16 files changed, 349 insertions, 292 deletions

diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index 5ee20ff..64bccd8 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -15,11 +15,7 @@ if(HOST_ASM_ELF_ARMV4)
         add_definitions(-DAES_ASM)
         add_definitions(-DOPENSSL_BN_ASM_MONT)
         add_definitions(-DGHASH_ASM)
-        add_definitions(-DSHA1_ASM)
-        add_definitions(-DSHA256_ASM)
-        add_definitions(-DSHA512_ASM)
         add_definitions(-DOPENSSL_CPUID_OBJ)
-        set_property(SOURCE ${ASM_ARMV4_ELF_SRC} PROPERTY LANGUAGE C)
         set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_ARMV4_ELF_SRC})
 endif()
 
@@ -33,13 +29,8 @@ if(HOST_ASM_ELF_X86_64)
                 bn/modexp512-elf-x86_64.S
                 bn/mont-elf-x86_64.S
                 bn/mont5-elf-x86_64.S
-                md5/md5-elf-x86_64.S
                 modes/ghash-elf-x86_64.S
                 rc4/rc4-elf-x86_64.S
-                sha/sha1-elf-x86_64.S
-                sha/sha256-elf-x86_64.S
-                sha/sha512-elf-x86_64.S
-                cpuid-elf-x86_64.S
 
                 bn/arch/amd64/bignum_add.S
                 bn/arch/amd64/bignum_cmadd.S
@@ -57,24 +48,12 @@ if(HOST_ASM_ELF_X86_64)
         add_definitions(-DAES_ASM)
         add_definitions(-DBSAES_ASM)
         add_definitions(-DVPAES_ASM)
-        add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_DECRYPT_INTERNAL)
         add_definitions(-DOPENSSL_IA32_SSE2)
         add_definitions(-DOPENSSL_BN_ASM_MONT)
         add_definitions(-DOPENSSL_BN_ASM_MONT5)
-        add_definitions(-DMD5_ASM)
         add_definitions(-DGHASH_ASM)
         add_definitions(-DRSA_ASM)
-        add_definitions(-DSHA1_ASM)
-        add_definitions(-DSHA256_ASM)
-        add_definitions(-DSHA512_ASM)
-        add_definitions(-DWHIRLPOOL_ASM)
-        add_definitions(-DOPENSSL_CPUID_OBJ)
         set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_ELF_SRC})
-        set_property(SOURCE ${ASM_X86_64_ELF_SRC} PROPERTY LANGUAGE C)
 endif()
 
 if(HOST_ASM_MACOSX_X86_64)
@@ -87,13 +66,8 @@ if(HOST_ASM_MACOSX_X86_64)
                 bn/modexp512-macosx-x86_64.S
                 bn/mont-macosx-x86_64.S
                 bn/mont5-macosx-x86_64.S
-                md5/md5-macosx-x86_64.S
                 modes/ghash-macosx-x86_64.S
                 rc4/rc4-macosx-x86_64.S
-                sha/sha1-macosx-x86_64.S
-                sha/sha256-macosx-x86_64.S
-                sha/sha512-macosx-x86_64.S
-                cpuid-macosx-x86_64.S
 
                 bn/arch/amd64/bignum_add.S
                 bn/arch/amd64/bignum_cmadd.S
@@ -111,24 +85,12 @@ if(HOST_ASM_MACOSX_X86_64)
         add_definitions(-DAES_ASM)
         add_definitions(-DBSAES_ASM)
         add_definitions(-DVPAES_ASM)
-        add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_DECRYPT_INTERNAL)
         add_definitions(-DOPENSSL_IA32_SSE2)
         add_definitions(-DOPENSSL_BN_ASM_MONT)
         add_definitions(-DOPENSSL_BN_ASM_MONT5)
-        add_definitions(-DMD5_ASM)
         add_definitions(-DGHASH_ASM)
         add_definitions(-DRSA_ASM)
-        add_definitions(-DSHA1_ASM)
-        add_definitions(-DSHA256_ASM)
-        add_definitions(-DSHA512_ASM)
-        add_definitions(-DWHIRLPOOL_ASM)
-        add_definitions(-DOPENSSL_CPUID_OBJ)
         set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MACOSX_SRC})
-        set_property(SOURCE ${ASM_X86_64_MACOSX_SRC} PROPERTY LANGUAGE C)
         set_property(SOURCE ${ASM_X86_64_MACOSX_SRC} PROPERTY XCODE_EXPLICIT_FILE_TYPE "sourcecode.asm")
 endif()
 
@@ -142,34 +104,18 @@ if(HOST_ASM_MASM_X86_64)
                 #bn/modexp512-masm-x86_64.S
                 #bn/mont-masm-x86_64.S
                 #bn/mont5-masm-x86_64.S
-                md5/md5-masm-x86_64.S
                 modes/ghash-masm-x86_64.S
                 rc4/rc4-masm-x86_64.S
-                sha/sha1-masm-x86_64.S
-                sha/sha256-masm-x86_64.S
-                sha/sha512-masm-x86_64.S
-                cpuid-masm-x86_64.S
         )
         add_definitions(-Dendbr64=)
         add_definitions(-DAES_ASM)
         add_definitions(-DBSAES_ASM)
         add_definitions(-DVPAES_ASM)
-        add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_DECRYPT_INTERNAL)
         add_definitions(-DOPENSSL_IA32_SSE2)
         #add_definitions(-DOPENSSL_BN_ASM_MONT)
         #add_definitions(-DOPENSSL_BN_ASM_MONT5)
-        add_definitions(-DMD5_ASM)
         add_definitions(-DGHASH_ASM)
         add_definitions(-DRSA_ASM)
-        add_definitions(-DSHA1_ASM)
-        add_definitions(-DSHA256_ASM)
-        add_definitions(-DSHA512_ASM)
-        add_definitions(-DWHIRLPOOL_ASM)
-        add_definitions(-DOPENSSL_CPUID_OBJ)
         set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MASM_SRC})
         set_property(SOURCE ${ASM_X86_64_MASM_SRC} PROPERTY LANGUAGE ASM_MASM)
 endif()
@@ -184,50 +130,37 @@ if(HOST_ASM_MINGW64_X86_64)
                 #bn/modexp512-mingw64-x86_64.S
                 #bn/mont-mingw64-x86_64.S
                 #bn/mont5-mingw64-x86_64.S
-                md5/md5-mingw64-x86_64.S
                 modes/ghash-mingw64-x86_64.S
                 rc4/rc4-mingw64-x86_64.S
-                sha/sha1-mingw64-x86_64.S
-                sha/sha256-mingw64-x86_64.S
-                sha/sha512-mingw64-x86_64.S
-                cpuid-mingw64-x86_64.S
         )
         add_definitions(-Dendbr32=endbr64)
         add_definitions(-DAES_ASM)
         add_definitions(-DBSAES_ASM)
         add_definitions(-DVPAES_ASM)
-        add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_DECRYPT_INTERNAL)
         add_definitions(-DOPENSSL_IA32_SSE2)
         #add_definitions(-DOPENSSL_BN_ASM_MONT)
         #add_definitions(-DOPENSSL_BN_ASM_MONT5)
-        add_definitions(-DMD5_ASM)
         add_definitions(-DGHASH_ASM)
         add_definitions(-DRSA_ASM)
-        add_definitions(-DSHA1_ASM)
-        add_definitions(-DSHA256_ASM)
-        add_definitions(-DSHA512_ASM)
-        add_definitions(-DWHIRLPOOL_ASM)
-        add_definitions(-DOPENSSL_CPUID_OBJ)
         set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MINGW64_SRC})
-        set_property(SOURCE ${ASM_X86_64_MINGW64_SRC} PROPERTY LANGUAGE C)
+endif()
+
+if(HOST_AARCH64)
+        set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps.c)
+elseif(HOST_X86_64)
+        set(CRYPTO_SRC ${CRYPTO_SRC} arch/amd64/crypto_cpu_caps.c)
+elseif(HOST_I386)
+        set(CRYPTO_SRC ${CRYPTO_SRC} arch/i386/crypto_cpu_caps.c)
 endif()
 
 set(
         CRYPTO_SRC
         ${CRYPTO_SRC}
-        cpt_err.c
-        cryptlib.c
+        crypto_err.c
+        crypto_ex_data.c
         crypto_init.c
-        cversion.c
-        ex_data.c
-        malloc-wrapper.c
-        mem_clr.c
-        mem_dbg.c
-        o_fips.c
+        crypto_legacy.c
+        crypto_memory.c
         aes/aes.c
         aes/aes_core.c
         aes/aes_ige.c
@@ -364,7 +297,6 @@ set(
         conf/conf_def.c
         conf/conf_err.c
         conf/conf_lib.c
-        conf/conf_mall.c
         conf/conf_mod.c
         conf/conf_sap.c
         ct/ct_b64.c
@@ -379,26 +311,11 @@ set(
         ct/ct_x509v3.c
         curve25519/curve25519-generic.c
         curve25519/curve25519.c
-        des/cbc_cksm.c
-        des/cbc_enc.c
-        des/cfb64ede.c
-        des/cfb64enc.c
-        des/cfb_enc.c
+        des/des.c
+        des/des_cksum.c
         des/des_enc.c
-        des/ecb3_enc.c
-        des/ecb_enc.c
-        des/ede_cbcm_enc.c
-        des/enc_read.c
-        des/fcrypt.c
-        des/fcrypt_b.c
-        des/ofb64ede.c
-        des/ofb64enc.c
-        des/ofb_enc.c
-        des/pcbc_enc.c
-        des/qud_cksm.c
-        des/set_key.c
-        des/str2key.c
-        des/xcbc_enc.c
+        des/des_fcrypt.c
+        des/des_key.c
         dh/dh_ameth.c
         dh/dh_asn1.c
         dh/dh_check.c
@@ -419,21 +336,15 @@ set(
         dsa/dsa_prn.c
         ec/ec_ameth.c
         ec/ec_asn1.c
-        ec/ec_check.c
+        ec/ec_convert.c
         ec/ec_curve.c
-        ec/ec_cvt.c
         ec/ec_err.c
         ec/ec_key.c
-        ec/ec_kmeth.c
         ec/ec_lib.c
         ec/ec_mult.c
-        ec/ec_oct.c
         ec/ec_pmeth.c
-        ec/ec_print.c
         ec/eck_prn.c
-        ec/ecp_mont.c
-        ec/ecp_oct.c
-        ec/ecp_smpl.c
+        ec/ecp_methods.c
         ec/ecx_methods.c
         ecdh/ecdh.c
         ecdsa/ecdsa.c
@@ -476,7 +387,6 @@ set(
         evp/m_sha3.c
         evp/m_sigver.c
         evp/m_sm3.c
-        evp/m_wp.c
         evp/p_legacy.c
         evp/p_lib.c
         evp/p_sign.c
@@ -495,6 +405,8 @@ set(
         lhash/lhash.c
         md4/md4.c
         md5/md5.c
+        mlkem/mlkem768.c
+        mlkem/mlkem1024.c
         modes/cbc128.c
         modes/ccm128.c
         modes/cfb128.c
@@ -599,8 +511,6 @@ set(
         ui/ui_err.c
         ui/ui_lib.c
         ui/ui_null.c
-        ui/ui_util.c
-        whrlpool/whirlpool.c
         x509/by_dir.c
         x509/by_file.c
         x509/by_mem.c
@@ -641,6 +551,7 @@ set(
         x509/x509_r2x.c
         x509/x509_req.c
         x509/x509_set.c
+        x509/x509_siginfo.c
         x509/x509_skey.c
         x509/x509_trs.c
         x509/x509_txt.c
@@ -685,6 +596,14 @@ if(NOT HAVE_FREEZERO)
         set(COMPAT_SRC ${COMPAT_SRC} compat/freezero.c)
 endif()
 
+if(NOT HAVE_GETDELIM)
+        set(COMPAT_SRC ${COMPAT_SRC} compat/getdelim.c)
+endif()
+
+if(NOT HAVE_GETLINE)
+        set(COMPAT_SRC ${COMPAT_SRC} compat/getline.c)
+endif()
+
 if(NOT HAVE_GETOPT)
         set(COMPAT_SRC ${COMPAT_SRC} compat/getopt_long.c)
 endif()
@@ -821,6 +740,7 @@ target_include_directories(crypto_obj
                 bio
                 bn
                 bytestring
+                conf
                 dh
                 dsa
                 curve25519
@@ -832,6 +752,7 @@ target_include_directories(crypto_obj
                 hidden
                 hmac
                 lhash
+                mlkem
                 modes
                 ocsp
                 pkcs12
@@ -845,41 +766,65 @@ target_include_directories(crypto_obj
                 ${CMAKE_BINARY_DIR}/include)
 
 if(HOST_AARCH64)
+        target_include_directories(crypto_obj PRIVATE arch/aarch64/)
         target_include_directories(crypto_obj PRIVATE bn/arch/aarch64/)
 elseif(HOST_ARM)
+        target_include_directories(crypto_obj PRIVATE arch/arm/)
         target_include_directories(crypto_obj PRIVATE bn/arch/arm/)
 elseif(HOST_I386)
+        target_include_directories(crypto_obj PRIVATE arch/i386/)
         target_include_directories(crypto_obj PRIVATE bn/arch/i386/)
+elseif(HOST_LOONGARCH64)
+        target_include_directories(crypto_obj PRIVATE arch/loongarch64)
+        target_include_directories(crypto_obj PRIVATE bn/arch/loongarch64)
 elseif(HOST_MIPS64)
+        target_include_directories(crypto_obj PRIVATE arch/mips64)
         target_include_directories(crypto_obj PRIVATE bn/arch/mips64)
 elseif(HOST_MIPS)
+        target_include_directories(crypto_obj PRIVATE arch/mips)
         target_include_directories(crypto_obj PRIVATE bn/arch/mips)
 elseif(HOST_POWERPC)
+        target_include_directories(crypto_obj PRIVATE arch/powerpc)
         target_include_directories(crypto_obj PRIVATE bn/arch/powerpc)
 elseif(HOST_POWERPC64)
+        target_include_directories(crypto_obj PRIVATE arch/powerpc64)
         target_include_directories(crypto_obj PRIVATE bn/arch/powerpc64)
 elseif(HOST_RISCV64)
+        target_include_directories(crypto_obj PRIVATE arch/riscv64)
         target_include_directories(crypto_obj PRIVATE bn/arch/riscv64)
 elseif(HOST_SPARC64)
+        target_include_directories(crypto_obj PRIVATE arch/sparc64)
         target_include_directories(crypto_obj PRIVATE bn/arch/sparc64)
 elseif(HOST_X86_64)
+        target_include_directories(crypto_obj PRIVATE arch/amd64)
         target_include_directories(crypto_obj PRIVATE bn/arch/amd64)
 endif()
 
+if(MSVC)
+        # "C4701" - Potentially uninitialized local variable 'name' used
+        set_source_files_properties(bn/bn_convert.c pem/pem_lib.c PROPERTIES
+                COMPILE_OPTIONS /wd4701
+        )
+        # "C4702" - unreachable code
+        set_source_files_properties(pkcs7/pk7_doit.c PROPERTIES
+                COMPILE_OPTIONS /wd4702
+        )
+endif()
+
 add_library(crypto $<TARGET_OBJECTS:crypto_obj> $<TARGET_OBJECTS:compat_obj> empty.c)
 
 export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym)
 target_link_libraries(crypto ${PLATFORM_LIBS})
-if (WIN32)
-        set(CRYPTO_POSTFIX -${CRYPTO_MAJOR_VERSION} PARENT_SCOPE)
-endif()
 set_target_properties(crypto PROPERTIES
-        OUTPUT_NAME crypto${CRYPTO_POSTFIX}
-        ARCHIVE_OUTPUT_NAME crypto${CRYPTO_POSTFIX}
+        OUTPUT_NAME crypto
+        ARCHIVE_OUTPUT_NAME crypto
         EXPORT_NAME Crypto
         VERSION ${CRYPTO_VERSION}
         SOVERSION ${CRYPTO_MAJOR_VERSION}
 )
+if(NOT CMAKE_VERSION VERSION_LESS 3.27.0)
+        set_target_properties(crypto PROPERTIES DLL_NAME_WITH_SOVERSION TRUE)
+endif()
 
 target_include_directories(
         crypto
@@ -919,4 +864,3 @@ if(BUILD_SHARED_LIBS)
         add_library(crypto-static STATIC $<TARGET_OBJECTS:crypto_obj>)
         target_link_libraries(crypto-static ${PLATFORM_LIBS})
 endif()
-
diff --git a/crypto/Makefile.am b/crypto/Makefile.am
index 6e1e975..d1c5b76 100644
--- a/crypto/Makefile.am
+++ b/crypto/Makefile.am
@@ -5,6 +5,7 @@ AM_CPPFLAGS += -I$(top_srcdir)/crypto/asn1
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bio
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bn
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bytestring
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/conf
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/curve25519
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/dh
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/dsa
@@ -15,6 +16,7 @@ AM_CPPFLAGS += -I$(top_srcdir)/crypto/err
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/evp
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/hmac
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/lhash
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/mlkem
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/modes
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/ocsp
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/pkcs12
@@ -132,6 +134,14 @@ if !HAVE_FREEZERO
 libcompat_la_SOURCES += compat/freezero.c
 endif
 
+if !HAVE_GETDELIM
+libcompat_la_SOURCES += compat/getdelim.c
+endif
+
+if !HAVE_GETLINE
+libcompat_la_SOURCES += compat/getline.c
+endif
+
 if !HAVE_GETPAGESIZE
 libcompat_la_SOURCES += compat/getpagesize.c
 endif
@@ -201,23 +211,28 @@ endif
 endif
 endif
 
-libcrypto_la_SOURCES += cpt_err.c
-libcrypto_la_SOURCES += cryptlib.c
+if HOST_AARCH64
+libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps.c
+endif
+if HOST_X86_64
+libcrypto_la_SOURCES += arch/amd64/crypto_cpu_caps.c
+endif
+if HOST_I386
+libcrypto_la_SOURCES += arch/i386/crypto_cpu_caps.c
+endif
+
+libcrypto_la_SOURCES += crypto_err.c
+libcrypto_la_SOURCES += crypto_ex_data.c
 libcrypto_la_SOURCES += crypto_init.c
+libcrypto_la_SOURCES += crypto_legacy.c
 if !HOST_WIN
 libcrypto_la_SOURCES += crypto_lock.c
 else
 libcrypto_la_SOURCES += compat/crypto_lock_win.c
 endif
-libcrypto_la_SOURCES += cversion.c
-libcrypto_la_SOURCES += ex_data.c
-libcrypto_la_SOURCES += malloc-wrapper.c
-libcrypto_la_SOURCES += mem_clr.c
-libcrypto_la_SOURCES += mem_dbg.c
-libcrypto_la_SOURCES += o_fips.c
+libcrypto_la_SOURCES += crypto_memory.c
 noinst_HEADERS += arm_arch.h
 noinst_HEADERS += constant_time.h
-noinst_HEADERS += cryptlib.h
 noinst_HEADERS += crypto_internal.h
 noinst_HEADERS += crypto_local.h
 noinst_HEADERS += x86_arch.h
@@ -359,55 +374,82 @@ noinst_HEADERS += bn/bn_prime.h
 noinst_HEADERS += bn/s2n_bignum.h
 noinst_HEADERS += bn/s2n_bignum_internal.h
 
-# bn/arch
+# arch, bn/arch
 if HOST_AARCH64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/aarch64/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/aarch64/
 endif
+noinst_HEADERS += arch/aarch64/crypto_arch.h
 noinst_HEADERS += bn/arch/aarch64/bn_arch.h
 
 if HOST_ARM
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/arm/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/arm/
 endif
+noinst_HEADERS += arch/arm/crypto_arch.h
 noinst_HEADERS += bn/arch/arm/bn_arch.h
 
 if HOST_I386
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/i386/
 endif
+noinst_HEADERS += arch/i386/crypto_arch.h
 noinst_HEADERS += bn/arch/i386/bn_arch.h
 
+if HOST_LOONGARCH64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/loongarch64/
+endif
+noinst_HEADERS += arch/loongarch64/crypto_arch.h
+noinst_HEADERS += bn/arch/loongarch64/bn_arch.h
+
 if HOST_MIPS
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips/
 endif
+noinst_HEADERS += arch/mips/crypto_arch.h
 noinst_HEADERS += bn/arch/mips/bn_arch.h
 
 if HOST_MIPS64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips64/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips64/
 endif
+noinst_HEADERS += arch/mips64/crypto_arch.h
 noinst_HEADERS += bn/arch/mips64/bn_arch.h
 
 if HOST_POWERPC
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/powerpc/
 endif
+noinst_HEADERS += arch/powerpc/crypto_arch.h
 noinst_HEADERS += bn/arch/powerpc/bn_arch.h
 
 if HOST_POWERPC64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc64/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/powerpc64/
 endif
+noinst_HEADERS += arch/powerpc64/crypto_arch.h
 noinst_HEADERS += bn/arch/powerpc64/bn_arch.h
 
 if HOST_RISCV64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/riscv64/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/riscv64/
 endif
+noinst_HEADERS += arch/riscv64/crypto_arch.h
 noinst_HEADERS += bn/arch/riscv64/bn_arch.h
 
 if HOST_SPARC64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/sparc64/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/sparc64/
 endif
+noinst_HEADERS += arch/sparc64/crypto_arch.h
 noinst_HEADERS += bn/arch/sparc64/bn_arch.h
 
 if HOST_X86_64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/amd64/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/amd64/
 endif
+noinst_HEADERS += arch/amd64/crypto_arch.h
 noinst_HEADERS += bn/arch/amd64/bn_arch.h
 
 # buffer
@@ -458,10 +500,10 @@ libcrypto_la_SOURCES += conf/conf_api.c
 libcrypto_la_SOURCES += conf/conf_def.c
 libcrypto_la_SOURCES += conf/conf_err.c
 libcrypto_la_SOURCES += conf/conf_lib.c
-libcrypto_la_SOURCES += conf/conf_mall.c
 libcrypto_la_SOURCES += conf/conf_mod.c
 libcrypto_la_SOURCES += conf/conf_sap.c
 noinst_HEADERS += conf/conf_def.h
+noinst_HEADERS += conf/conf_local.h
 
 # ct
 libcrypto_la_SOURCES += ct/ct_b64.c
@@ -483,29 +525,12 @@ noinst_HEADERS += curve25519/curve25519_internal.h
 
 
 # des
-libcrypto_la_SOURCES += des/cbc_cksm.c
-libcrypto_la_SOURCES += des/cbc_enc.c
-libcrypto_la_SOURCES += des/cfb64ede.c
-libcrypto_la_SOURCES += des/cfb64enc.c
-libcrypto_la_SOURCES += des/cfb_enc.c
+libcrypto_la_SOURCES += des/des.c
+libcrypto_la_SOURCES += des/des_cksum.c
 libcrypto_la_SOURCES += des/des_enc.c
-libcrypto_la_SOURCES += des/ecb3_enc.c
-libcrypto_la_SOURCES += des/ecb_enc.c
-libcrypto_la_SOURCES += des/ede_cbcm_enc.c
-libcrypto_la_SOURCES += des/enc_read.c
-libcrypto_la_SOURCES += des/fcrypt.c
-libcrypto_la_SOURCES += des/fcrypt_b.c
-EXTRA_libcrypto_la_SOURCES += des/ncbc_enc.c
-libcrypto_la_SOURCES += des/ofb64ede.c
-libcrypto_la_SOURCES += des/ofb64enc.c
-libcrypto_la_SOURCES += des/ofb_enc.c
-libcrypto_la_SOURCES += des/pcbc_enc.c
-libcrypto_la_SOURCES += des/qud_cksm.c
-libcrypto_la_SOURCES += des/set_key.c
-libcrypto_la_SOURCES += des/str2key.c
-libcrypto_la_SOURCES += des/xcbc_enc.c
+libcrypto_la_SOURCES += des/des_fcrypt.c
+libcrypto_la_SOURCES += des/des_key.c
 noinst_HEADERS += des/des_local.h
-noinst_HEADERS += des/spr.h
 
 # dh
 libcrypto_la_SOURCES += dh/dh_ameth.c
@@ -534,21 +559,15 @@ noinst_HEADERS += dsa/dsa_local.h
 # ec
 libcrypto_la_SOURCES += ec/ec_ameth.c
 libcrypto_la_SOURCES += ec/ec_asn1.c
-libcrypto_la_SOURCES += ec/ec_check.c
+libcrypto_la_SOURCES += ec/ec_convert.c
 libcrypto_la_SOURCES += ec/ec_curve.c
-libcrypto_la_SOURCES += ec/ec_cvt.c
 libcrypto_la_SOURCES += ec/ec_err.c
 libcrypto_la_SOURCES += ec/ec_key.c
-libcrypto_la_SOURCES += ec/ec_kmeth.c
 libcrypto_la_SOURCES += ec/ec_lib.c
 libcrypto_la_SOURCES += ec/ec_mult.c
-libcrypto_la_SOURCES += ec/ec_oct.c
 libcrypto_la_SOURCES += ec/ec_pmeth.c
-libcrypto_la_SOURCES += ec/ec_print.c
 libcrypto_la_SOURCES += ec/eck_prn.c
-libcrypto_la_SOURCES += ec/ecp_mont.c
-libcrypto_la_SOURCES += ec/ecp_oct.c
-libcrypto_la_SOURCES += ec/ecp_smpl.c
+libcrypto_la_SOURCES += ec/ecp_methods.c
 libcrypto_la_SOURCES += ec/ecx_methods.c
 noinst_HEADERS += ec/ec_local.h
 
@@ -604,7 +623,6 @@ libcrypto_la_SOURCES += evp/m_sha1.c
 libcrypto_la_SOURCES += evp/m_sha3.c
 libcrypto_la_SOURCES += evp/m_sigver.c
 libcrypto_la_SOURCES += evp/m_sm3.c
-libcrypto_la_SOURCES += evp/m_wp.c
 libcrypto_la_SOURCES += evp/p_legacy.c
 libcrypto_la_SOURCES += evp/p_lib.c
 libcrypto_la_SOURCES += evp/p_sign.c
@@ -629,7 +647,6 @@ noinst_HEADERS += hidden/openssl/chacha.h
 noinst_HEADERS += hidden/openssl/cmac.h
 noinst_HEADERS += hidden/openssl/cms.h
 noinst_HEADERS += hidden/openssl/conf.h
-noinst_HEADERS += hidden/openssl/conf_api.h
 noinst_HEADERS += hidden/openssl/crypto.h
 noinst_HEADERS += hidden/openssl/ct.h
 noinst_HEADERS += hidden/openssl/curve25519.h
@@ -646,6 +663,7 @@ noinst_HEADERS += hidden/openssl/idea.h
 noinst_HEADERS += hidden/openssl/lhash.h
 noinst_HEADERS += hidden/openssl/md4.h
 noinst_HEADERS += hidden/openssl/md5.h
+noinst_HEADERS += hidden/openssl/mlkem.h
 noinst_HEADERS += hidden/openssl/modes.h
 noinst_HEADERS += hidden/openssl/objects.h
 noinst_HEADERS += hidden/openssl/ocsp.h
@@ -666,7 +684,6 @@ noinst_HEADERS += hidden/openssl/stack.h
 noinst_HEADERS += hidden/openssl/ts.h
 noinst_HEADERS += hidden/openssl/txt_db.h
 noinst_HEADERS += hidden/openssl/ui.h
-noinst_HEADERS += hidden/openssl/whrlpool.h
 noinst_HEADERS += hidden/openssl/x509.h
 noinst_HEADERS += hidden/openssl/x509_vfy.h
 noinst_HEADERS += hidden/openssl/x509v3.h
@@ -698,6 +715,12 @@ libcrypto_la_SOURCES += md4/md4.c
 # md5
 libcrypto_la_SOURCES += md5/md5.c
 
+# mlkem
+libcrypto_la_SOURCES += mlkem/mlkem768.c
+libcrypto_la_SOURCES += mlkem/mlkem1024.c
+noinst_HEADERS += mlkem/mlkem.h
+noinst_HEADERS += mlkem/mlkem_internal.h
+
 # modes
 libcrypto_la_SOURCES += modes/cbc128.c
 libcrypto_la_SOURCES += modes/ccm128.c
@@ -856,12 +879,8 @@ endif
 if HOST_WIN
 libcrypto_la_SOURCES += ui/ui_openssl_win.c
 endif
-libcrypto_la_SOURCES += ui/ui_util.c
 noinst_HEADERS += ui/ui_local.h
 
-# whrlpool
-libcrypto_la_SOURCES += whrlpool/whirlpool.c
-
 # x509
 libcrypto_la_SOURCES += x509/by_dir.c
 libcrypto_la_SOURCES += x509/by_file.c
@@ -903,6 +922,7 @@ libcrypto_la_SOURCES += x509/x509_purp.c
 libcrypto_la_SOURCES += x509/x509_r2x.c
 libcrypto_la_SOURCES += x509/x509_req.c
 libcrypto_la_SOURCES += x509/x509_set.c
+libcrypto_la_SOURCES += x509/x509_siginfo.c
 libcrypto_la_SOURCES += x509/x509_skey.c
 libcrypto_la_SOURCES += x509/x509_trs.c
 libcrypto_la_SOURCES += x509/x509_txt.c
diff --git a/crypto/Makefile.am.elf-arm b/crypto/Makefile.am.elf-arm
index 4f88994..6a9fa50 100644
--- a/crypto/Makefile.am.elf-arm
+++ b/crypto/Makefile.am.elf-arm
@@ -13,9 +13,6 @@ if HOST_ASM_ELF_ARM
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
 libcrypto_la_CPPFLAGS += -DGHASH_ASM
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
 libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
 libcrypto_la_SOURCES += $(ASM_ARM_ELF)
 endif
diff --git a/crypto/Makefile.am.elf-mips b/crypto/Makefile.am.elf-mips
index ea0a730..f7a44f2 100644
--- a/crypto/Makefile.am.elf-mips
+++ b/crypto/Makefile.am.elf-mips
@@ -10,8 +10,5 @@ EXTRA_DIST += $(ASM_MIPS_ELF)
 if HOST_ASM_ELF_MIPS
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
 libcrypto_la_SOURCES += $(ASM_MIPS_ELF)
 endif
diff --git a/crypto/Makefile.am.elf-mips64 b/crypto/Makefile.am.elf-mips64
index 8f851f3..7d90bc0 100644
--- a/crypto/Makefile.am.elf-mips64
+++ b/crypto/Makefile.am.elf-mips64
@@ -10,8 +10,5 @@ EXTRA_DIST += $(ASM_MIPS64_ELF)
 if HOST_ASM_ELF_MIPS64
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
 libcrypto_la_SOURCES += $(ASM_MIPS64_ELF)
 endif
diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64
index 6933a11..c62662c 100644
--- a/crypto/Makefile.am.elf-x86_64
+++ b/crypto/Makefile.am.elf-x86_64
@@ -6,13 +6,8 @@ ASM_X86_64_ELF += aes/aesni-elf-x86_64.S
 ASM_X86_64_ELF += bn/modexp512-elf-x86_64.S
 ASM_X86_64_ELF += bn/mont-elf-x86_64.S
 ASM_X86_64_ELF += bn/mont5-elf-x86_64.S
-ASM_X86_64_ELF += md5/md5-elf-x86_64.S
 ASM_X86_64_ELF += modes/ghash-elf-x86_64.S
 ASM_X86_64_ELF += rc4/rc4-elf-x86_64.S
-ASM_X86_64_ELF += sha/sha1-elf-x86_64.S
-ASM_X86_64_ELF += sha/sha256-elf-x86_64.S
-ASM_X86_64_ELF += sha/sha512-elf-x86_64.S
-ASM_X86_64_ELF += cpuid-elf-x86_64.S
 
 ASM_X86_64_ELF += bn/arch/amd64/bignum_add.S
 ASM_X86_64_ELF += bn/arch/amd64/bignum_cmadd.S
@@ -33,21 +28,10 @@ if HOST_ASM_ELF_X86_64
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DBSAES_ASM
 libcrypto_la_CPPFLAGS += -DVPAES_ASM
-libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL
 libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5
-libcrypto_la_CPPFLAGS += -DMD5_ASM
 libcrypto_la_CPPFLAGS += -DGHASH_ASM
 libcrypto_la_CPPFLAGS += -DRSA_ASM
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
-libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM
-libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
 libcrypto_la_SOURCES += $(ASM_X86_64_ELF)
 endif
diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64
index 1020567..010e3be 100644
--- a/crypto/Makefile.am.macosx-x86_64
+++ b/crypto/Makefile.am.macosx-x86_64
@@ -6,13 +6,8 @@ ASM_X86_64_MACOSX += aes/aesni-macosx-x86_64.S
 ASM_X86_64_MACOSX += bn/modexp512-macosx-x86_64.S
 ASM_X86_64_MACOSX += bn/mont-macosx-x86_64.S
 ASM_X86_64_MACOSX += bn/mont5-macosx-x86_64.S
-ASM_X86_64_MACOSX += md5/md5-macosx-x86_64.S
 ASM_X86_64_MACOSX += modes/ghash-macosx-x86_64.S
 ASM_X86_64_MACOSX += rc4/rc4-macosx-x86_64.S
-ASM_X86_64_MACOSX += sha/sha1-macosx-x86_64.S
-ASM_X86_64_MACOSX += sha/sha256-macosx-x86_64.S
-ASM_X86_64_MACOSX += sha/sha512-macosx-x86_64.S
-ASM_X86_64_MACOSX += cpuid-macosx-x86_64.S
 
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_add.S
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_cmadd.S
@@ -33,21 +28,10 @@ if HOST_ASM_MACOSX_X86_64
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DBSAES_ASM
 libcrypto_la_CPPFLAGS += -DVPAES_ASM
-libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL
 libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5
-libcrypto_la_CPPFLAGS += -DMD5_ASM
 libcrypto_la_CPPFLAGS += -DGHASH_ASM
 libcrypto_la_CPPFLAGS += -DRSA_ASM
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
-libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM
-libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
 libcrypto_la_SOURCES += $(ASM_X86_64_MACOSX)
 endif
diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64
index 7da3cc2..2ef7e1b 100644
--- a/crypto/Makefile.am.masm-x86_64
+++ b/crypto/Makefile.am.masm-x86_64
@@ -6,13 +6,8 @@ ASM_X86_64_MASM += aes/aesni-masm-x86_64.S
 ASM_X86_64_MASM += bn/modexp512-masm-x86_64.S
 ASM_X86_64_MASM += bn/mont-masm-x86_64.S
 ASM_X86_64_MASM += bn/mont5-masm-x86_64.S
-ASM_X86_64_MASM += md5/md5-masm-x86_64.S
 ASM_X86_64_MASM += modes/ghash-masm-x86_64.S
 ASM_X86_64_MASM += rc4/rc4-masm-x86_64.S
-ASM_X86_64_MASM += sha/sha1-masm-x86_64.S
-ASM_X86_64_MASM += sha/sha256-masm-x86_64.S
-ASM_X86_64_MASM += sha/sha512-masm-x86_64.S
-ASM_X86_64_MASM += cpuid-masm-x86_64.S
 
 EXTRA_DIST += $(ASM_X86_64_MASM)
 
@@ -20,21 +15,10 @@ if HOST_ASM_MASM_X86_64
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DBSAES_ASM
 libcrypto_la_CPPFLAGS += -DVPAES_ASM
-libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL
 libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5
-libcrypto_la_CPPFLAGS += -DMD5_ASM
 libcrypto_la_CPPFLAGS += -DGHASH_ASM
 libcrypto_la_CPPFLAGS += -DRSA_ASM
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
-libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM
-libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
 libcrypto_la_SOURCES += $(ASM_X86_64_MASM)
 endif
diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64
index 7d0d3f7..8e39e9f 100644
--- a/crypto/Makefile.am.mingw64-x86_64
+++ b/crypto/Makefile.am.mingw64-x86_64
@@ -6,13 +6,8 @@ ASM_X86_64_MINGW64 += aes/aesni-mingw64-x86_64.S
 #ASM_X86_64_MINGW64 += bn/modexp512-mingw64-x86_64.S
 #ASM_X86_64_MINGW64 += bn/mont-mingw64-x86_64.S
 #ASM_X86_64_MINGW64 += bn/mont5-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += md5/md5-mingw64-x86_64.S
 ASM_X86_64_MINGW64 += modes/ghash-mingw64-x86_64.S
 ASM_X86_64_MINGW64 += rc4/rc4-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += sha/sha1-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += sha/sha256-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += sha/sha512-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += cpuid-mingw64-x86_64.S
 
 EXTRA_DIST += $(ASM_X86_64_MINGW64)
 
@@ -21,21 +16,10 @@ libcrypto_la_CPPFLAGS += -Dendbr32=endbr64
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DBSAES_ASM
 libcrypto_la_CPPFLAGS += -DVPAES_ASM
-libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL
 libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2
 #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
 #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5
-libcrypto_la_CPPFLAGS += -DMD5_ASM
 libcrypto_la_CPPFLAGS += -DGHASH_ASM
 libcrypto_la_CPPFLAGS += -DRSA_ASM
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
-libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM
-libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
 libcrypto_la_SOURCES += $(ASM_X86_64_MINGW64)
 endif
diff --git a/crypto/arch/loongarch64/crypto_arch.h b/crypto/arch/loongarch64/crypto_arch.h
new file mode 100644
index 0000000..a3dd98d
--- /dev/null
+++ b/crypto/arch/loongarch64/crypto_arch.h
@@ -0,0 +1,21 @@
+/*      $OpenBSD: crypto_arch.h,v 1.1 2024/08/11 13:02:39 jsing Exp $ */
+/*
+ * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HEADER_CRYPTO_ARCH_H
+#define HEADER_CRYPTO_ARCH_H
+
+#endif
diff --git a/crypto/arch/mips/crypto_arch.h b/crypto/arch/mips/crypto_arch.h
new file mode 100644
index 0000000..274879c
--- /dev/null
+++ b/crypto/arch/mips/crypto_arch.h
@@ -0,0 +1,21 @@
+/*      $OpenBSD$ */
+/*
+ * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HEADER_CRYPTO_ARCH_H
+#define HEADER_CRYPTO_ARCH_H
+
+#endif
diff --git a/crypto/bn/arch/loongarch64/bn_arch.h b/crypto/bn/arch/loongarch64/bn_arch.h
new file mode 100644
index 0000000..672ac12
--- /dev/null
+++ b/crypto/bn/arch/loongarch64/bn_arch.h
@@ -0,0 +1,23 @@
+/*      $OpenBSD: bn_arch.h,v 1.7 2023/07/09 10:37:32 jsing Exp $ */
+/*
+ * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <openssl/bn.h>
+
+#ifndef HEADER_BN_ARCH_H
+#define HEADER_BN_ARCH_H
+
+#endif
diff --git a/crypto/compat/getdelim.c b/crypto/compat/getdelim.c
new file mode 100644
index 0000000..caec3f2
--- /dev/null
+++ b/crypto/compat/getdelim.c
@@ -0,0 +1,78 @@
+/*-
+ * Copyright (c) 2011 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#ifndef HAVE_GETDELIM
+
+ssize_t
+getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp)
+{
+        char *ptr, *eptr;
+
+
+        if (*buf == NULL || *bufsiz == 0) {
+                *bufsiz = BUFSIZ;
+                if ((*buf = malloc(*bufsiz)) == NULL)
+                        return -1;
+        }
+
+        for (ptr = *buf, eptr = *buf + *bufsiz;;) {
+                int c = fgetc(fp);
+                if (c == -1) {
+                        if (feof(fp)) {
+                                ssize_t diff = (ssize_t)(ptr - *buf);
+                                if (diff != 0) {
+                                        *ptr = '\0';
+                                        return diff;
+                                }
+                        }
+                        return -1;
+                }
+                *ptr++ = c;
+                if (c == delimiter) {
+                        *ptr = '\0';
+                        return ptr - *buf;
+                }
+                if (ptr + 2 >= eptr) {
+                        char *nbuf;
+                        size_t nbufsiz = *bufsiz * 2;
+                        ssize_t d = ptr - *buf;
+                        if ((nbuf = realloc(*buf, nbufsiz)) == NULL)
+                                return -1;
+                        *buf = nbuf;
+                        *bufsiz = nbufsiz;
+                        eptr = nbuf + nbufsiz;
+                        ptr = nbuf + d;
+                }
+        }
+}
+
+#endif /* HAVE_GETDELIM */
diff --git a/crypto/compat/getline.c b/crypto/compat/getline.c
new file mode 100644
index 0000000..e6ecde0
--- /dev/null
+++ b/crypto/compat/getline.c
@@ -0,0 +1,40 @@
+/*-
+ * Copyright (c) 2011 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdio.h>
+
+#ifndef HAVE_GETLINE
+
+ssize_t
+getline(char **buf, size_t *bufsiz, FILE *fp)
+{
+        return getdelim(buf, bufsiz, '\n', fp);
+}
+
+#endif /* HAVE_GETLINE */
diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c
index bb3e653..572e527 100644
--- a/crypto/compat/posix_win.c
+++ b/crypto/compat/posix_win.c
@@ -9,6 +9,8 @@
 
 #define NO_REDEF_POSIX_FUNCTIONS
 
+#include <sys/time.h>
+
 #include <ws2tcpip.h>
 #include <windows.h>
 
@@ -20,6 +22,25 @@
 #include <string.h>
 #include <unistd.h>
 
+#include <sys/stat.h>
+
+static int
+is_socket(int fd)
+{
+        // Border case: Don't break std* file descriptors
+        if (fd < 3)
+                return 0;
+
+        // All locally-allocated file descriptors will have the high bit set
+        return (fd & 0x80000000) == 0;
+}
+
+static int
+get_real_fd(int fd)
+{
+        return (fd & 0x7fffffff);
+}
+
 void
 posix_perror(const char *s)
 {
@@ -42,6 +63,12 @@ posix_fopen(const char *path, const char *mode)
 }
 
 int
+libressl_fstat(int fd, struct stat *statbuf)
+{
+        return fstat(get_real_fd(fd), statbuf);
+}
+
+int
 posix_open(const char *path, ...)
 {
         va_list ap;
@@ -60,7 +87,11 @@ posix_open(const char *path, ...)
                 flags |= O_NOINHERIT;
         }
         flags &= ~O_NONBLOCK;
-        return open(path, flags, mode);
+
+        const int fh = open(path, flags, mode);
+
+        // Set high bit to mark file descriptor as a file handle
+        return fh + 0x80000000;
 }
 
 char *
@@ -148,52 +179,6 @@ wsa_errno(int err)
         return -1;
 }
 
-/*
- * Employ a similar trick to cpython (pycore_fileutils.h) where the CRT report
- * handler is disabled while checking if a descriptor is a socket or a file
- */
-#if defined _MSC_VER && _MSC_VER >= 1900
-
-#include <crtdbg.h>
-#include <stdlib.h>
-
-static void noop_handler(const wchar_t *expression,     const wchar_t *function,
-    const wchar_t *file, unsigned int line, uintptr_t pReserved)
-{
-        return;
-}
-
-#define BEGIN_SUPPRESS_IPH \
-        const int old_report_mode = _CrtSetReportMode(_CRT_ASSERT, 0); \
-        const _invalid_parameter_handler old_handler = _set_thread_local_invalid_parameter_handler(noop_handler)
-#define END_SUPPRESS_IPH \
-        (void)old_report_mode; /* Silence warning in release mode when _CrtSetReportMode compiles to void. */ \
-        _CrtSetReportMode(_CRT_ASSERT, old_report_mode); \
-        _set_thread_local_invalid_parameter_handler(old_handler)
-
-#else
-
-#define BEGIN_SUPPRESS_IPH
-#define END_SUPPRESS_IPH
-
-#endif
-
-static int
-is_socket(int fd)
-{
-        intptr_t hd;
-
-        BEGIN_SUPPRESS_IPH;
-        hd = _get_osfhandle(fd);
-        END_SUPPRESS_IPH;
-
-        if (hd == (intptr_t)INVALID_HANDLE_VALUE) {
-                return 1; /* fd is not file descriptor */
-        }
-
-        return 0;
-}
-
 int
 posix_connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
 {
@@ -207,14 +192,13 @@ int
 posix_close(int fd)
 {
         int rc;
-
         if (is_socket(fd)) {
                 if ((rc = closesocket(fd)) == SOCKET_ERROR) {
                         int err = WSAGetLastError();
                         rc = wsa_errno(err);
                 }
         } else {
-                rc = close(fd);
+                rc = close(get_real_fd(fd));
         }
         return rc;
 }
@@ -223,14 +207,13 @@ ssize_t
 posix_read(int fd, void *buf, size_t count)
 {
         ssize_t rc;
-
         if (is_socket(fd)) {
                 if ((rc = recv(fd, buf, count, 0)) == SOCKET_ERROR) {
                         int err = WSAGetLastError();
                         rc = wsa_errno(err);
                 }
         } else {
-                rc = read(fd, buf, count);
+                rc = read(get_real_fd(fd), buf, count);
         }
         return rc;
 }
@@ -244,7 +227,7 @@ posix_write(int fd, const void *buf, size_t count)
                         rc = wsa_errno(WSAGetLastError());
                 }
         } else {
-                rc = write(fd, buf, count);
+                rc = write(get_real_fd(fd), buf, count);
         }
         return rc;
 }
@@ -289,7 +272,7 @@ uid_t getuid(void)
 
 #ifdef _MSC_VER
 struct timezone;
-int gettimeofday(struct timeval * tp, struct timezone * tzp)
+int gettimeofday(struct timeval *tp, void *tzp)
 {
         /*
          * Note: some broken versions only have 8 trailing zero's, the correct
@@ -306,7 +289,7 @@ int gettimeofday(struct timeval * tp, struct timezone * tzp)
         time = ((uint64_t)file_time.dwLowDateTime);
         time += ((uint64_t)file_time.dwHighDateTime) << 32;
 
-        tp->tv_sec = (long)((time - EPOCH) / 10000000L);
+        tp->tv_sec = (long long)((time - EPOCH) / 10000000L);
         tp->tv_usec = (long)(system_time.wMilliseconds * 1000);
         return 0;
 }
diff --git a/crypto/compat/ui_openssl_win.c b/crypto/compat/ui_openssl_win.c
index 09705e4..4ae2c5d 100644
--- a/crypto/compat/ui_openssl_win.c
+++ b/crypto/compat/ui_openssl_win.c
@@ -146,7 +146,7 @@ static int echo_console(UI *ui);
 static int noecho_console(UI *ui);
 static int close_console(UI *ui);
 
-static UI_METHOD ui_openssl = {
+static const UI_METHOD ui_openssl = {
         .name = "OpenSSL default user interface",
         .ui_open_session = open_console,
         .ui_write_string = write_string,
@@ -155,7 +155,7 @@ static UI_METHOD ui_openssl = {
 };
 
 /* The method with all the built-in thingies */
-UI_METHOD *
+const UI_METHOD *
 UI_OpenSSL(void)
 {
         return &ui_openssl;