabelLength = strlen(key_id);
+        unsigned char modulus[256];
+        long modulusFieldLength = sizeof(modulus);
+        long modulusLength = 0;
+        unsigned char exponent[256];
+        long exponentLength = sizeof(exponent);
+
+        if (keyLabelLength > sizeof(keyLabel))
+                {
+                CCA4758err(CCA4758_F_IBM_4758_LOAD_PRIVKEY,
+                CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
+                return NULL;
+                }
+
+        memset(keyLabel,' ', sizeof(keyLabel));
+        memcpy(keyLabel, key_id, keyLabelLength);
+
+        keyToken = OPENSSL_malloc(MAX_CCA_PKA_TOKEN_SIZE + sizeof(long));
+        if (!keyToken)
+                {
+                CCA4758err(CCA4758_F_IBM_4758_LOAD_PRIVKEY,
+                                ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        keyRecordRead(&returnCode, &reasonCode, &exitDataLength,
+                exitData, &ruleArrayLength, ruleArray, keyLabel,
+                &keyTokenLength, keyToken+sizeof(long));
+
+        if (returnCode)
+                {
+                CCA4758err(CCA4758_F_IBM_4758_LOAD_PRIVKEY,
+                        CCA4758_R_FAILED_LOADING_PRIVATE_KEY);
+                goto err;
+                }
+
+        publicKeyExtract(&returnCode, &reasonCode, &exitDataLength,
+                exitData, &ruleArrayLength, ruleArray, &keyTokenLength,
+                keyToken+sizeof(long), &pubKeyTokenLength, pubKeyToken);
+
+        if (returnCode)
+                {
+                CCA4758err(CCA4758_F_IBM_4758_LOAD_PRIVKEY,
+                        CCA4758_R_FAILED_LOADING_PRIVATE_KEY);
+                goto err;
+                }
+
+        if (!getModulusAndExponent(pubKeyToken, &exponentLength,
+                        exponent, &modulusLength, &modulusFieldLength,
+                        modulus))
+                {
+                CCA4758err(CCA4758_F_IBM_4758_LOAD_PRIVKEY,
+                        CCA4758_R_FAILED_LOADING_PRIVATE_KEY);
+                goto err;
+                }
+
+        (*(long*)keyToken) = keyTokenLength;
+        rtmp = RSA_new_method(e);
+        RSA_set_ex_data(rtmp, hndidx, (char *)keyToken);
+
+        rtmp->e = BN_bin2bn(exponent, exponentLength, NULL);
+        rtmp->n = BN_bin2bn(modulus, modulusFieldLength, NULL);
+        rtmp->flags |= RSA_FLAG_EXT_PKEY;
+
+        res = EVP_PKEY_new();
+        EVP_PKEY_assign_RSA(res, rtmp);
+
+        return res;
+err:
+        if (keyToken)
+                OPENSSL_free(keyToken);
+        if (res)
+                EVP_PKEY_free(res);
+        if (rtmp)
+                RSA_free(rtmp);
+        return NULL;
+        }
+
+static EVP_PKEY *ibm_4758_load_pubkey(ENGINE* e, const char* key_id,
+                        UI_METHOD *ui_method, void *callback_data)
+        {
+        RSA *rtmp = NULL;
+        EVP_PKEY *res = NULL;
+        unsigned char* keyToken = NULL;
+        long keyTokenLength = MAX_CCA_PKA_TOKEN_SIZE;
+        long returnCode;
+        long reasonCode;
+        long exitDataLength = 0;
+        long ruleArrayLength = 0;
+        unsigned char exitData[8];
+        unsigned char ruleArray[8];
+        unsigned char keyLabel[64];
+        unsigned long keyLabelLength = strlen(key_id);
+        unsigned char modulus[512];
+        long modulusFieldLength = sizeof(modulus);
+        long modulusLength = 0;
+        unsigned char exponent[512];
+        long exponentLength = sizeof(exponent);
+
+        if (keyLabelLength > sizeof(keyLabel))
+                {
+                CCA4758err(CCA4758_F_IBM_4758_LOAD_PUBKEY,
+                        CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
+                return NULL;
+                }
+
+        memset(keyLabel,' ', sizeof(keyLabel));
+        memcpy(keyLabel, key_id, keyLabelLength);
+
+        keyToken = OPENSSL_malloc(MAX_CCA_PKA_TOKEN_SIZE + sizeof(long));
+        if (!keyToken)
+                {
+                CCA4758err(CCA4758_F_IBM_4758_LOAD_PUBKEY,
+                                ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        keyRecordRead(&returnCode, &reasonCode, &exitDataLength, exitData,
+                &ruleArrayLength, ruleArray, keyLabel, &keyTokenLength,
+                keyToken+sizeof(long));
+
+        if (returnCode)
+                {
+                CCA4758err(CCA4758_F_IBM_4758_LOAD_PUBKEY,
+                                ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        if (!getModulusAndExponent(keyToken+sizeof(long), &exponentLength,
+                        exponent, &modulusLength, &modulusFieldLength, modulus))
+                {
+                CCA4758err(CCA4758_F_IBM_4758_LOAD_PUBKEY,
+                        CCA4758_R_FAILED_LOADING_PUBLIC_KEY);
+                goto err;
+                }
+
+        (*(long*)keyToken) = keyTokenLength;
+        rtmp = RSA_new_method(e);
+        RSA_set_ex_data(rtmp, hndidx, (char *)keyToken);
+        rtmp->e = BN_bin2bn(exponent, exponentLength, NULL);
+        rtmp->n = BN_bin2bn(modulus, modulusFieldLength, NULL);
+        rtmp->flags |= RSA_FLAG_EXT_PKEY;
+        res = EVP_PKEY_new();
+        EVP_PKEY_assign_RSA(res, rtmp);
+
+        return res;
+err:
+        if (keyToken)
+                OPENSSL_free(keyToken);
+        if (res)
+                EVP_PKEY_free(res);
+        if (rtmp)
+                RSA_free(rtmp);
+        return NULL;
+        }
+
+static int cca_rsa_pub_enc(int flen, const unsigned char *from,
+                        unsigned char *to, RSA *rsa,int padding)
+        {
+        long returnCode;
+        long reasonCode;
+        long lflen = flen;
+        long exitDataLength = 0;
+        unsigned char exitData[8];
+        long ruleArrayLength = 1;
+        unsigned char ruleArray[8] = "PKCS-1.2";
+        long dataStructureLength = 0;
+        unsigned char dataStructure[8];
+        long outputLength = RSA_size(rsa);
+        long keyTokenLength;
+        unsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);
+
+        keyTokenLength = *(long*)keyToken;
+        keyToken+=sizeof(long);
+
+        pkaEncrypt(&returnCode, &reasonCode, &exitDataLength, exitData,
+                &ruleArrayLength, ruleArray, &lflen, (unsigned char*)from,
+                &dataStructureLength, dataStructure, &keyTokenLength,
+                keyToken, &outputLength, to);
+
+        if (returnCode || reasonCode)
+                return -(returnCode << 16 | reasonCode);
+        return outputLength;
+        }
+
+static int cca_rsa_priv_dec(int flen, const unsigned char *from,
+                        unsigned char *to, RSA *rsa,int padding)
+        {
+        long returnCode;
+        long reasonCode;
+        long lflen = flen;
+        long exitDataLength = 0;
+        unsigned char exitData[8];
+        long ruleArrayLength = 1;
+        unsigned char ruleArray[8] = "PKCS-1.2";
+        long dataStructureLength = 0;
+        unsigned char dataStructure[8];
+        long outputLength = RSA_size(rsa);
+        long keyTokenLength;
+        unsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);
+
+        keyTokenLength = *(long*)keyToken;
+        keyToken+=sizeof(long);
+
+        pkaDecrypt(&returnCode, &reasonCode, &exitDataLength, exitData,
+                &ruleArrayLength, ruleArray, &lflen, (unsigned char*)from,
+                &dataStructureLength, dataStructure, &keyTokenLength,
+                keyToken, &outputLength, to);
+
+        return (returnCode | reasonCode) ? 0 : 1;
+        }
+
+#define SSL_SIG_LEN 36
+
+static int cca_rsa_verify(int type, const unsigned char *m, unsigned int m_len,
+                unsigned char *sigbuf, unsigned int siglen, const RSA *rsa)
+        {
+        long returnCode;
+        long reasonCode;
+        long lsiglen = siglen;
+        long exitDataLength = 0;
+        unsigned char exitData[8];
+        long ruleArrayLength = 1;
+        unsigned char ruleArray[8] = "PKCS-1.1";
+        long keyTokenLength;
+        unsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);
+        long length = SSL_SIG_LEN;
+        long keyLength ;
+        unsigned char *hashBuffer = NULL;
+        X509_SIG sig;
+        ASN1_TYPE parameter;
+        X509_ALGOR algorithm;
+        ASN1_OCTET_STRING digest;
+
+        keyTokenLength = *(long*)keyToken;
+        keyToken+=sizeof(long);
+
+        if (type == NID_md5 || type == NID_sha1)
+                {
+                sig.algor = &algorithm;
+                algorithm.algorithm = OBJ_nid2obj(type);
+
+                if (!algorithm.algorithm)
+                        {
+                        CCA4758err(CCA4758_F_CCA_RSA_VERIFY,
+                                CCA4758_R_UNKNOWN_ALGORITHM_TYPE);
+                        return 0;
+                        }
+
+                if (!algorithm.algorithm->length)
+                        {
+                        CCA4758err(CCA4758_F_CCA_RSA_VERIFY,
+                                CCA4758_R_ASN1_OID_UNKNOWN_FOR_MD);
+                        return 0;
+                        }
+
+                parameter.type = V_ASN1_NULL;
+                parameter.value.ptr = NULL;
+                algorithm.parameter = &parameter;
+
+                sig.digest = &digest;
+                sig.digest->data = (unsigned char*)m;
+                sig.digest->length = m_len;
+
+                length = i2d_X509_SIG(&sig, NULL);
+                }
+
+        keyLength = RSA_size(rsa);
+
+        if (length - RSA_PKCS1_PADDING > keyLength)
+                {
+                CCA4758err(CCA4758_F_CCA_RSA_VERIFY,
+                        CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
+                return 0;
+                }
+
+        switch (type)
+                {
+                case NID_md5_sha1 :
+                        if (m_len != SSL_SIG_LEN)
+                                {
+                                CCA4758err(CCA4758_F_CCA_RSA_VERIFY,
+                                CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
+                                return 0;
+                                }
+
+                        hashBuffer = (unsigned char *)m;
+                        length = m_len;
+                        break;
+                case NID_md5 :
+                        {
+                        unsigned char *ptr;
+                        ptr = hashBuffer = OPENSSL_malloc(
+                                        (unsigned int)keyLength+1);
+                        if (!hashBuffer)
+                                {
+                                CCA4758err(CCA4758_F_CCA_RSA_VERIFY,
+                                                ERR_R_MALLOC_FAILURE);
+                                return 0;
+                                }
+
+                        i2d_X509_SIG(&sig, &ptr);
+                        }
+                        break;
+                case NID_sha1 :
+                        {
+                        unsigned char *ptr;
+                        ptr = hashBuffer = OPENSSL_malloc(
+                                        (unsigned int)keyLength+1);
+                        if (!hashBuffer)
+                                {
+                                CCA4758err(CCA4758_F_CCA_RSA_VERIFY,
+                                                ERR_R_MALLOC_FAILURE);
+                                return 0;
+                                }
+                        i2d_X509_SIG(&sig, &ptr);
+                        }
+                        break;
+                default:
+                        return 0;
+                }
+
+        digitalSignatureVerify(&returnCode, &reasonCode, &exitDataLength,
+                exitData, &ruleArrayLength, ruleArray, &keyTokenLength,
+                keyToken, &length, hashBuffer, &lsiglen, sigbuf);
+
+        if (type == NID_sha1 || type == NID_md5)
+                {
+                OPENSSL_cleanse(hashBuffer, keyLength+1);
+                OPENSSL_free(hashBuffer);
+                }
+
+        return ((returnCode || reasonCode) ? 0 : 1);
+        }
+
+#define SSL_SIG_LEN 36
+
+static int cca_rsa_sign(int type, const unsigned char *m, unsigned int m_len,
+                unsigned char *sigret, unsigned int *siglen, const RSA *rsa)
+        {
+        long returnCode;
+        long reasonCode;
+        long exitDataLength = 0;
+        unsigned char exitData[8];
+        long ruleArrayLength = 1;
+        unsigned char ruleArray[8] = "PKCS-1.1";
+        long outputLength=256;
+        long outputBitLength;
+        long keyTokenLength;
+        unsigned char *hashBuffer = NULL;
+        unsigned char* keyToken = (unsigned char*)RSA_get_ex_data(rsa, hndidx);
+        long length = SSL_SIG_LEN;
+        long keyLength ;
+        X509_SIG sig;
+        ASN1_TYPE parameter;
+        X509_ALGOR algorithm;
+        ASN1_OCTET_STRING digest;
+
+        keyTokenLength = *(long*)keyToken;
+        keyToken+=sizeof(long);
+
+        if (type == NID_md5 || type == NID_sha1)
+                {
+                sig.algor = &algorithm;
+                algorithm.algorithm = OBJ_nid2obj(type);
+
+                if (!algorithm.algorithm)
+                        {
+                        CCA4758err(CCA4758_F_CCA_RSA_SIGN,
+                                CCA4758_R_UNKNOWN_ALGORITHM_TYPE);
+                        return 0;
+                        }
+
+                if (!algorithm.algorithm->length)
+                        {
+                        CCA4758err(CCA4758_F_CCA_RSA_SIGN,
+                                CCA4758_R_ASN1_OID_UNKNOWN_FOR_MD);
+                        return 0;
+                        }
+
+                parameter.type = V_ASN1_NULL;
+                parameter.value.ptr = NULL;
+                algorithm.parameter = &parameter;
+
+                sig.digest = &digest;
+                sig.digest->data = (unsigned char*)m;
+                sig.digest->length = m_len;
+
+                length = i2d_X509_SIG(&sig, NULL);
+                }
+
+        keyLength = RSA_size(rsa);
+
+        if (length - RSA_PKCS1_PADDING > keyLength)
+                {
+                CCA4758err(CCA4758_F_CCA_RSA_SIGN,
+                        CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
+                return 0;
+                }
+
+        switch (type)
+                {
+                case NID_md5_sha1 :
+                        if (m_len != SSL_SIG_LEN)
+                                {
+                                CCA4758err(CCA4758_F_CCA_RSA_SIGN,
+                                CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
+                                return 0;
+                                }
+                        hashBuffer = (unsigned char*)m;
+                        length = m_len;
+                        break;
+                case NID_md5 :
+                        {
+                        unsigned char *ptr;
+                        ptr = hashBuffer = OPENSSL_malloc(
+                                        (unsigned int)keyLength+1);
+                        if (!hashBuffer)
+                                {
+                                CCA4758err(CCA4758_F_CCA_RSA_SIGN,
+                                                ERR_R_MALLOC_FAILURE);
+                                return 0;
+                                }
+                        i2d_X509_SIG(&sig, &ptr);
+                        }
+                        break;
+                case NID_sha1 :
+                        {
+                        unsigned char *ptr;
+                        ptr = hashBuffer = OPENSSL_malloc(
+                                        (unsigned int)keyLength+1);
+                        if (!hashBuffer)
+                                {
+                                CCA4758err(CCA4758_F_CCA_RSA_SIGN,
+                                                ERR_R_MALLOC_FAILURE);
+                                return 0;
+                                }
+                        i2d_X509_SIG(&sig, &ptr);
+                        }
+                        break;
+                default:
+                        return 0;
+                }
+
+        digitalSignatureGenerate(&returnCode, &reasonCode, &exitDataLength,
+                exitData, &ruleArrayLength, ruleArray, &keyTokenLength,
+                keyToken, &length, hashBuffer, &outputLength, &outputBitLength,
+                sigret);
+
+        if (type == NID_sha1 || type == NID_md5)
+                {
+                OPENSSL_cleanse(hashBuffer, keyLength+1);
+                OPENSSL_free(hashBuffer);
+                }
+
+        *siglen = outputLength;
+
+        return ((returnCode || reasonCode) ? 0 : 1);
+        }
+
+static int getModulusAndExponent(const unsigned char*token, long *exponentLength,
+                unsigned char *exponent, long *modulusLength, long *modulusFieldLength,
+                unsigned char *modulus)
+        {
+        unsigned long len;
+
+        if (*token++ != (char)0x1E) /* internal PKA token? */
+                return 0;
+
+        if (*token++) /* token version must be zero */
+                return 0;
+
+        len = *token++;
+        len = len << 8;
+        len |= (unsigned char)*token++;
+
+        token += 4; /* skip reserved bytes */
+
+        if (*token++ == (char)0x04)
+                {
+                if (*token++) /* token version must be zero */
+                        return 0;
+
+                len = *token++;
+                len = len << 8;
+                len |= (unsigned char)*token++;
+
+                token+=2; /* skip reserved section */
+
+                len = *token++;
+                len = len << 8;
+                len |= (unsigned char)*token++;
+
+                *exponentLength = len;
+
+                len = *token++;
+                len = len << 8;
+                len |= (unsigned char)*token++;
+
+                *modulusLength = len;
+
+                len = *token++;
+                len = len << 8;
+                len |= (unsigned char)*token++;
+
+                *modulusFieldLength = len;
+
+                memcpy(exponent, token, *exponentLength);
+                token+= *exponentLength;
+
+                memcpy(modulus, token, *modulusFieldLength);
+                return 1;
+                }
+        return 0;
+        }
+
+#endif /* OPENSSL_NO_RSA */
+
+static int cca_random_status(void)
+        {
+        return 1;
+        }
+
+static int cca_get_random_bytes(unsigned char* buf, int num)
+        {
+        long ret_code;
+        long reason_code;
+        long exit_data_length;
+        unsigned char exit_data[4];
+        unsigned char form[] = "RANDOM  ";
+        unsigned char rand_buf[8];
+
+        while(num >= (int)sizeof(rand_buf))
+                {
+                randomNumberGenerate(&ret_code, &reason_code, &exit_data_length,
+                        exit_data, form, rand_buf);
+                if (ret_code)
+                        return 0;
+                num -= sizeof(rand_buf);
+                memcpy(buf, rand_buf, sizeof(rand_buf));
+                buf += sizeof(rand_buf);
+                }
+
+        if (num)
+                {
+                randomNumberGenerate(&ret_code, &reason_code, NULL, NULL,
+                        form, rand_buf);
+                if (ret_code)
+                        return 0;
+                memcpy(buf, rand_buf, num);
+                }
+
+        return 1;
+        }
+
+#ifndef OPENSSL_NO_RSA
+static void cca_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad, int idx,
+                long argl, void *argp)
+        {
+        if (item)
+                OPENSSL_free(item);
+        }
+#endif
+
+/* Goo to handle building as a dynamic engine */
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE 
+static int bind_fn(ENGINE *e, const char *id)
+        {
+        if(id && (strcmp(id, engine_4758_cca_id) != 0) &&
+                        (strcmp(id, engine_4758_cca_id_alt) != 0))
+                return 0;
+        if(!bind_helper(e))
+                return 0;
+        return 1;
+        }       
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
+#endif /* OPENSSL_NO_DYNAMIC_ENGINE */
+
+#endif /* !OPENSSL_NO_HW_4758_CCA */
+#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libssl/src/engines/e_4758cca.ec b/src/lib/libssl/src/engines/e_4758cca.ec
new file mode 100644
index 0000000000..f30ed02c05
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_4758cca.ec
@@ -0,0 +1 @@
+L CCA4758       e_4758cca_err.h         e_4758cca_err.c
diff --git a/src/lib/libssl/src/engines/e_4758cca_err.c b/src/lib/libssl/src/engines/e_4758cca_err.c
new file mode 100644
index 0000000000..6ecdc6e627
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_4758cca_err.c
@@ -0,0 +1,153 @@
+/* e_4758cca_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "e_4758cca_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(0,func,0)
+#define ERR_REASON(reason) ERR_PACK(0,0,reason)
+
+static ERR_STRING_DATA CCA4758_str_functs[]=
+        {
+{ERR_FUNC(CCA4758_F_CCA_RSA_SIGN),      "CCA_RSA_SIGN"},
+{ERR_FUNC(CCA4758_F_CCA_RSA_VERIFY),    "CCA_RSA_VERIFY"},
+{ERR_FUNC(CCA4758_F_IBM_4758_CCA_CTRL), "IBM_4758_CCA_CTRL"},
+{ERR_FUNC(CCA4758_F_IBM_4758_CCA_FINISH),       "IBM_4758_CCA_FINISH"},
+{ERR_FUNC(CCA4758_F_IBM_4758_CCA_INIT), "IBM_4758_CCA_INIT"},
+{ERR_FUNC(CCA4758_F_IBM_4758_LOAD_PRIVKEY),     "IBM_4758_LOAD_PRIVKEY"},
+{ERR_FUNC(CCA4758_F_IBM_4758_LOAD_PUBKEY),      "IBM_4758_LOAD_PUBKEY"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA CCA4758_str_reasons[]=
+        {
+{ERR_REASON(CCA4758_R_ALREADY_LOADED)    ,"already loaded"},
+{ERR_REASON(CCA4758_R_ASN1_OID_UNKNOWN_FOR_MD),"asn1 oid unknown for md"},
+{ERR_REASON(CCA4758_R_COMMAND_NOT_IMPLEMENTED),"command not implemented"},
+{ERR_REASON(CCA4758_R_DSO_FAILURE)       ,"dso failure"},
+{ERR_REASON(CCA4758_R_FAILED_LOADING_PRIVATE_KEY),"failed loading private key"},
+{ERR_REASON(CCA4758_R_FAILED_LOADING_PUBLIC_KEY),"failed loading public key"},
+{ERR_REASON(CCA4758_R_NOT_LOADED)        ,"not loaded"},
+{ERR_REASON(CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL),"size too large or too small"},
+{ERR_REASON(CCA4758_R_UNIT_FAILURE)      ,"unit failure"},
+{ERR_REASON(CCA4758_R_UNKNOWN_ALGORITHM_TYPE),"unknown algorithm type"},
+{0,NULL}
+        };
+
+#endif
+
+#ifdef CCA4758_LIB_NAME
+static ERR_STRING_DATA CCA4758_lib_name[]=
+        {
+{0      ,CCA4758_LIB_NAME},
+{0,NULL}
+        };
+#endif
+
+
+static int CCA4758_lib_error_code=0;
+static int CCA4758_error_init=1;
+
+static void ERR_load_CCA4758_strings(void)
+        {
+        if (CCA4758_lib_error_code == 0)
+                CCA4758_lib_error_code=ERR_get_next_error_library();
+
+        if (CCA4758_error_init)
+                {
+                CCA4758_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(CCA4758_lib_error_code,CCA4758_str_functs);
+                ERR_load_strings(CCA4758_lib_error_code,CCA4758_str_reasons);
+#endif
+
+#ifdef CCA4758_LIB_NAME
+                CCA4758_lib_name->error = ERR_PACK(CCA4758_lib_error_code,0,0);
+                ERR_load_strings(0,CCA4758_lib_name);
+#endif
+                }
+        }
+
+static void ERR_unload_CCA4758_strings(void)
+        {
+        if (CCA4758_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(CCA4758_lib_error_code,CCA4758_str_functs);
+                ERR_unload_strings(CCA4758_lib_error_code,CCA4758_str_reasons);
+#endif
+
+#ifdef CCA4758_LIB_NAME
+                ERR_unload_strings(0,CCA4758_lib_name);
+#endif
+                CCA4758_error_init=1;
+                }
+        }
+
+static void ERR_CCA4758_error(int function, int reason, char *file, int line)
+        {
+        if (CCA4758_lib_error_code == 0)
+                CCA4758_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(CCA4758_lib_error_code,function,reason,file,line);
+        }
diff --git a/src/lib/libssl/src/engines/e_4758cca_err.h b/src/lib/libssl/src/engines/e_4758cca_err.h
new file mode 100644
index 0000000000..26087edbfa
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_4758cca_err.h
@@ -0,0 +1,97 @@
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_CCA4758_ERR_H
+#define HEADER_CCA4758_ERR_H
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_CCA4758_strings(void);
+static void ERR_unload_CCA4758_strings(void);
+static void ERR_CCA4758_error(int function, int reason, char *file, int line);
+#define CCA4758err(f,r) ERR_CCA4758_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the CCA4758 functions. */
+
+/* Function codes. */
+#define CCA4758_F_CCA_RSA_SIGN                           105
+#define CCA4758_F_CCA_RSA_VERIFY                         106
+#define CCA4758_F_IBM_4758_CCA_CTRL                      100
+#define CCA4758_F_IBM_4758_CCA_FINISH                    101
+#define CCA4758_F_IBM_4758_CCA_INIT                      102
+#define CCA4758_F_IBM_4758_LOAD_PRIVKEY                  103
+#define CCA4758_F_IBM_4758_LOAD_PUBKEY                   104
+
+/* Reason codes. */
+#define CCA4758_R_ALREADY_LOADED                         100
+#define CCA4758_R_ASN1_OID_UNKNOWN_FOR_MD                101
+#define CCA4758_R_COMMAND_NOT_IMPLEMENTED                102
+#define CCA4758_R_DSO_FAILURE                            103
+#define CCA4758_R_FAILED_LOADING_PRIVATE_KEY             104
+#define CCA4758_R_FAILED_LOADING_PUBLIC_KEY              105
+#define CCA4758_R_NOT_LOADED                             106
+#define CCA4758_R_SIZE_TOO_LARGE_OR_TOO_SMALL            107
+#define CCA4758_R_UNIT_FAILURE                           108
+#define CCA4758_R_UNKNOWN_ALGORITHM_TYPE                 109
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/engines/e_aep.c b/src/lib/libssl/src/engines/e_aep.c
new file mode 100644
index 0000000000..ffdc354cdc
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_aep.c
@@ -0,0 +1,1142 @@
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <openssl/bn.h>
+#include <string.h>
+
+#include <openssl/e_os2.h>
+#if !defined(OPENSSL_SYS_MSDOS) || defined(__DJGPP__)
+#include <sys/types.h>
+#include <unistd.h>
+#else
+#include <process.h>
+typedef int pid_t;
+#endif
+
+#if defined(OPENSSL_SYS_NETWARE) && defined(NETWARE_CLIB)
+#define getpid GetThreadID
+extern int GetThreadID(void);
+#endif
+
+#include <openssl/crypto.h>
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+#include <openssl/buffer.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_AEP
+#ifdef FLAT_INC
+#include "aep.h"
+#else
+#include "vendor_defns/aep.h"
+#endif
+
+#define AEP_LIB_NAME "aep engine"
+#define FAIL_TO_SW 0x10101010
+
+#include "e_aep_err.c"
+
+static int aep_init(ENGINE *e);
+static int aep_finish(ENGINE *e);
+static int aep_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void));
+static int aep_destroy(ENGINE *e);
+
+static AEP_RV aep_get_connection(AEP_CONNECTION_HNDL_PTR hConnection);
+static AEP_RV aep_return_connection(AEP_CONNECTION_HNDL hConnection);
+static AEP_RV aep_close_connection(AEP_CONNECTION_HNDL hConnection);
+static AEP_RV aep_close_all_connections(int use_engine_lock, int *in_use);
+
+/* BIGNUM stuff */
+#ifndef OPENSSL_NO_RSA
+static int aep_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *m, BN_CTX *ctx);
+
+static AEP_RV aep_mod_exp_crt(BIGNUM *r,const  BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *q, const BIGNUM *dmp1,const BIGNUM *dmq1,
+        const BIGNUM *iqmp, BN_CTX *ctx);
+#endif
+
+/* RSA stuff */
+#ifndef OPENSSL_NO_RSA
+static int aep_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
+#endif
+
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+#ifndef OPENSSL_NO_RSA
+static int aep_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#endif
+
+/* DSA stuff */
+#ifndef OPENSSL_NO_DSA
+static int aep_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+        BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+        BN_CTX *ctx, BN_MONT_CTX *in_mont);
+
+static int aep_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+        BN_MONT_CTX *m_ctx);
+#endif
+
+/* DH stuff */
+/* This function is aliased to mod_exp (with the DH and mont dropped). */
+#ifndef OPENSSL_NO_DH
+static int aep_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
+        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#endif
+
+/* rand stuff   */
+#ifdef AEPRAND
+static int aep_rand(unsigned char *buf, int num);
+static int aep_rand_status(void);
+#endif
+
+/* Bignum conversion stuff */
+static AEP_RV GetBigNumSize(AEP_VOID_PTR ArbBigNum, AEP_U32* BigNumSize);
+static AEP_RV MakeAEPBigNum(AEP_VOID_PTR ArbBigNum, AEP_U32 BigNumSize,
+        unsigned char* AEP_BigNum);
+static AEP_RV ConvertAEPBigNum(void* ArbBigNum, AEP_U32 BigNumSize,
+        unsigned char* AEP_BigNum);
+
+/* The definitions for control commands specific to this engine */
+#define AEP_CMD_SO_PATH         ENGINE_CMD_BASE
+static const ENGINE_CMD_DEFN aep_cmd_defns[] =
+        {
+        { AEP_CMD_SO_PATH,
+          "SO_PATH",
+          "Specifies the path to the 'aep' shared library",
+          ENGINE_CMD_FLAG_STRING
+        },
+        {0, NULL, NULL, 0}
+        };
+
+#ifndef OPENSSL_NO_RSA
+/* Our internal RSA_METHOD that we provide pointers to */
+static RSA_METHOD aep_rsa =
+        {
+        "Aep RSA method",
+        NULL,                /*rsa_pub_encrypt*/
+        NULL,                /*rsa_pub_decrypt*/
+        NULL,                /*rsa_priv_encrypt*/
+        NULL,                /*rsa_priv_encrypt*/
+        aep_rsa_mod_exp,     /*rsa_mod_exp*/
+        aep_mod_exp_mont,    /*bn_mod_exp*/
+        NULL,                /*init*/
+        NULL,                /*finish*/
+        0,                   /*flags*/
+        NULL,                /*app_data*/
+        NULL,                /*rsa_sign*/
+        NULL,                /*rsa_verify*/
+        NULL                 /*rsa_keygen*/
+        };
+#endif
+
+#ifndef OPENSSL_NO_DSA
+/* Our internal DSA_METHOD that we provide pointers to */
+static DSA_METHOD aep_dsa =
+        {
+        "Aep DSA method",
+        NULL,                /* dsa_do_sign */
+        NULL,                /* dsa_sign_setup */
+        NULL,                /* dsa_do_verify */
+        aep_dsa_mod_exp,     /* dsa_mod_exp */
+        aep_mod_exp_dsa,     /* bn_mod_exp */
+        NULL,                /* init */
+        NULL,                /* finish */
+        0,                   /* flags */
+        NULL,                /* app_data */
+        NULL,                /* dsa_paramgen */
+        NULL                 /* dsa_keygen */
+        };
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* Our internal DH_METHOD that we provide pointers to */
+static DH_METHOD aep_dh =
+        {
+        "Aep DH method",
+        NULL,
+        NULL,
+        aep_mod_exp_dh,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL
+        };
+#endif
+
+#ifdef AEPRAND
+/* our internal RAND_method that we provide pointers to  */
+static RAND_METHOD aep_random =
+        {
+        /*"AEP RAND method", */
+        NULL,
+        aep_rand,
+        NULL,
+        NULL,
+        aep_rand,
+        aep_rand_status,
+        };
+#endif
+
+/*Define an array of structures to hold connections*/
+static AEP_CONNECTION_ENTRY aep_app_conn_table[MAX_PROCESS_CONNECTIONS];
+
+/*Used to determine if this is a new process*/
+static pid_t    recorded_pid = 0;
+
+#ifdef AEPRAND
+static AEP_U8   rand_block[RAND_BLK_SIZE];
+static AEP_U32  rand_block_bytes = 0;
+#endif
+
+/* Constants used when creating the ENGINE */
+static const char *engine_aep_id = "aep";
+static const char *engine_aep_name = "Aep hardware engine support";
+
+static int max_key_len = 2176;
+
+
+/* This internal function is used by ENGINE_aep() and possibly by the
+ * "dynamic" ENGINE support too */
+static int bind_aep(ENGINE *e)
+        {
+#ifndef OPENSSL_NO_RSA
+        const RSA_METHOD  *meth1;
+#endif
+#ifndef OPENSSL_NO_DSA
+        const DSA_METHOD  *meth2;
+#endif
+#ifndef OPENSSL_NO_DH
+        const DH_METHOD   *meth3;
+#endif
+
+        if(!ENGINE_set_id(e, engine_aep_id) ||
+                !ENGINE_set_name(e, engine_aep_name) ||
+#ifndef OPENSSL_NO_RSA
+                !ENGINE_set_RSA(e, &aep_rsa) ||
+#endif
+#ifndef OPENSSL_NO_DSA
+                !ENGINE_set_DSA(e, &aep_dsa) ||
+#endif
+#ifndef OPENSSL_NO_DH
+                !ENGINE_set_DH(e, &aep_dh) ||
+#endif
+#ifdef AEPRAND
+                !ENGINE_set_RAND(e, &aep_random) ||
+#endif
+                !ENGINE_set_init_function(e, aep_init) ||
+                !ENGINE_set_destroy_function(e, aep_destroy) ||
+                !ENGINE_set_finish_function(e, aep_finish) ||
+                !ENGINE_set_ctrl_function(e, aep_ctrl) ||
+                !ENGINE_set_cmd_defns(e, aep_cmd_defns))
+                return 0;
+
+#ifndef OPENSSL_NO_RSA
+        /* We know that the "PKCS1_SSLeay()" functions hook properly
+         * to the aep-specific mod_exp and mod_exp_crt so we use
+         * those functions. NB: We don't use ENGINE_openssl() or
+         * anything "more generic" because something like the RSAref
+         * code may not hook properly, and if you own one of these
+         * cards then you have the right to do RSA operations on it
+         * anyway! */
+        meth1 = RSA_PKCS1_SSLeay();
+        aep_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
+        aep_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
+        aep_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
+        aep_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
+#endif
+
+
+#ifndef OPENSSL_NO_DSA
+        /* Use the DSA_OpenSSL() method and just hook the mod_exp-ish
+         * bits. */
+        meth2 = DSA_OpenSSL();
+        aep_dsa.dsa_do_sign    = meth2->dsa_do_sign;
+        aep_dsa.dsa_sign_setup = meth2->dsa_sign_setup;
+        aep_dsa.dsa_do_verify  = meth2->dsa_do_verify;
+
+        aep_dsa = *DSA_get_default_method(); 
+        aep_dsa.dsa_mod_exp = aep_dsa_mod_exp; 
+        aep_dsa.bn_mod_exp = aep_mod_exp_dsa;
+#endif
+
+#ifndef OPENSSL_NO_DH
+        /* Much the same for Diffie-Hellman */
+        meth3 = DH_OpenSSL();
+        aep_dh.generate_key = meth3->generate_key;
+        aep_dh.compute_key  = meth3->compute_key;
+        aep_dh.bn_mod_exp   = meth3->bn_mod_exp;
+#endif
+
+        /* Ensure the aep error handling is set up */
+        ERR_load_AEPHK_strings();
+
+        return 1;
+}
+
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE
+static int bind_helper(ENGINE *e, const char *id)
+        {
+        if(id && (strcmp(id, engine_aep_id) != 0))
+                return 0;
+        if(!bind_aep(e))
+                return 0;
+        return 1;
+        }       
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)
+#else
+static ENGINE *engine_aep(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!bind_aep(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_aep(void)
+        {
+        /* Copied from eng_[openssl|dyn].c */
+        ENGINE *toadd = engine_aep();
+        if(!toadd) return;
+        ENGINE_add(toadd);
+        ENGINE_free(toadd);
+        ERR_clear_error();
+        }
+#endif
+
+/* This is a process-global DSO handle used for loading and unloading
+ * the Aep library. NB: This is only set (or unset) during an
+ * init() or finish() call (reference counts permitting) and they're
+ * operating with global locks, so this should be thread-safe
+ * implicitly. */
+static DSO *aep_dso = NULL;
+
+/* These are the static string constants for the DSO file name and the function
+ * symbol names to bind to. 
+*/
+static const char *AEP_LIBNAME = NULL;
+static const char *get_AEP_LIBNAME(void)
+        {
+        if(AEP_LIBNAME)
+                return AEP_LIBNAME;
+        return "aep";
+        }
+static void free_AEP_LIBNAME(void)
+        {
+        if(AEP_LIBNAME)
+                OPENSSL_free((void*)AEP_LIBNAME);
+        AEP_LIBNAME = NULL;
+        }
+static long set_AEP_LIBNAME(const char *name)
+        {
+        free_AEP_LIBNAME();
+        return ((AEP_LIBNAME = BUF_strdup(name)) != NULL ? 1 : 0);
+        }
+
+static const char *AEP_F1    = "AEP_ModExp";
+static const char *AEP_F2    = "AEP_ModExpCrt";
+#ifdef AEPRAND
+static const char *AEP_F3    = "AEP_GenRandom";
+#endif
+static const char *AEP_F4    = "AEP_Finalize";
+static const char *AEP_F5    = "AEP_Initialize";
+static const char *AEP_F6    = "AEP_OpenConnection";
+static const char *AEP_F7    = "AEP_SetBNCallBacks";
+static const char *AEP_F8    = "AEP_CloseConnection";
+
+/* These are the function pointers that are (un)set when the library has
+ * successfully (un)loaded. */
+static t_AEP_OpenConnection    *p_AEP_OpenConnection  = NULL;
+static t_AEP_CloseConnection   *p_AEP_CloseConnection = NULL;
+static t_AEP_ModExp            *p_AEP_ModExp          = NULL;
+static t_AEP_ModExpCrt         *p_AEP_ModExpCrt       = NULL;
+#ifdef AEPRAND
+static t_AEP_GenRandom         *p_AEP_GenRandom       = NULL;
+#endif
+static t_AEP_Initialize        *p_AEP_Initialize      = NULL;
+static t_AEP_Finalize          *p_AEP_Finalize        = NULL;
+static t_AEP_SetBNCallBacks    *p_AEP_SetBNCallBacks  = NULL;
+
+/* (de)initialisation functions. */
+static int aep_init(ENGINE *e)
+        {
+        t_AEP_ModExp          *p1;
+        t_AEP_ModExpCrt       *p2;
+#ifdef AEPRAND
+        t_AEP_GenRandom       *p3;
+#endif
+        t_AEP_Finalize        *p4;
+        t_AEP_Initialize      *p5;
+        t_AEP_OpenConnection  *p6;
+        t_AEP_SetBNCallBacks  *p7;
+        t_AEP_CloseConnection *p8;
+
+        int to_return = 0;
+ 
+        if(aep_dso != NULL)
+                {
+                AEPHKerr(AEPHK_F_AEP_INIT,AEPHK_R_ALREADY_LOADED);
+                goto err;
+                }
+        /* Attempt to load libaep.so. */
+
+        aep_dso = DSO_load(NULL, get_AEP_LIBNAME(), NULL, 0);
+  
+        if(aep_dso == NULL)
+                {
+                AEPHKerr(AEPHK_F_AEP_INIT,AEPHK_R_NOT_LOADED);
+                goto err;
+                }
+
+        if(     !(p1 = (t_AEP_ModExp *)     DSO_bind_func( aep_dso,AEP_F1))  ||
+                !(p2 = (t_AEP_ModExpCrt*)   DSO_bind_func( aep_dso,AEP_F2))  ||
+#ifdef AEPRAND
+                !(p3 = (t_AEP_GenRandom*)   DSO_bind_func( aep_dso,AEP_F3))  ||
+#endif
+                !(p4 = (t_AEP_Finalize*)    DSO_bind_func( aep_dso,AEP_F4))  ||
+                !(p5 = (t_AEP_Initialize*)  DSO_bind_func( aep_dso,AEP_F5))  ||
+                !(p6 = (t_AEP_OpenConnection*) DSO_bind_func( aep_dso,AEP_F6))  ||
+                !(p7 = (t_AEP_SetBNCallBacks*) DSO_bind_func( aep_dso,AEP_F7))  ||
+                !(p8 = (t_AEP_CloseConnection*) DSO_bind_func( aep_dso,AEP_F8)))
+                {
+                AEPHKerr(AEPHK_F_AEP_INIT,AEPHK_R_NOT_LOADED);
+                goto err;
+                }
+
+        /* Copy the pointers */
+  
+        p_AEP_ModExp           = p1;
+        p_AEP_ModExpCrt        = p2;
+#ifdef AEPRAND
+        p_AEP_GenRandom        = p3;
+#endif
+        p_AEP_Finalize         = p4;
+        p_AEP_Initialize       = p5;
+        p_AEP_OpenConnection   = p6;
+        p_AEP_SetBNCallBacks   = p7;
+        p_AEP_CloseConnection  = p8;
+ 
+        to_return = 1;
+ 
+        return to_return;
+
+ err: 
+
+        if(aep_dso)
+                DSO_free(aep_dso);
+        aep_dso = NULL;
+                
+        p_AEP_OpenConnection    = NULL;
+        p_AEP_ModExp            = NULL;
+        p_AEP_ModExpCrt         = NULL;
+#ifdef AEPRAND
+        p_AEP_GenRandom         = NULL;
+#endif
+        p_AEP_Initialize        = NULL;
+        p_AEP_Finalize          = NULL;
+        p_AEP_SetBNCallBacks    = NULL;
+        p_AEP_CloseConnection   = NULL;
+
+        return to_return;
+        }
+
+/* Destructor (complements the "ENGINE_aep()" constructor) */
+static int aep_destroy(ENGINE *e)
+        {
+        free_AEP_LIBNAME();
+        ERR_unload_AEPHK_strings();
+        return 1;
+        }
+
+static int aep_finish(ENGINE *e)
+        {
+        int to_return = 0, in_use;
+        AEP_RV rv;
+
+        if(aep_dso == NULL)
+                {
+                AEPHKerr(AEPHK_F_AEP_FINISH,AEPHK_R_NOT_LOADED);
+                goto err;
+                }
+
+        rv = aep_close_all_connections(0, &in_use);
+        if (rv != AEP_R_OK)
+                {
+                AEPHKerr(AEPHK_F_AEP_FINISH,AEPHK_R_CLOSE_HANDLES_FAILED);
+                goto err;
+                }
+        if (in_use)
+                {
+                AEPHKerr(AEPHK_F_AEP_FINISH,AEPHK_R_CONNECTIONS_IN_USE);
+                goto err;
+                }
+
+        rv = p_AEP_Finalize();
+        if (rv != AEP_R_OK)
+                {
+                AEPHKerr(AEPHK_F_AEP_FINISH,AEPHK_R_FINALIZE_FAILED);
+                goto err;
+                }
+
+        if(!DSO_free(aep_dso))
+                {
+                AEPHKerr(AEPHK_F_AEP_FINISH,AEPHK_R_UNIT_FAILURE);
+                goto err;
+                }
+
+        aep_dso = NULL;
+        p_AEP_CloseConnection   = NULL;
+        p_AEP_OpenConnection    = NULL;
+        p_AEP_ModExp            = NULL;
+        p_AEP_ModExpCrt         = NULL;
+#ifdef AEPRAND
+        p_AEP_GenRandom         = NULL;
+#endif
+        p_AEP_Initialize        = NULL;
+        p_AEP_Finalize          = NULL;
+        p_AEP_SetBNCallBacks    = NULL;
+
+        to_return = 1;
+ err:
+        return to_return;
+        }
+
+static int aep_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+        {
+        int initialised = ((aep_dso == NULL) ? 0 : 1);
+        switch(cmd)
+                {
+        case AEP_CMD_SO_PATH:
+                if(p == NULL)
+                        {
+                        AEPHKerr(AEPHK_F_AEP_CTRL,
+                                ERR_R_PASSED_NULL_PARAMETER);
+                        return 0;
+                        }
+                if(initialised)
+                        {
+                        AEPHKerr(AEPHK_F_AEP_CTRL,
+                                AEPHK_R_ALREADY_LOADED);
+                        return 0;
+                        }
+                return set_AEP_LIBNAME((const char*)p);
+        default:
+                break;
+                }
+        AEPHKerr(AEPHK_F_AEP_CTRL,AEPHK_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+        return 0;
+        }
+
+static int aep_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *m, BN_CTX *ctx)
+        {
+        int to_return = 0;
+        int     r_len = 0;
+        AEP_CONNECTION_HNDL hConnection;
+        AEP_RV rv;
+        
+        r_len = BN_num_bits(m);
+
+        /* Perform in software if modulus is too large for hardware. */
+
+        if (r_len > max_key_len){
+                AEPHKerr(AEPHK_F_AEP_MOD_EXP, AEPHK_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
+                return BN_mod_exp(r, a, p, m, ctx);
+        } 
+
+        /*Grab a connection from the pool*/
+        rv = aep_get_connection(&hConnection);
+        if (rv != AEP_R_OK)
+                {     
+                AEPHKerr(AEPHK_F_AEP_MOD_EXP,AEPHK_R_GET_HANDLE_FAILED);
+                return BN_mod_exp(r, a, p, m, ctx);
+                }
+
+        /*To the card with the mod exp*/
+        rv = p_AEP_ModExp(hConnection,(void*)a, (void*)p,(void*)m, (void*)r,NULL);
+
+        if (rv !=  AEP_R_OK)
+                {
+                AEPHKerr(AEPHK_F_AEP_MOD_EXP,AEPHK_R_MOD_EXP_FAILED);
+                rv = aep_close_connection(hConnection);
+                return BN_mod_exp(r, a, p, m, ctx);
+                }
+
+        /*Return the connection to the pool*/
+        rv = aep_return_connection(hConnection);
+        if (rv != AEP_R_OK)
+                {
+                AEPHKerr(AEPHK_F_AEP_MOD_EXP,AEPHK_R_RETURN_CONNECTION_FAILED); 
+                goto err;
+                }
+
+        to_return = 1;
+ err:
+        return to_return;
+        }
+        
+#ifndef OPENSSL_NO_RSA
+static AEP_RV aep_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *q, const BIGNUM *dmp1,
+        const BIGNUM *dmq1,const BIGNUM *iqmp, BN_CTX *ctx)
+        {
+        AEP_RV rv = AEP_R_OK;
+        AEP_CONNECTION_HNDL hConnection;
+
+        /*Grab a connection from the pool*/
+        rv = aep_get_connection(&hConnection);
+        if (rv != AEP_R_OK)
+                {
+                AEPHKerr(AEPHK_F_AEP_MOD_EXP_CRT,AEPHK_R_GET_HANDLE_FAILED);
+                return FAIL_TO_SW;
+                }
+
+        /*To the card with the mod exp*/
+        rv = p_AEP_ModExpCrt(hConnection,(void*)a, (void*)p, (void*)q, (void*)dmp1,(void*)dmq1,
+                (void*)iqmp,(void*)r,NULL);
+        if (rv != AEP_R_OK)
+                {
+                AEPHKerr(AEPHK_F_AEP_MOD_EXP_CRT,AEPHK_R_MOD_EXP_CRT_FAILED);
+                rv = aep_close_connection(hConnection);
+                return FAIL_TO_SW;
+                }
+
+        /*Return the connection to the pool*/
+        rv = aep_return_connection(hConnection);
+        if (rv != AEP_R_OK)
+                {
+                AEPHKerr(AEPHK_F_AEP_MOD_EXP_CRT,AEPHK_R_RETURN_CONNECTION_FAILED); 
+                goto err;
+                }
+ 
+ err:
+        return rv;
+        }
+#endif
+        
+
+#ifdef AEPRAND
+static int aep_rand(unsigned char *buf,int len )
+        {
+        AEP_RV rv = AEP_R_OK;
+        AEP_CONNECTION_HNDL hConnection;
+
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+
+        /*Can the request be serviced with what's already in the buffer?*/
+        if (len <= rand_block_bytes)
+                {
+                memcpy(buf, &rand_block[RAND_BLK_SIZE - rand_block_bytes], len);
+                rand_block_bytes -= len;
+                CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+                }
+        else
+                /*If not the get another block of random bytes*/
+                {
+                CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+
+                rv = aep_get_connection(&hConnection);
+                if (rv !=  AEP_R_OK)
+                        { 
+                        AEPHKerr(AEPHK_F_AEP_RAND,AEPHK_R_GET_HANDLE_FAILED);             
+                        goto err_nounlock;
+                        }
+
+                if (len > RAND_BLK_SIZE)
+                        {
+                        rv = p_AEP_GenRandom(hConnection, len, 2, buf, NULL);
+                        if (rv !=  AEP_R_OK)
+                                {  
+                                AEPHKerr(AEPHK_F_AEP_RAND,AEPHK_R_GET_RANDOM_FAILED); 
+                                goto err_nounlock;
+                                }
+                        }
+                else
+                        {
+                        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+
+                        rv = p_AEP_GenRandom(hConnection, RAND_BLK_SIZE, 2, &rand_block[0], NULL);
+                        if (rv !=  AEP_R_OK)
+                                {       
+                                AEPHKerr(AEPHK_F_AEP_RAND,AEPHK_R_GET_RANDOM_FAILED); 
+              
+                                goto err;
+                                }
+
+                        rand_block_bytes = RAND_BLK_SIZE;
+
+                        memcpy(buf, &rand_block[RAND_BLK_SIZE - rand_block_bytes], len);
+                        rand_block_bytes -= len;
+
+                        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+                        }
+
+                rv = aep_return_connection(hConnection);
+                if (rv != AEP_R_OK)
+                        {
+                        AEPHKerr(AEPHK_F_AEP_RAND,AEPHK_R_RETURN_CONNECTION_FAILED); 
+          
+                        goto err_nounlock;
+                        }
+                }
+  
+        return 1;
+ err:
+        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+ err_nounlock:
+        return 0;
+        }
+        
+static int aep_rand_status(void)
+{
+        return 1;
+}
+#endif
+
+#ifndef OPENSSL_NO_RSA
+static int aep_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
+        {
+        int to_return = 0;
+        AEP_RV rv = AEP_R_OK;
+
+        if (!aep_dso)
+                {
+                AEPHKerr(AEPHK_F_AEP_RSA_MOD_EXP,AEPHK_R_NOT_LOADED);
+                goto err;
+                }
+
+        /*See if we have all the necessary bits for a crt*/
+        if (rsa->q && rsa->dmp1 && rsa->dmq1 && rsa->iqmp)
+                {
+                rv =  aep_mod_exp_crt(r0,I,rsa->p,rsa->q, rsa->dmp1,rsa->dmq1,rsa->iqmp,ctx);
+
+                if (rv == FAIL_TO_SW){
+                        const RSA_METHOD *meth = RSA_PKCS1_SSLeay();
+                        to_return = (*meth->rsa_mod_exp)(r0, I, rsa, ctx);
+                        goto err;
+                }
+                else if (rv != AEP_R_OK)
+                        goto err;
+                }
+        else
+                {
+                if (!rsa->d || !rsa->n)
+                        {
+                        AEPHKerr(AEPHK_F_AEP_RSA_MOD_EXP,AEPHK_R_MISSING_KEY_COMPONENTS);
+                        goto err;
+                        }
+ 
+                rv = aep_mod_exp(r0,I,rsa->d,rsa->n,ctx);
+                if  (rv != AEP_R_OK)
+                        goto err;
+        
+                }
+
+        to_return = 1;
+
+ err:
+        return to_return;
+}
+#endif
+
+#ifndef OPENSSL_NO_DSA
+static int aep_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+        BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+        BN_CTX *ctx, BN_MONT_CTX *in_mont)
+        {
+        BIGNUM t;
+        int to_return = 0;
+        BN_init(&t);
+
+        /* let rr = a1 ^ p1 mod m */
+        if (!aep_mod_exp(rr,a1,p1,m,ctx)) goto end;
+        /* let t = a2 ^ p2 mod m */
+        if (!aep_mod_exp(&t,a2,p2,m,ctx)) goto end;
+        /* let rr = rr * t mod m */
+        if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
+        to_return = 1;
+ end: 
+        BN_free(&t);
+        return to_return;
+        }
+
+static int aep_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+        BN_MONT_CTX *m_ctx)
+        {  
+        return aep_mod_exp(r, a, p, m, ctx); 
+        }
+#endif
+
+#ifndef OPENSSL_NO_RSA
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int aep_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        return aep_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* This function is aliased to mod_exp (with the dh and mont dropped). */
+static int aep_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
+        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+        BN_MONT_CTX *m_ctx)
+        {
+        return aep_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+static AEP_RV aep_get_connection(AEP_CONNECTION_HNDL_PTR phConnection)
+        {
+        int count;
+        AEP_RV rv = AEP_R_OK;
+
+        /*Get the current process id*/
+        pid_t curr_pid;
+
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+
+#ifndef NETWARE_CLIB
+        curr_pid = getpid();
+#else
+        curr_pid = GetThreadID();
+#endif
+
+        /*Check if this is the first time this is being called from the current
+          process*/
+        if (recorded_pid != curr_pid)
+                {
+                /*Remember our pid so we can check if we're in a new process*/
+                recorded_pid = curr_pid;
+
+                /*Call Finalize to make sure we have not inherited some data
+                  from a parent process*/
+                p_AEP_Finalize();
+     
+                /*Initialise the AEP API*/
+                rv = p_AEP_Initialize(NULL);
+
+                if (rv != AEP_R_OK)
+                        {
+                        AEPHKerr(AEPHK_F_AEP_GET_CONNECTION,AEPHK_R_INIT_FAILURE);
+                        recorded_pid = 0;
+                        goto end;
+                        }
+
+                /*Set the AEP big num call back functions*/
+                rv = p_AEP_SetBNCallBacks(&GetBigNumSize, &MakeAEPBigNum,
+                        &ConvertAEPBigNum);
+
+                if (rv != AEP_R_OK)
+                        {
+                        AEPHKerr(AEPHK_F_AEP_GET_CONNECTION,AEPHK_R_SETBNCALLBACK_FAILURE);
+                        recorded_pid = 0;
+                        goto end;
+                        }
+
+#ifdef AEPRAND
+                /*Reset the rand byte count*/
+                rand_block_bytes = 0;
+#endif
+
+                /*Init the structures*/
+                for (count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
+                        {
+                        aep_app_conn_table[count].conn_state = NotConnected;
+                        aep_app_conn_table[count].conn_hndl  = 0;
+                        }
+
+                /*Open a connection*/
+                rv = p_AEP_OpenConnection(phConnection);
+
+                if (rv != AEP_R_OK)
+                        {
+                        AEPHKerr(AEPHK_F_AEP_GET_CONNECTION,AEPHK_R_UNIT_FAILURE);
+                        recorded_pid = 0;
+                        goto end;
+                        }
+
+                aep_app_conn_table[0].conn_state = InUse;
+                aep_app_conn_table[0].conn_hndl = *phConnection;
+                goto end;
+                }
+        /*Check the existing connections to see if we can find a free one*/
+        for (count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
+                {
+                if (aep_app_conn_table[count].conn_state == Connected)
+                        {
+                        aep_app_conn_table[count].conn_state = InUse;
+                        *phConnection = aep_app_conn_table[count].conn_hndl;
+                        goto end;
+                        }
+                }
+        /*If no connections available, we're going to have to try
+          to open a new one*/
+        for (count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
+                {
+                if (aep_app_conn_table[count].conn_state == NotConnected)
+                        {
+                        /*Open a connection*/
+                        rv = p_AEP_OpenConnection(phConnection);
+
+                        if (rv != AEP_R_OK)
+                                {             
+                                AEPHKerr(AEPHK_F_AEP_GET_CONNECTION,AEPHK_R_UNIT_FAILURE);
+                                goto end;
+                                }
+
+                        aep_app_conn_table[count].conn_state = InUse;
+                        aep_app_conn_table[count].conn_hndl = *phConnection;
+                        goto end;
+                        }
+                }
+        rv = AEP_R_GENERAL_ERROR;
+ end:
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        return rv;
+        }
+
+
+static AEP_RV aep_return_connection(AEP_CONNECTION_HNDL hConnection)
+        {
+        int count;
+
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+
+        /*Find the connection item that matches this connection handle*/
+        for(count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
+                {
+                if (aep_app_conn_table[count].conn_hndl == hConnection)
+                        {
+                        aep_app_conn_table[count].conn_state = Connected;
+                        break;
+                        }
+                }
+
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+
+        return AEP_R_OK;
+        }
+
+static AEP_RV aep_close_connection(AEP_CONNECTION_HNDL hConnection)
+        {
+        int count;
+        AEP_RV rv = AEP_R_OK;
+
+        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+
+        /*Find the connection item that matches this connection handle*/
+        for(count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
+                {
+                if (aep_app_conn_table[count].conn_hndl == hConnection)
+                        {
+                        rv = p_AEP_CloseConnection(aep_app_conn_table[count].conn_hndl);
+                        if (rv != AEP_R_OK)
+                                goto end;
+                        aep_app_conn_table[count].conn_state = NotConnected;
+                        aep_app_conn_table[count].conn_hndl  = 0;
+                        break;
+                        }
+                }
+
+ end:
+        CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        return rv;
+        }
+
+static AEP_RV aep_close_all_connections(int use_engine_lock, int *in_use)
+        {
+        int count;
+        AEP_RV rv = AEP_R_OK;
+
+        *in_use = 0;
+        if (use_engine_lock) CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+        for (count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
+                {
+                switch (aep_app_conn_table[count].conn_state)
+                        {
+                case Connected:
+                        rv = p_AEP_CloseConnection(aep_app_conn_table[count].conn_hndl);
+                        if (rv != AEP_R_OK)
+                                goto end;
+                        aep_app_conn_table[count].conn_state = NotConnected;
+                        aep_app_conn_table[count].conn_hndl  = 0;
+                        break;
+                case InUse:
+                        (*in_use)++;
+                        break;
+                case NotConnected:
+                        break;
+                        }
+                }
+ end:
+        if (use_engine_lock) CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+        return rv;
+        }
+
+/*BigNum call back functions, used to convert OpenSSL bignums into AEP bignums.
+  Note only 32bit Openssl build support*/
+
+static AEP_RV GetBigNumSize(AEP_VOID_PTR ArbBigNum, AEP_U32* BigNumSize)
+        {
+        BIGNUM* bn;
+
+        /*Cast the ArbBigNum pointer to our BIGNUM struct*/
+        bn = (BIGNUM*) ArbBigNum;
+
+#ifdef SIXTY_FOUR_BIT_LONG
+        *BigNumSize = bn->top << 3;
+#else
+        /*Size of the bignum in bytes is equal to the bn->top (no of 32 bit
+          words) multiplies by 4*/
+        *BigNumSize = bn->top << 2;
+#endif
+
+        return AEP_R_OK;
+        }
+
+static AEP_RV MakeAEPBigNum(AEP_VOID_PTR ArbBigNum, AEP_U32 BigNumSize,
+        unsigned char* AEP_BigNum)
+        {
+        BIGNUM* bn;
+
+#ifndef SIXTY_FOUR_BIT_LONG
+        unsigned char* buf;
+        int i;
+#endif
+
+        /*Cast the ArbBigNum pointer to our BIGNUM struct*/
+        bn = (BIGNUM*) ArbBigNum;
+
+#ifdef SIXTY_FOUR_BIT_LONG
+        memcpy(AEP_BigNum, bn->d, BigNumSize);
+#else
+        /*Must copy data into a (monotone) least significant byte first format
+          performing endian conversion if necessary*/
+        for(i=0;i<bn->top;i++)
+                {
+                buf = (unsigned char*)&bn->d[i];
+
+                *((AEP_U32*)AEP_BigNum) = (AEP_U32)
+                        ((unsigned) buf[1] << 8 | buf[0]) |
+                        ((unsigned) buf[3] << 8 | buf[2])  << 16;
+
+                AEP_BigNum += 4;
+                }
+#endif
+
+        return AEP_R_OK;
+        }
+
+/*Turn an AEP Big Num back to a user big num*/
+static AEP_RV ConvertAEPBigNum(void* ArbBigNum, AEP_U32 BigNumSize,
+        unsigned char* AEP_BigNum)
+        {
+        BIGNUM* bn;
+#ifndef SIXTY_FOUR_BIT_LONG
+        int i;
+#endif
+
+        bn = (BIGNUM*)ArbBigNum;
+
+        /*Expand the result bn so that it can hold our big num.
+          Size is in bits*/
+        bn_expand(bn, (int)(BigNumSize << 3));
+
+#ifdef SIXTY_FOUR_BIT_LONG
+        bn->top = BigNumSize >> 3;
+        
+        if((BigNumSize & 7) != 0)
+                bn->top++;
+
+        memset(bn->d, 0, bn->top << 3); 
+
+        memcpy(bn->d, AEP_BigNum, BigNumSize);
+#else
+        bn->top = BigNumSize >> 2;
+ 
+        for(i=0;i<bn->top;i++)
+                {
+                bn->d[i] = (AEP_U32)
+                        ((unsigned) AEP_BigNum[3] << 8 | AEP_BigNum[2]) << 16 |
+                        ((unsigned) AEP_BigNum[1] << 8 | AEP_BigNum[0]);
+                AEP_BigNum += 4;
+                }
+#endif
+
+        return AEP_R_OK;
+}       
+        
+#endif /* !OPENSSL_NO_HW_AEP */
+#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libssl/src/engines/e_aep.ec b/src/lib/libssl/src/engines/e_aep.ec
new file mode 100644
index 0000000000..8eae642e06
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_aep.ec
@@ -0,0 +1 @@
+L AEPHK         e_aep_err.h                     e_aep_err.c
diff --git a/src/lib/libssl/src/engines/e_aep_err.c b/src/lib/libssl/src/engines/e_aep_err.c
new file mode 100644
index 0000000000..3f95881cab
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_aep_err.c
@@ -0,0 +1,161 @@
+/* e_aep_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "e_aep_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(0,func,0)
+#define ERR_REASON(reason) ERR_PACK(0,0,reason)
+
+static ERR_STRING_DATA AEPHK_str_functs[]=
+        {
+{ERR_FUNC(AEPHK_F_AEP_CTRL),    "AEP_CTRL"},
+{ERR_FUNC(AEPHK_F_AEP_FINISH),  "AEP_FINISH"},
+{ERR_FUNC(AEPHK_F_AEP_GET_CONNECTION),  "AEP_GET_CONNECTION"},
+{ERR_FUNC(AEPHK_F_AEP_INIT),    "AEP_INIT"},
+{ERR_FUNC(AEPHK_F_AEP_MOD_EXP), "AEP_MOD_EXP"},
+{ERR_FUNC(AEPHK_F_AEP_MOD_EXP_CRT),     "AEP_MOD_EXP_CRT"},
+{ERR_FUNC(AEPHK_F_AEP_RAND),    "AEP_RAND"},
+{ERR_FUNC(AEPHK_F_AEP_RSA_MOD_EXP),     "AEP_RSA_MOD_EXP"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA AEPHK_str_reasons[]=
+        {
+{ERR_REASON(AEPHK_R_ALREADY_LOADED)      ,"already loaded"},
+{ERR_REASON(AEPHK_R_CLOSE_HANDLES_FAILED),"close handles failed"},
+{ERR_REASON(AEPHK_R_CONNECTIONS_IN_USE)  ,"connections in use"},
+{ERR_REASON(AEPHK_R_CTRL_COMMAND_NOT_IMPLEMENTED),"ctrl command not implemented"},
+{ERR_REASON(AEPHK_R_FINALIZE_FAILED)     ,"finalize failed"},
+{ERR_REASON(AEPHK_R_GET_HANDLE_FAILED)   ,"get handle failed"},
+{ERR_REASON(AEPHK_R_GET_RANDOM_FAILED)   ,"get random failed"},
+{ERR_REASON(AEPHK_R_INIT_FAILURE)        ,"init failure"},
+{ERR_REASON(AEPHK_R_MISSING_KEY_COMPONENTS),"missing key components"},
+{ERR_REASON(AEPHK_R_MOD_EXP_CRT_FAILED)  ,"mod exp crt failed"},
+{ERR_REASON(AEPHK_R_MOD_EXP_FAILED)      ,"mod exp failed"},
+{ERR_REASON(AEPHK_R_NOT_LOADED)          ,"not loaded"},
+{ERR_REASON(AEPHK_R_OK)                  ,"ok"},
+{ERR_REASON(AEPHK_R_RETURN_CONNECTION_FAILED),"return connection failed"},
+{ERR_REASON(AEPHK_R_SETBNCALLBACK_FAILURE),"setbncallback failure"},
+{ERR_REASON(AEPHK_R_SIZE_TOO_LARGE_OR_TOO_SMALL),"size too large or too small"},
+{ERR_REASON(AEPHK_R_UNIT_FAILURE)        ,"unit failure"},
+{0,NULL}
+        };
+
+#endif
+
+#ifdef AEPHK_LIB_NAME
+static ERR_STRING_DATA AEPHK_lib_name[]=
+        {
+{0      ,AEPHK_LIB_NAME},
+{0,NULL}
+        };
+#endif
+
+
+static int AEPHK_lib_error_code=0;
+static int AEPHK_error_init=1;
+
+static void ERR_load_AEPHK_strings(void)
+        {
+        if (AEPHK_lib_error_code == 0)
+                AEPHK_lib_error_code=ERR_get_next_error_library();
+
+        if (AEPHK_error_init)
+                {
+                AEPHK_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(AEPHK_lib_error_code,AEPHK_str_functs);
+                ERR_load_strings(AEPHK_lib_error_code,AEPHK_str_reasons);
+#endif
+
+#ifdef AEPHK_LIB_NAME
+                AEPHK_lib_name->error = ERR_PACK(AEPHK_lib_error_code,0,0);
+                ERR_load_strings(0,AEPHK_lib_name);
+#endif
+                }
+        }
+
+static void ERR_unload_AEPHK_strings(void)
+        {
+        if (AEPHK_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(AEPHK_lib_error_code,AEPHK_str_functs);
+                ERR_unload_strings(AEPHK_lib_error_code,AEPHK_str_reasons);
+#endif
+
+#ifdef AEPHK_LIB_NAME
+                ERR_unload_strings(0,AEPHK_lib_name);
+#endif
+                AEPHK_error_init=1;
+                }
+        }
+
+static void ERR_AEPHK_error(int function, int reason, char *file, int line)
+        {
+        if (AEPHK_lib_error_code == 0)
+                AEPHK_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(AEPHK_lib_error_code,function,reason,file,line);
+        }
diff --git a/src/lib/libssl/src/engines/e_aep_err.h b/src/lib/libssl/src/engines/e_aep_err.h
new file mode 100644
index 0000000000..35b2e74260
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_aep_err.h
@@ -0,0 +1,105 @@
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_AEPHK_ERR_H
+#define HEADER_AEPHK_ERR_H
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_AEPHK_strings(void);
+static void ERR_unload_AEPHK_strings(void);
+static void ERR_AEPHK_error(int function, int reason, char *file, int line);
+#define AEPHKerr(f,r) ERR_AEPHK_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the AEPHK functions. */
+
+/* Function codes. */
+#define AEPHK_F_AEP_CTRL                                 100
+#define AEPHK_F_AEP_FINISH                               101
+#define AEPHK_F_AEP_GET_CONNECTION                       102
+#define AEPHK_F_AEP_INIT                                 103
+#define AEPHK_F_AEP_MOD_EXP                              104
+#define AEPHK_F_AEP_MOD_EXP_CRT                          105
+#define AEPHK_F_AEP_RAND                                 106
+#define AEPHK_F_AEP_RSA_MOD_EXP                          107
+
+/* Reason codes. */
+#define AEPHK_R_ALREADY_LOADED                           100
+#define AEPHK_R_CLOSE_HANDLES_FAILED                     101
+#define AEPHK_R_CONNECTIONS_IN_USE                       102
+#define AEPHK_R_CTRL_COMMAND_NOT_IMPLEMENTED             103
+#define AEPHK_R_FINALIZE_FAILED                          104
+#define AEPHK_R_GET_HANDLE_FAILED                        105
+#define AEPHK_R_GET_RANDOM_FAILED                        106
+#define AEPHK_R_INIT_FAILURE                             107
+#define AEPHK_R_MISSING_KEY_COMPONENTS                   108
+#define AEPHK_R_MOD_EXP_CRT_FAILED                       109
+#define AEPHK_R_MOD_EXP_FAILED                           110
+#define AEPHK_R_NOT_LOADED                               111
+#define AEPHK_R_OK                                       112
+#define AEPHK_R_RETURN_CONNECTION_FAILED                 113
+#define AEPHK_R_SETBNCALLBACK_FAILURE                    114
+#define AEPHK_R_SIZE_TOO_LARGE_OR_TOO_SMALL              116
+#define AEPHK_R_UNIT_FAILURE                             115
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/engines/e_atalla.c b/src/lib/libssl/src/engines/e_atalla.c
new file mode 100644
index 0000000000..fabaa86a52
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_atalla.c
@@ -0,0 +1,607 @@
+/* crypto/engine/hw_atalla.c */
+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
+ * project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/crypto.h>
+#include <openssl/buffer.h>
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_ATALLA
+
+#ifdef FLAT_INC
+#include "atalla.h"
+#else
+#include "vendor_defns/atalla.h"
+#endif
+
+#define ATALLA_LIB_NAME "atalla engine"
+#include "e_atalla_err.c"
+
+static int atalla_destroy(ENGINE *e);
+static int atalla_init(ENGINE *e);
+static int atalla_finish(ENGINE *e);
+static int atalla_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void));
+
+/* BIGNUM stuff */
+static int atalla_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx);
+
+#ifndef OPENSSL_NO_RSA
+/* RSA stuff */
+static int atalla_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int atalla_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#endif
+
+#ifndef OPENSSL_NO_DSA
+/* DSA stuff */
+static int atalla_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+                BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+                BN_CTX *ctx, BN_MONT_CTX *in_mont);
+static int atalla_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *m_ctx);
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* DH stuff */
+/* This function is alised to mod_exp (with the DH and mont dropped). */
+static int atalla_mod_exp_dh(const DH *dh, BIGNUM *r,
+                const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#endif
+
+/* The definitions for control commands specific to this engine */
+#define ATALLA_CMD_SO_PATH              ENGINE_CMD_BASE
+static const ENGINE_CMD_DEFN atalla_cmd_defns[] = {
+        {ATALLA_CMD_SO_PATH,
+                "SO_PATH",
+                "Specifies the path to the 'atasi' shared library",
+                ENGINE_CMD_FLAG_STRING},
+        {0, NULL, NULL, 0}
+        };
+
+#ifndef OPENSSL_NO_RSA
+/* Our internal RSA_METHOD that we provide pointers to */
+static RSA_METHOD atalla_rsa =
+        {
+        "Atalla RSA method",
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        atalla_rsa_mod_exp,
+        atalla_mod_exp_mont,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL,
+        NULL,
+        NULL
+        };
+#endif
+
+#ifndef OPENSSL_NO_DSA
+/* Our internal DSA_METHOD that we provide pointers to */
+static DSA_METHOD atalla_dsa =
+        {
+        "Atalla DSA method",
+        NULL, /* dsa_do_sign */
+        NULL, /* dsa_sign_setup */
+        NULL, /* dsa_do_verify */
+        atalla_dsa_mod_exp, /* dsa_mod_exp */
+        atalla_mod_exp_dsa, /* bn_mod_exp */
+        NULL, /* init */
+        NULL, /* finish */
+        0, /* flags */
+        NULL, /* app_data */
+        NULL, /* dsa_paramgen */
+        NULL /* dsa_keygen */
+        };
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* Our internal DH_METHOD that we provide pointers to */
+static DH_METHOD atalla_dh =
+        {
+        "Atalla DH method",
+        NULL,
+        NULL,
+        atalla_mod_exp_dh,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL
+        };
+#endif
+
+/* Constants used when creating the ENGINE */
+static const char *engine_atalla_id = "atalla";
+static const char *engine_atalla_name = "Atalla hardware engine support";
+
+/* This internal function is used by ENGINE_atalla() and possibly by the
+ * "dynamic" ENGINE support too */
+static int bind_helper(ENGINE *e)
+        {
+#ifndef OPENSSL_NO_RSA
+        const RSA_METHOD *meth1;
+#endif
+#ifndef OPENSSL_NO_DSA
+        const DSA_METHOD *meth2;
+#endif
+#ifndef OPENSSL_NO_DH
+        const DH_METHOD *meth3;
+#endif
+        if(!ENGINE_set_id(e, engine_atalla_id) ||
+                        !ENGINE_set_name(e, engine_atalla_name) ||
+#ifndef OPENSSL_NO_RSA
+                        !ENGINE_set_RSA(e, &atalla_rsa) ||
+#endif
+#ifndef OPENSSL_NO_DSA
+                        !ENGINE_set_DSA(e, &atalla_dsa) ||
+#endif
+#ifndef OPENSSL_NO_DH
+                        !ENGINE_set_DH(e, &atalla_dh) ||
+#endif
+                        !ENGINE_set_destroy_function(e, atalla_destroy) ||
+                        !ENGINE_set_init_function(e, atalla_init) ||
+                        !ENGINE_set_finish_function(e, atalla_finish) ||
+                        !ENGINE_set_ctrl_function(e, atalla_ctrl) ||
+                        !ENGINE_set_cmd_defns(e, atalla_cmd_defns))
+                return 0;
+
+#ifndef OPENSSL_NO_RSA
+        /* We know that the "PKCS1_SSLeay()" functions hook properly
+         * to the atalla-specific mod_exp and mod_exp_crt so we use
+         * those functions. NB: We don't use ENGINE_openssl() or
+         * anything "more generic" because something like the RSAref
+         * code may not hook properly, and if you own one of these
+         * cards then you have the right to do RSA operations on it
+         * anyway! */ 
+        meth1 = RSA_PKCS1_SSLeay();
+        atalla_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
+        atalla_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
+        atalla_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
+        atalla_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
+#endif
+
+#ifndef OPENSSL_NO_DSA
+        /* Use the DSA_OpenSSL() method and just hook the mod_exp-ish
+         * bits. */
+        meth2 = DSA_OpenSSL();
+        atalla_dsa.dsa_do_sign = meth2->dsa_do_sign;
+        atalla_dsa.dsa_sign_setup = meth2->dsa_sign_setup;
+        atalla_dsa.dsa_do_verify = meth2->dsa_do_verify;
+#endif
+
+#ifndef OPENSSL_NO_DH
+        /* Much the same for Diffie-Hellman */
+        meth3 = DH_OpenSSL();
+        atalla_dh.generate_key = meth3->generate_key;
+        atalla_dh.compute_key = meth3->compute_key;
+#endif
+
+        /* Ensure the atalla error handling is set up */
+        ERR_load_ATALLA_strings();
+        return 1;
+        }
+
+#ifdef OPENSSL_NO_DYNAMIC_ENGINE
+static ENGINE *engine_atalla(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!bind_helper(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_atalla(void)
+        {
+        /* Copied from eng_[openssl|dyn].c */
+        ENGINE *toadd = engine_atalla();
+        if(!toadd) return;
+        ENGINE_add(toadd);
+        ENGINE_free(toadd);
+        ERR_clear_error();
+        }
+#endif
+
+/* This is a process-global DSO handle used for loading and unloading
+ * the Atalla library. NB: This is only set (or unset) during an
+ * init() or finish() call (reference counts permitting) and they're
+ * operating with global locks, so this should be thread-safe
+ * implicitly. */
+static DSO *atalla_dso = NULL;
+
+/* These are the function pointers that are (un)set when the library has
+ * successfully (un)loaded. */
+static tfnASI_GetHardwareConfig *p_Atalla_GetHardwareConfig = NULL;
+static tfnASI_RSAPrivateKeyOpFn *p_Atalla_RSAPrivateKeyOpFn = NULL;
+static tfnASI_GetPerformanceStatistics *p_Atalla_GetPerformanceStatistics = NULL;
+
+/* These are the static string constants for the DSO file name and the function
+ * symbol names to bind to. Regrettably, the DSO name on *nix appears to be
+ * "atasi.so" rather than something more consistent like "libatasi.so". At the
+ * time of writing, I'm not sure what the file name on win32 is but clearly
+ * native name translation is not possible (eg libatasi.so on *nix, and
+ * atasi.dll on win32). For the purposes of testing, I have created a symbollic
+ * link called "libatasi.so" so that we can use native name-translation - a
+ * better solution will be needed. */
+static const char *ATALLA_LIBNAME = NULL;
+static const char *get_ATALLA_LIBNAME(void)
+        {
+                if(ATALLA_LIBNAME)
+                        return ATALLA_LIBNAME;
+                return "atasi";
+        }
+static void free_ATALLA_LIBNAME(void)
+        {
+                if(ATALLA_LIBNAME)
+                        OPENSSL_free((void*)ATALLA_LIBNAME);
+                ATALLA_LIBNAME = NULL;
+        }
+static long set_ATALLA_LIBNAME(const char *name)
+        {
+        free_ATALLA_LIBNAME();
+        return (((ATALLA_LIBNAME = BUF_strdup(name)) != NULL) ? 1 : 0);
+        }
+static const char *ATALLA_F1 = "ASI_GetHardwareConfig";
+static const char *ATALLA_F2 = "ASI_RSAPrivateKeyOpFn";
+static const char *ATALLA_F3 = "ASI_GetPerformanceStatistics";
+
+/* Destructor (complements the "ENGINE_atalla()" constructor) */
+static int atalla_destroy(ENGINE *e)
+        {
+        free_ATALLA_LIBNAME();
+        /* Unload the atalla error strings so any error state including our
+         * functs or reasons won't lead to a segfault (they simply get displayed
+         * without corresponding string data because none will be found). */
+        ERR_unload_ATALLA_strings();
+        return 1;
+        }
+
+/* (de)initialisation functions. */
+static int atalla_init(ENGINE *e)
+        {
+        tfnASI_GetHardwareConfig *p1;
+        tfnASI_RSAPrivateKeyOpFn *p2;
+        tfnASI_GetPerformanceStatistics *p3;
+        /* Not sure of the origin of this magic value, but Ben's code had it
+         * and it seemed to have been working for a few people. :-) */
+        unsigned int config_buf[1024];
+
+        if(atalla_dso != NULL)
+                {
+                ATALLAerr(ATALLA_F_ATALLA_INIT,ATALLA_R_ALREADY_LOADED);
+                goto err;
+                }
+        /* Attempt to load libatasi.so/atasi.dll/whatever. Needs to be
+         * changed unfortunately because the Atalla drivers don't have
+         * standard library names that can be platform-translated well. */
+        /* TODO: Work out how to actually map to the names the Atalla
+         * drivers really use - for now a symbollic link needs to be
+         * created on the host system from libatasi.so to atasi.so on
+         * unix variants. */
+        atalla_dso = DSO_load(NULL, get_ATALLA_LIBNAME(), NULL, 0);
+        if(atalla_dso == NULL)
+                {
+                ATALLAerr(ATALLA_F_ATALLA_INIT,ATALLA_R_NOT_LOADED);
+                goto err;
+                }
+        if(!(p1 = (tfnASI_GetHardwareConfig *)DSO_bind_func(
+                                atalla_dso, ATALLA_F1)) ||
+                        !(p2 = (tfnASI_RSAPrivateKeyOpFn *)DSO_bind_func(
+                                atalla_dso, ATALLA_F2)) ||
+                        !(p3 = (tfnASI_GetPerformanceStatistics *)DSO_bind_func(
+                                atalla_dso, ATALLA_F3)))
+                {
+                ATALLAerr(ATALLA_F_ATALLA_INIT,ATALLA_R_NOT_LOADED);
+                goto err;
+                }
+        /* Copy the pointers */
+        p_Atalla_GetHardwareConfig = p1;
+        p_Atalla_RSAPrivateKeyOpFn = p2;
+        p_Atalla_GetPerformanceStatistics = p3;
+        /* Perform a basic test to see if there's actually any unit
+         * running. */
+        if(p1(0L, config_buf) != 0)
+                {
+                ATALLAerr(ATALLA_F_ATALLA_INIT,ATALLA_R_UNIT_FAILURE);
+                goto err;
+                }
+        /* Everything's fine. */
+        return 1;
+err:
+        if(atalla_dso)
+                DSO_free(atalla_dso);
+        atalla_dso = NULL;
+        p_Atalla_GetHardwareConfig = NULL;
+        p_Atalla_RSAPrivateKeyOpFn = NULL;
+        p_Atalla_GetPerformanceStatistics = NULL;
+        return 0;
+        }
+
+static int atalla_finish(ENGINE *e)
+        {
+        free_ATALLA_LIBNAME();
+        if(atalla_dso == NULL)
+                {
+                ATALLAerr(ATALLA_F_ATALLA_FINISH,ATALLA_R_NOT_LOADED);
+                return 0;
+                }
+        if(!DSO_free(atalla_dso))
+                {
+                ATALLAerr(ATALLA_F_ATALLA_FINISH,ATALLA_R_UNIT_FAILURE);
+                return 0;
+                }
+        atalla_dso = NULL;
+        p_Atalla_GetHardwareConfig = NULL;
+        p_Atalla_RSAPrivateKeyOpFn = NULL;
+        p_Atalla_GetPerformanceStatistics = NULL;
+        return 1;
+        }
+
+static int atalla_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+        {
+        int initialised = ((atalla_dso == NULL) ? 0 : 1);
+        switch(cmd)
+                {
+        case ATALLA_CMD_SO_PATH:
+                if(p == NULL)
+                        {
+                        ATALLAerr(ATALLA_F_ATALLA_CTRL,ERR_R_PASSED_NULL_PARAMETER);
+                        return 0;
+                        }
+                if(initialised)
+                        {
+                        ATALLAerr(ATALLA_F_ATALLA_CTRL,ATALLA_R_ALREADY_LOADED);
+                        return 0;
+                        }
+                return set_ATALLA_LIBNAME((const char *)p);
+        default:
+                break;
+                }
+        ATALLAerr(ATALLA_F_ATALLA_CTRL,ATALLA_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+        return 0;
+        }
+
+static int atalla_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                        const BIGNUM *m, BN_CTX *ctx)
+        {
+        /* I need somewhere to store temporary serialised values for
+         * use with the Atalla API calls. A neat cheat - I'll use
+         * BIGNUMs from the BN_CTX but access their arrays directly as
+         * byte arrays <grin>. This way I don't have to clean anything
+         * up. */
+        BIGNUM *modulus;
+        BIGNUM *exponent;
+        BIGNUM *argument;
+        BIGNUM *result;
+        RSAPrivateKey keydata;
+        int to_return, numbytes;
+
+        modulus = exponent = argument = result = NULL;
+        to_return = 0; /* expect failure */
+
+        if(!atalla_dso)
+                {
+                ATALLAerr(ATALLA_F_ATALLA_MOD_EXP,ATALLA_R_NOT_LOADED);
+                goto err;
+                }
+        /* Prepare the params */
+        BN_CTX_start(ctx);
+        modulus = BN_CTX_get(ctx);
+        exponent = BN_CTX_get(ctx);
+        argument = BN_CTX_get(ctx);
+        result = BN_CTX_get(ctx);
+        if (!result)
+                {
+                ATALLAerr(ATALLA_F_ATALLA_MOD_EXP,ATALLA_R_BN_CTX_FULL);
+                goto err;
+                }
+        if(!bn_wexpand(modulus, m->top) || !bn_wexpand(exponent, m->top) ||
+           !bn_wexpand(argument, m->top) || !bn_wexpand(result, m->top))
+                {
+                ATALLAerr(ATALLA_F_ATALLA_MOD_EXP,ATALLA_R_BN_EXPAND_FAIL);
+                goto err;
+                }
+        /* Prepare the key-data */
+        memset(&keydata, 0,sizeof keydata);
+        numbytes = BN_num_bytes(m);
+        memset(exponent->d, 0, numbytes);
+        memset(modulus->d, 0, numbytes);
+        BN_bn2bin(p, (unsigned char *)exponent->d + numbytes - BN_num_bytes(p));
+        BN_bn2bin(m, (unsigned char *)modulus->d + numbytes - BN_num_bytes(m));
+        keydata.privateExponent.data = (unsigned char *)exponent->d;
+        keydata.privateExponent.len = numbytes;
+        keydata.modulus.data = (unsigned char *)modulus->d;
+        keydata.modulus.len = numbytes;
+        /* Prepare the argument */
+        memset(argument->d, 0, numbytes);
+        memset(result->d, 0, numbytes);
+        BN_bn2bin(a, (unsigned char *)argument->d + numbytes - BN_num_bytes(a));
+        /* Perform the operation */
+        if(p_Atalla_RSAPrivateKeyOpFn(&keydata, (unsigned char *)result->d,
+                        (unsigned char *)argument->d,
+                        keydata.modulus.len) != 0)
+                {
+                ATALLAerr(ATALLA_F_ATALLA_MOD_EXP,ATALLA_R_REQUEST_FAILED);
+                goto err;
+                }
+        /* Convert the response */
+        BN_bin2bn((unsigned char *)result->d, numbytes, r);
+        to_return = 1;
+err:
+        BN_CTX_end(ctx);
+        return to_return;
+        }
+
+#ifndef OPENSSL_NO_RSA
+static int atalla_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
+        {
+        int to_return = 0;
+
+        if(!atalla_dso)
+                {
+                ATALLAerr(ATALLA_F_ATALLA_RSA_MOD_EXP,ATALLA_R_NOT_LOADED);
+                goto err;
+                }
+        if(!rsa->d || !rsa->n)
+                {
+                ATALLAerr(ATALLA_F_ATALLA_RSA_MOD_EXP,ATALLA_R_MISSING_KEY_COMPONENTS);
+                goto err;
+                }
+        to_return = atalla_mod_exp(r0, I, rsa->d, rsa->n, ctx);
+err:
+        return to_return;
+        }
+#endif
+
+#ifndef OPENSSL_NO_DSA
+/* This code was liberated and adapted from the commented-out code in
+ * dsa_ossl.c. Because of the unoptimised form of the Atalla acceleration
+ * (it doesn't have a CRT form for RSA), this function means that an
+ * Atalla system running with a DSA server certificate can handshake
+ * around 5 or 6 times faster/more than an equivalent system running with
+ * RSA. Just check out the "signs" statistics from the RSA and DSA parts
+ * of "openssl speed -engine atalla dsa1024 rsa1024". */
+static int atalla_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+                BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+                BN_CTX *ctx, BN_MONT_CTX *in_mont)
+        {
+        BIGNUM t;
+        int to_return = 0;
+ 
+        BN_init(&t);
+        /* let rr = a1 ^ p1 mod m */
+        if (!atalla_mod_exp(rr,a1,p1,m,ctx)) goto end;
+        /* let t = a2 ^ p2 mod m */
+        if (!atalla_mod_exp(&t,a2,p2,m,ctx)) goto end;
+        /* let rr = rr * t mod m */
+        if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
+        to_return = 1;
+end:
+        BN_free(&t);
+        return to_return;
+        }
+
+static int atalla_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *m_ctx)
+        {
+        return atalla_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+#ifndef OPENSSL_NO_RSA
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int atalla_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        return atalla_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* This function is aliased to mod_exp (with the dh and mont dropped). */
+static int atalla_mod_exp_dh(const DH *dh, BIGNUM *r,
+                const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        return atalla_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library. */
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE
+static int bind_fn(ENGINE *e, const char *id)
+        {
+        if(id && (strcmp(id, engine_atalla_id) != 0))
+                return 0;
+        if(!bind_helper(e))
+                return 0;
+        return 1;
+        }
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
+#endif /* OPENSSL_NO_DYNAMIC_ENGINE */
+
+#endif /* !OPENSSL_NO_HW_ATALLA */
+#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libssl/src/engines/e_atalla.ec b/src/lib/libssl/src/engines/e_atalla.ec
new file mode 100644
index 0000000000..1d735e1b20
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_atalla.ec
@@ -0,0 +1 @@
+L ATALLA        e_atalla_err.h                  e_atalla_err.c
diff --git a/src/lib/libssl/src/engines/e_atalla_err.c b/src/lib/libssl/src/engines/e_atalla_err.c
new file mode 100644
index 0000000000..fd3e0049ce
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_atalla_err.c
@@ -0,0 +1,149 @@
+/* e_atalla_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "e_atalla_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(0,func,0)
+#define ERR_REASON(reason) ERR_PACK(0,0,reason)
+
+static ERR_STRING_DATA ATALLA_str_functs[]=
+        {
+{ERR_FUNC(ATALLA_F_ATALLA_CTRL),        "ATALLA_CTRL"},
+{ERR_FUNC(ATALLA_F_ATALLA_FINISH),      "ATALLA_FINISH"},
+{ERR_FUNC(ATALLA_F_ATALLA_INIT),        "ATALLA_INIT"},
+{ERR_FUNC(ATALLA_F_ATALLA_MOD_EXP),     "ATALLA_MOD_EXP"},
+{ERR_FUNC(ATALLA_F_ATALLA_RSA_MOD_EXP), "ATALLA_RSA_MOD_EXP"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA ATALLA_str_reasons[]=
+        {
+{ERR_REASON(ATALLA_R_ALREADY_LOADED)     ,"already loaded"},
+{ERR_REASON(ATALLA_R_BN_CTX_FULL)        ,"bn ctx full"},
+{ERR_REASON(ATALLA_R_BN_EXPAND_FAIL)     ,"bn expand fail"},
+{ERR_REASON(ATALLA_R_CTRL_COMMAND_NOT_IMPLEMENTED),"ctrl command not implemented"},
+{ERR_REASON(ATALLA_R_MISSING_KEY_COMPONENTS),"missing key components"},
+{ERR_REASON(ATALLA_R_NOT_LOADED)         ,"not loaded"},
+{ERR_REASON(ATALLA_R_REQUEST_FAILED)     ,"request failed"},
+{ERR_REASON(ATALLA_R_UNIT_FAILURE)       ,"unit failure"},
+{0,NULL}
+        };
+
+#endif
+
+#ifdef ATALLA_LIB_NAME
+static ERR_STRING_DATA ATALLA_lib_name[]=
+        {
+{0      ,ATALLA_LIB_NAME},
+{0,NULL}
+        };
+#endif
+
+
+static int ATALLA_lib_error_code=0;
+static int ATALLA_error_init=1;
+
+static void ERR_load_ATALLA_strings(void)
+        {
+        if (ATALLA_lib_error_code == 0)
+                ATALLA_lib_error_code=ERR_get_next_error_library();
+
+        if (ATALLA_error_init)
+                {
+                ATALLA_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(ATALLA_lib_error_code,ATALLA_str_functs);
+                ERR_load_strings(ATALLA_lib_error_code,ATALLA_str_reasons);
+#endif
+
+#ifdef ATALLA_LIB_NAME
+                ATALLA_lib_name->error = ERR_PACK(ATALLA_lib_error_code,0,0);
+                ERR_load_strings(0,ATALLA_lib_name);
+#endif
+                }
+        }
+
+static void ERR_unload_ATALLA_strings(void)
+        {
+        if (ATALLA_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(ATALLA_lib_error_code,ATALLA_str_functs);
+                ERR_unload_strings(ATALLA_lib_error_code,ATALLA_str_reasons);
+#endif
+
+#ifdef ATALLA_LIB_NAME
+                ERR_unload_strings(0,ATALLA_lib_name);
+#endif
+                ATALLA_error_init=1;
+                }
+        }
+
+static void ERR_ATALLA_error(int function, int reason, char *file, int line)
+        {
+        if (ATALLA_lib_error_code == 0)
+                ATALLA_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(ATALLA_lib_error_code,function,reason,file,line);
+        }
diff --git a/src/lib/libssl/src/engines/e_atalla_err.h b/src/lib/libssl/src/engines/e_atalla_err.h
new file mode 100644
index 0000000000..36e09bf42f
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_atalla_err.h
@@ -0,0 +1,93 @@
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_ATALLA_ERR_H
+#define HEADER_ATALLA_ERR_H
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_ATALLA_strings(void);
+static void ERR_unload_ATALLA_strings(void);
+static void ERR_ATALLA_error(int function, int reason, char *file, int line);
+#define ATALLAerr(f,r) ERR_ATALLA_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the ATALLA functions. */
+
+/* Function codes. */
+#define ATALLA_F_ATALLA_CTRL                             100
+#define ATALLA_F_ATALLA_FINISH                           101
+#define ATALLA_F_ATALLA_INIT                             102
+#define ATALLA_F_ATALLA_MOD_EXP                          103
+#define ATALLA_F_ATALLA_RSA_MOD_EXP                      104
+
+/* Reason codes. */
+#define ATALLA_R_ALREADY_LOADED                          100
+#define ATALLA_R_BN_CTX_FULL                             101
+#define ATALLA_R_BN_EXPAND_FAIL                          102
+#define ATALLA_R_CTRL_COMMAND_NOT_IMPLEMENTED            103
+#define ATALLA_R_MISSING_KEY_COMPONENTS                  104
+#define ATALLA_R_NOT_LOADED                              105
+#define ATALLA_R_REQUEST_FAILED                          106
+#define ATALLA_R_UNIT_FAILURE                            107
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/engines/e_chil.c b/src/lib/libssl/src/engines/e_chil.c
new file mode 100644
index 0000000000..26108caa64
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_chil.c
@@ -0,0 +1,1374 @@
+/* crypto/engine/e_chil.c -*- mode: C; c-file-style: "eay" -*- */
+/* Written by Richard Levitte (richard@levitte.org), Geoff Thorpe
+ * (geoff@geoffthorpe.net) and Dr Stephen N Henson (shenson@bigfoot.com)
+ * for the OpenSSL project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/crypto.h>
+#include <openssl/pem.h>
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+#include <openssl/ui.h>
+#include <openssl/rand.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_CHIL
+
+/* Attribution notice: nCipher have said several times that it's OK for
+ * us to implement a general interface to their boxes, and recently declared
+ * their HWCryptoHook to be public, and therefore available for us to use.
+ * Thanks, nCipher.
+ *
+ * The hwcryptohook.h included here is from May 2000.
+ * [Richard Levitte]
+ */
+#ifdef FLAT_INC
+#include "hwcryptohook.h"
+#else
+#include "vendor_defns/hwcryptohook.h"
+#endif
+
+#define HWCRHK_LIB_NAME "CHIL engine"
+#include "e_chil_err.c"
+
+static int hwcrhk_destroy(ENGINE *e);
+static int hwcrhk_init(ENGINE *e);
+static int hwcrhk_finish(ENGINE *e);
+static int hwcrhk_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void)); 
+
+/* Functions to handle mutexes */
+static int hwcrhk_mutex_init(HWCryptoHook_Mutex*, HWCryptoHook_CallerContext*);
+static int hwcrhk_mutex_lock(HWCryptoHook_Mutex*);
+static void hwcrhk_mutex_unlock(HWCryptoHook_Mutex*);
+static void hwcrhk_mutex_destroy(HWCryptoHook_Mutex*);
+
+/* BIGNUM stuff */
+static int hwcrhk_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx);
+
+#ifndef OPENSSL_NO_RSA
+/* RSA stuff */
+static int hwcrhk_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
+#endif
+#ifndef OPENSSL_NO_RSA
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int hwcrhk_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* DH stuff */
+/* This function is alised to mod_exp (with the DH and mont dropped). */
+static int hwcrhk_mod_exp_dh(const DH *dh, BIGNUM *r,
+        const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#endif
+
+/* RAND stuff */
+static int hwcrhk_rand_bytes(unsigned char *buf, int num);
+static int hwcrhk_rand_status(void);
+
+/* KM stuff */
+static EVP_PKEY *hwcrhk_load_privkey(ENGINE *eng, const char *key_id,
+        UI_METHOD *ui_method, void *callback_data);
+static EVP_PKEY *hwcrhk_load_pubkey(ENGINE *eng, const char *key_id,
+        UI_METHOD *ui_method, void *callback_data);
+#ifndef OPENSSL_NO_RSA
+static void hwcrhk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
+        int ind,long argl, void *argp);
+#endif
+
+/* Interaction stuff */
+static int hwcrhk_insert_card(const char *prompt_info,
+        const char *wrong_info,
+        HWCryptoHook_PassphraseContext *ppctx,
+        HWCryptoHook_CallerContext *cactx);
+static int hwcrhk_get_pass(const char *prompt_info,
+        int *len_io, char *buf,
+        HWCryptoHook_PassphraseContext *ppctx,
+        HWCryptoHook_CallerContext *cactx);
+static void hwcrhk_log_message(void *logstr, const char *message);
+
+/* The definitions for control commands specific to this engine */
+#define HWCRHK_CMD_SO_PATH              ENGINE_CMD_BASE
+#define HWCRHK_CMD_FORK_CHECK           (ENGINE_CMD_BASE + 1)
+#define HWCRHK_CMD_THREAD_LOCKING       (ENGINE_CMD_BASE + 2)
+#define HWCRHK_CMD_SET_USER_INTERFACE   (ENGINE_CMD_BASE + 3)
+#define HWCRHK_CMD_SET_CALLBACK_DATA    (ENGINE_CMD_BASE + 4)
+static const ENGINE_CMD_DEFN hwcrhk_cmd_defns[] = {
+        {HWCRHK_CMD_SO_PATH,
+                "SO_PATH",
+                "Specifies the path to the 'hwcrhk' shared library",
+                ENGINE_CMD_FLAG_STRING},
+        {HWCRHK_CMD_FORK_CHECK,
+                "FORK_CHECK",
+                "Turns fork() checking on or off (boolean)",
+                ENGINE_CMD_FLAG_NUMERIC},
+        {HWCRHK_CMD_THREAD_LOCKING,
+                "THREAD_LOCKING",
+                "Turns thread-safe locking on or off (boolean)",
+                ENGINE_CMD_FLAG_NUMERIC},
+        {HWCRHK_CMD_SET_USER_INTERFACE,
+                "SET_USER_INTERFACE",
+                "Set the global user interface (internal)",
+                ENGINE_CMD_FLAG_INTERNAL},
+        {HWCRHK_CMD_SET_CALLBACK_DATA,
+                "SET_CALLBACK_DATA",
+                "Set the global user interface extra data (internal)",
+                ENGINE_CMD_FLAG_INTERNAL},
+        {0, NULL, NULL, 0}
+        };
+
+#ifndef OPENSSL_NO_RSA
+/* Our internal RSA_METHOD that we provide pointers to */
+static RSA_METHOD hwcrhk_rsa =
+        {
+        "CHIL RSA method",
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        hwcrhk_rsa_mod_exp,
+        hwcrhk_mod_exp_mont,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL,
+        NULL,
+        NULL
+        };
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* Our internal DH_METHOD that we provide pointers to */
+static DH_METHOD hwcrhk_dh =
+        {
+        "CHIL DH method",
+        NULL,
+        NULL,
+        hwcrhk_mod_exp_dh,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL
+        };
+#endif
+
+static RAND_METHOD hwcrhk_rand =
+        {
+        /* "CHIL RAND method", */
+        NULL,
+        hwcrhk_rand_bytes,
+        NULL,
+        NULL,
+        hwcrhk_rand_bytes,
+        hwcrhk_rand_status,
+        };
+
+/* Constants used when creating the ENGINE */
+static const char *engine_hwcrhk_id = "chil";
+static const char *engine_hwcrhk_name = "CHIL hardware engine support";
+
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE 
+/* Compatibility hack, the dynamic library uses this form in the path */
+static const char *engine_hwcrhk_id_alt = "ncipher";
+#endif
+
+/* Internal stuff for HWCryptoHook */
+
+/* Some structures needed for proper use of thread locks */
+/* hwcryptohook.h has some typedefs that turn struct HWCryptoHook_MutexValue
+   into HWCryptoHook_Mutex */
+struct HWCryptoHook_MutexValue
+        {
+        int lockid;
+        };
+
+/* hwcryptohook.h has some typedefs that turn
+   struct HWCryptoHook_PassphraseContextValue
+   into HWCryptoHook_PassphraseContext */
+struct HWCryptoHook_PassphraseContextValue
+        {
+        UI_METHOD *ui_method;
+        void *callback_data;
+        };
+
+/* hwcryptohook.h has some typedefs that turn
+   struct HWCryptoHook_CallerContextValue
+   into HWCryptoHook_CallerContext */
+struct HWCryptoHook_CallerContextValue
+        {
+        pem_password_cb *password_callback; /* Deprecated!  Only present for
+                                               backward compatibility! */
+        UI_METHOD *ui_method;
+        void *callback_data;
+        };
+
+/* The MPI structure in HWCryptoHook is pretty compatible with OpenSSL
+   BIGNUM's, so lets define a couple of conversion macros */
+#define BN2MPI(mp, bn) \
+    {mp.size = bn->top * sizeof(BN_ULONG); mp.buf = (unsigned char *)bn->d;}
+#define MPI2BN(bn, mp) \
+    {mp.size = bn->dmax * sizeof(BN_ULONG); mp.buf = (unsigned char *)bn->d;}
+
+static BIO *logstream = NULL;
+static int disable_mutex_callbacks = 0;
+
+/* One might wonder why these are needed, since one can pass down at least
+   a UI_METHOD and a pointer to callback data to the key-loading functions.
+   The thing is that the ModExp and RSAImmed functions can load keys as well,
+   if the data they get is in a special, nCipher-defined format (hint: if you
+   look at the private exponent of the RSA data as a string, you'll see this
+   string: "nCipher KM tool key id", followed by some bytes, followed a key
+   identity string, followed by more bytes.  This happens when you use "embed"
+   keys instead of "hwcrhk" keys).  Unfortunately, those functions do not take
+   any passphrase or caller context, and our functions can't really take any
+   callback data either.  Still, the "insert_card" and "get_passphrase"
+   callbacks may be called down the line, and will need to know what user
+   interface callbacks to call, and having callback data from the application
+   may be a nice thing as well, so we need to keep track of that globally. */
+static HWCryptoHook_CallerContext password_context = { NULL, NULL, NULL };
+
+/* Stuff to pass to the HWCryptoHook library */
+static HWCryptoHook_InitInfo hwcrhk_globals = {
+        HWCryptoHook_InitFlags_SimpleForkCheck, /* Flags */
+        &logstream,             /* logstream */
+        sizeof(BN_ULONG),       /* limbsize */
+        0,                      /* mslimb first: false for BNs */
+        -1,                     /* msbyte first: use native */
+        0,                      /* Max mutexes, 0 = no small limit */
+        0,                      /* Max simultaneous, 0 = default */
+
+        /* The next few are mutex stuff: we write wrapper functions
+           around the OS mutex functions.  We initialise them to 0
+           here, and change that to actual function pointers in hwcrhk_init()
+           if dynamic locks are supported (that is, if the application
+           programmer has made sure of setting up callbacks bafore starting
+           this engine) *and* if disable_mutex_callbacks hasn't been set by
+           a call to ENGINE_ctrl(ENGINE_CTRL_CHIL_NO_LOCKING). */
+        sizeof(HWCryptoHook_Mutex),
+        0,
+        0,
+        0,
+        0,
+
+        /* The next few are condvar stuff: we write wrapper functions
+           round the OS functions.  Currently not implemented and not
+           and absolute necessity even in threaded programs, therefore
+           0'ed.  Will hopefully be implemented some day, since it
+           enhances the efficiency of HWCryptoHook.  */
+        0, /* sizeof(HWCryptoHook_CondVar), */
+        0, /* hwcrhk_cv_init, */
+        0, /* hwcrhk_cv_wait, */
+        0, /* hwcrhk_cv_signal, */
+        0, /* hwcrhk_cv_broadcast, */
+        0, /* hwcrhk_cv_destroy, */
+
+        hwcrhk_get_pass,        /* pass phrase */
+        hwcrhk_insert_card,     /* insert a card */
+        hwcrhk_log_message      /* Log message */
+};
+
+
+/* Now, to our own code */
+
+/* This internal function is used by ENGINE_chil() and possibly by the
+ * "dynamic" ENGINE support too */
+static int bind_helper(ENGINE *e)
+        {
+#ifndef OPENSSL_NO_RSA
+        const RSA_METHOD *meth1;
+#endif
+#ifndef OPENSSL_NO_DH
+        const DH_METHOD *meth2;
+#endif
+        if(!ENGINE_set_id(e, engine_hwcrhk_id) ||
+                        !ENGINE_set_name(e, engine_hwcrhk_name) ||
+#ifndef OPENSSL_NO_RSA
+                        !ENGINE_set_RSA(e, &hwcrhk_rsa) ||
+#endif
+#ifndef OPENSSL_NO_DH
+                        !ENGINE_set_DH(e, &hwcrhk_dh) ||
+#endif
+                        !ENGINE_set_RAND(e, &hwcrhk_rand) ||
+                        !ENGINE_set_destroy_function(e, hwcrhk_destroy) ||
+                        !ENGINE_set_init_function(e, hwcrhk_init) ||
+                        !ENGINE_set_finish_function(e, hwcrhk_finish) ||
+                        !ENGINE_set_ctrl_function(e, hwcrhk_ctrl) ||
+                        !ENGINE_set_load_privkey_function(e, hwcrhk_load_privkey) ||
+                        !ENGINE_set_load_pubkey_function(e, hwcrhk_load_pubkey) ||
+                        !ENGINE_set_cmd_defns(e, hwcrhk_cmd_defns))
+                return 0;
+
+#ifndef OPENSSL_NO_RSA
+        /* We know that the "PKCS1_SSLeay()" functions hook properly
+         * to the cswift-specific mod_exp and mod_exp_crt so we use
+         * those functions. NB: We don't use ENGINE_openssl() or
+         * anything "more generic" because something like the RSAref
+         * code may not hook properly, and if you own one of these
+         * cards then you have the right to do RSA operations on it
+         * anyway! */ 
+        meth1 = RSA_PKCS1_SSLeay();
+        hwcrhk_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
+        hwcrhk_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
+        hwcrhk_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
+        hwcrhk_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
+#endif
+
+#ifndef OPENSSL_NO_DH
+        /* Much the same for Diffie-Hellman */
+        meth2 = DH_OpenSSL();
+        hwcrhk_dh.generate_key = meth2->generate_key;
+        hwcrhk_dh.compute_key = meth2->compute_key;
+#endif
+
+        /* Ensure the hwcrhk error handling is set up */
+        ERR_load_HWCRHK_strings();
+        return 1;
+        }
+
+#ifdef OPENSSL_NO_DYNAMIC_ENGINE
+static ENGINE *engine_chil(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!bind_helper(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_chil(void)
+        {
+        /* Copied from eng_[openssl|dyn].c */
+        ENGINE *toadd = engine_chil();
+        if(!toadd) return;
+        ENGINE_add(toadd);
+        ENGINE_free(toadd);
+        ERR_clear_error();
+        }
+#endif
+
+/* This is a process-global DSO handle used for loading and unloading
+ * the HWCryptoHook library. NB: This is only set (or unset) during an
+ * init() or finish() call (reference counts permitting) and they're
+ * operating with global locks, so this should be thread-safe
+ * implicitly. */
+static DSO *hwcrhk_dso = NULL;
+static HWCryptoHook_ContextHandle hwcrhk_context = 0;
+#ifndef OPENSSL_NO_RSA
+static int hndidx_rsa = -1;    /* Index for KM handle.  Not really used yet. */
+#endif
+
+/* These are the function pointers that are (un)set when the library has
+ * successfully (un)loaded. */
+static HWCryptoHook_Init_t *p_hwcrhk_Init = NULL;
+static HWCryptoHook_Finish_t *p_hwcrhk_Finish = NULL;
+static HWCryptoHook_ModExp_t *p_hwcrhk_ModExp = NULL;
+#ifndef OPENSSL_NO_RSA
+static HWCryptoHook_RSA_t *p_hwcrhk_RSA = NULL;
+#endif
+static HWCryptoHook_RandomBytes_t *p_hwcrhk_RandomBytes = NULL;
+#ifndef OPENSSL_NO_RSA
+static HWCryptoHook_RSALoadKey_t *p_hwcrhk_RSALoadKey = NULL;
+static HWCryptoHook_RSAGetPublicKey_t *p_hwcrhk_RSAGetPublicKey = NULL;
+static HWCryptoHook_RSAUnloadKey_t *p_hwcrhk_RSAUnloadKey = NULL;
+#endif
+static HWCryptoHook_ModExpCRT_t *p_hwcrhk_ModExpCRT = NULL;
+
+/* Used in the DSO operations. */
+static const char *HWCRHK_LIBNAME = NULL;
+static void free_HWCRHK_LIBNAME(void)
+        {
+        if(HWCRHK_LIBNAME)
+                OPENSSL_free((void*)HWCRHK_LIBNAME);
+        HWCRHK_LIBNAME = NULL;
+        }
+static const char *get_HWCRHK_LIBNAME(void)
+        {
+        if(HWCRHK_LIBNAME)
+                return HWCRHK_LIBNAME;
+        return "nfhwcrhk";
+        }
+static long set_HWCRHK_LIBNAME(const char *name)
+        {
+        free_HWCRHK_LIBNAME();
+        return (((HWCRHK_LIBNAME = BUF_strdup(name)) != NULL) ? 1 : 0);
+        }
+static const char *n_hwcrhk_Init = "HWCryptoHook_Init";
+static const char *n_hwcrhk_Finish = "HWCryptoHook_Finish";
+static const char *n_hwcrhk_ModExp = "HWCryptoHook_ModExp";
+#ifndef OPENSSL_NO_RSA
+static const char *n_hwcrhk_RSA = "HWCryptoHook_RSA";
+#endif
+static const char *n_hwcrhk_RandomBytes = "HWCryptoHook_RandomBytes";
+#ifndef OPENSSL_NO_RSA
+static const char *n_hwcrhk_RSALoadKey = "HWCryptoHook_RSALoadKey";
+static const char *n_hwcrhk_RSAGetPublicKey = "HWCryptoHook_RSAGetPublicKey";
+static const char *n_hwcrhk_RSAUnloadKey = "HWCryptoHook_RSAUnloadKey";
+#endif
+static const char *n_hwcrhk_ModExpCRT = "HWCryptoHook_ModExpCRT";
+
+/* HWCryptoHook library functions and mechanics - these are used by the
+ * higher-level functions further down. NB: As and where there's no
+ * error checking, take a look lower down where these functions are
+ * called, the checking and error handling is probably down there. */
+
+/* utility function to obtain a context */
+static int get_context(HWCryptoHook_ContextHandle *hac,
+        HWCryptoHook_CallerContext *cac)
+        {
+        char tempbuf[1024];
+        HWCryptoHook_ErrMsgBuf rmsg;
+
+        rmsg.buf = tempbuf;
+        rmsg.size = sizeof(tempbuf);
+
+        *hac = p_hwcrhk_Init(&hwcrhk_globals, sizeof(hwcrhk_globals), &rmsg,
+                cac);
+        if (!*hac)
+                return 0;
+        return 1;
+        }
+ 
+/* similarly to release one. */
+static void release_context(HWCryptoHook_ContextHandle hac)
+        {
+        p_hwcrhk_Finish(hac);
+        }
+
+/* Destructor (complements the "ENGINE_chil()" constructor) */
+static int hwcrhk_destroy(ENGINE *e)
+        {
+        free_HWCRHK_LIBNAME();
+        ERR_unload_HWCRHK_strings();
+        return 1;
+        }
+
+/* (de)initialisation functions. */
+static int hwcrhk_init(ENGINE *e)
+        {
+        HWCryptoHook_Init_t *p1;
+        HWCryptoHook_Finish_t *p2;
+        HWCryptoHook_ModExp_t *p3;
+#ifndef OPENSSL_NO_RSA
+        HWCryptoHook_RSA_t *p4;
+        HWCryptoHook_RSALoadKey_t *p5;
+        HWCryptoHook_RSAGetPublicKey_t *p6;
+        HWCryptoHook_RSAUnloadKey_t *p7;
+#endif
+        HWCryptoHook_RandomBytes_t *p8;
+        HWCryptoHook_ModExpCRT_t *p9;
+
+        if(hwcrhk_dso != NULL)
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_INIT,HWCRHK_R_ALREADY_LOADED);
+                goto err;
+                }
+        /* Attempt to load libnfhwcrhk.so/nfhwcrhk.dll/whatever. */
+        hwcrhk_dso = DSO_load(NULL, get_HWCRHK_LIBNAME(), NULL, 0);
+        if(hwcrhk_dso == NULL)
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_INIT,HWCRHK_R_DSO_FAILURE);
+                goto err;
+                }
+        if(!(p1 = (HWCryptoHook_Init_t *)
+                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_Init)) ||
+                !(p2 = (HWCryptoHook_Finish_t *)
+                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_Finish)) ||
+                !(p3 = (HWCryptoHook_ModExp_t *)
+                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_ModExp)) ||
+#ifndef OPENSSL_NO_RSA
+                !(p4 = (HWCryptoHook_RSA_t *)
+                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_RSA)) ||
+                !(p5 = (HWCryptoHook_RSALoadKey_t *)
+                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_RSALoadKey)) ||
+                !(p6 = (HWCryptoHook_RSAGetPublicKey_t *)
+                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_RSAGetPublicKey)) ||
+                !(p7 = (HWCryptoHook_RSAUnloadKey_t *)
+                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_RSAUnloadKey)) ||
+#endif
+                !(p8 = (HWCryptoHook_RandomBytes_t *)
+                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_RandomBytes)) ||
+                !(p9 = (HWCryptoHook_ModExpCRT_t *)
+                        DSO_bind_func(hwcrhk_dso, n_hwcrhk_ModExpCRT)))
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_INIT,HWCRHK_R_DSO_FAILURE);
+                goto err;
+                }
+        /* Copy the pointers */
+        p_hwcrhk_Init = p1;
+        p_hwcrhk_Finish = p2;
+        p_hwcrhk_ModExp = p3;
+#ifndef OPENSSL_NO_RSA
+        p_hwcrhk_RSA = p4;
+        p_hwcrhk_RSALoadKey = p5;
+        p_hwcrhk_RSAGetPublicKey = p6;
+        p_hwcrhk_RSAUnloadKey = p7;
+#endif
+        p_hwcrhk_RandomBytes = p8;
+        p_hwcrhk_ModExpCRT = p9;
+
+        /* Check if the application decided to support dynamic locks,
+           and if it does, use them. */
+        if (disable_mutex_callbacks == 0)
+                {
+                if (CRYPTO_get_dynlock_create_callback() != NULL &&
+                        CRYPTO_get_dynlock_lock_callback() != NULL &&
+                        CRYPTO_get_dynlock_destroy_callback() != NULL)
+                        {
+                        hwcrhk_globals.mutex_init = hwcrhk_mutex_init;
+                        hwcrhk_globals.mutex_acquire = hwcrhk_mutex_lock;
+                        hwcrhk_globals.mutex_release = hwcrhk_mutex_unlock;
+                        hwcrhk_globals.mutex_destroy = hwcrhk_mutex_destroy;
+                        }
+                else if (CRYPTO_get_locking_callback() != NULL)
+                        {
+                        HWCRHKerr(HWCRHK_F_HWCRHK_INIT,HWCRHK_R_LOCKING_MISSING);
+                        ERR_add_error_data(1,"You HAVE to add dynamic locking callbacks via CRYPTO_set_dynlock_{create,lock,destroy}_callback()");
+                        goto err;
+                        }
+                }
+
+        /* Try and get a context - if not, we may have a DSO but no
+         * accelerator! */
+        if(!get_context(&hwcrhk_context, &password_context))
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_INIT,HWCRHK_R_UNIT_FAILURE);
+                goto err;
+                }
+        /* Everything's fine. */
+#ifndef OPENSSL_NO_RSA
+        if (hndidx_rsa == -1)
+                hndidx_rsa = RSA_get_ex_new_index(0,
+                        "nFast HWCryptoHook RSA key handle",
+                        NULL, NULL, hwcrhk_ex_free);
+#endif
+        return 1;
+err:
+        if(hwcrhk_dso)
+                DSO_free(hwcrhk_dso);
+        hwcrhk_dso = NULL;
+        p_hwcrhk_Init = NULL;
+        p_hwcrhk_Finish = NULL;
+        p_hwcrhk_ModExp = NULL;
+#ifndef OPENSSL_NO_RSA
+        p_hwcrhk_RSA = NULL;
+        p_hwcrhk_RSALoadKey = NULL;
+        p_hwcrhk_RSAGetPublicKey = NULL;
+        p_hwcrhk_RSAUnloadKey = NULL;
+#endif
+        p_hwcrhk_ModExpCRT = NULL;
+        p_hwcrhk_RandomBytes = NULL;
+        return 0;
+        }
+
+static int hwcrhk_finish(ENGINE *e)
+        {
+        int to_return = 1;
+        free_HWCRHK_LIBNAME();
+        if(hwcrhk_dso == NULL)
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_FINISH,HWCRHK_R_NOT_LOADED);
+                to_return = 0;
+                goto err;
+                }
+        release_context(hwcrhk_context);
+        if(!DSO_free(hwcrhk_dso))
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_FINISH,HWCRHK_R_DSO_FAILURE);
+                to_return = 0;
+                goto err;
+                }
+ err:
+        if (logstream)
+                BIO_free(logstream);
+        hwcrhk_dso = NULL;
+        p_hwcrhk_Init = NULL;
+        p_hwcrhk_Finish = NULL;
+        p_hwcrhk_ModExp = NULL;
+#ifndef OPENSSL_NO_RSA
+        p_hwcrhk_RSA = NULL;
+        p_hwcrhk_RSALoadKey = NULL;
+        p_hwcrhk_RSAGetPublicKey = NULL;
+        p_hwcrhk_RSAUnloadKey = NULL;
+#endif
+        p_hwcrhk_ModExpCRT = NULL;
+        p_hwcrhk_RandomBytes = NULL;
+        return to_return;
+        }
+
+static int hwcrhk_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+        {
+        int to_return = 1;
+
+        switch(cmd)
+                {
+        case HWCRHK_CMD_SO_PATH:
+                if(hwcrhk_dso)
+                        {
+                        HWCRHKerr(HWCRHK_F_HWCRHK_CTRL,HWCRHK_R_ALREADY_LOADED);
+                        return 0;
+                        }
+                if(p == NULL)
+                        {
+                        HWCRHKerr(HWCRHK_F_HWCRHK_CTRL,ERR_R_PASSED_NULL_PARAMETER);
+                        return 0;
+                        }
+                return set_HWCRHK_LIBNAME((const char *)p);
+        case ENGINE_CTRL_SET_LOGSTREAM:
+                {
+                BIO *bio = (BIO *)p;
+
+                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+                if (logstream)
+                        {
+                        BIO_free(logstream);
+                        logstream = NULL;
+                        }
+                if (CRYPTO_add(&bio->references,1,CRYPTO_LOCK_BIO) > 1)
+                        logstream = bio;
+                else
+                        HWCRHKerr(HWCRHK_F_HWCRHK_CTRL,HWCRHK_R_BIO_WAS_FREED);
+                }
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                break;
+        case ENGINE_CTRL_SET_PASSWORD_CALLBACK:
+                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+                password_context.password_callback = (pem_password_cb *)f;
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                break;
+        case ENGINE_CTRL_SET_USER_INTERFACE:
+        case HWCRHK_CMD_SET_USER_INTERFACE:
+                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+                password_context.ui_method = (UI_METHOD *)p;
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                break;
+        case ENGINE_CTRL_SET_CALLBACK_DATA:
+        case HWCRHK_CMD_SET_CALLBACK_DATA:
+                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+                password_context.callback_data = p;
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                break;
+        /* this enables or disables the "SimpleForkCheck" flag used in the
+         * initialisation structure. */
+        case ENGINE_CTRL_CHIL_SET_FORKCHECK:
+        case HWCRHK_CMD_FORK_CHECK:
+                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+                if(i)
+                        hwcrhk_globals.flags |=
+                                HWCryptoHook_InitFlags_SimpleForkCheck;
+                else
+                        hwcrhk_globals.flags &=
+                                ~HWCryptoHook_InitFlags_SimpleForkCheck;
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                break;
+        /* This will prevent the initialisation function from "installing"
+         * the mutex-handling callbacks, even if they are available from
+         * within the library (or were provided to the library from the
+         * calling application). This is to remove any baggage for
+         * applications not using multithreading. */
+        case ENGINE_CTRL_CHIL_NO_LOCKING:
+                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+                disable_mutex_callbacks = 1;
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                break;
+        case HWCRHK_CMD_THREAD_LOCKING:
+                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+                disable_mutex_callbacks = ((i == 0) ? 0 : 1);
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                break;
+
+        /* The command isn't understood by this engine */
+        default:
+                HWCRHKerr(HWCRHK_F_HWCRHK_CTRL,
+                        HWCRHK_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+                to_return = 0;
+                break;
+                }
+
+        return to_return;
+        }
+
+static EVP_PKEY *hwcrhk_load_privkey(ENGINE *eng, const char *key_id,
+        UI_METHOD *ui_method, void *callback_data)
+        {
+#ifndef OPENSSL_NO_RSA
+        RSA *rtmp = NULL;
+#endif
+        EVP_PKEY *res = NULL;
+#ifndef OPENSSL_NO_RSA
+        HWCryptoHook_MPI e, n;
+        HWCryptoHook_RSAKeyHandle *hptr;
+#endif
+#if !defined(OPENSSL_NO_RSA)
+        char tempbuf[1024];
+        HWCryptoHook_ErrMsgBuf rmsg;
+        HWCryptoHook_PassphraseContext ppctx;
+#endif
+
+#if !defined(OPENSSL_NO_RSA)
+        rmsg.buf = tempbuf;
+        rmsg.size = sizeof(tempbuf);
+#endif
+
+        if(!hwcrhk_context)
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
+                        HWCRHK_R_NOT_INITIALISED);
+                goto err;
+                }
+#ifndef OPENSSL_NO_RSA
+        hptr = OPENSSL_malloc(sizeof(HWCryptoHook_RSAKeyHandle));
+        if (!hptr)
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
+                        ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+        ppctx.ui_method = ui_method;
+        ppctx.callback_data = callback_data;
+        if (p_hwcrhk_RSALoadKey(hwcrhk_context, key_id, hptr,
+                &rmsg, &ppctx))
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
+                        HWCRHK_R_CHIL_ERROR);
+                ERR_add_error_data(1,rmsg.buf);
+                goto err;
+                }
+        if (!*hptr)
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
+                        HWCRHK_R_NO_KEY);
+                goto err;
+                }
+#endif
+#ifndef OPENSSL_NO_RSA
+        rtmp = RSA_new_method(eng);
+        RSA_set_ex_data(rtmp, hndidx_rsa, (char *)hptr);
+        rtmp->e = BN_new();
+        rtmp->n = BN_new();
+        rtmp->flags |= RSA_FLAG_EXT_PKEY;
+        MPI2BN(rtmp->e, e);
+        MPI2BN(rtmp->n, n);
+        if (p_hwcrhk_RSAGetPublicKey(*hptr, &n, &e, &rmsg)
+                != HWCRYPTOHOOK_ERROR_MPISIZE)
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,HWCRHK_R_CHIL_ERROR);
+                ERR_add_error_data(1,rmsg.buf);
+                goto err;
+                }
+
+        bn_expand2(rtmp->e, e.size/sizeof(BN_ULONG));
+        bn_expand2(rtmp->n, n.size/sizeof(BN_ULONG));
+        MPI2BN(rtmp->e, e);
+        MPI2BN(rtmp->n, n);
+
+        if (p_hwcrhk_RSAGetPublicKey(*hptr, &n, &e, &rmsg))
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
+                        HWCRHK_R_CHIL_ERROR);
+                ERR_add_error_data(1,rmsg.buf);
+                goto err;
+                }
+        rtmp->e->top = e.size / sizeof(BN_ULONG);
+        bn_fix_top(rtmp->e);
+        rtmp->n->top = n.size / sizeof(BN_ULONG);
+        bn_fix_top(rtmp->n);
+
+        res = EVP_PKEY_new();
+        EVP_PKEY_assign_RSA(res, rtmp);
+#endif
+
+        if (!res)
+                HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
+                        HWCRHK_R_PRIVATE_KEY_ALGORITHMS_DISABLED);
+
+        return res;
+ err:
+        if (res)
+                EVP_PKEY_free(res);
+#ifndef OPENSSL_NO_RSA
+        if (rtmp)
+                RSA_free(rtmp);
+#endif
+        return NULL;
+        }
+
+static EVP_PKEY *hwcrhk_load_pubkey(ENGINE *eng, const char *key_id,
+        UI_METHOD *ui_method, void *callback_data)
+        {
+        EVP_PKEY *res = NULL;
+
+#ifndef OPENSSL_NO_RSA
+        res = hwcrhk_load_privkey(eng, key_id,
+                ui_method, callback_data);
+#endif
+
+        if (res)
+                switch(res->type)
+                        {
+#ifndef OPENSSL_NO_RSA
+                case EVP_PKEY_RSA:
+                        {
+                        RSA *rsa = NULL;
+
+                        CRYPTO_w_lock(CRYPTO_LOCK_EVP_PKEY);
+                        rsa = res->pkey.rsa;
+                        res->pkey.rsa = RSA_new();
+                        res->pkey.rsa->n = rsa->n;
+                        res->pkey.rsa->e = rsa->e;
+                        rsa->n = NULL;
+                        rsa->e = NULL;
+                        CRYPTO_w_unlock(CRYPTO_LOCK_EVP_PKEY);
+                        RSA_free(rsa);
+                        }
+                        break;
+#endif
+                default:
+                        HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PUBKEY,
+                                HWCRHK_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+                        goto err;
+                        }
+
+        return res;
+ err:
+        if (res)
+                EVP_PKEY_free(res);
+        return NULL;
+        }
+
+/* A little mod_exp */
+static int hwcrhk_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                        const BIGNUM *m, BN_CTX *ctx)
+        {
+        char tempbuf[1024];
+        HWCryptoHook_ErrMsgBuf rmsg;
+        /* Since HWCryptoHook_MPI is pretty compatible with BIGNUM's,
+           we use them directly, plus a little macro magic.  We only
+           thing we need to make sure of is that enough space is allocated. */
+        HWCryptoHook_MPI m_a, m_p, m_n, m_r;
+        int to_return, ret;
+ 
+        to_return = 0; /* expect failure */
+        rmsg.buf = tempbuf;
+        rmsg.size = sizeof(tempbuf);
+
+        if(!hwcrhk_context)
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_MOD_EXP,HWCRHK_R_NOT_INITIALISED);
+                goto err;
+                }
+        /* Prepare the params */
+        bn_expand2(r, m->top);  /* Check for error !! */
+        BN2MPI(m_a, a);
+        BN2MPI(m_p, p);
+        BN2MPI(m_n, m);
+        MPI2BN(r, m_r);
+
+        /* Perform the operation */
+        ret = p_hwcrhk_ModExp(hwcrhk_context, m_a, m_p, m_n, &m_r, &rmsg);
+
+        /* Convert the response */
+        r->top = m_r.size / sizeof(BN_ULONG);
+        bn_fix_top(r);
+
+        if (ret < 0)
+                {
+                /* FIXME: When this error is returned, HWCryptoHook is
+                   telling us that falling back to software computation
+                   might be a good thing. */
+                if(ret == HWCRYPTOHOOK_ERROR_FALLBACK)
+                        {
+                        HWCRHKerr(HWCRHK_F_HWCRHK_MOD_EXP,HWCRHK_R_REQUEST_FALLBACK);
+                        }
+                else
+                        {
+                        HWCRHKerr(HWCRHK_F_HWCRHK_MOD_EXP,HWCRHK_R_REQUEST_FAILED);
+                        }
+                ERR_add_error_data(1,rmsg.buf);
+                goto err;
+                }
+
+        to_return = 1;
+err:
+        return to_return;
+        }
+
+#ifndef OPENSSL_NO_RSA 
+static int hwcrhk_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
+        {
+        char tempbuf[1024];
+        HWCryptoHook_ErrMsgBuf rmsg;
+        HWCryptoHook_RSAKeyHandle *hptr;
+        int to_return = 0, ret;
+
+        rmsg.buf = tempbuf;
+        rmsg.size = sizeof(tempbuf);
+
+        if(!hwcrhk_context)
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,HWCRHK_R_NOT_INITIALISED);
+                goto err;
+                }
+
+        /* This provides support for nForce keys.  Since that's opaque data
+           all we do is provide a handle to the proper key and let HWCryptoHook
+           take care of the rest. */
+        if ((hptr = (HWCryptoHook_RSAKeyHandle *) RSA_get_ex_data(rsa, hndidx_rsa))
+                != NULL)
+                {
+                HWCryptoHook_MPI m_a, m_r;
+
+                if(!rsa->n)
+                        {
+                        HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,
+                                HWCRHK_R_MISSING_KEY_COMPONENTS);
+                        goto err;
+                        }
+
+                /* Prepare the params */
+                bn_expand2(r, rsa->n->top); /* Check for error !! */
+                BN2MPI(m_a, I);
+                MPI2BN(r, m_r);
+
+                /* Perform the operation */
+                ret = p_hwcrhk_RSA(m_a, *hptr, &m_r, &rmsg);
+
+                /* Convert the response */
+                r->top = m_r.size / sizeof(BN_ULONG);
+                bn_fix_top(r);
+
+                if (ret < 0)
+                        {
+                        /* FIXME: When this error is returned, HWCryptoHook is
+                           telling us that falling back to software computation
+                           might be a good thing. */
+                        if(ret == HWCRYPTOHOOK_ERROR_FALLBACK)
+                                {
+                                HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,
+                                        HWCRHK_R_REQUEST_FALLBACK);
+                                }
+                        else
+                                {
+                                HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,
+                                        HWCRHK_R_REQUEST_FAILED);
+                                }
+                        ERR_add_error_data(1,rmsg.buf);
+                        goto err;
+                        }
+                }
+        else
+                {
+                HWCryptoHook_MPI m_a, m_p, m_q, m_dmp1, m_dmq1, m_iqmp, m_r;
+
+                if(!rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)
+                        {
+                        HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,
+                                HWCRHK_R_MISSING_KEY_COMPONENTS);
+                        goto err;
+                        }
+
+                /* Prepare the params */
+                bn_expand2(r, rsa->n->top); /* Check for error !! */
+                BN2MPI(m_a, I);
+                BN2MPI(m_p, rsa->p);
+                BN2MPI(m_q, rsa->q);
+                BN2MPI(m_dmp1, rsa->dmp1);
+                BN2MPI(m_dmq1, rsa->dmq1);
+                BN2MPI(m_iqmp, rsa->iqmp);
+                MPI2BN(r, m_r);
+
+                /* Perform the operation */
+                ret = p_hwcrhk_ModExpCRT(hwcrhk_context, m_a, m_p, m_q,
+                        m_dmp1, m_dmq1, m_iqmp, &m_r, &rmsg);
+
+                /* Convert the response */
+                r->top = m_r.size / sizeof(BN_ULONG);
+                bn_fix_top(r);
+
+                if (ret < 0)
+                        {
+                        /* FIXME: When this error is returned, HWCryptoHook is
+                           telling us that falling back to software computation
+                           might be a good thing. */
+                        if(ret == HWCRYPTOHOOK_ERROR_FALLBACK)
+                                {
+                                HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,
+                                        HWCRHK_R_REQUEST_FALLBACK);
+                                }
+                        else
+                                {
+                                HWCRHKerr(HWCRHK_F_HWCRHK_RSA_MOD_EXP,
+                                        HWCRHK_R_REQUEST_FAILED);
+                                }
+                        ERR_add_error_data(1,rmsg.buf);
+                        goto err;
+                        }
+                }
+        /* If we're here, we must be here with some semblance of success :-) */
+        to_return = 1;
+err:
+        return to_return;
+        }
+#endif
+
+#ifndef OPENSSL_NO_RSA
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int hwcrhk_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        return hwcrhk_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* This function is aliased to mod_exp (with the dh and mont dropped). */
+static int hwcrhk_mod_exp_dh(const DH *dh, BIGNUM *r,
+                const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        return hwcrhk_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+/* Random bytes are good */
+static int hwcrhk_rand_bytes(unsigned char *buf, int num)
+        {
+        char tempbuf[1024];
+        HWCryptoHook_ErrMsgBuf rmsg;
+        int to_return = 0; /* assume failure */
+        int ret;
+
+        rmsg.buf = tempbuf;
+        rmsg.size = sizeof(tempbuf);
+
+        if(!hwcrhk_context)
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_RAND_BYTES,HWCRHK_R_NOT_INITIALISED);
+                goto err;
+                }
+
+        ret = p_hwcrhk_RandomBytes(hwcrhk_context, buf, num, &rmsg);
+        if (ret < 0)
+                {
+                /* FIXME: When this error is returned, HWCryptoHook is
+                   telling us that falling back to software computation
+                   might be a good thing. */
+                if(ret == HWCRYPTOHOOK_ERROR_FALLBACK)
+                        {
+                        HWCRHKerr(HWCRHK_F_HWCRHK_RAND_BYTES,
+                                HWCRHK_R_REQUEST_FALLBACK);
+                        }
+                else
+                        {
+                        HWCRHKerr(HWCRHK_F_HWCRHK_RAND_BYTES,
+                                HWCRHK_R_REQUEST_FAILED);
+                        }
+                ERR_add_error_data(1,rmsg.buf);
+                goto err;
+                }
+        to_return = 1;
+ err:
+        return to_return;
+        }
+
+static int hwcrhk_rand_status(void)
+        {
+        return 1;
+        }
+
+/* This cleans up an RSA KM key, called when ex_data is freed */
+#ifndef OPENSSL_NO_RSA
+static void hwcrhk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
+        int ind,long argl, void *argp)
+{
+        char tempbuf[1024];
+        HWCryptoHook_ErrMsgBuf rmsg;
+#ifndef OPENSSL_NO_RSA
+        HWCryptoHook_RSAKeyHandle *hptr;
+#endif
+#if !defined(OPENSSL_NO_RSA)
+        int ret;
+#endif
+
+        rmsg.buf = tempbuf;
+        rmsg.size = sizeof(tempbuf);
+
+#ifndef OPENSSL_NO_RSA
+        hptr = (HWCryptoHook_RSAKeyHandle *) item;
+        if(hptr)
+                {
+                ret = p_hwcrhk_RSAUnloadKey(*hptr, NULL);
+                OPENSSL_free(hptr);
+                }
+#endif
+}
+#endif
+
+/* Mutex calls: since the HWCryptoHook model closely follows the POSIX model
+ * these just wrap the POSIX functions and add some logging.
+ */
+
+static int hwcrhk_mutex_init(HWCryptoHook_Mutex* mt,
+        HWCryptoHook_CallerContext *cactx)
+        {
+        mt->lockid = CRYPTO_get_new_dynlockid();
+        if (mt->lockid == 0)
+                return 1; /* failure */
+        return 0; /* success */
+        }
+
+static int hwcrhk_mutex_lock(HWCryptoHook_Mutex *mt)
+        {
+        CRYPTO_w_lock(mt->lockid);
+        return 0;
+        }
+
+static void hwcrhk_mutex_unlock(HWCryptoHook_Mutex * mt)
+        {
+        CRYPTO_w_unlock(mt->lockid);
+        }
+
+static void hwcrhk_mutex_destroy(HWCryptoHook_Mutex *mt)
+        {
+        CRYPTO_destroy_dynlockid(mt->lockid);
+        }
+
+static int hwcrhk_get_pass(const char *prompt_info,
+        int *len_io, char *buf,
+        HWCryptoHook_PassphraseContext *ppctx,
+        HWCryptoHook_CallerContext *cactx)
+        {
+        pem_password_cb *callback = NULL;
+        void *callback_data = NULL;
+        UI_METHOD *ui_method = NULL;
+
+        if (cactx)
+                {
+                if (cactx->ui_method)
+                        ui_method = cactx->ui_method;
+                if (cactx->password_callback)
+                        callback = cactx->password_callback;
+                if (cactx->callback_data)
+                        callback_data = cactx->callback_data;
+                }
+        if (ppctx)
+                {
+                if (ppctx->ui_method)
+                        {
+                        ui_method = ppctx->ui_method;
+                        callback = NULL;
+                        }
+                if (ppctx->callback_data)
+                        callback_data = ppctx->callback_data;
+                }
+        if (callback == NULL && ui_method == NULL)
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_GET_PASS,HWCRHK_R_NO_CALLBACK);
+                return -1;
+                }
+
+        if (ui_method)
+                {
+                UI *ui = UI_new_method(ui_method);
+                if (ui)
+                        {
+                        int ok;
+                        char *prompt = UI_construct_prompt(ui,
+                                "pass phrase", prompt_info);
+
+                        ok = UI_add_input_string(ui,prompt,
+                                UI_INPUT_FLAG_DEFAULT_PWD,
+                                buf,0,(*len_io) - 1);
+                        UI_add_user_data(ui, callback_data);
+                        UI_ctrl(ui, UI_CTRL_PRINT_ERRORS, 1, 0, 0);
+
+                        if (ok >= 0)
+                                do
+                                        {
+                                        ok=UI_process(ui);
+                                        }
+                                while (ok < 0 && UI_ctrl(ui, UI_CTRL_IS_REDOABLE, 0, 0, 0));
+
+                        if (ok >= 0)
+                                *len_io = strlen(buf);
+
+                        UI_free(ui);
+                        OPENSSL_free(prompt);
+                        }
+                }
+        else
+                {
+                *len_io = callback(buf, *len_io, 0, callback_data);
+                }
+        if(!*len_io)
+                return -1;
+        return 0;
+        }
+
+static int hwcrhk_insert_card(const char *prompt_info,
+                      const char *wrong_info,
+                      HWCryptoHook_PassphraseContext *ppctx,
+                      HWCryptoHook_CallerContext *cactx)
+        {
+        int ok = -1;
+        UI *ui;
+        void *callback_data = NULL;
+        UI_METHOD *ui_method = NULL;
+
+        if (cactx)
+                {
+                if (cactx->ui_method)
+                        ui_method = cactx->ui_method;
+                if (cactx->callback_data)
+                        callback_data = cactx->callback_data;
+                }
+        if (ppctx)
+                {
+                if (ppctx->ui_method)
+                        ui_method = ppctx->ui_method;
+                if (ppctx->callback_data)
+                        callback_data = ppctx->callback_data;
+                }
+        if (ui_method == NULL)
+                {
+                HWCRHKerr(HWCRHK_F_HWCRHK_INSERT_CARD,
+                        HWCRHK_R_NO_CALLBACK);
+                return -1;
+                }
+
+        ui = UI_new_method(ui_method);
+
+        if (ui)
+                {
+                char answer;
+                char buf[BUFSIZ];
+
+                if (wrong_info)
+                        BIO_snprintf(buf, sizeof(buf)-1,
+                                "Current card: \"%s\"\n", wrong_info);
+                ok = UI_dup_info_string(ui, buf);
+                if (ok >= 0 && prompt_info)
+                        {
+                        BIO_snprintf(buf, sizeof(buf)-1,
+                                "Insert card \"%s\"", prompt_info);
+                        ok = UI_dup_input_boolean(ui, buf,
+                                "\n then hit <enter> or C<enter> to cancel\n",
+                                "\r\n", "Cc", UI_INPUT_FLAG_ECHO, &answer);
+                        }
+                UI_add_user_data(ui, callback_data);
+
+                if (ok >= 0)
+                        ok = UI_process(ui);
+                UI_free(ui);
+
+                if (ok == -2 || (ok >= 0 && answer == 'C'))
+                        ok = 1;
+                else if (ok < 0)
+                        ok = -1;
+                else
+                        ok = 0;
+                }
+        return ok;
+        }
+
+static void hwcrhk_log_message(void *logstr, const char *message)
+        {
+        BIO *lstream = NULL;
+
+        CRYPTO_w_lock(CRYPTO_LOCK_BIO);
+        if (logstr)
+                lstream=*(BIO **)logstr;
+        if (lstream)
+                {
+                BIO_printf(lstream, "%s\n", message);
+                }
+        CRYPTO_w_unlock(CRYPTO_LOCK_BIO);
+        }
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library. */      
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE
+static int bind_fn(ENGINE *e, const char *id)
+        {
+        if(id && (strcmp(id, engine_hwcrhk_id) != 0) &&
+                        (strcmp(id, engine_hwcrhk_id_alt) != 0))
+                return 0;
+        if(!bind_helper(e))
+                return 0;
+        return 1;
+        }       
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
+#endif /* OPENSSL_NO_DYNAMIC_ENGINE */
+
+#endif /* !OPENSSL_NO_HW_CHIL */
+#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libssl/src/engines/e_chil.ec b/src/lib/libssl/src/engines/e_chil.ec
new file mode 100644
index 0000000000..b5a76e17df
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_chil.ec
@@ -0,0 +1 @@
+L HWCRHK        e_chil_err.h                    e_chil_err.c
diff --git a/src/lib/libssl/src/engines/e_chil_err.c b/src/lib/libssl/src/engines/e_chil_err.c
new file mode 100644
index 0000000000..3fec95a272
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_chil_err.c
@@ -0,0 +1,161 @@
+/* e_chil_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "e_chil_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(0,func,0)
+#define ERR_REASON(reason) ERR_PACK(0,0,reason)
+
+static ERR_STRING_DATA HWCRHK_str_functs[]=
+        {
+{ERR_FUNC(HWCRHK_F_HWCRHK_CTRL),        "HWCRHK_CTRL"},
+{ERR_FUNC(HWCRHK_F_HWCRHK_FINISH),      "HWCRHK_FINISH"},
+{ERR_FUNC(HWCRHK_F_HWCRHK_GET_PASS),    "HWCRHK_GET_PASS"},
+{ERR_FUNC(HWCRHK_F_HWCRHK_INIT),        "HWCRHK_INIT"},
+{ERR_FUNC(HWCRHK_F_HWCRHK_INSERT_CARD), "HWCRHK_INSERT_CARD"},
+{ERR_FUNC(HWCRHK_F_HWCRHK_LOAD_PRIVKEY),        "HWCRHK_LOAD_PRIVKEY"},
+{ERR_FUNC(HWCRHK_F_HWCRHK_LOAD_PUBKEY), "HWCRHK_LOAD_PUBKEY"},
+{ERR_FUNC(HWCRHK_F_HWCRHK_MOD_EXP),     "HWCRHK_MOD_EXP"},
+{ERR_FUNC(HWCRHK_F_HWCRHK_RAND_BYTES),  "HWCRHK_RAND_BYTES"},
+{ERR_FUNC(HWCRHK_F_HWCRHK_RSA_MOD_EXP), "HWCRHK_RSA_MOD_EXP"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA HWCRHK_str_reasons[]=
+        {
+{ERR_REASON(HWCRHK_R_ALREADY_LOADED)     ,"already loaded"},
+{ERR_REASON(HWCRHK_R_BIO_WAS_FREED)      ,"bio was freed"},
+{ERR_REASON(HWCRHK_R_CHIL_ERROR)         ,"chil error"},
+{ERR_REASON(HWCRHK_R_CTRL_COMMAND_NOT_IMPLEMENTED),"ctrl command not implemented"},
+{ERR_REASON(HWCRHK_R_DSO_FAILURE)        ,"dso failure"},
+{ERR_REASON(HWCRHK_R_LOCKING_MISSING)    ,"locking missing"},
+{ERR_REASON(HWCRHK_R_MISSING_KEY_COMPONENTS),"missing key components"},
+{ERR_REASON(HWCRHK_R_NOT_INITIALISED)    ,"not initialised"},
+{ERR_REASON(HWCRHK_R_NOT_LOADED)         ,"not loaded"},
+{ERR_REASON(HWCRHK_R_NO_CALLBACK)        ,"no callback"},
+{ERR_REASON(HWCRHK_R_NO_KEY)             ,"no key"},
+{ERR_REASON(HWCRHK_R_PRIVATE_KEY_ALGORITHMS_DISABLED),"private key algorithms disabled"},
+{ERR_REASON(HWCRHK_R_REQUEST_FAILED)     ,"request failed"},
+{ERR_REASON(HWCRHK_R_REQUEST_FALLBACK)   ,"request fallback"},
+{ERR_REASON(HWCRHK_R_UNIT_FAILURE)       ,"unit failure"},
+{0,NULL}
+        };
+
+#endif
+
+#ifdef HWCRHK_LIB_NAME
+static ERR_STRING_DATA HWCRHK_lib_name[]=
+        {
+{0      ,HWCRHK_LIB_NAME},
+{0,NULL}
+        };
+#endif
+
+
+static int HWCRHK_lib_error_code=0;
+static int HWCRHK_error_init=1;
+
+static void ERR_load_HWCRHK_strings(void)
+        {
+        if (HWCRHK_lib_error_code == 0)
+                HWCRHK_lib_error_code=ERR_get_next_error_library();
+
+        if (HWCRHK_error_init)
+                {
+                HWCRHK_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(HWCRHK_lib_error_code,HWCRHK_str_functs);
+                ERR_load_strings(HWCRHK_lib_error_code,HWCRHK_str_reasons);
+#endif
+
+#ifdef HWCRHK_LIB_NAME
+                HWCRHK_lib_name->error = ERR_PACK(HWCRHK_lib_error_code,0,0);
+                ERR_load_strings(0,HWCRHK_lib_name);
+#endif
+                }
+        }
+
+static void ERR_unload_HWCRHK_strings(void)
+        {
+        if (HWCRHK_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(HWCRHK_lib_error_code,HWCRHK_str_functs);
+                ERR_unload_strings(HWCRHK_lib_error_code,HWCRHK_str_reasons);
+#endif
+
+#ifdef HWCRHK_LIB_NAME
+                ERR_unload_strings(0,HWCRHK_lib_name);
+#endif
+                HWCRHK_error_init=1;
+                }
+        }
+
+static void ERR_HWCRHK_error(int function, int reason, char *file, int line)
+        {
+        if (HWCRHK_lib_error_code == 0)
+                HWCRHK_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(HWCRHK_lib_error_code,function,reason,file,line);
+        }
diff --git a/src/lib/libssl/src/engines/e_chil_err.h b/src/lib/libssl/src/engines/e_chil_err.h
new file mode 100644
index 0000000000..051854950a
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_chil_err.h
@@ -0,0 +1,105 @@
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_HWCRHK_ERR_H
+#define HEADER_HWCRHK_ERR_H
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_HWCRHK_strings(void);
+static void ERR_unload_HWCRHK_strings(void);
+static void ERR_HWCRHK_error(int function, int reason, char *file, int line);
+#define HWCRHKerr(f,r) ERR_HWCRHK_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the HWCRHK functions. */
+
+/* Function codes. */
+#define HWCRHK_F_HWCRHK_CTRL                             100
+#define HWCRHK_F_HWCRHK_FINISH                           101
+#define HWCRHK_F_HWCRHK_GET_PASS                         102
+#define HWCRHK_F_HWCRHK_INIT                             103
+#define HWCRHK_F_HWCRHK_INSERT_CARD                      104
+#define HWCRHK_F_HWCRHK_LOAD_PRIVKEY                     105
+#define HWCRHK_F_HWCRHK_LOAD_PUBKEY                      106
+#define HWCRHK_F_HWCRHK_MOD_EXP                          107
+#define HWCRHK_F_HWCRHK_RAND_BYTES                       108
+#define HWCRHK_F_HWCRHK_RSA_MOD_EXP                      109
+
+/* Reason codes. */
+#define HWCRHK_R_ALREADY_LOADED                          100
+#define HWCRHK_R_BIO_WAS_FREED                           101
+#define HWCRHK_R_CHIL_ERROR                              102
+#define HWCRHK_R_CTRL_COMMAND_NOT_IMPLEMENTED            103
+#define HWCRHK_R_DSO_FAILURE                             104
+#define HWCRHK_R_LOCKING_MISSING                         114
+#define HWCRHK_R_MISSING_KEY_COMPONENTS                  105
+#define HWCRHK_R_NOT_INITIALISED                         106
+#define HWCRHK_R_NOT_LOADED                              107
+#define HWCRHK_R_NO_CALLBACK                             108
+#define HWCRHK_R_NO_KEY                                  109
+#define HWCRHK_R_PRIVATE_KEY_ALGORITHMS_DISABLED         110
+#define HWCRHK_R_REQUEST_FAILED                          111
+#define HWCRHK_R_REQUEST_FALLBACK                        112
+#define HWCRHK_R_UNIT_FAILURE                            113
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/engines/e_cswift.c b/src/lib/libssl/src/engines/e_cswift.c
new file mode 100644
index 0000000000..bc65179846
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_cswift.c
@@ -0,0 +1,1131 @@
+/* crypto/engine/hw_cswift.c */
+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
+ * project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/crypto.h>
+#include <openssl/buffer.h>
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/rand.h>
+#include <openssl/bn.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_CSWIFT
+
+/* Attribution notice: Rainbow have generously allowed me to reproduce
+ * the necessary definitions here from their API. This means the support
+ * can build independently of whether application builders have the
+ * API or hardware. This will allow developers to easily produce software
+ * that has latent hardware support for any users that have accelerators
+ * installed, without the developers themselves needing anything extra.
+ *
+ * I have only clipped the parts from the CryptoSwift header files that
+ * are (or seem) relevant to the CryptoSwift support code. This is
+ * simply to keep the file sizes reasonable.
+ * [Geoff]
+ */
+#ifdef FLAT_INC
+#include "cswift.h"
+#else
+#include "vendor_defns/cswift.h"
+#endif
+
+#define CSWIFT_LIB_NAME "cswift engine"
+#include "e_cswift_err.c"
+
+#define DECIMAL_SIZE(type)      ((sizeof(type)*8+2)/3+1)
+
+static int cswift_destroy(ENGINE *e);
+static int cswift_init(ENGINE *e);
+static int cswift_finish(ENGINE *e);
+static int cswift_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void));
+#ifndef OPENSSL_NO_RSA
+static int cswift_bn_32copy(SW_LARGENUMBER * out, const BIGNUM * in);
+#endif
+
+/* BIGNUM stuff */
+static int cswift_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx);
+#ifndef OPENSSL_NO_RSA
+static int cswift_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *q, const BIGNUM *dmp1, const BIGNUM *dmq1,
+                const BIGNUM *iqmp, BN_CTX *ctx);
+#endif
+
+#ifndef OPENSSL_NO_RSA
+/* RSA stuff */
+static int cswift_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int cswift_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#endif
+
+#ifndef OPENSSL_NO_DSA
+/* DSA stuff */
+static DSA_SIG *cswift_dsa_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+static int cswift_dsa_verify(const unsigned char *dgst, int dgst_len,
+                                DSA_SIG *sig, DSA *dsa);
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* DH stuff */
+/* This function is alised to mod_exp (with the DH and mont dropped). */
+static int cswift_mod_exp_dh(const DH *dh, BIGNUM *r,
+                const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#endif
+
+/* RAND stuff */
+static int cswift_rand_bytes(unsigned char *buf, int num);
+static int cswift_rand_status(void);
+
+/* The definitions for control commands specific to this engine */
+#define CSWIFT_CMD_SO_PATH              ENGINE_CMD_BASE
+static const ENGINE_CMD_DEFN cswift_cmd_defns[] = {
+        {CSWIFT_CMD_SO_PATH,
+                "SO_PATH",
+                "Specifies the path to the 'cswift' shared library",
+                ENGINE_CMD_FLAG_STRING},
+        {0, NULL, NULL, 0}
+        };
+
+#ifndef OPENSSL_NO_RSA
+/* Our internal RSA_METHOD that we provide pointers to */
+static RSA_METHOD cswift_rsa =
+        {
+        "CryptoSwift RSA method",
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        cswift_rsa_mod_exp,
+        cswift_mod_exp_mont,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL,
+        NULL,
+        NULL
+        };
+#endif
+
+#ifndef OPENSSL_NO_DSA
+/* Our internal DSA_METHOD that we provide pointers to */
+static DSA_METHOD cswift_dsa =
+        {
+        "CryptoSwift DSA method",
+        cswift_dsa_sign,
+        NULL, /* dsa_sign_setup */
+        cswift_dsa_verify,
+        NULL, /* dsa_mod_exp */
+        NULL, /* bn_mod_exp */
+        NULL, /* init */
+        NULL, /* finish */
+        0, /* flags */
+        NULL, /* app_data */
+        NULL, /* dsa_paramgen */
+        NULL /* dsa_keygen */
+        };
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* Our internal DH_METHOD that we provide pointers to */
+static DH_METHOD cswift_dh =
+        {
+        "CryptoSwift DH method",
+        NULL,
+        NULL,
+        cswift_mod_exp_dh,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL
+        };
+#endif
+
+static RAND_METHOD cswift_random =
+    {
+    /* "CryptoSwift RAND method", */
+    NULL,
+    cswift_rand_bytes,
+    NULL,
+    NULL,
+    cswift_rand_bytes,
+    cswift_rand_status,
+    };
+
+
+/* Constants used when creating the ENGINE */
+static const char *engine_cswift_id = "cswift";
+static const char *engine_cswift_name = "CryptoSwift hardware engine support";
+
+/* This internal function is used by ENGINE_cswift() and possibly by the
+ * "dynamic" ENGINE support too */
+static int bind_helper(ENGINE *e)
+        {
+#ifndef OPENSSL_NO_RSA
+        const RSA_METHOD *meth1;
+#endif
+#ifndef OPENSSL_NO_DH
+        const DH_METHOD *meth2;
+#endif
+        if(!ENGINE_set_id(e, engine_cswift_id) ||
+                        !ENGINE_set_name(e, engine_cswift_name) ||
+#ifndef OPENSSL_NO_RSA
+                        !ENGINE_set_RSA(e, &cswift_rsa) ||
+#endif
+#ifndef OPENSSL_NO_DSA
+                        !ENGINE_set_DSA(e, &cswift_dsa) ||
+#endif
+#ifndef OPENSSL_NO_DH
+                        !ENGINE_set_DH(e, &cswift_dh) ||
+#endif
+                        !ENGINE_set_RAND(e, &cswift_random) ||
+                        !ENGINE_set_destroy_function(e, cswift_destroy) ||
+                        !ENGINE_set_init_function(e, cswift_init) ||
+                        !ENGINE_set_finish_function(e, cswift_finish) ||
+                        !ENGINE_set_ctrl_function(e, cswift_ctrl) ||
+                        !ENGINE_set_cmd_defns(e, cswift_cmd_defns))
+                return 0;
+
+#ifndef OPENSSL_NO_RSA
+        /* We know that the "PKCS1_SSLeay()" functions hook properly
+         * to the cswift-specific mod_exp and mod_exp_crt so we use
+         * those functions. NB: We don't use ENGINE_openssl() or
+         * anything "more generic" because something like the RSAref
+         * code may not hook properly, and if you own one of these
+         * cards then you have the right to do RSA operations on it
+         * anyway! */ 
+        meth1 = RSA_PKCS1_SSLeay();
+        cswift_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
+        cswift_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
+        cswift_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
+        cswift_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
+#endif
+
+#ifndef OPENSSL_NO_DH
+        /* Much the same for Diffie-Hellman */
+        meth2 = DH_OpenSSL();
+        cswift_dh.generate_key = meth2->generate_key;
+        cswift_dh.compute_key = meth2->compute_key;
+#endif
+
+        /* Ensure the cswift error handling is set up */
+        ERR_load_CSWIFT_strings();
+        return 1;
+        }
+
+#ifdef OPENSSL_NO_DYNAMIC_ENGINE
+static ENGINE *engine_cswift(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!bind_helper(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_cswift(void)
+        {
+        /* Copied from eng_[openssl|dyn].c */
+        ENGINE *toadd = engine_cswift();
+        if(!toadd) return;
+        ENGINE_add(toadd);
+        ENGINE_free(toadd);
+        ERR_clear_error();
+        }
+#endif
+
+/* This is a process-global DSO handle used for loading and unloading
+ * the CryptoSwift library. NB: This is only set (or unset) during an
+ * init() or finish() call (reference counts permitting) and they're
+ * operating with global locks, so this should be thread-safe
+ * implicitly. */
+static DSO *cswift_dso = NULL;
+
+/* These are the function pointers that are (un)set when the library has
+ * successfully (un)loaded. */
+t_swAcquireAccContext *p_CSwift_AcquireAccContext = NULL;
+t_swAttachKeyParam *p_CSwift_AttachKeyParam = NULL;
+t_swSimpleRequest *p_CSwift_SimpleRequest = NULL;
+t_swReleaseAccContext *p_CSwift_ReleaseAccContext = NULL;
+
+/* Used in the DSO operations. */
+static const char *CSWIFT_LIBNAME = NULL;
+static const char *get_CSWIFT_LIBNAME(void)
+        {
+        if(CSWIFT_LIBNAME)
+                return CSWIFT_LIBNAME;
+        return "swift";
+        }
+static void free_CSWIFT_LIBNAME(void)
+        {
+        if(CSWIFT_LIBNAME)
+                OPENSSL_free((void*)CSWIFT_LIBNAME);
+        CSWIFT_LIBNAME = NULL;
+        }
+static long set_CSWIFT_LIBNAME(const char *name)
+        {
+        free_CSWIFT_LIBNAME();
+        return (((CSWIFT_LIBNAME = BUF_strdup(name)) != NULL) ? 1 : 0);
+        }
+static const char *CSWIFT_F1 = "swAcquireAccContext";
+static const char *CSWIFT_F2 = "swAttachKeyParam";
+static const char *CSWIFT_F3 = "swSimpleRequest";
+static const char *CSWIFT_F4 = "swReleaseAccContext";
+
+
+/* CryptoSwift library functions and mechanics - these are used by the
+ * higher-level functions further down. NB: As and where there's no
+ * error checking, take a look lower down where these functions are
+ * called, the checking and error handling is probably down there. */
+
+/* utility function to obtain a context */
+static int get_context(SW_CONTEXT_HANDLE *hac)
+        {
+        SW_STATUS status;
+ 
+        status = p_CSwift_AcquireAccContext(hac);
+        if(status != SW_OK)
+                return 0;
+        return 1;
+        }
+ 
+/* similarly to release one. */
+static void release_context(SW_CONTEXT_HANDLE hac)
+        {
+        p_CSwift_ReleaseAccContext(hac);
+        }
+
+/* Destructor (complements the "ENGINE_cswift()" constructor) */
+static int cswift_destroy(ENGINE *e)
+        {
+        free_CSWIFT_LIBNAME();
+        ERR_unload_CSWIFT_strings();
+        return 1;
+        }
+
+/* (de)initialisation functions. */
+static int cswift_init(ENGINE *e)
+        {
+        SW_CONTEXT_HANDLE hac;
+        t_swAcquireAccContext *p1;
+        t_swAttachKeyParam *p2;
+        t_swSimpleRequest *p3;
+        t_swReleaseAccContext *p4;
+
+        if(cswift_dso != NULL)
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_INIT,CSWIFT_R_ALREADY_LOADED);
+                goto err;
+                }
+        /* Attempt to load libswift.so/swift.dll/whatever. */
+        cswift_dso = DSO_load(NULL, get_CSWIFT_LIBNAME(), NULL, 0);
+        if(cswift_dso == NULL)
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_INIT,CSWIFT_R_NOT_LOADED);
+                goto err;
+                }
+        if(!(p1 = (t_swAcquireAccContext *)
+                                DSO_bind_func(cswift_dso, CSWIFT_F1)) ||
+                        !(p2 = (t_swAttachKeyParam *)
+                                DSO_bind_func(cswift_dso, CSWIFT_F2)) ||
+                        !(p3 = (t_swSimpleRequest *)
+                                DSO_bind_func(cswift_dso, CSWIFT_F3)) ||
+                        !(p4 = (t_swReleaseAccContext *)
+                                DSO_bind_func(cswift_dso, CSWIFT_F4)))
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_INIT,CSWIFT_R_NOT_LOADED);
+                goto err;
+                }
+        /* Copy the pointers */
+        p_CSwift_AcquireAccContext = p1;
+        p_CSwift_AttachKeyParam = p2;
+        p_CSwift_SimpleRequest = p3;
+        p_CSwift_ReleaseAccContext = p4;
+        /* Try and get a context - if not, we may have a DSO but no
+         * accelerator! */
+        if(!get_context(&hac))
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_INIT,CSWIFT_R_UNIT_FAILURE);
+                goto err;
+                }
+        release_context(hac);
+        /* Everything's fine. */
+        return 1;
+err:
+        if(cswift_dso)
+        {
+                DSO_free(cswift_dso);
+                cswift_dso = NULL;
+        }
+        p_CSwift_AcquireAccContext = NULL;
+        p_CSwift_AttachKeyParam = NULL;
+        p_CSwift_SimpleRequest = NULL;
+        p_CSwift_ReleaseAccContext = NULL;
+        return 0;
+        }
+
+static int cswift_finish(ENGINE *e)
+        {
+        free_CSWIFT_LIBNAME();
+        if(cswift_dso == NULL)
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_FINISH,CSWIFT_R_NOT_LOADED);
+                return 0;
+                }
+        if(!DSO_free(cswift_dso))
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_FINISH,CSWIFT_R_UNIT_FAILURE);
+                return 0;
+                }
+        cswift_dso = NULL;
+        p_CSwift_AcquireAccContext = NULL;
+        p_CSwift_AttachKeyParam = NULL;
+        p_CSwift_SimpleRequest = NULL;
+        p_CSwift_ReleaseAccContext = NULL;
+        return 1;
+        }
+
+static int cswift_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+        {
+        int initialised = ((cswift_dso == NULL) ? 0 : 1);
+        switch(cmd)
+                {
+        case CSWIFT_CMD_SO_PATH:
+                if(p == NULL)
+                        {
+                        CSWIFTerr(CSWIFT_F_CSWIFT_CTRL,ERR_R_PASSED_NULL_PARAMETER);
+                        return 0;
+                        }
+                if(initialised)
+                        {
+                        CSWIFTerr(CSWIFT_F_CSWIFT_CTRL,CSWIFT_R_ALREADY_LOADED);
+                        return 0;
+                        }
+                return set_CSWIFT_LIBNAME((const char *)p);
+        default:
+                break;
+                }
+        CSWIFTerr(CSWIFT_F_CSWIFT_CTRL,CSWIFT_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+        return 0;
+        }
+
+/* Un petit mod_exp */
+static int cswift_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                        const BIGNUM *m, BN_CTX *ctx)
+        {
+        /* I need somewhere to store temporary serialised values for
+         * use with the CryptoSwift API calls. A neat cheat - I'll use
+         * BIGNUMs from the BN_CTX but access their arrays directly as
+         * byte arrays <grin>. This way I don't have to clean anything
+         * up. */
+        BIGNUM *modulus;
+        BIGNUM *exponent;
+        BIGNUM *argument;
+        BIGNUM *result;
+        SW_STATUS sw_status;
+        SW_LARGENUMBER arg, res;
+        SW_PARAM sw_param;
+        SW_CONTEXT_HANDLE hac;
+        int to_return, acquired;
+ 
+        modulus = exponent = argument = result = NULL;
+        to_return = 0; /* expect failure */
+        acquired = 0;
+ 
+        if(!get_context(&hac))
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP,CSWIFT_R_UNIT_FAILURE);
+                goto err;
+                }
+        acquired = 1;
+        /* Prepare the params */
+        BN_CTX_start(ctx);
+        modulus = BN_CTX_get(ctx);
+        exponent = BN_CTX_get(ctx);
+        argument = BN_CTX_get(ctx);
+        result = BN_CTX_get(ctx);
+        if(!result)
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP,CSWIFT_R_BN_CTX_FULL);
+                goto err;
+                }
+        if(!bn_wexpand(modulus, m->top) || !bn_wexpand(exponent, p->top) ||
+                !bn_wexpand(argument, a->top) || !bn_wexpand(result, m->top))
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP,CSWIFT_R_BN_EXPAND_FAIL);
+                goto err;
+                }
+        sw_param.type = SW_ALG_EXP;
+        sw_param.up.exp.modulus.nbytes = BN_bn2bin(m,
+                (unsigned char *)modulus->d);
+        sw_param.up.exp.modulus.value = (unsigned char *)modulus->d;
+        sw_param.up.exp.exponent.nbytes = BN_bn2bin(p,
+                (unsigned char *)exponent->d);
+        sw_param.up.exp.exponent.value = (unsigned char *)exponent->d;
+        /* Attach the key params */
+        sw_status = p_CSwift_AttachKeyParam(hac, &sw_param);
+        switch(sw_status)
+                {
+        case SW_OK:
+                break;
+        case SW_ERR_INPUT_SIZE:
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP,CSWIFT_R_BAD_KEY_SIZE);
+                goto err;
+        default:
+                {
+                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP,CSWIFT_R_REQUEST_FAILED);
+                sprintf(tmpbuf, "%ld", sw_status);
+                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
+                }
+                goto err;
+                }
+        /* Prepare the argument and response */
+        arg.nbytes = BN_bn2bin(a, (unsigned char *)argument->d);
+        arg.value = (unsigned char *)argument->d;
+        res.nbytes = BN_num_bytes(m);
+        memset(result->d, 0, res.nbytes);
+        res.value = (unsigned char *)result->d;
+        /* Perform the operation */
+        if((sw_status = p_CSwift_SimpleRequest(hac, SW_CMD_MODEXP, &arg, 1,
+                &res, 1)) != SW_OK)
+                {
+                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP,CSWIFT_R_REQUEST_FAILED);
+                sprintf(tmpbuf, "%ld", sw_status);
+                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
+                goto err;
+                }
+        /* Convert the response */
+        BN_bin2bn((unsigned char *)result->d, res.nbytes, r);
+        to_return = 1;
+err:
+        if(acquired)
+                release_context(hac);
+        BN_CTX_end(ctx);
+        return to_return;
+        }
+
+
+#ifndef OPENSSL_NO_RSA
+int cswift_bn_32copy(SW_LARGENUMBER * out, const BIGNUM * in)
+{
+        int mod;
+        int numbytes = BN_num_bytes(in);
+
+        mod = 0;
+        while( ((out->nbytes = (numbytes+mod)) % 32) )
+        {
+                mod++;
+        }
+        out->value = (unsigned char*)OPENSSL_malloc(out->nbytes);
+        if(!out->value)
+        {
+                return 0;
+        }
+        BN_bn2bin(in, &out->value[mod]);
+        if(mod)
+                memset(out->value, 0, mod);
+
+        return 1;
+}
+#endif
+
+#ifndef OPENSSL_NO_RSA
+/* Un petit mod_exp chinois */
+static int cswift_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                        const BIGNUM *q, const BIGNUM *dmp1,
+                        const BIGNUM *dmq1, const BIGNUM *iqmp, BN_CTX *ctx)
+        {
+        SW_STATUS sw_status;
+        SW_LARGENUMBER arg, res;
+        SW_PARAM sw_param;
+        SW_CONTEXT_HANDLE hac;
+        BIGNUM *result = NULL;
+        BIGNUM *argument = NULL;
+        int to_return = 0; /* expect failure */
+        int acquired = 0;
+
+        sw_param.up.crt.p.value = NULL;
+        sw_param.up.crt.q.value = NULL;
+        sw_param.up.crt.dmp1.value = NULL;
+        sw_param.up.crt.dmq1.value = NULL;
+        sw_param.up.crt.iqmp.value = NULL;
+ 
+        if(!get_context(&hac))
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_UNIT_FAILURE);
+                goto err;
+                }
+        acquired = 1;
+
+        /* Prepare the params */
+        argument = BN_new();
+        result = BN_new();
+        if(!result || !argument)
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_CTX_FULL);
+                goto err;
+                }
+
+
+        sw_param.type = SW_ALG_CRT;
+        /************************************************************************/
+        /* 04/02/2003                                                           */
+        /* Modified by Frederic Giudicelli (deny-all.com) to overcome the       */
+        /* limitation of cswift with values not a multiple of 32                */
+        /************************************************************************/
+        if(!cswift_bn_32copy(&sw_param.up.crt.p, p))
+        {
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_EXPAND_FAIL);
+                goto err;
+        }
+        if(!cswift_bn_32copy(&sw_param.up.crt.q, q))
+        {
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_EXPAND_FAIL);
+                goto err;
+        }
+        if(!cswift_bn_32copy(&sw_param.up.crt.dmp1, dmp1))
+        {
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_EXPAND_FAIL);
+                goto err;
+        }
+        if(!cswift_bn_32copy(&sw_param.up.crt.dmq1, dmq1))
+        {
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_EXPAND_FAIL);
+                goto err;
+        }
+        if(!cswift_bn_32copy(&sw_param.up.crt.iqmp, iqmp))
+        {
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_EXPAND_FAIL);
+                goto err;
+        }
+        if(     !bn_wexpand(argument, a->top) ||
+                        !bn_wexpand(result, p->top + q->top))
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BN_EXPAND_FAIL);
+                goto err;
+                }
+
+        /* Attach the key params */
+        sw_status = p_CSwift_AttachKeyParam(hac, &sw_param);
+        switch(sw_status)
+                {
+        case SW_OK:
+                break;
+        case SW_ERR_INPUT_SIZE:
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_BAD_KEY_SIZE);
+                goto err;
+        default:
+                {
+                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_REQUEST_FAILED);
+                sprintf(tmpbuf, "%ld", sw_status);
+                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
+                }
+                goto err;
+                }
+        /* Prepare the argument and response */
+        arg.nbytes = BN_bn2bin(a, (unsigned char *)argument->d);
+        arg.value = (unsigned char *)argument->d;
+        res.nbytes = 2 * BN_num_bytes(p);
+        memset(result->d, 0, res.nbytes);
+        res.value = (unsigned char *)result->d;
+        /* Perform the operation */
+        if((sw_status = p_CSwift_SimpleRequest(hac, SW_CMD_MODEXP_CRT, &arg, 1,
+                &res, 1)) != SW_OK)
+                {
+                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
+                CSWIFTerr(CSWIFT_F_CSWIFT_MOD_EXP_CRT,CSWIFT_R_REQUEST_FAILED);
+                sprintf(tmpbuf, "%ld", sw_status);
+                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
+                goto err;
+                }
+        /* Convert the response */
+        BN_bin2bn((unsigned char *)result->d, res.nbytes, r);
+        to_return = 1;
+err:
+        if(sw_param.up.crt.p.value)
+                OPENSSL_free(sw_param.up.crt.p.value);
+        if(sw_param.up.crt.q.value)
+                OPENSSL_free(sw_param.up.crt.q.value);
+        if(sw_param.up.crt.dmp1.value)
+                OPENSSL_free(sw_param.up.crt.dmp1.value);
+        if(sw_param.up.crt.dmq1.value)
+                OPENSSL_free(sw_param.up.crt.dmq1.value);
+        if(sw_param.up.crt.iqmp.value)
+                OPENSSL_free(sw_param.up.crt.iqmp.value);
+        if(result)
+                BN_free(result);
+        if(argument)
+                BN_free(argument);
+        if(acquired)
+                release_context(hac);
+        return to_return;
+        }
+#endif
+ 
+#ifndef OPENSSL_NO_RSA
+static int cswift_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
+        {
+        int to_return = 0;
+        const RSA_METHOD * def_rsa_method;
+
+        if(!rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_RSA_MOD_EXP,CSWIFT_R_MISSING_KEY_COMPONENTS);
+                goto err;
+                }
+
+        /* Try the limits of RSA (2048 bits) */
+        if(BN_num_bytes(rsa->p) > 128 ||
+                BN_num_bytes(rsa->q) > 128 ||
+                BN_num_bytes(rsa->dmp1) > 128 ||
+                BN_num_bytes(rsa->dmq1) > 128 ||
+                BN_num_bytes(rsa->iqmp) > 128)
+        {
+#ifdef RSA_NULL
+                def_rsa_method=RSA_null_method();
+#else
+#if 0
+                def_rsa_method=RSA_PKCS1_RSAref();
+#else
+                def_rsa_method=RSA_PKCS1_SSLeay();
+#endif
+#endif
+                if(def_rsa_method)
+                        return def_rsa_method->rsa_mod_exp(r0, I, rsa, ctx);
+        }
+
+        to_return = cswift_mod_exp_crt(r0, I, rsa->p, rsa->q, rsa->dmp1,
+                rsa->dmq1, rsa->iqmp, ctx);
+err:
+        return to_return;
+        }
+
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int cswift_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        const RSA_METHOD * def_rsa_method;
+
+        /* Try the limits of RSA (2048 bits) */
+        if(BN_num_bytes(r) > 256 ||
+                BN_num_bytes(a) > 256 ||
+                BN_num_bytes(m) > 256)
+        {
+#ifdef RSA_NULL
+                def_rsa_method=RSA_null_method();
+#else
+#if 0
+                def_rsa_method=RSA_PKCS1_RSAref();
+#else
+                def_rsa_method=RSA_PKCS1_SSLeay();
+#endif
+#endif
+                if(def_rsa_method)
+                        return def_rsa_method->bn_mod_exp(r, a, p, m, ctx, m_ctx);
+        }
+
+        return cswift_mod_exp(r, a, p, m, ctx);
+        }
+#endif  /* OPENSSL_NO_RSA */
+
+#ifndef OPENSSL_NO_DSA
+static DSA_SIG *cswift_dsa_sign(const unsigned char *dgst, int dlen, DSA *dsa)
+        {
+        SW_CONTEXT_HANDLE hac;
+        SW_PARAM sw_param;
+        SW_STATUS sw_status;
+        SW_LARGENUMBER arg, res;
+        unsigned char *ptr;
+        BN_CTX *ctx;
+        BIGNUM *dsa_p = NULL;
+        BIGNUM *dsa_q = NULL;
+        BIGNUM *dsa_g = NULL;
+        BIGNUM *dsa_key = NULL;
+        BIGNUM *result = NULL;
+        DSA_SIG *to_return = NULL;
+        int acquired = 0;
+
+        if((ctx = BN_CTX_new()) == NULL)
+                goto err;
+        if(!get_context(&hac))
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_SIGN,CSWIFT_R_UNIT_FAILURE);
+                goto err;
+                }
+        acquired = 1;
+        /* Prepare the params */
+        BN_CTX_start(ctx);
+        dsa_p = BN_CTX_get(ctx);
+        dsa_q = BN_CTX_get(ctx);
+        dsa_g = BN_CTX_get(ctx);
+        dsa_key = BN_CTX_get(ctx);
+        result = BN_CTX_get(ctx);
+        if(!result)
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_SIGN,CSWIFT_R_BN_CTX_FULL);
+                goto err;
+                }
+        if(!bn_wexpand(dsa_p, dsa->p->top) ||
+                        !bn_wexpand(dsa_q, dsa->q->top) ||
+                        !bn_wexpand(dsa_g, dsa->g->top) ||
+                        !bn_wexpand(dsa_key, dsa->priv_key->top) ||
+                        !bn_wexpand(result, dsa->p->top))
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_SIGN,CSWIFT_R_BN_EXPAND_FAIL);
+                goto err;
+                }
+        sw_param.type = SW_ALG_DSA;
+        sw_param.up.dsa.p.nbytes = BN_bn2bin(dsa->p,
+                                (unsigned char *)dsa_p->d);
+        sw_param.up.dsa.p.value = (unsigned char *)dsa_p->d;
+        sw_param.up.dsa.q.nbytes = BN_bn2bin(dsa->q,
+                                (unsigned char *)dsa_q->d);
+        sw_param.up.dsa.q.value = (unsigned char *)dsa_q->d;
+        sw_param.up.dsa.g.nbytes = BN_bn2bin(dsa->g,
+                                (unsigned char *)dsa_g->d);
+        sw_param.up.dsa.g.value = (unsigned char *)dsa_g->d;
+        sw_param.up.dsa.key.nbytes = BN_bn2bin(dsa->priv_key,
+                                (unsigned char *)dsa_key->d);
+        sw_param.up.dsa.key.value = (unsigned char *)dsa_key->d;
+        /* Attach the key params */
+        sw_status = p_CSwift_AttachKeyParam(hac, &sw_param);
+        switch(sw_status)
+                {
+        case SW_OK:
+                break;
+        case SW_ERR_INPUT_SIZE:
+                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_SIGN,CSWIFT_R_BAD_KEY_SIZE);
+                goto err;
+        default:
+                {
+                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
+                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_SIGN,CSWIFT_R_REQUEST_FAILED);
+                sprintf(tmpbuf, "%ld", sw_status);
+                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
+                }
+                goto err;
+                }
+        /* Prepare the argument and response */
+        arg.nbytes = dlen;
+        arg.value = (unsigned char *)dgst;
+        res.nbytes = BN_num_bytes(dsa->p);
+        memset(result->d, 0, res.nbytes);
+        res.value = (unsigned char *)result->d;
+        /* Perform the operation */
+        sw_status = p_CSwift_SimpleRequest(hac, SW_CMD_DSS_SIGN, &arg, 1,
+                &res, 1);
+        if(sw_status != SW_OK)
+                {
+                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
+                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_SIGN,CSWIFT_R_REQUEST_FAILED);
+                sprintf(tmpbuf, "%ld", sw_status);
+                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
+                goto err;
+                }
+        /* Convert the response */
+        ptr = (unsigned char *)result->d;
+        if((to_return = DSA_SIG_new()) == NULL)
+                goto err;
+        to_return->r = BN_bin2bn((unsigned char *)result->d, 20, NULL);
+        to_return->s = BN_bin2bn((unsigned char *)result->d + 20, 20, NULL);
+
+err:
+        if(acquired)
+                release_context(hac);
+        if(ctx)
+                {
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
+                }
+        return to_return;
+        }
+
+static int cswift_dsa_verify(const unsigned char *dgst, int dgst_len,
+                                DSA_SIG *sig, DSA *dsa)
+        {
+        SW_CONTEXT_HANDLE hac;
+        SW_PARAM sw_param;
+        SW_STATUS sw_status;
+        SW_LARGENUMBER arg[2], res;
+        unsigned long sig_result;
+        BN_CTX *ctx;
+        BIGNUM *dsa_p = NULL;
+        BIGNUM *dsa_q = NULL;
+        BIGNUM *dsa_g = NULL;
+        BIGNUM *dsa_key = NULL;
+        BIGNUM *argument = NULL;
+        int to_return = -1;
+        int acquired = 0;
+
+        if((ctx = BN_CTX_new()) == NULL)
+                goto err;
+        if(!get_context(&hac))
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_VERIFY,CSWIFT_R_UNIT_FAILURE);
+                goto err;
+                }
+        acquired = 1;
+        /* Prepare the params */
+        BN_CTX_start(ctx);
+        dsa_p = BN_CTX_get(ctx);
+        dsa_q = BN_CTX_get(ctx);
+        dsa_g = BN_CTX_get(ctx);
+        dsa_key = BN_CTX_get(ctx);
+        argument = BN_CTX_get(ctx);
+        if(!argument)
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_VERIFY,CSWIFT_R_BN_CTX_FULL);
+                goto err;
+                }
+        if(!bn_wexpand(dsa_p, dsa->p->top) ||
+                        !bn_wexpand(dsa_q, dsa->q->top) ||
+                        !bn_wexpand(dsa_g, dsa->g->top) ||
+                        !bn_wexpand(dsa_key, dsa->pub_key->top) ||
+                        !bn_wexpand(argument, 40))
+                {
+                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_VERIFY,CSWIFT_R_BN_EXPAND_FAIL);
+                goto err;
+                }
+        sw_param.type = SW_ALG_DSA;
+        sw_param.up.dsa.p.nbytes = BN_bn2bin(dsa->p,
+                                (unsigned char *)dsa_p->d);
+        sw_param.up.dsa.p.value = (unsigned char *)dsa_p->d;
+        sw_param.up.dsa.q.nbytes = BN_bn2bin(dsa->q,
+                                (unsigned char *)dsa_q->d);
+        sw_param.up.dsa.q.value = (unsigned char *)dsa_q->d;
+        sw_param.up.dsa.g.nbytes = BN_bn2bin(dsa->g,
+                                (unsigned char *)dsa_g->d);
+        sw_param.up.dsa.g.value = (unsigned char *)dsa_g->d;
+        sw_param.up.dsa.key.nbytes = BN_bn2bin(dsa->pub_key,
+                                (unsigned char *)dsa_key->d);
+        sw_param.up.dsa.key.value = (unsigned char *)dsa_key->d;
+        /* Attach the key params */
+        sw_status = p_CSwift_AttachKeyParam(hac, &sw_param);
+        switch(sw_status)
+                {
+        case SW_OK:
+                break;
+        case SW_ERR_INPUT_SIZE:
+                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_VERIFY,CSWIFT_R_BAD_KEY_SIZE);
+                goto err;
+        default:
+                {
+                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
+                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_VERIFY,CSWIFT_R_REQUEST_FAILED);
+                sprintf(tmpbuf, "%ld", sw_status);
+                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
+                }
+                goto err;
+                }
+        /* Prepare the argument and response */
+        arg[0].nbytes = dgst_len;
+        arg[0].value = (unsigned char *)dgst;
+        arg[1].nbytes = 40;
+        arg[1].value = (unsigned char *)argument->d;
+        memset(arg[1].value, 0, 40);
+        BN_bn2bin(sig->r, arg[1].value + 20 - BN_num_bytes(sig->r));
+        BN_bn2bin(sig->s, arg[1].value + 40 - BN_num_bytes(sig->s));
+        res.nbytes = 4; /* unsigned long */
+        res.value = (unsigned char *)(&sig_result);
+        /* Perform the operation */
+        sw_status = p_CSwift_SimpleRequest(hac, SW_CMD_DSS_VERIFY, arg, 2,
+                &res, 1);
+        if(sw_status != SW_OK)
+                {
+                char tmpbuf[DECIMAL_SIZE(sw_status)+1];
+                CSWIFTerr(CSWIFT_F_CSWIFT_DSA_VERIFY,CSWIFT_R_REQUEST_FAILED);
+                sprintf(tmpbuf, "%ld", sw_status);
+                ERR_add_error_data(2, "CryptoSwift error number is ",tmpbuf);
+                goto err;
+                }
+        /* Convert the response */
+        to_return = ((sig_result == 0) ? 0 : 1);
+
+err:
+        if(acquired)
+                release_context(hac);
+        if(ctx)
+                {
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
+                }
+        return to_return;
+        }
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* This function is aliased to mod_exp (with the dh and mont dropped). */
+static int cswift_mod_exp_dh(const DH *dh, BIGNUM *r,
+                const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        return cswift_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+/* Random bytes are good */
+static int cswift_rand_bytes(unsigned char *buf, int num)
+{
+        SW_CONTEXT_HANDLE hac;
+        SW_STATUS swrc;
+        SW_LARGENUMBER largenum;
+        int acquired = 0;
+        int to_return = 0; /* assume failure */
+        unsigned char buf32[1024];
+
+
+        if (!get_context(&hac))
+        {
+                CSWIFTerr(CSWIFT_F_CSWIFT_RAND_BYTES, CSWIFT_R_UNIT_FAILURE);
+                goto err;
+        }
+        acquired = 1;
+
+        /************************************************************************/
+        /* 04/02/2003                                                           */
+        /* Modified by Frederic Giudicelli (deny-all.com) to overcome the       */
+        /* limitation of cswift with values not a multiple of 32                */
+        /************************************************************************/
+
+        while(num >= (int)sizeof(buf32))
+        {
+                largenum.value = buf;
+                largenum.nbytes = sizeof(buf32);
+                /* tell CryptoSwift how many bytes we want and where we want it.
+                 * Note: - CryptoSwift cannot do more than 4096 bytes at a time.
+                 *       - CryptoSwift can only do multiple of 32-bits. */
+                swrc = p_CSwift_SimpleRequest(hac, SW_CMD_RAND, NULL, 0, &largenum, 1);
+                if (swrc != SW_OK)
+                {
+                        char tmpbuf[20];
+                        CSWIFTerr(CSWIFT_F_CSWIFT_RAND_BYTES, CSWIFT_R_REQUEST_FAILED);
+                        sprintf(tmpbuf, "%ld", swrc);
+                        ERR_add_error_data(2, "CryptoSwift error number is ", tmpbuf);
+                        goto err;
+                }
+                buf += sizeof(buf32);
+                num -= sizeof(buf32);
+        }
+        if(num)
+        {
+                largenum.nbytes = sizeof(buf32);
+                largenum.value = buf32;
+                swrc = p_CSwift_SimpleRequest(hac, SW_CMD_RAND, NULL, 0, &largenum, 1);
+                if (swrc != SW_OK)
+                {
+                        char tmpbuf[20];
+                        CSWIFTerr(CSWIFT_F_CSWIFT_RAND_BYTES, CSWIFT_R_REQUEST_FAILED);
+                        sprintf(tmpbuf, "%ld", swrc);
+                        ERR_add_error_data(2, "CryptoSwift error number is ", tmpbuf);
+                        goto err;
+                }
+                memcpy(buf, largenum.value, num);
+        }
+
+        to_return = 1;  /* success */
+err:
+        if (acquired)
+                release_context(hac);
+
+        return to_return;
+}
+
+static int cswift_rand_status(void)
+{
+        return 1;
+}
+
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library. */
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE
+static int bind_fn(ENGINE *e, const char *id)
+        {
+        if(id && (strcmp(id, engine_cswift_id) != 0))
+                return 0;
+        if(!bind_helper(e))
+                return 0;
+        return 1;
+        }       
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
+#endif /* OPENSSL_NO_DYNAMIC_ENGINE */
+
+#endif /* !OPENSSL_NO_HW_CSWIFT */
+#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libssl/src/engines/e_cswift.ec b/src/lib/libssl/src/engines/e_cswift.ec
new file mode 100644
index 0000000000..a7f9d11434
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_cswift.ec
@@ -0,0 +1 @@
+L CSWIFT        e_cswift_err.h                  e_cswift_err.c
diff --git a/src/lib/libssl/src/engines/e_cswift_err.c b/src/lib/libssl/src/engines/e_cswift_err.c
new file mode 100644
index 0000000000..c7942a31fc
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_cswift_err.c
@@ -0,0 +1,154 @@
+/* e_cswift_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "e_cswift_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(0,func,0)
+#define ERR_REASON(reason) ERR_PACK(0,0,reason)
+
+static ERR_STRING_DATA CSWIFT_str_functs[]=
+        {
+{ERR_FUNC(CSWIFT_F_CSWIFT_CTRL),        "CSWIFT_CTRL"},
+{ERR_FUNC(CSWIFT_F_CSWIFT_DSA_SIGN),    "CSWIFT_DSA_SIGN"},
+{ERR_FUNC(CSWIFT_F_CSWIFT_DSA_VERIFY),  "CSWIFT_DSA_VERIFY"},
+{ERR_FUNC(CSWIFT_F_CSWIFT_FINISH),      "CSWIFT_FINISH"},
+{ERR_FUNC(CSWIFT_F_CSWIFT_INIT),        "CSWIFT_INIT"},
+{ERR_FUNC(CSWIFT_F_CSWIFT_MOD_EXP),     "CSWIFT_MOD_EXP"},
+{ERR_FUNC(CSWIFT_F_CSWIFT_MOD_EXP_CRT), "CSWIFT_MOD_EXP_CRT"},
+{ERR_FUNC(CSWIFT_F_CSWIFT_RAND_BYTES),  "CSWIFT_RAND_BYTES"},
+{ERR_FUNC(CSWIFT_F_CSWIFT_RSA_MOD_EXP), "CSWIFT_RSA_MOD_EXP"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA CSWIFT_str_reasons[]=
+        {
+{ERR_REASON(CSWIFT_R_ALREADY_LOADED)     ,"already loaded"},
+{ERR_REASON(CSWIFT_R_BAD_KEY_SIZE)       ,"bad key size"},
+{ERR_REASON(CSWIFT_R_BN_CTX_FULL)        ,"bn ctx full"},
+{ERR_REASON(CSWIFT_R_BN_EXPAND_FAIL)     ,"bn expand fail"},
+{ERR_REASON(CSWIFT_R_CTRL_COMMAND_NOT_IMPLEMENTED),"ctrl command not implemented"},
+{ERR_REASON(CSWIFT_R_MISSING_KEY_COMPONENTS),"missing key components"},
+{ERR_REASON(CSWIFT_R_NOT_LOADED)         ,"not loaded"},
+{ERR_REASON(CSWIFT_R_REQUEST_FAILED)     ,"request failed"},
+{ERR_REASON(CSWIFT_R_UNIT_FAILURE)       ,"unit failure"},
+{0,NULL}
+        };
+
+#endif
+
+#ifdef CSWIFT_LIB_NAME
+static ERR_STRING_DATA CSWIFT_lib_name[]=
+        {
+{0      ,CSWIFT_LIB_NAME},
+{0,NULL}
+        };
+#endif
+
+
+static int CSWIFT_lib_error_code=0;
+static int CSWIFT_error_init=1;
+
+static void ERR_load_CSWIFT_strings(void)
+        {
+        if (CSWIFT_lib_error_code == 0)
+                CSWIFT_lib_error_code=ERR_get_next_error_library();
+
+        if (CSWIFT_error_init)
+                {
+                CSWIFT_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(CSWIFT_lib_error_code,CSWIFT_str_functs);
+                ERR_load_strings(CSWIFT_lib_error_code,CSWIFT_str_reasons);
+#endif
+
+#ifdef CSWIFT_LIB_NAME
+                CSWIFT_lib_name->error = ERR_PACK(CSWIFT_lib_error_code,0,0);
+                ERR_load_strings(0,CSWIFT_lib_name);
+#endif
+                }
+        }
+
+static void ERR_unload_CSWIFT_strings(void)
+        {
+        if (CSWIFT_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(CSWIFT_lib_error_code,CSWIFT_str_functs);
+                ERR_unload_strings(CSWIFT_lib_error_code,CSWIFT_str_reasons);
+#endif
+
+#ifdef CSWIFT_LIB_NAME
+                ERR_unload_strings(0,CSWIFT_lib_name);
+#endif
+                CSWIFT_error_init=1;
+                }
+        }
+
+static void ERR_CSWIFT_error(int function, int reason, char *file, int line)
+        {
+        if (CSWIFT_lib_error_code == 0)
+                CSWIFT_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(CSWIFT_lib_error_code,function,reason,file,line);
+        }
diff --git a/src/lib/libssl/src/engines/e_cswift_err.h b/src/lib/libssl/src/engines/e_cswift_err.h
new file mode 100644
index 0000000000..69c2a9f874
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_cswift_err.h
@@ -0,0 +1,98 @@
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_CSWIFT_ERR_H
+#define HEADER_CSWIFT_ERR_H
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_CSWIFT_strings(void);
+static void ERR_unload_CSWIFT_strings(void);
+static void ERR_CSWIFT_error(int function, int reason, char *file, int line);
+#define CSWIFTerr(f,r) ERR_CSWIFT_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the CSWIFT functions. */
+
+/* Function codes. */
+#define CSWIFT_F_CSWIFT_CTRL                             100
+#define CSWIFT_F_CSWIFT_DSA_SIGN                         101
+#define CSWIFT_F_CSWIFT_DSA_VERIFY                       102
+#define CSWIFT_F_CSWIFT_FINISH                           103
+#define CSWIFT_F_CSWIFT_INIT                             104
+#define CSWIFT_F_CSWIFT_MOD_EXP                          105
+#define CSWIFT_F_CSWIFT_MOD_EXP_CRT                      106
+#define CSWIFT_F_CSWIFT_RAND_BYTES                       108
+#define CSWIFT_F_CSWIFT_RSA_MOD_EXP                      107
+
+/* Reason codes. */
+#define CSWIFT_R_ALREADY_LOADED                          100
+#define CSWIFT_R_BAD_KEY_SIZE                            101
+#define CSWIFT_R_BN_CTX_FULL                             102
+#define CSWIFT_R_BN_EXPAND_FAIL                          103
+#define CSWIFT_R_CTRL_COMMAND_NOT_IMPLEMENTED            104
+#define CSWIFT_R_MISSING_KEY_COMPONENTS                  105
+#define CSWIFT_R_NOT_LOADED                              106
+#define CSWIFT_R_REQUEST_FAILED                          107
+#define CSWIFT_R_UNIT_FAILURE                            108
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/engines/e_gmp.c b/src/lib/libssl/src/engines/e_gmp.c
new file mode 100644
index 0000000000..e62e6fcd07
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_gmp.c
@@ -0,0 +1,471 @@
+/* crypto/engine/e_gmp.c */
+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
+ * project 2003.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* This engine is not (currently) compiled in by default. Do enable it,
+ * reconfigure OpenSSL with "enable-gmp -lgmp". The GMP libraries and
+ * headers must reside in one of the paths searched by the compiler/linker,
+ * otherwise paths must be specified - eg. try configuring with
+ * "enable-gmp -I<includepath> -L<libpath> -lgmp". YMMV. */
+
+/* As for what this does - it's a largely unoptimised implementation of an
+ * ENGINE that uses the GMP library to perform RSA private key operations. To
+ * obtain more information about what "unoptimised" means, see my original mail
+ * on the subject (though ignore the build instructions which have since
+ * changed);
+ *
+ *    http://www.mail-archive.com/openssl-dev@openssl.org/msg12227.html
+ *
+ * On my athlon system at least, it appears the builtin OpenSSL code is now
+ * slightly faster, which is to say that the RSA-related MPI performance
+ * between OpenSSL's BIGNUM and GMP's mpz implementations is probably pretty
+ * balanced for this chip, and so the performance degradation in this ENGINE by
+ * having to convert to/from GMP formats (and not being able to cache
+ * montgomery forms) is probably the difference. However, if some unconfirmed
+ * reports from users is anything to go by, the situation on some other
+ * chipsets might be a good deal more favourable to the GMP version (eg. PPC).
+ * Feedback welcome. */
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/crypto.h>
+#include <openssl/buffer.h>
+#include <openssl/engine.h>
+#include <openssl/rsa.h>
+#include <openssl/bn.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_GMP
+
+#include <gmp.h>
+
+#define E_GMP_LIB_NAME "gmp engine"
+#include "e_gmp_err.c"
+
+static int e_gmp_destroy(ENGINE *e);
+static int e_gmp_init(ENGINE *e);
+static int e_gmp_finish(ENGINE *e);
+static int e_gmp_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void)); 
+
+#ifndef OPENSSL_NO_RSA
+/* RSA stuff */
+static int e_gmp_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
+static int e_gmp_rsa_finish(RSA *r);
+#endif
+
+/* The definitions for control commands specific to this engine */
+/* #define E_GMP_CMD_SO_PATH            ENGINE_CMD_BASE */
+static const ENGINE_CMD_DEFN e_gmp_cmd_defns[] = {
+#if 0
+        {E_GMP_CMD_SO_PATH,
+                "SO_PATH",
+                "Specifies the path to the 'e_gmp' shared library",
+                ENGINE_CMD_FLAG_STRING},
+#endif
+        {0, NULL, NULL, 0}
+        };
+
+#ifndef OPENSSL_NO_RSA
+/* Our internal RSA_METHOD that we provide pointers to */
+static RSA_METHOD e_gmp_rsa =
+        {
+        "GMP RSA method",
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        e_gmp_rsa_mod_exp,
+        NULL,
+        NULL,
+        e_gmp_rsa_finish,
+        /* These flags initialise montgomery crud that GMP ignores, however it
+         * makes sure the public key ops (which are done in openssl) don't seem
+         * *slower* than usual :-) */
+        RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE,
+        NULL,
+        NULL,
+        NULL
+        };
+#endif
+
+/* Constants used when creating the ENGINE */
+static const char *engine_e_gmp_id = "gmp";
+static const char *engine_e_gmp_name = "GMP engine support";
+
+/* This internal function is used by ENGINE_gmp() and possibly by the
+ * "dynamic" ENGINE support too */
+static int bind_helper(ENGINE *e)
+        {
+#ifndef OPENSSL_NO_RSA
+        const RSA_METHOD *meth1;
+#endif
+        if(!ENGINE_set_id(e, engine_e_gmp_id) ||
+                        !ENGINE_set_name(e, engine_e_gmp_name) ||
+#ifndef OPENSSL_NO_RSA
+                        !ENGINE_set_RSA(e, &e_gmp_rsa) ||
+#endif
+                        !ENGINE_set_destroy_function(e, e_gmp_destroy) ||
+                        !ENGINE_set_init_function(e, e_gmp_init) ||
+                        !ENGINE_set_finish_function(e, e_gmp_finish) ||
+                        !ENGINE_set_ctrl_function(e, e_gmp_ctrl) ||
+                        !ENGINE_set_cmd_defns(e, e_gmp_cmd_defns))
+                return 0;
+
+#ifndef OPENSSL_NO_RSA
+        meth1 = RSA_PKCS1_SSLeay();
+        e_gmp_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
+        e_gmp_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
+        e_gmp_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
+        e_gmp_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
+        e_gmp_rsa.bn_mod_exp = meth1->bn_mod_exp;
+#endif
+
+        /* Ensure the e_gmp error handling is set up */
+        ERR_load_GMP_strings();
+        return 1;
+        }
+
+static ENGINE *engine_gmp(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!bind_helper(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_gmp(void)
+        {
+        /* Copied from eng_[openssl|dyn].c */
+        ENGINE *toadd = engine_gmp();
+        if(!toadd) return;
+        ENGINE_add(toadd);
+        ENGINE_free(toadd);
+        ERR_clear_error();
+        }
+
+#ifndef OPENSSL_NO_RSA
+/* Used to attach our own key-data to an RSA structure */
+static int hndidx_rsa = -1;
+#endif
+
+static int e_gmp_destroy(ENGINE *e)
+        {
+        ERR_unload_GMP_strings();
+        return 1;
+        }
+
+/* (de)initialisation functions. */
+static int e_gmp_init(ENGINE *e)
+        {
+#ifndef OPENSSL_NO_RSA
+        if (hndidx_rsa == -1)
+                hndidx_rsa = RSA_get_ex_new_index(0,
+                        "GMP-based RSA key handle",
+                        NULL, NULL, NULL);
+#endif
+        if (hndidx_rsa == -1)
+                return 0;
+        return 1;
+        }
+
+static int e_gmp_finish(ENGINE *e)
+        {
+        return 1;
+        }
+
+static int e_gmp_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+        {
+        int to_return = 1;
+
+        switch(cmd)
+                {
+#if 0
+        case E_GMP_CMD_SO_PATH:
+                /* ... */
+#endif
+        /* The command isn't understood by this engine */
+        default:
+                GMPerr(GMP_F_E_GMP_CTRL,
+                        GMP_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+                to_return = 0;
+                break;
+                }
+
+        return to_return;
+        }
+
+
+/* Most often limb sizes will be the same. If not, we use hex conversion
+ * which is neat, but extremely inefficient. */
+static int bn2gmp(const BIGNUM *bn, mpz_t g)
+        {
+        bn_check_top(bn);
+        if(((sizeof(bn->d[0]) * 8) == GMP_NUMB_BITS) &&
+                        (BN_BITS2 == GMP_NUMB_BITS)) 
+                {
+                /* The common case */
+                if(!_mpz_realloc (g, bn->top))
+                        return 0;
+                memcpy(&g->_mp_d[0], &bn->d[0], bn->top * sizeof(bn->d[0]));
+                g->_mp_size = bn->top;
+                if(bn->neg)
+                        g->_mp_size = -g->_mp_size;
+                return 1;
+                }
+        else
+                {
+                int toret;
+                char *tmpchar = BN_bn2hex(bn);
+                if(!tmpchar) return 0;
+                toret = (mpz_set_str(g, tmpchar, 16) == 0 ? 1 : 0);
+                OPENSSL_free(tmpchar);
+                return toret;
+                }
+        }
+
+static int gmp2bn(mpz_t g, BIGNUM *bn)
+        {
+        if(((sizeof(bn->d[0]) * 8) == GMP_NUMB_BITS) &&
+                        (BN_BITS2 == GMP_NUMB_BITS))
+                {
+                /* The common case */
+                int s = (g->_mp_size >= 0) ? g->_mp_size : -g->_mp_size;
+                BN_zero(bn);
+                if(bn_expand2 (bn, s) == NULL)
+                        return 0;
+                bn->top = s;
+                memcpy(&bn->d[0], &g->_mp_d[0], s * sizeof(bn->d[0]));
+                bn_correct_top(bn);
+                bn->neg = g->_mp_size >= 0 ? 0 : 1;
+                return 1;
+                }
+        else
+                {
+                int toret;
+                char *tmpchar = OPENSSL_malloc(mpz_sizeinbase(g, 16) + 10);
+                if(!tmpchar) return 0;
+                mpz_get_str(tmpchar, 16, g);
+                toret = BN_hex2bn(&bn, tmpchar);
+                OPENSSL_free(tmpchar);
+                return toret;
+                }
+        }
+
+#ifndef OPENSSL_NO_RSA 
+typedef struct st_e_gmp_rsa_ctx
+        {
+        int public_only;
+        mpz_t n;
+        mpz_t d;
+        mpz_t e;
+        mpz_t p;
+        mpz_t q;
+        mpz_t dmp1;
+        mpz_t dmq1;
+        mpz_t iqmp;
+        mpz_t r0, r1, I0, m1;
+        } E_GMP_RSA_CTX;
+
+static E_GMP_RSA_CTX *e_gmp_get_rsa(RSA *rsa)
+        {
+        E_GMP_RSA_CTX *hptr = RSA_get_ex_data(rsa, hndidx_rsa);
+        if(hptr) return hptr;
+        hptr = OPENSSL_malloc(sizeof(E_GMP_RSA_CTX));
+        if(!hptr) return NULL;
+        /* These inits could probably be replaced by more intelligent
+         * mpz_init2() versions, to reduce malloc-thrashing. */
+        mpz_init(hptr->n);
+        mpz_init(hptr->d);
+        mpz_init(hptr->e);
+        mpz_init(hptr->p);
+        mpz_init(hptr->q);
+        mpz_init(hptr->dmp1);
+        mpz_init(hptr->dmq1);
+        mpz_init(hptr->iqmp);
+        mpz_init(hptr->r0);
+        mpz_init(hptr->r1);
+        mpz_init(hptr->I0);
+        mpz_init(hptr->m1);
+        if(!bn2gmp(rsa->n, hptr->n) || !bn2gmp(rsa->e, hptr->e))
+                goto err;
+        if(!rsa->p || !rsa->q || !rsa->d || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)
+                {
+                hptr->public_only = 1;
+                return hptr;
+                }
+        if(!bn2gmp(rsa->d, hptr->d) || !bn2gmp(rsa->p, hptr->p) ||
+                        !bn2gmp(rsa->q, hptr->q) || !bn2gmp(rsa->dmp1, hptr->dmp1) ||
+                        !bn2gmp(rsa->dmq1, hptr->dmq1) || !bn2gmp(rsa->iqmp, hptr->iqmp))
+                goto err;
+        hptr->public_only = 0;
+        RSA_set_ex_data(rsa, hndidx_rsa, hptr);
+        return hptr;
+err:
+        mpz_clear(hptr->n);
+        mpz_clear(hptr->d);
+        mpz_clear(hptr->e);
+        mpz_clear(hptr->p);
+        mpz_clear(hptr->q);
+        mpz_clear(hptr->dmp1);
+        mpz_clear(hptr->dmq1);
+        mpz_clear(hptr->iqmp);
+        mpz_clear(hptr->r0);
+        mpz_clear(hptr->r1);
+        mpz_clear(hptr->I0);
+        mpz_clear(hptr->m1);
+        OPENSSL_free(hptr);
+        return NULL;
+        }
+
+static int e_gmp_rsa_finish(RSA *rsa)
+        {
+        E_GMP_RSA_CTX *hptr = RSA_get_ex_data(rsa, hndidx_rsa);
+        if(!hptr) return 0;
+        mpz_clear(hptr->n);
+        mpz_clear(hptr->d);
+        mpz_clear(hptr->e);
+        mpz_clear(hptr->p);
+        mpz_clear(hptr->q);
+        mpz_clear(hptr->dmp1);
+        mpz_clear(hptr->dmq1);
+        mpz_clear(hptr->iqmp);
+        mpz_clear(hptr->r0);
+        mpz_clear(hptr->r1);
+        mpz_clear(hptr->I0);
+        mpz_clear(hptr->m1);
+        OPENSSL_free(hptr);
+        RSA_set_ex_data(rsa, hndidx_rsa, NULL);
+        return 1;
+        }
+
+static int e_gmp_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
+        {
+        E_GMP_RSA_CTX *hptr;
+        int to_return = 0;
+
+        hptr = e_gmp_get_rsa(rsa);
+        if(!hptr)
+                {
+                GMPerr(GMP_F_E_GMP_RSA_MOD_EXP,
+                                GMP_R_KEY_CONTEXT_ERROR);
+                return 0;
+                }
+        if(hptr->public_only)
+                {
+                GMPerr(GMP_F_E_GMP_RSA_MOD_EXP,
+                                GMP_R_MISSING_KEY_COMPONENTS);
+                return 0;
+                }
+
+        /* ugh!!! */
+        if(!bn2gmp(I, hptr->I0))
+                return 0;
+
+        /* This is basically the CRT logic in crypto/rsa/rsa_eay.c reworded into
+         * GMP-speak. It may be that GMP's API facilitates cleaner formulations
+         * of this stuff, eg. better handling of negatives, or functions that
+         * combine operations. */
+
+        mpz_mod(hptr->r1, hptr->I0, hptr->q);
+        mpz_powm(hptr->m1, hptr->r1, hptr->dmq1, hptr->q);
+
+        mpz_mod(hptr->r1, hptr->I0, hptr->p);
+        mpz_powm(hptr->r0, hptr->r1, hptr->dmp1, hptr->p);
+
+        mpz_sub(hptr->r0, hptr->r0, hptr->m1);
+
+        if(mpz_sgn(hptr->r0) < 0)
+                mpz_add(hptr->r0, hptr->r0, hptr->p);
+        mpz_mul(hptr->r1, hptr->r0, hptr->iqmp);
+        mpz_mod(hptr->r0, hptr->r1, hptr->p);
+
+        if(mpz_sgn(hptr->r0) < 0)
+                mpz_add(hptr->r0, hptr->r0, hptr->p);
+        mpz_mul(hptr->r1, hptr->r0, hptr->q);
+        mpz_add(hptr->r0, hptr->r1, hptr->m1);
+
+        /* ugh!!! */
+        if(gmp2bn(hptr->r0, r))
+                to_return = 1;
+
+        return 1;
+        }
+#endif
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library. */      
+#ifndef ENGINE_NO_DYNAMIC_SUPPORT
+static int bind_fn(ENGINE *e, const char *id)
+        {
+        if(id && (strcmp(id, engine_e_gmp_id) != 0))
+                return 0;
+        if(!bind_helper(e))
+                return 0;
+        return 1;
+        }       
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
+#endif /* ENGINE_DYNAMIC_SUPPORT */
+
+#endif /* !OPENSSL_NO_GMP */
+#endif /* !OPENSSL_NO_HW */
+
diff --git a/src/lib/libssl/src/engines/e_gmp.ec b/src/lib/libssl/src/engines/e_gmp.ec
new file mode 100644
index 0000000000..72ec447fb7
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_gmp.ec
@@ -0,0 +1 @@
+L GMP           e_gmp_err.h                     e_gmp_err.c
diff --git a/src/lib/libssl/src/engines/e_gmp_err.c b/src/lib/libssl/src/engines/e_gmp_err.c
new file mode 100644
index 0000000000..61db956796
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_gmp_err.c
@@ -0,0 +1,141 @@
+/* e_gmp_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "e_gmp_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(0,func,0)
+#define ERR_REASON(reason) ERR_PACK(0,0,reason)
+
+static ERR_STRING_DATA GMP_str_functs[]=
+        {
+{ERR_FUNC(GMP_F_E_GMP_CTRL),    "E_GMP_CTRL"},
+{ERR_FUNC(GMP_F_E_GMP_RSA_MOD_EXP),     "E_GMP_RSA_MOD_EXP"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA GMP_str_reasons[]=
+        {
+{ERR_REASON(GMP_R_CTRL_COMMAND_NOT_IMPLEMENTED),"ctrl command not implemented"},
+{ERR_REASON(GMP_R_KEY_CONTEXT_ERROR)     ,"key context error"},
+{ERR_REASON(GMP_R_MISSING_KEY_COMPONENTS),"missing key components"},
+{0,NULL}
+        };
+
+#endif
+
+#ifdef GMP_LIB_NAME
+static ERR_STRING_DATA GMP_lib_name[]=
+        {
+{0      ,GMP_LIB_NAME},
+{0,NULL}
+        };
+#endif
+
+
+static int GMP_lib_error_code=0;
+static int GMP_error_init=1;
+
+static void ERR_load_GMP_strings(void)
+        {
+        if (GMP_lib_error_code == 0)
+                GMP_lib_error_code=ERR_get_next_error_library();
+
+        if (GMP_error_init)
+                {
+                GMP_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(GMP_lib_error_code,GMP_str_functs);
+                ERR_load_strings(GMP_lib_error_code,GMP_str_reasons);
+#endif
+
+#ifdef GMP_LIB_NAME
+                GMP_lib_name->error = ERR_PACK(GMP_lib_error_code,0,0);
+                ERR_load_strings(0,GMP_lib_name);
+#endif
+                }
+        }
+
+static void ERR_unload_GMP_strings(void)
+        {
+        if (GMP_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(GMP_lib_error_code,GMP_str_functs);
+                ERR_unload_strings(GMP_lib_error_code,GMP_str_reasons);
+#endif
+
+#ifdef GMP_LIB_NAME
+                ERR_unload_strings(0,GMP_lib_name);
+#endif
+                GMP_error_init=1;
+                }
+        }
+
+static void ERR_GMP_error(int function, int reason, char *file, int line)
+        {
+        if (GMP_lib_error_code == 0)
+                GMP_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(GMP_lib_error_code,function,reason,file,line);
+        }
diff --git a/src/lib/libssl/src/engines/e_gmp_err.h b/src/lib/libssl/src/engines/e_gmp_err.h
new file mode 100644
index 0000000000..dd05dfd800
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_gmp_err.h
@@ -0,0 +1,85 @@
+/* ====================================================================
+ * Copyright (c) 2001-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_GMP_ERR_H
+#define HEADER_GMP_ERR_H
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_GMP_strings(void);
+static void ERR_unload_GMP_strings(void);
+static void ERR_GMP_error(int function, int reason, char *file, int line);
+#define GMPerr(f,r) ERR_GMP_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the GMP functions. */
+
+/* Function codes. */
+#define GMP_F_E_GMP_CTRL                                 100
+#define GMP_F_E_GMP_RSA_MOD_EXP                          101
+
+/* Reason codes. */
+#define GMP_R_CTRL_COMMAND_NOT_IMPLEMENTED               100
+#define GMP_R_KEY_CONTEXT_ERROR                          101
+#define GMP_R_MISSING_KEY_COMPONENTS                     102
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/engines/e_nuron.c b/src/lib/libssl/src/engines/e_nuron.c
new file mode 100644
index 0000000000..4c2537cbc3
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_nuron.c
@@ -0,0 +1,434 @@
+/* crypto/engine/hw_nuron.c */
+/* Written by Ben Laurie for the OpenSSL Project, leaning heavily on Geoff
+ * Thorpe's Atalla implementation.
+ */
+/* ====================================================================
+ * Copyright (c) 2000-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/crypto.h>
+#include <openssl/buffer.h>
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_NURON
+
+#define NURON_LIB_NAME "nuron engine"
+#include "e_nuron_err.c"
+
+static const char *NURON_LIBNAME = NULL;
+static const char *get_NURON_LIBNAME(void)
+        {
+        if(NURON_LIBNAME)
+                return NURON_LIBNAME;
+        return "nuronssl";
+        }
+static void free_NURON_LIBNAME(void)
+        {
+        if(NURON_LIBNAME)
+                OPENSSL_free((void*)NURON_LIBNAME);
+        NURON_LIBNAME = NULL;
+        }
+static long set_NURON_LIBNAME(const char *name)
+        {
+        free_NURON_LIBNAME();
+        return (((NURON_LIBNAME = BUF_strdup(name)) != NULL) ? 1 : 0);
+        }
+static const char *NURON_F1 = "nuron_mod_exp";
+
+/* The definitions for control commands specific to this engine */
+#define NURON_CMD_SO_PATH               ENGINE_CMD_BASE
+static const ENGINE_CMD_DEFN nuron_cmd_defns[] = {
+        {NURON_CMD_SO_PATH,
+                "SO_PATH",
+                "Specifies the path to the 'nuronssl' shared library",
+                ENGINE_CMD_FLAG_STRING},
+        {0, NULL, NULL, 0}
+        };
+
+typedef int tfnModExp(BIGNUM *r,const BIGNUM *a,const BIGNUM *p,const BIGNUM *m);
+static tfnModExp *pfnModExp = NULL;
+
+static DSO *pvDSOHandle = NULL;
+
+static int nuron_destroy(ENGINE *e)
+        {
+        free_NURON_LIBNAME();
+        ERR_unload_NURON_strings();
+        return 1;
+        }
+
+static int nuron_init(ENGINE *e)
+        {
+        if(pvDSOHandle != NULL)
+                {
+                NURONerr(NURON_F_NURON_INIT,NURON_R_ALREADY_LOADED);
+                return 0;
+                }
+
+        pvDSOHandle = DSO_load(NULL, get_NURON_LIBNAME(), NULL,
+                DSO_FLAG_NAME_TRANSLATION_EXT_ONLY);
+        if(!pvDSOHandle)
+                {
+                NURONerr(NURON_F_NURON_INIT,NURON_R_DSO_NOT_FOUND);
+                return 0;
+                }
+
+        pfnModExp = (tfnModExp *)DSO_bind_func(pvDSOHandle, NURON_F1);
+        if(!pfnModExp)
+                {
+                NURONerr(NURON_F_NURON_INIT,NURON_R_DSO_FUNCTION_NOT_FOUND);
+                return 0;
+                }
+
+        return 1;
+        }
+
+static int nuron_finish(ENGINE *e)
+        {
+        free_NURON_LIBNAME();
+        if(pvDSOHandle == NULL)
+                {
+                NURONerr(NURON_F_NURON_FINISH,NURON_R_NOT_LOADED);
+                return 0;
+                }
+        if(!DSO_free(pvDSOHandle))
+                {
+                NURONerr(NURON_F_NURON_FINISH,NURON_R_DSO_FAILURE);
+                return 0;
+                }
+        pvDSOHandle=NULL;
+        pfnModExp=NULL;
+        return 1;
+        }
+
+static int nuron_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+        {
+        int initialised = ((pvDSOHandle == NULL) ? 0 : 1);
+        switch(cmd)
+                {
+        case NURON_CMD_SO_PATH:
+                if(p == NULL)
+                        {
+                        NURONerr(NURON_F_NURON_CTRL,ERR_R_PASSED_NULL_PARAMETER);
+                        return 0;
+                        }
+                if(initialised)
+                        {
+                        NURONerr(NURON_F_NURON_CTRL,NURON_R_ALREADY_LOADED);
+                        return 0;
+                        }
+                return set_NURON_LIBNAME((const char *)p);
+        default:
+                break;
+                }
+        NURONerr(NURON_F_NURON_CTRL,NURON_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+        return 0;
+}
+
+static int nuron_mod_exp(BIGNUM *r,const BIGNUM *a,const BIGNUM *p,
+                         const BIGNUM *m,BN_CTX *ctx)
+        {
+        if(!pvDSOHandle)
+                {
+                NURONerr(NURON_F_NURON_MOD_EXP,NURON_R_NOT_LOADED);
+                return 0;
+                }
+        return pfnModExp(r,a,p,m);
+        }
+
+#ifndef OPENSSL_NO_RSA
+static int nuron_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
+        {
+        return nuron_mod_exp(r0,I,rsa->d,rsa->n,ctx);
+        }
+#endif
+
+#ifndef OPENSSL_NO_DSA
+/* This code was liberated and adapted from the commented-out code in
+ * dsa_ossl.c. Because of the unoptimised form of the Atalla acceleration
+ * (it doesn't have a CRT form for RSA), this function means that an
+ * Atalla system running with a DSA server certificate can handshake
+ * around 5 or 6 times faster/more than an equivalent system running with
+ * RSA. Just check out the "signs" statistics from the RSA and DSA parts
+ * of "openssl speed -engine atalla dsa1024 rsa1024". */
+static int nuron_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+                             BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+                             BN_CTX *ctx, BN_MONT_CTX *in_mont)
+        {
+        BIGNUM t;
+        int to_return = 0;
+ 
+        BN_init(&t);
+        /* let rr = a1 ^ p1 mod m */
+        if (!nuron_mod_exp(rr,a1,p1,m,ctx))
+                goto end;
+        /* let t = a2 ^ p2 mod m */
+        if (!nuron_mod_exp(&t,a2,p2,m,ctx))
+                goto end;
+        /* let rr = rr * t mod m */
+        if (!BN_mod_mul(rr,rr,&t,m,ctx))
+                goto end;
+        to_return = 1;
+end:
+        BN_free(&t);
+        return to_return;
+        }
+
+
+static int nuron_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+                             const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+                             BN_MONT_CTX *m_ctx)
+        {
+        return nuron_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+#ifndef OPENSSL_NO_RSA
+static int nuron_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                              const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        return nuron_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* This function is aliased to mod_exp (with the dh and mont dropped). */
+static int nuron_mod_exp_dh(const DH *dh, BIGNUM *r,
+                const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        return nuron_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+#ifndef OPENSSL_NO_RSA
+static RSA_METHOD nuron_rsa =
+        {
+        "Nuron RSA method",
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        nuron_rsa_mod_exp,
+        nuron_mod_exp_mont,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL,
+        NULL,
+        NULL
+        };
+#endif
+
+#ifndef OPENSSL_NO_DSA
+static DSA_METHOD nuron_dsa =
+        {
+        "Nuron DSA method",
+        NULL, /* dsa_do_sign */
+        NULL, /* dsa_sign_setup */
+        NULL, /* dsa_do_verify */
+        nuron_dsa_mod_exp, /* dsa_mod_exp */
+        nuron_mod_exp_dsa, /* bn_mod_exp */
+        NULL, /* init */
+        NULL, /* finish */
+        0, /* flags */
+        NULL, /* app_data */
+        NULL, /* dsa_paramgen */
+        NULL /* dsa_keygen */
+        };
+#endif
+
+#ifndef OPENSSL_NO_DH
+static DH_METHOD nuron_dh =
+        {
+        "Nuron DH method",
+        NULL,
+        NULL,
+        nuron_mod_exp_dh,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL
+        };
+#endif
+
+/* Constants used when creating the ENGINE */
+static const char *engine_nuron_id = "nuron";
+static const char *engine_nuron_name = "Nuron hardware engine support";
+
+/* This internal function is used by ENGINE_nuron() and possibly by the
+ * "dynamic" ENGINE support too */
+static int bind_helper(ENGINE *e)
+        {
+#ifndef OPENSSL_NO_RSA
+        const RSA_METHOD *meth1;
+#endif
+#ifndef OPENSSL_NO_DSA
+        const DSA_METHOD *meth2;
+#endif
+#ifndef OPENSSL_NO_DH
+        const DH_METHOD *meth3;
+#endif
+        if(!ENGINE_set_id(e, engine_nuron_id) ||
+                        !ENGINE_set_name(e, engine_nuron_name) ||
+#ifndef OPENSSL_NO_RSA
+                        !ENGINE_set_RSA(e, &nuron_rsa) ||
+#endif
+#ifndef OPENSSL_NO_DSA
+                        !ENGINE_set_DSA(e, &nuron_dsa) ||
+#endif
+#ifndef OPENSSL_NO_DH
+                        !ENGINE_set_DH(e, &nuron_dh) ||
+#endif
+                        !ENGINE_set_destroy_function(e, nuron_destroy) ||
+                        !ENGINE_set_init_function(e, nuron_init) ||
+                        !ENGINE_set_finish_function(e, nuron_finish) ||
+                        !ENGINE_set_ctrl_function(e, nuron_ctrl) ||
+                        !ENGINE_set_cmd_defns(e, nuron_cmd_defns))
+                return 0;
+
+#ifndef OPENSSL_NO_RSA
+        /* We know that the "PKCS1_SSLeay()" functions hook properly
+         * to the nuron-specific mod_exp and mod_exp_crt so we use
+         * those functions. NB: We don't use ENGINE_openssl() or
+         * anything "more generic" because something like the RSAref
+         * code may not hook properly, and if you own one of these
+         * cards then you have the right to do RSA operations on it
+         * anyway! */ 
+        meth1=RSA_PKCS1_SSLeay();
+        nuron_rsa.rsa_pub_enc=meth1->rsa_pub_enc;
+        nuron_rsa.rsa_pub_dec=meth1->rsa_pub_dec;
+        nuron_rsa.rsa_priv_enc=meth1->rsa_priv_enc;
+        nuron_rsa.rsa_priv_dec=meth1->rsa_priv_dec;
+#endif
+
+#ifndef OPENSSL_NO_DSA
+        /* Use the DSA_OpenSSL() method and just hook the mod_exp-ish
+         * bits. */
+        meth2=DSA_OpenSSL();
+        nuron_dsa.dsa_do_sign=meth2->dsa_do_sign;
+        nuron_dsa.dsa_sign_setup=meth2->dsa_sign_setup;
+        nuron_dsa.dsa_do_verify=meth2->dsa_do_verify;
+#endif
+
+#ifndef OPENSSL_NO_DH
+        /* Much the same for Diffie-Hellman */
+        meth3=DH_OpenSSL();
+        nuron_dh.generate_key=meth3->generate_key;
+        nuron_dh.compute_key=meth3->compute_key;
+#endif
+
+        /* Ensure the nuron error handling is set up */
+        ERR_load_NURON_strings();
+        return 1;
+        }
+
+#ifdef OPENSSL_NO_DYNAMIC_ENGINE
+static ENGINE *engine_nuron(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!bind_helper(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_nuron(void)
+        {
+        /* Copied from eng_[openssl|dyn].c */
+        ENGINE *toadd = engine_nuron();
+        if(!toadd) return;
+        ENGINE_add(toadd);
+        ENGINE_free(toadd);
+        ERR_clear_error();
+        }
+#endif
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library. */      
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE
+static int bind_fn(ENGINE *e, const char *id)
+        {
+        if(id && (strcmp(id, engine_nuron_id) != 0))
+                return 0;
+        if(!bind_helper(e))
+                return 0;
+        return 1;
+        }       
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
+#endif /* OPENSSL_NO_DYNAMIC_ENGINE */
+
+#endif /* !OPENSSL_NO_HW_NURON */
+#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libssl/src/engines/e_nuron.ec b/src/lib/libssl/src/engines/e_nuron.ec
new file mode 100644
index 0000000000..cfa430dfcd
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_nuron.ec
@@ -0,0 +1 @@
+L NURON         e_nuron_err.h                   e_nuron_err.c
diff --git a/src/lib/libssl/src/engines/e_nuron_err.c b/src/lib/libssl/src/engines/e_nuron_err.c
new file mode 100644
index 0000000000..9a7864f42f
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_nuron_err.c
@@ -0,0 +1,146 @@
+/* e_nuron_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "e_nuron_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(0,func,0)
+#define ERR_REASON(reason) ERR_PACK(0,0,reason)
+
+static ERR_STRING_DATA NURON_str_functs[]=
+        {
+{ERR_FUNC(NURON_F_NURON_CTRL),  "NURON_CTRL"},
+{ERR_FUNC(NURON_F_NURON_FINISH),        "NURON_FINISH"},
+{ERR_FUNC(NURON_F_NURON_INIT),  "NURON_INIT"},
+{ERR_FUNC(NURON_F_NURON_MOD_EXP),       "NURON_MOD_EXP"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA NURON_str_reasons[]=
+        {
+{ERR_REASON(NURON_R_ALREADY_LOADED)      ,"already loaded"},
+{ERR_REASON(NURON_R_CTRL_COMMAND_NOT_IMPLEMENTED),"ctrl command not implemented"},
+{ERR_REASON(NURON_R_DSO_FAILURE)         ,"dso failure"},
+{ERR_REASON(NURON_R_DSO_FUNCTION_NOT_FOUND),"dso function not found"},
+{ERR_REASON(NURON_R_DSO_NOT_FOUND)       ,"dso not found"},
+{ERR_REASON(NURON_R_NOT_LOADED)          ,"not loaded"},
+{0,NULL}
+        };
+
+#endif
+
+#ifdef NURON_LIB_NAME
+static ERR_STRING_DATA NURON_lib_name[]=
+        {
+{0      ,NURON_LIB_NAME},
+{0,NULL}
+        };
+#endif
+
+
+static int NURON_lib_error_code=0;
+static int NURON_error_init=1;
+
+static void ERR_load_NURON_strings(void)
+        {
+        if (NURON_lib_error_code == 0)
+                NURON_lib_error_code=ERR_get_next_error_library();
+
+        if (NURON_error_init)
+                {
+                NURON_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(NURON_lib_error_code,NURON_str_functs);
+                ERR_load_strings(NURON_lib_error_code,NURON_str_reasons);
+#endif
+
+#ifdef NURON_LIB_NAME
+                NURON_lib_name->error = ERR_PACK(NURON_lib_error_code,0,0);
+                ERR_load_strings(0,NURON_lib_name);
+#endif
+                }
+        }
+
+static void ERR_unload_NURON_strings(void)
+        {
+        if (NURON_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(NURON_lib_error_code,NURON_str_functs);
+                ERR_unload_strings(NURON_lib_error_code,NURON_str_reasons);
+#endif
+
+#ifdef NURON_LIB_NAME
+                ERR_unload_strings(0,NURON_lib_name);
+#endif
+                NURON_error_init=1;
+                }
+        }
+
+static void ERR_NURON_error(int function, int reason, char *file, int line)
+        {
+        if (NURON_lib_error_code == 0)
+                NURON_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(NURON_lib_error_code,function,reason,file,line);
+        }
diff --git a/src/lib/libssl/src/engines/e_nuron_err.h b/src/lib/libssl/src/engines/e_nuron_err.h
new file mode 100644
index 0000000000..219babbb45
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_nuron_err.h
@@ -0,0 +1,90 @@
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_NURON_ERR_H
+#define HEADER_NURON_ERR_H
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_NURON_strings(void);
+static void ERR_unload_NURON_strings(void);
+static void ERR_NURON_error(int function, int reason, char *file, int line);
+#define NURONerr(f,r) ERR_NURON_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the NURON functions. */
+
+/* Function codes. */
+#define NURON_F_NURON_CTRL                               100
+#define NURON_F_NURON_FINISH                             101
+#define NURON_F_NURON_INIT                               102
+#define NURON_F_NURON_MOD_EXP                            103
+
+/* Reason codes. */
+#define NURON_R_ALREADY_LOADED                           100
+#define NURON_R_CTRL_COMMAND_NOT_IMPLEMENTED             101
+#define NURON_R_DSO_FAILURE                              102
+#define NURON_R_DSO_FUNCTION_NOT_FOUND                   103
+#define NURON_R_DSO_NOT_FOUND                            104
+#define NURON_R_NOT_LOADED                               105
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/engines/e_sureware.c b/src/lib/libssl/src/engines/e_sureware.c
new file mode 100644
index 0000000000..58fa9a98ee
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_sureware.c
@@ -0,0 +1,1057 @@
+/* Written by Corinne Dive-Reclus(cdive@baltimore.com)
+* 
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions
+* are met:
+*
+* 1. Redistributions of source code must retain the above copyright
+*    notice, this list of conditions and the following disclaimer. 
+*
+* 2. Redistributions in binary form must reproduce the above copyright
+*    notice, this list of conditions and the following disclaimer in
+*    the documentation and/or other materials provided with the
+*    distribution.
+*
+* 3. All advertising materials mentioning features or use of this
+*    software must display the following acknowledgment:
+*    "This product includes software developed by the OpenSSL Project
+*    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+*
+* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+*    endorse or promote products derived from this software without
+*    prior written permission. For written permission, please contact
+*    licensing@OpenSSL.org.
+*
+* 5. Products derived from this software may not be called "OpenSSL"
+*    nor may "OpenSSL" appear in their names without prior written
+*    permission of the OpenSSL Project.
+*
+* 6. Redistributions of any form whatsoever must retain the following
+*    acknowledgment:
+*    "This product includes software developed by the OpenSSL Project
+*    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+*
+* Written by Corinne Dive-Reclus(cdive@baltimore.com)
+*
+* Copyright@2001 Baltimore Technologies Ltd.
+* All right Reserved.
+*                                                                                                                                                                                               *       
+*               THIS FILE IS PROVIDED BY BALTIMORE TECHNOLOGIES ``AS IS'' AND                                                                                                                                                   *
+*               ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE                                   * 
+*               IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE                              *
+*               ARE DISCLAIMED.  IN NO EVENT SHALL BALTIMORE TECHNOLOGIES BE LIABLE                                             *
+*               FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL                              *
+*               DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS                                 *
+*               OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)                                   *
+*               HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT                              *
+*               LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY                               *
+*               OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF                                  *
+*               SUCH DAMAGE.                                                                                                                                                    *
+====================================================================*/
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/crypto.h>
+#include <openssl/pem.h>
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+#include <openssl/rand.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_SUREWARE
+
+#ifdef FLAT_INC
+#include "sureware.h"
+#else
+#include "vendor_defns/sureware.h"
+#endif
+
+#define SUREWARE_LIB_NAME "sureware engine"
+#include "e_sureware_err.c"
+
+static int surewarehk_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void));
+static int surewarehk_destroy(ENGINE *e);
+static int surewarehk_init(ENGINE *e);
+static int surewarehk_finish(ENGINE *e);
+static int surewarehk_modexp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        const BIGNUM *m, BN_CTX *ctx);
+
+/* RSA stuff */
+#ifndef OPENSSL_NO_RSA
+static int surewarehk_rsa_priv_dec(int flen,const unsigned char *from,unsigned char *to,
+                        RSA *rsa,int padding);
+static int surewarehk_rsa_sign(int flen,const unsigned char *from,unsigned char *to,
+                            RSA *rsa,int padding);
+#endif
+
+/* RAND stuff */
+static int surewarehk_rand_bytes(unsigned char *buf, int num);
+static void surewarehk_rand_seed(const void *buf, int num);
+static void surewarehk_rand_add(const void *buf, int num, double entropy);
+
+/* KM stuff */
+static EVP_PKEY *surewarehk_load_privkey(ENGINE *e, const char *key_id,
+        UI_METHOD *ui_method, void *callback_data);
+static EVP_PKEY *surewarehk_load_pubkey(ENGINE *e, const char *key_id,
+        UI_METHOD *ui_method, void *callback_data);
+static void surewarehk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
+        int idx,long argl, void *argp);
+#if 0
+static void surewarehk_dh_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
+        int idx,long argl, void *argp);
+#endif
+
+#ifndef OPENSSL_NO_RSA
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int surewarehk_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+{
+        return surewarehk_modexp(r, a, p, m, ctx);
+}
+
+/* Our internal RSA_METHOD that we provide pointers to */
+static RSA_METHOD surewarehk_rsa =
+        {
+        "SureWare RSA method",
+        NULL, /* pub_enc*/
+        NULL, /* pub_dec*/
+        surewarehk_rsa_sign, /* our rsa_sign is OpenSSL priv_enc*/
+        surewarehk_rsa_priv_dec, /* priv_dec*/
+        NULL, /*mod_exp*/
+        surewarehk_mod_exp_mont, /*mod_exp_mongomery*/
+        NULL, /* init*/
+        NULL, /* finish*/
+        0,      /* RSA flag*/
+        NULL, 
+        NULL, /* OpenSSL sign*/
+        NULL, /* OpenSSL verify*/
+        NULL  /* keygen */
+        };
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* Our internal DH_METHOD that we provide pointers to */
+/* This function is aliased to mod_exp (with the dh and mont dropped). */
+static int surewarehk_modexp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
+        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+{
+        return surewarehk_modexp(r, a, p, m, ctx);
+}
+
+static DH_METHOD surewarehk_dh =
+        {
+        "SureWare DH method",
+        NULL,/*gen_key*/
+        NULL,/*agree,*/
+        surewarehk_modexp_dh, /*dh mod exp*/
+        NULL, /* init*/
+        NULL, /* finish*/
+        0,    /* flags*/
+        NULL,
+        NULL
+        };
+#endif
+
+static RAND_METHOD surewarehk_rand =
+        {
+        /* "SureWare RAND method", */
+        surewarehk_rand_seed,
+        surewarehk_rand_bytes,
+        NULL,/*cleanup*/
+        surewarehk_rand_add,
+        surewarehk_rand_bytes,
+        NULL,/*rand_status*/
+        };
+
+#ifndef OPENSSL_NO_DSA
+/* DSA stuff */
+static  DSA_SIG * surewarehk_dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+static int surewarehk_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+                BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+                BN_CTX *ctx, BN_MONT_CTX *in_mont)
+{
+        BIGNUM t;
+        int to_return = 0;
+        BN_init(&t);
+        /* let rr = a1 ^ p1 mod m */
+        if (!surewarehk_modexp(rr,a1,p1,m,ctx)) goto end;
+        /* let t = a2 ^ p2 mod m */
+        if (!surewarehk_modexp(&t,a2,p2,m,ctx)) goto end;
+        /* let rr = rr * t mod m */
+        if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
+        to_return = 1;
+end:
+        BN_free(&t);
+        return to_return;
+}
+
+static DSA_METHOD surewarehk_dsa =
+        {
+         "SureWare DSA method", 
+        surewarehk_dsa_do_sign,
+        NULL,/*sign setup*/
+        NULL,/*verify,*/
+        surewarehk_dsa_mod_exp,/*mod exp*/
+        NULL,/*bn mod exp*/
+        NULL, /*init*/
+        NULL,/*finish*/
+        0,
+        NULL,
+        NULL,
+        NULL
+        };
+#endif
+
+static const char *engine_sureware_id = "sureware";
+static const char *engine_sureware_name = "SureWare hardware engine support";
+
+/* Now, to our own code */
+
+/* As this is only ever called once, there's no need for locking
+ * (indeed - the lock will already be held by our caller!!!) */
+static int bind_sureware(ENGINE *e)
+{
+#ifndef OPENSSL_NO_RSA
+        const RSA_METHOD *meth1;
+#endif
+#ifndef OPENSSL_NO_DSA
+        const DSA_METHOD *meth2;
+#endif
+#ifndef OPENSSL_NO_DH
+        const DH_METHOD *meth3;
+#endif
+
+        if(!ENGINE_set_id(e, engine_sureware_id) ||
+           !ENGINE_set_name(e, engine_sureware_name) ||
+#ifndef OPENSSL_NO_RSA
+           !ENGINE_set_RSA(e, &surewarehk_rsa) ||
+#endif
+#ifndef OPENSSL_NO_DSA
+           !ENGINE_set_DSA(e, &surewarehk_dsa) ||
+#endif
+#ifndef OPENSSL_NO_DH
+           !ENGINE_set_DH(e, &surewarehk_dh) ||
+#endif
+           !ENGINE_set_RAND(e, &surewarehk_rand) ||
+           !ENGINE_set_destroy_function(e, surewarehk_destroy) ||
+           !ENGINE_set_init_function(e, surewarehk_init) ||
+           !ENGINE_set_finish_function(e, surewarehk_finish) ||
+           !ENGINE_set_ctrl_function(e, surewarehk_ctrl) ||
+           !ENGINE_set_load_privkey_function(e, surewarehk_load_privkey) ||
+           !ENGINE_set_load_pubkey_function(e, surewarehk_load_pubkey))
+          return 0;
+
+#ifndef OPENSSL_NO_RSA
+        /* We know that the "PKCS1_SSLeay()" functions hook properly
+         * to the cswift-specific mod_exp and mod_exp_crt so we use
+         * those functions. NB: We don't use ENGINE_openssl() or
+         * anything "more generic" because something like the RSAref
+         * code may not hook properly, and if you own one of these
+         * cards then you have the right to do RSA operations on it
+         * anyway! */ 
+        meth1 = RSA_PKCS1_SSLeay();
+        if (meth1)
+        {
+                surewarehk_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
+                surewarehk_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
+        }
+#endif
+
+#ifndef OPENSSL_NO_DSA
+        /* Use the DSA_OpenSSL() method and just hook the mod_exp-ish
+         * bits. */
+        meth2 = DSA_OpenSSL();
+        if (meth2)
+        {
+                surewarehk_dsa.dsa_do_verify = meth2->dsa_do_verify;
+        }
+#endif
+
+#ifndef OPENSSL_NO_DH
+        /* Much the same for Diffie-Hellman */
+        meth3 = DH_OpenSSL();
+        if (meth3)
+        {
+                surewarehk_dh.generate_key = meth3->generate_key;
+                surewarehk_dh.compute_key = meth3->compute_key;
+        }
+#endif
+
+        /* Ensure the sureware error handling is set up */
+        ERR_load_SUREWARE_strings();
+        return 1;
+}
+
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE
+static int bind_helper(ENGINE *e, const char *id)
+        {
+        if(id && (strcmp(id, engine_sureware_id) != 0))
+                return 0;
+        if(!bind_sureware(e))
+                return 0;
+        return 1;
+        }       
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)
+#else
+static ENGINE *engine_sureware(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!bind_sureware(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_sureware(void)
+        {
+        /* Copied from eng_[openssl|dyn].c */
+        ENGINE *toadd = engine_sureware();
+        if(!toadd) return;
+        ENGINE_add(toadd);
+        ENGINE_free(toadd);
+        ERR_clear_error();
+        }
+#endif
+
+/* This is a process-global DSO handle used for loading and unloading
+ * the SureWareHook library. NB: This is only set (or unset) during an
+ * init() or finish() call (reference counts permitting) and they're
+ * operating with global locks, so this should be thread-safe
+ * implicitly. */
+static DSO *surewarehk_dso = NULL;
+#ifndef OPENSSL_NO_RSA
+static int rsaHndidx = -1;      /* Index for KM handle.  Not really used yet. */
+#endif
+#ifndef OPENSSL_NO_DSA
+static int dsaHndidx = -1;      /* Index for KM handle.  Not really used yet. */
+#endif
+
+/* These are the function pointers that are (un)set when the library has
+ * successfully (un)loaded. */
+static SureWareHook_Init_t *p_surewarehk_Init = NULL;
+static SureWareHook_Finish_t *p_surewarehk_Finish = NULL;
+static SureWareHook_Rand_Bytes_t *p_surewarehk_Rand_Bytes = NULL;
+static SureWareHook_Rand_Seed_t *p_surewarehk_Rand_Seed = NULL;
+static SureWareHook_Load_Privkey_t *p_surewarehk_Load_Privkey = NULL;
+static SureWareHook_Info_Pubkey_t *p_surewarehk_Info_Pubkey = NULL;
+static SureWareHook_Load_Rsa_Pubkey_t *p_surewarehk_Load_Rsa_Pubkey = NULL;
+static SureWareHook_Load_Dsa_Pubkey_t *p_surewarehk_Load_Dsa_Pubkey = NULL;
+static SureWareHook_Free_t *p_surewarehk_Free=NULL;
+static SureWareHook_Rsa_Priv_Dec_t *p_surewarehk_Rsa_Priv_Dec=NULL;
+static SureWareHook_Rsa_Sign_t *p_surewarehk_Rsa_Sign=NULL;
+static SureWareHook_Dsa_Sign_t *p_surewarehk_Dsa_Sign=NULL;
+static SureWareHook_Mod_Exp_t *p_surewarehk_Mod_Exp=NULL;
+
+/* Used in the DSO operations. */
+static const char *surewarehk_LIBNAME = "SureWareHook";
+static const char *n_surewarehk_Init = "SureWareHook_Init";
+static const char *n_surewarehk_Finish = "SureWareHook_Finish";
+static const char *n_surewarehk_Rand_Bytes="SureWareHook_Rand_Bytes";
+static const char *n_surewarehk_Rand_Seed="SureWareHook_Rand_Seed";
+static const char *n_surewarehk_Load_Privkey="SureWareHook_Load_Privkey";
+static const char *n_surewarehk_Info_Pubkey="SureWareHook_Info_Pubkey";
+static const char *n_surewarehk_Load_Rsa_Pubkey="SureWareHook_Load_Rsa_Pubkey";
+static const char *n_surewarehk_Load_Dsa_Pubkey="SureWareHook_Load_Dsa_Pubkey";
+static const char *n_surewarehk_Free="SureWareHook_Free";
+static const char *n_surewarehk_Rsa_Priv_Dec="SureWareHook_Rsa_Priv_Dec";
+static const char *n_surewarehk_Rsa_Sign="SureWareHook_Rsa_Sign";
+static const char *n_surewarehk_Dsa_Sign="SureWareHook_Dsa_Sign";
+static const char *n_surewarehk_Mod_Exp="SureWareHook_Mod_Exp";
+static BIO *logstream = NULL;
+
+/* SureWareHook library functions and mechanics - these are used by the
+ * higher-level functions further down. NB: As and where there's no
+ * error checking, take a look lower down where these functions are
+ * called, the checking and error handling is probably down there. 
+*/
+static int threadsafe=1;
+static int surewarehk_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+{
+        int to_return = 1;
+
+        switch(cmd)
+        {
+                case ENGINE_CTRL_SET_LOGSTREAM:
+                {
+                        BIO *bio = (BIO *)p;
+                        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+                        if (logstream)
+                        {
+                                BIO_free(logstream);
+                                logstream = NULL;
+                        }
+                        if (CRYPTO_add(&bio->references,1,CRYPTO_LOCK_BIO) > 1)
+                                logstream = bio;
+                        else
+                                SUREWAREerr(SUREWARE_F_SUREWAREHK_CTRL,SUREWARE_R_BIO_WAS_FREED);
+                }
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                break;
+        /* This will prevent the initialisation function from "installing"
+         * the mutex-handling callbacks, even if they are available from
+         * within the library (or were provided to the library from the
+         * calling application). This is to remove any baggage for
+         * applications not using multithreading. */
+        case ENGINE_CTRL_CHIL_NO_LOCKING:
+                CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+                threadsafe = 0;
+                CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+                break;
+
+        /* The command isn't understood by this engine */
+        default:
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_CTRL,
+                        ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+                to_return = 0;
+                break;
+                }
+
+        return to_return;
+}
+
+/* Destructor (complements the "ENGINE_surewarehk()" constructor) */
+static int surewarehk_destroy(ENGINE *e)
+{
+        ERR_unload_SUREWARE_strings();
+        return 1;
+}
+
+/* (de)initialisation functions. */
+static int surewarehk_init(ENGINE *e)
+{
+        char msg[64]="ENGINE_init";
+        SureWareHook_Init_t *p1=NULL;
+        SureWareHook_Finish_t *p2=NULL;
+        SureWareHook_Rand_Bytes_t *p3=NULL;
+        SureWareHook_Rand_Seed_t *p4=NULL;
+        SureWareHook_Load_Privkey_t *p5=NULL;
+        SureWareHook_Load_Rsa_Pubkey_t *p6=NULL;
+        SureWareHook_Free_t *p7=NULL;
+        SureWareHook_Rsa_Priv_Dec_t *p8=NULL;
+        SureWareHook_Rsa_Sign_t *p9=NULL;
+        SureWareHook_Dsa_Sign_t *p12=NULL;
+        SureWareHook_Info_Pubkey_t *p13=NULL;
+        SureWareHook_Load_Dsa_Pubkey_t *p14=NULL;
+        SureWareHook_Mod_Exp_t *p15=NULL;
+
+        if(surewarehk_dso != NULL)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,ENGINE_R_ALREADY_LOADED);
+                goto err;
+        }
+        /* Attempt to load libsurewarehk.so/surewarehk.dll/whatever. */
+        surewarehk_dso = DSO_load(NULL, surewarehk_LIBNAME, NULL, 0);
+        if(surewarehk_dso == NULL)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,ENGINE_R_DSO_FAILURE);
+                goto err;
+        }
+        if(!(p1=(SureWareHook_Init_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Init)) ||
+           !(p2=(SureWareHook_Finish_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Finish)) ||
+           !(p3=(SureWareHook_Rand_Bytes_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rand_Bytes)) ||
+           !(p4=(SureWareHook_Rand_Seed_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rand_Seed)) ||
+           !(p5=(SureWareHook_Load_Privkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Load_Privkey)) ||
+           !(p6=(SureWareHook_Load_Rsa_Pubkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Load_Rsa_Pubkey)) ||
+           !(p7=(SureWareHook_Free_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Free)) ||
+           !(p8=(SureWareHook_Rsa_Priv_Dec_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rsa_Priv_Dec)) ||
+           !(p9=(SureWareHook_Rsa_Sign_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rsa_Sign)) ||
+           !(p12=(SureWareHook_Dsa_Sign_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Dsa_Sign)) ||
+           !(p13=(SureWareHook_Info_Pubkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Info_Pubkey)) ||
+           !(p14=(SureWareHook_Load_Dsa_Pubkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Load_Dsa_Pubkey)) ||
+           !(p15=(SureWareHook_Mod_Exp_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Mod_Exp)))
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,ENGINE_R_DSO_FAILURE);
+                goto err;
+        }
+        /* Copy the pointers */
+        p_surewarehk_Init = p1;
+        p_surewarehk_Finish = p2;
+        p_surewarehk_Rand_Bytes = p3;
+        p_surewarehk_Rand_Seed = p4;
+        p_surewarehk_Load_Privkey = p5;
+        p_surewarehk_Load_Rsa_Pubkey = p6;
+        p_surewarehk_Free = p7;
+        p_surewarehk_Rsa_Priv_Dec = p8;
+        p_surewarehk_Rsa_Sign = p9;
+        p_surewarehk_Dsa_Sign = p12;
+        p_surewarehk_Info_Pubkey = p13;
+        p_surewarehk_Load_Dsa_Pubkey = p14;
+        p_surewarehk_Mod_Exp = p15;
+        /* Contact the hardware and initialises it. */
+        if(p_surewarehk_Init(msg,threadsafe)==SUREWAREHOOK_ERROR_UNIT_FAILURE)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,SUREWARE_R_UNIT_FAILURE);
+                goto err;
+        }
+        if(p_surewarehk_Init(msg,threadsafe)==SUREWAREHOOK_ERROR_UNIT_FAILURE)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,SUREWARE_R_UNIT_FAILURE);
+                goto err;
+        }
+        /* try to load the default private key, if failed does not return a failure but
+           wait for an explicit ENGINE_load_privakey */
+        surewarehk_load_privkey(e,NULL,NULL,NULL);
+
+        /* Everything's fine. */
+#ifndef OPENSSL_NO_RSA
+        if (rsaHndidx == -1)
+                rsaHndidx = RSA_get_ex_new_index(0,
+                                                "SureWareHook RSA key handle",
+                                                NULL, NULL, surewarehk_ex_free);
+#endif
+#ifndef OPENSSL_NO_DSA
+        if (dsaHndidx == -1)
+                dsaHndidx = DSA_get_ex_new_index(0,
+                                                "SureWareHook DSA key handle",
+                                                NULL, NULL, surewarehk_ex_free);
+#endif
+
+        return 1;
+err:
+        if(surewarehk_dso)
+                DSO_free(surewarehk_dso);
+        surewarehk_dso = NULL;
+        p_surewarehk_Init = NULL;
+        p_surewarehk_Finish = NULL;
+        p_surewarehk_Rand_Bytes = NULL;
+        p_surewarehk_Rand_Seed = NULL;
+        p_surewarehk_Load_Privkey = NULL;
+        p_surewarehk_Load_Rsa_Pubkey = NULL;
+        p_surewarehk_Free = NULL;
+        p_surewarehk_Rsa_Priv_Dec = NULL;
+        p_surewarehk_Rsa_Sign = NULL;
+        p_surewarehk_Dsa_Sign = NULL;
+        p_surewarehk_Info_Pubkey = NULL;
+        p_surewarehk_Load_Dsa_Pubkey = NULL;
+        p_surewarehk_Mod_Exp = NULL;
+        return 0;
+}
+
+static int surewarehk_finish(ENGINE *e)
+{
+        int to_return = 1;
+        if(surewarehk_dso == NULL)
+                {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_FINISH,ENGINE_R_NOT_LOADED);
+                to_return = 0;
+                goto err;
+                }
+        p_surewarehk_Finish();
+        if(!DSO_free(surewarehk_dso))
+                {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_FINISH,ENGINE_R_DSO_FAILURE);
+                to_return = 0;
+                goto err;
+                }
+ err:
+        if (logstream)
+                BIO_free(logstream);
+        surewarehk_dso = NULL;
+        p_surewarehk_Init = NULL;
+        p_surewarehk_Finish = NULL;
+        p_surewarehk_Rand_Bytes = NULL;
+        p_surewarehk_Rand_Seed = NULL;
+        p_surewarehk_Load_Privkey = NULL;
+        p_surewarehk_Load_Rsa_Pubkey = NULL;
+        p_surewarehk_Free = NULL;
+        p_surewarehk_Rsa_Priv_Dec = NULL;
+        p_surewarehk_Rsa_Sign = NULL;
+        p_surewarehk_Dsa_Sign = NULL;
+        p_surewarehk_Info_Pubkey = NULL;
+        p_surewarehk_Load_Dsa_Pubkey = NULL;
+        p_surewarehk_Mod_Exp = NULL;
+        return to_return;
+}
+
+static void surewarehk_error_handling(char *const msg,int func,int ret)
+{
+        switch (ret)
+        {
+                case SUREWAREHOOK_ERROR_UNIT_FAILURE:
+                        ENGINEerr(func,SUREWARE_R_UNIT_FAILURE);
+                        break;
+                case SUREWAREHOOK_ERROR_FALLBACK:
+                        ENGINEerr(func,SUREWARE_R_REQUEST_FALLBACK);
+                        break;
+                case SUREWAREHOOK_ERROR_DATA_SIZE:
+                        ENGINEerr(func,SUREWARE_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
+                        break;
+                case SUREWAREHOOK_ERROR_INVALID_PAD:
+                        ENGINEerr(func,SUREWARE_R_PADDING_CHECK_FAILED);
+                        break;
+                default:
+                        ENGINEerr(func,SUREWARE_R_REQUEST_FAILED);
+                        break;
+                case 1:/*nothing*/
+                        msg[0]='\0';
+        }
+        if (*msg)
+        {
+                ERR_add_error_data(1,msg);
+                if (logstream)
+                {
+                        CRYPTO_w_lock(CRYPTO_LOCK_BIO);
+                        BIO_write(logstream, msg, strlen(msg));
+                        CRYPTO_w_unlock(CRYPTO_LOCK_BIO);
+                }
+        }
+}
+
+static int surewarehk_rand_bytes(unsigned char *buf, int num)
+{
+        int ret=0;
+        char msg[64]="ENGINE_rand_bytes";
+        if(!p_surewarehk_Rand_Bytes)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_RAND_BYTES,ENGINE_R_NOT_INITIALISED);
+        }
+        else
+        {
+                ret = p_surewarehk_Rand_Bytes(msg,buf, num);
+                surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RAND_BYTES,ret);
+        }
+        return ret==1 ? 1 : 0;
+}
+
+static void surewarehk_rand_seed(const void *buf, int num)
+{
+        int ret=0;
+        char msg[64]="ENGINE_rand_seed";
+        if(!p_surewarehk_Rand_Seed)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_RAND_SEED,ENGINE_R_NOT_INITIALISED);
+        }
+        else
+        {
+                ret = p_surewarehk_Rand_Seed(msg,buf, num);
+                surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RAND_SEED,ret);
+        }
+}
+
+static void surewarehk_rand_add(const void *buf, int num, double entropy)
+{
+        surewarehk_rand_seed(buf,num);
+}
+
+static EVP_PKEY* sureware_load_public(ENGINE *e,const char *key_id,char *hptr,unsigned long el,char keytype)
+{
+        EVP_PKEY *res = NULL;
+#ifndef OPENSSL_NO_RSA
+        RSA *rsatmp = NULL;
+#endif
+#ifndef OPENSSL_NO_DSA
+        DSA *dsatmp=NULL;
+#endif
+        char msg[64]="sureware_load_public";
+        int ret=0;
+        if(!p_surewarehk_Load_Rsa_Pubkey || !p_surewarehk_Load_Dsa_Pubkey)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWARE_LOAD_PUBLIC,ENGINE_R_NOT_INITIALISED);
+                goto err;
+        }
+        switch (keytype)
+        {
+#ifndef OPENSSL_NO_RSA
+        case 1: /*RSA*/
+                /* set private external reference */
+                rsatmp = RSA_new_method(e);
+                RSA_set_ex_data(rsatmp,rsaHndidx,hptr);
+                rsatmp->flags |= RSA_FLAG_EXT_PKEY;
+
+                /* set public big nums*/
+                rsatmp->e = BN_new();
+                rsatmp->n = BN_new();
+                bn_expand2(rsatmp->e, el/sizeof(BN_ULONG));
+                bn_expand2(rsatmp->n, el/sizeof(BN_ULONG));
+                if (!rsatmp->e || rsatmp->e->dmax!=(int)(el/sizeof(BN_ULONG))|| 
+                        !rsatmp->n || rsatmp->n->dmax!=(int)(el/sizeof(BN_ULONG)))
+                        goto err;
+                ret=p_surewarehk_Load_Rsa_Pubkey(msg,key_id,el,
+                                                 (unsigned long *)rsatmp->n->d,
+                                                 (unsigned long *)rsatmp->e->d);
+                surewarehk_error_handling(msg,SUREWARE_F_SUREWARE_LOAD_PUBLIC,ret);
+                if (ret!=1)
+                {
+                        SUREWAREerr(SUREWARE_F_SUREWARE_LOAD_PUBLIC,ENGINE_R_FAILED_LOADING_PUBLIC_KEY);
+                        goto err;
+                }
+                /* normalise pub e and pub n */
+                rsatmp->e->top=el/sizeof(BN_ULONG);
+                bn_fix_top(rsatmp->e);
+                rsatmp->n->top=el/sizeof(BN_ULONG);
+                bn_fix_top(rsatmp->n);
+                /* create an EVP object: engine + rsa key */
+                res = EVP_PKEY_new();
+                EVP_PKEY_assign_RSA(res, rsatmp);
+                break;
+#endif
+
+#ifndef OPENSSL_NO_DSA
+        case 2:/*DSA*/
+                /* set private/public external reference */
+                dsatmp = DSA_new_method(e);
+                DSA_set_ex_data(dsatmp,dsaHndidx,hptr);
+                /*dsatmp->flags |= DSA_FLAG_EXT_PKEY;*/
+
+                /* set public key*/
+                dsatmp->pub_key = BN_new();
+                dsatmp->p = BN_new();
+                dsatmp->q = BN_new();
+                dsatmp->g = BN_new();
+                bn_expand2(dsatmp->pub_key, el/sizeof(BN_ULONG));
+                bn_expand2(dsatmp->p, el/sizeof(BN_ULONG));
+                bn_expand2(dsatmp->q, 20/sizeof(BN_ULONG));
+                bn_expand2(dsatmp->g, el/sizeof(BN_ULONG));
+                if (!dsatmp->pub_key || dsatmp->pub_key->dmax!=(int)(el/sizeof(BN_ULONG))|| 
+                        !dsatmp->p || dsatmp->p->dmax!=(int)(el/sizeof(BN_ULONG)) ||
+                        !dsatmp->q || dsatmp->q->dmax!=20/sizeof(BN_ULONG) ||
+                        !dsatmp->g || dsatmp->g->dmax!=(int)(el/sizeof(BN_ULONG)))
+                        goto err;
+
+                ret=p_surewarehk_Load_Dsa_Pubkey(msg,key_id,el,
+                                                 (unsigned long *)dsatmp->pub_key->d, 
+                                                 (unsigned long *)dsatmp->p->d,
+                                                 (unsigned long *)dsatmp->q->d,
+                                                 (unsigned long *)dsatmp->g->d);
+                surewarehk_error_handling(msg,SUREWARE_F_SUREWARE_LOAD_PUBLIC,ret);
+                if (ret!=1)
+                {
+                        SUREWAREerr(SUREWARE_F_SUREWARE_LOAD_PUBLIC,ENGINE_R_FAILED_LOADING_PUBLIC_KEY);
+                        goto err;
+                }
+                /* set parameters */
+                /* normalise pubkey and parameters in case of */
+                dsatmp->pub_key->top=el/sizeof(BN_ULONG);
+                bn_fix_top(dsatmp->pub_key);
+                dsatmp->p->top=el/sizeof(BN_ULONG);
+                bn_fix_top(dsatmp->p);
+                dsatmp->q->top=20/sizeof(BN_ULONG);
+                bn_fix_top(dsatmp->q);
+                dsatmp->g->top=el/sizeof(BN_ULONG);
+                bn_fix_top(dsatmp->g);
+
+                /* create an EVP object: engine + rsa key */
+                res = EVP_PKEY_new();
+                EVP_PKEY_assign_DSA(res, dsatmp);
+                break;
+#endif
+
+        default:
+                SUREWAREerr(SUREWARE_F_SUREWARE_LOAD_PUBLIC,ENGINE_R_FAILED_LOADING_PRIVATE_KEY);
+                goto err;
+        }
+        return res;
+ err:
+        if (res)
+                EVP_PKEY_free(res);
+#ifndef OPENSSL_NO_RSA
+        if (rsatmp)
+                RSA_free(rsatmp);
+#endif
+#ifndef OPENSSL_NO_DSA
+        if (dsatmp)
+                DSA_free(dsatmp);
+#endif
+        return NULL;
+}
+
+static EVP_PKEY *surewarehk_load_privkey(ENGINE *e, const char *key_id,
+                                         UI_METHOD *ui_method, void *callback_data)
+{
+        EVP_PKEY *res = NULL;
+        int ret=0;
+        unsigned long el=0;
+        char *hptr=NULL;
+        char keytype=0;
+        char msg[64]="ENGINE_load_privkey";
+
+        if(!p_surewarehk_Load_Privkey)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PRIVKEY,ENGINE_R_NOT_INITIALISED);
+        }
+        else
+        {
+                ret=p_surewarehk_Load_Privkey(msg,key_id,&hptr,&el,&keytype);
+                if (ret!=1)
+                {
+                        SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PRIVKEY,ENGINE_R_FAILED_LOADING_PRIVATE_KEY);
+                        ERR_add_error_data(1,msg);              
+                }
+                else
+                        res=sureware_load_public(e,key_id,hptr,el,keytype);
+        }
+        return res;
+}
+
+static EVP_PKEY *surewarehk_load_pubkey(ENGINE *e, const char *key_id,
+                                         UI_METHOD *ui_method, void *callback_data)
+{
+        EVP_PKEY *res = NULL;
+        int ret=0;
+        unsigned long el=0;
+        char *hptr=NULL;
+        char keytype=0;
+        char msg[64]="ENGINE_load_pubkey";
+
+        if(!p_surewarehk_Info_Pubkey)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PUBKEY,ENGINE_R_NOT_INITIALISED);
+        }
+        else
+        {
+                /* call once to identify if DSA or RSA */
+                ret=p_surewarehk_Info_Pubkey(msg,key_id,&el,&keytype);
+                if (ret!=1)
+                {
+                        SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PUBKEY,ENGINE_R_FAILED_LOADING_PUBLIC_KEY);
+                        ERR_add_error_data(1,msg);
+                }
+                else
+                        res=sureware_load_public(e,key_id,hptr,el,keytype);
+        }
+        return res;
+}
+
+/* This cleans up an RSA/DSA KM key(do not destroy the key into the hardware)
+, called when ex_data is freed */
+static void surewarehk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
+        int idx,long argl, void *argp)
+{
+        if(!p_surewarehk_Free)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_EX_FREE,ENGINE_R_NOT_INITIALISED);
+        }
+        else
+                p_surewarehk_Free((char *)item,0);
+}
+
+#if 0
+/* not currently used (bug?) */
+/* This cleans up an DH KM key (destroys the key into hardware), 
+called when ex_data is freed */
+static void surewarehk_dh_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
+        int idx,long argl, void *argp)
+{
+        if(!p_surewarehk_Free)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_DH_EX_FREE,ENGINE_R_NOT_INITIALISED);
+        }
+        else
+                p_surewarehk_Free((char *)item,1);
+}
+#endif
+
+/*
+* return number of decrypted bytes
+*/
+#ifndef OPENSSL_NO_RSA
+static int surewarehk_rsa_priv_dec(int flen,const unsigned char *from,unsigned char *to,
+                        RSA *rsa,int padding)
+{
+        int ret=0,tlen;
+        char *buf=NULL,*hptr=NULL;
+        char msg[64]="ENGINE_rsa_priv_dec";
+        if (!p_surewarehk_Rsa_Priv_Dec)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,ENGINE_R_NOT_INITIALISED);
+        }
+        /* extract ref to private key */
+        else if (!(hptr=RSA_get_ex_data(rsa, rsaHndidx)))
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,SUREWARE_R_MISSING_KEY_COMPONENTS);
+                goto err;
+        }
+        /* analyse what padding we can do into the hardware */
+        if (padding==RSA_PKCS1_PADDING)
+        {
+                /* do it one shot */
+                ret=p_surewarehk_Rsa_Priv_Dec(msg,flen,(unsigned char *)from,&tlen,to,hptr,SUREWARE_PKCS1_PAD);
+                surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,ret);
+                if (ret!=1)
+                        goto err;
+                ret=tlen;
+        }
+        else /* do with no padding into hardware */
+        {
+                ret=p_surewarehk_Rsa_Priv_Dec(msg,flen,(unsigned char *)from,&tlen,to,hptr,SUREWARE_NO_PAD);
+                surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,ret);
+                if (ret!=1)
+                        goto err;
+                /* intermediate buffer for padding */
+                if ((buf=OPENSSL_malloc(tlen)) == NULL)
+                {
+                        SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                }
+                memcpy(buf,to,tlen);/* transfert to into buf */
+                switch (padding) /* check padding in software */
+                {
+#ifndef OPENSSL_NO_SHA
+                case RSA_PKCS1_OAEP_PADDING:
+                        ret=RSA_padding_check_PKCS1_OAEP(to,tlen,(unsigned char *)buf,tlen,tlen,NULL,0);
+                        break;
+#endif
+                case RSA_SSLV23_PADDING:
+                        ret=RSA_padding_check_SSLv23(to,tlen,(unsigned char *)buf,flen,tlen);
+                        break;
+                case RSA_NO_PADDING:
+                        ret=RSA_padding_check_none(to,tlen,(unsigned char *)buf,flen,tlen);
+                        break;
+                default:
+                        SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,SUREWARE_R_UNKNOWN_PADDING_TYPE);
+                        goto err;
+                }
+                if (ret < 0)
+                        SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,SUREWARE_R_PADDING_CHECK_FAILED);
+        }
+err:
+        if (buf)
+        {
+                OPENSSL_cleanse(buf,tlen);
+                OPENSSL_free(buf);
+        }
+        return ret;
+}
+
+/*
+* Does what OpenSSL rsa_priv_enc does.
+*/
+static int surewarehk_rsa_sign(int flen,const unsigned char *from,unsigned char *to,
+                            RSA *rsa,int padding)
+{
+        int ret=0,tlen;
+        char *hptr=NULL;
+        char msg[64]="ENGINE_rsa_sign";
+        if (!p_surewarehk_Rsa_Sign)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_SIGN,ENGINE_R_NOT_INITIALISED);
+        }
+        /* extract ref to private key */
+        else if (!(hptr=RSA_get_ex_data(rsa, rsaHndidx)))
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_SIGN,SUREWARE_R_MISSING_KEY_COMPONENTS);
+        }
+        else
+        {
+                switch (padding)
+                {
+                case RSA_PKCS1_PADDING: /* do it in one shot */
+                        ret=p_surewarehk_Rsa_Sign(msg,flen,(unsigned char *)from,&tlen,to,hptr,SUREWARE_PKCS1_PAD);
+                        surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RSA_SIGN,ret);
+                        break;
+                case RSA_NO_PADDING:
+                default:
+                        SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_SIGN,SUREWARE_R_UNKNOWN_PADDING_TYPE);
+                }
+        }
+        return ret==1 ? tlen : ret;
+}
+
+#endif
+
+#ifndef OPENSSL_NO_DSA
+/* DSA sign and verify */
+static  DSA_SIG * surewarehk_dsa_do_sign(const unsigned char *from, int flen, DSA *dsa)
+{
+        int ret=0;
+        char *hptr=NULL;
+        DSA_SIG *psign=NULL;
+        char msg[64]="ENGINE_dsa_do_sign";
+        if (!p_surewarehk_Dsa_Sign)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,ENGINE_R_NOT_INITIALISED);
+                goto err;
+        }
+        /* extract ref to private key */
+        else if (!(hptr=DSA_get_ex_data(dsa, dsaHndidx)))
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,SUREWARE_R_MISSING_KEY_COMPONENTS);
+                goto err;
+        }
+        else
+        {
+                if((psign = DSA_SIG_new()) == NULL)
+                {
+                        SUREWAREerr(SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                }
+                psign->r=BN_new();
+                psign->s=BN_new();
+                bn_expand2(psign->r, 20/sizeof(BN_ULONG));
+                bn_expand2(psign->s, 20/sizeof(BN_ULONG));
+                if (!psign->r || psign->r->dmax!=20/sizeof(BN_ULONG) ||
+                        !psign->s || psign->s->dmax!=20/sizeof(BN_ULONG))
+                        goto err;
+                ret=p_surewarehk_Dsa_Sign(msg,flen,from,
+                                          (unsigned long *)psign->r->d,
+                                          (unsigned long *)psign->s->d,
+                                          hptr);
+                surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,ret);
+        }
+        psign->r->top=20/sizeof(BN_ULONG);
+        bn_fix_top(psign->r);
+        psign->s->top=20/sizeof(BN_ULONG);
+        bn_fix_top(psign->s);
+
+err:    
+        if (psign)
+        {
+                DSA_SIG_free(psign);
+                psign=NULL;
+        }
+        return psign;
+}
+#endif
+
+static int surewarehk_modexp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                             const BIGNUM *m, BN_CTX *ctx)
+{
+        int ret=0;
+        char msg[64]="ENGINE_modexp";
+        if (!p_surewarehk_Mod_Exp)
+        {
+                SUREWAREerr(SUREWARE_F_SUREWAREHK_MODEXP,ENGINE_R_NOT_INITIALISED);
+        }
+        else
+        {
+                bn_expand2(r,m->top);
+                if (r && r->dmax==m->top)
+                {
+                        /* do it*/
+                        ret=p_surewarehk_Mod_Exp(msg,
+                                                 m->top*sizeof(BN_ULONG),
+                                                 (unsigned long *)m->d,
+                                                 p->top*sizeof(BN_ULONG),
+                                                 (unsigned long *)p->d,
+                                                 a->top*sizeof(BN_ULONG),
+                                                 (unsigned long *)a->d,
+                                                 (unsigned long *)r->d);
+                        surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_MODEXP,ret);
+                        if (ret==1)
+                        {
+                                /* normalise result */
+                                r->top=m->top;
+                                bn_fix_top(r);
+                        }
+                }
+        }
+        return ret;
+}
+#endif /* !OPENSSL_NO_HW_SureWare */
+#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libssl/src/engines/e_sureware.ec b/src/lib/libssl/src/engines/e_sureware.ec
new file mode 100644
index 0000000000..3d266b8b7c
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_sureware.ec
@@ -0,0 +1 @@
+L SUREWARE      e_sureware_err.h                e_sureware_err.c
diff --git a/src/lib/libssl/src/engines/e_sureware_err.c b/src/lib/libssl/src/engines/e_sureware_err.c
new file mode 100644
index 0000000000..d4ca68c1db
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_sureware_err.c
@@ -0,0 +1,158 @@
+/* e_sureware_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "e_sureware_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(0,func,0)
+#define ERR_REASON(reason) ERR_PACK(0,0,reason)
+
+static ERR_STRING_DATA SUREWARE_str_functs[]=
+        {
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_CTRL),  "SUREWAREHK_CTRL"},
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_DH_EX_FREE),    "SUREWAREHK_DH_EX_FREE"},
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_DSA_DO_SIGN),   "SUREWAREHK_DSA_DO_SIGN"},
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_EX_FREE),       "SUREWAREHK_EX_FREE"},
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_FINISH),        "SUREWAREHK_FINISH"},
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_INIT),  "SUREWAREHK_INIT"},
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_LOAD_PRIVKEY),  "SUREWAREHK_LOAD_PRIVKEY"},
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_LOAD_PUBKEY),   "SUREWAREHK_LOAD_PUBKEY"},
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_MODEXP),        "SUREWAREHK_MODEXP"},
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_RAND_BYTES),    "SUREWAREHK_RAND_BYTES"},
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_RAND_SEED),     "SUREWAREHK_RAND_SEED"},
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC),  "SUREWAREHK_RSA_PRIV_DEC"},
+{ERR_FUNC(SUREWARE_F_SUREWAREHK_RSA_SIGN),      "SUREWAREHK_RSA_SIGN"},
+{ERR_FUNC(SUREWARE_F_SUREWARE_LOAD_PUBLIC),     "SUREWARE_LOAD_PUBLIC"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA SUREWARE_str_reasons[]=
+        {
+{ERR_REASON(SUREWARE_R_BIO_WAS_FREED)    ,"bio was freed"},
+{ERR_REASON(SUREWARE_R_MISSING_KEY_COMPONENTS),"missing key components"},
+{ERR_REASON(SUREWARE_R_PADDING_CHECK_FAILED),"padding check failed"},
+{ERR_REASON(SUREWARE_R_REQUEST_FAILED)   ,"request failed"},
+{ERR_REASON(SUREWARE_R_REQUEST_FALLBACK) ,"request fallback"},
+{ERR_REASON(SUREWARE_R_SIZE_TOO_LARGE_OR_TOO_SMALL),"size too large or too small"},
+{ERR_REASON(SUREWARE_R_UNIT_FAILURE)     ,"unit failure"},
+{ERR_REASON(SUREWARE_R_UNKNOWN_PADDING_TYPE),"unknown padding type"},
+{0,NULL}
+        };
+
+#endif
+
+#ifdef SUREWARE_LIB_NAME
+static ERR_STRING_DATA SUREWARE_lib_name[]=
+        {
+{0      ,SUREWARE_LIB_NAME},
+{0,NULL}
+        };
+#endif
+
+
+static int SUREWARE_lib_error_code=0;
+static int SUREWARE_error_init=1;
+
+static void ERR_load_SUREWARE_strings(void)
+        {
+        if (SUREWARE_lib_error_code == 0)
+                SUREWARE_lib_error_code=ERR_get_next_error_library();
+
+        if (SUREWARE_error_init)
+                {
+                SUREWARE_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(SUREWARE_lib_error_code,SUREWARE_str_functs);
+                ERR_load_strings(SUREWARE_lib_error_code,SUREWARE_str_reasons);
+#endif
+
+#ifdef SUREWARE_LIB_NAME
+                SUREWARE_lib_name->error = ERR_PACK(SUREWARE_lib_error_code,0,0);
+                ERR_load_strings(0,SUREWARE_lib_name);
+#endif
+                }
+        }
+
+static void ERR_unload_SUREWARE_strings(void)
+        {
+        if (SUREWARE_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(SUREWARE_lib_error_code,SUREWARE_str_functs);
+                ERR_unload_strings(SUREWARE_lib_error_code,SUREWARE_str_reasons);
+#endif
+
+#ifdef SUREWARE_LIB_NAME
+                ERR_unload_strings(0,SUREWARE_lib_name);
+#endif
+                SUREWARE_error_init=1;
+                }
+        }
+
+static void ERR_SUREWARE_error(int function, int reason, char *file, int line)
+        {
+        if (SUREWARE_lib_error_code == 0)
+                SUREWARE_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(SUREWARE_lib_error_code,function,reason,file,line);
+        }
diff --git a/src/lib/libssl/src/engines/e_sureware_err.h b/src/lib/libssl/src/engines/e_sureware_err.h
new file mode 100644
index 0000000000..ec8ed0c59b
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_sureware_err.h
@@ -0,0 +1,102 @@
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_SUREWARE_ERR_H
+#define HEADER_SUREWARE_ERR_H
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_SUREWARE_strings(void);
+static void ERR_unload_SUREWARE_strings(void);
+static void ERR_SUREWARE_error(int function, int reason, char *file, int line);
+#define SUREWAREerr(f,r) ERR_SUREWARE_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the SUREWARE functions. */
+
+/* Function codes. */
+#define SUREWARE_F_SUREWAREHK_CTRL                       100
+#define SUREWARE_F_SUREWAREHK_DH_EX_FREE                 112
+#define SUREWARE_F_SUREWAREHK_DSA_DO_SIGN                101
+#define SUREWARE_F_SUREWAREHK_EX_FREE                    102
+#define SUREWARE_F_SUREWAREHK_FINISH                     103
+#define SUREWARE_F_SUREWAREHK_INIT                       104
+#define SUREWARE_F_SUREWAREHK_LOAD_PRIVKEY               105
+#define SUREWARE_F_SUREWAREHK_LOAD_PUBKEY                113
+#define SUREWARE_F_SUREWAREHK_MODEXP                     107
+#define SUREWARE_F_SUREWAREHK_RAND_BYTES                 108
+#define SUREWARE_F_SUREWAREHK_RAND_SEED                  109
+#define SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC               110
+#define SUREWARE_F_SUREWAREHK_RSA_SIGN                   111
+#define SUREWARE_F_SUREWARE_LOAD_PUBLIC                  106
+
+/* Reason codes. */
+#define SUREWARE_R_BIO_WAS_FREED                         100
+#define SUREWARE_R_MISSING_KEY_COMPONENTS                105
+#define SUREWARE_R_PADDING_CHECK_FAILED                  106
+#define SUREWARE_R_REQUEST_FAILED                        101
+#define SUREWARE_R_REQUEST_FALLBACK                      102
+#define SUREWARE_R_SIZE_TOO_LARGE_OR_TOO_SMALL           103
+#define SUREWARE_R_UNIT_FAILURE                          104
+#define SUREWARE_R_UNKNOWN_PADDING_TYPE                  107
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/engines/e_ubsec.c b/src/lib/libssl/src/engines/e_ubsec.c
new file mode 100644
index 0000000000..e8389de6a1
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_ubsec.c
@@ -0,0 +1,1070 @@
+/* crypto/engine/hw_ubsec.c */
+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
+ * project 2000.
+ *
+ * Cloned shamelessly by Joe Tardo. 
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/crypto.h>
+#include <openssl/buffer.h>
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_UBSEC
+
+#ifdef FLAT_INC
+#include "hw_ubsec.h"
+#else
+#include "vendor_defns/hw_ubsec.h"
+#endif
+
+#define UBSEC_LIB_NAME "ubsec engine"
+#include "e_ubsec_err.c"
+
+#define FAIL_TO_SOFTWARE -15
+
+static int ubsec_destroy(ENGINE *e);
+static int ubsec_init(ENGINE *e);
+static int ubsec_finish(ENGINE *e);
+static int ubsec_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void));
+static int ubsec_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx);
+static int ubsec_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                        const BIGNUM *q, const BIGNUM *dp,
+                        const BIGNUM *dq, const BIGNUM *qinv, BN_CTX *ctx);
+#ifndef OPENSSL_NO_RSA
+static int ubsec_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
+#endif
+static int ubsec_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#ifndef OPENSSL_NO_DSA
+#ifdef NOT_USED
+static int ubsec_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+                BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+                BN_CTX *ctx, BN_MONT_CTX *in_mont);
+static int ubsec_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *m_ctx);
+#endif
+static DSA_SIG *ubsec_dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+static int ubsec_dsa_verify(const unsigned char *dgst, int dgst_len,
+                                DSA_SIG *sig, DSA *dsa);
+#endif
+#ifndef OPENSSL_NO_DH
+static int ubsec_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
+                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *m_ctx);
+static int ubsec_dh_compute_key(unsigned char *key,const BIGNUM *pub_key,DH *dh);
+static int ubsec_dh_generate_key(DH *dh);
+#endif
+
+#ifdef NOT_USED
+static int ubsec_rand_bytes(unsigned char *buf, int num);
+static int ubsec_rand_status(void);
+#endif
+
+#define UBSEC_CMD_SO_PATH               ENGINE_CMD_BASE
+static const ENGINE_CMD_DEFN ubsec_cmd_defns[] = {
+        {UBSEC_CMD_SO_PATH,
+                "SO_PATH",
+                "Specifies the path to the 'ubsec' shared library",
+                ENGINE_CMD_FLAG_STRING},
+        {0, NULL, NULL, 0}
+        };
+
+#ifndef OPENSSL_NO_RSA
+/* Our internal RSA_METHOD that we provide pointers to */
+static RSA_METHOD ubsec_rsa =
+        {
+        "UBSEC RSA method",
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        ubsec_rsa_mod_exp,
+        ubsec_mod_exp_mont,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL,
+        NULL,
+        NULL
+        };
+#endif
+
+#ifndef OPENSSL_NO_DSA
+/* Our internal DSA_METHOD that we provide pointers to */
+static DSA_METHOD ubsec_dsa =
+        {
+        "UBSEC DSA method",
+        ubsec_dsa_do_sign, /* dsa_do_sign */
+        NULL, /* dsa_sign_setup */
+        ubsec_dsa_verify, /* dsa_do_verify */
+        NULL, /* ubsec_dsa_mod_exp */ /* dsa_mod_exp */
+        NULL, /* ubsec_mod_exp_dsa */ /* bn_mod_exp */
+        NULL, /* init */
+        NULL, /* finish */
+        0, /* flags */
+        NULL, /* app_data */
+        NULL, /* dsa_paramgen */
+        NULL /* dsa_keygen */
+        };
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* Our internal DH_METHOD that we provide pointers to */
+static DH_METHOD ubsec_dh =
+        {
+        "UBSEC DH method",
+        ubsec_dh_generate_key,
+        ubsec_dh_compute_key,
+        ubsec_mod_exp_dh,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL
+        };
+#endif
+
+/* Constants used when creating the ENGINE */
+static const char *engine_ubsec_id = "ubsec";
+static const char *engine_ubsec_name = "UBSEC hardware engine support";
+
+/* This internal function is used by ENGINE_ubsec() and possibly by the
+ * "dynamic" ENGINE support too */
+static int bind_helper(ENGINE *e)
+        {
+#ifndef OPENSSL_NO_RSA
+        const RSA_METHOD *meth1;
+#endif
+#ifndef OPENSSL_NO_DH
+#ifndef HAVE_UBSEC_DH
+        const DH_METHOD *meth3;
+#endif /* HAVE_UBSEC_DH */
+#endif
+        if(!ENGINE_set_id(e, engine_ubsec_id) ||
+                        !ENGINE_set_name(e, engine_ubsec_name) ||
+#ifndef OPENSSL_NO_RSA
+                        !ENGINE_set_RSA(e, &ubsec_rsa) ||
+#endif
+#ifndef OPENSSL_NO_DSA
+                        !ENGINE_set_DSA(e, &ubsec_dsa) ||
+#endif
+#ifndef OPENSSL_NO_DH
+                        !ENGINE_set_DH(e, &ubsec_dh) ||
+#endif
+                        !ENGINE_set_destroy_function(e, ubsec_destroy) ||
+                        !ENGINE_set_init_function(e, ubsec_init) ||
+                        !ENGINE_set_finish_function(e, ubsec_finish) ||
+                        !ENGINE_set_ctrl_function(e, ubsec_ctrl) ||
+                        !ENGINE_set_cmd_defns(e, ubsec_cmd_defns))
+                return 0;
+
+#ifndef OPENSSL_NO_RSA
+        /* We know that the "PKCS1_SSLeay()" functions hook properly
+         * to the Broadcom-specific mod_exp and mod_exp_crt so we use
+         * those functions. NB: We don't use ENGINE_openssl() or
+         * anything "more generic" because something like the RSAref
+         * code may not hook properly, and if you own one of these
+         * cards then you have the right to do RSA operations on it
+         * anyway! */ 
+        meth1 = RSA_PKCS1_SSLeay();
+        ubsec_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
+        ubsec_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
+        ubsec_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
+        ubsec_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
+#endif
+
+#ifndef OPENSSL_NO_DH
+#ifndef HAVE_UBSEC_DH
+        /* Much the same for Diffie-Hellman */
+        meth3 = DH_OpenSSL();
+        ubsec_dh.generate_key = meth3->generate_key;
+        ubsec_dh.compute_key = meth3->compute_key;
+#endif /* HAVE_UBSEC_DH */
+#endif
+
+        /* Ensure the ubsec error handling is set up */
+        ERR_load_UBSEC_strings();
+        return 1;
+        }
+
+#ifdef OPENSSL_NO_DYNAMIC_ENGINE
+static ENGINE *engine_ubsec(void)
+        {
+        ENGINE *ret = ENGINE_new();
+        if(!ret)
+                return NULL;
+        if(!bind_helper(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_ubsec(void)
+        {
+        /* Copied from eng_[openssl|dyn].c */
+        ENGINE *toadd = engine_ubsec();
+        if(!toadd) return;
+        ENGINE_add(toadd);
+        ENGINE_free(toadd);
+        ERR_clear_error();
+        }
+#endif
+
+/* This is a process-global DSO handle used for loading and unloading
+ * the UBSEC library. NB: This is only set (or unset) during an
+ * init() or finish() call (reference counts permitting) and they're
+ * operating with global locks, so this should be thread-safe
+ * implicitly. */
+
+static DSO *ubsec_dso = NULL;
+
+/* These are the function pointers that are (un)set when the library has
+ * successfully (un)loaded. */
+
+static t_UBSEC_ubsec_bytes_to_bits *p_UBSEC_ubsec_bytes_to_bits = NULL;
+static t_UBSEC_ubsec_bits_to_bytes *p_UBSEC_ubsec_bits_to_bytes = NULL;
+static t_UBSEC_ubsec_open *p_UBSEC_ubsec_open = NULL;
+static t_UBSEC_ubsec_close *p_UBSEC_ubsec_close = NULL;
+#ifndef OPENSSL_NO_DH
+static t_UBSEC_diffie_hellman_generate_ioctl 
+        *p_UBSEC_diffie_hellman_generate_ioctl = NULL;
+static t_UBSEC_diffie_hellman_agree_ioctl *p_UBSEC_diffie_hellman_agree_ioctl = NULL;
+#endif
+/* #ifndef OPENSSL_NO_RSA */
+static t_UBSEC_rsa_mod_exp_ioctl *p_UBSEC_rsa_mod_exp_ioctl = NULL;
+static t_UBSEC_rsa_mod_exp_crt_ioctl *p_UBSEC_rsa_mod_exp_crt_ioctl = NULL;
+/* #endif */
+#ifndef OPENSSL_NO_DSA
+static t_UBSEC_dsa_sign_ioctl *p_UBSEC_dsa_sign_ioctl = NULL;
+static t_UBSEC_dsa_verify_ioctl *p_UBSEC_dsa_verify_ioctl = NULL;
+#endif
+static t_UBSEC_math_accelerate_ioctl *p_UBSEC_math_accelerate_ioctl = NULL;
+static t_UBSEC_rng_ioctl *p_UBSEC_rng_ioctl = NULL;
+static t_UBSEC_max_key_len_ioctl *p_UBSEC_max_key_len_ioctl = NULL;
+
+static int max_key_len = 1024;  /* ??? */
+
+/* 
+ * These are the static string constants for the DSO file name and the function
+ * symbol names to bind to. 
+ */
+
+static const char *UBSEC_LIBNAME = NULL;
+static const char *get_UBSEC_LIBNAME(void)
+        {
+        if(UBSEC_LIBNAME)
+                return UBSEC_LIBNAME;
+        return "ubsec";
+        }
+static void free_UBSEC_LIBNAME(void)
+        {
+        if(UBSEC_LIBNAME)
+                OPENSSL_free((void*)UBSEC_LIBNAME);
+        UBSEC_LIBNAME = NULL;
+        }
+static long set_UBSEC_LIBNAME(const char *name)
+        {
+        free_UBSEC_LIBNAME();
+        return (((UBSEC_LIBNAME = BUF_strdup(name)) != NULL) ? 1 : 0);
+        }
+static const char *UBSEC_F1 = "ubsec_bytes_to_bits";
+static const char *UBSEC_F2 = "ubsec_bits_to_bytes";
+static const char *UBSEC_F3 = "ubsec_open";
+static const char *UBSEC_F4 = "ubsec_close";
+#ifndef OPENSSL_NO_DH
+static const char *UBSEC_F5 = "diffie_hellman_generate_ioctl";
+static const char *UBSEC_F6 = "diffie_hellman_agree_ioctl";
+#endif
+/* #ifndef OPENSSL_NO_RSA */
+static const char *UBSEC_F7 = "rsa_mod_exp_ioctl";
+static const char *UBSEC_F8 = "rsa_mod_exp_crt_ioctl";
+/* #endif */
+#ifndef OPENSSL_NO_DSA
+static const char *UBSEC_F9 = "dsa_sign_ioctl";
+static const char *UBSEC_F10 = "dsa_verify_ioctl";
+#endif
+static const char *UBSEC_F11 = "math_accelerate_ioctl";
+static const char *UBSEC_F12 = "rng_ioctl";
+static const char *UBSEC_F13 = "ubsec_max_key_len_ioctl";
+
+/* Destructor (complements the "ENGINE_ubsec()" constructor) */
+static int ubsec_destroy(ENGINE *e)
+        {
+        free_UBSEC_LIBNAME();
+        ERR_unload_UBSEC_strings();
+        return 1;
+        }
+
+/* (de)initialisation functions. */
+static int ubsec_init(ENGINE *e)
+        {
+        t_UBSEC_ubsec_bytes_to_bits *p1;
+        t_UBSEC_ubsec_bits_to_bytes *p2;
+        t_UBSEC_ubsec_open *p3;
+        t_UBSEC_ubsec_close *p4;
+#ifndef OPENSSL_NO_DH
+        t_UBSEC_diffie_hellman_generate_ioctl *p5;
+        t_UBSEC_diffie_hellman_agree_ioctl *p6;
+#endif
+/* #ifndef OPENSSL_NO_RSA */
+        t_UBSEC_rsa_mod_exp_ioctl *p7;
+        t_UBSEC_rsa_mod_exp_crt_ioctl *p8;
+/* #endif */
+#ifndef OPENSSL_NO_DSA
+        t_UBSEC_dsa_sign_ioctl *p9;
+        t_UBSEC_dsa_verify_ioctl *p10;
+#endif
+        t_UBSEC_math_accelerate_ioctl *p11;
+        t_UBSEC_rng_ioctl *p12;
+        t_UBSEC_max_key_len_ioctl *p13;
+        int fd = 0;
+
+        if(ubsec_dso != NULL)
+                {
+                UBSECerr(UBSEC_F_UBSEC_INIT, UBSEC_R_ALREADY_LOADED);
+                goto err;
+                }
+        /* 
+         * Attempt to load libubsec.so/ubsec.dll/whatever. 
+         */
+        ubsec_dso = DSO_load(NULL, get_UBSEC_LIBNAME(), NULL, 0);
+        if(ubsec_dso == NULL)
+                {
+                UBSECerr(UBSEC_F_UBSEC_INIT, UBSEC_R_DSO_FAILURE);
+                goto err;
+                }
+
+        if (
+        !(p1 = (t_UBSEC_ubsec_bytes_to_bits *) DSO_bind_func(ubsec_dso, UBSEC_F1)) ||
+        !(p2 = (t_UBSEC_ubsec_bits_to_bytes *) DSO_bind_func(ubsec_dso, UBSEC_F2)) ||
+        !(p3 = (t_UBSEC_ubsec_open *) DSO_bind_func(ubsec_dso, UBSEC_F3)) ||
+        !(p4 = (t_UBSEC_ubsec_close *) DSO_bind_func(ubsec_dso, UBSEC_F4)) ||
+#ifndef OPENSSL_NO_DH
+        !(p5 = (t_UBSEC_diffie_hellman_generate_ioctl *) 
+                                DSO_bind_func(ubsec_dso, UBSEC_F5)) ||
+        !(p6 = (t_UBSEC_diffie_hellman_agree_ioctl *) 
+                                DSO_bind_func(ubsec_dso, UBSEC_F6)) ||
+#endif
+/* #ifndef OPENSSL_NO_RSA */
+        !(p7 = (t_UBSEC_rsa_mod_exp_ioctl *) DSO_bind_func(ubsec_dso, UBSEC_F7)) ||
+        !(p8 = (t_UBSEC_rsa_mod_exp_crt_ioctl *) DSO_bind_func(ubsec_dso, UBSEC_F8)) ||
+/* #endif */
+#ifndef OPENSSL_NO_DSA
+        !(p9 = (t_UBSEC_dsa_sign_ioctl *) DSO_bind_func(ubsec_dso, UBSEC_F9)) ||
+        !(p10 = (t_UBSEC_dsa_verify_ioctl *) DSO_bind_func(ubsec_dso, UBSEC_F10)) ||
+#endif
+        !(p11 = (t_UBSEC_math_accelerate_ioctl *) 
+                                DSO_bind_func(ubsec_dso, UBSEC_F11)) ||
+        !(p12 = (t_UBSEC_rng_ioctl *) DSO_bind_func(ubsec_dso, UBSEC_F12)) ||
+        !(p13 = (t_UBSEC_max_key_len_ioctl *) DSO_bind_func(ubsec_dso, UBSEC_F13)))
+                {
+                UBSECerr(UBSEC_F_UBSEC_INIT, UBSEC_R_DSO_FAILURE);
+                goto err;
+                }
+
+        /* Copy the pointers */
+        p_UBSEC_ubsec_bytes_to_bits = p1;
+        p_UBSEC_ubsec_bits_to_bytes = p2;
+        p_UBSEC_ubsec_open = p3;
+        p_UBSEC_ubsec_close = p4;
+#ifndef OPENSSL_NO_DH
+        p_UBSEC_diffie_hellman_generate_ioctl = p5;
+        p_UBSEC_diffie_hellman_agree_ioctl = p6;
+#endif
+#ifndef OPENSSL_NO_RSA
+        p_UBSEC_rsa_mod_exp_ioctl = p7;
+        p_UBSEC_rsa_mod_exp_crt_ioctl = p8;
+#endif
+#ifndef OPENSSL_NO_DSA
+        p_UBSEC_dsa_sign_ioctl = p9;
+        p_UBSEC_dsa_verify_ioctl = p10;
+#endif
+        p_UBSEC_math_accelerate_ioctl = p11;
+        p_UBSEC_rng_ioctl = p12;
+        p_UBSEC_max_key_len_ioctl = p13;
+
+        /* Perform an open to see if there's actually any unit running. */
+        if (((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) > 0) && (p_UBSEC_max_key_len_ioctl(fd, &max_key_len) == 0))
+        {
+           p_UBSEC_ubsec_close(fd);
+           return 1;
+        }
+        else
+        {
+          UBSECerr(UBSEC_F_UBSEC_INIT, UBSEC_R_UNIT_FAILURE);
+        }
+
+err:
+        if(ubsec_dso)
+                DSO_free(ubsec_dso);
+        ubsec_dso = NULL;
+        p_UBSEC_ubsec_bytes_to_bits = NULL;
+        p_UBSEC_ubsec_bits_to_bytes = NULL;
+        p_UBSEC_ubsec_open = NULL;
+        p_UBSEC_ubsec_close = NULL;
+#ifndef OPENSSL_NO_DH
+        p_UBSEC_diffie_hellman_generate_ioctl = NULL;
+        p_UBSEC_diffie_hellman_agree_ioctl = NULL;
+#endif
+#ifndef OPENSSL_NO_RSA
+        p_UBSEC_rsa_mod_exp_ioctl = NULL;
+        p_UBSEC_rsa_mod_exp_crt_ioctl = NULL;
+#endif
+#ifndef OPENSSL_NO_DSA
+        p_UBSEC_dsa_sign_ioctl = NULL;
+        p_UBSEC_dsa_verify_ioctl = NULL;
+#endif
+        p_UBSEC_math_accelerate_ioctl = NULL;
+        p_UBSEC_rng_ioctl = NULL;
+        p_UBSEC_max_key_len_ioctl = NULL;
+
+        return 0;
+        }
+
+static int ubsec_finish(ENGINE *e)
+        {
+        free_UBSEC_LIBNAME();
+        if(ubsec_dso == NULL)
+                {
+                UBSECerr(UBSEC_F_UBSEC_FINISH, UBSEC_R_NOT_LOADED);
+                return 0;
+                }
+        if(!DSO_free(ubsec_dso))
+                {
+                UBSECerr(UBSEC_F_UBSEC_FINISH, UBSEC_R_DSO_FAILURE);
+                return 0;
+                }
+        ubsec_dso = NULL;
+        p_UBSEC_ubsec_bytes_to_bits = NULL;
+        p_UBSEC_ubsec_bits_to_bytes = NULL;
+        p_UBSEC_ubsec_open = NULL;
+        p_UBSEC_ubsec_close = NULL;
+#ifndef OPENSSL_NO_DH
+        p_UBSEC_diffie_hellman_generate_ioctl = NULL;
+        p_UBSEC_diffie_hellman_agree_ioctl = NULL;
+#endif
+#ifndef OPENSSL_NO_RSA
+        p_UBSEC_rsa_mod_exp_ioctl = NULL;
+        p_UBSEC_rsa_mod_exp_crt_ioctl = NULL;
+#endif
+#ifndef OPENSSL_NO_DSA
+        p_UBSEC_dsa_sign_ioctl = NULL;
+        p_UBSEC_dsa_verify_ioctl = NULL;
+#endif
+        p_UBSEC_math_accelerate_ioctl = NULL;
+        p_UBSEC_rng_ioctl = NULL;
+        p_UBSEC_max_key_len_ioctl = NULL;
+        return 1;
+        }
+
+static int ubsec_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+        {
+        int initialised = ((ubsec_dso == NULL) ? 0 : 1);
+        switch(cmd)
+                {
+        case UBSEC_CMD_SO_PATH:
+                if(p == NULL)
+                        {
+                        UBSECerr(UBSEC_F_UBSEC_CTRL,ERR_R_PASSED_NULL_PARAMETER);
+                        return 0;
+                        }
+                if(initialised)
+                        {
+                        UBSECerr(UBSEC_F_UBSEC_CTRL,UBSEC_R_ALREADY_LOADED);
+                        return 0;
+                        }
+                return set_UBSEC_LIBNAME((const char *)p);
+        default:
+                break;
+                }
+        UBSECerr(UBSEC_F_UBSEC_CTRL,UBSEC_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+        return 0;
+        }
+
+static int ubsec_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx)
+        {
+        int     y_len = 0;
+        int     fd;
+
+        if(ubsec_dso == NULL)
+        {
+                UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_NOT_LOADED);
+                return 0;
+        }
+
+        /* Check if hardware can't handle this argument. */
+        y_len = BN_num_bits(m);
+        if (y_len > max_key_len) {
+                UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
+                return BN_mod_exp(r, a, p, m, ctx);
+        } 
+
+        if(!bn_wexpand(r, m->top))
+        {
+                UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_BN_EXPAND_FAIL);
+                return 0;
+        }
+
+        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0) {
+                fd = 0;
+                UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_UNIT_FAILURE);
+                return BN_mod_exp(r, a, p, m, ctx);
+        }
+
+        if (p_UBSEC_rsa_mod_exp_ioctl(fd, (unsigned char *)a->d, BN_num_bits(a),
+                (unsigned char *)m->d, BN_num_bits(m), (unsigned char *)p->d, 
+                BN_num_bits(p), (unsigned char *)r->d, &y_len) != 0)
+        {
+                UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_REQUEST_FAILED);
+                p_UBSEC_ubsec_close(fd);
+
+                return BN_mod_exp(r, a, p, m, ctx);
+        }
+
+        p_UBSEC_ubsec_close(fd);
+
+        r->top = (BN_num_bits(m)+BN_BITS2-1)/BN_BITS2;
+        return 1;
+        }
+
+#ifndef OPENSSL_NO_RSA
+static int ubsec_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
+        {
+        int to_return = 0;
+
+        if(!rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)
+                {
+                UBSECerr(UBSEC_F_UBSEC_RSA_MOD_EXP, UBSEC_R_MISSING_KEY_COMPONENTS);
+                goto err;
+                }
+
+        to_return = ubsec_mod_exp_crt(r0, I, rsa->p, rsa->q, rsa->dmp1,
+                    rsa->dmq1, rsa->iqmp, ctx);
+        if (to_return == FAIL_TO_SOFTWARE)
+        {
+          /*
+           * Do in software as hardware failed.
+           */
+           const RSA_METHOD *meth = RSA_PKCS1_SSLeay();
+           to_return = (*meth->rsa_mod_exp)(r0, I, rsa, ctx);
+        }
+err:
+        return to_return;
+        }
+#endif
+
+static int ubsec_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                        const BIGNUM *q, const BIGNUM *dp,
+                        const BIGNUM *dq, const BIGNUM *qinv, BN_CTX *ctx)
+        {
+        int     y_len,
+                m_len,
+                fd;
+
+        m_len = BN_num_bytes(p) + BN_num_bytes(q) + 1;
+        y_len = BN_num_bits(p) + BN_num_bits(q);
+
+        /* Check if hardware can't handle this argument. */
+        if (y_len > max_key_len) {
+                UBSECerr(UBSEC_F_UBSEC_MOD_EXP_CRT, UBSEC_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
+                return FAIL_TO_SOFTWARE;
+        } 
+
+        if (!bn_wexpand(r, p->top + q->top + 1)) {
+                UBSECerr(UBSEC_F_UBSEC_MOD_EXP_CRT, UBSEC_R_BN_EXPAND_FAIL);
+                return 0;
+        }
+
+        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0) {
+                fd = 0;
+                UBSECerr(UBSEC_F_UBSEC_MOD_EXP_CRT, UBSEC_R_UNIT_FAILURE);
+                return FAIL_TO_SOFTWARE;
+        }
+
+        if (p_UBSEC_rsa_mod_exp_crt_ioctl(fd,
+                (unsigned char *)a->d, BN_num_bits(a), 
+                (unsigned char *)qinv->d, BN_num_bits(qinv),
+                (unsigned char *)dp->d, BN_num_bits(dp),
+                (unsigned char *)p->d, BN_num_bits(p),
+                (unsigned char *)dq->d, BN_num_bits(dq),
+                (unsigned char *)q->d, BN_num_bits(q),
+                (unsigned char *)r->d,  &y_len) != 0) {
+                UBSECerr(UBSEC_F_UBSEC_MOD_EXP_CRT, UBSEC_R_REQUEST_FAILED);
+                p_UBSEC_ubsec_close(fd);
+                return FAIL_TO_SOFTWARE;
+        }
+
+        p_UBSEC_ubsec_close(fd);
+
+        r->top = (BN_num_bits(p) + BN_num_bits(q) + BN_BITS2 - 1)/BN_BITS2;
+        return 1;
+}
+
+#ifndef OPENSSL_NO_DSA
+#ifdef NOT_USED
+static int ubsec_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+                BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+                BN_CTX *ctx, BN_MONT_CTX *in_mont)
+        {
+        BIGNUM t;
+        int to_return = 0;
+ 
+        BN_init(&t);
+        /* let rr = a1 ^ p1 mod m */
+        if (!ubsec_mod_exp(rr,a1,p1,m,ctx)) goto end;
+        /* let t = a2 ^ p2 mod m */
+        if (!ubsec_mod_exp(&t,a2,p2,m,ctx)) goto end;
+        /* let rr = rr * t mod m */
+        if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
+        to_return = 1;
+end:
+        BN_free(&t);
+        return to_return;
+        }
+
+static int ubsec_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *m_ctx)
+        {
+        return ubsec_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+#endif
+
+/*
+ * This function is aliased to mod_exp (with the mont stuff dropped).
+ */
+static int ubsec_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        int ret = 0;
+
+#ifndef OPENSSL_NO_RSA
+        /* Do in software if the key is too large for the hardware. */
+        if (BN_num_bits(m) > max_key_len)
+                {
+                const RSA_METHOD *meth = RSA_PKCS1_SSLeay();
+                ret = (*meth->bn_mod_exp)(r, a, p, m, ctx, m_ctx);
+                }
+        else
+#endif
+                {
+                ret = ubsec_mod_exp(r, a, p, m, ctx);
+                }
+        
+        return ret;
+        }
+
+#ifndef OPENSSL_NO_DH
+/* This function is aliased to mod_exp (with the dh and mont dropped). */
+static int ubsec_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
+                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *m_ctx)
+        {
+        return ubsec_mod_exp(r, a, p, m, ctx);
+        }
+#endif
+
+#ifndef OPENSSL_NO_DSA
+static DSA_SIG *ubsec_dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
+        {
+        DSA_SIG *to_return = NULL;
+        int s_len = 160, r_len = 160, d_len, fd;
+        BIGNUM m, *r=NULL, *s=NULL;
+
+        BN_init(&m);
+
+        s = BN_new();
+        r = BN_new();
+        if ((s == NULL) || (r==NULL))
+                goto err;
+
+        d_len = p_UBSEC_ubsec_bytes_to_bits((unsigned char *)dgst, dlen);
+
+        if(!bn_wexpand(r, (160+BN_BITS2-1)/BN_BITS2) ||
+           (!bn_wexpand(s, (160+BN_BITS2-1)/BN_BITS2))) {
+                UBSECerr(UBSEC_F_UBSEC_DSA_DO_SIGN, UBSEC_R_BN_EXPAND_FAIL);
+                goto err;
+        }
+
+        if (BN_bin2bn(dgst,dlen,&m) == NULL) {
+                UBSECerr(UBSEC_F_UBSEC_DSA_DO_SIGN, UBSEC_R_BN_EXPAND_FAIL);
+                goto err;
+        } 
+
+        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0) {
+                const DSA_METHOD *meth;
+                fd = 0;
+                UBSECerr(UBSEC_F_UBSEC_DSA_DO_SIGN, UBSEC_R_UNIT_FAILURE);
+                meth = DSA_OpenSSL();
+                to_return =  meth->dsa_do_sign(dgst, dlen, dsa);
+                goto err;
+        }
+
+        if (p_UBSEC_dsa_sign_ioctl(fd, 0, /* compute hash before signing */
+                (unsigned char *)dgst, d_len,
+                NULL, 0,  /* compute random value */
+                (unsigned char *)dsa->p->d, BN_num_bits(dsa->p), 
+                (unsigned char *)dsa->q->d, BN_num_bits(dsa->q),
+                (unsigned char *)dsa->g->d, BN_num_bits(dsa->g),
+                (unsigned char *)dsa->priv_key->d, BN_num_bits(dsa->priv_key),
+                (unsigned char *)r->d, &r_len,
+                (unsigned char *)s->d, &s_len ) != 0) {
+                const DSA_METHOD *meth;
+
+                UBSECerr(UBSEC_F_UBSEC_DSA_DO_SIGN, UBSEC_R_REQUEST_FAILED);
+                p_UBSEC_ubsec_close(fd);
+                meth = DSA_OpenSSL();
+                to_return = meth->dsa_do_sign(dgst, dlen, dsa);
+
+                goto err;
+        }
+
+        p_UBSEC_ubsec_close(fd);
+
+        r->top = (160+BN_BITS2-1)/BN_BITS2;
+        s->top = (160+BN_BITS2-1)/BN_BITS2;
+
+        to_return = DSA_SIG_new();
+        if(to_return == NULL) {
+                UBSECerr(UBSEC_F_UBSEC_DSA_DO_SIGN, UBSEC_R_BN_EXPAND_FAIL);
+                goto err;
+        }
+
+        to_return->r = r;
+        to_return->s = s;
+
+err:
+        if (!to_return) {
+                if (r) BN_free(r);
+                if (s) BN_free(s);
+        }                                 
+        BN_clear_free(&m);
+        return to_return;
+}
+
+static int ubsec_dsa_verify(const unsigned char *dgst, int dgst_len,
+                                DSA_SIG *sig, DSA *dsa)
+        {
+        int v_len, d_len;
+        int to_return = 0;
+        int fd;
+        BIGNUM v, *pv = &v;
+
+        BN_init(&v);
+
+        if(!bn_wexpand(pv, dsa->p->top)) {
+                UBSECerr(UBSEC_F_UBSEC_DSA_VERIFY, UBSEC_R_BN_EXPAND_FAIL);
+                goto err;
+        }
+
+        v_len = BN_num_bits(dsa->p);
+
+        d_len = p_UBSEC_ubsec_bytes_to_bits((unsigned char *)dgst, dgst_len);
+
+        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0) {
+                const DSA_METHOD *meth;
+                fd = 0;
+                UBSECerr(UBSEC_F_UBSEC_DSA_VERIFY, UBSEC_R_UNIT_FAILURE);
+                meth = DSA_OpenSSL();
+                to_return = meth->dsa_do_verify(dgst, dgst_len, sig, dsa);
+                goto err;
+        }
+
+        if (p_UBSEC_dsa_verify_ioctl(fd, 0, /* compute hash before signing */
+                (unsigned char *)dgst, d_len,
+                (unsigned char *)dsa->p->d, BN_num_bits(dsa->p), 
+                (unsigned char *)dsa->q->d, BN_num_bits(dsa->q),
+                (unsigned char *)dsa->g->d, BN_num_bits(dsa->g),
+                (unsigned char *)dsa->pub_key->d, BN_num_bits(dsa->pub_key),
+                (unsigned char *)sig->r->d, BN_num_bits(sig->r),
+                (unsigned char *)sig->s->d, BN_num_bits(sig->s),
+                (unsigned char *)v.d, &v_len) != 0) {
+                const DSA_METHOD *meth;
+                UBSECerr(UBSEC_F_UBSEC_DSA_VERIFY, UBSEC_R_REQUEST_FAILED);
+                p_UBSEC_ubsec_close(fd);
+
+                meth = DSA_OpenSSL();
+                to_return = meth->dsa_do_verify(dgst, dgst_len, sig, dsa);
+
+                goto err;
+        }
+
+        p_UBSEC_ubsec_close(fd);
+
+        to_return = 1;
+err:
+        BN_clear_free(&v);
+        return to_return;
+        }
+#endif
+
+#ifndef OPENSSL_NO_DH
+static int ubsec_dh_compute_key(unsigned char *key,const BIGNUM *pub_key,DH *dh)
+        {
+        int      ret      = -1,
+                 k_len,
+                 fd;
+
+        k_len = BN_num_bits(dh->p);
+
+        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0)
+                {
+                const DH_METHOD *meth;
+                UBSECerr(UBSEC_F_UBSEC_DH_COMPUTE_KEY, UBSEC_R_UNIT_FAILURE);
+                meth = DH_OpenSSL();
+                ret = meth->compute_key(key, pub_key, dh);
+                goto err;
+                }
+
+        if (p_UBSEC_diffie_hellman_agree_ioctl(fd,
+                                               (unsigned char *)dh->priv_key->d, BN_num_bits(dh->priv_key),
+                                               (unsigned char *)pub_key->d, BN_num_bits(pub_key),
+                                               (unsigned char *)dh->p->d, BN_num_bits(dh->p),
+                                               key, &k_len) != 0)
+                {
+                /* Hardware's a no go, failover to software */
+                const DH_METHOD *meth;
+                UBSECerr(UBSEC_F_UBSEC_DH_COMPUTE_KEY, UBSEC_R_REQUEST_FAILED);
+                p_UBSEC_ubsec_close(fd);
+
+                meth = DH_OpenSSL();
+                ret = meth->compute_key(key, pub_key, dh);
+
+                goto err;
+                }
+
+        p_UBSEC_ubsec_close(fd);
+
+        ret = p_UBSEC_ubsec_bits_to_bytes(k_len);
+err:
+        return ret;
+        }
+
+static int ubsec_dh_generate_key(DH *dh)
+        {
+        int      ret               = 0,
+                 random_bits       = 0,
+                 pub_key_len       = 0,
+                 priv_key_len      = 0,
+                 fd;
+        BIGNUM   *pub_key          = NULL;
+        BIGNUM   *priv_key         = NULL;
+
+        /* 
+         *  How many bits should Random x be? dh_key.c
+         *  sets the range from 0 to num_bits(modulus) ???
+         */
+
+        if (dh->priv_key == NULL)
+                {
+                priv_key = BN_new();
+                if (priv_key == NULL) goto err;
+                priv_key_len = BN_num_bits(dh->p);
+                bn_wexpand(priv_key, dh->p->top);
+                do
+                        if (!BN_rand_range(priv_key, dh->p)) goto err;
+                while (BN_is_zero(priv_key));
+                random_bits = BN_num_bits(priv_key);
+                }
+        else
+                {
+                priv_key = dh->priv_key;
+                }
+
+        if (dh->pub_key == NULL)
+                {
+                pub_key = BN_new();
+                pub_key_len = BN_num_bits(dh->p);
+                bn_wexpand(pub_key, dh->p->top);
+                if(pub_key == NULL) goto err;
+                }
+        else
+                {
+                pub_key = dh->pub_key;
+                }
+
+        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0)
+                {
+                const DH_METHOD *meth;
+                UBSECerr(UBSEC_F_UBSEC_DH_GENERATE_KEY, UBSEC_R_UNIT_FAILURE);
+                meth = DH_OpenSSL();
+                ret = meth->generate_key(dh);
+                goto err;
+                }
+
+        if (p_UBSEC_diffie_hellman_generate_ioctl(fd,
+                                                  (unsigned char *)priv_key->d, &priv_key_len,
+                                                  (unsigned char *)pub_key->d,  &pub_key_len,
+                                                  (unsigned char *)dh->g->d, BN_num_bits(dh->g),
+                                                  (unsigned char *)dh->p->d, BN_num_bits(dh->p),
+                                                  0, 0, random_bits) != 0)
+                {
+                /* Hardware's a no go, failover to software */
+                const DH_METHOD *meth;
+
+                UBSECerr(UBSEC_F_UBSEC_DH_GENERATE_KEY, UBSEC_R_REQUEST_FAILED);
+                p_UBSEC_ubsec_close(fd);
+
+                meth = DH_OpenSSL();
+                ret = meth->generate_key(dh);
+
+                goto err;
+                }
+
+        p_UBSEC_ubsec_close(fd);
+
+        dh->pub_key = pub_key;
+        dh->pub_key->top = (pub_key_len + BN_BITS2-1) / BN_BITS2;
+        dh->priv_key = priv_key;
+        dh->priv_key->top = (priv_key_len + BN_BITS2-1) / BN_BITS2;
+
+        ret = 1;
+err:
+        return ret;
+        }
+#endif
+
+#ifdef NOT_USED
+static int ubsec_rand_bytes(unsigned char * buf,
+                            int num)
+        {
+        int      ret      = 0,
+                 fd;
+
+        if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0)
+                {
+                const RAND_METHOD *meth;
+                UBSECerr(UBSEC_F_UBSEC_RAND_BYTES, UBSEC_R_UNIT_FAILURE);
+                num = p_UBSEC_ubsec_bits_to_bytes(num);
+                meth = RAND_SSLeay();
+                meth->seed(buf, num);
+                ret = meth->bytes(buf, num);
+                goto err;
+                }
+
+        num *= 8; /* bytes to bits */
+
+        if (p_UBSEC_rng_ioctl(fd,
+                              UBSEC_RNG_DIRECT,
+                              buf,
+                              &num) != 0)
+                {
+                /* Hardware's a no go, failover to software */
+                const RAND_METHOD *meth;
+
+                UBSECerr(UBSEC_F_UBSEC_RAND_BYTES, UBSEC_R_REQUEST_FAILED);
+                p_UBSEC_ubsec_close(fd);
+
+                num = p_UBSEC_ubsec_bits_to_bytes(num);
+                meth = RAND_SSLeay();
+                meth->seed(buf, num);
+                ret = meth->bytes(buf, num);
+
+                goto err;
+                }
+
+        p_UBSEC_ubsec_close(fd);
+
+        ret = 1;
+err:
+        return(ret);
+        }
+
+
+static int ubsec_rand_status(void)
+        {
+        return 0;
+        }
+#endif
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library. */
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE
+static int bind_fn(ENGINE *e, const char *id)
+        {
+        if(id && (strcmp(id, engine_ubsec_id) != 0))
+                return 0;
+        if(!bind_helper(e))
+                return 0;
+        return 1;
+        }
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
+#endif /* OPENSSL_NO_DYNAMIC_ENGINE */
+
+#endif /* !OPENSSL_NO_HW_UBSEC */
+#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libssl/src/engines/e_ubsec.ec b/src/lib/libssl/src/engines/e_ubsec.ec
new file mode 100644
index 0000000000..99b9233569
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_ubsec.ec
@@ -0,0 +1 @@
+L UBSEC         e_ubsec_err.h                   e_ubsec_err.c
diff --git a/src/lib/libssl/src/engines/e_ubsec_err.c b/src/lib/libssl/src/engines/e_ubsec_err.c
new file mode 100644
index 0000000000..14c3d61e24
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_ubsec_err.c
@@ -0,0 +1,157 @@
+/* e_ubsec_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "e_ubsec_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(0,func,0)
+#define ERR_REASON(reason) ERR_PACK(0,0,reason)
+
+static ERR_STRING_DATA UBSEC_str_functs[]=
+        {
+{ERR_FUNC(UBSEC_F_UBSEC_CTRL),  "UBSEC_CTRL"},
+{ERR_FUNC(UBSEC_F_UBSEC_DH_COMPUTE_KEY),        "UBSEC_DH_COMPUTE_KEY"},
+{ERR_FUNC(UBSEC_F_UBSEC_DH_GENERATE_KEY),       "UBSEC_DH_GENERATE_KEY"},
+{ERR_FUNC(UBSEC_F_UBSEC_DSA_DO_SIGN),   "UBSEC_DSA_DO_SIGN"},
+{ERR_FUNC(UBSEC_F_UBSEC_DSA_VERIFY),    "UBSEC_DSA_VERIFY"},
+{ERR_FUNC(UBSEC_F_UBSEC_FINISH),        "UBSEC_FINISH"},
+{ERR_FUNC(UBSEC_F_UBSEC_INIT),  "UBSEC_INIT"},
+{ERR_FUNC(UBSEC_F_UBSEC_MOD_EXP),       "UBSEC_MOD_EXP"},
+{ERR_FUNC(UBSEC_F_UBSEC_MOD_EXP_CRT),   "UBSEC_MOD_EXP_CRT"},
+{ERR_FUNC(UBSEC_F_UBSEC_RAND_BYTES),    "UBSEC_RAND_BYTES"},
+{ERR_FUNC(UBSEC_F_UBSEC_RSA_MOD_EXP),   "UBSEC_RSA_MOD_EXP"},
+{ERR_FUNC(UBSEC_F_UBSEC_RSA_MOD_EXP_CRT),       "UBSEC_RSA_MOD_EXP_CRT"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA UBSEC_str_reasons[]=
+        {
+{ERR_REASON(UBSEC_R_ALREADY_LOADED)      ,"already loaded"},
+{ERR_REASON(UBSEC_R_BN_EXPAND_FAIL)      ,"bn expand fail"},
+{ERR_REASON(UBSEC_R_CTRL_COMMAND_NOT_IMPLEMENTED),"ctrl command not implemented"},
+{ERR_REASON(UBSEC_R_DSO_FAILURE)         ,"dso failure"},
+{ERR_REASON(UBSEC_R_MISSING_KEY_COMPONENTS),"missing key components"},
+{ERR_REASON(UBSEC_R_NOT_LOADED)          ,"not loaded"},
+{ERR_REASON(UBSEC_R_REQUEST_FAILED)      ,"request failed"},
+{ERR_REASON(UBSEC_R_SIZE_TOO_LARGE_OR_TOO_SMALL),"size too large or too small"},
+{ERR_REASON(UBSEC_R_UNIT_FAILURE)        ,"unit failure"},
+{0,NULL}
+        };
+
+#endif
+
+#ifdef UBSEC_LIB_NAME
+static ERR_STRING_DATA UBSEC_lib_name[]=
+        {
+{0      ,UBSEC_LIB_NAME},
+{0,NULL}
+        };
+#endif
+
+
+static int UBSEC_lib_error_code=0;
+static int UBSEC_error_init=1;
+
+static void ERR_load_UBSEC_strings(void)
+        {
+        if (UBSEC_lib_error_code == 0)
+                UBSEC_lib_error_code=ERR_get_next_error_library();
+
+        if (UBSEC_error_init)
+                {
+                UBSEC_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(UBSEC_lib_error_code,UBSEC_str_functs);
+                ERR_load_strings(UBSEC_lib_error_code,UBSEC_str_reasons);
+#endif
+
+#ifdef UBSEC_LIB_NAME
+                UBSEC_lib_name->error = ERR_PACK(UBSEC_lib_error_code,0,0);
+                ERR_load_strings(0,UBSEC_lib_name);
+#endif
+                }
+        }
+
+static void ERR_unload_UBSEC_strings(void)
+        {
+        if (UBSEC_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(UBSEC_lib_error_code,UBSEC_str_functs);
+                ERR_unload_strings(UBSEC_lib_error_code,UBSEC_str_reasons);
+#endif
+
+#ifdef UBSEC_LIB_NAME
+                ERR_unload_strings(0,UBSEC_lib_name);
+#endif
+                UBSEC_error_init=1;
+                }
+        }
+
+static void ERR_UBSEC_error(int function, int reason, char *file, int line)
+        {
+        if (UBSEC_lib_error_code == 0)
+                UBSEC_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(UBSEC_lib_error_code,function,reason,file,line);
+        }
diff --git a/src/lib/libssl/src/engines/e_ubsec_err.h b/src/lib/libssl/src/engines/e_ubsec_err.h
new file mode 100644
index 0000000000..b10b2387f2
--- /dev/null
+++ b/src/lib/libssl/src/engines/e_ubsec_err.h
@@ -0,0 +1,101 @@
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_UBSEC_ERR_H
+#define HEADER_UBSEC_ERR_H
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_UBSEC_strings(void);
+static void ERR_unload_UBSEC_strings(void);
+static void ERR_UBSEC_error(int function, int reason, char *file, int line);
+#define UBSECerr(f,r) ERR_UBSEC_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the UBSEC functions. */
+
+/* Function codes. */
+#define UBSEC_F_UBSEC_CTRL                               100
+#define UBSEC_F_UBSEC_DH_COMPUTE_KEY                     101
+#define UBSEC_F_UBSEC_DH_GENERATE_KEY                    111
+#define UBSEC_F_UBSEC_DSA_DO_SIGN                        102
+#define UBSEC_F_UBSEC_DSA_VERIFY                         103
+#define UBSEC_F_UBSEC_FINISH                             104
+#define UBSEC_F_UBSEC_INIT                               105
+#define UBSEC_F_UBSEC_MOD_EXP                            106
+#define UBSEC_F_UBSEC_MOD_EXP_CRT                        110
+#define UBSEC_F_UBSEC_RAND_BYTES                         107
+#define UBSEC_F_UBSEC_RSA_MOD_EXP                        108
+#define UBSEC_F_UBSEC_RSA_MOD_EXP_CRT                    109
+
+/* Reason codes. */
+#define UBSEC_R_ALREADY_LOADED                           100
+#define UBSEC_R_BN_EXPAND_FAIL                           101
+#define UBSEC_R_CTRL_COMMAND_NOT_IMPLEMENTED             102
+#define UBSEC_R_DSO_FAILURE                              103
+#define UBSEC_R_MISSING_KEY_COMPONENTS                   104
+#define UBSEC_R_NOT_LOADED                               105
+#define UBSEC_R_REQUEST_FAILED                           106
+#define UBSEC_R_SIZE_TOO_LARGE_OR_TOO_SMALL              107
+#define UBSEC_R_UNIT_FAILURE                             108
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/engines/engine_vector.mar b/src/lib/libssl/src/engines/engine_vector.mar
new file mode 100644
index 0000000000..7d968e7b40
--- /dev/null
+++ b/src/lib/libssl/src/engines/engine_vector.mar
@@ -0,0 +1,24 @@
+;
+; Transfer vector for VAX shareable image
+;
+        .TITLE ENGINE
+        .IDENT /ENGINE/
+;
+; Define macro to assist in building transfer vector entries.  Each entry
+; should take no more than 8 bytes.
+;
+        .MACRO FTRANSFER_ENTRY routine
+        .ALIGN QUAD
+        .TRANSFER routine
+        .MASK   routine
+        JMP     routine+2
+        .ENDM FTRANSFER_ENTRY
+;
+; Place entries in own program section.
+;
+        .PSECT $$ENGINE,QUAD,PIC,USR,CON,REL,LCL,SHR,EXE,RD,NOWRT
+ENGINE_xfer:
+        FTRANSFER_ENTRY bind_engine
+        FTRANSFER_ENTRY v_check
+        .BLKB 32768-<.-ENGINE_xfer>     ; 64 pages total.
+        .END
diff --git a/src/lib/libssl/src/engines/vax.opt b/src/lib/libssl/src/engines/vax.opt
new file mode 100644
index 0000000000..72e6bd895f
--- /dev/null
+++ b/src/lib/libssl/src/engines/vax.opt
@@ -0,0 +1,9 @@
+!
+! Ensure transfer vector is at beginning of image
+!
+CLUSTER=FIRST
+COLLECT=FIRST,$$ENGINE
+!
+! make psects nonshareable so image can be installed.
+!
+PSECT_ATTR=$CHAR_STRING_CONSTANTS,NOWRT
diff --git a/src/lib/libssl/src/engines/vendor_defns/aep.h b/src/lib/libssl/src/engines/vendor_defns/aep.h
new file mode 100644
index 0000000000..5e9754fe43
--- /dev/null
+++ b/src/lib/libssl/src/engines/vendor_defns/aep.h
@@ -0,0 +1,178 @@
+/* This header declares the necessary definitions for using the exponentiation
+ * acceleration capabilities, and rnd number generation of the AEP card. 
+ *
+ */
+
+/*
+ *
+ * Some AEP defines
+ *
+ */
+
+/*Successful return value*/
+#define AEP_R_OK                                0x00000000
+
+/*Miscelleanous unsuccessful return value*/
+#define AEP_R_GENERAL_ERROR                     0x10000001
+
+/*Insufficient host memory*/
+#define AEP_R_HOST_MEMORY                       0x10000002
+
+#define AEP_R_FUNCTION_FAILED                   0x10000006
+
+/*Invalid arguments in function call*/
+#define AEP_R_ARGUMENTS_BAD                     0x10020000
+
+#define AEP_R_NO_TARGET_RESOURCES                               0x10030000
+
+/*Error occuring on socket operation*/
+#define AEP_R_SOCKERROR                                                 0x10000010
+
+/*Socket has been closed from the other end*/
+#define AEP_R_SOCKEOF                                                   0x10000011
+
+/*Invalid handles*/
+#define AEP_R_CONNECTION_HANDLE_INVALID         0x100000B3
+
+#define AEP_R_TRANSACTION_HANDLE_INVALID                0x10040000
+
+/*Transaction has not yet returned from accelerator*/
+#define AEP_R_TRANSACTION_NOT_READY                             0x00010000
+
+/*There is already a thread waiting on this transaction*/
+#define AEP_R_TRANSACTION_CLAIMED                               0x10050000
+
+/*The transaction timed out*/
+#define AEP_R_TIMED_OUT                                                 0x10060000
+
+#define AEP_R_FXN_NOT_IMPLEMENTED                               0x10070000
+
+#define AEP_R_TARGET_ERROR                                              0x10080000
+
+/*Error in the AEP daemon process*/
+#define AEP_R_DAEMON_ERROR                                              0x10090000
+
+/*Invalid ctx id*/
+#define AEP_R_INVALID_CTX_ID                                    0x10009000
+
+#define AEP_R_NO_KEY_MANAGER                                    0x1000a000
+
+/*Error obtaining a mutex*/
+#define AEP_R_MUTEX_BAD                         0x000001A0
+
+/*Fxn call before AEP_Initialise ot after AEP_Finialise*/
+#define AEP_R_AEPAPI_NOT_INITIALIZED                    0x10000190
+
+/*AEP_Initialise has already been called*/
+#define AEP_R_AEPAPI_ALREADY_INITIALIZED                0x10000191
+
+/*Maximum number of connections to daemon reached*/
+#define AEP_R_NO_MORE_CONNECTION_HNDLS                  0x10000200
+
+/*
+ *
+ * Some AEP Type definitions
+ *
+ */
+
+/* an unsigned 8-bit value */
+typedef unsigned char                           AEP_U8;
+
+/* an unsigned 8-bit character */
+typedef char                                    AEP_CHAR;
+
+/* a BYTE-sized Boolean flag */
+typedef AEP_U8                                  AEP_BBOOL;
+
+/*Unsigned value, at least 16 bits long*/
+typedef unsigned short                          AEP_U16;
+
+/* an unsigned value, at least 32 bits long */
+#ifdef SIXTY_FOUR_BIT_LONG
+typedef unsigned int                            AEP_U32;
+#else
+typedef unsigned long                           AEP_U32;
+#endif
+
+#ifdef SIXTY_FOUR_BIT_LONG
+typedef unsigned long                           AEP_U64;
+#else
+typedef struct { unsigned long l1, l2; }        AEP_U64;
+#endif
+
+/* at least 32 bits; each bit is a Boolean flag */
+typedef AEP_U32                 AEP_FLAGS;
+
+typedef AEP_U8          *AEP_U8_PTR;
+typedef AEP_CHAR        *AEP_CHAR_PTR;
+typedef AEP_U32                 *AEP_U32_PTR;
+typedef AEP_U64                 *AEP_U64_PTR;
+typedef void            *AEP_VOID_PTR;
+
+/* Pointer to a AEP_VOID_PTR-- i.e., pointer to pointer to void */
+typedef AEP_VOID_PTR    *AEP_VOID_PTR_PTR;
+
+/*Used to identify an AEP connection handle*/
+typedef AEP_U32                                 AEP_CONNECTION_HNDL;
+
+/*Pointer to an AEP connection handle*/
+typedef AEP_CONNECTION_HNDL     *AEP_CONNECTION_HNDL_PTR;
+
+/*Used by an application (in conjunction with the apps process id) to 
+identify an individual transaction*/
+typedef AEP_U32                                 AEP_TRANSACTION_ID;
+
+/*Pointer to an applications transaction identifier*/
+typedef AEP_TRANSACTION_ID              *AEP_TRANSACTION_ID_PTR;
+
+/*Return value type*/
+typedef AEP_U32                                 AEP_RV;
+
+#define MAX_PROCESS_CONNECTIONS 256
+
+#define RAND_BLK_SIZE 1024
+
+typedef enum{
+        NotConnected=   0,
+        Connected=              1,
+        InUse=                  2
+} AEP_CONNECTION_STATE;
+
+
+typedef struct AEP_CONNECTION_ENTRY{
+        AEP_CONNECTION_STATE    conn_state;
+        AEP_CONNECTION_HNDL     conn_hndl;
+} AEP_CONNECTION_ENTRY;
+
+
+typedef AEP_RV t_AEP_OpenConnection(AEP_CONNECTION_HNDL_PTR phConnection);
+typedef AEP_RV t_AEP_CloseConnection(AEP_CONNECTION_HNDL hConnection);
+
+typedef AEP_RV t_AEP_ModExp(AEP_CONNECTION_HNDL hConnection,
+                            AEP_VOID_PTR pA, AEP_VOID_PTR pP,
+                            AEP_VOID_PTR pN,
+                            AEP_VOID_PTR pResult,
+                            AEP_TRANSACTION_ID* pidTransID);
+
+typedef AEP_RV t_AEP_ModExpCrt(AEP_CONNECTION_HNDL hConnection,
+                               AEP_VOID_PTR pA, AEP_VOID_PTR pP,
+                               AEP_VOID_PTR pQ,
+                               AEP_VOID_PTR pDmp1, AEP_VOID_PTR pDmq1,
+                               AEP_VOID_PTR pIqmp,
+                               AEP_VOID_PTR pResult,
+                               AEP_TRANSACTION_ID* pidTransID);
+
+#ifdef AEPRAND
+typedef AEP_RV t_AEP_GenRandom(AEP_CONNECTION_HNDL hConnection,
+                               AEP_U32 Len,
+                               AEP_U32 Type,
+                               AEP_VOID_PTR pResult,
+                               AEP_TRANSACTION_ID* pidTransID);
+#endif
+
+typedef AEP_RV t_AEP_Initialize(AEP_VOID_PTR pInitArgs);
+typedef AEP_RV t_AEP_Finalize(void);
+typedef AEP_RV t_AEP_SetBNCallBacks(AEP_RV (*GetBigNumSizeFunc)(AEP_VOID_PTR ArbBigNum, AEP_U32* BigNumSize),
+                                    AEP_RV (*MakeAEPBigNumFunc)(AEP_VOID_PTR ArbBigNum, AEP_U32 BigNumSize, unsigned char* AEP_BigNum),
+                                    AEP_RV (*ConverAEPBigNumFunc)(void* ArbBigNum, AEP_U32 BigNumSize, unsigned char* AEP_BigNum));
+
diff --git a/src/lib/libssl/src/engines/vendor_defns/atalla.h b/src/lib/libssl/src/engines/vendor_defns/atalla.h
new file mode 100644
index 0000000000..149970d441
--- /dev/null
+++ b/src/lib/libssl/src/engines/vendor_defns/atalla.h
@@ -0,0 +1,48 @@
+/* This header declares the necessary definitions for using the exponentiation
+ * acceleration capabilities of Atalla cards. The only cryptographic operation
+ * is performed by "ASI_RSAPrivateKeyOpFn" and this takes a structure that
+ * defines an "RSA private key". However, it is really only performing a
+ * regular mod_exp using the supplied modulus and exponent - no CRT form is
+ * being used. Hence, it is a generic mod_exp function in disguise, and we use
+ * it as such.
+ *
+ * Thanks to the people at Atalla for letting me know these definitions are
+ * fine and that they can be reproduced here.
+ *
+ * Geoff.
+ */
+
+typedef struct ItemStr
+        {
+        unsigned char *data;
+        int len;
+        } Item;
+
+typedef struct RSAPrivateKeyStr
+        {
+        void *reserved;
+        Item version;
+        Item modulus;
+        Item publicExponent;
+        Item privateExponent;
+        Item prime[2];
+        Item exponent[2];
+        Item coefficient;
+        } RSAPrivateKey;
+
+/* Predeclare the function pointer types that we dynamically load from the DSO.
+ * These use the same names and form that Ben's original support code had (in
+ * crypto/bn/bn_exp.c) unless of course I've inadvertently changed the style
+ * somewhere along the way!
+ */
+
+typedef int tfnASI_GetPerformanceStatistics(int reset_flag,
+                                        unsigned int *ret_buf);
+
+typedef int tfnASI_GetHardwareConfig(long card_num, unsigned int *ret_buf);
+
+typedef int tfnASI_RSAPrivateKeyOpFn(RSAPrivateKey * rsaKey,
+                                        unsigned char *output,
+                                        unsigned char *input,
+                                        unsigned int modulus_len);
+
diff --git a/src/lib/libssl/src/engines/vendor_defns/cswift.h b/src/lib/libssl/src/engines/vendor_defns/cswift.h
new file mode 100644
index 0000000000..60079326bb
--- /dev/null
+++ b/src/lib/libssl/src/engines/vendor_defns/cswift.h
@@ -0,0 +1,234 @@
+/* Attribution notice: Rainbow have generously allowed me to reproduce
+ * the necessary definitions here from their API. This means the support
+ * can build independently of whether application builders have the
+ * API or hardware. This will allow developers to easily produce software
+ * that has latent hardware support for any users that have accelertors
+ * installed, without the developers themselves needing anything extra.
+ *
+ * I have only clipped the parts from the CryptoSwift header files that
+ * are (or seem) relevant to the CryptoSwift support code. This is
+ * simply to keep the file sizes reasonable.
+ * [Geoff]
+ */
+
+
+/* NB: These type widths do *not* seem right in general, in particular
+ * they're not terribly friendly to 64-bit architectures (unsigned long)
+ * will be 64-bit on IA-64 for a start. I'm leaving these alone as they
+ * agree with Rainbow's API and this will only be called into question
+ * on platforms with Rainbow support anyway! ;-) */
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+typedef long              SW_STATUS;              /* status           */
+typedef unsigned char     SW_BYTE;                /* 8 bit byte       */
+typedef unsigned short    SW_U16;                 /* 16 bit number    */
+#if defined(_IRIX)
+#include <sgidefs.h>
+typedef __uint32_t        SW_U32;
+#else
+typedef unsigned long     SW_U32;                 /* 32 bit integer   */
+#endif
+ 
+#if defined(OPENSSL_SYS_WIN32)
+  typedef struct _SW_U64 {
+      SW_U32 low32;
+      SW_U32 high32;
+  } SW_U64;                                         /* 64 bit integer   */
+#elif defined(OPENSSL_SYS_MACINTOSH_CLASSIC)
+  typedef longlong SW_U64
+#else /* Unix variants */
+  typedef struct _SW_U64 {
+      SW_U32 low32;
+      SW_U32 high32;
+  } SW_U64;                                         /* 64 bit integer   */
+#endif
+
+/* status codes */
+#define SW_OK                 (0L)
+#define SW_ERR_BASE           (-10000L)
+#define SW_ERR_NO_CARD        (SW_ERR_BASE-1) /* The Card is not present   */
+#define SW_ERR_CARD_NOT_READY (SW_ERR_BASE-2) /* The card has not powered  */
+                                              /*    up yet                 */
+#define SW_ERR_TIME_OUT       (SW_ERR_BASE-3) /* Execution of a command    */
+                                              /*    time out               */
+#define SW_ERR_NO_EXECUTE     (SW_ERR_BASE-4) /* The Card failed to        */
+                                              /*    execute the command    */
+#define SW_ERR_INPUT_NULL_PTR (SW_ERR_BASE-5) /* a required pointer is     */
+                                              /*    NULL                   */
+#define SW_ERR_INPUT_SIZE     (SW_ERR_BASE-6) /* size is invalid, too      */
+                                              /*    small, too large.      */
+#define SW_ERR_INVALID_HANDLE (SW_ERR_BASE-7) /* Invalid SW_ACC_CONTEXT    */
+                                              /*    handle                 */
+#define SW_ERR_PENDING        (SW_ERR_BASE-8) /* A request is already out- */
+                                              /*    standing at this       */
+                                              /*    context handle         */
+#define SW_ERR_AVAILABLE      (SW_ERR_BASE-9) /* A result is available.    */
+#define SW_ERR_NO_PENDING     (SW_ERR_BASE-10)/* No request is pending.    */
+#define SW_ERR_NO_MEMORY      (SW_ERR_BASE-11)/* Not enough memory         */
+#define SW_ERR_BAD_ALGORITHM  (SW_ERR_BASE-12)/* Invalid algorithm type    */
+                                              /*    in SW_PARAM structure  */
+#define SW_ERR_MISSING_KEY    (SW_ERR_BASE-13)/* No key is associated with */
+                                              /*    context.               */
+                                              /*    swAttachKeyParam() is  */
+                                              /*    not called.            */
+#define SW_ERR_KEY_CMD_MISMATCH \
+                              (SW_ERR_BASE-14)/* Cannot perform requested  */
+                                              /*    SW_COMMAND_CODE since  */
+                                              /*    key attached via       */
+                                              /*    swAttachKeyParam()     */
+                                              /*    cannot be used for this*/
+                                              /*    SW_COMMAND_CODE.       */
+#define SW_ERR_NOT_IMPLEMENTED \
+                              (SW_ERR_BASE-15)/* Not implemented           */
+#define SW_ERR_BAD_COMMAND    (SW_ERR_BASE-16)/* Bad command code          */
+#define SW_ERR_BAD_ITEM_SIZE  (SW_ERR_BASE-17)/* too small or too large in */
+                                              /*    the "initems" or       */
+                                              /*    "outitems".            */
+#define SW_ERR_BAD_ACCNUM     (SW_ERR_BASE-18)/* Bad accelerator number    */
+#define SW_ERR_SELFTEST_FAIL  (SW_ERR_BASE-19)/* At least one of the self  */
+                                              /*    test fail, look at the */
+                                              /*    selfTestBitmap in      */
+                                              /*    SW_ACCELERATOR_INFO for*/
+                                              /*    details.               */
+#define SW_ERR_MISALIGN       (SW_ERR_BASE-20)/* Certain alogrithms require*/
+                                              /*    key materials aligned  */
+                                              /*    in certain order, e.g. */
+                                              /*    128 bit for CRT        */
+#define SW_ERR_OUTPUT_NULL_PTR \
+                              (SW_ERR_BASE-21)/* a required pointer is     */
+                                              /*    NULL                   */
+#define SW_ERR_OUTPUT_SIZE \
+                              (SW_ERR_BASE-22)/* size is invalid, too      */
+                                              /*    small, too large.      */
+#define SW_ERR_FIRMWARE_CHECKSUM \
+                              (SW_ERR_BASE-23)/* firmware checksum mismatch*/
+                                              /*    download failed.       */
+#define SW_ERR_UNKNOWN_FIRMWARE \
+                              (SW_ERR_BASE-24)/* unknown firmware error    */
+#define SW_ERR_INTERRUPT      (SW_ERR_BASE-25)/* request is abort when     */
+                                              /*    it's waiting to be     */
+                                              /*    completed.             */
+#define SW_ERR_NVWRITE_FAIL   (SW_ERR_BASE-26)/* error in writing to Non-  */
+                                              /*    volatile memory        */
+#define SW_ERR_NVWRITE_RANGE  (SW_ERR_BASE-27)/* out of range error in     */
+                                              /*    writing to NV memory   */
+#define SW_ERR_RNG_ERROR      (SW_ERR_BASE-28)/* Random Number Generation  */
+                                              /*    failure                */
+#define SW_ERR_DSS_FAILURE    (SW_ERR_BASE-29)/* DSS Sign or Verify failure*/
+#define SW_ERR_MODEXP_FAILURE (SW_ERR_BASE-30)/* Failure in various math   */
+                                              /*    calculations           */
+#define SW_ERR_ONBOARD_MEMORY (SW_ERR_BASE-31)/* Error in accessing on -   */
+                                              /*    board memory           */
+#define SW_ERR_FIRMWARE_VERSION \
+                              (SW_ERR_BASE-32)/* Wrong version in firmware */
+                                              /*    update                 */
+#define SW_ERR_ZERO_WORKING_ACCELERATOR \
+                              (SW_ERR_BASE-44)/* All accelerators are bad  */
+
+
+  /* algorithm type */
+#define SW_ALG_CRT          1
+#define SW_ALG_EXP          2
+#define SW_ALG_DSA          3
+#define SW_ALG_NVDATA       4
+
+  /* command code */
+#define SW_CMD_MODEXP_CRT   1 /* perform Modular Exponentiation using  */
+                              /*  Chinese Remainder Theorem (CRT)      */
+#define SW_CMD_MODEXP       2 /* perform Modular Exponentiation        */
+#define SW_CMD_DSS_SIGN     3 /* perform DSS sign                      */
+#define SW_CMD_DSS_VERIFY   4 /* perform DSS verify                    */
+#define SW_CMD_RAND         5 /* perform random number generation      */
+#define SW_CMD_NVREAD       6 /* perform read to nonvolatile RAM       */
+#define SW_CMD_NVWRITE      7 /* perform write to nonvolatile RAM      */
+
+typedef SW_U32            SW_ALGTYPE;             /* alogrithm type   */
+typedef SW_U32            SW_STATE;               /* state            */
+typedef SW_U32            SW_COMMAND_CODE;        /* command code     */
+typedef SW_U32            SW_COMMAND_BITMAP[4];   /* bitmap           */
+
+typedef struct _SW_LARGENUMBER {
+    SW_U32    nbytes;       /* number of bytes in the buffer "value"  */
+    SW_BYTE*  value;        /* the large integer as a string of       */
+                            /*   bytes in network (big endian) order  */
+} SW_LARGENUMBER;               
+
+#if defined(OPENSSL_SYS_WIN32)
+    #include <windows.h>
+    typedef HANDLE          SW_OSHANDLE;          /* handle to kernel object */
+    #define SW_OS_INVALID_HANDLE  INVALID_HANDLE_VALUE
+    #define SW_CALLCONV _stdcall
+#elif defined(OPENSSL_SYS_MACINTOSH_CLASSIC)
+    /* async callback mechanisms */
+    /* swiftCallbackLevel */
+    #define SW_MAC_CALLBACK_LEVEL_NO         0          
+    #define SW_MAC_CALLBACK_LEVEL_HARDWARE   1  /* from the hardware ISR */
+    #define SW_MAC_CALLBACK_LEVEL_SECONDARY  2  /* as secondary ISR */
+    typedef int             SW_MAC_CALLBACK_LEVEL;
+    typedef int             SW_OSHANDLE;
+    #define SW_OS_INVALID_HANDLE  (-1)
+    #define SW_CALLCONV
+#else /* Unix variants */
+    typedef int             SW_OSHANDLE;          /* handle to driver */
+    #define SW_OS_INVALID_HANDLE  (-1)
+    #define SW_CALLCONV
+#endif 
+
+typedef struct _SW_CRT {
+    SW_LARGENUMBER  p;      /* prime number p                         */
+    SW_LARGENUMBER  q;      /* prime number q                         */
+    SW_LARGENUMBER  dmp1;   /* exponent1                              */
+    SW_LARGENUMBER  dmq1;   /* exponent2                              */
+    SW_LARGENUMBER  iqmp;   /* CRT coefficient                        */
+} SW_CRT;
+
+typedef struct _SW_EXP {
+    SW_LARGENUMBER  modulus; /* modulus                                */
+    SW_LARGENUMBER  exponent;/* exponent                               */
+} SW_EXP;
+
+typedef struct _SW_DSA {
+    SW_LARGENUMBER  p;      /*                                        */
+    SW_LARGENUMBER  q;      /*                                        */
+    SW_LARGENUMBER  g;      /*                                        */
+    SW_LARGENUMBER  key;    /* private/public key                     */
+} SW_DSA;
+
+typedef struct _SW_NVDATA {
+    SW_U32 accnum;          /* accelerator board number               */
+    SW_U32 offset;          /* offset in byte                         */
+} SW_NVDATA;
+
+typedef struct _SW_PARAM {
+    SW_ALGTYPE    type;     /* type of the alogrithm                  */
+    union {
+        SW_CRT    crt;
+        SW_EXP    exp;
+        SW_DSA    dsa;
+        SW_NVDATA nvdata;
+    } up;
+} SW_PARAM;
+
+typedef SW_U32 SW_CONTEXT_HANDLE; /* opaque context handle */
+
+
+/* Now the OpenSSL bits, these function types are the for the function
+ * pointers that will bound into the Rainbow shared libraries. */
+typedef SW_STATUS SW_CALLCONV t_swAcquireAccContext(SW_CONTEXT_HANDLE *hac);
+typedef SW_STATUS SW_CALLCONV t_swAttachKeyParam(SW_CONTEXT_HANDLE hac,
+                                                SW_PARAM *key_params);
+typedef SW_STATUS SW_CALLCONV t_swSimpleRequest(SW_CONTEXT_HANDLE hac,
+                                                SW_COMMAND_CODE cmd,
+                                                SW_LARGENUMBER pin[],
+                                                SW_U32 pin_count,
+                                                SW_LARGENUMBER pout[],
+                                                SW_U32 pout_count);
+typedef SW_STATUS SW_CALLCONV t_swReleaseAccContext(SW_CONTEXT_HANDLE hac);
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
diff --git a/src/lib/libssl/src/engines/vendor_defns/hw_4758_cca.h b/src/lib/libssl/src/engines/vendor_defns/hw_4758_cca.h
new file mode 100644
index 0000000000..296636e81a
--- /dev/null
+++ b/src/lib/libssl/src/engines/vendor_defns/hw_4758_cca.h
@@ -0,0 +1,149 @@
+/**********************************************************************/
+/*                                                                    */
+/*  Prototypes of the CCA verbs used by the 4758 CCA openssl driver   */
+/*                                                                    */
+/*  Maurice Gittens <maurice@gittens.nl>                              */
+/*                                                                    */
+/**********************************************************************/
+
+#ifndef __HW_4758_CCA__
+#define __HW_4758_CCA__
+
+/*
+ *  Only WIN32 support for now
+ */
+#if defined(WIN32)
+
+  #define CCA_LIB_NAME "CSUNSAPI"
+
+  #define CSNDPKX   "CSNDPKX_32"
+  #define CSNDKRR   "CSNDKRR_32"
+  #define CSNDPKE   "CSNDPKE_32"
+  #define CSNDPKD   "CSNDPKD_32"
+  #define CSNDDSV   "CSNDDSV_32"
+  #define CSNDDSG   "CSNDDSG_32"
+  #define CSNBRNG   "CSNBRNG_32"
+
+  #define SECURITYAPI __stdcall
+#else
+    /* Fixme!!         
+      Find out the values of these constants for other platforms.
+    */
+  #define CCA_LIB_NAME "CSUNSAPI"
+
+  #define CSNDPKX   "CSNDPKX"
+  #define CSNDKRR   "CSNDKRR"
+  #define CSNDPKE   "CSNDPKE"
+  #define CSNDPKD   "CSNDPKD"
+  #define CSNDDSV   "CSNDDSV"
+  #define CSNDDSG   "CSNDDSG"
+  #define CSNBRNG   "CSNBRNG"
+
+  #define SECURITYAPI
+#endif
+
+/*
+ * security API prototypes
+ */
+
+/* PKA Key Record Read */
+typedef void (SECURITYAPI *F_KEYRECORDREAD)
+             (long          * return_code,
+              long          * reason_code,
+              long          * exit_data_length,
+              unsigned char * exit_data,
+              long          * rule_array_count,
+              unsigned char * rule_array,
+              unsigned char * key_label,
+              long          * key_token_length,
+              unsigned char * key_token);
+
+/* Random Number Generate */
+typedef void (SECURITYAPI *F_RANDOMNUMBERGENERATE)
+             (long          * return_code,
+              long          * reason_code,
+              long          * exit_data_length,
+              unsigned char * exit_data,
+              unsigned char * form,
+              unsigned char * random_number);
+
+/* Digital Signature Generate */
+typedef void (SECURITYAPI *F_DIGITALSIGNATUREGENERATE)
+             (long          * return_code,
+              long          * reason_code,
+              long          * exit_data_length,
+              unsigned char * exit_data,
+              long          * rule_array_count,
+              unsigned char * rule_array,
+              long          * PKA_private_key_id_length,
+              unsigned char * PKA_private_key_id,
+              long          * hash_length,
+              unsigned char * hash,
+              long          * signature_field_length,
+              long          * signature_bit_length,
+              unsigned char * signature_field);
+
+/* Digital Signature Verify */
+typedef void (SECURITYAPI *F_DIGITALSIGNATUREVERIFY)(
+              long          * return_code,
+              long          * reason_code,
+              long          * exit_data_length,
+              unsigned char * exit_data,
+              long          * rule_array_count,
+              unsigned char * rule_array,
+              long          * PKA_public_key_id_length,
+              unsigned char * PKA_public_key_id,
+              long          * hash_length,
+              unsigned char * hash,
+              long          * signature_field_length,
+              unsigned char * signature_field);
+
+/* PKA Public Key Extract */
+typedef void (SECURITYAPI *F_PUBLICKEYEXTRACT)(
+              long          * return_code,
+              long          * reason_code,
+              long          * exit_data_length,
+              unsigned char * exit_data,
+              long          * rule_array_count,
+              unsigned char * rule_array,
+              long          * source_key_identifier_length,
+              unsigned char * source_key_identifier,
+              long          * target_key_token_length,
+              unsigned char * target_key_token);
+
+/* PKA Encrypt */
+typedef void   (SECURITYAPI *F_PKAENCRYPT)
+               (long          *  return_code,
+                 long          *  reason_code,
+                 long          *  exit_data_length,
+                 unsigned char *  exit_data,
+                 long          *  rule_array_count,
+                 unsigned char *  rule_array,
+                 long          *  key_value_length,
+                 unsigned char *  key_value,
+                 long          *  data_struct_length,
+                 unsigned char *  data_struct,
+                 long          *  RSA_public_key_length,
+                 unsigned char *  RSA_public_key,
+                 long          *  RSA_encipher_length,
+                 unsigned char *  RSA_encipher );
+
+/* PKA Decrypt */
+typedef void    (SECURITYAPI *F_PKADECRYPT)
+                (long          *  return_code,
+                 long          *  reason_code,
+                 long          *  exit_data_length,
+                 unsigned char *  exit_data,
+                 long          *  rule_array_count,
+                 unsigned char *  rule_array,
+                 long          *  enciphered_key_length,
+                 unsigned char *  enciphered_key,
+                 long          *  data_struct_length,
+                 unsigned char *  data_struct,
+                 long          *  RSA_private_key_length,
+                 unsigned char *  RSA_private_key,
+                 long          *  key_value_length,
+                 unsigned char *  key_value    );
+
+
+#endif
diff --git a/src/lib/libssl/src/engines/vendor_defns/hw_ubsec.h b/src/lib/libssl/src/engines/vendor_defns/hw_ubsec.h
new file mode 100644
index 0000000000..b6619d40f2
--- /dev/null
+++ b/src/lib/libssl/src/engines/vendor_defns/hw_ubsec.h
@@ -0,0 +1,100 @@
+/******************************************************************************
+ *
+ *  Copyright 2000
+ *  Broadcom Corporation
+ *  16215 Alton Parkway
+ *  PO Box 57013
+ *  Irvine CA 92619-7013
+ *
+ *****************************************************************************/
+/* 
+ * Broadcom Corporation uBSec SDK 
+ */
+/*
+ * Character device header file.
+ */
+/*
+ * Revision History:
+ *
+ * October 2000 JTT Created.
+ */
+
+#define MAX_PUBLIC_KEY_BITS (1024)
+#define MAX_PUBLIC_KEY_BYTES (1024/8)
+#define SHA_BIT_SIZE  (160)
+#define MAX_CRYPTO_KEY_LENGTH 24
+#define MAX_MAC_KEY_LENGTH 64
+#define UBSEC_CRYPTO_DEVICE_NAME ((unsigned char *)"/dev/ubscrypt")
+#define UBSEC_KEY_DEVICE_NAME ((unsigned char *)"/dev/ubskey")
+
+/* Math command types. */
+#define UBSEC_MATH_MODADD 0x0001
+#define UBSEC_MATH_MODSUB 0x0002
+#define UBSEC_MATH_MODMUL 0x0004
+#define UBSEC_MATH_MODEXP 0x0008
+#define UBSEC_MATH_MODREM 0x0010
+#define UBSEC_MATH_MODINV 0x0020
+
+typedef long ubsec_MathCommand_t;
+typedef long ubsec_RNGCommand_t;
+
+typedef struct ubsec_crypto_context_s {
+        unsigned int    flags;
+        unsigned char   crypto[MAX_CRYPTO_KEY_LENGTH];
+        unsigned char   auth[MAX_MAC_KEY_LENGTH];
+} ubsec_crypto_context_t, *ubsec_crypto_context_p;
+
+/* 
+ * Predeclare the function pointer types that we dynamically load from the DSO.
+ */
+
+typedef int t_UBSEC_ubsec_bytes_to_bits(unsigned char *n, int bytes);
+
+typedef int t_UBSEC_ubsec_bits_to_bytes(int bits);
+
+typedef int t_UBSEC_ubsec_open(unsigned char *device);
+
+typedef int t_UBSEC_ubsec_close(int fd);
+
+typedef int t_UBSEC_diffie_hellman_generate_ioctl (int fd,
+        unsigned char *x, int *x_len, unsigned char *y, int *y_len, 
+        unsigned char *g, int g_len, unsigned char *m, int m_len,
+        unsigned char *userX, int userX_len, int random_bits);
+
+typedef int t_UBSEC_diffie_hellman_agree_ioctl (int fd,
+        unsigned char *x, int x_len, unsigned char *y, int y_len, 
+        unsigned char *m, int m_len, unsigned char *k, int *k_len);
+
+typedef int t_UBSEC_rsa_mod_exp_ioctl (int fd,
+        unsigned char *x, int x_len, unsigned char *m, int m_len,
+        unsigned char *e, int e_len, unsigned char *y, int *y_len);
+
+typedef int t_UBSEC_rsa_mod_exp_crt_ioctl (int fd,
+        unsigned char *x, int x_len, unsigned char *qinv, int qinv_len,
+        unsigned char *edq, int edq_len, unsigned char *q, int q_len,
+        unsigned char *edp, int edp_len, unsigned char *p, int p_len,
+        unsigned char *y, int *y_len);
+
+typedef int t_UBSEC_dsa_sign_ioctl (int fd,
+        int hash, unsigned char *data, int data_len, 
+        unsigned char *rndom, int random_len, 
+        unsigned char *p, int p_len, unsigned char *q, int q_len,
+        unsigned char *g, int g_len, unsigned char *key, int key_len,
+        unsigned char *r, int *r_len, unsigned char *s, int *s_len);
+
+typedef int t_UBSEC_dsa_verify_ioctl (int fd,
+        int hash, unsigned char *data, int data_len,
+        unsigned char *p, int p_len, unsigned char *q, int q_len,
+        unsigned char *g, int g_len, unsigned char *key, int key_len,
+        unsigned char *r, int r_len, unsigned char *s, int s_len,
+        unsigned char *v, int *v_len);
+
+typedef int t_UBSEC_math_accelerate_ioctl(int fd, ubsec_MathCommand_t command,
+        unsigned char *ModN, int *ModN_len, unsigned char *ExpE, int *ExpE_len, 
+        unsigned char *ParamA, int *ParamA_len, unsigned char *ParamB, int *ParamB_len,
+        unsigned char *Result, int *Result_len);
+
+typedef int t_UBSEC_rng_ioctl(int fd, ubsec_RNGCommand_t command,
+        unsigned char *Result, int *Result_len);
+
+typedef int t_UBSEC_max_key_len_ioctl(int fd, int *max_key_len);
diff --git a/src/lib/libssl/src/engines/vendor_defns/hwcryptohook.h b/src/lib/libssl/src/engines/vendor_defns/hwcryptohook.h
new file mode 100644
index 0000000000..3c32feda62
--- /dev/null
+++ b/src/lib/libssl/src/engines/vendor_defns/hwcryptohook.h
@@ -0,0 +1,486 @@
+/*
+ * ModExp / RSA (with/without KM) plugin API
+ *
+ * The application will load a dynamic library which
+ * exports entrypoint(s) defined in this file.
+ *
+ * This set of entrypoints provides only a multithreaded,
+ * synchronous-within-each-thread, facility.
+ *
+ *
+ * This file is Copyright 1998-2000 nCipher Corporation Limited.
+ *
+ * Redistribution and use in source and binary forms, with opr without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the copyright notice,
+ *    this list of conditions, and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions, and the following
+ *    disclaimer, in the documentation and/or other materials provided
+ *    with the distribution
+ *
+ * IN NO EVENT SHALL NCIPHER CORPORATION LIMITED (`NCIPHER') AND/OR
+ * ANY OTHER AUTHORS OR DISTRIBUTORS OF THIS FILE BE LIABLE for any
+ * damages arising directly or indirectly from this file, its use or
+ * this licence.  Without prejudice to the generality of the
+ * foregoing: all liability shall be excluded for direct, indirect,
+ * special, incidental, consequential or other damages or any loss of
+ * profits, business, revenue goodwill or anticipated savings;
+ * liability shall be excluded even if nCipher or anyone else has been
+ * advised of the possibility of damage.  In any event, if the
+ * exclusion of liability is not effective, the liability of nCipher
+ * or any author or distributor shall be limited to the lesser of the
+ * price paid and 1,000 pounds sterling. This licence only fails to
+ * exclude or limit liability for death or personal injury arising out
+ * of negligence, and only to the extent that such an exclusion or
+ * limitation is not effective.
+ *
+ * NCIPHER AND THE AUTHORS AND DISTRIBUTORS SPECIFICALLY DISCLAIM ALL
+ * AND ANY WARRANTIES (WHETHER EXPRESS OR IMPLIED), including, but not
+ * limited to, any implied warranties of merchantability, fitness for
+ * a particular purpose, satisfactory quality, and/or non-infringement
+ * of any third party rights.
+ *
+ * US Government use: This software and documentation is Commercial
+ * Computer Software and Computer Software Documentation, as defined in
+ * sub-paragraphs (a)(1) and (a)(5) of DFAR 252.227-7014, "Rights in
+ * Noncommercial Computer Software and Noncommercial Computer Software
+ * Documentation."  Use, duplication or disclosure by the Government is
+ * subject to the terms and conditions specified here.
+ *
+ * By using or distributing this file you will be accepting these
+ * terms and conditions, including the limitation of liability and
+ * lack of warranty.  If you do not wish to accept these terms and
+ * conditions, DO NOT USE THE FILE.
+ *
+ *
+ * The actual dynamically loadable plugin, and the library files for
+ * static linking, which are also provided in some distributions, are
+ * not covered by the licence described above.  You should have
+ * received a separate licence with terms and conditions for these
+ * library files; if you received the library files without a licence,
+ * please contact nCipher.
+ *
+ *
+ * $Id: hwcryptohook.h,v 1.1.1.1 2008/09/06 12:15:50 djm Exp $
+ */
+
+#ifndef HWCRYPTOHOOK_H
+#define HWCRYPTOHOOK_H
+
+#include <sys/types.h>
+#include <stdio.h>
+
+#ifndef HWCRYPTOHOOK_DECLARE_APPTYPES
+#define HWCRYPTOHOOK_DECLARE_APPTYPES 1
+#endif
+
+#define HWCRYPTOHOOK_ERROR_FAILED   -1
+#define HWCRYPTOHOOK_ERROR_FALLBACK -2
+#define HWCRYPTOHOOK_ERROR_MPISIZE  -3
+
+#if HWCRYPTOHOOK_DECLARE_APPTYPES
+
+/* These structs are defined by the application and opaque to the
+ * crypto plugin.  The application may define these as it sees fit.
+ * Default declarations are provided here, but the application may
+ *  #define HWCRYPTOHOOK_DECLARE_APPTYPES 0
+ * to prevent these declarations, and instead provide its own
+ * declarations of these types.  (Pointers to them must still be
+ * ordinary pointers to structs or unions, or the resulting combined
+ * program will have a type inconsistency.)
+ */
+typedef struct HWCryptoHook_MutexValue HWCryptoHook_Mutex;
+typedef struct HWCryptoHook_CondVarValue HWCryptoHook_CondVar;
+typedef struct HWCryptoHook_PassphraseContextValue HWCryptoHook_PassphraseContext;
+typedef struct HWCryptoHook_CallerContextValue HWCryptoHook_CallerContext;
+
+#endif /* HWCRYPTOHOOK_DECLARE_APPTYPES */
+
+/* These next two structs are opaque to the application.  The crypto
+ * plugin will return pointers to them; the caller simply manipulates
+ * the pointers.
+ */
+typedef struct HWCryptoHook_Context *HWCryptoHook_ContextHandle;
+typedef struct HWCryptoHook_RSAKey *HWCryptoHook_RSAKeyHandle;
+
+typedef struct {
+  char *buf;
+  size_t size;
+} HWCryptoHook_ErrMsgBuf;
+/* Used for error reporting.  When a HWCryptoHook function fails it
+ * will return a sentinel value (0 for pointer-valued functions, or a
+ * negative number, usually HWCRYPTOHOOK_ERROR_FAILED, for
+ * integer-valued ones).  It will, if an ErrMsgBuf is passed, also put
+ * an error message there.
+ * 
+ * size is the size of the buffer, and will not be modified.  If you
+ * pass 0 for size you must pass 0 for buf, and nothing will be
+ * recorded (just as if you passed 0 for the struct pointer).
+ * Messages written to the buffer will always be null-terminated, even
+ * when truncated to fit within size bytes.
+ *
+ * The contents of the buffer are not defined if there is no error.
+ */
+
+typedef struct HWCryptoHook_MPIStruct {
+  unsigned char *buf;
+  size_t size;
+} HWCryptoHook_MPI;
+/* When one of these is returned, a pointer is passed to the function.
+ * At call, size is the space available.  Afterwards it is updated to
+ * be set to the actual length (which may be more than the space available,
+ * if there was not enough room and the result was truncated).
+ * buf (the pointer) is not updated.
+ *
+ * size is in bytes and may be zero at call or return, but must be a
+ * multiple of the limb size.  Zero limbs at the MS end are not
+ * permitted.
+ */
+
+#define HWCryptoHook_InitFlags_FallbackModExp    0x0002UL
+#define HWCryptoHook_InitFlags_FallbackRSAImmed  0x0004UL
+/* Enable requesting fallback to software in case of problems with the
+ * hardware support.  This indicates to the crypto provider that the
+ * application is prepared to fall back to software operation if the
+ * ModExp* or RSAImmed* functions return HWCRYPTOHOOK_ERROR_FALLBACK.
+ * Without this flag those calls will never return
+ * HWCRYPTOHOOK_ERROR_FALLBACK.  The flag will also cause the crypto
+ * provider to avoid repeatedly attempting to contact dead hardware
+ * within a short interval, if appropriate.
+ */
+
+#define HWCryptoHook_InitFlags_SimpleForkCheck   0x0010UL
+/* Without _SimpleForkCheck the library is allowed to assume that the
+ * application will not fork and call the library in the child(ren).
+ *
+ * When it is specified, this is allowed.  However, after a fork
+ * neither parent nor child may unload any loaded keys or call
+ * _Finish.  Instead, they should call exit (or die with a signal)
+ * without calling _Finish.  After all the children have died the
+ * parent may unload keys or call _Finish.
+ *
+ * This flag only has any effect on UN*X platforms.
+ */
+
+typedef struct {
+  unsigned long flags;
+  void *logstream; /* usually a FILE*.  See below. */
+
+  size_t limbsize; /* bignum format - size of radix type, must be power of 2 */
+  int mslimbfirst; /* 0 or 1 */
+  int msbytefirst; /* 0 or 1; -1 = native */
+
+  /* All the callback functions should return 0 on success, or a
+   * nonzero integer (whose value will be visible in the error message
+   * put in the buffer passed to the call).
+   *
+   * If a callback is not available pass a null function pointer.
+   *
+   * The callbacks may not call down again into the crypto plugin.
+   */
+  
+  /* For thread-safety.  Set everything to 0 if you promise only to be
+   * singlethreaded.  maxsimultaneous is the number of calls to
+   * ModExp[Crt]/RSAImmed{Priv,Pub}/RSA.  If you don't know what to
+   * put there then say 0 and the hook library will use a default.
+   *
+   * maxmutexes is a small limit on the number of simultaneous mutexes
+   * which will be requested by the library.  If there is no small
+   * limit, set it to 0.  If the crypto plugin cannot create the
+   * advertised number of mutexes the calls to its functions may fail.
+   * If a low number of mutexes is advertised the plugin will try to
+   * do the best it can.  Making larger numbers of mutexes available
+   * may improve performance and parallelism by reducing contention
+   * over critical sections.  Unavailability of any mutexes, implying
+   * single-threaded operation, should be indicated by the setting
+   * mutex_init et al to 0.
+   */
+  int maxmutexes;
+  int maxsimultaneous;
+  size_t mutexsize;
+  int (*mutex_init)(HWCryptoHook_Mutex*, HWCryptoHook_CallerContext *cactx);
+  int (*mutex_acquire)(HWCryptoHook_Mutex*);
+  void (*mutex_release)(HWCryptoHook_Mutex*);
+  void (*mutex_destroy)(HWCryptoHook_Mutex*);
+
+  /* For greater efficiency, can use condition vars internally for
+   * synchronisation.  In this case maxsimultaneous is ignored, but
+   * the other mutex stuff must be available.  In singlethreaded
+   * programs, set everything to 0.
+   */
+  size_t condvarsize;
+  int (*condvar_init)(HWCryptoHook_CondVar*, HWCryptoHook_CallerContext *cactx);
+  int (*condvar_wait)(HWCryptoHook_CondVar*, HWCryptoHook_Mutex*);
+  void (*condvar_signal)(HWCryptoHook_CondVar*);
+  void (*condvar_broadcast)(HWCryptoHook_CondVar*);
+  void (*condvar_destroy)(HWCryptoHook_CondVar*);
+  
+  /* The semantics of acquiring and releasing mutexes and broadcasting
+   * and waiting on condition variables are expected to be those from
+   * POSIX threads (pthreads).  The mutexes may be (in pthread-speak)
+   * fast mutexes, recursive mutexes, or nonrecursive ones.
+   * 
+   * The _release/_signal/_broadcast and _destroy functions must
+   * always succeed when given a valid argument; if they are given an
+   * invalid argument then the program (crypto plugin + application)
+   * has an internal error, and they should abort the program.
+   */
+
+  int (*getpassphrase)(const char *prompt_info,
+                       int *len_io, char *buf,
+                       HWCryptoHook_PassphraseContext *ppctx,
+                       HWCryptoHook_CallerContext *cactx);
+  /* Passphrases and the prompt_info, if they contain high-bit-set
+   * characters, are UTF-8.  The prompt_info may be a null pointer if
+   * no prompt information is available (it should not be an empty
+   * string).  It will not contain text like `enter passphrase';
+   * instead it might say something like `Operator Card for John
+   * Smith' or `SmartCard in nFast Module #1, Slot #1'.
+   *
+   * buf points to a buffer in which to return the passphrase; on
+   * entry *len_io is the length of the buffer.  It should be updated
+   * by the callback.  The returned passphrase should not be
+   * null-terminated by the callback.
+   */
+  
+  int (*getphystoken)(const char *prompt_info,
+                      const char *wrong_info,
+                      HWCryptoHook_PassphraseContext *ppctx,
+                      HWCryptoHook_CallerContext *cactx);
+  /* Requests that the human user physically insert a different
+   * smartcard, DataKey, etc.  The plugin should check whether the
+   * currently inserted token(s) are appropriate, and if they are it
+   * should not make this call.
+   *
+   * prompt_info is as before.  wrong_info is a description of the
+   * currently inserted token(s) so that the user is told what
+   * something is.  wrong_info, like prompt_info, may be null, but
+   * should not be an empty string.  Its contents should be
+   * syntactically similar to that of prompt_info. 
+   */
+  
+  /* Note that a single LoadKey operation might cause several calls to
+   * getpassphrase and/or requestphystoken.  If requestphystoken is
+   * not provided (ie, a null pointer is passed) then the plugin may
+   * not support loading keys for which authorisation by several cards
+   * is required.  If getpassphrase is not provided then cards with
+   * passphrases may not be supported.
+   *
+   * getpassphrase and getphystoken do not need to check that the
+   * passphrase has been entered correctly or the correct token
+   * inserted; the crypto plugin will do that.  If this is not the
+   * case then the crypto plugin is responsible for calling these
+   * routines again as appropriate until the correct token(s) and
+   * passphrase(s) are supplied as required, or until any retry limits
+   * implemented by the crypto plugin are reached.
+   *
+   * In either case, the application must allow the user to say `no'
+   * or `cancel' to indicate that they do not know the passphrase or
+   * have the appropriate token; this should cause the callback to
+   * return nonzero indicating error.
+   */
+
+  void (*logmessage)(void *logstream, const char *message);
+  /* A log message will be generated at least every time something goes
+   * wrong and an ErrMsgBuf is filled in (or would be if one was
+   * provided).  Other diagnostic information may be written there too,
+   * including more detailed reasons for errors which are reported in an
+   * ErrMsgBuf.
+   *
+   * When a log message is generated, this callback is called.  It
+   * should write a message to the relevant logging arrangements.
+   *
+   * The message string passed will be null-terminated and may be of arbitrary
+   * length.  It will not be prefixed by the time and date, nor by the
+   * name of the library that is generating it - if this is required,
+   * the logmessage callback must do it.  The message will not have a
+   * trailing newline (though it may contain internal newlines).
+   *
+   * If a null pointer is passed for logmessage a default function is
+   * used.  The default function treats logstream as a FILE* which has
+   * been converted to a void*.  If logstream is 0 it does nothing.
+   * Otherwise it prepends the date and time and library name and
+   * writes the message to logstream.  Each line will be prefixed by a
+   * descriptive string containing the date, time and identity of the
+   * crypto plugin.  Errors on the logstream are not reported
+   * anywhere, and the default function doesn't flush the stream, so
+   * the application must set the buffering how it wants it.
+   *
+   * The crypto plugin may also provide a facility to have copies of
+   * log messages sent elsewhere, and or for adjusting the verbosity
+   * of the log messages; any such facilities will be configured by
+   * external means.
+   */
+
+} HWCryptoHook_InitInfo;
+
+typedef
+HWCryptoHook_ContextHandle HWCryptoHook_Init_t(const HWCryptoHook_InitInfo *initinfo,
+                                               size_t initinfosize,
+                                               const HWCryptoHook_ErrMsgBuf *errors,
+                                               HWCryptoHook_CallerContext *cactx);
+extern HWCryptoHook_Init_t HWCryptoHook_Init;
+
+/* Caller should set initinfosize to the size of the HWCryptoHook struct,
+ * so it can be extended later.
+ *
+ * On success, a message for display or logging by the server,
+ * including the name and version number of the plugin, will be filled
+ * in into *errors; on failure *errors is used for error handling, as
+ * usual.
+ */
+
+/* All these functions return 0 on success, HWCRYPTOHOOK_ERROR_FAILED
+ * on most failures.  HWCRYPTOHOOK_ERROR_MPISIZE means at least one of
+ * the output MPI buffer(s) was too small; the sizes of all have been
+ * set to the desired size (and for those where the buffer was large
+ * enough, the value may have been copied in), and no error message
+ * has been recorded.
+ *
+ * You may pass 0 for the errors struct.  In any case, unless you set
+ * _NoStderr at init time then messages may be reported to stderr.
+ */
+
+/* The RSAImmed* functions (and key managed RSA) only work with
+ * modules which have an RSA patent licence - currently that means KM
+ * units; the ModExp* ones work with all modules, so you need a patent
+ * licence in the software in the US.  They are otherwise identical.
+ */
+
+typedef
+void HWCryptoHook_Finish_t(HWCryptoHook_ContextHandle hwctx);
+extern HWCryptoHook_Finish_t HWCryptoHook_Finish;
+/* You must not have any calls going or keys loaded when you call this. */
+
+typedef
+int HWCryptoHook_RandomBytes_t(HWCryptoHook_ContextHandle hwctx,
+                               unsigned char *buf, size_t len,
+                               const HWCryptoHook_ErrMsgBuf *errors);
+extern HWCryptoHook_RandomBytes_t HWCryptoHook_RandomBytes;
+
+typedef
+int HWCryptoHook_ModExp_t(HWCryptoHook_ContextHandle hwctx,
+                          HWCryptoHook_MPI a,
+                          HWCryptoHook_MPI p,
+                          HWCryptoHook_MPI n,
+                          HWCryptoHook_MPI *r,
+                          const HWCryptoHook_ErrMsgBuf *errors);
+extern HWCryptoHook_ModExp_t HWCryptoHook_ModExp;
+
+typedef
+int HWCryptoHook_RSAImmedPub_t(HWCryptoHook_ContextHandle hwctx,
+                               HWCryptoHook_MPI m,
+                               HWCryptoHook_MPI e,
+                               HWCryptoHook_MPI n,
+                               HWCryptoHook_MPI *r,
+                               const HWCryptoHook_ErrMsgBuf *errors);
+extern HWCryptoHook_RSAImmedPub_t HWCryptoHook_RSAImmedPub;
+
+typedef
+int HWCryptoHook_ModExpCRT_t(HWCryptoHook_ContextHandle hwctx,
+                             HWCryptoHook_MPI a,
+                             HWCryptoHook_MPI p,
+                             HWCryptoHook_MPI q,
+                             HWCryptoHook_MPI dmp1,
+                             HWCryptoHook_MPI dmq1,
+                             HWCryptoHook_MPI iqmp,
+                             HWCryptoHook_MPI *r,
+                             const HWCryptoHook_ErrMsgBuf *errors);
+extern HWCryptoHook_ModExpCRT_t HWCryptoHook_ModExpCRT;
+
+typedef
+int HWCryptoHook_RSAImmedPriv_t(HWCryptoHook_ContextHandle hwctx,
+                                HWCryptoHook_MPI m,
+                                HWCryptoHook_MPI p,
+                                HWCryptoHook_MPI q,
+                                HWCryptoHook_MPI dmp1,
+                                HWCryptoHook_MPI dmq1,
+                                HWCryptoHook_MPI iqmp,
+                                HWCryptoHook_MPI *r,
+                                const HWCryptoHook_ErrMsgBuf *errors);
+extern HWCryptoHook_RSAImmedPriv_t HWCryptoHook_RSAImmedPriv;
+
+/* The RSAImmed* and ModExp* functions may return E_FAILED or
+ * E_FALLBACK for failure.
+ *
+ * E_FAILED means the failure is permanent and definite and there
+ *    should be no attempt to fall back to software.  (Eg, for some
+ *    applications, which support only the acceleration-only
+ *    functions, the `key material' may actually be an encoded key
+ *    identifier, and doing the operation in software would give wrong
+ *    answers.)
+ *
+ * E_FALLBACK means that doing the computation in software would seem
+ *    reasonable.  If an application pays attention to this and is
+ *    able to fall back, it should also set the Fallback init flags.
+ */
+
+typedef
+int HWCryptoHook_RSALoadKey_t(HWCryptoHook_ContextHandle hwctx,
+                              const char *key_ident,
+                              HWCryptoHook_RSAKeyHandle *keyhandle_r,
+                              const HWCryptoHook_ErrMsgBuf *errors,
+                              HWCryptoHook_PassphraseContext *ppctx);
+extern HWCryptoHook_RSALoadKey_t HWCryptoHook_RSALoadKey;
+/* The key_ident is a null-terminated string configured by the
+ * user via the application's usual configuration mechanisms.
+ * It is provided to the user by the crypto provider's key management
+ * system.  The user must be able to enter at least any string of between
+ * 1 and 1023 characters inclusive, consisting of printable 7-bit
+ * ASCII characters.  The provider should avoid using
+ * any characters except alphanumerics and the punctuation
+ * characters  _ - + . / @ ~  (the user is expected to be able
+ * to enter these without quoting).  The string may be case-sensitive.
+ * The application may allow the user to enter other NULL-terminated strings,
+ * and the provider must cope (returning an error if the string is not
+ * valid).
+ *
+ * If the key does not exist, no error is recorded and 0 is returned;
+ * keyhandle_r will be set to 0 instead of to a key handle.
+ */
+
+typedef
+int HWCryptoHook_RSAGetPublicKey_t(HWCryptoHook_RSAKeyHandle k,
+                                   HWCryptoHook_MPI *n,
+                                   HWCryptoHook_MPI *e,
+                                   const HWCryptoHook_ErrMsgBuf *errors);
+extern HWCryptoHook_RSAGetPublicKey_t HWCryptoHook_RSAGetPublicKey;
+/* The crypto plugin will not store certificates.
+ *
+ * Although this function for acquiring the public key value is
+ * provided, it is not the purpose of this API to deal fully with the
+ * handling of the public key.
+ *
+ * It is expected that the crypto supplier's key generation program
+ * will provide general facilities for producing X.509
+ * self-certificates and certificate requests in PEM format.  These
+ * will be given to the user so that they can configure them in the
+ * application, send them to CAs, or whatever.
+ *
+ * In case this kind of certificate handling is not appropriate, the
+ * crypto supplier's key generation program should be able to be
+ * configured not to generate such a self-certificate or certificate
+ * request.  Then the application will need to do all of this, and
+ * will need to store and handle the public key and certificates
+ * itself.
+ */
+
+typedef
+int HWCryptoHook_RSAUnloadKey_t(HWCryptoHook_RSAKeyHandle k,
+                                const HWCryptoHook_ErrMsgBuf *errors);
+extern HWCryptoHook_RSAUnloadKey_t HWCryptoHook_RSAUnloadKey;
+/* Might fail due to locking problems, or other serious internal problems. */
+
+typedef
+int HWCryptoHook_RSA_t(HWCryptoHook_MPI m,
+                       HWCryptoHook_RSAKeyHandle k,
+                       HWCryptoHook_MPI *r,
+                       const HWCryptoHook_ErrMsgBuf *errors);
+extern HWCryptoHook_RSA_t HWCryptoHook_RSA;
+/* RSA private key operation (sign or decrypt) - raw, unpadded. */
+
+#endif /*HWCRYPTOHOOK_H*/
diff --git a/src/lib/libssl/src/engines/vendor_defns/sureware.h b/src/lib/libssl/src/engines/vendor_defns/sureware.h
new file mode 100644
index 0000000000..e46b000ddc
--- /dev/null
+++ b/src/lib/libssl/src/engines/vendor_defns/sureware.h
@@ -0,0 +1,239 @@
+/*
+* Written by Corinne Dive-Reclus(cdive@baltimore.com)
+*
+* Copyright@2001 Baltimore Technologies Ltd.
+*                                                                                                                                                                                               *       
+*               THIS FILE IS PROVIDED BY BALTIMORE TECHNOLOGIES ``AS IS'' AND                                                                                                                                                   *
+*               ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE                                   * 
+*               IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE                              *
+*               ARE DISCLAIMED.  IN NO EVENT SHALL BALTIMORE TECHNOLOGIES BE LIABLE                                             *
+*               FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL                              *
+*               DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS                                 *
+*               OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)                                   *
+*               HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT                              *
+*               LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY                               *
+*               OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF                                  *
+*               SUCH DAMAGE.                                                                                                                                                    *
+*
+* 
+*/
+#ifdef WIN32
+#define SW_EXPORT       __declspec ( dllexport )
+#else
+#define SW_EXPORT
+#endif
+
+/*
+*       List of exposed SureWare errors
+*/
+#define SUREWAREHOOK_ERROR_FAILED               -1
+#define SUREWAREHOOK_ERROR_FALLBACK             -2
+#define SUREWAREHOOK_ERROR_UNIT_FAILURE -3
+#define SUREWAREHOOK_ERROR_DATA_SIZE -4
+#define SUREWAREHOOK_ERROR_INVALID_PAD -5
+/*
+* -----------------WARNING-----------------------------------
+* In all the following functions:
+* msg is a string with at least 24 bytes free.
+* A 24 bytes string will be concatenated to the existing content of msg. 
+*/
+/*
+*       SureWare Initialisation function
+*       in param threadsafe, if !=0, thread safe enabled
+*       return SureWareHOOK_ERROR_UNIT_FAILURE if failure, 1 if success
+*/
+typedef int SureWareHook_Init_t(char*const msg,int threadsafe);
+extern SW_EXPORT SureWareHook_Init_t SureWareHook_Init;
+/*
+*       SureWare Finish function
+*/
+typedef void SureWareHook_Finish_t(void);
+extern SW_EXPORT SureWareHook_Finish_t SureWareHook_Finish;
+/*
+*        PRE_CONDITION:
+*               DO NOT CALL ANY OF THE FOLLOWING FUNCTIONS IN CASE OF INIT FAILURE
+*/
+/*
+*       SureWare RAND Bytes function
+*       In case of failure, the content of buf is unpredictable.
+*       return 1 if success
+*                       SureWareHOOK_ERROR_FALLBACK if function not available in hardware
+*                       SureWareHOOK_ERROR_FAILED if error while processing
+*                       SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure
+*                       SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf
+*
+*       in/out param buf : a num bytes long buffer where random bytes will be put
+*       in param num : the number of bytes into buf
+*/
+typedef int SureWareHook_Rand_Bytes_t(char*const msg,unsigned char *buf, int num);
+extern SW_EXPORT SureWareHook_Rand_Bytes_t SureWareHook_Rand_Bytes;
+
+/*
+*       SureWare RAND Seed function
+*       Adds some seed to the Hardware Random Number Generator
+*       return 1 if success
+*                       SureWareHOOK_ERROR_FALLBACK if function not available in hardware
+*                       SureWareHOOK_ERROR_FAILED if error while processing
+*                       SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure
+*                       SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf
+*
+*       in param buf : the seed to add into the HRNG
+*       in param num : the number of bytes into buf
+*/
+typedef int SureWareHook_Rand_Seed_t(char*const msg,const void *buf, int num);
+extern SW_EXPORT SureWareHook_Rand_Seed_t SureWareHook_Rand_Seed;
+
+/*
+*       SureWare Load Private Key function
+*       return 1 if success
+*                       SureWareHOOK_ERROR_FAILED if error while processing
+*       No hardware is contact for this function.
+*
+*       in param key_id :the name of the private protected key file without the extension
+                                                ".sws"
+*       out param hptr : a pointer to a buffer allocated by SureWare_Hook
+*       out param num: the effective key length in bytes
+*       out param keytype: 1 if RSA 2 if DSA
+*/
+typedef int SureWareHook_Load_Privkey_t(char*const msg,const char *key_id,char **hptr,unsigned long *num,char *keytype);
+extern SW_EXPORT SureWareHook_Load_Privkey_t SureWareHook_Load_Privkey;
+
+/*
+*       SureWare Info Public Key function
+*       return 1 if success
+*                       SureWareHOOK_ERROR_FAILED if error while processing
+*       No hardware is contact for this function.
+*
+*       in param key_id :the name of the private protected key file without the extension
+                                                ".swp"
+*       out param hptr : a pointer to a buffer allocated by SureWare_Hook
+*       out param num: the effective key length in bytes
+*       out param keytype: 1 if RSA 2 if DSA
+*/
+typedef int SureWareHook_Info_Pubkey_t(char*const msg,const char *key_id,unsigned long *num,
+                                                                                char *keytype);
+extern SW_EXPORT SureWareHook_Info_Pubkey_t SureWareHook_Info_Pubkey;
+
+/*
+*       SureWare Load Public Key function
+*       return 1 if success
+*                       SureWareHOOK_ERROR_FAILED if error while processing
+*       No hardware is contact for this function.
+*
+*       in param key_id :the name of the public protected key file without the extension
+                                                ".swp"
+*       in param num : the bytes size of n and e
+*       out param n: where to write modulus in bn format
+*       out param e: where to write exponent in bn format
+*/
+typedef int SureWareHook_Load_Rsa_Pubkey_t(char*const msg,const char *key_id,unsigned long num,
+                                                                                unsigned long *n, unsigned long *e);
+extern SW_EXPORT SureWareHook_Load_Rsa_Pubkey_t SureWareHook_Load_Rsa_Pubkey;
+
+/*
+*       SureWare Load DSA Public Key function
+*       return 1 if success
+*                       SureWareHOOK_ERROR_FAILED if error while processing
+*       No hardware is contact for this function.
+*
+*       in param key_id :the name of the public protected key file without the extension
+                                                ".swp"
+*       in param num : the bytes size of n and e
+*       out param pub: where to write pub key in bn format
+*       out param p: where to write prime in bn format
+*       out param q: where to write sunprime (length 20 bytes) in bn format
+*       out param g: where to write base in bn format
+*/
+typedef int SureWareHook_Load_Dsa_Pubkey_t(char*const msg,const char *key_id,unsigned long num,
+                                                                                unsigned long *pub, unsigned long *p,unsigned long*q,
+                                                                                unsigned long *g);
+extern SW_EXPORT SureWareHook_Load_Dsa_Pubkey_t SureWareHook_Load_Dsa_Pubkey;
+
+/*
+*       SureWare Free function
+*       Destroy the key into the hardware if destroy==1
+*/
+typedef void SureWareHook_Free_t(char *p,int destroy);
+extern SW_EXPORT SureWareHook_Free_t SureWareHook_Free;
+
+#define SUREWARE_PKCS1_PAD 1
+#define SUREWARE_ISO9796_PAD 2
+#define SUREWARE_NO_PAD 0
+/*
+* SureWare RSA Private Decryption
+* return 1 if success
+*                       SureWareHOOK_ERROR_FAILED if error while processing
+*                       SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure
+*                       SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf
+*
+*       in param flen : byte size of from and to
+*       in param from : encrypted data buffer, should be a not-null valid pointer
+*       out param tlen: byte size of decrypted data, if error, unexpected value
+*       out param to : decrypted data buffer, should be a not-null valid pointer
+*   in param prsa: a protected key pointer, should be a not-null valid pointer
+*   int padding: padding id as follow
+*                                       SUREWARE_PKCS1_PAD
+*                                       SUREWARE_NO_PAD
+*
+*/
+typedef int SureWareHook_Rsa_Priv_Dec_t(char*const msg,int flen,unsigned char *from,
+                                                                                int *tlen,unsigned char *to,
+                                                                                char *prsa,int padding);
+extern SW_EXPORT SureWareHook_Rsa_Priv_Dec_t SureWareHook_Rsa_Priv_Dec;
+/*
+* SureWare RSA Signature
+* return 1 if success
+*                       SureWareHOOK_ERROR_FAILED if error while processing
+*                       SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure
+*                       SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf
+*
+*       in param flen : byte size of from and to
+*       in param from : encrypted data buffer, should be a not-null valid pointer
+*       out param tlen: byte size of decrypted data, if error, unexpected value
+*       out param to : decrypted data buffer, should be a not-null valid pointer
+*   in param prsa: a protected key pointer, should be a not-null valid pointer
+*   int padding: padding id as follow
+*                                       SUREWARE_PKCS1_PAD
+*                                       SUREWARE_ISO9796_PAD
+*
+*/
+typedef int SureWareHook_Rsa_Sign_t(char*const msg,int flen,unsigned char *from,
+                                                                                int *tlen,unsigned char *to,
+                                                                                char *prsa,int padding);
+extern SW_EXPORT SureWareHook_Rsa_Sign_t SureWareHook_Rsa_Sign;
+/*
+* SureWare DSA Signature
+* return 1 if success
+*                       SureWareHOOK_ERROR_FAILED if error while processing
+*                       SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure
+*                       SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf
+*
+*       in param flen : byte size of from and to
+*       in param from : encrypted data buffer, should be a not-null valid pointer
+*       out param to : decrypted data buffer, should be a 40bytes valid pointer
+*   in param pdsa: a protected key pointer, should be a not-null valid pointer
+*
+*/
+typedef int SureWareHook_Dsa_Sign_t(char*const msg,int flen,const unsigned char *from,
+                                                                                unsigned long *r,unsigned long *s,char *pdsa);
+extern SW_EXPORT SureWareHook_Dsa_Sign_t SureWareHook_Dsa_Sign;
+
+
+/*
+* SureWare Mod Exp
+* return 1 if success
+*                       SureWareHOOK_ERROR_FAILED if error while processing
+*                       SureWareHOOK_ERROR_UNIT_FAILURE if hardware failure
+*                       SUREWAREHOOK_ERROR_DATA_SIZE wrong size for buf
+*
+*       mod and res are mlen bytes long.
+*       exp is elen bytes long
+*       data is dlen bytes long
+*       mlen,elen and dlen are all multiple of sizeof(unsigned long)
+*/
+typedef int SureWareHook_Mod_Exp_t(char*const msg,int mlen,const unsigned long *mod,
+                                                                        int elen,const unsigned long *exponent,
+                                                                        int dlen,unsigned long *data,
+                                                                        unsigned long *res);
+extern SW_EXPORT SureWareHook_Mod_Exp_t SureWareHook_Mod_Exp;
+
diff --git a/src/lib/libssl/src/ssl/d1_both.c b/src/lib/libssl/src/ssl/d1_both.c
new file mode 100644
index 0000000000..15a201a25c
--- /dev/null
+++ b/src/lib/libssl/src/ssl/d1_both.c
@@ -0,0 +1,1193 @@
+/* ssl/d1_both.c */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <limits.h>
+#include <string.h>
+#include <stdio.h>
+#include "ssl_locl.h"
+#include <openssl/buffer.h>
+#include <openssl/rand.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
+#include <openssl/x509.h>
+
+
+/* XDTLS:  figure out the right values */
+static unsigned int g_probable_mtu[] = {1500 - 28, 512 - 28, 256 - 28};
+
+static unsigned int dtls1_min_mtu(void);
+static unsigned int dtls1_guess_mtu(unsigned int curr_mtu);
+static void dtls1_fix_message_header(SSL *s, unsigned long frag_off, 
+        unsigned long frag_len);
+static unsigned char *dtls1_write_message_header(SSL *s,
+        unsigned char *p);
+static void dtls1_set_message_header_int(SSL *s, unsigned char mt,
+        unsigned long len, unsigned short seq_num, unsigned long frag_off, 
+        unsigned long frag_len);
+static int dtls1_retransmit_buffered_messages(SSL *s);
+static long dtls1_get_message_fragment(SSL *s, int st1, int stn, 
+        long max, int *ok);
+
+static hm_fragment *
+dtls1_hm_fragment_new(unsigned long frag_len)
+        {
+        hm_fragment *frag = NULL;
+        unsigned char *buf = NULL;
+
+        frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
+        if ( frag == NULL)
+                return NULL;
+
+        if (frag_len)
+                {
+                buf = (unsigned char *)OPENSSL_malloc(frag_len);
+                if ( buf == NULL)
+                        {
+                        OPENSSL_free(frag);
+                        return NULL;
+                        }
+                }
+
+        /* zero length fragment gets zero frag->fragment */
+        frag->fragment = buf;
+
+        return frag;
+        }
+
+static void
+dtls1_hm_fragment_free(hm_fragment *frag)
+        {
+        if (frag->fragment) OPENSSL_free(frag->fragment);
+        OPENSSL_free(frag);
+        }
+
+/* send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or SSL3_RT_CHANGE_CIPHER_SPEC) */
+int dtls1_do_write(SSL *s, int type)
+        {
+        int ret;
+        int curr_mtu;
+        unsigned int len, frag_off;
+
+        /* AHA!  Figure out the MTU, and stick to the right size */
+        if ( ! (SSL_get_options(s) & SSL_OP_NO_QUERY_MTU))
+                {
+                s->d1->mtu = 
+                        BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_QUERY_MTU, 0, NULL);
+
+                /* I've seen the kernel return bogus numbers when it doesn't know
+                 * (initial write), so just make sure we have a reasonable number */
+                if ( s->d1->mtu < dtls1_min_mtu())
+                        {
+                        s->d1->mtu = 0;
+                        s->d1->mtu = dtls1_guess_mtu(s->d1->mtu);
+                        BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SET_MTU, 
+                                s->d1->mtu, NULL);
+                        }
+                }
+#if 0 
+        mtu = s->d1->mtu;
+
+        fprintf(stderr, "using MTU = %d\n", mtu);
+
+        mtu -= (DTLS1_HM_HEADER_LENGTH + DTLS1_RT_HEADER_LENGTH);
+
+        curr_mtu = mtu - BIO_wpending(SSL_get_wbio(s));
+
+        if ( curr_mtu > 0)
+                mtu = curr_mtu;
+        else if ( ( ret = BIO_flush(SSL_get_wbio(s))) <= 0)
+                return ret;
+
+        if ( BIO_wpending(SSL_get_wbio(s)) + s->init_num >= mtu)
+                {
+                ret = BIO_flush(SSL_get_wbio(s));
+                if ( ret <= 0)
+                        return ret;
+                mtu = s->d1->mtu - (DTLS1_HM_HEADER_LENGTH + DTLS1_RT_HEADER_LENGTH);
+                }
+
+        OPENSSL_assert(mtu > 0);  /* should have something reasonable now */
+
+#endif
+
+        if ( s->init_off == 0  && type == SSL3_RT_HANDSHAKE)
+                OPENSSL_assert(s->init_num == 
+                        (int)s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH);
+
+        frag_off = 0;
+        while( s->init_num)
+                {
+                curr_mtu = s->d1->mtu - BIO_wpending(SSL_get_wbio(s)) - 
+                        DTLS1_RT_HEADER_LENGTH;
+
+                if ( curr_mtu <= DTLS1_HM_HEADER_LENGTH)
+                        {
+                        /* grr.. we could get an error if MTU picked was wrong */
+                        ret = BIO_flush(SSL_get_wbio(s));
+                        if ( ret <= 0)
+                                return ret;
+                        curr_mtu = s->d1->mtu - DTLS1_RT_HEADER_LENGTH;
+                        }
+
+                if ( s->init_num > curr_mtu)
+                        len = curr_mtu;
+                else
+                        len = s->init_num;
+
+
+                /* XDTLS: this function is too long.  split out the CCS part */
+                if ( type == SSL3_RT_HANDSHAKE)
+                        {
+                        if ( s->init_off != 0)
+                                {
+                                OPENSSL_assert(s->init_off > DTLS1_HM_HEADER_LENGTH);
+                                s->init_off -= DTLS1_HM_HEADER_LENGTH;
+                                s->init_num += DTLS1_HM_HEADER_LENGTH;
+
+                                /* write atleast DTLS1_HM_HEADER_LENGTH bytes */
+                                if ( len <= DTLS1_HM_HEADER_LENGTH)  
+                                        len += DTLS1_HM_HEADER_LENGTH;
+                                }
+
+                        dtls1_fix_message_header(s, frag_off, 
+                                len - DTLS1_HM_HEADER_LENGTH);
+
+                        dtls1_write_message_header(s, (unsigned char *)&s->init_buf->data[s->init_off]);
+
+                        OPENSSL_assert(len >= DTLS1_HM_HEADER_LENGTH);
+                        }
+
+                ret=dtls1_write_bytes(s,type,&s->init_buf->data[s->init_off],
+                        len);
+                if (ret < 0)
+                        {
+                        /* might need to update MTU here, but we don't know
+                         * which previous packet caused the failure -- so can't
+                         * really retransmit anything.  continue as if everything
+                         * is fine and wait for an alert to handle the
+                         * retransmit 
+                         */
+                        if ( BIO_ctrl(SSL_get_wbio(s),
+                                BIO_CTRL_DGRAM_MTU_EXCEEDED, 0, NULL))
+                                s->d1->mtu = BIO_ctrl(SSL_get_wbio(s),
+                                        BIO_CTRL_DGRAM_QUERY_MTU, 0, NULL);
+                        else
+                                return(-1);
+                        }
+                else
+                        {
+
+                        /* bad if this assert fails, only part of the handshake
+                         * message got sent.  but why would this happen? */
+                        OPENSSL_assert(len == (unsigned int)ret);
+
+                        if (type == SSL3_RT_HANDSHAKE && ! s->d1->retransmitting)
+                                {
+                                /* should not be done for 'Hello Request's, but in that case
+                                 * we'll ignore the result anyway */
+                                unsigned char *p = (unsigned char *)&s->init_buf->data[s->init_off];
+                                const struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
+                                int xlen;
+
+                                if (frag_off == 0 && s->client_version != DTLS1_BAD_VER)
+                                        {
+                                        /* reconstruct message header is if it
+                                         * is being sent in single fragment */
+                                        *p++ = msg_hdr->type;
+                                        l2n3(msg_hdr->msg_len,p);
+                                        s2n (msg_hdr->seq,p);
+                                        l2n3(0,p);
+                                        l2n3(msg_hdr->msg_len,p);
+                                        p  -= DTLS1_HM_HEADER_LENGTH;
+                                        xlen = ret;
+                                        }
+                                else
+                                        {
+                                        p  += DTLS1_HM_HEADER_LENGTH;
+                                        xlen = ret - DTLS1_HM_HEADER_LENGTH;
+                                        }
+
+                                ssl3_finish_mac(s, p, xlen);
+                                }
+
+                        if (ret == s->init_num)
+                                {
+                                if (s->msg_callback)
+                                        s->msg_callback(1, s->version, type, s->init_buf->data, 
+                                                (size_t)(s->init_off + s->init_num), s, 
+                                                s->msg_callback_arg);
+
+                                s->init_off = 0;  /* done writing this message */
+                                s->init_num = 0;
+
+                                return(1);
+                                }
+                        s->init_off+=ret;
+                        s->init_num-=ret;
+                        frag_off += (ret -= DTLS1_HM_HEADER_LENGTH);
+                        }
+                }
+        return(0);
+        }
+
+
+/* Obtain handshake message of message type 'mt' (any if mt == -1),
+ * maximum acceptable body length 'max'.
+ * Read an entire handshake message.  Handshake messages arrive in
+ * fragments.
+ */
+long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
+        {
+        int i, al;
+        struct hm_header_st *msg_hdr;
+
+        /* s3->tmp is used to store messages that are unexpected, caused
+         * by the absence of an optional handshake message */
+        if (s->s3->tmp.reuse_message)
+                {
+                s->s3->tmp.reuse_message=0;
+                if ((mt >= 0) && (s->s3->tmp.message_type != mt))
+                        {
+                        al=SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_DTLS1_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
+                        goto f_err;
+                        }
+                *ok=1;
+                s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
+                s->init_num = (int)s->s3->tmp.message_size;
+                return s->init_num;
+                }
+
+        msg_hdr = &s->d1->r_msg_hdr;
+        do
+                {
+                if ( msg_hdr->frag_off == 0)
+                        {
+                        /* s->d1->r_message_header.msg_len = 0; */
+                        memset(msg_hdr, 0x00, sizeof(struct hm_header_st));
+                        }
+
+                i = dtls1_get_message_fragment(s, st1, stn, max, ok);
+                if ( i == DTLS1_HM_BAD_FRAGMENT ||
+                        i == DTLS1_HM_FRAGMENT_RETRY)  /* bad fragment received */
+                        continue;
+                else if ( i <= 0 && !*ok)
+                        return i;
+
+                /* Note that s->init_sum is used as a counter summing
+                 * up fragments' lengths: as soon as they sum up to
+                 * handshake packet length, we assume we have got all
+                 * the fragments. Overlapping fragments would cause
+                 * premature termination, so we don't expect overlaps.
+                 * Well, handling overlaps would require something more
+                 * drastic. Indeed, as it is now there is no way to
+                 * tell if out-of-order fragment from the middle was
+                 * the last. '>=' is the best/least we can do to control
+                 * the potential damage caused by malformed overlaps. */
+                if ((unsigned int)s->init_num >= msg_hdr->msg_len)
+                        {
+                        unsigned char *p = (unsigned char *)s->init_buf->data;
+                        unsigned long msg_len = msg_hdr->msg_len;
+
+                        /* reconstruct message header as if it was
+                         * sent in single fragment */
+                        *(p++) = msg_hdr->type;
+                        l2n3(msg_len,p);
+                        s2n (msg_hdr->seq,p);
+                        l2n3(0,p);
+                        l2n3(msg_len,p);
+                        if (s->client_version != DTLS1_BAD_VER)
+                                p       -= DTLS1_HM_HEADER_LENGTH,
+                                msg_len += DTLS1_HM_HEADER_LENGTH;
+
+                        ssl3_finish_mac(s, p, msg_len);
+                        if (s->msg_callback)
+                                s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,
+                                        p, msg_len,
+                                        s, s->msg_callback_arg);
+
+                        memset(msg_hdr, 0x00, sizeof(struct hm_header_st));
+
+                        s->d1->handshake_read_seq++;
+                        /* we just read a handshake message from the other side:
+                         * this means that we don't need to retransmit of the
+                         * buffered messages.  
+                         * XDTLS: may be able clear out this
+                         * buffer a little sooner (i.e if an out-of-order
+                         * handshake message/record is received at the record
+                         * layer.  
+                         * XDTLS: exception is that the server needs to
+                         * know that change cipher spec and finished messages
+                         * have been received by the client before clearing this
+                         * buffer.  this can simply be done by waiting for the
+                         * first data  segment, but is there a better way?  */
+                        dtls1_clear_record_buffer(s);
+
+                        s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
+                        return s->init_num;
+                        }
+                else
+                        msg_hdr->frag_off = i;
+                } while(1) ;
+
+f_err:
+        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+        *ok = 0;
+        return -1;
+        }
+
+
+static int dtls1_preprocess_fragment(SSL *s,struct hm_header_st *msg_hdr,int max)
+        {
+        size_t frag_off,frag_len,msg_len;
+
+        msg_len  = msg_hdr->msg_len;
+        frag_off = msg_hdr->frag_off;
+        frag_len = msg_hdr->frag_len;
+
+        /* sanity checking */
+        if ( (frag_off+frag_len) > msg_len)
+                {
+                SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);
+                return SSL_AD_ILLEGAL_PARAMETER;
+                }
+
+        if ( (frag_off+frag_len) > (unsigned long)max)
+                {
+                SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);
+                return SSL_AD_ILLEGAL_PARAMETER;
+                }
+
+        if ( s->d1->r_msg_hdr.frag_off == 0) /* first fragment */
+                {
+                /* msg_len is limited to 2^24, but is effectively checked
+                 * against max above */
+                if (!BUF_MEM_grow_clean(s->init_buf,(int)msg_len+DTLS1_HM_HEADER_LENGTH))
+                        {
+                        SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT,ERR_R_BUF_LIB);
+                        return SSL_AD_INTERNAL_ERROR;
+                        }
+
+                s->s3->tmp.message_size  = msg_len;
+                s->d1->r_msg_hdr.msg_len = msg_len;
+                s->s3->tmp.message_type  = msg_hdr->type;
+                s->d1->r_msg_hdr.type    = msg_hdr->type;
+                s->d1->r_msg_hdr.seq     = msg_hdr->seq;
+                }
+        else if (msg_len != s->d1->r_msg_hdr.msg_len)
+                {
+                /* They must be playing with us! BTW, failure to enforce
+                 * upper limit would open possibility for buffer overrun. */
+                SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);
+                return SSL_AD_ILLEGAL_PARAMETER;
+                }
+
+        return 0; /* no error */
+        }
+
+
+static int
+dtls1_retrieve_buffered_fragment(SSL *s, long max, int *ok)
+        {
+        /* (0) check whether the desired fragment is available
+         * if so:
+         * (1) copy over the fragment to s->init_buf->data[]
+         * (2) update s->init_num
+         */
+        pitem *item;
+        hm_fragment *frag;
+        int al;
+
+        *ok = 0;
+        item = pqueue_peek(s->d1->buffered_messages);
+        if ( item == NULL)
+                return 0;
+
+        frag = (hm_fragment *)item->data;
+
+        if ( s->d1->handshake_read_seq == frag->msg_header.seq)
+                {
+                pqueue_pop(s->d1->buffered_messages);
+
+                al=dtls1_preprocess_fragment(s,&frag->msg_header,max);
+
+                if (al==0) /* no alert */
+                        {
+                        unsigned char *p = (unsigned char *)s->init_buf->data+DTLS1_HM_HEADER_LENGTH;
+                        memcpy(&p[frag->msg_header.frag_off],
+                                frag->fragment,frag->msg_header.frag_len);
+                        }
+
+                dtls1_hm_fragment_free(frag);
+                pitem_free(item);
+
+                if (al==0)
+                        {
+                        *ok = 1;
+                        return frag->msg_header.frag_len;
+                        }
+
+                ssl3_send_alert(s,SSL3_AL_FATAL,al);
+                s->init_num = 0;
+                *ok = 0;
+                return -1;
+                }
+        else
+                return 0;
+        }
+
+
+static int
+dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+{
+        int i=-1;
+        hm_fragment *frag = NULL;
+        pitem *item = NULL;
+        PQ_64BIT seq64;
+        unsigned long frag_len = msg_hdr->frag_len;
+
+        if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len)
+                goto err;
+
+        if (msg_hdr->seq <= s->d1->handshake_read_seq)
+                {
+                unsigned char devnull [256];
+
+                while (frag_len)
+                        {
+                        i = s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
+                                devnull,
+                                frag_len>sizeof(devnull)?sizeof(devnull):frag_len,0);
+                        if (i<=0) goto err;
+                        frag_len -= i;
+                        }
+                }
+
+        frag = dtls1_hm_fragment_new(frag_len);
+        if ( frag == NULL)
+                goto err;
+
+        memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
+
+        if (frag_len)
+                {
+                /* read the body of the fragment (header has already been read */
+                i = s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
+                        frag->fragment,frag_len,0);
+                if (i<=0 || (unsigned long)i!=frag_len)
+                        goto err;
+                }
+
+        pq_64bit_init(&seq64);
+        pq_64bit_assign_word(&seq64, msg_hdr->seq);
+
+        item = pitem_new(seq64, frag);
+        pq_64bit_free(&seq64);
+        if ( item == NULL)
+                goto err;
+
+        pqueue_insert(s->d1->buffered_messages, item);
+        return DTLS1_HM_FRAGMENT_RETRY;
+
+err:
+        if ( frag != NULL) dtls1_hm_fragment_free(frag);
+        if ( item != NULL) OPENSSL_free(item);
+        *ok = 0;
+        return i;
+        }
+
+
+static long
+dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
+        {
+        unsigned char wire[DTLS1_HM_HEADER_LENGTH];
+        unsigned long l, frag_off, frag_len;
+        int i,al;
+        struct hm_header_st msg_hdr;
+
+        /* see if we have the required fragment already */
+        if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok)
+                {
+                if (*ok)        s->init_num += frag_len;
+                return frag_len;
+                }
+
+        /* read handshake message header */
+        i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,wire,
+                DTLS1_HM_HEADER_LENGTH, 0);
+        if (i <= 0)     /* nbio, or an error */
+                {
+                s->rwstate=SSL_READING;
+                *ok = 0;
+                return i;
+                }
+        OPENSSL_assert(i == DTLS1_HM_HEADER_LENGTH);
+
+        /* parse the message fragment header */
+        dtls1_get_message_header(wire, &msg_hdr);
+
+        /* 
+         * if this is a future (or stale) message it gets buffered
+         * (or dropped)--no further processing at this time 
+         */
+        if ( msg_hdr.seq != s->d1->handshake_read_seq)
+                return dtls1_process_out_of_seq_message(s, &msg_hdr, ok);
+
+        l = msg_hdr.msg_len;
+        frag_off = msg_hdr.frag_off;
+        frag_len = msg_hdr.frag_len;
+
+        if (!s->server && s->d1->r_msg_hdr.frag_off == 0 &&
+                wire[0] == SSL3_MT_HELLO_REQUEST)
+                {
+                /* The server may always send 'Hello Request' messages --
+                 * we are doing a handshake anyway now, so ignore them
+                 * if their format is correct. Does not count for
+                 * 'Finished' MAC. */
+                if (wire[1] == 0 && wire[2] == 0 && wire[3] == 0)
+                        {
+                        if (s->msg_callback)
+                                s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, 
+                                        wire, DTLS1_HM_HEADER_LENGTH, s, 
+                                        s->msg_callback_arg);
+                        
+                        s->init_num = 0;
+                        return dtls1_get_message_fragment(s, st1, stn,
+                                max, ok);
+                        }
+                else /* Incorrectly formated Hello request */
+                        {
+                        al=SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_UNEXPECTED_MESSAGE);
+                        goto f_err;
+                        }
+                }
+
+        if ((al=dtls1_preprocess_fragment(s,&msg_hdr,max)))
+                goto f_err;
+
+        /* XDTLS:  ressurect this when restart is in place */
+        s->state=stn;
+
+        if ( frag_len > 0)
+                {
+                unsigned char *p=(unsigned char *)s->init_buf->data+DTLS1_HM_HEADER_LENGTH;
+
+                i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
+                        &p[frag_off],frag_len,0);
+                /* XDTLS:  fix this--message fragments cannot span multiple packets */
+                if (i <= 0)
+                        {
+                        s->rwstate=SSL_READING;
+                        *ok = 0;
+                        return i;
+                        }
+                }
+        else
+                i = 0;
+
+        /* XDTLS:  an incorrectly formatted fragment should cause the 
+         * handshake to fail */
+        OPENSSL_assert(i == (int)frag_len);
+
+        *ok = 1;
+
+        /* Note that s->init_num is *not* used as current offset in
+         * s->init_buf->data, but as a counter summing up fragments'
+         * lengths: as soon as they sum up to handshake packet
+         * length, we assume we have got all the fragments. */
+        s->init_num += frag_len;
+        return frag_len;
+
+f_err:
+        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+        s->init_num = 0;
+
+        *ok=0;
+        return(-1);
+        }
+
+int dtls1_send_finished(SSL *s, int a, int b, const char *sender, int slen)
+        {
+        unsigned char *p,*d;
+        int i;
+        unsigned long l;
+
+        if (s->state == a)
+                {
+                d=(unsigned char *)s->init_buf->data;
+                p= &(d[DTLS1_HM_HEADER_LENGTH]);
+
+                i=s->method->ssl3_enc->final_finish_mac(s,
+                        &(s->s3->finish_dgst1),
+                        &(s->s3->finish_dgst2),
+                        sender,slen,s->s3->tmp.finish_md);
+                s->s3->tmp.finish_md_len = i;
+                memcpy(p, s->s3->tmp.finish_md, i);
+                p+=i;
+                l=i;
+
+#ifdef OPENSSL_SYS_WIN16
+                /* MSVC 1.5 does not clear the top bytes of the word unless
+                 * I do this.
+                 */
+                l&=0xffff;
+#endif
+
+                d = dtls1_set_message_header(s, d, SSL3_MT_FINISHED, l, 0, l);
+                s->init_num=(int)l+DTLS1_HM_HEADER_LENGTH;
+                s->init_off=0;
+
+                /* buffer the message to handle re-xmits */
+                dtls1_buffer_message(s, 0);
+
+                s->state=b;
+                }
+
+        /* SSL3_ST_SEND_xxxxxx_HELLO_B */
+        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+        }
+
+/* for these 2 messages, we need to
+ * ssl->enc_read_ctx                    re-init
+ * ssl->s3->read_sequence               zero
+ * ssl->s3->read_mac_secret             re-init
+ * ssl->session->read_sym_enc           assign
+ * ssl->session->read_compression       assign
+ * ssl->session->read_hash              assign
+ */
+int dtls1_send_change_cipher_spec(SSL *s, int a, int b)
+        { 
+        unsigned char *p;
+
+        if (s->state == a)
+                {
+                p=(unsigned char *)s->init_buf->data;
+                *p++=SSL3_MT_CCS;
+                s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
+                s->init_num=DTLS1_CCS_HEADER_LENGTH;
+
+                if (s->client_version == DTLS1_BAD_VER)
+                        {
+                        s->d1->next_handshake_write_seq++;
+                        s2n(s->d1->handshake_write_seq,p);
+                        s->init_num+=2;
+                        }
+
+                s->init_off=0;
+
+                dtls1_set_message_header_int(s, SSL3_MT_CCS, 0, 
+                        s->d1->handshake_write_seq, 0, 0);
+
+                /* buffer the message to handle re-xmits */
+                dtls1_buffer_message(s, 1);
+
+                s->state=b;
+                }
+
+        /* SSL3_ST_CW_CHANGE_B */
+        return(dtls1_do_write(s,SSL3_RT_CHANGE_CIPHER_SPEC));
+        }
+
+unsigned long dtls1_output_cert_chain(SSL *s, X509 *x)
+        {
+        unsigned char *p;
+        int n,i;
+        unsigned long l= 3 + DTLS1_HM_HEADER_LENGTH;
+        BUF_MEM *buf;
+        X509_STORE_CTX xs_ctx;
+        X509_OBJECT obj;
+
+        /* TLSv1 sends a chain with nothing in it, instead of an alert */
+        buf=s->init_buf;
+        if (!BUF_MEM_grow_clean(buf,10))
+                {
+                SSLerr(SSL_F_DTLS1_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
+                return(0);
+                }
+        if (x != NULL)
+                {
+                if(!X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,NULL,NULL))
+                        {
+                        SSLerr(SSL_F_DTLS1_OUTPUT_CERT_CHAIN,ERR_R_X509_LIB);
+                        return(0);
+                        }
+
+                for (;;)
+                        {
+                        n=i2d_X509(x,NULL);
+                        if (!BUF_MEM_grow_clean(buf,(int)(n+l+3)))
+                                {
+                                SSLerr(SSL_F_DTLS1_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
+                                return(0);
+                                }
+                        p=(unsigned char *)&(buf->data[l]);
+                        l2n3(n,p);
+                        i2d_X509(x,&p);
+                        l+=n+3;
+                        if (X509_NAME_cmp(X509_get_subject_name(x),
+                                X509_get_issuer_name(x)) == 0) break;
+
+                        i=X509_STORE_get_by_subject(&xs_ctx,X509_LU_X509,
+                                X509_get_issuer_name(x),&obj);
+                        if (i <= 0) break;
+                        x=obj.data.x509;
+                        /* Count is one too high since the X509_STORE_get uped the
+                         * ref count */
+                        X509_free(x);
+                        }
+
+                X509_STORE_CTX_cleanup(&xs_ctx);
+                }
+
+        /* Thawte special :-) */
+        if (s->ctx->extra_certs != NULL)
+        for (i=0; i<sk_X509_num(s->ctx->extra_certs); i++)
+                {
+                x=sk_X509_value(s->ctx->extra_certs,i);
+                n=i2d_X509(x,NULL);
+                if (!BUF_MEM_grow_clean(buf,(int)(n+l+3)))
+                        {
+                        SSLerr(SSL_F_DTLS1_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
+                        return(0);
+                        }
+                p=(unsigned char *)&(buf->data[l]);
+                l2n3(n,p);
+                i2d_X509(x,&p);
+                l+=n+3;
+                }
+
+        l-= (3 + DTLS1_HM_HEADER_LENGTH);
+
+        p=(unsigned char *)&(buf->data[DTLS1_HM_HEADER_LENGTH]);
+        l2n3(l,p);
+        l+=3;
+        p=(unsigned char *)&(buf->data[0]);
+        p = dtls1_set_message_header(s, p, SSL3_MT_CERTIFICATE, l, 0, l);
+
+        l+=DTLS1_HM_HEADER_LENGTH;
+        return(l);
+        }
+
+int dtls1_read_failed(SSL *s, int code)
+        {
+        DTLS1_STATE *state;
+        BIO *bio;
+        int send_alert = 0;
+
+        if ( code > 0)
+                {
+                fprintf( stderr, "invalid state reached %s:%d", __FILE__, __LINE__);
+                return 1;
+                }
+
+        bio = SSL_get_rbio(s);
+        if ( ! BIO_dgram_recv_timedout(bio))
+                {
+                /* not a timeout, none of our business, 
+                   let higher layers handle this.  in fact it's probably an error */
+                return code;
+                }
+
+        if ( ! SSL_in_init(s))  /* done, no need to send a retransmit */
+                {
+                BIO_set_flags(SSL_get_rbio(s), BIO_FLAGS_READ);
+                return code;
+                }
+
+        state = s->d1;
+        state->timeout.num_alerts++;
+        if ( state->timeout.num_alerts > DTLS1_TMO_ALERT_COUNT)
+                {
+                /* fail the connection, enough alerts have been sent */
+                SSLerr(SSL_F_DTLS1_READ_FAILED,SSL_R_READ_TIMEOUT_EXPIRED);
+                return 0;
+                }
+
+        state->timeout.read_timeouts++;
+        if ( state->timeout.read_timeouts > DTLS1_TMO_READ_COUNT)
+                {
+                send_alert = 1;
+                state->timeout.read_timeouts = 1;
+                }
+
+
+#if 0 /* for now, each alert contains only one record number */
+        item = pqueue_peek(state->rcvd_records);
+        if ( item )
+                {
+                /* send an alert immediately for all the missing records */
+                }
+        else
+#endif
+
+#if 0  /* no more alert sending, just retransmit the last set of messages */
+                if ( send_alert)
+                        ssl3_send_alert(s,SSL3_AL_WARNING,
+                                DTLS1_AD_MISSING_HANDSHAKE_MESSAGE);
+#endif
+
+        return dtls1_retransmit_buffered_messages(s) ;
+        }
+
+
+static int
+dtls1_retransmit_buffered_messages(SSL *s)
+        {
+        pqueue sent = s->d1->sent_messages;
+        piterator iter;
+        pitem *item;
+        hm_fragment *frag;
+        int found = 0;
+
+        iter = pqueue_iterator(sent);
+
+        for ( item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter))
+                {
+                frag = (hm_fragment *)item->data;
+                if ( dtls1_retransmit_message(s, frag->msg_header.seq, 0, &found) <= 0 &&
+                        found)
+                        {
+                        fprintf(stderr, "dtls1_retransmit_message() failed\n");
+                        return -1;
+                        }
+                }
+
+        return 1;
+        }
+
+int
+dtls1_buffer_message(SSL *s, int is_ccs)
+        {
+        pitem *item;
+        hm_fragment *frag;
+        PQ_64BIT seq64;
+        unsigned int epoch = s->d1->w_epoch;
+
+        /* this function is called immediately after a message has 
+         * been serialized */
+        OPENSSL_assert(s->init_off == 0);
+
+        frag = dtls1_hm_fragment_new(s->init_num);
+
+        memcpy(frag->fragment, s->init_buf->data, s->init_num);
+
+        if ( is_ccs)
+                {
+                OPENSSL_assert(s->d1->w_msg_hdr.msg_len + 
+                        DTLS1_CCS_HEADER_LENGTH <= (unsigned int)s->init_num);
+                epoch++;
+                }
+        else
+                {
+                OPENSSL_assert(s->d1->w_msg_hdr.msg_len + 
+                        DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num);
+                }
+
+        frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;
+        frag->msg_header.seq = s->d1->w_msg_hdr.seq;
+        frag->msg_header.type = s->d1->w_msg_hdr.type;
+        frag->msg_header.frag_off = 0;
+        frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;
+        frag->msg_header.is_ccs = is_ccs;
+
+        pq_64bit_init(&seq64);
+        pq_64bit_assign_word(&seq64, epoch<<16 | frag->msg_header.seq);
+
+        item = pitem_new(seq64, frag);
+        pq_64bit_free(&seq64);
+        if ( item == NULL)
+                {
+                dtls1_hm_fragment_free(frag);
+                return 0;
+                }
+
+#if 0
+        fprintf( stderr, "buffered messge: \ttype = %xx\n", msg_buf->type);
+        fprintf( stderr, "\t\t\t\t\tlen = %d\n", msg_buf->len);
+        fprintf( stderr, "\t\t\t\t\tseq_num = %d\n", msg_buf->seq_num);
+#endif
+
+        pqueue_insert(s->d1->sent_messages, item);
+        return 1;
+        }
+
+int
+dtls1_retransmit_message(SSL *s, unsigned short seq, unsigned long frag_off,
+        int *found)
+        {
+        int ret;
+        /* XDTLS: for now assuming that read/writes are blocking */
+        pitem *item;
+        hm_fragment *frag ;
+        unsigned long header_length;
+        PQ_64BIT seq64;
+
+        /*
+          OPENSSL_assert(s->init_num == 0);
+          OPENSSL_assert(s->init_off == 0);
+         */
+
+        /* XDTLS:  the requested message ought to be found, otherwise error */
+        pq_64bit_init(&seq64);
+        pq_64bit_assign_word(&seq64, seq);
+
+        item = pqueue_find(s->d1->sent_messages, seq64);
+        pq_64bit_free(&seq64);
+        if ( item == NULL)
+                {
+                fprintf(stderr, "retransmit:  message %d non-existant\n", seq);
+                *found = 0;
+                return 0;
+                }
+
+        *found = 1;
+        frag = (hm_fragment *)item->data;
+
+        if ( frag->msg_header.is_ccs)
+                header_length = DTLS1_CCS_HEADER_LENGTH;
+        else
+                header_length = DTLS1_HM_HEADER_LENGTH;
+
+        memcpy(s->init_buf->data, frag->fragment, 
+                frag->msg_header.msg_len + header_length);
+                s->init_num = frag->msg_header.msg_len + header_length;
+
+        dtls1_set_message_header_int(s, frag->msg_header.type, 
+                frag->msg_header.msg_len, frag->msg_header.seq, 0, 
+                frag->msg_header.frag_len);
+
+        s->d1->retransmitting = 1;
+        ret = dtls1_do_write(s, frag->msg_header.is_ccs ? 
+                SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
+        s->d1->retransmitting = 0;
+
+        (void)BIO_flush(SSL_get_wbio(s));
+        return ret;
+        }
+
+/* call this function when the buffered messages are no longer needed */
+void
+dtls1_clear_record_buffer(SSL *s)
+        {
+        pitem *item;
+
+        for(item = pqueue_pop(s->d1->sent_messages);
+                item != NULL; item = pqueue_pop(s->d1->sent_messages))
+                {
+                dtls1_hm_fragment_free((hm_fragment *)item->data);
+                pitem_free(item);
+                }
+        }
+
+
+unsigned char *
+dtls1_set_message_header(SSL *s, unsigned char *p, unsigned char mt,
+                        unsigned long len, unsigned long frag_off, unsigned long frag_len)
+        {
+        if ( frag_off == 0)
+                {
+                s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
+                s->d1->next_handshake_write_seq++;
+                }
+
+        dtls1_set_message_header_int(s, mt, len, s->d1->handshake_write_seq,
+                frag_off, frag_len);
+
+        return p += DTLS1_HM_HEADER_LENGTH;
+        }
+
+
+/* don't actually do the writing, wait till the MTU has been retrieved */
+static void
+dtls1_set_message_header_int(SSL *s, unsigned char mt,
+                            unsigned long len, unsigned short seq_num, unsigned long frag_off,
+                            unsigned long frag_len)
+        {
+        struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
+
+        msg_hdr->type = mt;
+        msg_hdr->msg_len = len;
+        msg_hdr->seq = seq_num;
+        msg_hdr->frag_off = frag_off;
+        msg_hdr->frag_len = frag_len;
+        }
+
+static void
+dtls1_fix_message_header(SSL *s, unsigned long frag_off,
+                        unsigned long frag_len)
+        {
+        struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
+
+        msg_hdr->frag_off = frag_off;
+        msg_hdr->frag_len = frag_len;
+        }
+
+static unsigned char *
+dtls1_write_message_header(SSL *s, unsigned char *p)
+        {
+        struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
+
+        *p++ = msg_hdr->type;
+        l2n3(msg_hdr->msg_len, p);
+
+        s2n(msg_hdr->seq, p);
+        l2n3(msg_hdr->frag_off, p);
+        l2n3(msg_hdr->frag_len, p);
+
+        return p;
+        }
+
+static unsigned int 
+dtls1_min_mtu(void)
+        {
+        return (g_probable_mtu[(sizeof(g_probable_mtu) / 
+                sizeof(g_probable_mtu[0])) - 1]);
+        }
+
+static unsigned int 
+dtls1_guess_mtu(unsigned int curr_mtu)
+        {
+        size_t i;
+
+        if ( curr_mtu == 0 )
+                return g_probable_mtu[0] ;
+
+        for ( i = 0; i < sizeof(g_probable_mtu)/sizeof(g_probable_mtu[0]); i++)
+                if ( curr_mtu > g_probable_mtu[i])
+                        return g_probable_mtu[i];
+
+        return curr_mtu;
+        }
+
+void
+dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr)
+        {
+        memset(msg_hdr, 0x00, sizeof(struct hm_header_st));
+        msg_hdr->type = *(data++);
+        n2l3(data, msg_hdr->msg_len);
+
+        n2s(data, msg_hdr->seq);
+        n2l3(data, msg_hdr->frag_off);
+        n2l3(data, msg_hdr->frag_len);
+        }
+
+void
+dtls1_get_ccs_header(unsigned char *data, struct ccs_header_st *ccs_hdr)
+        {
+        memset(ccs_hdr, 0x00, sizeof(struct ccs_header_st));
+
+        ccs_hdr->type = *(data++);
+        }
diff --git a/src/lib/libssl/src/ssl/d1_clnt.c b/src/lib/libssl/src/ssl/d1_clnt.c
new file mode 100644
index 0000000000..5e59dc845a
--- /dev/null
+++ b/src/lib/libssl/src/ssl/d1_clnt.c
@@ -0,0 +1,1156 @@
+/* ssl/d1_clnt.c */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "ssl_locl.h"
+#include "kssl_lcl.h"
+#include <openssl/buffer.h>
+#include <openssl/rand.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
+#include <openssl/md5.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+
+static SSL_METHOD *dtls1_get_client_method(int ver);
+static int dtls1_get_hello_verify(SSL *s);
+
+static SSL_METHOD *dtls1_get_client_method(int ver)
+        {
+        if (ver == DTLS1_VERSION)
+                return(DTLSv1_client_method());
+        else
+                return(NULL);
+        }
+
+IMPLEMENT_dtls1_meth_func(DTLSv1_client_method,
+                        ssl_undefined_function,
+                        dtls1_connect,
+                        dtls1_get_client_method)
+
+int dtls1_connect(SSL *s)
+        {
+        BUF_MEM *buf=NULL;
+        unsigned long Time=(unsigned long)time(NULL),l;
+        long num1;
+        void (*cb)(const SSL *ssl,int type,int val)=NULL;
+        int ret= -1;
+        int new_state,state,skip=0;;
+
+        RAND_add(&Time,sizeof(Time),0);
+        ERR_clear_error();
+        clear_sys_error();
+
+        if (s->info_callback != NULL)
+                cb=s->info_callback;
+        else if (s->ctx->info_callback != NULL)
+                cb=s->ctx->info_callback;
+        
+        s->in_handshake++;
+        if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s); 
+
+        for (;;)
+                {
+                state=s->state;
+
+                switch(s->state)
+                        {
+                case SSL_ST_RENEGOTIATE:
+                        s->new_session=1;
+                        s->state=SSL_ST_CONNECT;
+                        s->ctx->stats.sess_connect_renegotiate++;
+                        /* break */
+                case SSL_ST_BEFORE:
+                case SSL_ST_CONNECT:
+                case SSL_ST_BEFORE|SSL_ST_CONNECT:
+                case SSL_ST_OK|SSL_ST_CONNECT:
+
+                        s->server=0;
+                        if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
+
+                        if ((s->version & 0xff00 ) != (DTLS1_VERSION & 0xff00))
+                                {
+                                SSLerr(SSL_F_DTLS1_CONNECT, ERR_R_INTERNAL_ERROR);
+                                ret = -1;
+                                goto end;
+                                }
+                                
+                        /* s->version=SSL3_VERSION; */
+                        s->type=SSL_ST_CONNECT;
+
+                        if (s->init_buf == NULL)
+                                {
+                                if ((buf=BUF_MEM_new()) == NULL)
+                                        {
+                                        ret= -1;
+                                        goto end;
+                                        }
+                                if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
+                                        {
+                                        ret= -1;
+                                        goto end;
+                                        }
+                                s->init_buf=buf;
+                                buf=NULL;
+                                }
+
+                        if (!ssl3_setup_buffers(s)) { ret= -1; goto end; }
+
+                        /* setup buffing BIO */
+                        if (!ssl_init_wbio_buffer(s,0)) { ret= -1; goto end; }
+
+                        /* don't push the buffering BIO quite yet */
+
+                        s->state=SSL3_ST_CW_CLNT_HELLO_A;
+                        s->ctx->stats.sess_connect++;
+                        s->init_num=0;
+                        /* mark client_random uninitialized */
+                        memset(s->s3->client_random,0,sizeof(s->s3->client_random));
+                        break;
+
+                case SSL3_ST_CW_CLNT_HELLO_A:
+                case SSL3_ST_CW_CLNT_HELLO_B:
+
+                        s->shutdown=0;
+
+                        /* every DTLS ClientHello resets Finished MAC */
+                        ssl3_init_finished_mac(s);
+
+                        ret=dtls1_client_hello(s);
+                        if (ret <= 0) goto end;
+
+                        if ( s->d1->send_cookie)
+                                {
+                                s->state=SSL3_ST_CW_FLUSH;
+                                s->s3->tmp.next_state=SSL3_ST_CR_SRVR_HELLO_A;
+                                }
+                        else
+                                s->state=SSL3_ST_CR_SRVR_HELLO_A;
+
+                        s->init_num=0;
+
+                        /* turn on buffering for the next lot of output */
+                        if (s->bbio != s->wbio)
+                                s->wbio=BIO_push(s->bbio,s->wbio);
+
+                        break;
+
+                case SSL3_ST_CR_SRVR_HELLO_A:
+                case SSL3_ST_CR_SRVR_HELLO_B:
+                        ret=ssl3_get_server_hello(s);
+                        if (ret <= 0) goto end;
+                        else
+                                {
+                                if (s->hit)
+                                        s->state=SSL3_ST_CR_FINISHED_A;
+                                else
+                                        s->state=DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A;
+                                }
+                        s->init_num=0;
+                        break;
+
+                case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A:
+                case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B:
+
+                        ret = dtls1_get_hello_verify(s);
+                        if ( ret <= 0)
+                                goto end;
+                        if ( s->d1->send_cookie) /* start again, with a cookie */
+                                s->state=SSL3_ST_CW_CLNT_HELLO_A;
+                        else
+                                s->state = SSL3_ST_CR_CERT_A;
+                        s->init_num = 0;
+                        break;
+
+                case SSL3_ST_CR_CERT_A:
+                case SSL3_ST_CR_CERT_B:
+                        /* Check if it is anon DH */
+                        if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
+                                {
+                                ret=ssl3_get_server_certificate(s);
+                                if (ret <= 0) goto end;
+                                }
+                        else
+                                skip=1;
+                        s->state=SSL3_ST_CR_KEY_EXCH_A;
+                        s->init_num=0;
+                        break;
+
+                case SSL3_ST_CR_KEY_EXCH_A:
+                case SSL3_ST_CR_KEY_EXCH_B:
+                        ret=ssl3_get_key_exchange(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_CR_CERT_REQ_A;
+                        s->init_num=0;
+
+                        /* at this point we check that we have the
+                         * required stuff from the server */
+                        if (!ssl3_check_cert_and_algorithm(s))
+                                {
+                                ret= -1;
+                                goto end;
+                                }
+                        break;
+
+                case SSL3_ST_CR_CERT_REQ_A:
+                case SSL3_ST_CR_CERT_REQ_B:
+                        ret=ssl3_get_certificate_request(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_CR_SRVR_DONE_A;
+                        s->init_num=0;
+                        break;
+
+                case SSL3_ST_CR_SRVR_DONE_A:
+                case SSL3_ST_CR_SRVR_DONE_B:
+                        ret=ssl3_get_server_done(s);
+                        if (ret <= 0) goto end;
+                        if (s->s3->tmp.cert_req)
+                                s->state=SSL3_ST_CW_CERT_A;
+                        else
+                                s->state=SSL3_ST_CW_KEY_EXCH_A;
+                        s->init_num=0;
+
+                        break;
+
+                case SSL3_ST_CW_CERT_A:
+                case SSL3_ST_CW_CERT_B:
+                case SSL3_ST_CW_CERT_C:
+                case SSL3_ST_CW_CERT_D:
+                        ret=dtls1_send_client_certificate(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_CW_KEY_EXCH_A;
+                        s->init_num=0;
+                        break;
+
+                case SSL3_ST_CW_KEY_EXCH_A:
+                case SSL3_ST_CW_KEY_EXCH_B:
+                        ret=dtls1_send_client_key_exchange(s);
+                        if (ret <= 0) goto end;
+                        l=s->s3->tmp.new_cipher->algorithms;
+                        /* EAY EAY EAY need to check for DH fix cert
+                         * sent back */
+                        /* For TLS, cert_req is set to 2, so a cert chain
+                         * of nothing is sent, but no verify packet is sent */
+                        if (s->s3->tmp.cert_req == 1)
+                                {
+                                s->state=SSL3_ST_CW_CERT_VRFY_A;
+                                }
+                        else
+                                {
+                                s->state=SSL3_ST_CW_CHANGE_A;
+                                s->s3->change_cipher_spec=0;
+                                }
+
+                        s->init_num=0;
+                        break;
+
+                case SSL3_ST_CW_CERT_VRFY_A:
+                case SSL3_ST_CW_CERT_VRFY_B:
+                        ret=dtls1_send_client_verify(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_CW_CHANGE_A;
+                        s->init_num=0;
+                        s->s3->change_cipher_spec=0;
+                        break;
+
+                case SSL3_ST_CW_CHANGE_A:
+                case SSL3_ST_CW_CHANGE_B:
+                        ret=dtls1_send_change_cipher_spec(s,
+                                SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_CW_FINISHED_A;
+                        s->init_num=0;
+
+                        s->session->cipher=s->s3->tmp.new_cipher;
+#ifdef OPENSSL_NO_COMP
+                        s->session->compress_meth=0;
+#else
+                        if (s->s3->tmp.new_compression == NULL)
+                                s->session->compress_meth=0;
+                        else
+                                s->session->compress_meth=
+                                        s->s3->tmp.new_compression->id;
+#endif
+                        if (!s->method->ssl3_enc->setup_key_block(s))
+                                {
+                                ret= -1;
+                                goto end;
+                                }
+
+                        if (!s->method->ssl3_enc->change_cipher_state(s,
+                                SSL3_CHANGE_CIPHER_CLIENT_WRITE))
+                                {
+                                ret= -1;
+                                goto end;
+                                }
+                        
+                        dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
+                        break;
+
+                case SSL3_ST_CW_FINISHED_A:
+                case SSL3_ST_CW_FINISHED_B:
+                        ret=dtls1_send_finished(s,
+                                SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B,
+                                s->method->ssl3_enc->client_finished_label,
+                                s->method->ssl3_enc->client_finished_label_len);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_CW_FLUSH;
+
+                        /* clear flags */
+                        s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
+                        if (s->hit)
+                                {
+                                s->s3->tmp.next_state=SSL_ST_OK;
+                                if (s->s3->flags & SSL3_FLAGS_DELAY_CLIENT_FINISHED)
+                                        {
+                                        s->state=SSL_ST_OK;
+                                        s->s3->flags|=SSL3_FLAGS_POP_BUFFER;
+                                        s->s3->delay_buf_pop_ret=0;
+                                        }
+                                }
+                        else
+                                {
+                                s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A;
+                                }
+                        s->init_num=0;
+                        /* mark client_random uninitialized */
+                        memset (s->s3->client_random,0,sizeof(s->s3->client_random));
+
+                        break;
+
+                case SSL3_ST_CR_FINISHED_A:
+                case SSL3_ST_CR_FINISHED_B:
+
+                        ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A,
+                                SSL3_ST_CR_FINISHED_B);
+                        if (ret <= 0) goto end;
+
+                        if (s->hit)
+                                s->state=SSL3_ST_CW_CHANGE_A;
+                        else
+                                s->state=SSL_ST_OK;
+                        s->init_num=0;
+                        break;
+
+                case SSL3_ST_CW_FLUSH:
+                        /* number of bytes to be flushed */
+                        num1=BIO_ctrl(s->wbio,BIO_CTRL_INFO,0,NULL);
+                        if (num1 > 0)
+                                {
+                                s->rwstate=SSL_WRITING;
+                                num1=BIO_flush(s->wbio);
+                                if (num1 <= 0) { ret= -1; goto end; }
+                                s->rwstate=SSL_NOTHING;
+                                }
+
+                        s->state=s->s3->tmp.next_state;
+                        break;
+
+                case SSL_ST_OK:
+                        /* clean a few things up */
+                        ssl3_cleanup_key_block(s);
+
+#if 0
+                        if (s->init_buf != NULL)
+                                {
+                                BUF_MEM_free(s->init_buf);
+                                s->init_buf=NULL;
+                                }
+#endif
+
+                        /* If we are not 'joining' the last two packets,
+                         * remove the buffering now */
+                        if (!(s->s3->flags & SSL3_FLAGS_POP_BUFFER))
+                                ssl_free_wbio_buffer(s);
+                        /* else do it later in ssl3_write */
+
+                        s->init_num=0;
+                        s->new_session=0;
+
+                        ssl_update_cache(s,SSL_SESS_CACHE_CLIENT);
+                        if (s->hit) s->ctx->stats.sess_hit++;
+
+                        ret=1;
+                        /* s->server=0; */
+                        s->handshake_func=dtls1_connect;
+                        s->ctx->stats.sess_connect_good++;
+
+                        if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
+
+                        /* done with handshaking */
+                        s->d1->handshake_read_seq  = 0;
+                        goto end;
+                        /* break; */
+                        
+                default:
+                        SSLerr(SSL_F_DTLS1_CONNECT,SSL_R_UNKNOWN_STATE);
+                        ret= -1;
+                        goto end;
+                        /* break; */
+                        }
+
+                /* did we do anything */
+                if (!s->s3->tmp.reuse_message && !skip)
+                        {
+                        if (s->debug)
+                                {
+                                if ((ret=BIO_flush(s->wbio)) <= 0)
+                                        goto end;
+                                }
+
+                        if ((cb != NULL) && (s->state != state))
+                                {
+                                new_state=s->state;
+                                s->state=state;
+                                cb(s,SSL_CB_CONNECT_LOOP,1);
+                                s->state=new_state;
+                                }
+                        }
+                skip=0;
+                }
+end:
+        s->in_handshake--;
+        if (buf != NULL)
+                BUF_MEM_free(buf);
+        if (cb != NULL)
+                cb(s,SSL_CB_CONNECT_EXIT,ret);
+        return(ret);
+        }
+
+int dtls1_client_hello(SSL *s)
+        {
+        unsigned char *buf;
+        unsigned char *p,*d;
+        unsigned int i,j;
+        unsigned long Time,l;
+        SSL_COMP *comp;
+
+        buf=(unsigned char *)s->init_buf->data;
+        if (s->state == SSL3_ST_CW_CLNT_HELLO_A)
+                {
+                if ((s->session == NULL) ||
+                        (s->session->ssl_version != s->version) ||
+                        (s->session->not_resumable))
+                        {
+                        if (!ssl_get_new_session(s,0))
+                                goto err;
+                        }
+                /* else use the pre-loaded session */
+
+                p=s->s3->client_random;
+                /* if client_random is initialized, reuse it, we are
+                 * required to use same upon reply to HelloVerify */
+                for (i=0;p[i]=='\0' && i<sizeof(s->s3->client_random);i++) ;
+                if (i==sizeof(s->s3->client_random))
+                        {
+                        Time=(unsigned long)time(NULL); /* Time */
+                        l2n(Time,p);
+                        RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4);
+                        }
+
+                /* Do the message type and length last */
+                d=p= &(buf[DTLS1_HM_HEADER_LENGTH]);
+
+                *(p++)=s->version>>8;
+                *(p++)=s->version&0xff;
+                s->client_version=s->version;
+
+                /* Random stuff */
+                memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE);
+                p+=SSL3_RANDOM_SIZE;
+
+                /* Session ID */
+                if (s->new_session)
+                        i=0;
+                else
+                        i=s->session->session_id_length;
+                *(p++)=i;
+                if (i != 0)
+                        {
+                        if (i > sizeof s->session->session_id)
+                                {
+                                SSLerr(SSL_F_DTLS1_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+                        memcpy(p,s->session->session_id,i);
+                        p+=i;
+                        }
+                
+                /* cookie stuff */
+                if ( s->d1->cookie_len > sizeof(s->d1->cookie))
+                        {
+                        SSLerr(SSL_F_DTLS1_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
+                        goto err;
+                        }
+                *(p++) = s->d1->cookie_len;
+                memcpy(p, s->d1->cookie, s->d1->cookie_len);
+                p += s->d1->cookie_len;
+
+                /* Ciphers supported */
+                i=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),&(p[2]),0);
+                if (i == 0)
+                        {
+                        SSLerr(SSL_F_DTLS1_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE);
+                        goto err;
+                        }
+                s2n(i,p);
+                p+=i;
+
+                /* COMPRESSION */
+                if (s->ctx->comp_methods == NULL)
+                        j=0;
+                else
+                        j=sk_SSL_COMP_num(s->ctx->comp_methods);
+                *(p++)=1+j;
+                for (i=0; i<j; i++)
+                        {
+                        comp=sk_SSL_COMP_value(s->ctx->comp_methods,i);
+                        *(p++)=comp->id;
+                        }
+                *(p++)=0; /* Add the NULL method */
+                
+                l=(p-d);
+                d=buf;
+
+                d = dtls1_set_message_header(s, d, SSL3_MT_CLIENT_HELLO, l, 0, l);
+
+                s->state=SSL3_ST_CW_CLNT_HELLO_B;
+                /* number of bytes to write */
+                s->init_num=p-buf;
+                s->init_off=0;
+
+                /* buffer the message to handle re-xmits */
+                dtls1_buffer_message(s, 0);
+                }
+
+        /* SSL3_ST_CW_CLNT_HELLO_B */
+        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+err:
+        return(-1);
+        }
+
+static int dtls1_get_hello_verify(SSL *s)
+        {
+        int n, al, ok = 0;
+        unsigned char *data;
+        unsigned int cookie_len;
+
+        n=s->method->ssl_get_message(s,
+                DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A,
+                DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B,
+                -1,
+                s->max_cert_list,
+                &ok);
+
+        if (!ok) return((int)n);
+
+        if (s->s3->tmp.message_type != DTLS1_MT_HELLO_VERIFY_REQUEST)
+                {
+                s->d1->send_cookie = 0;
+                s->s3->tmp.reuse_message=1;
+                return(1);
+                }
+
+        data = (unsigned char *)s->init_msg;
+
+        if ((data[0] != (s->version>>8)) || (data[1] != (s->version&0xff)))
+                {
+                SSLerr(SSL_F_DTLS1_GET_HELLO_VERIFY,SSL_R_WRONG_SSL_VERSION);
+                s->version=(s->version&0xff00)|data[1];
+                al = SSL_AD_PROTOCOL_VERSION;
+                goto f_err;
+                }
+        data+=2;
+
+        cookie_len = *(data++);
+        if ( cookie_len > sizeof(s->d1->cookie))
+                {
+                al=SSL_AD_ILLEGAL_PARAMETER;
+                goto f_err;
+                }
+
+        memcpy(s->d1->cookie, data, cookie_len);
+        s->d1->cookie_len = cookie_len;
+
+        s->d1->send_cookie = 1;
+        return 1;
+
+f_err:
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
+        return -1;
+        }
+
+int dtls1_send_client_key_exchange(SSL *s)
+        {
+        unsigned char *p,*d;
+        int n;
+        unsigned long l;
+#ifndef OPENSSL_NO_RSA
+        unsigned char *q;
+        EVP_PKEY *pkey=NULL;
+#endif
+#ifndef OPENSSL_NO_KRB5
+        KSSL_ERR kssl_err;
+#endif /* OPENSSL_NO_KRB5 */
+
+        if (s->state == SSL3_ST_CW_KEY_EXCH_A)
+                {
+                d=(unsigned char *)s->init_buf->data;
+                p= &(d[DTLS1_HM_HEADER_LENGTH]);
+
+                l=s->s3->tmp.new_cipher->algorithms;
+
+                /* Fool emacs indentation */
+                if (0) {}
+#ifndef OPENSSL_NO_RSA
+                else if (l & SSL_kRSA)
+                        {
+                        RSA *rsa;
+                        unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
+
+                        if (s->session->sess_cert->peer_rsa_tmp != NULL)
+                                rsa=s->session->sess_cert->peer_rsa_tmp;
+                        else
+                                {
+                                pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
+                                if ((pkey == NULL) ||
+                                        (pkey->type != EVP_PKEY_RSA) ||
+                                        (pkey->pkey.rsa == NULL))
+                                        {
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
+                                        goto err;
+                                        }
+                                rsa=pkey->pkey.rsa;
+                                EVP_PKEY_free(pkey);
+                                }
+                                
+                        tmp_buf[0]=s->client_version>>8;
+                        tmp_buf[1]=s->client_version&0xff;
+                        if (RAND_bytes(&(tmp_buf[2]),sizeof tmp_buf-2) <= 0)
+                                        goto err;
+
+                        s->session->master_key_length=sizeof tmp_buf;
+
+                        q=p;
+                        /* Fix buf for TLS and [incidentally] DTLS */
+                        if (s->version > SSL3_VERSION)
+                                p+=2;
+                        n=RSA_public_encrypt(sizeof tmp_buf,
+                                tmp_buf,p,rsa,RSA_PKCS1_PADDING);
+#ifdef PKCS1_CHECK
+                        if (s->options & SSL_OP_PKCS1_CHECK_1) p[1]++;
+                        if (s->options & SSL_OP_PKCS1_CHECK_2) tmp_buf[0]=0x70;
+#endif
+                        if (n <= 0)
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_ENCRYPT);
+                                goto err;
+                                }
+
+                        /* Fix buf for TLS and [incidentally] DTLS */
+                        if (s->version > SSL3_VERSION)
+                                {
+                                s2n(n,q);
+                                n+=2;
+                                }
+
+                        s->session->master_key_length=
+                                s->method->ssl3_enc->generate_master_secret(s,
+                                        s->session->master_key,
+                                        tmp_buf,sizeof tmp_buf);
+                        OPENSSL_cleanse(tmp_buf,sizeof tmp_buf);
+                        }
+#endif
+#ifndef OPENSSL_NO_KRB5
+                else if (l & SSL_kKRB5)
+                        {
+                        krb5_error_code krb5rc;
+                        KSSL_CTX        *kssl_ctx = s->kssl_ctx;
+                        /*  krb5_data   krb5_ap_req;  */
+                        krb5_data       *enc_ticket;
+                        krb5_data       authenticator, *authp = NULL;
+                        EVP_CIPHER_CTX  ciph_ctx;
+                        EVP_CIPHER      *enc = NULL;
+                        unsigned char   iv[EVP_MAX_IV_LENGTH];
+                        unsigned char   tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
+                        unsigned char   epms[SSL_MAX_MASTER_KEY_LENGTH 
+                                                + EVP_MAX_IV_LENGTH];
+                        int             padl, outl = sizeof(epms);
+
+                        EVP_CIPHER_CTX_init(&ciph_ctx);
+
+#ifdef KSSL_DEBUG
+                        printf("ssl3_send_client_key_exchange(%lx & %lx)\n",
+                                l, SSL_kKRB5);
+#endif  /* KSSL_DEBUG */
+
+                        authp = NULL;
+#ifdef KRB5SENDAUTH
+                        if (KRB5SENDAUTH)  authp = &authenticator;
+#endif  /* KRB5SENDAUTH */
+
+                        krb5rc = kssl_cget_tkt(kssl_ctx, &enc_ticket, authp,
+                                &kssl_err);
+                        enc = kssl_map_enc(kssl_ctx->enctype);
+                        if (enc == NULL)
+                            goto err;
+#ifdef KSSL_DEBUG
+                        {
+                        printf("kssl_cget_tkt rtn %d\n", krb5rc);
+                        if (krb5rc && kssl_err.text)
+                          printf("kssl_cget_tkt kssl_err=%s\n", kssl_err.text);
+                        }
+#endif  /* KSSL_DEBUG */
+
+                        if (krb5rc)
+                                {
+                                ssl3_send_alert(s,SSL3_AL_FATAL,
+                                                SSL_AD_HANDSHAKE_FAILURE);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                                kssl_err.reason);
+                                goto err;
+                                }
+
+                        /*  20010406 VRS - Earlier versions used KRB5 AP_REQ
+                        **  in place of RFC 2712 KerberosWrapper, as in:
+                        **
+                        **  Send ticket (copy to *p, set n = length)
+                        **  n = krb5_ap_req.length;
+                        **  memcpy(p, krb5_ap_req.data, krb5_ap_req.length);
+                        **  if (krb5_ap_req.data)  
+                        **    kssl_krb5_free_data_contents(NULL,&krb5_ap_req);
+                        **
+                        **  Now using real RFC 2712 KerberosWrapper
+                        **  (Thanks to Simon Wilkinson <sxw@sxw.org.uk>)
+                        **  Note: 2712 "opaque" types are here replaced
+                        **  with a 2-byte length followed by the value.
+                        **  Example:
+                        **  KerberosWrapper= xx xx asn1ticket 0 0 xx xx encpms
+                        **  Where "xx xx" = length bytes.  Shown here with
+                        **  optional authenticator omitted.
+                        */
+
+                        /*  KerberosWrapper.Ticket              */
+                        s2n(enc_ticket->length,p);
+                        memcpy(p, enc_ticket->data, enc_ticket->length);
+                        p+= enc_ticket->length;
+                        n = enc_ticket->length + 2;
+
+                        /*  KerberosWrapper.Authenticator       */
+                        if (authp  &&  authp->length)  
+                                {
+                                s2n(authp->length,p);
+                                memcpy(p, authp->data, authp->length);
+                                p+= authp->length;
+                                n+= authp->length + 2;
+                                
+                                free(authp->data);
+                                authp->data = NULL;
+                                authp->length = 0;
+                                }
+                        else
+                                {
+                                s2n(0,p);/*  null authenticator length  */
+                                n+=2;
+                                }
+ 
+                        if (RAND_bytes(tmp_buf,sizeof tmp_buf) <= 0)
+                            goto err;
+
+                        /*  20010420 VRS.  Tried it this way; failed.
+                        **      EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,NULL);
+                        **      EVP_CIPHER_CTX_set_key_length(&ciph_ctx,
+                        **                              kssl_ctx->length);
+                        **      EVP_EncryptInit_ex(&ciph_ctx,NULL, key,iv);
+                        */
+
+                        memset(iv, 0, sizeof iv);  /* per RFC 1510 */
+                        EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,
+                                kssl_ctx->key,iv);
+                        EVP_EncryptUpdate(&ciph_ctx,epms,&outl,tmp_buf,
+                                sizeof tmp_buf);
+                        EVP_EncryptFinal_ex(&ciph_ctx,&(epms[outl]),&padl);
+                        outl += padl;
+                        if (outl > sizeof epms)
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+                        EVP_CIPHER_CTX_cleanup(&ciph_ctx);
+
+                        /*  KerberosWrapper.EncryptedPreMasterSecret    */
+                        s2n(outl,p);
+                        memcpy(p, epms, outl);
+                        p+=outl;
+                        n+=outl + 2;
+
+                        s->session->master_key_length=
+                                s->method->ssl3_enc->generate_master_secret(s,
+                                        s->session->master_key,
+                                        tmp_buf, sizeof tmp_buf);
+
+                        OPENSSL_cleanse(tmp_buf, sizeof tmp_buf);
+                        OPENSSL_cleanse(epms, outl);
+                        }
+#endif
+#ifndef OPENSSL_NO_DH
+                else if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
+                        {
+                        DH *dh_srvr,*dh_clnt;
+
+                        if (s->session->sess_cert->peer_dh_tmp != NULL)
+                                dh_srvr=s->session->sess_cert->peer_dh_tmp;
+                        else
+                                {
+                                /* we get them from the cert */
+                                ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
+                                goto err;
+                                }
+                        
+                        /* generate a new random key */
+                        if ((dh_clnt=DHparams_dup(dh_srvr)) == NULL)
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
+                                goto err;
+                                }
+                        if (!DH_generate_key(dh_clnt))
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
+                                goto err;
+                                }
+
+                        /* use the 'p' output buffer for the DH key, but
+                         * make sure to clear it out afterwards */
+
+                        n=DH_compute_key(p,dh_srvr->pub_key,dh_clnt);
+
+                        if (n <= 0)
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
+                                goto err;
+                                }
+
+                        /* generate master key from the result */
+                        s->session->master_key_length=
+                                s->method->ssl3_enc->generate_master_secret(s,
+                                        s->session->master_key,p,n);
+                        /* clean up */
+                        memset(p,0,n);
+
+                        /* send off the data */
+                        n=BN_num_bytes(dh_clnt->pub_key);
+                        s2n(n,p);
+                        BN_bn2bin(dh_clnt->pub_key,p);
+                        n+=2;
+
+                        DH_free(dh_clnt);
+
+                        /* perhaps clean things up a bit EAY EAY EAY EAY*/
+                        }
+#endif
+                else
+                        {
+                        ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
+                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
+                        goto err;
+                        }
+                
+                d = dtls1_set_message_header(s, d,
+                SSL3_MT_CLIENT_KEY_EXCHANGE, n, 0, n);
+                /*
+                 *(d++)=SSL3_MT_CLIENT_KEY_EXCHANGE;
+                 l2n3(n,d);
+                 l2n(s->d1->handshake_write_seq,d);
+                 s->d1->handshake_write_seq++;
+                */
+                
+                s->state=SSL3_ST_CW_KEY_EXCH_B;
+                /* number of bytes to write */
+                s->init_num=n+DTLS1_HM_HEADER_LENGTH;
+                s->init_off=0;
+
+                /* buffer the message to handle re-xmits */
+                dtls1_buffer_message(s, 0);
+                }
+        
+        /* SSL3_ST_CW_KEY_EXCH_B */
+        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+err:
+        return(-1);
+        }
+
+int dtls1_send_client_verify(SSL *s)
+        {
+        unsigned char *p,*d;
+        unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
+        EVP_PKEY *pkey;
+#ifndef OPENSSL_NO_RSA
+        unsigned u=0;
+#endif
+        unsigned long n;
+#ifndef OPENSSL_NO_DSA
+        int j;
+#endif
+
+        if (s->state == SSL3_ST_CW_CERT_VRFY_A)
+                {
+                d=(unsigned char *)s->init_buf->data;
+                p= &(d[DTLS1_HM_HEADER_LENGTH]);
+                pkey=s->cert->key->privatekey;
+
+                s->method->ssl3_enc->cert_verify_mac(s,&(s->s3->finish_dgst2),
+                        &(data[MD5_DIGEST_LENGTH]));
+
+#ifndef OPENSSL_NO_RSA
+                if (pkey->type == EVP_PKEY_RSA)
+                        {
+                        s->method->ssl3_enc->cert_verify_mac(s,
+                                &(s->s3->finish_dgst1),&(data[0]));
+                        if (RSA_sign(NID_md5_sha1, data,
+                                         MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
+                                        &(p[2]), &u, pkey->pkey.rsa) <= 0 )
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,ERR_R_RSA_LIB);
+                                goto err;
+                                }
+                        s2n(u,p);
+                        n=u+2;
+                        }
+                else
+#endif
+#ifndef OPENSSL_NO_DSA
+                        if (pkey->type == EVP_PKEY_DSA)
+                        {
+                        if (!DSA_sign(pkey->save_type,
+                                &(data[MD5_DIGEST_LENGTH]),
+                                SHA_DIGEST_LENGTH,&(p[2]),
+                                (unsigned int *)&j,pkey->pkey.dsa))
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,ERR_R_DSA_LIB);
+                                goto err;
+                                }
+                        s2n(j,p);
+                        n=j+2;
+                        }
+                else
+#endif
+                        {
+                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,ERR_R_INTERNAL_ERROR);
+                        goto err;
+                        }
+
+                d = dtls1_set_message_header(s, d,
+                        SSL3_MT_CERTIFICATE_VERIFY, n, 0, n) ;
+
+                s->init_num=(int)n+DTLS1_HM_HEADER_LENGTH;
+                s->init_off=0;
+
+                /* buffer the message to handle re-xmits */
+                dtls1_buffer_message(s, 0);
+
+                s->state = SSL3_ST_CW_CERT_VRFY_B;
+                }
+
+        /* s->state = SSL3_ST_CW_CERT_VRFY_B */
+        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+err:
+        return(-1);
+        }
+
+int dtls1_send_client_certificate(SSL *s)
+        {
+        X509 *x509=NULL;
+        EVP_PKEY *pkey=NULL;
+        int i;
+        unsigned long l;
+
+        if (s->state == SSL3_ST_CW_CERT_A)
+                {
+                if ((s->cert == NULL) ||
+                        (s->cert->key->x509 == NULL) ||
+                        (s->cert->key->privatekey == NULL))
+                        s->state=SSL3_ST_CW_CERT_B;
+                else
+                        s->state=SSL3_ST_CW_CERT_C;
+                }
+
+        /* We need to get a client cert */
+        if (s->state == SSL3_ST_CW_CERT_B)
+                {
+                /* If we get an error, we need to
+                 * ssl->rwstate=SSL_X509_LOOKUP; return(-1);
+                 * We then get retied later */
+                i=0;
+                if (s->ctx->client_cert_cb != NULL)
+                        i=s->ctx->client_cert_cb(s,&(x509),&(pkey));
+                if (i < 0)
+                        {
+                        s->rwstate=SSL_X509_LOOKUP;
+                        return(-1);
+                        }
+                s->rwstate=SSL_NOTHING;
+                if ((i == 1) && (pkey != NULL) && (x509 != NULL))
+                        {
+                        s->state=SSL3_ST_CW_CERT_B;
+                        if (    !SSL_use_certificate(s,x509) ||
+                                !SSL_use_PrivateKey(s,pkey))
+                                i=0;
+                        }
+                else if (i == 1)
+                        {
+                        i=0;
+                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE,SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
+                        }
+
+                if (x509 != NULL) X509_free(x509);
+                if (pkey != NULL) EVP_PKEY_free(pkey);
+                if (i == 0)
+                        {
+                        if (s->version == SSL3_VERSION)
+                                {
+                                s->s3->tmp.cert_req=0;
+                                ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_NO_CERTIFICATE);
+                                return(1);
+                                }
+                        else
+                                {
+                                s->s3->tmp.cert_req=2;
+                                }
+                        }
+
+                /* Ok, we have a cert */
+                s->state=SSL3_ST_CW_CERT_C;
+                }
+
+        if (s->state == SSL3_ST_CW_CERT_C)
+                {
+                s->state=SSL3_ST_CW_CERT_D;
+                l=dtls1_output_cert_chain(s,
+                        (s->s3->tmp.cert_req == 2)?NULL:s->cert->key->x509);
+                s->init_num=(int)l;
+                s->init_off=0;
+
+                /* set header called by dtls1_output_cert_chain() */
+
+                /* buffer the message to handle re-xmits */
+                dtls1_buffer_message(s, 0);
+                }
+        /* SSL3_ST_CW_CERT_D */
+        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+        }
+
+
diff --git a/src/lib/libssl/src/ssl/d1_enc.c b/src/lib/libssl/src/ssl/d1_enc.c
new file mode 100644
index 0000000000..cbff7495c5
--- /dev/null
+++ b/src/lib/libssl/src/ssl/d1_enc.c
@@ -0,0 +1,281 @@
+/* ssl/d1_enc.c */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "ssl_locl.h"
+#include <openssl/comp.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/md5.h>
+#include <openssl/rand.h>
+
+
+int dtls1_enc(SSL *s, int send)
+        {
+        SSL3_RECORD *rec;
+        EVP_CIPHER_CTX *ds;
+        unsigned long l;
+        int bs,i,ii,j,k,n=0;
+        const EVP_CIPHER *enc;
+
+        if (send)
+                {
+                if (s->write_hash != NULL)
+                        n=EVP_MD_size(s->write_hash);
+                ds=s->enc_write_ctx;
+                rec= &(s->s3->wrec);
+                if (s->enc_write_ctx == NULL)
+                        enc=NULL;
+                else
+                        {
+                        enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
+                        if ( rec->data != rec->input)
+                                /* we can't write into the input stream */
+                                fprintf(stderr, "%s:%d: rec->data != rec->input\n",
+                                        __FILE__, __LINE__);
+                        else if ( EVP_CIPHER_block_size(ds->cipher) > 1)
+                                {
+                                if (!RAND_bytes(rec->input, EVP_CIPHER_block_size(ds->cipher)))
+                                        return -1;
+                                }
+                        }
+                }
+        else
+                {
+                if (s->read_hash != NULL)
+                        n=EVP_MD_size(s->read_hash);
+                ds=s->enc_read_ctx;
+                rec= &(s->s3->rrec);
+                if (s->enc_read_ctx == NULL)
+                        enc=NULL;
+                else
+                        enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
+                }
+
+#ifdef KSSL_DEBUG
+        printf("dtls1_enc(%d)\n", send);
+#endif    /* KSSL_DEBUG */
+
+        if ((s->session == NULL) || (ds == NULL) ||
+                (enc == NULL))
+                {
+                memmove(rec->data,rec->input,rec->length);
+                rec->input=rec->data;
+                }
+        else
+                {
+                l=rec->length;
+                bs=EVP_CIPHER_block_size(ds->cipher);
+
+                if ((bs != 1) && send)
+                        {
+                        i=bs-((int)l%bs);
+
+                        /* Add weird padding of upto 256 bytes */
+
+                        /* we need to add 'i' padding bytes of value j */
+                        j=i-1;
+                        if (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG)
+                                {
+                                if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
+                                        j++;
+                                }
+                        for (k=(int)l; k<(int)(l+i); k++)
+                                rec->input[k]=j;
+                        l+=i;
+                        rec->length+=i;
+                        }
+
+#ifdef KSSL_DEBUG
+                {
+                unsigned long ui;
+                printf("EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\n",
+                        ds,rec->data,rec->input,l);
+                printf("\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%d %d], %d iv_len\n",
+                        ds->buf_len, ds->cipher->key_len,
+                        DES_KEY_SZ, DES_SCHEDULE_SZ,
+                        ds->cipher->iv_len);
+                printf("\t\tIV: ");
+                for (i=0; i<ds->cipher->iv_len; i++) printf("%02X", ds->iv[i]);
+                printf("\n");
+                printf("\trec->input=");
+                for (ui=0; ui<l; ui++) printf(" %02x", rec->input[ui]);
+                printf("\n");
+                }
+#endif  /* KSSL_DEBUG */
+
+                if (!send)
+                        {
+                        if (l == 0 || l%bs != 0)
+                                {
+                                SSLerr(SSL_F_DTLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
+                                ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
+                                return 0;
+                                }
+                        }
+                
+                EVP_Cipher(ds,rec->data,rec->input,l);
+
+#ifdef KSSL_DEBUG
+                {
+                unsigned long i;
+                printf("\trec->data=");
+                for (i=0; i<l; i++)
+                        printf(" %02x", rec->data[i]);  printf("\n");
+                }
+#endif  /* KSSL_DEBUG */
+
+                if ((bs != 1) && !send)
+                        {
+                        ii=i=rec->data[l-1]; /* padding_length */
+                        i++;
+                        if (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
+                                {
+                                /* First packet is even in size, so check */
+                                if ((memcmp(s->s3->read_sequence,
+                                        "\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1))
+                                        s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
+                                if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
+                                        i--;
+                                }
+                        /* TLS 1.0 does not bound the number of padding bytes by the block size.
+                         * All of them must have value 'padding_length'. */
+                        if (i > (int)rec->length)
+                                {
+                                /* Incorrect padding. SSLerr() and ssl3_alert are done
+                                 * by caller: we don't want to reveal whether this is
+                                 * a decryption error or a MAC verification failure
+                                 * (see http://www.openssl.org/~bodo/tls-cbc.txt) 
+                                 */
+                                return -1;
+                                }
+                        for (j=(int)(l-i); j<(int)l; j++)
+                                {
+                                if (rec->data[j] != ii)
+                                        {
+                                        /* Incorrect padding */
+                                        return -1;
+                                        }
+                                }
+                        rec->length-=i;
+
+                        rec->data += bs;    /* skip the implicit IV */
+                        rec->input += bs;
+                        rec->length -= bs;
+                        }
+                }
+        return(1);
+        }
+
diff --git a/src/lib/libssl/src/ssl/d1_lib.c b/src/lib/libssl/src/ssl/d1_lib.c
new file mode 100644
index 0000000000..fc088b4148
--- /dev/null
+++ b/src/lib/libssl/src/ssl/d1_lib.c
@@ -0,0 +1,210 @@
+/* ssl/d1_lib.c */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <openssl/objects.h>
+#include "ssl_locl.h"
+
+const char dtls1_version_str[]="DTLSv1" OPENSSL_VERSION_PTEXT;
+
+SSL3_ENC_METHOD DTLSv1_enc_data={
+    dtls1_enc,
+        tls1_mac,
+        tls1_setup_key_block,
+        tls1_generate_master_secret,
+        tls1_change_cipher_state,
+        tls1_final_finish_mac,
+        TLS1_FINISH_MAC_LENGTH,
+        tls1_cert_verify_mac,
+        TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
+        TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
+        tls1_alert_code,
+        };
+
+long dtls1_default_timeout(void)
+        {
+        /* 2 hours, the 24 hours mentioned in the DTLSv1 spec
+         * is way too long for http, the cache would over fill */
+        return(60*60*2);
+        }
+
+IMPLEMENT_dtls1_meth_func(dtlsv1_base_method,
+                        ssl_undefined_function,
+                        ssl_undefined_function,
+                        ssl_bad_method)
+
+int dtls1_new(SSL *s)
+        {
+        DTLS1_STATE *d1;
+
+        if (!ssl3_new(s)) return(0);
+        if ((d1=OPENSSL_malloc(sizeof *d1)) == NULL) return (0);
+        memset(d1,0, sizeof *d1);
+
+        /* d1->handshake_epoch=0; */
+#if defined(OPENSSL_SYS_VMS) || defined(VMS_TEST)
+        d1->bitmap.length=64;
+#else
+        d1->bitmap.length=sizeof(d1->bitmap.map) * 8;
+#endif
+        pq_64bit_init(&(d1->bitmap.map));
+        pq_64bit_init(&(d1->bitmap.max_seq_num));
+        
+        pq_64bit_init(&(d1->next_bitmap.map));
+        pq_64bit_init(&(d1->next_bitmap.max_seq_num));
+
+        d1->unprocessed_rcds.q=pqueue_new();
+        d1->processed_rcds.q=pqueue_new();
+        d1->buffered_messages = pqueue_new();
+        d1->sent_messages=pqueue_new();
+
+        if ( s->server)
+                {
+                d1->cookie_len = sizeof(s->d1->cookie);
+                }
+
+        if( ! d1->unprocessed_rcds.q || ! d1->processed_rcds.q 
+        || ! d1->buffered_messages || ! d1->sent_messages)
+                {
+        if ( d1->unprocessed_rcds.q) pqueue_free(d1->unprocessed_rcds.q);
+        if ( d1->processed_rcds.q) pqueue_free(d1->processed_rcds.q);
+        if ( d1->buffered_messages) pqueue_free(d1->buffered_messages);
+                if ( d1->sent_messages) pqueue_free(d1->sent_messages);
+                OPENSSL_free(d1);
+                return (0);
+                }
+
+        s->d1=d1;
+        s->method->ssl_clear(s);
+        return(1);
+        }
+
+void dtls1_free(SSL *s)
+        {
+    pitem *item = NULL;
+    hm_fragment *frag = NULL;
+
+        ssl3_free(s);
+
+    while( (item = pqueue_pop(s->d1->unprocessed_rcds.q)) != NULL)
+        {
+        OPENSSL_free(item->data);
+        pitem_free(item);
+        }
+    pqueue_free(s->d1->unprocessed_rcds.q);
+
+    while( (item = pqueue_pop(s->d1->processed_rcds.q)) != NULL)
+        {
+        OPENSSL_free(item->data);
+        pitem_free(item);
+        }
+    pqueue_free(s->d1->processed_rcds.q);
+
+    while( (item = pqueue_pop(s->d1->buffered_messages)) != NULL)
+        {
+        frag = (hm_fragment *)item->data;
+        OPENSSL_free(frag->fragment);
+        OPENSSL_free(frag);
+        pitem_free(item);
+        }
+    pqueue_free(s->d1->buffered_messages);
+
+    while ( (item = pqueue_pop(s->d1->sent_messages)) != NULL)
+        {
+        frag = (hm_fragment *)item->data;
+        OPENSSL_free(frag->fragment);
+        OPENSSL_free(frag);
+        pitem_free(item);
+        }
+        pqueue_free(s->d1->sent_messages);
+
+        pq_64bit_free(&(s->d1->bitmap.map));
+        pq_64bit_free(&(s->d1->bitmap.max_seq_num));
+
+        pq_64bit_free(&(s->d1->next_bitmap.map));
+        pq_64bit_free(&(s->d1->next_bitmap.max_seq_num));
+
+        OPENSSL_free(s->d1);
+        }
+
+void dtls1_clear(SSL *s)
+        {
+        ssl3_clear(s);
+        s->version=DTLS1_VERSION;
+        }
+
+/*
+ * As it's impossible to use stream ciphers in "datagram" mode, this
+ * simple filter is designed to disengage them in DTLS. Unfortunately
+ * there is no universal way to identify stream SSL_CIPHER, so we have
+ * to explicitly list their SSL_* codes. Currently RC4 is the only one
+ * available, but if new ones emerge, they will have to be added...
+ */
+SSL_CIPHER *dtls1_get_cipher(unsigned int u)
+        {
+        SSL_CIPHER *ciph = ssl3_get_cipher(u);
+
+        if (ciph != NULL)
+                {
+                if ((ciph->algorithms&SSL_ENC_MASK) == SSL_RC4)
+                        return NULL;
+                }
+
+        return ciph;
+        }
diff --git a/src/lib/libssl/src/ssl/d1_meth.c b/src/lib/libssl/src/ssl/d1_meth.c
new file mode 100644
index 0000000000..8a6cf31947
--- /dev/null
+++ b/src/lib/libssl/src/ssl/d1_meth.c
@@ -0,0 +1,77 @@
+/* ssl/d1_meth.h */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <openssl/objects.h>
+#include "ssl_locl.h"
+
+static SSL_METHOD *dtls1_get_method(int ver);
+static SSL_METHOD *dtls1_get_method(int ver)
+        {
+        if (ver == DTLS1_VERSION)
+                return(DTLSv1_method());
+        else
+                return(NULL);
+        }
+
+IMPLEMENT_dtls1_meth_func(DTLSv1_method,
+                        dtls1_accept,
+                        dtls1_connect,
+                        dtls1_get_method)
+
diff --git a/src/lib/libssl/src/ssl/d1_pkt.c b/src/lib/libssl/src/ssl/d1_pkt.c
new file mode 100644
index 0000000000..377696deac
--- /dev/null
+++ b/src/lib/libssl/src/ssl/d1_pkt.c
@@ -0,0 +1,1778 @@
+/* ssl/d1_pkt.c */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#define USE_SOCKETS
+#include "ssl_locl.h"
+#include <openssl/evp.h>
+#include <openssl/buffer.h>
+#include <openssl/pqueue.h>
+#include <openssl/rand.h>
+
+static int have_handshake_fragment(SSL *s, int type, unsigned char *buf, 
+        int len, int peek);
+static int dtls1_record_replay_check(SSL *s, DTLS1_BITMAP *bitmap,
+        PQ_64BIT *seq_num);
+static void dtls1_record_bitmap_update(SSL *s, DTLS1_BITMAP *bitmap);
+static DTLS1_BITMAP *dtls1_get_bitmap(SSL *s, SSL3_RECORD *rr, 
+    unsigned int *is_next_epoch);
+#if 0
+static int dtls1_record_needs_buffering(SSL *s, SSL3_RECORD *rr,
+        unsigned short *priority, unsigned long *offset);
+#endif
+static int dtls1_buffer_record(SSL *s, record_pqueue *q,
+        PQ_64BIT priority);
+static int dtls1_process_record(SSL *s);
+#if PQ_64BIT_IS_INTEGER
+static PQ_64BIT bytes_to_long_long(unsigned char *bytes, PQ_64BIT *num);
+#endif
+static void dtls1_clear_timeouts(SSL *s);
+
+/* copy buffered record into SSL structure */
+static int
+dtls1_copy_record(SSL *s, pitem *item)
+    {
+    DTLS1_RECORD_DATA *rdata;
+
+    rdata = (DTLS1_RECORD_DATA *)item->data;
+    
+    if (s->s3->rbuf.buf != NULL)
+        OPENSSL_free(s->s3->rbuf.buf);
+    
+    s->packet = rdata->packet;
+    s->packet_length = rdata->packet_length;
+    memcpy(&(s->s3->rbuf), &(rdata->rbuf), sizeof(SSL3_BUFFER));
+    memcpy(&(s->s3->rrec), &(rdata->rrec), sizeof(SSL3_RECORD));
+    
+    return(1);
+    }
+
+
+static int
+dtls1_buffer_record(SSL *s, record_pqueue *queue, PQ_64BIT priority)
+{
+    DTLS1_RECORD_DATA *rdata;
+        pitem *item;
+
+        rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
+        item = pitem_new(priority, rdata);
+        if (rdata == NULL || item == NULL)
+                {
+                if (rdata != NULL) OPENSSL_free(rdata);
+                if (item != NULL) pitem_free(item);
+                
+                SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
+                return(0);
+                }
+        
+        rdata->packet = s->packet;
+        rdata->packet_length = s->packet_length;
+        memcpy(&(rdata->rbuf), &(s->s3->rbuf), sizeof(SSL3_BUFFER));
+        memcpy(&(rdata->rrec), &(s->s3->rrec), sizeof(SSL3_RECORD));
+
+        item->data = rdata;
+
+        /* insert should not fail, since duplicates are dropped */
+        if (pqueue_insert(queue->q, item) == NULL)
+                {
+                OPENSSL_free(rdata);
+                pitem_free(item);
+                return(0);
+                }
+
+        s->packet = NULL;
+        s->packet_length = 0;
+        memset(&(s->s3->rbuf), 0, sizeof(SSL3_BUFFER));
+        memset(&(s->s3->rrec), 0, sizeof(SSL3_RECORD));
+        
+        if (!ssl3_setup_buffers(s))
+                {
+                SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
+                OPENSSL_free(rdata);
+                pitem_free(item);
+                return(0);
+                }
+        
+        return(1);
+    }
+
+
+static int
+dtls1_retrieve_buffered_record(SSL *s, record_pqueue *queue)
+    {
+    pitem *item;
+
+    item = pqueue_pop(queue->q);
+    if (item)
+        {
+        dtls1_copy_record(s, item);
+
+        OPENSSL_free(item->data);
+                pitem_free(item);
+
+        return(1);
+        }
+
+    return(0);
+    }
+
+
+/* retrieve a buffered record that belongs to the new epoch, i.e., not processed 
+ * yet */
+#define dtls1_get_unprocessed_record(s) \
+                   dtls1_retrieve_buffered_record((s), \
+                   &((s)->d1->unprocessed_rcds))
+
+/* retrieve a buffered record that belongs to the current epoch, ie, processed */
+#define dtls1_get_processed_record(s) \
+                   dtls1_retrieve_buffered_record((s), \
+                   &((s)->d1->processed_rcds))
+
+static int
+dtls1_process_buffered_records(SSL *s)
+    {
+    pitem *item;
+    
+    item = pqueue_peek(s->d1->unprocessed_rcds.q);
+    if (item)
+        {
+        DTLS1_RECORD_DATA *rdata;
+        rdata = (DTLS1_RECORD_DATA *)item->data;
+        
+        /* Check if epoch is current. */
+        if (s->d1->unprocessed_rcds.epoch != s->d1->r_epoch)
+            return(1);  /* Nothing to do. */
+        
+        /* Process all the records. */
+        while (pqueue_peek(s->d1->unprocessed_rcds.q))
+            {
+            dtls1_get_unprocessed_record(s);
+            if ( ! dtls1_process_record(s))
+                return(0);
+            dtls1_buffer_record(s, &(s->d1->processed_rcds), 
+                s->s3->rrec.seq_num);
+            }
+        }
+
+    /* sync epoch numbers once all the unprocessed records 
+     * have been processed */
+    s->d1->processed_rcds.epoch = s->d1->r_epoch;
+    s->d1->unprocessed_rcds.epoch = s->d1->r_epoch + 1;
+
+    return(1);
+    }
+
+
+#if 0
+
+static int
+dtls1_get_buffered_record(SSL *s)
+        {
+        pitem *item;
+        PQ_64BIT priority = 
+                (((PQ_64BIT)s->d1->handshake_read_seq) << 32) | 
+                ((PQ_64BIT)s->d1->r_msg_hdr.frag_off);
+        
+        if ( ! SSL_in_init(s))  /* if we're not (re)negotiating, 
+                                                           nothing buffered */
+                return 0;
+
+
+        item = pqueue_peek(s->d1->rcvd_records);
+        if (item && item->priority == priority)
+                {
+                /* Check if we've received the record of interest.  It must be
+                 * a handshake record, since data records as passed up without
+                 * buffering */
+                DTLS1_RECORD_DATA *rdata;
+                item = pqueue_pop(s->d1->rcvd_records);
+                rdata = (DTLS1_RECORD_DATA *)item->data;
+                
+                if (s->s3->rbuf.buf != NULL)
+                        OPENSSL_free(s->s3->rbuf.buf);
+                
+                s->packet = rdata->packet;
+                s->packet_length = rdata->packet_length;
+                memcpy(&(s->s3->rbuf), &(rdata->rbuf), sizeof(SSL3_BUFFER));
+                memcpy(&(s->s3->rrec), &(rdata->rrec), sizeof(SSL3_RECORD));
+                
+                OPENSSL_free(item->data);
+                pitem_free(item);
+                
+                /* s->d1->next_expected_seq_num++; */
+                return(1);
+                }
+        
+        return 0;
+        }
+
+#endif
+
+static int
+dtls1_process_record(SSL *s)
+{
+    int i,al;
+        int clear=0;
+    int enc_err;
+        SSL_SESSION *sess;
+    SSL3_RECORD *rr;
+        unsigned int mac_size;
+        unsigned char md[EVP_MAX_MD_SIZE];
+
+
+        rr= &(s->s3->rrec);
+    sess = s->session;
+
+        /* At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,
+         * and we have that many bytes in s->packet
+         */
+        rr->input= &(s->packet[DTLS1_RT_HEADER_LENGTH]);
+
+        /* ok, we can now read from 's->packet' data into 'rr'
+         * rr->input points at rr->length bytes, which
+         * need to be copied into rr->data by either
+         * the decryption or by the decompression
+         * When the data is 'copied' into the rr->data buffer,
+         * rr->input will be pointed at the new buffer */ 
+
+        /* We now have - encrypted [ MAC [ compressed [ plain ] ] ]
+         * rr->length bytes of encrypted compressed stuff. */
+
+        /* check is not needed I believe */
+        if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH)
+                {
+                al=SSL_AD_RECORD_OVERFLOW;
+                SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
+                goto f_err;
+                }
+
+        /* decrypt in place in 'rr->input' */
+        rr->data=rr->input;
+
+        enc_err = s->method->ssl3_enc->enc(s,0);
+        if (enc_err <= 0)
+                {
+                if (enc_err == 0)
+                        /* SSLerr() and ssl3_send_alert() have been called */
+                        goto err;
+
+                /* otherwise enc_err == -1 */
+                goto decryption_failed_or_bad_record_mac;
+                }
+
+#ifdef TLS_DEBUG
+printf("dec %d\n",rr->length);
+{ unsigned int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1)%16)?' ':'\n'); }
+printf("\n");
+#endif
+
+        /* r->length is now the compressed data plus mac */
+if (    (sess == NULL) ||
+                (s->enc_read_ctx == NULL) ||
+                (s->read_hash == NULL))
+    clear=1;
+
+        if (!clear)
+                {
+                mac_size=EVP_MD_size(s->read_hash);
+
+                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+mac_size)
+                        {
+#if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */
+                        al=SSL_AD_RECORD_OVERFLOW;
+                        SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
+                        goto f_err;
+#else
+                        goto decryption_failed_or_bad_record_mac;
+#endif                  
+                        }
+                /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
+                if (rr->length < mac_size)
+                        {
+#if 0 /* OK only for stream ciphers */
+                        al=SSL_AD_DECODE_ERROR;
+                        SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT);
+                        goto f_err;
+#else
+                        goto decryption_failed_or_bad_record_mac;
+#endif
+                        }
+                rr->length-=mac_size;
+                i=s->method->ssl3_enc->mac(s,md,0);
+                if (memcmp(md,&(rr->data[rr->length]),mac_size) != 0)
+                        {
+                        goto decryption_failed_or_bad_record_mac;
+                        }
+                }
+
+        /* r->length is now just compressed */
+        if (s->expand != NULL)
+                {
+                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH)
+                        {
+                        al=SSL_AD_RECORD_OVERFLOW;
+                        SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_COMPRESSED_LENGTH_TOO_LONG);
+                        goto f_err;
+                        }
+                if (!ssl3_do_uncompress(s))
+                        {
+                        al=SSL_AD_DECOMPRESSION_FAILURE;
+                        SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_BAD_DECOMPRESSION);
+                        goto f_err;
+                        }
+                }
+
+        if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH)
+                {
+                al=SSL_AD_RECORD_OVERFLOW;
+                SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_DATA_LENGTH_TOO_LONG);
+                goto f_err;
+                }
+
+        rr->off=0;
+        /* So at this point the following is true
+         * ssl->s3->rrec.type   is the type of record
+         * ssl->s3->rrec.length == number of bytes in record
+         * ssl->s3->rrec.off    == offset to first valid byte
+         * ssl->s3->rrec.data   == where to take bytes from, increment
+         *                         after use :-).
+         */
+
+        /* we have pulled in a full packet so zero things */
+        s->packet_length=0;
+    dtls1_record_bitmap_update(s, &(s->d1->bitmap));/* Mark receipt of record. */
+    return(1);
+
+decryption_failed_or_bad_record_mac:
+        /* Separate 'decryption_failed' alert was introduced with TLS 1.0,
+         * SSL 3.0 only has 'bad_record_mac'.  But unless a decryption
+         * failure is directly visible from the ciphertext anyway,
+         * we should not reveal which kind of error occured -- this
+         * might become visible to an attacker (e.g. via logfile) */
+        al=SSL_AD_BAD_RECORD_MAC;
+        SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
+f_err:
+        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+err:
+        return(0);
+}
+
+
+/* Call this to get a new input record.
+ * It will return <= 0 if more data is needed, normally due to an error
+ * or non-blocking IO.
+ * When it finishes, one packet has been decoded and can be found in
+ * ssl->s3->rrec.type    - is the type of record
+ * ssl->s3->rrec.data,   - data
+ * ssl->s3->rrec.length, - number of bytes
+ */
+/* used only by dtls1_read_bytes */
+int dtls1_get_record(SSL *s)
+        {
+        int ssl_major,ssl_minor,al;
+        int i,n;
+        SSL3_RECORD *rr;
+        SSL_SESSION *sess;
+        unsigned char *p;
+        unsigned short version;
+        DTLS1_BITMAP *bitmap;
+        unsigned int is_next_epoch;
+
+        rr= &(s->s3->rrec);
+        sess=s->session;
+
+    /* The epoch may have changed.  If so, process all the
+     * pending records.  This is a non-blocking operation. */
+    if ( ! dtls1_process_buffered_records(s))
+        return 0;
+
+        /* if we're renegotiating, then there may be buffered records */
+        if (dtls1_get_processed_record(s))
+                return 1;
+
+        /* get something from the wire */
+again:
+        /* check if we have the header */
+        if (    (s->rstate != SSL_ST_READ_BODY) ||
+                (s->packet_length < DTLS1_RT_HEADER_LENGTH)) 
+                {
+                n=ssl3_read_n(s, DTLS1_RT_HEADER_LENGTH, s->s3->rbuf.len, 0);
+                /* read timeout is handled by dtls1_read_bytes */
+                if (n <= 0) return(n); /* error or non-blocking */
+
+                OPENSSL_assert(s->packet_length == DTLS1_RT_HEADER_LENGTH);
+
+                s->rstate=SSL_ST_READ_BODY;
+
+                p=s->packet;
+
+                /* Pull apart the header into the DTLS1_RECORD */
+                rr->type= *(p++);
+                ssl_major= *(p++);
+                ssl_minor= *(p++);
+                version=(ssl_major<<8)|ssl_minor;
+
+                /* sequence number is 64 bits, with top 2 bytes = epoch */ 
+                n2s(p,rr->epoch);
+
+                memcpy(&(s->s3->read_sequence[2]), p, 6);
+                p+=6;
+
+                n2s(p,rr->length);
+
+                /* Lets check version */
+                if (!s->first_packet)
+                        {
+                        if (version != s->version && version != DTLS1_BAD_VER)
+                                {
+                                SSLerr(SSL_F_DTLS1_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
+                                /* Send back error using their
+                                 * version number :-) */
+                                s->version=version;
+                                al=SSL_AD_PROTOCOL_VERSION;
+                                goto f_err;
+                                }
+                        }
+
+                if ((version & 0xff00) != (DTLS1_VERSION & 0xff00) &&
+                    (version & 0xff00) != (DTLS1_BAD_VER & 0xff00))
+                        {
+                        SSLerr(SSL_F_DTLS1_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
+                        goto err;
+                        }
+
+                if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH)
+                        {
+                        al=SSL_AD_RECORD_OVERFLOW;
+                        SSLerr(SSL_F_DTLS1_GET_RECORD,SSL_R_PACKET_LENGTH_TOO_LONG);
+                        goto f_err;
+                        }
+
+                s->client_version = version;
+                /* now s->rstate == SSL_ST_READ_BODY */
+                }
+
+        /* s->rstate == SSL_ST_READ_BODY, get and decode the data */
+
+        if (rr->length > s->packet_length-DTLS1_RT_HEADER_LENGTH)
+                {
+                /* now s->packet_length == DTLS1_RT_HEADER_LENGTH */
+                i=rr->length;
+                n=ssl3_read_n(s,i,i,1);
+                if (n <= 0) return(n); /* error or non-blocking io */
+
+                /* this packet contained a partial record, dump it */
+                if ( n != i)
+                        {
+                        s->packet_length = 0;
+                        goto again;
+                        }
+
+                /* now n == rr->length,
+                 * and s->packet_length == DTLS1_RT_HEADER_LENGTH + rr->length */
+                }
+        s->rstate=SSL_ST_READ_HEADER; /* set state for later operations */
+
+        /* match epochs.  NULL means the packet is dropped on the floor */
+        bitmap = dtls1_get_bitmap(s, rr, &is_next_epoch);
+        if ( bitmap == NULL)
+        {
+        s->packet_length = 0;  /* dump this record */
+        goto again;   /* get another record */
+                }
+
+        /* check whether this is a repeat, or aged record */
+        if ( ! dtls1_record_replay_check(s, bitmap, &(rr->seq_num)))
+                {
+                s->packet_length=0; /* dump this record */
+                goto again;     /* get another record */
+                }
+
+        /* just read a 0 length packet */
+        if (rr->length == 0) goto again;
+
+    /* If this record is from the next epoch (either HM or ALERT), buffer it
+     * since it cannot be processed at this time.
+     * Records from the next epoch are marked as received even though they are 
+     * not processed, so as to prevent any potential resource DoS attack */
+    if (is_next_epoch)
+        {
+        dtls1_record_bitmap_update(s, bitmap);
+        dtls1_buffer_record(s, &(s->d1->unprocessed_rcds), rr->seq_num);
+        s->packet_length = 0;
+        goto again;
+        }
+
+    if ( ! dtls1_process_record(s))
+        return(0);
+
+        dtls1_clear_timeouts(s);  /* done waiting */
+        return(1);
+
+f_err:
+        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+err:
+        return(0);
+        }
+
+/* Return up to 'len' payload bytes received in 'type' records.
+ * 'type' is one of the following:
+ *
+ *   -  SSL3_RT_HANDSHAKE (when ssl3_get_message calls us)
+ *   -  SSL3_RT_APPLICATION_DATA (when ssl3_read calls us)
+ *   -  0 (during a shutdown, no data has to be returned)
+ *
+ * If we don't have stored data to work from, read a SSL/TLS record first
+ * (possibly multiple records if we still don't have anything to return).
+ *
+ * This function must handle any surprises the peer may have for us, such as
+ * Alert records (e.g. close_notify), ChangeCipherSpec records (not really
+ * a surprise, but handled as if it were), or renegotiation requests.
+ * Also if record payloads contain fragments too small to process, we store
+ * them until there is enough for the respective protocol (the record protocol
+ * may use arbitrary fragmentation and even interleaving):
+ *     Change cipher spec protocol
+ *             just 1 byte needed, no need for keeping anything stored
+ *     Alert protocol
+ *             2 bytes needed (AlertLevel, AlertDescription)
+ *     Handshake protocol
+ *             4 bytes needed (HandshakeType, uint24 length) -- we just have
+ *             to detect unexpected Client Hello and Hello Request messages
+ *             here, anything else is handled by higher layers
+ *     Application data protocol
+ *             none of our business
+ */
+int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
+        {
+        int al,i,j,ret;
+        unsigned int n;
+        SSL3_RECORD *rr;
+        void (*cb)(const SSL *ssl,int type2,int val)=NULL;
+
+        if (s->s3->rbuf.buf == NULL) /* Not initialized yet */
+                if (!ssl3_setup_buffers(s))
+                        return(-1);
+
+    /* XXX: check what the second '&& type' is about */
+        if ((type && (type != SSL3_RT_APPLICATION_DATA) && 
+                (type != SSL3_RT_HANDSHAKE) && type) ||
+            (peek && (type != SSL3_RT_APPLICATION_DATA)))
+                {
+                SSLerr(SSL_F_DTLS1_READ_BYTES, ERR_R_INTERNAL_ERROR);
+                return -1;
+                }
+
+        /* check whether there's a handshake message (client hello?) waiting */
+        if ( (ret = have_handshake_fragment(s, type, buf, len, peek)))
+                return ret;
+
+        /* Now s->d1->handshake_fragment_len == 0 if type == SSL3_RT_HANDSHAKE. */
+
+        if (!s->in_handshake && SSL_in_init(s))
+                {
+                /* type == SSL3_RT_APPLICATION_DATA */
+                i=s->handshake_func(s);
+                if (i < 0) return(i);
+                if (i == 0)
+                        {
+                        SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
+                        return(-1);
+                        }
+                }
+
+start:
+        s->rwstate=SSL_NOTHING;
+
+        /* s->s3->rrec.type         - is the type of record
+         * s->s3->rrec.data,    - data
+         * s->s3->rrec.off,     - offset into 'data' for next read
+         * s->s3->rrec.length,  - number of bytes. */
+        rr = &(s->s3->rrec);
+
+        /* get new packet if necessary */
+        if ((rr->length == 0) || (s->rstate == SSL_ST_READ_BODY))
+                {
+                ret=dtls1_get_record(s);
+                if (ret <= 0) 
+                        {
+                        ret = dtls1_read_failed(s, ret);
+                        /* anything other than a timeout is an error */
+                        if (ret <= 0)  
+                                return(ret);
+                        else
+                                goto start;
+                        }
+                }
+
+        /* we now have a packet which can be read and processed */
+
+        if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,
+                                       * reset by ssl3_get_finished */
+                && (rr->type != SSL3_RT_HANDSHAKE))
+                {
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);
+                goto err;
+                }
+
+        /* If the other end has shut down, throw anything we read away
+         * (even in 'peek' mode) */
+        if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
+                {
+                rr->length=0;
+                s->rwstate=SSL_NOTHING;
+                return(0);
+                }
+
+
+        if (type == rr->type) /* SSL3_RT_APPLICATION_DATA or SSL3_RT_HANDSHAKE */
+                {
+                /* make sure that we are not getting application data when we
+                 * are doing a handshake for the first time */
+                if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&
+                        (s->enc_read_ctx == NULL))
+                        {
+                        al=SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_APP_DATA_IN_HANDSHAKE);
+                        goto f_err;
+                        }
+
+                if (len <= 0) return(len);
+
+                if ((unsigned int)len > rr->length)
+                        n = rr->length;
+                else
+                        n = (unsigned int)len;
+
+                memcpy(buf,&(rr->data[rr->off]),n);
+                if (!peek)
+                        {
+                        rr->length-=n;
+                        rr->off+=n;
+                        if (rr->length == 0)
+                                {
+                                s->rstate=SSL_ST_READ_HEADER;
+                                rr->off=0;
+                                }
+                        }
+                return(n);
+                }
+
+
+        /* If we get here, then type != rr->type; if we have a handshake
+         * message, then it was unexpected (Hello Request or Client Hello). */
+
+        /* In case of record types for which we have 'fragment' storage,
+         * fill that so that we can process the data at a fixed place.
+         */
+                {
+                unsigned int k, dest_maxlen = 0;
+                unsigned char *dest = NULL;
+                unsigned int *dest_len = NULL;
+
+                if (rr->type == SSL3_RT_HANDSHAKE)
+                        {
+                        dest_maxlen = sizeof s->d1->handshake_fragment;
+                        dest = s->d1->handshake_fragment;
+                        dest_len = &s->d1->handshake_fragment_len;
+                        }
+                else if (rr->type == SSL3_RT_ALERT)
+                        {
+                        dest_maxlen = sizeof(s->d1->alert_fragment);
+                        dest = s->d1->alert_fragment;
+                        dest_len = &s->d1->alert_fragment_len;
+                        }
+                /* else it's a CCS message, or it's wrong */
+                else if (rr->type != SSL3_RT_CHANGE_CIPHER_SPEC)
+                        {
+                          /* Not certain if this is the right error handling */
+                          al=SSL_AD_UNEXPECTED_MESSAGE;
+                          SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
+                          goto f_err;
+                        }
+
+
+                if (dest_maxlen > 0)
+                        {
+            /* XDTLS:  In a pathalogical case, the Client Hello
+             *  may be fragmented--don't always expect dest_maxlen bytes */
+                        if ( rr->length < dest_maxlen)
+                                {
+                                s->rstate=SSL_ST_READ_HEADER;
+                                rr->length = 0;
+                                goto start;
+                                }
+
+                        /* now move 'n' bytes: */
+                        for ( k = 0; k < dest_maxlen; k++)
+                                {
+                                dest[k] = rr->data[rr->off++];
+                                rr->length--;
+                                }
+                        *dest_len = dest_maxlen;
+                        }
+                }
+
+        /* s->d1->handshake_fragment_len == 12  iff  rr->type == SSL3_RT_HANDSHAKE;
+         * s->d1->alert_fragment_len == 7      iff  rr->type == SSL3_RT_ALERT.
+         * (Possibly rr is 'empty' now, i.e. rr->length may be 0.) */
+
+        /* If we are a client, check for an incoming 'Hello Request': */
+        if ((!s->server) &&
+                (s->d1->handshake_fragment_len >= DTLS1_HM_HEADER_LENGTH) &&
+                (s->d1->handshake_fragment[0] == SSL3_MT_HELLO_REQUEST) &&
+                (s->session != NULL) && (s->session->cipher != NULL))
+                {
+                s->d1->handshake_fragment_len = 0;
+
+                if ((s->d1->handshake_fragment[1] != 0) ||
+                        (s->d1->handshake_fragment[2] != 0) ||
+                        (s->d1->handshake_fragment[3] != 0))
+                        {
+                        al=SSL_AD_DECODE_ERROR;
+                        SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_BAD_HELLO_REQUEST);
+                        goto err;
+                        }
+
+                /* no need to check sequence number on HELLO REQUEST messages */
+
+                if (s->msg_callback)
+                        s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, 
+                                s->d1->handshake_fragment, 4, s, s->msg_callback_arg);
+
+                if (SSL_is_init_finished(s) &&
+                        !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) &&
+                        !s->s3->renegotiate)
+                        {
+                        ssl3_renegotiate(s);
+                        if (ssl3_renegotiate_check(s))
+                                {
+                                i=s->handshake_func(s);
+                                if (i < 0) return(i);
+                                if (i == 0)
+                                        {
+                                        SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
+                                        return(-1);
+                                        }
+
+                                if (!(s->mode & SSL_MODE_AUTO_RETRY))
+                                        {
+                                        if (s->s3->rbuf.left == 0) /* no read-ahead left? */
+                                                {
+                                                BIO *bio;
+                                                /* In the case where we try to read application data,
+                                                 * but we trigger an SSL handshake, we return -1 with
+                                                 * the retry option set.  Otherwise renegotiation may
+                                                 * cause nasty problems in the blocking world */
+                                                s->rwstate=SSL_READING;
+                                                bio=SSL_get_rbio(s);
+                                                BIO_clear_retry_flags(bio);
+                                                BIO_set_retry_read(bio);
+                                                return(-1);
+                                                }
+                                        }
+                                }
+                        }
+                /* we either finished a handshake or ignored the request,
+                 * now try again to obtain the (application) data we were asked for */
+                goto start;
+                }
+
+        if (s->d1->alert_fragment_len >= DTLS1_AL_HEADER_LENGTH)
+                {
+                int alert_level = s->d1->alert_fragment[0];
+                int alert_descr = s->d1->alert_fragment[1];
+
+                s->d1->alert_fragment_len = 0;
+
+                if (s->msg_callback)
+                        s->msg_callback(0, s->version, SSL3_RT_ALERT, 
+                                s->d1->alert_fragment, 2, s, s->msg_callback_arg);
+
+                if (s->info_callback != NULL)
+                        cb=s->info_callback;
+                else if (s->ctx->info_callback != NULL)
+                        cb=s->ctx->info_callback;
+
+                if (cb != NULL)
+                        {
+                        j = (alert_level << 8) | alert_descr;
+                        cb(s, SSL_CB_READ_ALERT, j);
+                        }
+
+                if (alert_level == 1) /* warning */
+                        {
+                        s->s3->warn_alert = alert_descr;
+                        if (alert_descr == SSL_AD_CLOSE_NOTIFY)
+                                {
+                                s->shutdown |= SSL_RECEIVED_SHUTDOWN;
+                                return(0);
+                                }
+#if 0
+            /* XXX: this is a possible improvement in the future */
+                        /* now check if it's a missing record */
+                        if (alert_descr == DTLS1_AD_MISSING_HANDSHAKE_MESSAGE)
+                                {
+                                unsigned short seq;
+                                unsigned int frag_off;
+                                unsigned char *p = &(s->d1->alert_fragment[2]);
+
+                                n2s(p, seq);
+                                n2l3(p, frag_off);
+
+                                dtls1_retransmit_message(s, seq, frag_off, &found);
+                                if ( ! found  && SSL_in_init(s))
+                                        {
+                                        /* fprintf( stderr,"in init = %d\n", SSL_in_init(s)); */
+                                        /* requested a message not yet sent, 
+                                           send an alert ourselves */
+                                        ssl3_send_alert(s,SSL3_AL_WARNING,
+                                                DTLS1_AD_MISSING_HANDSHAKE_MESSAGE);
+                                        }
+                                }
+#endif
+                        }
+                else if (alert_level == 2) /* fatal */
+                        {
+                        char tmp[16];
+
+                        s->rwstate=SSL_NOTHING;
+                        s->s3->fatal_alert = alert_descr;
+                        SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);
+                        BIO_snprintf(tmp,sizeof tmp,"%d",alert_descr);
+                        ERR_add_error_data(2,"SSL alert number ",tmp);
+                        s->shutdown|=SSL_RECEIVED_SHUTDOWN;
+                        SSL_CTX_remove_session(s->ctx,s->session);
+                        return(0);
+                        }
+                else
+                        {
+                        al=SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_UNKNOWN_ALERT_TYPE);
+                        goto f_err;
+                        }
+
+                goto start;
+                }
+
+        if (s->shutdown & SSL_SENT_SHUTDOWN) /* but we have not received a shutdown */
+                {
+                s->rwstate=SSL_NOTHING;
+                rr->length=0;
+                return(0);
+                }
+
+        if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)
+                {
+                struct ccs_header_st ccs_hdr;
+
+                dtls1_get_ccs_header(rr->data, &ccs_hdr);
+
+                /* 'Change Cipher Spec' is just a single byte, so we know
+                 * exactly what the record payload has to look like */
+                /* XDTLS: check that epoch is consistent */
+                if (    (s->client_version == DTLS1_BAD_VER && rr->length != 3) ||
+                        (s->client_version != DTLS1_BAD_VER && rr->length != DTLS1_CCS_HEADER_LENGTH) || 
+                        (rr->off != 0) || (rr->data[0] != SSL3_MT_CCS))
+                        {
+                        i=SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);
+                        goto err;
+                        }
+
+                rr->length=0;
+
+                if (s->msg_callback)
+                        s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC, 
+                                rr->data, 1, s, s->msg_callback_arg);
+
+                s->s3->change_cipher_spec=1;
+                if (!ssl3_do_change_cipher_spec(s))
+                        goto err;
+
+                /* do this whenever CCS is processed */
+                dtls1_reset_seq_numbers(s, SSL3_CC_READ);
+
+                if (s->client_version == DTLS1_BAD_VER)
+                        s->d1->handshake_read_seq++;
+
+                goto start;
+                }
+
+        /* Unexpected handshake message (Client Hello, or protocol violation) */
+        if ((s->d1->handshake_fragment_len >= DTLS1_HM_HEADER_LENGTH) && 
+                !s->in_handshake)
+                {
+                struct hm_header_st msg_hdr;
+                
+                /* this may just be a stale retransmit */
+                dtls1_get_message_header(rr->data, &msg_hdr);
+                if( rr->epoch != s->d1->r_epoch)
+                        {
+                        rr->length = 0;
+                        goto start;
+                        }
+
+                if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&
+                        !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS))
+                        {
+#if 0 /* worked only because C operator preferences are not as expected (and
+       * because this is not really needed for clients except for detecting
+       * protocol violations): */
+                        s->state=SSL_ST_BEFORE|(s->server)
+                                ?SSL_ST_ACCEPT
+                                :SSL_ST_CONNECT;
+#else
+                        s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
+#endif
+                        s->new_session=1;
+                        }
+                i=s->handshake_func(s);
+                if (i < 0) return(i);
+                if (i == 0)
+                        {
+                        SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
+                        return(-1);
+                        }
+
+                if (!(s->mode & SSL_MODE_AUTO_RETRY))
+                        {
+                        if (s->s3->rbuf.left == 0) /* no read-ahead left? */
+                                {
+                                BIO *bio;
+                                /* In the case where we try to read application data,
+                                 * but we trigger an SSL handshake, we return -1 with
+                                 * the retry option set.  Otherwise renegotiation may
+                                 * cause nasty problems in the blocking world */
+                                s->rwstate=SSL_READING;
+                                bio=SSL_get_rbio(s);
+                                BIO_clear_retry_flags(bio);
+                                BIO_set_retry_read(bio);
+                                return(-1);
+                                }
+                        }
+                goto start;
+                }
+
+        switch (rr->type)
+                {
+        default:
+#ifndef OPENSSL_NO_TLS
+                /* TLS just ignores unknown message types */
+                if (s->version == TLS1_VERSION)
+                        {
+                        rr->length = 0;
+                        goto start;
+                        }
+#endif
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
+                goto f_err;
+        case SSL3_RT_CHANGE_CIPHER_SPEC:
+        case SSL3_RT_ALERT:
+        case SSL3_RT_HANDSHAKE:
+                /* we already handled all of these, with the possible exception
+                 * of SSL3_RT_HANDSHAKE when s->in_handshake is set, but that
+                 * should not happen when type != rr->type */
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_DTLS1_READ_BYTES,ERR_R_INTERNAL_ERROR);
+                goto f_err;
+        case SSL3_RT_APPLICATION_DATA:
+                /* At this point, we were expecting handshake data,
+                 * but have application data.  If the library was
+                 * running inside ssl3_read() (i.e. in_read_app_data
+                 * is set) and it makes sense to read application data
+                 * at this point (session renegotiation not yet started),
+                 * we will indulge it.
+                 */
+                if (s->s3->in_read_app_data &&
+                        (s->s3->total_renegotiations != 0) &&
+                        ((
+                                (s->state & SSL_ST_CONNECT) &&
+                                (s->state >= SSL3_ST_CW_CLNT_HELLO_A) &&
+                                (s->state <= SSL3_ST_CR_SRVR_HELLO_A)
+                                ) || (
+                                        (s->state & SSL_ST_ACCEPT) &&
+                                        (s->state <= SSL3_ST_SW_HELLO_REQ_A) &&
+                                        (s->state >= SSL3_ST_SR_CLNT_HELLO_A)
+                                        )
+                                ))
+                        {
+                        s->s3->in_read_app_data=2;
+                        return(-1);
+                        }
+                else
+                        {
+                        al=SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
+                        goto f_err;
+                        }
+                }
+        /* not reached */
+
+f_err:
+        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+err:
+        return(-1);
+        }
+
+int
+dtls1_write_app_data_bytes(SSL *s, int type, const void *buf_, int len)
+        {
+        unsigned int n,tot;
+        int i;
+
+        if (SSL_in_init(s) && !s->in_handshake)
+                {
+                i=s->handshake_func(s);
+                if (i < 0) return(i);
+                if (i == 0)
+                        {
+                        SSLerr(SSL_F_DTLS1_WRITE_APP_DATA_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
+                        return -1;
+                        }
+                }
+
+        tot = s->s3->wnum;
+        n = len - tot;
+
+        while( n)
+                {
+                /* dtls1_write_bytes sends one record at a time, sized according to 
+                 * the currently known MTU */
+                i = dtls1_write_bytes(s, type, buf_, len);
+                if (i <= 0) return i;
+                
+                if ((i == (int)n) ||
+                        (type == SSL3_RT_APPLICATION_DATA &&
+                                (s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE)))
+                        {
+                        /* next chunk of data should get another prepended empty fragment
+                         * in ciphersuites with known-IV weakness: */
+                        s->s3->empty_fragment_done = 0;
+                        return tot+i;
+                        }
+
+                tot += i;
+                n-=i;
+                }
+
+        return tot;
+        }
+
+
+        /* this only happens when a client hello is received and a handshake 
+         * is started. */
+static int
+have_handshake_fragment(SSL *s, int type, unsigned char *buf, 
+        int len, int peek)
+        {
+        
+        if ((type == SSL3_RT_HANDSHAKE) && (s->d1->handshake_fragment_len > 0))
+                /* (partially) satisfy request from storage */
+                {
+                unsigned char *src = s->d1->handshake_fragment;
+                unsigned char *dst = buf;
+                unsigned int k,n;
+                
+                /* peek == 0 */
+                n = 0;
+                while ((len > 0) && (s->d1->handshake_fragment_len > 0))
+                        {
+                        *dst++ = *src++;
+                        len--; s->d1->handshake_fragment_len--;
+                        n++;
+                        }
+                /* move any remaining fragment bytes: */
+                for (k = 0; k < s->d1->handshake_fragment_len; k++)
+                        s->d1->handshake_fragment[k] = *src++;
+                return n;
+                }
+        
+        return 0;
+        }
+
+
+
+
+/* Call this to write data in records of type 'type'
+ * It will return <= 0 if not all data has been sent or non-blocking IO.
+ */
+int dtls1_write_bytes(SSL *s, int type, const void *buf_, int len)
+        {
+        const unsigned char *buf=buf_;
+        unsigned int tot,n,nw;
+        int i;
+        unsigned int mtu;
+
+        s->rwstate=SSL_NOTHING;
+        tot=s->s3->wnum;
+
+        n=(len-tot);
+
+        /* handshake layer figures out MTU for itself, but data records
+         * are also sent through this interface, so need to figure out MTU */
+#if 0
+        mtu = BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_GET_MTU, 0, NULL);
+        mtu += DTLS1_HM_HEADER_LENGTH;  /* HM already inserted */
+#endif
+        mtu = s->d1->mtu;
+
+        if (mtu > SSL3_RT_MAX_PLAIN_LENGTH)
+                mtu = SSL3_RT_MAX_PLAIN_LENGTH;
+
+        if (n > mtu)
+                nw=mtu;
+        else
+                nw=n;
+        
+        i=do_dtls1_write(s, type, &(buf[tot]), nw, 0);
+        if (i <= 0)
+                {
+                s->s3->wnum=tot;
+                return i;
+                }
+
+        if ( (int)s->s3->wnum + i == len)
+                s->s3->wnum = 0;
+        else 
+                s->s3->wnum += i;
+
+        return tot + i;
+        }
+
+int do_dtls1_write(SSL *s, int type, const unsigned char *buf, unsigned int len, int create_empty_fragment)
+        {
+        unsigned char *p,*pseq;
+        int i,mac_size,clear=0;
+        int prefix_len = 0;
+        SSL3_RECORD *wr;
+        SSL3_BUFFER *wb;
+        SSL_SESSION *sess;
+        int bs;
+
+        /* first check if there is a SSL3_BUFFER still being written
+         * out.  This will happen with non blocking IO */
+        if (s->s3->wbuf.left != 0)
+                {
+                OPENSSL_assert(0); /* XDTLS:  want to see if we ever get here */
+                return(ssl3_write_pending(s,type,buf,len));
+                }
+
+        /* If we have an alert to send, lets send it */
+        if (s->s3->alert_dispatch)
+                {
+                i=s->method->ssl_dispatch_alert(s);
+                if (i <= 0)
+                        return(i);
+                /* if it went, fall through and send more stuff */
+                }
+
+        if (len == 0 && !create_empty_fragment)
+                return 0;
+
+        wr= &(s->s3->wrec);
+        wb= &(s->s3->wbuf);
+        sess=s->session;
+
+        if (    (sess == NULL) ||
+                (s->enc_write_ctx == NULL) ||
+                (s->write_hash == NULL))
+                clear=1;
+
+        if (clear)
+                mac_size=0;
+        else
+                mac_size=EVP_MD_size(s->write_hash);
+
+        /* DTLS implements explicit IV, so no need for empty fragments */
+#if 0
+        /* 'create_empty_fragment' is true only when this function calls itself */
+        if (!clear && !create_empty_fragment && !s->s3->empty_fragment_done
+                && SSL_version(s) != DTLS1_VERSION)
+                {
+                /* countermeasure against known-IV weakness in CBC ciphersuites
+                 * (see http://www.openssl.org/~bodo/tls-cbc.txt) 
+                 */
+
+                if (s->s3->need_empty_fragments && type == SSL3_RT_APPLICATION_DATA)
+                        {
+                        /* recursive function call with 'create_empty_fragment' set;
+                         * this prepares and buffers the data for an empty fragment
+                         * (these 'prefix_len' bytes are sent out later
+                         * together with the actual payload) */
+                        prefix_len = s->method->do_ssl_write(s, type, buf, 0, 1);
+                        if (prefix_len <= 0)
+                                goto err;
+
+                        if (s->s3->wbuf.len < (size_t)prefix_len + SSL3_RT_MAX_PACKET_SIZE)
+                                {
+                                /* insufficient space */
+                                SSLerr(SSL_F_DO_DTLS1_WRITE, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+                        }
+                
+                s->s3->empty_fragment_done = 1;
+                }
+#endif
+
+        p = wb->buf + prefix_len;
+
+        /* write the header */
+
+        *(p++)=type&0xff;
+        wr->type=type;
+
+        if (s->client_version == DTLS1_BAD_VER)
+                *(p++) = DTLS1_BAD_VER>>8,
+                *(p++) = DTLS1_BAD_VER&0xff;
+        else
+                *(p++)=(s->version>>8),
+                *(p++)=s->version&0xff;
+
+        /* field where we are to write out packet epoch, seq num and len */
+        pseq=p; 
+        p+=10;
+
+        /* lets setup the record stuff. */
+
+        /* Make space for the explicit IV in case of CBC.
+         * (this is a bit of a boundary violation, but what the heck).
+         */
+        if ( s->enc_write_ctx && 
+                (EVP_CIPHER_mode( s->enc_write_ctx->cipher ) & EVP_CIPH_CBC_MODE))
+                bs = EVP_CIPHER_block_size(s->enc_write_ctx->cipher);
+        else
+                bs = 0;
+
+        wr->data=p + bs;  /* make room for IV in case of CBC */
+        wr->length=(int)len;
+        wr->input=(unsigned char *)buf;
+
+        /* we now 'read' from wr->input, wr->length bytes into
+         * wr->data */
+
+        /* first we compress */
+        if (s->compress != NULL)
+                {
+                if (!ssl3_do_compress(s))
+                        {
+                        SSLerr(SSL_F_DO_DTLS1_WRITE,SSL_R_COMPRESSION_FAILURE);
+                        goto err;
+                        }
+                }
+        else
+                {
+                memcpy(wr->data,wr->input,wr->length);
+                wr->input=wr->data;
+                }
+
+        /* we should still have the output to wr->data and the input
+         * from wr->input.  Length should be wr->length.
+         * wr->data still points in the wb->buf */
+
+        if (mac_size != 0)
+                {
+                s->method->ssl3_enc->mac(s,&(p[wr->length + bs]),1);
+                wr->length+=mac_size;
+                }
+
+        /* this is true regardless of mac size */
+        wr->input=p;
+        wr->data=p;
+
+
+        /* ssl3_enc can only have an error on read */
+        if (bs) /* bs != 0 in case of CBC */
+                {
+                RAND_pseudo_bytes(p,bs);
+                /* master IV and last CBC residue stand for
+                 * the rest of randomness */
+                wr->length += bs;
+                }
+
+        s->method->ssl3_enc->enc(s,1);
+
+        /* record length after mac and block padding */
+/*      if (type == SSL3_RT_APPLICATION_DATA ||
+        (type == SSL3_RT_ALERT && ! SSL_in_init(s))) */
+        
+        /* there's only one epoch between handshake and app data */
+        
+        s2n(s->d1->w_epoch, pseq);
+
+        /* XDTLS: ?? */
+/*      else
+        s2n(s->d1->handshake_epoch, pseq); */
+
+        memcpy(pseq, &(s->s3->write_sequence[2]), 6);
+        pseq+=6;
+        s2n(wr->length,pseq);
+
+        /* we should now have
+         * wr->data pointing to the encrypted data, which is
+         * wr->length long */
+        wr->type=type; /* not needed but helps for debugging */
+        wr->length+=DTLS1_RT_HEADER_LENGTH;
+
+#if 0  /* this is now done at the message layer */
+        /* buffer the record, making it easy to handle retransmits */
+        if ( type == SSL3_RT_HANDSHAKE || type == SSL3_RT_CHANGE_CIPHER_SPEC)
+                dtls1_buffer_record(s, wr->data, wr->length, 
+                        *((PQ_64BIT *)&(s->s3->write_sequence[0])));
+#endif
+
+        ssl3_record_sequence_update(&(s->s3->write_sequence[0]));
+
+        if (create_empty_fragment)
+                {
+                /* we are in a recursive call;
+                 * just return the length, don't write out anything here
+                 */
+                return wr->length;
+                }
+
+        /* now let's set up wb */
+        wb->left = prefix_len + wr->length;
+        wb->offset = 0;
+
+        /* memorize arguments so that ssl3_write_pending can detect bad write retries later */
+        s->s3->wpend_tot=len;
+        s->s3->wpend_buf=buf;
+        s->s3->wpend_type=type;
+        s->s3->wpend_ret=len;
+
+        /* we now just need to write the buffer */
+        return ssl3_write_pending(s,type,buf,len);
+err:
+        return -1;
+        }
+
+
+
+static int dtls1_record_replay_check(SSL *s, DTLS1_BITMAP *bitmap,
+        PQ_64BIT *seq_num)
+        {
+#if PQ_64BIT_IS_INTEGER
+        PQ_64BIT mask = 0x0000000000000001L;
+#endif
+        PQ_64BIT rcd_num, tmp;
+
+        pq_64bit_init(&rcd_num);
+        pq_64bit_init(&tmp);
+
+        /* this is the sequence number for the record just read */
+        pq_64bit_bin2num(&rcd_num, s->s3->read_sequence, 8);
+
+        
+        if (pq_64bit_gt(&rcd_num, &(bitmap->max_seq_num)) ||
+                pq_64bit_eq(&rcd_num, &(bitmap->max_seq_num)))
+                {
+                pq_64bit_assign(seq_num, &rcd_num);
+                pq_64bit_free(&rcd_num);
+                pq_64bit_free(&tmp);
+                return 1;  /* this record is new */
+                }
+
+        pq_64bit_sub(&tmp, &(bitmap->max_seq_num), &rcd_num);
+
+        if ( pq_64bit_get_word(&tmp) > bitmap->length)
+                {
+                pq_64bit_free(&rcd_num);
+                pq_64bit_free(&tmp);
+                return 0;  /* stale, outside the window */
+                }
+
+#if PQ_64BIT_IS_BIGNUM
+        {
+        int offset;
+        pq_64bit_sub(&tmp, &(bitmap->max_seq_num), &rcd_num);
+        pq_64bit_sub_word(&tmp, 1);
+        offset = pq_64bit_get_word(&tmp);
+        if ( pq_64bit_is_bit_set(&(bitmap->map), offset))
+                {
+                pq_64bit_free(&rcd_num);
+                pq_64bit_free(&tmp);
+                return 0;
+                }
+        }
+#else
+        mask <<= (bitmap->max_seq_num - rcd_num - 1);
+        if (bitmap->map & mask)
+                return 0; /* record previously received */
+#endif
+        
+        pq_64bit_assign(seq_num, &rcd_num);
+        pq_64bit_free(&rcd_num);
+        pq_64bit_free(&tmp);
+        return 1;
+        }
+
+
+static void dtls1_record_bitmap_update(SSL *s, DTLS1_BITMAP *bitmap)
+        {
+        unsigned int shift;
+        PQ_64BIT rcd_num;
+        PQ_64BIT tmp;
+        PQ_64BIT_CTX *ctx;
+
+        pq_64bit_init(&rcd_num);
+        pq_64bit_init(&tmp);
+
+        pq_64bit_bin2num(&rcd_num, s->s3->read_sequence, 8);
+
+        /* unfortunate code complexity due to 64-bit manipulation support
+         * on 32-bit machines */
+        if ( pq_64bit_gt(&rcd_num, &(bitmap->max_seq_num)) ||
+                pq_64bit_eq(&rcd_num, &(bitmap->max_seq_num)))
+                {
+                pq_64bit_sub(&tmp, &rcd_num, &(bitmap->max_seq_num));
+                pq_64bit_add_word(&tmp, 1);
+
+                shift = (unsigned int)pq_64bit_get_word(&tmp);
+
+                pq_64bit_lshift(&(tmp), &(bitmap->map), shift);
+                pq_64bit_assign(&(bitmap->map), &tmp);
+
+                pq_64bit_set_bit(&(bitmap->map), 0);
+                pq_64bit_add_word(&rcd_num, 1);
+                pq_64bit_assign(&(bitmap->max_seq_num), &rcd_num);
+
+                pq_64bit_assign_word(&tmp, 1);
+                pq_64bit_lshift(&tmp, &tmp, bitmap->length);
+                ctx = pq_64bit_ctx_new(&ctx);
+                pq_64bit_mod(&(bitmap->map), &(bitmap->map), &tmp, ctx);
+                pq_64bit_ctx_free(ctx);
+                }
+        else
+                {
+                pq_64bit_sub(&tmp, &(bitmap->max_seq_num), &rcd_num);
+                pq_64bit_sub_word(&tmp, 1);
+                shift = (unsigned int)pq_64bit_get_word(&tmp);
+
+                pq_64bit_set_bit(&(bitmap->map), shift);
+                }
+
+        pq_64bit_free(&rcd_num);
+        pq_64bit_free(&tmp);
+        }
+
+
+int dtls1_dispatch_alert(SSL *s)
+        {
+        int i,j;
+        void (*cb)(const SSL *ssl,int type,int val)=NULL;
+        unsigned char buf[2 + 2 + 3]; /* alert level + alert desc + message seq +frag_off */
+        unsigned char *ptr = &buf[0];
+
+        s->s3->alert_dispatch=0;
+
+        memset(buf, 0x00, sizeof(buf));
+        *ptr++ = s->s3->send_alert[0];
+        *ptr++ = s->s3->send_alert[1];
+
+        if (s->s3->send_alert[1] == DTLS1_AD_MISSING_HANDSHAKE_MESSAGE)
+                {       
+                s2n(s->d1->handshake_read_seq, ptr);
+#if 0
+                if ( s->d1->r_msg_hdr.frag_off == 0)  /* waiting for a new msg */
+
+                else
+                        s2n(s->d1->r_msg_hdr.seq, ptr); /* partial msg read */
+#endif
+
+#if 0
+                fprintf(stderr, "s->d1->handshake_read_seq = %d, s->d1->r_msg_hdr.seq = %d\n",s->d1->handshake_read_seq,s->d1->r_msg_hdr.seq);
+#endif
+                l2n3(s->d1->r_msg_hdr.frag_off, ptr);
+                }
+
+        i = do_dtls1_write(s, SSL3_RT_ALERT, &buf[0], sizeof(buf), 0);
+        if (i <= 0)
+                {
+                s->s3->alert_dispatch=1;
+                /* fprintf( stderr, "not done with alert\n" ); */
+                }
+        else
+                {
+                if ( s->s3->send_alert[0] == SSL3_AL_FATAL ||
+                        s->s3->send_alert[1] == DTLS1_AD_MISSING_HANDSHAKE_MESSAGE)
+                        (void)BIO_flush(s->wbio);
+
+                if (s->msg_callback)
+                        s->msg_callback(1, s->version, SSL3_RT_ALERT, s->s3->send_alert, 
+                                2, s, s->msg_callback_arg);
+
+                if (s->info_callback != NULL)
+                        cb=s->info_callback;
+                else if (s->ctx->info_callback != NULL)
+                        cb=s->ctx->info_callback;
+
+                if (cb != NULL)
+                        {
+                        j=(s->s3->send_alert[0]<<8)|s->s3->send_alert[1];
+                        cb(s,SSL_CB_WRITE_ALERT,j);
+                        }
+                }
+        return(i);
+        }
+
+
+static DTLS1_BITMAP *
+dtls1_get_bitmap(SSL *s, SSL3_RECORD *rr, unsigned int *is_next_epoch)
+    {
+    
+    *is_next_epoch = 0;
+
+    /* In current epoch, accept HM, CCS, DATA, & ALERT */
+    if (rr->epoch == s->d1->r_epoch)
+        return &s->d1->bitmap;
+
+    /* Only HM and ALERT messages can be from the next epoch */
+    else if (rr->epoch == (unsigned long)(s->d1->r_epoch + 1) &&
+        (rr->type == SSL3_RT_HANDSHAKE ||
+            rr->type == SSL3_RT_ALERT))
+        {
+        *is_next_epoch = 1;
+        return &s->d1->next_bitmap;
+        }
+
+    return NULL;
+    }
+
+#if 0
+static int
+dtls1_record_needs_buffering(SSL *s, SSL3_RECORD *rr, unsigned short *priority,
+        unsigned long *offset)
+        {
+
+        /* alerts are passed up immediately */
+        if ( rr->type == SSL3_RT_APPLICATION_DATA ||
+                rr->type == SSL3_RT_ALERT)
+                return 0;
+
+        /* Only need to buffer if a handshake is underway.
+         * (this implies that Hello Request and Client Hello are passed up
+         * immediately) */
+        if ( SSL_in_init(s))
+                {
+                unsigned char *data = rr->data;
+                /* need to extract the HM/CCS sequence number here */
+                if ( rr->type == SSL3_RT_HANDSHAKE ||
+                        rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)
+                        {
+                        unsigned short seq_num;
+                        struct hm_header_st msg_hdr;
+                        struct ccs_header_st ccs_hdr;
+
+                        if ( rr->type == SSL3_RT_HANDSHAKE)
+                                {
+                                dtls1_get_message_header(data, &msg_hdr);
+                                seq_num = msg_hdr.seq;
+                                *offset = msg_hdr.frag_off;
+                                }
+                        else
+                                {
+                                dtls1_get_ccs_header(data, &ccs_hdr);
+                                seq_num = ccs_hdr.seq;
+                                *offset = 0;
+                                }
+                                
+                        /* this is either a record we're waiting for, or a
+                         * retransmit of something we happened to previously 
+                         * receive (higher layers will drop the repeat silently */
+                        if ( seq_num < s->d1->handshake_read_seq)
+                                return 0;
+                        if (rr->type == SSL3_RT_HANDSHAKE && 
+                                seq_num == s->d1->handshake_read_seq &&
+                                msg_hdr.frag_off < s->d1->r_msg_hdr.frag_off)
+                                return 0;
+                        else if ( seq_num == s->d1->handshake_read_seq &&
+                                (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC ||
+                                        msg_hdr.frag_off == s->d1->r_msg_hdr.frag_off))
+                                return 0;
+                        else
+                                {
+                                *priority = seq_num;
+                                return 1;
+                                }
+                        }
+                else /* unknown record type */
+                        return 0;
+                }
+
+        return 0;
+        }
+#endif
+
+void
+dtls1_reset_seq_numbers(SSL *s, int rw)
+        {
+        unsigned char *seq;
+        unsigned int seq_bytes = sizeof(s->s3->read_sequence);
+
+        if ( rw & SSL3_CC_READ)
+                {
+                seq = s->s3->read_sequence;
+                s->d1->r_epoch++;
+
+                pq_64bit_assign(&(s->d1->bitmap.map), &(s->d1->next_bitmap.map));
+                s->d1->bitmap.length = s->d1->next_bitmap.length;
+                pq_64bit_assign(&(s->d1->bitmap.max_seq_num), 
+                        &(s->d1->next_bitmap.max_seq_num));
+
+                pq_64bit_free(&(s->d1->next_bitmap.map));
+                pq_64bit_free(&(s->d1->next_bitmap.max_seq_num));
+                memset(&(s->d1->next_bitmap), 0x00, sizeof(DTLS1_BITMAP));
+                pq_64bit_init(&(s->d1->next_bitmap.map));
+                pq_64bit_init(&(s->d1->next_bitmap.max_seq_num));
+                }
+        else
+                {
+                seq = s->s3->write_sequence;
+                s->d1->w_epoch++;
+                }
+
+        memset(seq, 0x00, seq_bytes);
+        }
+
+#if PQ_64BIT_IS_INTEGER
+static PQ_64BIT
+bytes_to_long_long(unsigned char *bytes, PQ_64BIT *num)
+       {
+       PQ_64BIT _num;
+
+       _num = (((PQ_64BIT)bytes[0]) << 56) |
+               (((PQ_64BIT)bytes[1]) << 48) |
+               (((PQ_64BIT)bytes[2]) << 40) |
+               (((PQ_64BIT)bytes[3]) << 32) |
+               (((PQ_64BIT)bytes[4]) << 24) |
+               (((PQ_64BIT)bytes[5]) << 16) |
+               (((PQ_64BIT)bytes[6]) <<  8) |
+               (((PQ_64BIT)bytes[7])      );
+
+           *num = _num ;
+       return _num;
+       }
+#endif
+
+
+static void
+dtls1_clear_timeouts(SSL *s)
+        {
+        memset(&(s->d1->timeout), 0x00, sizeof(struct dtls1_timeout_st));
+        }
diff --git a/src/lib/libssl/src/ssl/d1_srvr.c b/src/lib/libssl/src/ssl/d1_srvr.c
new file mode 100644
index 0000000000..927b01f3c4
--- /dev/null
+++ b/src/lib/libssl/src/ssl/d1_srvr.c
@@ -0,0 +1,1147 @@
+/* ssl/d1_srvr.c */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "ssl_locl.h"
+#include <openssl/buffer.h>
+#include <openssl/rand.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
+#include <openssl/x509.h>
+#include <openssl/md5.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+
+static SSL_METHOD *dtls1_get_server_method(int ver);
+static int dtls1_send_hello_verify_request(SSL *s);
+
+static SSL_METHOD *dtls1_get_server_method(int ver)
+        {
+        if (ver == DTLS1_VERSION)
+                return(DTLSv1_server_method());
+        else
+                return(NULL);
+        }
+
+IMPLEMENT_dtls1_meth_func(DTLSv1_server_method,
+                        dtls1_accept,
+                        ssl_undefined_function,
+                        dtls1_get_server_method)
+
+int dtls1_accept(SSL *s)
+        {
+        BUF_MEM *buf;
+        unsigned long l,Time=(unsigned long)time(NULL);
+        void (*cb)(const SSL *ssl,int type,int val)=NULL;
+        long num1;
+        int ret= -1;
+        int new_state,state,skip=0;
+
+        RAND_add(&Time,sizeof(Time),0);
+        ERR_clear_error();
+        clear_sys_error();
+
+        if (s->info_callback != NULL)
+                cb=s->info_callback;
+        else if (s->ctx->info_callback != NULL)
+                cb=s->ctx->info_callback;
+
+        /* init things to blank */
+        s->in_handshake++;
+        if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);
+
+        if (s->cert == NULL)
+                {
+                SSLerr(SSL_F_DTLS1_ACCEPT,SSL_R_NO_CERTIFICATE_SET);
+                return(-1);
+                }
+
+        for (;;)
+                {
+                state=s->state;
+
+                switch (s->state)
+                        {
+                case SSL_ST_RENEGOTIATE:
+                        s->new_session=1;
+                        /* s->state=SSL_ST_ACCEPT; */
+
+                case SSL_ST_BEFORE:
+                case SSL_ST_ACCEPT:
+                case SSL_ST_BEFORE|SSL_ST_ACCEPT:
+                case SSL_ST_OK|SSL_ST_ACCEPT:
+
+                        s->server=1;
+                        if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
+
+                        if ((s->version & 0xff00) != (DTLS1_VERSION & 0xff00))
+                                {
+                                SSLerr(SSL_F_DTLS1_ACCEPT, ERR_R_INTERNAL_ERROR);
+                                return -1;
+                                }
+                        s->type=SSL_ST_ACCEPT;
+
+                        if (s->init_buf == NULL)
+                                {
+                                if ((buf=BUF_MEM_new()) == NULL)
+                                        {
+                                        ret= -1;
+                                        goto end;
+                                        }
+                                if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
+                                        {
+                                        ret= -1;
+                                        goto end;
+                                        }
+                                s->init_buf=buf;
+                                }
+
+                        if (!ssl3_setup_buffers(s))
+                                {
+                                ret= -1;
+                                goto end;
+                                }
+
+                        s->init_num=0;
+
+                        if (s->state != SSL_ST_RENEGOTIATE)
+                                {
+                                /* Ok, we now need to push on a buffering BIO so that
+                                 * the output is sent in a way that TCP likes :-)
+                                 */
+                                if (!ssl_init_wbio_buffer(s,1)) { ret= -1; goto end; }
+
+                                ssl3_init_finished_mac(s);
+                                s->state=SSL3_ST_SR_CLNT_HELLO_A;
+                                s->ctx->stats.sess_accept++;
+                                }
+                        else
+                                {
+                                /* s->state == SSL_ST_RENEGOTIATE,
+                                 * we will just send a HelloRequest */
+                                s->ctx->stats.sess_accept_renegotiate++;
+                                s->state=SSL3_ST_SW_HELLO_REQ_A;
+                                }
+
+            if ( (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE))
+                s->d1->send_cookie = 1;
+            else
+                s->d1->send_cookie = 0;
+
+                        break;
+
+                case SSL3_ST_SW_HELLO_REQ_A:
+                case SSL3_ST_SW_HELLO_REQ_B:
+
+                        s->shutdown=0;
+                        ret=dtls1_send_hello_request(s);
+                        if (ret <= 0) goto end;
+                        s->s3->tmp.next_state=SSL3_ST_SW_HELLO_REQ_C;
+                        s->state=SSL3_ST_SW_FLUSH;
+                        s->init_num=0;
+
+                        ssl3_init_finished_mac(s);
+                        break;
+
+                case SSL3_ST_SW_HELLO_REQ_C:
+                        s->state=SSL_ST_OK;
+                        break;
+
+                case SSL3_ST_SR_CLNT_HELLO_A:
+                case SSL3_ST_SR_CLNT_HELLO_B:
+                case SSL3_ST_SR_CLNT_HELLO_C:
+
+                        s->shutdown=0;
+                        ret=ssl3_get_client_hello(s);
+                        if (ret <= 0) goto end;
+                        s->new_session = 2;
+
+                        if ( s->d1->send_cookie)
+                                s->state = DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A;
+                        else
+                                s->state = SSL3_ST_SW_SRVR_HELLO_A;
+
+                        s->init_num=0;
+                        break;
+                        
+                case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A:
+                case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B:
+
+                        ret = dtls1_send_hello_verify_request(s);
+                        if ( ret <= 0) goto end;
+                        s->d1->send_cookie = 0;
+                        s->state=SSL3_ST_SW_FLUSH;
+                        s->s3->tmp.next_state=SSL3_ST_SR_CLNT_HELLO_A;
+
+                        /* HelloVerifyRequests resets Finished MAC */
+                        if (s->client_version != DTLS1_BAD_VER)
+                                ssl3_init_finished_mac(s);
+                        break;
+                        
+                case SSL3_ST_SW_SRVR_HELLO_A:
+                case SSL3_ST_SW_SRVR_HELLO_B:
+                        ret=dtls1_send_server_hello(s);
+                        if (ret <= 0) goto end;
+
+                        if (s->hit)
+                                s->state=SSL3_ST_SW_CHANGE_A;
+                        else
+                                s->state=SSL3_ST_SW_CERT_A;
+                        s->init_num=0;
+                        break;
+
+                case SSL3_ST_SW_CERT_A:
+                case SSL3_ST_SW_CERT_B:
+                        /* Check if it is anon DH */
+                        if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
+                                {
+                                ret=dtls1_send_server_certificate(s);
+                                if (ret <= 0) goto end;
+                                }
+                        else
+                                skip=1;
+                        s->state=SSL3_ST_SW_KEY_EXCH_A;
+                        s->init_num=0;
+                        break;
+
+                case SSL3_ST_SW_KEY_EXCH_A:
+                case SSL3_ST_SW_KEY_EXCH_B:
+                        l=s->s3->tmp.new_cipher->algorithms;
+
+                        /* clear this, it may get reset by
+                         * send_server_key_exchange */
+                        if ((s->options & SSL_OP_EPHEMERAL_RSA)
+#ifndef OPENSSL_NO_KRB5
+                                && !(l & SSL_KRB5)
+#endif /* OPENSSL_NO_KRB5 */
+                                )
+                                /* option SSL_OP_EPHEMERAL_RSA sends temporary RSA key
+                                 * even when forbidden by protocol specs
+                                 * (handshake may fail as clients are not required to
+                                 * be able to handle this) */
+                                s->s3->tmp.use_rsa_tmp=1;
+                        else
+                                s->s3->tmp.use_rsa_tmp=0;
+
+                        /* only send if a DH key exchange, fortezza or
+                         * RSA but we have a sign only certificate */
+                        if (s->s3->tmp.use_rsa_tmp
+                            || (l & (SSL_DH|SSL_kFZA))
+                            || ((l & SSL_kRSA)
+                                && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL
+                                    || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher)
+                                        && EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)
+                                        )
+                                    )
+                                )
+                            )
+                                {
+                                ret=dtls1_send_server_key_exchange(s);
+                                if (ret <= 0) goto end;
+                                }
+                        else
+                                skip=1;
+
+                        s->state=SSL3_ST_SW_CERT_REQ_A;
+                        s->init_num=0;
+                        break;
+
+                case SSL3_ST_SW_CERT_REQ_A:
+                case SSL3_ST_SW_CERT_REQ_B:
+                        if (/* don't request cert unless asked for it: */
+                                !(s->verify_mode & SSL_VERIFY_PEER) ||
+                                /* if SSL_VERIFY_CLIENT_ONCE is set,
+                                 * don't request cert during re-negotiation: */
+                                ((s->session->peer != NULL) &&
+                                 (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) ||
+                                /* never request cert in anonymous ciphersuites
+                                 * (see section "Certificate request" in SSL 3 drafts
+                                 * and in RFC 2246): */
+                                ((s->s3->tmp.new_cipher->algorithms & SSL_aNULL) &&
+                                 /* ... except when the application insists on verification
+                                  * (against the specs, but s3_clnt.c accepts this for SSL 3) */
+                                 !(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) ||
+                                 /* never request cert in Kerberos ciphersuites */
+                                (s->s3->tmp.new_cipher->algorithms & SSL_aKRB5))
+                                {
+                                /* no cert request */
+                                skip=1;
+                                s->s3->tmp.cert_request=0;
+                                s->state=SSL3_ST_SW_SRVR_DONE_A;
+                                }
+                        else
+                                {
+                                s->s3->tmp.cert_request=1;
+                                ret=dtls1_send_certificate_request(s);
+                                if (ret <= 0) goto end;
+#ifndef NETSCAPE_HANG_BUG
+                                s->state=SSL3_ST_SW_SRVR_DONE_A;
+#else
+                                s->state=SSL3_ST_SW_FLUSH;
+                                s->s3->tmp.next_state=SSL3_ST_SR_CERT_A;
+#endif
+                                s->init_num=0;
+                                }
+                        break;
+
+                case SSL3_ST_SW_SRVR_DONE_A:
+                case SSL3_ST_SW_SRVR_DONE_B:
+                        ret=dtls1_send_server_done(s);
+                        if (ret <= 0) goto end;
+                        s->s3->tmp.next_state=SSL3_ST_SR_CERT_A;
+                        s->state=SSL3_ST_SW_FLUSH;
+                        s->init_num=0;
+                        break;
+                
+                case SSL3_ST_SW_FLUSH:
+                        /* number of bytes to be flushed */
+                        num1=BIO_ctrl(s->wbio,BIO_CTRL_INFO,0,NULL);
+                        if (num1 > 0)
+                                {
+                                s->rwstate=SSL_WRITING;
+                                num1=BIO_flush(s->wbio);
+                                if (num1 <= 0) { ret= -1; goto end; }
+                                s->rwstate=SSL_NOTHING;
+                                }
+
+                        s->state=s->s3->tmp.next_state;
+                        break;
+
+                case SSL3_ST_SR_CERT_A:
+                case SSL3_ST_SR_CERT_B:
+                        /* Check for second client hello (MS SGC) */
+                        ret = ssl3_check_client_hello(s);
+                        if (ret <= 0)
+                                goto end;
+                        if (ret == 2)
+                                s->state = SSL3_ST_SR_CLNT_HELLO_C;
+                        else {
+                                /* could be sent for a DH cert, even if we
+                                 * have not asked for it :-) */
+                                ret=ssl3_get_client_certificate(s);
+                                if (ret <= 0) goto end;
+                                s->init_num=0;
+                                s->state=SSL3_ST_SR_KEY_EXCH_A;
+                        }
+                        break;
+
+                case SSL3_ST_SR_KEY_EXCH_A:
+                case SSL3_ST_SR_KEY_EXCH_B:
+                        ret=ssl3_get_client_key_exchange(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_SR_CERT_VRFY_A;
+                        s->init_num=0;
+
+                        /* We need to get hashes here so if there is
+                         * a client cert, it can be verified */ 
+                        s->method->ssl3_enc->cert_verify_mac(s,
+                                &(s->s3->finish_dgst1),
+                                &(s->s3->tmp.cert_verify_md[0]));
+                        s->method->ssl3_enc->cert_verify_mac(s,
+                                &(s->s3->finish_dgst2),
+                                &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]));
+
+                        break;
+
+                case SSL3_ST_SR_CERT_VRFY_A:
+                case SSL3_ST_SR_CERT_VRFY_B:
+
+                        /* we should decide if we expected this one */
+                        ret=ssl3_get_cert_verify(s);
+                        if (ret <= 0) goto end;
+
+                        s->state=SSL3_ST_SR_FINISHED_A;
+                        s->init_num=0;
+                        break;
+
+                case SSL3_ST_SR_FINISHED_A:
+                case SSL3_ST_SR_FINISHED_B:
+                        ret=ssl3_get_finished(s,SSL3_ST_SR_FINISHED_A,
+                                SSL3_ST_SR_FINISHED_B);
+                        if (ret <= 0) goto end;
+                        if (s->hit)
+                                s->state=SSL_ST_OK;
+                        else
+                                s->state=SSL3_ST_SW_CHANGE_A;
+                        s->init_num=0;
+                        break;
+
+                case SSL3_ST_SW_CHANGE_A:
+                case SSL3_ST_SW_CHANGE_B:
+
+                        s->session->cipher=s->s3->tmp.new_cipher;
+                        if (!s->method->ssl3_enc->setup_key_block(s))
+                                { ret= -1; goto end; }
+
+                        ret=dtls1_send_change_cipher_spec(s,
+                                SSL3_ST_SW_CHANGE_A,SSL3_ST_SW_CHANGE_B);
+
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_SW_FINISHED_A;
+                        s->init_num=0;
+
+                        if (!s->method->ssl3_enc->change_cipher_state(s,
+                                SSL3_CHANGE_CIPHER_SERVER_WRITE))
+                                {
+                                ret= -1;
+                                goto end;
+                                }
+
+                        dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
+                        break;
+
+                case SSL3_ST_SW_FINISHED_A:
+                case SSL3_ST_SW_FINISHED_B:
+                        ret=dtls1_send_finished(s,
+                                SSL3_ST_SW_FINISHED_A,SSL3_ST_SW_FINISHED_B,
+                                s->method->ssl3_enc->server_finished_label,
+                                s->method->ssl3_enc->server_finished_label_len);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_SW_FLUSH;
+                        if (s->hit)
+                                s->s3->tmp.next_state=SSL3_ST_SR_FINISHED_A;
+                        else
+                                s->s3->tmp.next_state=SSL_ST_OK;
+                        s->init_num=0;
+                        break;
+
+                case SSL_ST_OK:
+                        /* clean a few things up */
+                        ssl3_cleanup_key_block(s);
+
+#if 0
+                        BUF_MEM_free(s->init_buf);
+                        s->init_buf=NULL;
+#endif
+
+                        /* remove buffering on output */
+                        ssl_free_wbio_buffer(s);
+
+                        s->init_num=0;
+
+                        if (s->new_session == 2) /* skipped if we just sent a HelloRequest */
+                                {
+                                /* actually not necessarily a 'new' session unless
+                                 * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION is set */
+                                
+                                s->new_session=0;
+                                
+                                ssl_update_cache(s,SSL_SESS_CACHE_SERVER);
+                                
+                                s->ctx->stats.sess_accept_good++;
+                                /* s->server=1; */
+                                s->handshake_func=dtls1_accept;
+
+                                if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
+                                }
+                        
+                        ret = 1;
+
+                        /* done handshaking, next message is client hello */
+                        s->d1->handshake_read_seq = 0;
+                        /* next message is server hello */
+                        s->d1->handshake_write_seq = 0;
+                        goto end;
+                        /* break; */
+
+                default:
+                        SSLerr(SSL_F_DTLS1_ACCEPT,SSL_R_UNKNOWN_STATE);
+                        ret= -1;
+                        goto end;
+                        /* break; */
+                        }
+                
+                if (!s->s3->tmp.reuse_message && !skip)
+                        {
+                        if (s->debug)
+                                {
+                                if ((ret=BIO_flush(s->wbio)) <= 0)
+                                        goto end;
+                                }
+
+
+                        if ((cb != NULL) && (s->state != state))
+                                {
+                                new_state=s->state;
+                                s->state=state;
+                                cb(s,SSL_CB_ACCEPT_LOOP,1);
+                                s->state=new_state;
+                                }
+                        }
+                skip=0;
+                }
+end:
+        /* BIO_flush(s->wbio); */
+
+        s->in_handshake--;
+        if (cb != NULL)
+                cb(s,SSL_CB_ACCEPT_EXIT,ret);
+        return(ret);
+        }
+
+int dtls1_send_hello_request(SSL *s)
+        {
+        unsigned char *p;
+
+        if (s->state == SSL3_ST_SW_HELLO_REQ_A)
+                {
+                p=(unsigned char *)s->init_buf->data;
+                p = dtls1_set_message_header(s, p, SSL3_MT_HELLO_REQUEST, 0, 0, 0);
+
+                s->state=SSL3_ST_SW_HELLO_REQ_B;
+                /* number of bytes to write */
+                s->init_num=DTLS1_HM_HEADER_LENGTH;
+                s->init_off=0;
+
+                /* no need to buffer this message, since there are no retransmit 
+                 * requests for it */
+                }
+
+        /* SSL3_ST_SW_HELLO_REQ_B */
+        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+        }
+
+int dtls1_send_hello_verify_request(SSL *s)
+        {
+        unsigned int msg_len;
+        unsigned char *msg, *buf, *p;
+
+        if (s->state == DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A)
+                {
+                buf = (unsigned char *)s->init_buf->data;
+
+                msg = p = &(buf[DTLS1_HM_HEADER_LENGTH]);
+                if (s->client_version == DTLS1_BAD_VER)
+                        *(p++) = DTLS1_BAD_VER>>8,
+                        *(p++) = DTLS1_BAD_VER&0xff;
+                else
+                        *(p++) = s->version >> 8,
+                        *(p++) = s->version & 0xFF;
+
+                if (s->ctx->app_gen_cookie_cb != NULL &&
+                    s->ctx->app_gen_cookie_cb(s, s->d1->cookie, 
+                    &(s->d1->cookie_len)) == 0)
+                        {
+                        SSLerr(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST,ERR_R_INTERNAL_ERROR);
+                        return 0;
+                        }
+                /* else the cookie is assumed to have 
+                 * been initialized by the application */
+
+                *(p++) = (unsigned char) s->d1->cookie_len;
+                memcpy(p, s->d1->cookie, s->d1->cookie_len);
+                p += s->d1->cookie_len;
+                msg_len = p - msg;
+
+                dtls1_set_message_header(s, buf,
+                        DTLS1_MT_HELLO_VERIFY_REQUEST, msg_len, 0, msg_len);
+
+                s->state=DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B;
+                /* number of bytes to write */
+                s->init_num=p-buf;
+                s->init_off=0;
+
+                /* buffer the message to handle re-xmits */
+                dtls1_buffer_message(s, 0);
+                }
+
+        /* s->state = DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B */
+        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+        }
+
+int dtls1_send_server_hello(SSL *s)
+        {
+        unsigned char *buf;
+        unsigned char *p,*d;
+        int i;
+        unsigned int sl;
+        unsigned long l,Time;
+
+        if (s->state == SSL3_ST_SW_SRVR_HELLO_A)
+                {
+                buf=(unsigned char *)s->init_buf->data;
+                p=s->s3->server_random;
+                Time=(unsigned long)time(NULL);                 /* Time */
+                l2n(Time,p);
+                RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
+                /* Do the message type and length last */
+                d=p= &(buf[DTLS1_HM_HEADER_LENGTH]);
+
+                if (s->client_version == DTLS1_BAD_VER)
+                        *(p++)=DTLS1_BAD_VER>>8,
+                        *(p++)=DTLS1_BAD_VER&0xff;
+                else
+                        *(p++)=s->version>>8,
+                        *(p++)=s->version&0xff;
+
+                /* Random stuff */
+                memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE);
+                p+=SSL3_RANDOM_SIZE;
+
+                /* now in theory we have 3 options to sending back the
+                 * session id.  If it is a re-use, we send back the
+                 * old session-id, if it is a new session, we send
+                 * back the new session-id or we send back a 0 length
+                 * session-id if we want it to be single use.
+                 * Currently I will not implement the '0' length session-id
+                 * 12-Jan-98 - I'll now support the '0' length stuff.
+                 */
+                if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER))
+                        s->session->session_id_length=0;
+
+                sl=s->session->session_id_length;
+                if (sl > sizeof s->session->session_id)
+                        {
+                        SSLerr(SSL_F_DTLS1_SEND_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
+                        return -1;
+                        }
+                *(p++)=sl;
+                memcpy(p,s->session->session_id,sl);
+                p+=sl;
+
+                /* put the cipher */
+                i=ssl3_put_cipher_by_char(s->s3->tmp.new_cipher,p);
+                p+=i;
+
+                /* put the compression method */
+#ifdef OPENSSL_NO_COMP
+                *(p++)=0;
+#else
+                if (s->s3->tmp.new_compression == NULL)
+                        *(p++)=0;
+                else
+                        *(p++)=s->s3->tmp.new_compression->id;
+#endif
+
+                /* do the header */
+                l=(p-d);
+                d=buf;
+
+                d = dtls1_set_message_header(s, d, SSL3_MT_SERVER_HELLO, l, 0, l);
+
+                s->state=SSL3_ST_CW_CLNT_HELLO_B;
+                /* number of bytes to write */
+                s->init_num=p-buf;
+                s->init_off=0;
+
+                /* buffer the message to handle re-xmits */
+                dtls1_buffer_message(s, 0);
+                }
+
+        /* SSL3_ST_CW_CLNT_HELLO_B */
+        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+        }
+
+int dtls1_send_server_done(SSL *s)
+        {
+        unsigned char *p;
+
+        if (s->state == SSL3_ST_SW_SRVR_DONE_A)
+                {
+                p=(unsigned char *)s->init_buf->data;
+
+                /* do the header */
+                p = dtls1_set_message_header(s, p, SSL3_MT_SERVER_DONE, 0, 0, 0);
+
+                s->state=SSL3_ST_SW_SRVR_DONE_B;
+                /* number of bytes to write */
+                s->init_num=DTLS1_HM_HEADER_LENGTH;
+                s->init_off=0;
+
+                /* buffer the message to handle re-xmits */
+                dtls1_buffer_message(s, 0);
+                }
+
+        /* SSL3_ST_CW_CLNT_HELLO_B */
+        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+        }
+
+int dtls1_send_server_key_exchange(SSL *s)
+        {
+#ifndef OPENSSL_NO_RSA
+        unsigned char *q;
+        int j,num;
+        RSA *rsa;
+        unsigned char md_buf[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
+        unsigned int u;
+#endif
+#ifndef OPENSSL_NO_DH
+        DH *dh=NULL,*dhp;
+#endif
+        EVP_PKEY *pkey;
+        unsigned char *p,*d;
+        int al,i;
+        unsigned long type;
+        int n;
+        CERT *cert;
+        BIGNUM *r[4];
+        int nr[4],kn;
+        BUF_MEM *buf;
+        EVP_MD_CTX md_ctx;
+
+        EVP_MD_CTX_init(&md_ctx);
+        if (s->state == SSL3_ST_SW_KEY_EXCH_A)
+                {
+                type=s->s3->tmp.new_cipher->algorithms & SSL_MKEY_MASK;
+                cert=s->cert;
+
+                buf=s->init_buf;
+
+                r[0]=r[1]=r[2]=r[3]=NULL;
+                n=0;
+#ifndef OPENSSL_NO_RSA
+                if (type & SSL_kRSA)
+                        {
+                        rsa=cert->rsa_tmp;
+                        if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL))
+                                {
+                                rsa=s->cert->rsa_tmp_cb(s,
+                                      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
+                                      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
+                                if(rsa == NULL)
+                                {
+                                        al=SSL_AD_HANDSHAKE_FAILURE;
+                                        SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,SSL_R_ERROR_GENERATING_TMP_RSA_KEY);
+                                        goto f_err;
+                                }
+                                RSA_up_ref(rsa);
+                                cert->rsa_tmp=rsa;
+                                }
+                        if (rsa == NULL)
+                                {
+                                al=SSL_AD_HANDSHAKE_FAILURE;
+                                SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_RSA_KEY);
+                                goto f_err;
+                                }
+                        r[0]=rsa->n;
+                        r[1]=rsa->e;
+                        s->s3->tmp.use_rsa_tmp=1;
+                        }
+                else
+#endif
+#ifndef OPENSSL_NO_DH
+                        if (type & SSL_kEDH)
+                        {
+                        dhp=cert->dh_tmp;
+                        if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
+                                dhp=s->cert->dh_tmp_cb(s,
+                                      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
+                                      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
+                        if (dhp == NULL)
+                                {
+                                al=SSL_AD_HANDSHAKE_FAILURE;
+                                SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);
+                                goto f_err;
+                                }
+
+                        if (s->s3->tmp.dh != NULL)
+                                {
+                                DH_free(dh);
+                                SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+
+                        if ((dh=DHparams_dup(dhp)) == NULL)
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
+                                goto err;
+                                }
+
+                        s->s3->tmp.dh=dh;
+                        if ((dhp->pub_key == NULL ||
+                             dhp->priv_key == NULL ||
+                             (s->options & SSL_OP_SINGLE_DH_USE)))
+                                {
+                                if(!DH_generate_key(dh))
+                                    {
+                                    SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,
+                                           ERR_R_DH_LIB);
+                                    goto err;
+                                    }
+                                }
+                        else
+                                {
+                                dh->pub_key=BN_dup(dhp->pub_key);
+                                dh->priv_key=BN_dup(dhp->priv_key);
+                                if ((dh->pub_key == NULL) ||
+                                        (dh->priv_key == NULL))
+                                        {
+                                        SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
+                                        goto err;
+                                        }
+                                }
+                        r[0]=dh->p;
+                        r[1]=dh->g;
+                        r[2]=dh->pub_key;
+                        }
+                else 
+#endif
+                        {
+                        al=SSL_AD_HANDSHAKE_FAILURE;
+                        SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
+                        goto f_err;
+                        }
+                for (i=0; r[i] != NULL; i++)
+                        {
+                        nr[i]=BN_num_bytes(r[i]);
+                        n+=2+nr[i];
+                        }
+
+                if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
+                        {
+                        if ((pkey=ssl_get_sign_pkey(s,s->s3->tmp.new_cipher))
+                                == NULL)
+                                {
+                                al=SSL_AD_DECODE_ERROR;
+                                goto f_err;
+                                }
+                        kn=EVP_PKEY_size(pkey);
+                        }
+                else
+                        {
+                        pkey=NULL;
+                        kn=0;
+                        }
+
+                if (!BUF_MEM_grow_clean(buf,n+DTLS1_HM_HEADER_LENGTH+kn))
+                        {
+                        SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_BUF);
+                        goto err;
+                        }
+                d=(unsigned char *)s->init_buf->data;
+                p= &(d[DTLS1_HM_HEADER_LENGTH]);
+
+                for (i=0; r[i] != NULL; i++)
+                        {
+                        s2n(nr[i],p);
+                        BN_bn2bin(r[i],p);
+                        p+=nr[i];
+                        }
+
+                /* not anonymous */
+                if (pkey != NULL)
+                        {
+                        /* n is the length of the params, they start at
+                         * &(d[DTLS1_HM_HEADER_LENGTH]) and p points to the space
+                         * at the end. */
+#ifndef OPENSSL_NO_RSA
+                        if (pkey->type == EVP_PKEY_RSA)
+                                {
+                                q=md_buf;
+                                j=0;
+                                for (num=2; num > 0; num--)
+                                        {
+                                        EVP_DigestInit_ex(&md_ctx,(num == 2)
+                                                ?s->ctx->md5:s->ctx->sha1, NULL);
+                                        EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
+                                        EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
+                                        EVP_DigestUpdate(&md_ctx,&(d[DTLS1_HM_HEADER_LENGTH]),n);
+                                        EVP_DigestFinal_ex(&md_ctx,q,
+                                                (unsigned int *)&i);
+                                        q+=i;
+                                        j+=i;
+                                        }
+                                if (RSA_sign(NID_md5_sha1, md_buf, j,
+                                        &(p[2]), &u, pkey->pkey.rsa) <= 0)
+                                        {
+                                        SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_RSA);
+                                        goto err;
+                                        }
+                                s2n(u,p);
+                                n+=u+2;
+                                }
+                        else
+#endif
+#if !defined(OPENSSL_NO_DSA)
+                                if (pkey->type == EVP_PKEY_DSA)
+                                {
+                                /* lets do DSS */
+                                EVP_SignInit_ex(&md_ctx,EVP_dss1(), NULL);
+                                EVP_SignUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
+                                EVP_SignUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
+                                EVP_SignUpdate(&md_ctx,&(d[DTLS1_HM_HEADER_LENGTH]),n);
+                                if (!EVP_SignFinal(&md_ctx,&(p[2]),
+                                        (unsigned int *)&i,pkey))
+                                        {
+                                        SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_DSA);
+                                        goto err;
+                                        }
+                                s2n(i,p);
+                                n+=i+2;
+                                }
+                        else
+#endif
+                                {
+                                /* Is this error check actually needed? */
+                                al=SSL_AD_HANDSHAKE_FAILURE;
+                                SSLerr(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_PKEY_TYPE);
+                                goto f_err;
+                                }
+                        }
+
+                d = dtls1_set_message_header(s, d,
+                        SSL3_MT_SERVER_KEY_EXCHANGE, n, 0, n);
+
+                /* we should now have things packed up, so lets send
+                 * it off */
+                s->init_num=n+DTLS1_HM_HEADER_LENGTH;
+                s->init_off=0;
+
+                /* buffer the message to handle re-xmits */
+                dtls1_buffer_message(s, 0);
+                }
+
+        s->state = SSL3_ST_SW_KEY_EXCH_B;
+        EVP_MD_CTX_cleanup(&md_ctx);
+        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+f_err:
+        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+err:
+        EVP_MD_CTX_cleanup(&md_ctx);
+        return(-1);
+        }
+
+int dtls1_send_certificate_request(SSL *s)
+        {
+        unsigned char *p,*d;
+        int i,j,nl,off,n;
+        STACK_OF(X509_NAME) *sk=NULL;
+        X509_NAME *name;
+        BUF_MEM *buf;
+        unsigned int msg_len;
+
+        if (s->state == SSL3_ST_SW_CERT_REQ_A)
+                {
+                buf=s->init_buf;
+
+                d=p=(unsigned char *)&(buf->data[DTLS1_HM_HEADER_LENGTH]);
+
+                /* get the list of acceptable cert types */
+                p++;
+                n=ssl3_get_req_cert_type(s,p);
+                d[0]=n;
+                p+=n;
+                n++;
+
+                off=n;
+                p+=2;
+                n+=2;
+
+                sk=SSL_get_client_CA_list(s);
+                nl=0;
+                if (sk != NULL)
+                        {
+                        for (i=0; i<sk_X509_NAME_num(sk); i++)
+                                {
+                                name=sk_X509_NAME_value(sk,i);
+                                j=i2d_X509_NAME(name,NULL);
+                                if (!BUF_MEM_grow_clean(buf,DTLS1_HM_HEADER_LENGTH+n+j+2))
+                                        {
+                                        SSLerr(SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST,ERR_R_BUF_LIB);
+                                        goto err;
+                                        }
+                                p=(unsigned char *)&(buf->data[DTLS1_HM_HEADER_LENGTH+n]);
+                                if (!(s->options & SSL_OP_NETSCAPE_CA_DN_BUG))
+                                        {
+                                        s2n(j,p);
+                                        i2d_X509_NAME(name,&p);
+                                        n+=2+j;
+                                        nl+=2+j;
+                                        }
+                                else
+                                        {
+                                        d=p;
+                                        i2d_X509_NAME(name,&p);
+                                        j-=2; s2n(j,d); j+=2;
+                                        n+=j;
+                                        nl+=j;
+                                        }
+                                }
+                        }
+                /* else no CA names */
+                p=(unsigned char *)&(buf->data[DTLS1_HM_HEADER_LENGTH+off]);
+                s2n(nl,p);
+
+                d=(unsigned char *)buf->data;
+                *(d++)=SSL3_MT_CERTIFICATE_REQUEST;
+                l2n3(n,d);
+                s2n(s->d1->handshake_write_seq,d);
+                s->d1->handshake_write_seq++;
+
+                /* we should now have things packed up, so lets send
+                 * it off */
+
+                s->init_num=n+DTLS1_HM_HEADER_LENGTH;
+                s->init_off=0;
+#ifdef NETSCAPE_HANG_BUG
+/* XXX: what to do about this? */
+                p=(unsigned char *)s->init_buf->data + s->init_num;
+
+                /* do the header */
+                *(p++)=SSL3_MT_SERVER_DONE;
+                *(p++)=0;
+                *(p++)=0;
+                *(p++)=0;
+                s->init_num += 4;
+#endif
+
+                /* XDTLS:  set message header ? */
+                msg_len = s->init_num - DTLS1_HM_HEADER_LENGTH;
+                dtls1_set_message_header(s, (void *)s->init_buf->data,
+                        SSL3_MT_CERTIFICATE_REQUEST, msg_len, 0, msg_len);
+
+                /* buffer the message to handle re-xmits */
+                dtls1_buffer_message(s, 0);
+
+                s->state = SSL3_ST_SW_CERT_REQ_B;
+                }
+
+        /* SSL3_ST_SW_CERT_REQ_B */
+        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+err:
+        return(-1);
+        }
+
+int dtls1_send_server_certificate(SSL *s)
+        {
+        unsigned long l;
+        X509 *x;
+
+        if (s->state == SSL3_ST_SW_CERT_A)
+                {
+                x=ssl_get_server_send_cert(s);
+                if (x == NULL &&
+                        /* VRS: allow null cert if auth == KRB5 */
+                        (s->s3->tmp.new_cipher->algorithms
+                                & (SSL_MKEY_MASK|SSL_AUTH_MASK))
+                        != (SSL_aKRB5|SSL_kKRB5))
+                        {
+                        SSLerr(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE,ERR_R_INTERNAL_ERROR);
+                        return(0);
+                        }
+
+                l=dtls1_output_cert_chain(s,x);
+                s->state=SSL3_ST_SW_CERT_B;
+                s->init_num=(int)l;
+                s->init_off=0;
+
+                /* buffer the message to handle re-xmits */
+                dtls1_buffer_message(s, 0);
+                }
+
+        /* SSL3_ST_SW_CERT_B */
+        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+        }
diff --git a/src/lib/libssl/src/ssl/dtls1.h b/src/lib/libssl/src/ssl/dtls1.h
new file mode 100644
index 0000000000..a663cf85f2
--- /dev/null
+++ b/src/lib/libssl/src/ssl/dtls1.h
@@ -0,0 +1,211 @@
+/* ssl/dtls1.h */
+/* 
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_DTLS1_H 
+#define HEADER_DTLS1_H 
+
+#include <openssl/buffer.h>
+#include <openssl/pqueue.h>
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+#define DTLS1_VERSION                   0xFEFF
+#define DTLS1_BAD_VER                   0x0100
+
+#define DTLS1_AD_MISSING_HANDSHAKE_MESSAGE    110
+
+/* lengths of messages */
+#define DTLS1_COOKIE_LENGTH                     32
+
+#define DTLS1_RT_HEADER_LENGTH                  13
+
+#define DTLS1_HM_HEADER_LENGTH                  12
+
+#define DTLS1_HM_BAD_FRAGMENT                   -2
+#define DTLS1_HM_FRAGMENT_RETRY                 -3
+
+#define DTLS1_CCS_HEADER_LENGTH                  1
+
+#define DTLS1_AL_HEADER_LENGTH                   7
+
+
+typedef struct dtls1_bitmap_st
+        {
+        PQ_64BIT map;
+        unsigned long length;     /* sizeof the bitmap in bits */
+        PQ_64BIT max_seq_num;  /* max record number seen so far */
+        } DTLS1_BITMAP;
+
+struct hm_header_st
+        {
+        unsigned char type;
+        unsigned long msg_len;
+        unsigned short seq;
+        unsigned long frag_off;
+        unsigned long frag_len;
+        unsigned int is_ccs;
+        };
+
+struct ccs_header_st
+        {
+        unsigned char type;
+        unsigned short seq;
+        };
+
+struct dtls1_timeout_st
+        {
+        /* Number of read timeouts so far */
+        unsigned int read_timeouts;
+        
+        /* Number of write timeouts so far */
+        unsigned int write_timeouts;
+        
+        /* Number of alerts received so far */
+        unsigned int num_alerts;
+        };
+
+typedef struct record_pqueue_st
+        {
+        unsigned short epoch;
+        pqueue q;
+        } record_pqueue;
+
+typedef struct hm_fragment_st
+        {
+        struct hm_header_st msg_header;
+        unsigned char *fragment;
+        } hm_fragment;
+
+typedef struct dtls1_state_st
+        {
+        unsigned int send_cookie;
+        unsigned char cookie[DTLS1_COOKIE_LENGTH];
+        unsigned char rcvd_cookie[DTLS1_COOKIE_LENGTH];
+        unsigned int cookie_len;
+
+        /* 
+         * The current data and handshake epoch.  This is initially
+         * undefined, and starts at zero once the initial handshake is
+         * completed 
+         */
+        unsigned short r_epoch;
+        unsigned short w_epoch;
+
+        /* records being received in the current epoch */
+        DTLS1_BITMAP bitmap;
+
+        /* renegotiation starts a new set of sequence numbers */
+        DTLS1_BITMAP next_bitmap;
+
+        /* handshake message numbers */
+        unsigned short handshake_write_seq;
+        unsigned short next_handshake_write_seq;
+
+        unsigned short handshake_read_seq;
+
+        /* Received handshake records (processed and unprocessed) */
+        record_pqueue unprocessed_rcds;
+        record_pqueue processed_rcds;
+
+        /* Buffered handshake messages */
+        pqueue buffered_messages;
+
+        /* Buffered (sent) handshake records */
+        pqueue sent_messages;
+
+        unsigned int mtu; /* max wire packet size */
+
+        struct hm_header_st w_msg_hdr;
+        struct hm_header_st r_msg_hdr;
+
+        struct dtls1_timeout_st timeout;
+        
+        /* storage for Alert/Handshake protocol data received but not
+         * yet processed by ssl3_read_bytes: */
+        unsigned char alert_fragment[DTLS1_AL_HEADER_LENGTH];
+        unsigned int alert_fragment_len;
+        unsigned char handshake_fragment[DTLS1_HM_HEADER_LENGTH];
+        unsigned int handshake_fragment_len;
+
+        unsigned int retransmitting;
+
+        } DTLS1_STATE;
+
+typedef struct dtls1_record_data_st
+        {
+        unsigned char *packet;
+        unsigned int   packet_length;
+        SSL3_BUFFER    rbuf;
+        SSL3_RECORD    rrec;
+        } DTLS1_RECORD_DATA;
+
+
+/* Timeout multipliers (timeout slice is defined in apps/timeouts.h */
+#define DTLS1_TMO_READ_COUNT                      2
+#define DTLS1_TMO_WRITE_COUNT                     2
+
+#define DTLS1_TMO_ALERT_COUNT                     12
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
+
diff --git a/src/lib/libssl/src/test/cms-examples.pl b/src/lib/libssl/src/test/cms-examples.pl
new file mode 100644
index 0000000000..2e95b48ba4
--- /dev/null
+++ b/src/lib/libssl/src/test/cms-examples.pl
@@ -0,0 +1,409 @@
+# test/cms-examples.pl
+# Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+# project.
+#
+# ====================================================================
+# Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+#
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in
+#    the documentation and/or other materials provided with the
+#    distribution.
+#
+# 3. All advertising materials mentioning features or use of this
+#    software must display the following acknowledgment:
+#    "This product includes software developed by the OpenSSL Project
+#    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+#
+# 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+#    endorse or promote products derived from this software without
+#    prior written permission. For written permission, please contact
+#    licensing@OpenSSL.org.
+#
+# 5. Products derived from this software may not be called "OpenSSL"
+#    nor may "OpenSSL" appear in their names without prior written
+#    permission of the OpenSSL Project.
+#
+# 6. Redistributions of any form whatsoever must retain the following
+#    acknowledgment:
+#    "This product includes software developed by the OpenSSL Project
+#    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+#
+# THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+# EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+# ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
+# ====================================================================
+
+# Perl script to run tests against S/MIME examples in RFC4134
+# Assumes RFC is in current directory and called "rfc4134.txt"
+
+use MIME::Base64;
+
+my $badttest = 0;
+my $verbose  = 1;
+
+my $cmscmd;
+my $exdir  = "./";
+my $exfile = "./rfc4134.txt";
+
+if (-f "../apps/openssl")
+        {
+        $cmscmd = "../util/shlib_wrap.sh ../apps/openssl cms";
+        }
+elsif (-f "..\\out32dll\\openssl.exe")
+        {
+        $cmscmd = "..\\out32dll\\openssl.exe cms";
+        }
+elsif (-f "..\\out32\\openssl.exe")
+        {
+        $cmscmd = "..\\out32\\openssl.exe cms";
+        }
+
+my @test_list = (
+    [ "3.1.bin"  => "dataout" ],
+    [ "3.2.bin"  => "encode, dataout" ],
+    [ "4.1.bin"  => "encode, verifyder, cont, dss" ],
+    [ "4.2.bin"  => "encode, verifyder, cont, rsa" ],
+    [ "4.3.bin"  => "encode, verifyder, cont_extern, dss" ],
+    [ "4.4.bin"  => "encode, verifyder, cont, dss" ],
+    [ "4.5.bin"  => "verifyder, cont, rsa" ],
+    [ "4.6.bin"  => "encode, verifyder, cont, dss" ],
+    [ "4.7.bin"  => "encode, verifyder, cont, dss" ],
+    [ "4.8.eml"  => "verifymime, dss" ],
+    [ "4.9.eml"  => "verifymime, dss" ],
+    [ "4.10.bin" => "encode, verifyder, cont, dss" ],
+    [ "4.11.bin" => "encode, certsout" ],
+    [ "5.1.bin"  => "encode, envelopeder, cont" ],
+    [ "5.2.bin"  => "encode, envelopeder, cont" ],
+    [ "5.3.eml"  => "envelopemime, cont" ],
+    [ "6.0.bin"  => "encode, digest, cont" ],
+    [ "7.1.bin"  => "encode, encrypted, cont" ],
+    [ "7.2.bin"  => "encode, encrypted, cont" ]
+);
+
+# Extract examples from RFC4134 text.
+# Base64 decode all examples, certificates and
+# private keys are converted to PEM format.
+
+my ( $filename, $data );
+
+my @cleanup = ( "cms.out", "cms.err", "tmp.der", "tmp.txt" );
+
+$data = "";
+
+open( IN, $exfile ) || die "Can't Open RFC examples file $exfile";
+
+while (<IN>) {
+    next unless (/^\|/);
+    s/^\|//;
+    next if (/^\*/);
+    if (/^>(.*)$/) {
+        $filename = $1;
+        next;
+    }
+    if (/^</) {
+        $filename = "$exdir/$filename";
+        if ( $filename =~ /\.bin$/ || $filename =~ /\.eml$/ ) {
+            $data = decode_base64($data);
+            open OUT, ">$filename";
+            binmode OUT;
+            print OUT $data;
+            close OUT;
+            push @cleanup, $filename;
+        }
+        elsif ( $filename =~ /\.cer$/ ) {
+            write_pem( $filename, "CERTIFICATE", $data );
+        }
+        elsif ( $filename =~ /\.pri$/ ) {
+            write_pem( $filename, "PRIVATE KEY", $data );
+        }
+        $data     = "";
+        $filename = "";
+    }
+    else {
+        $data .= $_;
+    }
+
+}
+
+my $secretkey =
+  "73:7c:79:1f:25:ea:d0:e0:46:29:25:43:52:f7:dc:62:91:e5:cb:26:91:7a:da:32";
+
+foreach (@test_list) {
+    my ( $file, $tlist ) = @$_;
+    print "Example file $file:\n";
+    if ( $tlist =~ /encode/ ) {
+        run_reencode_test( $exdir, $file );
+    }
+    if ( $tlist =~ /certsout/ ) {
+        run_certsout_test( $exdir, $file );
+    }
+    if ( $tlist =~ /dataout/ ) {
+        run_dataout_test( $exdir, $file );
+    }
+    if ( $tlist =~ /verify/ ) {
+        run_verify_test( $exdir, $tlist, $file );
+    }
+    if ( $tlist =~ /digest/ ) {
+        run_digest_test( $exdir, $tlist, $file );
+    }
+    if ( $tlist =~ /encrypted/ ) {
+        run_encrypted_test( $exdir, $tlist, $file, $secretkey );
+    }
+    if ( $tlist =~ /envelope/ ) {
+        run_envelope_test( $exdir, $tlist, $file );
+    }
+
+}
+
+foreach (@cleanup) {
+    unlink $_;
+}
+
+if ($badtest) {
+    print "\n$badtest TESTS FAILED!!\n";
+}
+else {
+    print "\n***All tests successful***\n";
+}
+
+sub write_pem {
+    my ( $filename, $str, $data ) = @_;
+
+    $filename =~ s/\.[^.]*$/.pem/;
+
+    push @cleanup, $filename;
+
+    open OUT, ">$filename";
+
+    print OUT "-----BEGIN $str-----\n";
+    print OUT $data;
+    print OUT "-----END $str-----\n";
+
+    close OUT;
+}
+
+sub run_reencode_test {
+    my ( $cmsdir, $tfile ) = @_;
+    unlink "tmp.der";
+
+    system( "$cmscmd -cmsout -inform DER -outform DER"
+          . " -in $cmsdir/$tfile -out tmp.der" );
+
+    if ($?) {
+        print "\tReencode command FAILED!!\n";
+        $badtest++;
+    }
+    elsif ( !cmp_files( "$cmsdir/$tfile", "tmp.der" ) ) {
+        print "\tReencode FAILED!!\n";
+        $badtest++;
+    }
+    else {
+        print "\tReencode passed\n" if $verbose;
+    }
+}
+
+sub run_certsout_test {
+    my ( $cmsdir, $tfile ) = @_;
+    unlink "tmp.der";
+    unlink "tmp.pem";
+
+    system( "$cmscmd -cmsout -inform DER -certsout tmp.pem"
+          . " -in $cmsdir/$tfile -out tmp.der" );
+
+    if ($?) {
+        print "\tCertificate output command FAILED!!\n";
+        $badtest++;
+    }
+    else {
+        print "\tCertificate output passed\n" if $verbose;
+    }
+}
+
+sub run_dataout_test {
+    my ( $cmsdir, $tfile ) = @_;
+    unlink "tmp.txt";
+
+    system(
+        "$cmscmd -data_out -inform DER" . " -in $cmsdir/$tfile -out tmp.txt" );
+
+    if ($?) {
+        print "\tDataout command FAILED!!\n";
+        $badtest++;
+    }
+    elsif ( !cmp_files( "$cmsdir/ExContent.bin", "tmp.txt" ) ) {
+        print "\tDataout compare FAILED!!\n";
+        $badtest++;
+    }
+    else {
+        print "\tDataout passed\n" if $verbose;
+    }
+}
+
+sub run_verify_test {
+    my ( $cmsdir, $tlist, $tfile ) = @_;
+    unlink "tmp.txt";
+
+    $form   = "DER"                     if $tlist =~ /verifyder/;
+    $form   = "SMIME"                   if $tlist =~ /verifymime/;
+    $cafile = "$cmsdir/CarlDSSSelf.pem" if $tlist =~ /dss/;
+    $cafile = "$cmsdir/CarlRSASelf.pem" if $tlist =~ /rsa/;
+
+    $cmd =
+        "$cmscmd -verify -inform $form"
+      . " -CAfile $cafile"
+      . " -in $cmsdir/$tfile -out tmp.txt";
+
+    $cmd .= " -content $cmsdir/ExContent.bin" if $tlist =~ /cont_extern/;
+
+    system("$cmd 2>cms.err 1>cms.out");
+
+    if ($?) {
+        print "\tVerify command FAILED!!\n";
+        $badtest++;
+    }
+    elsif ( $tlist =~ /cont/
+        && !cmp_files( "$cmsdir/ExContent.bin", "tmp.txt" ) )
+    {
+        print "\tVerify content compare FAILED!!\n";
+        $badtest++;
+    }
+    else {
+        print "\tVerify passed\n" if $verbose;
+    }
+}
+
+sub run_envelope_test {
+    my ( $cmsdir, $tlist, $tfile ) = @_;
+    unlink "tmp.txt";
+
+    $form = "DER"   if $tlist =~ /envelopeder/;
+    $form = "SMIME" if $tlist =~ /envelopemime/;
+
+    $cmd =
+        "$cmscmd -decrypt -inform $form"
+      . " -recip $cmsdir/BobRSASignByCarl.pem"
+      . " -inkey $cmsdir/BobPrivRSAEncrypt.pem"
+      . " -in $cmsdir/$tfile -out tmp.txt";
+
+    system("$cmd 2>cms.err 1>cms.out");
+
+    if ($?) {
+        print "\tDecrypt command FAILED!!\n";
+        $badtest++;
+    }
+    elsif ( $tlist =~ /cont/
+        && !cmp_files( "$cmsdir/ExContent.bin", "tmp.txt" ) )
+    {
+        print "\tDecrypt content compare FAILED!!\n";
+        $badtest++;
+    }
+    else {
+        print "\tDecrypt passed\n" if $verbose;
+    }
+}
+
+sub run_digest_test {
+    my ( $cmsdir, $tlist, $tfile ) = @_;
+    unlink "tmp.txt";
+
+    my $cmd =
+      "$cmscmd -digest_verify -inform DER" . " -in $cmsdir/$tfile -out tmp.txt";
+
+    system("$cmd 2>cms.err 1>cms.out");
+
+    if ($?) {
+        print "\tDigest verify command FAILED!!\n";
+        $badtest++;
+    }
+    elsif ( $tlist =~ /cont/
+        && !cmp_files( "$cmsdir/ExContent.bin", "tmp.txt" ) )
+    {
+        print "\tDigest verify content compare FAILED!!\n";
+        $badtest++;
+    }
+    else {
+        print "\tDigest verify passed\n" if $verbose;
+    }
+}
+
+sub run_encrypted_test {
+    my ( $cmsdir, $tlist, $tfile, $key ) = @_;
+    unlink "tmp.txt";
+
+    system( "$cmscmd -EncryptedData_decrypt -inform DER"
+          . " -secretkey $key"
+          . " -in $cmsdir/$tfile -out tmp.txt" );
+
+    if ($?) {
+        print "\tEncrypted Data command FAILED!!\n";
+        $badtest++;
+    }
+    elsif ( $tlist =~ /cont/
+        && !cmp_files( "$cmsdir/ExContent.bin", "tmp.txt" ) )
+    {
+        print "\tEncrypted Data content compare FAILED!!\n";
+        $badtest++;
+    }
+    else {
+        print "\tEncryptedData verify passed\n" if $verbose;
+    }
+}
+
+sub cmp_files {
+    my ( $f1, $f2 ) = @_;
+    my ( $fp1, $fp2 );
+
+    my ( $rd1, $rd2 );
+
+    if ( !open( $fp1, "<$f1" ) ) {
+        print STDERR "Can't Open file $f1\n";
+        return 0;
+    }
+
+    if ( !open( $fp2, "<$f2" ) ) {
+        print STDERR "Can't Open file $f2\n";
+        return 0;
+    }
+
+    binmode $fp1;
+    binmode $fp2;
+
+    my $ret = 0;
+
+    for ( ; ; ) {
+        $n1 = sysread $fp1, $rd1, 4096;
+        $n2 = sysread $fp2, $rd2, 4096;
+        last if ( $n1 != $n2 );
+        last if ( $rd1 ne $rd2 );
+
+        if ( $n1 == 0 ) {
+            $ret = 1;
+            last;
+        }
+
+    }
+
+    close $fp1;
+    close $fp2;
+
+    return $ret;
+
+}
+
diff --git a/src/lib/libssl/src/test/cms-test.pl b/src/lib/libssl/src/test/cms-test.pl
new file mode 100644
index 0000000000..a84e089ddc
--- /dev/null
+++ b/src/lib/libssl/src/test/cms-test.pl
@@ -0,0 +1,453 @@
+# test/cms-test.pl
+# Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+# project.
+#
+# ====================================================================
+# Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+#
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in
+#    the documentation and/or other materials provided with the
+#    distribution.
+#
+# 3. All advertising materials mentioning features or use of this
+#    software must display the following acknowledgment:
+#    "This product includes software developed by the OpenSSL Project
+#    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+#
+# 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+#    endorse or promote products derived from this software without
+#    prior written permission. For written permission, please contact
+#    licensing@OpenSSL.org.
+#
+# 5. Products derived from this software may not be called "OpenSSL"
+#    nor may "OpenSSL" appear in their names without prior written
+#    permission of the OpenSSL Project.
+#
+# 6. Redistributions of any form whatsoever must retain the following
+#    acknowledgment:
+#    "This product includes software developed by the OpenSSL Project
+#    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+#
+# THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+# EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+# ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+# OF THE POSSIBILITY OF SUCH DAMAGE.
+# ====================================================================
+
+# CMS, PKCS7 consistency test script. Run extensive tests on
+# OpenSSL PKCS#7 and CMS implementations.
+
+my $ossl_path;
+
+if ( -f "../apps/openssl" ) {
+    $ossl_path = "../util/shlib_wrap.sh ../apps/openssl";
+}
+elsif ( -f "..\\out32dll\\openssl.exe" ) {
+    $ossl_path = "..\\out32dll\\openssl.exe";
+}
+elsif ( -f "..\\out32\\openssl.exe" ) {
+    $ossl_path = "..\\out32\\openssl.exe";
+}
+else {
+    die "Can't find OpenSSL executable";
+}
+
+my $pk7cmd   = "$ossl_path smime ";
+my $cmscmd   = "$ossl_path cms ";
+my $smdir    = "smime-certs";
+my $halt_err = 1;
+
+my $badcmd = 0;
+my $ossl8 = `$ossl_path version -v` =~ /0\.9\.8/;
+
+my @smime_pkcs7_tests = (
+
+    [
+        "signed content DER format, RSA key",
+        "-sign -in smcont.txt -outform DER -nodetach"
+          . " -certfile $smdir/smroot.pem"
+          . " -signer $smdir/smrsa1.pem -out test.cms",
+        "-verify -in test.cms -inform DER "
+          . " -CAfile $smdir/smroot.pem -out smtst.txt"
+    ],
+
+    [
+        "signed detached content DER format, RSA key",
+        "-sign -in smcont.txt -outform DER"
+          . " -signer $smdir/smrsa1.pem -out test.cms",
+        "-verify -in test.cms -inform DER "
+          . " -CAfile $smdir/smroot.pem -out smtst.txt -content smcont.txt"
+    ],
+
+    [
+        "signed content test streaming BER format, RSA",
+        "-sign -in smcont.txt -outform DER -nodetach"
+          . " -stream -signer $smdir/smrsa1.pem -out test.cms",
+        "-verify -in test.cms -inform DER "
+          . " -CAfile $smdir/smroot.pem -out smtst.txt"
+    ],
+
+    [
+        "signed content DER format, DSA key",
+        "-sign -in smcont.txt -outform DER -nodetach"
+          . " -signer $smdir/smdsa1.pem -out test.cms",
+        "-verify -in test.cms -inform DER "
+          . " -CAfile $smdir/smroot.pem -out smtst.txt"
+    ],
+
+    [
+        "signed detached content DER format, DSA key",
+        "-sign -in smcont.txt -outform DER"
+          . " -signer $smdir/smdsa1.pem -out test.cms",
+        "-verify -in test.cms -inform DER "
+          . " -CAfile $smdir/smroot.pem -out smtst.txt -content smcont.txt"
+    ],
+
+    [
+        "signed detached content DER format, add RSA signer",
+        "-resign -inform DER -in test.cms -outform DER"
+          . " -signer $smdir/smrsa1.pem -out test2.cms",
+        "-verify -in test2.cms -inform DER "
+          . " -CAfile $smdir/smroot.pem -out smtst.txt -content smcont.txt"
+    ],
+
+    [
+        "signed content test streaming BER format, DSA key",
+        "-sign -in smcont.txt -outform DER -nodetach"
+          . " -stream -signer $smdir/smdsa1.pem -out test.cms",
+        "-verify -in test.cms -inform DER "
+          . " -CAfile $smdir/smroot.pem -out smtst.txt"
+    ],
+
+    [
+        "signed content test streaming BER format, 2 DSA and 2 RSA keys",
+        "-sign -in smcont.txt -outform DER -nodetach"
+          . " -signer $smdir/smrsa1.pem -signer $smdir/smrsa2.pem"
+          . " -signer $smdir/smdsa1.pem -signer $smdir/smdsa2.pem"
+          . " -stream -out test.cms",
+        "-verify -in test.cms -inform DER "
+          . " -CAfile $smdir/smroot.pem -out smtst.txt"
+    ],
+
+    [
+"signed content test streaming BER format, 2 DSA and 2 RSA keys, no attributes",
+        "-sign -in smcont.txt -outform DER -noattr -nodetach"
+          . " -signer $smdir/smrsa1.pem -signer $smdir/smrsa2.pem"
+          . " -signer $smdir/smdsa1.pem -signer $smdir/smdsa2.pem"
+          . " -stream -out test.cms",
+        "-verify -in test.cms -inform DER "
+          . " -CAfile $smdir/smroot.pem -out smtst.txt"
+    ],
+
+    [
+        "signed content test streaming S/MIME format, 2 DSA and 2 RSA keys",
+        "-sign -in smcont.txt -nodetach"
+          . " -signer $smdir/smrsa1.pem -signer $smdir/smrsa2.pem"
+          . " -signer $smdir/smdsa1.pem -signer $smdir/smdsa2.pem"
+          . " -stream -out test.cms",
+        "-verify -in test.cms " . " -CAfile $smdir/smroot.pem -out smtst.txt"
+    ],
+
+    [
+"signed content test streaming multipart S/MIME format, 2 DSA and 2 RSA keys",
+        "-sign -in smcont.txt"
+          . " -signer $smdir/smrsa1.pem -signer $smdir/smrsa2.pem"
+          . " -signer $smdir/smdsa1.pem -signer $smdir/smdsa2.pem"
+          . " -stream -out test.cms",
+        "-verify -in test.cms " . " -CAfile $smdir/smroot.pem -out smtst.txt"
+    ],
+
+    [
+        "enveloped content test streaming S/MIME format, 3 recipients",
+        "-encrypt -in smcont.txt"
+          . " -stream -out test.cms"
+          . " $smdir/smrsa1.pem $smdir/smrsa2.pem $smdir/smrsa3.pem ",
+        "-decrypt -recip $smdir/smrsa1.pem -in test.cms -out smtst.txt"
+    ],
+
+    [
+"enveloped content test streaming S/MIME format, 3 recipients, 3rd used",
+        "-encrypt -in smcont.txt"
+          . " -stream -out test.cms"
+          . " $smdir/smrsa1.pem $smdir/smrsa2.pem $smdir/smrsa3.pem ",
+        "-decrypt -recip $smdir/smrsa3.pem -in test.cms -out smtst.txt"
+    ],
+
+    [
+"enveloped content test streaming S/MIME format, 3 recipients, key only used",
+        "-encrypt -in smcont.txt"
+          . " -stream -out test.cms"
+          . " $smdir/smrsa1.pem $smdir/smrsa2.pem $smdir/smrsa3.pem ",
+        "-decrypt -inkey $smdir/smrsa3.pem -in test.cms -out smtst.txt"
+    ],
+
+    [
+"enveloped content test streaming S/MIME format, AES-256 cipher, 3 recipients",
+        "-encrypt -in smcont.txt"
+          . " -aes256 -stream -out test.cms"
+          . " $smdir/smrsa1.pem $smdir/smrsa2.pem $smdir/smrsa3.pem ",
+        "-decrypt -recip $smdir/smrsa1.pem -in test.cms -out smtst.txt"
+    ],
+
+);
+
+my @smime_cms_tests = (
+
+    [
+        "signed content test streaming BER format, 2 DSA and 2 RSA keys, keyid",
+        "-sign -in smcont.txt -outform DER -nodetach -keyid"
+          . " -signer $smdir/smrsa1.pem -signer $smdir/smrsa2.pem"
+          . " -signer $smdir/smdsa1.pem -signer $smdir/smdsa2.pem"
+          . " -stream -out test.cms",
+        "-verify -in test.cms -inform DER "
+          . " -CAfile $smdir/smroot.pem -out smtst.txt"
+    ],
+
+    [
+        "signed content test streaming PEM format, 2 DSA and 2 RSA keys",
+        "-sign -in smcont.txt -outform PEM -nodetach"
+          . " -signer $smdir/smrsa1.pem -signer $smdir/smrsa2.pem"
+          . " -signer $smdir/smdsa1.pem -signer $smdir/smdsa2.pem"
+          . " -stream -out test.cms",
+        "-verify -in test.cms -inform PEM "
+          . " -CAfile $smdir/smroot.pem -out smtst.txt"
+    ],
+
+    [
+        "signed content MIME format, RSA key, signed receipt request",
+        "-sign -in smcont.txt -signer $smdir/smrsa1.pem -nodetach"
+          . " -receipt_request_to test@openssl.org -receipt_request_all"
+          . " -out test.cms",
+        "-verify -in test.cms "
+          . " -CAfile $smdir/smroot.pem -out smtst.txt"
+    ],
+
+    [
+        "signed receipt MIME format, RSA key",
+        "-sign_receipt -in test.cms"
+          . " -signer $smdir/smrsa2.pem"
+          . " -out test2.cms",
+        "-verify_receipt test2.cms -in test.cms"
+          . " -CAfile $smdir/smroot.pem"
+    ],
+
+    [
+        "enveloped content test streaming S/MIME format, 3 recipients, keyid",
+        "-encrypt -in smcont.txt"
+          . " -stream -out test.cms -keyid"
+          . " $smdir/smrsa1.pem $smdir/smrsa2.pem $smdir/smrsa3.pem ",
+        "-decrypt -recip $smdir/smrsa1.pem -in test.cms -out smtst.txt"
+    ],
+
+    [
+        "enveloped content test streaming PEM format, KEK",
+        "-encrypt -in smcont.txt -outform PEM -aes128"
+          . " -stream -out test.cms "
+          . " -secretkey 000102030405060708090A0B0C0D0E0F "
+          . " -secretkeyid C0FEE0",
+        "-decrypt -in test.cms -out smtst.txt -inform PEM"
+          . " -secretkey 000102030405060708090A0B0C0D0E0F "
+          . " -secretkeyid C0FEE0"
+    ],
+
+    [
+        "enveloped content test streaming PEM format, KEK, key only",
+        "-encrypt -in smcont.txt -outform PEM -aes128"
+          . " -stream -out test.cms "
+          . " -secretkey 000102030405060708090A0B0C0D0E0F "
+          . " -secretkeyid C0FEE0",
+        "-decrypt -in test.cms -out smtst.txt -inform PEM"
+          . " -secretkey 000102030405060708090A0B0C0D0E0F "
+    ],
+
+    [
+        "data content test streaming PEM format",
+        "-data_create -in smcont.txt -outform PEM -nodetach"
+          . " -stream -out test.cms",
+        "-data_out -in test.cms -inform PEM -out smtst.txt"
+    ],
+
+    [
+        "encrypted content test streaming PEM format, 128 bit RC2 key",
+        "-EncryptedData_encrypt -in smcont.txt -outform PEM"
+          . " -rc2 -secretkey 000102030405060708090A0B0C0D0E0F"
+          . " -stream -out test.cms",
+        "-EncryptedData_decrypt -in test.cms -inform PEM "
+          . " -secretkey 000102030405060708090A0B0C0D0E0F -out smtst.txt"
+    ],
+
+    [
+        "encrypted content test streaming PEM format, 40 bit RC2 key",
+        "-EncryptedData_encrypt -in smcont.txt -outform PEM"
+          . " -rc2 -secretkey 0001020304"
+          . " -stream -out test.cms",
+        "-EncryptedData_decrypt -in test.cms -inform PEM "
+          . " -secretkey 0001020304 -out smtst.txt"
+    ],
+
+    [
+        "encrypted content test streaming PEM format, triple DES key",
+        "-EncryptedData_encrypt -in smcont.txt -outform PEM"
+          . " -des3 -secretkey 000102030405060708090A0B0C0D0E0F1011121314151617"
+          . " -stream -out test.cms",
+        "-EncryptedData_decrypt -in test.cms -inform PEM "
+          . " -secretkey 000102030405060708090A0B0C0D0E0F1011121314151617"
+          . " -out smtst.txt"
+    ],
+
+    [
+        "encrypted content test streaming PEM format, 128 bit AES key",
+        "-EncryptedData_encrypt -in smcont.txt -outform PEM"
+          . " -aes128 -secretkey 000102030405060708090A0B0C0D0E0F"
+          . " -stream -out test.cms",
+        "-EncryptedData_decrypt -in test.cms -inform PEM "
+          . " -secretkey 000102030405060708090A0B0C0D0E0F -out smtst.txt"
+    ],
+
+);
+
+my @smime_cms_comp_tests = (
+
+    [
+        "compressed content test streaming PEM format",
+        "-compress -in smcont.txt -outform PEM -nodetach"
+          . " -stream -out test.cms",
+        "-uncompress -in test.cms -inform PEM -out smtst.txt"
+    ]
+
+);
+
+print "PKCS#7 <=> PKCS#7 consistency tests\n";
+
+run_smime_tests( \$badcmd, \@smime_pkcs7_tests, $pk7cmd, $pk7cmd );
+
+print "CMS => PKCS#7 compatibility tests\n";
+
+run_smime_tests( \$badcmd, \@smime_pkcs7_tests, $cmscmd, $pk7cmd );
+
+print "CMS <= PKCS#7 compatibility tests\n";
+
+run_smime_tests( \$badcmd, \@smime_pkcs7_tests, $pk7cmd, $cmscmd );
+
+print "CMS <=> CMS consistency tests\n";
+
+run_smime_tests( \$badcmd, \@smime_pkcs7_tests, $cmscmd, $cmscmd );
+run_smime_tests( \$badcmd, \@smime_cms_tests,   $cmscmd, $cmscmd );
+
+if ( `$ossl_path version -f` =~ /ZLIB/ ) {
+    run_smime_tests( \$badcmd, \@smime_cms_comp_tests, $cmscmd, $cmscmd );
+}
+else {
+    print "Zlib not supported: compression tests skipped\n";
+}
+
+print "Running modified tests for OpenSSL 0.9.8 cms backport\n" if($ossl8);
+
+if ($badcmd) {
+    print "$badcmd TESTS FAILED!!\n";
+}
+else {
+    print "ALL TESTS SUCCESSFUL.\n";
+}
+
+unlink "test.cms";
+unlink "test2.cms";
+unlink "smtst.txt";
+unlink "cms.out";
+unlink "cms.err";
+
+sub run_smime_tests {
+    my ( $rv, $aref, $scmd, $vcmd ) = @_;
+
+    foreach $smtst (@$aref) {
+        my ( $tnam, $rscmd, $rvcmd ) = @$smtst;
+        if ($ossl8)
+                {
+                # Skip smime resign: 0.9.8 smime doesn't support -resign        
+                next if ($scmd =~ /smime/ && $rscmd =~ /-resign/);
+                # Disable streaming: option not supported in 0.9.8
+                $tnam =~ s/streaming//; 
+                $rscmd =~ s/-stream//;  
+                $rvcmd =~ s/-stream//;
+                }
+        system("$scmd$rscmd 2>cms.err 1>cms.out");
+        if ($?) {
+            print "$tnam: generation error\n";
+            $$rv++;
+            exit 1 if $halt_err;
+            next;
+        }
+        system("$vcmd$rvcmd 2>cms.err 1>cms.out");
+        if ($?) {
+            print "$tnam: verify error\n";
+            $$rv++;
+            exit 1 if $halt_err;
+            next;
+        }
+        if (!cmp_files("smtst.txt", "smcont.txt")) {
+            print "$tnam: content verify error\n";
+            $$rv++;
+            exit 1 if $halt_err;
+            next;
+        }
+        print "$tnam: OK\n";
+    }
+}
+
+sub cmp_files {
+    my ( $f1, $f2 ) = @_;
+    my ( $fp1, $fp2 );
+
+    my ( $rd1, $rd2 );
+
+    if ( !open( $fp1, "<$f1" ) ) {
+        print STDERR "Can't Open file $f1\n";
+        return 0;
+    }
+
+    if ( !open( $fp2, "<$f2" ) ) {
+        print STDERR "Can't Open file $f2\n";
+        return 0;
+    }
+
+    binmode $fp1;
+    binmode $fp2;
+
+    my $ret = 0;
+
+    for ( ; ; ) {
+        $n1 = sysread $fp1, $rd1, 4096;
+        $n2 = sysread $fp2, $rd2, 4096;
+        last if ( $n1 != $n2 );
+        last if ( $rd1 ne $rd2 );
+
+        if ( $n1 == 0 ) {
+            $ret = 1;
+            last;
+        }
+
+    }
+
+    close $fp1;
+    close $fp2;
+
+    return $ret;
+
+}
+
diff --git a/src/lib/libssl/src/test/igetest.c b/src/lib/libssl/src/test/igetest.c
new file mode 100644
index 0000000000..95452d0965
--- /dev/null
+++ b/src/lib/libssl/src/test/igetest.c
@@ -0,0 +1,503 @@
+/* test/igetest.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+
+#include <openssl/aes.h>
+#include <openssl/rand.h>
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+
+#define TEST_SIZE       128
+#define BIG_TEST_SIZE 10240
+
+static void hexdump(FILE *f,const char *title,const unsigned char *s,int l)
+    {
+    int n=0;
+
+    fprintf(f,"%s",title);
+    for( ; n < l ; ++n)
+                {
+                if((n%16) == 0)
+                        fprintf(f,"\n%04x",n);
+                fprintf(f," %02x",s[n]);
+                }
+    fprintf(f,"\n");
+    }
+
+#define MAX_VECTOR_SIZE 64
+
+struct ige_test
+        {
+        const unsigned char key[16];
+        const unsigned char iv[32];
+        const unsigned char in[MAX_VECTOR_SIZE];
+        const unsigned char out[MAX_VECTOR_SIZE];
+        const size_t length;
+        const int encrypt;
+        };
+
+static struct ige_test const ige_test_vectors[] = {
+{ { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f }, /* key */
+  { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+    0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+    0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f }, /* iv */
+  { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, /* in */
+  { 0x1a, 0x85, 0x19, 0xa6, 0x55, 0x7b, 0xe6, 0x52,
+    0xe9, 0xda, 0x8e, 0x43, 0xda, 0x4e, 0xf4, 0x45,
+    0x3c, 0xf4, 0x56, 0xb4, 0xca, 0x48, 0x8a, 0xa3,
+    0x83, 0xc7, 0x9c, 0x98, 0xb3, 0x47, 0x97, 0xcb }, /* out */
+  32, AES_ENCRYPT }, /* test vector 0 */
+
+{ { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20,
+    0x61, 0x6e, 0x20, 0x69, 0x6d, 0x70, 0x6c, 0x65 }, /* key */
+  { 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f,
+    0x6e, 0x20, 0x6f, 0x66, 0x20, 0x49, 0x47, 0x45,
+    0x20, 0x6d, 0x6f, 0x64, 0x65, 0x20, 0x66, 0x6f,
+    0x72, 0x20, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x53 }, /* iv */
+  { 0x4c, 0x2e, 0x20, 0x4c, 0x65, 0x74, 0x27, 0x73,
+    0x20, 0x68, 0x6f, 0x70, 0x65, 0x20, 0x42, 0x65,
+    0x6e, 0x20, 0x67, 0x6f, 0x74, 0x20, 0x69, 0x74,
+    0x20, 0x72, 0x69, 0x67, 0x68, 0x74, 0x21, 0x0a }, /* in */
+  { 0x99, 0x70, 0x64, 0x87, 0xa1, 0xcd, 0xe6, 0x13,
+    0xbc, 0x6d, 0xe0, 0xb6, 0xf2, 0x4b, 0x1c, 0x7a,
+    0xa4, 0x48, 0xc8, 0xb9, 0xc3, 0x40, 0x3e, 0x34,
+    0x67, 0xa8, 0xca, 0xd8, 0x93, 0x40, 0xf5, 0x3b }, /* out */
+  32, AES_DECRYPT }, /* test vector 1 */
+};
+
+struct bi_ige_test
+        {
+        const unsigned char key1[32];
+        const unsigned char key2[32];
+        const unsigned char iv[64];
+        const unsigned char in[MAX_VECTOR_SIZE];
+        const unsigned char out[MAX_VECTOR_SIZE];
+        const size_t keysize;
+        const size_t length;
+        const int encrypt;
+        };
+
+static struct bi_ige_test const bi_ige_test_vectors[] = {
+{ { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f }, /* key1 */
+  { 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+    0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f }, /* key2 */
+  { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+    0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+    0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+    0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+    0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+    0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+    0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f }, /* iv */
+  { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, /* in */
+  { 0x14, 0x40, 0x6f, 0xae, 0xa2, 0x79, 0xf2, 0x56,
+        0x1f, 0x86, 0xeb, 0x3b, 0x7d, 0xff, 0x53, 0xdc,
+        0x4e, 0x27, 0x0c, 0x03, 0xde, 0x7c, 0xe5, 0x16,
+        0x6a, 0x9c, 0x20, 0x33, 0x9d, 0x33, 0xfe, 0x12 }, /* out */
+  16, 32, AES_ENCRYPT }, /* test vector 0 */
+{ { 0x58, 0x0a, 0x06, 0xe9, 0x97, 0x07, 0x59, 0x5c,
+        0x9e, 0x19, 0xd2, 0xa7, 0xbb, 0x40, 0x2b, 0x7a,
+        0xc7, 0xd8, 0x11, 0x9e, 0x4c, 0x51, 0x35, 0x75,
+        0x64, 0x28, 0x0f, 0x23, 0xad, 0x74, 0xac, 0x37 }, /* key1 */
+  { 0xd1, 0x80, 0xa0, 0x31, 0x47, 0xa3, 0x11, 0x13,
+        0x86, 0x26, 0x9e, 0x6d, 0xff, 0xaf, 0x72, 0x74,
+        0x5b, 0xa2, 0x35, 0x81, 0xd2, 0xa6, 0x3d, 0x21,
+        0x67, 0x7b, 0x58, 0xa8, 0x18, 0xf9, 0x72, 0xe4 }, /* key2 */
+  { 0x80, 0x3d, 0xbd, 0x4c, 0xe6, 0x7b, 0x06, 0xa9,
+        0x53, 0x35, 0xd5, 0x7e, 0x71, 0xc1, 0x70, 0x70,
+        0x74, 0x9a, 0x00, 0x28, 0x0c, 0xbf, 0x6c, 0x42,
+        0x9b, 0xa4, 0xdd, 0x65, 0x11, 0x77, 0x7c, 0x67,
+        0xfe, 0x76, 0x0a, 0xf0, 0xd5, 0xc6, 0x6e, 0x6a,
+        0xe7, 0x5e, 0x4c, 0xf2, 0x7e, 0x9e, 0xf9, 0x20,
+        0x0e, 0x54, 0x6f, 0x2d, 0x8a, 0x8d, 0x7e, 0xbd,
+        0x48, 0x79, 0x37, 0x99, 0xff, 0x27, 0x93, 0xa3 }, /* iv */
+  { 0xf1, 0x54, 0x3d, 0xca, 0xfe, 0xb5, 0xef, 0x1c,
+        0x4f, 0xa6, 0x43, 0xf6, 0xe6, 0x48, 0x57, 0xf0,
+        0xee, 0x15, 0x7f, 0xe3, 0xe7, 0x2f, 0xd0, 0x2f,
+        0x11, 0x95, 0x7a, 0x17, 0x00, 0xab, 0xa7, 0x0b,
+        0xbe, 0x44, 0x09, 0x9c, 0xcd, 0xac, 0xa8, 0x52,
+        0xa1, 0x8e, 0x7b, 0x75, 0xbc, 0xa4, 0x92, 0x5a,
+        0xab, 0x46, 0xd3, 0x3a, 0xa0, 0xd5, 0x35, 0x1c,
+        0x55, 0xa4, 0xb3, 0xa8, 0x40, 0x81, 0xa5, 0x0b}, /* in */
+  { 0x42, 0xe5, 0x28, 0x30, 0x31, 0xc2, 0xa0, 0x23,
+        0x68, 0x49, 0x4e, 0xb3, 0x24, 0x59, 0x92, 0x79,
+        0xc1, 0xa5, 0xcc, 0xe6, 0x76, 0x53, 0xb1, 0xcf,
+        0x20, 0x86, 0x23, 0xe8, 0x72, 0x55, 0x99, 0x92,
+        0x0d, 0x16, 0x1c, 0x5a, 0x2f, 0xce, 0xcb, 0x51,
+        0xe2, 0x67, 0xfa, 0x10, 0xec, 0xcd, 0x3d, 0x67,
+        0xa5, 0xe6, 0xf7, 0x31, 0x26, 0xb0, 0x0d, 0x76,
+        0x5e, 0x28, 0xdc, 0x7f, 0x01, 0xc5, 0xa5, 0x4c}, /* out */
+  32, 64, AES_ENCRYPT }, /* test vector 1 */
+
+};
+
+static int run_test_vectors(void)
+        {
+        int n;
+        int errs = 0;
+
+        for(n=0 ; n < sizeof(ige_test_vectors)/sizeof(ige_test_vectors[0]) ; ++n)
+                {
+                const struct ige_test * const v = &ige_test_vectors[n];
+                AES_KEY key;
+                unsigned char buf[MAX_VECTOR_SIZE];
+                unsigned char iv[AES_BLOCK_SIZE*2];
+
+                assert(v->length <= MAX_VECTOR_SIZE);
+
+                if(v->encrypt == AES_ENCRYPT)
+                        AES_set_encrypt_key(v->key, 8*sizeof v->key, &key);
+                else
+                        AES_set_decrypt_key(v->key, 8*sizeof v->key, &key);
+                memcpy(iv, v->iv, sizeof iv);
+                AES_ige_encrypt(v->in, buf, v->length, &key, iv, v->encrypt);
+
+                if(memcmp(v->out, buf, v->length))
+                        {
+                        printf("IGE test vector %d failed\n", n);
+                        hexdump(stdout, "key", v->key, sizeof v->key);
+                        hexdump(stdout, "iv", v->iv, sizeof v->iv);
+                        hexdump(stdout, "in", v->in, v->length);
+                        hexdump(stdout, "expected", v->out, v->length);
+                        hexdump(stdout, "got", buf, v->length);
+
+                        ++errs;
+                        }
+
+                /* try with in == out */
+                memcpy(iv, v->iv, sizeof iv);
+                memcpy(buf, v->in, v->length);
+                AES_ige_encrypt(buf, buf, v->length, &key, iv, v->encrypt);
+
+                if(memcmp(v->out, buf, v->length))
+                        {
+                        printf("IGE test vector %d failed (with in == out)\n", n);
+                        hexdump(stdout, "key", v->key, sizeof v->key);
+                        hexdump(stdout, "iv", v->iv, sizeof v->iv);
+                        hexdump(stdout, "in", v->in, v->length);
+                        hexdump(stdout, "expected", v->out, v->length);
+                        hexdump(stdout, "got", buf, v->length);
+
+                        ++errs;
+                        }
+                }
+
+        for(n=0 ; n < sizeof(bi_ige_test_vectors)/sizeof(bi_ige_test_vectors[0])
+                        ; ++n)
+                {
+                const struct bi_ige_test * const v = &bi_ige_test_vectors[n];
+                AES_KEY key1;
+                AES_KEY key2;
+                unsigned char buf[MAX_VECTOR_SIZE];
+
+                assert(v->length <= MAX_VECTOR_SIZE);
+
+                if(v->encrypt == AES_ENCRYPT)
+                        {
+                        AES_set_encrypt_key(v->key1, 8*v->keysize, &key1);
+                        AES_set_encrypt_key(v->key2, 8*v->keysize, &key2);
+                        }
+                else
+                        {
+                        AES_set_decrypt_key(v->key1, 8*v->keysize, &key1);
+                        AES_set_decrypt_key(v->key2, 8*v->keysize, &key2);
+                        }
+
+                AES_bi_ige_encrypt(v->in, buf, v->length, &key1, &key2, v->iv,
+                                                   v->encrypt);
+
+                if(memcmp(v->out, buf, v->length))
+                        {
+                        printf("Bidirectional IGE test vector %d failed\n", n);
+                        hexdump(stdout, "key 1", v->key1, sizeof v->key1);
+                        hexdump(stdout, "key 2", v->key2, sizeof v->key2);
+                        hexdump(stdout, "iv", v->iv, sizeof v->iv);
+                        hexdump(stdout, "in", v->in, v->length);
+                        hexdump(stdout, "expected", v->out, v->length);
+                        hexdump(stdout, "got", buf, v->length);
+
+                        ++errs;
+                        }
+                }
+
+        return errs;
+        }
+
+int main(int argc, char **argv)
+        {
+        unsigned char rkey[16];
+        unsigned char rkey2[16];
+        AES_KEY key;
+        AES_KEY key2;
+        unsigned char plaintext[BIG_TEST_SIZE];
+        unsigned char ciphertext[BIG_TEST_SIZE];
+        unsigned char checktext[BIG_TEST_SIZE];
+        unsigned char iv[AES_BLOCK_SIZE*4];
+        unsigned char saved_iv[AES_BLOCK_SIZE*4];
+        int err = 0;
+        int n;
+        unsigned matches;
+
+        assert(BIG_TEST_SIZE >= TEST_SIZE);
+
+        RAND_pseudo_bytes(rkey, sizeof rkey);
+        RAND_pseudo_bytes(plaintext, sizeof plaintext);
+        RAND_pseudo_bytes(iv, sizeof iv);
+        memcpy(saved_iv, iv, sizeof saved_iv);
+
+        /* Forward IGE only... */
+
+        /* Straight encrypt/decrypt */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_ige_encrypt(plaintext, ciphertext, TEST_SIZE, &key, iv,
+                                        AES_ENCRYPT);
+
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(ciphertext, checktext, TEST_SIZE, &key, iv,
+                                        AES_DECRYPT);
+
+        if(memcmp(checktext, plaintext, TEST_SIZE))
+                {
+                printf("Encrypt+decrypt doesn't match\n");
+                hexdump(stdout, "Plaintext", plaintext, TEST_SIZE);
+                hexdump(stdout, "Checktext", checktext, TEST_SIZE);
+                ++err;
+                }
+
+        /* Now check encrypt chaining works */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(plaintext, ciphertext, TEST_SIZE/2, &key, iv,
+                                        AES_ENCRYPT);
+        AES_ige_encrypt(plaintext+TEST_SIZE/2,
+                                        ciphertext+TEST_SIZE/2, TEST_SIZE/2,
+                                        &key, iv, AES_ENCRYPT);
+
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(ciphertext, checktext, TEST_SIZE, &key, iv,
+                                        AES_DECRYPT);
+
+        if(memcmp(checktext, plaintext, TEST_SIZE))
+                {
+                printf("Chained encrypt+decrypt doesn't match\n");
+                hexdump(stdout, "Plaintext", plaintext, TEST_SIZE);
+                hexdump(stdout, "Checktext", checktext, TEST_SIZE);
+                ++err;
+                }
+
+        /* And check decrypt chaining */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(plaintext, ciphertext, TEST_SIZE/2, &key, iv,
+                                        AES_ENCRYPT);
+        AES_ige_encrypt(plaintext+TEST_SIZE/2,
+                                        ciphertext+TEST_SIZE/2, TEST_SIZE/2,
+                                        &key, iv, AES_ENCRYPT);
+
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(ciphertext, checktext, TEST_SIZE/2, &key, iv,
+                                        AES_DECRYPT);
+        AES_ige_encrypt(ciphertext+TEST_SIZE/2,
+                                        checktext+TEST_SIZE/2, TEST_SIZE/2, &key, iv,
+                                        AES_DECRYPT);
+
+        if(memcmp(checktext, plaintext, TEST_SIZE))
+                {
+                printf("Chained encrypt+chained decrypt doesn't match\n");
+                hexdump(stdout, "Plaintext", plaintext, TEST_SIZE);
+                hexdump(stdout, "Checktext", checktext, TEST_SIZE);
+                ++err;
+                }
+
+        /* make sure garble extends forwards only */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(plaintext, ciphertext, sizeof plaintext, &key, iv,
+                                        AES_ENCRYPT);
+
+        /* corrupt halfway through */
+        ++ciphertext[sizeof ciphertext/2];
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(ciphertext, checktext, sizeof checktext, &key, iv,
+                                        AES_DECRYPT);
+
+        matches=0;
+        for(n=0 ; n < sizeof checktext ; ++n)
+                if(checktext[n] == plaintext[n])
+                        ++matches;
+
+        if(matches > sizeof checktext/2+sizeof checktext/100)
+                {
+                printf("More than 51%% matches after garbling\n");
+                ++err;
+                }
+
+        if(matches < sizeof checktext/2)
+                {
+                printf("Garble extends backwards!\n");
+                ++err;
+                }
+
+        /* Bi-directional IGE */
+
+        /* Note that we don't have to recover the IV, because chaining isn't */
+        /* possible with biIGE, so the IV is not updated. */
+
+        RAND_pseudo_bytes(rkey2, sizeof rkey2);
+
+        /* Straight encrypt/decrypt */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_encrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_bi_ige_encrypt(plaintext, ciphertext, TEST_SIZE, &key, &key2, iv,
+                                           AES_ENCRYPT);
+
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_decrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_bi_ige_encrypt(ciphertext, checktext, TEST_SIZE, &key, &key2, iv,
+                                           AES_DECRYPT);
+
+        if(memcmp(checktext, plaintext, TEST_SIZE))
+                {
+                printf("Encrypt+decrypt doesn't match\n");
+                hexdump(stdout, "Plaintext", plaintext, TEST_SIZE);
+                hexdump(stdout, "Checktext", checktext, TEST_SIZE);
+                ++err;
+                }
+
+        /* make sure garble extends both ways */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_encrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_ige_encrypt(plaintext, ciphertext, sizeof plaintext, &key, iv,
+                                        AES_ENCRYPT);
+
+        /* corrupt halfway through */
+        ++ciphertext[sizeof ciphertext/2];
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_decrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_ige_encrypt(ciphertext, checktext, sizeof checktext, &key, iv,
+                                        AES_DECRYPT);
+
+        matches=0;
+        for(n=0 ; n < sizeof checktext ; ++n)
+                if(checktext[n] == plaintext[n])
+                        ++matches;
+
+        if(matches > sizeof checktext/100)
+                {
+                printf("More than 1%% matches after bidirectional garbling\n");
+                ++err;
+                }
+
+        /* make sure garble extends both ways (2) */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_encrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_ige_encrypt(plaintext, ciphertext, sizeof plaintext, &key, iv,
+                                        AES_ENCRYPT);
+
+        /* corrupt right at the end */
+        ++ciphertext[sizeof ciphertext-1];
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_decrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_ige_encrypt(ciphertext, checktext, sizeof checktext, &key, iv,
+                                        AES_DECRYPT);
+
+        matches=0;
+        for(n=0 ; n < sizeof checktext ; ++n)
+                if(checktext[n] == plaintext[n])
+                        ++matches;
+
+        if(matches > sizeof checktext/100)
+                {
+                printf("More than 1%% matches after bidirectional garbling (2)\n");
+                ++err;
+                }
+
+        /* make sure garble extends both ways (3) */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_encrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_ige_encrypt(plaintext, ciphertext, sizeof plaintext, &key, iv,
+                                        AES_ENCRYPT);
+
+        /* corrupt right at the start */
+        ++ciphertext[0];
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_decrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_ige_encrypt(ciphertext, checktext, sizeof checktext, &key, iv,
+                                        AES_DECRYPT);
+
+        matches=0;
+        for(n=0 ; n < sizeof checktext ; ++n)
+                if(checktext[n] == plaintext[n])
+                        ++matches;
+
+        if(matches > sizeof checktext/100)
+                {
+                printf("More than 1%% matches after bidirectional garbling (3)\n");
+                ++err;
+                }
+
+        err += run_test_vectors();
+
+        return err;
+        }
diff --git a/src/lib/libssl/src/test/smcont.txt b/src/lib/libssl/src/test/smcont.txt
new file mode 100644
index 0000000000..e837c0b75b
--- /dev/null
+++ b/src/lib/libssl/src/test/smcont.txt
@@ -0,0 +1 @@
+Some test content for OpenSSL CMS
\ No newline at end of file
diff --git a/src/lib/libssl/src/test/smime-certs/smdsa1.pem b/src/lib/libssl/src/test/smime-certs/smdsa1.pem
new file mode 100644
index 0000000000..d5677dbfbe
--- /dev/null
+++ b/src/lib/libssl/src/test/smime-certs/smdsa1.pem
@@ -0,0 +1,34 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBuwIBAAKBgQDFJfsIPOIawMO5biw+AoYUhNVxReBOLQosU3Qv4B8krac0BNr3
+OjSGLh1wZxHqhlAE0QmasTaKojuk20nNWeFnczSz6vDl0IVJEhS8VYor5kt9gLqt
+GcoAgsf4gRDIutJyQDaNn3IVY89uXUVIoexvQeLQDBCgQPC5O8rJdqBwtwIVAK2J
+jt+dqk07eQUE59koYUEKyNorAoGBAI4IEpusf8G14kCHmRtnHXM2tG5EWJDmW6Qt
+wjqvWp1GKUx5WFy1tVWR9nl5rL0Di+kNdENo+SkKj7h3uDulGOI6T0mQYbV2h1IK
++FMOGnOqvZ8eNTE2n4PGTo5puZ63LBm+QYrQsrNiUY4vakLFQ2rEK/SLwdsDFK4Z
+SJCBQw5zAoGATQlPPF+OeU8nu3rsdXGDiZdJzOkuCce3KQfTABA9C+Dk4CVcvBdd
+YRLGpnykumkNTO1sTO+4/Gphsuje1ujK9td4UEhdYqylCe5QjEMrszDlJtelDQF9
+C0yhdjKGTP0kxofLhsGckcuQvcKEKffT2pDDKJIy4vWQO0UyJl1vjLcCFG2uiGGx
+9fMUZq1v0ePD4Wo0Xkxo
+-----END DSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIDpDCCAw2gAwIBAgIJAMtotfHYdEsWMA0GCSqGSIb3DQEBBQUAMEQxCzAJBgNV
+BAYTAlVLMRYwFAYDVQQKEw1PcGVuU1NMIEdyb3VwMR0wGwYDVQQDExRUZXN0IFMv
+TUlNRSBSU0EgUm9vdDAeFw0wODAyMjIxMzUzMDlaFw0xNjA1MTAxMzUzMDlaMEUx
+CzAJBgNVBAYTAlVLMRYwFAYDVQQKDA1PcGVuU1NMIEdyb3VwMR4wHAYDVQQDDBVU
+ZXN0IFMvTUlNRSBFRSBEU0EgIzEwggG3MIIBLAYHKoZIzjgEATCCAR8CgYEAxSX7
+CDziGsDDuW4sPgKGFITVcUXgTi0KLFN0L+AfJK2nNATa9zo0hi4dcGcR6oZQBNEJ
+mrE2iqI7pNtJzVnhZ3M0s+rw5dCFSRIUvFWKK+ZLfYC6rRnKAILH+IEQyLrSckA2
+jZ9yFWPPbl1FSKHsb0Hi0AwQoEDwuTvKyXagcLcCFQCtiY7fnapNO3kFBOfZKGFB
+CsjaKwKBgQCOCBKbrH/BteJAh5kbZx1zNrRuRFiQ5lukLcI6r1qdRilMeVhctbVV
+kfZ5eay9A4vpDXRDaPkpCo+4d7g7pRjiOk9JkGG1dodSCvhTDhpzqr2fHjUxNp+D
+xk6OabmetywZvkGK0LKzYlGOL2pCxUNqxCv0i8HbAxSuGUiQgUMOcwOBhAACgYBN
+CU88X455Tye7eux1cYOJl0nM6S4Jx7cpB9MAED0L4OTgJVy8F11hEsamfKS6aQ1M
+7WxM77j8amGy6N7W6Mr213hQSF1irKUJ7lCMQyuzMOUm16UNAX0LTKF2MoZM/STG
+h8uGwZyRy5C9woQp99PakMMokjLi9ZA7RTImXW+Mt6OBgzCBgDAdBgNVHQ4EFgQU
+4Qfbhpi5yqXaXuCLXj427mR25MkwHwYDVR0jBBgwFoAUE89Lp7uJLrM4Vxd2xput
+aFvl7RcwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwIAYDVR0RBBkwF4EV
+c21pbWVkc2ExQG9wZW5zc2wub3JnMA0GCSqGSIb3DQEBBQUAA4GBAFrdUzKK1pWO
+kd02S423KUBc4GWWyiGlVoEO7WxVhHLJ8sm67X7OtJOwe0UGt+Nc5qLtyJYSirw8
+phjiTdNpQCTJ8+Kc56tWkJ6H7NAI4vTJtPL5BM/EmeYrVSU9JI9xhqpyKw9IBD+n
+hRJ79W9FaiJRvaAOX+TkyTukJrxAWRyv
+-----END CERTIFICATE-----
diff --git a/src/lib/libssl/src/test/smime-certs/smdsa2.pem b/src/lib/libssl/src/test/smime-certs/smdsa2.pem
new file mode 100644
index 0000000000..ef86c115d7
--- /dev/null
+++ b/src/lib/libssl/src/test/smime-certs/smdsa2.pem
@@ -0,0 +1,34 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBvAIBAAKBgQDFJfsIPOIawMO5biw+AoYUhNVxReBOLQosU3Qv4B8krac0BNr3
+OjSGLh1wZxHqhlAE0QmasTaKojuk20nNWeFnczSz6vDl0IVJEhS8VYor5kt9gLqt
+GcoAgsf4gRDIutJyQDaNn3IVY89uXUVIoexvQeLQDBCgQPC5O8rJdqBwtwIVAK2J
+jt+dqk07eQUE59koYUEKyNorAoGBAI4IEpusf8G14kCHmRtnHXM2tG5EWJDmW6Qt
+wjqvWp1GKUx5WFy1tVWR9nl5rL0Di+kNdENo+SkKj7h3uDulGOI6T0mQYbV2h1IK
++FMOGnOqvZ8eNTE2n4PGTo5puZ63LBm+QYrQsrNiUY4vakLFQ2rEK/SLwdsDFK4Z
+SJCBQw5zAoGBAIPmO8BtJ+Yac58trrPwq9b/6VW3jQTWzTLWSH84/QQdqQa+Pz3v
+It/+hHM0daNF5uls8ICsPL1aLXmRx0pHvIyb0aAzYae4T4Jv/COPDMTdKbA1uitJ
+VbkGZrm+LIrs7I9lOkb4T0vI6kL/XdOCXY1469zsqCgJ/O2ibn6mq0nWAhR716o2
+Nf8SimTZYB0/CKje6M5ufA==
+-----END DSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIDpTCCAw6gAwIBAgIJAMtotfHYdEsXMA0GCSqGSIb3DQEBBQUAMEQxCzAJBgNV
+BAYTAlVLMRYwFAYDVQQKEw1PcGVuU1NMIEdyb3VwMR0wGwYDVQQDExRUZXN0IFMv
+TUlNRSBSU0EgUm9vdDAeFw0wODAyMjIxMzUzMDlaFw0xNjA1MTAxMzUzMDlaMEUx
+CzAJBgNVBAYTAlVLMRYwFAYDVQQKDA1PcGVuU1NMIEdyb3VwMR4wHAYDVQQDDBVU
+ZXN0IFMvTUlNRSBFRSBEU0EgIzIwggG4MIIBLAYHKoZIzjgEATCCAR8CgYEAxSX7
+CDziGsDDuW4sPgKGFITVcUXgTi0KLFN0L+AfJK2nNATa9zo0hi4dcGcR6oZQBNEJ
+mrE2iqI7pNtJzVnhZ3M0s+rw5dCFSRIUvFWKK+ZLfYC6rRnKAILH+IEQyLrSckA2
+jZ9yFWPPbl1FSKHsb0Hi0AwQoEDwuTvKyXagcLcCFQCtiY7fnapNO3kFBOfZKGFB
+CsjaKwKBgQCOCBKbrH/BteJAh5kbZx1zNrRuRFiQ5lukLcI6r1qdRilMeVhctbVV
+kfZ5eay9A4vpDXRDaPkpCo+4d7g7pRjiOk9JkGG1dodSCvhTDhpzqr2fHjUxNp+D
+xk6OabmetywZvkGK0LKzYlGOL2pCxUNqxCv0i8HbAxSuGUiQgUMOcwOBhQACgYEA
+g+Y7wG0n5hpzny2us/Cr1v/pVbeNBNbNMtZIfzj9BB2pBr4/Pe8i3/6EczR1o0Xm
+6WzwgKw8vVoteZHHSke8jJvRoDNhp7hPgm/8I48MxN0psDW6K0lVuQZmub4siuzs
+j2U6RvhPS8jqQv9d04JdjXjr3OyoKAn87aJufqarSdajgYMwgYAwHQYDVR0OBBYE
+FHsAGNfVltSYUq4hC+YVYwsYtA+dMB8GA1UdIwQYMBaAFBPPS6e7iS6zOFcXdsab
+rWhb5e0XMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgbAMCAGA1UdEQQZMBeB
+FXNtaW1lZHNhMkBvcGVuc3NsLm9yZzANBgkqhkiG9w0BAQUFAAOBgQCx9BtCbaYF
+FXjLClkuKXbESaDZA1biPgY25i00FsUzARuhCpqD2v+0tu5c33ZzIhL6xlvBRU5l
+6Atw/xpZhae+hdBEtxPJoGekLLrHOau7Md3XwDjV4lFgcEJkWZoaSOOIK+4D5jF0
+jZWtHjnwEzuLYlo7ScHSsbcQfjH0M1TP5A==
+-----END CERTIFICATE-----
diff --git a/src/lib/libssl/src/test/smime-certs/smdsa3.pem b/src/lib/libssl/src/test/smime-certs/smdsa3.pem
new file mode 100644
index 0000000000..eeb848dabc
--- /dev/null
+++ b/src/lib/libssl/src/test/smime-certs/smdsa3.pem
@@ -0,0 +1,34 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBvAIBAAKBgQDFJfsIPOIawMO5biw+AoYUhNVxReBOLQosU3Qv4B8krac0BNr3
+OjSGLh1wZxHqhlAE0QmasTaKojuk20nNWeFnczSz6vDl0IVJEhS8VYor5kt9gLqt
+GcoAgsf4gRDIutJyQDaNn3IVY89uXUVIoexvQeLQDBCgQPC5O8rJdqBwtwIVAK2J
+jt+dqk07eQUE59koYUEKyNorAoGBAI4IEpusf8G14kCHmRtnHXM2tG5EWJDmW6Qt
+wjqvWp1GKUx5WFy1tVWR9nl5rL0Di+kNdENo+SkKj7h3uDulGOI6T0mQYbV2h1IK
++FMOGnOqvZ8eNTE2n4PGTo5puZ63LBm+QYrQsrNiUY4vakLFQ2rEK/SLwdsDFK4Z
+SJCBQw5zAoGAYzOpPmh8Je1IDauEXhgaLz14wqYUHHcrj2VWVJ6fRm8GhdQFJSI7
+GUk08pgKZSKic2lNqxuzW7/vFxKQ/nvzfytY16b+2i+BR4Q6yvMzCebE1hHVg0Ju
+TwfUMwoFEOhYP6ZwHSUiQl9IBMH9TNJCMwYMxfY+VOrURFsjGTRUgpwCFQCIGt5g
+Y+XZd0Sv69CatDIRYWvaIA==
+-----END DSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIDpDCCAw2gAwIBAgIJAMtotfHYdEsYMA0GCSqGSIb3DQEBBQUAMEQxCzAJBgNV
+BAYTAlVLMRYwFAYDVQQKEw1PcGVuU1NMIEdyb3VwMR0wGwYDVQQDExRUZXN0IFMv
+TUlNRSBSU0EgUm9vdDAeFw0wODAyMjIxMzUzMDlaFw0xNjA1MTAxMzUzMDlaMEUx
+CzAJBgNVBAYTAlVLMRYwFAYDVQQKDA1PcGVuU1NMIEdyb3VwMR4wHAYDVQQDDBVU
+ZXN0IFMvTUlNRSBFRSBEU0EgIzMwggG3MIIBLAYHKoZIzjgEATCCAR8CgYEAxSX7
+CDziGsDDuW4sPgKGFITVcUXgTi0KLFN0L+AfJK2nNATa9zo0hi4dcGcR6oZQBNEJ
+mrE2iqI7pNtJzVnhZ3M0s+rw5dCFSRIUvFWKK+ZLfYC6rRnKAILH+IEQyLrSckA2
+jZ9yFWPPbl1FSKHsb0Hi0AwQoEDwuTvKyXagcLcCFQCtiY7fnapNO3kFBOfZKGFB
+CsjaKwKBgQCOCBKbrH/BteJAh5kbZx1zNrRuRFiQ5lukLcI6r1qdRilMeVhctbVV
+kfZ5eay9A4vpDXRDaPkpCo+4d7g7pRjiOk9JkGG1dodSCvhTDhpzqr2fHjUxNp+D
+xk6OabmetywZvkGK0LKzYlGOL2pCxUNqxCv0i8HbAxSuGUiQgUMOcwOBhAACgYBj
+M6k+aHwl7UgNq4ReGBovPXjCphQcdyuPZVZUnp9GbwaF1AUlIjsZSTTymAplIqJz
+aU2rG7Nbv+8XEpD+e/N/K1jXpv7aL4FHhDrK8zMJ5sTWEdWDQm5PB9QzCgUQ6Fg/
+pnAdJSJCX0gEwf1M0kIzBgzF9j5U6tREWyMZNFSCnKOBgzCBgDAdBgNVHQ4EFgQU
+VhpVXqQ/EzUMdxLvP7o9EhJ8h70wHwYDVR0jBBgwFoAUE89Lp7uJLrM4Vxd2xput
+aFvl7RcwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwIAYDVR0RBBkwF4EV
+c21pbWVkc2EzQG9wZW5zc2wub3JnMA0GCSqGSIb3DQEBBQUAA4GBACM9e75EQa8m
+k/AZkH/tROqf3yeqijULl9x8FjFatqoY+29OM6oMGM425IqSkKd2ipz7OxO0SShu
+rE0O3edS7DvYBwvhWPviRaYBMyZ4iFJVup+fOzoYK/j/bASxS3BHQBwb2r4rhe25
+OlTyyFEk7DJyW18YFOG97S1P52oQ5f5x
+-----END CERTIFICATE-----
diff --git a/src/lib/libssl/src/test/smime-certs/smdsap.pem b/src/lib/libssl/src/test/smime-certs/smdsap.pem
new file mode 100644
index 0000000000..249706c8c7
--- /dev/null
+++ b/src/lib/libssl/src/test/smime-certs/smdsap.pem
@@ -0,0 +1,9 @@
+-----BEGIN DSA PARAMETERS-----
+MIIBHwKBgQDFJfsIPOIawMO5biw+AoYUhNVxReBOLQosU3Qv4B8krac0BNr3OjSG
+Lh1wZxHqhlAE0QmasTaKojuk20nNWeFnczSz6vDl0IVJEhS8VYor5kt9gLqtGcoA
+gsf4gRDIutJyQDaNn3IVY89uXUVIoexvQeLQDBCgQPC5O8rJdqBwtwIVAK2Jjt+d
+qk07eQUE59koYUEKyNorAoGBAI4IEpusf8G14kCHmRtnHXM2tG5EWJDmW6Qtwjqv
+Wp1GKUx5WFy1tVWR9nl5rL0Di+kNdENo+SkKj7h3uDulGOI6T0mQYbV2h1IK+FMO
+GnOqvZ8eNTE2n4PGTo5puZ63LBm+QYrQsrNiUY4vakLFQ2rEK/SLwdsDFK4ZSJCB
+Qw5z
+-----END DSA PARAMETERS-----
diff --git a/src/lib/libssl/src/test/smime-certs/smroot.pem b/src/lib/libssl/src/test/smime-certs/smroot.pem
new file mode 100644
index 0000000000..a59eb2684c
--- /dev/null
+++ b/src/lib/libssl/src/test/smime-certs/smroot.pem
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDBV1Z/Q5gPF7lojc8pKUdyz5+Jf2B3vs4he6egekugWnoJduki
+9Lnae/JchB/soIX0co3nLc11NuFFlnAWJNMDJr08l5AHAJLYNHevF5l/f9oDQwvZ
+speKh1xpIAJNqCTzVeQ/ZLx6/GccIXV/xDuKIiovqJTPgR5WPkYKaw++lQIDAQAB
+AoGALXnUj5SflJU4+B2652ydMKUjWl0KnL/VjkyejgGV/j6py8Ybaixz9q8Gv7oY
+JDlRqMC1HfZJCFQDQrHy5VJ+CywA/H9WrqKo/Ch9U4tJAZtkig1Cmay/BAYixVu0
+xBeim10aKF6hxHH4Chg9We+OCuzWBWJhqveNjuDedL/i7JUCQQDlejovcwBUCbhJ
+U12qKOwlaboolWbl7yF3XdckTJZg7+1UqQHZH5jYZlLZyZxiaC92SNV0SyTLJZnS
+Jh5CO+VDAkEA16/pPcuVtMMz/R6SSPpRSIAa1stLs0mFSs3NpR4pdm0n42mu05pO
+1tJEt3a1g7zkreQBf53+Dwb+lA841EkjRwJBAIFmt0DifKDnCkBu/jZh9SfzwsH3
+3Zpzik+hXxxdA7+ODCrdUul449vDd5zQD5t+XKU61QNLDGhxv5e9XvrCg7kCQH/a
+3ldsVF0oDaxxL+QkxoREtCQ5tLEd1u7F2q6Tl56FDE0pe6Ih6bQ8RtG+g9EI60IN
+U7oTrOO5kLWx5E0q4ccCQAZVgoenn9MhRU1agKOCuM6LT2DxReTu4XztJzynej+8
+0J93n3ebanB1MlRpn1XJwhQ7gAC8ImaQKLJK5jdJzFc=
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIICaTCCAdKgAwIBAgIJAP6VN47boiXRMA0GCSqGSIb3DQEBBQUAMEQxCzAJBgNV
+BAYTAlVLMRYwFAYDVQQKEw1PcGVuU1NMIEdyb3VwMR0wGwYDVQQDExRUZXN0IFMv
+TUlNRSBSU0EgUm9vdDAeFw0wODAyMjIxMzUzMDdaFw0xNjA1MTExMzUzMDdaMEQx
+CzAJBgNVBAYTAlVLMRYwFAYDVQQKEw1PcGVuU1NMIEdyb3VwMR0wGwYDVQQDExRU
+ZXN0IFMvTUlNRSBSU0EgUm9vdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
+wVdWf0OYDxe5aI3PKSlHcs+fiX9gd77OIXunoHpLoFp6CXbpIvS52nvyXIQf7KCF
+9HKN5y3NdTbhRZZwFiTTAya9PJeQBwCS2DR3rxeZf3/aA0ML2bKXiodcaSACTagk
+81XkP2S8evxnHCF1f8Q7iiIqL6iUz4EeVj5GCmsPvpUCAwEAAaNjMGEwHQYDVR0O
+BBYEFBPPS6e7iS6zOFcXdsabrWhb5e0XMB8GA1UdIwQYMBaAFBPPS6e7iS6zOFcX
+dsabrWhb5e0XMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqG
+SIb3DQEBBQUAA4GBAIECprq5viDvnDbkyOaiSr9ubMUmWqvycfAJMdPZRKcOZczS
+l+L9R9lF3JSqbt3knOe9u6bGDBOTY2285PdCCuHRVMk2Af1f6El1fqAlRUwNqipp
+r68sWFuRqrcRNtk6QQvXfkOhrqQBuDa7te/OVQLa2lGN9Dr2mQsD8ijctatG
+-----END CERTIFICATE-----
diff --git a/src/lib/libssl/src/test/smime-certs/smrsa1.pem b/src/lib/libssl/src/test/smime-certs/smrsa1.pem
new file mode 100644
index 0000000000..2cf3148e33
--- /dev/null
+++ b/src/lib/libssl/src/test/smime-certs/smrsa1.pem
@@ -0,0 +1,31 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXgIBAAKBgQC6A978j4pmPgUtUQqF+bjh6vdhwGOGZSD7xXgFTMjm88twfv+E
+ixkq2KXSDjD0ZXoQbdOaSbvGRQrIJpG2NGiKAFdYNrP025kCCdh5wF/aEI7KLEm7
+JlHwXpQsuj4wkMgmkFjL3Ty4Z55aNH+2pPQIa0k+ENJXm2gDuhqgBmduAwIDAQAB
+AoGBAJMuYu51aO2THyeHGwt81uOytcCbqGP7eoib62ZOJhxPRGYjpmuqX+R9/V5i
+KiwGavm63JYUx0WO9YP+uIZxm1BUATzkgkS74u5LP6ajhkZh6/Bck1oIYYkbVOXl
+JVrdENuH6U7nupznsyYgONByo+ykFPVUGmutgiaC7NMVo/MxAkEA6KLejWXdCIEn
+xr7hGph9NlvY9xuRIMexRV/WrddcFfCdjI1PciIupgrIkR65M9yr7atm1iU6/aRf
+KOr8rLZsSQJBAMyyXN71NsDNx4BP6rtJ/LJMP0BylznWkA7zWfGCbAYn9VhZVlSY
+Eu9Gyr7quD1ix7G3kInKVYOEEOpockBLz+sCQQCedyMmKjcQLfpMVYW8uhbAynvW
+h36qV5yXZxszO7nMcCTBsxhk5IfmLv5EbCs3+p9avCDGyoGOeUMg+kC33WORAkAg
+oUIarH4o5+SoeJTTfCzTA0KF9H5U0vYt2+73h7HOnWoHxl3zqDZEfEVvf50U8/0f
+QELDJETTbScBJtsnkq43AkEA38etvoZ2i4FJvvo7R/9gWBHVEcrGzcsCBYrNnIR1
+SZLRwHEGaiOK1wxMsWzqp7PJwL9z/M8A8DyOFBx3GPOniA==
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIICizCCAfSgAwIBAgIJAMtotfHYdEsTMA0GCSqGSIb3DQEBBQUAMEQxCzAJBgNV
+BAYTAlVLMRYwFAYDVQQKEw1PcGVuU1NMIEdyb3VwMR0wGwYDVQQDExRUZXN0IFMv
+TUlNRSBSU0EgUm9vdDAeFw0wODAyMjIxMzUzMDhaFw0xNjA1MTAxMzUzMDhaMEUx
+CzAJBgNVBAYTAlVLMRYwFAYDVQQKDA1PcGVuU1NMIEdyb3VwMR4wHAYDVQQDDBVU
+ZXN0IFMvTUlNRSBFRSBSU0EgIzEwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGB
+ALoD3vyPimY+BS1RCoX5uOHq92HAY4ZlIPvFeAVMyObzy3B+/4SLGSrYpdIOMPRl
+ehBt05pJu8ZFCsgmkbY0aIoAV1g2s/TbmQIJ2HnAX9oQjsosSbsmUfBelCy6PjCQ
+yCaQWMvdPLhnnlo0f7ak9AhrST4Q0lebaAO6GqAGZ24DAgMBAAGjgYMwgYAwHQYD
+VR0OBBYEFE2vMvKz5jrC7Lbdg68XwZ95iL/QMB8GA1UdIwQYMBaAFBPPS6e7iS6z
+OFcXdsabrWhb5e0XMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgXgMCAGA1Ud
+EQQZMBeBFXNtaW1lcnNhMUBvcGVuc3NsLm9yZzANBgkqhkiG9w0BAQUFAAOBgQAi
+O3GOkUl646oLnOimc36i9wxZ1tejsqs8vMjJ0Pym6Uq9FE2JoGzJ6OhB1GOsEVmj
+9cQ5UNQcRYL3cqOFtl6f4Dpu/lhzfbaqgmLjv29G1mS0uuTZrixhlyCXjwcbOkNC
+I/+wvHHENYIK5+T/79M9LaZ2Qk4F9MNE1VMljdz9Qw==
+-----END CERTIFICATE-----
diff --git a/src/lib/libssl/src/test/smime-certs/smrsa2.pem b/src/lib/libssl/src/test/smime-certs/smrsa2.pem
new file mode 100644
index 0000000000..d41f69c82f
--- /dev/null
+++ b/src/lib/libssl/src/test/smime-certs/smrsa2.pem
@@ -0,0 +1,31 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQCwBfryW4Vu5U9wNIDKspJO/N9YF4CcTlrCUyzVlKgb+8urHlSe
+59i5verR9IOCCXkemjOzZ/3nALTGqYZlnEvHp0Rjk+KdKXnKBIB+SRPpeu3LcXMT
+WPgsThPa0UQxedNKG0g6aG+kLhsDlFBCoxd09jJtSpb9jmroJOq0ZYEHLwIDAQAB
+AoGAKa/w4677Je1W5+r3SYoLDnvi5TkDs4D3C6ipKJgBTEdQz+DqB4w/DpZE4551
++rkFn1LDxcxuHGRVa+tAMhZW97fwq9YUbjVZEyOz79qrX+BMyl/NbHkf1lIKDo3q
+dWalzQvop7nbzeLC+VmmviwZfLQUbA61AQl3jm4dswT4XykCQQDloDadEv/28NTx
+bvvywvyGuvJkCkEIycm4JrIInvwsd76h/chZ3oymrqzc7hkEtK6kThqlS5y+WXl6
+QzPruTKTAkEAxD2ro/VUoN+scIVaLmn0RBmZ67+9Pdn6pNSfjlK3s0T0EM6/iUWS
+M06l6L9wFS3/ceu1tIifsh9BeqOGTa+udQJARIFnybTBaIqw/NZ/lA1YCVn8tpvY
+iyaoZ6gjtS65TQrsdKeh/i3HCHNUXxUpoZ3F/H7QtD+6o49ODou+EbVOwQJAVmex
+A2gp8wuJKaINqxIL81AybZLnCCzKJ3lXJ5tUNyLNM/lUbGStktm2Q1zHRQwTxV07
+jFn7trn8YrtNjzcjYQJAUKIJRt38A8Jw3HoPT+D0WS2IgxjVL0eYGsZX1lyeammG
+6rfnQ3u5uP7mEK2EH2o8mDUpAE0gclWBU9UkKxJsGA==
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIICizCCAfSgAwIBAgIJAMtotfHYdEsUMA0GCSqGSIb3DQEBBQUAMEQxCzAJBgNV
+BAYTAlVLMRYwFAYDVQQKEw1PcGVuU1NMIEdyb3VwMR0wGwYDVQQDExRUZXN0IFMv
+TUlNRSBSU0EgUm9vdDAeFw0wODAyMjIxMzUzMDhaFw0xNjA1MTAxMzUzMDhaMEUx
+CzAJBgNVBAYTAlVLMRYwFAYDVQQKDA1PcGVuU1NMIEdyb3VwMR4wHAYDVQQDDBVU
+ZXN0IFMvTUlNRSBFRSBSU0EgIzIwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGB
+ALAF+vJbhW7lT3A0gMqykk7831gXgJxOWsJTLNWUqBv7y6seVJ7n2Lm96tH0g4IJ
+eR6aM7Nn/ecAtMaphmWcS8enRGOT4p0pecoEgH5JE+l67ctxcxNY+CxOE9rRRDF5
+00obSDpob6QuGwOUUEKjF3T2Mm1Klv2Oaugk6rRlgQcvAgMBAAGjgYMwgYAwHQYD
+VR0OBBYEFIL/u+mEvaw7RuKLRuElfVkxSQjYMB8GA1UdIwQYMBaAFBPPS6e7iS6z
+OFcXdsabrWhb5e0XMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgXgMCAGA1Ud
+EQQZMBeBFXNtaW1lcnNhMkBvcGVuc3NsLm9yZzANBgkqhkiG9w0BAQUFAAOBgQC2
+rXR5bm/9RtOMQPleNpd3y6uUX3oy+0CafK5Yl3PMnItjjnKJ0l1/DbLbDj2twehe
+ewaB8CROcBCA3AMLSmGvPKgUCFMGtWam3328M4fBHzon5ka7qDXzM+imkAly/Yx2
+YNdR/aNOug+5sXygHmTSKqiCpQjOIClzXoPVVeEVHw==
+-----END CERTIFICATE-----
diff --git a/src/lib/libssl/src/test/smime-certs/smrsa3.pem b/src/lib/libssl/src/test/smime-certs/smrsa3.pem
new file mode 100644
index 0000000000..c8cbe55151
--- /dev/null
+++ b/src/lib/libssl/src/test/smime-certs/smrsa3.pem
@@ -0,0 +1,31 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQC6syTZtZNe1hRScFc4PUVyVLsr7+C1HDIZnOHmwFoLayX6RHwy
+ep/TkdwiPHnemVLuwvpSjLMLZkXy/J764kSHJrNeVl3UvmCVCOm40hAtK1+F39pM
+h8phkbPPD7i+hwq4/Vs79o46nzwbVKmzgoZBJhZ+codujUSYM3LjJ4aq+wIDAQAB
+AoGAE1Zixrnr3bLGwBMqtYSDIOhtyos59whImCaLr17U9MHQWS+mvYO98if1aQZi
+iQ/QazJ+wvYXxWJ+dEB+JvYwqrGeuAU6He/rAb4OShG4FPVU2D19gzRnaButWMeT
+/1lgXV08hegGBL7RQNaN7b0viFYMcKnSghleMP0/q+Y/oaECQQDkXEwDYJW13X9p
+ijS20ykWdY5lLknjkHRhhOYux0rlhOqsyMZjoUmwI2m0qj9yrIysKhrk4MZaM/uC
+hy0xp3hdAkEA0Uv/UY0Kwsgc+W6YxeypECtg1qCE6FBib8n4iFy/6VcWqhvE5xrs
+OdhKv9/p6aLjLneGd1sU+F8eS9LGyKIbNwJBAJPgbNzXA7uUZriqZb5qeTXxBDfj
+RLfXSHYKAKEULxz3+JvRHB9SR4yHMiFrCdExiZrHXUkPgYLSHLGG5a4824UCQD6T
+9XvhquUARkGCAuWy0/3Eqoihp/t6BWSdQ9Upviu7YUhtUxsyXo0REZB7F4pGrJx5
+GlhXgFaewgUzuUHFzlMCQCzJMMWslWpoLntnR6sMhBMhBFHSw+Y5CbxBmFrdtSkd
+VdtNO1VuDCTxjjW7W3Khj7LX4KZ1ye/5jfAgnnnXisc=
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIICizCCAfSgAwIBAgIJAMtotfHYdEsVMA0GCSqGSIb3DQEBBQUAMEQxCzAJBgNV
+BAYTAlVLMRYwFAYDVQQKEw1PcGVuU1NMIEdyb3VwMR0wGwYDVQQDExRUZXN0IFMv
+TUlNRSBSU0EgUm9vdDAeFw0wODAyMjIxMzUzMDlaFw0xNjA1MTAxMzUzMDlaMEUx
+CzAJBgNVBAYTAlVLMRYwFAYDVQQKDA1PcGVuU1NMIEdyb3VwMR4wHAYDVQQDDBVU
+ZXN0IFMvTUlNRSBFRSBSU0EgIzMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGB
+ALqzJNm1k17WFFJwVzg9RXJUuyvv4LUcMhmc4ebAWgtrJfpEfDJ6n9OR3CI8ed6Z
+Uu7C+lKMswtmRfL8nvriRIcms15WXdS+YJUI6bjSEC0rX4Xf2kyHymGRs88PuL6H
+Crj9Wzv2jjqfPBtUqbOChkEmFn5yh26NRJgzcuMnhqr7AgMBAAGjgYMwgYAwHQYD
+VR0OBBYEFDsSFjNtYZzd0tTHafNS7tneQQj6MB8GA1UdIwQYMBaAFBPPS6e7iS6z
+OFcXdsabrWhb5e0XMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgXgMCAGA1Ud
+EQQZMBeBFXNtaW1lcnNhM0BvcGVuc3NsLm9yZzANBgkqhkiG9w0BAQUFAAOBgQBE
+tUDB+1Dqigu4p1xtdq7JRK6S+gfA7RWmhz0j2scb2zhpS12h37JLHsidGeKAzZYq
+jUjOrH/j3xcV5AnuJoqImJaN23nzzxtR4qGGX2mrq6EtObzdEGgCUaizsGM+0slJ
+PYxcy8KeY/63B1BpYhj2RjGkL6HrvuAaxVORa3acoA==
+-----END CERTIFICATE-----
diff --git a/src/lib/libssl/src/util/copy.pl b/src/lib/libssl/src/util/copy.pl
new file mode 100644
index 0000000000..e20b45530a
--- /dev/null
+++ b/src/lib/libssl/src/util/copy.pl
@@ -0,0 +1,59 @@
+#!/usr/local/bin/perl
+
+use Fcntl;
+
+
+# copy.pl
+
+# Perl script 'copy' comment. On Windows the built in "copy" command also
+# copies timestamps: this messes up Makefile dependencies.
+
+my $arg;
+
+foreach $arg (@ARGV) {
+        $arg =~ s|\\|/|g;       # compensate for bug/feature in cygwin glob...
+        foreach (glob $arg)
+                {
+                push @filelist, $_;
+                }
+}
+
+$fnum = @filelist;
+
+if ($fnum <= 1)
+        {
+        die "Need at least two filenames";
+        }
+
+$dest = pop @filelist;
+        
+if ($fnum > 2 && ! -d $dest)
+        {
+        die "Destination must be a directory";
+        }
+
+foreach (@filelist)
+        {
+        if (-d $dest)
+                {
+                $dfile = $_;
+                $dfile =~ s|^.*[/\\]([^/\\]*)$|$1|;
+                $dfile = "$dest/$dfile";
+                }
+        else
+                {
+                $dfile = $dest;
+                }
+        sysopen(IN, $_, O_RDONLY|O_BINARY) || die "Can't Open $_";
+        sysopen(OUT, $dfile, O_WRONLY|O_CREAT|O_TRUNC|O_BINARY)
+                                        || die "Can't Open $dfile";
+        while (sysread IN, $buf, 10240)
+                {
+                syswrite(OUT, $buf, length($buf));
+                }
+        close(IN);
+        close(OUT);
+        print "Copying: $_ to $dfile\n";
+        }
+                
+
diff --git a/src/lib/libssl/src/util/extract-section.pl b/src/lib/libssl/src/util/extract-section.pl
new file mode 100644
index 0000000000..7a0ba4f69a
--- /dev/null
+++ b/src/lib/libssl/src/util/extract-section.pl
@@ -0,0 +1,12 @@
+#!/usr/bin/perl
+
+while(<STDIN>) {
+        if (/=for\s+comment\s+openssl_manual_section:(\S+)/)
+                {
+                print "$1\n";
+                exit 0;
+                }
+}
+
+print "$ARGV[0]\n";
+
diff --git a/src/lib/libssl/src/util/pl/netware.pl b/src/lib/libssl/src/util/pl/netware.pl
new file mode 100644
index 0000000000..173c9919f2
--- /dev/null
+++ b/src/lib/libssl/src/util/pl/netware.pl
@@ -0,0 +1,526 @@
+# Metrowerks Codewarrior or gcc / nlmconv for NetWare
+#
+
+$version_header = "crypto/opensslv.h";
+open(IN, "$version_header") or die "Couldn't open $version_header: $!";
+while (<IN>) {
+  if (/^#define[\s\t]+OPENSSL_VERSION_NUMBER[\s\t]+0x(\d)(\d{2})(\d{2})(\d{2})/)
+  {
+    # die "OpenSSL version detected: $1.$2.$3.$4\n";
+    #$nlmvernum = "$1,$2,$3";
+    $nlmvernum = "$1,".($2*10+$3).",".($4*1);
+    #$nlmverstr = "$1.".($2*1).".".($3*1).($4?(chr(96+$4)):"");
+    break;
+  }
+}
+close(IN) or die "Couldn't close $version_header: $!";
+
+$readme_file = "README";
+open(IN, $readme_file) or die "Couldn't open $readme_file: $!";
+while (<IN>) {
+  if (/^[\s\t]+OpenSSL[\s\t]+(\d)\.(\d{1,2})\.(\d{1,2})([a-z])(.*)/)
+  {
+    #$nlmvernum = "$1,$2,$3";
+    #$nlmvernum = "$1,".($2*10+$3).",".($4*1);
+    $nlmverstr = "$1.$2.$3$4$5";
+  }
+  elsif (/^[\s\t]+(Copyright \(c\) \d{4}\-\d{4} The OpenSSL Project)$/)
+  {
+    $nlmcpystr = $1;
+  }
+  break if ($nlmvernum && $nlmcpystr);
+}
+close(IN) or die "Couldn't close $readme_file: $!";
+
+# Define stacksize here
+$nlmstack = "32768";
+
+# some default settings here in case we failed to find them in README
+$nlmvernum = "1,0,0" if (!$nlmvernum);
+$nlmverstr = "OpenSSL" if (!$nlmverstr);
+$nlmcpystr = "Copyright (c) 1998-now The OpenSSL Project" if (!$nlmcpystr);
+
+# die "OpenSSL copyright: $nlmcpystr\nOpenSSL verstring: $nlmverstr\nOpenSSL vernumber: $nlmvernum\n";
+
+# The import files and other misc imports needed to link
+@misc_imports = ("GetProcessSwitchCount", "RunningProcess",
+                 "GetSuperHighResolutionTimer");
+if ($LIBC)
+{
+   @import_files = ("libc.imp");
+   @module_files = ("libc");
+   $libarch = "LIBC";
+}
+else
+{
+   # clib build
+   @import_files = ("clib.imp");
+   push(@import_files, "socklib.imp") if ($BSDSOCK);
+   @module_files = ("clib");
+   # push(@misc_imports, "_rt_modu64%16", "_rt_divu64%16");
+   $libarch = "CLIB";
+}
+if ($BSDSOCK)
+{
+   $libarch .= "-BSD";
+}
+else
+{
+   $libarch .= "-WS2";
+   push(@import_files, "ws2nlm.imp");
+}
+
+# The "IMPORTS" environment variable must be set and point to the location
+# where import files (*.imp) can be found.
+# Example:  set IMPORTS=c:\ndk\nwsdk\imports
+$import_path = $ENV{"IMPORTS"} || die ("IMPORTS environment variable not set\n");
+
+
+# The "PRELUDE" environment variable must be set and point to the location
+# and name of the prelude source to link with ( nwpre.obj is recommended ).
+# Example: set PRELUDE=c:\codewar\novell support\metrowerks support\libraries\runtime\nwpre.obj
+$prelude = $ENV{"PRELUDE"} || die ("PRELUDE environment variable not set\n");
+
+# The "INCLUDES" environment variable must be set and point to the location
+# where import files (*.imp) can be found.
+$include_path = $ENV{"INCLUDE"} || die ("INCLUDES environment variable not set\n");
+$include_path =~ s/\\/\//g;
+$include_path = join(" -I", split(/;/, $include_path));
+
+# check for gcc compiler
+$gnuc = $ENV{"GNUC"};
+
+#$ssl=   "ssleay32";
+#$crypto="libeay32";
+
+if ($gnuc)
+{
+   # C compiler
+   $cc='gcc';
+   # Linker
+   $link='nlmconv';
+   # librarian
+   $mklib='ar';
+   $o='/';
+   # cp command
+   $cp='cp -af';
+   # rm command
+   $rm='rm -f';
+   # mv command
+   $mv='mv -f';
+   # mkdir command
+   $mkdir='gmkdir';
+   #$ranlib='ranlib';
+}
+else
+{
+   # C compiler
+   $cc='mwccnlm';
+   # Linker
+   $link='mwldnlm';
+   # librarian
+   $mklib='mwldnlm';
+   # Path separator
+   $o='\\';
+   # cp command
+   $cp='copy >nul:';
+   # rm command
+   $rm='del /f /q';
+}
+
+# assembler
+if ($nw_nasm)
+{
+   if ($gnuc)
+   {
+      $asm="nasmw -s -f elf";
+   }
+   else
+   {
+      $asm="nasmw -s -f coff";
+   }
+   $afile="-o ";
+   $asm.=" -g" if $debug;
+}
+elsif ($nw_mwasm)
+{
+   $asm="mwasmnlm -maxerrors 20";
+   $afile="-o ";
+   $asm.=" -g" if $debug;
+}
+elsif ($nw_masm)
+{
+# masm assembly settings - it should be possible to use masm but haven't
+# got it working.
+# $asm='ml /Cp /coff /c /Cx';
+# $asm.=" /Zi" if $debug;
+# $afile='/Fo';
+   die("Support for masm assembler not yet functional\n");
+}
+else
+{
+   $asm="";
+   $afile="";
+}
+
+
+
+if ($gnuc)
+{
+   # compile flags for GNUC
+   # additional flags based upon debug | non-debug
+   if ($debug)
+   {
+      $cflags="-g -DDEBUG";
+   }
+   else
+   {
+      $cflags="-O2";
+   }
+   $cflags.=" -nostdinc -I$include_path \\
+         -fno-builtin -fpcc-struct-return -fno-strict-aliasing \\
+         -funsigned-char -Wall -Wno-unused -Wno-uninitialized";
+
+   # link flags
+   $lflags="-T";
+}
+else
+{
+   # compile flags for CodeWarrior
+   # additional flags based upon debug | non-debug
+   if ($debug)
+   {
+      $cflags="-opt off -g -sym internal -DDEBUG";
+   }
+   else
+   {
+   # CodeWarrior compiler has a problem with optimizations for floating
+   # points - no optimizations until further investigation
+   #      $cflags="-opt all";
+   }
+
+   # NOTES: Several c files in the crypto subdirectory include headers from
+   #        their local directories.  Metrowerks wouldn't find these h files
+   #        without adding individual include directives as compile flags
+   #        or modifying the c files.  Instead of adding individual include
+   #        paths for each subdirectory a recursive include directive
+   #        is used ( -ir crypto ).
+   #
+   #        A similar issue exists for the engines and apps subdirectories.
+   #
+   #        Turned off the "possible" warnings ( -w nopossible ).  Metrowerks
+   #        complained a lot about various stuff.  May want to turn back
+   #        on for further development.
+   $cflags.=" -nostdinc -ir crypto -ir engines -ir apps -I$include_path \\
+         -msgstyle gcc -align 4 -processor pentium -char unsigned \\
+         -w on -w nolargeargs -w nopossible -w nounusedarg -w nounusedexpr \\
+         -w noimplicitconv -relax_pointers -nosyspath -maxerrors 20";
+
+   # link flags
+   $lflags="-msgstyle gcc -zerobss -nostdlib -sym internal -commandfile";
+}
+
+# common defines
+$cflags.=" -DL_ENDIAN -DOPENSSL_SYSNAME_NETWARE -U_WIN32";
+
+# If LibC build add in NKS_LIBC define and set the entry/exit
+# routines - The default entry/exit routines are for CLib and don't exist
+# in LibC
+if ($LIBC)
+{
+   $cflags.=" -DNETWARE_LIBC";
+   $nlmstart = "_LibCPrelude";
+   $nlmexit = "_LibCPostlude";
+   @nlm_flags = ("pseudopreemption", "flag_on 64");
+}
+else
+{
+   $cflags.=" -DNETWARE_CLIB";
+   $nlmstart = "_Prelude";
+   $nlmexit = "_Stop";
+}
+
+# If BSD Socket support is requested, set a define for the compiler
+if ($BSDSOCK)
+{
+   $cflags.=" -DNETWARE_BSDSOCK";
+   if (!$LIBC)
+   {
+      $cflags.=" -DNETDB_USE_INTERNET";
+   }
+}
+
+
+# linking stuff
+# for the output directories use the mk1mf.pl values with "_nw" appended
+if ($shlib)
+{
+   if ($LIBC)
+   {
+      $out_def.="_nw_libc_nlm";
+      $tmp_def.="_nw_libc_nlm";
+      $inc_def.="_nw_libc_nlm";
+   }
+   else  # NETWARE_CLIB
+   {
+      $out_def.="_nw_clib_nlm";
+      $tmp_def.="_nw_clib_nlm";
+      $inc_def.="_nw_clib_nlm";
+   }
+}
+else
+{
+   if ($gnuc) # GNUC Tools
+   {
+      $libp=".a";
+      $shlibp=".a";
+      $lib_flags="-cr";
+   }
+   else       # CodeWarrior
+   {
+      $libp=".lib";
+      $shlibp=".lib";
+      $lib_flags="-nodefaults -type library -o";
+   }
+   if ($LIBC)
+   {
+      $out_def.="_nw_libc";
+      $tmp_def.="_nw_libc";
+      $inc_def.="_nw_libc";
+   }
+   else  # NETWARE_CLIB
+   {
+      $out_def.="_nw_clib";
+      $tmp_def.="_nw_clib";
+      $inc_def.="_nw_clib";
+   }
+}
+
+# used by mk1mf.pl
+$obj='.o';
+$ofile='-o ';
+$efile='';
+$exep='.nlm';
+$ex_libs='';
+
+if (!$no_asm)
+{
+   $bn_asm_obj="\$(OBJ_D)${o}bn-nw${obj}";
+   $bn_asm_src="crypto${o}bn${o}asm${o}bn-nw.asm";
+   $bnco_asm_obj="\$(OBJ_D)${o}co-nw${obj}";
+   $bnco_asm_src="crypto${o}bn${o}asm${o}co-nw.asm";
+   $aes_asm_obj="\$(OBJ_D)${o}a-nw${obj}";
+   $aes_asm_src="crypto${o}aes${o}asm${o}a-nw.asm";
+   $des_enc_obj="\$(OBJ_D)${o}d-nw${obj} \$(OBJ_D)${o}y-nw${obj}";
+   $des_enc_src="crypto${o}des${o}asm${o}d-nw.asm crypto${o}des${o}asm${o}y-nw.asm";
+   $bf_enc_obj="\$(OBJ_D)${o}b-nw${obj}";
+   $bf_enc_src="crypto${o}bf${o}asm${o}b-nw.asm";
+   $cast_enc_obj="\$(OBJ_D)${o}c-nw${obj}";
+   $cast_enc_src="crypto${o}cast${o}asm${o}c-nw.asm";
+   $rc4_enc_obj="\$(OBJ_D)${o}r4-nw${obj}";
+   $rc4_enc_src="crypto${o}rc4${o}asm${o}r4-nw.asm";
+   $rc5_enc_obj="\$(OBJ_D)${o}r5-nw${obj}";
+   $rc5_enc_src="crypto${o}rc5${o}asm${o}r5-nw.asm";
+   $md5_asm_obj="\$(OBJ_D)${o}m5-nw${obj}";
+   $md5_asm_src="crypto${o}md5${o}asm${o}m5-nw.asm";
+   $sha1_asm_obj="\$(OBJ_D)${o}s1-nw${obj}";
+   $sha1_asm_src="crypto${o}sha${o}asm${o}s1-nw.asm";
+   $rmd160_asm_obj="\$(OBJ_D)${o}rm-nw${obj}";
+   $rmd160_asm_src="crypto${o}ripemd${o}asm${o}rm-nw.asm";
+   $cpuid_asm_obj="\$(OBJ_D)${o}x86cpuid-nw${obj}";
+   $cpuid_asm_src="crypto${o}x86cpuid-nw.asm";
+   $cflags.=" -DOPENSSL_CPUID_OBJ -DBN_ASM -DOPENSSL_BN_ASM_PART_WORDS -DMD5_ASM -DSHA1_ASM";
+   $cflags.=" -DAES_ASM -DRMD160_ASM";
+}
+else
+{
+   $bn_asm_obj='';
+   $bn_asm_src='';
+   $bnco_asm_obj='';
+   $bnco_asm_src='';
+   $aes_asm_obj='';
+   $aes_asm_src='';
+   $des_enc_obj='';
+   $des_enc_src='';
+   $bf_enc_obj='';
+   $bf_enc_src='';
+   $cast_enc_obj='';
+   $cast_enc_src='';
+   $rc4_enc_obj='';
+   $rc4_enc_src='';
+   $rc5_enc_obj='';
+   $rc5_enc_src='';
+   $md5_asm_obj='';
+   $md5_asm_src='';
+   $sha1_asm_obj='';
+   $sha1_asm_src='';
+   $rmd160_asm_obj='';
+   $rmd160_asm_src='';
+   $cpuid_asm_obj='';
+   $cpuid_asm_src='';
+}
+
+# create the *.def linker command files in \openssl\netware\ directory
+sub do_def_file
+{
+   # strip off the leading path
+   my($target) = bname(shift);
+   my($i);
+
+   if ($target =~ /(.*).nlm/)
+   {
+      $target = $1;
+   }
+
+   # special case for openssl - the mk1mf.pl defines E_EXE = openssl
+   if ($target =~ /E_EXE/)
+   {
+      $target =~ s/\$\(E_EXE\)/openssl/;
+   }
+
+   # Note: originally tried to use full path ( \openssl\netware\$target.def )
+   # Metrowerks linker choked on this with an assertion failure. bug???
+   #
+   my($def_file) = "netware${o}$target.def";
+
+   open(DEF_OUT, ">$def_file") || die("unable to open file $def_file\n");
+
+   print( DEF_OUT "# command file generated by netware.pl for NLM target.\n" );
+   print( DEF_OUT "# do not edit this file - all your changes will be lost!!\n" );
+   print( DEF_OUT "#\n");
+   print( DEF_OUT "DESCRIPTION \"$target ($libarch) - OpenSSL $nlmverstr\"\n");
+   print( DEF_OUT "COPYRIGHT \"$nlmcpystr\"\n");
+   print( DEF_OUT "VERSION $nlmvernum\n");
+   print( DEF_OUT "STACK $nlmstack\n");
+   print( DEF_OUT "START $nlmstart\n");
+   print( DEF_OUT "EXIT $nlmexit\n");
+
+   # special case for openssl
+   if ($target eq "openssl")
+   {
+      print( DEF_OUT "SCREENNAME \"OpenSSL $nlmverstr\"\n");
+   }
+   else
+   {
+      print( DEF_OUT "SCREENNAME \"DEFAULT\"\n");
+   }
+
+   foreach $i (@misc_imports)
+   {
+      print( DEF_OUT "IMPORT $i\n");
+   }
+
+   foreach $i (@import_files)
+   {
+      print( DEF_OUT "IMPORT \@$import_path${o}$i\n");
+   }
+
+   foreach $i (@module_files)
+   {
+      print( DEF_OUT "MODULE $i\n");
+   }
+
+   foreach $i (@nlm_flags)
+   {
+      print( DEF_OUT "$i\n");
+   }
+
+   if ($gnuc)
+   {
+      if ($target =~ /openssl/)
+      {
+         print( DEF_OUT "INPUT ${tmp_def}${o}openssl${obj}\n");
+         print( DEF_OUT "INPUT ${tmp_def}${o}openssl${libp}\n");
+      }
+      else
+      {
+         print( DEF_OUT "INPUT ${tmp_def}${o}${target}${obj}\n");
+      }
+      print( DEF_OUT "INPUT $prelude\n");
+      print( DEF_OUT "INPUT ${out_def}${o}${ssl}${libp} ${out_def}${o}${crypto}${libp}\n");
+      print( DEF_OUT "OUTPUT $target.nlm\n");
+   }
+
+   close(DEF_OUT);
+   return($def_file);
+}
+
+sub do_lib_rule
+{
+   my($objs,$target,$name,$shlib)=@_;
+   my($ret);
+
+   $ret.="$target: $objs\n";
+   if (!$shlib)
+   {
+      $ret.="\t\@echo Building Lib: $name\n";
+      $ret.="\t\$(MKLIB) $lib_flags $target $objs\n";
+      $ret.="\t\@echo .\n"
+   }
+   else
+   {
+      die( "Building as NLM not currently supported!" );
+   }
+
+   $ret.="\n";
+   return($ret);
+}
+
+sub do_link_rule
+{
+   my($target,$files,$dep_libs,$libs)=@_;
+   my($ret);
+   my($def_file) = do_def_file($target);
+
+   $ret.="$target: $files $dep_libs\n";
+
+   # NOTE:  When building the test nlms no screen name is given
+   #  which causes the console screen to be used.  By using the console
+   #  screen there is no "<press any key to continue>" message which
+   #  requires user interaction.  The test script ( do_tests.pl ) needs
+   #  to be able to run the tests without requiring user interaction.
+   #
+   #  However, the sample program "openssl.nlm" is used by the tests and is
+   #  a interactive sample so a screen is desired when not be run by the
+   #  tests.  To solve the problem, two versions of the program are built:
+   #    openssl2 - no screen used by tests
+   #    openssl - default screen - use for normal interactive modes
+   #
+
+   # special case for openssl - the mk1mf.pl defines E_EXE = openssl
+   if ($target =~ /E_EXE/)
+   {
+      my($target2) = $target;
+
+      $target2 =~ s/\(E_EXE\)/\(E_EXE\)2/;
+
+      # openssl2
+      my($def_file2) = do_def_file($target2);
+
+      if ($gnuc)
+      {
+         $ret.="\t\$(MKLIB) $lib_flags \$(TMP_D)${o}\$(E_EXE).a \$(filter-out \$(TMP_D)${o}\$(E_EXE)${obj},$files)\n";
+         $ret.="\t\$(LINK) \$(LFLAGS) $def_file2\n";
+         $ret.="\t\@$mv \$(E_EXE)2.nlm \$(TEST_D)\n";
+      }
+      else
+      {
+         $ret.="\t\$(LINK) \$(LFLAGS) $def_file2 $files \"$prelude\" $libs -o $target2\n";
+      }
+   }
+   if ($gnuc)
+   {
+      $ret.="\t\$(LINK) \$(LFLAGS) $def_file\n";
+      $ret.="\t\@$mv \$(\@F) \$(TEST_D)\n";
+   }
+   else
+   {
+      $ret.="\t\$(LINK) \$(LFLAGS) $def_file $files \"$prelude\" $libs -o $target\n";
+   }
+
+   $ret.="\n";
+   return($ret);
+
+}
+
+1;
diff --git a/src/lib/libssl/test/igetest.c b/src/lib/libssl/test/igetest.c
new file mode 100644
index 0000000000..95452d0965
--- /dev/null
+++ b/src/lib/libssl/test/igetest.c
@@ -0,0 +1,503 @@
+/* test/igetest.c -*- mode:C; c-file-style: "eay" -*- */
+/* ====================================================================
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+
+#include <openssl/aes.h>
+#include <openssl/rand.h>
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+
+#define TEST_SIZE       128
+#define BIG_TEST_SIZE 10240
+
+static void hexdump(FILE *f,const char *title,const unsigned char *s,int l)
+    {
+    int n=0;
+
+    fprintf(f,"%s",title);
+    for( ; n < l ; ++n)
+                {
+                if((n%16) == 0)
+                        fprintf(f,"\n%04x",n);
+                fprintf(f," %02x",s[n]);
+                }
+    fprintf(f,"\n");
+    }
+
+#define MAX_VECTOR_SIZE 64
+
+struct ige_test
+        {
+        const unsigned char key[16];
+        const unsigned char iv[32];
+        const unsigned char in[MAX_VECTOR_SIZE];
+        const unsigned char out[MAX_VECTOR_SIZE];
+        const size_t length;
+        const int encrypt;
+        };
+
+static struct ige_test const ige_test_vectors[] = {
+{ { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f }, /* key */
+  { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+    0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+    0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f }, /* iv */
+  { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, /* in */
+  { 0x1a, 0x85, 0x19, 0xa6, 0x55, 0x7b, 0xe6, 0x52,
+    0xe9, 0xda, 0x8e, 0x43, 0xda, 0x4e, 0xf4, 0x45,
+    0x3c, 0xf4, 0x56, 0xb4, 0xca, 0x48, 0x8a, 0xa3,
+    0x83, 0xc7, 0x9c, 0x98, 0xb3, 0x47, 0x97, 0xcb }, /* out */
+  32, AES_ENCRYPT }, /* test vector 0 */
+
+{ { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20,
+    0x61, 0x6e, 0x20, 0x69, 0x6d, 0x70, 0x6c, 0x65 }, /* key */
+  { 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f,
+    0x6e, 0x20, 0x6f, 0x66, 0x20, 0x49, 0x47, 0x45,
+    0x20, 0x6d, 0x6f, 0x64, 0x65, 0x20, 0x66, 0x6f,
+    0x72, 0x20, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x53 }, /* iv */
+  { 0x4c, 0x2e, 0x20, 0x4c, 0x65, 0x74, 0x27, 0x73,
+    0x20, 0x68, 0x6f, 0x70, 0x65, 0x20, 0x42, 0x65,
+    0x6e, 0x20, 0x67, 0x6f, 0x74, 0x20, 0x69, 0x74,
+    0x20, 0x72, 0x69, 0x67, 0x68, 0x74, 0x21, 0x0a }, /* in */
+  { 0x99, 0x70, 0x64, 0x87, 0xa1, 0xcd, 0xe6, 0x13,
+    0xbc, 0x6d, 0xe0, 0xb6, 0xf2, 0x4b, 0x1c, 0x7a,
+    0xa4, 0x48, 0xc8, 0xb9, 0xc3, 0x40, 0x3e, 0x34,
+    0x67, 0xa8, 0xca, 0xd8, 0x93, 0x40, 0xf5, 0x3b }, /* out */
+  32, AES_DECRYPT }, /* test vector 1 */
+};
+
+struct bi_ige_test
+        {
+        const unsigned char key1[32];
+        const unsigned char key2[32];
+        const unsigned char iv[64];
+        const unsigned char in[MAX_VECTOR_SIZE];
+        const unsigned char out[MAX_VECTOR_SIZE];
+        const size_t keysize;
+        const size_t length;
+        const int encrypt;
+        };
+
+static struct bi_ige_test const bi_ige_test_vectors[] = {
+{ { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f }, /* key1 */
+  { 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+    0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f }, /* key2 */
+  { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+    0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+    0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+    0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+    0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+    0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+    0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f }, /* iv */
+  { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, /* in */
+  { 0x14, 0x40, 0x6f, 0xae, 0xa2, 0x79, 0xf2, 0x56,
+        0x1f, 0x86, 0xeb, 0x3b, 0x7d, 0xff, 0x53, 0xdc,
+        0x4e, 0x27, 0x0c, 0x03, 0xde, 0x7c, 0xe5, 0x16,
+        0x6a, 0x9c, 0x20, 0x33, 0x9d, 0x33, 0xfe, 0x12 }, /* out */
+  16, 32, AES_ENCRYPT }, /* test vector 0 */
+{ { 0x58, 0x0a, 0x06, 0xe9, 0x97, 0x07, 0x59, 0x5c,
+        0x9e, 0x19, 0xd2, 0xa7, 0xbb, 0x40, 0x2b, 0x7a,
+        0xc7, 0xd8, 0x11, 0x9e, 0x4c, 0x51, 0x35, 0x75,
+        0x64, 0x28, 0x0f, 0x23, 0xad, 0x74, 0xac, 0x37 }, /* key1 */
+  { 0xd1, 0x80, 0xa0, 0x31, 0x47, 0xa3, 0x11, 0x13,
+        0x86, 0x26, 0x9e, 0x6d, 0xff, 0xaf, 0x72, 0x74,
+        0x5b, 0xa2, 0x35, 0x81, 0xd2, 0xa6, 0x3d, 0x21,
+        0x67, 0x7b, 0x58, 0xa8, 0x18, 0xf9, 0x72, 0xe4 }, /* key2 */
+  { 0x80, 0x3d, 0xbd, 0x4c, 0xe6, 0x7b, 0x06, 0xa9,
+        0x53, 0x35, 0xd5, 0x7e, 0x71, 0xc1, 0x70, 0x70,
+        0x74, 0x9a, 0x00, 0x28, 0x0c, 0xbf, 0x6c, 0x42,
+        0x9b, 0xa4, 0xdd, 0x65, 0x11, 0x77, 0x7c, 0x67,
+        0xfe, 0x76, 0x0a, 0xf0, 0xd5, 0xc6, 0x6e, 0x6a,
+        0xe7, 0x5e, 0x4c, 0xf2, 0x7e, 0x9e, 0xf9, 0x20,
+        0x0e, 0x54, 0x6f, 0x2d, 0x8a, 0x8d, 0x7e, 0xbd,
+        0x48, 0x79, 0x37, 0x99, 0xff, 0x27, 0x93, 0xa3 }, /* iv */
+  { 0xf1, 0x54, 0x3d, 0xca, 0xfe, 0xb5, 0xef, 0x1c,
+        0x4f, 0xa6, 0x43, 0xf6, 0xe6, 0x48, 0x57, 0xf0,
+        0xee, 0x15, 0x7f, 0xe3, 0xe7, 0x2f, 0xd0, 0x2f,
+        0x11, 0x95, 0x7a, 0x17, 0x00, 0xab, 0xa7, 0x0b,
+        0xbe, 0x44, 0x09, 0x9c, 0xcd, 0xac, 0xa8, 0x52,
+        0xa1, 0x8e, 0x7b, 0x75, 0xbc, 0xa4, 0x92, 0x5a,
+        0xab, 0x46, 0xd3, 0x3a, 0xa0, 0xd5, 0x35, 0x1c,
+        0x55, 0xa4, 0xb3, 0xa8, 0x40, 0x81, 0xa5, 0x0b}, /* in */
+  { 0x42, 0xe5, 0x28, 0x30, 0x31, 0xc2, 0xa0, 0x23,
+        0x68, 0x49, 0x4e, 0xb3, 0x24, 0x59, 0x92, 0x79,
+        0xc1, 0xa5, 0xcc, 0xe6, 0x76, 0x53, 0xb1, 0xcf,
+        0x20, 0x86, 0x23, 0xe8, 0x72, 0x55, 0x99, 0x92,
+        0x0d, 0x16, 0x1c, 0x5a, 0x2f, 0xce, 0xcb, 0x51,
+        0xe2, 0x67, 0xfa, 0x10, 0xec, 0xcd, 0x3d, 0x67,
+        0xa5, 0xe6, 0xf7, 0x31, 0x26, 0xb0, 0x0d, 0x76,
+        0x5e, 0x28, 0xdc, 0x7f, 0x01, 0xc5, 0xa5, 0x4c}, /* out */
+  32, 64, AES_ENCRYPT }, /* test vector 1 */
+
+};
+
+static int run_test_vectors(void)
+        {
+        int n;
+        int errs = 0;
+
+        for(n=0 ; n < sizeof(ige_test_vectors)/sizeof(ige_test_vectors[0]) ; ++n)
+                {
+                const struct ige_test * const v = &ige_test_vectors[n];
+                AES_KEY key;
+                unsigned char buf[MAX_VECTOR_SIZE];
+                unsigned char iv[AES_BLOCK_SIZE*2];
+
+                assert(v->length <= MAX_VECTOR_SIZE);
+
+                if(v->encrypt == AES_ENCRYPT)
+                        AES_set_encrypt_key(v->key, 8*sizeof v->key, &key);
+                else
+                        AES_set_decrypt_key(v->key, 8*sizeof v->key, &key);
+                memcpy(iv, v->iv, sizeof iv);
+                AES_ige_encrypt(v->in, buf, v->length, &key, iv, v->encrypt);
+
+                if(memcmp(v->out, buf, v->length))
+                        {
+                        printf("IGE test vector %d failed\n", n);
+                        hexdump(stdout, "key", v->key, sizeof v->key);
+                        hexdump(stdout, "iv", v->iv, sizeof v->iv);
+                        hexdump(stdout, "in", v->in, v->length);
+                        hexdump(stdout, "expected", v->out, v->length);
+                        hexdump(stdout, "got", buf, v->length);
+
+                        ++errs;
+                        }
+
+                /* try with in == out */
+                memcpy(iv, v->iv, sizeof iv);
+                memcpy(buf, v->in, v->length);
+                AES_ige_encrypt(buf, buf, v->length, &key, iv, v->encrypt);
+
+                if(memcmp(v->out, buf, v->length))
+                        {
+                        printf("IGE test vector %d failed (with in == out)\n", n);
+                        hexdump(stdout, "key", v->key, sizeof v->key);
+                        hexdump(stdout, "iv", v->iv, sizeof v->iv);
+                        hexdump(stdout, "in", v->in, v->length);
+                        hexdump(stdout, "expected", v->out, v->length);
+                        hexdump(stdout, "got", buf, v->length);
+
+                        ++errs;
+                        }
+                }
+
+        for(n=0 ; n < sizeof(bi_ige_test_vectors)/sizeof(bi_ige_test_vectors[0])
+                        ; ++n)
+                {
+                const struct bi_ige_test * const v = &bi_ige_test_vectors[n];
+                AES_KEY key1;
+                AES_KEY key2;
+                unsigned char buf[MAX_VECTOR_SIZE];
+
+                assert(v->length <= MAX_VECTOR_SIZE);
+
+                if(v->encrypt == AES_ENCRYPT)
+                        {
+                        AES_set_encrypt_key(v->key1, 8*v->keysize, &key1);
+                        AES_set_encrypt_key(v->key2, 8*v->keysize, &key2);
+                        }
+                else
+                        {
+                        AES_set_decrypt_key(v->key1, 8*v->keysize, &key1);
+                        AES_set_decrypt_key(v->key2, 8*v->keysize, &key2);
+                        }
+
+                AES_bi_ige_encrypt(v->in, buf, v->length, &key1, &key2, v->iv,
+                                                   v->encrypt);
+
+                if(memcmp(v->out, buf, v->length))
+                        {
+                        printf("Bidirectional IGE test vector %d failed\n", n);
+                        hexdump(stdout, "key 1", v->key1, sizeof v->key1);
+                        hexdump(stdout, "key 2", v->key2, sizeof v->key2);
+                        hexdump(stdout, "iv", v->iv, sizeof v->iv);
+                        hexdump(stdout, "in", v->in, v->length);
+                        hexdump(stdout, "expected", v->out, v->length);
+                        hexdump(stdout, "got", buf, v->length);
+
+                        ++errs;
+                        }
+                }
+
+        return errs;
+        }
+
+int main(int argc, char **argv)
+        {
+        unsigned char rkey[16];
+        unsigned char rkey2[16];
+        AES_KEY key;
+        AES_KEY key2;
+        unsigned char plaintext[BIG_TEST_SIZE];
+        unsigned char ciphertext[BIG_TEST_SIZE];
+        unsigned char checktext[BIG_TEST_SIZE];
+        unsigned char iv[AES_BLOCK_SIZE*4];
+        unsigned char saved_iv[AES_BLOCK_SIZE*4];
+        int err = 0;
+        int n;
+        unsigned matches;
+
+        assert(BIG_TEST_SIZE >= TEST_SIZE);
+
+        RAND_pseudo_bytes(rkey, sizeof rkey);
+        RAND_pseudo_bytes(plaintext, sizeof plaintext);
+        RAND_pseudo_bytes(iv, sizeof iv);
+        memcpy(saved_iv, iv, sizeof saved_iv);
+
+        /* Forward IGE only... */
+
+        /* Straight encrypt/decrypt */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_ige_encrypt(plaintext, ciphertext, TEST_SIZE, &key, iv,
+                                        AES_ENCRYPT);
+
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(ciphertext, checktext, TEST_SIZE, &key, iv,
+                                        AES_DECRYPT);
+
+        if(memcmp(checktext, plaintext, TEST_SIZE))
+                {
+                printf("Encrypt+decrypt doesn't match\n");
+                hexdump(stdout, "Plaintext", plaintext, TEST_SIZE);
+                hexdump(stdout, "Checktext", checktext, TEST_SIZE);
+                ++err;
+                }
+
+        /* Now check encrypt chaining works */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(plaintext, ciphertext, TEST_SIZE/2, &key, iv,
+                                        AES_ENCRYPT);
+        AES_ige_encrypt(plaintext+TEST_SIZE/2,
+                                        ciphertext+TEST_SIZE/2, TEST_SIZE/2,
+                                        &key, iv, AES_ENCRYPT);
+
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(ciphertext, checktext, TEST_SIZE, &key, iv,
+                                        AES_DECRYPT);
+
+        if(memcmp(checktext, plaintext, TEST_SIZE))
+                {
+                printf("Chained encrypt+decrypt doesn't match\n");
+                hexdump(stdout, "Plaintext", plaintext, TEST_SIZE);
+                hexdump(stdout, "Checktext", checktext, TEST_SIZE);
+                ++err;
+                }
+
+        /* And check decrypt chaining */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(plaintext, ciphertext, TEST_SIZE/2, &key, iv,
+                                        AES_ENCRYPT);
+        AES_ige_encrypt(plaintext+TEST_SIZE/2,
+                                        ciphertext+TEST_SIZE/2, TEST_SIZE/2,
+                                        &key, iv, AES_ENCRYPT);
+
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(ciphertext, checktext, TEST_SIZE/2, &key, iv,
+                                        AES_DECRYPT);
+        AES_ige_encrypt(ciphertext+TEST_SIZE/2,
+                                        checktext+TEST_SIZE/2, TEST_SIZE/2, &key, iv,
+                                        AES_DECRYPT);
+
+        if(memcmp(checktext, plaintext, TEST_SIZE))
+                {
+                printf("Chained encrypt+chained decrypt doesn't match\n");
+                hexdump(stdout, "Plaintext", plaintext, TEST_SIZE);
+                hexdump(stdout, "Checktext", checktext, TEST_SIZE);
+                ++err;
+                }
+
+        /* make sure garble extends forwards only */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(plaintext, ciphertext, sizeof plaintext, &key, iv,
+                                        AES_ENCRYPT);
+
+        /* corrupt halfway through */
+        ++ciphertext[sizeof ciphertext/2];
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        memcpy(iv, saved_iv, sizeof iv);
+        AES_ige_encrypt(ciphertext, checktext, sizeof checktext, &key, iv,
+                                        AES_DECRYPT);
+
+        matches=0;
+        for(n=0 ; n < sizeof checktext ; ++n)
+                if(checktext[n] == plaintext[n])
+                        ++matches;
+
+        if(matches > sizeof checktext/2+sizeof checktext/100)
+                {
+                printf("More than 51%% matches after garbling\n");
+                ++err;
+                }
+
+        if(matches < sizeof checktext/2)
+                {
+                printf("Garble extends backwards!\n");
+                ++err;
+                }
+
+        /* Bi-directional IGE */
+
+        /* Note that we don't have to recover the IV, because chaining isn't */
+        /* possible with biIGE, so the IV is not updated. */
+
+        RAND_pseudo_bytes(rkey2, sizeof rkey2);
+
+        /* Straight encrypt/decrypt */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_encrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_bi_ige_encrypt(plaintext, ciphertext, TEST_SIZE, &key, &key2, iv,
+                                           AES_ENCRYPT);
+
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_decrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_bi_ige_encrypt(ciphertext, checktext, TEST_SIZE, &key, &key2, iv,
+                                           AES_DECRYPT);
+
+        if(memcmp(checktext, plaintext, TEST_SIZE))
+                {
+                printf("Encrypt+decrypt doesn't match\n");
+                hexdump(stdout, "Plaintext", plaintext, TEST_SIZE);
+                hexdump(stdout, "Checktext", checktext, TEST_SIZE);
+                ++err;
+                }
+
+        /* make sure garble extends both ways */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_encrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_ige_encrypt(plaintext, ciphertext, sizeof plaintext, &key, iv,
+                                        AES_ENCRYPT);
+
+        /* corrupt halfway through */
+        ++ciphertext[sizeof ciphertext/2];
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_decrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_ige_encrypt(ciphertext, checktext, sizeof checktext, &key, iv,
+                                        AES_DECRYPT);
+
+        matches=0;
+        for(n=0 ; n < sizeof checktext ; ++n)
+                if(checktext[n] == plaintext[n])
+                        ++matches;
+
+        if(matches > sizeof checktext/100)
+                {
+                printf("More than 1%% matches after bidirectional garbling\n");
+                ++err;
+                }
+
+        /* make sure garble extends both ways (2) */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_encrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_ige_encrypt(plaintext, ciphertext, sizeof plaintext, &key, iv,
+                                        AES_ENCRYPT);
+
+        /* corrupt right at the end */
+        ++ciphertext[sizeof ciphertext-1];
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_decrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_ige_encrypt(ciphertext, checktext, sizeof checktext, &key, iv,
+                                        AES_DECRYPT);
+
+        matches=0;
+        for(n=0 ; n < sizeof checktext ; ++n)
+                if(checktext[n] == plaintext[n])
+                        ++matches;
+
+        if(matches > sizeof checktext/100)
+                {
+                printf("More than 1%% matches after bidirectional garbling (2)\n");
+                ++err;
+                }
+
+        /* make sure garble extends both ways (3) */
+        AES_set_encrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_encrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_ige_encrypt(plaintext, ciphertext, sizeof plaintext, &key, iv,
+                                        AES_ENCRYPT);
+
+        /* corrupt right at the start */
+        ++ciphertext[0];
+        AES_set_decrypt_key(rkey, 8*sizeof rkey, &key);
+        AES_set_decrypt_key(rkey2, 8*sizeof rkey2, &key2);
+        AES_ige_encrypt(ciphertext, checktext, sizeof checktext, &key, iv,
+                                        AES_DECRYPT);
+
+        matches=0;
+        for(n=0 ; n < sizeof checktext ; ++n)
+                if(checktext[n] == plaintext[n])
+                        ++matches;
+
+        if(matches > sizeof checktext/100)
+                {
+                printf("More than 1%% matches after bidirectional garbling (3)\n");
+                ++err;
+                }
+
+        err += run_test_vectors();
+
+        return err;
+        }